From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Google-Smtp-Source: AH8x226yJqLMGONyf0QIDhOpeFVI+s/bOCmIzDn0LXtC7KfIkOjT1n7mhteazfJUsYhLIUEsflsb ARC-Seal: i=1; a=rsa-sha256; t=1516980618; cv=none; d=google.com; s=arc-20160816; b=AJeQLR3A9gQbiMGM6iqSwozd8mCpOH9sjj/1cFRjJUMp7w7f6PeAZ12dCNQWzSF2DT LkDUnbh3ZnFqBDasb/fMgkFh3FwbeyAbVXxCo20vhOjK/B1eOK+XOeMfJ/XigbK1PR2U iQAC9CdWb5vvbSetuqNltjaoYbnt3xXJbhXKQWcFUxB4Mojn8SAPKW3FQbwhxhNUBxdI pMHDjrcguPx2V9DdmxoLDv34JKv6g2RnU2sjA7zNIjHzCGFqSsgw9h4l/wIZuzvXrNWN IV1ExsYrdfhVi0qas9j62o3dK8s8EF2v/7ebeyChMcgrKqTuJg6gCPdVMwploglmqpDo GLvw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=content-transfer-encoding:content-language:in-reply-to:mime-version :user-agent:date:message-id:from:references:to:subject :arc-authentication-results; bh=D/YfBxBOvT6CFgRLYv2n+FQyNrC9gt/6BO8MOUQYukI=; b=iEXXtII6ECdR4OSv3ASB19cSN0SiejeNL2tVGbRjt5CHVFViJ2obKVWMjMde9tgScA 5QUoqCUTGKrPeSxBd3Pt5rFYEqEfbSi2jdR0UzSETvq6H2eBnF9bzq7vobhlIN2JEku5 BjVgNGTp4MhwJDckpr2BeDMy9wu+x6f5bJn1R++xQyyLiWvcwNnXJfBZBsK3QGqWUTEm yYy0qMO0aeUqDqcOcfyOoXrzcXYtMvI3T8GUJPGU0K0VfSU64LBcme06sL33zHs0p+TR zw4O00a1jgvmimNWsVc6sczTsSV3bFIpd9t2+2oenU5VfqERzxMyQcsVj/xm7gRzV5Oe OsNw== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: best guess record for domain of arjan@linux.intel.com designates 134.134.136.20 as permitted sender) smtp.mailfrom=arjan@linux.intel.com Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of arjan@linux.intel.com designates 134.134.136.20 as permitted sender) smtp.mailfrom=arjan@linux.intel.com X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.46,417,1511856000"; d="scan'208";a="29705630" Subject: Re: [PATCH v3 5/6] x86/pti: Do not enable PTI on processors which are not vulnerable to Meltdown To: Dave Hansen , Yves-Alexis Perez , David Woodhouse , tglx@linutronix.de, karahmed@amazon.de, x86@kernel.org, linux-kernel@vger.kernel.org, tim.c.chen@linux.intel.com, bp@alien8.de, peterz@infradead.org, pbonzini@redhat.com, ak@linux.intel.com, torvalds@linux-foundation.org, gregkh@linux-foundation.org, gnomes@lxorguk.ukuu.org.uk References: <1516813025-10794-1-git-send-email-dwmw@amazon.co.uk> <1516813025-10794-6-git-send-email-dwmw@amazon.co.uk> <1516968886.19619.7.camel@debian.org> From: Arjan van de Ven Message-ID: Date: Fri, 26 Jan 2018 07:30:15 -0800 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Thunderbird/52.5.2 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: 7bit X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-THRID: =?utf-8?q?1590493766352787258?= X-GMAIL-MSGID: =?utf-8?q?1590669468827724669?= X-Mailing-List: linux-kernel@vger.kernel.org List-ID: On 1/26/2018 7:27 AM, Dave Hansen wrote: > On 01/26/2018 04:14 AM, Yves-Alexis Perez wrote: >> I know we'll still be able to manually enable PTI with a command line option, >> but it's also a hardening feature which has the nice side effect of emulating >> SMEP on CPU which don't support it (e.g the Atom boxes above). > > For Meltdown-vulnerable systems, it's a no brainer: pti=on. The > vulnerability there is just too much. > > But, if we are going to change the default, IMNHO, we need a clear list > of what SMEP emulation mitigates and where. RSB-related Variant 2 stuff > on Atom where the kernel speculatively 'ret's back to userspace is > certainly a concern. But, there's a lot of other RSB stuffing that's > going on that will mitigate that too. > > Were you thinking of anything concrete? not Atom though. Atom has has SMEP for a very long time, at least the ones that do speculation do afaict. SMEP is for other bugs (dud kernel function pointer) and for that, emulating SMEP is an interesting opt-in for sure.