272 lines · plain
1=========================================2Processor MMIO Stale Data Vulnerabilities3=========================================4 5Processor MMIO Stale Data Vulnerabilities are a class of memory-mapped I/O6(MMIO) vulnerabilities that can expose data. The sequences of operations for7exposing data range from simple to very complex. Because most of the8vulnerabilities require the attacker to have access to MMIO, many environments9are not affected. System environments using virtualization where MMIO access is10provided to untrusted guests may need mitigation. These vulnerabilities are11not transient execution attacks. However, these vulnerabilities may propagate12stale data into core fill buffers where the data can subsequently be inferred13by an unmitigated transient execution attack. Mitigation for these14vulnerabilities includes a combination of microcode update and software15changes, depending on the platform and usage model. Some of these mitigations16are similar to those used to mitigate Microarchitectural Data Sampling (MDS) or17those used to mitigate Special Register Buffer Data Sampling (SRBDS).18 19Data Propagators20================21Propagators are operations that result in stale data being copied or moved from22one microarchitectural buffer or register to another. Processor MMIO Stale Data23Vulnerabilities are operations that may result in stale data being directly24read into an architectural, software-visible state or sampled from a buffer or25register.26 27Fill Buffer Stale Data Propagator (FBSDP)28-----------------------------------------29Stale data may propagate from fill buffers (FB) into the non-coherent portion30of the uncore on some non-coherent writes. Fill buffer propagation by itself31does not make stale data architecturally visible. Stale data must be propagated32to a location where it is subject to reading or sampling.33 34Sideband Stale Data Propagator (SSDP)35-------------------------------------36The sideband stale data propagator (SSDP) is limited to the client (including37Intel Xeon server E3) uncore implementation. The sideband response buffer is38shared by all client cores. For non-coherent reads that go to sideband39destinations, the uncore logic returns 64 bytes of data to the core, including40both requested data and unrequested stale data, from a transaction buffer and41the sideband response buffer. As a result, stale data from the sideband42response and transaction buffers may now reside in a core fill buffer.43 44Primary Stale Data Propagator (PSDP)45------------------------------------46The primary stale data propagator (PSDP) is limited to the client (including47Intel Xeon server E3) uncore implementation. Similar to the sideband response48buffer, the primary response buffer is shared by all client cores. For some49processors, MMIO primary reads will return 64 bytes of data to the core fill50buffer including both requested data and unrequested stale data. This is51similar to the sideband stale data propagator.52 53Vulnerabilities54===============55Device Register Partial Write (DRPW) (CVE-2022-21166)56-----------------------------------------------------57Some endpoint MMIO registers incorrectly handle writes that are smaller than58the register size. Instead of aborting the write or only copying the correct59subset of bytes (for example, 2 bytes for a 2-byte write), more bytes than60specified by the write transaction may be written to the register. On61processors affected by FBSDP, this may expose stale data from the fill buffers62of the core that created the write transaction.63 64Shared Buffers Data Sampling (SBDS) (CVE-2022-21125)65----------------------------------------------------66After propagators may have moved data around the uncore and copied stale data67into client core fill buffers, processors affected by MFBDS can leak data from68the fill buffer. It is limited to the client (including Intel Xeon server E3)69uncore implementation.70 71Shared Buffers Data Read (SBDR) (CVE-2022-21123)72------------------------------------------------73It is similar to Shared Buffer Data Sampling (SBDS) except that the data is74directly read into the architectural software-visible state. It is limited to75the client (including Intel Xeon server