linux-kernel - [PATCH v4 00/11] x86/bugs: Separate config for mitigations

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20240729164105.554296-1-leitao@debian.org>
Date: Mon, 29 Jul 2024 09:40:48 -0700
From: Breno Leitao <leitao@...ian.org>
To: bp@...en8.de
Cc: linux-kernel@...r.kernel.org,
	x86@...nel.org,
	jpoimboe@...nel.org,
	mingo@...hat.com
Subject: [PATCH v4 00/11] x86/bugs: Separate config for mitigations

The current CONFIG_SPECULATION_MITIGATIONS namespace is only
halfway populated, where some mitigations have entries in Kconfig, and
they could be modified, while others mitigations do not have Kconfig
entries, and can not be controlled at build time.

New mitigations, such as BHI, were properly added, i.e, having an
independent Kconfig, which depends on CONFIG_SPECULATION_MITIGATIONS,
so, you can enable/disable at compilation time.

This patch set aims to have the old mitigations in the same format,
bringing some uniformity to the mitigations.

These are the advantages of having fine-grained control for the
mitigations:

1) Users can choose and pick only mitigations that are important for
 their workloads.

2) Users and developers can choose to disable mitigations that mangle
 the assembly code generation, making it hard to read.

3) Separate Kconfigs for just source code readability,
 so that we see *which* butt-ugly piece of crap code is for what
 reason...

In most cases, if a mitigation is disabled at compilation time, it
can still be enabled at runtime using kernel command line arguments.

This is the second part of the initial patchset[1] that got half landed.
The first patch did some code re-organization. This second part
contains the exact missing patches from the initial patchset, and
basically adds build-time configuration for the other mitigations that
are currently only disabled at boot time.

Here is a detailed view of each patch:

With this patch applied, setting CONFIG_SPECULATION_MITIGATIONS=n, a
simple script[2] shows that all the mitigations are disabled:

  spectre_v2_user_stibp   	 SPECTRE_V2_USER_NONE
  spectre_v2_user_ibpb    	 SPECTRE_V2_USER_NONE
  spectre_v2_cmd          	 SPECTRE_V2_CMD_NONE
  ssb_mode                	 SPEC_STORE_BYPASS_NONE
  l1tf_mitigation         	 L1TF_MITIGATION_OFF
  srso_mitigation         	 SRSO_MITIGATION_NONE
  srso_cmd                	 SRSO_CMD_SAFE_RET
  mds_mitigation          	 MDS_MITIGATION_OFF
  taa_mitigation          	 TAA_MITIGATION_OFF
  mmio_mitigation         	 MMIO_MITIGATION_OFF
  srbds_mitigation        	 SRBDS_MITIGATION_OFF
  gds_mitigation          	 GDS_MITIGATION_OFF
  spectre_v1_mitigation   	 SPECTRE_V1_MITIGATION_NONE
  spectre_v2_enabled      	 SPECTRE_V2_NONE
  retbleed_mitigation     	 RETBLEED_MITIGATION_NONE

[1] https://lore.kernel.org/all/ZZ7c9EbJ71zU5TOF@gmail.com/#t
[2] https://github.com/leitao/debug/blob/main/spec/dump_speculation.py

Changelog:

v4:
  * Created a patch that removes the MITIGATION_GDS_FORCE Kconfig entry,
    then rebasing the last patch ("x86/bugs: Add a separate config for
    GDS") on top of it (Borislav Petkov)

v3:
  * Rebased the patch on top of linux-next, since BHI mitigation added
    some hunk to original patch series.
  * Broke down the patches even further, creating one patch for each
    mitigation. This make the review code easier (I hope).
	* Nothing was changed, code-wise. The code is *exactly* the * same
  * Dropped the "spectre_v2_user default mode depends on main default"
    patch, that will be sent later, since there is no dependency to this
    patch series. Hopping to make the review/acceptance easier as well.
  * https://lore.kernel.org/all/20240422165830.2142904-1-leitao@debian.org/

v2:
  * Patch 2: Changed `mode` type from int to `enum spectre_v2_user_cmd`
    as suggested by Pawan Gupta
  * Patch 3: Change MITIGATION_RETBLEED dependency to match the code.
  * https://lore.kernel.org/all/20240208174555.44200-1-leitao@debian.org/

v1:
  * https://lore.kernel.org/all/20240118173213.2008115-1-leitao@debian.org/

Breno Leitao (11):
  x86/bugs: Add a separate config for MDS
  x86/bugs: Add a separate config for TAA
  x86/bugs: Add a separate config for MMIO Stable Data
  x86/bugs: Add a separate config for L1TF
  x86/bugs: Add a separate config for RETBLEED
  x86/bugs: Add a separate config for Spectre v1
  x86/bugs: Add a separate config for SRBDS
  x86/bugs: Add a separate config for Spectre V2
  x86/bugs: Add a separate config for SSB
  x86/bugs: Remove GDS Force Kconfig option
  x86/bugs: Add a separate config for GDS

 arch/x86/Kconfig           | 124 ++++++++++++++++++++++++++++++++-----
 arch/x86/kernel/cpu/bugs.c |  46 ++++++++------
 2 files changed, 134 insertions(+), 36 deletions(-)

-- 
2.43.0