Messages in this thread | | | From | Breno Leitao <> | Subject | [PATCH v3 00/10] x86/bugs: Separate config for mitigations | Date | Mon, 22 Apr 2024 09:58:14 -0700 |
| |
The current CONFIG_SPECULATION_MITIGATIONS namespace is only halfway populated, where some mitigations have entries in Kconfig, and they could be modified, while others mitigations do not have Kconfig entries, and can not be controlled at build time.
New mitigations, such as BHI, were properly added, i.e, having an independent Kconfig, which depends on CONFIG_SPECULATION_MITIGATIONS, so, you can enable/disable at compilation time.
This patch set aims to have the old mitigations in the same format, bringing some uniformity to the mitigations.
These are the advantages of having fine-grained control for the mitigations:
1) Users can choose and pick only mitigations that are important for their workloads.
2) Users and developers can choose to disable mitigations that mangle the assembly code generation, making it hard to read.
3) Separate Kconfigs for just source code readability, so that we see *which* butt-ugly piece of crap code is for what reason...
In most cases, if a mitigation is disabled at compilation time, it can still be enabled at runtime using kernel command line arguments.
This is the second part of the initial patchset[1] that got half landed. The first patch did some code re-organization. This second part contains the exact missing patches from the initial patchset, and basically adds build-time configuration for the other mitigations that are currently only disabled at boot time.
Here is a detailed view of each patch:
With this patch applied, setting CONFIG_SPECULATION_MITIGATIONS=n, a simple script[2] shows that all the mitigations are disabled:
spectre_v2_user_stibp SPECTRE_V2_USER_NONE spectre_v2_user_ibpb SPECTRE_V2_USER_NONE spectre_v2_cmd SPECTRE_V2_CMD_NONE ssb_mode SPEC_STORE_BYPASS_NONE l1tf_mitigation L1TF_MITIGATION_OFF srso_mitigation SRSO_MITIGATION_NONE srso_cmd SRSO_CMD_SAFE_RET mds_mitigation MDS_MITIGATION_OFF taa_mitigation TAA_MITIGATION_OFF mmio_mitigation MMIO_MITIGATION_OFF srbds_mitigation SRBDS_MITIGATION_OFF gds_mitigation GDS_MITIGATION_OFF spectre_v1_mitigation SPECTRE_V1_MITIGATION_NONE spectre_v2_enabled SPECTRE_V2_NONE retbleed_mitigation RETBLEED_MITIGATION_NONE
[1] https://lore.kernel.org/all/ZZ7c9EbJ71zU5TOF@gmail.com/#t [2] https://github.com/leitao/debug/blob/main/spec/dump_speculation.py
Changelog:
v3: * Rebased the patch on top of linux-next, since BHI mitigation added some hunk to original patch series. * Broke down the patches even further, creating one patch for each mitigation. This make the review code easier (I hope). * Nothing was changed, code-wise. The code is *exactly* the * same * Dropped the "spectre_v2_user default mode depends on main default" patch, that will be sent later, since there is no dependency to this patch series. Hopping to make the review/acceptance easier as well. v2: * Patch 2: Changed `mode` type from int to `enum spectre_v2_user_cmd` as suggested by Pawan Gupta * Patch 3: Change MITIGATION_RETBLEED dependency to match the code. * https://lore.kernel.org/all/20240208174555.44200-1-leitao@debian.org/ v1: * https://lore.kernel.org/all/20240118173213.2008115-1-leitao@debian.org/
Breno Leitao (10): x86/bugs: Add a separate config for GDS x86/bugs: Add a separate config for MDS x86/bugs: Add a separate config for TAA x86/bugs: Add a separate config for MMIO Stable Data x86/bugs: Add a separate config for L1TF x86/bugs: Add a separate config for RETBLEED x86/bugs: Add a separate config for Spectre v1 x86/bugs: Add a separate config for SRBDS x86/bugs: Add a separate config for Spectre V2 x86/bugs: Add a separate config for SSB
arch/x86/Kconfig | 117 +++++++++++++++++++++++++++++++++++-- arch/x86/kernel/cpu/bugs.c | 46 +++++++++------ 2 files changed, 140 insertions(+), 23 deletions(-)
-- 2.43.0
| |