Documentation/x86: Document new attack vector controls

Browse source

Document the 5 new attack vector command line options, how they
interact with existing vulnerability controls, and recommendations on when
they can be disabled.

Note that while mitigating against untrusted userspace requires both
user-to-kernel and user-to-user protection, these are kept separate.  The
kernel can control what code executes inside of it and that may affect the
risk associated with vulnerabilities especially if new kernel mitigations
are implemented.  The same isn't typically true of userspace.

In other words, the risk associated with user-to-user or guest-to-guest
attacks is unlikely to change over time.  While the risk associated with
user-to-kernel or guest-to-host attacks may change.  Therefore, these
controls are separated.

Signed-off-by: David Kaplan <david.kaplan@amd.com>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Link: https://lore.kernel.org/20250709155731.3279419-1-david.kaplan@amd.com

...

This commit is contained in:

David Kaplan 2025-07-09 10:57:31 -05:00 • committed by Borislav Petkov (AMD)

parent fde494e905

commit 1caa1b0509

3 changed files with 243 additions and 0 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

238

Documentation/admin-guide/hw-vuln/attack_vector_controls.rst

View file

1

Documentation/admin-guide/hw-vuln/index.rst

View file

4

Documentation/admin-guide/kernel-parameters.txt

View file