[MODERATED] Re: LVI

On 26/11/19 01:54, speck for Andi Kleen wrote:
> 
> Hi Folks,
> 
> We (well Tony, but he's currently on vacation) did a lot of analysis on LVI and we
> concluded the kernel does not need any new changes. That's why you didn't see any
> patches from Intel on this.
> 
> Longer story: 
> 
> Assists are somewhat messy and can happen in many circumstances. However most
> are rare and hard to trigger, so if you get them they're typically not usable
> for a high loop count practical side channel. The main exception is the page A/D
> assist which can be triggered in the kernel by *_user()
> 
> *_user is protected by STAC/CLAC already and those have strong enough semantics
> to stop an LVI attack outside the uaccess region. But of course there are CPUs
> (pre BDW) which don't have STAC/CLAC.
> 
> But to do anything with LVI you need a Spectre v1 style read gadget. Without 
> a gadget the attack is not feasible. And those gadgets are usually Spectre v1
> problems, so they would need to be fixed anyways.

Don't you need only half of a Spectrev1 gadget (see the Xen advisory at
https://xenbits.xen.org/xsa/advisory-289.html and the KVM patch at
https://marc.info/?l=kvm&m=157444806904659&w=2)?  Also I assume you
didn't take into account using vmexits as an assist.

Paolo