[PATCH 6.18] x86/bugs: Adapt SRSO mitigation to Zen6

[PATCH 6.18] x86/bugs: Adapt SRSO mitigation to Zen6

[S Shaiju (AMD)]

From: "Borislav Petkov (AMD)" <bp@alien8.de>

commit ae1d2082d93bc04604dc08e9b7f9cdba5e0c28e6 upstream.

Zen6 has BTB protection which isolates the different contexts
(user/kernel, guest/host) from one another. This makes the SafeRET
mitigation there unnecessary leaving the user/user and guest/guest
attack vectors open, whose protection is handled by the Spectre v2
mitigation setting to do IBPB on a context switch.

Detect that setting and report it with a new mitigation string.

Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Link: https://patch.msgid.link/20260822013231.1109255-1-bp@kernel.org
Signed-off-by: S Shaiju (AMD) <sshaiju.lkml@gmail.com>
---
 arch/x86/include/asm/cpufeatures.h |  1 +
 arch/x86/kernel/cpu/bugs.c         | 18 ++++++++++++++++--
 arch/x86/kernel/cpu/scattered.c    |  1 +
 3 files changed, 18 insertions(+), 2 deletions(-)

diff --git a/arch/x86/include/asm/cpufeatures.h b/arch/x86/include/asm/cpufeatures.h
index f4c85555b7e4..b60b4a82ea20 100644
--- a/arch/x86/include/asm/cpufeatures.h
+++ b/arch/x86/include/asm/cpufeatures.h
@@ -411,6 +411,7 @@
 #define X86_FEATURE_OVERFLOW_RECOV	(17*32+ 0) /* "overflow_recov" MCA overflow recovery support */
 #define X86_FEATURE_SUCCOR		(17*32+ 1) /* "succor" Uncorrectable error containment and recovery */
 #define X86_FEATURE_SMCA		(17*32+ 3) /* "smca" Scalable MCA */
+#define X86_FEATURE_BTB_CTX_ISOLATION	(17*32+ 4) /* AMD: Branch predictions contexts isolated */
 
 /* Intel-defined CPU features, CPUID level 0x00000007:0 (EDX), word 18 */
 #define X86_FEATURE_AVX512_4VNNIW	(18*32+ 2) /* "avx512_4vnniw" AVX-512 Neural Network Instructions */
diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
index fbc465555e67..a39d97eee8bd 100644
--- a/arch/x86/kernel/cpu/bugs.c
+++ b/arch/x86/kernel/cpu/bugs.c
@@ -1320,6 +1320,7 @@ enum srso_mitigation {
 	SRSO_MITIGATION_IBPB,
 	SRSO_MITIGATION_IBPB_ON_VMEXIT,
 	SRSO_MITIGATION_BP_SPEC_REDUCE,
+	SRSO_MITIGATION_USER_IBPB,
 };
 
 static enum srso_mitigation srso_mitigation __ro_after_init = SRSO_MITIGATION_AUTO;
@@ -3055,7 +3056,8 @@ static const char * const srso_strings[] = {
 	[SRSO_MITIGATION_SAFE_RET]		= "Mitigation: Safe RET",
 	[SRSO_MITIGATION_IBPB]			= "Mitigation: IBPB",
 	[SRSO_MITIGATION_IBPB_ON_VMEXIT]	= "Mitigation: IBPB on VMEXIT only",
-	[SRSO_MITIGATION_BP_SPEC_REDUCE]	= "Mitigation: Reduced Speculation"
+	[SRSO_MITIGATION_BP_SPEC_REDUCE]	= "Mitigation: Reduced Speculation",
+	[SRSO_MITIGATION_USER_IBPB]		= "Mitigation: IBPB on context switch",
 };
 
 static int __init srso_parse_cmdline(char *str)
@@ -3095,7 +3097,9 @@ static void __init srso_select_mitigation(void)
 		 * required.  Otherwise the 'microcode' mitigation is sufficient
 		 * to protect the user->user and guest->guest vectors.
 		 */
-		if (cpu_attack_vector_mitigated(CPU_MITIGATE_GUEST_HOST) ||
+		if ((cpu_attack_vector_mitigated(CPU_MITIGATE_GUEST_HOST) &&
+		    !boot_cpu_has(X86_FEATURE_BTB_CTX_ISOLATION))
+					||
 		    (cpu_attack_vector_mitigated(CPU_MITIGATE_USER_KERNEL) &&
 		     !boot_cpu_has(X86_FEATURE_SRSO_USER_KERNEL_NO))) {
 			srso_mitigation = SRSO_MITIGATION_SAFE_RET;
@@ -3171,6 +3175,16 @@ static void __init srso_update_mitigation(void)
 	    boot_cpu_has(X86_FEATURE_IBPB_BRTYPE))
 		srso_mitigation = SRSO_MITIGATION_IBPB;
 
