Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Date:   Mon, 14 Aug 2023 12:11:34 +0200
From:   Borislav Petkov <bp@alien8.de>
To:     Rainer Fiebig <jrf@mailbox.org>
Cc:     Xi Ruoyao <xry111@xry111.site>, x86@kernel.org,
        linux-kernel@vger.kernel.org
Subject: Re: Does srso safe RET mitigation require microcode update?
Message-ID: <20230814101134.GBZNn91uTmNImxRDXr@fat_crate.local>
References: <79c179acaa6ec4e1cf112ae2dfce8370694a5089.camel@xry111.site>
 <20230814091012.GAZNnvdD6JX/4E679D@fat_crate.local>
 <0338eb8b-6b60-313c-e6eb-faca071c5227@mailbox.org>
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
In-Reply-To: <0338eb8b-6b60-313c-e6eb-faca071c5227@mailbox.org>
Precedence: bulk

On Mon, Aug 14, 2023 at 11:47:54AM +0200, Rainer Fiebig wrote:
> "* 'Mitigation: safe RET':
>
>    Software-only mitigation. It complements the extended IBPB microcode
>    patch functionality by addressing User->Kernel and Guest->Host
>    transitions protection."
>
> Now, what does that mean: partial mitigation or also no mitigation
> without microcode?

It *complements*! Meaning, for a full safe RET mitigation, you need the
microcode on Zen3/4.

Would that explain it better?

"First of all, it is required that the latest microcode be loaded for
mitigations to be effective. That means that for the User->User
aspect of the mitigation to be effective, one needs the updated
microcode for Zen3 and Zen4 generations. In addition, one needs to
*enable* the User->User mitigation which is part of the spectre_v2_user
controls:

  - conditional IBPB:

  where each process can select whether it needs an IBPB issued around
  it PR_SPEC_DISABLE/_ENABLE etc, see Spectre Side Channels. That is the
  default setting

  - strict:

  i.e., always on - by supplying spectre_v2_user=on on the kernel
  command line."

IOW, without microcode, you do not mitigate the User->User aspect of the
mitigation but you mitigate the other vectors with safe RET.

-- 
Regards/Gruss,
    Boris.

https://people.kernel.org/tglx/notes-about-netiquette