Commit 3267cb6d authored by Pawan Gupta's avatar Pawan Gupta Committed by Dave Hansen
Browse files

x86/lam: Disable ADDRESS_MASKING in most cases 

Linear Address Masking (LAM) has a weakness related to transient
execution as described in the SLAM paper[1]. Unless Linear Address
Space Separation (LASS) is enabled this weakness may be exploitable.

Until kernel adds support for LASS[2], only allow LAM for COMPILE_TEST,
or when speculation mitigations have been disabled at compile time,
otherwise keep LAM disabled.

There are no processors in market that support LAM yet, so currently
nobody is affected by this issue.

[1] SLAM: https://download.vusec.net/papers/slam_sp24.pdf
[2] LASS: https://lore.kernel.org/lkml/20230609183632.48706-1-alexander.shishkin@linux.intel.com/



[ dhansen: update SPECULATION_MITIGATIONS -> CPU_MITIGATIONS ]

Signed-off-by: default avatarPawan Gupta <pawan.kumar.gupta@linux.intel.com>
Signed-off-by: default avatarDave Hansen <dave.hansen@linux.intel.com>
Reviewed-by: default avatarSohil Mehta <sohil.mehta@intel.com>
Acked-by: default avatarKirill A. Shutemov <kirill.shutemov@linux.intel.com>
Cc:stable@vger.kernel.org
Link: https://lore.kernel.org/all/5373262886f2783f054256babdf5a98545dc986b.1706068222.git.pawan.kumar.gupta%40linux.intel.com
parent ffd95846

arch/x86/Kconfig

+1 −0
Original line number Diff line number Diff line
@@ -2257,6 +2257,7 @@ config RANDOMIZE_MEMORY_PHYSICAL_PADDING 
config ADDRESS_MASKING

	bool "Linear Address Masking support"

	depends on X86_64

	depends on COMPILE_TEST || !CPU_MITIGATIONS # wait for LASS

	help

	  Linear Address Masking (LAM) modifies the checking that is applied

	  to 64-bit linear addresses, allowing software to use of the