From patchwork Wed Jan 24 03:55:21 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Pawan Gupta X-Patchwork-Id: 191390 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a05:7300:2553:b0:103:945f:af90 with SMTP id p19csp829090dyi; Tue, 23 Jan 2024 23:31:35 -0800 (PST) X-Google-Smtp-Source: AGHT+IFAF6Ox99CLCJxXrTPROmV3mrAXndo2iutRZDlxkf9kjb+NhDAasoyw+JjHakTFkEq8DfOa X-Received: by 2002:a05:6402:d71:b0:559:9588:1bd4 with SMTP id ec49-20020a0564020d7100b0055995881bd4mr1401716edb.25.1706081495656; Tue, 23 Jan 2024 23:31:35 -0800 (PST) ARC-Seal: i=2; a=rsa-sha256; t=1706081495; cv=pass; d=google.com; s=arc-20160816; b=ix6yE1bTdbT8lvjZ2p74r6mYnCb01o9sJOCTAcvqZWbzS6Bed1OtCKtUCh+VAriwdM ey4OFoHv8+Ch8x64QKSC6gG1CClrcthaIM43W9fNRE+ocwJxz5p1RXOhkd4HGLLQD7q4 lOpKmxSTO1pNVLMDFuuK3ciD2+TKsgAZ7MIYTqCM/DHNHYSzdFAm8zvjqJaASADFHqBl Sijko99+VyC30oJhHZPkuSLSubeIm+sBUII0jtrFX2Y3208RmZQA2Khm+c70Njy8XUm6 vjI33YHokwD4YdPQwg96KMBUWTKqDDWeU+JPtAmxkzKETCOBny455ROI1z9NG/9Qd61+ hsBw== ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=content-disposition:mime-version:list-unsubscribe:list-subscribe :list-id:precedence:message-id:subject:cc:to:from:date :dkim-signature; bh=kwdS4lpFv/5Lgu2/B6bLSJPpZpoN6bLDJZAXIYP7uuA=; fh=SJ+xCroZJxxjm7bbzWUu2KiKHoNlLGN+BwrfazK6mJU=; b=oT2dWmdXwRskE7YpvMqq0JvymkMmNH1DfxMBPmRPoIEYu9gcBM5yw3kTYQXL7EbML/ glOXLeEIzXkr9S+u5i/qgQp1hiQ6qOf0nNe8yfHYdk7cqo/2MYTc9NOQeAwjcjXff3ko SXGdrCSFjgUJcKelvWFw6Pi2JYfuniX4AWWcFne1i4xhUvC5lhwsb0Sbx92p4SbY8xUL iIZiJBsnMwrdfBVGvoGC4QoB/qr4LU51QiVT13qKwh/5hwQNAxPomeCKXSqJMz/q7tjn c1g2XLxGy7/lVOlTcyGyeNFhPUno3lx4vLHV7wLyJJ5c3C1fk3QcBIw4eX/sMmp20nZA KEHQ== ARC-Authentication-Results: i=2; mx.google.com; dkim=pass header.i=@intel.com header.s=Intel header.b=Rgznz5BT; arc=pass (i=1 dkim=pass dkdomain=intel.com dmarc=pass fromdomain=linux.intel.com); spf=pass (google.com: domain of linux-kernel+bounces-36412-ouuuleilei=gmail.com@vger.kernel.org designates 2604:1380:4601:e00::3 as permitted sender) smtp.mailfrom="linux-kernel+bounces-36412-ouuuleilei=gmail.com@vger.kernel.org"; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=intel.com Received: from am.mirrors.kernel.org (am.mirrors.kernel.org. [2604:1380:4601:e00::3]) by mx.google.com with ESMTPS id c2-20020a056402100200b005597b26db6dsi9215980edu.516.2024.01.23.23.31.35 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 23 Jan 2024 23:31:35 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel+bounces-36412-ouuuleilei=gmail.com@vger.kernel.org designates 2604:1380:4601:e00::3 as permitted sender) client-ip=2604:1380:4601:e00::3; Authentication-Results: mx.google.com; dkim=pass header.i=@intel.com header.s=Intel header.b=Rgznz5BT; arc=pass (i=1 dkim=pass dkdomain=intel.com dmarc=pass fromdomain=linux.intel.com); spf=pass (google.com: domain of linux-kernel+bounces-36412-ouuuleilei=gmail.com@vger.kernel.org designates 2604:1380:4601:e00::3 as permitted sender) smtp.mailfrom="linux-kernel+bounces-36412-ouuuleilei=gmail.com@vger.kernel.org"; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=intel.com Received: from smtp.subspace.kernel.org (wormhole.subspace.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by am.mirrors.kernel.org (Postfix) with ESMTPS id CDF2C1F2A3CE for ; Wed, 24 Jan 2024 03:55:42 +0000 (UTC) Received: from localhost.localdomain (localhost.localdomain [127.0.0.1]) by smtp.subspace.kernel.org (Postfix) with ESMTP id 380A7BE79; Wed, 24 Jan 2024 03:55:28 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b="Rgznz5BT" Received: from mgamail.intel.com (mgamail.intel.com [192.198.163.11]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B7DAA6105 for ; Wed, 24 Jan 2024 03:55:23 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=192.198.163.11 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1706068525; cv=none; b=k02atuGPo8H17mSJfL3VJQKz7mkKAMHE2ZOzo2tHSg0ZT3qDbRNj6goGTauNEmgS85skpErzqnTt9puc1g7BlCCfGxcpQPdi7xKxWT0wV/IWWt93G5YbrN4QkTIgEfgzvKW+4K5OvWSMwBV0JfhMkyqjH6Q/yhNy7mpWLztWIpE= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1706068525; c=relaxed/simple; bh=nHrFvNM3bh3lbKS38lsuzZRKTu1bEfaTjCo0hUglgFA=; h=Date:From:To:Cc:Subject:Message-ID:MIME-Version:Content-Type: Content-Disposition; b=EAZ/jLHWLJ9ucw1qZuQK+8i9+3v51reJYw935Bn94HgzFO8K3l7QXDAJeEHWdwXTXaF5bkghKqQmlqGTP5EKYg67wYWcwCC0uqV35NUrRp+KeADErFrI0uEShs/fP8rZnwyq0v4JfGgpiaEDlDRiw+0I3WClCwHbwRdXRFJTJHk= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.intel.com; spf=none smtp.mailfrom=linux.intel.com; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b=Rgznz5BT; arc=none smtp.client-ip=192.198.163.11 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.intel.com Authentication-Results: smtp.subspace.kernel.org; spf=none smtp.mailfrom=linux.intel.com DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1706068524; x=1737604524; h=date:from:to:cc:subject:message-id:mime-version; bh=nHrFvNM3bh3lbKS38lsuzZRKTu1bEfaTjCo0hUglgFA=; b=Rgznz5BT4RHuh9m7TiqrYDxfj1C3ii3R8uVe+xaTHfnBY8yUaBnFB4YR ADvjBFRpJsJGhnzAJLTL/LAPOpBGNkaINGPhzhcY7K3k6AGR6gRNPPFb1 VTMV4u9a7tfw6CHEhUTckZExyVxC0gGdlf6thQ7qn74MKZ//Ki2YoF6EX 00fsTNbxkbaD1At94M7ahzgzETJlnrjZi9IOmZvQXveKeP7DaJSU4+KC+ DAoRg4hkenOzZASmo6cxH5f6cDtjIGHJ1e/Yl2k1Jff6pyCl63+ZgSJVa nySIbzAb1yEJNRQTx4LtP+MNmhxX7AfNiUqbULjimxHNE/y0GRto2dZjC g==; X-IronPort-AV: E=McAfee;i="6600,9927,10962"; a="8407804" X-IronPort-AV: E=Sophos;i="6.05,215,1701158400"; d="scan'208";a="8407804" Received: from fmviesa001.fm.intel.com ([10.60.135.141]) by fmvoesa105.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 23 Jan 2024 19:55:23 -0800 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="6.05,215,1701158400"; d="scan'208";a="28255527" Received: from lmichele-mobl.amr.corp.intel.com (HELO desk) ([10.209.71.221]) by smtpauth.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 23 Jan 2024 19:55:23 -0800 Date: Tue, 23 Jan 2024 19:55:21 -0800 From: Pawan Gupta To: Thomas Gleixner , Ingo Molnar , Borislav Petkov , Dave Hansen , x86@kernel.org Cc: "H. Peter Anvin" , linux-kernel@vger.kernel.org, kirill.shutemov@linux.intel.com, daniel.sneddon@linux.intel.com, antonio.gomez.iglesias@linux.intel.com, rick.p.edgecombe@intel.com, sohil.mehta@intel.com, alexander.shishkin@intel.com Subject: [PATCH v2] x86/lam: Disable ADDRESS_MASKING in most cases Message-ID: <5373262886f2783f054256babdf5a98545dc986b.1706068222.git.pawan.kumar.gupta@linux.intel.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Disposition: inline X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-THRID: 1788956110337597472 X-GMAIL-MSGID: 1788956110337597472 Intel feature Linear Address Masking (LAM) has a weakness related to transient execution as described in the SLAM paper[1]. Unless Linear Address Space Separation (LASS) is enabled this weakness may be exploitable. Until kernel adds support for LASS[2], only allow LAM for COMPILE_TEST, or when speculation mitigations have been disabled at compile time, otherwise keep LAM disabled. There are no processors in market that support LAM yet, so currently nobody is affected by this issue. [1] SLAM: https://download.vusec.net/papers/slam_sp24.pdf [2] LASS: https://lore.kernel.org/lkml/20230609183632.48706-1-alexander.shishkin@linux.intel.com/ Cc: stable@vger.kernel.org # v6.4+ Acked-by: Kirill A. Shutemov Reviewed-by: Sohil Mehta Signed-off-by: Pawan Gupta --- v2: - Updated commit message to reflect that currently there is no exposure of this issue. - Added review tags. arch/x86/Kconfig | 1 + 1 file changed, 1 insertion(+) base-commit: 0dd3ee31125508cd67f7e7172247f05b7fd1753a diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig index 1566748f16c4..794517df8068 100644 --- a/arch/x86/Kconfig +++ b/arch/x86/Kconfig @@ -2270,6 +2270,7 @@ config RANDOMIZE_MEMORY_PHYSICAL_PADDING config ADDRESS_MASKING bool "Linear Address Masking support" depends on X86_64 + depends on COMPILE_TEST || !SPECULATION_MITIGATIONS # wait for LASS help Linear Address Masking (LAM) modifies the checking that is applied to 64-bit linear addresses, allowing software to use of the