From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.linutronix.de (193.142.43.55:993) by crypto-ml.lab.linutronix.de with IMAP4-SSL for ; 24 Oct 2019 16:33:43 -0000 Received: from mx2.suse.de ([195.135.220.15] helo=mx1.suse.de) by Galois.linutronix.de with esmtps (TLS1.2:DHE_RSA_AES_256_CBC_SHA256:256) (Exim 4.80) (envelope-from ) id 1iNg3S-0002vV-Sk for speck@linutronix.de; Thu, 24 Oct 2019 18:33:43 +0200 Received: from relay2.suse.de (unknown [195.135.220.254]) by mx1.suse.de (Postfix) with ESMTP id A4B11AC28 for ; Thu, 24 Oct 2019 16:33:37 +0000 (UTC) Date: Thu, 24 Oct 2019 18:33:36 +0200 From: Borislav Petkov Subject: [MODERATED] Re: [PATCH 3/9] TAA 3 Message-ID: <20191024163336.GC14115@zn.tnic> References: <580e02757c3e639bff00fcea830aa46eba46a92f.1571905227.git.bp@suse.de> <20191024153015.akowqjkf2wm52scv@treble> MIME-Version: 1.0 In-Reply-To: <20191024153015.akowqjkf2wm52scv@treble> Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable To: speck@linutronix.de List-ID: On Thu, Oct 24, 2019 at 10:30:15AM -0500, speck for Josh Poimboeuf wrote: > This still needs details about when 'tsx=3Doff' does and doesn't work. >=20 > The above makes it sound like it's off for all CPUs, when in fact it's > only off for newer MDS_NO CPUs. How does that sound (and that is being mentioned somewhere in all the text but here it is important to have): off - Disable TSX on the system. (Note that this option takes effect only on newer CPUs which are not vulnerable to MDS, i.e., have MSR_IA32_ARCH_CAPABILITIES.MDS_NO=3D1 and which get the new IA32_TSX_CTRL MSR through a microcode update. This new MSR allows for the reliable deactivation of the TSX functionality.) > It should also perhaps describe the risks associated with tsx=3Don. While > there are mitigations for all known issues (i.e., the tsx_async_abort=3D > option), TSX has been known to be an accelerator for several previous > speculation-related CVEs, and so there may be unknown security risks > associated with leaving it enabled. You've basically said it nicely already: "Although there are mitigations for all known security vulnerabilities, TSX has been known to be an accelerator for several previous speculation-related CVEs, and so there may be unknown security risks associated with leaving it enabled." ACK? --=20 Regards/Gruss, Boris. SUSE Software Solutions Germany GmbH, GF: Felix Imend=C3=B6rffer, HRB 36809, = AG N=C3=BCrnberg --=20