Re: [PATCH v5 16/16] x86/bugs: Restructure SRSO mitigation

Borislav Petkov
2025-04-29T16:50:54Z

On Fri, Apr 18, 2025 at 11:17:21AM -0500, David Kaplan wrote:
> @@ -2738,130 +2730,80 @@ static void __init srso_select_mitigation(void)
> {
> bool has_microcode = boot_cpu_has(X86_FEATURE_IBPB_BRTYPE);

I'll push that init after the return so that it doesn't happen unnecessarily.

> - if (!boot_cpu_has_bug(X86_BUG_SRSO) ||
> - cpu_mitigations_off() ||
> - srso_cmd == SRSO_CMD_OFF) {
> - if (boot_cpu_has(X86_FEATURE_SBPB))
> - x86_pred_cmd = PRED_CMD_SBPB;
> - goto out;
> - }
> + if (!boot_cpu_has_bug(X86_BUG_SRSO) || cpu_mitigations_off())
> + srso_mitigation = SRSO_MITIGATION_NONE;
> +
> + if (srso_mitigation == SRSO_MITIGATION_NONE)
> + return;
> +
> + if (srso_mitigation == SRSO_MITIGATION_AUTO)
> + srso_mitigation = SRSO_MITIGATION_SAFE_RET;
>
> if (has_microcode) {
> /*
> * Zen1/2 with SMT off aren't vulnerable after the right
> * IBPB microcode has been applied.
> - *
> - * Zen1/2 don't have SBPB, no need to try to enable it here.

Why?

--
Regards/Gruss,
Boris.