From: Sasha Levin <sashal@kernel.org>
To: stable@vger.kernel.org
Cc: Patrick Bellasi <derkling@google.com>, Sasha Levin <sashal@kernel.org>
Subject: Re: [PATCH 6.6] x86/cpu/kvm: SRSO: Fix possible missing IBPB on VM-Exit
Date: Sat, 22 Feb 2025 10:53:47 -0500 [thread overview]
Message-ID: <20250221203055-b786f70fab651df1@stable.kernel.org> (raw)
In-Reply-To: <20250221142002.4136456-1-derkling@google.com>
[ Sasha's backport helper bot ]
Hi,
✅ All tests passed successfully. No issues detected.
No action required from the submitter.
The upstream commit SHA1 provided is correct: 318e8c339c9a0891c389298bb328ed0762a9935e
Note: The patch differs from the upstream commit:
---
1: 318e8c339c9a0 ! 1: 7e78323cfe696 x86/cpu/kvm: SRSO: Fix possible missing IBPB on VM-Exit
@@ Metadata
## Commit message ##
x86/cpu/kvm: SRSO: Fix possible missing IBPB on VM-Exit
+ commit 318e8c339c9a0891c389298bb328ed0762a9935e upstream.
+
In [1] the meaning of the synthetic IBPB flags has been redefined for a
better separation of concerns:
- ENTRY_IBPB -- issue IBPB on entry only
@@ Commit message
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
## arch/x86/Kconfig ##
-@@ arch/x86/Kconfig: config MITIGATION_IBPB_ENTRY
+@@ arch/x86/Kconfig: config CPU_IBPB_ENTRY
depends on CPU_SUP_AMD && X86_64
default y
help
@@ arch/x86/Kconfig: config MITIGATION_IBPB_ENTRY
+ Compile the kernel with support for the retbleed=ibpb and
+ spec_rstack_overflow={ibpb,ibpb-vmexit} mitigations.
- config MITIGATION_IBRS_ENTRY
+ config CPU_IBRS_ENTRY
bool "Enable IBRS on kernel entry"
## arch/x86/kernel/cpu/bugs.c ##
@@ arch/x86/kernel/cpu/bugs.c: static void __init retbleed_select_mitigation(void)
* There is no need for RSB filling: entry_ibpb() ensures
* all predictions, including the RSB, are invalidated,
@@ arch/x86/kernel/cpu/bugs.c: static void __init srso_select_mitigation(void)
- if (IS_ENABLED(CONFIG_MITIGATION_IBPB_ENTRY)) {
+ if (IS_ENABLED(CONFIG_CPU_IBPB_ENTRY)) {
if (has_microcode) {
setup_force_cpu_cap(X86_FEATURE_ENTRY_IBPB);
+ setup_force_cpu_cap(X86_FEATURE_IBPB_ON_VMEXIT);
@@ arch/x86/kernel/cpu/bugs.c: static void __init srso_select_mitigation(void)
+ setup_clear_cpu_cap(X86_FEATURE_RSB_VMEXIT);
}
} else {
- pr_err("WARNING: kernel not compiled with MITIGATION_IBPB_ENTRY.\n");
+ pr_err("WARNING: kernel not compiled with CPU_IBPB_ENTRY.\n");
@@ arch/x86/kernel/cpu/bugs.c: static void __init srso_select_mitigation(void)
+ break;
- ibpb_on_vmexit:
case SRSO_CMD_IBPB_ON_VMEXIT:
-- if (IS_ENABLED(CONFIG_MITIGATION_SRSO)) {
+- if (IS_ENABLED(CONFIG_CPU_SRSO)) {
- if (!boot_cpu_has(X86_FEATURE_ENTRY_IBPB) && has_microcode) {
-+ if (IS_ENABLED(CONFIG_MITIGATION_IBPB_ENTRY)) {
++ if (IS_ENABLED(CONFIG_CPU_IBPB_ENTRY)) {
+ if (has_microcode) {
setup_force_cpu_cap(X86_FEATURE_IBPB_ON_VMEXIT);
srso_mitigation = SRSO_MITIGATION_IBPB_ON_VMEXIT;
@@ arch/x86/kernel/cpu/bugs.c: static void __init srso_select_mitigation(void)
setup_clear_cpu_cap(X86_FEATURE_RSB_VMEXIT);
}
} else {
-- pr_err("WARNING: kernel not compiled with MITIGATION_SRSO.\n");
+- pr_err("WARNING: kernel not compiled with CPU_SRSO.\n");
++ pr_err("WARNING: kernel not compiled with CPU_IBPB_ENTRY.\n");
+ goto pred_cmd;
- }
-+ pr_err("WARNING: kernel not compiled with MITIGATION_IBPB_ENTRY.\n");
+ }
break;
+
default:
- break;
---
Results of testing on various branches:
| Branch | Patch Apply | Build Test |
|---------------------------|-------------|------------|
| stable/linux-6.6.y | Success | Success |
prev parent reply other threads:[~2025-02-22 15:53 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-02-21 14:20 [PATCH 6.6] x86/cpu/kvm: SRSO: Fix possible missing IBPB on VM-Exit Patrick Bellasi
2025-02-22 14:59 ` Borislav Petkov
2025-02-22 15:53 ` Sasha Levin [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20250221203055-b786f70fab651df1@stable.kernel.org \
--to=sashal@kernel.org \
--cc=derkling@google.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.