tsx_async_abort.rst 6.8 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117
  1. .. SPDX-License-Identifier: GPL-2.0
  2. TSX Async Abort (TAA) mitigation
  3. ================================
  4. .. _tsx_async_abort:
  5. Overview
  6. --------
  7. TSX Async Abort (TAA) is a side channel attack on internal buffers in some
  8. Intel processors similar to Microachitectural Data Sampling (MDS). In this
  9. case certain loads may speculatively pass invalid data to dependent operations
  10. when an asynchronous abort condition is pending in a Transactional
  11. Synchronization Extensions (TSX) transaction. This includes loads with no
  12. fault or assist condition. Such loads may speculatively expose stale data from
  13. the same uarch data structures as in MDS, with same scope of exposure i.e.
  14. same-thread and cross-thread. This issue affects all current processors that
  15. support TSX.
  16. Mitigation strategy
  17. -------------------
  18. a) TSX disable - one of the mitigations is to disable TSX. A new MSR
  19. IA32_TSX_CTRL will be available in future and current processors after
  20. microcode update which can be used to disable TSX. In addition, it
  21. controls the enumeration of the TSX feature bits (RTM and HLE) in CPUID.
  22. b) Clear CPU buffers - similar to MDS, clearing the CPU buffers mitigates this
  23. vulnerability. More details on this approach can be found in
  24. :ref:`Documentation/admin-guide/hw-vuln/mds.rst <mds>`.
  25. Kernel internal mitigation modes
  26. --------------------------------
  27. ============= ============================================================
  28. off Mitigation is disabled. Either the CPU is not affected or
  29. tsx_async_abort=off is supplied on the kernel command line.
  30. tsx disabled Mitigation is enabled. TSX feature is disabled by default at
  31. bootup on processors that support TSX control.
  32. verw Mitigation is enabled. CPU is affected and MD_CLEAR is
  33. advertised in CPUID.
  34. ucode needed Mitigation is enabled. CPU is affected and MD_CLEAR is not
  35. advertised in CPUID. That is mainly for virtualization
  36. scenarios where the host has the updated microcode but the
  37. hypervisor does not expose MD_CLEAR in CPUID. It's a best
  38. effort approach without guarantee.
  39. ============= ============================================================
  40. If the CPU is affected and the "tsx_async_abort" kernel command line parameter is
  41. not provided then the kernel selects an appropriate mitigation depending on the
  42. status of RTM and MD_CLEAR CPUID bits.
  43. Below tables indicate the impact of tsx=on|off|auto cmdline options on state of
  44. TAA mitigation, VERW behavior and TSX feature for various combinations of
  45. MSR_IA32_ARCH_CAPABILITIES bits.
  46. 1. "tsx=off"
  47. ========= ========= ============ ============ ============== =================== ======================
  48. MSR_IA32_ARCH_CAPABILITIES bits Result with cmdline tsx=off
  49. ---------------------------------- -------------------------------------------------------------------------
  50. TAA_NO MDS_NO TSX_CTRL_MSR TSX state VERW can clear TAA mitigation TAA mitigation
  51. after bootup CPU buffers tsx_async_abort=off tsx_async_abort=full
  52. ========= ========= ============ ============ ============== =================== ======================
  53. 0 0 0 HW default Yes Same as MDS Same as MDS
  54. 0 0 1 Invalid case Invalid case Invalid case Invalid case
  55. 0 1 0 HW default No Need ucode update Need ucode update
  56. 0 1 1 Disabled Yes TSX disabled TSX disabled
  57. 1 X 1 Disabled X None needed None needed
  58. ========= ========= ============ ============ ============== =================== ======================
  59. 2. "tsx=on"
  60. ========= ========= ============ ============ ============== =================== ======================
  61. MSR_IA32_ARCH_CAPABILITIES bits Result with cmdline tsx=on
  62. ---------------------------------- -------------------------------------------------------------------------
  63. TAA_NO MDS_NO TSX_CTRL_MSR TSX state VERW can clear TAA mitigation TAA mitigation
  64. after bootup CPU buffers tsx_async_abort=off tsx_async_abort=full
  65. ========= ========= ============ ============ ============== =================== ======================
  66. 0 0 0 HW default Yes Same as MDS Same as MDS
  67. 0 0 1 Invalid case Invalid case Invalid case Invalid case
  68. 0 1 0 HW default No Need ucode update Need ucode update
  69. 0 1 1 Enabled Yes None Same as MDS
  70. 1 X 1 Enabled X None needed None needed
  71. ========= ========= ============ ============ ============== =================== ======================
  72. 3. "tsx=auto"
  73. ========= ========= ============ ============ ============== =================== ======================
  74. MSR_IA32_ARCH_CAPABILITIES bits Result with cmdline tsx=auto
  75. ---------------------------------- -------------------------------------------------------------------------
  76. TAA_NO MDS_NO TSX_CTRL_MSR TSX state VERW can clear TAA mitigation TAA mitigation
  77. after bootup CPU buffers tsx_async_abort=off tsx_async_abort=full
  78. ========= ========= ============ ============ ============== =================== ======================
  79. 0 0 0 HW default Yes Same as MDS Same as MDS
  80. 0 0 1 Invalid case Invalid case Invalid case Invalid case
  81. 0 1 0 HW default No Need ucode update Need ucode update
  82. 0 1 1 Disabled Yes TSX disabled TSX disabled
  83. 1 X 1 Enabled X None needed None needed
  84. ========= ========= ============ ============ ============== =================== ======================
  85. In the tables, TSX_CTRL_MSR is a new bit in MSR_IA32_ARCH_CAPABILITIES that
  86. indicates whether MSR_IA32_TSX_CTRL is supported.
  87. There are two control bits in IA32_TSX_CTRL MSR:
  88. Bit 0: When set it disables the Restricted Transactional Memory (RTM)
  89. sub-feature of TSX (will force all transactions to abort on the
  90. XBEGIN instruction).
  91. Bit 1: When set it disables the enumeration of the RTM and HLE feature
  92. (i.e. it will make CPUID(EAX=7).EBX{bit4} and
  93. CPUID(EAX=7).EBX{bit11} read as 0).