linux-kernel - Re: [PATCH] x86/cpufeatures: Cleanup AMD speculation feature bits

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <2cea933f-7e06-26d5-95cf-41df8308a0f8@amd.com>
Date:   Fri, 26 Jan 2018 17:14:42 -0600
From:   Tom Lendacky <thomas.lendacky@....com>
To:     Borislav Petkov <bp@...en8.de>,
        David Woodhouse <dwmw2@...radead.org>
Cc:     x86-ml <x86@...nel.org>, linux-tip-commits@...r.kernel.org,
        hpa@...or.com, gregkh@...uxfoundation.org, tglx@...utronix.de,
        linux-kernel@...r.kernel.org, mingo@...nel.org
Subject: Re: [PATCH] x86/cpufeatures: Cleanup AMD speculation feature bits

On 1/26/2018 4:10 PM, Borislav Petkov wrote:
> On Fri, Jan 26, 2018 at 09:59:44PM +0000, David Woodhouse wrote:
>> If we wanted to do this kind of thing, we'd do it the other way round.
>> Turn the *Intel* feature into both 'IBRS' and 'IBPB' CPU-visible
>> features, and have those defined in the AMD word.
> 
> You lost me here: have those defined in the AMD word?
> 
>> Then use virtual bits with "" for the software features, since we
>> don't want *those* to appear in /proc/cpuinfo.
> 
> Whatever we do, I think it would be most consistent to have three
> strings, *both* on Intel and AMD visible in cpuinfo: "ibrs", "ibpb" and
> "stibp" so that there's no confusion what is enabled on each box.
> 
> Now, those three can be the *virtual* features which get set by the
> actual CPUID features on init. And the latter, the *actual* CPUID
> features don't need to be visible in cpuinfo: people shouldn't care
> whether "spec_ctrl" on Intel and "pred_cmd" on AMD both mean "ibpb". It
> should be simply "ibpb" on both vendors in cpuinfo.
> 
> Ditto for the others.
> 
> This way you have one unified message of what is enabled on *any* box.

That sounds good to me.

Thanks,
Tom

>