ibrs.patch

diff -purN linux-4.15.4.org/arch/x86/entry/calling.h linux-4.15.4/arch/x86/entry/calling.h
--- linux-4.15.4.org/arch/x86/entry/calling.h	2018-02-16 19:07:01.000000000 +0000
+++ linux-4.15.4/arch/x86/entry/calling.h	2018-02-17 16:14:20.482102170 +0000
@@ -6,6 +6,8 @@
 #include <asm/percpu.h>
 #include <asm/asm-offsets.h>
 #include <asm/processor-flags.h>
+#include <asm/msr-index.h>
+#include <asm/cpufeatures.h>
 
 /*
 
@@ -349,3 +351,75 @@ For 32-bit we have the following convent
 .Lafter_call_\@:
 #endif
 .endm
+
+/*
+ * IBRS related macros
+ */
+
+.macro PUSH_MSR_REGS
+	pushq	%rax
+	pushq	%rcx
+	pushq	%rdx
+.endm
+
+.macro POP_MSR_REGS
+	popq	%rdx
+	popq	%rcx
+	popq	%rax
+.endm
+
+.macro WRMSR_ASM msr_nr:req edx_val:req eax_val:req
+	movl	\msr_nr, %ecx
+	movl	\edx_val, %edx
+	movl	\eax_val, %eax
+	wrmsr
+.endm
+
+.macro ENABLE_IBRS
+	STATIC_JUMP_IF_FALSE .Lskip_\@, specctrl_ibrs, def=0
+	PUSH_MSR_REGS
+	WRMSR_ASM $MSR_IA32_SPEC_CTRL, $0, $SPEC_CTRL_ENABLE_IBRS
+	POP_MSR_REGS
+.Lskip_\@:
+.endm
+
+.macro DISABLE_IBRS
+	STATIC_JUMP_IF_FALSE .Lskip_\@, specctrl_ibrs, def=0
+	PUSH_MSR_REGS
+	WRMSR_ASM $MSR_IA32_SPEC_CTRL, $0, $SPEC_CTRL_DISABLE_IBRS
+	POP_MSR_REGS
+.Lskip_\@:
+.endm
+
+.macro ENABLE_IBRS_CLOBBER
+	STATIC_JUMP_IF_FALSE .Lskip_\@, specctrl_ibrs, def=0
+	WRMSR_ASM $MSR_IA32_SPEC_CTRL, $0, $SPEC_CTRL_ENABLE_IBRS
+.Lskip_\@:
+.endm
+
+.macro DISABLE_IBRS_CLOBBER
+	STATIC_JUMP_IF_FALSE .Lskip_\@, specctrl_ibrs, def=0
+	WRMSR_ASM $MSR_IA32_SPEC_CTRL, $0, $SPEC_CTRL_DISABLE_IBRS
+.Lskip_\@:
+.endm
+
+.macro ENABLE_IBRS_SAVE_AND_CLOBBER save_reg:req
+	STATIC_JUMP_IF_FALSE .Lskip_\@, specctrl_ibrs, def=0
+	movl	$MSR_IA32_SPEC_CTRL, %ecx
+	rdmsr
+	movl	%eax, \save_reg
+	movl	$0, %edx
+	movl	$SPEC_CTRL_ENABLE_IBRS, %eax
+	wrmsr
+.Lskip_\@:
+.endm
+
+.macro RESTORE_IBRS_CLOBBER save_reg:req
+	STATIC_JUMP_IF_FALSE .Lskip_\@, specctrl_ibrs, def=0
+	/* Set IBRS to the value saved in the save_reg */
+	movl    $MSR_IA32_SPEC_CTRL, %ecx
+	movl    $0, %edx
+	movl    \save_reg, %eax
+	wrmsr
+.Lskip_\@:
+.endm
diff -purN linux-4.15.4.org/arch/x86/entry/entry_64_compat.S linux-4.15.4/arch/x86/entry/entry_64_compat.S
--- linux-4.15.4.org/arch/x86/entry/entry_64_compat.S	2018-02-16 19:07:01.000000000 +0000
+++ linux-4.15.4/arch/x86/entry/entry_64_compat.S	2018-02-17 16:14:20.482102170 +0000
@@ -54,6 +54,7 @@ ENTRY(entry_SYSENTER_compat)
 	SWITCH_TO_KERNEL_CR3 scratch_reg=%rsp
 
 	movq	PER_CPU_VAR(cpu_current_top_of_stack), %rsp
+	ENABLE_IBRS
 
 	/*
 	 * User tracing code (ptrace or signal handlers) might assume that
@@ -225,7 +226,12 @@ GLOBAL(entry_SYSCALL_compat_after_hwfram
 	pushq   $0			/* pt_regs->r15 = 0 */
 
