Skip to content

Commit 04d29e3

Browse files
torvaldstorvalds
committed
Merge tag 'x86_bugs_for_v6.17_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull x86 CPU mitigation updates from Borislav Petkov: - Untangle the Retbleed from the ITS mitigation on Intel. Allow for ITS to enable stuffing independently from Retbleed, do some cleanups to simplify and streamline the code - Simplify SRSO and make mitigation types selection more versatile depending on the Retbleed mitigation selection. Simplify code some - Add the second part of the attack vector controls which provide a lot friendlier user interface to the speculation mitigations than selecting each one by one as it is now. Instead, the selection of whole attack vectors which are relevant to the system in use can be done and protection against only those vectors is enabled, thus giving back some performance to the users * tag 'x86_bugs_for_v6.17_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (31 commits) x86/bugs: Print enabled attack vectors x86/bugs: Add attack vector controls for TSA x86/pti: Add attack vector controls for PTI x86/bugs: Add attack vector controls for ITS x86/bugs: Add attack vector controls for SRSO x86/bugs: Add attack vector controls for L1TF x86/bugs: Add attack vector controls for spectre_v2 x86/bugs: Add attack vector controls for BHI x86/bugs: Add attack vector controls for spectre_v2_user x86/bugs: Add attack vector controls for retbleed x86/bugs: Add attack vector controls for spectre_v1 x86/bugs: Add attack vector controls for GDS x86/bugs: Add attack vector controls for SRBDS x86/bugs: Add attack vector controls for RFDS x86/bugs: Add attack vector controls for MMIO x86/bugs: Add attack vector controls for TAA x86/bugs: Add attack vector controls for MDS x86/bugs: Define attack vectors relevant for each bug x86/Kconfig: Add arch attack vector support cpu: Define attack vectors ...
2 parents d7223ae + a026dc6 commit 04d29e3

