On 01/20/2018 01:06 PM, Woodhouse, David wrote: > On Sat, 2018-01-20 at 20:22 +0100, KarimAllah Ahmed wrote: >> From: Tim Chen <tim.c.chen@xxxxxxxxxxxxxxx> > > I think this is probably From: Andi now rather than From: Tim? This change is from Andi. >> 1 file changed, 12 insertions(+), 1 deletion(-) >> >> diff --git a/arch/x86/mm/tlb.c b/arch/x86/mm/tlb.c >> index 304de7d..f64e80c 100644 >> --- a/arch/x86/mm/tlb.c >> +++ b/arch/x86/mm/tlb.c >> @@ -225,8 +225,19 @@ void switch_mm_irqs_off(struct mm_struct *prev, struct mm_struct *next, >> * Avoid user/user BTB poisoning by flushing the branch predictor >> * when switching between processes. This stops one process from >> * doing Spectre-v2 attacks on another. >> + * >> + * As an optimization: Flush indirect branches only when >> + * switching into processes that disable dumping. >> + * >> + * This will not flush when switching into kernel threads. >> + * But it would flush when switching into idle and back >> + * >> + * It might be useful to have a one-off cache here >> + * to also not flush the idle case, but we would need some >> + * kind of stable sequence number to remember the previous mm. >> */ >> - indirect_branch_prediction_barrier(); >> + if (tsk && tsk->mm && get_dumpable(tsk->mm) != SUID_DUMP_USER) >> + indirect_branch_prediction_barrier(); We could move this close to the cr3 write. The cr3 write provides barrier against unwanted speculation in the above if check. Tim