 	/*
-	 * User mode is traced as though IRQs are on, and SYSENTER
+	 * We just saved %rdi so it is safe to clobber.  It is not
+	 * preserved during the C calls inside TRACE_IRQS_OFF anyway.
+	 */
+	ENABLE_IBRS_CLOBBER /* clobbers %rax, %rcx, %rdx */
+
+	/* User mode is traced as though IRQs are on, and SYSENTER
 	 * turned them off.
 	 */
 	TRACE_IRQS_OFF
@@ -239,6 +245,12 @@ GLOBAL(entry_SYSCALL_compat_after_hwfram
 	/* Opportunistic SYSRET */
 sysret32_from_system_call:
 	TRACE_IRQS_ON			/* User mode traces as IRQs on. */
+	/*
+	 * Clobber of %rax, %rcx, %rdx is OK before register restoring.
+	 * This is safe to do here because we have no indirect branches
+	 * between here and the return to userspace (sysretl).
+	 */
+	DISABLE_IBRS_CLOBBER
 	movq	RBX(%rsp), %rbx		/* pt_regs->rbx */
 	movq	RBP(%rsp), %rbp		/* pt_regs->rbp */
 	movq	EFLAGS(%rsp), %r11	/* pt_regs->flags (in r11) */
diff -purN linux-4.15.4.org/arch/x86/entry/entry_64.S linux-4.15.4/arch/x86/entry/entry_64.S
--- linux-4.15.4.org/arch/x86/entry/entry_64.S	2018-02-16 19:07:01.000000000 +0000
+++ linux-4.15.4/arch/x86/entry/entry_64.S	2018-02-17 16:14:20.482102170 +0000
@@ -175,6 +175,8 @@ ENTRY(entry_SYSCALL_64_trampoline)
 
 	/* Load the top of the task stack into RSP */
 	movq	CPU_ENTRY_AREA_tss + TSS_sp1 + CPU_ENTRY_AREA, %rsp
+	/* Stack is usable, use the non-clobbering IBRS enable: */
+	ENABLE_IBRS
 
 	/* Start building the simulated IRET frame. */
 	pushq	$__USER_DS			/* pt_regs->ss */
@@ -218,6 +220,8 @@ ENTRY(entry_SYSCALL_64)
 	 */
 	movq	%rsp, PER_CPU_VAR(rsp_scratch)
 	movq	PER_CPU_VAR(cpu_current_top_of_stack), %rsp
+	/* Stack is usable, use the non-clobbering IBRS enable: */
+	ENABLE_IBRS
 
 	/* Construct struct pt_regs on stack */
 	pushq	$__USER_DS			/* pt_regs->ss */
@@ -345,6 +349,7 @@ syscall_return_via_sysret:
 	 * We are on the trampoline stack.  All regs except RDI are live.
 	 * We can do future final exit work right here.
 	 */
+	DISABLE_IBRS
 	SWITCH_TO_USER_CR3_STACK scratch_reg=%rdi
 
 	popq	%rdi
@@ -654,6 +659,7 @@ GLOBAL(swapgs_restore_regs_and_return_to
 	 * We can do future final exit work right here.
 	 */
 
+	DISABLE_IBRS
 	SWITCH_TO_USER_CR3_STACK scratch_reg=%rdi
 
 	/* Restore RDI. */
@@ -741,6 +747,14 @@ native_irq_return_ldt:
 	SWAPGS					/* to kernel GS */
 	SWITCH_TO_KERNEL_CR3 scratch_reg=%rdi	/* to kernel CR3 */
 
