'sphinx.addnodesdocument)}( rawsourcechildren]( translations LanguagesNode)}(hhh](h pending_xref)}(hhh]docutils.nodesTextChinese (Simplified)}parenthsba attributes}(ids]classes]names]dupnames]backrefs] refdomainstdreftypedoc reftarget+/translations/zh_CN/admin-guide/hw-vuln/mdsmodnameN classnameN refexplicitutagnamehhh ubh)}(hhh]hChinese (Traditional)}hh2sbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget+/translations/zh_TW/admin-guide/hw-vuln/mdsmodnameN classnameN refexplicituh1hhh ubh)}(hhh]hItalian}hhFsbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget+/translations/it_IT/admin-guide/hw-vuln/mdsmodnameN classnameN refexplicituh1hhh ubh)}(hhh]hJapanese}hhZsbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget+/translations/ja_JP/admin-guide/hw-vuln/mdsmodnameN classnameN refexplicituh1hhh ubh)}(hhh]hKorean}hhnsbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget+/translations/ko_KR/admin-guide/hw-vuln/mdsmodnameN classnameN refexplicituh1hhh ubh)}(hhh]hPortuguese (Brazilian)}hhsbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget+/translations/pt_BR/admin-guide/hw-vuln/mdsmodnameN classnameN refexplicituh1hhh ubh)}(hhh]hSpanish}hhsbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget+/translations/sp_SP/admin-guide/hw-vuln/mdsmodnameN classnameN refexplicituh1hhh ubeh}(h]h ]h"]h$]h&]current_languageEnglishuh1h hh _documenthsourceNlineNubhsection)}(hhh](htitle)}(h&MDS - Microarchitectural Data Samplingh]h&MDS - Microarchitectural Data Sampling}(hhhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhhhE/var/lib/git/docbuild/linux/Documentation/admin-guide/hw-vuln/mds.rsthKubh paragraph)}(hMicroarchitectural Data Sampling is a hardware vulnerability which allows unprivileged speculative access to data which is available in various CPU internal buffers.h]hMicroarchitectural Data Sampling is a hardware vulnerability which allows unprivileged speculative access to data which is available in various CPU internal buffers.}(hhhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhhhhubh)}(hhh](h)}(hAffected processorsh]hAffected processors}(hhhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhhhhhK ubh)}(haThis vulnerability affects a wide range of Intel processors. The vulnerability is not present on:h]haThis vulnerability affects a wide range of Intel processors. The vulnerability is not present on:}(hhhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhK hhhhubh block_quote)}(hX - Processors from AMD, Centaur and other non Intel vendors - Older processor models, where the CPU family is < 6 - Some Atoms (Bonnell, Saltwell, Goldmont, GoldmontPlus) - Intel processors which have the ARCH_CAP_MDS_NO bit set in the IA32_ARCH_CAPABILITIES MSR. h]h bullet_list)}(hhh](h list_item)}(h9Processors from AMD, Centaur and other non Intel vendors h]h)}(h8Processors from AMD, Centaur and other non Intel vendorsh]h8Processors from AMD, Centaur and other non Intel vendors}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhjubah}(h]h ]h"]h$]h&]uh1jhjubj)}(h4Older processor models, where the CPU family is < 6 h]h)}(h3Older processor models, where the CPU family is < 6h]h3Older processor models, where the CPU family is < 6}(hj#hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhjubah}(h]h ]h"]h$]h&]uh1jhjubj)}(h7Some Atoms (Bonnell, Saltwell, Goldmont, GoldmontPlus) h]h)}(h6Some Atoms (Bonnell, Saltwell, Goldmont, GoldmontPlus)h]h6Some Atoms (Bonnell, Saltwell, Goldmont, GoldmontPlus)}(hj;hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhj7ubah}(h]h ]h"]h$]h&]uh1jhjubj)}(h[Intel processors which have the ARCH_CAP_MDS_NO bit set in the IA32_ARCH_CAPABILITIES MSR. h]h)}(hZIntel processors which have the ARCH_CAP_MDS_NO bit set in the IA32_ARCH_CAPABILITIES MSR.h]hZIntel processors which have the ARCH_CAP_MDS_NO bit set in the IA32_ARCH_CAPABILITIES MSR.}(hjShhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhjOubah}(h]h ]h"]h$]h&]uh1jhjubeh}(h]h ]h"]h$]h&]bullet-uh1jhhhKhhubah}(h]h ]h"]h$]h&]uh1hhhhKhhhhubh)}(hyWhether a processor is affected or not can be read out from the MDS vulnerability file in sysfs. See :ref:`mds_sys_info`.h](heWhether a processor is affected or not can be read out from the MDS vulnerability file in sysfs. See }(hjuhhhNhNubh)}(h:ref:`mds_sys_info`h]hinline)}(hjh]h mds_sys_info}(hjhhhNhNubah}(h]h ](xrefstdstd-refeh"]h$]h&]uh1jhj}ubah}(h]h ]h"]h$]h&]refdocadmin-guide/hw-vuln/mds refdomainjreftyperef refexplicitrefwarn reftarget mds_sys_infouh1hhhhKhjuubh.}(hjuhhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhKhhhhubh)}(hNot all processors are affected by all variants of MDS, but the mitigation is identical for all of them so the kernel treats them as a single vulnerability.h]hNot all processors are affected by all variants of MDS, but the mitigation is identical for all of them so the kernel treats them as a single vulnerability.