View source for Configuring Spectre Protection Level

The Spectre protections on [[POWER9]] can be partly or fully disengaged if desired. Note that disengaging the protections will leave you vulnerable to attack via Spectre variant 2, and could result in data leakage and/or system compromise. The override is controlled by the BMC and requires a reboot of the POWER9 to take effect.<ref>[ftp://170.225.15.34/ecc/sar/CMA/SFA/08h25/1/AC922_8335-GTH-GTX_OpenPowerReadme.op920.21.xhtml IBM POWER9 Systems LC Server Firmware]. Retrieved 2020-03-26.</ref>

To override the protection level:

<ol>
<li>Create/edit the file <code>/var/lib/obmc/cfam_overrides</code> on the BMC.</li>
<li>Add the following contents:</li>
<pre># Control speculative execution mode
0 0x283a 0x00000001  # bits 28:31 are used for init level -- in this case 1 (Kernel protection only)
0 0x283F 0x20000000  # Indicate override register is valid</pre>
<li>Re-[[IPL]] (fully power off and restart the host system) to apply changes.</li>
</ol>

Key:
* Init level 0 &mdash; Kernel and User protection (safest, default)
* Init level 1 &mdash; Kernel protection only
* Init level 2 &mdash; No protection

Note: Overriding the protection level in this manner may cause the POWER9 CPU to be detected by the operating system as an earlier revision than it should be - for instance, if your CPU is DD2.3, <code>/proc/cpuinfo</code> may report it as DD2.2. This can cause unexpected behavior or errors when running virtual machines. There is [[Speculative_Execution_Vulnerabilities_of_2018#Official_statement_from_Raptor_Computing_Systems_regarding_Talos.E2.84.A2_II|no performance benefit]] to disabling protections and in general, they should be left in place.

== See also ==

* [[Speculative Execution Vulnerabilities of 2018]]

== References ==

<references />

[[Category:Guides]]