+	/*
+	 * Normally we enable IBRS when we switch to kernel's CR3.
+	 * But we are going to switch back to user CR3 immediately
+	 * in this routine after fixing ESPFIX stack.  There is
+	 * no vulnerable code branching for IBRS to protect.
+	 * We don't toggle IBRS to avoid the cost of two MSR writes.
+	 */
+
 	movq	PER_CPU_VAR(espfix_waddr), %rdi
 	movq	%rax, (0*8)(%rdi)		/* user RAX */
 	movq	(1*8)(%rsp), %rax		/* user RIP */
@@ -874,6 +888,8 @@ ENTRY(switch_to_thread_stack)
 	SWITCH_TO_KERNEL_CR3 scratch_reg=%rdi
 	movq	%rsp, %rdi
 	movq	PER_CPU_VAR(cpu_current_top_of_stack), %rsp
+	/* Stack is usable, use the non-clobbering IBRS enable: */
+	ENABLE_IBRS
 	UNWIND_HINT sp_offset=16 sp_reg=ORC_REG_DI
 
 	pushq	7*8(%rdi)		/* regs->ss */
@@ -1176,6 +1192,7 @@ ENTRY(paranoid_entry)
 
 1:
 	SAVE_AND_SWITCH_TO_KERNEL_CR3 scratch_reg=%rax save_reg=%r14
+	ENABLE_IBRS_SAVE_AND_CLOBBER save_reg=%r13d
 
 	ret
 END(paranoid_entry)
@@ -1199,6 +1216,7 @@ ENTRY(paranoid_exit)
 	testl	%ebx, %ebx			/* swapgs needed? */
 	jnz	.Lparanoid_exit_no_swapgs
 	TRACE_IRQS_IRETQ
+	RESTORE_IBRS_CLOBBER save_reg=%r13d
 	RESTORE_CR3	scratch_reg=%rbx save_reg=%r14
 	SWAPGS_UNSAFE_STACK
 	jmp	.Lparanoid_exit_restore
@@ -1229,6 +1247,7 @@ ENTRY(error_entry)
 	SWAPGS
 	/* We have user CR3.  Change to kernel CR3. */
 	SWITCH_TO_KERNEL_CR3 scratch_reg=%rax
+	ENABLE_IBRS_CLOBBER
 
 .Lerror_entry_from_usermode_after_swapgs:
 	/* Put us onto the real thread stack. */
@@ -1276,6 +1295,7 @@ ENTRY(error_entry)
 	 */
 	SWAPGS
 	SWITCH_TO_KERNEL_CR3 scratch_reg=%rax
+	ENABLE_IBRS_CLOBBER
 	jmp .Lerror_entry_done
 
 .Lbstep_iret:
@@ -1290,6 +1310,7 @@ ENTRY(error_entry)
 	 */
 	SWAPGS
 	SWITCH_TO_KERNEL_CR3 scratch_reg=%rax
+	ENABLE_IBRS
 
 	/*
 	 * Pretend that the exception came from user mode: set up pt_regs
@@ -1391,6 +1412,7 @@ ENTRY(nmi)
 	SWITCH_TO_KERNEL_CR3 scratch_reg=%rdx
 	movq	%rsp, %rdx
 	movq	PER_CPU_VAR(cpu_current_top_of_stack), %rsp
+	ENABLE_IBRS
 	UNWIND_HINT_IRET_REGS base=%rdx offset=8
 	pushq	5*8(%rdx)	/* pt_regs->ss */
 	pushq	4*8(%rdx)	/* pt_regs->rsp */
@@ -1641,6 +1663,7 @@ end_repeat_nmi:
 	movq	$-1, %rsi
 	call	do_nmi
 
+	RESTORE_IBRS_CLOBBER save_reg=%r13d
 	RESTORE_CR3 scratch_reg=%r15 save_reg=%r14
 
 	testl	%ebx, %ebx			/* swapgs needed? */
diff -purN linux-4.15.4.org/arch/x86/include/asm/msr-index.h linux-4.15.4/arch/x86/include/asm/msr-index.h
--- linux-4.15.4.org/arch/x86/include/asm/msr-index.h	2018-02-16 19:07:01.000000000 +0000
+++ linux-4.15.4/arch/x86/include/asm/msr-index.h	2018-02-17 16:01:35.568806118 +0000
@@ -42,6 +42,9 @@
 #define MSR_IA32_SPEC_CTRL		0x00000048 /* Speculation Control */
 #define SPEC_CTRL_IBRS			(1 << 0)   /* Indirect Branch Restricted Speculation */
 #define SPEC_CTRL_STIBP			(1 << 1)   /* Single Thread Indirect Branch Predictors */
+#define SPEC_CTRL_DISABLE_IBRS         0x00000000
+#define SPEC_CTRL_ENABLE_IBRS          0x00000001
+
 
