Re: [PATCH v5 2/8] x86/bugs: Allow spectre_v2=ibrs on x86 vendors other than Intel

[Pawan Gupta]

On Wed, Aug 26, 2026 at 05:35:04PM -0500, Kim Phillips wrote:
> Prepare for legacy IBRS toggling on AMD, where the BTB Isolation
> SEV-SNP feature uses it to optimize the VM exit-to-re-entry path.
> Commit 7c693f54c873 ("x86/speculation: Add spectre_v2=ibrs option to
> support Kernel IBRS") restricted the option to Intel because that was the
> only vendor that needed it at the time; nothing about the mechanism
> is Intel-specific.
> 
> Keep the IBRS-trumps-retbleed logic in retbleed_update_mitigation()
> Intel-only.  Legacy SPEC_CTRL.IBRS does not mitigate AMD's Branch
> Type Confusion RETBleed variant (RET prediction uses the Return
> Address Predictor, not the indirect branch predictors IBRS
> restricts), so letting SPECTRE_V2_IBRS trump retbleed on AMD would
> silently drop the UNRET/IBPB mitigation that does cover it.
> 
> On AMD the decoupling is total: retbleed mitigation selection never
> consults spectre_v2=, so spectre_v2=ibrs neither adds nor removes
> RETBleed coverage.  A kernel built without MITIGATION_UNRET_ENTRY and
> MITIGATION_IBPB_ENTRY already reports RETBleed as "Vulnerable" via the
> retbleed sysfs node and boot log regardless of the spectre_v2= value,
> so there is no silent gap in the spectre_v2=ibrs path to warn about --
> and a warning there would wrongly imply the Intel-style IBRS/RETBleed
> coupling exists on AMD.
> 
> Also drop CPU_SUP_INTEL from CONFIG_MITIGATION_IBRS_ENTRY's depends
> line: the IBRS_ENTER/IBRS_EXIT macros are vendor-neutral, and the
> Intel-only restriction would silently redirect spectre_v2=ibrs to
> AUTO on AMD-only kernels.
> 
> In spectre_v2_apply_mitigation(), route AutoIBRS-capable CPUs to
> EFER.AUTOIBRS only for the eIBRS modes.  Previously any IBRS mode used
> EFER.AUTOIBRS when the CPU had AutoIBRS, which was unreachable while
> spectre_v2=ibrs was Intel-only, but would now hand spectre_v2=ibrs the
> always-on AutoIBRS behaviour instead of the toggleable SPEC_CTRL.IBRS
> the option asks for.
> 
> Finally, clear EFER.AUTOIBRS at the top of cpu_select_mitigations(),
> alongside the existing SPEC_CTRL kexec cleanup.  head_64.S preserves
> incoming EFER bits, so a kexec from a kernel that ran in AutoIBRS mode
> carries the bit into the new kernel; without an explicit clear the CPU
> stays in AutoIBRS mode while sysfs reports e.g. "Mitigation: IBRS" or a
> retpoline mode, diverging from the actual hardware state.  On a normal
> cold boot the bit is already clear, so the msr_clear_bit() is a no-op
> there.  Clearing on the boot CPU suffices for APs, since it precedes the
> init_real_mode() EFER snapshot used by the AP trampoline.
> 
> Reported-by: Tom Lendacky <thomas.lendacky@xxxxxxx>
> Cc: Pawan Gupta <pawan.kumar.gupta@xxxxxxxxxxxxxxx>
> Cc: Borislav Petkov (AMD) <bp@xxxxxxxxx>
> Signed-off-by: Kim Phillips <kim.phillips@xxxxxxx>

Reviewed-by: Pawan Gupta <pawan.kumar.gupta@xxxxxxxxxxxxxxx>