Messages in this thread | | | Subject | Re: Does srso safe RET mitigation require microcode update? | From | Rainer Fiebig <> | Date | Mon, 14 Aug 2023 13:21:01 +0200 |
| |
Am 14.08.23 um 12:11 schrieb Borislav Petkov: > On Mon, Aug 14, 2023 at 11:47:54AM +0200, Rainer Fiebig wrote: >> "* 'Mitigation: safe RET': >> >> Software-only mitigation. It complements the extended IBPB microcode >> patch functionality by addressing User->Kernel and Guest->Host >> transitions protection." >> >> Now, what does that mean: partial mitigation or also no mitigation >> without microcode? > > It *complements*! Meaning, for a full safe RET mitigation, you need the > microcode on Zen3/4. > > Would that explain it better? > > "First of all, it is required that the latest microcode be loaded for > mitigations to be effective. That means that for the User->User > aspect of the mitigation to be effective, one needs the updated > microcode for Zen3 and Zen4 generations. In addition, one needs to > *enable* the User->User mitigation which is part of the spectre_v2_user > controls: > > - conditional IBPB: > > where each process can select whether it needs an IBPB issued around > it PR_SPEC_DISABLE/_ENABLE etc, see Spectre Side Channels. That is the > default setting > > - strict: > > i.e., always on - by supplying spectre_v2_user=on on the kernel > command line." > > IOW, without microcode, you do not mitigate the User->User aspect of the > mitigation but you mitigate the other vectors with safe RET. > OK, thanks. So I think a reasonable approach for ordinary users would be to update to the latest (LTS-) kernel, use the defaults for the mitigations and update to the new AGESA when available.
Rainer
| |