x86/bugs: Select best SRSO mitigation

The SRSO bug can theoretically be used to conduct user->user or guest->guest
attacks and requires a mitigation (namely IBPB instead of SBPB on context
switch) for these.  So mark SRSO as being applicable to the user->user and
guest->guest attack vectors.

Additionally, SRSO supports multiple mitigations which mitigate different
potential attack vectors.  Some CPUs are also immune to SRSO from
certain attack vectors (like user->kernel).

Use the specific attack vectors requiring mitigation to select the best
SRSO mitigation to avoid unnecessary performance hits.

Signed-off-by: David Kaplan <david.kaplan@amd.com>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Reviewed-by: Borislav Petkov (AMD) <bp@alien8.de>
Link: https://lore.kernel.org/20250721160310.1804203-1-david.kaplan@amd.com

diff --git a/Documentation/admin-guide/hw-vuln/attack_vector_controls.rst b/Documentation/admin-guide/hw-vuln/attack_vector_controls.rst
index b4de16f5ec4451b66f7ddc33c02172f7765cc65a..6dd0800146f65b78d7eee31076d012640f3ee35f 100644 (file)
--- a/Documentation/admin-guide/hw-vuln/attack_vector_controls.rst
+++ b/Documentation/admin-guide/hw-vuln/attack_vector_controls.rst
@@ -214,7 +214,7 @@ Spectre_v1            X
 Spectre_v2            X                           X
 Spectre_v2_user                      X                           X            *       (Note 1)
 SRBDS                 X              X            X              X
-SRSO                  X                           X
+SRSO                  X              X            X              X
 SSB                                                                                   (Note 4)
 TAA                   X              X            X              X            *       (Note 2)
 TSA                   X              X            X              X

diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
index b74bf937cd9fbc689a2a8e0f29b5be3614ac4486..2186a771b9fc3d79aee3f1dcdb02fb51c390a606 100644 (file)
--- a/arch/x86/kernel/cpu/bugs.c
+++ b/arch/x86/kernel/cpu/bugs.c
@@ -386,7 +386,6 @@ static bool __init should_mitigate_vuln(unsigned int bug)
 
        case X86_BUG_SPECTRE_V2:
        case X86_BUG_RETBLEED:
-       case X86_BUG_SRSO:
        case X86_BUG_L1TF:
        case X86_BUG_ITS:
                return cpu_attack_vector_mitigated(CPU_MITIGATE_USER_KERNEL) ||
@@ -3184,8 +3183,18 @@ static void __init srso_select_mitigation(void)
        }
 
        if (srso_mitigation == SRSO_MITIGATION_AUTO) {
-               if (should_mitigate_vuln(X86_BUG_SRSO)) {
+               /*
+                * Use safe-RET if user->kernel or guest->host protection is
+                * required.  Otherwise the 'microcode' mitigation is sufficient
+                * to protect the user->user and guest->guest vectors.
+                */
+               if (cpu_attack_vector_mitigated(CPU_MITIGATE_GUEST_HOST) ||
+                   (cpu_attack_vector_mitigated(CPU_MITIGATE_USER_KERNEL) &&
+                    !boot_cpu_has(X86_FEATURE_SRSO_USER_KERNEL_NO))) {
                        srso_mitigation = SRSO_MITIGATION_SAFE_RET;
+               } else if (cpu_attack_vector_mitigated(CPU_MITIGATE_USER_USER) ||
+                          cpu_attack_vector_mitigated(CPU_MITIGATE_GUEST_GUEST)) {
+                       srso_mitigation = SRSO_MITIGATION_MICROCODE;
                } else {
                        srso_mitigation = SRSO_MITIGATION_NONE;
                        return;