d/freebsd-nq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
fe6277692f
freebsd-nq/sys/amd64
History
Scott Long e372160177 TSX Asynchronous Abort mitigation for Intel CVE-2019-11135. 
This CVE has already been announced in FreeBSD SA-19:26.mcu.

Mitigation for TAA involves either turning off TSX or turning on the
VERW mitigation used for MDS. Some CPUs will also be self-mitigating
for TAA and require no software workaround.

Control knobs are:
machdep.mitigations.taa.enable:
        0 - no software mitigation is enabled
        1 - attempt to disable TSX
        2 - use the VERW mitigation
        3 - automatically select the mitigation based on processor
	    features.

machdep.mitigations.taa.state:
        inactive        - no mitigation is active/enabled
        TSX disable     - TSX is disabled in the bare metal CPU as well as
                        - any virtualized CPUs
        VERW            - VERW instruction clears CPU buffers
	not vulnerable	- The CPU has identified itself as not being
			  vulnerable

Nothing in the base FreeBSD system uses TSX.  However, the instructions
are straight-forward to add to custom applications and require no kernel
support, so the mitigation is provided for users with untrusted
applications and tenants.

Reviewed by:	emaste, imp, kib, scottph
Sponsored by:	Intel
Differential Revision:	22374
2019-11-16 00:26:42 +00:00
..
acpica Merge ACPICA 20190329. 2019-03-29 20:21:28 +00:00
amd64 TSX Asynchronous Abort mitigation for Intel CVE-2019-11135. 2019-11-16 00:26:42 +00:00
cloudabi32 Remove sv_pagesize, originally introduced with r100384. 2019-03-01 16:16:38 +00:00
cloudabi64 Remove sv_pagesize, originally introduced with r100384. 2019-03-01 16:16:38 +00:00
conf Add the pvscsi driver to the tree. 2019-11-14 23:31:20 +00:00
ia32 Don't pass error from syscallenter() to syscallret(). 2019-07-15 21:25:16 +00:00
include Workaround for Intel SKL002/SKL012S errata. 2019-11-12 18:01:33 +00:00
linux Use a sv_copyout_auxargs hook in the Linux ELF ABIs. 2019-11-15 23:01:43 +00:00
linux32 Use a sv_copyout_auxargs hook in the Linux ELF ABIs. 2019-11-15 23:01:43 +00:00
pci pci_cfgreg.c: Use io port config access for early boot time. 2019-04-09 18:07:17 +00:00
sgx (4/6) Protect page valid with the busy lock. 2019-10-15 03:45:41 +00:00
vmm amd64: move GDT into PCPU area. 2019-11-12 15:51:47 +00:00
Makefile