linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Andy Lutomirski <luto@amacapital.net>
To: "Van De Ven, Arjan" <arjan.van.de.ven@intel.com>
Cc: "Andy Lutomirski" <luto@kernel.org>,
	"Tim Chen" <tim.c.chen@linux.intel.com>,
	"Woodhouse, David" <dwmw@amazon.co.uk>,
	"Andi Kleen" <ak@linux.intel.com>,
	"Tom Lendacky" <thomas.lendacky@amd.com>,
	"KarimAllah Ahmed" <karahmed@amazon.de>,
	LKML <linux-kernel@vger.kernel.org>,
	"Andrea Arcangeli" <aarcange@redhat.com>,
	"Arjan van de Ven" <arjan@linux.intel.com>,
	"Raj, Ashok" <ashok.raj@intel.com>,
	"Mallick, Asit K" <asit.k.mallick@intel.com>,
	"Borislav Petkov" <bp@suse.de>,
	"Williams, Dan J" <dan.j.williams@intel.com>,
	"Hansen, Dave" <dave.hansen@intel.com>,
	"Greg Kroah-Hartman" <gregkh@linuxfoundation.org>,
	"H . Peter Anvin" <hpa@zytor.com>,
	"Ingo Molnar" <mingo@redhat.com>,
	"Janakarajan Natarajan" <Janakarajan.Natarajan@amd.com>,
	"Joerg Roedel" <joro@8bytes.org>,
	"Nakajima, Jun" <jun.nakajima@intel.com>,
	"Laura Abbott" <labbott@redhat.com>,
	"Linus Torvalds" <torvalds@linux-foundation.org>,
	"Masami Hiramatsu" <mhiramat@kernel.org>,
	"Paolo Bonzini" <pbonzini@redhat.com>,
	"Peter Zijlstra" <peterz@infradead.org>,
	"Radim Krcmár" <rkrcmar@redhat.com>,
	"Thomas Gleixner" <tglx@linutronix.de>,
	"kvm list" <kvm@vger.kernel.org>, "X86 ML" <x86@kernel.org>
Subject: Re: [RFC 09/10] x86/enter: Create macros to restrict/unrestrict Indirect Branch Speculation
Date: Tue, 23 Jan 2018 19:25:23 -0800	[thread overview]
Message-ID: <BA8CD56D-CB26-415B-9ABA-6E6552900916@amacapital.net> (raw)
In-Reply-To: <0575AF4FD06DD142AD198903C74E1CC87A5F0AC5@ORSMSX103.amr.corp.intel.com>



> On Jan 23, 2018, at 5:59 PM, Van De Ven, Arjan <arjan.van.de.ven@intel.com> wrote:
> 
> 
>>> It is a reasonable approach.  Let a process who needs max security
>>> opt in with disabled dumpable. It can have a flush with IBPB clear before
>>> starting to run, and have STIBP set while running.
>>> 
>> 
>> Do we maybe want a separate opt in?  I can easily imagine things like
>> web browsers that *don't* want to be non-dumpable but do want this
>> opt-in.
> 
> eventually we need something better. Probably in addition.
> dumpable is used today for things that want this.
> 
>> 
>> Also, what's the performance hit of STIBP?
> 
> pretty steep, but it depends on the CPU generation, for some it's cheaper than others. (yes I realize this is a vague answer, but the range is really from just about zero to oh my god)
> 
> I'm not a fan of doing this right now to be honest. We really need to not piece meal some of this, and come up with a better concept of protection on a higher level.
> For example, you mention web browsers, but the threat model for browsers is generally internet content. For V2 to work you need to get some "evil pointer" into the app from the observer and browsers usually aren't doing that.
> The most likely user would be some software-TPM-like service that has magic keys.
> 
> And for keys we want something else... we want an madvice() sort of thing that does a few things, like equivalent of mlock (so the key does not end up in swap),

I'd love to see a slight variant: encrypt that page against some ephemeral key if it gets swapped.

