From mboxrd@z Thu Jan  1 00:00:00 1970
Return-path: <bp@suse.de>
Received: from mx2.suse.de ([195.135.220.15])	by Galois.linutronix.de with
 esmtps (TLS1.0:DHE_RSA_CAMELLIA_256_CBC_SHA1:256)	(Exim 4.80)	(envelope-from
 <bp@suse.de>)	id 1fAgfB-0007Vr-Eb	for speck@linutronix.de; Mon, 23 Apr 2018
 20:58:10 +0200
Received: from relay1.suse.de (charybdis-ext.suse.de [195.135.220.254])
	by mx2.suse.de (Postfix) with ESMTP id 627D2AD77
	for <speck@linutronix.de>; Mon, 23 Apr 2018 18:58:03 +0000 (UTC)
Date: Mon, 23 Apr 2018 20:57:55 +0200
From: Borislav Petkov <bp@suse.de>
Subject: [MODERATED] Re: [PATCH v3 06/10] [PATCH v3 6/9] Linux Patch #6
Message-ID: <20180423185755.GM24245@pd.tnic>
References: <20180423171426.795385641@dhcp-10-159-147-220.vpn.oracle.com>
MIME-Version: 1.0
In-Reply-To: <20180423171426.795385641@dhcp-10-159-147-220.vpn.oracle.com>
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable
To: speck@linutronix.de
List-ID: <speck.linutronix.de>

On Mon, Apr 23, 2018 at 01:11:30PM -0400, speck for konrad.wilk_at_oracle.com=
 wrote:
> x86/spec_store_bypass_disable: Provide boot parameters for the mitigation
>=20
> Contemporary high performance processors use a common industry-wide
> optimization known as "Speculative Store Bypass" in which loads from
> addresses to which a recent store has occurred may (speculatively)
> see an older value. Intel refers to this feature as "Memory
> Disambiguation", which is part of their "Smart Memory Access"
> capability in Nehalem and later generation processors.
>=20
> Some processors have an implementation bug that enables a cache
> side-channel attack against such speculatively read values. An
> attacker can create exploit code that allows them to read memory
> outside of a sandbox environment (for example, malicious JavaScript
> in a web page), or to perform more complex attacks against code
> running within the same privilege level, e.g. via the stack.
>=20
> We provide two command line control knobs:
>=20
>  nospec_store_bypass_disable
>  spec_store_bypass_disable=3D[off,auto,on]

Something's still fishy with this patch. I'm booting a guest with

spec_store_bypass_disable=3Don

but dmesg still says:

[    0.044001] Speculative Store Bypass: Vulnerable

and sysfs:

$ grep . /sys/devices/system/cpu/vulnerabilities/*
/sys/devices/system/cpu/vulnerabilities/meltdown:Not affected
/sys/devices/system/cpu/vulnerabilities/spec_store_bypass:Vulnerable

--=20
Regards/Gruss,
    Boris.

SUSE Linux GmbH, GF: Felix Imend=C3=B6rffer, Jane Smithard, Graham Norton, HR=
B 21284 (AG N=C3=BCrnberg)
--=20