Re: [PATCH bpf] bpf: prevent out-of-bounds speculation

2018-02-05 Thread Will Deacon
Hi all, On Wed, Jan 10, 2018 at 07:47:33PM +, Will Deacon wrote: > On Tue, Jan 09, 2018 at 10:21:29AM +, Will Deacon wrote: > > On Mon, Jan 08, 2018 at 10:49:01AM -0800, Linus Torvalds wrote: > > > In this particular case, we should be very much aware of future CPU's > > > being more _cons

Re: [PATCH bpf] bpf: prevent out-of-bounds speculation

2018-01-17 Thread Alan Cox
> (c) isn't actually done in any real CPU's today that I'm aware of > (unless you want to call the return stack data speculation). There are processors out there today that data speculate. For Intel family 6 Core, Knights and Atom today all is good. Alan

Re: [PATCH bpf] bpf: prevent out-of-bounds speculation

2018-01-17 Thread Alan Cox
> That fixes bpf side of "Variant 1: bounds check bypass (CVE-2017- > 5753)" on > all architectures with and without JIT. For Intel we believe this is true for all family 6 Core, Atom and Knights processors. If that ceases to be the case in future then Intel will provide guidance beforehand. For

Re: [PATCH bpf] bpf: prevent out-of-bounds speculation

2018-01-10 Thread Alexei Starovoitov
On 1/10/18 11:47 AM, Will Deacon wrote: Hi again Linus, Alexei, I can happily confirm that there aren't any (ARM architecture) CPUs where the masking approach is not sufficient, so there's no need to worry about value speculation breaking this. Awesome! Thank you for confirming.

Re: [PATCH bpf] bpf: prevent out-of-bounds speculation

2018-01-10 Thread Will Deacon
Hi again Linus, Alexei, On Tue, Jan 09, 2018 at 10:21:29AM +, Will Deacon wrote: > On Mon, Jan 08, 2018 at 10:49:01AM -0800, Linus Torvalds wrote: > > In this particular case, we should be very much aware of future CPU's > > being more _constrained_, because CPU vendors had better start taking

Re: [PATCH bpf] bpf: prevent out-of-bounds speculation

2018-01-09 Thread Mark Rutland
On Mon, Jan 08, 2018 at 10:49:01AM -0800, Linus Torvalds wrote: > On Mon, Jan 8, 2018 at 9:05 AM, Mark Rutland wrote: > > > > I'm a little worried that in the presence of some CPU/compiler > > optimisations, the masking may effectively be skipped under speculation. > > So I'm not sure how robust t

Re: [PATCH bpf] bpf: prevent out-of-bounds speculation

2018-01-09 Thread Will Deacon
Hi Linus, On Mon, Jan 08, 2018 at 10:49:01AM -0800, Linus Torvalds wrote: > On Mon, Jan 8, 2018 at 9:05 AM, Mark Rutland wrote: > > > > I'm a little worried that in the presence of some CPU/compiler > > optimisations, the masking may effectively be skipped under speculation. > > So I'm not sure h

Re: [PATCH bpf] bpf: prevent out-of-bounds speculation

2018-01-08 Thread Alexei Starovoitov
On 1/8/18 9:05 AM, Mark Rutland wrote: Hi Alexei, On Thu, Jan 04, 2018 at 08:28:11PM -0800, Alexei Starovoitov wrote: From: Alexei Starovoitov Under speculation, CPUs may mis-predict branches in bounds checks. Thus, memory accesses under a bounds check may be speculated even if the bounds che

Re: [PATCH bpf] bpf: prevent out-of-bounds speculation

2018-01-08 Thread Linus Torvalds
On Mon, Jan 8, 2018 at 9:05 AM, Mark Rutland wrote: > > I'm a little worried that in the presence of some CPU/compiler > optimisations, the masking may effectively be skipped under speculation. > So I'm not sure how robust this is going to be. Honestly, I think the masking is a hell of a lot more

Re: [PATCH bpf] bpf: prevent out-of-bounds speculation

2018-01-08 Thread Mark Rutland
Hi Alexei, On Thu, Jan 04, 2018 at 08:28:11PM -0800, Alexei Starovoitov wrote: > From: Alexei Starovoitov > > Under speculation, CPUs may mis-predict branches in bounds checks. Thus, > memory accesses under a bounds check may be speculated even if the > bounds check fails, providing a primitive

Re: [PATCH bpf] bpf: prevent out-of-bounds speculation

2018-01-05 Thread Mark Rutland
Hi Alexei, On Thu, Jan 04, 2018 at 08:28:11PM -0800, Alexei Starovoitov wrote: > From: Alexei Starovoitov > > Under speculation, CPUs may mis-predict branches in bounds checks. Thus, > memory accesses under a bounds check may be speculated even if the > bounds check fails, providing a primitive