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhhhhubeh}(h]affected-processorsah ]h"]affected processorsah$]h&]uh1hhhhhhhhK ubh)}(hhh](h)}(h Related CVEsh]h Related CVEs}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjhhhhhKubh)}(h?The following CVE entries are related to the MDS vulnerability:h]h?The following CVE entries are related to the MDS vulnerability:}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhK!hjhhubh)}(hX============== ===== =================================================== CVE-2018-12126 MSBDS Microarchitectural Store Buffer Data Sampling CVE-2018-12130 MFBDS Microarchitectural Fill Buffer Data Sampling CVE-2018-12127 MLPDS Microarchitectural Load Port Data Sampling CVE-2019-11091 MDSUM Microarchitectural Data Sampling Uncacheable Memory ============== ===== =================================================== h]htable)}(hhh]htgroup)}(hhh](hcolspec)}(hhh]h}(h]h ]h"]h$]h&]colwidthKuh1jhjubj)}(hhh]h}(h]h ]h"]h$]h&]colwidthKuh1jhjubj)}(hhh]h}(h]h ]h"]h$]h&]colwidthK3uh1jhjubhtbody)}(hhh](hrow)}(hhh](hentry)}(hhh]h)}(hCVE-2018-12126h]hCVE-2018-12126}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhK$hjubah}(h]h ]h"]h$]h&]uh1jhjubj)}(hhh]h)}(hMSBDSh]hMSBDS}(hj5hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhK$hj2ubah}(h]h ]h"]h$]h&]uh1jhjubj)}(hhh]h)}(h-Microarchitectural Store Buffer Data Samplingh]h-Microarchitectural Store Buffer Data Sampling}(hjLhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhK$hjIubah}(h]h ]h"]h$]h&]uh1jhjubeh}(h]h ]h"]h$]h&]uh1jhjubj)}(hhh](j)}(hhh]h)}(hCVE-2018-12130h]hCVE-2018-12130}(hjlhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhK%hjiubah}(h]h ]h"]h$]h&]uh1jhjfubj)}(hhh]h)}(hMFBDSh]hMFBDS}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhK%hjubah}(h]h ]h"]h$]h&]uh1jhjfubj)}(hhh]h)}(h,Microarchitectural Fill Buffer Data Samplingh]h,Microarchitectural Fill Buffer Data Sampling}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhK%hjubah}(h]h ]h"]h$]h&]uh1jhjfubeh}(h]h ]h"]h$]h&]uh1jhjubj)}(hhh](j)}(hhh]h)}(hCVE-2018-12127h]hCVE-2018-12127}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhK&hjubah}(h]h ]h"]h$]h&]uh1jhjubj)}(hhh]h)}(hMLPDSh]hMLPDS}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhK&hjubah}(h]h ]h"]h$]h&]uh1jhjubj)}(hhh]h)}(h*Microarchitectural Load Port Data Samplingh]h*Microarchitectural Load Port Data Sampling}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhK&hjubah}(h]h ]h"]h$]h&]uh1jhjubeh}(h]h ]h"]h$]h&]uh1jhjubj)}(hhh](j)}(hhh]h)}(hCVE-2019-11091h]hCVE-2019-11091}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhK'hjubah}(h]h ]h"]h$]h&]uh1jhjubj)}(hhh]h)}(hMDSUMh]hMDSUM}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhK'hjubah}(h]h ]h"]h$]h&]uh1jhjubj)}(hhh]h)}(h3Microarchitectural Data Sampling Uncacheable Memoryh]h3Microarchitectural Data Sampling Uncacheable Memory}(hj6hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhK'hj3ubah}(h]h ]h"]h$]h&]uh1jhjubeh}(h]h ]h"]h$]h&]uh1jhjubeh}(h]h ]h"]h$]h&]uh1jhjubeh}(h]h ]h"]h$]h&]colsKuh1jhjubah}(h]h ]h"]h$]h&]uh1jhjubah}(h]h ]h"]h$]h&]uh1hhhhK#hjhhubeh}(h] related-cvesah ]h"] related cvesah$]h&]uh1hhhhhhhhKubh)}(hhh](h)}(hProblemh]hProblem}(hjthhhNhNubah}(h]h ]h"]h$]h&]uh1hhjqhhhhhK+ubh)}(hWhen performing store, load, L1 refill operations, processors write data into temporary microarchitectural structures (buffers). The data in the buffer can be forwarded to load operations as an optimization.h]hWhen performing store, load, L1 refill operations, processors write data into temporary microarchitectural structures (buffers). The data in the buffer can be forwarded to load operations as an optimization.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhK-hjqhhubh)}(hXUnder certain conditions, usually a fault/assist caused by a load operation, data unrelated to the load memory address can be speculatively forwarded from the buffers. Because the load operation causes a fault or assist and its result will be discarded, the forwarded data will not cause incorrect program execution or state changes. But a malicious operation may be able to forward this speculative data to a disclosure gadget which allows in turn to infer the value via a cache side channel attack.h]hXUnder certain conditions, usually a fault/assist caused by a load operation, data unrelated to the load memory address can be speculatively forwarded from the buffers. Because the load operation causes a fault or assist and its result will be discarded, the forwarded data will not cause incorrect program execution or state changes. But a malicious operation may be able to forward this speculative data to a disclosure gadget which allows in turn to infer the value via a cache side channel attack.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhK1hjqhhubh)}(hiBecause the buffers are potentially shared between Hyper-Threads cross Hyper-Thread attacks are possible.h]hiBecause the buffers are potentially shared between Hyper-Threads cross Hyper-Thread attacks are possible.