From: "tip-bot2 for Josh Poimboeuf" <tip-bot2@linutronix.de>
To: linux-tip-commits@vger.kernel.org
Cc: Josh Poimboeuf <jpoimboe@kernel.org>,
"Borislav Petkov (AMD)" <bp@alien8.de>,
Daniel Sneddon <daniel.sneddon@linux.intel.com>,
x86@kernel.org, linux-kernel@vger.kernel.org
Subject: [tip: x86/bugs] x86/bugs: Remove duplicate Spectre cmdline option descriptions
Date: Sat, 29 Jun 2024 05:49:22 -0000 [thread overview]
Message-ID: <171964016299.2215.16998294900924718294.tip-bot2@tip-bot2> (raw)
In-Reply-To: <450b5f4ffe891a8cc9736ec52b0c6f225bab3f4b.1719381528.git.jpoimboe@kernel.org>
The following commit has been merged into the x86/bugs branch of tip:
Commit-ID: 4586c93ebf410c2b7f480cc4762edd59012a66c0
Gitweb: https://git.kernel.org/tip/4586c93ebf410c2b7f480cc4762edd59012a66c0
Author: Josh Poimboeuf <jpoimboe@kernel.org>
AuthorDate: Tue, 25 Jun 2024 23:02:01 -07:00
Committer: Borislav Petkov (AMD) <bp@alien8.de>
CommitterDate: Fri, 28 Jun 2024 15:28:38 +02:00
x86/bugs: Remove duplicate Spectre cmdline option descriptions
Duplicating the documentation of all the Spectre kernel cmdline options
in two separate files is unwieldy and error-prone. Instead just add a
reference to kernel-parameters.txt from spectre.rst.
Signed-off-by: Josh Poimboeuf <jpoimboe@kernel.org>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Reviewed-by: Daniel Sneddon <daniel.sneddon@linux.intel.com>
Link: https://lore.kernel.org/r/450b5f4ffe891a8cc9736ec52b0c6f225bab3f4b.1719381528.git.jpoimboe@kernel.org
---
Documentation/admin-guide/hw-vuln/spectre.rst | 86 ++----------------
1 file changed, 10 insertions(+), 76 deletions(-)
diff --git a/Documentation/admin-guide/hw-vuln/spectre.rst b/Documentation/admin-guide/hw-vuln/spectre.rst
index 25a04cd..132e0bc 100644
--- a/Documentation/admin-guide/hw-vuln/spectre.rst
+++ b/Documentation/admin-guide/hw-vuln/spectre.rst
@@ -592,85 +592,19 @@ Spectre variant 2
Mitigation control on the kernel command line
---------------------------------------------
-Spectre variant 2 mitigation can be disabled or force enabled at the
-kernel command line.
+In general the kernel selects reasonable default mitigations for the
+current CPU.
- nospectre_v1
+Spectre default mitigations can be disabled or changed at the kernel
+command line with the following options:
- [X86,PPC] Disable mitigations for Spectre Variant 1
- (bounds check bypass). With this option data leaks are
- possible in the system.
+ - nospectre_v1
+ - nospectre_v2
+ - spectre_v2={option}
+ - spectre_v2_user={option}
+ - spectre_bhi={option}
- nospectre_v2
-
- [X86] Disable all mitigations for the Spectre variant 2
- (indirect branch prediction) vulnerability. System may
- allow data leaks with this option, which is equivalent
- to spectre_v2=off.
-
-
- spectre_v2=
-
- [X86] Control mitigation of Spectre variant 2
- (indirect branch speculation) vulnerability.
- The default operation protects the kernel from
- user space attacks.
-
- on
- unconditionally enable, implies
- spectre_v2_user=on
- off
- unconditionally disable, implies
- spectre_v2_user=off
- auto
- kernel detects whether your CPU model is
- vulnerable
-
- Selecting 'on' will, and 'auto' may, choose a
- mitigation method at run time according to the
- CPU, the available microcode, the setting of the
- CONFIG_MITIGATION_RETPOLINE configuration option,
- and the compiler with which the kernel was built.
-
- Selecting 'on' will also enable the mitigation
- against user space to user space task attacks.
-
- Selecting 'off' will disable both the kernel and
- the user space protections.
-
- Specific mitigations can also be selected manually:
-
- retpoline auto pick between generic,lfence
- retpoline,generic Retpolines
- retpoline,lfence LFENCE; indirect branch
- retpoline,amd alias for retpoline,lfence
- eibrs Enhanced/Auto IBRS
- eibrs,retpoline Enhanced/Auto IBRS + Retpolines
- eibrs,lfence Enhanced/Auto IBRS + LFENCE
- ibrs use IBRS to protect kernel
-
- Not specifying this option is equivalent to
- spectre_v2=auto.
-
- In general the kernel by default selects
- reasonable mitigations for the current CPU. To
- disable Spectre variant 2 mitigations, boot with
- spectre_v2=off. Spectre variant 1 mitigations
- cannot be disabled.
-
- spectre_bhi=
-
- [X86] Control mitigation of Branch History Injection
- (BHI) vulnerability. This setting affects the deployment
- of the HW BHI control and the SW BHB clearing sequence.
-
- on
- (default) Enable the HW or SW mitigation as
- needed.
- off
- Disable the mitigation.
-
-For spectre_v2_user see Documentation/admin-guide/kernel-parameters.txt
+For more details on the available options, refer to Documentation/admin-guide/kernel-parameters.txt
Mitigation selection guide
--------------------------
next prev parent reply other threads:[~2024-06-29 5:49 UTC|newest]
Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-06-26 6:01 [PATCH v6 0/3] x86/bugs: BHI updates Josh Poimboeuf
2024-06-26 6:02 ` [PATCH v6 1/3] x86/syscall: Mark exit[_group] syscall handlers __noreturn Josh Poimboeuf
2024-06-26 7:33 ` Greg Kroah-Hartman
2024-06-27 7:26 ` Borislav Petkov
2024-06-27 13:37 ` Paul E. McKenney
2024-06-28 0:44 ` Josh Poimboeuf
2024-06-29 5:49 ` [tip: x86/bugs] " tip-bot2 for Josh Poimboeuf
2024-06-26 6:02 ` [PATCH v6 2/3] x86/bugs: Remove duplicate Spectre cmdline option descriptions Josh Poimboeuf
2024-06-29 5:49 ` tip-bot2 for Josh Poimboeuf [this message]
2024-06-26 6:02 ` [PATCH v6 3/3] x86/bugs: Add 'spectre_bhi=vmexit' cmdline option Josh Poimboeuf
2024-06-28 9:40 ` Borislav Petkov
2024-06-29 5:49 ` [tip: x86/bugs] " tip-bot2 for Josh Poimboeuf
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=171964016299.2215.16998294900924718294.tip-bot2@tip-bot2 \
--to=tip-bot2@linutronix.de \
--cc=bp@alien8.de \
--cc=daniel.sneddon@linux.intel.com \
--cc=jpoimboe@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-tip-commits@vger.kernel.org \
--cc=x86@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®