Skip to content

gather_data_sampling=force - Enable Gather Data Sampling (GDS) mitigation - related to CPU AVX instruction; More CPU Mitigations and Additional References #218

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 9 commits into from
May 10, 2024
Merged

gather_data_sampling=force - Enable Gather Data Sampling (GDS) mitigation - related to CPU AVX instruction; More CPU Mitigations and Additional References #218

Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
965c864
Update BHI mitigation reference
raja-grewal May 1, 2024
de4f4be
Merge spectre mitigations
raja-grewal May 1, 2024
015dcc4
Add reference for SSB
raja-grewal May 1, 2024
d89d7e8
Add reference for RETBleed
raja-grewal May 1, 2024
c002bd6
Clarify use of `mitigations=auto`
raja-grewal May 1, 2024
1122b34
GDS mitigation for CPUs
raja-grewal May 1, 2024
0c031a2
RFDS mitigation on Intel Atom CPUs (including E-cores)
raja-grewal May 1, 2024
8f7768c
Add vendor links
raja-grewal May 5, 2024
4694268
Remove a word
raja-grewal May 5, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
35 changes: 26 additions & 9 deletions etc/default/grub.d/40_cpu_mitigations.cfg
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,21 +1,30 @@
## Copyright (C) 2019 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## See the file COPYING for copying conditions.

## Enables all known mitigations for CPU vulnerabilities.
## Enables known mitigations for CPU vulnerabilities.
##
## https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/index.html
## https://www.kernel.org/doc/html/latest/admin-guide/kernel-parameters.html
## https://forums.whonix.org/t/should-all-kernel-patches-for-cpu-bugs-be-unconditionally-enabled-vs-performance-vs-applicability/7647

## Enable known mitigations for CPU vulnerabilities and disable SMT.
## Check for potential updates directly from AMD and Intel.
##
## https://www.amd.com/en/resources/product-security.html
## https://www.intel.com/content/www/us/en/developer/topic-technology/software-security-guidance/advisory-guidance.html
## https://www.intel.com/content/www/us/en/developer/topic-technology/software-security-guidance/disclosure-documentation.html

## Enable a subset of known mitigations for CPU vulnerabilities and disable SMT.
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX mitigations=auto,nosmt"

## Enable mitigations for Spectre variant 2 (indirect branch speculation).
## Enable mitigations for both Spectre Variant 2 (indirect branch speculation)
## and Intel branch history injection (BHI) vulnerabilities.
##
## https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/spectre.html
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX spectre_v2=on"
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX spectre_v2=on spectre_bhi=on"

## Disable Speculative Store Bypass.
## Disable Speculative Store Bypass (Spectre Variant 4).
##
## https://www.suse.com/support/kb/doc/?id=000019189
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX spec_store_bypass_disable=on"

## Enable mitigations for the L1TF vulnerability through disabling SMT
Expand Down Expand Up @@ -67,6 +76,7 @@ GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX mmio_stale_data=full,nosmt"
## Enable mitigations for RETBleed (Arbitrary Speculative Code Execution with
## Return Instructions) vulnerability and disable SMT.
##
## https://www.suse.com/support/kb/doc/?id=000020693
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX retbleed=auto,nosmt"

## Control RAS overflow mitigation on AMD Zen CPUs.
Expand All @@ -75,8 +85,15 @@ GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX retbleed=auto,nosmt"
##
## https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/srso.html

## Enables mitigation of Branch History Injection vulnerabilities on Intel CPUs.
## Mitigates Gather Data Sampling (GDS) vulnerability.
## Note for systems that have not received a suitable microcode update this will
## entirely disable use of the AVX instructions set.
##
## https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/gather_data_sampling.html
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX gather_data_sampling=force"

## Register File Data Sampling (RFDS) mitigation on Intel Atom CPUs which
## encompasses E-cores on hybrid architectures.
##
## https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=2bb69f5fc72183e1c62547d900f560d0e9334925
## TODO: update the above link with better alternative when possible
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX spectre_bhi=on"
## https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/reg-file-data-sampling.html
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX reg_file_data_sampling=on"