Re: [patch 3/8] MDS basics 3

Andi,

On Wed, 20 Feb 2019, speck for Andi Kleen wrote:
> > Please provide a conclusive technical explanation why a NMI entered from
> > user space and returning to that would expose sensible information to an
> > attacker in an exploitable way.
> 
> Okay so you're not actually implementing full, like you stated earlier,
> but a strange undocumented minimal version of lazy.
> 
> Lazy is always a trade off. Since we still run with a single address
> space the CPU can always do some prefetching or speculative execution
> and fetch something nearby that the code doesn't actually access intentionally,
> which may end up leaking through some buffer.
> 
> In such a case even a NMI could leak.
> 
> Of course such a case is unlikely, but in theory it could happen.
> 
> The intention of the full option was to allow an option 
> for people who cannot accept any risk at all. Of course
> that's not the right approach for most users, but for a few
> it might be.

That makes sense if you map full to paranoid, which I tried to
avoid, but fair enough.

Thanks for the explanation.

       tglx