From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Google-Smtp-Source: AH8x224P5uLaQ+aUpkR/Vmk/L2H7LscSpU8RskBCy9TQ0melvh1xKDOCIRVs6v+n6iax9EcMO1MT ARC-Seal: i=1; a=rsa-sha256; t=1516536269; cv=none; d=google.com; s=arc-20160816; b=FLVp9uhe+2fNr10nqWgkT3P0k0OnYCh/52qVpDzInzVl9QwEnl1noPn6jnJ9tdDFrl hCRtvFjz9lgBmyAdWeOgMZYbKXw54dN+J3woDLiZcmwUM6pdSt1k7RjrT7YYv88ruan3 D3Uqbw2RhL1K3OQ8heM8jLdYyrd9DTqpy3GvO5yxxJi50P735fvBzc6f2r/ZAGUV5xCR EWFipgAtYHDio7sp9d8vZv8QbyRlxcjHg1WnJQ/u9w5jvruCFRRugd0sgfz5GCLB47wv 78PchWFzE4BoIRrGRC17GSRU6MyEGrt3vdGcPjbYbd3EmAaraVkDrytxpEP5CNarzgJp P3rQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=importance:content-transfer-encoding:mime-version:user-agent:cc:to :from:subject:date:references:in-reply-to:message-id:dkim-signature :arc-authentication-results; bh=n4qL0wkFUokv28LVCfjtRn4sS2fJvgjGgwUJwk1D3uk=; b=UAJ7MiGnu5kjNE0DOdf7bgInorlyDsWLCV55EjsKZf6R21VZISsMQxoaNOgNZS99+S 3zBAAvA++zB/E2nT3UJias2piH1RrBecr7mrstYcd91WYD9600ycvHChQvNR+xqb3t1y c7//psODBKrWX4ssxVxkVupfnEolkbQ6NGWwNwAgJKWR9pw0Tf1Lf5vilnxj39Myz67v KwnkCfD9Gp3jSp+cZgI+ILYPZOvVL9ICiaRXjTnTXlJJSFZ/3xm/UaMyhq+H0MAFDzT1 5TzgyNxiW4SfDS7xZeEbIQq6AJgflwNehklnZ5GX0LVL2+LfssVZHepXAP2pujC4VaVh hcYg== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@infradead.org header.s=twosheds.20170209 header.b=nkljZgUD; spf=pass (google.com: best guess record for domain of batv+c3727a9e9cf4ad240057+5264+infradead.org+dwmw2@twosheds.srs.infradead.org designates 2001:8b0:10b:1:21d:7dff:fe04:dbe2 as permitted sender) smtp.mailfrom=BATV+c3727a9e9cf4ad240057+5264+infradead.org+dwmw2@twosheds.srs.infradead.org Authentication-Results: mx.google.com; dkim=pass header.i=@infradead.org header.s=twosheds.20170209 header.b=nkljZgUD; spf=pass (google.com: best guess record for domain of batv+c3727a9e9cf4ad240057+5264+infradead.org+dwmw2@twosheds.srs.infradead.org designates 2001:8b0:10b:1:21d:7dff:fe04:dbe2 as permitted sender) smtp.mailfrom=BATV+c3727a9e9cf4ad240057+5264+infradead.org+dwmw2@twosheds.srs.infradead.org Message-ID: <477cc452f17665440978ae1e227861ca.squirrel@twosheds.infradead.org> In-Reply-To: <20180121112224.GH2269@hirez.programming.kicks-ass.net> References: <1516476182-5153-1-git-send-email-karahmed@amazon.de> <1516476182-5153-5-git-send-email-karahmed@amazon.de> <20180121112224.GH2269@hirez.programming.kicks-ass.net> Date: Sun, 21 Jan 2018 12:04:03 -0000 Subject: Re: [RFC 04/10] x86/mm: Only flush indirect branches when switching into non dumpable process From: "David Woodhouse" To: "Peter Zijlstra" , hjl.tools@gmail.com Cc: "KarimAllah Ahmed" , linux-kernel@vger.kernel.org, "Andi Kleen" , "Andrea Arcangeli" , "Andy Lutomirski" , "Arjan van de Ven" , "Ashok Raj" , "Asit Mallick" , "Borislav Petkov" , "Dan Williams" , "Dave Hansen" , "David Woodhouse" , "Greg Kroah-Hartman" , "H . Peter Anvin" , "Ingo Molnar" , "Janakarajan Natarajan" , "Joerg Roedel" , "Jun Nakajima" , "Laura Abbott" , "Linus Torvalds" , "Masami Hiramatsu" , "Paolo Bonzini" , =?utf-8?B?IlJhZGltIEtyxI1tw6HFmSI=?= , "Thomas Gleixner" , "Tim Chen" , "Tom Lendacky" , kvm@vger.kernel.org, x86@kernel.org User-Agent: SquirrelMail/1.4.22-21.fc27 MIME-Version: 1.0 Content-Type: text/plain;charset=utf-8 Content-Transfer-Encoding: 8bit X-Priority: 3 (Normal) Importance: Normal X-SRS-Rewrite: SMTP reverse-path rewritten from by twosheds.infradead.org. See http://www.infradead.org/rpr.html X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-THRID: =?utf-8?q?1590140567714479425?= X-GMAIL-MSGID: =?utf-8?q?1590203536008731320?= X-Mailing-List: linux-kernel@vger.kernel.org List-ID: > On Sat, Jan 20, 2018 at 08:22:55PM +0100, KarimAllah Ahmed wrote: >> From: Tim Chen >> >> Flush indirect branches when switching into a process that marked >> itself non dumpable. This protects high value processes like gpg >> better, without having too high performance overhead. > > So if I understand it right, this is only needed if the 'other' > executable itself is susceptible to spectre. If say someone audited gpg > for spectre-v1 and build it with retpoline, it would be safe to not > issue the IBPB, right? Spectre V2 not v1. V1 is separate. For V2 retpoline is enough... as long as all the libraries have it too. > So would it make sense to provide an ELF flag / personality thing such > that userspace can indicate its spectre-safe? Yes, Arjan and I were pondering that yesterday; it probably does make sense. Also for allowing a return to userspace after vmexit, if the army process itself is so marked. > I realize that this is all future work, because so far auditing for v1 > is a lot of pain (we need better tools), but would it be something that > makes sense in the longer term? It's *only* retpoline so it isn't actually that much. Although I'm wary of Cc'ing HJ on such thoughts because he seems to never sleep and always respond promptly with "OK I did that... " :) If we did systematically do this in userspace we'd probably want to do external thunks there too, and a flag in the auxvec to tell it not to bother (for IBRS_ALL etc.). -- dwmw2