[6.6]Use Hygon IBRS and IBPB rather than software-based mitigation to mitigate Retbleed and SRSO.#1465
Merged
Conversation
…ia Hygon IBRS to avoid performance degradation caused by software-based mitigation. hygon inclusion category:feature ------------------ Hygon IBRS is different from AMD's Auto IBRS. It mitigates vulnerabilities based on the predicted branch type rather than the actual branch type; therefore, it can mitigate both Retbleed and SRSO by preventing predicted branch types from being used in the kernel. We leverage Hygon IBRS for Retbleed and SRSO mitigation, which avoids the performance degradation caused by software-based mitigation methods. Signed-off-by: zhangjun <zhangjun@hygon.cn>
Reviewer's GuideThis PR updates the x86 Hygon CPU mitigation paths to prefer hardware-based Enhanced IBRS and IBPB capabilities for Retbleed and SRSO, introduces Hygon‑specific IBPB branch-type control via cmdline and MSR programming, wires up eIBRS-based mitigations into the generic bugs/mitigation selection logic, and adds an early Hygon RAS flush mitigation hook. Sequence diagram for Hygon SRSO mitigation selection with eIBRS and IBPBsequenceDiagram
participant Boot
participant CPU as boot_cpu_data
participant Bugs as srso_select_mitigation
participant IBPB as ibpb_can_flush_all
Boot->>Bugs: srso_select_mitigation()
Bugs->>CPU: boot_cpu_has X86_BUG_SRSO
CPU-->>Bugs: result
Bugs->>CPU: cpu_mitigations_off()
CPU-->>Bugs: result
alt Hygon vendor
Bugs->>CPU: check X86_FEATURE_IBPB_BRTYPE
CPU-->>Bugs: has_microcode
Bugs->>IBPB: ibpb_can_flush_all()
IBPB->>CPU: read x86_vendor, x86, x86_model, ibpb_brtype
alt family 0x18 and model <= 0x3
IBPB-->>Bugs: true (IBPB flushes all branches)
else family 0x18 and model > 0x3 and ibpb_brtype == IBPB_FLUSH_ALL
IBPB->>CPU: msr_set_bit MSR_ZEN4_BP_CFG IBPB_FLUSH_ALL_BIT
IBPB-->>Bugs: true
else other Hygon config
IBPB-->>Bugs: false
end
Bugs->>Bugs: has_microcode = ibpb_can_flush_all result
else non-Hygon
Bugs->>CPU: boot_cpu_has X86_FEATURE_IBPB_BRTYPE
CPU-->>Bugs: has_microcode
end
Bugs->>CPU: read spectre_v2_enabled
alt Hygon with eIBRS mode
Bugs->>Bugs: srso_mitigation = SRSO_MITIGATION_EIBRS
Bugs->>Boot: print srso_strings[SRSO_MITIGATION_EIBRS] + microcode info
Bugs-->>Boot: return
else other vendors or non-eIBRS
Bugs->>Bugs: choose mitigation based on srso_cmd and has_microcode
Bugs-->>Boot: return
end
Sequence diagram for Hygon Retbleed mitigation selection with eIBRSsequenceDiagram
participant Boot
participant CPU as boot_cpu_data
participant Bugs as retbleed_select_mitigation
Boot->>Bugs: retbleed_select_mitigation()
Bugs->>Bugs: determine default retbleed_mitigation
alt Hygon vendor
Bugs->>CPU: read x86_vendor
CPU-->>Bugs: X86_VENDOR_HYGON
Bugs->>CPU: read spectre_v2_enabled
alt spectre_v2_enabled in {SPECTRE_V2_EIBRS, SPECTRE_V2_EIBRS_RETPOLINE, SPECTRE_V2_EIBRS_LFENCE}
Bugs->>Bugs: retbleed_mitigation = RETBLEED_MITIGATION_EIBRS
else non-eIBRS Spectre v2 mode
Bugs->>Bugs: keep previously selected mitigation
end
else non-Hygon vendor
Bugs->>Bugs: keep previously selected mitigation
end
Bugs->>CPU: apply mitigation (setup caps, IBPB, etc.) based on retbleed_mitigation
Bugs-->>Boot: return
Sequence diagram for early Hygon CPU vulnerability mitigation and eIBRS capability setupsequenceDiagram
participant Boot
participant Hygon as early_init_hygon
participant Vul as cpu_vul_mitigation
participant Common as init_speculation_control
participant CPU as cpuinfo_x86
