Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Subject: Re: [PATCH v2 5/8] x86/speculation: Add basic support for IBPB
To:     David Woodhouse <dwmw2@infradead.org>,
        Borislav Petkov <bp@alien8.de>,
        KarimAllah Ahmed <karahmed@amazon.com>
CC:     <arjan@linux.intel.com>, <tglx@linutronix.de>,
        <karahmed@amazon.de>, <x86@kernel.org>,
        <linux-kernel@vger.kernel.org>, <tim.c.chen@linux.intel.com>,
        <peterz@infradead.org>, <pbonzini@redhat.com>,
        <ak@linux.intel.com>, <torvalds@linux-foundation.org>,
        <gregkh@linux-foundation.org>
References: <1516528149-9370-1-git-send-email-dwmw@amazon.co.uk>
 <1516528149-9370-6-git-send-email-dwmw@amazon.co.uk>
 <20180121180621.ufmc5m7nr6v4tjvc@pd.tnic>
 <31c52131-5f7a-8af0-3092-5fc9e322a734@amazon.com>
 <20180121190145.uuk3xizxejckth5s@pd.tnic>
 <1516563060.9814.52.camel@infradead.org>
From:   Andrew Cooper <andrew.cooper3@citrix.com>
Message-ID: <f9141600-45e4-999a-e997-05eeb56cda29@citrix.com>
Date:   Sun, 21 Jan 2018 19:37:14 +0000
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101
 Thunderbird/52.5.2
MIME-Version: 1.0
In-Reply-To: <1516563060.9814.52.camel@infradead.org>
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 8bit
Content-Language: en-GB
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

On 21/01/18 19:31, David Woodhouse wrote:
> On Sun, 2018-01-21 at 20:01 +0100, Borislav Petkov wrote:
>> so execution runs directly into the MSR write and the JMP is gone.
>>
>> So I don't see indirect branches anywhere...
> Wait until the wind changes.
>
> Congratulations, you've just turned a potential GCC missed optimisation
> into a kernel bug. We don't *care* that it's unlikely that GCC will
> miss that optimisation. The point is that it doesn't *have* to do it,
> and we don't *check*.
>
> cf. https://lkml.org/lkml/2018/1/12/176
>
>
> ... after which Peter went off and implemented that check, which is all
> fine and dandy but let's not rely on backporting that too.

It doesn't matter if an attacker can use SP1 to try and skip the IBPB.

Exits to userspace/guest are serialising (with some retroactive updates
to the architecture spec coming), so an attacker can't cause victim code
to be executed before speculation has caught up and noticed that the
IBPB did need to happen.

~Andrew