Re: [coreboot] When does AMD release the fam15 spectre microcode updates?

AMD has at long last coughed up the stuff to the linux-firmware people

https://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git/...

The fam15h microcode update adds IBPB

* Indirect Branch Prediction Barrier (IBPB)
    * PRED_CMD MSR is available:  YES
    * CPU indicates IBPB capability:  YES  (IBPB_SUPPORT feature bit)

The question is what about the other stuff? IBRS, STIBP? This is
confusing due to zero documentation on these updates from amd...Why
don't they have those in this update? Would it be possible to easily add
the support flags without microcode for those who use libreboot?

Would it still be a good idea to add the lfence msr as rmarek mentioned?

As this is all above my pay-grade I would very much appreciate one of
the experts to chime in.

When does AMD release the fam15 spectre microcode updates?

My lord yet another one.
https://www.phoronix.com/scan.php?page=news_item&px=Spectre-V3-V4-Vulner...
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?i...
Now we also seem to need something called SSBD (Speculative Store Bypass
Disable) of which I can't find much information on, does anyone know if
fam15h will receive it? and if the microcode update 0x06000852 I have
posted is the latest one currently in the wild? It only has one of
mitigations whilst AMD's
"Architecture_Guidelines_Update_Indirect_Branch_Control.pdf" seems to
indicate that there are microcode with all three (and now 4) mitigations.

Where can one obtain the microcode with all 4 for fam15h?

When does AMD release the fam15 spectre microcode updates?

[Rudolf Marek]

Hi all,

Dne 22.5.2018 v 07:03 [e-mail] napsal(a):
> AMD has at long last coughed up the stuff to the linux-firmware people
>
> https://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git/...
>
> The fam15h microcode update adds IBPB
>
> * Indirect Branch Prediction Barrier (IBPB)
>     * PRED_CMD MSR is available:  YES
>     * CPU indicates IBPB capability:  YES  (IBPB_SUPPORT feature bit)

For some reason this firmware update deletes microcode for Trinity CPUs, I tried to contact the person who commit this
without any luck. As I have previously written the github page has even newer microcode.
> The question is what about the other stuff? IBRS, STIBP? This is
> confusing due to zero documentation on these updates from amd...Why

Not true, check:
https://developer.amd.com/resources/speculative-execution/

You only need IBPB + retpoline in kernel + RSB clear on CPL switch.
> don't they have those in this update? Would it be possible to easily add
> the support flags without microcode for those who use libreboot?

So libreboot guys don't want any fixes for a CPU?
> Would it still be a good idea to add the lfence msr as rmarek mentioned?

You could, but OS will do that for you (at least Linux). Moreover the Variant 4, can
be mitigated on fam15h by switch off some chicken bits in the CFG_LS see above.

I think I have seen some commit in Linux to do that.

Thanks
Rudolf

When does AMD release the fam15 spectre microcode updates?

[ron minnich]

On Wed, May 23, 2018 at 12:54 PM Rudolf Marek  wrote:
> Hi all,
>
> Dne 22.5.2018 v 07:03 [e-mail] napsal(a):
> > don't they have those in this update? Would it be possible to easily add
> > the support flags without microcode for those who use libreboot?
>
> So libreboot guys don't want any fixes for a CPU?

I've been wondering about this. IIRC the original motivation for the
libreboot fork was microcode.
Is microcode still out of bounds for libreboot?

When does AMD release the fam15 spectre microcode updates?

[Alberto Bursi]

On 22/05/2018 07:03, [e-mail] wrote:
> AMD has at long last coughed up the stuff to the linux-firmware people
>
> https://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git/...
>
> The fam15h microcode update adds IBPB
>
> * Indirect Branch Prediction Barrier (IBPB)
>      * PRED_CMD MSR is available:  YES
>      * CPU indicates IBPB capability:  YES  (IBPB_SUPPORT feature bit)
>
> The question is what about the other stuff? IBRS, STIBP? This is
> confusing due to zero documentation on these updates from amd...Why
> don't they have those in this update? Would it be possible to easily add
> the support flags without microcode for those who use libreboot?

What you mean with "add the support flags without microcode"?

A CPU either supports some instructions (like IBPB) because it actually 
does (i.e. the microcode tells it how to do that), or it does not.

I don't know if you can fake enable these support flags, but I don't 
think it is a good idea at all, at best it would just be a lie, at worst 
it could cause issues (crashing?) if the kernel calls an instruction 
that isn't available (I don't know how that is handled).

-Alberto

When does AMD release the fam15 spectre microcode updates?

[Rudolf Marek]

Hi again,

Dne 23.5.2018 v 21:52 Rudolf Marek napsal(a):
> For some reason this firmware update deletes microcode for Trinity CPUs, I tried to contact the person who commit this
> without any luck. As I have previously written the github page has even newer microcode.

This was fixed, however the old (same) microcode was provided again.

Thanks
Rudolf

When does AMD release the fam15 spectre microcode updates?

[Mike Banon]

Hi Rudolf,

Please could you try contacting this AMD person again, regarding the
problems with this recent microcode update? Because it looks like he
noticed your messages since he at least tried to fix, but haven't
noticed mine for some reason (regarding the lack of updated 16h
microcode; why only 15h and 17h are being updated while 16h is
forgotten - I could not understand, and this is relevant since there
are some coreboot-supporting 16h boards)

Best regards,
Mike Banon

On Sat, May 26, 2018 at 7:13 PM, Rudolf Marek  wrote:
> Hi again,
>
> Dne 23.5.2018 v 21:52 Rudolf Marek napsal(a):
> > For some reason this firmware update deletes microcode for Trinity CPUs, I tried to contact the person who commit this
> > without any luck. As I have previously written the github page has even newer microcode.
>
> This was fixed, however the old (same) microcode was provided again.
>
> Thanks
> Rudolf