This is a note to let you know that I've just added the patch titled
x86/srso: Add IBPB_BRTYPE support
to the 5.15-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
x86-srso-add-ibpb_brtype-support.patch
and it can be found in the queue-5.15 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From a7ff37a3eec5020f9750360f956240baea4f0ef1 Mon Sep 17 00:00:00 2001
From: "Borislav Petkov (AMD)" <bp@xxxxxxxxx>
Date: Tue, 18 Jul 2023 11:13:40 +0200
Subject: x86/srso: Add IBPB_BRTYPE support
From: "Borislav Petkov (AMD)" <bp@xxxxxxxxx>
Upstream commit: 79113e4060aba744787a81edb9014f2865193854
Add support for the synthetic CPUID flag which "if this bit is 1,
it indicates that MSR 49h (PRED_CMD) bit 0 (IBPB) flushes all branch
type predictions from the CPU branch predictor."
This flag is there so that this capability in guests can be detected
easily (otherwise one would have to track microcode revisions which is
impossible for guests).
It is also needed only for Zen3 and -4. The other two (Zen1 and -2)
always flush branch type predictions by default.
Signed-off-by: Borislav Petkov (AMD) <bp@xxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
arch/x86/include/asm/cpufeatures.h | 2 ++
arch/x86/kernel/cpu/bugs.c | 12 +++++++++++-
2 files changed, 13 insertions(+), 1 deletion(-)
--- a/arch/x86/include/asm/cpufeatures.h
+++ b/arch/x86/include/asm/cpufeatures.h
@@ -415,6 +415,8 @@
#define X86_FEATURE_SEV_ES (19*32+ 3) /* AMD Secure Encrypted Virtualization - Encrypted State */
#define X86_FEATURE_SME_COHERENT (19*32+10) /* "" AMD hardware-enforced cache coherency */
+#define X86_FEATURE_IBPB_BRTYPE (20*32+28) /* "" MSR_PRED_CMD[IBPB] flushes all branch type predictions */
+
/*
* BUG word(s)
*/
--- a/arch/x86/kernel/cpu/bugs.c
+++ b/arch/x86/kernel/cpu/bugs.c
@@ -2356,10 +2356,20 @@ static void __init srso_select_mitigatio
if (!boot_cpu_has_bug(X86_BUG_SRSO) || cpu_mitigations_off())
return;
- has_microcode = cpu_has_ibpb_brtype_microcode();
+ /*
+ * The first check is for the kernel running as a guest in order
+ * for guests to verify whether IBPB is a viable mitigation.
+ */
+ has_microcode = boot_cpu_has(X86_FEATURE_IBPB_BRTYPE) || cpu_has_ibpb_brtype_microcode();
if (!has_microcode) {
pr_warn("IBPB-extending microcode not applied!\n");
pr_warn(SRSO_NOTICE);
+ } else {
+ /*
+ * Enable the synthetic (even if in a real CPUID leaf)
+ * flag for guests.
+ */
+ setup_force_cpu_cap(X86_FEATURE_IBPB_BRTYPE);
}
switch (srso_cmd) {
Patches currently in stable-queue which might be from bp@xxxxxxxxx are
queue-5.15/x86-cpu-switch-to-arch_cpu_finalize_init.patch
queue-5.15/x86-srso-add-ibpb_brtype-support.patch
queue-5.15/x86-cpu-kvm-add-support-for-cpuid_80000021_eax.patch
queue-5.15/x86-srso-tie-sbpb-bit-setting-to-microcode-patch-detection.patch
queue-5.15/x86-bugs-increase-the-x86-bugs-vector-size-to-two-u32s.patch
queue-5.15/x86-srso-add-ibpb-on-vmexit.patch
queue-5.15/x86-xen-fix-secondary-processors-fpu-initialization.patch
queue-5.15/x86-srso-add-ibpb.patch
queue-5.15/x86-srso-fix-return-thunks-in-generated-code.patch
queue-5.15/x86-srso-add-a-speculative-ras-overflow-mitigation.patch
queue-5.15/x86-srso-add-srso_no-support.patch
