From: Joel Fernandes <joel@joelfernandes.org>
To: Peter Zijlstra <peterz@infradead.org>
Cc: Nishanth Aravamudan <naravamudan@digitalocean.com>,
Julien Desfossez <jdesfossez@digitalocean.com>,
Tim Chen <tim.c.chen@linux.intel.com>,
Vineeth Pillai <viremana@linux.microsoft.com>,
Aaron Lu <aaron.lwe@gmail.com>,
Aubrey Li <aubrey.intel@gmail.com>,
tglx@linutronix.de, linux-kernel@vger.kernel.org,
mingo@kernel.org, torvalds@linux-foundation.org,
fweisbec@gmail.com, keescook@chromium.org, kerrnel@google.com,
Phil Auld <pauld@redhat.com>,
Valentin Schneider <valentin.schneider@arm.com>,
Mel Gorman <mgorman@techsingularity.net>,
Pawan Gupta <pawan.kumar.gupta@linux.intel.com>,
Paolo Bonzini <pbonzini@redhat.com>,
vineeth@bitbyteword.org, Chen Yu <yu.c.chen@intel.com>,
Christian Brauner <christian.brauner@ubuntu.com>,
Agata Gruza <agata.gruza@intel.com>,
Antonio Gomez Iglesias <antonio.gomez.iglesias@intel.com>,
graf@amazon.com, konrad.wilk@oracle.com, dfaggioli@suse.com,
pjt@google.com, rostedt@goodmis.org, derkling@google.com,
benbjiang@tencent.com,
Alexandre Chartre <alexandre.chartre@oracle.com>,
James.Bottomley@hansenpartnership.com, OWeisse@umich.edu,
Dhaval Giani <dhaval.giani@oracle.com>,
Junaid Shahid <junaids@google.com>,
jsbarnes@google.com, chris.hyser@oracle.com,
Ben Segall <bsegall@google.com>, Josh Don <joshdon@google.com>,
Hao Luo <haoluo@google.com>,
Tom Lendacky <thomas.lendacky@amd.com>,
Aubrey Li <aubrey.li@linux.intel.com>,
Tim Chen <tim.c.chen@intel.com>,
"Paul E . McKenney" <paulmck@kernel.org>
Subject: Re: [PATCH -tip 18/32] kernel/entry: Add support for core-wide protection of kernel-mode
Date: Tue, 1 Dec 2020 12:55:02 -0500 [thread overview]
Message-ID: <20201201175502.GB201514@google.com> (raw)
In-Reply-To: <20201125093700.GP2414@hirez.programming.kicks-ass.net>
On Wed, Nov 25, 2020 at 10:37:00AM +0100, Peter Zijlstra wrote:
> On Tue, Nov 17, 2020 at 06:19:48PM -0500, Joel Fernandes (Google) wrote:
> > Core-scheduling prevents hyperthreads in usermode from attacking each
> > other, but it does not do anything about one of the hyperthreads
> > entering the kernel for any reason. This leaves the door open for MDS
> > and L1TF attacks with concurrent execution sequences between
> > hyperthreads.
> >
> > This patch therefore adds support for protecting all syscall and IRQ
> > kernel mode entries. Care is taken to track the outermost usermode exit
> > and entry using per-cpu counters. In cases where one of the hyperthreads
> > enter the kernel, no additional IPIs are sent. Further, IPIs are avoided
> > when not needed - example: idle and non-cookie HTs do not need to be
> > forced into kernel mode.
> >
> > More information about attacks:
> > For MDS, it is possible for syscalls, IRQ and softirq handlers to leak
> > data to either host or guest attackers. For L1TF, it is possible to leak
> > to guest attackers. There is no possible mitigation involving flushing
> > of buffers to avoid this since the execution of attacker and victims
> > happen concurrently on 2 or more HTs.
>
> > .../admin-guide/kernel-parameters.txt | 11 +
> > include/linux/entry-common.h | 12 +-
> > include/linux/sched.h | 12 +
> > kernel/entry/common.c | 28 +-
> > kernel/sched/core.c | 241 ++++++++++++++++++
> > kernel/sched/sched.h | 3 +
> > 6 files changed, 304 insertions(+), 3 deletions(-)
> >
> > diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
> > index bd1a5b87a5e2..b185c6ed4aba 100644
> > --- a/Documentation/admin-guide/kernel-parameters.txt
> > +++ b/Documentation/admin-guide/kernel-parameters.txt
> > @@ -4678,6 +4678,17 @@
> >
> > sbni= [NET] Granch SBNI12 leased line adapter
> >
> > + sched_core_protect_kernel=
> > + [SCHED_CORE] Pause SMT siblings of a core running in
> > + user mode, if at least one of the siblings of the core
> > + is running in kernel mode. This is to guarantee that
> > + kernel data is not leaked to tasks which are not trusted
> > + by the kernel. A value of 0 disables protection, 1
> > + enables protection. The default is 1. Note that protection
> > + depends on the arch defining the _TIF_UNSAFE_RET flag.
