@@ -592,85 +592,19 @@ Spectre variant 2
592
592
Mitigation control on the kernel command line
593
593
---------------------------------------------
594
594
595
- Spectre variant 2 mitigation can be disabled or force enabled at the
596
- kernel command line .
595
+ In general the kernel selects reasonable default mitigations for the
596
+ current CPU .
597
597
598
- nospectre_v1
598
+ Spectre default mitigations can be disabled or changed at the kernel
599
+ command line with the following options:
599
600
600
- [X86,PPC] Disable mitigations for Spectre Variant 1
601
- (bounds check bypass). With this option data leaks are
602
- possible in the system.
601
+ - nospectre_v1
602
+ - nospectre_v2
603
+ - spectre_v2={option}
604
+ - spectre_v2_user={option}
605
+ - spectre_bhi={option}
603
606
604
- nospectre_v2
605
-
606
- [X86] Disable all mitigations for the Spectre variant 2
607
- (indirect branch prediction) vulnerability. System may
608
- allow data leaks with this option, which is equivalent
609
- to spectre_v2=off.
610
-
611
-
612
- spectre_v2=
613
-
614
- [X86] Control mitigation of Spectre variant 2
615
- (indirect branch speculation) vulnerability.
616
- The default operation protects the kernel from
617
- user space attacks.
618
-
619
- on
620
- unconditionally enable, implies
621
- spectre_v2_user=on
622
- off
623
- unconditionally disable, implies
624
- spectre_v2_user=off
625
- auto
626
- kernel detects whether your CPU model is
627
- vulnerable
628
-
629
- Selecting 'on' will, and 'auto' may, choose a
630
- mitigation method at run time according to the
631
- CPU, the available microcode, the setting of the
632
- CONFIG_MITIGATION_RETPOLINE configuration option,
633
- and the compiler with which the kernel was built.
634
-
635
- Selecting 'on' will also enable the mitigation
636
- against user space to user space task attacks.
637
-
638
- Selecting 'off' will disable both the kernel and
639
- the user space protections.
640
-
641
- Specific mitigations can also be selected manually:
642
-
643
- retpoline auto pick between generic,lfence
644
- retpoline,generic Retpolines
645
- retpoline,lfence LFENCE; indirect branch
646
- retpoline,amd alias for retpoline,lfence
647
- eibrs Enhanced/Auto IBRS
648
- eibrs,retpoline Enhanced/Auto IBRS + Retpolines
649
- eibrs,lfence Enhanced/Auto IBRS + LFENCE
650
- ibrs use IBRS to protect kernel
651
-
652
- Not specifying this option is equivalent to
653
- spectre_v2=auto.
654
-
655
- In general the kernel by default selects
656
- reasonable mitigations for the current CPU. To
657
- disable Spectre variant 2 mitigations, boot with
658
- spectre_v2=off. Spectre variant 1 mitigations
659
- cannot be disabled.
660
-
661
- spectre_bhi=
662
-
663
- [X86] Control mitigation of Branch History Injection
664
- (BHI) vulnerability. This setting affects the deployment
665
- of the HW BHI control and the SW BHB clearing sequence.
666
-
667
- on
668
- (default) Enable the HW or SW mitigation as
669
- needed.
670
- off
671
- Disable the mitigation.
672
-
673
- For spectre_v2_user see Documentation/admin-guide/kernel-parameters.txt
607
+ For more details on the available options, refer to Documentation/admin-guide/kernel-parameters.txt
674
608
675
609
Mitigation selection guide
676
610
--------------------------
0 commit comments