[MODERATED] Re: [PATCH v3 00/32] MDSv3 12

[Andi Kleen <ak@linux.intel.com>]

On Wed, Jan 09, 2019 at 09:35:22AM -0800, speck for Linus Torvalds wrote:
> On Wed, Jan 9, 2019 at 3:01 AM speck for Andi Kleen <speck@linutronix.de> wrote:
> >
> > VERW is not done unconditionally because it doesn't allow reporting
> > the correct status in the vulnerabilities file, which I consider important.
> > Instead we now have a mds=verw option that can be set as needed,
> > but is reported explicitely in the mitigation status.
> 
> I also don't see what the logic of this is AT ALL.
> 
> "Reporting" has absolutely nothign to do with "use VERW". The fact
> that you link the two is crazy.
> 
> The rule for VERW should be simple: use VERW if the CPU doesn't have
> the NOMDS bit set (or whatever the name is today).

The case that worried me is that with this we would end up
with some systems which are actually protected, but report vulnerable.

So you could not simply say

"If the sysfs file says you're vulnerable you're vulnerable"

but would need

"If the sysfs file says you're vulnerable, you're vulnerable except
<add some long paragraph of small print enumerating different
vmware and other hyper visor versions>"

Doesn't seem like a clear message for me.

With the current scheme at least only the people who see vulnerable
have to read the documentation and figure out the VMWare mess.

-Andi