linux-kernel - Re: [PATCH v5 3/3] x86/bugs: Add 'spectre

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <60ddec81-5102-4984-848a-ae3adb8c4c38@suse.com>
Date: Thu, 9 May 2024 11:21:44 +0300
From: Nikolay Borisov <nik.borisov@...e.com>
To: Josh Poimboeuf <jpoimboe@...nel.org>
Cc: x86@...nel.org, linux-kernel@...r.kernel.org,
 Linus Torvalds <torvalds@...ux-foundation.org>,
 Daniel Sneddon <daniel.sneddon@...ux.intel.com>,
 Pawan Gupta <pawan.kumar.gupta@...ux.intel.com>,
 Thomas Gleixner <tglx@...utronix.de>,
 Alexandre Chartre <alexandre.chartre@...cle.com>,
 Konrad Rzeszutek Wilk <konrad.wilk@...cle.com>,
 Peter Zijlstra <peterz@...radead.org>,
 Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
 Sean Christopherson <seanjc@...gle.com>,
 Andrew Cooper <andrew.cooper3@...rix.com>,
 Dave Hansen <dave.hansen@...ux.intel.com>, KP Singh <kpsingh@...nel.org>,
 Waiman Long <longman@...hat.com>, Borislav Petkov <bp@...en8.de>,
 Ingo Molnar <mingo@...nel.org>, Maksim Davydov <davydov-max@...dex-team.ru>
Subject: Re: [PATCH v5 3/3] x86/bugs: Add 'spectre_bhi=vmexit' cmdline option



On 9.05.24 г. 8:24 ч., Josh Poimboeuf wrote:
> On Wed, May 08, 2024 at 06:10:21PM +0300, Nikolay Borisov wrote:
>>> @@ -1659,19 +1662,22 @@ static void __init bhi_select_mitigation(void)
>>>    			return;
>>>    	}
>>> +	/* Mitigate in hardware if supported */
>>>    	if (spec_ctrl_bhi_dis())
>>>    		return;
>>>    	if (!IS_ENABLED(CONFIG_X86_64))
>>>    		return;
>>> -	/* Mitigate KVM by default */
>>> -	setup_force_cpu_cap(X86_FEATURE_CLEAR_BHB_LOOP_ON_VMEXIT);
>>> -	pr_info("Spectre BHI mitigation: SW BHB clearing on vm exit\n");
>>> +	if (bhi_mitigation == BHI_MITIGATION_VMEXIT_ONLY) {
>>> +		pr_info("Spectre BHI mitigation: SW BHB clearing on vm exit only\n");
>>> +		setup_force_cpu_cap(X86_FEATURE_CLEAR_BHB_LOOP_ON_VMEXIT);
>>> +		return;
>>> +	}
>>
>> nit: How about setting CLEAR_BHB_LOOP_ON_VMEXIT unconditionally, then
>> afterwards checking if MITIGATION_VMEXIT_ONLY is set and if yes simply
>> return, that way you don't duplicate the setup of the VMEXIT code
> 
> I think the duplication actually makes it more readable.  In both cases
> it puts the setting of the features together along with the
> corresponding pr_info().

Right, my suggestion also meant that setting + pr info will be together, 
unconditional and if MITIGATION_VMEXIT_ONLY is set we return early, 
without setting X86_FEATURE_CLEAR_BHB_LOOP. In any case it's a minor 
remark, feel free to ignore.

Reviewed-by: Nikolay Borisov <nik.borisov@...e.com>

>