 #define MSR_IA32_PRED_CMD		0x00000049 /* Prediction Command */
 #define PRED_CMD_IBPB			(1 << 0)   /* Indirect Branch Prediction Barrier */
diff -purN linux-4.15.4.org/arch/x86/include/asm/mwait.h linux-4.15.4/arch/x86/include/asm/mwait.h
--- linux-4.15.4.org/arch/x86/include/asm/mwait.h	2018-02-16 19:07:01.000000000 +0000
+++ linux-4.15.4/arch/x86/include/asm/mwait.h	2018-02-17 16:14:34.748950720 +0000
@@ -6,6 +6,7 @@
 #include <linux/sched/idle.h>
 
 #include <asm/cpufeature.h>
+#include <asm/nospec-branch.h>
 
 #define MWAIT_SUBSTATE_MASK		0xf
 #define MWAIT_CSTATE_MASK		0xf
@@ -106,9 +107,21 @@ static inline void mwait_idle_with_hints
 			mb();
 		}
 
+	       /*
+		* CPUs run faster with speculation protection
+		* disabled.  All CPU threads in a core must
+		* disable speculation protection for it to be
+		* disabled.  Disable it while we are idle so the
+		* other hyperthread can run fast.
+		*
+		* Interrupts have been disabled at this point.
+		*/
+
+		specctrl_unprotected_begin();
 		__monitor((void *)&current_thread_info()->flags, 0, 0);
 		if (!need_resched())
 			__mwait(eax, ecx);
+		specctrl_unprotected_end();
 	}
 	current_clr_polling();
 }
diff -purN linux-4.15.4.org/arch/x86/include/asm/nospec-branch.h linux-4.15.4/arch/x86/include/asm/nospec-branch.h
--- linux-4.15.4.org/arch/x86/include/asm/nospec-branch.h	2018-02-16 19:07:01.000000000 +0000
+++ linux-4.15.4/arch/x86/include/asm/nospec-branch.h	2018-02-17 16:14:34.748950720 +0000
@@ -3,6 +3,8 @@
 #ifndef _ASM_X86_NOSPEC_BRANCH_H_
 #define _ASM_X86_NOSPEC_BRANCH_H_
 
+#include <linux/static_key.h>
+
 #include <asm/alternative.h>
 #include <asm/alternative-asm.h>
 #include <asm/cpufeatures.h>
@@ -170,5 +172,16 @@ static inline void indirect_branch_predi
 			  ASM_NO_INPUT_CLOBBER("eax", "ecx", "edx", "memory"));
 }
 
+ 
+
+DECLARE_STATIC_KEY_FALSE(specctrl_ibrs);
+
+void specctrl_init_features(void);
+void specctrl_update_features(void);
+bool specctrl_force_enable_ibrs(void);
+bool specctrl_cond_enable_ibrs(bool full_retpoline);
+void specctrl_unprotected_begin(void);
+void specctrl_unprotected_end(void);
+
 #endif /* __ASSEMBLY__ */
 #endif /* _ASM_X86_NOSPEC_BRANCH_H_ */
diff -purN linux-4.15.4.org/arch/x86/kernel/cpu/bugs.c linux-4.15.4/arch/x86/kernel/cpu/bugs.c
--- linux-4.15.4.org/arch/x86/kernel/cpu/bugs.c	2018-02-16 19:07:01.000000000 +0000
+++ linux-4.15.4/arch/x86/kernel/cpu/bugs.c	2018-02-17 16:13:27.013668256 +0000
@@ -39,6 +39,7 @@ void __init check_bugs(void)
 
 	/* Select the proper spectre mitigation before patching alternatives */
 	spectre_v2_select_mitigation();
+	specctrl_init_features();
 
