dsanchez/spectre-meltdown-checker
1
0
Fork 0
mirror of https://github.com/speed47/spectre-meltdown-checker synced 2025-01-03 01:55:51 +01:00
Code Issues Releases Wiki Activity

Explain that Enhanced IBRS is better for performance than classic IBRS

Browse Source
This commit is contained in:
Stéphane Lesimple 2019-08-14 12:42:27 +02:00
parent 482d6c200a
commit f835f4d07d
1 changed files with 13 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

27
spectre-meltdown-checker.sh
View File

@ -2939,8 +2939,6 @@ check_CVE_2017_5715_linux()
ibpb_can_tell=0 ibpb_can_tell=0
ibpb_supported='' ibpb_supported=''
ibpb_enabled='' ibpb_enabled=''
need_enhanced_ibrs=0
enhanced_ibrs=''
if [ "$opt_live" = 1 ]; then if [ "$opt_live" = 1 ]; then
# in live mode, we can check for the ibrs_enabled file in debugfs # in live mode, we can check for the ibrs_enabled file in debugfs
@ -3001,15 +2999,19 @@ check_CVE_2017_5715_linux()
ibrs_fw_enabled=1 ibrs_fw_enabled=1
fi fi
# when IBRS is enabled on 4.15+, we can see it in sysfs # when IBRS is enabled on 4.15+, we can see it in sysfs
# on a more recent kernel, classic "IBRS" is not even longer an option, because of the performance impact.
# only "Enhanced IBRS" is available (on CPUs with the IBRS_ALL flag)
if echo "$fullmsg" | grep -q -e '\<IBRS\>' -e 'Indirect Branch Restricted Speculation'; then if echo "$fullmsg" | grep -q -e '\<IBRS\>' -e 'Indirect Branch Restricted Speculation'; then
_debug "ibrs: found IBRS in sysfs" _debug "ibrs: found IBRS in sysfs"
[ -z "$ibrs_supported" ] && ibrs_supported='found IBRS in sysfs' [ -z "$ibrs_supported" ] && ibrs_supported='found IBRS in sysfs'
[ -z "$ibrs_enabled" ] && ibrs_enabled=3 [ -z "$ibrs_enabled" ] && ibrs_enabled=3
fi fi
# checking for 'Enhanced IBRS' in sysfs # checking for 'Enhanced IBRS' in sysfs, enabled on CPUs with IBRS_ALL
if echo "$fullmsg" | grep -q -e 'Enhanced IBRS'; then if echo "$fullmsg" | grep -q -e 'Enhanced IBRS'; then
need_enhanced_ibrs=1 [ -z "$ibrs_supported" ] && ibrs_supported='found Enhanced IBRS in sysfs'
enhanced_ibrs="Enhanced" # 4 isn't actually a valid value of the now extinct "ibrs_enabled" flag file,
# that only went from 0 to 3, so we use 4 as "enhanced ibrs is enabled"
ibrs_enabled=4
fi fi
fi fi
# in live mode, if ibrs or ibpb is supported and we didn't find these are enabled, then they are not # in live mode, if ibrs or ibpb is supported and we didn't find these are enabled, then they are not
@ -3056,7 +3058,7 @@ check_CVE_2017_5715_linux()
fi fi
fi fi
fi fi
_info_nol " * Kernel is compiled with IBRS support: " _info_nol " * Kernel is compiled with IBRS support: "
if [ -z "$ibrs_supported" ]; then if [ -z "$ibrs_supported" ]; then
if [ "$ibrs_can_tell" = 1 ]; then if [ "$ibrs_can_tell" = 1 ]; then
@ -3073,11 +3075,7 @@ check_CVE_2017_5715_linux()
fi fi
fi fi
if [ "$need_enhanced_ibrs" = 1 ]; then _info_nol " * IBRS enabled and active: "
_info_nol " * $enhanced_ibrs IBRS enabled and active: "
else
_info_nol " * IBRS enabled and active: "
