On Mon, Sep 29, 2014 at 09:39:16AM -0700, Andy Lutomirski wrote: > I was surprised to notice that, by default, every task has permission > to use rdpmc.
Right, we figured the paranoid would poke at /sys/bus/event_source/devices/cpu/rdpmc. > seccomp cannot work around this. I know nothing much about seccomp. > This leaks information, although the information leaked is of dubious > and variable value to an attacker. It also renders the PR_TSC_SEGV > mechanism mostly useless. I'm not seeing how, there's no saying what will run on those counters, let alone if its correlated to the TSC. But yes I appreciate the argument. > Would it make sense to restrict rdpmc to tasks that are in mms that > have a perf_event mapping? We could, > After all, unless I misunderstand > something, user code can't reliably use rdpmc unless they've mapped a > perf_event object to check the rdpmc bit and figure out what ecx value > to use. correct, > I think that this could be implemented with very little overhead, > especially if combined with the existing CR4_TSD code and if that code > were taught to avoid reading cr4. but there's a definite cost to having to write cr4 on every context switch. It would be better if we could put it under TIF_NOTSC or something similar and only be effective when something like seccomp or other thingy is present and enabled. We should definitely avoid a double cr4 write in case of both rdpmc and tsc switch. -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