> not having the page (but potentially the rest) end up in core dumps, and the kernel making sure that if the program exits (say for segv) that the key page gets zeroed before going into the free pool. Once you do that as feature, making the key speculation safe is not too hard (intel and arm have cpu options to mark pages for that)
> 
> 

How do we do that on Intel?  Make it UC?

  reply	other threads:[~2018-01-24  3:25 UTC|newest]

Thread overview: 161+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2018-01-20 19:22 [RFC 00/10] Speculation Control feature support KarimAllah Ahmed
2018-01-20 19:22 ` [RFC 01/10] x86/speculation: Add basic support for IBPB KarimAllah Ahmed
2018-01-20 19:22 ` [RFC 02/10] x86/kvm: Add IBPB support KarimAllah Ahmed
2018-01-20 20:18   ` Woodhouse, David
2018-01-22 18:56   ` Jim Mattson
2018-01-22 19:31     ` Jim Mattson
2018-01-20 19:22 ` [RFC 03/10] x86/speculation: Use Indirect Branch Prediction Barrier in context switch KarimAllah Ahmed
2018-01-20 19:22 ` [RFC 04/10] x86/mm: Only flush indirect branches when switching into non dumpable process KarimAllah Ahmed
2018-01-20 21:06   ` Woodhouse, David
2018-01-22 18:29     ` Tim Chen
2018-01-21 11:22   ` Peter Zijlstra
2018-01-21 12:04     ` David Woodhouse
2018-01-21 14:07       ` H.J. Lu
2018-01-22 10:19       ` Peter Zijlstra
2018-01-22 10:23         ` David Woodhouse
2018-01-21 16:21     ` Ingo Molnar
2018-01-21 16:25       ` Arjan van de Ven
2018-01-21 22:20       ` Woodhouse, David
2018-01-29  6:35     ` Jon Masters
2018-01-29 14:07       ` Peter Zijlstra
2018-01-20 19:22 ` [RFC 05/10] x86/speculation: Add basic IBRS support infrastructure KarimAllah Ahmed
2018-01-21 14:31   ` Thomas Gleixner
2018-01-21 14:56     ` Borislav Petkov
2018-01-22  9:51       ` Peter Zijlstra
2018-01-22 12:06         ` Borislav Petkov
2018-01-22 13:30           ` Greg Kroah-Hartman
2018-01-22 13:37             ` Woodhouse, David
2018-01-21 15:25     ` David Woodhouse
2018-01-23 20:58     ` David Woodhouse
2018-01-23 22:43       ` Johannes Erdfelt
2018-01-24  8:47       ` Peter Zijlstra
2018-01-24  9:02         ` David Woodhouse
2018-01-24  9:10           ` Greg Kroah-Hartman
2018-01-24 15:09             ` Arjan van de Ven
2018-01-24 15:18               ` David Woodhouse
2018-01-24  9:34           ` Peter Zijlstra
2018-01-24 10:49           ` Henrique de Moraes Holschuh
2018-01-24 12:30             ` David Woodhouse
2018-01-24 12:14         ` David Woodhouse
2018-01-24 12:29           ` Peter Zijlstra
2018-01-24 12:58             ` David Woodhouse
2018-01-29 20:14   ` [RFC,05/10] " Eduardo Habkost
2018-01-29 20:17     ` David Woodhouse
2018-01-29 20:42       ` Eduardo Habkost
2018-01-29 20:44         ` Arjan van de Ven
2018-01-29 21:02           ` David Woodhouse
2018-01-29 21:37             ` Jim Mattson
2018-01-29 21:50               ` Eduardo Habkost
2018-01-29 22:12                 ` Jim Mattson
2018-01-30  1:22                   ` Eduardo Habkost
2018-01-29 22:25                 ` Andi Kleen
2018-01-30  1:37                   ` Eduardo Habkost
2018-01-29 21:37             ` Andi Kleen
2018-01-29 21:44             ` Eduardo Habkost
2018-01-29 22:10               ` Konrad Rzeszutek Wilk
2018-01-30  1:12                 ` Eduardo Habkost
2018-01-30  0:23             ` Linus Torvalds
2018-01-30  1:03               ` Jim Mattson
2018-01-30  3:13                 ` Andi Kleen
2018-01-31 15:03                   ` Paolo Bonzini
2018-01-31 15:07                     ` Dr. David Alan Gilbert
2018-01-30  1:32               ` Arjan van de Ven
2018-01-30  3:32                 ` Linus Torvalds
2018-01-30 12:04                   ` Eduardo Habkost
2018-01-30 13:54                   ` Arjan van de Ven
2018-01-30  8:22               ` David Woodhouse
2018-01-30 11:35               ` David Woodhouse
2018-01-30 11:56               ` Dr. David Alan Gilbert
2018-01-30 12:11               ` Christian Borntraeger
2018-01-30 14:46                 ` Christophe de Dinechin
2018-01-30 14:52                   ` Christian Borntraeger
2018-01-30 14:56                     ` Christophe de Dinechin
2018-01-30 15:33                       ` Christian Borntraeger
2018-01-30 20:46               ` Alan Cox
2018-01-31 10:05                 ` Christophe de Dinechin
2018-01-31 10:15                   ` Thomas Gleixner
2018-01-31 11:04                     ` Dr. David Alan Gilbert
