linux-kernel - Re: [PATCH v2] Documentation/x86: Add documentation for /proc/cpuinfo feature flags

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <b171209faab7e141a9988ecf47fa55bf855cb664.camel@intel.com>
Date:   Fri, 28 Aug 2020 15:30:32 -0700
From:   Kyung Min Park <kyung.min.park@...el.com>
To:     Borislav Petkov <bp@...en8.de>
Cc:     x86@...nel.org, linux-kernel@...r.kernel.org, tglx@...utronix.de,
        tony.luck@...el.com, dave.hansen@...el.com, ricardo.neri@...el.com,
        hpa@...or.com, gregkh@...uxfoundation.org, ak@...ux.intel.com,
        ravi.v.shankar@...el.com,
        Ricardo Neri <ricardo.neri-calderon@...ux.intel.com>
Subject: Re: [PATCH v2] Documentation/x86: Add documentation for
 /proc/cpuinfo feature flags

Hi Boris,

On Fri, 2020-08-28 at 20:42 +0200, Borislav Petkov wrote:
> On Mon, Aug 24, 2020 at 11:04:12AM -0700, Kyung Min Park wrote:
> > +If the expected flag does not appear in /proc/cpuinfo, things are
> > murkier.
> > +Users need to find out the reason why the flag is missing and find
> > the way
> > +how to enable it, which is not always easy. There are several
> > factors that
> > +can explain missing flags: the expected feature failed to enable,
> > the feature
> > +is missing in hardware, platform firmware did not enable it, the
> > feature is
> > +disabled at build or run time, an old kernel is in use, or the
> > kernel does
> > +not support the feature and thus has not enabled it. In general,
> > /proc/cpuinfo
> > +shows features which the kernel supports.
> > +
> > +For a full list of CPUID flags which the CPU supports, the users
> > may use
> > +tools like http://www.etallen.com/cpuid.html (which is not updated
> > with
> > +kernel releases) or other custom tools that read CPUID.
> 
> I guess this should talk only about our own kcpuid tool since we
> wanna
> do that now, right?

Should I mention the tool specifically although the tool is WIP? As you
commented previously, should I use tools/arch/x86/tools/cpuid/cpuid as
the future tool and its location?

Or do you want it to be mentioned in the future tense without
specifying the tool name and location?

> 
> ...
> 
> > +c: The kernel disabled support for it at compile-time.
> > +------------------------------------------------------
> > +For example, if 5-level-paging is not enabled when building (i.e.,
> > +CONFIG_X86_5LEVEL is not selected) the flag "la57" will not show
> > up [#f1]_.
> > +Even though the feature will still be detected via CPUID, the
> > kernel disables
> > +it via cleared by setup_clear_cpu_cap(X86_FEATURE_LA57).
> 
> "... disables it by clearing... "

Sure, let me fix it.

> 
> > +d: The feature is disabled at boot-time.
> > +----------------------------------------
> > +A feature can be disabled either using a command-line parameter or
> > because
> > +it failed to be enabled. The command-line parameter clearcpuid=
> > can be used
> > +to disable features using the feature number as defined in
> > +/arch/x86/include/asm/cpufeatures.h. For instance, User Mode
> > Instruction
> > +Protection can be disabled using clearcpuid=514. The number 514 is
> > calculated
> > +from #define X86_FEATURE_UMIP (16*32 + 2).
> > +
> > +In addition, there exists a variety of custom command-line
> > parameters that
> > +disable specific features. The list of parameters includes, but is
> > not limited
> > +to, no5lvl, nosmap, and nosmep.
> 
> You already give the separate example for "no5lvl" below so use
> something else
> above, say, "nofsgsbase", for example.

You're right. Let me change it.

> 
> > 5-level paging can also be disabled using
> > +"no5lvl". SMAP and SMEP are disabled with the aforementioned
> > parameters,
> > +respectively.
> > +
> > +e: The feature was known to be non-functional.
> > +----------------------------------------------
> > +The feature was known to be non-functional because a dependency
> > was
> > +missing at runtime. For example, AVX flags will not show up if
> > XSAVE feature
> > +is disabled since they depend on XSAVE feature.
> 
> Another example would be: broken CPUs and them missing microcode
> patches
> and due to that the kernel deciding not to enable a feature.

Thank you for the comment. I'll add that too.

> 
> But yap, all in all looks like a good idea. I'll take the next
> version
> after you've fixed those nitpicks.
> 
> Thx.

Thanks Boris!