sphinx.addnodesdocument)}( rawsourcechildren]( translations LanguagesNode)}(hhh](h pending_xref)}(hhh]docutils.nodesTextChinese (Simplified)}parenthsba attributes}(ids]classes]names]dupnames]backrefs] refdomainstdreftypedoc reftarget+/translations/zh_CN/admin-guide/hw-vuln/mdsmodnameN classnameN refexplicitutagnamehhh ubh)}(hhh]hChinese (Traditional)}hh2sbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget+/translations/zh_TW/admin-guide/hw-vuln/mdsmodnameN classnameN refexplicituh1hhh ubh)}(hhh]hItalian}hhFsbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget+/translations/it_IT/admin-guide/hw-vuln/mdsmodnameN classnameN refexplicituh1hhh ubh)}(hhh]hJapanese}hhZsbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget+/translations/ja_JP/admin-guide/hw-vuln/mdsmodnameN classnameN refexplicituh1hhh ubh)}(hhh]hKorean}hhnsbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget+/translations/ko_KR/admin-guide/hw-vuln/mdsmodnameN classnameN refexplicituh1hhh ubh)}(hhh]hSpanish}hhsbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget+/translations/sp_SP/admin-guide/hw-vuln/mdsmodnameN classnameN refexplicituh1hhh ubeh}(h]h ]h"]h$]h&]current_languageEnglishuh1h hh _documenthsourceNlineNubhsection)}(hhh](htitle)}(h&MDS - Microarchitectural Data Samplingh]h&MDS - Microarchitectural Data Sampling}(hhhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhhhE/var/lib/git/docbuild/linux/Documentation/admin-guide/hw-vuln/mds.rsthKubh paragraph)}(hMicroarchitectural Data Sampling is a hardware vulnerability which allows unprivileged speculative access to data which is available in various CPU internal buffers.h]hMicroarchitectural Data Sampling is a hardware vulnerability which allows unprivileged speculative access to data which is available in various CPU internal buffers.}(hhhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhhhhubh)}(hhh](h)}(hAffected processorsh]hAffected processors}(hhhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhhhhhK ubh)}(haThis vulnerability affects a wide range of Intel processors. The vulnerability is not present on:h]haThis vulnerability affects a wide range of Intel processors. The vulnerability is not present on:}(hhhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhK hhhhubh block_quote)}(hX - Processors from AMD, Centaur and other non Intel vendors - Older processor models, where the CPU family is < 6 - Some Atoms (Bonnell, Saltwell, Goldmont, GoldmontPlus) - Intel processors which have the ARCH_CAP_MDS_NO bit set in the IA32_ARCH_CAPABILITIES MSR. h]h bullet_list)}(hhh](h list_item)}(h9Processors from AMD, Centaur and other non Intel vendors h]h)}(h8Processors from AMD, Centaur and other non Intel vendorsh]h8Processors from AMD, Centaur and other non Intel vendors}(hhhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhhubah}(h]h ]h"]h$]h&]uh1hhhubh)}(h4Older processor models, where the CPU family is < 6 h]h)}(h3Older processor models, where the CPU family is < 6h]h3Older processor models, where the CPU family is < 6}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhj ubah}(h]h ]h"]h$]h&]uh1hhhubh)}(h7Some Atoms (Bonnell, Saltwell, Goldmont, GoldmontPlus) h]h)}(h6Some Atoms (Bonnell, Saltwell, Goldmont, GoldmontPlus)h]h6Some Atoms (Bonnell, Saltwell, Goldmont, GoldmontPlus)}(hj'hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhj#ubah}(h]h ]h"]h$]h&]uh1hhhubh)}(h[Intel processors which have the ARCH_CAP_MDS_NO bit set in the IA32_ARCH_CAPABILITIES MSR. h]h)}(hZIntel processors which have the ARCH_CAP_MDS_NO bit set in the IA32_ARCH_CAPABILITIES MSR.h]hZIntel processors which have the ARCH_CAP_MDS_NO bit set in the IA32_ARCH_CAPABILITIES MSR.}(hj?hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhj;ubah}(h]h ]h"]h$]h&]uh1hhhubeh}(h]h ]h"]h$]h&]bullet-uh1hhhhKhhubah}(h]h ]h"]h$]h&]uh1hhhhKhhhhubh)}(hyWhether a processor is affected or not can be read out from the MDS vulnerability file in sysfs. See :ref:`mds_sys_info`.h](heWhether a processor is affected or not can be read out from the MDS vulnerability file in sysfs. See }(hjahhhNhNubh)}(h:ref:`mds_sys_info`h]hinline)}(hjkh]h mds_sys_info}(hjohhhNhNubah}(h]h ](xrefstdstd-refeh"]h$]h&]uh1jmhjiubah}(h]h ]h"]h$]h&]refdocadmin-guide/hw-vuln/mds refdomainjzreftyperef refexplicitrefwarn reftarget mds_sys_infouh1hhhhKhjaubh.