Messages in this thread | | | Subject | Re: [PATCH] x86/speculation: Fill the RSB on context switch also on non-IBPB CPUs | From | "Maciej S. Szmigiero" <> | Date | Wed, 21 Mar 2018 23:57:04 +0100 |
| |
On 21.03.2018 15:05, Dave Hansen wrote: > On 03/20/2018 04:17 AM, Maciej S. Szmigiero wrote: >> If we run on a CPU that does not have IBPB support RSB entries from one >> userspace process can influence 'ret' target prediction in another >> userspace process after a context switch. >> >> Since it is unlikely that existing RSB entries from the previous task match >> the new task call stack we can use the existing unconditional >> RSB-filling-on-context-switch infrastructure to protect against such >> userspace-to-userspace attacks. >> >> This patch brings a change in behavior only for the following CPU types: >> * Intel pre-Skylake CPUs without updated microcode, > > The assumption thus far (good or bad) is that everything will get a > microcode update. I actually don't know for sure if RSB manipulation is > effective on old microcode before Skylake. I'm pretty sure it has not > been documented publicly. > > How did you decide that this is an effective mitigation? > A RSB overwrite is already being done even on pre-Skylake Intel CPUs on VMEXIT to protect the host from the guest, regardless of the microcode version.
But I see that an Intel guidance document published last month about retpolines says that "RET has this [predictable speculative] behavior on all processors (...) microarchitecture codename Broadwell and earlier when updated with the latest microcode". This suggests that updated microcode may be needed for protection anyway on such CPUs - as you say. Such update (hopefully) brings IBPB support, too, so I agree that the change introduced by this patch can be skipped on Intel CPUs.
Maciej
| |