| /linux/Documentation/admin-guide/hw-vuln/ |
| H A D | gather_data_sampling.rst | 29 Without mitigation, GDS can infer stale data across virtually all
38 Because of this, it is important to ensure that the mitigation stays enabled in
41 The hardware enforces the mitigation for SGX. Likewise, VMMs should ensure
42 that guests are not allowed to disable the GDS mitigation. If a host erred and
43 allowed this, a guest could theoretically disable GDS mitigation, mount an
53 and mitigation support.
55 IA32_MCU_OPT_CTRL[GDS_MITG_DIS] R/W Disables the mitigation
73 The mitigation can be disabled by setting "gather_data_sampling=off" or
75 to the mitigation being enabled. Specifying "gather_data_sampling=force" will
76 use the microcode mitigation when available or disable AVX on affected systems
[all …]
|
| H A D | indirect-target-selection.rst | 49 update for mitigation.
59 the mitigation is to not allow indirect branches in the lower half.
89 reason, when retpoline is enabled, ITS mitigation only relocates the RETs to
90 safe thunks. Unless user requested the RSB-stuffing mitigation.
94 RSB-stuffing via Call Depth Tracking is a mitigation for Retbleed RSB-underflow
99 All guests deploy ITS mitigation by default, irrespective of eIBRS enumeration
104 To prevent guests from unnecessarily deploying the mitigation on unaffected
112 The ITS mitigation can be controlled using the "indirect_target_selection"
116 on (default) Deploy the "Aligned branch/return thunks" mitigation.
117 If spectre_v2 mitigation enables retpoline, aligned-thunks are only
[all …]
|
| H A D | vmscape.rst | 23 Note that, BHI affected parts that use BHB clearing software mitigation e.g.
42 Note that the existing userspace mitigation against Spectre-v2 is effective in
48 Vulnerability enumeration and mitigation is not applied inside a guest. This is
69 The sysfs file showing VMSCAPE mitigation status is:
81 The processor is vulnerable and no mitigation has been applied.
85 Conditional IBPB mitigation is enabled. The kernel tracks when a CPU has
97 The mitigation can be controlled via the ``vmscape=`` command line parameter:
101 Disable the VMSCAPE mitigation.
105 Enable conditional IBPB mitigation (default when CONFIG_MITIGATION_VMSCAPE=y).
109 Force vulnerability detection and mitigation even on processors that are
|
| H A D | mds.rst | 26 Not all processors are affected by all variants of MDS, but the mitigation
103 - The processor is vulnerable, but no mitigation enabled
106 mitigation is enabled on a best effort basis.
109 based mitigation mechanism is not advertised via CPUID, the kernel
110 selects a best effort mitigation mode. This mode invokes the mitigation
119 - The processor is vulnerable and the CPU buffer clearing mitigation is
139 enables the mitigation by default. The mitigation can be controlled at boot
148 The mitigation for MDS clears the affected CPU buffers on return to user
160 Virtualization mitigation
168 If the L1D flush mitigation is enabled and up to date microcode is
[all …]
|
| H A D | special-register-buffer-data-sampling.rst | 87 the mitigation for RDRAND and RDSEED instructions executed outside of Intel
89 disable the mitigation using this opt-out mechanism, RDRAND and RDSEED do not
97 Along with the mitigation for this issue, Intel added a new thread-scope
103 disables the mitigation for RDRAND and RDSEED executed outside of an Intel SGX
104 enclave on that logical processor. Opting out of the mitigation for a
108 Note that inside of an Intel SGX enclave, the mitigation is applied regardless
113 The kernel command line allows control over the SRBDS mitigation at boot time
117 off This option disables SRBDS mitigation for RDRAND and RDSEED on
131 Vulnerable Processor vulnerable and mitigation disabled
133 mitigation
[all …]
|
| H A D | srso.rst | 6 This is a mitigation for the speculative return stack overflow (SRSO)
39 The sysfs file showing SRSO mitigation status is:
60 The "Safe RET" mitigation (see below) has been applied to protect the
70 Note that User->User mitigation is controlled by how the IBPB aspect in
71 the Spectre v2 mitigation is selected:
87 Combined microcode/software mitigation. It complements the
109 This mitigation gets automatically enabled when the above one "IBPB on
114 to the above =ibpb-vmexit mitigation because the user/kernel boundary is
117 After enabling the IBPB on VMEXIT mitigation option, the BpSpecReduce bit
135 Considering the performance implications of each mitigation type, the
[all …]
|
| H A D | processor_mmio_stale_data.rst | 10 provided to untrusted guests may need mitigation. These vulnerabilities are
110 section, mitigation largely remains the same for all the variants, i.e. to
117 specific variants of Processor MMIO Stale Data vulnerabilities and mitigation
153 same mitigation strategy to force the CPU to clear the affected buffers before
164 additional mitigation is needed on such CPUs.
