[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [PATCH v2 for-4.21 0/2] x86/AMD: deal with RDSEED issues
- To: Jan Beulich <jbeulich@xxxxxxxx>
- From: Roger Pau Monné <roger.pau@xxxxxxxxxx>
- Date: Fri, 31 Oct 2025 11:54:06 +0100
- Arc-authentication-results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=citrix.com; dmarc=pass action=none header.from=citrix.com; dkim=pass header.d=citrix.com; arc=none
- Arc-message-signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=PxEqSoxAfuqXaN12M/HaAOBAdOoe4YwaxJ3x1Z75AOQ=; b=ekuGim6L4gCke0Y6g5i1cdWyG86APjc+CjskJqo42t5Q46yaNDX9UkhmxkHo7nn2iwKj0HawPEzXL0R+sKS+KxwMQpxIlfL11SHpiz8syQn2l+hawgMQTFy95FPJui7N7MIF+01mj8b6icf71Fz++FWJFrYGCtCk/+fgPXJ+34Vr7z957Cmd2u4rPTUd8AtGCUEmE+ZVBMu5aCYrEkuOrgmUbsveRi7sqQqI+N3it0JUsMGb8QKFFzY+BcPA6umU7xIcOXIdoGDZXfJDFtL3n7SKs+HVxrNmZ4OSzZxHTqakbPsrsoelRyrH3aDkyxTr5OJl9cf6QwjWxncwBbMLbw==
- Arc-seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=fJJn89nyx7rFqs7v8izAAy/hj9cJ0l3ACnbY8MmBVYHVvP1R/0NiMNVTpDDMz9H9c/yxDpbMoJjP5LNPmD5yv1cnRnTH/VP2rr+tS00B9ROT7DTA6zdtb86txWV9nfFzEAOdL0OTqHLxJtGIqoTiOikFXlZ1tnANwIryNz5vJ4eK9UCkLG+HghqNb994YYPquvBu+iQ2RtM+f1g8iDOrtF+t05JA31EOTadXQjQpNUTA5PXxpJsqrDqwpvKXAGbDPDsSjO02yExn4EiQHvPzlb1Dh2Y6cCgPWQFNNQ3/n7MvririrX8VMZmoABPr4A+bTBMKdneeDi/w5JkXn7ygUQ==
- Authentication-results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=citrix.com;
- Cc: "xen-devel@xxxxxxxxxxxxxxxxxxxx" <xen-devel@xxxxxxxxxxxxxxxxxxxx>, Andrew Cooper <andrew.cooper3@xxxxxxxxxx>, Oleksii Kurochko <oleksii.kurochko@xxxxxxxxx>
- Delivery-date: Fri, 31 Oct 2025 10:54:22 +0000
- List-id: Xen developer discussion <xen-devel.lists.xenproject.org>
On Fri, Oct 31, 2025 at 11:29:44AM +0100, Jan Beulich wrote:
> On 31.10.2025 11:22, Roger Pau Monné wrote:
> > On Tue, Oct 28, 2025 at 04:32:17PM +0100, Jan Beulich wrote:
> >> Both patches also want 'x86/CPU: extend is_forced_cpu_cap()'s "reach"' in
> >> place.
> >>
> >> 1: disable RDSEED on Fam17 model 47 stepping 0
> >> 2: disable RDSEED on most of Zen5
> >
> > For both patches: don't we need to set the feature in the max policy
> > to allow for incoming migrations of guests that have already seen the
> > feature?
>
> No, such guests should not run on affected hosts (unless overrides are in
> place),
> or else they'd face sudden malfunction of RDSEED. If an override was in place
> on
> the source host, an override will also need to be put in place on the
> destination
> one.
But they may be malfunctioning before already, if started on a
vulnerable hosts without this fix and having seen RDSEED?
IMO after this fix is applied you should do pool leveling, at which
point RDSEED shouldn't be advertised anymore. Having the feature in
the max policy allows to evacuate running guests while updating the
pool. Otherwise those existing guests would be stuck to run on
non-updated hosts.
Thanks, Roger.
|