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhK9hjqhhubh)}(hDeeper technical information is available in the MDS specific x86 architecture section: :ref:`Documentation/arch/x86/mds.rst `.h](hXDeeper technical information is available in the MDS specific x86 architecture section: }(hjhhhNhNubh)}(h+:ref:`Documentation/arch/x86/mds.rst `h]j)}(hjh]hDocumentation/arch/x86/mds.rst}(hjhhhNhNubah}(h]h ](jstdstd-refeh"]h$]h&]uh1jhjubah}(h]h ]h"]h$]h&]refdocj refdomainjreftyperef refexplicitrefwarnjmdsuh1hhhhKsexpect_referenced_by_id}jIj>subh)}(hhh](h)}(hMitigation mechanismh]hMitigation mechanism}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjhhhhhKubh)}(hYThe kernel detects the affected CPUs and the presence of the microcode which is required.h]hYThe kernel detects the affected CPUs and the presence of the microcode which is required.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhjhhubh)}(hIf a CPU is affected and the microcode is available, then the kernel enables the mitigation by default. The mitigation can be controlled at boot time via a kernel command line option. See :ref:`mds_mitigation_control_command_line`.h](hIf a CPU is affected and the microcode is available, then the kernel enables the mitigation by default. The mitigation can be controlled at boot time via a kernel command line option. See }(hjhhhNhNubh)}(h*:ref:`mds_mitigation_control_command_line`h]j)}(hj h]h#mds_mitigation_control_command_line}(hj"hhhNhNubah}(h]h ](jstdstd-refeh"]h$]h&]uh1jhjubah}(h]h ]h"]h$]h&]refdocj refdomainj,reftyperef refexplicitrefwarnj#mds_mitigation_control_command_lineuh1hhhhKhjubh.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhKhjhhubj=)}(h.. _cpu_buffer_clear:h]h}(h]h ]h"]h$]h&]jHcpu-buffer-clearuh1j<hKhjhhhhubh)}(hhh](h)}(hCPU buffer clearingh]hCPU buffer clearing}(hjVhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjShhhhhKubh)}(hXThe mitigation for MDS clears the affected CPU buffers on return to user space and when entering a guest. If SMT is enabled it also clears the buffers on idle entry when the CPU is only affected by MSBDS and not any other MDS variant, because the other variants cannot be protected against cross Hyper-Thread attacks. For CPUs which are only affected by MSBDS the user space, guest and idle transition mitigations are sufficient and SMT is not affected. h](h)}(hiThe mitigation for MDS clears the affected CPU buffers on return to user space and when entering a guest.h]hiThe mitigation for MDS clears the affected CPU buffers on return to user space and when entering a guest.}(hjhhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhjdubh)}(hIf SMT is enabled it also clears the buffers on idle entry when the CPU is only affected by MSBDS and not any other MDS variant, because the other variants cannot be protected against cross Hyper-Thread attacks.h]hIf SMT is enabled it also clears the buffers on idle entry when the CPU is only affected by MSBDS and not any other MDS variant, because the other variants cannot be protected against cross Hyper-Thread attacks.}(hjvhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhjdubh)}(hFor CPUs which are only affected by MSBDS the user space, guest and idle transition mitigations are sufficient and SMT is not affected.h]hFor CPUs which are only affected by MSBDS the user space, guest and idle transition mitigations are sufficient and SMT is not affected.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhjdubeh}(h]h ]h"]h$]h&]uh1hhhhKhjShhubj=)}(h.. _virt_mechanism:h]h}(h]h ]h"]h$]h&]jHvirt-mechanismuh1j<hKhjShhhhubeh}(h](cpu-buffer-clearingjReh ]h"](cpu buffer clearingcpu_buffer_cleareh$]h&]uh1hhjhhhhhKj}jjHsj}jRjHsubh)}(hhh](h)}(hVirtualization mitigationh]hVirtualization mitigation}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjhhhhhKubh)}(hXThe protection for host to guest transition depends on the L1TF vulnerability of the CPU: - CPU is affected by L1TF: If the L1D flush mitigation is enabled and up to date microcode is available, the L1D flush mitigation is automatically protecting the guest transition. If the L1D flush mitigation is disabled then the MDS mitigation is invoked explicit when the host MDS mitigation is enabled. For details on L1TF and virtualization see: :ref:`Documentation/admin-guide/hw-vuln//l1tf.rst `. - CPU is not affected by L1TF: CPU buffers are flushed before entering the guest when the host MDS mitigation is enabled. The resulting MDS protection matrix for the host to guest transition: ============ ===== ============= ============ ================= L1TF MDS VMX-L1FLUSH Host MDS MDS-State Don't care No Don't care N/A Not affected Yes Yes Disabled Off Vulnerable Yes Yes Disabled Full Mitigated Yes Yes Enabled Don't care Mitigated No Yes N/A Off Vulnerable No Yes N/A Full Mitigated ============ ===== ============= ============ ================= This only covers the host to guest transition, i.e. prevents leakage from host to guest, but does not protect the guest internally. Guests need to have their own protections. h](h)}(hYThe protection for host to guest transition depends on the L1TF vulnerability of the CPU:h]hYThe protection for host to guest transition depends on the L1TF vulnerability of the CPU:}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhjubj)}(hhh](j)}(hXCPU is affected by L1TF: If the L1D flush mitigation is enabled and up to date microcode is available, the L1D flush mitigation is automatically protecting the guest transition. If the L1D flush mitigation is disabled then the MDS mitigation is invoked explicit when the host MDS mitigation is enabled. For details on L1TF and virtualization see: :ref:`Documentation/admin-guide/hw-vuln//l1tf.rst `. h](h)}(hCPU is affected by L1TF:h]hCPU is affected by L1TF:}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhjubh)}(hIf the L1D flush mitigation is enabled and up to date microcode is available, the L1D flush mitigation is automatically protecting the guest transition.h]hIf the L1D flush mitigation is enabled and up to date microcode is available, the L1D flush mitigation is automatically protecting the guest transition.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhjubh)}(h|If the L1D flush mitigation is disabled then the MDS mitigation is invoked explicit when the host MDS mitigation is enabled.h]h|If the L1D flush mitigation is disabled then the MDS mitigation is invoked explicit when the host MDS mitigation is enabled.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhjubh)}(hxFor details on L1TF and virtualization see: :ref:`Documentation/admin-guide/hw-vuln//l1tf.rst `.h](h,For details on L1TF and virtualization see: }(hjhhhNhNubh)}(hK:ref:`Documentation/admin-guide/hw-vuln//l1tf.rst `h]j)}(hj h]h+Documentation/admin-guide/hw-vuln//l1tf.rst}(hjhhhNhNubah}(h]h ](jstdstd-refeh"]h$]h&]uh1jhj ubah}(h]h ]h"]h$]h&]refdocj refdomainjreftyperef refexplicitrefwarnjmitigation_control_kvmuh1hhhhKhjubh.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhKhjubeh}(h]h ]h"]h$]h&]uh1jhjubj)}(hyCPU is not affected by L1TF: CPU buffers are flushed before entering the guest when the host MDS mitigation is enabled. h](h)}(hCPU is not affected by L1TF:h]hCPU is not affected by L1TF:}(hj>hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhj:ubh)}(hZCPU buffers are flushed before entering the guest when the host MDS mitigation is enabled.h]hZCPU buffers are flushed before entering the guest when the host MDS mitigation is enabled.}(hjLhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhj:ubeh}(h]h ]h"]h$]h&]uh1jhjubeh}(h]h ]h"]h$]h&]jmjnuh1jhhhKhjubh)}(hEThe resulting MDS protection matrix for the host to guest transition:h]hEThe resulting MDS protection matrix for the host to guest transition:}(hjfhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhjubj)}(hhh]j)}(hhh](j)}(hhh]h}(h]h ]h"]h$]h&]colwidthK uh1jhjwubj)}(hhh]h}(h]h ]h"]h$]h&]colwidthKuh1jhjwubj)}(hhh]h}(h]h ]h"]h$]h&]colwidthK uh1jhjwubj)}(hhh]h}(h]h ]h"]h$]h&]colwidthK uh1jhjwubj)}(hhh]h}(h]h ]h"]h$]h&]colwidthKuh1jhjwubj)}(hhh](j)}(hhh](j)}(hhh]h)}(hL1TFh]hL1TF}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhjubah}(h]h ]h"]h$]h&]uh1jhjubj)}(hhh]h)}(hMDSh]hMDS}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhjubah}(h]h ]h"]h$]h&]uh1jhjubj)}(hhh]h)}(h VMX-L1FLUSHh]h VMX-L1FLUSH}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhjubah}(h]h ]h"]h$]h&]uh1jhjubj)}(hhh]h)}(hHost MDSh]hHost MDS}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhjubah}(h]h ]h"]h$]h&]uh1jhjubj)}(hhh]h)}(h MDS-Stateh]h MDS-State}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhj ubah}(h]h ]h"]h$]h&]uh1jhjubeh}(h]h ]h"]h$]h&]uh1jhjubj)}(hhh](j)}(hhh]h)}(h Don't careh]h Don’t care}(hj1 hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhj. ubah}(h]h ]h"]h$]h&]uh1jhj+ ubj)}(hhh]h)}(hNoh]hNo}(hjH hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhjE ubah}(h]h ]h"]h$]h&]uh1jhj+ ubj)}(hhh]h)}(h Don't careh]h Don’t care}(hj_ hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhj\ ubah}(h]h ]h"]h$]h&]uh1jhj+ ubj)}(hhh]h)}(hN/Ah]hN/A}(hjv hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhjs ubah}(h]h ]h"]h$]h&]uh1jhj+ ubj)}(hhh]h)}(h Not affectedh]h Not affected}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhj ubah}(h]h ]h"]h$]h&]uh1jhj+ ubeh}(h]h ]h"]h$]h&]uh1jhjubj)}(hhh](j)}(hhh]h)}(hYesh]hYes}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhj ubah}(h]h ]h"]h$]h&]uh1jhj ubj)}(hhh]h)}(hYesh]hYes}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhj ubah}(h]h ]h"]h$]h&]uh1jhj ubj)}(hhh]h)}(hDisabledh]hDisabled}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhj ubah}(h]h ]h"]h$]h&]uh1jhj ubj)}(hhh]h)}(hOffh]hOff}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhj ubah}(h]h ]h"]h$]h&]uh1jhj ubj)}(hhh]h)}(h Vulnerableh]h Vulnerable}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhj ubah}(h]h ]h"]h$]h&]uh1jhj ubeh}(h]h ]h"]h$]h&]uh1jhjubj)}(hhh](j)}(hhh]h)}(hYesh]hYes}(hj) hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhj& ubah}(h]h ]h"]h$]h&]uh1jhj# ubj)}(hhh]h)}(hYesh]hYes}(hj@ hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhj= ubah}(h]h ]h"]h$]h&]uh1jhj# ubj)}(hhh]h)}(hDisabledh]hDisabled}(hjW hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhjT ubah}(h]h ]h"]h$]h&]uh1jhj# ubj)}(hhh]h)}(hFullh]hFull}(hjn hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhjk ubah}(h]h ]h"]h$]h&]uh1jhj# ubj)}(hhh]h)}(h Mitigatedh]h Mitigated}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhj ubah}(h]h ]h"]h$]h&]uh1jhj# ubeh}(h]h ]h"]h$]h&]uh1jhjubj)}(hhh](j)}(hhh]h)}(hYesh]hYes}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhj ubah}(h]h ]h"]h$]h&]uh1jhj ubj)}(hhh]h)}(hYesh]hYes}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhj ubah}(h]h ]h"]h$]h&]uh1jhj ubj)}(hhh]h)}(hEnabledh]hEnabled}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhj ubah}(h]h ]h"]h$]h&]uh1jhj ubj)}(hhh]h)}(h Don't careh]h Don’t care}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhj ubah}(h]h ]h"]h$]h&]uh1jhj ubj)}(hhh]h)}(h Mitigatedh]h Mitigated}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhj ubah}(h]h ]h"]h$]h&]uh1jhj ubeh}(h]h ]h"]h$]h&]uh1jhjubj)}(hhh](j)}(hhh]h)}(hNoh]hNo}(hj! hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhj ubah}(h]h ]h"]h$]h&]uh1jhj ubj)}(hhh]h)}(hYesh]hYes}(hj8 hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhj5 ubah}(h]h ]h"]h$]h&]uh1jhj ubj)}(hhh]h)}(hN/Ah]hN/A}(hjO hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhjL ubah}(h]h ]h"]h$]h&]uh1jhj ubj)}(hhh]h)}(hOffh]hOff}(hjf hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhjc ubah}(h]h ]h"]h$]h&]uh1jhj ubj)}(hhh]h)}(h Vulnerableh]h Vulnerable}(hj} hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhjz ubah}(h]h ]h"]h$]h&]uh1jhj ubeh}(h]h ]h"]h$]h&]uh1jhjubj)}(hhh](j)}(hhh]h)}(hNoh]hNo}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhj ubah}(h]h ]h"]h$]h&]uh1jhj ubj)}(hhh]h)}(hYesh]hYes}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhj ubah}(h]h ]h"]h$]h&]uh1jhj ubj)}(hhh]h)}(hN/Ah]hN/A}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhj ubah}(h]h ]h"]h$]h&]uh1jhj ubj)}(hhh]h)}(hFullh]hFull}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhj ubah}(h]h ]h"]h$]h&]uh1jhj ubj)}(hhh]h)}(h Mitigatedh]h Mitigated}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhj ubah}(h]h ]h"]h$]h&]uh1jhj ubeh}(h]h ]h"]h$]h&]uh1jhjubeh}(h]h ]h"]h$]h&]uh1jhjwubeh}(h]h ]h"]h$]h&]colsKuh1jhjtubah}(h]h ]h"]h$]h&]uh1jhjubh)}(hThis only covers the host to guest transition, i.e. prevents leakage from host to guest, but does not protect the guest internally. Guests need to have their own protections.h]hThis only covers the host to guest transition, i.e. prevents leakage from host to guest, but does not protect the guest internally. Guests need to have their own protections.}(hj& hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhjubeh}(h]h ]h"]h$]h&]uh1hhhhKhjhhubj=)}(h .. _xeon_phi:h]h}(h]h ]h"]h$]h&]jHxeon-phiuh1j<hKhjhhhhubeh}(h](virtualization-mitigationjeh ]h"](virtualization mitigationvirt_mechanismeh$]h&]uh1hhjhhhhhKj}jK jsj}jjsubh)}(hhh](h)}(h XEON PHI specific considerationsh]h XEON PHI specific considerations}(hjS hhhNhNubah}(h]h ]h"]h$]h&]uh1hhjP hhhhhKubh)}(hX4The XEON PHI processor family is affected by MSBDS which can be exploited cross Hyper-Threads when entering idle states. Some XEON PHI variants allow to use MWAIT in user space (Ring 3) which opens an potential attack vector for malicious user space. The exposure can be disabled on the kernel command line with the 'ring3mwait=disable' command line option. XEON PHI is not affected by the other MDS variants and MSBDS is mitigated before the CPU enters an idle state. As XEON PHI is not affected by L1TF either disabling SMT is not required for full protection. h](h)}(hXeThe XEON PHI processor family is affected by MSBDS which can be exploited cross Hyper-Threads when entering idle states. Some XEON PHI variants allow to use MWAIT in user space (Ring 3) which opens an potential attack vector for malicious user space. The exposure can be disabled on the kernel command line with the 'ring3mwait=disable' command line option.h]hXiThe XEON PHI processor family is affected by MSBDS which can be exploited cross Hyper-Threads when entering idle states. Some XEON PHI variants allow to use MWAIT in user space (Ring 3) which opens an potential attack vector for malicious user space. The exposure can be disabled on the kernel command line with the ‘ring3mwait=disable’ command line option.