 #ifdef CONFIG_X86_32
 	/*
@@ -80,6 +81,7 @@ enum spectre_v2_mitigation_cmd {
 	SPECTRE_V2_CMD_RETPOLINE,
 	SPECTRE_V2_CMD_RETPOLINE_GENERIC,
 	SPECTRE_V2_CMD_RETPOLINE_AMD,
+	SPECTRE_V2_CMD_IBRS,
 };
 
 static const char *spectre_v2_strings[] = {
@@ -88,12 +90,13 @@ static const char *spectre_v2_strings[]
 	[SPECTRE_V2_RETPOLINE_MINIMAL_AMD]	= "Vulnerable: Minimal AMD ASM retpoline",
 	[SPECTRE_V2_RETPOLINE_GENERIC]		= "Mitigation: Full generic retpoline",
 	[SPECTRE_V2_RETPOLINE_AMD]		= "Mitigation: Full AMD retpoline",
+	[SPECTRE_V2_IBRS]			= "Mitigation: Indirect Branch Restricted Speculation",
 };
 
 #undef pr_fmt
 #define pr_fmt(fmt)     "Spectre V2 : " fmt
 
-static enum spectre_v2_mitigation spectre_v2_enabled = SPECTRE_V2_NONE;
+enum spectre_v2_mitigation spectre_v2_enabled = SPECTRE_V2_NONE;
 
 #ifdef RETPOLINE
 static bool spectre_v2_bad_module;
@@ -147,6 +150,7 @@ static const struct {
 } mitigation_options[] = {
 	{ "off",               SPECTRE_V2_CMD_NONE,              false },
 	{ "on",                SPECTRE_V2_CMD_FORCE,             true },
+	{ "ibrs",              SPECTRE_V2_CMD_IBRS,		 false },
 	{ "retpoline",         SPECTRE_V2_CMD_RETPOLINE,         false },
 	{ "retpoline,amd",     SPECTRE_V2_CMD_RETPOLINE_AMD,     false },
 	{ "retpoline,generic", SPECTRE_V2_CMD_RETPOLINE_GENERIC, false },
@@ -223,6 +227,7 @@ static bool __init is_skylake_era(void)
 
 static void __init spectre_v2_select_mitigation(void)
 {
+	bool full_retpoline = IS_ENABLED(CONFIG_RETPOLINE) && retp_compiler();
 	enum spectre_v2_mitigation_cmd cmd = spectre_v2_parse_cmdline();
 	enum spectre_v2_mitigation mode = SPECTRE_V2_NONE;
 
@@ -237,6 +242,13 @@ static void __init spectre_v2_select_mit
 	switch (cmd) {
 	case SPECTRE_V2_CMD_NONE:
 		return;
+	case SPECTRE_V2_CMD_IBRS:
+		/* Command line requested IBRS. Try to enable it */
+		if (specctrl_force_enable_ibrs()) {
+			mode = SPECTRE_V2_IBRS;
+			goto set_mode;
+		}
+		/* FALLTRHU */
 
 	case SPECTRE_V2_CMD_FORCE:
 	case SPECTRE_V2_CMD_AUTO:
@@ -277,6 +289,7 @@ retpoline_auto:
 		setup_force_cpu_cap(X86_FEATURE_RETPOLINE);
 	}
 
+set_mode:
 	spectre_v2_enabled = mode;
 	pr_info("%s\n", spectre_v2_strings[mode]);
 
diff -purN linux-4.15.4.org/arch/x86/kernel/cpu/common.c linux-4.15.4/arch/x86/kernel/cpu/common.c
--- linux-4.15.4.org/arch/x86/kernel/cpu/common.c	2018-02-16 19:07:01.000000000 +0000
+++ linux-4.15.4/arch/x86/kernel/cpu/common.c	2018-02-17 15:58:56.514432358 +0000
@@ -770,6 +770,23 @@ static void init_speculation_control(str
 		set_cpu_cap(c, X86_FEATURE_STIBP);
 }
 