2018-01-31 11:52                       ` Borislav Petkov
2018-01-31 12:30                         ` Dr. David Alan Gilbert
2018-01-31 13:18                           ` Borislav Petkov
2018-01-31 14:04                             ` Dr. David Alan Gilbert
2018-01-31 14:44                               ` Eduardo Habkost
2018-01-31 16:28                                 ` Borislav Petkov
2018-01-31 11:07                     ` Christophe de Dinechin
2018-01-31 15:00                     ` Eduardo Habkost
2018-01-31 15:11                     ` Arjan van de Ven
2018-01-31 10:03   ` [RFC 05/10] " Christophe de Dinechin
2018-01-20 19:22 ` [RFC 06/10] x86/speculation: Add inlines to control Indirect Branch Speculation KarimAllah Ahmed
2018-01-20 19:22 ` [RFC 07/10] x86: Simplify spectre_v2 command line parsing KarimAllah Ahmed
2018-01-20 19:22 ` [RFC 08/10] x86/idle: Control Indirect Branch Speculation in idle KarimAllah Ahmed
2018-01-20 19:23 ` [RFC 09/10] x86/enter: Create macros to restrict/unrestrict Indirect Branch Speculation KarimAllah Ahmed
2018-01-21 19:14   ` Andy Lutomirski
2018-01-23 16:12     ` Tom Lendacky
2018-01-23 16:20       ` Woodhouse, David
2018-01-23 22:37         ` Tom Lendacky
2018-01-23 22:49           ` Andi Kleen
2018-01-23 23:14             ` Woodhouse, David
2018-01-23 23:22               ` Andi Kleen
2018-01-24  0:47               ` Tim Chen
2018-01-24  1:00                 ` Andy Lutomirski
2018-01-24  1:22                   ` David Woodhouse
2018-01-24  1:59                   ` Van De Ven, Arjan
2018-01-24  3:25                     ` Andy Lutomirski [this message]
2018-01-21 19:34   ` Linus Torvalds
2018-01-21 20:28     ` David Woodhouse
2018-01-21 21:35       ` Linus Torvalds
2018-01-21 22:00         ` David Woodhouse
2018-01-21 22:27           ` Linus Torvalds
2018-01-22 16:27             ` David Woodhouse
2018-01-23  7:29               ` Ingo Molnar
2018-01-23  7:53                 ` Ingo Molnar
2018-01-23  9:27                   ` Ingo Molnar
2018-01-23  9:37                     ` David Woodhouse
2018-01-23 15:01                     ` Dave Hansen
2018-01-23  9:30                   ` David Woodhouse
2018-01-23 10:15                     ` Ingo Molnar
2018-01-23 10:27                       ` David Woodhouse
2018-01-23 10:44                         ` Ingo Molnar
2018-01-23 10:57                           ` David Woodhouse
2018-01-23 10:23                     ` Ingo Molnar
2018-01-23 10:35                       ` David Woodhouse
2018-02-04 18:43                       ` Thomas Gleixner
2018-02-04 20:22                         ` David Woodhouse
2018-02-06  9:14                         ` David Woodhouse
2018-01-25 16:19                     ` Mason
2018-01-25 17:16                       ` Greg Kroah-Hartman
2018-01-29 11:59                         ` Mason
2018-01-24  0:05                 ` Andi Kleen
2018-01-23 20:16       ` Pavel Machek
2018-01-20 19:23 ` [RFC 10/10] x86/enter: Use IBRS on syscall and interrupts KarimAllah Ahmed
2018-01-21 13:50   ` Konrad Rzeszutek Wilk
2018-01-21 14:40     ` KarimAllah Ahmed
2018-01-21 17:22     ` Dave Hansen
2018-01-21 14:02 ` [RFC 00/10] Speculation Control feature support Konrad Rzeszutek Wilk
2018-01-22 21:27   ` David Woodhouse
2018-01-22 22:15 [RFC 09/10] x86/enter: Create macros to restrict/unrestrict Indirect Branch Speculation Luke Kenneth Casson Leighton
2018-01-23 11:13 Liran Alon
2018-01-25 22:20 ` Dave Hansen
2018-01-26  2:11 Liran Alon
2018-01-26  2:23 ` Dave Hansen
2018-01-26  9:11   ` David Woodhouse
2018-01-26 17:19     ` Linus Torvalds
2018-01-26 17:27       ` Borislav Petkov
2018-01-26 17:29       ` David Woodhouse
2018-01-26 17:31         ` David Woodhouse
2018-01-26 17:59       ` Andi Kleen
2018-01-26 18:11         ` David Woodhouse
2018-01-26 18:12           ` Arjan van de Ven
2018-01-26 18:26             ` David Woodhouse
2018-01-26 18:28               ` Van De Ven, Arjan
2018-01-26 18:43                 ` David Woodhouse
2018-01-26 18:44                   ` Van De Ven, Arjan
2018-01-26 18:53                     ` David Woodhouse
2018-01-26 19:02         ` Konrad Rzeszutek Wilk
2018-01-26 19:11           ` Hansen, Dave
2018-01-27 13:42             ` Konrad Rzeszutek Wilk
2018-01-27 15:55               ` Dave Hansen
2018-01-26 19:11           ` David Woodhouse
2018-01-26  8:46 ` David Woodhouse
2018-01-26  2:50 Liran Alon
2018-01-26  2:55 ` Van De Ven, Arjan