File tree

9 files changed

+713
-154
lines changed

9 files changed

+713
-154
lines changed

‎Documentation/admin-guide/hw-vuln/attack_vector_controls.rst

Lines changed: 238 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,238 @@
1+
.. SPDX-License-Identifier: GPL-2.0
2+
3+
Attack Vector Controls
4+
======================
5+
6+
Attack vector controls provide a simple method to configure only the mitigations
7+
for CPU vulnerabilities which are relevant given the intended use of a system.
8+
Administrators are encouraged to consider which attack vectors are relevant and
9+
disable all others in order to recoup system performance.
10+
11+
When new relevant CPU vulnerabilities are found, they will be added to these
12+
attack vector controls so administrators will likely not need to reconfigure
13+
their command line parameters as mitigations will continue to be correctly
14+
applied based on the chosen attack vector controls.
15+
16+
Attack Vectors
17+
--------------
18+
19+
There are 5 sets of attack-vector mitigations currently supported by the kernel:
20+
21+
#. :ref:`user_kernel`
22+
#. :ref:`user_user`
23+
#. :ref:`guest_host`
24+
#. :ref:`guest_guest`
25+
#. :ref:`smt`
26+
27+
To control the enabled attack vectors, see :ref:`cmdline`.
28+
29+
.. _user_kernel:
30+
31+
User-to-Kernel
32+
^^^^^^^^^^^^^^
33+
34+
The user-to-kernel attack vector involves a malicious userspace program
35+
attempting to leak kernel data into userspace by exploiting a CPU vulnerability.
36+
The kernel data involved might be limited to certain kernel memory, or include
37+
all memory in the system, depending on the vulnerability exploited.
38+
39+
If no untrusted userspace applications are being run, such as with single-user
40+
systems, consider disabling user-to-kernel mitigations.
41+
42+
Note that the CPU vulnerabilities mitigated by Linux have generally not been
43+
shown to be exploitable from browser-based sandboxes. User-to-kernel
44+
mitigations are therefore mostly relevant if unknown userspace applications may
45+
be run by untrusted users.
46+
47+
*user-to-kernel mitigations are enabled by default*
48+
49+
.. _user_user:
50+
51+
User-to-User
52+
^^^^^^^^^^^^
53+
54+
The user-to-user attack vector involves a malicious userspace program attempting
55+
to influence the behavior of another unsuspecting userspace program in order to
56+
exfiltrate data. The vulnerability of a userspace program is based on the
57+
program itself and the interfaces it provides.
58+
59+
If no untrusted userspace applications are being run, consider disabling
60+
user-to-user mitigations.
61+
62+
Note that because the Linux kernel contains a mapping of all physical memory,
63+
preventing a malicious userspace program from leaking data from another
64+
userspace program requires mitigating user-to-kernel attacks as well for
65+
complete protection.
66+
67+
*user-to-user mitigations are enabled by default*
68+
69+
.. _guest_host:
70+
71+
Guest-to-Host
72+
^^^^^^^^^^^^^
73+
74+
The guest-to-host attack vector involves a malicious VM attempting to leak
75+
hypervisor data into the VM. The data involved may be limited, or may
76+
potentially include all memory in the system, depending on the vulnerability
77+
exploited.
78+
79+
If no untrusted VMs are being run, consider disabling guest-to-host mitigations.
80+
81+
*guest-to-host mitigations are enabled by default if KVM support is present*
82+
83+
.. _guest_guest:
84+
85+
Guest-to-Guest
86+
^^^^^^^^^^^^^^
87+
88+
The guest-to-guest attack vector involves a malicious VM attempting to influence
89+
the behavior of another unsuspecting VM in order to exfiltrate data. The
90+
vulnerability of a VM is based on the code inside the VM itself and the
91+
interfaces it provides.
92+
93+
If no untrusted VMs, or only a single VM is being run, consider disabling
94+
guest-to-guest mitigations.
95+
96+
Similar to the user-to-user attack vector, preventing a malicious VM from
97+
leaking data from another VM requires mitigating guest-to-host attacks as well
98+
due to the Linux kernel phys map.
99+
100+
*guest-to-guest mitigations are enabled by default if KVM support is present*
101+
102+
.. _smt:
103+
104+
Cross-Thread
105+
^^^^^^^^^^^^
106+
107+
The cross-thread attack vector involves a malicious userspace program or
108+
malicious VM either observing or attempting to influence the behavior of code
109+
running on the SMT sibling thread in order to exfiltrate data.
110+
111+
Many cross-thread attacks can only be mitigated if SMT is disabled, which will
112+
result in reduced CPU core count and reduced performance.
113+
114+
If cross-thread mitigations are fully enabled ('auto,nosmt'), all mitigations
115+
for cross-thread attacks will be enabled. SMT may be disabled depending on
116+
which vulnerabilities are present in the CPU.
117+
118+
If cross-thread mitigations are partially enabled ('auto'), mitigations for
119+
cross-thread attacks will be enabled but SMT will not be disabled.
120+
121+
If cross-thread mitigations are disabled, no mitigations for cross-thread
122+
attacks will be enabled.
123+
124+
Cross-thread mitigation may not be required if core-scheduling or similar
125+
techniques are used to prevent untrusted workloads from running on SMT siblings.
126+
127+
*cross-thread mitigations default to partially enabled*
128+
129+
.. _cmdline:
130+
131+
Command Line Controls
132+
---------------------
133+
134+
Attack vectors are controlled through the mitigations= command line option. The
135+
value provided begins with a global option and then may optionally include one
136+
or more options to disable various attack vectors.
137+
138+
Format:
139+
| ``mitigations=[global]``
140+
| ``mitigations=[global],[attack vectors]``
141+
142+
Global options:
143+
144+
============ =============================================================
145+
Option Description
146+
============ =============================================================
147+
'off' All attack vectors disabled.
148+
'auto' All attack vectors enabled, partial cross-thread mitigations.
149+
'auto,nosmt' All attack vectors enabled, full cross-thread mitigations.
150+
============ =============================================================
151+
152+
Attack vector options:
153+
154+
================= =======================================
155+
Option Description
156+
================= =======================================
157+
'no_user_kernel' Disables user-to-kernel mitigations.
158+
'no_user_user' Disables user-to-user mitigations.
159+
'no_guest_host' Disables guest-to-host mitigations.
160+
'no_guest_guest' Disables guest-to-guest mitigations
161+
'no_cross_thread' Disables all cross-thread mitigations.
162+
================= =======================================
163+
164+
Multiple attack vector options may be specified in a comma-separated list. If
165+
the global option is not specified, it defaults to 'auto'. The global option
166+
'off' is equivalent to disabling all attack vectors.
167+
168+
Examples:
169+
| ``mitigations=auto,no_user_kernel``
170+
171+
Enable all attack vectors except user-to-kernel. Partial cross-thread
172+
mitigations.
173+
174+
| ``mitigations=auto,nosmt,no_guest_host,no_guest_guest``
175+
176+
Enable all attack vectors and cross-thread mitigations except for
177+
guest-to-host and guest-to-guest mitigations.
178+
179+
| ``mitigations=,no_cross_thread``
180+
181+
Enable all attack vectors but not cross-thread mitigations.
182+
183+
Interactions with command-line options
184+
--------------------------------------
185+
186+
Vulnerability-specific controls (e.g. "retbleed=off") take precedence over all
187+
attack vector controls. Mitigations for individual vulnerabilities may be
188+
turned on or off via their command-line options regardless of the attack vector
189+
controls.
190+
191+
Summary of attack-vector mitigations
192+
------------------------------------
193+
194+
When a vulnerability is mitigated due to an attack-vector control, the default
195+
mitigation option for that particular vulnerability is used. To use a different
196+
mitigation, please use the vulnerability-specific command line option.
197+
198+
The table below summarizes which vulnerabilities are mitigated when different
199+
attack vectors are enabled and assuming the CPU is vulnerable.
200+
201+
=============== ============== ============ ============= ============== ============ ========
202+
Vulnerability User-to-Kernel User-to-User Guest-to-Host Guest-to-Guest Cross-Thread Notes
203+
=============== ============== ============ ============= ============== ============ ========
204+
BHI X X
205+
ITS X X
206+
GDS X X X X * (Note 1)
207+
L1TF X X * (Note 2)
208+
MDS X X X X * (Note 2)
209+
MMIO X X X X * (Note 2)
210+
Meltdown X
211+
Retbleed X X * (Note 3)
212+
RFDS X X X X
213+
Spectre_v1 X
214+
Spectre_v2 X X
215+
Spectre_v2_user X X * (Note 1)
216+
SRBDS X X X X
217+
SRSO X X
218+
SSB (Note 4)
219+
TAA X X X X * (Note 2)
220+
TSA X X X X
221+
=============== ============== ============ ============= ============== ============ ========
222+
223+
Notes:
224+
1 -- Can be mitigated without disabling SMT.
225+
226+
2 -- Disables SMT if cross-thread mitigations are fully enabled and the CPU
227+
is vulnerable
228+
229+
3 -- Disables SMT if cross-thread mitigations are fully enabled, the CPU is
230+
vulnerable, and STIBP is not supported
231+
232+
4 -- Speculative store bypass is always enabled by default (no kernel
233+
mitigation applied) unless overridden with spec_store_bypass_disable option
234+
235+
When an attack-vector is disabled, all mitigations for the vulnerabilities
236+
listed in the above table are disabled, unless mitigation is required for a
237+
different enabled attack-vector or a mitigation is explicitly selected via a
238+
vulnerability-specific command line option.

