linux-kernel - Re: [PATCH] clarify how insecure CPU is

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Sun, 4 Mar 2018 10:29:18 +0100
From:   Borislav Petkov <bp@...e.de>
To:     Pavel Machek <pavel@....cz>
Cc:     Thomas Gleixner <tglx@...utronix.de>, linux-kernel@...r.kernel.org,
        r.marek@...embler.cz, ricardo.neri-calderon@...ux.intel.com,
        rkrcmar@...hat.com, Janakarajan.Natarajan@....com, x86@...nel.org,
        hpa@...or.com, mingo@...hat.com,
        Linus Torvalds <torvalds@...ux-foundation.org>
Subject: Re: [PATCH] clarify how insecure CPU is

On Sun, Mar 04, 2018 at 09:51:59AM +0100, Pavel Machek wrote:
> diff --git a/arch/x86/include/asm/cpufeatures.h b/arch/x86/include/asm/cpufeatures.h
> index f41079d..4901742 100644
> --- a/arch/x86/include/asm/cpufeatures.h
> +++ b/arch/x86/include/asm/cpufeatures.h
> @@ -341,7 +341,7 @@
>  #define X86_BUG_FDIV			X86_BUG(1) /* FPU FDIV */
>  #define X86_BUG_COMA			X86_BUG(2) /* Cyrix 6x86 coma */
>  #define X86_BUG_AMD_TLB_MMATCH		X86_BUG(3) /* "tlb_mmatch" AMD Erratum 383 */
> -#define X86_BUG_AMD_APIC_C1E		X86_BUG(4) /* "apic_c1e" AMD Erratum 400 */
> +#define X86_BUG_AMD_APIC_C1E		X86_BUG(4) /* System is affected AMD Erratum 400, special idle routine is needed */
>  #define X86_BUG_11AP			X86_BUG(5) /* Bad local APIC aka 11AP */
>  #define X86_BUG_FXSAVE_LEAK		X86_BUG(6) /* FXSAVE leaks FOP/FIP/FOP */
>  #define X86_BUG_CLFLUSH_MONITOR		X86_BUG(7) /* AAI65, CLFLUSH required before MONITOR */
> @@ -356,7 +356,7 @@
>  #define X86_BUG_NULL_SEG		X86_BUG(10) /* Nulling a selector preserves the base */
>  #define X86_BUG_SWAPGS_FENCE		X86_BUG(11) /* SWAPGS without input dep on GS */
>  #define X86_BUG_MONITOR			X86_BUG(12) /* IPI required to wake up remote CPU */
> -#define X86_BUG_AMD_E400		X86_BUG(13) /* CPU is among the affected by Erratum 400 */
> +#define X86_BUG_AMD_E400		X86_BUG(13) /* System may be affected by Erratum 400, X86_BUG_AMD_APIC_C1E might be needed  */

Not "might be needed" - "X86_BUG_AMD_APIC_C1E will be set if platform is
affected".

And then you don't need the above comment change. And you can't remove
"apic_c1e" there because it is magical.

-- 
Regards/Gruss,
    Boris.

SUSE Linux GmbH, GF: Felix Imendörffer, Jane Smithard, Graham Norton, HRB 21284 (AG Nürnberg)
--