File:  [NetBSD Developer Wiki] / wikisrc / security / meltdown_spectre.mdwn
Revision 1.32: download - view: text, annotated - select for diffs
Tue May 22 10:26:00 2018 UTC (4 years, 1 month ago) by maxv
Branches: MAIN
CVS tags: HEAD
Mention the SpectreV4 mitigation for AMD families 15h and 16h.

    1: [[!meta title="Meltdown and Spectre Status Page"]]
    2: 
    3: Status of the Fixes
    4: -------------------
    5: 
    6: NetBSD-6, and all the anterior releases, have no planned fixes.
    7: 
    8: ## Spectre Variant 1
    9: 
   10: [[!table data="""
   11: Port		|Vendor/Model	|Spectre (V1)	|NetBSD-7	|NetBSD-8	|NetBSD-current
   12: amd64		|Intel		|Vulnerable	|Not fixed	|Not fixed	|Not fixed
   13: amd64		|AMD		|Vulnerable	|Not fixed	|Not fixed	|Not fixed
   14: amd64		|VIA		|Unknown	|		|		|
   15: i386		|Intel		|Vulnerable	|Not fixed	|Not fixed	|Not fixed
   16: i386		|AMD		|Vulnerable	|Not fixed	|Not fixed	|Not fixed
   17: i386		|VIA		|Unknown	|		|		|
   18: 		|MIPS P5600	|Vulnerable	|Not fixed	|Not fixed	|Not fixed
   19: 		|MIPS P6600	|Vulnerable	|Not fixed	|Not fixed	|Not fixed
   20: 		|MIPS (others)	|Not vulnerable	|		|		|
   21: ia64		|Intel		|Not vulnerable	|		|		|
   22: riscv		|(Spec.)	|Not vulnerable	|		|		|
   23: 		|ARM Cortex-R7	|Vulnerable	|Not fixed	|Not fixed	|Not fixed
   24: 		|ARM Cortex-R8	|Vulnerable	|Not fixed	|Not fixed	|Not fixed
   25: 		|ARM Cortex-A8	|Vulnerable	|Not fixed	|Not fixed	|Not fixed
   26: 		|ARM Cortex-A9	|Vulnerable	|Not fixed	|Not fixed	|Not fixed
   27: 		|ARM Cortex-A12	|Vulnerable	|Not fixed	|Not fixed	|Not fixed
   28: 		|ARM Cortex-A15	|Vulnerable	|Not fixed	|Not fixed	|Not fixed
   29: 		|ARM Cortex-A17	|Vulnerable	|Not fixed	|Not fixed	|Not fixed
   30: 		|ARM Cortex-A57	|Vulnerable	|Not fixed	|Not fixed	|Not fixed
   31: 		|ARM Cortex-A72	|Vulnerable	|Not fixed	|Not fixed	|Not fixed
   32: 		|ARM Cortex-A73	|Vulnerable	|Not fixed	|Not fixed	|Not fixed
   33: 		|ARM Cortex-A75	|Vulnerable	|Not fixed	|Not fixed	|Not fixed
   34: 		|ARM (others)	|Not vulnerable	|		|		|
   35: """]]
   36: 
   37: ## Spectre Variant 2
   38: 
   39: [[!table data="""
   40: Port		|Vendor/Model	|Spectre (V2)	|NetBSD-7	|NetBSD-8	|NetBSD-current
   41: amd64		|Intel		|Vulnerable	|Not fixed	|Fixed [MitigD]	|Fixed [MitigB] [MitigD]
   42: amd64		|AMD		|Vulnerable	|Not fixed	|Fixed [MitigD]	|Fixed [MitigC] [MitigD]
   43: amd64		|VIA		|Unknown	|		|		|
   44: i386		|Intel		|Vulnerable	|Not fixed	|Fixed [MitigD]	|Fixed [MitigD]
   45: i386		|AMD		|Vulnerable	|Not fixed	|Fixed [MitigD]	|Fixed [MitigC] [MitigD]
   46: i386		|VIA		|Unknown	|		|		|
