linux-kernel - Re: [Patch v5 11/16] x86/speculation: Add Spectre v2 app to app protection modes

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 19 Nov 2018 17:14:11 -0800
From:   Tim Chen <tim.c.chen@...ux.intel.com>
To:     Thomas Gleixner <tglx@...utronix.de>
Cc:     Jiri Kosina <jikos@...nel.org>,
        Tom Lendacky <thomas.lendacky@....com>,
        Ingo Molnar <mingo@...hat.com>,
        Peter Zijlstra <peterz@...radead.org>,
        Josh Poimboeuf <jpoimboe@...hat.com>,
        Andrea Arcangeli <aarcange@...hat.com>,
        David Woodhouse <dwmw@...zon.co.uk>,
        Andi Kleen <ak@...ux.intel.com>,
        Dave Hansen <dave.hansen@...el.com>,
        Casey Schaufler <casey.schaufler@...el.com>,
        Asit Mallick <asit.k.mallick@...el.com>,
        Arjan van de Ven <arjan@...ux.intel.com>,
        Jon Masters <jcm@...hat.com>,
        Waiman Long <longman9394@...il.com>,
        linux-kernel@...r.kernel.org, x86@...nel.org
Subject: Re: [Patch v5 11/16] x86/speculation: Add Spectre v2 app to app
 protection modes

On 11/19/2018 04:30 PM, Thomas Gleixner wrote:
> 
> What has spectre_v2=on to do with spectre_v2_app2app=on?
> 
> Exactly nothing. You can have 'on' for both. The only side effect of
> spectre_v2=on is that it also forces spectre_v2_app2app to 'on'
> irrespective of what eventually was added for spectre_v2_app2app= on the
> command line.
> 
>> What will you like to name the "lite" and "strict" option instead?
> 
> 'prctl' and 'on' and if we add 'seccomp' then this is exactly the same as
> we have for ssbd.
> 
>>> Can we please have a full documentation for all the spectre_v2 stuff
>>> similar to l1tf?
>>>
>> Sure.  Can we do that as a separate patch?  I'll need some time 
>> and internal review for any spectre_v2 documentation that's produced.
> 
> I'm not taking that stuff without proper documentation. I complained about
> that vs. L1TF and got told that no sysadmin cares, but L1TF has shown that
> they care very much and appreciate proper documentation.
> 
> Nobody can oracle the protection scope out of that inconsistent command
> line maze.
> 

Thomas,

I'm not a good writer and it will take me some time to have the documentation
and boot options code ironed out.  In the mean time, will it make sense
to revert Jiri's patchset, till we have this patchset and associated
documentation updated to everyone's liking?

Thanks.

Tim