Linux 7.4 Brings AMD Zen 6 BTB Context Isolation

A fresh batch of AMD Zen 6 patches is lining up for the Linux 7.4 kernel, and among them is support for a new hardware defense called Branch Target Buffer Context Isolation — BTB CTX Isolation for short.

Hardware takes over from a software fix

The feature targets SRSO, the Speculative Return Stack Overflow vulnerability that affected AMD chips from Zen 1 through Zen 4. The idea behind the new defense is that the silicon itself isolates the different execution contexts from one another — user from kernel, guest from host.

As a result, Zen 6 no longer needs the old software-based SRSO mitigation known as SafeRET. In other words, what the kernel previously had to handle in code is now taken care of by the processor itself.

What the kernel still handles

The hardware isolation does not replace every software measure, though. The user-versus-user and guest-versus-guest attack vectors remain open, and those are still covered by the Spectre v2 mitigation, which issues an IBPB (branch predictor flush) on a context switch.

The patch, already sitting in the x86/bugs branch of the tip/tip.git tree, teaches the kernel to detect this configuration and report it with a new, dedicated mitigation status string — so users can see exactly which protection is in effect.

A big release for Zen 6

Linux 7.4 is shaping up to be an important kernel for Zen 6 enablement overall. The client side is especially active, with a number of patches arriving for desktop Ryzen parts. On the server side, the sixth-generation EPYC "Venice" line has already been getting work over several kernel cycles.

The Linux 7.4 merge window opens later this month, and the BTB CTX Isolation patch is expected to make it into that release.

Source: Phoronix