Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Date:   Wed, 16 Feb 2022 10:59:50 -0800
From:   Pawan Gupta <pawan.kumar.gupta@linux.intel.com>
To:     Andrew Cooper <Andrew.Cooper3@citrix.com>
Cc:     Borislav Petkov <bp@alien8.de>,
        Thomas Gleixner <tglx@linutronix.de>,
        Ingo Molnar <mingo@redhat.com>,
        Dave Hansen <dave.hansen@linux.intel.com>,
        "x86@kernel.org" <x86@kernel.org>,
        "H. Peter Anvin" <hpa@zytor.com>, Andi Kleen <ak@linux.intel.com>,
        Tony Luck <tony.luck@intel.com>,
        "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
        "antonio.gomez.iglesias@linux.intel.com" 
        <antonio.gomez.iglesias@linux.intel.com>,
        "neelima.krishnan@intel.com" <neelima.krishnan@intel.com>,
        "stable@vger.kernel.org" <stable@vger.kernel.org>
Subject: Re: [PATCH] x86/tsx: Use MSR_TSX_CTRL to clear CPUID bits
Message-ID: <20220216185950.6nmkllbgawv5tjd7@guptapa-mobl1.amr.corp.intel.com>
References: <20220215002014.mb7g4y3hfefmyozx@guptapa-mobl1.amr.corp.intel.com>
 <Ygt/QSTSMlUJnzFS@zn.tnic>
 <20220215121103.vhb2lpoygxn3xywy@guptapa-mobl1.amr.corp.intel.com>
 <YgvVcdpmFCCn20A7@zn.tnic>
 <20220215181931.wxfsn2a3npg7xmi2@guptapa-mobl1.amr.corp.intel.com>
 <YgwAHU7gCnik8Kv6@zn.tnic>
 <20220216003950.5jxecuf773g2kuwl@guptapa-mobl1.amr.corp.intel.com>
 <6724088f-c7cf-da92-e894-d8970f13bf1e@citrix.com>
 <20220216012841.vxlnugre2j4pczp7@guptapa-mobl1.amr.corp.intel.com>
 <a1e836c5-e2d0-3916-ec11-9f8690463c58@citrix.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
In-Reply-To: <a1e836c5-e2d0-3916-ec11-9f8690463c58@citrix.com>
Precedence: bulk

On 16.02.2022 11:46, Andrew Cooper wrote:
>On 16/02/2022 01:28, Pawan Gupta wrote:
>> On 16.02.2022 00:49, Andrew Cooper wrote:
>>> On 16/02/2022 00:39, Pawan Gupta wrote:
>>>> On 15.02.2022 20:33, Borislav Petkov wrote:
>>>>> On Tue, Feb 15, 2022 at 10:19:31AM -0800, Pawan Gupta wrote:
>>>>>> I admit it has gotten complicated with so many bits associated with
>>>>>> TSX.
>>>>>
>>>>> Yah, and looka here:
>>>>>
>>>>> https://github.com/andyhhp/xen/commit/ad9f7c3b2e0df38ad6d54f4769d4dccf765fbcee
>>>>>
>>>>>
>>>>>
>>>>> It seems it isn't complicated enough. ;-\
>>>>>
>>>>> Andy just made me aware of this thing where you guys have added a new
>>>>> MSR bit:
>>>>>
>>>>> MSR_MCU_OPT_CTRL[1] which is called something like
>>>>> MCU_OPT_CTRL_RTM_ALLOW or so.
>>>>
>>>> RTM_ALLOW bit was added to MSR_MCU_OPT_CTRL, but its not set by
>>>> default,
>>>> and it is *not* recommended to be used in production deployments [1]:
>>>>
>>>>   Although MSR 0x122 (TSX_CTRL) and MSR 0x123 (IA32_MCU_OPT_CTRL)
>>>> can be
>>>>   used to reenable Intel TSX for development, doing so is not
>>>> recommended
>>>>   for production deployments. In particular, applying MD_CLEAR flows
>>>> for
>>>>   mitigation of the Intel TSX Asynchronous Abort (TAA) transient
>>>> execution
>>>>   attack may not be effective on these processors when Intel TSX is
>>>>   enabled with updated microcode. The processors continue to be
>>>> mitigated
>>>>   against TAA when Intel TSX is disabled.
>>>
>>> The purpose of setting RTM_ALLOW isn't to enable TSX per say.
>>>
>>> The purpose is to make MSR_TSX_CTRL.RTM_DISABLE behaves consistently on
>>> all hardware, which reduces the complexity and invasiveness of dealing
>>> with this special case, because the TAA workaround will still turn TSX
>>> off by default.
>>>
>>> The configuration you don't want to be running with is RTM_ALLOW &&
>>> !RTM_DISABLE, because that is "still vulnerable to TSX Async Abort".
>>
>> I am not sure how a system can end up with RTM_ALLOW && !RTM_DISABLE? I
>> have no problem taking care of this case, I am just debating why we need
>> it.
>
>Well for one, when Linux is starting up as the kexec environment
>following Xen.
>
>You're not coding for "what logic should follow a clean microcode
>load".  You're coding for "how to take the arbitrary state that my
>preceding environment left, and turn it into what I want".

I will add the handling for this case (and I am going to follow these
words of wisdom in my future work).

Thanks,
Pawan