Hi Peter, David, all, First a quick note on David's earlier comment, about this optimization being still up for debate. The problem with this optimization as-is is that it doesn't protect userspace-to-userspace unless applications are rebuilt and we get the infrastructure to handle that (ELF, whatever). But... On 01/21/2018 06:22 AM, Peter Zijlstra wrote: > On Sat, Jan 20, 2018 at 08:22:55PM +0100, KarimAllah Ahmed wrote: >> From: Tim Chen <tim.c.chen@xxxxxxxxxxxxxxx> >> >> Flush indirect branches when switching into a process that marked >> itself non dumpable. This protects high value processes like gpg >> better, without having too high performance overhead. > > So if I understand it right, this is only needed if the 'other' > executable itself is susceptible to spectre. If say someone audited gpg > for spectre-v1 and build it with retpoline, it would be safe to not > issue the IBPB, right? More importantly, rebuilding the world introduces a lot of challenges that need to be discussed heavily before they happen (I would like to see someone run a session at one of the various upcoming events on userspace, I've already prodded a few people to nudge that forward). In particular, we don't have the infrastructure in gcc/glibc to dynamically patch userspace call sites to enable/disable retpolines. We discussed nasty hacks last year (I even suggested an ugly kernel exported page similar to VDSO that could be implementation patched for different uarches), but the bottom line is there isn't anything in place to provide a similar userspace experience to what the kernel can do, and that would need to be solved in addition to the ELF/ABI bits. > So would it make sense to provide an ELF flag / personality thing such > that userspace can indicate its spectre-safe? > > I realize that this is all future work, because so far auditing for v1 > is a lot of pain (we need better tools), but would it be something that > makes sense in the longer term? So I would just caution that doing this isn't necessarily bad, but it's far more than just ELF bits and rebuilding. Once userspace is rebuilt with un-nopable retpolines, they're there whether you need them on $future_hardware or not, and that fancy branch predictor is useless. So we really need a way to allow for userspace patchable calls, or at least some kind of plan before everyone runs away with rebuilding. (unless they're embedded/Gentoo/whatever...have fun in that case) Jon. P.S. This is why for certain downstream distros you'll see IBPB use like prior to this patch - it'll prevent certain attacks that can't be otherwise mitigated without going and properly solving the tools issue.
