D55281.id.diff
No OneTemporary
Actions

Size

1 KB

Referenced Files

None

Subscribers

None

D55281.id.diff
View Options

	Index: share/man/man7/mitigations.7
	===================================================================
	--- share/man/man7/mitigations.7
	+++ share/man/man7/mitigations.7
	@@ -335,8 +335,14 @@
	from the kernel.
	This also provides effective protection against NULL pointer dereferences from
	kernel.
	+An additional technique,
	+Linear Address Space Separation (LASS), is available on amd64.
	+LASS prevents user-mode applications from accessing kernel-mode memory,
	+and vice-versa, to additionally mitigate speculative-execution
	+side-channel attacks.
	.Bl -column -offset indent "Architecture" "Feature" "Access Type Prevented"
	.It Sy Architecture Ta Sy Feature Ta Sy Access Type Prevented
	+.It amd64 Ta LASS Ta All
	.It amd64 Ta SMAP Ta Read / Write
	.It amd64 Ta SMEP Ta Execute
	.It arm64 Ta PAN Ta Read / Write
	@@ -345,8 +351,11 @@
	.It riscv Ta - Ta Execute
	.El
	.Pp
	-These features are automatically used by the kernel.
	-There is no user-facing configuration.
	+Most of these features are automatically used by the kernel,
	+with no user-facing configuration.
	+LASS is controlled by the
	+.Va hw.lass
	+loader tunable.
	.\"
	.Ss Capsicum
	Capsicum is a lightweight OS capability and sandbox framework.