}(hje hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhja ubh)}(hXEON PHI is not affected by the other MDS variants and MSBDS is mitigated before the CPU enters an idle state. As XEON PHI is not affected by L1TF either disabling SMT is not required for full protection.h]hXEON PHI is not affected by the other MDS variants and MSBDS is mitigated before the CPU enters an idle state. As XEON PHI is not affected by L1TF either disabling SMT is not required for full protection.}(hjs hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhja ubeh}(h]h ]h"]h$]h&]uh1hhhhKhjP hhubj=)}(h.. _mds_smt_control:h]h}(h]h ]h"]h$]h&]jHmds-smt-controluh1j<hKhjP hhhhubeh}(h]( xeon-phi-specific-considerationsjD eh ]h"]( xeon phi specific considerationsxeon_phieh$]h&]uh1hhjhhhhhKj}j j: sj}jD j: subh)}(hhh](h)}(h SMT controlh]h SMT control}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj hhhhhKubh)}(hXAll MDS variants except MSBDS can be attacked cross Hyper-Threads. That means on CPUs which are affected by MFBDS or MLPDS it is necessary to disable SMT for full protection. These are most of the affected CPUs; the exception is XEON PHI, see :ref:`xeon_phi`. Disabling SMT can have a significant performance impact, but the impact depends on the type of workloads. See the relevant chapter in the L1TF mitigation documentation for details: :ref:`Documentation/admin-guide/hw-vuln/l1tf.rst `. h](h)}(hXAll MDS variants except MSBDS can be attacked cross Hyper-Threads. That means on CPUs which are affected by MFBDS or MLPDS it is necessary to disable SMT for full protection. These are most of the affected CPUs; the exception is XEON PHI, see :ref:`xeon_phi`.h](hAll MDS variants except MSBDS can be attacked cross Hyper-Threads. That means on CPUs which are affected by MFBDS or MLPDS it is necessary to disable SMT for full protection. These are most of the affected CPUs; the exception is XEON PHI, see }(hj hhhNhNubh)}(h:ref:`xeon_phi`h]j)}(hj h]hxeon_phi}(hj hhhNhNubah}(h]h ](jstdstd-refeh"]h$]h&]uh1jhj ubah}(h]h ]h"]h$]h&]refdocj refdomainj reftyperef refexplicitrefwarnjxeon_phiuh1hhhhKhj ubh.}(hj hhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhKhj ubh)}(hiDisabling SMT can have a significant performance impact, but the impact depends on the type of workloads.h]hiDisabling SMT can have a significant performance impact, but the impact depends on the type of workloads.}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhj ubh)}(hSee the relevant chapter in the L1TF mitigation documentation for details: :ref:`Documentation/admin-guide/hw-vuln/l1tf.rst `.h](hKSee the relevant chapter in the L1TF mitigation documentation for details: }(hj hhhNhNubh)}(h?:ref:`Documentation/admin-guide/hw-vuln/l1tf.rst `h]j)}(hj h]h*Documentation/admin-guide/hw-vuln/l1tf.rst}(hj hhhNhNubah}(h]h ](jstdstd-refeh"]h$]h&]uh1jhj ubah}(h]h ]h"]h$]h&]refdocj refdomainj reftyperef refexplicitrefwarnj smt_controluh1hhhhKhj ubh.}(hj hhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhKhj ubeh}(h]h ]h"]h$]h&]uh1hhhhKhj hhubj=)}(h(.. _mds_mitigation_control_command_line:h]h}(h]h ]h"]h$]h&]jH#mds-mitigation-control-command-lineuh1j<hKhj hhhhubeh}(h]( smt-controlj eh ]h"]( smt controlmds_smt_controleh$]h&]uh1hhjhhhhhKj}j; j sj}j j subeh}(h]mitigation-mechanismah ]h"]mitigation mechanismah$]h&]uh1hhhhhhhhKubh)}(hhh](h)}(h-Mitigation control on the kernel command lineh]h-Mitigation control on the kernel command line}(hjK hhhNhNubah}(h]h ]h"]h$]h&]uh1hhjH hhhhhKubh)}(hThe kernel command line allows to control the MDS mitigations at boot time with the option "mds=". The valid arguments for this option are:h]hThe kernel command line allows to control the MDS mitigations at boot time with the option “mds=”. The valid arguments for this option are:}(hjY hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhjH hhubh)}(hX============ ============================================================= full If the CPU is vulnerable, enable all available mitigations for the MDS vulnerability, CPU buffer clearing on exit to userspace and when entering a VM. Idle transitions are protected as well if SMT is enabled. It does not automatically disable SMT. full,nosmt The same as mds=full, with SMT disabled on vulnerable CPUs. This is the complete mitigation. off Disables MDS mitigations completely. ============ ============================================================= h]j)}(hhh]j)}(hhh](j)}(hhh]h}(h]h ]h"]h$]h&]colwidthK uh1jhjn ubj)}(hhh]h}(h]h ]h"]h$]h&]colwidthK=uh1jhjn ubj)}(hhh](j)}(hhh](j)}(hhh]h)}(hfullh]hfull}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhj ubah}(h]h ]h"]h$]h&]uh1jhj ubj)}(hhh](h)}(hIf the CPU is vulnerable, enable all available mitigations for the MDS vulnerability, CPU buffer clearing on exit to userspace and when entering a VM. Idle transitions are protected as well if SMT is enabled.h]hIf the CPU is vulnerable, enable all available mitigations for the MDS vulnerability, CPU buffer clearing on exit to userspace and when entering a VM. Idle transitions are protected as well if SMT is enabled.