linux-kernel - Re: [PATCH v2] Documentation/x86: Add documentation for /proc/cpuinfo feature flags

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20200828184209.GC19342@zn.tnic>
Date:   Fri, 28 Aug 2020 20:42:09 +0200
From:   Borislav Petkov <bp@...en8.de>
To:     Kyung Min Park <kyung.min.park@...el.com>
Cc:     x86@...nel.org, linux-kernel@...r.kernel.org, tglx@...utronix.de,
        tony.luck@...el.com, dave.hansen@...el.com, ricardo.neri@...el.com,
        hpa@...or.com, gregkh@...uxfoundation.org, ak@...ux.intel.com,
        ravi.v.shankar@...el.com,
        Ricardo Neri <ricardo.neri-calderon@...ux.intel.com>
Subject: Re: [PATCH v2] Documentation/x86: Add documentation for
 /proc/cpuinfo feature flags

On Mon, Aug 24, 2020 at 11:04:12AM -0700, Kyung Min Park wrote:
> +If the expected flag does not appear in /proc/cpuinfo, things are murkier.
> +Users need to find out the reason why the flag is missing and find the way
> +how to enable it, which is not always easy. There are several factors that
> +can explain missing flags: the expected feature failed to enable, the feature
> +is missing in hardware, platform firmware did not enable it, the feature is
> +disabled at build or run time, an old kernel is in use, or the kernel does
> +not support the feature and thus has not enabled it. In general, /proc/cpuinfo
> +shows features which the kernel supports.
> +
> +For a full list of CPUID flags which the CPU supports, the users may use
> +tools like http://www.etallen.com/cpuid.html (which is not updated with
> +kernel releases) or other custom tools that read CPUID.

I guess this should talk only about our own kcpuid tool since we wanna
do that now, right?

...

> +c: The kernel disabled support for it at compile-time.
> +------------------------------------------------------
> +For example, if 5-level-paging is not enabled when building (i.e.,
> +CONFIG_X86_5LEVEL is not selected) the flag "la57" will not show up [#f1]_.
> +Even though the feature will still be detected via CPUID, the kernel disables
> +it via cleared by setup_clear_cpu_cap(X86_FEATURE_LA57).

"... disables it by clearing... "

> +d: The feature is disabled at boot-time.
> +----------------------------------------
> +A feature can be disabled either using a command-line parameter or because
> +it failed to be enabled. The command-line parameter clearcpuid= can be used
> +to disable features using the feature number as defined in
> +/arch/x86/include/asm/cpufeatures.h. For instance, User Mode Instruction
> +Protection can be disabled using clearcpuid=514. The number 514 is calculated
> +from #define X86_FEATURE_UMIP (16*32 + 2).
> +
> +In addition, there exists a variety of custom command-line parameters that
> +disable specific features. The list of parameters includes, but is not limited
> +to, no5lvl, nosmap, and nosmep.

You already give the separate example for "no5lvl" below so use something else
above, say, "nofsgsbase", for example.

> 5-level paging can also be disabled using
> +"no5lvl". SMAP and SMEP are disabled with the aforementioned parameters,
> +respectively.
> +
> +e: The feature was known to be non-functional.
> +----------------------------------------------
> +The feature was known to be non-functional because a dependency was
> +missing at runtime. For example, AVX flags will not show up if XSAVE feature
> +is disabled since they depend on XSAVE feature.

Another example would be: broken CPUs and them missing microcode patches
and due to that the kernel deciding not to enable a feature.

But yap, all in all looks like a good idea. I'll take the next version
after you've fixed those nitpicks.

Thx.

-- 
Regards/Gruss,
    Boris.

https://people.kernel.org/tglx/notes-about-netiquette