[MODERATED] Re: [PATCH v3 2/6] PERFv3

[Andrew Cooper <andrew.cooper3@citrix.com>]

[-- Attachment #1: Type: text/plain, Size: 2311 bytes --]

On 08/02/2019 09:01, speck for Peter Zijlstra wrote:
> On Fri, Feb 08, 2019 at 12:51:01AM +0000, speck for Andrew Cooper wrote:
>> On 07/02/2019 23:41, speck for Andi Kleen wrote:
>>> This patch assumes that the kernel is using
>>> RETPOLINE (or IBRS), otherwise speculative execution could
>>> still corrupt counter 3 in very unlikely cases.
>> What has the kernel configuration got to do with it?
>>
>> It is my understanding that any execution of an XBEGIN instruction, even
>> speculatively, even in userspace will result in PCR3 getting modified.
>>
>> A CPU either has force abort mode active, or PCR3 can be changed behind
>> the kernel's back.
> We are executing kernel code; therefore any user RTM will have aborted
> and is irrelevant.
>
> So what the kernel does is:
>
> 	/*
> 	 * And as noted; userspace transactions will be aborted by
> 	 * having entered the kernel. The kernel does not use RTM
> 	 * itself.
> 	 */
>
>
> 	/*
> 	 * stops all counters; irrespective of ucode using PMC3 or not
> 	 */
> 	GLOBAL_CTRL = 0;
>
> 	/*
> 	 * program PMC3
> 	 */
> 	CTRVAL3 = x;
> 	EVTSEL3 = y;
>
> 	/*
> 	 * Set the TFA bit to make ucode not touch PMC3; since there has
> 	 * not been an RTM instruction between GLOBAL_CTRL=0 and here,
> 	 * PMC3 will still be {x,y} as we just wrote.
> 	 *
> 	 * This is what requires RETPOLINE/IBRS; because otherwise
> 	 * speculation could see a partial kernel instruction that looks
> 	 * like RTM, which would mess things up.
> 	 */
> 	WRMSR(MSR_TFA, 1);

Ok, so this is a narrow window during PMC reprogramming.

What other code exists between the PMC3 setup and TFA setup?  Even with
Retpoline, BCBS can be used by a determined attacker to hijack ret
speculation for a short period of time.  Then again, I suppose that is a
security hole in and of itself.

Also, you are blindly trusting that there is no part of your hypervisor
or SMI handler that will execute an XBEGIN instruction, even
speculatively.  The hypervisor part is easy if noone exposes TFA to
guests, but you have no control over the SMI handler, or the fact that
if one hits, your rets will start speculating into SRAM region again.

Perhaps the risk here is sufficiently small to be fine in practice, but
it is isn't zero.

~Andrew