   47: 		|MIPS P5600	|Vulnerable	|Not fixed	|Not fixed	|Not fixed
   48: 		|MIPS P6600	|Vulnerable	|Not fixed	|Not fixed	|Not fixed
   49: 		|MIPS (others)	|Not vulnerable	|		|		|
   50: ia64		|Intel		|Not vulnerable	|		|		|
   51: riscv		|(Spec.)	|Not vulnerable	|		|		|
   52: 		|ARM Cortex-R7	|Vulnerable	|Not fixed	|Not fixed	|Not fixed
   53: 		|ARM Cortex-R8	|Vulnerable	|Not fixed	|Not fixed	|Not fixed
   54: 		|ARM Cortex-A8	|Vulnerable	|Not fixed	|Not fixed	|Not fixed
   55: 		|ARM Cortex-A9	|Vulnerable	|Not fixed	|Not fixed	|Not fixed
   56: 		|ARM Cortex-A12	|Vulnerable	|Not fixed	|Not fixed	|Not fixed
   57: 		|ARM Cortex-A15	|Vulnerable	|Not fixed	|Not fixed	|Not fixed
   58: 		|ARM Cortex-A17	|Vulnerable	|Not fixed	|Not fixed	|Not fixed
   59: 		|ARM Cortex-A57	|Vulnerable	|Not fixed	|Not fixed	|Not fixed
   60: 		|ARM Cortex-A72	|Vulnerable	|Not fixed	|Not fixed	|Not fixed
   61: 		|ARM Cortex-A73	|Vulnerable	|Not fixed	|Not fixed	|Not fixed
   62: 		|ARM Cortex-A75	|Vulnerable	|Not fixed	|Not fixed	|Not fixed
   63: 		|ARM (others)	|Not vulnerable	|		|		|
   64: """]]
   65: 
   66: ## Meltdown
   67: 
   68: [[!table data="""
   69: Port		|Vendor/Model	|Meltdown (V3)	|NetBSD-7	|NetBSD-8	|NetBSD-current
   70: amd64		|Intel		|Vulnerable	|Not fixed	|Fixed [MitigA]	|Fixed [MitigA]
   71: amd64		|AMD		|Not vulnerable	|		|		|
   72: amd64		|VIA		|Unknown	|		|		|
   73: i386		|Intel		|Vulnerable	|Not fixed	|Not fixed	|Not fixed
   74: i386		|AMD		|Not vulnerable	|		|		|
   75: i386		|VIA		|Unknown	|		|		|
   76: 		|MIPS P5600	|Not vulnerable	|		|		|
   77: 		|MIPS P6600	|Not vulnerable	|		|		|
   78: 		|MIPS (others)	|Not vulnerable	|		|		|
   79: ia64		|Intel		|Not vulnerable	|		|		|
   80: riscv		|(Spec.)	|Not vulnerable	|		|		|
   81: 		|ARM Cortex-R7	|Not vulnerable	|		|		|
   82: 		|ARM Cortex-R8	|Not vulnerable	|		|		|
   83: 		|ARM Cortex-A8	|Not vulnerable	|		|		|
   84: 		|ARM Cortex-A9	|Not vulnerable	|		|		|
   85: 		|ARM Cortex-A12	|Not vulnerable	|		|		|
   86: 		|ARM Cortex-A15	|Vulnerable	|Not fixed	|Not fixed	|Not fixed
   87: 		|ARM Cortex-A17	|Not vulnerable	|		|		|
   88: 		|ARM Cortex-A57	|Vulnerable	|Not fixed	|Not fixed	|Not fixed
   89: 		|ARM Cortex-A72	|Vulnerable	|Not fixed	|Not fixed	|Not fixed
   90: 		|ARM Cortex-A73	|Not vulnerable	|		|		|
   91: 		|ARM Cortex-A75	|Vulnerable	|Not fixed	|Not fixed	|Not fixed
   92: 		|ARM (others)	|Not vulnerable	|		|		|
   93: """]]
   94: 
   95: ## Spectre Variant 3a
   96: 
   97: This issue will be addressed in future microcode updates on x86. No
   98: software change is required.
