)_sphinx.addnodesdocument)}( rawsourcechildren]( translations LanguagesNode)}(hhh](h pending_xref)}(hhh]docutils.nodesTextChinese (Simplified)}parenthsba attributes}(ids]classes]names]dupnames]backrefs] refdomainstdreftypedoc reftarget>/translations/zh_CN/admin-guide/hw-vuln/reg-file-data-samplingmodnameN classnameN refexplicitutagnamehhh ubh)}(hhh]hChinese (Traditional)}hh2sbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget>/translations/zh_TW/admin-guide/hw-vuln/reg-file-data-samplingmodnameN classnameN refexplicituh1hhh ubh)}(hhh]hItalian}hhFsbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget>/translations/it_IT/admin-guide/hw-vuln/reg-file-data-samplingmodnameN classnameN refexplicituh1hhh ubh)}(hhh]hJapanese}hhZsbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget>/translations/ja_JP/admin-guide/hw-vuln/reg-file-data-samplingmodnameN classnameN refexplicituh1hhh ubh)}(hhh]hKorean}hhnsbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget>/translations/ko_KR/admin-guide/hw-vuln/reg-file-data-samplingmodnameN classnameN refexplicituh1hhh ubh)}(hhh]hSpanish}hhsbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget>/translations/sp_SP/admin-guide/hw-vuln/reg-file-data-samplingmodnameN classnameN refexplicituh1hhh ubeh}(h]h ]h"]h$]h&]current_languageEnglishuh1h hh _documenthsourceNlineNubhsection)}(hhh](htitle)}(h"Register File Data Sampling (RFDS)h]h"Register File Data Sampling (RFDS)}(hhhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhhhX/var/lib/git/docbuild/linux/Documentation/admin-guide/hw-vuln/reg-file-data-sampling.rsthKubh paragraph)}(hXxRegister File Data Sampling (RFDS) is a microarchitectural vulnerability that only affects Intel Atom parts(also branded as E-cores). RFDS may allow a malicious actor to infer data values previously used in floating point registers, vector registers, or integer registers. RFDS does not provide the ability to choose which data is inferred. CVE-2023-28746 is assigned to RFDS.h]hXxRegister File Data Sampling (RFDS) is a microarchitectural vulnerability that only affects Intel Atom parts(also branded as E-cores). RFDS may allow a malicious actor to infer data values previously used in floating point registers, vector registers, or integer registers. RFDS does not provide the ability to choose which data is inferred. CVE-2023-28746 is assigned to RFDS.}(hhhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhhhhubh)}(hhh](h)}(hAffected Processorsh]hAffected Processors}(hhhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhhhhhK ubh)}(h6Below is the list of affected Intel processors [#f1]_:h](h/Below is the list of affected Intel processors }(hhhhhNhNubhfootnote_reference)}(h[#f1]_h]h1}(hhhhhNhNubah}(h]id1ah ]h"]h$]h&]autoKrefidf1docname*admin-guide/hw-vuln/reg-file-data-samplinguh1hhh،resolvedKubh:}(hhhhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhK hhhhubh block_quote)}(hX=================== ============ Common name Family_Model =================== ============ ATOM_GOLDMONT 06_5CH ATOM_GOLDMONT_D 06_5FH ATOM_GOLDMONT_PLUS 06_7AH ATOM_TREMONT_D 06_86H ATOM_TREMONT 06_96H ALDERLAKE 06_97H ALDERLAKE_L 06_9AH ATOM_TREMONT_L 06_9CH RAPTORLAKE 06_B7H RAPTORLAKE_P 06_BAH ATOM_GRACEMONT 06_BEH RAPTORLAKE_S 06_BFH =================== ============ h]htable)}(hhh]htgroup)}(hhh](hcolspec)}(hhh]h}(h]h ]h"]h$]h&]colwidthKuh1jhjubj)}(hhh]h}(h]h ]h"]h$]h&]colwidthK uh1jhjubhthead)}(hhh]hrow)}(hhh](hentry)}(hhh]h)}(h Common nameh]h Common name}(hj6hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhj3ubah}(h]h ]h"]h$]h&]uh1j1hj.ubj2)}(hhh]h)}(h Family_Modelh]h Family_Model}(hjMhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhjJubah}(h]h ]h"]h$]h&]uh1j1hj.ubeh}(h]h ]h"]h$]h&]uh1j,hj)ubah}(h]h ]h"]h$]h&]uh1j'hjubhtbody)}(hhh](j-)}(hhh](j2)}(hhh]h)}(h ATOM_GOLDMONTh]h ATOM_GOLDMONT}(hjxhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhjuubah}(h]h ]h"]h$]h&]uh1j1hjrubj2)}(hhh]h)}(h06_5CHh]h06_5CH}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhjubah}(h]h ]h"]h$]h&]uh1j1hjrubeh}(h]h ]h"]h$]h&]uh1j,hjoubj-)}(hhh](j2)}(hhh]h)}(hATOM_GOLDMONT_Dh]hATOM_GOLDMONT_D}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhjubah}(h]h ]h"]h$]h&]uh1j1hjubj2)}(hhh]h)}(h06_5FHh]h06_5FH}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhjubah}(h]h ]h"]h$]h&]uh1j1hjubeh}(h]h ]h"]h$]h&]uh1j,hjoubj-)}(hhh](j2)}(hhh]h)}(hATOM_GOLDMONT_PLUSh]hATOM_GOLDMONT_PLUS}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhjubah}(h]h ]h"]h$]h&]uh1j1hjubj2)}(hhh]h)}(h06_7AHh]h06_7AH}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhjubah}(h]h ]h"]h$]h&]uh1j1hjubeh}(h]h ]h"]h$]h&]uh1j,hjoubj-)}(hhh](j2)}(hhh]h)}(hATOM_TREMONT_Dh]hATOM_TREMONT_D}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhjubah}(h]h ]h"]h$]h&]uh1j1hjubj2)}(hhh]h)}(h06_86Hh]h06_86H}(hj4hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhj1ubah}(h]h ]h"]h$]h&]uh1j1hjubeh}(h]h ]h"]h$]h&]uh1j,hjoubj-)}(hhh](j2)}(hhh]h)}(h ATOM_TREMONTh]h ATOM_TREMONT}(hjThhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhjQubah}(h]h ]h"]h$]h&]uh1j1hjNubj2)}(hhh]h)}(h06_96Hh]h06_96H}(hjkhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhjhubah}(h]h ]h"]h$]h&]uh1j1hjNubeh}(h]h ]h"]h$]h&]uh1j,hjoubj-)}(hhh](j2)}(hhh]h)}(h ALDERLAKEh]h ALDERLAKE}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhjubah}(h]h ]h"]h$]h&]uh1j1hjubj2)}(hhh]h)}(h06_97Hh]h06_97H}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhjubah}(h]h ]h"]h$]h&]uh1j1hjubeh}(h]h ]h"]h$]h&]uh1j,hjoubj-)}(hhh](j2)}(hhh]h)}(h ALDERLAKE_Lh]h ALDERLAKE_L}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhjubah}(h]h ]h"]h$]h&]uh1j1hjubj2)}(hhh]h)}(h06_9AHh]h06_9AH}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhjubah}(h]h ]h"]h$]h&]uh1j1hjubeh}(h]h ]h"]h$]h&]uh1j,hjoubj-)}(hhh](j2)}(hhh]h)}(hATOM_TREMONT_Lh]hATOM_TREMONT_L}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhjubah}(h]h ]h"]h$]h&]uh1j1hjubj2)}(hhh]h)}(h06_9CHh]h06_9CH}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhj ubah}(h]h ]h"]h$]h&]uh1j1hjubeh}(h]h ]h"]h$]h&]uh1j,hjoubj-)}(hhh](j2)}(hhh]h)}(h RAPTORLAKEh]h RAPTORLAKE}(hj0hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhj-ubah}(h]h ]h"]h$]h&]uh1j1hj*ubj2)}(hhh]h)}(h06_B7Hh]h06_B7H}(hjGhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhjDubah}(h]h ]h"]h$]h&]uh1j1hj*ubeh}(h]h ]h"]h$]h&]uh1j,hjoubj-)}(hhh](j2)}(hhh]h)}(h RAPTORLAKE_Ph]h RAPTORLAKE_P}(hjghhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhjdubah}(h]h ]h"]h$]h&]uh1j1hjaubj2)}(hhh]h)}(h06_BAHh]h06_BAH}(hj~hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhj{ubah}(h]h ]h"]h$]h&]uh1j1hjaubeh}(h]h ]h"]h$]h&]uh1j,hjoubj-)}(hhh](j2)}(hhh]h)}(hATOM_GRACEMONTh]hATOM_GRACEMONT}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhjubah}(h]h ]h"]h$]h&]uh1j1hjubj2)}(hhh]h)}(h06_BEHh]h06_BEH}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhjubah}(h]h ]h"]h$]h&]uh1j1hjubeh}(h]h ]h"]h$]h&]uh1j,hjoubj-)}(hhh](j2)}(hhh]h)}(h RAPTORLAKE_Sh]h RAPTORLAKE_S}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhjubah}(h]h ]h"]h$]h&]uh1j1hjubj2)}(hhh]h)}(h06_BFHh]h06_BFH}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhjubah}(h]h ]h"]h$]h&]uh1j1hjubeh}(h]h ]h"]h$]h&]uh1j,hjoubeh}(h]h ]h"]h$]h&]uh1jmhjubeh}(h]h ]h"]h$]h&]colsKuh1j hj ubah}(h]h ]h"]h$]h&]uh1jhjubah}(h]h ]h"]h$]h&]uh1jhhhKhhhhubeh}(h]affected-processorsah ]h"]affected processorsah$]h&]uh1hhhhhhhhK ubh)}(hhh](h)}(h Mitigationh]h Mitigation}(hj*hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj'hhhhhK!ubh)}(hXIntel released a microcode update that enables software to clear sensitive information using the VERW instruction. Like MDS, RFDS deploys the same mitigation strategy to force the CPU to clear the affected buffers before an attacker can extract the secrets. This is achieved by using the otherwise unused and obsolete VERW instruction in combination with a microcode update. The microcode clears the affected CPU buffers when the VERW instruction is executed.h]hXIntel released a microcode update that enables software to clear sensitive information using the VERW instruction. Like MDS, RFDS deploys the same mitigation strategy to force the CPU to clear the affected buffers before an attacker can extract the secrets. This is achieved by using the otherwise unused and obsolete VERW instruction in combination with a microcode update. The microcode clears the affected CPU buffers when the VERW instruction is executed.}(hj8hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhK"hj'hhubh)}(hhh](h)}(hMitigation pointsh]hMitigation points}(hjIhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjFhhhhhK+ubh)}(hVERW is executed by the kernel before returning to user space, and by KVM before VMentry. None of the affected cores support SMT, so VERW is not required at C-state transitions.h]hVERW is executed by the kernel before returning to user space, and by KVM before VMentry. None of the affected cores support SMT, so VERW is not required at C-state transitions.}(hjWhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhK,hjFhhubeh}(h]mitigation-pointsah ]h"]mitigation pointsah$]h&]uh1hhj'hhhhhK+ubh)}(hhh](h)}(h"New bits in IA32_ARCH_CAPABILITIESh]h"New bits in IA32_ARCH_CAPABILITIES}(hjphhhNhNubah}(h]h ]h"]h$]h&]uh1hhjmhhhhhK1ubh)}(hNewer processors and microcode update on existing affected processors added new bits to IA32_ARCH_CAPABILITIES MSR. These bits can be used to enumerate vulnerability and mitigation capability:h]hNewer processors and microcode update on existing affected processors added new bits to IA32_ARCH_CAPABILITIES MSR. These bits can be used to enumerate vulnerability and mitigation capability:}(hj~hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhK2hjmhhubh bullet_list)}(hhh](h list_item)}(h?Bit 27 - RFDS_NO - When set, processor is not affected by RFDS.h]h)}(hjh]h?Bit 27 - RFDS_NO - When set, processor is not affected by RFDS.