> > + Further, for protecting VMEXIT, arch needs to call
> > + KVM entry/exit hooks.
> > +
> > sched_debug [KNL] Enables verbose scheduler debug messages.
> >
> > schedstats= [KNL,X86] Enable or disable scheduled statistics.
>
> So I don't like the parameter name, it's too long. Also I don't like it
> because its a boolean.
Maybe ht_protect= then?
> You're adding syscall,irq,kvm under a single knob where they're all due
> to different flavours of broken. Different hardware might want/need
> different combinations.
Ok, I can try to make it ht_protect=irq,syscall,kvm etc. And conditionally
enable the protection. Does that work for you?
>
> Hardware without MDS but with L1TF wouldn't need the syscall hook, but
> you're not givng a choice here. And this is generic code, you can't
> assume stuff like this.
Got it.
thanks,
- Joel
next prev parent reply other threads:[~2020-12-01 17:56 UTC|newest]
Thread overview: 150+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-11-17 23:19 [PATCH -tip 00/32] Core scheduling (v9) Joel Fernandes (Google)
2020-11-17 23:19 ` [PATCH -tip 01/32] sched: Wrap rq::lock access Joel Fernandes (Google)
2020-11-19 23:31 ` Singh, Balbir
2020-11-20 16:55 ` Joel Fernandes
2020-11-22 8:52 ` Balbir Singh
2020-11-17 23:19 ` [PATCH -tip 02/32] sched: Introduce sched_class::pick_task() Joel Fernandes (Google)
2020-11-19 23:56 ` Singh, Balbir
2020-11-20 16:58 ` Joel Fernandes
2020-11-25 23:19 ` Balbir Singh
2020-11-25 16:28 ` Vincent Guittot
2020-11-26 9:07 ` Peter Zijlstra
2020-11-26 10:17 ` Vincent Guittot
2020-11-26 12:40 ` Peter Zijlstra
2020-11-17 23:19 ` [PATCH -tip 03/32] sched/fair: Fix pick_task_fair crashes due to empty rbtree Joel Fernandes (Google)
2020-11-20 10:15 ` Singh, Balbir
2020-11-20 18:11 ` Vineeth Pillai
2020-11-23 22:31 ` Balbir Singh
2020-11-24 8:31 ` Peter Zijlstra
2020-11-17 23:19 ` [PATCH -tip 04/32] sched: Core-wide rq->lock Joel Fernandes (Google)
2020-11-22 9:11 ` Balbir Singh
2020-11-24 8:16 ` Peter Zijlstra
2020-11-26 0:35 ` Balbir Singh
2020-11-17 23:19 ` [PATCH -tip 05/32] sched/fair: Add a few assertions Joel Fernandes (Google)
2020-11-17 23:19 ` [PATCH -tip 06/32] sched: Basic tracking of matching tasks Joel Fernandes (Google)
2020-11-17 23:19 ` [PATCH -tip 07/32] sched: Add core wide task selection and scheduling Joel Fernandes (Google)
2020-11-17 23:19 ` [PATCH -tip 08/32] sched/fair: Fix forced idle sibling starvation corner case Joel Fernandes (Google)
2020-11-22 10:35 ` Balbir Singh
2020-11-17 23:19 ` [PATCH -tip 09/32] sched/fair: Snapshot the min_vruntime of CPUs on force idle Joel Fernandes (Google)
2020-11-22 11:44 ` Balbir Singh
2020-11-23 12:31 ` Vineeth Pillai
2020-11-23 23:31 ` Balbir Singh
2020-11-24 9:09 ` Peter Zijlstra
2020-11-25 23:17 ` Balbir Singh
2020-11-26 8:23 ` Peter Zijlstra
2020-11-17 23:19 ` [PATCH -tip 10/32] sched: Fix priority inversion of cookied task with sibling Joel Fernandes (Google)
2020-11-22 22:41 ` Balbir Singh
2020-11-24 18:30 ` Joel Fernandes
2020-11-25 23:05 ` Balbir Singh
2020-11-26 8:29 ` Peter Zijlstra
2020-11-26 22:27 ` Balbir Singh
2020-12-01 17:49 ` Joel Fernandes
2020-11-17 23:19 ` [PATCH -tip 11/32] sched: Enqueue task into core queue only after vruntime is updated Joel Fernandes (Google)
2020-11-17 23:19 ` [PATCH -tip 12/32] sched: Simplify the core pick loop for optimized case Joel Fernandes (Google)
