Messages in this thread | | | Date | Mon, 14 Aug 2023 12:11:34 +0200 | From | Borislav Petkov <> | Subject | Re: Does srso safe RET mitigation require microcode update? |
| |
On Mon, Aug 14, 2023 at 11:47:54AM +0200, Rainer Fiebig wrote: > "* 'Mitigation: safe RET': > > Software-only mitigation. It complements the extended IBPB microcode > patch functionality by addressing User->Kernel and Guest->Host > transitions protection." > > Now, what does that mean: partial mitigation or also no mitigation > without microcode?
It *complements*! Meaning, for a full safe RET mitigation, you need the microcode on Zen3/4.
Would that explain it better?
"First of all, it is required that the latest microcode be loaded for mitigations to be effective. That means that for the User->User aspect of the mitigation to be effective, one needs the updated microcode for Zen3 and Zen4 generations. In addition, one needs to *enable* the User->User mitigation which is part of the spectre_v2_user controls:
- conditional IBPB:
where each process can select whether it needs an IBPB issued around it PR_SPEC_DISABLE/_ENABLE etc, see Spectre Side Channels. That is the default setting
- strict:
i.e., always on - by supplying spectre_v2_user=on on the kernel command line."
IOW, without microcode, you do not mitigate the User->User aspect of the mitigation but you mitigate the other vectors with safe RET.
-- Regards/Gruss, Boris.
https://people.kernel.org/tglx/notes-about-netiquette
| |