Re: [PATCH] x86/bugs: protect against userspace-userspace spectreRSB

[Josh Poimboeuf]

On Thu, Jul 26, 2018 at 01:11:01AM +0200, Jiri Kosina wrote:
> On Wed, 25 Jul 2018, Linus Torvalds wrote:
> 
> > > Mitigate userspace-userspace attacks by always unconditionally filling RSB on
> > > context switch when generic spectrev2 mitigation has been enabled.
> > 
> > Shouldn't this also do something like
> > 
> >      x86_spec_ctrl_base |= x86_spec_ctrl_mask & SPEC_CTRL_STIBP;
> > 
> > if we have HT enabled?
> 
> So IIUC your comment is not really tightly related to spectreRSB, is it?
> 
> If you're making a more general remark about things that we'd also have to 
> do in order to improve userspace-userspace spectrev2 prevention, then I 
> agree.
> 
> It probably wouldn't be as simple as adding it to x86_spec_ctrl_base I 
> think though, as the VM switching also has to save/restore it properly 
> (the same way we handle SSBD). So I'd rather handle this separately, as it 
> really is in principle a completely different protection.
> 
> STIBP is plugging much smaller hole than spectreRSB (as the bigger part is 
> already plugged by IBPB)

Just to clarify, the IBPB hole is *not* plugged for context switches.
It's only enabled for non-dumpable processes (which are basically
non-existent in practice).

> so I'd rather have that one in first, and look at improving STIBP
> later if noone beats me to it.

It would be interesting to see performance measurements for STIBP, but
based on what we've seen with IBRS in user space, I'd guess that it's
not pretty.

-- 
Josh