[MODERATED] Re: ***UNCHECKED*** Re: [PATCH v5 08/11] TAAv5 8

On Tue, 15 Oct 2019, speck for Josh Poimboeuf wrote:

> > > Since all (or most?) modern Intel CPUs are vulnerable to TAA, 
> > > defaulting to tsx=auto would effectively be the same as defaulting 
> > > to tsx=off, right?  How does this help with regressions?
> > 
> > The mitigation is only needed on CPUs where verw doesn't have the buffer 
> > clearing semantics.
> 
> Can you elaborate?  I have no idea what you're trying to say and how it
> relates to my question :-)

Only those CPUs with TSX *and* with MDS_NO need TSX disabled in order to 
protect from this issues.

The CPUs that don't enumarate MDS_NO (and therefore got ucode update with 
verw buffer-clearing semantics) are fully mitigated against TAA by MDS 
mitigations already.

Therefore the set of CPUs where we *really* need to turn of TSX in order 
to protect from TAA is currently rather minimal (CascadeLake-B, 
WhiskeyLake-V, CommitLake, CoffeeLake-R), so force-disabling on all CPUs 
covers way bigger set of platforms than actually needed.

-- 
Jiri Kosina
SUSE Labs