lkml.org 
[lkml]   [2018]   [Jan]   [10]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: [patch RFC 5/5] x86/speculation: Add basic speculation control code
From
Date
On Wed, 2018-01-10 at 13:01 +0100, Andrea Arcangeli wrote:
>
> > On all current hardware, if you only set IBRS when you exit a guest,
> > then you are not protecting yourself from userspace at all. IBRS acts
> > as a *barrier* in all current hardware.
>
> Kernel memory is 100% protected if you set only IBRS at vmexit.
>
> Once IBRS is set, there's no way any userland (nor host nor guest) can
> attack the kernel memory through spectre variant#2.

That is not consistent with the documentation I've seen, which Intel
have so far utterly failed to publish AFAICT.

"a near indirect jump/call/return may be affected by code in a less privileged
prediction mode that executed AFTER IBRS mode was last written with a value of 1"

The kernel is only protected from branch targets set in userspace
*BEFORE* the IBRS mode was last set to 1. If you set it to 1, then
leave it like that while you run userspace and then kernel code again,
you are not protected.[unhandled content-type:application/x-pkcs7-signature]
\
 
 \ /
  Last update: 2018-01-14 23:21    [W:0.483 / U:0.088 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site