[lkml]   [2018]   [Jan]   [21]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: [PATCH v2 5/8] x86/speculation: Add basic support for IBPB
On Sun, 2018-01-21 at 19:37 +0000, Andrew Cooper wrote:
> It doesn't matter if an attacker can use SP1 to try and skip the IBPB.
> Exits to userspace/guest are serialising (with some retroactive updates
> to the architecture spec coming), so an attacker can't cause victim code
> to be executed before speculation has caught up and noticed that the
> IBPB did need to happen.

For the specific case of IBPB, knowing what we do about non-
architectural behaviour, that's probably true.

In the early patch sets in both Xen and Linux, we did have a
conditional branch on {sys,hyper}call entry that blithely let the CPU
speculate all the way to the {sys,hyper}call table jump. No exit to
userspace/guest there.

Which is why I've been saying I want call sites to have an *explicit*
comment saying why they're safe to use conditional branches without
taking extra steps to be safe, like the 'else lfence'. And why I'd
really like the underlying primitives to *support* being fixed at

ALTERNATIVE is fine for now, and can end up with basically the same
code as static_cpu_has() — either we do the wrmsr, or we jump/nop over
where it used to be. Let's worry about getting clever with it *later*.[unhandled content-type:application/x-pkcs7-signature]
 \ /
  Last update: 2018-01-21 21:04    [W:0.060 / U:2.284 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site