Date: Fri, 26 Jan 2018 18:47:28 +0100 From: "Jason A. Donenfeld" <Jason@...c4.com> To: Alan Cox <gnomes@...rguk.ukuu.org.uk> Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>, LKML <linux-kernel@...r.kernel.org>, kernel-hardening@...ts.openwall.com Subject: Re: Re: [PATCH v2] cpu: do not leak vulnerabilities to unprivileged users On Fri, Jan 26, 2018 at 5:43 PM, Alan Cox <gnomes@...rguk.ukuu.org.uk> wrote: > a) The info is already trivially accessible via /proc/cpuinfo No, /proc/cpuinfo shows if the CPU itself has these bugs, but doesn't show whether or not the kernel has gone to lengths to mitigate these bugs. # grep -o 'bugs.*cpu_meltdown' -m1 /proc/cpuinfo bugs : cpu_meltdown # cat /sys/devices/system/cpu/vulnerabilities/meltdown Mitigation: PTI > or by measurement to an attacker Right, so without this, an attacker has to measure. The purpose of this patchset is to require the attacker to perform an additional measurement. That seems worthwhile, especially if measurements are or would ever become non-trivial to make. > b) Some JIT and other environments need to know Shouldn't JITs do the best they can with the environment they're in? And for that, isn't /proc/cpuinfo enough? Jason
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.