Linux Inadvertently Has Been Leaving IBRS-Mitigated Systems Without STIBP

[phoronix]

Phoronix: Linux Inadvertently Has Been Leaving IBRS-Mitigated Systems Without STIBP

The Linux kernel since last year has mistakenly left systems relying on the original Indirect Branch Restricted Speculation (IBRS) for Spectre V2 mitigation without Single Threaded Indirect Branch Predictor (STIBP) coverage for cross-HyperThread dealing with this Spectre vulnerability. There is a patch underway that is resolving this issue for Intel Skylake era systems...

https://www.phoronix.com/news/Linux-IBRS-With-STIBP-Patch

[aviallon]

The performance impact is so enormous on Skylake that I ended up doing two boot entries on my NixOS setup, with one of them disabling all mitigations. Compilation is atrociously slow otherwise.

[ppcorp]

I hate when that happens

[CTTY]

There was also the bug, that systems had no mitigation after suspend (for quite a long time).
A lot of people review the code, but it seams so complex that these mistakes just happen.

[kiffmet]

On the systems where STIBP should be enabled, but isn't, does that show in /sys/devices/system/cpu/vulnerabilities/spectre_v2 or does the system always claim it's enabled?
That's my output on a 5900X with Kernel 6.2.:

Mitigation: Retpolines, IBPB: conditional, IBRS_FW, STIBP: always-on, RSB filling, PBRSB-eIBRS: Not affected