From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.linutronix.de (193.142.43.55:993) by crypto-ml.lab.linutronix.de with IMAP4-SSL for ; 24 Oct 2019 16:58:46 -0000 Received: from mx2.suse.de ([195.135.220.15] helo=mx1.suse.de) by Galois.linutronix.de with esmtps (TLS1.2:DHE_RSA_AES_256_CBC_SHA256:256) (Exim 4.80) (envelope-from ) id 1iNgRg-0004VP-Vm for speck@linutronix.de; Thu, 24 Oct 2019 18:58:46 +0200 Received: from relay2.suse.de (unknown [195.135.220.254]) by mx1.suse.de (Postfix) with ESMTP id 4FF1EB63D for ; Thu, 24 Oct 2019 16:58:38 +0000 (UTC) Date: Thu, 24 Oct 2019 18:58:28 +0200 From: Borislav Petkov Subject: [MODERATED] Re: [PATCH 9/9] TAA 9 Message-ID: <20191024165828.GF14115@zn.tnic> References: <33b6f0fd589ba3ea35f05aacbcda0be19352a994.1571905227.git.bp@suse.de> <20191024161016.dnqexztns5xaiwh2@treble> MIME-Version: 1.0 In-Reply-To: <20191024161016.dnqexztns5xaiwh2@treble> Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable To: speck@linutronix.de List-ID: On Thu, Oct 24, 2019 at 11:10:16AM -0500, speck for Josh Poimboeuf wrote: > I think this is misleading. tsx=3Don doesn't make you vulnerable to TAA, > because we still the TAA mitigation. Changed to: Therefore TSX is not enabled by default (aka tsx=3Doff). An admin might override this decision by tsx=3Don the command line parameter. Even with TSX enabled, the kernel will attempt to enable the best=20 possible TAA mitigation setting depending on the microcode availabl= e=20 for the particular machine. > tsx=3Don vs tsx=3Dauto is not a security consideration, but rather a > performance one. With tsx=3Dauto you disable TSX on some TAA-affected > CPUs so you don't have to pay the performance penalty of the MDS > mitigations. By performance penalty you mean, when you have TSX disabled on those parts, you'll save yourself the VERW which should be taking care of TAA too? >=20 > > + > > +config X86_INTEL_TSX_MODE_OFF > > + bool "off" > > + help > > + TSX is always disabled - equals tsx=3Doff command line parameter. >=20 > Define "always" :-) Changed to: "TSX is disabled if possible - equals to tsx=3Doff command line parameter." > Not exactly :-) This also leaves TSX enabled on MDS vulnerable parts. Your point being, the MD_CLEAR which takes care of TAA too? --=20 Regards/Gruss, Boris. SUSE Software Solutions Germany GmbH, GF: Felix Imend=C3=B6rffer, HRB 36809, = AG N=C3=BCrnberg --=20