From: Breno Leitao <leitao@debian.org>
To: jpoimboe@kernel.org, mingo@redhat.com, tglx@linutronix.de, bp@alien8.de
Cc: x86@kernel.org, leit@meta.com, linux-kernel@vger.kernel.org,
pawan.kumar.gupta@linux.intel.com,
bpf@vger.kernel.org (open list:BPF
[MISC]:Keyword:(?:\b|_)bpf(?:\b|_))
Subject: [PATCH v6 00/13] x86/bugs: Add a separate config for each mitigation
Date: Tue, 21 Nov 2023 08:07:27 -0800 [thread overview]
Message-ID: <20231121160740.1249350-1-leitao@debian.org> (raw)
Currently, the CONFIG_SPECULATION_MITIGATIONS is halfway populated,
where some mitigations have entries in Kconfig, and they could be
modified, while others mitigations do not have Kconfig entries, and
could not be controlled at build time.
The fact of having a fine grained control can help in a few ways:
1) Users can choose and pick only mitigations that are important for
their workloads.
2) Users and developers can choose to disable mitigations that mangle
the assembly code generation, making it hard to read.
3) Separate configs for just source code readability,
so that we see *which* butt-ugly piece of crap code is for what
reason.
Important to say, if a mitigation is disabled at compilation time, it
could be enabled at runtime using kernel command line arguments.
Discussion about this approach:
https://lore.kernel.org/all/CAHk-=wjTHeQjsqtHcBGvy9TaJQ5uAm5HrCDuOD9v7qA9U1Xr4w@mail.gmail.com/
and
https://lore.kernel.org/lkml/20231011044252.42bplzjsam3qsasz@treble/
In order to get the missing mitigations, some clean up was done.
1) Get a namespace for mitigations, prepending MITIGATION to the Kconfig
entries.
2) Adding the missing mitigations, so, the mitigations have entries in the
Kconfig that could be easily configure by the user.
With this patchset applied, all configs have an individual entry under
CONFIG_SPECULATION_MITIGATIONS, and all of them starts with CONFIG_MITIGATION.
Changelog
---------
V1:
* Creates a way to mitigate all (or none) hardware bugs
V2:
* Create KCONFIGs entries only some hardware bugs (MDS, TAA, MMIO)
V3:
* Expand the mitigations KCONFIGs to all hardware bugs that are
Linux mitigates.
V4:
* Patch rebase.
* Better documentation about the reasons of this decision.
V5:
* Create a "MITIGATION" Kconfig namespace for the entries mitigating
hardware bugs.
* Add GDS to the set of mitigations that are being covered.
* Reduce the ifdefs in the code by leveraging conditionals with omitted
operands.
V6:
* Reference documentation RST files from Kconfig entries
* Fix some grammar mistakes and Kconfig dependencies
* Now spectre v2 user depends on CONFIG_MITIGATION_SPECTRE_V2. See
patch "spectre_v2_user default mode depends on Kconfig"
Breno Leitao (13):
x86/bugs: Rename GDS_FORCE_MITIGATION to MITIGATION_GDS_FORCE
x86/bugs: Rename CPU_IBPB_ENTRY to MITIGATION_IBPB_ENTRY
x86/bugs: Rename CALL_DEPTH_TRACKING to MITIGATION_CALL_DEPTH_TRACKING
x86/bugs: Rename PAGE_TABLE_ISOLATION to MITIGATION_PAGE_TABLE_ISOLATION
x86/bugs: Rename RETPOLINE to MITIGATION_RETPOLINE
x86/bugs: Rename SLS to CONFIG_MITIGATION_SLS
x86/bugs: Rename CPU_UNRET_ENTRY to MITIGATION_UNRET_ENTRY
x86/bugs: Rename CPU_IBRS_ENTRY to MITIGATION_IBRS_ENTRY
x86/bugs: Rename CPU_SRSO to MITIGATION_SRSO
x86/bugs: Rename RETHUNK to MITIGATION_RETHUNK
x86/bugs: Create a way to disable GDS mitigation
x86/bugs: spectre_v2_user default mode depends on Kconfig
x86/bugs: Add a separate config for missing mitigation
