Re: [PATCH v5 13/16] x86/bugs: Restructure spectre_v2 mitigation

Borislav Petkov
2025-04-29T10:46:33Z

On Fri, Apr 18, 2025 at 11:17:18AM -0500, David Kaplan wrote:
> static void __init spectre_v2_select_mitigation(void)
> {
> - enum spectre_v2_mitigation_cmd cmd = spectre_v2_parse_cmdline();
> enum spectre_v2_mitigation mode = SPECTRE_V2_NONE;
> + spectre_v2_cmd = spectre_v2_parse_cmdline();
>
> /*
> * If the CPU is not affected and the command line mode is NONE or AUTO
> * then nothing to do.
> */

Obvious comment. Lemme zap it.

> if (!boot_cpu_has_bug(X86_BUG_SPECTRE_V2) &&
> - (cmd == SPECTRE_V2_CMD_NONE || cmd == SPECTRE_V2_CMD_AUTO))
> + (spectre_v2_cmd == SPECTRE_V2_CMD_NONE || spectre_v2_cmd == SPECTRE_V2_CMD_AUTO))
> return;
>
> - switch (cmd) {
> + switch (spectre_v2_cmd) {
> case SPECTRE_V2_CMD_NONE:
> return;
>
> @@ -1898,16 +1907,6 @@ static void __init spectre_v2_select_mitigation(void)
> break;
> }
>
> - if (IS_ENABLED(CONFIG_MITIGATION_IBRS_ENTRY) &&
> - boot_cpu_has_bug(X86_BUG_RETBLEED) &&
> - retbleed_mitigation != RETBLEED_MITIGATION_NONE &&
> - retbleed_mitigation != RETBLEED_MITIGATION_STUFF &&
> - boot_cpu_has(X86_FEATURE_IBRS) &&
> - boot_cpu_data.x86_vendor == X86_VENDOR_INTEL) {
> - mode = SPECTRE_V2_IBRS;
> - break;
> - }
> -
> mode = spectre_v2_select_retpoline();
> break;
>
> @@ -1941,10 +1940,32 @@ static void __init spectre_v2_select_mitigation(void)
> break;
> }
>
> - if (mode == SPECTRE_V2_EIBRS && unprivileged_ebpf_enabled())
> + spectre_v2_enabled = mode;

Might as well zap mode here too, like for the others.

...

Diff ontop:

---

diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
index 3b0ffebb8f4b..93d07438eea7 100644
--- a/arch/x86/kernel/cpu/bugs.c
+++ b/arch/x86/kernel/cpu/bugs.c
@@ -1887,13 +1887,8 @@ static void __init bhi_apply_mitigation(void)

static void __init spectre_v2_select_mitigation(void)
{
- enum spectre_v2_mitigation mode = SPECTRE_V2_NONE;
spectre_v2_cmd = spectre_v2_parse_cmdline();

- /*
- * If the CPU is not affected and the command line mode is NONE or AUTO
- * then nothing to do.
- */
if (!boot_cpu_has_bug(X86_BUG_SPECTRE_V2) &&
(spectre_v2_cmd == SPECTRE_V2_CMD_NONE || spectre_v2_cmd == SPECTRE_V2_CMD_AUTO))
return;
@@ -1905,44 +1900,42 @@ static void __init spectre_v2_select_mitigation(void)
case SPECTRE_V2_CMD_FORCE:
case SPECTRE_V2_CMD_AUTO:
if (boot_cpu_has(X86_FEATURE_IBRS_ENHANCED)) {
- mode = SPECTRE_V2_EIBRS;
+ spectre_v2_enabled = SPECTRE_V2_EIBRS;
break;
}

- mode = spectre_v2_select_retpoline();
+ spectre_v2_enabled = spectre_v2_select_retpoline();
break;

case SPECTRE_V2_CMD_RETPOLINE_LFENCE:
pr_err(SPECTRE_V2_LFENCE_MSG);
- mode = SPECTRE_V2_LFENCE;
+ spectre_v2_enabled = SPECTRE_V2_LFENCE;
break;

case SPECTRE_V2_CMD_RETPOLINE_GENERIC:
- mode = SPECTRE_V2_RETPOLINE;
+ spectre_v2_enabled = SPECTRE_V2_RETPOLINE;
break;

case SPECTRE_V2_CMD_RETPOLINE:
- mode = spectre_v2_select_retpoline();
+ spectre_v2_enabled = spectre_v2_select_retpoline();
break;

case SPECTRE_V2_CMD_IBRS:
- mode = SPECTRE_V2_IBRS;
+ spectre_v2_enabled = SPECTRE_V2_IBRS;
break;

case SPECTRE_V2_CMD_EIBRS:
- mode = SPECTRE_V2_EIBRS;
+ spectre_v2_enabled = SPECTRE_V2_EIBRS;
break;

case SPECTRE_V2_CMD_EIBRS_LFENCE:
- mode = SPECTRE_V2_EIBRS_LFENCE;
+ spectre_v2_enabled = SPECTRE_V2_EIBRS_LFENCE;
break;

case SPECTRE_V2_CMD_EIBRS_RETPOLINE:
- mode = SPECTRE_V2_EIBRS_RETPOLINE;
+ spectre_v2_enabled = SPECTRE_V2_EIBRS_RETPOLINE;
break;
}
-
- spectre_v2_enabled = mode;
}

static void __init spectre_v2_update_mitigation(void)

--
Regards/Gruss,
Boris.