From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Google-Smtp-Source: AH8x2268S9xt9827TtIq+avgqntjv0E16NZ1o91OyW2ionHOP4L0S74pdjdCIiG7MRyDNyD1KWSa ARC-Seal: i=1; a=rsa-sha256; t=1516775404; cv=none; d=google.com; s=arc-20160816; b=itjosL2rZ5i4zcQAkZQ7wodWmOIMAv1m3HL8l3jF3TKA6oUAbMBv2uvCVBEGwk/xde jUyV35b0ZZX2pUPqfmuKXwQ4YpdVuY+9GZtM8ov34/yQeXFgYva0t7ozmdmfQjzSC4k8 BUFtS8MoQZdcZnovsBOKRaIPtq7kJ9Gr3nRKZxiwlcQL+wRmWgD06pI/r1PuNizTbZHv hqj/BAPL7MaG5TYtfO5SdP/RIqFAUGz3DBxOqHL98JAhxbdEr95j9hnlqwJk8tFfzZFL Hamy112N4SoRDVUS8Otc+oTM9313AQLxrfMuZPnPrL3oITf2uMx5uC095MoqvZ8CMKJu WT+A== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=message-id:content-transfer-encoding:mime-version:references :in-reply-to:subject:cc:to:from:date:arc-authentication-results; bh=gPnKl0+7r5Q21ldlGDyzTiWyNX3TEuwEB4+AqAiFqq8=; b=GCSBQAw8wFWBeLIypEwN6LE7CISkE12HfteU0ir6InsnuY3+NLwTh16bpYKNwzz67b S5ml9m5FEW6lm1Ox+0NYhDr2KMRa+IZWZUIgBz4U5q+XLrc+KgVAlNK+WdSgFv5VSVVW toMTfZHhI817zzzlMIpmQtSmuXHHsES4jQpi6Dh+DFX7F++sAimzV/A1Retm6D31zauv kSWfh3dTm1SdvEHQq7Q8iyDsIyhi8jenIENXTCSKgf0psrKdTKYwJKuQ/tXSWxjLksPD MG2Bpgll8DI9hVZ1W+MXE6IJTqJLlR/+zDZN+0lEPI4PFXe8B+xAEd746K9aFLKdLPi9 m1mg== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of schwidefsky@de.ibm.com designates 148.163.158.5 as permitted sender) smtp.mailfrom=schwidefsky@de.ibm.com; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=ibm.com Authentication-Results: mx.google.com; spf=pass (google.com: domain of schwidefsky@de.ibm.com designates 148.163.158.5 as permitted sender) smtp.mailfrom=schwidefsky@de.ibm.com; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=ibm.com Date: Wed, 24 Jan 2018 07:29:53 +0100 From: Martin Schwidefsky To: Dominik Brodowski Cc: linux-kernel@vger.kernel.org, linux-s390@vger.kernel.org, kvm@vger.kernel.org, Heiko Carstens , Christian Borntraeger , Paolo Bonzini , Cornelia Huck , David Hildenbrand , Greg Kroah-Hartman , Jon Masters , Marcus Meissner , Jiri Kosina , w@1wt.eu, keescook@chromium.org Subject: Re: [PATCH 1/5] prctl: add PR_ISOLATE_BP process control In-Reply-To: <20180123170719.GA4154@isilmar-4.linta.de> References: <1516712825-2917-1-git-send-email-schwidefsky@de.ibm.com> <1516712825-2917-2-git-send-email-schwidefsky@de.ibm.com> <20180123170719.GA4154@isilmar-4.linta.de> X-Mailer: Claws Mail 3.13.2 (GTK+ 2.24.30; x86_64-pc-linux-gnu) MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit X-TM-AS-GCONF: 00 x-cbid: 18012406-0016-0000-0000-0000051B2BED X-IBM-AV-DETECTION: SAVI=unused REMOTE=unused XFE=unused x-cbparentid: 18012406-0017-0000-0000-00002857B3A0 Message-Id: <20180124072953.50851fec@mschwideX1> X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:,, definitions=2018-01-24_03:,, signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 malwarescore=0 suspectscore=0 phishscore=0 bulkscore=0 spamscore=0 clxscore=1015 lowpriorityscore=0 impostorscore=0 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1709140000 definitions=main-1801240085 X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-THRID: =?utf-8?q?1590388677068788062?= X-GMAIL-MSGID: =?utf-8?q?1590454286650559135?= X-Mailing-List: linux-kernel@vger.kernel.org List-ID: On Tue, 23 Jan 2018 18:07:19 +0100 Dominik Brodowski wrote: > On Tue, Jan 23, 2018 at 02:07:01PM +0100, Martin Schwidefsky wrote: > > Add the PR_ISOLATE_BP operation to prctl. The effect of the process > > control is to make all branch prediction entries created by the execution > > of the user space code of this task not applicable to kernel code or the > > code of any other task. > > What is the rationale for requiring a per-process *opt-in* for this added > protection? > > For KPTI on x86, the exact opposite approach is being discussed (see, e.g. > http://lkml.kernel.org/r/1515612500-14505-1-git-send-email-w@1wt.eu ): By > default, play it safe, with KPTI enabled. But for "trusted" processes, one > may opt out using prctrl. The rationale is that there are cases where you got code from *somewhere* and want to run it in an isolated context. Think: a docker container that runs under KVM. But with spectre this is still not really safe. So you include a wrapper program in the docker container to use the trap door prctl to start the potential malicious program. Now you should be good, no? -- blue skies, Martin. "Reality continues to ruin my life." - Calvin.