‎Documentation/admin-guide/hw-vuln/index.rst

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@ are configurable at compile, boot or run time.
99
.. toctree::
1010
:maxdepth: 1
1111

12+
attack_vector_controls
1213
spectre
1314
l1tf
1415
mds

‎Documentation/admin-guide/kernel-parameters.txt

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3797,6 +3797,10 @@
37973797
mmio_stale_data=full,nosmt [X86]
37983798
retbleed=auto,nosmt [X86]
37993799

3800+
[X86] After one of the above options, additionally
3801+
supports attack-vector based controls as documented in
3802+
Documentation/admin-guide/hw-vuln/attack_vector_controls.rst
3803+
38003804
mminit_loglevel=
38013805
[KNL,EARLY] When CONFIG_DEBUG_MEMORY_INIT is set, this
38023806
parameter allows control of the logging verbosity for

‎arch/Kconfig

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1772,4 +1772,7 @@ config ARCH_WANTS_PRE_LINK_VMLINUX
17721772
An architecture can select this if it provides arch/<arch>/tools/Makefile
17731773
with .arch.vmlinux.o target to be linked into vmlinux.
17741774

1775+
config ARCH_HAS_CPU_ATTACK_VECTORS
1776+
bool
1777+
17751778
endmenu

‎arch/x86/Kconfig

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -75,6 +75,7 @@ config X86
7575
select ARCH_ENABLE_SPLIT_PMD_PTLOCK if (PGTABLE_LEVELS > 2) && (X86_64 || X86_PAE)
7676
select ARCH_ENABLE_THP_MIGRATION if X86_64 && TRANSPARENT_HUGEPAGE
7777
select ARCH_HAS_ACPI_TABLE_UPGRADE if ACPI
78+
select ARCH_HAS_CPU_ATTACK_VECTORS if CPU_MITIGATIONS
7879
select ARCH_HAS_CACHE_LINE_SIZE
7980
select ARCH_HAS_CPU_CACHE_INVALIDATE_MEMREGION
8081
select ARCH_HAS_CPU_FINALIZE_INIT

0 commit comments

Comments
 (0)