}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhj ubh)}(h&It does not automatically disable SMT.h]h&It does not automatically disable SMT.}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhj ubeh}(h]h ]h"]h$]h&]uh1jhj ubeh}(h]h ]h"]h$]h&]uh1jhj ubj)}(hhh](j)}(hhh]h)}(h full,nosmth]h full,nosmt}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhj ubah}(h]h ]h"]h$]h&]uh1jhj ubj)}(hhh]h)}(h]The same as mds=full, with SMT disabled on vulnerable CPUs. This is the complete mitigation.h]h]The same as mds=full, with SMT disabled on vulnerable CPUs. This is the complete mitigation.}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhj ubah}(h]h ]h"]h$]h&]uh1jhj ubeh}(h]h ]h"]h$]h&]uh1jhj ubj)}(hhh](j)}(hhh]h)}(hoffh]hoff}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMhjubah}(h]h ]h"]h$]h&]uh1jhjubj)}(hhh]h)}(h$Disables MDS mitigations completely.h]h$Disables MDS mitigations completely.}(hj!hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMhjubah}(h]h ]h"]h$]h&]uh1jhjubeh}(h]h ]h"]h$]h&]uh1jhj ubeh}(h]h ]h"]h$]h&]uh1jhjn ubeh}(h]h ]h"]h$]h&]colsKuh1jhjk ubah}(h]h ]h"]h$]h&]uh1jhjg ubah}(h]h ]h"]h$]h&]uh1hhhhKhjH hhubh)}(hXNot specifying this option is equivalent to "mds=full". For processors that are affected by both TAA (TSX Asynchronous Abort) and MDS, specifying just "mds=off" without an accompanying "tsx_async_abort=off" will have no effect as the same mitigation is used for both vulnerabilities.h]hX'Not specifying this option is equivalent to “mds=full”. For processors that are affected by both TAA (TSX Asynchronous Abort) and MDS, specifying just “mds=off” without an accompanying “tsx_async_abort=off” will have no effect as the same mitigation is used for both vulnerabilities.}(hjThhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMhjH hhubeh}(h](-mitigation-control-on-the-kernel-command-linej4 eh ]h"](-mitigation control on the kernel command line#mds_mitigation_control_command_lineeh$]h&]uh1hhhhhhhhKj}jhj* sj}j4 j* subh)}(hhh](h)}(hMitigation selection guideh]hMitigation selection guide}(hjphhhNhNubah}(h]h ]h"]h$]h&]uh1hhjmhhhhhM ubh)}(hhh](h)}(h1. Trusted userspaceh]h1. Trusted userspace}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhj~hhhhhMubh)}(hIf all userspace applications are from a trusted source and do not execute untrusted code which is supplied externally, then the mitigation can be disabled. h]h)}(hIf all userspace applications are from a trusted source and do not execute untrusted code which is supplied externally, then the mitigation can be disabled.h]hIf all userspace applications are from a trusted source and do not execute untrusted code which is supplied externally, then the mitigation can be disabled.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMhjubah}(h]h ]h"]h$]h&]uh1hhhhMhj~hhubeh}(h]trusted-userspaceah ]h"]1. trusted userspaceah$]h&]uh1hhjmhhhhhMubh)}(hhh](h)}(h%2. Virtualization with trusted guestsh]h%2. Virtualization with trusted guests}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjhhhhhMubh)}(hBThe same considerations as above versus trusted user space apply. h]h)}(hAThe same considerations as above versus trusted user space apply.h]hAThe same considerations as above versus trusted user space apply.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMhjubah}(h]h ]h"]h$]h&]uh1hhhhMhjhhubeh}(h]"virtualization-with-trusted-guestsah ]h"]%2. virtualization with trusted guestsah$]h&]uh1hhjmhhhhhMubh)}(hhh](h)}(h'3. Virtualization with untrusted guestsh]h'3. Virtualization with untrusted guests}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjhhhhhMubh)}(hThe protection depends on the state of the L1TF mitigations. See :ref:`virt_mechanism`. If the MDS mitigation is enabled and SMT is disabled, guest to host and guest to guest attacks are prevented. h](h)}(hWThe protection depends on the state of the L1TF mitigations. See :ref:`virt_mechanism`.h](hAThe protection depends on the state of the L1TF mitigations. See }(hjhhhNhNubh)}(h:ref:`virt_mechanism`h]j)}(hjh]hvirt_mechanism}(hjhhhNhNubah}(h]h ](jstdstd-refeh"]h$]h&]uh1jhjubah}(h]h ]h"]h$]h&]refdocj refdomainj reftyperef refexplicitrefwarnjvirt_mechanismuh1hhhhMhjubh.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhMhjubh)}(hmIf the MDS mitigation is enabled and SMT is disabled, guest to host and guest to guest attacks are prevented.h]hmIf the MDS mitigation is enabled and SMT is disabled, guest to host and guest to guest attacks are prevented.