mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
synced 2025-12-27 10:01:39 -05:00
7baadd463e
Linear Address Space Separation (LASS) is a security feature that mitigates a class of side-channel attacks relying on speculative access across the user/kernel boundary. Privilege mode based access protection already exists today with paging and features such as SMEP and SMAP. However, to enforce these protections, the processor must traverse the paging structures in memory. An attacker can use timing information resulting from this traversal to determine details about the paging structures, and to determine the layout of the kernel memory. LASS provides the same mode-based protections as paging but without traversing the paging structures. Because the protections are enforced prior to page-walks, an attacker will not be able to derive paging-based timing information from the various caching structures such as the TLBs, mid-level caches, page walker, data caches, etc. LASS enforcement relies on the kernel implementation to divide the 64-bit virtual address space into two halves: Addr[63]=0 -> User address space Addr[63]=1 -> Kernel address space Any data access or code execution across address spaces typically results in a #GP fault, with an #SS generated in some rare cases. The LASS enforcement for kernel data accesses is dependent on CR4.SMAP being set. The enforcement can be disabled by toggling the RFLAGS.AC bit similar to SMAP. Define the CPU feature bits to enumerate LASS. Also, disable the feature at compile time on 32-bit kernels. Use a direct dependency on X86_32 (instead of !X86_64) to make it easier to combine with similar 32-bit specific dependencies in the future. LASS mitigates a class of side-channel speculative attacks, such as Spectre LAM, described in the paper, "Leaky Address Masking: Exploiting Unmasked Spectre Gadgets with Noncanonical Address Translation". Add the "lass" flag to /proc/cpuinfo to indicate that the feature is supported by hardware and enabled by the kernel. This allows userspace to determine if the system is secure against such attacks. Signed-off-by: Sohil Mehta <sohil.mehta@intel.com> Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com> Reviewed-by: Borislav Petkov (AMD) <bp@alien8.de> Reviewed-by: Xin Li (Intel) <xin@zytor.com> Reviewed-by: Dave Hansen <dave.hansen@linux.intel.com> Link: https://patch.msgid.link/20251118182911.2983253-2-sohil.mehta%40intel.com
