x86/bugs: Add attack vector controls for ITS

Use attack vector controls to determine if ITS mitigation is required.

Signed-off-by: David Kaplan <david.kaplan@amd.com>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Link: https://lore.kernel.org/20250707183316.1349127-19-david.kaplan@amd.com

diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
index eef6ccd17c79c36e23550a6515b8f972b03ea899..f41d871f0622025ebb5bfa894d0527a9470bdca9 100644 (file)
--- a/arch/x86/kernel/cpu/bugs.c
+++ b/arch/x86/kernel/cpu/bugs.c
@@ -1518,13 +1518,17 @@ early_param("indirect_target_selection", its_parse_cmdline);
 
 static void __init its_select_mitigation(void)
 {
-       if (!boot_cpu_has_bug(X86_BUG_ITS) || cpu_mitigations_off()) {
+       if (!boot_cpu_has_bug(X86_BUG_ITS)) {
                its_mitigation = ITS_MITIGATION_OFF;
                return;
        }
 
-       if (its_mitigation == ITS_MITIGATION_AUTO)
-               its_mitigation = ITS_MITIGATION_ALIGNED_THUNKS;
+       if (its_mitigation == ITS_MITIGATION_AUTO) {
+               if (should_mitigate_vuln(X86_BUG_ITS))
+                       its_mitigation = ITS_MITIGATION_ALIGNED_THUNKS;
+               else
+                       its_mitigation = ITS_MITIGATION_OFF;
+       }
 
        if (its_mitigation == ITS_MITIGATION_OFF)
                return;
@@ -1555,12 +1559,13 @@ static void __init its_select_mitigation(void)
 
 static void __init its_update_mitigation(void)
 {
-       if (!boot_cpu_has_bug(X86_BUG_ITS) || cpu_mitigations_off())
+       if (!boot_cpu_has_bug(X86_BUG_ITS))
                return;
 
        switch (spectre_v2_enabled) {
        case SPECTRE_V2_NONE:
-               pr_err("WARNING: Spectre-v2 mitigation is off, disabling ITS\n");
+               if (its_mitigation != ITS_MITIGATION_OFF)
+                       pr_err("WARNING: Spectre-v2 mitigation is off, disabling ITS\n");
                its_mitigation = ITS_MITIGATION_OFF;
                break;
        case SPECTRE_V2_RETPOLINE: