From: Scott Wood <oss@buserror.net>
To: Diana Madalina Craciun <diana.craciun@nxp.com>,
"linuxppc-dev@lists.ozlabs.org" <linuxppc-dev@lists.ozlabs.org>
Cc: "mpe@ellerman.id.au" <mpe@ellerman.id.au>, Leo Li <leoyang.li@nxp.com>
Subject: Re: [RFC PATCH] powerpc/fsl: Add barrier_nospec implementation for NXP PowerPC Book E
Date: Tue, 29 May 2018 14:14:05 -0500 [thread overview]
Message-ID: <1527621245.30674.30.camel@buserror.net> (raw)
In-Reply-To: <VI1PR0401MB246345AD11EC8666B7187F8DFF6D0@VI1PR0401MB2463.eurprd04.prod.outlook.com>
On Tue, 2018-05-29 at 15:22 +0000, Diana Madalina Craciun wrote:
> Hi Scott,
>
> Thanks for the review.
>
> On 05/22/2018 11:31 PM, Scott Wood wrote:
> > On Tue, 2018-05-22 at 10:10 +0300, Diana Craciun wrote:
> > > Implement the barrier_nospec as a isync;sync instruction sequence.
> > > The implementation uses the infrastructure built for BOOK3S 64
> > > with the difference that for NXP platforms there is no firmware involved
> > > and the need for a speculation barrier is read from the device tree.
> > > I have used the same name for the property:
> > > fsl,needs-spec-barrier-for-bounds-check
> >
> > Using the device tree this way means that anyone without an updated device
> > tree won't get the protection. I also don't see any device tree updates
> > --
> > which chips are affected?
>
> I was planning to have the device tree changes in a different patch-set.
> The affected cores are e500, e500mc, e5500, e6500.
So, all supported FSL/NXP book E chips. Why not just enable the workaround
unconditionally (and revisit if NXP ever produces a book E chip that doesn't
need it and/or e200 is ever supported if that's simple enough to be immune)?
> > Why patch nops in if not enabled? Aren't those locations already
> > nops? For
> > that matter, how can this function even be called on FSL_BOOK3E with
> > enable !=
> > true?
>
> There is some code in arch/powerpc/kernel/security.c which allows
> control of barrier_nospec via debugfs.
OK.
> > Should there be a way for the user to choose not to enable this (editing
> > the
> > device tree doesn't count), for a use case that is not sufficiently
> > security
> > sensitive to justify the performance loss? What is the performance impact
> > of
> > this patch?
>
> My reason was that on the other architectures Spectre variant 1
> mitigations are not disabled either. But I think that it might be a good
> idea to add a bootarg parameter to disable the barrier.
Is there a specific policy reason why they allow spectre v2 to be disabled but
not v1, or just a matter of not having a mechanism to disable it, or the parts
which could practically be disabled not impacting performance much?
-Scott
next prev parent reply other threads:[~2018-05-29 19:16 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <1526973031-9543-1-git-send-email-diana.craciun@nxp.com>
2018-05-22 20:29 ` [RFC PATCH] powerpc/fsl: Add barrier_nospec implementation for NXP PowerPC Book E Scott Wood
2018-05-29 15:22 ` Diana Madalina Craciun
2018-05-29 19:14 ` Scott Wood [this message]
2018-05-30 15:09 ` Diana Madalina Craciun
2018-05-31 14:21 ` Michael Ellerman
2018-05-31 14:35 ` Diana Madalina Craciun
2018-05-31 22:03 ` Scott Wood
2018-06-01 10:40 ` Michael Ellerman
2018-06-01 14:58 ` Diana Madalina Craciun
2018-05-23 8:56 ` [RESEND RFC " Diana Craciun
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1527621245.30674.30.camel@buserror.net \
--to=oss@buserror.net \
--cc=diana.craciun@nxp.com \
--cc=leoyang.li@nxp.com \
--cc=linuxppc-dev@lists.ozlabs.org \
--cc=mpe@ellerman.id.au \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).