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhK6hjubah}(h]h ]h"]h$]h&]uh1jhjhhhhhNubj)}(hBit 28 - RFDS_CLEAR - When set, processor is affected by RFDS, and has the microcode that clears the affected buffers on VERW execution. h]h)}(hBit 28 - RFDS_CLEAR - When set, processor is affected by RFDS, and has the microcode that clears the affected buffers on VERW execution.h]hBit 28 - RFDS_CLEAR - When set, processor is affected by RFDS, and has the microcode that clears the affected buffers on VERW execution.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhK7hjubah}(h]h ]h"]h$]h&]uh1jhjhhhhhNubeh}(h]h ]h"]h$]h&]bullet-uh1jhhhK6hjmhhubeh}(h]"new-bits-in-ia32-arch-capabilitiesah ]h"]"new bits in ia32_arch_capabilitiesah$]h&]uh1hhj'hhhhhK1ubh)}(hhh](h)}(h-Mitigation control on the kernel command lineh]h-Mitigation control on the kernel command line}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjhhhhhK;ubh)}(hThe kernel command line allows to control RFDS mitigation at boot time with the parameter "reg_file_data_sampling=". The valid arguments are:h]hThe kernel command line allows to control RFDS mitigation at boot time with the parameter “reg_file_data_sampling=”. The valid arguments are:}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhK/sys/devices/system/cpu/vulnerabilities/reg_file_data_samplingh]h>/sys/devices/system/cpu/vulnerabilities/reg_file_data_sampling}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKMhjubah}(h]h ]h"]h$]h&]uh1jhhhKMhjhhubh)}(h%The possible values in this file are:h]h%The possible values in this file are:}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKOhjhhubj)}(hX.. list-table:: * - 'Not affected' - The processor is not vulnerable * - 'Vulnerable' - The processor is vulnerable, but no mitigation enabled * - 'Vulnerable: No microcode' - The processor is vulnerable but microcode is not updated. * - 'Mitigation: Clear Register File' - The processor is vulnerable and the CPU buffer clearing mitigation is enabled. h]j)}(hhh]j )}(hhh](j)}(hhh]h}(h]h ]h"]h$]h&]colwidthK2uh1jhjubj)}(hhh]h}(h]h ]h"]h$]h&]jK2uh1jhjubjn)}(hhh](j-)}(hhh](j2)}(hhh]h)}(h'Not affected'h]h‘Not affected’}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKShjubah}(h]h ]h"]h$]h&]uh1j1hjubj2)}(hhh]h)}(hThe processor is not vulnerableh]hThe processor is not vulnerable}(hj1hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKThj.ubah}(h]h ]h"]h$]h&]uh1j1hjubeh}(h]h ]h"]h$]h&]uh1j,hjubj-)}(hhh](j2)}(hhh]h)}(h 'Vulnerable'h]h‘Vulnerable’}(hjQhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKUhjNubah}(h]h ]h"]h$]h&]uh1j1hjKubj2)}(hhh]h)}(h6The processor is vulnerable, but no mitigation enabledh]h6The processor is vulnerable, but no mitigation enabled}(hjhhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKVhjeubah}(h]h ]h"]h$]h&]uh1j1hjKubeh}(h]h ]h"]h$]h&]uh1j,hjubj-)}(hhh](j2)}(hhh]h)}(h'Vulnerable: No microcode'h]h‘Vulnerable: No microcode’}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKWhjubah}(h]h ]h"]h$]h&]uh1j1hjubj2)}(hhh]h)}(h9The processor is vulnerable but microcode is not updated.h]h9The processor is vulnerable but microcode is not updated.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKXhjubah}(h]h ]h"]h$]h&]uh1j1hjubeh}(h]h ]h"]h$]h&]uh1j,hjubj-)}(hhh](j2)}(hhh]h)}(h!'Mitigation: Clear Register File'h]h%‘Mitigation: Clear Register File’}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKYhjubah}(h]h ]h"]h$]h&]uh1j1hjubj2)}(hhh]h)}(hNThe processor is vulnerable and the CPU buffer clearing mitigation is enabled.h]hNThe processor is vulnerable and the CPU buffer clearing mitigation is enabled.