}(hjahhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhKhhhhubh)}(hNot all processors are affected by all variants of MDS, but the mitigation is identical for all of them so the kernel treats them as a single vulnerability.h]hNot all processors are affected by all variants of MDS, but the mitigation is identical for all of them so the kernel treats them as a single vulnerability.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhhhhubeh}(h]affected-processorsah ]h"]affected processorsah$]h&]uh1hhhhhhhhK ubh)}(hhh](h)}(h Related CVEsh]h Related CVEs}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjhhhhhKubh)}(h?The following CVE entries are related to the MDS vulnerability:h]h?The following CVE entries are related to the MDS vulnerability:}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhK!hjhhubh)}(hX============== ===== =================================================== CVE-2018-12126 MSBDS Microarchitectural Store Buffer Data Sampling CVE-2018-12130 MFBDS Microarchitectural Fill Buffer Data Sampling CVE-2018-12127 MLPDS Microarchitectural Load Port Data Sampling CVE-2019-11091 MDSUM Microarchitectural Data Sampling Uncacheable Memory ============== ===== =================================================== h]htable)}(hhh]htgroup)}(hhh](hcolspec)}(hhh]h}(h]h ]h"]h$]h&]colwidthKuh1jhjubj)}(hhh]h}(h]h ]h"]h$]h&]colwidthKuh1jhjubj)}(hhh]h}(h]h ]h"]h$]h&]colwidthK3uh1jhjubhtbody)}(hhh](hrow)}(hhh](hentry)}(hhh]h)}(hCVE-2018-12126h]hCVE-2018-12126}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhK$hjubah}(h]h ]h"]h$]h&]uh1jhjubj)}(hhh]h)}(hMSBDSh]hMSBDS}(hj!hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhK$hjubah}(h]h ]h"]h$]h&]uh1jhjubj)}(hhh]h)}(h-Microarchitectural Store Buffer Data Samplingh]h-Microarchitectural Store Buffer Data Sampling}(hj8hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhK$hj5ubah}(h]h ]h"]h$]h&]uh1jhjubeh}(h]h ]h"]h$]h&]uh1jhjubj)}(hhh](j)}(hhh]h)}(hCVE-2018-12130h]hCVE-2018-12130}(hjXhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhK%hjUubah}(h]h ]h"]h$]h&]uh1jhjRubj)}(hhh]h)}(hMFBDSh]hMFBDS}(hjohhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhK%hjlubah}(h]h ]h"]h$]h&]uh1jhjRubj)}(hhh]h)}(h,Microarchitectural Fill Buffer Data Samplingh]h,Microarchitectural Fill Buffer Data Sampling}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhK%hjubah}(h]h ]h"]h$]h&]uh1jhjRubeh}(h]h ]h"]h$]h&]uh1jhjubj)}(hhh](j)}(hhh]h)}(hCVE-2018-12127h]hCVE-2018-12127}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhK&hjubah}(h]h ]h"]h$]h&]uh1jhjubj)}(hhh]h)}(hMLPDSh]hMLPDS}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhK&hjubah}(h]h ]h"]h$]h&]uh1jhjubj)}(hhh]h)}(h*Microarchitectural Load Port Data Samplingh]h*Microarchitectural Load Port Data Sampling}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhK&hjubah}(h]h ]h"]h$]h&]uh1jhjubeh}(h]h ]h"]h$]h&]uh1jhjubj)}(hhh](j)}(hhh]h)}(hCVE-2019-11091h]hCVE-2019-11091}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhK'hjubah}(h]h ]h"]h$]h&]uh1jhjubj)}(hhh]h)}(hMDSUMh]hMDSUM}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhK'hjubah}(h]h ]h"]h$]h&]uh1jhjubj)}(hhh]h)}(h3Microarchitectural Data Sampling Uncacheable Memoryh]h3Microarchitectural Data Sampling Uncacheable Memory}(hj"hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhK'hjubah}(h]h ]h"]h$]h&]uh1jhjubeh}(h]h ]h"]h$]h&]uh1jhjubeh}(h]h ]h"]h$]h&]uh1jhjubeh}(h]h ]h"]h$]h&]colsKuh1jhjubah}(h]h ]h"]h$]h&]uh1jhjubah}(h]h ]h"]h$]h&]uh1hhhhK#hjhhubeh}(h] related-cvesah ]h"] related cvesah$]h&]uh1hhhhhhhhKubh)}(hhh](h)}(hProblemh]hProblem}(hj`hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj]hhhhhK+ubh)}(hWhen performing store, load, L1 refill operations, processors write data into temporary microarchitectural structures (buffers). The data in the buffer can be forwarded to load operations as an optimization.h]hWhen performing store, load, L1 refill operations, processors write data into temporary microarchitectural structures (buffers). The data in the buffer can be forwarded to load operations as an optimization.}(hjnhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhK-hj]hhubh)}(hXUnder certain conditions, usually a fault/assist caused by a load operation, data unrelated to the load memory address can be speculatively forwarded from the buffers. Because the load operation causes a fault or assist and its result will be discarded, the forwarded data will not cause incorrect program execution or state changes. But a malicious operation may be able to forward this speculative data to a disclosure gadget which allows in turn to infer the value via a cache side channel attack.h]hXUnder certain conditions, usually a fault/assist caused by a load operation, data unrelated to the load memory address can be speculatively forwarded from the buffers. Because the load operation causes a fault or assist and its result will be discarded, the forwarded data will not cause incorrect program execution or state changes. But a malicious operation may be able to forward this speculative data to a disclosure gadget which allows in turn to infer the value via a cache side channel attack.