Difference between revisions of "Configuring Spectre Protection Level"

From RCS Wiki
Jump to navigation Jump to search
(Add detailed information on the vulnerabilities.)
 
(6 intermediate revisions by 2 users not shown)
Line 1: Line 1:
RaptorCS ships [[POWER9]] default for the Spectre mitigation protection as Kernel + User protection. The security vulnerabilities, [https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5753 CVE-2017-5753] and [https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5715 CVE-2017-5715] (collectively known as Spectre) allow user-level code to infer data from unauthorized memory by using speculative execution to perform side-channel information disclosure attacks. If the default Spectre protection level had been changed on the system previously, this modified level of Spectre protection will persist across the firmware update. 
+
The Spectre protections on [[POWER9]] can be partly or fully disengaged if desired. Note that disengaging the protections will leave you vulnerable to attack via Spectre variant 2, and could result in data leakage and/or system compromise. The override is controlled by the BMC and requires a reboot of the POWER9 to take effect.<ref>[ftp://170.225.15.34/ecc/sar/CMA/SFA/08h25/1/AC922_8335-GTH-GTX_OpenPowerReadme.op920.21.xhtml IBM POWER9 Systems LC Server Firmware]. Retrieved 2020-03-26.</ref>
 
 
The following are the steps that can be used to override the default Spectre protection to provide Kernel protection for Spectre or provide for more performance by fully disengaging the Spectre protection. Note that disengaging the protections will leave the system vulnerable to attack via Spectre variant 2, and could result in data leakage and/or system compromise. '''The override is controlled by the BMC and requires a reboot of the POWER9 to take effect'''.
 
  
 
To override the protection level:
 
To override the protection level:
  
* Create/edit the <tt>/var/lib/obmc/cfam_overrides</tt> on the BMC.
+
<ol>
* Add the following contents:
+
<li>Create/edit the file <code>/var/lib/obmc/cfam_overrides</code> on the BMC.</li>
# Control speculative execution mode
+
<li>Add the following contents:</li>
0 0x283a 0x00000001  # bits 28:31 are used for init level -- in this case set to Init level 1 (Kernel protection)
+
<pre># Control speculative execution mode
0 0x283F 0x20000000  # Indicate override register is valid
+
0 0x283a 0x00000001  # bits 28:31 are used for init level -- in this case 1 (Kernel protection only)
Re-[[IPL]] (reboot) to apply changes.
+
0 0x283F 0x20000000  # Indicate override register is valid</pre>
 +
<li>Re-[[IPL]] (fully power off and restart the host system) to apply changes.</li>
 +
</ol>
  
 
Key:
 
Key:
Line 16: Line 16:
 
* Init level 1 &mdash; Kernel protection only
 
* Init level 1 &mdash; Kernel protection only
 
* Init level 2 &mdash; No protection
 
* Init level 2 &mdash; No protection
 +
 +
Note: Overriding the protection level in this manner may cause the POWER9 CPU to be detected by the operating system as an earlier revision than it should be - for instance, if your CPU is DD2.3, <code>/proc/cpuinfo</code> may report it as DD2.2. This can cause unexpected behavior or errors when running virtual machines. There is [[Speculative_Execution_Vulnerabilities_of_2018#Official_statement_from_Raptor_Computing_Systems_regarding_Talos.E2.84.A2_II|no performance benefit]] to disabling protections and in general, they should be left in place.
 +
 +
== See also ==
 +
 +
* [[Speculative Execution Vulnerabilities of 2018]]
 +
 +
== References ==
 +
 +
<references />
  
 
[[Category:Guides]]
 
[[Category:Guides]]

Latest revision as of 19:32, 17 November 2021

The Spectre protections on POWER9 can be partly or fully disengaged if desired. Note that disengaging the protections will leave you vulnerable to attack via Spectre variant 2, and could result in data leakage and/or system compromise. The override is controlled by the BMC and requires a reboot of the POWER9 to take effect.[1]

To override the protection level:

  1. Create/edit the file /var/lib/obmc/cfam_overrides on the BMC.
  2. Add the following contents:
  3. # Control speculative execution mode
    0 0x283a 0x00000001  # bits 28:31 are used for init level -- in this case 1 (Kernel protection only)
    0 0x283F 0x20000000  # Indicate override register is valid
  4. Re-IPL (fully power off and restart the host system) to apply changes.

Key:

  • Init level 0 — Kernel and User protection (safest, default)
  • Init level 1 — Kernel protection only
  • Init level 2 — No protection

Note: Overriding the protection level in this manner may cause the POWER9 CPU to be detected by the operating system as an earlier revision than it should be - for instance, if your CPU is DD2.3, /proc/cpuinfo may report it as DD2.2. This can cause unexpected behavior or errors when running virtual machines. There is no performance benefit to disabling protections and in general, they should be left in place.

See also

References