mirror of
git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
synced 2025-08-05 16:54:27 +00:00
1caa1b0509
Document the 5 new attack vector command line options, how they interact with existing vulnerability controls, and recommendations on when they can be disabled. Note that while mitigating against untrusted userspace requires both user-to-kernel and user-to-user protection, these are kept separate. The kernel can control what code executes inside of it and that may affect the risk associated with vulnerabilities especially if new kernel mitigations are implemented. The same isn't typically true of userspace. In other words, the risk associated with user-to-user or guest-to-guest attacks is unlikely to change over time. While the risk associated with user-to-kernel or guest-to-host attacks may change. Therefore, these controls are separated. Signed-off-by: David Kaplan <david.kaplan@amd.com> Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de> Link: https://lore.kernel.org/20250709155731.3279419-1-david.kaplan@amd.com |
||
|---|---|---|
| .. | ||
| attack_vector_controls.rst | ||
| core-scheduling.rst | ||
| cross-thread-rsb.rst | ||
| gather_data_sampling.rst | ||
| index.rst | ||
| indirect-target-selection.rst | ||
| l1d_flush.rst | ||
| l1tf.rst | ||
| mds.rst | ||
| multihit.rst | ||
| old_microcode.rst | ||
| processor_mmio_stale_data.rst | ||
| reg-file-data-sampling.rst | ||
| rsb.rst | ||
| special-register-buffer-data-sampling.rst | ||
| spectre.rst | ||
| srso.rst | ||
| tsx_async_abort.rst | ||