E3) uncore implementation.76 77Affected Processors78===================79Not all the CPUs are affected by all the variants. For instance, most80processors for the server market (excluding Intel Xeon E3 processors) are81impacted by only Device Register Partial Write (DRPW).82 83Below is the list of affected Intel processors [#f1]_:84 85 =================== ============ =========86 Common name Family_Model Steppings87 =================== ============ =========88 HASWELL_X 06_3FH 2,489 SKYLAKE_L 06_4EH 390 BROADWELL_X 06_4FH All91 SKYLAKE_X 06_55H 3,4,6,7,1192 BROADWELL_D 06_56H 3,4,593 SKYLAKE 06_5EH 394 ICELAKE_X 06_6AH 4,5,695 ICELAKE_D 06_6CH 196 ICELAKE_L 06_7EH 597 ATOM_TREMONT_D 06_86H All98 LAKEFIELD 06_8AH 199 KABYLAKE_L 06_8EH 9 to 12100 ATOM_TREMONT 06_96H 1101 ATOM_TREMONT_L 06_9CH 0102 KABYLAKE 06_9EH 9 to 13103 COMETLAKE 06_A5H 2,3,5104 COMETLAKE_L 06_A6H 0,1105 ROCKETLAKE 06_A7H 1106 =================== ============ =========107 108If a CPU is in the affected processor list, but not affected by a variant, it109is indicated by new bits in MSR IA32_ARCH_CAPABILITIES. As described in a later110section, mitigation largely remains the same for all the variants, i.e. to111clear the CPU fill buffers via VERW instruction.112 113New bits in MSRs114================115Newer processors and microcode update on existing affected processors added new116bits to IA32_ARCH_CAPABILITIES MSR. These bits can be used to enumerate117specific variants of Processor MMIO Stale Data vulnerabilities and mitigation118capability.119 120MSR IA32_ARCH_CAPABILITIES121--------------------------122Bit 13 - SBDR_SSDP_NO - When set, processor is not affected by either the123 Shared Buffers Data Read (SBDR) vulnerability or the sideband stale124 data propagator (SSDP).125Bit 14 - FBSDP_NO - When set, processor is not affected by the Fill Buffer126 Stale Data Propagator (FBSDP).127Bit 15 - PSDP_NO - When set, processor is not affected by Primary Stale Data128 Propagator (PSDP).129Bit 17 - FB_CLEAR - When set, VERW instruction will overwrite CPU fill buffer130 values as part of MD_CLEAR operations. Processors that do not131 enumerate MDS_NO (meaning they are affected by MDS) but that do132 enumerate support for both L1D_FLUSH and MD_CLEAR implicitly enumerate133 FB_CLEAR as part of their MD_CLEAR support.134Bit 18 - FB_CLEAR_CTRL - Processor supports read and write to MSR135 IA32_MCU_OPT_CTRL[FB_CLEAR_DIS]. On such processors, the FB_CLEAR_DIS136 bit can be set to cause the VERW instruction to not perform the137 FB_CLEAR action. Not all processors that support FB_CLEAR will support138 FB_CLEAR_CTRL.139 140MSR IA32_MCU_OPT_CTRL141---------------------142Bit 3 - FB_CLEAR_DIS - When set, VERW instruction does not perform the FB_CLEAR143action. This may be useful to reduce the performance impact of FB_CLEAR in144cases where system software deems it warranted (for example, when performance145is more critical, or the untrusted software has no MMIO access). Note that146FB_CLEAR_DIS has no impact on enumeration (for example, it does not change147FB_CLEAR or MD_CLEAR enumeration) and it may not be supported on all processors148that enumerate FB_CLEAR.149 150Mitigation151==========152Like MDS, all variants of Processor MMIO Stale Data vulnerabilities have the153same mitigation strategy to force the CPU to clear the affected buffers before154an attacker can extract the secrets.155 156This is achieved by using the otherwise unused and obsolete VERW instruction in157combination with a microcode update. The microcode clears the affected CPU158buffers when the VERW instruction is executed.159 160Kernel reuses the MDS function to invoke the buffer clearing:161 162 mds_clear_cpu_buffers()163 164On MDS affected CPUs, the kernel already invokes CPU buffer clear on165kernel/userspace, hypervisor/guest and C-state (idle) transitions. No166additional mitigation is needed on such CPUs.167 168For CPUs not affected by MDS or TAA, mitigation is needed only for the attacker169with MMIO capability. Therefore, VERW is not required for kernel/userspace. For170virtualization case, VERW is only needed at VMENTER for a guest with MMIO171capability.172 173Mitigation points174-----------------175Return to user space176^^^^^^^^^^^^^^^^^^^^177Same mitigation