LKML Archive on
help / color / mirror / Atom feed
From: "Maciej S. Szmigiero" <>
To: Dave Hansen <>
Cc: Thomas Gleixner <>,
	Ingo Molnar <>, "H. Peter Anvin" <>,
	David Woodhouse <>,
	KarimAllah Ahmed <>,
	Andi Kleen <>,
	Tim Chen <>,,,
Subject: Re: [PATCH] x86/speculation: Fill the RSB on context switch also on non-IBPB CPUs
Date: Thu, 22 Mar 2018 01:09:34 +0100	[thread overview]
Message-ID: <> (raw)
In-Reply-To: <>

On 22.03.2018 00:30, Dave Hansen wrote:
> On 03/20/2018 04:17 AM, Maciej S. Szmigiero wrote:
>> Since it is unlikely that existing RSB entries from the previous task match
>> the new task call stack we can use the existing unconditional
>> RSB-filling-on-context-switch infrastructure to protect against such
>> userspace-to-userspace attacks.
>> This patch brings a change in behavior only for the following CPU types:
>> * Intel pre-Skylake CPUs without updated microcode,
>> * AMD Family 15h model >60h, Family 17h CPUs without updated microcode.
>> Other CPU types either already do the RSB filling on context switch for
>> other reasons or do support IBPB for more complete userspace-to-userspace
>> protection.
> I think I misunderstood your reasoning a bit.  Let me see if I can
> restate the problem a bit.
> IBPB provides provides userspace-to-userspace protection because it
> prevents all indirect branch predictions after the barrier from being
> controlled by software executed before the barrier.  We only use IBPB
> for KVM and when processes clear their dumpable flag.
> You're saying that, even if we don't have IBPB, we can do *some*
> userspace-to-userspace protection with RSB manipulation.  The RSB
> manipulation obviously only helps 'RET' instructions and not JMP/CALL,
> but it does do *something* useful.
> Is that right?


As far as I understand the issue this should provide a good protection
for userspace processes that were recompiled with retpolines as they
won't have any indirect jumps and calls.

> Do you really want this behavior on all context switches?  We don't do
> IBPB on all context switches, only the ones where we are switching *to*
> a non-dumpable process.
> Do you perhaps want to do RSB manipulation in lieu of IBPB when
> switching *to* a non-dumpable process and IBPB is not available?

Is it worth differentiating such processes in this case?
IBPB is supposed to be very expensive so certainly it is worthwhile
to do it only for high-value processes (=non-dumpable).

However, it is unlikely that existing RSB entries from the previous
task match the new task call stack anyway.
We already do unconditional RSB-filling-on-context-switch in many


  reply	other threads:[~2018-03-22  0:09 UTC|newest]

Thread overview: 7+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2018-03-20 11:17 Maciej S. Szmigiero
2018-03-21 14:05 ` Dave Hansen
2018-03-21 22:57   ` Maciej S. Szmigiero
2018-03-21 23:30 ` Dave Hansen
2018-03-22  0:09   ` Maciej S. Szmigiero [this message]
2018-03-22 15:46     ` Dave Hansen
2018-03-23 23:11       ` Maciej S. Szmigiero

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \ \ \ \ \ \ \ \ \ \ \ \ \ \
    --subject='Re: [PATCH] x86/speculation: Fill the RSB on context switch also on non-IBPB CPUs' \

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).