On Thu, Mar 10, 2022 at 6:37 AM Pavel Machek <pavel@...> wrote:
It looks like 5.10.105 will be "fun" release. There's big series of
arm64 related speculation tweaks, including
|61f85b56f 558c30 o: 5.10| arm64: Mitigate spectre style branch history side channels
And apparently there are some problems on x86-64 side, too:
|d185aa3cb e9b601 .: 5.10| x86/speculation: Update link to AMD speculation whitepaper
|edc29f23a eafd98 o: 5.10| x86/speculation: Warn about Spectre v2 LFENCE mitigation
|67997c824 0de05d o: 5.10| x86/speculation: Warn about eIBRS + LFENCE + Unprivileged eBPF + SMT
We have seen worse stuff for a hardware bug mitigation before. Scary
thing here is that arm64 patches are queued against 5.10 but not 4.19
Let me reiterate again that using complex out-of-order CPU is a bad
idea if you care about security.
Let me reiterate that JITs such as eBPF are complex/dangerous and
especially unpriviledged eBPF is risky.
That's true. We saw lots of CVEs which recommended disabling unprivileged eBPF.
It is difficult to achieve both safety and usefulness :(
v |316f1dd5e 44a391 o: 5.10| x86/speculation: Include unprivileged eBPF status in Spectre v2 mitigation reporting
DENX Software Engineering GmbH, Managing Director: Wolfgang Denk
HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany
Cybertrust Japan Co., Ltd.