linux-kernel - Re: x86: Meltdown/Spectre

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 12 Jan 2018 16:48:14 -0600
From:   Josh Poimboeuf <jpoimboe@...hat.com>
To:     Thomas Gleixner <tglx@...utronix.de>
Cc:     LKML <linux-kernel@...r.kernel.org>,
        Linus Torvalds <torvalds@...ux-foundation.org>,
        Ingo Molnar <mingo@...nel.org>, Borislav Petkov <bp@...en8.de>,
        Peter Zijlstra <peterz@...radead.org>,
        David Woodhouse <dwmw@...zon.co.uk>,
        Arjan van de Ven <arjan@...ux.intel.com>,
        Dave Hansen <dave.hansen@...el.com>,
        Andi Kleen <ak@...ux.intel.com>,
        Tom Lendacky <thomas.lendacky@....com>,
        Tim Chen <tim.c.chen@...ux.intel.com>,
        Jiri Kosina <jikos@...nel.org>,
        Greg Kroah-Hartman <gregkh@...ux-foundation.org>,
        Paul Turner <pjt@...gle.com>
Subject: Re: x86: Meltdown/Spectre_v2 status

On Fri, Jan 12, 2018 at 10:44:48PM +0100, Thomas Gleixner wrote:
> Folks!
> 
> After 10 days of frenzy following the disclosure of the mess, I'm at a
> point where I think that the current set which we have in Linus tree and
> the pending patches in tip:x86/pti plus one not yet applied patch (RSB on
> context switch) have reached a state where the main targets are covered
> even on skylake:
> 
>   1) Meltdown is addressed
>   2) Retpoline mostly covered if we have working compilers some day 
>   3) RSB after vmexit and on context switch (pending)
> 
> plus the infrastructure and basic building blocks are in place.
> 
> That's what is going to be in 4.15 (unless Linus goes berserk on the pull
> requests)

And for those who are curious (I was) it looks like the BPF variant 1
fix has already been merged into Linus' tree.

> and next week should be focussed on eventual fallout, fixes and
> small corrections here and there. Also to spend some time on taming the
> backlog of our inboxes a bit. There is also stuff happening outside of this
> which needs our attention and care.
> 
> I want to say thanks to everyone involved and I want to apologize if I went
> overboard or offended someone in the course of the discussions.
> 
> Surely we all know there is room for improvements, but we also have reached
> a state where the remaining issues are not longer to be treated in full
> emergency and panic mode. We're good now, but not perfect.
> 
> The further RSB vs. IBRS discussion has to be settled in the way we
> normally work. We need full documentation, proper working micro code and
> actual comparisons of the two approaches vs. performance, coverage of
> attack vectors and code complexity/ugliness.
> 
> We all are exhausted and at our limits and I think we can agree that having
> the most problematic stuff covered is the right point to calm down and put
> the heads back on the chickens. Take a break and have a few drinks at least
> over the weekend!
> 
> To be honest the last 10 days were more horrible than the whole PTI work
> due to lack of documentation, 12 different opinions when asking 8 people
> (why does this have a lawyer smell?) and an amazing amount of half baken
> and hastily cobbled together crap.
> 
> Please lets stop this and return to normality now.

Amen.

Thomas, amazing job distilling some sanity out of the pandemonium.

For future patch submissions, I would ask everyone to at least add
x86@...nel.org to To: or Cc: (along with lkml).  It's not only good
etiquette to help the x86 maintainers, but it also gives those us not
directly on Cc: a way to filter the patches into our inboxes.

-- 
Josh