lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date:   Sun, 5 Jul 2020 11:56:56 -0400
From:   Waiman Long <>
To:     Mike Rapoport <>,
        Doug Anderson <>
Cc:     Abhishek Bhardwaj <>,
        Anthony Steinhauser <>,
        LKML <>,
        Borislav Petkov <>,
        "H. Peter Anvin" <>, Ingo Molnar <>,
        Jim Mattson <>,
        Joerg Roedel <>,
        Josh Poimboeuf <>,
        Mark Gross <>,
        Paolo Bonzini <>,
        Pawan Gupta <>,
        Peter Zijlstra <>,
        Sean Christopherson <>,
        Thomas Gleixner <>,
        Tony Luck <>,
        Vitaly Kuznetsov <>,
        Wanpeng Li <>,,
        x86 <>
Subject: Re: [PATCH v3] x86/speculation/l1tf: Add KConfig for setting the L1D
 cache flush mode

On 7/5/20 11:23 AM, Mike Rapoport wrote:
>> Nothing prevents people from continuing to use the command line
>> options if they want, right?  This just allows a different default.
>> So if a distro is security focused and decided that it wanted a slower
>> / more secure default then it could ship that way but individual users
>> could still override, right?
> Well, nothing prevents you from continuing to use the command line as
> well;-)
> I can see why whould you want an ability to select compile time default
> for an option, but I'm really not thrilled by the added ifdefery.

It turns out that CONFIG_KVM_VMENTRY_L1D_FLUSH values match the enum 
vmx_l1d_flush_state values. So one way to reduce the ifdefery is to do, 
for example,

-enum vmx_l1d_flush_state l1tf_vmx_mitigation = VMENTER_L1D_FLUSH_AUTO;
+enum vmx_l1d_flush_state l1tf_vmx_mitigation = VMENTER_L1D_FLUSH_DEFAULT;

Of course, we may need to add a comment on enum vmx_l1d_flush_state 
definition to highlight the dependency of CONFIG_KVM_VMENTRY_L1D_FLUSH 
on it to avoid future mismatch.


Powered by blists - more mailing lists