}(hj|hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhK1hj]hhubh)}(hiBecause the buffers are potentially shared between Hyper-Threads cross Hyper-Thread attacks are possible.h]hiBecause the buffers are potentially shared between Hyper-Threads cross Hyper-Thread attacks are possible.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhK9hj]hhubh)}(hDeeper technical information is available in the MDS specific x86 architecture section: :ref:`Documentation/arch/x86/mds.rst `.h](hXDeeper technical information is available in the MDS specific x86 architecture section: }(hjhhhNhNubh)}(h+:ref:`Documentation/arch/x86/mds.rst `h]jn)}(hjh]hDocumentation/arch/x86/mds.rst}(hjhhhNhNubah}(h]h ](jystdstd-refeh"]h$]h&]uh1jmhjubah}(h]h ]h"]h$]h&]refdocj refdomainjreftyperef refexplicitrefwarnjmdsuh1hhhhKeh ]h"](cpu buffer clearingcpu_buffer_cleareh$]h&]uh1hhjhhhhhKj}jj4sj}j>j4subh)}(hhh](h)}(hVirtualization mitigationh]hVirtualization mitigation}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjhhhhhKubh)}(hXThe protection for host to guest transition depends on the L1TF vulnerability of the CPU: - CPU is affected by L1TF: If the L1D flush mitigation is enabled and up to date microcode is available, the L1D flush mitigation is automatically protecting the guest transition. If the L1D flush mitigation is disabled then the MDS mitigation is invoked explicit when the host MDS mitigation is enabled. For details on L1TF and virtualization see: :ref:`Documentation/admin-guide/hw-vuln//l1tf.rst `. - CPU is not affected by L1TF: CPU buffers are flushed before entering the guest when the host MDS mitigation is enabled. The resulting MDS protection matrix for the host to guest transition: ============ ===== ============= ============ ================= L1TF MDS VMX-L1FLUSH Host MDS MDS-State Don't care No Don't care N/A Not affected Yes Yes Disabled Off Vulnerable Yes Yes Disabled Full Mitigated Yes Yes Enabled Don't care Mitigated No Yes N/A Off Vulnerable No Yes N/A Full Mitigated ============ ===== ============= ============ ================= This only covers the host to guest transition, i.e. prevents leakage from host to guest, but does not protect the guest internally. Guests need to have their own protections. h](h)}(hYThe protection for host to guest transition depends on the L1TF vulnerability of the CPU:h]hYThe protection for host to guest transition depends on the L1TF vulnerability of the CPU:}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhjubh)}(hhh](h)}(hXCPU is affected by L1TF: If the L1D flush mitigation is enabled and up to date microcode is available, the L1D flush mitigation is automatically protecting the guest transition. If the L1D flush mitigation is disabled then the MDS mitigation is invoked explicit when the host MDS mitigation is enabled. For details on L1TF and virtualization see: :ref:`Documentation/admin-guide/hw-vuln//l1tf.rst `. h](h)}(hCPU is affected by L1TF:h]hCPU is affected by L1TF:}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhjubh)}(hIf the L1D flush mitigation is enabled and up to date microcode is available, the L1D flush mitigation is automatically protecting the guest transition.h]hIf the L1D flush mitigation is enabled and up to date microcode is available, the L1D flush mitigation is automatically protecting the guest transition.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhjubh)}(h|If the L1D flush mitigation is disabled then the MDS mitigation is invoked explicit when the host MDS mitigation is enabled.h]h|If the L1D flush mitigation is disabled then the MDS mitigation is invoked explicit when the host MDS mitigation is enabled.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhjubh)}(hxFor details on L1TF and virtualization see: :ref:`Documentation/admin-guide/hw-vuln//l1tf.rst `.h](h,For details on L1TF and virtualization see: }(hjhhhNhNubh)}(hK:ref:`Documentation/admin-guide/hw-vuln//l1tf.rst `h]jn)}(hjh]h+Documentation/admin-guide/hw-vuln//l1tf.rst}(hjhhhNhNubah}(h]h ](jystdstd-refeh"]h$]h&]uh1jmhjubah}(h]h ]h"]h$]h&]refdocj refdomainjreftyperef refexplicitrefwarnjmitigation_control_kvmuh1hhhhKhjubh.