Skip to content

Additional Explicit CPU Mitigations #197

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 5 commits into from
Feb 3, 2024
Merged

Additional Explicit CPU Mitigations #197

Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
4231155
Add reference for kernel parameters
raja-grewal Jan 29, 2024
4509a5f
Enable known mitigations for CPU vulnerabilities and disable SMT
raja-grewal Jan 29, 2024
6c54e35
Enable mitigations for RETBleed vulnerability and disable SMT
raja-grewal Jan 29, 2024
139b10a
Control RAS overflow mitigation on AMD Zen CPUs
raja-grewal Jan 29, 2024
b16c99a
Remove hardcoded `spec_rstack_overflow` setting
raja-grewal Jan 29, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 16 additions & 0 deletions etc/default/grub.d/40_cpu_mitigations.cfg
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,8 +4,12 @@
## Enables all known mitigations for CPU vulnerabilities.
##
## https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/index.html
## https://www.kernel.org/doc/html/latest/admin-guide/kernel-parameters.html
## https://forums.whonix.org/t/should-all-kernel-patches-for-cpu-bugs-be-unconditionally-enabled-vs-performance-vs-applicability/7647

## Enable known mitigations for CPU vulnerabilities and disable SMT.
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX mitigations=auto,nosmt"

## Enable mitigations for Spectre variant 2 (indirect branch speculation).
##
## https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/spectre.html
Expand Down Expand Up @@ -59,3 +63,15 @@ GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX l1d_flush=on"
##
## https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/processor_mmio_stale_data.html
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX mmio_stale_data=full,nosmt"

## Enable mitigations for RETBleed (Arbitrary Speculative Code Execution with
## Return Instructions) vulnerability and disable SMT.
##
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX retbleed=auto,nosmt"

## Control RAS overflow mitigation on AMD Zen CPUs.
## The current default kernel parameter is 'spec_rstack_overflow=safe-ret'
## This default will used until provided sufficient evidence to modify.
##
## https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/srso.html