Linux 7.4 enables optimized security mitigations for AMD Zen 6
Key Takeaway
Linux 7.4 will use AMD Zen 6's new BTB CTX isolation to replace the more performance-heavy SRSO SafeRET mitigation.
Summary
The x86/bugs pull request merged for the Linux 7.4 kernel introduces optimized CPU security handling for AMD Zen 6 processors. By utilizing the new BTB CTX isolation feature, the kernel can safely disable the more performance-intensive SRSO SafeRET mitigation. This change aims to reduce the security-related performance overhead on Zen 6 hardware.
Optimizing Zen 6 security
- AMD Zen 6 introduces BTB CTX isolation, which provides per-context tagging for the Branch Target Buffer to separate user/kernel and guest/host contexts.
- This hardware feature allows the kernel to bypass the SRSO SafeRET (Speculative Return Stack Overflow) mitigation.
- The update also includes a fix for Spectre v2 mitigation reporting in builds where RETPOLINE=n.
Why it matters
Users of AMD Zen 6 hardware can expect better system performance under the Linux 7.4 kernel due to more efficient security mitigation handling.
Original reference: www.phoronix.com →