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhKhjubeh}(h]h ]h"]h$]h&]uh1hhjubh)}(hyCPU is not affected by L1TF: CPU buffers are flushed before entering the guest when the host MDS mitigation is enabled. h](h)}(hCPU is not affected by L1TF:h]hCPU is not affected by L1TF:}(hj*hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhj&ubh)}(hZCPU buffers are flushed before entering the guest when the host MDS mitigation is enabled.h]hZCPU buffers are flushed before entering the guest when the host MDS mitigation is enabled.}(hj8hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhj&ubeh}(h]h ]h"]h$]h&]uh1hhjubeh}(h]h ]h"]h$]h&]jYjZuh1hhhhKhjubh)}(hEThe resulting MDS protection matrix for the host to guest transition:h]hEThe resulting MDS protection matrix for the host to guest transition:}(hjRhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhjubj)}(hhh]j)}(hhh](j)}(hhh]h}(h]h ]h"]h$]h&]colwidthK uh1jhjcubj)}(hhh]h}(h]h ]h"]h$]h&]colwidthKuh1jhjcubj)}(hhh]h}(h]h ]h"]h$]h&]colwidthK uh1jhjcubj)}(hhh]h}(h]h ]h"]h$]h&]colwidthK uh1jhjcubj)}(hhh]h}(h]h ]h"]h$]h&]colwidthKuh1jhjcubj)}(hhh](j)}(hhh](j)}(hhh]h)}(hL1TFh]hL1TF}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhjubah}(h]h ]h"]h$]h&]uh1jhjubj)}(hhh]h)}(hMDSh]hMDS}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhjubah}(h]h ]h"]h$]h&]uh1jhjubj)}(hhh]h)}(h VMX-L1FLUSHh]h VMX-L1FLUSH}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhjubah}(h]h ]h"]h$]h&]uh1jhjubj)}(hhh]h)}(hHost MDSh]hHost MDS}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhjubah}(h]h ]h"]h$]h&]uh1jhjubj)}(hhh]h)}(h MDS-Stateh]h MDS-State}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhjubah}(h]h ]h"]h$]h&]uh1jhjubeh}(h]h ]h"]h$]h&]uh1jhjubj)}(hhh](j)}(hhh]h)}(h Don't careh]h Don’t care}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhj ubah}(h]h ]h"]h$]h&]uh1jhj ubj)}(hhh]h)}(hNoh]hNo}(hj4 hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhj1 ubah}(h]h ]h"]h$]h&]uh1jhj ubj)}(hhh]h)}(h Don't careh]h Don’t care}(hjK hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhjH ubah}(h]h ]h"]h$]h&]uh1jhj ubj)}(hhh]h)}(hN/Ah]hN/A}(hjb hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhj_ ubah}(h]h ]h"]h$]h&]uh1jhj ubj)}(hhh]h)}(h Not affectedh]h Not affected}(hjy hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhjv ubah}(h]h ]h"]h$]h&]uh1jhj ubeh}(h]h ]h"]h$]h&]uh1jhjubj)}(hhh](j)}(hhh]h)}(hYesh]hYes}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhj ubah}(h]h ]h"]h$]h&]uh1jhj ubj)}(hhh]h)}(hYesh]hYes}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhj ubah}(h]h ]h"]h$]h&]uh1jhj ubj)}(hhh]h)}(hDisabledh]hDisabled}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhj ubah}(h]h ]h"]h$]h&]uh1jhj ubj)}(hhh]h)}(hOffh]hOff}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhj ubah}(h]h ]h"]h$]h&]uh1jhj ubj)}(hhh]h)}(h Vulnerableh]h Vulnerable}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhj ubah}(h]h ]h"]h$]h&]uh1jhj ubeh}(h]h ]h"]h$]h&]uh1jhjubj)}(hhh](j)}(hhh]h)}(hYesh]hYes}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhj ubah}(h]h ]h"]h$]h&]uh1jhj ubj)}(hhh]h)}(hYesh]hYes}(hj, hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhj) ubah}(h]h ]h"]h$]h&]uh1jhj ubj)}(hhh]h)}(hDisabledh]hDisabled}(hjC hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhj@ ubah}(h]h ]h"]h$]h&]uh1jhj ubj)}(hhh]h)}(hFullh]hFull}(hjZ hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhjW ubah}(h]h ]h"]h$]h&]uh1jhj ubj)}(hhh]h)}(h Mitigatedh]h Mitigated}(hjq hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhjn ubah}(h]h ]h"]h$]h&]uh1jhj ubeh}(h]h ]h"]h$]h&]uh1jhjubj)}(hhh](j)}(hhh]h)}(hYesh]hYes}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhj ubah}(h]h ]h"]h$]h&]uh1jhj ubj)}(hhh]h)}(hYesh]hYes}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhj ubah}(h]h ]h"]h$]h&]uh1jhj ubj)}(hhh]h)}(hEnabledh]hEnabled}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhj ubah}(h]h ]h"]h$]h&]uh1jhj ubj)}(hhh]h)}(h Don't careh]h Don’t care}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhj ubah}(h]h ]h"]h$]h&]uh1jhj ubj)}(hhh]h)}(h Mitigatedh]h Mitigated}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhj ubah}(h]h ]h"]h$]h&]uh1jhj ubeh}(h]h ]h"]h$]h&]uh1jhjubj)}(hhh](j)}(hhh]h)}(hNoh]hNo}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhj ubah}(h]h ]h"]h$]h&]uh1jhj ubj)}(hhh]h)}(hYesh]hYes}(hj$ hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhj! ubah}(h]h ]h"]h$]h&]uh1jhj ubj)}(hhh]h)}(hN/Ah]hN/A}(hj; hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhj8 ubah}(h]h ]h"]h$]h&]uh1jhj ubj)}(hhh]h)}(hOffh]hOff}(hjR hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhjO ubah}(h]h ]h"]h$]h&]uh1jhj ubj)}(hhh]h)}(h Vulnerableh]h Vulnerable}(hji hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhjf ubah}(h]h ]h"]h$]h&]uh1jhj ubeh}(h]h ]h"]h$]h&]uh1jhjubj)}(hhh](j)}(hhh]h)}(hNoh]hNo}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhj ubah}(h]h ]h"]h$]h&]uh1jhj ubj)}(hhh]h)}(hYesh]hYes}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhj ubah}(h]h ]h"]h$]h&]uh1jhj ubj)}(hhh]h)}(hN/Ah]hN/A}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhj ubah}(h]h ]h"]h$]h&]uh1jhj ubj)}(hhh]h)}(hFullh]hFull}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhj ubah}(h]h ]h"]h$]h&]uh1jhj ubj)}(hhh]h)}(h Mitigatedh]h Mitigated}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhj ubah}(h]h ]h"]h$]h&]uh1jhj ubeh}(h]h ]h"]h$]h&]uh1jhjubeh}(h]h ]h"]h$]h&]uh1jhjcubeh}(h]h ]h"]h$]h&]colsKuh1jhj`ubah}(h]h ]h"]h$]h&]uh1jhjubh)}(hThis only covers the host to guest transition, i.e. prevents leakage from host to guest, but does not protect the guest internally. Guests need to have their own protections.h]hThis only covers the host to guest transition, i.e. prevents leakage from host to guest, but does not protect the guest internally. Guests need to have their own protections.}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhjubeh}(h]h ]h"]h$]h&]uh1hhhhKhjhhubj))}(h .. _xeon_phi:h]h}(h]h ]h"]h$]h&]j4xeon-phiuh1j(hKhjhhhhubeh}(h](virtualization-mitigationjeh ]h"](virtualization mitigationvirt_mechanismeh$]h&]uh1hhjhhhhhKj}j7 jsj}jjsubh)}(hhh](h)}(h XEON PHI specific considerationsh]h XEON PHI specific considerations}(hj? hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj< hhhhhKubh)}(hX3The XEON PHI processor family is affected by MSBDS which can be exploited cross Hyper-Threads when entering idle states. Some XEON PHI variants allow to use MWAIT in user space (Ring 3) which opens an potential attack vector for malicious user space. The exposure can be disabled on the kernel command line with the 'ring3mwait=disable' command line option. XEON PHI is not affected by the other MDS variants and MSBDS is mitigated before the CPU enters a idle state. As XEON PHI is not affected by L1TF either disabling SMT is not required for full protection. h](h)}(hXeThe XEON PHI processor family is affected by MSBDS which can be exploited cross Hyper-Threads when entering idle states. Some XEON PHI variants allow to use MWAIT in user space (Ring 3) which opens an potential attack vector for malicious user space. The exposure can be disabled on the kernel command line with the 'ring3mwait=disable' command line option.h]hXiThe XEON PHI processor family is affected by MSBDS which can be exploited cross Hyper-Threads when entering idle states. Some XEON PHI variants allow to use MWAIT in user space (Ring 3) which opens an potential attack vector for malicious user space. The exposure can be disabled on the kernel command line with the ‘ring3mwait=disable’ command line option.}(hjQ hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhjM ubh)}(hXEON PHI is not affected by the other MDS variants and MSBDS is mitigated before the CPU enters a idle state. As XEON PHI is not affected by L1TF either disabling SMT is not required for full protection.h]hXEON PHI is not affected by the other MDS variants and MSBDS is mitigated before the CPU enters a idle state. As XEON PHI is not affected by L1TF either disabling SMT is not required for full protection.}(hj_ hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhjM ubeh}(h]h ]h"]h$]h&]uh1hhhhKhj< hhubj))}(h.. _mds_smt_control:h]h}(h]h ]h"]h$]h&]j4mds-smt-controluh1j(hKhj< hhhhubeh}(h]( xeon-phi-specific-considerationsj0 eh ]h"]( xeon phi specific considerationsxeon_phieh$]h&]uh1hhjhhhhhKj}j j& sj}j0 j& subh)}(hhh](h)}(h SMT controlh]h SMT control}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj hhhhhKubh)}(hXAll MDS variants except MSBDS can be attacked cross Hyper-Threads. That means on CPUs which are affected by MFBDS or MLPDS it is necessary to disable SMT for full protection. These are most of the affected CPUs; the exception is XEON PHI, see :ref:`xeon_phi`. Disabling SMT can have a significant performance impact, but the impact depends on the type of workloads. See the relevant chapter in the L1TF