Boot->>Hygon: early_init_hygon(cpuinfo_x86)
Hygon->>Hygon: early_init_hygon_mc(cpuinfo_x86)
Hygon->>Vul: cpu_vul_mitigation()
Vul->>CPU: read x86, x86_model
alt family 0x18 and model > 0x3
Vul->>CPU: msr_set_bit MSR_ZEN4_BP_CFG IBRS_FLUSH_RAS_BIT
else other Hygon models
Vul->>Vul: no RAS flush MSR change
end
Hygon->>CPU: set_cpu_cap X86_FEATURE_K8
Hygon->>CPU: rdmsr_safe MSR_AMD64_PATCH_LEVEL
Hygon-->>Boot: return
Boot->>Common: init_speculation_control(cpuinfo_x86)
Common->>CPU: cpu_has X86_FEATURE_SPEC_CTRL
alt SPEC_CTRL available
Common->>CPU: check x86_vendor
alt Hygon vendor
Common->>CPU: set_cpu_cap X86_FEATURE_IBRS_ENHANCED
else non-Hygon vendor
Common->>CPU: set_cpu_cap X86_FEATURE_IBRS
end
Common->>CPU: set_cpu_cap X86_FEATURE_IBPB
Common->>CPU: set_cpu_cap X86_FEATURE_MSR_SPEC_CTRL
end
Common->>CPU: cpu_has X86_FEATURE_AMD_IBRS
alt AMD_IBRS available
Common->>CPU: check x86_vendor
alt Hygon vendor
Common->>CPU: set_cpu_cap X86_FEATURE_IBRS_ENHANCED
else non-Hygon vendor
Common->>CPU: set_cpu_cap X86_FEATURE_IBRS
end
Common->>CPU: set_cpu_cap X86_FEATURE_MSR_SPEC_CTRL
end
Common-->>Boot: return
Class diagram for new and updated Hygon mitigation-related types and functionsclassDiagram
class cpuinfo_x86 {
int x86
int x86_model
int x86_vendor
u32 microcode
}
class ibpb_brtype_cmd {
<<enum>>
IBPB_FLUSH_IND
IBPB_FLUSH_ALL
}
class srso_mitigation {
<<enum>>
SRSO_MITIGATION_NONE
SRSO_MITIGATION_AUTO
SRSO_MITIGATION_MICROCODE
SRSO_MITIGATION_SAFE_RET
SRSO_MITIGATION_IBPB
SRSO_MITIGATION_IBPB_ON_VMEXIT
SRSO_MITIGATION_EIBRS
}
class retbleed_mitigation_enum {
<<enum>>
RETBLEED_MITIGATION_UNRET
RETBLEED_MITIGATION_IBPB
RETBLEED_MITIGATION_EIBRS
RETBLEED_MITIGATION_NONE
}
class cpu_vul_mitigation {
+void cpu_vul_mitigation()
}
class early_init_hygon {
+void early_init_hygon(cpuinfo_x86 c)
}
class init_speculation_control {
+void init_speculation_control(cpuinfo_x86 c)
}
class ibpb_brtype_cmdline {
+int ibpb_brtype_cmdline(char str)
}
class ibpb_can_flush_all_fn {
+bool ibpb_can_flush_all()
}
class x86_spec_ctrl_setup_ap {
+void x86_spec_ctrl_setup_ap()
}
class srso_select_mitigation_fn {
+void srso_select_mitigation()
}
class retbleed_select_mitigation_fn {
+void retbleed_select_mitigation()
}
class retbleed_show_state_fn {
+ssize_t retbleed_show_state(char buf)
}
class Globals {
<<global>>
ibpb_brtype_cmd ibpb_brtype
srso_mitigation srso_mitigation
retbleed_mitigation_enum retbleed_mitigation
int spectre_v2_enabled
}
early_init_hygon --> cpu_vul_mitigation : calls
early_init_hygon --> cpuinfo_x86 : uses
cpu_vul_mitigation --> cpuinfo_x86 : reads vendor, family, model
init_speculation_control --> cpuinfo_x86 : uses
init_speculation_control --> Globals : sets IBRS or IBRS_ENHANCED
ibpb_brtype_cmdline --> ibpb_brtype_cmd : sets value
ibpb_brtype_cmdline --> Globals : updates ibpb_brtype
ibpb_can_flush_all_fn --> cpuinfo_x86 : reads vendor, family, model
ibpb_can_flush_all_fn --> Globals : reads ibpb_brtype
x86_spec_ctrl_setup_ap --> Globals : reads ibpb_brtype
x86_spec_ctrl_setup_ap --> cpuinfo_x86 : reads vendor, family, model
srso_select_mitigation_fn --> ibpb_can_flush_all_fn : calls
srso_select_mitigation_fn --> Globals : sets srso_mitigation
retbleed_select_mitigation_fn --> Globals : sets retbleed_mitigation
retbleed_show_state_fn --> Globals : reads retbleed_mitigation and spectre_v2_enabled
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
|
Hi @wildfreedom. Thanks for your PR. 😃 |
|
