Re: [PATCH] clarify how insecure CPU is

[Borislav Petkov]

On Sun, Mar 04, 2018 at 09:51:59AM +0100, Pavel Machek wrote:
> diff --git a/arch/x86/include/asm/cpufeatures.h b/arch/x86/include/asm/cpufeatures.h
> index f41079d..4901742 100644
> --- a/arch/x86/include/asm/cpufeatures.h
> +++ b/arch/x86/include/asm/cpufeatures.h
> @@ -341,7 +341,7 @@
>  #define X86_BUG_FDIV			X86_BUG(1) /* FPU FDIV */
>  #define X86_BUG_COMA			X86_BUG(2) /* Cyrix 6x86 coma */
>  #define X86_BUG_AMD_TLB_MMATCH		X86_BUG(3) /* "tlb_mmatch" AMD Erratum 383 */
> -#define X86_BUG_AMD_APIC_C1E		X86_BUG(4) /* "apic_c1e" AMD Erratum 400 */
> +#define X86_BUG_AMD_APIC_C1E		X86_BUG(4) /* System is affected AMD Erratum 400, special idle routine is needed */
>  #define X86_BUG_11AP			X86_BUG(5) /* Bad local APIC aka 11AP */
>  #define X86_BUG_FXSAVE_LEAK		X86_BUG(6) /* FXSAVE leaks FOP/FIP/FOP */
>  #define X86_BUG_CLFLUSH_MONITOR		X86_BUG(7) /* AAI65, CLFLUSH required before MONITOR */
> @@ -356,7 +356,7 @@
>  #define X86_BUG_NULL_SEG		X86_BUG(10) /* Nulling a selector preserves the base */
>  #define X86_BUG_SWAPGS_FENCE		X86_BUG(11) /* SWAPGS without input dep on GS */
>  #define X86_BUG_MONITOR			X86_BUG(12) /* IPI required to wake up remote CPU */
> -#define X86_BUG_AMD_E400		X86_BUG(13) /* CPU is among the affected by Erratum 400 */
> +#define X86_BUG_AMD_E400		X86_BUG(13) /* System may be affected by Erratum 400, X86_BUG_AMD_APIC_C1E might be needed  */

Not "might be needed" - "X86_BUG_AMD_APIC_C1E will be set if platform is
affected".

And then you don't need the above comment change. And you can't remove
"apic_c1e" there because it is magical.

-- 
Regards/Gruss,
    Boris.

SUSE Linux GmbH, GF: Felix ImendÃrffer, Jane Smithard, Graham Norton, HRB 21284 (AG NÃrnberg)
--