x86/speculation: Identify processors vulnerable to SMT RSB predictions
authorTom Lendacky <thomas.lendacky@amd.com>
Thu, 9 Feb 2023 15:22:24 +0000 (09:22 -0600)
committerPaolo Bonzini <pbonzini@redhat.com>
Fri, 10 Feb 2023 11:43:03 +0000 (06:43 -0500)
commitbe8de49bea505e7777a69ef63d60e02ac1712683
tree4c88f8c1d113f43885f6fe147ad4e36f30519973
parent6d796c50f84ca79f1722bb131799e5a5710c4700
x86/speculation: Identify processors vulnerable to SMT RSB predictions

Certain AMD processors are vulnerable to a cross-thread return address
predictions bug. When running in SMT mode and one of the sibling threads
transitions out of C0 state, the other sibling thread could use return
target predictions from the sibling thread that transitioned out of C0.

The Spectre v2 mitigations cover the Linux kernel, as it fills the RSB
when context switching to the idle thread. However, KVM allows a VMM to
prevent exiting guest mode when transitioning out of C0. A guest could
act maliciously in this situation, so create a new x86 BUG that can be
used to detect if the processor is vulnerable.

Reviewed-by: Borislav Petkov (AMD) <bp@alien8.de>
Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com>
Message-Id: <91cec885656ca1fcd4f0185ce403a53dd9edecb7.1675956146.git.thomas.lendacky@amd.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
arch/x86/include/asm/cpufeatures.h
arch/x86/kernel/cpu/common.c