Hi @wildfreedom. Thanks for your PR. I'm waiting for a deepin-community member to verify that this patch is reasonable to test. If it is, they should reply with Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
Member
|
/ok-to-test |
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey - I've left some high level feedback:
- Consider making
ibpb_can_flush_all()static(and possibly__init) since it is only used withinbugs.c, to avoid exporting unnecessary global symbols. - The new
pr_err()inibpb_brtype_cmdline()is missing a trailing newline, which is inconsistent with the surrounding logging style and will produce slightly messy dmesg output. - The logic for setting
MSR_ZEN4_BP_CFGis now duplicated in several places (cpu_vul_mitigation(),ibpb_can_flush_all(),x86_spec_ctrl_setup_ap()); consider factoring the Hygon family/model checks and MSR bit programming into a common helper to keep the behavior consistent and easier to maintain.
Prompt for AI Agents
Please address the comments from this code review:
## Overall Comments
- Consider making `ibpb_can_flush_all()` `static` (and possibly `__init`) since it is only used within `bugs.c`, to avoid exporting unnecessary global symbols.
- The new `pr_err()` in `ibpb_brtype_cmdline()` is missing a trailing newline, which is inconsistent with the surrounding logging style and will produce slightly messy dmesg output.
- The logic for setting `MSR_ZEN4_BP_CFG` is now duplicated in several places (`cpu_vul_mitigation()`, `ibpb_can_flush_all()`, `x86_spec_ctrl_setup_ap()`); consider factoring the Hygon family/model checks and MSR bit programming into a common helper to keep the behavior consistent and easier to maintain.Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
There was a problem hiding this comment.
Pull request overview
This PR updates x86 speculation/vulnerability mitigation logic to prefer Hygon hardware features (enhanced IBRS behavior and configurable IBPB behavior) over software-based mitigations for Retbleed and SRSO on Hygon CPUs.
Changes:
- Enable Hygon-specific MSR configuration to automatically flush RAS on privilege level changes as part of return/RSB-related mitigation.
- Advertise
X86_FEATURE_IBRS_ENHANCEDfor Hygon CPUs during speculation-control capability initialization. - Add a Hygon-only
ibpb_brtype=early boot parameter and integrate it into SRSO/Retbleed mitigation selection and sysfs reporting.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 7 comments.
| File | Description |
|---|---|
| arch/x86/kernel/cpu/hygon.c | Adds Hygon MSR configuration to flush RAS automatically during privilege level changes. |
| arch/x86/kernel/cpu/common.c | Marks Hygon CPUs as supporting enhanced IBRS capability during speculation control init. |
| arch/x86/kernel/cpu/bugs.c | Prefers eIBRS on Hygon for Retbleed/SRSO, adds ibpb_brtype param, and updates mitigation logic/reporting. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
|
|
||
| #include "cpu.h" | ||
|
|
||
| #define IBRS_FLUSH_RAS_BIT 56 |
There was a problem hiding this comment.
Macro name IBRS_FLUSH_RAS_BIT is ambiguous (it’s a bit index for MSR_ZEN4_BP_CFG). Consider renaming it to reflect the MSR/field (e.g., MSR_ZEN4_BP_CFG_*_BIT) to avoid confusion with MSR_SPEC_CTRL/IBRS itself.
| { | ||
| /* | ||
| * Automatically flush RAS upon protection level changes from low to high. | ||
| * it's used as rsb mitigation instead of RSB filling. |
There was a problem hiding this comment.
