diff options
| author | Pawan Gupta <pawan.kumar.gupta@linux.intel.com> | 2022-07-08 23:36:09 +0300 |
|---|---|---|
| committer | Borislav Petkov <bp@suse.de> | 2022-07-09 14:12:45 +0300 |
| commit | 4ad3278df6fe2b0852b00d5757fc2ccd8e92c26e (patch) | |
| tree | c0cb01cfa5e763370ef4a8a682dc7a636a8763a0 /mm/vmstat.c | |
| parent | 697977d8415d61f3acbc4ee6d564c9dcf0309507 (diff) | |
| download | linux-4ad3278df6fe2b0852b00d5757fc2ccd8e92c26e.tar.xz | |
x86/speculation: Disable RRSBA behavior
Some Intel processors may use alternate predictors for RETs on
RSB-underflow. This condition may be vulnerable to Branch History
Injection (BHI) and intramode-BTI.
Kernel earlier added spectre_v2 mitigation modes (eIBRS+Retpolines,
eIBRS+LFENCE, Retpolines) which protect indirect CALLs and JMPs against
such attacks. However, on RSB-underflow, RET target prediction may
fallback to alternate predictors. As a result, RET's predicted target
may get influenced by branch history.
A new MSR_IA32_SPEC_CTRL bit (RRSBA_DIS_S) controls this fallback
behavior when in kernel mode. When set, RETs will not take predictions
from alternate predictors, hence mitigating RETs as well. Support for
this is enumerated by CPUID.7.2.EDX[RRSBA_CTRL] (bit2).
For spectre v2 mitigation, when a user selects a mitigation that
protects indirect CALLs and JMPs against BHI and intramode-BTI, set
RRSBA_DIS_S also to protect RETs for RSB-underflow case.
Signed-off-by: Pawan Gupta <pawan.kumar.gupta@linux.intel.com>
Signed-off-by: Borislav Petkov <bp@suse.de>
Diffstat (limited to 'mm/vmstat.c')
0 files changed, 0 insertions, 0 deletions