Re: [tip:x86/pti] x86/speculation: Use Indirect Branch Prediction Barrier in context switch

From: Josh Poimboeuf
Date: Thu Feb 01 2018 - 10:40:58 EST


On Thu, Feb 01, 2018 at 08:31:53AM +0000, David Woodhouse wrote:
> On Wed, 2018-01-31 at 08:03 +0100, Dominik Brodowski wrote:
> > Whether a process needs protection by IBPB on context switches is a
> > different question to whether a process should be allowed to be dumped,
> > though the former may be a superset of the latter. Enable IBPB on all
> > context switches to a different userspace process, until we have a clear
> > mitigation strategy for userspace against Spectre-v2 designed and
> > implemented.
> >
> > ...
> > ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂif (tsk && tsk->mm &&
> > -ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ tsk->mm->context.ctx_id != last_ctx_id &&
> > -ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ get_dumpable(tsk->mm) != SUID_DUMP_USER)
> > +ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ tsk->mm->context.ctx_id != last_ctx_id)
> > ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂindirect_branch_prediction_barrier();
>
>
> I understand your argument and I sympathise.
>
> But that's going to hurt a *lot*, and we don't even have a viable
> proof-of-concept for a userââuser Spectre v2 attack, do we? It's only
> theoretical?
>
> Show a working PoC and it makes the argument somewhat more
> convincing...

Fair point. From what I can gather, user space ASLR seems to be the
only layer of protection before a POC would be feasible. So, unless I'm
mistaken, which is very possible, it seems to be a question of how much
we trust ASLR.

--
Josh