linux-kernel - Re: [patch V2 1/2] sysfs/cpu: Add vulnerability folder

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Mon, 8 Jan 2018 21:04:32 +0300
From:   Alexey Dobriyan <adobriyan@...il.com>
To:     Alan Cox <gnomes@...rguk.ukuu.org.uk>
Cc:     Konrad Rzeszutek Wilk <konrad@...nel.org>, tglx@...utronix.de,
        linux-kernel@...r.kernel.org
Subject: Re: [patch V2 1/2] sysfs/cpu: Add vulnerability folder

On Mon, Jan 08, 2018 at 11:54:54AM +0000, Alan Cox wrote:
> On Mon, 8 Jan 2018 08:35:14 +0300
> Alexey Dobriyan <adobriyan@...il.com> wrote:
> 
> > On Sun, Jan 07, 2018 at 10:50:58PM -0500, Konrad Rzeszutek Wilk wrote:
> > > On Mon, Jan 08, 2018 at 01:22:04AM +0300, Alexey Dobriyan wrote:  
> > > > Thomas Gleixner wrote:  
> > > > > Create /sys/devices/system/cpu/vulnerabilities folder and files for
> > > > > meltdown, spectre_v1 and spectre_v2.  
> > > > 
> > > > It is called "grep -e '^bugs' /proc/cpuinfo".
> > > > 
> > > > kpti is deduceable from .config and /proc/cmdline .
> > > > If people don't know what .config they are running, god bless them.  
> > > 
> > > It is not just for meltdown (kpti). You also have retpoline and IBRS
> > > which is for spectre.  
> > 
> > If you, as kernel developer, are sure that bug is properly mitigated
> > to the best of your knowledge then clear the bit from the bug mask.
> 
> It's probably useful to have the mitigation status somewhere because that
> is what most people will care about. Both pieces of information are
> needed though.

Then proper way for mainline is Documentation/.

Kernel doesn't announce many things such as ASLR, it simply enables it
by default.

Real checks are done by disassembly and verifying that generated
code does what's necessary anyway. But dumbed down version doesn't need
runtime file in sysfs, internet page somewhere (kernel.org gitweb
interface) should be enough.