mitigation documentation for details: :ref:`Documentation/admin-guide/hw-vuln/l1tf.rst `. h](h)}(hXAll MDS variants except MSBDS can be attacked cross Hyper-Threads. That means on CPUs which are affected by MFBDS or MLPDS it is necessary to disable SMT for full protection. These are most of the affected CPUs; the exception is XEON PHI, see :ref:`xeon_phi`.h](hAll MDS variants except MSBDS can be attacked cross Hyper-Threads. That means on CPUs which are affected by MFBDS or MLPDS it is necessary to disable SMT for full protection. These are most of the affected CPUs; the exception is XEON PHI, see }(hj hhhNhNubh)}(h:ref:`xeon_phi`h]jn)}(hj h]hxeon_phi}(hj hhhNhNubah}(h]h ](jystdstd-refeh"]h$]h&]uh1jmhj ubah}(h]h ]h"]h$]h&]refdocj refdomainj reftyperef refexplicitrefwarnjxeon_phiuh1hhhhKhj ubh.}(hj hhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhKhj ubh)}(hiDisabling SMT can have a significant performance impact, but the impact depends on the type of workloads.h]hiDisabling SMT can have a significant performance impact, but the impact depends on the type of workloads.}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhj ubh)}(hSee the relevant chapter in the L1TF mitigation documentation for details: :ref:`Documentation/admin-guide/hw-vuln/l1tf.rst `.h](hKSee the relevant chapter in the L1TF mitigation documentation for details: }(hj hhhNhNubh)}(h?:ref:`Documentation/admin-guide/hw-vuln/l1tf.rst `h]jn)}(hj h]h*Documentation/admin-guide/hw-vuln/l1tf.rst}(hj hhhNhNubah}(h]h ](jystdstd-refeh"]h$]h&]uh1jmhj ubah}(h]h ]h"]h$]h&]refdocj refdomainj reftyperef refexplicitrefwarnj smt_controluh1hhhhKhj ubh.}(hj hhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhKhj ubeh}(h]h ]h"]h$]h&]uh1hhhhKhj hhubj))}(h(.. _mds_mitigation_control_command_line:h]h}(h]h ]h"]h$]h&]j4#mds-mitigation-control-command-lineuh1j(hKhj hhhhubeh}(h]( smt-controlj} eh ]h"]( smt controlmds_smt_controleh$]h&]uh1hhjhhhhhKj}j' js sj}j} js subeh}(h]mitigation-mechanismah ]h"]mitigation mechanismah$]h&]uh1hhhhhhhhKubh)}(hhh](h)}(h-Mitigation control on the kernel command lineh]h-Mitigation control on the kernel command line}(hj7 hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj4 hhhhhKubh)}(hThe kernel command line allows to control the MDS mitigations at boot time with the option "mds=". The valid arguments for this option are:h]hThe kernel command line allows to control the MDS mitigations at boot time with the option “mds=”. The valid arguments for this option are:}(hjE hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhj4 hhubh)}(hX============ ============================================================= full If the CPU is vulnerable, enable all available mitigations for the MDS vulnerability, CPU buffer clearing on exit to userspace and when entering a VM. Idle transitions are protected as well if SMT is enabled. It does not automatically disable SMT. full,nosmt The same as mds=full, with SMT disabled on vulnerable CPUs. This is the complete mitigation. off Disables MDS mitigations completely. ============ ============================================================= h]j)}(hhh]j)}(hhh](j)}(hhh]h}(h]h ]h"]h$]h&]colwidthK uh1jhjZ ubj)}(hhh]h}(h]h ]h"]h$]h&]colwidthK=uh1jhjZ ubj)}(hhh](j)}(hhh](j)}(hhh]h)}(hfullh]hfull}(hjz hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhjw ubah}(h]h ]h"]h$]h&]uh1jhjt ubj)}(hhh](h)}(hIf the CPU is vulnerable, enable all available mitigations for the MDS vulnerability, CPU buffer clearing on exit to userspace and when entering a VM. Idle transitions are protected as well if SMT is enabled.h]hIf the CPU is vulnerable, enable all available mitigations for the MDS vulnerability, CPU buffer clearing on exit to userspace and when entering a VM. Idle transitions are protected as well if SMT is enabled.}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhj ubh)}(h&It does not automatically disable SMT.h]h&It does not automatically disable SMT.}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhj ubeh}(h]h ]h"]h$]h&]uh1jhjt ubeh}(h]h ]h"]h$]h&]uh1jhjq ubj)}(hhh](j)}(hhh]h)}(h full,nosmth]h full,nosmt}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhj ubah}(h]h ]h"]h$]h&]uh1jhj ubj)}(hhh]h)}(h]The same as mds=full, with SMT disabled on vulnerable CPUs. This is the complete mitigation.h]h]The same as mds=full, with SMT disabled on vulnerable CPUs. This is the complete mitigation.