linux-kernel - Re: [RFC PATCH v2 1/3] x86: cpu/bugs: update SpectreRSB comments for AMD

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <ZzXHK1O9E1sQ8mBt@gmail.com>
Date: Thu, 14 Nov 2024 10:47:23 +0100
From: Ingo Molnar <mingo@...nel.org>
To: Borislav Petkov <bp@...en8.de>
Cc: Josh Poimboeuf <jpoimboe@...nel.org>,
	Andrew Cooper <andrew.cooper3@...rix.com>,
	Amit Shah <amit@...nel.org>, linux-kernel@...r.kernel.org,
	kvm@...r.kernel.org, x86@...nel.org, linux-doc@...r.kernel.org,
	amit.shah@....com, thomas.lendacky@....com, tglx@...utronix.de,
	peterz@...radead.org, pawan.kumar.gupta@...ux.intel.com,
	corbet@....net, mingo@...hat.com, dave.hansen@...ux.intel.com,
	hpa@...or.com, seanjc@...gle.com, pbonzini@...hat.com,
	daniel.sneddon@...ux.intel.com, kai.huang@...el.com,
	sandipan.das@....com, boris.ostrovsky@...cle.com,
	Babu.Moger@....com, david.kaplan@....com, dwmw@...zon.co.uk
Subject: Re: [RFC PATCH v2 1/3] x86: cpu/bugs: update SpectreRSB comments for
 AMD


* Borislav Petkov <bp@...en8.de> wrote:

> On Wed, Nov 13, 2024 at 04:43:58PM -0800, Josh Poimboeuf wrote:
> > This comment relates to the "why" for the code itself (and its poor
> > confused developers), taking all the RSB-related vulnerabilities into
> > account.
> 
> So use Documentation/arch/x86/.
> 
> This is exactly the reason why we need more "why" documentation - because
> everytime we have to swap the whole bugs.c horror back in, we're poor confused
> developers. And we have the "why" spread out across commit messages and other
> folklore which means everytime we have to change stuff, the git archeology
> starts. :-\ "err, do you remember why we're doing this?!" And so on
> converstaions on IRC.
> 
> So having an implementation document explaining clearly why we did things is
> long overdue.
> 
> But it's fine - I can move it later when the dust settles here.

I think in-line documentation is better in this case: the primary defense
against mistakes and misunderstandings is in the source code itself.

And "it's too long" is an argument *against* moving it out into some obscure
place 99% of developers aren't even aware of...

Thanks,

	Ingo