166 For CPUs not affected by MDS or TAA, mitigation is needed only for the attacker
175 Same mitigation as MDS when affected by MDS/TAA, otherwise no mitigation
186 Same mitigation as MDS when processor is also affected by MDS/TAA, otherwise
198 full If the CPU is vulnerable, enable mitigation; CPU buffer clearing
202 complete mitigation.
[all …]
|
| H A D | tsx_async_abort.rst | 99 …- The CPU is affected by this vulnerability and the microcode and kernel mitigation are not applie…
102 mitigation is enabled on a best effort basis.
105 based mitigation mechanism is not advertised via CPUID, the kernel
106 selects a best effort mitigation mode. This mode invokes the mitigation
126 enables the mitigation by default.
129 The mitigation can be controlled at boot time via a kernel command line option.
132 Virtualization mitigation
152 off This option disables the TAA mitigation on affected platforms.
156 full TAA mitigation is enabled. If TSX is enabled, on an affected
158 systems which are MDS-affected and deploy MDS mitigation,
[all …]
|
| H A D | reg-file-data-sampling.rst | 36 mitigation strategy to force the CPU to clear the affected buffers before an
52 vulnerability and mitigation capability:
60 The kernel command line allows to control RFDS mitigation at boot time with the
64 on If the CPU is vulnerable, enable mitigation; CPU buffer clearing
66 off Disables mitigation.
86 - The processor is vulnerable, but no mitigation enabled
90 - The processor is vulnerable and the CPU buffer clearing mitigation is
|
| H A D | l1tf.rst | 78 The Linux kernel contains a mitigation for this attack vector, PTE
92 PTE inversion mitigation for L1TF, to attack physical host memory.
158 Host mitigation mechanism
165 Guest mitigation mechanisms
282 of other mitigation solutions like confining guests to dedicated cores.
351 Disabling EPT for virtual machines provides full mitigation for L1TF even
354 significant performance impact especially when the Meltdown mitigation
359 There is ongoing research and development for new mitigation mechanisms to
386 mitigation, i.e. conditional L1D flushing
394 flush,nosmt Disables SMT and enables the default hypervisor mitigation,
[all …]
|
| H A D | spectre.rst | 143 For a full mitigation against BHB attacks it is recommended to set BHI_DIS_S or
330 mitigation status of the system for Spectre: whether the system is
333 The sysfs file showing Spectre variant 1 mitigation status is:
357 retpoline mitigation or if the CPU has hardware mitigation, and if the
358 CPU has support for additional process-specific mitigation.
371 The sysfs file showing Spectre variant 2 mitigation status is:
381 'Mitigation: None' Vulnerable, no mitigation
384 'Mitigation: Enhanced IBRS' Hardware-focused mitigation
449 Full mitigation might require a microcode update from the CPU
453 Turning on mitigation for Spectre variant 1 and Spectre variant 2
[all …]
|
| H A D | multihit.rst | 88 - The processor is vulnerable, but no mitigation enabled
125 The KVM hypervisor mitigation mechanism for marking huge pages as
133 force Mitigation is enabled. In this case, the mitigation implements
141 auto Enable mitigation only if the platform is affected and the kernel
166 to apply iTLB multihit mitigation via the kernel command line or kvm
|
| H A D | attack_vector_controls.rst | 124 Cross-thread mitigation may not be required if core-scheduling or similar
195 mitigation option for that particular vulnerability is used. To use a different
196 mitigation, please use the vulnerability-specific command line option.
234 listed in the above table are disabled, unless mitigation is required for a
235 different enabled attack-vector or a mitigation is explicitly selected via a
|
| H A D | l1d_flush.rst | 39 mechanism is used, software fallback for the mitigation, is not supported.
