Merge tag 'tsa_x86_bugs_for_6.16' into tip-x86-bugs

Pick up TSA changes from mainline so that attack vectors work can
continue ontop.

Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>

diff --cc arch/x86/kernel/cpu/bugs.c
index e2a8a21efb10089424d345c0bf6118a4d4ec62bb,f4d3abb12317a7c93029c3a457c7a3d53e3d3b96..88769c46effba9dbd6ba21aac9481191ef846572
--- 1/arch/x86/kernel/cpu/bugs.c
--- 2/arch/x86/kernel/cpu/bugs.c
+++ b/arch/x86/kernel/cpu/bugs.c
@@@ -1497,26 -1480,105 +1501,114 @@@ static void __init its_update_mitigatio
  
  static void __init its_apply_mitigation(void)
  {
 -      /* its=stuff forces retbleed stuffing and is enabled there. */
 -      if (its_mitigation != ITS_MITIGATION_ALIGNED_THUNKS)
 -              return;
 -
 -      if (!boot_cpu_has(X86_FEATURE_RETPOLINE))
 -              setup_force_cpu_cap(X86_FEATURE_INDIRECT_THUNK_ITS);
 +      switch (its_mitigation) {
 +      case ITS_MITIGATION_OFF:
 +      case ITS_MITIGATION_AUTO:
 +      case ITS_MITIGATION_VMEXIT_ONLY:
 +              break;
 +      case ITS_MITIGATION_ALIGNED_THUNKS:
 +              if (!boot_cpu_has(X86_FEATURE_RETPOLINE))
 +                      setup_force_cpu_cap(X86_FEATURE_INDIRECT_THUNK_ITS);
  
 -      setup_force_cpu_cap(X86_FEATURE_RETHUNK);
 -      set_return_thunk(its_return_thunk);
 +              setup_force_cpu_cap(X86_FEATURE_RETHUNK);
 +              set_return_thunk(its_return_thunk);
 +              break;
 +      case ITS_MITIGATION_RETPOLINE_STUFF:
 +              setup_force_cpu_cap(X86_FEATURE_RETHUNK);
 +              setup_force_cpu_cap(X86_FEATURE_CALL_DEPTH);
 +              set_return_thunk(call_depth_return_thunk);
 +              break;
 +      }
  }
  
+ #undef pr_fmt
+ #define pr_fmt(fmt)   "Transient Scheduler Attacks: " fmt
+ 
+ enum tsa_mitigations {
+       TSA_MITIGATION_NONE,
+       TSA_MITIGATION_AUTO,
+       TSA_MITIGATION_UCODE_NEEDED,
+       TSA_MITIGATION_USER_KERNEL,
+       TSA_MITIGATION_VM,
+       TSA_MITIGATION_FULL,
+ };
+ 
+ static const char * const tsa_strings[] = {
+       [TSA_MITIGATION_NONE]           = "Vulnerable",
+       [TSA_MITIGATION_UCODE_NEEDED]   = "Vulnerable: No microcode",
+       [TSA_MITIGATION_USER_KERNEL]    = "Mitigation: Clear CPU buffers: user/kernel boundary",
+       [TSA_MITIGATION_VM]             = "Mitigation: Clear CPU buffers: VM",
+       [TSA_MITIGATION_FULL]           = "Mitigation: Clear CPU buffers",
+ };
+ 
+ static enum tsa_mitigations tsa_mitigation __ro_after_init =
+       IS_ENABLED(CONFIG_MITIGATION_TSA) ? TSA_MITIGATION_AUTO : TSA_MITIGATION_NONE;
+ 
+ static int __init tsa_parse_cmdline(char *str)
+ {
+       if (!str)
+               return -EINVAL;
+ 
+       if (!strcmp(str, "off"))
+               tsa_mitigation = TSA_MITIGATION_NONE;
+       else if (!strcmp(str, "on"))
+               tsa_mitigation = TSA_MITIGATION_FULL;
+       else if (!strcmp(str, "user"))
+               tsa_mitigation = TSA_MITIGATION_USER_KERNEL;
+       else if (!strcmp(str, "vm"))
+               tsa_mitigation = TSA_MITIGATION_VM;
+       else
+               pr_err("Ignoring unknown tsa=%s option.\n", str);
+ 
+       return 0;
+ }
+ early_param("tsa", tsa_parse_cmdline);
+ 
+ static void __init tsa_select_mitigation(void)
+ {
+       if (cpu_mitigations_off() || !boot_cpu_has_bug(X86_BUG_TSA)) {
+               tsa_mitigation = TSA_MITIGATION_NONE;
+               return;
+       }
+ 
+       if (tsa_mitigation == TSA_MITIGATION_NONE)
+               return;
+ 
+       if (!boot_cpu_has(X86_FEATURE_VERW_CLEAR)) {
+               tsa_mitigation = TSA_MITIGATION_UCODE_NEEDED;
+               goto out;
+       }
+ 
+       if (tsa_mitigation == TSA_MITIGATION_AUTO)
+               tsa_mitigation = TSA_MITIGATION_FULL;
+ 
+       /*
+        * No need to set verw_clear_cpu_buf_mitigation_selected - it
+        * doesn't fit all cases here and it is not needed because this
+        * is the only VERW-based mitigation on AMD.
+        */
+ out:
+       pr_info("%s\n", tsa_strings[tsa_mitigation]);
+ }
+ 
+ static void __init tsa_apply_mitigation(void)
+ {
+       switch (tsa_mitigation) {
+       case TSA_MITIGATION_USER_KERNEL:
+               setup_force_cpu_cap(X86_FEATURE_CLEAR_CPU_BUF);
+               break;
+       case TSA_MITIGATION_VM:
+               setup_force_cpu_cap(X86_FEATURE_CLEAR_CPU_BUF_VM);
+               break;
+       case TSA_MITIGATION_FULL:
+               setup_force_cpu_cap(X86_FEATURE_CLEAR_CPU_BUF);
+               setup_force_cpu_cap(X86_FEATURE_CLEAR_CPU_BUF_VM);
+               break;
+       default:
+               break;
+       }
+ }
+ 
  #undef pr_fmt
  #define pr_fmt(fmt)     "Spectre V2 : " fmt