Date:   Wed, 25 Jan 2023 10:07:57 +0700
From:   Bagas Sanjaya <bagasdotme@gmail.com>
To:     Eric Biggers <ebiggers@kernel.org>,
        Thomas Gleixner <tglx@linutronix.de>,
        Ingo Molnar <mingo@redhat.com>, Borislav Petkov <bp@alien8.de>,
        Dave Hansen <dave.hansen@linux.intel.com>,
        "H . Peter Anvin" <hpa@zytor.com>, x86@kernel.org
Cc:     linux-crypto@vger.kernel.org, linux-kernel@vger.kernel.org,
        linux-hardening@vger.kernel.org,
        Peter Zijlstra <peterz@infradead.org>,
        Roxana Bradescu <roxabee@chromium.org>,
        Adam Langley <agl@google.com>,
        Ard Biesheuvel <ardb@kernel.org>,
        "Jason A . Donenfeld" <Jason@zx2c4.com>
Subject: Re: [PATCH] x86: enable Data Operand Independent Timing Mode
Message-ID: <Y9CdDUudjeczrOWz@debian.me>
References: <20230125012801.362496-1-ebiggers@kernel.org>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
        protocol="application/pgp-signature"; boundary="dhq4nShMaaV3GoZ4"
Content-Disposition: inline
In-Reply-To: <20230125012801.362496-1-ebiggers@kernel.org>
Precedence: bulk


--dhq4nShMaaV3GoZ4
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Tue, Jan 24, 2023 at 05:28:01PM -0800, Eric Biggers wrote:
> +.. SPDX-License-Identifier: GPL-2.0
> +
> +DODT - Data Operand Dependent Timing
> +=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
> +
> +Data Operand Dependent Timing (DODT) is a CPU vulnerability that makes t=
he
> +execution times of instructions depend on the values of the data operate=
d on.
> +
> +This vulnerability potentially enables side-channel attacks on data, inc=
luding
> +cryptographic keys.  Most cryptography algorithms require that a variety=
 of
> +instructions be constant-time in order to prevent side-channel attacks.
> +
> +Affected CPUs
> +-------------
> +
> +This vulnerability affects Intel Core family processors based on the Ice=
 Lake
> +and later microarchitectures, and Intel Atom family processors based on =
the
> +Gracemont and later microarchitectures.  For more information, see Intel=
's
> +documentation [1]_.
> +
> +Mitigation
> +----------
> +
> +Mitigation of this vulnerability involves setting a Model Specific Regis=
ter
> +(MSR) bit to enable Data Operand Independent Timing Mode (DOITM).
> +
> +By the default, the kernel does this on all CPUs.  This mitigation is gl=
obal, so
> +it applies to both the kernel and userspace.
> +
> +This mitigation can be disabled by adding ``doitm=3Doff`` to the kernel =
command
> +line.  It's also one of the mitigations that can be disabled by
> +``mitigations=3Doff``.
> +
> +References
> +----------
> +.. [1] Data Operand Independent Timing Instruction Set Architecture (ISA=
) Guidance
> +   https://www.intel.com/content/www/us/en/developer/articles/technical/=
software-security-guidance/best-practices/data-operand-independent-timing-i=
sa-guidance.html
> diff --git a/Documentation/admin-guide/hw-vuln/index.rst b/Documentation/=
admin-guide/hw-vuln/index.rst
> index 4df436e7c4177..cd962f9634dad 100644
> --- a/Documentation/admin-guide/hw-vuln/index.rst
> +++ b/Documentation/admin-guide/hw-vuln/index.rst
> @@ -18,3 +18,4 @@ are configurable at compile, boot or run time.
>     core-scheduling.rst
>     l1d_flush.rst
>     processor_mmio_stale_data.rst
> +   dodt.rst
> diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentat=
ion/admin-guide/kernel-parameters.txt
> index 6cfa6e3996cf7..a6a872c4365e6 100644
> --- a/Documentation/admin-guide/kernel-parameters.txt
> +++ b/Documentation/admin-guide/kernel-parameters.txt
> @@ -1119,6 +1119,12 @@
>  			The filter can be disabled or changed to another
>  			driver later using sysfs.
> =20
> +	doitm=3Doff	[X86,INTEL] Disable the use of Data Operand Independent
> +			Timing Mode (DOITM).  I.e., disable the mitigation for
> +			the Data Operand Dependent Timing (DODT) CPU
> +			vulnerability.  For details, see
> +			Documentation/admin-guide/hw-vuln/dodt.rst
> +
>  	driver_async_probe=3D  [KNL]
>  			List of driver names to be probed asynchronously. *
>  			matches with all driver names. If * is specified, the
> @@ -3259,6 +3265,7 @@
>  					       no_uaccess_flush [PPC]
>  					       mmio_stale_data=3Doff [X86]
>  					       retbleed=3Doff [X86]
> +					       doitm=3Doff [X86,INTEL]
> =20
>  				Exceptions:
>  					       This does not have any effect on
=20
The doc LGTM, thanks!

Reviewed-by: Bagas Sanjaya <bagasdotme@gmail.com>

--=20
An old man doll... just what I always wanted! - Clara

--dhq4nShMaaV3GoZ4
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iHUEABYKAB0WIQSSYQ6Cy7oyFNCHrUH2uYlJVVFOowUCY9CdBQAKCRD2uYlJVVFO
o3YWAP9vxo2raPyezzmpJXihfOoPIsfgiDaVQnNuEA2vPpLg/gD7BkpfGEypyQoE
M217c17ZSWa/VpCfJRbSiQBF9Vz0OQ8=
=hiFs
-----END PGP SIGNATURE-----

--dhq4nShMaaV3GoZ4--