Return-path: Received: from foss.arm.com ([217.140.101.70]:55256 "EHLO foss.arm.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1756245AbeARNSc (ORCPT ); Thu, 18 Jan 2018 08:18:32 -0500 Date: Thu, 18 Jan 2018 13:18:37 +0000 From: Will Deacon To: Dan Williams Cc: Linus Torvalds , Linux Kernel Mailing List , Mark Rutland , kernel-hardening@lists.openwall.com, Peter Zijlstra , Alan Cox , Alexei Starovoitov , Solomon Peachy , "H. Peter Anvin" , Christian Lamparter , Elena Reshetova , linux-arch@vger.kernel.org, Andi Kleen , "James E.J. Bottomley" , Linux SCSI List , Jonathan Corbet , the arch/x86 maintainers , Russell King , Ingo Molnar , Catalin Marinas , Alexey Kuznetsov , Linux Media Mailing List , Tom Lendacky , Kees Cook , Jan Kara , Al Viro , qla2xxx-upstream@qlogic.com, Thomas Gleixner , Mauro Carvalho Chehab , Kalle Valo , Alan Cox , "Martin K. Petersen" , Hideaki YOSHIFUJI , Greg KH , Linux Wireless List , "Eric W. Biederman" , Network Development , Andrew Morton , "David S. Miller" , Laurent Pinchart Subject: Re: [PATCH v2 00/19] prevent bounds-check bypass via speculative execution Message-ID: <20180118131837.GA20783@arm.com> (sfid-20180118_141932_798911_D52900C0) References: <151571798296.27429.7166552848688034184.stgit@dwillia2-desk3.amr.corp.intel.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii In-Reply-To: Sender: linux-wireless-owner@vger.kernel.org List-ID: Hi Dan, Linus, On Thu, Jan 11, 2018 at 05:41:08PM -0800, Dan Williams wrote: > On Thu, Jan 11, 2018 at 5:19 PM, Linus Torvalds > wrote: > > On Thu, Jan 11, 2018 at 4:46 PM, Dan Williams wrote: > >> > >> This series incorporates Mark Rutland's latest ARM changes and adds > >> the x86 specific implementation of 'ifence_array_ptr'. That ifence > >> based approach is provided as an opt-in fallback, but the default > >> mitigation, '__array_ptr', uses a 'mask' approach that removes > >> conditional branches instructions, and otherwise aims to redirect > >> speculation to use a NULL pointer rather than a user controlled value. > > > > Do you have any performance numbers and perhaps example code > > generation? Is this noticeable? Are there any microbenchmarks showing > > the difference between lfence use and the masking model? > > I don't have performance numbers, but here's a sample code generation > from __fcheck_files, where the 'and; lea; and' sequence is portion of > array_ptr() after the mask generation with 'sbb'. > > fdp = array_ptr(fdt->fd, fd, fdt->max_fds); > 8e7: 8b 02 mov (%rdx),%eax > 8e9: 48 39 c7 cmp %rax,%rdi > 8ec: 48 19 c9 sbb %rcx,%rcx > 8ef: 48 8b 42 08 mov 0x8(%rdx),%rax > 8f3: 48 89 fe mov %rdi,%rsi > 8f6: 48 21 ce and %rcx,%rsi > 8f9: 48 8d 04 f0 lea (%rax,%rsi,8),%rax > 8fd: 48 21 c8 and %rcx,%rax > > > > Having both seems good for testing, but wouldn't we want to pick one in the end? > > I was thinking we'd keep it as a 'just in case' sort of thing, at > least until the 'probably safe' assumption of the 'mask' approach has > more time to settle out. >From the arm64 side, the only concern I have (and this actually applies to our CSDB sequence as well) is the calculation of the array size by the caller. As Linus mentioned at the end of [1], if the determination of the size argument is based on a conditional branch, then masking doesn't help because you bound within the wrong range under speculation. We ran into this when trying to use masking to protect our uaccess routines where the conditional bound is either KERNEL_DS or USER_DS. It's possible that a prior conditional set_fs(KERNEL_DS) could defeat the masking and so we'd need to throw some heavy barriers in set_fs to make it robust. The question then is whether or not we're likely to run into this elsewhere, and I don't have a good feel for that. Will [1] http://lkml.kernel.org/r/CA+55aFz0tsreoa=5Ud2noFCpng-dizLBhT9WU9asyhpLfjdcYA@mail.gmail.com