Qubes Cpu Pinning: automatically pin CPUs for VMs

[Atrate]

@solene

SMT is still disabled by default because it’s a shitshow that can’t really be considered safe I guess. Is it what you mean?

I was referring to this comment by @renehoj, wherein you could help make SMT (moderately) more secure by setting sched-gran=core, but it was not possible with asymmetric CPUs.

Is it safe to use hyper-threading (SMT) with Qubes OS if done the 'correct way'?

sched-gran doesn’t work on CPUs that are asymmetric, like the Intel E and P core CPUs. It also does solve all problems, transient HT exploits are still possible even if you change the scheduling granularity to core. If you want to use smt then sched-gran=core is better than cpu, if you can use it, but it doesn’t make smt safe. If smt is worth it depends on your threat model, and your work load, but if you need the highest level of security you shouldn’t enable smt, it’s never going to be safe…

@solene

Are you sure soft affinity works by default?

I am not fully sure about that, althought the Xen wiki page about CPU pinning does not mention that it should only work with credit(1). Later in the day I can do some testing based on the amount of fan noise/temperature rise when I perform soft pinning.