Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Date:   Wed, 24 Jan 2018 18:40:35 +0000
From:   Alan Cox <gnomes@lxorguk.ukuu.org.uk>
To:     David Woodhouse <dwmw2@infradead.org>
Cc:     Dave Hansen <dave.hansen@linux.intel.com>,
        linux-kernel@vger.kernel.org
Subject: Re: [PATCH v2 5/5] x86/pti: Do not enable PTI on fixed Intel
 processors
Message-ID: <20180124183958.267e405b@alans-desktop>
In-Reply-To: <1516815723.13558.164.camel@infradead.org>
References: <1516726375-25168-1-git-send-email-dwmw@amazon.co.uk>
        <1516726375-25168-6-git-send-email-dwmw@amazon.co.uk>
        <20180123173312.1d8cf02f@alans-desktop>
        <1516811127.13558.150.camel@infradead.org>
        <20180124170652.4c78ca17@alans-desktop>
        <1516815723.13558.164.camel@infradead.org>
Organization: Intel Corporation
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8BIT
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

> > AND K5 speculates, Cyrix 6x86 speculates, IDT WinChip does not. I think
> > this should be
> > 
> > X86_VENDOR_ANY, 4
> > X86_VENDOR_INTEL, 5,
> > X86_VENDOR_CENTAUR, 5,  
> 
> Hm, for the specific case of controlling X86_BUG_CPU_MELTDOWN it's not
> just "speculates" which is the criterion. It's "optimises away the
> permissions checks while speculating, on the assumption that it'll be
> fixed up before retiring the instruction".

Nobody has published official statements on Cyrix or AMD 32bit processors
so we don't know if they are vulnerable to meltdown. One problem I
suspect is that as with things like Alpha 21264 - the people who knew are
probably long retired. We do know the Intel ones I listed are OK and the
Centaur.

If someone can figure out the Cyrix and AMD cases that would be great.

> By the time the dust settles we might end up with a bunch of different
> match tables, *one* of which is "does not speculate at all". And the
> conditions for the different bugs will each use different sets of match
> tables. For example
> 
>  if (!x86_match_cpu(cpu_no_speculation_at_all) &&
>      !x86_match_cpu(speculation_but_no_meltdown) &&
>      !cpu_sets_rdcl_no())
> 	setup_force_cpu_bug(X86_BUG_CPU_MELTDOWN);
> 
>  if (!x86_match_cpu(cpu_no_speculation_at_all) &&
>      !x86_match_cpu(no_branch_target_buffer))
> 	setup_force_cpu_bug(X86_BUG_SPECTRE_V2);

There are afaik no x86 processors that speculate and don't have a BTB.
It's a bit like building a racing car with no gearbox.

Alan