Configuring Spectre Protection Level

The Spectre protections on POWER9 can be partly of fully disengaged if desired. Note that disengaging the protections will leave you vulnerable to attack via Spectre variant 2, and could result in data leakage and/or system compromise.

To override the protection level:

• Create/edit the "/var/lib/obmc/cfam_overrides" on OpenBMC
• Add the following contents

# Control speculative execution mode
0 0x283a 0x00000001  # bits 28:31 are used for init level -- in this case 1
0 0x283F 0x20000000  # Indicate scratch 3 is valid

• Re-IPL to apply changes.

Key:

• init level 0 == Kernel and User protection (safest, default)
• init level 1 == Kernel protection only
• init level 2 == No protection