mirror of
git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
synced 2025-08-05 16:54:27 +00:00
3ebc170068
jmp2ret mitigates the easy-to-attack case at relatively low overhead. It mitigates the long speculation windows after a mispredicted RET, but it does not mitigate the short speculation window from arbitrary instruction boundaries. On Zen2, there is a chicken bit which needs setting, which mitigates "arbitrary instruction boundaries" down to just "basic block boundaries". But there is no fix for the short speculation window on basic block boundaries, other than to flush the entire BTB to evict all attacker predictions. On the spectrum of "fast & blurry" -> "safe", there is (on top of STIBP or no-SMT): 1) Nothing System wide open 2) jmp2ret May stop a script kiddy 3) jmp2ret+chickenbit Raises the bar rather further 4) IBPB Only thing which can count as "safe". Tentative numbers put IBPB-on-entry at a 2.5x hit on Zen2, and a 10x hit on Zen1 according to lmbench. [ bp: Fixup feature bit comments, document option, 32-bit build fix. ] Suggested-by: Andrew Cooper <Andrew.Cooper3@citrix.com> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Signed-off-by: Borislav Petkov <bp@suse.de> Reviewed-by: Josh Poimboeuf <jpoimboe@kernel.org> Signed-off-by: Borislav Petkov <bp@suse.de> |
||
|---|---|---|
| .. | ||
| mce | ||
| microcode | ||
| mtrr | ||
| resctrl | ||
| sgx | ||
| .gitignore | ||
| acrn.c | ||
| amd.c | ||
| aperfmperf.c | ||
| bugs.c | ||
| cacheinfo.c | ||
| centaur.c | ||
| common.c | ||
| cpu.h | ||
| cpuid-deps.c | ||
| cyrix.c | ||
| feat_ctl.c | ||
| hygon.c | ||
| hypervisor.c | ||
| intel.c | ||
| intel_epb.c | ||
| intel_pconfig.c | ||
| Makefile | ||
| match.c | ||
| mkcapflags.sh | ||
| mshyperv.c | ||
| perfctr-watchdog.c | ||
| powerflags.c | ||
| proc.c | ||
| rdrand.c | ||
| scattered.c | ||
| topology.c | ||
| transmeta.c | ||
| tsx.c | ||
| umc.c | ||
| umwait.c | ||
| vmware.c | ||
| vortex.c | ||
| zhaoxin.c | ||