sphinx.addnodesdocument)}( rawsourcechildren]( translations LanguagesNode)}(hhh](h pending_xref)}(hhh]docutils.nodesTextChinese (Simplified)}parenthsba attributes}(ids]classes]names]dupnames]backrefs] refdomainstdreftypedoc reftarget,/translations/zh_CN/arch/x86/tsx_async_abortmodnameN classnameN refexplicitutagnamehhh ubh)}(hhh]hChinese (Traditional)}hh2sbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget,/translations/zh_TW/arch/x86/tsx_async_abortmodnameN classnameN refexplicituh1hhh ubh)}(hhh]hItalian}hhFsbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget,/translations/it_IT/arch/x86/tsx_async_abortmodnameN classnameN refexplicituh1hhh ubh)}(hhh]hJapanese}hhZsbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget,/translations/ja_JP/arch/x86/tsx_async_abortmodnameN classnameN refexplicituh1hhh ubh)}(hhh]hKorean}hhnsbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget,/translations/ko_KR/arch/x86/tsx_async_abortmodnameN classnameN refexplicituh1hhh ubh)}(hhh]hSpanish}hhsbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget,/translations/sp_SP/arch/x86/tsx_async_abortmodnameN classnameN refexplicituh1hhh ubeh}(h]h ]h"]h$]h&]current_languageEnglishuh1h hh _documenthsourceNlineNubhcomment)}(h SPDX-License-Identifier: GPL-2.0h]h SPDX-License-Identifier: GPL-2.0}hhsbah}(h]h ]h"]h$]h&] xml:spacepreserveuh1hhhhhhF/var/lib/git/docbuild/linux/Documentation/arch/x86/tsx_async_abort.rsthKubhsection)}(hhh](htitle)}(h TSX Async Abort (TAA) mitigationh]h TSX Async Abort (TAA) mitigation}(hhhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhhhhhKubhtarget)}(h.. _tsx_async_abort:h]h}(h]h ]h"]h$]h&]refidtsx-async-abortuh1hhKhhhhhhubh)}(hhh](h)}(hOverviewh]hOverview}(hhhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhhhhhK ubh paragraph)}(hXgTSX Async Abort (TAA) is a side channel attack on internal buffers in some Intel processors similar to Microachitectural Data Sampling (MDS). In this case certain loads may speculatively pass invalid data to dependent operations when an asynchronous abort condition is pending in a Transactional Synchronization Extensions (TSX) transaction. This includes loads with no fault or assist condition. Such loads may speculatively expose stale data from the same uarch data structures as in MDS, with same scope of exposure i.e. same-thread and cross-thread. This issue affects all current processors that support TSX.h]hXgTSX Async Abort (TAA) is a side channel attack on internal buffers in some Intel processors similar to Microachitectural Data Sampling (MDS). In this case certain loads may speculatively pass invalid data to dependent operations when an asynchronous abort condition is pending in a Transactional Synchronization Extensions (TSX) transaction. This includes loads with no fault or assist condition. Such loads may speculatively expose stale data from the same uarch data structures as in MDS, with same scope of exposure i.e. same-thread and cross-thread. This issue affects all current processors that support TSX.}(hhhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhK hhhhubeh}(h](overviewheh ]h"](overviewtsx_async_aborteh$]h&]uh1hhhhhhhhK expect_referenced_by_name}hhsexpect_referenced_by_id}hhsubh)}(hhh](h)}(hMitigation strategyh]hMitigation strategy}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjhhhhhKubh)}(hXa) TSX disable - one of the mitigations is to disable TSX. A new MSR IA32_TSX_CTRL will be available in future and current processors after microcode update which can be used to disable TSX. In addition, it controls the enumeration of the TSX feature bits (RTM and HLE) in CPUID.h]hXa) TSX disable - one of the mitigations is to disable TSX. A new MSR IA32_TSX_CTRL will be available in future and current processors after microcode update which can be used to disable TSX. In addition, it controls the enumeration of the TSX feature bits (RTM and HLE) in CPUID.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhjhhubh)}(hb) Clear CPU buffers - similar to MDS, clearing the CPU buffers mitigates this vulnerability. More details on this approach can be found in :ref:`Documentation/admin-guide/hw-vuln/mds.rst `.h](hb) Clear CPU buffers - similar to MDS, clearing the CPU buffers mitigates this vulnerability. More details on this approach can be found in }(hj$hhhNhNubh)}(h6:ref:`Documentation/admin-guide/hw-vuln/mds.rst `h]hinline)}(hj.h]h)Documentation/admin-guide/hw-vuln/mds.rst}(hj2hhhNhNubah}(h]h ](xrefstdstd-refeh"]h$]h&]uh1j0hj,ubah}(h]h ]h"]h$]h&]refdocarch/x86/tsx_async_abort refdomainj=reftyperef refexplicitrefwarn reftargetmdsuh1hhhhKhj$ubh.}(hj$hhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhKhjhhubeh}(h]mitigation-strategyah ]h"]mitigation strategyah$]h&]uh1hhhhhhhhKubh)}(hhh](h)}(h Kernel internal mitigation modesh]h Kernel internal mitigation modes}(hjfhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjchhhhhK"ubh block_quote)}(hX============= ============================================================ off Mitigation is disabled. Either the CPU is not affected or tsx_async_abort=off is supplied on the kernel command line. tsx disabled Mitigation is enabled. TSX feature is disabled by default at bootup on processors that support TSX control. verw Mitigation is enabled. CPU is affected and MD_CLEAR is advertised in CPUID. ucode needed Mitigation is enabled. CPU is affected and MD_CLEAR is not advertised in CPUID. That is mainly for virtualization scenarios where the host has the updated microcode but the hypervisor does not expose MD_CLEAR in CPUID. It's a best effort approach without guarantee. ============= ============================================================ h]htable)}(hhh]htgroup)}(hhh](hcolspec)}(hhh]h}(h]h ]h"]h$]h&]colwidthK uh1jhjubj)}(hhh]h}(h]h ]h"]h$]h&]colwidthKEnumerated list start value not ordinal-1: “2” (ordinal 2)}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjubah}(h]h ]h"]h$]h&]levelKtypeINFOsourcehlineKuh1jhjchhhhhKLubj)}(hhh]h)}(h:Enumerated list start value not ordinal-1: "3" (ordinal 3)h]h>Enumerated list start value not ordinal-1: “3” (ordinal 3)}(hj!hhhNhNubah}(h]h ]h"]h$]h&]uh1hhjubah}(h]h ]h"]h$]h&]levelKtypejsourcehlineKuh1jhjchhhhhK[ubetransform_messages]j)}(hhh]h)}(hhh]h5Hyperlink target "tsx-async-abort" is not referenced.}hj>sbah}(h]h ]h"]h$]h&]uh1hhj;ubah}(h]h ]h"]h$]h&]levelKtypejsourcehlineKuh1juba transformerN include_log] decorationNhhub.