Giters

google / security-research

This project hosts security advisories and their accompanying proof-of-concepts related to research conducted at Google which impact non-Google owned code.

Home Page:https://www.google.com/about/appsecurity/

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

zenbleed "chicken bit" mitigation errata; "modprobe msr"

vielmetti opened this issue · comments

commented

Referencing @taviso post about ZenBleed at https://lock.cmpxchg8b.com/zenbleed.html :

First, thanks for an excellent explanation. I was able to reproduce the problem on an "AMD EPYC 7402P 24-Core" system.

Second, the "chicken bit" mitigation worked on this system under Ubuntu 22.04 LTS, but required these extra steps

apt install msr-tools
modprobe msr 
wrmsr -a 0xc0011029 $(($(rdmsr -c 0xc0011029) | (1<<9)))

Without the modprobe you get a weird error message from the shell when wrmsr tries to
interpret the rdmsr: open: No such file or directory error described in the rdmsr(1)
man page.

commented

Also, if you want to toggle this mitigation, you can do

wrmsr -a 0xc0011029 $(($(rdmsr -c 0xc0011029) ^ (1<<9)))

(replace the | with a ^ in the provided command).

commented

Hi,
Is bit 9 of DE_CFG register available only since microcode patch ?
I have searched among Zen PPR(s) and previous Gen datasheets and found no specification of such bit.
Thks

commented

Without the modprobe you get a weird error message from the shell

Hmm thanks, I'll clarify the documentation. I thought module autoload would take care it.

Hi, Is bit 9 of DE_CFG register available only since microcode patch ?

You only need to use it if you cant apply the patch. If you have the update, then you don't need to be concerned.

I have searched among Zen PPR(s) and previous Gen datasheets and found no specification of such bit. Thks

This is normal, they are not usually documented until needed.

commented

Strangely, the performance of the vzeroupper instruction itself seems to be little affected by this chicken bit.
If it is free to disclosure, could you please explain what does MSRC001_1029[9] actually does? Thanks.

commented

Sorry, only AMD can answer that question - you know as much as we do!

commented

Sorry, only AMD can answer that question - you know as much as we do!

I believe Manufacturer answer is MSR_AMD64_DE_CFG_ZEN2_FP_BACKUP_FIX_BIT which seems to be per CPU for an overall effect. But not clear if per logical (SMT) or per physical Core

EDIT: Scope is per physical Core

wrmsr -p 15 0xc0011029 0x3000310e08003

3000310e08202
3000310e08202
3000310e08202
3000310e08202
3000310e08202
3000310e08202
3000310e08202
3000310e08202
3000310e08202
3000310e08202
3000310e08202
3000310e08202
3000310e08202
3000310e08202
3000310e08202
3000310e08002
3000310e08203
3000310e08203
3000310e08203
3000310e08203
3000310e08203
3000310e08203
3000310e08203
3000310e08203
3000310e08203
3000310e08203
3000310e08203
3000310e08203
3000310e08203
3000310e08203
3000310e08203
3000310e08003
commented

Hey! I am closing this issue, feel free to re-open if there is anything actionable. Thanks!