Date: Mon, 30 Apr 2018 11:59:49 -0700
From: Andi Kleen <ak@linux.intel.com>
Subject: [MODERATED] Re: [patch V8 07/15] SSB 7
Message-ID: <20180430185949.GK75137@tassilo.jf.intel.com>
References: <20180430150423.180110059@linutronix.de>
 <20180430151232.364582976@linutronix.de>
MIME-Version: 1.0
In-Reply-To: <20180430151232.364582976@linutronix.de>
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 7bit
To: speck@linutronix.de

> Contemporary high performance processors use a common industry-wide
> optimization known as "Speculative Store Bypass" in which loads from
> addresses to which a recent store has occurred may (speculatively) see an
> older value. Intel refers to this feature as "Memory Disambiguation" which
> is part of their "Smart Memory Access" capability in Nehalem and later
> generation processors.

Same. Remove the "in Nehalem and later generation processors"

> 
> Some processors have an implementation bug that enables a cache
> side-channel attack against such speculatively read values. An attacker can

My understanding is that any CPU that has Memory Disambiguation is
vulnerable, it doesn't need a specific bug. As soon as you speculate
you can mis-speculate, and that is all that is needed for the attack.

>  			Not specifying this option is equivalent to
>  			spectre_v2=auto.
>  
> +	spec_store_bypass_disable=
> +			[HW] Control Speculative Store Bypass (SSB) Disable mitigation
> +			(Speculative Store Bypass vulnerability)
> +
> +			Certain CPUs are vulnerable to an exploit against a
> +			a common industry wide performance optimization known
> +			as "Speculative Store Bypass" in which recent stores
> +			to the same memory location may not be observed by
> +			later loads during speculative execution. The idea

It's the same here. Any CPU with Speculative Store Bypass is vulnerable.

> +			Bypass optimization is used.
> +
> +			on     - Unconditionally disable Speculative Store Bypass
> +			off    - Unconditionally enable Speculative Store Bypass
> +			auto   - Kernel detects whether the CPU model contains a
> +			         vulnerable implementation of Speculative Store


contains an implementation of Speculative Store Bypass 

-Andi