<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal">Hi,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><a href="https://packages.debian.org/sid/amd64-microcode">https://packages.debian.org/sid/amd64-microcode</a> has IBPB according to
<a href="https://packages.qa.debian.org/a/amd64-microcode/news/20180110T100416Z.html">
https://packages.qa.debian.org/a/amd64-microcode/news/20180110T100416Z.html</a> .<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><a name="_MailEndCompose"><o:p> </o:p></a></p>
<span style="mso-bookmark:_MailEndCompose"></span>
<p class="MsoNormal"><b>From:</b> Users [mailto:users-bounces@dragonflybsd.org] <b>
On Behalf Of </b>Matthew Dillon<br>
<b>Sent:</b> Thursday, January 11, 2018 6:16 AM<br>
<b>To:</b> users@dragonflybsd.org<br>
<b>Subject:</b> master now has full ibrs and ibpb support - notes<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">Hey everyone. Ok, DFly master now has full ibrs and ibpb support. If your system has a microcode that supports it, or you load a new microcode that supports it, master will default to IBRS mode 1 operation.<o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">IBRS mode 1 operation will protect the kernel (even without the kernel having RetPoline), and will also protect between user contexts, but will not protect attacks within the same user context (such as a browser Javascript attack against
the browser itself). For that I point people to our chrome wiki page with instructions on how to do multi-layered protection of the chrome browser.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><a href="https://www.dragonflybsd.org/docs/docs/handbook/RunSecureBrowser/">https://www.dragonflybsd.org/docs/docs/handbook/RunSecureBrowser/</a><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">If you want to run IBRS in mode 2 you can, but it won't add a whole lot to the mode 1 protections and it comes at a high cost. Essentially IBRS mode 2 is designed for future chipsets and microcodes which will have a new IBRS but which
can just be set and forgotten. The current mode 2 operation still requires that the kernel issue a wrmsr for IBRS on every user->kernel transition.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">IBPB is primarily designed to solve certain hardware virtualization issues and is not needed for user->kernel transitions when IBRS is enabled, so we recommennd leaving IBPB mode turned off. This also requires a microcode update that supports
it. Eventually IBPB on future processors may wind up being faster than IBRS as IBPB imposes a strict barrier and the cpu runs at full speed before and after. But right now the microcode IBPB implementations have a 2uS (2000nS) latency associated with them,
so IBRS mode 1 is typically faster.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Most BIOS vendors do NOT yet have microcode updates. Intel has microcode updates but they haven't been integrated into our devcpu-data package yet and it takes a small bit of effort to translate the intel-supplied microcode to the .fw
format that cpucontrol needs. But I expect this will change soon.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">--<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">We do not have AMD support yet, because there are no publically available AMD microcodes for Ryzen that I can find to test with which have these features. AMD is generally less vulnerable and will likely use IBRS=0 IBPB=1. I do not know
what the AMD IBPB is going to cost us, yet, though.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">--<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">I have included a general loss-of-performance matrix below so people can get an idea of the cost. I have included MMU isolation overheads assuming 4% overhead for Haswell and 2% overhead for Skylake and Kabylake for MMU isolation. This
loss matrix is based on a time make -j 8 nativekernel NO_MODULES=TRUE, which is a good concurrent compile test. A very general case. Obviously different workloads are going to have wildly different performance loss figures, but this matrix will give you
a pretty good idea at what the cost is.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">These tests are just with CPUs I have handy and by no means complete.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<div>
<p class="MsoNormal"> Performance Loss Matrix<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> Using Highly concurrent compile test case<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> INCLUDING MMU ISOLATION<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> HASWELL SKYLAKE KABYLAKE-U<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> IBPB=0 IBPB=1 IBPB=0 IBPB=1 IBPB=0 IBPB=1<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">IBRS=0 4% 16% 2% 19% 2% 19%<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">IBRS=1 16% 25% 4.4% 17% 4.0% 20%<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">IBRS=2 62% 64% 25% 34% 21% 31%<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
<div>
<p class="MsoNormal">Keeping in mind that the default setting will be IBRS=1 IBPB=0. As you can see, older CPUs such as Haswell are the most impacted, while more recent CPUs are far less impacted.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">--<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">In DragonFlyBSD master, the machdep.spectre_mitigation sysctl can be used (if the microcode supports it) to set the mode of operation at any time.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">mode<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">0 IBRS=0 IBPB=0<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">1 IBRS=1 IBPB=0<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">2 IBRS=2 IBPB=0<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">4 IBRS=0 IBPB=1<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">5 IBRS=1 IBPB=1<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">6 IBRS=2 IBPB=1<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">And the machdep.meltdown_mitigation sysctl can turn on/off MMU isolation (0=OFF, 1=ON), default will be on for Intel CPUs and off for AMD CPUs for now.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">-Matt<o:p></o:p></p>
</div>
</div>
</div>
</body>
</html>