Difference between revisions of "Configuring Spectre Protection Level"
Jump to navigation
Jump to search
(Add detailed information on the vulnerabilities.) |
(Undo revision 3125 by Carlosedp (talk) Reason: Summary of the spectre vulnerabilities is off-topic here. I will re-add the useful parts (i.e. new information) in a future revision.) Tag: Undo |
||
| Line 1: | Line 1: | ||
| − | + | The Spectre protections on [[POWER9]] can be partly or fully disengaged if desired. Note that disengaging the protections will leave you vulnerable to attack via Spectre variant 2, and could result in data leakage and/or system compromise. | |
| − | |||
| − | |||
To override the protection level: | To override the protection level: | ||
| Line 8: | Line 6: | ||
* Add the following contents: | * Add the following contents: | ||
# Control speculative execution mode | # Control speculative execution mode | ||
| − | 0 0x283a 0x00000001 # bits 28:31 are used for init level -- in this case | + | 0 0x283a 0x00000001 # bits 28:31 are used for init level -- in this case 1 |
| − | 0 0x283F 0x20000000 # Indicate | + | 0 0x283F 0x20000000 # Indicate scratch 3 is valid |
| − | * Re-[[IPL]] ( | + | * Re-[[IPL]] (fully power off and restart the host system) to apply changes. |
Key: | Key: | ||
Revision as of 18:06, 25 March 2020
The Spectre protections on POWER9 can be partly or fully disengaged if desired. Note that disengaging the protections will leave you vulnerable to attack via Spectre variant 2, and could result in data leakage and/or system compromise.
To override the protection level:
- Create/edit the /var/lib/obmc/cfam_overrides on the BMC.
- Add the following contents:
# Control speculative execution mode 0 0x283a 0x00000001 # bits 28:31 are used for init level -- in this case 1 0 0x283F 0x20000000 # Indicate scratch 3 is valid
- Re-IPL (fully power off and restart the host system) to apply changes.
Key:
- Init level 0 — Kernel and User protection (safest, default)
- Init level 1 — Kernel protection only
- Init level 2 — No protection