}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhj ubah}(h]h ]h"]h$]h&]uh1jhj ubeh}(h]h ]h"]h$]h&]uh1jhjq ubj)}(hhh](j)}(hhh]h)}(hoffh]hoff}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMhj ubah}(h]h ]h"]h$]h&]uh1jhj ubj)}(hhh]h)}(h$Disables MDS mitigations completely.h]h$Disables MDS mitigations completely.}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMhj ubah}(h]h ]h"]h$]h&]uh1jhj ubeh}(h]h ]h"]h$]h&]uh1jhjq ubeh}(h]h ]h"]h$]h&]uh1jhjZ ubeh}(h]h ]h"]h$]h&]colsKuh1jhjW ubah}(h]h ]h"]h$]h&]uh1jhjS ubah}(h]h ]h"]h$]h&]uh1hhhhKhj4 hhubh)}(hXNot specifying this option is equivalent to "mds=full". For processors that are affected by both TAA (TSX Asynchronous Abort) and MDS, specifying just "mds=off" without an accompanying "tsx_async_abort=off" will have no effect as the same mitigation is used for both vulnerabilities.h]hX'Not specifying this option is equivalent to “mds=full”. For processors that are affected by both TAA (TSX Asynchronous Abort) and MDS, specifying just “mds=off” without an accompanying “tsx_async_abort=off” will have no effect as the same mitigation is used for both vulnerabilities.}(hj@hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMhj4 hhubeh}(h](-mitigation-control-on-the-kernel-command-linej eh ]h"](-mitigation control on the kernel command line#mds_mitigation_control_command_lineeh$]h&]uh1hhhhhhhhKj}jTj sj}j j subh)}(hhh](h)}(hMitigation selection guideh]hMitigation selection guide}(hj\hhhNhNubah}(h]h ]h"]h$]h&]uh1hhjYhhhhhM ubh)}(hhh](h)}(h1. Trusted userspaceh]h1. Trusted userspace}(hjmhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjjhhhhhMubh)}(hIf all userspace applications are from a trusted source and do not execute untrusted code which is supplied externally, then the mitigation can be disabled. h]h)}(hIf all userspace applications are from a trusted source and do not execute untrusted code which is supplied externally, then the mitigation can be disabled.h]hIf all userspace applications are from a trusted source and do not execute untrusted code which is supplied externally, then the mitigation can be disabled.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMhj{ubah}(h]h ]h"]h$]h&]uh1hhhhMhjjhhubeh}(h]trusted-userspaceah ]h"]1. trusted userspaceah$]h&]uh1hhjYhhhhhMubh)}(hhh](h)}(h%2. Virtualization with trusted guestsh]h%2. Virtualization with trusted guests}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjhhhhhMubh)}(hBThe same considerations as above versus trusted user space apply. h]h)}(hAThe same considerations as above versus trusted user space apply.h]hAThe same considerations as above versus trusted user space apply.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMhjubah}(h]h ]h"]h$]h&]uh1hhhhMhjhhubeh}(h]"virtualization-with-trusted-guestsah ]h"]%2. virtualization with trusted guestsah$]h&]uh1hhjYhhhhhMubh)}(hhh](h)}(h'3. Virtualization with untrusted guestsh]h'3. Virtualization with untrusted guests}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjhhhhhMubh)}(hThe protection depends on the state of the L1TF mitigations. See :ref:`virt_mechanism`. If the MDS mitigation is enabled and SMT is disabled, guest to host and guest to guest attacks are prevented. h](h)}(hWThe protection depends on the state of the L1TF mitigations. See :ref:`virt_mechanism`.h](hAThe protection depends on the state of the L1TF mitigations. See }(hjhhhNhNubh)}(h:ref:`virt_mechanism`h]jn)}(hjh]hvirt_mechanism}(hjhhhNhNubah}(h]h ](jystdstd-refeh"]h$]h&]uh1jmhjubah}(h]h ]h"]h$]h&]refdocj refdomainjreftyperef refexplicitrefwarnjvirt_mechanismuh1hhhhMhjubh.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhMhjubh)}(hmIf the MDS mitigation is enabled and SMT is disabled, guest to host and guest to guest attacks are prevented.h]hmIf the MDS mitigation is enabled and SMT is disabled, guest to host and guest to guest attacks are prevented.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhM hjubeh}(h]h ]h"]h$]h&]uh1hhhhMhjhhubj))}(h.. _mds_default_mitigations:h]h}(h]h ]h"]h$]h&]j4mds-default-mitigationsuh1j(hM#hjhhhhubeh}(h]$virtualization-with-untrusted-guestsah ]h"]'3. virtualization with untrusted guestsah$]h&]uh1hhjYhhhhhMubeh}(h]mitigation-selection-guideah ]h"]mitigation selection guideah$]h&]uh1hhhhhhhhM ubh)}(hhh](h)}(hDefault mitigationsh]hDefault mitigations}(hjEhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjBhhhhhM&ubh)}(hXPThe kernel default mitigations for vulnerable processors are: - Enable CPU buffer clearing The kernel does not by default enforce the disabling of SMT, which leaves SMT systems vulnerable when running untrusted code. The