63 cores or by disabling SMT. See the relevant chapter in the L1TF mitigation
|
| /linux/tools/testing/selftests/x86/bugs/ |
| H A D | common.py | 52 def sysfs_has(bug, mitigation): argument
54 if mitigation in status:
60 for mitigation in mitigations:
61 if sysfs_has(bug, mitigation):
70 for mitigation in mitigations:
71 if not sysfs_has(bug, mitigation):
91 def basic_checks_sufficient(bug, mitigation): argument
92 if not mitigation:
95 elif mitigation == "Not affected":
98 elif mitigation == "Vulnerable":
[all …]
|
| H A D | its_sysfs.py | 16 mitigation = get_sysfs(bug) variable
24 if mitigation == ITS_MITIGATION_ALIGNED_THUNKS:
34 if mitigation == ITS_MITIGATION_RETPOLINE_STUFF:
43 if mitigation == ITS_MITIGATION_VMEXIT_ONLY:
49 if mitigation == ITS_MITIGATION_VULNERABLE:
55 bug_status_unknown(bug, mitigation)
62 if not basic_checks_sufficient(bug, mitigation):
|
| H A D | its_permutations.py | 17 mitigation = c.get_sysfs(bug) variable
19 if not mitigation or "Not affected" in mitigation:
|
| H A D | its_ret_alignment.py | 31 mitigation = c.get_sysfs(bug) variable
32 if not mitigation or "Aligned branch/return thunks" not in mitigation:
|
| H A D | its_indirect_alignment.py | 32 mitigation = c.get_sysfs(bug) variable
33 if not mitigation or "Aligned branch/return thunks" not in mitigation:
|
| /linux/tools/testing/selftests/powerpc/security/ |
| H A D | mitigation-patching.sh | 9 local mitigation="$1"
14 orig=$(cat "$mitigation")
21 echo 0 > "$mitigation"
22 echo 1 > "$mitigation"
27 echo "$orig" > "$mitigation"
|
| H A D | Makefile | 4 TEST_PROGS := mitigation-patching.sh
|
| /linux/Documentation/arch/x86/ |
| H A D | tsx_async_abort.rst | 3 TSX Async Abort (TAA) mitigation
33 Kernel internal mitigation modes
54 not provided then the kernel selects an appropriate mitigation depending on the
58 TAA mitigation, VERW behavior and TSX feature for various combinations of
66 …A_NO MDS_NO TSX_CTRL_MSR TSX state VERW can clear TAA mitigation TAA mitigation
81 …A_NO MDS_NO TSX_CTRL_MSR TSX state VERW can clear TAA mitigation TAA mitigation
96 …A_NO MDS_NO TSX_CTRL_MSR TSX state VERW can clear TAA mitigation TAA mitigation
|
| H A D | mds.rst | 1 Microarchitectural Data Sampling (MDS) mitigation
73 All variants have the same mitigation strategy at least for the single CPU
82 command. The latter is issued when L1TF mitigation is enabled so the extra
101 The mitigation is invoked on kernel/userspace, hypervisor/guest and C-state
115 Kernel internal mitigation modes
133 line then the kernel selects the appropriate mitigation mode depending on
143 on affected CPUs when the mitigation is not disabled on the kernel
144 command line. The mitigation is enabled through the feature flag
147 The mitigation is invoked just before transitioning to userspace after
189 switched depending on the chosen mitigation mode and the SMT state of the
[all …]
|
| /linux/Documentation/userspace-api/ |
| H A D | spec_ctrl.rst | 9 The kernel provides mitigation for such vulnerabilities in various
37 1 PR_SPEC_ENABLE The speculation feature is enabled, mitigation is
39 2 PR_SPEC_DISABLE The speculation feature is disabled, mitigation is
49 If PR_SPEC_PRCTL is set, then the per-task control of the mitigation is
91 mitigation is not possible because of the system's boot configuration.
118 For this control, PR_SPEC_ENABLE means that the **mitigation** is enabled (L1D
|
| /linux/Documentation/driver-api/thermal/ |
| H A D | cpu-idle-cooling.rst | 90 the duty cycle percentage. When no mitigation is happening the cooling
93 When the mitigation begins, depending on the governor's policy, a
133 mitigation begins. It is platform dependent and will depend on the
138 for thermal mitigation, otherwise we end up consuming more energy.
194 potentially invert the mitigation effect
|