linux-kernel - Re: [PATCH PATCH v2 8/9] x86/bugs: Declutter vulnerable CPU list

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20240703010018.qov5lxldvou7fhhl@treble>
Date: Tue, 2 Jul 2024 18:00:18 -0700
From: Josh Poimboeuf <jpoimboe@...nel.org>
To: Pawan Gupta <pawan.kumar.gupta@...ux.intel.com>
Cc: Thomas Gleixner <tglx@...utronix.de>, Ingo Molnar <mingo@...hat.com>,
	Borislav Petkov <bp@...en8.de>,
	Dave Hansen <dave.hansen@...ux.intel.com>, x86@...nel.org,
	daniel.sneddon@...ux.intel.com, tony.luck@...el.com,
	linux-kernel@...r.kernel.org, linux-pm@...r.kernel.org,
	linux-perf-users@...r.kernel.org,
	Srinivas Pandruvada <srinivas.pandruvada@...ux.intel.com>,
	"Rafael J. Wysocki" <rafael@...nel.org>,
	Ricardo Neri <ricardo.neri-calderon@...ux.intel.com>,
	"Liang, Kan" <kan.liang@...ux.intel.com>,
	Andrew Cooper <andrew.cooper3@...rix.com>,
	Brice Goglin <brice.goglin@...il.com>,
	Mario Limonciello <mario.limonciello@....com>,
	Perry Yuan <Perry.Yuan@....com>,
	Dapeng Mi <dapeng1.mi@...ux.intel.com>
Subject: Re: [PATCH PATCH v2 8/9] x86/bugs: Declutter vulnerable CPU list

On Thu, Jun 27, 2024 at 01:44:48PM -0700, Pawan Gupta wrote:
> The affected processor table has a lot of repetition and redundant
> information that can be omitted. For example:
> 
>   VULNBL_INTEL_STEPPINGS(INTEL_IVYBRIDGE,		X86_STEPPING_ANY,		SRBDS),
> 
> can easily be simplified to:
> 
>   VULNBL_INTEL(IVYBRIDGE,	SRBDS),
> 
> Apply this to all the entries in the affected processor table.
> 
> No functional change. Disassembly of arch/x86/kernel/cpu/common.o does not
> show any difference before and after the change.

This patch only changes data, not code.  So there's not much point in
diffing the disassembly ;-)

A diff of the .init.rodata sections actually shows one (non-functional)
difference in cpu_vuln_blacklist[].

The COMETLAKE_L entries were moved to a new section below the rest of
the entries:

	/* Match more than Vendor/Family/Model */
	VULNBL_INTEL_STEPPINGS(COMETLAKE_L,	X86_STEPPINGS(0x0, 0x0),	MMIO | RETBLEED),
	VULNBL_INTEL	      (COMETLAKE_L,					MMIO | MMIO_SBDS | RETBLEED | GDS),

While that's functionally correct, it breaks the visual sorting, which
is confusing and even a bit dangerous.  One would reasonably expect the
COMETLAKE_L entries to come immediately after COMETLAKE, so it would be
quite possible for somebody to come along later and add a new
COMETLAKE_L there which conflicts with the later entries.

I'd much rather leave the STEPPINGS entry in the original list where it
belongs.  Something like:

	...
	VULNBL_INTEL(ICELAKE_L,			MMIO | MMIO_SBDS | RETBLEED | GDS),
	VULNBL_INTEL(ICELAKE_D,			MMIO | GDS),
	VULNBL_INTEL(ICELAKE_X,			MMIO | GDS),
	VULNBL_INTEL(COMETLAKE,			MMIO | MMIO_SBDS | RETBLEED | GDS),
	VULNBL_INTEL_STEPPINGS(COMETLAKE_L,
			       X86_STEPPINGS(0x0, 0x0),
			       MMIO | RETBLEED),
	VULNBL_INTEL(COMETLAKE_L,		MMIO | MMIO_SBDS | RETBLEED | GDS),
	VULNBL_INTEL(TIGERLAKE_L,		GDS),
	VULNBL_INTEL(TIGERLAKE,			GDS),
	...

Yes, that's a little ugly, but at least the sorting is correct so it's
less confusing and more robust overall.

-- 
Josh