fi
if [ "$opt_live" = 1 ]; then if [ "$opt_live" = 1 ]; then
if [ "$ibpb_enabled" = 2 ]; then if [ "$ibpb_enabled" = 2 ]; then
# if ibpb=2, ibrs is forcefully=0 # if ibpb=2, ibrs is forcefully=0
@ -3087,6 +3085,7 @@ check_CVE_2017_5715_linux()
# 1 is enabled only for kernel space # 1 is enabled only for kernel space
# 2 is enabled for kernel and user space # 2 is enabled for kernel and user space
# 3 is enabled # 3 is enabled
# 4 is enhanced ibrs enabled
case "$ibrs_enabled" in case "$ibrs_enabled" in
0) 0)
if [ "$ibrs_fw_enabled" = 1 ]; then if [ "$ibrs_fw_enabled" = 1 ]; then
@ -3098,6 +3097,7 @@ check_CVE_2017_5715_linux()
1) if [ "$ibrs_fw_enabled" = 1 ]; then pstatus green YES "for kernel space and firmware code"; else pstatus green YES "for kernel space"; fi;; 1) if [ "$ibrs_fw_enabled" = 1 ]; then pstatus green YES "for kernel space and firmware code"; else pstatus green YES "for kernel space"; fi;;
2) if [ "$ibrs_fw_enabled" = 1 ]; then pstatus green YES "for kernel, user space, and firmware code" ; else pstatus green YES "for both kernel and user space"; fi;; 2) if [ "$ibrs_fw_enabled" = 1 ]; then pstatus green YES "for kernel, user space, and firmware code" ; else pstatus green YES "for both kernel and user space"; fi;;
3) if [ "$ibrs_fw_enabled" = 1 ]; then pstatus green YES "for kernel and firmware code"; else pstatus green YES; fi;; 3) if [ "$ibrs_fw_enabled" = 1 ]; then pstatus green YES "for kernel and firmware code"; else pstatus green YES; fi;;
4) pstatus green YES "Enhanced flavor, performance impact will be greatly reduced";;
*) if [ "$cpuid_ibrs" != 'SPEC_CTRL' ] && [ "$cpuid_ibrs" != 'IBRS_SUPPORT' ] && [ "$cpuid_spec_ctrl" != -1 ]; *) if [ "$cpuid_ibrs" != 'SPEC_CTRL' ] && [ "$cpuid_ibrs" != 'IBRS_SUPPORT' ] && [ "$cpuid_spec_ctrl" != -1 ];
then pstatus yellow NO; _debug "ibrs: known cpu not supporting SPEC-CTRL or IBRS"; then pstatus yellow NO; _debug "ibrs: known cpu not supporting SPEC-CTRL or IBRS";
else else
@ -3308,9 +3308,8 @@ check_CVE_2017_5715_linux()
_warn "IBPB is considered as a good addition to retpoline for Variant 2 mitigation, but your CPU microcode doesn't support it" _warn "IBPB is considered as a good addition to retpoline for Variant 2 mitigation, but your CPU microcode doesn't support it"
fi fi
elif [ -n "$ibrs_enabled" ] && [ -n "$ibpb_enabled" ] && [ "$ibrs_enabled" -ge 1 ] && [ "$ibpb_enabled" -ge 1 ]; then elif [ -n "$ibrs_enabled" ] && [ -n "$ibpb_enabled" ] && [ "$ibrs_enabled" -ge 1 ] && [ "$ibpb_enabled" -ge 1 ]; then
pvulnstatus $cve OK "IBRS + IBPB are mitigating the vulnerability" if [ "$ibrs_enabled" = 4 ]; then
if [ "$need_enhanced_ibrs" = 1 ]; then pvulnstatus $cve OK "Enhanced IBRS + IBPB are mitigating the vulnerability"
pvulnstatus $cve OK "$enhanced_ibrs IBRS + IBPB are mitigating the vulnerability"
else else
pvulnstatus $cve OK "IBRS + IBPB are mitigating the vulnerability" pvulnstatus $cve OK "IBRS + IBPB are mitigating the vulnerability"
fi fi