From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.linutronix.de (146.0.238.70:993) by crypto-ml.lab.linutronix.de with IMAP4-SSL for ; 24 Feb 2019 15:11:20 -0000 Received: from mga02.intel.com ([134.134.136.20]) by Galois.linutronix.de with esmtps (TLS1.2:DHE_RSA_AES_256_CBC_SHA256:256) (Exim 4.80) (envelope-from ) id 1gxvNv-0001Qu-D7 for speck@linutronix.de; Sun, 24 Feb 2019 16:08:08 +0100 From: Andi Kleen Subject: [MODERATED] [PATCH v6 06/43] MDSv6 Date: Sun, 24 Feb 2019 07:07:12 -0800 Message-Id: In-Reply-To: References: In-Reply-To: References: Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit MIME-Version: 1.0 To: speck@linutronix.de Cc: Andi Kleen List-ID: Add a Documentation file for administrators that describes MDS on a high level. Needs updates later for public URLs of supporting documentation. Signed-off-by: Andi Kleen --- Documentation/admin-guide/mds.rst | 95 +++++++++++++++++++++++++++++++ 1 file changed, 95 insertions(+) create mode 100644 Documentation/admin-guide/mds.rst diff --git a/Documentation/admin-guide/mds.rst b/Documentation/admin-guide/mds.rst new file mode 100644 index 000000000000..045ecf8f37f0 --- /dev/null +++ b/Documentation/admin-guide/mds.rst @@ -0,0 +1,95 @@ +MDS - Microarchitectural Data Sampling) +======================================= + +Microarchitectural Data Sampling is a side channel vulnerability that +allows an attacker to sample data that has been earlier used during +program execution. Internal buffers in the CPU may keep old data +for some limited time, which can the later be determined by an attacker +with side channel analysis. MDS can be used to occasionaly observe +some values accessed earlier, but it cannot be used to observe values +not recently touched by other code running on the same core. + +It is difficult to target particular data on a system using MDS, +but attackers may be able to infer secrets by collecting +and analyzing large amounts of data. MDS does not modify +memory. + +MDS consists of multiple sub-vulnerabilities: +Microarchitectural Store Buffer Data Sampling (MSBDS) (CVE-2018-12126) +Microarchitectual Fill Buffer Data Sampling (MFBDS) (CVE-2018-12130) +Microarchitectual Load Port Data (MLPDS) (CVE-2018-12127), +with the first leaking store data, and the second loads and sometimes +store data, and the third load data. + +The effects and mitigations are similar for all three, so the Linux +kernel handles and reports them all as a single vulnerability called +MDS. This also reduces the number of acronyms in use. + +Affected processors +------------------- + +This vulnerability affects a wide range of Intel processors. +Not all CPUs are affected by all of the sub vulnerabilities, +however the kernel handles it always the same. + +The vulnerability is not present in + + - Some Atoms (Bonnell, Saltwell, Goldmont, GoldmontPlus) + +The kernel will automatically detect future CPUs with hardware +mitigations for these issues and disable any workarounds. + +The kernel reports if the current CPU is vulnerable and any +mitigations used in + +/sys/devices/system/cpu/vulnerabilities/mds + +Kernel mitigation +----------------- + +The mitigation is automatically enabled, but can be further controlled +with the command line options documented below. + +The kernel clears the CPU buffers at every kernel exit. + +The mitigation can be done with microcode support, requiring +updated microcode. + +The microcode should be loaded at early boot using the initrd. Hot +updating microcode will not enable the mitigations. + +Virtual machine mitigation +-------------------------- + +The mitigation is enabled by default and controlled by the same options +as L1TF cache clearing. See l1tf.rst for more details. In the default +setting MDS for leaking data out of the guest into other processes +will be mitigated. + +Kernel command line options +--------------------------- + +Normally the kernel selects reasonable defaults and no special configuration +is needed. The default behavior can be overriden by the mds= kernel +command line options. + +These options can be specified in the boot loader. Any changes require a reboot. + +When the system only runs trusted code, MDS mitigation can be disabled with +mds=off as a performance optimization. + + - mds=off Disable workarounds if the CPU is not affected. + + - mds=auto Automatically select mitigation. + + - mds=full Currently equivalent to default. + +References +---------- + +Fore more details on the kernel internal implementation of the MDS mitigations, +please see Documentation/clearcpu.txt + +TBD Add URL for Intel white paper + +TBD add reference to microcodes -- 2.17.2