2020-11-24 12:04 ` Peter Zijlstra
2020-11-24 17:04 ` Joel Fernandes
2020-11-25 8:37 ` Peter Zijlstra
2020-11-17 23:19 ` [PATCH -tip 13/32] sched: Trivial forced-newidle balancer Joel Fernandes (Google)
2020-11-23 4:38 ` Balbir Singh
2020-11-23 15:07 ` Li, Aubrey
2020-11-23 23:35 ` Balbir Singh
2020-11-24 0:32 ` Li, Aubrey
2020-11-25 21:28 ` Balbir Singh
2020-11-17 23:19 ` [PATCH -tip 14/32] sched: migration changes for core scheduling Joel Fernandes (Google)
2020-11-22 23:54 ` Balbir Singh
2020-11-23 4:36 ` Li, Aubrey
2020-11-24 15:42 ` Peter Zijlstra
2020-11-25 3:12 ` Li, Aubrey
2020-11-25 22:57 ` Balbir Singh
2020-11-26 3:20 ` Li, Aubrey
2020-11-26 8:32 ` Balbir Singh
2020-11-26 9:26 ` Li, Aubrey
2020-11-30 9:33 ` Balbir Singh
2020-11-30 12:29 ` Li, Aubrey
2020-12-02 14:09 ` Li, Aubrey
2020-12-03 1:06 ` Li, Aubrey
2020-11-30 10:35 ` Vincent Guittot
2020-11-30 12:32 ` Li, Aubrey
2020-11-17 23:19 ` [PATCH -tip 15/32] sched: Improve snapshotting of min_vruntime for CGroups Joel Fernandes (Google)
2020-11-24 10:27 ` Peter Zijlstra
2020-11-24 17:07 ` Joel Fernandes
2020-11-25 8:41 ` Peter Zijlstra
2020-11-24 10:41 ` Peter Zijlstra
2020-11-17 23:19 ` [PATCH -tip 16/32] irq_work: Cleanup Joel Fernandes (Google)
2020-11-17 23:19 ` [PATCH -tip 17/32] arch/x86: Add a new TIF flag for untrusted tasks Joel Fernandes (Google)
2020-11-23 5:18 ` Balbir Singh
2020-11-17 23:19 ` [PATCH -tip 18/32] kernel/entry: Add support for core-wide protection of kernel-mode Joel Fernandes (Google)
2020-11-24 16:09 ` Peter Zijlstra
2020-11-24 17:52 ` Joel Fernandes
2020-11-25 9:37 ` Peter Zijlstra
2020-12-01 17:55 ` Joel Fernandes [this message]
2020-11-26 5:37 ` Balbir Singh
2020-11-17 23:19 ` [PATCH -tip 19/32] entry/idle: Enter and exit kernel protection during idle entry and exit Joel Fernandes (Google)
2020-11-24 16:13 ` Peter Zijlstra
2020-11-24 18:03 ` Joel Fernandes
2020-11-25 8:49 ` Peter Zijlstra
2020-12-01 18:24 ` Joel Fernandes
2020-11-17 23:19 ` [PATCH -tip 20/32] entry/kvm: Protect the kernel when entering from guest Joel Fernandes (Google)
2020-11-17 23:19 ` [PATCH -tip 21/32] sched: CGroup tagging interface for core scheduling Joel Fernandes (Google)
2020-11-17 23:19 ` [PATCH -tip 22/32] sched: Split the cookie and setup per-task cookie on fork Joel Fernandes (Google)
2020-11-25 11:07 ` Peter Zijlstra
2020-12-01 18:56 ` Joel Fernandes
2020-11-25 11:10 ` Peter Zijlstra
2020-12-01 19:20 ` Joel Fernandes
2020-12-01 19:34 ` Peter Zijlstra
2020-12-02 6:36 ` Josh Don
2020-12-02 7:54 ` Peter Zijlstra
2020-12-04 0:20 ` Josh Don
2020-12-06 17:49 ` Joel Fernandes
2020-11-25 11:11 ` Peter Zijlstra
2020-12-01 19:16 ` Joel Fernandes
2020-11-25 11:15 ` Peter Zijlstra
2020-12-01 19:11 ` Joel Fernandes
2020-12-01 19:20 ` Peter Zijlstra
2020-12-06 18:15 ` Joel Fernandes
2020-11-25 12:54 ` Peter Zijlstra
2020-12-01 18:38 ` Joel Fernandes
2020-11-25 13:03 ` Peter Zijlstra
2020-12-01 18:52 ` Joel Fernandes
2020-11-30 23:05 ` Balbir Singh
2020-11-17 23:19 ` [PATCH -tip 23/32] sched: Add a per-thread core scheduling interface Joel Fernandes (Google)
2020-11-25 13:08 ` Peter Zijlstra
2020-12-01 19:36 ` Joel Fernandes
2020-12-02 21:47 ` Chris Hyser
2020-12-02 23:13 ` chris hyser
2020-12-06 17:34 ` Joel Fernandes
2020-12-07 21:48 ` chris hyser
2020-12-09 18:52 ` Chris Hyser