as MDS when affected by MDS/TAA, otherwise no mitigation178needed.179 180C-State transition181^^^^^^^^^^^^^^^^^^182Control register writes by CPU during C-state transition can propagate data183from fill buffer to uncore buffers. Execute VERW before C-state transition to184clear CPU fill buffers.185 186Guest entry point187^^^^^^^^^^^^^^^^^188Same mitigation as MDS when processor is also affected by MDS/TAA, otherwise189execute VERW at VMENTER only for MMIO capable guests. On CPUs not affected by190MDS/TAA, guest without MMIO access cannot extract secrets using Processor MMIO191Stale Data vulnerabilities, so there is no need to execute VERW for such guests.192 193Mitigation control on the kernel command line194---------------------------------------------195The kernel command line allows to control the Processor MMIO Stale Data196mitigations at boot time with the option "mmio_stale_data=". The valid197arguments for this option are:198 199 ========== =================================================================200 full If the CPU is vulnerable, enable mitigation; CPU buffer clearing201 on exit to userspace and when entering a VM. Idle transitions are202 protected as well. It does not automatically disable SMT.203 full,nosmt Same as full, with SMT disabled on vulnerable CPUs. This is the204 complete mitigation.205 off Disables mitigation completely.206 ========== =================================================================207 208If the CPU is affected and mmio_stale_data=off is not supplied on the kernel209command line, then the kernel selects the appropriate mitigation.210 211Mitigation status information212-----------------------------213The Linux kernel provides a sysfs interface to enumerate the current214vulnerability status of the system: whether the system is vulnerable, and215which mitigations are active. The relevant sysfs file is:216 217 /sys/devices/system/cpu/vulnerabilities/mmio_stale_data218 219The possible values in this file are:220 221 .. list-table::222 223 * - 'Not affected'224 - The processor is not vulnerable225 * - 'Vulnerable'226 - The processor is vulnerable, but no mitigation enabled227 * - 'Vulnerable: Clear CPU buffers attempted, no microcode'228 - The processor is vulnerable but microcode is not updated. The229 mitigation is enabled on a best effort basis.230 231 If the processor is vulnerable but the availability of the microcode232 based mitigation mechanism is not advertised via CPUID, the kernel233 selects a best effort mitigation mode. This mode invokes the mitigation234 instructions without a guarantee that they clear the CPU buffers.235 236 This is done to address virtualization scenarios where the host has the237 microcode update applied, but the hypervisor is not yet updated to238 expose the CPUID to the guest. If the host has updated microcode the239 protection takes effect; otherwise a few CPU cycles are wasted240 pointlessly.241 * - 'Mitigation: Clear CPU buffers'242 - The processor is vulnerable and the CPU buffer clearing mitigation is243 enabled.244 * - 'Unknown: No mitigations'245 - The processor vulnerability status is unknown because it is246 out of Servicing period. Mitigation is not attempted.247 248Definitions:249------------250 251Servicing period: The process of providing functional and security updates to252Intel processors or platforms, utilizing the Intel Platform Update (IPU)253process or other similar mechanisms.254 255End of Servicing Updates (ESU): ESU is the date at which Intel will no256longer provide Servicing, such as through IPU or other similar update257processes. ESU dates will typically be aligned to end of quarter.258 259If the processor is vulnerable then the following information is appended to260the above information:261 262 ======================== ===========================================263 'SMT vulnerable' SMT is enabled264 'SMT disabled' SMT is disabled265 'SMT Host state unknown' Kernel runs in a VM, Host SMT state unknown266 ======================== ===========================================267 268References269----------270.. [#f1] Affected Processors271 https://www.intel.com/content/www/us/en/developer/topic-technology/software-security-guidance/processors-affected-consolidated-product-cpu-model.html272