Documentation/admin-guide/hw-vuln/spectre.rst | 8 +-
.../admin-guide/kernel-parameters.txt | 4 +-
Documentation/arch/x86/pti.rst | 6 +-
arch/x86/Kconfig | 151 +++++++++++++++---
arch/x86/Makefile | 8 +-
arch/x86/boot/compressed/ident_map_64.c | 4 +-
arch/x86/configs/i386_defconfig | 2 +-
arch/x86/entry/calling.h | 8 +-
arch/x86/entry/entry_64.S | 2 +-
arch/x86/entry/vdso/Makefile | 4 +-
arch/x86/include/asm/current.h | 2 +-
arch/x86/include/asm/disabled-features.h | 10 +-
arch/x86/include/asm/linkage.h | 16 +-
arch/x86/include/asm/nospec-branch.h | 30 ++--
arch/x86/include/asm/pgalloc.h | 2 +-
arch/x86/include/asm/pgtable-3level.h | 2 +-
arch/x86/include/asm/pgtable.h | 18 +--
arch/x86/include/asm/pgtable_64.h | 3 +-
arch/x86/include/asm/processor-flags.h | 2 +-
arch/x86/include/asm/pti.h | 2 +-
arch/x86/include/asm/static_call.h | 2 +-
arch/x86/kernel/alternative.c | 14 +-
arch/x86/kernel/asm-offsets.c | 2 +-
arch/x86/kernel/cpu/amd.c | 2 +-
arch/x86/kernel/cpu/bugs.c | 98 +++++++-----
arch/x86/kernel/dumpstack.c | 2 +-
arch/x86/kernel/ftrace.c | 3 +-
arch/x86/kernel/head_32.S | 4 +-
arch/x86/kernel/head_64.S | 2 +-
arch/x86/kernel/kprobes/opt.c | 2 +-
arch/x86/kernel/ldt.c | 8 +-
arch/x86/kernel/static_call.c | 2 +-
arch/x86/kernel/vmlinux.lds.S | 10 +-
arch/x86/kvm/mmu/mmu.c | 2 +-
arch/x86/kvm/mmu/mmu_internal.h | 2 +-
arch/x86/kvm/svm/svm.c | 2 +-
arch/x86/kvm/svm/vmenter.S | 4 +-
arch/x86/kvm/vmx/vmx.c | 2 +-
arch/x86/lib/Makefile | 2 +-
arch/x86/lib/retpoline.S | 26 +--
arch/x86/mm/Makefile | 2 +-
arch/x86/mm/debug_pagetables.c | 4 +-
arch/x86/mm/dump_pagetables.c | 4 +-
arch/x86/mm/pgtable.c | 4 +-
arch/x86/mm/tlb.c | 10 +-
arch/x86/net/bpf_jit_comp.c | 4 +-
arch/x86/net/bpf_jit_comp32.c | 2 +-
arch/x86/purgatory/Makefile | 2 +-
include/linux/compiler-gcc.h | 2 +-
include/linux/indirect_call_wrapper.h | 2 +-
include/linux/module.h | 2 +-
include/linux/objtool.h | 2 +-
include/linux/pti.h | 2 +-
include/net/netfilter/nf_tables_core.h | 2 +-
include/net/tc_wrapper.h | 2 +-
kernel/trace/ring_buffer.c | 2 +-
net/netfilter/Makefile | 2 +-
net/netfilter/nf_tables_core.c | 6 +-
net/netfilter/nft_ct.c | 4 +-
net/netfilter/nft_lookup.c | 2 +-
net/sched/sch_api.c | 2 +-
scripts/Makefile.lib | 8 +-
scripts/Makefile.vmlinux_o | 2 +-
scripts/generate_rust_target.rs | 2 +-
scripts/mod/modpost.c | 2 +-
.../arch/x86/include/asm/disabled-features.h | 10 +-
66 files changed, 344 insertions(+), 219 deletions(-)
--
2.34.1
next reply other threads:[~2023-11-21 17:09 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-11-21 16:07 Breno Leitao [this message]
2023-11-21 16:07 ` [PATCH v6 05/13] x86/bugs: Rename RETPOLINE to MITIGATION_RETPOLINE Breno Leitao
2023-11-22 15:08 ` Ariel Miculas
2023-11-21 16:07 ` [PATCH v6 06/13] x86/bugs: Rename SLS to CONFIG_MITIGATION_SLS Breno Leitao
2023-11-29 4:42 ` [PATCH v6 00/13] x86/bugs: Add a separate config for each mitigation Josh Poimboeuf
2024-01-10 9:56 ` Ingo Molnar
2024-01-10 11:55 ` Breno Leitao
2024-01-10 18:07 ` Ingo Molnar
2024-04-30 13:12 ` Breno Leitao
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20231121160740.1249350-1-leitao@debian.org \
--to=leitao@debian.org \
--cc=bp@alien8.de \
--cc=bpf@vger.kernel.org \
--cc=jpoimboe@kernel.org \
--cc=leit@meta.com \
--cc=linux-kernel@vger.kernel.org \
--cc=mingo@redhat.com \
--cc=pawan.kumar.gupta@linux.intel.com \
--cc=tglx@linutronix.de \
--cc=x86@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).