linux-kernel - [patch 00/24] x86/speculation: Remedy the STIBP/IBPB overhead

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 21 Nov 2018 21:14:30 +0100
From:   Thomas Gleixner <tglx@...utronix.de>
To:     LKML <linux-kernel@...r.kernel.org>
Cc:     x86@...nel.org, Peter Zijlstra <peterz@...radead.org>,
        Andy Lutomirski <luto@...nel.org>,
        Linus Torvalds <torvalds@...ux-foundation.org>,
        Jiri Kosina <jkosina@...e.cz>,
        Tom Lendacky <thomas.lendacky@....com>,
        Josh Poimboeuf <jpoimboe@...hat.com>,
        Andrea Arcangeli <aarcange@...hat.com>,
        David Woodhouse <dwmw@...zon.co.uk>,
        Andi Kleen <ak@...ux.intel.com>,
        Dave Hansen <dave.hansen@...el.com>,
        Casey Schaufler <casey.schaufler@...el.com>,
        Asit Mallick <asit.k.mallick@...el.com>,
        Arjan van de Ven <arjan@...ux.intel.com>,
        Jon Masters <jcm@...hat.com>,
        Waiman Long <longman9394@...il.com>,
        Greg KH <gregkh@...uxfoundation.org>,
        Dave Stewart <david.c.stewart@...el.com>,
        Kees Cook <keescook@...omium.org>
Subject: [patch 00/24] x86/speculation: Remedy the STIBP/IBPB overhead

This is based on Tim Chen's V5 patch series. The following changes have
been made:

   - Control STIPB evaluation with a single static key

   - Move IBPB out from switch_mm() into switch_to() and control the
     always and the conditional mode with static keys.

     The mainline implementation is wrong in a few aspects, e.g. it fails
     to protect tasks within the same process, which breaks
     sandboxing. That same process optimization was the sole reason to have
     it in switch_mm().

     The new always mode is just issuing the barrier unconditionally when
     switching to a user task, but that also leaves STIPB always on. So
     really paranoid people get the highest possible protection and the
     highest overhead.

     The conditional mode issues the barrier when a task which is mitigated
     is scheduling out or scheduling in. That is required to support proper
     sandboxing.

   - Remove the ptrace_may_access_sched() code as it's unused now. It was
     ugly anyway and would have given people ideas how to slow down
     switch_mm() some more.

   - Rename TIF_STIPB to TIF_SPEC_IB because it controls both STIBP and
     IBPB.

   - Fix all the corner cases vs. UP and SMT disabled.

   - Limit the overhead when conditional STIPB is not enabled so
     switch_to_xtra() is not invoked for nothing when the TIF bit would
     trigger the entry and nothing else is to do. That can happen when SMT
     is off and a task has the TIF bit set. On UP STIPB is never enabled.

   - Dropped the dumpable part

TODO: Write documentation

It's avaiable from git:

   git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git WIP.x86/pti

It's based on the x86/pti branch unfortunately, which contains the removal
of the minimal asm retpoline hackery. I noticed too late. If the minimal
asm stuff should not be backported it's trivial to rebase that series on
Linus tree.

Thanks,

	tglx