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=BA8CD56D-CB26-415B-9ABA-6E6552900916@amacapital.net \
    --to=luto@amacapital.net \
    --cc=Janakarajan.Natarajan@amd.com \
    --cc=aarcange@redhat.com \
    --cc=ak@linux.intel.com \
    --cc=arjan.van.de.ven@intel.com \
    --cc=arjan@linux.intel.com \
    --cc=ashok.raj@intel.com \
    --cc=asit.k.mallick@intel.com \
    --cc=bp@suse.de \
    --cc=dan.j.williams@intel.com \
    --cc=dave.hansen@intel.com \
    --cc=dwmw@amazon.co.uk \
    --cc=gregkh@linuxfoundation.org \
    --cc=hpa@zytor.com \
    --cc=joro@8bytes.org \
    --cc=jun.nakajima@intel.com \
    --cc=karahmed@amazon.de \
    --cc=kvm@vger.kernel.org \
    --cc=labbott@redhat.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=luto@kernel.org \
    --cc=mhiramat@kernel.org \
    --cc=mingo@redhat.com \
    --cc=pbonzini@redhat.com \
    --cc=peterz@infradead.org \
    --cc=rkrcmar@redhat.com \
    --cc=tglx@linutronix.de \
    --cc=thomas.lendacky@amd.com \
    --cc=tim.c.chen@linux.intel.com \
    --cc=torvalds@linux-foundation.org \
    --cc=x86@kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).