Annotation of wikisrc/security/meltdown_spectre.mdwn, revision 1.31
1.6 maxv 1: [[!meta title="Meltdown and Spectre Status Page"]]
1.1 maxv 2:
3: Status of the Fixes
4: -------------------
5:
1.18 maxv 6: NetBSD-6, and all the anterior releases, have no planned fixes.
7:
1.7 maxv 8: ## Spectre Variant 1
9:
1.1 maxv 10: [[!table data="""
1.18 maxv 11: Port |Vendor/Model |Spectre (V1) |NetBSD-7 |NetBSD-8 |NetBSD-current
12: amd64 |Intel |Vulnerable |Not fixed |Not fixed |Not fixed
13: amd64 |AMD |Vulnerable |Not fixed |Not fixed |Not fixed
14: amd64 |VIA |Unknown | | |
15: i386 |Intel |Vulnerable |Not fixed |Not fixed |Not fixed
16: i386 |AMD |Vulnerable |Not fixed |Not fixed |Not fixed
17: i386 |VIA |Unknown | | |
1.28 maxv 18: |MIPS P5600 |Vulnerable |Not fixed |Not fixed |Not fixed
19: |MIPS P6600 |Vulnerable |Not fixed |Not fixed |Not fixed
20: |MIPS (others) |Not vulnerable | | |
1.18 maxv 21: ia64 |Intel |Not vulnerable | | |
22: riscv |(Spec.) |Not vulnerable | | |
1.27 maxv 23: |ARM Cortex-R7 |Vulnerable |Not fixed |Not fixed |Not fixed
24: |ARM Cortex-R8 |Vulnerable |Not fixed |Not fixed |Not fixed
25: |ARM Cortex-A8 |Vulnerable |Not fixed |Not fixed |Not fixed
26: |ARM Cortex-A9 |Vulnerable |Not fixed |Not fixed |Not fixed
27: |ARM Cortex-A12 |Vulnerable |Not fixed |Not fixed |Not fixed
28: |ARM Cortex-A15 |Vulnerable |Not fixed |Not fixed |Not fixed
29: |ARM Cortex-A17 |Vulnerable |Not fixed |Not fixed |Not fixed
30: |ARM Cortex-A57 |Vulnerable |Not fixed |Not fixed |Not fixed
31: |ARM Cortex-A72 |Vulnerable |Not fixed |Not fixed |Not fixed
32: |ARM Cortex-A73 |Vulnerable |Not fixed |Not fixed |Not fixed
33: |ARM Cortex-A75 |Vulnerable |Not fixed |Not fixed |Not fixed
34: |ARM (others) |Not vulnerable | | |
1.1 maxv 35: """]]
36:
1.7 maxv 37: ## Spectre Variant 2
38:
1.1 maxv 39: [[!table data="""
1.18 maxv 40: Port |Vendor/Model |Spectre (V2) |NetBSD-7 |NetBSD-8 |NetBSD-current
1.26 maxv 41: amd64 |Intel |Vulnerable |Not fixed |Fixed [MitigD] |Fixed [MitigB] [MitigD]
42: amd64 |AMD |Vulnerable |Not fixed |Fixed [MitigD] |Fixed [MitigC] [MitigD]
1.18 maxv 43: amd64 |VIA |Unknown | | |
1.26 maxv 44: i386 |Intel |Vulnerable |Not fixed |Fixed [MitigD] |Fixed [MitigD]
45: i386 |AMD |Vulnerable |Not fixed |Fixed [MitigD] |Fixed [MitigC] [MitigD]
1.18 maxv 46: i386 |VIA |Unknown | | |
1.27 maxv 47: |MIPS P5600 |Vulnerable |Not fixed |Not fixed |Not fixed
48: |MIPS P6600 |Vulnerable |Not fixed |Not fixed |Not fixed
49: |MIPS (others) |Not vulnerable | | |
1.18 maxv 50: ia64 |Intel |Not vulnerable | | |
51: riscv |(Spec.) |Not vulnerable | | |
1.27 maxv 52: |ARM Cortex-R7 |Vulnerable |Not fixed |Not fixed |Not fixed
53: |ARM Cortex-R8 |Vulnerable |Not fixed |Not fixed |Not fixed
54: |ARM Cortex-A8 |Vulnerable |Not fixed |Not fixed |Not fixed
55: |ARM Cortex-A9 |Vulnerable |Not fixed |Not fixed |Not fixed
56: |ARM Cortex-A12 |Vulnerable |Not fixed |Not fixed |Not fixed
57: |ARM Cortex-A15 |Vulnerable |Not fixed |Not fixed |Not fixed
58: |ARM Cortex-A17 |Vulnerable |Not fixed |Not fixed |Not fixed
59: |ARM Cortex-A57 |Vulnerable |Not fixed |Not fixed |Not fixed
60: |ARM Cortex-A72 |Vulnerable |Not fixed |Not fixed |Not fixed
61: |ARM Cortex-A73 |Vulnerable |Not fixed |Not fixed |Not fixed
62: |ARM Cortex-A75 |Vulnerable |Not fixed |Not fixed |Not fixed
63: |ARM (others) |Not vulnerable | | |
1.1 maxv 64: """]]
65:
1.7 maxv 66: ## Meltdown
67:
1.1 maxv 68: [[!table data="""
1.18 maxv 69: Port |Vendor/Model |Meltdown (V3) |NetBSD-7 |NetBSD-8 |NetBSD-current
1.20 maxv 70: amd64 |Intel |Vulnerable |Not fixed |Fixed [MitigA] |Fixed [MitigA]
1.18 maxv 71: amd64 |AMD |Not vulnerable | | |
72: amd64 |VIA |Unknown | | |
73: i386 |Intel |Vulnerable |Not fixed |Not fixed |Not fixed
74: i386 |AMD |Not vulnerable | | |
75: i386 |VIA |Unknown | | |
1.27 maxv 76: |MIPS P5600 |Not vulnerable | | |
77: |MIPS P6600 |Not vulnerable | | |
78: |MIPS (others) |Not vulnerable | | |
1.18 maxv 79: ia64 |Intel |Not vulnerable | | |
80: riscv |(Spec.) |Not vulnerable | | |
