!1826 x86/speculation: Add Gather Data Sampling mitigation (829ecc1d) · Commits · EulixOS / Software / Kernel

Documentation/ABI/testing/sysfs-devices-system-cpu

+7 −6

Original line number	Original line	Diff line number	Diff line
	@@ -501,17 +501,18 @@ Description: information about CPUs heterogeneity.
	cpu_capacity: capacity of cpu#.		cpu_capacity: capacity of cpu#.

	What: /sys/devices/system/cpu/vulnerabilities		What: /sys/devices/system/cpu/vulnerabilities
			/sys/devices/system/cpu/vulnerabilities/gather_data_sampling
			/sys/devices/system/cpu/vulnerabilities/itlb_multihit
			/sys/devices/system/cpu/vulnerabilities/l1tf
			/sys/devices/system/cpu/vulnerabilities/mds
	/sys/devices/system/cpu/vulnerabilities/meltdown		/sys/devices/system/cpu/vulnerabilities/meltdown
			/sys/devices/system/cpu/vulnerabilities/mmio_stale_data
			/sys/devices/system/cpu/vulnerabilities/retbleed
			/sys/devices/system/cpu/vulnerabilities/spec_store_bypass
	/sys/devices/system/cpu/vulnerabilities/spectre_v1		/sys/devices/system/cpu/vulnerabilities/spectre_v1
	/sys/devices/system/cpu/vulnerabilities/spectre_v2		/sys/devices/system/cpu/vulnerabilities/spectre_v2
	/sys/devices/system/cpu/vulnerabilities/spec_store_bypass
	/sys/devices/system/cpu/vulnerabilities/l1tf
	/sys/devices/system/cpu/vulnerabilities/mds
	/sys/devices/system/cpu/vulnerabilities/srbds		/sys/devices/system/cpu/vulnerabilities/srbds
	/sys/devices/system/cpu/vulnerabilities/tsx_async_abort		/sys/devices/system/cpu/vulnerabilities/tsx_async_abort
	/sys/devices/system/cpu/vulnerabilities/itlb_multihit
	/sys/devices/system/cpu/vulnerabilities/mmio_stale_data
	/sys/devices/system/cpu/vulnerabilities/retbleed
	Date: January 2018		Date: January 2018
	Contact: Linux kernel mailing list <linux-kernel@vger.kernel.org>		Contact: Linux kernel mailing list <linux-kernel@vger.kernel.org>
	Description: Information about CPU vulnerabilities		Description: Information about CPU vulnerabilities

Documentation/admin-guide/hw-vuln/gather_data_sampling.rst

0 → 100644

+99 −0

Original line number	Original line	Diff line number	Diff line
			.. SPDX-License-Identifier: GPL-2.0

			GDS - Gather Data Sampling
			==========================

			Gather Data Sampling is a hardware vulnerability which allows unprivileged
			speculative access to data which was previously stored in vector registers.

			Problem
			-------
			When a gather instruction performs loads from memory, different data elements
			are merged into the destination vector register. However, when a gather
			instruction that is transiently executed encounters a fault, stale data from
			architectural or internal vector registers may get transiently forwarded to the
			destination vector register instead. This will allow a malicious attacker to
			infer stale data using typical side channel techniques like cache timing
			attacks. GDS is a purely sampling-based attack.

			The attacker uses gather instructions to infer the stale vector register data.
			The victim does not need to do anything special other than use the vector
			registers. The victim does not need to use gather instructions to be
			vulnerable.

			Because the buffers are shared between Hyper-Threads cross Hyper-Thread attacks
			are possible.

			Attack scenarios
			----------------
			Without mitigation, GDS can infer stale data across virtually all
			permission boundaries:

			Non-enclaves can infer SGX enclave data
			Userspace can infer kernel data
			Guests can infer data from hosts
			Guest can infer guest from other guests
			Users can infer data from other users

			Because of this, it is important to ensure that the mitigation stays enabled in
			lower-privilege contexts like guests and when running outside SGX enclaves.

			The hardware enforces the mitigation for SGX. Likewise, VMMs should ensure
			that guests are not allowed to disable the GDS mitigation. If a host erred and
			allowed this, a guest could theoretically disable GDS mitigation, mount an
			attack, and re-enable it.

			Mitigation mechanism
			--------------------
			This issue is mitigated in microcode. The microcode defines the following new
			bits:

			================================ === ============================
			IA32_ARCH_CAPABILITIES[GDS_CTRL] R/O Enumerates GDS vulnerability
			and mitigation support.
			IA32_ARCH_CAPABILITIES[GDS_NO] R/O Processor is not vulnerable.
			IA32_MCU_OPT_CTRL[GDS_MITG_DIS] R/W Disables the mitigation
			0 by default.
			IA32_MCU_OPT_CTRL[GDS_MITG_LOCK] R/W Locks GDS_MITG_DIS=0. Writes
			to GDS_MITG_DIS are ignored
			Can't be cleared once set.
			================================ === ============================

			GDS can also be mitigated on systems that don't have updated microcode by
			disabling AVX. This can be done by setting "clearcpuid=avx" on the kernel
			command-line.

			Mitigation control on the kernel command line
			---------------------------------------------
			The mitigation can be disabled by setting "gather_data_sampling=off" or
			"mitigations=off" on the kernel command line. Not specifying either will
			default to the mitigation being enabled.

