linux-kernel - Re: [PATCH 4.19 041/361] x86/speculation: Enable cross-hyperthread spectre v2 STIBP mitigation

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <41234d20-294f-d0f4-336c-64bf9fcb92a7@linux.intel.com>
Date:   Wed, 21 Nov 2018 09:47:48 -0800
From:   Tim Chen <tim.c.chen@...ux.intel.com>
To:     Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        Jiri Kosina <jikos@...nel.org>
Cc:     linux-kernel@...r.kernel.org, stable@...r.kernel.org,
        Thomas Gleixner <tglx@...utronix.de>,
        Peter Zijlstra <peterz@...radead.org>,
        Josh Poimboeuf <jpoimboe@...hat.com>,
        Andrea Arcangeli <aarcange@...hat.com>,
        WoodhouseDavid <dwmw@...zon.co.uk>,
        Andi Kleen <ak@...ux.intel.com>,
        SchauflerCasey <casey.schaufler@...el.com>,
        Dave Stewart <david.c.stewart@...el.com>
Subject: Re: [PATCH 4.19 041/361] x86/speculation: Enable cross-hyperthread
 spectre v2 STIBP mitigation

On 11/21/2018 05:56 AM, Greg Kroah-Hartman wrote:
> On Wed, Nov 21, 2018 at 02:21:15PM +0100, Jiri Kosina wrote:
>> On Sun, 11 Nov 2018, Greg Kroah-Hartman wrote:
>>
>>> 4.19-stable review patch.  If anyone has any objections, please let me know.
>>
>> Greg, please drop this patch from all -stable for now. Version that 
>> wouldn't have such performance impact is being worked on.
> 
> Is it reverted in Linus's tree?  If not, then anything that comes "later
> on" will not apply here, right?
> 
> I see the thread asking about this, but I got really conflicting
> messages here, and now it's in all of the latest releases, and no
> testing seems to have uncovered issues.  Is it just a "slow down"
> problem?

Greg,

It could be a big slow down in excess of 20% for some applications.
And cross sibling Spectre v2 attack is quite hard to pull off.

So till we have the accompanying patchset that only apply STIBP on processes
that really need it instead of universally, it should be withheld from
stable.

Tim