kernel/cpu/bugs.c

1307 static inline bool spectre_v2_in_ibrs_mode(enum spectre_v2_mitigation mode)
1309 	return spectre_v2_in_eibrs_mode(mode) || mode == SPECTRE_V2_IBRS;
1315 	enum spectre_v2_user_mitigation mode = SPECTRE_V2_USER_NONE;
1331 		mode = SPECTRE_V2_USER_STRICT;
1336 		mode = SPECTRE_V2_USER_PRCTL;
1341 			mode = SPECTRE_V2_USER_SECCOMP;
1343 			mode = SPECTRE_V2_USER_PRCTL;
1351 		spectre_v2_user_ibpb = mode;
1378 	 * injection in user-mode as the IBRS bit remains always set which
1380 	 * mode, the IBRS bit is set only on kernel entry and cleared on return
1392 	 * At this point, an STIBP mode other than "off" has been set.
1396 	if (mode != SPECTRE_V2_USER_STRICT &&
1398 		mode = SPECTRE_V2_USER_STRICT_PREFERRED;
1402 		if (mode != SPECTRE_V2_USER_STRICT &&
1403 		    mode != SPECTRE_V2_USER_STRICT_PREFERRED)
1404 			pr_info("Selecting STIBP always-on mode to complement retbleed mitigation\n");
1405 		mode = SPECTRE_V2_USER_STRICT_PREFERRED;
1408 	spectre_v2_user_stibp = mode;
1411 	pr_info("%s\n", spectre_v2_user_strings[mode]);
1562 static void __init spectre_v2_determine_rsb_fill_type_at_vmexit(enum spectre_v2_mitigation mode)
1584 	switch (mode) {
1605 	pr_warn_once("Unknown Spectre v2 mode, disabling RSB mitigation at VM exit");
1680 	enum spectre_v2_mitigation mode = SPECTRE_V2_NONE;
1683 	 * If the CPU is not affected and the command line mode is NONE or AUTO
1697 			mode = SPECTRE_V2_EIBRS;
1707 			mode = SPECTRE_V2_IBRS;
1711 		mode = spectre_v2_select_retpoline();
1716 		mode = SPECTRE_V2_LFENCE;
1720 		mode = SPECTRE_V2_RETPOLINE;
1724 		mode = spectre_v2_select_retpoline();
1728 		mode = SPECTRE_V2_IBRS;
1732 		mode = SPECTRE_V2_EIBRS;
1736 		mode = SPECTRE_V2_EIBRS_LFENCE;
1740 		mode = SPECTRE_V2_EIBRS_RETPOLINE;
1744 	if (mode == SPECTRE_V2_EIBRS && unprivileged_ebpf_enabled())
1747 	if (spectre_v2_in_ibrs_mode(mode)) {
1756 	switch (mode) {
1783 	if (mode == SPECTRE_V2_EIBRS_LFENCE ||
1784 	    mode == SPECTRE_V2_EIBRS_RETPOLINE ||
1785 	    mode == SPECTRE_V2_RETPOLINE)
1791 	spectre_v2_enabled = mode;
1792 	pr_info("%s\n", spectre_v2_strings[mode]);
1835 	spectre_v2_determine_rsb_fill_type_at_vmexit(mode);
1843 	 * Use "mode" to check Enhanced IBRS instead of boot_cpu_has(), because
1858 	} else if (boot_cpu_has(X86_FEATURE_IBRS) && !spectre_v2_in_ibrs_mode(mode)) {
2050 	enum ssb_mitigation mode = SPEC_STORE_BYPASS_NONE;
2054 		return mode;
2060 		return mode;
2065 		 * Choose prctl+seccomp as the default mode if seccomp is
2069 			mode = SPEC_STORE_BYPASS_SECCOMP;
2071 			mode = SPEC_STORE_BYPASS_PRCTL;
2074 		mode = SPEC_STORE_BYPASS_DISABLE;
2078 		mode = SPEC_STORE_BYPASS_PRCTL;
2090 	if (mode == SPEC_STORE_BYPASS_DISABLE) {
2105 	return mode;
2210 		 * With strict mode for both IBPB and STIBP, the instruction
2214 		 * enabled regardless of the mode of the other.