lkml.org 
[lkml]   [2018]   [Jan]   [23]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: [PATCH v8 04/12] x86/spectre: Add boot time option to select Spectre v2 mitigation
    On Tue, 23 Jan 2018, Borislav Petkov wrote:

    > > + mode = retp_compiler() ? SPECTRE_V2_RETPOLINE_GENERIC :
    > > + SPECTRE_V2_RETPOLINE_MINIMAL;
    > ^^^^^^^^^^^^^^^^^^^^^^^^^^^^
    >
    > but that might not always be an option.

    I think we should start recording CFLAGS the kernel has been compiled with
    anyway; doesn't hurt and might come handy when debugging.

    /proc/version is probably not the best place ... /proc/cflags?

    > And it probably should be a more reliable method which we probably could
    > use to detect !retpolined modules too.

    That's the vermagic stuff Andi pushed. But that's not really acceptable
    for distros.

    Distros have always been in the situation "we let the external modules to
    load, as it'll work when it comes to functionality, but then it's our
    duty/responsibility to explain to 3rd parties that they *really* should
    recompile". Mostly because of security fixes to static inlines, but not
    only that.

    So that vermagic patch doesn't really help anything in real world (FWIW
    I've just dropped it from SLE kernel). "Potentially insecure" doesn't mean
    it shouldn't be loaded if the user wishes so. Only "functionally
    incorrect" (which is the kernel ABI compatibility check) should be the
    show stopper.

    --
    Jiri Kosina
    SUSE Labs

    \
     
     \ /
      Last update: 2018-01-23 23:56    [W:4.176 / U:0.204 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site