+	/*
+	 * See if IBPB on context switch is the only thing needed to address
+	 * GUEST/GUEST and USER/USER vectors.
+	 */
+	if (srso_mitigation == SRSO_MITIGATION_MICROCODE  &&
+	    boot_cpu_has(X86_FEATURE_SRSO_USER_KERNEL_NO) &&
+	    boot_cpu_has(X86_FEATURE_BTB_CTX_ISOLATION) &&
+	    spectre_v2_user_ibpb != SPECTRE_V2_USER_NONE)
+		srso_mitigation = SRSO_MITIGATION_USER_IBPB;
+
 	pr_info("%s\n", srso_strings[srso_mitigation]);
 }
 
diff --git a/arch/x86/kernel/cpu/scattered.c b/arch/x86/kernel/cpu/scattered.c
index caa4dc885c21..c4bc3c259f3f 100644
--- a/arch/x86/kernel/cpu/scattered.c
+++ b/arch/x86/kernel/cpu/scattered.c
@@ -56,6 +56,7 @@ static const struct cpuid_bit cpuid_bits[] = {
 	{ X86_FEATURE_TSA_SQ_NO,		CPUID_ECX,  1, 0x80000021, 0 },
 	{ X86_FEATURE_TSA_L1_NO,		CPUID_ECX,  2, 0x80000021, 0 },
 	{ X86_FEATURE_AMD_WORKLOAD_CLASS,	CPUID_EAX, 22, 0x80000021, 0 },
+	{ X86_FEATURE_BTB_CTX_ISOLATION,	CPUID_ECX,  8, 0x80000021, 0 },
 	{ X86_FEATURE_PERFMON_V2,		CPUID_EAX,  0, 0x80000022, 0 },
 	{ X86_FEATURE_AMD_LBR_V2,		CPUID_EAX,  1, 0x80000022, 0 },
 	{ X86_FEATURE_AMD_LBR_PMC_FREEZE,	CPUID_EAX,  2, 0x80000022, 0 },
-- 
2.53.0

Re: [PATCH 6.18] x86/bugs: Adapt SRSO mitigation to Zen6

[Sasha Levin]

On 2026-11-03, "S Shaiju (AMD)" <sshaiju.lkml@gmail.com> wrote:
> Zen6 has BTB protection which isolates the different contexts
> (user/kernel, guest/host) from one another. This makes the SafeRET
> mitigation there unnecessary

This is Zen6 enablement (a new cpufeature bit, a new mitigation state and a new
sysfs string), not a fix. It has no Fixes: tag and no Cc: stable, and Zen6
already gets the correct SafeRET mitigation on 6.18 without it. 7.3 doesn't
have it either, so I won't queue it.

If it fixes a user-visible problem, please point me at it and I'll look again.

-- 
Thanks,
Sasha

Re: [PATCH 6.18] x86/bugs: Adapt SRSO mitigation to Zen6

[Borislav Petkov]

On Wed, Nov 04, 2026 at 10:03:12AM -0500, Sasha Levin wrote:
> On 2026-11-03, "S Shaiju (AMD)" <sshaiju.lkml@gmail.com> wrote:
> > Zen6 has BTB protection which isolates the different contexts
> > (user/kernel, guest/host) from one another. This makes the SafeRET
> > mitigation there unnecessary
> 
> This is Zen6 enablement (a new cpufeature bit, a new mitigation state and a new
> sysfs string), not a fix. It has no Fixes: tag and no Cc: stable, and Zen6
> already gets the correct SafeRET mitigation on 6.18 without it. 7.3 doesn't
> have it either, so I won't queue it.
> 
> If it fixes a user-visible problem, please point me at it and I'll look again.

It gives back a big pile of performance and this will practically get
backported everywhere. So I thought we should preempt all that work by doing
it ourselves in stable and people can pick it up.

So yeah, perhaps the stable rules do not apply, or maybe this one:

  - Serious issues as reported by a user of a distribution kernel may also
    be considered if they fix a notable performance or interactivity issue.
    				^^^^^^^^^^^^^^^^^^^

Thx.

-- 
Regards/Gruss,
    Boris.

https://people.kernel.org/tglx/notes-about-netiquette

Re: [PATCH 6.18] x86/bugs: Adapt SRSO mitigation to Zen6

[Greg KH]

On Tue, Nov 03, 2026 at 10:21:43AM -0800, S Shaiju (AMD) wrote:
> From: "Borislav Petkov (AMD)" <bp@alien8.de>
> 
> commit ae1d2082d93bc04604dc08e9b7f9cdba5e0c28e6 upstream.
> 
> Zen6 has BTB protection which isolates the different contexts
> (user/kernel, guest/host) from one another. This makes the SafeRET
> mitigation there unnecessary leaving the user/user and guest/guest
> attack vectors open, whose protection is handled by the Spectre v2
> mitigation setting to do IBPB on a context switch.
> 
> Detect that setting and report it with a new mitigation string.
> 
> Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
> Link: https://patch.msgid.link/20260822013231.1109255-1-bp@kernel.org
> Signed-off-by: S Shaiju (AMD) <sshaiju.lkml@gmail.com>
> ---
>  arch/x86/include/asm/cpufeatures.h |  1 +
>  arch/x86/kernel/cpu/bugs.c         | 18 ++++++++++++++++--
>  arch/x86/kernel/cpu/scattered.c    |  1 +
>  3 files changed, 18 insertions(+), 2 deletions(-)

You forgot to mention this needs to go to 7.3.y too.

