Commit c5f1e32e authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'x86-urgent-2022-08-13' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 

Pull x86 fix from Ingo Molnar:
 "Fix the 'IBPB mitigated RETBleed' mode of operation on AMD CPUs (not
  turned on by default), which also need STIBP enabled (if available) to
  be '100% safe' on even the shortest speculation windows"

* tag 'x86-urgent-2022-08-13' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  x86/bugs: Enable STIBP for IBPB mitigated RETBleed
parents 04734361 e6cfcdda

Documentation/admin-guide/kernel-parameters.txt

+21 −8
Original line number Diff line number Diff line
@@ -5274,20 +5274,33 @@ 
			Speculative Code Execution with Return Instructions)

			vulnerability.



			AMD-based UNRET and IBPB mitigations alone do not stop

			sibling threads from influencing the predictions of other

			sibling threads. For that reason, STIBP is used on pro-

			cessors that support it, and mitigate SMT on processors

			that don't.



			off          - no mitigation

			auto         - automatically select a migitation

			auto,nosmt   - automatically select a mitigation,

				       disabling SMT if necessary for

				       the full mitigation (only on Zen1

				       and older without STIBP).

			ibpb	     - mitigate short speculation windows on

				       basic block boundaries too. Safe, highest

				       perf impact.

			unret        - force enable untrained return thunks,

				       only effective on AMD f15h-f17h

				       based systems.

			unret,nosmt  - like unret, will disable SMT when STIBP

			               is not available.

			ibpb         - On AMD, mitigate short speculation

				       windows on basic block boundaries too.

				       Safe, highest perf impact. It also

				       enables STIBP if present. Not suitable

				       on Intel.

			ibpb,nosmt   - Like "ibpb" above but will disable SMT

				       when STIBP is not available. This is

				       the alternative for systems which do not

				       have STIBP.

			unret        - Force enable untrained return thunks,

				       only effective on AMD f15h-f17h based

				       systems.

			unret,nosmt  - Like unret, but will disable SMT when STIBP

				       is not available. This is the alternative for

				       systems which do not have STIBP.



			Selecting 'auto' will choose a mitigation method at run

			time according to the CPU.

arch/x86/kernel/cpu/bugs.c

+6 −4
Original line number Diff line number Diff line
@@ -152,7 +152,7 @@ void __init check_bugs(void) 
	/*

	 * spectre_v2_user_select_mitigation() relies on the state set by

	 * retbleed_select_mitigation(); specifically the STIBP selection is

	 * forced for UNRET.

	 * forced for UNRET or IBPB.

	 */

	spectre_v2_user_select_mitigation();

	ssb_select_mitigation();
@@ -1179,7 +1179,8 @@ spectre_v2_user_select_mitigation(void) 
	    boot_cpu_has(X86_FEATURE_AMD_STIBP_ALWAYS_ON))

		mode = SPECTRE_V2_USER_STRICT_PREFERRED;



	if (retbleed_mitigation == RETBLEED_MITIGATION_UNRET) {

	if (retbleed_mitigation == RETBLEED_MITIGATION_UNRET ||

	    retbleed_mitigation == RETBLEED_MITIGATION_IBPB) {

		if (mode != SPECTRE_V2_USER_STRICT &&

		    mode != SPECTRE_V2_USER_STRICT_PREFERRED)

			pr_info("Selecting STIBP always-on mode to complement retbleed mitigation\n");
@@ -2360,10 +2361,11 @@ static ssize_t srbds_show_state(char *buf) 


static ssize_t retbleed_show_state(char *buf)

{

	if (retbleed_mitigation == RETBLEED_MITIGATION_UNRET) {

	if (retbleed_mitigation == RETBLEED_MITIGATION_UNRET ||

	    retbleed_mitigation == RETBLEED_MITIGATION_IBPB) {

	    if (boot_cpu_data.x86_vendor != X86_VENDOR_AMD &&

		boot_cpu_data.x86_vendor != X86_VENDOR_HYGON)

		    return sprintf(buf, "Vulnerable: untrained return thunk on non-Zen uarch\n");

		    return sprintf(buf, "Vulnerable: untrained return thunk / IBPB on non-AMD based uarch\n");



	    return sprintf(buf, "%s; SMT %s\n",

			   retbleed_strings[retbleed_mitigation],