linux-kernel - Re: [PATCH] x86/cpufeatures: Cleanup AMD speculation feature bits

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 26 Jan 2018 21:59:44 +0000
From:   David Woodhouse <dwmw2@...radead.org>
To:     Borislav Petkov <bp@...en8.de>,
        Tom Lendacky <thomas.lendacky@....com>
Cc:     x86-ml <x86@...nel.org>, linux-tip-commits@...r.kernel.org,
        hpa@...or.com, gregkh@...uxfoundation.org, tglx@...utronix.de,
        linux-kernel@...r.kernel.org, mingo@...nel.org
Subject: Re: [PATCH] x86/cpufeatures: Cleanup AMD speculation feature bits

On Fri, 2018-01-26 at 22:52 +0100, Borislav Petkov wrote:
> On Fri, Jan 26, 2018 at 03:06:20PM -0600, Tom Lendacky wrote:
> > 
> > So I like the idea of AMD_IBRS/AMD_IBPB/AMD_STIBP and then use the magic
> > quotes as appropriate.  We could probably use the magic quotes on
> > AMD_STIBP and set X86_FEATURE_STIBP when we see X86_FEATURE_AMD_STIBP.
> Like this?
> 
> We set the respective Intel features when we detect the AMD ones so that
> we get correct /proc/cpuinfo strings. The respective AMD ones are not
> shown.
> 
> +
> +	if (cpu_has(c, X86_FEATURE_AMD_IBRS))
> +		set_cpu_cap(c, X86_FEATURE_IBRS);

No, there is no X86_FEATURE_IBRS; that was going to be the "we are
using IBRS" soft feature, analogous to X86_FEATURE_RETPOLINE and
X86_FEATURE_IBPB, actually used for the alternatives.

Intel doesn't *have* a feature bit for only IBRS. They have the bit
which indicates that *both* the SPEC_CTRL (with IBRS) and PRED_CMD
(with IBPB) registers are present.

If we wanted to do this kind of thing, we'd do it the other way round.
Turn the *Intel* feature into both 'IBRS' and 'IBPB' CPU-visible
features, and have those defined in the AMD word. Then use virtual bits
with "" for the software features, since we don't want *those* to
appear in /proc/cpuinfo.

I'll take a look at this in the morning.

Download attachment "smime.p7s" of type "application/x-pkcs7-signature" (5213 bytes)