lkml.org 
[lkml]   [2018]   [Jan]   [22]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: [RFC 04/10] x86/mm: Only flush indirect branches when switching into non dumpable process
From
Date
On 01/20/2018 01:06 PM, Woodhouse, David wrote:
> On Sat, 2018-01-20 at 20:22 +0100, KarimAllah Ahmed wrote:
>> From: Tim Chen <tim.c.chen@linux.intel.com>
>
> I think this is probably From: Andi now rather than From: Tim?

This change is from Andi.


>> 1 file changed, 12 insertions(+), 1 deletion(-)
>>
>> diff --git a/arch/x86/mm/tlb.c b/arch/x86/mm/tlb.c
>> index 304de7d..f64e80c 100644
>> --- a/arch/x86/mm/tlb.c
>> +++ b/arch/x86/mm/tlb.c
>> @@ -225,8 +225,19 @@ void switch_mm_irqs_off(struct mm_struct *prev, struct mm_struct *next,
>> * Avoid user/user BTB poisoning by flushing the branch predictor
>> * when switching between processes. This stops one process from
>> * doing Spectre-v2 attacks on another.
>> + *
>> + * As an optimization: Flush indirect branches only when
>> + * switching into processes that disable dumping.
>> + *
>> + * This will not flush when switching into kernel threads.
>> + * But it would flush when switching into idle and back
>> + *
>> + * It might be useful to have a one-off cache here
>> + * to also not flush the idle case, but we would need some
>> + * kind of stable sequence number to remember the previous mm.
>> */
>> - indirect_branch_prediction_barrier();
>> + if (tsk && tsk->mm && get_dumpable(tsk->mm) != SUID_DUMP_USER)
>> + indirect_branch_prediction_barrier();

We could move this close to the cr3 write. The cr3 write provides
barrier against unwanted speculation in the above if check.

Tim

\
 
 \ /
  Last update: 2018-01-22 19:30    [W:0.151 / U:1.544 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site