+/*
+ * This late synchronization of CPU caps has no effect on alternatives patching
+ * but updates the visible feature bits per CPU.
+ */
+void cpu_caps_sync_late(void)
+{
+	int cpu;
+
+	lockdep_assert_cpus_held();
+
+	for_each_online_cpu(cpu) {
+		struct cpuinfo_x86 *c = &cpu_data(cpu);
+
+		apply_forced_caps(c);
+	}
+}
+
 void get_cpu_cap(struct cpuinfo_x86 *c)
 {
 	u32 eax, ebx, ecx, edx;
diff -purN linux-4.15.4.org/arch/x86/kernel/cpu/cpu.h linux-4.15.4/arch/x86/kernel/cpu/cpu.h
--- linux-4.15.4.org/arch/x86/kernel/cpu/cpu.h	2018-02-16 19:07:01.000000000 +0000
+++ linux-4.15.4/arch/x86/kernel/cpu/cpu.h	2018-02-17 15:58:56.514432358 +0000
@@ -46,6 +46,9 @@ extern const struct cpu_dev *const __x86
 			    *const __x86_cpu_dev_end[];
 
 extern void get_cpu_cap(struct cpuinfo_x86 *c);
+
+extern void cpu_caps_sync_late(void);
+
 extern void cpu_detect_cache_sizes(struct cpuinfo_x86 *c);
 
 unsigned int aperfmperf_get_khz(int cpu);
diff -purN linux-4.15.4.org/arch/x86/kernel/cpu/Makefile linux-4.15.4/arch/x86/kernel/cpu/Makefile
--- linux-4.15.4.org/arch/x86/kernel/cpu/Makefile	2018-02-16 19:07:01.000000000 +0000
+++ linux-4.15.4/arch/x86/kernel/cpu/Makefile	2018-02-17 16:05:18.747677159 +0000
@@ -24,6 +24,7 @@ obj-y			+= match.o
 obj-y			+= bugs.o
 obj-y			+= aperfmperf.o
 obj-y			+= cpuid-deps.o
+obj-y			+= specctrl.o
 