2020-12-14 19:31 ` Joel Fernandes
2020-12-14 19:44 ` chris hyser
2020-12-14 23:25 ` Joel Fernandes
2020-12-15 14:56 ` chris hyser
2020-12-15 16:23 ` chris hyser
2020-12-15 18:13 ` Dhaval Giani
2020-12-16 0:35 ` Joel Fernandes
2020-11-17 23:19 ` [PATCH -tip 24/32] sched: Release references to the per-task cookie on exit Joel Fernandes (Google)
2020-11-25 13:03 ` Peter Zijlstra
2020-11-17 23:19 ` [PATCH -tip 25/32] sched: Refactor core cookie into struct Joel Fernandes (Google)
2020-11-17 23:19 ` [PATCH -tip 26/32] sched: Add a second-level tag for nested CGroup usecase Joel Fernandes (Google)
2020-11-25 13:42 ` Peter Zijlstra
2020-11-30 23:10 ` Balbir Singh
2020-12-01 20:08 ` Joel Fernandes
2020-12-02 6:18 ` Josh Don
2020-12-02 8:02 ` Peter Zijlstra
2020-12-02 18:53 ` Tejun Heo
2020-12-04 0:51 ` Josh Don
2020-12-04 15:45 ` Tejun Heo
2020-11-17 23:19 ` [PATCH -tip 27/32] sched/debug: Add CGroup node for printing group cookie if SCHED_DEBUG Joel Fernandes (Google)
2020-11-17 23:19 ` [PATCH -tip 28/32] kselftest: Add tests for core-sched interface Joel Fernandes (Google)
2020-11-17 23:19 ` [PATCH -tip 29/32] sched: Move core-scheduler interfacing code to a new file Joel Fernandes (Google)
2020-11-17 23:20 ` [PATCH -tip 30/32] Documentation: Add core scheduling documentation Joel Fernandes (Google)
2020-11-17 23:20 ` [PATCH -tip 31/32] sched: Add a coresched command line option Joel Fernandes (Google)
2020-11-19 23:39 ` Randy Dunlap
2020-11-25 13:45 ` Peter Zijlstra
2020-11-26 0:11 ` Balbir Singh
2020-11-17 23:20 ` [PATCH -tip 32/32] sched: Debug bits Joel Fernandes (Google)
2020-12-01 0:21 ` Balbir Singh
2021-01-15 15:10 ` Joel Fernandes
2020-11-24 11:48 ` [PATCH -tip 00/32] Core scheduling (v9) Vincent Guittot
2020-11-24 15:08 ` Joel Fernandes
2020-12-03 6:16 ` Ning, Hongyu
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20201201175502.GB201514@google.com \
--to=joel@joelfernandes.org \
--cc=James.Bottomley@hansenpartnership.com \
--cc=OWeisse@umich.edu \
--cc=aaron.lwe@gmail.com \
--cc=agata.gruza@intel.com \
--cc=alexandre.chartre@oracle.com \
--cc=antonio.gomez.iglesias@intel.com \
--cc=aubrey.intel@gmail.com \
--cc=aubrey.li@linux.intel.com \
--cc=benbjiang@tencent.com \
--cc=bsegall@google.com \
--cc=chris.hyser@oracle.com \
--cc=christian.brauner@ubuntu.com \
--cc=derkling@google.com \
--cc=dfaggioli@suse.com \
--cc=dhaval.giani@oracle.com \
--cc=fweisbec@gmail.com \
--cc=graf@amazon.com \
--cc=haoluo@google.com \
--cc=jdesfossez@digitalocean.com \
--cc=joshdon@google.com \
--cc=jsbarnes@google.com \
--cc=junaids@google.com \
--cc=keescook@chromium.org \
--cc=kerrnel@google.com \
--cc=konrad.wilk@oracle.com \
--cc=linux-kernel@vger.kernel.org \
--cc=mgorman@techsingularity.net \
--cc=mingo@kernel.org \
--cc=naravamudan@digitalocean.com \
--cc=pauld@redhat.com \
--cc=paulmck@kernel.org \
--cc=pawan.kumar.gupta@linux.intel.com \
--cc=pbonzini@redhat.com \
--cc=peterz@infradead.org \
--cc=pjt@google.com \
--cc=rostedt@goodmis.org \
--cc=tglx@linutronix.de \
--cc=thomas.lendacky@amd.com \
--cc=tim.c.chen@intel.com \
--cc=tim.c.chen@linux.intel.com \
--cc=torvalds@linux-foundation.org \
--cc=valentin.schneider@arm.com \
--cc=vineeth@bitbyteword.org \
--cc=viremana@linux.microsoft.com \
--cc=yu.c.chen@intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).