Comment typo/capitalization: sentence starts with "it's" but should be "It's".
Suggested change
| * it's used as rsb mitigation instead of RSB filling. | |
| * It's used as rsb mitigation instead of RSB filling. |
| { | ||
| /* | ||
| * Automatically flush RAS upon protection level changes from low to high. | ||
| * it's used as rsb mitigation instead of RSB filling. |
There was a problem hiding this comment.
Comment acronym casing: "rsb" should be capitalized as "RSB" for consistency with other kernel comments (and the same line already uses "RSB filling").
Suggested change
| * it's used as rsb mitigation instead of RSB filling. | |
| * it's used as RSB mitigation instead of RSB filling. |
Comment on lines
+2826
to
+2834
| bool ibpb_can_flush_all(void) | ||
| { | ||
| if ((boot_cpu_data.x86_vendor == X86_VENDOR_HYGON) && | ||
| (boot_cpu_data.x86 == 0x18)) { | ||
| if (boot_cpu_data.x86_model <= 0x3) { | ||
| return true; | ||
| } else if (ibpb_brtype == IBPB_FLUSH_ALL) { | ||
| msr_set_bit(MSR_ZEN4_BP_CFG, IBPB_FLUSH_ALL_BIT); | ||
| return true; |
There was a problem hiding this comment.
ibpb_can_flush_all() is only used within this file; leaving it non-static creates an unnecessary global symbol and can trigger -Wmissing-prototypes warnings under stricter build settings. Make it static (and, if appropriate, static __init) since it’s only used during init.
Comment on lines
+2821
to
+2822
| * ibpb_can_flush_all() - set IBPB flush type according to the cmdline param | ||
| * - and check whether IBPB can flush all branches |
There was a problem hiding this comment.
The doc comment for ibpb_can_flush_all() says it "set[s] IBPB flush type according to the cmdline param", but the function doesn’t set ibpb_brtype (it only checks it and may set an MSR bit). Please adjust the comment so it accurately describes the side effects and what is being checked.
Suggested change
| * ibpb_can_flush_all() - set IBPB flush type according to the cmdline param | |
| * - and check whether IBPB can flush all branches | |
| * ibpb_can_flush_all() - check whether IBPB can flush all branch types | |
| * - and enable "flush all branches" in hardware when | |
| * requested via the configured IBPB flush type |
Comment on lines
+2838
to
+2840
|
|
||
| pr_err("WARNING: this ibpb check is only used for HYGON.\n"); | ||
| return false; |
There was a problem hiding this comment.
The non-HYGON fallback path in ibpb_can_flush_all() logs pr_err("WARNING: ..."), but the only caller is already guarded by boot_cpu_data.x86_vendor == X86_VENDOR_HYGON, making this log effectively dead code (and noisy if the guard changes). Consider removing the printk or replacing it with a WARN_ON_ONCE() and returning false.
| * ibpb_brtype= [X86, HYGON only] | ||
| * IBPB action control flag | ||
| * Format: { ibpb-all | ibpb-ind } | ||
| * ibpb-all -- IBPB flushes all types of branches,this is the default value. |
There was a problem hiding this comment.
Minor typo in the kernel-parameter doc: missing space after comma in "branches,this".
Suggested change
| * ibpb-all -- IBPB flushes all types of branches,this is the default value. | |
| * ibpb-all -- IBPB flushes all types of branches, this is the default value. |
opsiff
approved these changes
Jan 30, 2026
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: opsiff The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description:
Hygon IBRS is different from AMD's Auto IBRS. It mitigates vulnerabilities based on the predicted branch type rather than the actual branch type; therefore, it can mitigate both Retbleed and SRSO by preventing predicted branch types from being used in the kernel. We leverage Hygon IBRS for Retbleed and SRSO mitigation, which avoids the performance degradation caused by software-based mitigation methods.
Summary by Sourcery
Leverage Hygon enhanced IBRS and configurable IBPB behavior to mitigate Retbleed and SRSO on Hygon processors instead of relying solely on software-based mitigations.
New Features:
Enhancements: