Messages in this thread | | | Subject | Re: [PATCH v3 10/13] x86/retpoline/pvops: Convert assembler indirect jumps | From | Juergen Gross <> | Date | Thu, 4 Jan 2018 17:04:29 +0100 |
| |
On 04/01/18 16:18, Andrew Cooper wrote: > On 04/01/18 15:02, Juergen Gross wrote: >> On 04/01/18 15:37, David Woodhouse wrote: >>> Convert pvops invocations to use non-speculative call sequences, when >>> CONFIG_RETPOLINE is enabled. >>> >>> There is scope for future optimisation here — once the pvops methods are >>> actually set, we could just turn the damn things into *direct* jumps. >>> But this is perfectly sufficient for now, without that added complexity. >> I don't see the need to modify the pvops calls. >> >> All indirect calls are replaced by either direct calls or other code >> long before any user code is active. >> >> For modules the replacements are in place before the module is being >> used. > > When booting virtualised, sibling hyperthreads can arrange VM-to-VM SP2 > attacks. > > One mitigation though is to consider if there is any interesting data to > leak that early during boot.
Right. And if you are able to detect a booting VM in the other hyperthread, obtain enough information about its kernel layout and extract the information via statistical methods in the very short time frame of the boot before pvops patching takes place. Not to forget the vast amount of data the booting VM will pull through the caches making side channel attacks a rather flaky endeavor...
I'd opt for leaving pvops calls untouched. The Reviewed-by: I gave for the patch was just for its correctness. :-)
Juergen
| |