linux-kernel - Re: Does srso safe RET mitigation require microcode update?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <9294eeed-e354-48e3-a0fe-8f917074ef8f@mailbox.org>
Date:   Mon, 14 Aug 2023 13:21:01 +0200
From:   Rainer Fiebig <jrf@...lbox.org>
To:     Borislav Petkov <bp@...en8.de>
Cc:     Xi Ruoyao <xry111@...111.site>, x86@...nel.org,
        linux-kernel@...r.kernel.org, Ken Moffat <zarniwhoop@...world.com>
Subject: Re: Does srso safe RET mitigation require microcode update?

Am 14.08.23 um 12:11 schrieb Borislav Petkov:
> On Mon, Aug 14, 2023 at 11:47:54AM +0200, Rainer Fiebig wrote:
>> "* 'Mitigation: safe RET':
>>
>>    Software-only mitigation. It complements the extended IBPB microcode
>>    patch functionality by addressing User->Kernel and Guest->Host
>>    transitions protection."
>>
>> Now, what does that mean: partial mitigation or also no mitigation
>> without microcode?
> 
> It *complements*! Meaning, for a full safe RET mitigation, you need the
> microcode on Zen3/4.
> 
> Would that explain it better?
> 
> "First of all, it is required that the latest microcode be loaded for
> mitigations to be effective. That means that for the User->User
> aspect of the mitigation to be effective, one needs the updated
> microcode for Zen3 and Zen4 generations. In addition, one needs to
> *enable* the User->User mitigation which is part of the spectre_v2_user
> controls:
> 
>   - conditional IBPB:
> 
>   where each process can select whether it needs an IBPB issued around
>   it PR_SPEC_DISABLE/_ENABLE etc, see Spectre Side Channels. That is the
>   default setting
> 
>   - strict:
> 
>   i.e., always on - by supplying spectre_v2_user=on on the kernel
>   command line."
> 
> IOW, without microcode, you do not mitigate the User->User aspect of the
> mitigation but you mitigate the other vectors with safe RET.
> 
OK, thanks.  So I think a reasonable approach for ordinary users would
be to update to the latest (LTS-) kernel, use the defaults for the
mitigations and update to the new AGESA when available.

Rainer