linux-kernel - Re: [RESEND RFC PATCH] x86/bugs: Add "unknown" reporting for MMIO Stale Data

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <YuRDbuQPYiYBZghm@zn.tnic>
Date:   Fri, 29 Jul 2022 22:30:38 +0200
From:   Borislav Petkov <bp@...en8.de>
To:     Pawan Gupta <pawan.kumar.gupta@...ux.intel.com>
Cc:     Jonathan Corbet <corbet@....net>,
        Thomas Gleixner <tglx@...utronix.de>,
        Ingo Molnar <mingo@...hat.com>,
        Dave Hansen <dave.hansen@...ux.intel.com>, x86@...nel.org,
        "H. Peter Anvin" <hpa@...or.com>, linux-doc@...r.kernel.org,
        linux-kernel@...r.kernel.org, stable@...r.kernel.org,
        tony.luck@...el.com, antonio.gomez.iglesias@...ux.intel.com,
        Daniel Sneddon <daniel.sneddon@...ux.intel.com>,
        andrew.cooper3@...rix.com, Josh Poimboeuf <jpoimboe@...nel.org>
Subject: Re: [RESEND RFC PATCH] x86/bugs: Add "unknown" reporting for MMIO
 Stale Data

On Fri, Jul 29, 2022 at 10:36:09AM -0700, Pawan Gupta wrote:
> Does this look okay:
> 
> -       if (cpu_matches(cpu_vuln_blacklist, MMIO) &&
> -           !arch_cap_mmio_immune(ia32_cap))
> -               setup_force_cpu_bug(X86_BUG_MMIO_STALE_DATA);
> +       if (!boot_cpu_has_bug(X86_BUG_MMIO_UNKNOWN)) {
> +               if (cpu_matches(cpu_vuln_blacklist, MMIO) &&
> +                   !arch_cap_mmio_immune(ia32_cap)) {
> +                       setup_force_cpu_bug(X86_BUG_MMIO_STALE_DATA);
> +               }
> +       }

Yeah, I had initially X86_BUG_MMIO_UNKNOWN set unconditionally on all.

Then I thought I should set it only on older but as dhansen said, Intel
is going in and out of servicing period so we better set it on all
initially and then clear it when the CPU is not in the vuln blacklist.

> 
> >  	if (!cpu_has(c, X86_FEATURE_BTC_NO)) {
> >  		if (cpu_matches(cpu_vuln_blacklist, RETBLEED) || (ia32_cap & ARCH_CAP_RSBA))
> > diff --git a/arch/x86/kernel/cpu/intel.c b/arch/x86/kernel/cpu/intel.c
> > index 663f6e6dd288..5b2508adc38a 100644
> > --- a/arch/x86/kernel/cpu/intel.c
> > +++ b/arch/x86/kernel/cpu/intel.c
> > @@ -372,6 +372,10 @@ static void early_init_intel(struct cpuinfo_x86 *c)
> >  static void bsp_init_intel(struct cpuinfo_x86 *c)
> >  {
> >  	resctrl_cpu_detect(c);
> > +
> > +	/* Set on older crap */
> > +	if (c->x86_model < INTEL_FAM6_IVYBRIDGE)

i.e., remove this check.

> > +		setup_force_cpu_bug(X86_BUG_MMIO_UNKNOWN);
> 
> Thanks for suggesting this approach.

You're welcome. I'm assuming you're gonna finish it or should I?

Thx.

-- 
Regards/Gruss,
    Boris.

https://people.kernel.org/tglx/notes-about-netiquette