Now queued up, thanks.

greg k-h

Re: [PATCH 6.18] x86/bugs: Adapt SRSO mitigation to Zen6

[Borislav Petkov]

On November 4, 2026 5:58:23 PM UTC, Greg KH <gregkh@linuxfoundation.org> wrote:
>On Tue, Nov 03, 2026 at 10:21:43AM -0800, S Shaiju (AMD) wrote:
>> From: "Borislav Petkov (AMD)" <bp@alien8.de>
>> 
>> commit ae1d2082d93bc04604dc08e9b7f9cdba5e0c28e6 upstream.
>> 
>> Zen6 has BTB protection which isolates the different contexts
>> (user/kernel, guest/host) from one another. This makes the SafeRET
>> mitigation there unnecessary leaving the user/user and guest/guest
>> attack vectors open, whose protection is handled by the Spectre v2
>> mitigation setting to do IBPB on a context switch.
>> 
>> Detect that setting and report it with a new mitigation string.
>> 
>> Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
>> Link: https://patch.msgid.link/20260822013231.1109255-1-bp@kernel.org
>> Signed-off-by: S Shaiju (AMD) <sshaiju.lkml@gmail.com>
>> ---
>>  arch/x86/include/asm/cpufeatures.h |  1 +
>>  arch/x86/kernel/cpu/bugs.c         | 18 ++++++++++++++++--
>>  arch/x86/kernel/cpu/scattered.c    |  1 +
>>  3 files changed, 18 insertions(+), 2 deletions(-)
>
>You forgot to mention this needs to go to 7.3.y too.
>
>Now queued up, thanks.
>
>greg k-h

Ah, thanks. You guys are opening and closing non-LTS branches waay to fast for me :-)
-- 
Small device. Typos and formatting crap

Re: [PATCH 6.18] x86/bugs: Adapt SRSO mitigation to Zen6

[Greg KH]

On Wed, Nov 04, 2026 at 09:08:29PM +0000, Borislav Petkov wrote:
> On November 4, 2026 5:58:23 PM UTC, Greg KH <gregkh@linuxfoundation.org> wrote:
> >On Tue, Nov 03, 2026 at 10:21:43AM -0800, S Shaiju (AMD) wrote:
> >> From: "Borislav Petkov (AMD)" <bp@alien8.de>
> >> 
> >> commit ae1d2082d93bc04604dc08e9b7f9cdba5e0c28e6 upstream.
> >> 
> >> Zen6 has BTB protection which isolates the different contexts
> >> (user/kernel, guest/host) from one another. This makes the SafeRET
> >> mitigation there unnecessary leaving the user/user and guest/guest
> >> attack vectors open, whose protection is handled by the Spectre v2
> >> mitigation setting to do IBPB on a context switch.
> >> 
> >> Detect that setting and report it with a new mitigation string.
> >> 
> >> Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
> >> Link: https://patch.msgid.link/20260822013231.1109255-1-bp@kernel.org
> >> Signed-off-by: S Shaiju (AMD) <sshaiju.lkml@gmail.com>
> >> ---
> >>  arch/x86/include/asm/cpufeatures.h |  1 +
> >>  arch/x86/kernel/cpu/bugs.c         | 18 ++++++++++++++++--
> >>  arch/x86/kernel/cpu/scattered.c    |  1 +
> >>  3 files changed, 18 insertions(+), 2 deletions(-)
> >
> >You forgot to mention this needs to go to 7.3.y too.
> >
> >Now queued up, thanks.
> >
> >greg k-h
> 
> Ah, thanks. You guys are opening and closing non-LTS branches waay to fast for me :-)

7.3 will be LTS :)

Re: [PATCH 6.18] x86/bugs: Adapt SRSO mitigation to Zen6

[Borislav Petkov]

On Wed, Nov 04, 2026 at 04:19:06PM -0500, Greg KH wrote:
> > Ah, thanks. You guys are opening and closing non-LTS branches waay to fast for me :-)
> 
> 7.3 will be LTS :)

LOL, I don't wanna play anymore!

:-P

-- 
Regards/Gruss,
    Boris.

https://people.kernel.org/tglx/notes-about-netiquette