lkml.org 
[lkml]   [2018]   [Jan]   [31]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: [tip:x86/pti] x86/speculation: Use Indirect Branch Prediction Barrier in context switch
    On Wed, Jan 31, 2018 at 08:03:00AM +0100, Dominik Brodowski wrote:
    > On Tue, Jan 30, 2018 at 02:39:45PM -0800, tip-bot for Tim Chen wrote:
    > > Commit-ID: 18bf3c3ea8ece8f03b6fc58508f2dfd23c7711c7
    > > Gitweb: https://git.kernel.org/tip/18bf3c3ea8ece8f03b6fc58508f2dfd23c7711c7
    > > Author: Tim Chen <tim.c.chen@linux.intel.com>
    > > AuthorDate: Mon, 29 Jan 2018 22:04:47 +0000
    > > Committer: Thomas Gleixner <tglx@linutronix.de>
    > > CommitDate: Tue, 30 Jan 2018 23:09:21 +0100
    > >
    > > x86/speculation: Use Indirect Branch Prediction Barrier in context switch
    > >
    > > Flush indirect branches when switching into a process that marked itself
    > > non dumpable. This protects high value processes like gpg better,
    > > without having too high performance overhead.
    >
    > For the record, I am still opposed to limit this to non-dumpable processes.
    > Whether a process needs protection by IBPB on context switches is a
    > different question to whether a process should be allowed to be dumped,
    > though the former may be a superset of the latter. In my opinion, IBPB
    > should be enabled on all context switches to userspace processes, until we
    > have a clear mitigation strategy for userspace against Spectre-v2 designed
    > and implemented.
    >
    > Thanks,
    > Dominik
    >
    > --------------------------
    > From: Dominik Brodowski <linux@dominikbrodowski.net>
    > Date: Wed, 31 Jan 2018 07:43:12 +0100
    > Subject: [PATCH] x86/speculation: Do not limit Indirect Branch Prediction Barrier to non-dumpable processes
    >
    > Whether a process needs protection by IBPB on context switches is a
    > different question to whether a process should be allowed to be dumped,
    > though the former may be a superset of the latter. Enable IBPB on all
    > context switches to a different userspace process, until we have a clear
    > mitigation strategy for userspace against Spectre-v2 designed and
    > implemented.
    >
    > Signed-off-by: Dominik Brodowski <linux@dominikbrodowski.net>

    Acked-by: Josh Poimboeuf <jpoimboe@redhat.com>

    --
    Josh

    \
     
     \ /
      Last update: 2018-01-31 14:25    [W:5.398 / U:0.008 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site