components: standardise the hardware: meta field on the requirement

The hardware: key is defined as the hardware requirement, but several
components put a mitigation there -- prefetch and prefetch_directmap named
"KPTI", sidt named "UMIP", which read as "requires KPTI/UMIP" when the leak
in fact needs them absent. Name the requirement and move the mitigating
feature into a trailing "(mitigated by X)", matching databounce's form:
  prefetch, prefetch_directmap:  prefetch side-channel (mitigated by KPTI)
  sidt:                          user-mode SIDT (mitigated by UMIP)

Spell out the convention in the KASLD_META doc and the hardening-render
comment, and add a check-component-meta rule that fails a bare KPTI/UMIP
left where the requirement goes (KPTI is a kernel config, not hardware;
UMIP is a CPU feature that only ever blocks user-mode leaks).

Author: bcoles

src/components/prefetch.c

@@ -159,7 +159,7 @@ KASLD_META("method:timing\n"
            "phase:probing\n"
            "live:1\n"
            "addr:virtual\n"
-           "hardware:KPTI\n");
+           "hardware:prefetch side-channel (mitigated by KPTI)\n");
 
 static int verbose = 0;
 

src/components/prefetch_directmap.c

@@ -75,7 +75,7 @@ KASLD_META("method:timing\n"
            "phase:probing\n"
            "live:1\n"
            "addr:virtual\n"
-           "hardware:KPTI\n"
+           "hardware:prefetch side-channel (mitigated by KPTI)\n"
            "config:RANDOMIZE_MEMORY\n");
 
 static int verbose = 0;

src/components/sidt.c

@@ -105,7 +105,7 @@ KASLD_META("method:parsed\n"
            "live:1\n"
            "addr:virtual\n"
            "patch:v3.10\n"
-           "hardware:UMIP\n");
+           "hardware:user-mode SIDT (mitigated by UMIP)\n");
 
 /* IDTR layout: 2-byte limit followed by base address (4 or 8 bytes) */
 struct idtr {

src/include/kasld/api.h

@@ -1448,7 +1448,11 @@ typedef int make_iso_compilers_happy;
  *   bypass:  Capability that bypasses the mitigation.
  *   patch:   Kernel version that closed the bug.
  *   cve:     Associated CVE.
- *   hardware: Hardware requirement.
+ *   hardware: Hardware requirement -- the positive condition the leak needs
+ *            (e.g. "TSX required", "prefetch side-channel"). A feature that
+ *            disables the leak goes in a trailing "(mitigated by <feature>)",
+ *            never as the bare value: KPTI, UMIP and the like name the
+ *            mitigation, not the requirement.
  */
 #define KASLD_META(text)                                                       \
   __attribute__((                                                              \

src/render/hardening.c

@@ -982,8 +982,8 @@ void render_hardening_text(void) {
       if (!rep.hw[i].succeeded)
         continue;
       /* Lead with the technique and what it leaks; the hardware field is the
-       * relevant CPU feature/mitigation (e.g. KPTI, "TSX required"), labelled
-       * so it does not read as the subject that leaks. */
+       * requirement (e.g. "TSX required", "prefetch side-channel (mitigated by
+       * KPTI)"), labelled so it does not read as the subject that leaks. */
       printf("    %-28s ", rep.hw[i].name);
       if (rep.hw[i].addr)
         printf("leaks %s address; ", rep.hw[i].addr);

tests/check-component-meta

@@ -27,6 +27,7 @@ fi
 rc=0
 missing=""
 nomethod=""
+badhw=""
 n=0
 for f in "$COMP"/*.c; do
   n=$((n + 1))
@@ -38,6 +39,18 @@ for f in "$COMP"/*.c; do
     nomethod="$nomethod $base"
     rc=1
   fi
+  # The hardware: field names the requirement; a feature that DISABLES the leak
+  # belongs in a trailing "(mitigated by X)", never as the bare value. The flagged
+  # tokens name mitigations, not requirements: KPTI is a kernel config, not
+  # hardware (a KPTI dependency belongs in config:); UMIP is a CPU feature but one
+  # that blocks user-mode instructions. A bare KPTI/UMIP where the requirement
+  # goes is the inverted meaning this catches.
+  hw=$(grep -E '"hardware:' "$f" | head -1 | sed -E 's/.*"hardware:([^"]*)".*/\1/')
+  req=$(printf '%s' "${hw%\\n}" | sed -E 's/\(mitigated by [^)]*\)//g')
+  if printf '%s' "$req" | grep -qwE 'KPTI|UMIP'; then
+    badhw="$badhw $base"
+    rc=1
+  fi
 done
 
 if [ -n "$missing" ]; then
@@ -48,6 +61,10 @@ if [ -n "$nomethod" ]; then
   printf '%scheck-component-meta: FAIL%s — KASLD_META without a method: key:\n' "$RED" "$RESET"
   for c in $nomethod; do printf '  %s\n' "$c"; done
 fi
+if [ -n "$badhw" ]; then
+  printf '%scheck-component-meta: FAIL%s — hardware: names a mitigation as the requirement (move it into "(mitigated by X)"):\n' "$RED" "$RESET"
+  for c in $badhw; do printf '  %s\n' "$c"; done
+fi
 if [ "$rc" -eq 0 ]; then
   printf '%scheck-component-meta: OK%s (%d components, all declare KASLD_META with a method: key)\n' "$GREEN" "$RESET" "$n"
 fi