admin-guide/hw-vuln/l1tf.rst

104    only possible, when the hypervisor does not sanitize the content of the
174    the hypervisor flushes the L1D before entering the guest.
195    address space layout of the hypervisor.
228    host OS (hypervisor) context and the other in guest context. The amount
353   managed and sanitized by the hypervisor. Though disabling EPT has a
357   EPT can be disabled in the hypervisor via the 'kvm-intel.ept' parameter.
385   flush		Leaves SMT enabled and enables the default hypervisor
394   flush,nosmt	Disables SMT and enables the default hypervisor mitigation,
406   off		Disables hypervisor mitigations and doesn't emit any
409 		on both hypervisor and bare metal.
421 The KVM hypervisor mitigation mechanism, flushing the L1D cache when
487   If EPT is not supported by the processor or disabled in the hypervisor,
491   EPT can be disabled in the hypervisor via the 'kvm-intel.ept' parameter.
550     EPT can be disabled in the hypervisor via the 'kvm-intel.ept'
557 the bare metal hypervisor, the nested hypervisor and the nested virtual
558 machine.  VMENTER operations from the nested hypervisor into the nested
559 guest will always be processed by the bare metal hypervisor. If KVM is the
560 bare metal hypervisor it will:
562  - Flush the L1D cache on every switch from the nested hypervisor to the
563    nested virtual machine, so that the nested hypervisor's secrets are not
567    the nested hypervisor; this is a complex operation, and flushing the L1D
568    cache avoids that the bare metal hypervisor's secrets are exposed to the
571  - Instruct the nested hypervisor to not perform any L1D cache flush. This