Re: [Patch v6 14/16] x86/speculation: Use STIBP to restrict speculation on non-dumpable task

[Linus Torvalds]

On Tue, Nov 20, 2018 at 4:33 PM Tim Chen <tim.c.chen@xxxxxxxxxxxxxxx> wrote:
>
> Implements arch_update_spec_restriction() for x86.  Use STIBP to
> restrict speculative execution when running a task set to non-dumpable,
> or clear the restriction if the task is set to dumpable.

I don't think this necessarily makes sense.

The new "auto" behavior is that we aim to restrict untrusted code (and
the loader of such code uses prctrl to set that flag), then this whole
"set STIBP for non-dumpable" makes little sense.

A non-dumpable app by definition is *more* trusted, not less trusted.

So this model of "let's disable prediction for system processes" not
only doesn't make sense, but it also unnecessarily penalizes those
potentially very important system processes.

Also, "dumpable" in general is pretty oddly defined to be used for this.

The same (privileged) process can be dumpable or not depending on how
it was started (ie if it was started by a regular user and became
trusted through suid, it's not dumpable, but if it was started from a
root process it remains dumpable.

So I'm just not convinced "dumpability" is meaningful for STIBP.

                  Linus