[MODERATED] Re: [PATCH v5 08/11] TAAv5 8

[Borislav Petkov <bp@suse.de>]

On Tue, Oct 15, 2019 at 12:34:54PM +0200, speck for Michal Hocko wrote:
> diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
> index d6e1faa28c58..9823e34b81ce 100644
> --- a/arch/x86/Kconfig
> +++ b/arch/x86/Kconfig
> @@ -1940,6 +1940,28 @@ config X86_INTEL_MEMORY_PROTECTION_KEYS
>  
>  	  If unsure, say y.
>  
> +config X86_INTEL_ENABLE_SAFE_TSX
> +	prompt ""

Needs a prompt sentence, otherwise it looks like this in menuconfig:

  │ │                                 [ ] Intel Memory Protection Keys                                                                       │ │
  │ │                                 [ ]  (NEW)                                                                                             │ │
  │ │                                 [*] EFI runtime service support

> +	def_bool n
> +	depends on CPU_SUP_INTEL
> +	---help---
> +	  Intel's TSX (Transactional Synchronization Extensions) feature
> +	  allows to optimize locking protocols through lock elision which
> +	  can lead to a noticeable performance boost.
> +
> +	  On the other hand it has been shown that TSX can be exploited
> +	  to form side channel attacks (e.g. TAA) and chances are there
> +	  will be more of those attacks discovered in the future.
> +
> +	  Therefore the TSX is not enabled by default. An admin might override

s/the //

> +	  this decision by tsx=on command line parameter. This has a risk that
> +	  TSX will get enabled also on platforms which are known to be vulnerable
> +	  to attacks like TAA and a safer option is to use tsx=auto command line
> +	  parameter. Enabling this config option will make tsx=auto the default.
> +	  See Documentation/admin-guide/kernel-parameters.txt for more details.
> +
> +	  If you really benefit from TSX then enable this option, otherwise say n.
					^
					and you know what you're doing,

> +
>  config EFI
>  	bool "EFI runtime service support"
>  	depends on ACPI
> diff --git a/arch/x86/kernel/cpu/tsx.c b/arch/x86/kernel/cpu/tsx.c
> index 96320449abb7..d3dc1ce5cd4b 100644
> --- a/arch/x86/kernel/cpu/tsx.c
> +++ b/arch/x86/kernel/cpu/tsx.c
> @@ -69,6 +69,14 @@ static bool __init tsx_ctrl_is_supported(void)
>  	return !!(ia32_cap & ARCH_CAP_TSX_CTRL_MSR);
>  }
>  
> +static enum tsx_ctrl_states x86_safe_tsx_mode(void)

x86_get_tsx_mode()

Thx.

-- 
Regards/Gruss,
    Boris.

SUSE Software Solutions Germany GmbH, GF: Felix Imendörffer, HRB 36809, AG Nürnberg
--