linux-kernel - Re: [PATCH v5 12/12] x86/bugs: Add a separate config for missing mitigation

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 9 Nov 2023 14:43:56 -0800
From:   Josh Poimboeuf <jpoimboe@...nel.org>
To:     Breno Leitao <leitao@...ian.org>
Cc:     mingo@...hat.com, tglx@...utronix.de, bp@...en8.de,
        Dave Hansen <dave.hansen@...ux.intel.com>, x86@...nel.org,
        "H. Peter Anvin" <hpa@...or.com>,
        Peter Zijlstra <peterz@...radead.org>,
        Pawan Gupta <pawan.kumar.gupta@...ux.intel.com>, leit@...a.com,
        "open list:X86 ARCHITECTURE (32-BIT AND 64-BIT)" 
        <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH v5 12/12] x86/bugs: Add a separate config for missing
 mitigation

On Thu, Oct 26, 2023 at 10:09:17AM -0700, Breno Leitao wrote:
> Hello Josh,
> 
> On Wed, Oct 25, 2023 at 09:29:06AM -0700, Josh Poimboeuf wrote:
> > On Thu, Oct 19, 2023 at 11:11:58AM -0700, Breno Leitao wrote:
> > > Currently, the CONFIG_SPECULATION_MITIGATIONS is halfway populated,
> > > where some mitigations have entries in Kconfig, and they could be
> > > modified, while others mitigations do not have Kconfig entries, and
> > > could not be controlled at build time.
> > > 
> > > Create an entry for each CPU mitigation under
> > > CONFIG_SPECULATION_MITIGATIONS. This allow users to enable or disable
> > > them at compilation time.
> > > 
> > > Signed-off-by: Breno Leitao <leitao@...ian.org>
> > 
> > We also probably need a CONFIG_MITIGATION_MELTDOWN.
> 
> Isn't Meltdown covered by the MITIGATION_PAGE_TABLE_ISOLATION Kconfig
> entry? Would you mind clarifying what would be the difference between
> CONFIG_MITIGATION_MELTDOWN and MITIGATION_PAGE_TABLE_ISOLATION, and why
> do we want CONFIG_MITIGATION_MELTDOWN?

Ah yes, not sure how I missed that one.

> > > +	cmd = IS_ENABLED(CONFIG_MITIGATION_SPECTRE_V2) ?  SPECTRE_V2_CMD_AUTO : SPECTRE_V2_CMD_NONE;
> > >  	if (cmdline_find_option_bool(boot_command_line, "nospectre_v2") ||
> > >  	    cpu_mitigations_off())
> > >  		return SPECTRE_V2_CMD_NONE;
> > 
> > I'm thinking CONFIG_MITIGATION_SPECTRE_V2 should also affect whether the spectre v2 user
> > mitigation gets enabled.
> 
> Makes sense, would something like this be enough?

Looks good to me.

While you're at it, for consistency can you add a cpu_mitigations_off()
check to spectre_v2_parse_user_cmdline()?

-- 
Josh