This is a note to let you know that I've just added the patch titled
x86/srso: Add IBPB
to the 5.15-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
x86-srso-add-ibpb.patch
and it can be found in the queue-5.15 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From b68e2e6932c74a8d467a494691ece4b174d71fdd Mon Sep 17 00:00:00 2001
From: "Borislav Petkov (AMD)" <bp@xxxxxxxxx>
Date: Thu, 6 Jul 2023 15:04:35 +0200
Subject: x86/srso: Add IBPB
From: "Borislav Petkov (AMD)" <bp@xxxxxxxxx>
Upstream commit: 233d6f68b98d480a7c42ebe78c38f79d44741ca9
Add the option to mitigate using IBPB on a kernel entry. Pull in the
Retbleed alternative so that the IBPB call from there can be used. Also,
if Retbleed mitigation is done using IBPB, the same mitigation can and
must be used here.
Signed-off-by: Borislav Petkov (AMD) <bp@xxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
arch/x86/include/asm/nospec-branch.h | 3 ++-
arch/x86/kernel/cpu/bugs.c | 23 +++++++++++++++++++++++
2 files changed, 25 insertions(+), 1 deletion(-)
--- a/arch/x86/include/asm/nospec-branch.h
+++ b/arch/x86/include/asm/nospec-branch.h
@@ -173,7 +173,8 @@
* where we have a stack but before any RET instruction.
*/
.macro UNTRAIN_RET
-#if defined(CONFIG_CPU_UNRET_ENTRY) || defined(CONFIG_CPU_IBPB_ENTRY)
+#if defined(CONFIG_CPU_UNRET_ENTRY) || defined(CONFIG_CPU_IBPB_ENTRY) || \
+ defined(CONFIG_CPU_SRSO)
ANNOTATE_UNRET_END
ALTERNATIVE_2 "", \
CALL_ZEN_UNTRAIN_RET, X86_FEATURE_UNRET, \
--- a/arch/x86/kernel/cpu/bugs.c
+++ b/arch/x86/kernel/cpu/bugs.c
@@ -2315,18 +2315,21 @@ enum srso_mitigation {
SRSO_MITIGATION_NONE,
SRSO_MITIGATION_MICROCODE,
SRSO_MITIGATION_SAFE_RET,
+ SRSO_MITIGATION_IBPB,
};
enum srso_mitigation_cmd {
SRSO_CMD_OFF,
SRSO_CMD_MICROCODE,
SRSO_CMD_SAFE_RET,
+ SRSO_CMD_IBPB,
};
static const char * const srso_strings[] = {
[SRSO_MITIGATION_NONE] = "Vulnerable",
[SRSO_MITIGATION_MICROCODE] = "Mitigation: microcode",
[SRSO_MITIGATION_SAFE_RET] = "Mitigation: safe RET",
+ [SRSO_MITIGATION_IBPB] = "Mitigation: IBPB",
};
static enum srso_mitigation srso_mitigation __ro_after_init = SRSO_MITIGATION_NONE;
@@ -2343,6 +2346,8 @@ static int __init srso_parse_cmdline(cha
srso_cmd = SRSO_CMD_MICROCODE;
else if (!strcmp(str, "safe-ret"))
srso_cmd = SRSO_CMD_SAFE_RET;
+ else if (!strcmp(str, "ibpb"))
+ srso_cmd = SRSO_CMD_IBPB;
else
pr_err("Ignoring unknown SRSO option (%s).", str);
@@ -2384,6 +2389,14 @@ static void __init srso_select_mitigatio
setup_force_cpu_cap(X86_FEATURE_SRSO_NO);
}
+ if (retbleed_mitigation == RETBLEED_MITIGATION_IBPB) {
+ if (has_microcode) {
+ pr_err("Retbleed IBPB mitigation enabled, using same for SRSO\n");
+ srso_mitigation = SRSO_MITIGATION_IBPB;
+ goto pred_cmd;
+ }
+ }
+
switch (srso_cmd) {
case SRSO_CMD_OFF:
return;
@@ -2408,6 +2421,16 @@ static void __init srso_select_mitigatio
}
break;
+ case SRSO_CMD_IBPB:
+ if (IS_ENABLED(CONFIG_CPU_IBPB_ENTRY)) {
+ if (has_microcode) {
+ setup_force_cpu_cap(X86_FEATURE_ENTRY_IBPB);
+ srso_mitigation = SRSO_MITIGATION_IBPB;
+ }
+ } else {
+ pr_err("WARNING: kernel not compiled with CPU_IBPB_ENTRY.\n");
+ goto pred_cmd;
+ }
default:
break;
}
Patches currently in stable-queue which might be from bp@xxxxxxxxx are
queue-5.15/x86-cpu-switch-to-arch_cpu_finalize_init.patch
queue-5.15/x86-srso-add-ibpb_brtype-support.patch
queue-5.15/x86-cpu-kvm-add-support-for-cpuid_80000021_eax.patch
queue-5.15/x86-srso-tie-sbpb-bit-setting-to-microcode-patch-detection.patch
queue-5.15/x86-bugs-increase-the-x86-bugs-vector-size-to-two-u32s.patch
queue-5.15/x86-srso-add-ibpb-on-vmexit.patch
queue-5.15/x86-xen-fix-secondary-processors-fpu-initialization.patch
queue-5.15/x86-srso-add-ibpb.patch
queue-5.15/x86-srso-fix-return-thunks-in-generated-code.patch
queue-5.15/x86-srso-add-a-speculative-ras-overflow-mitigation.patch
queue-5.15/x86-srso-add-srso_no-support.patch
