linux-kernel - Re: [PATCH] x86: Kill some chicken bits

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <90D1893E-1143-4B81-B849-74EB8B27574F@zytor.com>
Date:	Tue, 20 Oct 2015 09:58:18 -0700
From:	"H. Peter Anvin" <hpa@...or.com>
To:	Borislav Petkov <bp@...en8.de>
CC:	X86 ML <x86@...nel.org>, LKML <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] x86: Kill some chicken bits

On October 20, 2015 9:33:30 AM PDT, Borislav Petkov <bp@...en8.de> wrote:
>From: Borislav Petkov <bp@...e.de>
>
>Those were added as, well, chicken bits in case some of those features
>are b0rked and as a way for us to "chicken" out and disable them.
>Remove
>those chicken bits now, as they're not needed anymore.
>
>Requested-by: "H. Peter Anvin" <hpa@...or.com>
>Signed-off-by: Borislav Petkov <bp@...e.de>
>---
> Documentation/kernel-parameters.txt | 10 ----------
> arch/x86/kernel/cpu/common.c        | 22 ----------------------
> 2 files changed, 32 deletions(-)
>
>diff --git a/Documentation/kernel-parameters.txt
>b/Documentation/kernel-parameters.txt
>index 22a4b687ea5b..0448d63e3269 100644
>--- a/Documentation/kernel-parameters.txt
>+++ b/Documentation/kernel-parameters.txt
>@@ -2362,8 +2362,6 @@ bytes respectively. Such letter suffixes can also
>be entirely omitted.
> 
> 	nocache		[ARM]
> 
>-	noclflush	[BUGS=X86] Don't use the CLFLUSH instruction
>-
> 	nodelayacct	[KNL] Disable per-task delay accounting
> 
> 	nodisconnect	[HW,SCSI,M68K] Disables SCSI disconnects.
>@@ -2379,14 +2377,6 @@ bytes respectively. Such letter suffixes can
>also be entirely omitted.
> 			noexec=on: enable non-executable mappings (default)
> 			noexec=off: disable non-executable mappings
> 
>-	nosmap		[X86]
>-			Disable SMAP (Supervisor Mode Access Prevention)
>-			even if it is supported by processor.
>-
>-	nosmep		[X86]
>-			Disable SMEP (Supervisor Mode Execution Prevention)
>-			even if it is supported by processor.
>-
> 	noexec32	[X86-64]
> 			This affects only 32-bit executables.
> 			noexec32=on: enable non-executable mappings (default)
>diff --git a/arch/x86/kernel/cpu/common.c
>b/arch/x86/kernel/cpu/common.c
>index de22ea7ff82f..610c84379d87 100644
>--- a/arch/x86/kernel/cpu/common.c
>+++ b/arch/x86/kernel/cpu/common.c
>@@ -251,26 +251,12 @@ static inline void
>squash_the_stupid_serial_number(struct cpuinfo_x86 *c)
> }
> #endif
> 
>-static __init int setup_disable_smep(char *arg)
>-{
>-	setup_clear_cpu_cap(X86_FEATURE_SMEP);
>-	return 1;
>-}
>-__setup("nosmep", setup_disable_smep);
>-
> static __always_inline void setup_smep(struct cpuinfo_x86 *c)
> {
> 	if (cpu_has(c, X86_FEATURE_SMEP))
> 		cr4_set_bits(X86_CR4_SMEP);
> }
> 
>-static __init int setup_disable_smap(char *arg)
>-{
>-	setup_clear_cpu_cap(X86_FEATURE_SMAP);
>-	return 1;
>-}
>-__setup("nosmap", setup_disable_smap);
>-
> static __always_inline void setup_smap(struct cpuinfo_x86 *c)
> {
> 	unsigned long eflags;
>@@ -1083,14 +1069,6 @@ static __init int setup_show_msr(char *arg)
> }
> __setup("show_msr=", setup_show_msr);
> 
>-static __init int setup_noclflush(char *arg)
>-{
>-	setup_clear_cpu_cap(X86_FEATURE_CLFLUSH);
>-	setup_clear_cpu_cap(X86_FEATURE_CLFLUSHOPT);
>-	return 1;
>-}
>-__setup("noclflush", setup_noclflush);
>-
> void print_cpu_info(struct cpuinfo_x86 *c)
> {
> 	const char *vendor = NULL;

I would like to keep nosmap until SMAP hardware is more ubiquitous since SMAP is vulnerable to kernel bugs.  We have already had a case where a maintainer pushed "cleanup" code straight to Linus, bypassing the x86 maintainers, which broke booting on SMAP hardware.
-- 
Sent from my Android device with K-9 Mail. Please excuse my brevity.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/