lkml.org 
[lkml]   [2023]   [Aug]   [14]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: Does srso safe RET mitigation require microcode update?
From
Date
Am 14.08.23 um 12:11 schrieb Borislav Petkov:
> On Mon, Aug 14, 2023 at 11:47:54AM +0200, Rainer Fiebig wrote:
>> "* 'Mitigation: safe RET':
>>
>> Software-only mitigation. It complements the extended IBPB microcode
>> patch functionality by addressing User->Kernel and Guest->Host
>> transitions protection."
>>
>> Now, what does that mean: partial mitigation or also no mitigation
>> without microcode?
>
> It *complements*! Meaning, for a full safe RET mitigation, you need the
> microcode on Zen3/4.
>
> Would that explain it better?
>
> "First of all, it is required that the latest microcode be loaded for
> mitigations to be effective. That means that for the User->User
> aspect of the mitigation to be effective, one needs the updated
> microcode for Zen3 and Zen4 generations. In addition, one needs to
> *enable* the User->User mitigation which is part of the spectre_v2_user
> controls:
>
> - conditional IBPB:
>
> where each process can select whether it needs an IBPB issued around
> it PR_SPEC_DISABLE/_ENABLE etc, see Spectre Side Channels. That is the
> default setting
>
> - strict:
>
> i.e., always on - by supplying spectre_v2_user=on on the kernel
> command line."
>
> IOW, without microcode, you do not mitigate the User->User aspect of the
> mitigation but you mitigate the other vectors with safe RET.
>
OK, thanks. So I think a reasonable approach for ordinary users would
be to update to the latest (LTS-) kernel, use the defaults for the
mitigations and update to the new AGESA when available.

Rainer

\
 
 \ /
  Last update: 2023-08-14 13:23    [W:0.069 / U:0.196 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site