   99: 
  100: ## Spectre Variant 4
  101: 
  102: [[!table data="""
  103: Port		|Vendor/Model	|Spectre (V4)	|NetBSD-7	|NetBSD-8	|NetBSD-current
  104: amd64		|Intel		|Vulnerable	|Not fixed	|Not fixed	|Fixed [MitigE]
  105: amd64		|AMD		|Vulnerable	|Not fixed	|Not fixed	|Fixed [MitigF]
  106: amd64		|VIA		|Unknown	|		|		|
  107: i386		|Intel		|Vulnerable	|Not fixed	|Not fixed	|Fixed [MitigE]
  108: i386		|AMD		|Vulnerable	|Not fixed	|Not fixed	|Fixed [MitigF]
  109: i386		|VIA		|Unknown	|		|		|
  110: """]]
  111: 
  112: ## Mitigations
  113: 
  114: ### Mitigation A: SVS
  115: 
  116: Meltdown is mitigated with the SVS feature. It can be dynamically disabled
  117: by changing the "machdep.svs.enabled" sysctl.
  118: 
  119: ### Mitigations B, C, D
  120: 
  121: There is no unified mitigation for SpectreV2. Rather, a set of mitigations
  122: are available, in both hardware and software.
  123: 
  124: Three sysctls exist, under the machdep.spectre_v2 node:
  125: 
  126: [[!template id=programlisting text="""
  127: machdep.spectre_v2.hwmitigated = {0/1} user-settable
  128: machdep.spectre_v2.swmitigated = {0/1} set by the kernel
  129: machdep.spectre_v2.method = {string} constructed by the kernel
  130: """]]
  131: 
  132: Only "hwmitigated" can be set by the user. When set to one, the kernel will
  133: determine the best hardware mitigation available for the currently
  134: running CPU, and will apply it.
  135: 
  136: #### Mitigation B: Intel IBRS
  137: 
  138: Hardware mitigation, Intel only (for now). If the CPU supports this method,
  139: it is used automatically by the kernel. It can be dynamically
  140: enabled/disabled by changing the "hwmitigated" sysctl.
  141: 
  142: #### Mitigation C: AMD DIS_IND
  143: 
  144: Hardware mitigation, available only on a few AMD families. If the CPU
  145: supports this method, it is used automatically by the kernel. It can be
  146: dynamically enabled/disabled by changing the "hwmitigated" sysctl.
  147: 
  148: #### Mitigation D: GCC Retpoline
  149: 
  150: Software mitigation. It is enabled by default in GENERIC. When enabled,
  151: the "swmitigated" sysctl is set to one.
  152: 
  153: ### Mitigations E, F
  154: 
  155: There are two available mitigations for SpectreV4. Their availability
  156: depends on the CPU model and the microcode or BIOS revision.
  157: 
  158: [[!template id=programlisting text="""
  159: machdep.spectre_v4.mitigated = {0/1} user-settable
  160: machdep.spectre_v4.method = {string} constructed by the kernel
  161: """]]
  162: 
  163: Only "mitigated" can be set by the user. When set to one, the kernel will
  164: determine the best hardware mitigation available for the currently
  165: running CPU, and will apply it.
  166: 
  167: #### Mitigation E: Intel SSBD
  168: 
  169: Available on Intel only for now. It can be dynamically enabled/disabled by
  170: changing the "mitigated" sysctl.
  171: 
  172: #### Mitigation F: AMD NONARCH
  173: 
  174: Available only on AMD families 15h and 16h. It can be dynamically
  175: enabled/disabled by changing the "mitigated" sysctl.
  176: 
  177: ## External Resources
  178: 
  179: * [MIPS Blog Post](https://www.mips.com/blog/mips-response-on-speculative-execution-and-side-channel-vulnerabilities/)
  180: * [ARM Security Update](https://developer.arm.com/support/security-update)
  181: * [RISC-V](https://riscv.org/2018/01/more-secure-world-risc-v-isa/)
  182: 
  183: ## Notes
  184: 
  185: * VIA Technologies did not issue any statement regarding their CPUs. It is not currently known whether they are affected.
  186: 

CVSweb for NetBSD wikisrc <wikimaster@NetBSD.org> software: FreeBSD-CVSweb