@@ -592,85 +592,19 @@ Spectre variant 2
592592Mitigation control on the kernel command line
593593---------------------------------------------
594594
595- Spectre variant 2 mitigation can be disabled or force enabled at the
596- kernel command line .
595+ In general the kernel selects reasonable default mitigations for the
596+ current CPU .
597597
598- nospectre_v1
598+ Spectre default mitigations can be disabled or changed at the kernel
599+ command line with the following options:
599600
600- [X86,PPC] Disable mitigations for Spectre Variant 1
601- (bounds check bypass). With this option data leaks are
602- possible in the system.
601+ - nospectre_v1
602+ - nospectre_v2
603+ - spectre_v2={option}
604+ - spectre_v2_user={option}
605+ - spectre_bhi={option}
603606
604- nospectre_v2
605-
606- [X86] Disable all mitigations for the Spectre variant 2
607- (indirect branch prediction) vulnerability. System may
608- allow data leaks with this option, which is equivalent
609- to spectre_v2=off.
610-
611-
612- spectre_v2=
613-
614- [X86] Control mitigation of Spectre variant 2
615- (indirect branch speculation) vulnerability.
616- The default operation protects the kernel from
617- user space attacks.
618-
619- on
620- unconditionally enable, implies
621- spectre_v2_user=on
622- off
623- unconditionally disable, implies
624- spectre_v2_user=off
625- auto
626- kernel detects whether your CPU model is
627- vulnerable
628-
629- Selecting 'on' will, and 'auto' may, choose a
630- mitigation method at run time according to the
631- CPU, the available microcode, the setting of the
632- CONFIG_MITIGATION_RETPOLINE configuration option,
633- and the compiler with which the kernel was built.
634-
635- Selecting 'on' will also enable the mitigation
636- against user space to user space task attacks.
637-
638- Selecting 'off' will disable both the kernel and
639- the user space protections.
640-
641- Specific mitigations can also be selected manually:
642-
643- retpoline auto pick between generic,lfence
644- retpoline,generic Retpolines
645- retpoline,lfence LFENCE; indirect branch
646- retpoline,amd alias for retpoline,lfence
647- eibrs Enhanced/Auto IBRS
648- eibrs,retpoline Enhanced/Auto IBRS + Retpolines
649- eibrs,lfence Enhanced/Auto IBRS + LFENCE
650- ibrs use IBRS to protect kernel
651-
652- Not specifying this option is equivalent to
653- spectre_v2=auto.
654-
655- In general the kernel by default selects
656- reasonable mitigations for the current CPU. To
657- disable Spectre variant 2 mitigations, boot with
658- spectre_v2=off. Spectre variant 1 mitigations
659- cannot be disabled.
660-
661- spectre_bhi=
662-
663- [X86] Control mitigation of Branch History Injection
664- (BHI) vulnerability. This setting affects the deployment
665- of the HW BHI control and the SW BHB clearing sequence.
666-
667- on
668- (default) Enable the HW or SW mitigation as
669- needed.
670- off
671- Disable the mitigation.
672-
673- For spectre_v2_user see Documentation/admin-guide/kernel-parameters.txt
607+ For more details on the available options, refer to Documentation/admin-guide/kernel-parameters.txt
674608
675609Mitigation selection guide
676610--------------------------
0 commit comments