same rationale as for L1TF applies. See :ref:`Documentation/admin-guide/hw-vuln//l1tf.rst `.h](h)}(h=The kernel default mitigations for vulnerable processors are:h]h=The kernel default mitigations for vulnerable processors are:}(hjWhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhM(hjSubh)}(hhh]h)}(hEnable CPU buffer clearing h]h)}(hEnable CPU buffer clearingh]hEnable CPU buffer clearing}(hjlhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhM*hjhubah}(h]h ]h"]h$]h&]uh1hhjeubah}(h]h ]h"]h$]h&]jYjZuh1hhhhM*hjSubh)}(hThe kernel does not by default enforce the disabling of SMT, which leaves SMT systems vulnerable when running untrusted code. The same rationale as for L1TF applies. See :ref:`Documentation/admin-guide/hw-vuln//l1tf.rst `.h](hThe kernel does not by default enforce the disabling of SMT, which leaves SMT systems vulnerable when running untrusted code. The same rationale as for L1TF applies. See }(hjhhhNhNubh)}(hH:ref:`Documentation/admin-guide/hw-vuln//l1tf.rst `h]jn)}(hjh]h+Documentation/admin-guide/hw-vuln//l1tf.rst}(hjhhhNhNubah}(h]h ](jystdstd-refeh"]h$]h&]uh1jmhjubah}(h]h ]h"]h$]h&]refdocj refdomainjreftyperef refexplicitrefwarnjdefault_mitigationsuh1hhhhM,hjubh.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhM,hjSubeh}(h]h ]h"]h$]h&]uh1hhhhM(hjBhhubeh}(h](default-mitigationsj1eh ]h"](default mitigationsmds_default_mitigationseh$]h&]uh1hhhhhhhhM&j}jj'sj}j1j'subeh}(h]$mds-microarchitectural-data-samplingah ]h"]&mds - microarchitectural data samplingah$]h&]uh1hhhhhhhhKubeh}(h]h ]h"]h$]h&]sourcehuh1hcurrent_sourceN current_lineNsettingsdocutils.frontendValues)}(hN generatorN datestampN source_linkN source_urlN toc_backlinksjfootnote_backlinksK sectnum_xformKstrip_commentsNstrip_elements_with_classesN strip_classesN report_levelK halt_levelKexit_status_levelKdebugNwarning_streamN tracebackinput_encoding utf-8-siginput_encoding_error_handlerstrictoutput_encodingutf-8output_encoding_error_handlerjerror_encodingutf-8error_encoding_error_handlerbackslashreplace language_codeenrecord_dependenciesNconfigN id_prefixhauto_id_prefixid dump_settingsNdump_internalsNdump_transformsNdump_pseudo_xmlNexpose_internalsNstrict_visitorN_disable_configN_sourceh _destinationN _config_files]7/var/lib/git/docbuild/linux/Documentation/docutils.confafile_insertion_enabled raw_enabledKline_length_limitM'pep_referencesN pep_base_urlhttps://peps.python.org/pep_file_url_templatepep-%04drfc_referencesN rfc_base_url&https://datatracker.ietf.org/doc/html/ tab_widthKtrim_footnote_reference_spacesyntax_highlightlong smart_quotessmartquotes_locales]character_level_inline_markupdoctitle_xform docinfo_xformKsectsubtitle_xform image_loadinglinkembed_stylesheetcloak_email_addressessection_self_linkenvNubreporterNindirect_targets]substitution_defs}substitution_names}refnames}refids}(j5]j*aj>]j4aj]jaj0 ]j& aj} ]js aj ]j aj1]j'aunameids}(jjjjjZjWjjjCj@j;j8jj5jjj1 j. jj>jjj7 jj6 j3 j j0 j j j' j} j& j# jTj jSjPj?j<jjjjj7j4jj1jju nametypes}(jjjZjjCj;jjj1 jjj7 j6 j j j' j& jTjSj?jjj7jjuh}(jhjhjWjjj]j@jj8jj5jFjjFj. jj>j?jj?jjj3 jj0 j< j j< j} j j# j j j4 jPj4 j<jYjjjjjj4jj1jBjjBu footnote_refs} citation_refs} autofootnotes]autofootnote_refs]symbol_footnotes]symbol_footnote_refs] footnotes] citations]autofootnote_startKsymbol_footnote_startK id_counter collectionsCounter}Rparse_messages]transform_messages](hsystem_message)}(hhh]h)}(hhh]h2Hyperlink target "mds-sys-info" is not referenced.}hjcsbah}(h]h ]h"]h$]h&]uh1hhj`ubah}(h]h ]h"]h$]h&]levelKtypeINFOsourcehlineKUuh1j^ubj_)}(hhh]h)}(hhh]h6Hyperlink target "cpu-buffer-clear" is not referenced.}hj~sbah}(h]h ]h"]h$]h&]uh1hhj{ubah}(h]h ]h"]h$]h&]levelKtypejxsourcehlineKuh1j^ubj_)}(hhh]h)}(hhh]h4Hyperlink target "virt-mechanism" is not referenced.}hjsbah}(h]h ]h"]h$]h&]uh1hhjubah}(h]h ]h"]h$]h&]levelKtypejxsourcehlineKuh1j^ubj_)}(hhh]h)}(hhh]h.Hyperlink target "xeon-phi" is not referenced.}hjsbah}(h]h ]h"]h$]h&]uh1hhjubah}(h]h ]h"]h$]h&]levelKtypejxsourcehlineKuh1j^ubj_)}(hhh]h)}(hhh]h5Hyperlink target "mds-smt-control" is not referenced.}hjsbah}(h]h ]h"]h$]h&]uh1hhjubah}(h]h ]h"]h$]h&]levelKtypejxsourcehlineKuh1j^ubj_)}(hhh]h)}(hhh]hIHyperlink target "mds-mitigation-control-command-line" is not referenced.}hjsbah}(h]h ]h"]h$]h&]uh1hhjubah}(h]h ]h"]h$]h&]levelKtypejxsourcehlineKuh1j^ubj_)}(hhh]h)}(hhh]h=Hyperlink target "mds-default-mitigations" is not referenced.}hjsbah}(h]h ]h"]h$]h&]uh1hhjubah}(h]h ]h"]h$]h&]levelKtypejxsourcehlineM#uh1j^ube transformerN include_log] decorationNhhub.