linux-kernel - Re: [patch V2 1/2] sysfs/cpu: Add vulnerability folder

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20180108072930.GB26761@light.dominikbrodowski.net>
Date:   Mon, 8 Jan 2018 08:29:30 +0100
From:   Dominik Brodowski <linux@...inikbrodowski.net>
To:     Thomas Gleixner <tglx@...utronix.de>
Cc:     LKML <linux-kernel@...r.kernel.org>,
        Linus Torvalds <torvalds@...uxfoundation.org>,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        Ingo Molnar <mingo@...nel.org>,
        Peter Zijlstra <peterz@...radead.org>,
        Borislav Petkov <bp@...en8.de>,
        David Woodhouse <dwmw@...zon.co.uk>,
        Dave Hansen <dave.hansen@...el.com>,
        Will Deacon <will.deacon@....com>
Subject: Re: [patch V2 1/2] sysfs/cpu: Add vulnerability folder

On Sun, Jan 07, 2018 at 10:48:00PM +0100, Thomas Gleixner wrote:
> As the meltdown/spectre problem affects several CPU architectures, it makes
> sense to have common way to express whether a system is affected by a
> particular vulnerability or not. If affected the way to express the
> mitigation should be common as well.
> 
> Create /sys/devices/system/cpu/vulnerabilities folder and files for
> meltdown, spectre_v1 and spectre_v2.
> 
> Allow architectures to override the show function.
> 
> Signed-off-by: Thomas Gleixner <tglx@...utronix.de>
> ---
>  Documentation/ABI/testing/sysfs-devices-system-cpu |   16 +++++++
>  drivers/base/Kconfig                               |    3 +
>  drivers/base/cpu.c                                 |   48 +++++++++++++++++++++
>  include/linux/cpu.h                                |    7 +++
>  4 files changed, 74 insertions(+)
> 
> --- a/Documentation/ABI/testing/sysfs-devices-system-cpu
> +++ b/Documentation/ABI/testing/sysfs-devices-system-cpu
> @@ -373,3 +373,19 @@ Contact:	Linux kernel mailing list <linu
>  Description:	information about CPUs heterogeneity.
>  
>  		cpu_capacity: capacity of cpu#.
> +
> +What:		/sys/devices/system/cpu/vulnerabilities
> +		/sys/devices/system/cpu/vulnerabilities/meltdown
> +		/sys/devices/system/cpu/vulnerabilities/spectre_v1
> +		/sys/devices/system/cpu/vulnerabilities/spectre_v2
> +Date:		Januar 2018
> +Contact:	Linux kernel mailing list <linux-kernel@...r.kernel.org>
> +Description:	Information about CPU vulnerabilities
> +
> +		The files are named after the code names of CPU
> +		vulnerabilities. The output of those files reflects the
> +		state of the CPUs in the system.

Currently, your code sets X86_BUG_SPECTRE_V[12] unconditionally on x86
CPUs. However, to my understanding some CPUs which do not execute code
out-of-order aren't affected. As it is better to err on the safe side for
now, what about adding a disclaimer at the end of this sentence, such as:

	", but may contain false positives"

Thanks,
	Dominik