[MODERATED] Re: ***UNCHECKED*** Re: [PATCH 9/9] TAA 9

On Thu 24-10-19 18:58:28, speck for Borislav Petkov wrote:
> On Thu, Oct 24, 2019 at 11:10:16AM -0500, speck for Josh Poimboeuf wrote:
> > I think this is misleading.  tsx=on doesn't make you vulnerable to TAA,
> > because we still the TAA mitigation.
> 
> Changed to:
> 
>           Therefore TSX is not enabled by default (aka tsx=off). An admin
>           might override this decision by tsx=on the command line parameter.
>           Even with TSX enabled, the kernel will attempt to enable the best 
>           possible TAA mitigation setting depending on the microcode available 
>           for the particular machine.
> 
> > tsx=on vs tsx=auto is not a security consideration, but rather a
> > performance one.  With tsx=auto you disable TSX on some TAA-affected
> > CPUs so you don't have to pay the performance penalty of the MDS
> > mitigations.
> 
> By performance penalty you mean, when you have TSX disabled on those
> parts, you'll save yourself the VERW which should be taking care of TAA
> too?
> 
> > 
> > > +
> > > +config X86_INTEL_TSX_MODE_OFF
> > > +	bool "off"
> > > +	help
> > > +	  TSX is always disabled - equals tsx=off command line parameter.
> > 
> > Define "always" :-)
> 
> Changed to:
> 
> "TSX is disabled if possible - equals to tsx=off command line parameter."

Thanks for refinements. The changelog and the help text was written at
the time when all this was still clear as mud.
-- 
Michal Hocko
SUSE Labs