 obj-$(CONFIG_PROC_FS)	+= proc.o
 obj-$(CONFIG_X86_FEATURE_NAMES) += capflags.o powerflags.o
diff -purN linux-4.15.4.org/arch/x86/kernel/cpu/scattered.c linux-4.15.4/arch/x86/kernel/cpu/scattered.c
--- linux-4.15.4.org/arch/x86/kernel/cpu/scattered.c	2018-02-16 19:07:01.000000000 +0000
+++ linux-4.15.4/arch/x86/kernel/cpu/scattered.c	2018-02-17 16:02:51.245100708 +0000
@@ -28,6 +28,7 @@ static const struct cpuid_bit cpuid_bits
 	{ X86_FEATURE_HW_PSTATE,	CPUID_EDX,  7, 0x80000007, 0 },
 	{ X86_FEATURE_CPB,		CPUID_EDX,  9, 0x80000007, 0 },
 	{ X86_FEATURE_PROC_FEEDBACK,    CPUID_EDX, 11, 0x80000007, 0 },
+	{ X86_FEATURE_SPEC_CTRL,        CPUID_EDX, 26, 0x00000007, 0 },
 	{ X86_FEATURE_SME,		CPUID_EAX,  0, 0x8000001f, 0 },
 	{ 0, 0, 0, 0, 0 }
 };
diff -purN linux-4.15.4.org/arch/x86/kernel/cpu/specctrl.c linux-4.15.4/arch/x86/kernel/cpu/specctrl.c
--- linux-4.15.4.org/arch/x86/kernel/cpu/specctrl.c	1970-01-01 00:00:00.000000000 +0000
+++ linux-4.15.4/arch/x86/kernel/cpu/specctrl.c	2018-02-17 16:14:34.748950720 +0000
@@ -0,0 +1,104 @@
+// SPDX-License-Identifier: GPL-2.0
+
+#include <asm/nospec-branch.h>
+#include <asm/cpufeatures.h>
+#include <asm/cpufeature.h>
+#include <asm/microcode.h>
+
+/* Static key to control enablement of IBRS */
+DEFINE_STATIC_KEY_FALSE(specctrl_ibrs);
+EXPORT_SYMBOL_GPL(specctrl_ibrs);
+
+extern enum spectre_v2_mitigation spectre_v2_enabled;
+
+/**
+ * specctrl_init_features - Init speculation control features
+ *
+ * Called after static key patching is functional. The decision which
+ * mitigation to use has been made already in check_bugs() before patching
+ * the alternatives.
+ */
+void __init specctrl_init_features(void)
+{
+	if (spectre_v2_enabled != SPECTRE_V2_IBRS)
+		return;
+
+	static_branch_enable(&specctrl_ibrs);
+}
+
+#if 0
+/**
+ * specctrl_update_features - Update the speculation control features
+ *
+ * Called after a late microcode load changed CPU feature bits.
+ *
+ * Note: This is called with CPU hotplug lock and microcode mutex held.
+ */
+void specctrl_update_features(void)
+{
+	if (static_key_enabled(&specctrl_ibrs))
+		return;
+
+	/*
+	 * FIXME: Either the CPU bits need to be reevaluated here or its
+	 * done in the late microcode loader. Borislav ?
+	 */
+	spectre_v2_select_mitigation();
+	if (spectre_v2_enabled != SPECTRE_V2_IBRS)
+		return;
+	static_branch_enable_cpuslocked(&specctrl_ibrs);
+}
+#endif
+
+bool specctrl_force_enable_ibrs(void)
+{
+	if (!boot_cpu_has(X86_FEATURE_SPEC_CTRL))
+		return false;
+	return true;
+}
+
+bool specctrl_cond_enable_ibrs(bool full_retpoline)
+{
+	if (!boot_cpu_has(X86_FEATURE_SPEC_CTRL))
+		return false;
+	/*
+	 * FIXME: Add logic here to decide what the best option is for a
+	 * particular CPU.
+	 *
+	 * For now, don't enable IBRS unless the user choose that boot option
+	 * in specctrl_force_enable_ibrs
+	 */
+	return false;
+}
+
+static inline void __disable_indirect_speculation(void)
+{
+	native_wrmsrl(MSR_IA32_SPEC_CTRL, SPEC_CTRL_ENABLE_IBRS);
+}
+
+static inline void __enable_indirect_speculation(void)
+{
+	native_wrmsrl(MSR_IA32_SPEC_CTRL, SPEC_CTRL_DISABLE_IBRS);
+}
+
+
+/*
+ * Interrupts must be disabled to begin unprotected speculation.
+ * Otherwise interrupts could come in and start running in unprotected mode.
+ */
+
+void specctrl_unprotected_begin(void)
+{
+	/* should use lockdep_assert_irqs_disabled() when available */
+	WARN_ON_ONCE(!irqs_disabled());
+	if (static_branch_unlikely(&specctrl_ibrs))
+		__enable_indirect_speculation();
+}
+EXPORT_SYMBOL_GPL(specctrl_unprotected_begin);
+
+void specctrl_unprotected_end(void)
+{
+	if (static_branch_unlikely(&specctrl_ibrs))
+		__disable_indirect_speculation();
+}
+EXPORT_SYMBOL_GPL(specctrl_unprotected_end);
diff -purN linux-4.15.4.org/arch/x86/kernel/process.c linux-4.15.4/arch/x86/kernel/process.c
--- linux-4.15.4.org/arch/x86/kernel/process.c	2018-02-16 19:07:01.000000000 +0000
+++ linux-4.15.4/arch/x86/kernel/process.c	2018-02-17 16:14:34.748950720 +0000
@@ -39,6 +39,7 @@
 #include <asm/switch_to.h>
 #include <asm/desc.h>
 #include <asm/prctl.h>
+#include <asm/nospec-branch.h>
 
 /*
  * per-CPU TSS segments. Threads are completely 'soft' on Linux,
@@ -466,11 +467,15 @@ static __cpuidle void mwait_idle(void)
 			mb(); /* quirk */
 		}
 
+		specctrl_unprotected_begin();
 		__monitor((void *)&current_thread_info()->flags, 0, 0);
-		if (!need_resched())
+		if (!need_resched()) {
 			__sti_mwait(0, 0);
-		else
+			specctrl_unprotected_end();
+		} else {
+			specctrl_unprotected_end();
 			local_irq_enable();
+		}
 		trace_cpu_idle_rcuidle(PWR_EVENT_EXIT, smp_processor_id());
 	} else {
 		local_irq_enable();