Control for Special Register Buffer Data Sampling mitigation.

[kib]

Summary

New microcode update for Intel enables mitigation for SRBDS, which slows down RDSEED and related instructions. The update also provides a control to limit the mitigation to SGX enclaves, which should restore the speed of random generator by the cost of potential cross-core bufer sampling.

See https://software.intel.com/security-software-guidance/insights/deep-dive-special-register-buffer-data-sampling

GIve the user control over it.

[markj]

sys/amd64/amd64/machdep.c

1794 ↗

(On Diff #72954)

Loading into the wrong variable here.

[kib]

Fix variable for tunable fetch.

[kib]

Display MCUOPT bit in features3.

[markj]

sys/x86/x86/cpu_machdep.c

1407 ↗

(On Diff #72957)

Maybe call it "RDSEED SRBDS mitigation"?

1409 ↗

(On Diff #72957)

Is this the proposed default? I was under the impression that the kernel PRNG mixes several entropy sources, including that of RDRAND, and the Intel doc suggests that the mitigation is not necessary in that case.

1411 ↗

(On Diff #72957)

Why does it need to be an external parameter? Can't we just use smp_started to determine whether to signal remote CPUs?

1438 ↗

(On Diff #72957)

So mitigations.rngds.enable=0 means that the mitigation is enabled? That seems confusing. Shouldn't the sense be reversed?

1440 ↗

(On Diff #72957)

Extra newline.

[kib]

sys/x86/x86/cpu_machdep.c

1409 ↗

(On Diff #72957)

Answering both this and a proposal to call it "RDSEED SRBDS mitigation". We are probably somewhat fine in kernel, but usermode can use RDSEED/RDRAND, and same for any OS that is run inside VMM. So the Intel' decision to have the mitigation enabled by default makes sense.

The knob actually controls the optimization of access to MCU, which explains why it is called 'enable'. It enables faster RDSEED (I saw numbers like 3% of the previous performance in microbenchmark after new microcode is loaded).

1411 ↗

(On Diff #72957)

May be, but there are more _recalculate() around, and this instance is consistent with other code. If changing, I will consider doing single pass over all of it.

1438 ↗

(On Diff #72957)

It means that the optimization is enabled.

[markj]

sys/x86/x86/cpu_machdep.c

1411 ↗

(On Diff #72957)

Ok.

1414 ↗

(On Diff #72957)

According to the doc, the mitigation can be disabled in some cases if TSX is disabled.

1438 ↗

(On Diff #72957)

But the sysctl name contains "mitigation", so it sounds like "enable" applies to the mitigation, not the optimization. As I understand, the optimization is simply "disable the mitigation".

[kib]

sys/x86/x86/cpu_machdep.c

1414 ↗

(On Diff #72957)

And MDS_NO. I did not wanted to do that, and still do not want. We slowly make the mitigation sysctls into the spreadsheet with formulas. I want to keep it simpler, user can decide himself.

1438 ↗

(On Diff #72957)

Ok, I reverted this.

[kib]

disable->enable, default to 1 (enable)

[markj]

share/man/man7/security.7

1048 ↗

(On Diff #72997)

In addition, RDSEED makes concurrent off-core memory accesses more expensive. Something like "the RDSEED and RDRAND instructions do not incur serialization overhead for shared buffer accesses and do not serialize off-core memory accessses" might be clearer IMO.

sys/x86/x86/cpu_machdep.c

1448 ↗

(On Diff #72997)

Should it be "RDSEED"?

[kib]

Fix RDRAND spelling.
Update language in the man page.