Re: [PATCH 10/11] retpoline/taint: Taint kernel for missing retpoline in compiler

[Randy Dunlap]

On 01/03/2018 04:29 PM, Thomas Gleixner wrote:
> On Wed, 3 Jan 2018, Andi Kleen wrote:
>>  	unwind_init();
>> +
>> +#ifndef RETPOLINE
>> +	add_taint(TAINT_NO_RETPOLINE, LOCKDEP_STILL_OK);
>> +	pr_warn("No support for retpoline in kernel compiler\n");
>> +	pr_warn("Kernel may be vulnerable to data leaks.\n");
> 
> That's blantantly wrong.
> 
> The kernel is not vulnerable to data leaks. The hardware is.

Well it's the kernel that is vulnerable.  The warning doesn't say what is
causing the vulnerability, unless it's the "kernel compiler."

> An that's what the CPU_BUG bit is for. If the mitigation is in place,
> activate the proper feature bit like we did with PTI

> So you say, that we finally need a perl interpreter in the kernel to do
> alternative patching?

Yes, Finally.

-- 
~Randy