}(hj'hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhM hjubeh}(h]h ]h"]h$]h&]uh1hhhhMhjhhubj=)}(h.. _mds_default_mitigations:h]h}(h]h ]h"]h$]h&]jHmds-default-mitigationsuh1j<hM#hjhhhhubeh}(h]$virtualization-with-untrusted-guestsah ]h"]'3. virtualization with untrusted guestsah$]h&]uh1hhjmhhhhhMubeh}(h]mitigation-selection-guideah ]h"]mitigation selection guideah$]h&]uh1hhhhhhhhM ubh)}(hhh](h)}(hDefault mitigationsh]hDefault mitigations}(hjYhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjVhhhhhM&ubh)}(hXPThe kernel default mitigations for vulnerable processors are: - Enable CPU buffer clearing The kernel does not by default enforce the disabling of SMT, which leaves SMT systems vulnerable when running untrusted code. The same rationale as for L1TF applies. See :ref:`Documentation/admin-guide/hw-vuln//l1tf.rst `.h](h)}(h=The kernel default mitigations for vulnerable processors are:h]h=The kernel default mitigations for vulnerable processors are:}(hjkhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhM(hjgubj)}(hhh]j)}(hEnable CPU buffer clearing h]h)}(hEnable CPU buffer clearingh]hEnable CPU buffer clearing}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhM*hj|ubah}(h]h ]h"]h$]h&]uh1jhjyubah}(h]h ]h"]h$]h&]jmjnuh1jhhhM*hjgubh)}(hThe kernel does not by default enforce the disabling of SMT, which leaves SMT systems vulnerable when running untrusted code. The same rationale as for L1TF applies. See :ref:`Documentation/admin-guide/hw-vuln//l1tf.rst `.h](hThe kernel does not by default enforce the disabling of SMT, which leaves SMT systems vulnerable when running untrusted code. The same rationale as for L1TF applies. See }(hjhhhNhNubh)}(hH:ref:`Documentation/admin-guide/hw-vuln//l1tf.rst `h]j)}(hjh]h+Documentation/admin-guide/hw-vuln//l1tf.rst}(hjhhhNhNubah}(h]h ](jstdstd-refeh"]h$]h&]uh1jhjubah}(h]h ]h"]h$]h&]refdocj refdomainjreftyperef refexplicitrefwarnjdefault_mitigationsuh1hhhhM,hjubh.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhM,hjgubeh}(h]h ]h"]h$]h&]uh1hhhhM(hjVhhubeh}(h](default-mitigationsjEeh ]h"](default mitigationsmds_default_mitigationseh$]h&]uh1hhhhhhhhM&j}jj;sj}jEj;subeh}(h]$mds-microarchitectural-data-samplingah ]h"]&mds - microarchitectural data samplingah$]h&]uh1hhhhhhhhKubeh}(h]h ]h"]h$]h&]sourcehuh1hcurrent_sourceN current_lineNsettingsdocutils.frontendValues)}(hN generatorN datestampN source_linkN source_urlN toc_backlinksjfootnote_backlinksK sectnum_xformKstrip_commentsNstrip_elements_with_classesN strip_classesN report_levelK halt_levelKexit_status_levelKdebugNwarning_streamN tracebackinput_encoding utf-8-siginput_encoding_error_handlerstrictoutput_encodingutf-8output_encoding_error_handlerjerror_encodingutf-8error_encoding_error_handlerbackslashreplace language_codeenrecord_dependenciesNconfigN id_prefixhauto_id_prefixid dump_settingsNdump_internalsNdump_transformsNdump_pseudo_xmlNexpose_internalsNstrict_visitorN_disable_configN_sourcehʌ _destinationN _config_files]7/var/lib/git/docbuild/linux/Documentation/docutils.confafile_insertion_enabled raw_enabledKline_length_limitM'pep_referencesN pep_base_urlhttps://peps.python.org/pep_file_url_templatepep-%04drfc_referencesN rfc_base_url&https://datatracker.ietf.org/doc/html/ tab_widthKtrim_footnote_reference_spacesyntax_highlightlong smart_quotessmartquotes_locales]character_level_inline_markupdoctitle_xform docinfo_xformKsectsubtitle_xform image_loadinglinkembed_stylesheetcloak_email_addressessection_self_linkenvNubreporterNindirect_targets]substitution_defs}substitution_names}refnames}refids}(jI]j>ajR]jHaj]jajD ]j: aj ]j aj4 ]j* ajE]j;aunameids}(jjjjjnjkjjjWjTjOjLjjIjjjE jB jjRjjjK jjJ jG j jD j j j; j j: j7 jhj4 jgjdjSjPjjjjjKjHjjEjju nametypes}(jjjnjjWjOjjjE jjjK jJ j j j; j: jhjgjSjjjKjjuh}(jhjhjkjjjqjTjjLjjIjZjjZjB jjRjSjjSjjjG jjD jP j jP j j j7 j j4 jH jdjH jPjmjj~jjjHjjEjVjjVu footnote_refs} citation_refs} autofootnotes]autofootnote_refs]symbol_footnotes]symbol_footnote_refs] footnotes] citations]autofootnote_startKsymbol_footnote_startK id_counter collectionsCounter}Rparse_messages]transform_messages](hsystem_message)}(hhh]h)}(hhh]h2Hyperlink target "mds-sys-info" is not referenced.}hjwsbah}(h]h ]h"]h$]h&]uh1hhjtubah}(h]h ]h"]h$]h&]levelKtypeINFOsourcehʌlineKUuh1jrubjs)}(hhh]h)}(hhh]h6Hyperlink target "cpu-buffer-clear" is not referenced.}hjsbah}(h]h ]h"]h$]h&]uh1hhjubah}(h]h ]h"]h$]h&]levelKtypejsourcehʌlineKuh1jrubjs)}(hhh]h)}(hhh]h4Hyperlink target "virt-mechanism" is not referenced.}hjsbah}(h]h ]h"]h$]h&]uh1hhjubah}(h]h ]h"]h$]h&]levelKtypejsourcehʌlineKuh1jrubjs)}(hhh]h)}(hhh]h.Hyperlink target "xeon-phi" is not referenced.}hjsbah}(h]h ]h"]h$]h&]uh1hhjubah}(h]h ]h"]h$]h&]levelKtypejsourcehʌlineKuh1jrubjs)}(hhh]h)}(hhh]h5Hyperlink target "mds-smt-control" is not referenced.}hjsbah}(h]h ]h"]h$]h&]uh1hhjubah}(h]h ]h"]h$]h&]levelKtypejsourcehʌlineKuh1jrubjs)}(hhh]h)}(hhh]hIHyperlink target "mds-mitigation-control-command-line" is not referenced.}hjsbah}(h]h ]h"]h$]h&]uh1hhjubah}(h]h ]h"]h$]h&]levelKtypejsourcehʌlineKuh1jrubjs)}(hhh]h)}(hhh]h=Hyperlink target "mds-default-mitigations" is not referenced.}hjsbah}(h]h ]h"]h$]h&]uh1hhjubah}(h]h ]h"]h$]h&]levelKtypejsourcehʌlineM#uh1jrube transformerN include_log] decorationNhhub.