1.27 maxv 81: |ARM Cortex-R7 |Not vulnerable | | |
82: |ARM Cortex-R8 |Not vulnerable | | |
83: |ARM Cortex-A8 |Not vulnerable | | |
84: |ARM Cortex-A9 |Not vulnerable | | |
85: |ARM Cortex-A12 |Not vulnerable | | |
86: |ARM Cortex-A15 |Vulnerable |Not fixed |Not fixed |Not fixed
87: |ARM Cortex-A17 |Not vulnerable | | |
88: |ARM Cortex-A57 |Vulnerable |Not fixed |Not fixed |Not fixed
89: |ARM Cortex-A72 |Vulnerable |Not fixed |Not fixed |Not fixed
90: |ARM Cortex-A73 |Not vulnerable | | |
1.28 maxv 91: |ARM Cortex-A75 |Vulnerable |Not fixed |Not fixed |Not fixed
1.27 maxv 92: |ARM (others) |Not vulnerable | | |
1.1 maxv 93: """]]
94:
1.30 maxv 95: ## Spectre Variant 3a
96:
1.31 ! maxv 97: This issue will be addressed in future microcode updates on x86. No
! 98: software change is required.
1.30 maxv 99:
1.29 maxv 100: ## Spectre Variant 4
101:
102: [[!table data="""
103: Port |Vendor/Model |Spectre (V4) |NetBSD-7 |NetBSD-8 |NetBSD-current
104: amd64 |Intel |Vulnerable |Not fixed |Not fixed |Fixed [MitigE]
105: amd64 |AMD |Unknown | | |
106: amd64 |VIA |Unknown | | |
107: i386 |Intel |Vulnerable |Not fixed |Not fixed |Fixed [MitigE]
108: i386 |AMD |Unknown | | |
109: i386 |VIA |Unknown | | |
110: """]]
111:
1.16 maxv 112: ## Mitigations
113:
114: ### Mitigation A: SVS
115:
116: Meltdown is mitigated with the SVS feature. It can be dynamically disabled
117: by changing the "machdep.svs.enabled" sysctl.
118:
1.31 ! maxv 119: ### Mitigations B, C, D
1.19 maxv 120:
1.31 ! maxv 121: There is no unified mitigation for SpectreV2. Rather, a set of mitigations
! 122: are available, in both hardware and software.
! 123:
! 124: Three sysctls exist, under the machdep.spectre_v2 node:
! 125:
! 126: [[!template id=programlisting text="""
! 127: machdep.spectre_v2.hwmitigated = {0/1} user-settable
! 128: machdep.spectre_v2.swmitigated = {0/1} set by the kernel
! 129: machdep.spectre_v2.method = {string} set by the kernel
! 130: """]]
! 131:
! 132: Only hwmitigated can be set by the user. When set to one, the kernel will
! 133: determine the best hardware mitigation available for the currently
! 134: running CPU, and will apply it.
! 135:
! 136: #### Mitigation B: Intel IBRS
! 137:
! 138: Hardware mitigation, Intel only (for now). If the CPU supports this method,
! 139: it is used automatically by the kernel. It can be dynamically
! 140: enabled/disabled by changing the "hwmitigated" sysctl.
1.19 maxv 141:
1.31 ! maxv 142: #### Mitigation C: AMD DIS_IND
1.19 maxv 143:
1.31 ! maxv 144: Hardware mitigation, available only on a few AMD families. If the CPU
! 145: supports this method, it is used automatically by the kernel. It can be
! 146: dynamically enabled/disabled by changing the "hwmitigated" sysctl.
1.19 maxv 147:
1.31 ! maxv 148: #### Mitigation D: GCC Retpoline
1.23 maxv 149:
1.31 ! maxv 150: Software mitigation. It is enabled by default in GENERIC. When enabled,
! 151: the "swmitigated" sysctl is set to one.
1.23 maxv 152:
1.29 maxv 153: ### Mitigation E: Intel SSBD
154:
155: SpectreV4 can be mitigated with the SSBD method (Intel only for now). It
156: can be dynamically enabled by changing the "machdep.spectre_v4.mitigated"
157: sysctl.
158:
1.10 maxv 159: ## External Resources
160:
1.11 maxv 161: * [MIPS Blog Post](https://www.mips.com/blog/mips-response-on-speculative-execution-and-side-channel-vulnerabilities/)
1.12 maxv 162: * [ARM Security Update](https://developer.arm.com/support/security-update)
1.15 maxv 163: * [RISC-V](https://riscv.org/2018/01/more-secure-world-risc-v-isa/)
1.10 maxv 164:
1.13 maxv 165: ## Notes
166:
167: * VIA Technologies did not issue any statement regarding their CPUs. It is not currently known whether they are affected.
168:
CVSweb for NetBSD wikisrc <wikimaster@NetBSD.org> software: FreeBSD-CVSweb
![[BACK]](/icons/back.gif){kind=icon}
Return to meltdown_spectre.mdwn CVS log ![[TXT]](/icons/text.gif){kind=icon}
![[DIR]](/icons/dir.gif){kind=icon}
Up to [NetBSD Developer Wiki] / wikisrc / security