linux-kernel - Re: [PATCH 6/7] x86/spec_ctrl: Add sysctl knobs to enable/disable SPEC

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1515151008.29312.116.camel@infradead.org>
Date:   Fri, 05 Jan 2018 11:16:48 +0000
From:   David Woodhouse <dwmw2@...radead.org>
To:     Tim Chen <tim.c.chen@...ux.intel.com>,
        Thomas Gleixner <tglx@...utronix.de>,
        Andy Lutomirski <luto@...nel.org>,
        Linus Torvalds <torvalds@...ux-foundation.org>,
        Greg KH <gregkh@...uxfoundation.org>
Cc:     Dave Hansen <dave.hansen@...el.com>,
        Andrea Arcangeli <aarcange@...hat.com>,
        Andi Kleen <ak@...ux.intel.com>,
        Arjan Van De Ven <arjan.van.de.ven@...el.com>,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH 6/7] x86/spec_ctrl: Add sysctl knobs to enable/disable
 SPEC_CTRL feature

On Thu, 2018-01-04 at 09:56 -0800, Tim Chen wrote:
> 
> +       mutex_lock(&spec_ctrl_mutex);
> +
> +       if (enable == IBRS_DISABLED) {
> +               /* disable IBRS usage */
> +               set_ibrs_disabled();
> +               if (spec_ctrl_ibrs & SPEC_CTRL_IBRS_SUPPORTED)
> +                       spec_ctrl_flush_all_cpus(MSR_IA32_SPEC_CTRL, SPEC_CTRL_FEATURE_DISABLE_IBRS);
> +       } else if (enable == IBRS_ENABLED) {
> +               /* enable IBRS usage in kernel */
> +               clear_ibrs_disabled();
> +               if (spec_ctrl_ibrs & SPEC_CTRL_IBRS_SUPPORTED)
> +                       set_ibrs_inuse();
> +               else
> +                       /* Platform don't support IBRS */
> +                       enable = IBRS_DISABLED;
> +       } else if (enable == IBRS_ENABLED_USER) {
> +               /* enable IBRS usage in both userspace and kernel */
> +               clear_ibrs_disabled();
> +               /* don't change IBRS value once we set it to always on */
> +               clear_ibrs_inuse();
> +               if (spec_ctrl_ibrs & SPEC_CTRL_IBRS_SUPPORTED)
> +                       spec_ctrl_flush_all_cpus(MSR_IA32_SPEC_CTRL, SPEC_CTRL_FEATURE_ENABLE_IBRS);
> +               else
> +                       /* Platform don't support IBRS */
> +                       enable = IBRS_DISABLED;
> +       }

This doesn't take the retpoline status into account. If we have
retpoline, we don't need IBRS in the kernel.
Download attachment "smime.p7s" of type "application/x-pkcs7-signature" (5213 bytes)