			GDS System Information
			------------------------
			The kernel provides vulnerability status information through sysfs. For
			GDS this can be accessed by the following sysfs file:

			/sys/devices/system/cpu/vulnerabilities/gather_data_sampling

			The possible values contained in this file are:

			============================== =============================================
			Not affected Processor not vulnerable.
			Vulnerable Processor vulnerable and mitigation disabled.
			Vulnerable: No microcode Processor vulnerable and microcode is missing
			mitigation.
			Mitigation: Microcode Processor is vulnerable and mitigation is in
			effect.
			Mitigation: Microcode (locked) Processor is vulnerable and mitigation is in
			effect and cannot be disabled.
			Unknown: Dependent on
			hypervisor status Running on a virtual guest processor that is
			affected but with no way to know if host
			processor is mitigated or vulnerable.
			============================== =============================================

			GDS Default mitigation
			----------------------
			The updated microcode will enable the mitigation by default. The kernel's
			default action is to leave the mitigation enabled.

Documentation/admin-guide/hw-vuln/index.rst

+1 −0

Original line number	Original line	Diff line number	Diff line
	@@ -18,3 +18,4 @@ are configurable at compile, boot or run time.
	core-scheduling.rst		core-scheduling.rst
	processor_mmio_stale_data.rst		processor_mmio_stale_data.rst
	cross-thread-rsb.rst		cross-thread-rsb.rst
			gather_data_sampling.rst

Documentation/admin-guide/kernel-parameters.txt

+28 −11

Original line number	Original line	Diff line number	Diff line
	@@ -1477,6 +1477,20 @@
	Format: off \| on		Format: off \| on
	default: on		default: on

			gather_data_sampling=
			[X86,INTEL] Control the Gather Data Sampling (GDS)
			mitigation.

			Gather Data Sampling is a hardware vulnerability which
			allows unprivileged speculative access to data which was
			previously stored in vector registers.

			This issue is mitigated by default in updated microcode.
			The mitigation may have a performance impact but can be
			disabled.

			off: Disable GDS mitigation.

	gcov_persist= [GCOV] When non-zero (default), profiling data for		gcov_persist= [GCOV] When non-zero (default), profiling data for
	kernel modules is saved and remains accessible via		kernel modules is saved and remains accessible via
	debugfs, even when the module is unloaded/reloaded.		debugfs, even when the module is unloaded/reloaded.
	@@ -3024,22 +3038,25 @@
	Disable all optional CPU mitigations. This		Disable all optional CPU mitigations. This
	improves system performance, but it may also		improves system performance, but it may also
	expose users to several CPU vulnerabilities.		expose users to several CPU vulnerabilities.
	Equivalent to: nopti [X86,PPC]		Equivalent to: if nokaslr then kpti=0 [ARM64]
	kpti=0 [ARM64]		gather_data_sampling=off [X86]
	nospectre_v1 [X86,PPC]		kvm.nx_huge_pages=off [X86]
	nobp=0 [S390]
	nospectre_v2 [X86,PPC,S390,ARM64]
	spectre_v2_user=off [X86]
	spec_store_bypass_disable=off [X86,PPC]
	ssbd=force-off [ARM64]
	l1tf=off [X86]		l1tf=off [X86]
	mds=off [X86]		mds=off [X86]
	tsx_async_abort=off [X86]		mmio_stale_data=off [X86]
	kvm.nx_huge_pages=off [X86]
	no_entry_flush [PPC]		no_entry_flush [PPC]
	no_uaccess_flush [PPC]		no_uaccess_flush [PPC]
	mmio_stale_data=off [X86]		nobp=0 [S390]
			nopti [X86,PPC]
			nospectre_bhb [ARM64]
			nospectre_v1 [X86,PPC]
			nospectre_v2 [X86,PPC,S390,ARM64]
	retbleed=off [X86]		retbleed=off [X86]
			spec_store_bypass_disable=off [X86,PPC]
			spectre_v2_user=off [X86]
			srbds=off [X86,INTEL]
			ssbd=force-off [ARM64]
			tsx_async_abort=off [X86]

	Exceptions:		Exceptions:
	This does not have any effect on		This does not have any effect on

arch/x86/include/asm/cpufeatures.h

+1 −0

Original line number	Original line	Diff line number	Diff line
	@@ -477,5 +477,6 @@
	#define X86_BUG_RETBLEED X86_BUG(27) /* CPU is affected by RETBleed */		#define X86_BUG_RETBLEED X86_BUG(27) /* CPU is affected by RETBleed */
	#define X86_BUG_EIBRS_PBRSB X86_BUG(28) /* EIBRS is vulnerable to Post Barrier RSB Predictions */		#define X86_BUG_EIBRS_PBRSB X86_BUG(28) /* EIBRS is vulnerable to Post Barrier RSB Predictions */
	#define X86_BUG_SMT_RSB X86_BUG(29) /* CPU is vulnerable to Cross-Thread Return Address Predictions */		#define X86_BUG_SMT_RSB X86_BUG(29) /* CPU is vulnerable to Cross-Thread Return Address Predictions */
			#define X86_BUG_GDS X86_BUG(30) /* CPU is affected by Gather Data Sampling */

	#endif /* _ASM_X86_CPUFEATURES_H */		#endif /* _ASM_X86_CPUFEATURES_H */