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKZhjubah}(h]h ]h"]h$]h&]uh1j1hjubeh}(h]h ]h"]h$]h&]uh1j,hjubeh}(h]h ]h"]h$]h&]uh1jmhjubeh}(h]h ]h"]h$]h&]colsKuh1j hjubah}(h]h ]h"]h$]h&]uh1jhjubah}(h]h ]h"]h$]h&]uh1jhhhKQhjhhubeh}(h]mitigation-status-informationah ]h"]mitigation status informationah$]h&]uh1hhj'hhhhhKHubh)}(hhh](h)}(h Referencesh]h References}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjhhhhhK^ubhfootnote)}(hAffected Processors https://www.intel.com/content/www/us/en/developer/topic-technology/software-security-guidance/processors-affected-consolidated-product-cpu-model.htmlh](hlabel)}(hhh]h1}(hj*hhhNhNubah}(h]h ]h"]h$]h&]uh1j(hj$hhhNhNubh)}(hAffected Processors https://www.intel.com/content/www/us/en/developer/topic-technology/software-security-guidance/processors-affected-consolidated-product-cpu-model.htmlh](hAffected Processors }(hj7hhhNhNubh reference)}(hhttps://www.intel.com/content/www/us/en/developer/topic-technology/software-security-guidance/processors-affected-consolidated-product-cpu-model.htmlh]hhttps://www.intel.com/content/www/us/en/developer/topic-technology/software-security-guidance/processors-affected-consolidated-product-cpu-model.html}(hjAhhhNhNubah}(h]h ]h"]h$]h&]refurijCuh1j?hj7ubeh}(h]h ]h"]h$]h&]uh1hhhhK_hj$ubeh}(h]hah ]h"]f1ah$]h&]hahKhhuh1j"hhhK_hjhhubeh}(h] referencesah ]h"] referencesah$]h&]uh1hhj'hhhhhK^ubeh}(h] mitigationah ]h"] mitigationah$]h&]uh1hhhhhhhhK!ubeh}(h] register-file-data-sampling-rfdsah ]h"]"register file data sampling (rfds)ah$]h&]uh1hhhhhhhhKubeh}(h]h ]h"]h$]h&]sourcehuh1hcurrent_sourceN current_lineNsettingsdocutils.frontendValues)}(hN generatorN datestampN source_linkN source_urlN toc_backlinksj1footnote_backlinksK sectnum_xformKstrip_commentsNstrip_elements_with_classesN strip_classesN report_levelK halt_levelKexit_status_levelKdebugNwarning_streamN tracebackinput_encoding utf-8-siginput_encoding_error_handlerstrictoutput_encodingutf-8output_encoding_error_handlerjerror_encodingutf-8error_encoding_error_handlerbackslashreplace language_codeenrecord_dependenciesNconfigN id_prefixhauto_id_prefixid dump_settingsNdump_internalsNdump_transformsNdump_pseudo_xmlNexpose_internalsNstrict_visitorN_disable_configN_sourceh _destinationN _config_files]7/var/lib/git/docbuild/linux/Documentation/docutils.confafile_insertion_enabled raw_enabledKline_length_limitM'pep_referencesN pep_base_urlhttps://peps.python.org/pep_file_url_templatepep-%04drfc_referencesN rfc_base_url&https://datatracker.ietf.org/doc/html/ tab_widthKtrim_footnote_reference_spacesyntax_highlightlong smart_quotessmartquotes_locales]character_level_inline_markupdoctitle_xform docinfo_xformKsectsubtitle_xform image_loadinglinkembed_stylesheetcloak_email_addressessection_self_linkenvNubreporterNindirect_targets]substitution_defs}substitution_names}refnames}f1]hasrefids}h]hasnameids}(jrjoj$j!jjjgjjjgjjjjjj jbj_jZhu nametypes}(jrj$jjjjjjjjbjZuh}(johj!hhhjgj'jgjFjjmjjj jj_jhj$u footnote_refs}j]has citation_refs} autofootnotes]j$aautofootnote_refs]hasymbol_footnotes]symbol_footnote_refs] footnotes] citations]autofootnote_startKsymbol_footnote_startK id_counter collectionsCounter}jKsRparse_messages]transform_messages] transformerN include_log] decorationNhhub.