lkml.org 
[lkml]   [2018]   [Jul]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[PATCH] x86/bugs: protect against userspace-userspace spectreRSB
    From: Jiri Kosina <jkosina@suse.cz>

    The article "Spectre Returns! Speculation Attacks using the Return Stack
    Buffer" [1] describes two new (sub-)variants of spectrev2-like attack,
    making use solely of the RSB contents even on CPUs that don't fallback to
    BTB on RSB underflow (Skylake+).

    Mitigate userspace-userspace attacks by always unconditionally filling RSB on
    context switch when generic spectrev2 mitigation has been enabled.

    [1] https://arxiv.org/pdf/1807.07940.pdf

    Signed-off-by: Jiri Kosina <jkosina@suse.cz>
    ---

    Note: this doesn't address the potential 'userspace-kernelspace' (maked as no.
    4 in the article) attack variant. Mitigating that would require either filling
    RSB on every kernel entry (as one of the very early Tim Chen's patches did as
    part of spectrev2 mitigation proposal), or somehow (persumably throuhg objtool
    or runtime ftrace-based counting) control the unmatched returns in the kernel;
    and it's not yet clear whether this attack is practical at all in the first
    place.

    arch/x86/kernel/cpu/bugs.c | 38 +++++++-------------------------------
    1 file changed, 7 insertions(+), 31 deletions(-)

    diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
    index 5c0ea39311fe..5ae0c12390cd 100644
    --- a/arch/x86/kernel/cpu/bugs.c
    +++ b/arch/x86/kernel/cpu/bugs.c
    @@ -313,23 +313,6 @@ static enum spectre_v2_mitigation_cmd __init spectre_v2_parse_cmdline(void)
    return cmd;
    }

    -/* Check for Skylake-like CPUs (for RSB handling) */
    -static bool __init is_skylake_era(void)
    -{
    - if (boot_cpu_data.x86_vendor == X86_VENDOR_INTEL &&
    - boot_cpu_data.x86 == 6) {
    - switch (boot_cpu_data.x86_model) {
    - case INTEL_FAM6_SKYLAKE_MOBILE:
    - case INTEL_FAM6_SKYLAKE_DESKTOP:
    - case INTEL_FAM6_SKYLAKE_X:
    - case INTEL_FAM6_KABYLAKE_MOBILE:
    - case INTEL_FAM6_KABYLAKE_DESKTOP:
    - return true;
    - }
    - }
    - return false;
    -}
    -
    static void __init spectre_v2_select_mitigation(void)
    {
    enum spectre_v2_mitigation_cmd cmd = spectre_v2_parse_cmdline();
    @@ -390,22 +373,15 @@ static void __init spectre_v2_select_mitigation(void)
    pr_info("%s\n", spectre_v2_strings[mode]);

    /*
    - * If neither SMEP nor PTI are available, there is a risk of
    - * hitting userspace addresses in the RSB after a context switch
    - * from a shallow call stack to a deeper one. To prevent this fill
    - * the entire RSB, even when using IBRS.
    + * If spectre v2 protection has been enabled, unconditionally fill
    + * RSB during a context switch; this protects against two independent
    + * issues:
    *
    - * Skylake era CPUs have a separate issue with *underflow* of the
    - * RSB, when they will predict 'ret' targets from the generic BTB.
    - * The proper mitigation for this is IBRS. If IBRS is not supported
    - * or deactivated in favour of retpolines the RSB fill on context
    - * switch is required.
    + * - RSB underflow (and switch to BTB) on Skylake+
    + * - sepctreRSB variant of spectre v2 on X86_BUG_SPECTRE_V2 CPUs
    */
    - if ((!boot_cpu_has(X86_FEATURE_PTI) &&
    - !boot_cpu_has(X86_FEATURE_SMEP)) || is_skylake_era()) {
    - setup_force_cpu_cap(X86_FEATURE_RSB_CTXSW);
    - pr_info("Spectre v2 mitigation: Filling RSB on context switch\n");
    - }
    + setup_force_cpu_cap(X86_FEATURE_RSB_CTXSW);
    + pr_info("Spectre v2 / spectreRSB mitigation: Filling RSB on context switch\n");

    /* Initialize Indirect Branch Prediction Barrier if supported */
    if (boot_cpu_has(X86_FEATURE_IBPB)) {
    --
    Jiri Kosina
    SUSE Labs
    \
     
     \ /
      Last update: 2018-07-24 21:54    [W:2.471 / U:0.048 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site