Re: [PATCH v5 12/12] x86/bugs: Add a separate config for missing mitigation

[Josh Poimboeuf]

On Thu, Oct 26, 2023 at 10:09:17AM -0700, Breno Leitao wrote:
> Hello Josh,
> 
> On Wed, Oct 25, 2023 at 09:29:06AM -0700, Josh Poimboeuf wrote:
> > On Thu, Oct 19, 2023 at 11:11:58AM -0700, Breno Leitao wrote:
> > > Currently, the CONFIG_SPECULATION_MITIGATIONS is halfway populated,
> > > where some mitigations have entries in Kconfig, and they could be
> > > modified, while others mitigations do not have Kconfig entries, and
> > > could not be controlled at build time.
> > > 
> > > Create an entry for each CPU mitigation under
> > > CONFIG_SPECULATION_MITIGATIONS. This allow users to enable or disable
> > > them at compilation time.
> > > 
> > > Signed-off-by: Breno Leitao <leitao@xxxxxxxxxx>
> > 
> > We also probably need a CONFIG_MITIGATION_MELTDOWN.
> 
> Isn't Meltdown covered by the MITIGATION_PAGE_TABLE_ISOLATION Kconfig
> entry? Would you mind clarifying what would be the difference between
> CONFIG_MITIGATION_MELTDOWN and MITIGATION_PAGE_TABLE_ISOLATION, and why
> do we want CONFIG_MITIGATION_MELTDOWN?

Ah yes, not sure how I missed that one.

> > > +	cmd = IS_ENABLED(CONFIG_MITIGATION_SPECTRE_V2) ?  SPECTRE_V2_CMD_AUTO : SPECTRE_V2_CMD_NONE;
> > >  	if (cmdline_find_option_bool(boot_command_line, "nospectre_v2") ||
> > >  	    cpu_mitigations_off())
> > >  		return SPECTRE_V2_CMD_NONE;
> > 
> > I'm thinking CONFIG_MITIGATION_SPECTRE_V2 should also affect whether the spectre v2 user
> > mitigation gets enabled.
> 
> Makes sense, would something like this be enough?

Looks good to me.

While you're at it, for consistency can you add a cpu_mitigations_off()
check to spectre_v2_parse_user_cmdline()?

-- 
Josh