202 lines
4.8 KiB
Plaintext
202 lines
4.8 KiB
Plaintext
# SPDX-License-Identifier: GPL-2.0
|
|
#
|
|
# x86 feature bits (see arch/x86/include/asm/cpufeatures.h) that are
|
|
# either REQUIRED to be enabled, or DISABLED (always ignored) for this
|
|
# particular compile-time configuration. The tests for these features
|
|
# are turned into compile-time constants via the generated
|
|
# <asm/cpufeaturemasks.h>.
|
|
#
|
|
# The naming of these variables *must* match asm/cpufeatures.h, e.g.,
|
|
# X86_FEATURE_ALWAYS <==> X86_REQUIRED_FEATURE_ALWAYS
|
|
# X86_FEATURE_FRED <==> X86_DISABLED_FEATURE_FRED
|
|
#
|
|
# And these REQUIRED and DISABLED config options are manipulated in an
|
|
# AWK script as the following example:
|
|
#
|
|
# +----------------------+
|
|
# | X86_FRED = y ? |
|
|
# +----------------------+
|
|
# / \
|
|
# Y / \ N
|
|
# +-------------------------------------+ +-------------------------------+
|
|
# | X86_DISABLED_FEATURE_FRED undefined | | X86_DISABLED_FEATURE_FRED = y |
|
|
# +-------------------------------------+ +-------------------------------+
|
|
# |
|
|
# |
|
|
# +-------------------------------------------+ |
|
|
# | X86_FEATURE_FRED: feature word 12, bit 17 | ---->|
|
|
# +-------------------------------------------+ |
|
|
# |
|
|
# |
|
|
# +-------------------------------+
|
|
# | set bit 17 of DISABLED_MASK12 |
|
|
# +-------------------------------+
|
|
#
|
|
|
|
config X86_REQUIRED_FEATURE_ALWAYS
|
|
def_bool y
|
|
|
|
config X86_REQUIRED_FEATURE_NOPL
|
|
def_bool y
|
|
depends on X86_64 || X86_P6_NOP
|
|
|
|
config X86_REQUIRED_FEATURE_CX8
|
|
def_bool y
|
|
depends on X86_CX8
|
|
|
|
# this should be set for all -march=.. options where the compiler
|
|
# generates cmov.
|
|
config X86_REQUIRED_FEATURE_CMOV
|
|
def_bool y
|
|
depends on X86_CMOV
|
|
|
|
# this should be set for all -march= options where the compiler
|
|
# generates movbe.
|
|
config X86_REQUIRED_FEATURE_MOVBE
|
|
def_bool y
|
|
depends on MATOM
|
|
|
|
config X86_REQUIRED_FEATURE_CPUID
|
|
def_bool y
|
|
depends on X86_64
|
|
|
|
config X86_REQUIRED_FEATURE_UP
|
|
def_bool y
|
|
depends on !SMP
|
|
|
|
config X86_REQUIRED_FEATURE_FPU
|
|
def_bool y
|
|
depends on !MATH_EMULATION
|
|
|
|
config X86_REQUIRED_FEATURE_PAE
|
|
def_bool y
|
|
depends on X86_64 || X86_PAE
|
|
|
|
config X86_REQUIRED_FEATURE_PSE
|
|
def_bool y
|
|
depends on X86_64 && !PARAVIRT_XXL
|
|
|
|
config X86_REQUIRED_FEATURE_PGE
|
|
def_bool y
|
|
depends on X86_64 && !PARAVIRT_XXL
|
|
|
|
config X86_REQUIRED_FEATURE_MSR
|
|
def_bool y
|
|
depends on X86_64
|
|
|
|
config X86_REQUIRED_FEATURE_FXSR
|
|
def_bool y
|
|
depends on X86_64
|
|
|
|
config X86_REQUIRED_FEATURE_XMM
|
|
def_bool y
|
|
depends on X86_64
|
|
|
|
config X86_REQUIRED_FEATURE_XMM2
|
|
def_bool y
|
|
depends on X86_64
|
|
|
|
config X86_REQUIRED_FEATURE_LM
|
|
def_bool y
|
|
depends on X86_64
|
|
|
|
config X86_DISABLED_FEATURE_UMIP
|
|
def_bool y
|
|
depends on !X86_UMIP
|
|
|
|
config X86_DISABLED_FEATURE_VME
|
|
def_bool y
|
|
depends on X86_64
|
|
|
|
config X86_DISABLED_FEATURE_K6_MTRR
|
|
def_bool y
|
|
depends on X86_64
|
|
|
|
config X86_DISABLED_FEATURE_CYRIX_ARR
|
|
def_bool y
|
|
depends on X86_64
|
|
|
|
config X86_DISABLED_FEATURE_CENTAUR_MCR
|
|
def_bool y
|
|
depends on X86_64
|
|
|
|
config X86_DISABLED_FEATURE_PCID
|
|
def_bool y
|
|
depends on !X86_64
|
|
|
|
config X86_DISABLED_FEATURE_LASS
|
|
def_bool y
|
|
depends on X86_32
|
|
|
|
config X86_DISABLED_FEATURE_PKU
|
|
def_bool y
|
|
depends on !X86_INTEL_MEMORY_PROTECTION_KEYS
|
|
|
|
config X86_DISABLED_FEATURE_OSPKE
|
|
def_bool y
|
|
depends on !X86_INTEL_MEMORY_PROTECTION_KEYS
|
|
|
|
config X86_DISABLED_FEATURE_PTI
|
|
def_bool y
|
|
depends on !MITIGATION_PAGE_TABLE_ISOLATION
|
|
|
|
config X86_DISABLED_FEATURE_RETPOLINE
|
|
def_bool y
|
|
depends on !MITIGATION_RETPOLINE
|
|
|
|
config X86_DISABLED_FEATURE_RETPOLINE_LFENCE
|
|
def_bool y
|
|
depends on !MITIGATION_RETPOLINE
|
|
|
|
config X86_DISABLED_FEATURE_RETHUNK
|
|
def_bool y
|
|
depends on !MITIGATION_RETHUNK
|
|
|
|
config X86_DISABLED_FEATURE_UNRET
|
|
def_bool y
|
|
depends on !MITIGATION_UNRET_ENTRY
|
|
|
|
config X86_DISABLED_FEATURE_CALL_DEPTH
|
|
def_bool y
|
|
depends on !MITIGATION_CALL_DEPTH_TRACKING
|
|
|
|
config X86_DISABLED_FEATURE_LAM
|
|
def_bool y
|
|
depends on !ADDRESS_MASKING
|
|
|
|
config X86_DISABLED_FEATURE_ENQCMD
|
|
def_bool y
|
|
depends on !INTEL_IOMMU_SVM
|
|
|
|
config X86_DISABLED_FEATURE_SGX
|
|
def_bool y
|
|
depends on !X86_SGX
|
|
|
|
config X86_DISABLED_FEATURE_XENPV
|
|
def_bool y
|
|
depends on !XEN_PV
|
|
|
|
config X86_DISABLED_FEATURE_TDX_GUEST
|
|
def_bool y
|
|
depends on !INTEL_TDX_GUEST
|
|
|
|
config X86_DISABLED_FEATURE_USER_SHSTK
|
|
def_bool y
|
|
depends on !X86_USER_SHADOW_STACK
|
|
|
|
config X86_DISABLED_FEATURE_IBT
|
|
def_bool y
|
|
depends on !X86_KERNEL_IBT
|
|
|
|
config X86_DISABLED_FEATURE_FRED
|
|
def_bool y
|
|
depends on !X86_FRED
|
|
|
|
config X86_DISABLED_FEATURE_SEV_SNP
|
|
def_bool y
|
|
depends on !KVM_AMD_SEV
|
|
|
|
config X86_DISABLED_FEATURE_INVLPGB
|
|
def_bool y
|
|
depends on !BROADCAST_TLB_FLUSH
|