Skip to content

Remove redundant kernel arguments #200

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
TommyTran732 wants to merge 1 commit into from
Closed

Remove redundant kernel arguments #200

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 1 addition & 23 deletions etc/default/grub.d/40_cpu_mitigations.cfg
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,23 +18,11 @@ GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX spectre_v2=on"
## Disable Speculative Store Bypass.
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX spec_store_bypass_disable=on"

## Enable mitigations for the L1TF vulnerability through disabling SMT
## and L1D flush runtime control.
##
## https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX l1tf=full,force"

## Enable mitigations for the MDS vulnerability through clearing buffer cache
## and disabling SMT.
##
## https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/mds.html
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX mds=full,nosmt"

## Patches the TAA vulnerability by disabling TSX and enables mitigations using
## TSX Async Abort along with disabling SMT.
##
## https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/tsx_async_abort.html
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX tsx=off tsx_async_abort=full,nosmt"
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX tsx=off"

## Mark all huge pages in the EPT as non-executable to mitigate iTLB multihit.
##
Expand All @@ -59,16 +47,6 @@ GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX nosmt=force"
## https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1d_flush.html
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX l1d_flush=on"

## Mitigates numerous MMIO Stale Data vulnerabilities and disables SMT.
##
## https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/processor_mmio_stale_data.html
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX mmio_stale_data=full,nosmt"

## Enable mitigations for RETBleed (Arbitrary Speculative Code Execution with
## Return Instructions) vulnerability and disable SMT.
##
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX retbleed=auto,nosmt"

## Control RAS overflow mitigation on AMD Zen CPUs.
## The current default kernel parameter is 'spec_rstack_overflow=safe-ret'
## This default will used until provided sufficient evidence to modify.
Expand Down