[MODERATED] Re: [PATCH v5 00/27] MDSv5 19

[Andi Kleen <ak@linux.intel.com>]

On Tue, Jan 22, 2019 at 10:18:05AM +1300, speck for Linus Torvalds wrote:
> On Tue, Jan 22, 2019 at 8:54 AM speck for Andi Kleen
> <speck@linutronix.de> wrote:
> >
> >   mds: Mark interrupts clear cpu, unless opted-out
> >   mds: Clear cpu on all timers, unless the timer opts-out
> >   mds: Clear CPU on tasklets, unless opted-out
> >   mds: Clear CPU on irq poll, unless opted-out
> 
> I do wonder if this should just be opt-in instead of opt-out?
> 
> Just what is the attack vector, and what's the interrupt/timer data

The attack vector is usually a copy. The string instructions can leave
data in places that are not overwritten by normal integer code.

> that is so sensitive? It strikes me as a really hard thing to try to

Part of it was being conservative. I don't really know from what
context that data the timer process came from. But yes most of the
time it's just some meta data, like pointers. But if it copies
user data then it could well be leaked.

The rationale for the opt-out was that it's hard and difficult to audit
all the driver code. 

I can audit kernel/* and yes for that part opt-out would make more sense.

But with being conservative and having simple rules and don't make
too much assumptions about unaudited code we can make
a good case that the default policy is safe enough for near everyone
and they don't need mds=full

I'm open to other proposals:

In theory we could have a different default for different 
directories with some Makefile trickery, but that might be confusing?

Or could try to find some semi automated way to audit copies
in timers in drivers/* and do opt-in, but that's likely a substantial project.
It would also need to be repeated for backports and out of tree.

Thoughts?

-Andi