From nobody Mon Apr 6 12:18:30 2026 Received: from mgamail.intel.com (mgamail.intel.com [198.175.65.16]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 049A03E7169; Thu, 19 Mar 2026 15:42:34 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=198.175.65.16 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1773934956; cv=none; b=JDbt3Wd+47d+WfUpv5DeVE2beaBQDP4OsyvhjktAdPlp6sE3DS+Mr++P/84aJq3fbtZlWbSQOmR3fhPsMosSIxuPmq50lhgM5cXvxeHfH/b/pcZ3zYy4aey3jPsMx+VucvULUJSXUNcqkVEV7KGok4z9Om2Dsu2f5QImTV8x9Vc= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1773934956; c=relaxed/simple; bh=0tkO8GsBvrqJDvigQHXB7gncr+A13P3Biy4QfGW3Hfw=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=luUyqhSVTxO8W6okneVw72Tn4zJzUgZRYHRKUGjk6dz0y/J6D3d2FPe8NzpuvyUHjxp+tKI9kQWBRK8SWF3wK4bNQkhxGSROFtSrM7B5sfKpwiMbk/khfjFq9GQYMHfXYARxWJLbTk2fqxKznAJXiwcWqInK27XT1+PpGO0XsiE= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.intel.com; spf=pass smtp.mailfrom=linux.intel.com; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b=Xl2vd1/E; arc=none smtp.client-ip=198.175.65.16 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.intel.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.intel.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b="Xl2vd1/E" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1773934955; x=1805470955; h=date:from:to:cc:subject:message-id:references: mime-version:in-reply-to; bh=0tkO8GsBvrqJDvigQHXB7gncr+A13P3Biy4QfGW3Hfw=; b=Xl2vd1/EtUF8eYAHWF5kI9Xyv7lXQTl8FyrgttSc0f6za0Z9LxGJCEty vs5LqnxcUj+kWeEmIIByFuwRqO1gCrXI04gFazV2M5JnzBpyzDb3+sEXr LZdzuYTZRxBMJGSiU8pBT7aazmG4s2qUY33Jc9X2957W+nIF8JzIAa8/i VRdTdAinxtLcYvC+CnZErem5uUrXj1wa+lEuxzs7avM7CB8woM7zTCc61 yhGtl/DYZ97Y+ZdbQLpiQfzBoq4DR3HIxYiPHUW+b5KcWxiTjCo17AoR9 QiMmeXv/SLhSave0K4IaHOP/ZtXlcEmjnC79mUKBwy6g3UF2IC4WYwiWI Q==; X-CSE-ConnectionGUID: 5Vv9yaU3TnCq/vn373CQdQ== X-CSE-MsgGUID: PN13FugXTQWK/Qr58QBFPw== X-IronPort-AV: E=McAfee;i="6800,10657,11734"; a="75195873" X-IronPort-AV: E=Sophos;i="6.23,129,1770624000"; d="scan'208";a="75195873" Received: from fmviesa010.fm.intel.com ([10.60.135.150]) by orvoesa108.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 19 Mar 2026 08:42:34 -0700 X-CSE-ConnectionGUID: +LJHJO45QCma7UqAM6o0GQ== X-CSE-MsgGUID: SwalfNLQT+Gd8angzo5rbw== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="6.23,129,1770624000"; d="scan'208";a="218891718" Received: from guptapa-desk.jf.intel.com (HELO desk) ([10.165.239.46]) by fmviesa010-auth.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 19 Mar 2026 08:42:32 -0700 Date: Thu, 19 Mar 2026 08:42:31 -0700 From: Pawan Gupta To: x86@kernel.org, Nikolay Borisov , "H. Peter Anvin" , Josh Poimboeuf , David Kaplan , Sean Christopherson , Borislav Petkov , Dave Hansen , Peter Zijlstra , Alexei Starovoitov , Daniel Borkmann , Andrii Nakryiko , KP Singh , Jiri Olsa , "David S. Miller" , David Laight , Andy Lutomirski , Thomas Gleixner , Ingo Molnar , David Ahern , Martin KaFai Lau , Eduard Zingerman , Song Liu , Yonghong Song , John Fastabend , Stanislav Fomichev , Hao Luo , Paolo Bonzini , Jonathan Corbet Cc: linux-kernel@vger.kernel.org, kvm@vger.kernel.org, Asit Mallick , Tao Zhang , bpf@vger.kernel.org, netdev@vger.kernel.org, linux-doc@vger.kernel.org Subject: [PATCH v7 09/10] x86/vmscape: Fix conflicting attack-vector controls with =force Message-ID: <20260319-vmscape-bhb-v7-9-b76a777a98af@linux.intel.com> X-Mailer: b4 0.15-dev References: <20260319-vmscape-bhb-v7-0-b76a777a98af@linux.intel.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: <20260319-vmscape-bhb-v7-0-b76a777a98af@linux.intel.com> Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" vmscape=3Dforce option currently defaults to AUTO mitigation. This is not correct because attack-vector controls overrides a mitigation in AUTO mode. This prevents a user from being able to force VMSCAPE mitigation when it conflicts with attack-vector controls. Kernel should deploy a forced mitigation irrespective of attack vectors. Instead of AUTO, use VMSCAPE_MITIGATION_ON that wins over attack-vector controls. Reviewed-by: Nikolay Borisov Signed-off-by: Pawan Gupta --- arch/x86/kernel/cpu/bugs.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c index 444b41302533..aa4a727f0abf 100644 --- a/arch/x86/kernel/cpu/bugs.c +++ b/arch/x86/kernel/cpu/bugs.c @@ -3058,6 +3058,7 @@ static void __init srso_apply_mitigation(void) enum vmscape_mitigations { VMSCAPE_MITIGATION_NONE, VMSCAPE_MITIGATION_AUTO, + VMSCAPE_MITIGATION_ON, VMSCAPE_MITIGATION_IBPB_EXIT_TO_USER, VMSCAPE_MITIGATION_IBPB_ON_VMEXIT, VMSCAPE_MITIGATION_BHB_CLEAR_EXIT_TO_USER, @@ -3066,6 +3067,7 @@ enum vmscape_mitigations { static const char * const vmscape_strings[] =3D { [VMSCAPE_MITIGATION_NONE] =3D "Vulnerable", /* [VMSCAPE_MITIGATION_AUTO] */ + /* [VMSCAPE_MITIGATION_ON] */ [VMSCAPE_MITIGATION_IBPB_EXIT_TO_USER] =3D "Mitigation: IBPB before exit= to userspace", [VMSCAPE_MITIGATION_IBPB_ON_VMEXIT] =3D "Mitigation: IBPB on VMEXIT", [VMSCAPE_MITIGATION_BHB_CLEAR_EXIT_TO_USER] =3D "Mitigation: Clear BHB be= fore exit to userspace", @@ -3085,7 +3087,7 @@ static int __init vmscape_parse_cmdline(char *str) vmscape_mitigation =3D VMSCAPE_MITIGATION_IBPB_EXIT_TO_USER; } else if (!strcmp(str, "force")) { setup_force_cpu_bug(X86_BUG_VMSCAPE); - vmscape_mitigation =3D VMSCAPE_MITIGATION_AUTO; + vmscape_mitigation =3D VMSCAPE_MITIGATION_ON; } else { pr_err("Ignoring unknown vmscape=3D%s option.\n", str); } @@ -3115,6 +3117,7 @@ static void __init vmscape_select_mitigation(void) break; =20 case VMSCAPE_MITIGATION_AUTO: + case VMSCAPE_MITIGATION_ON: /* * CPUs with BHI_CTRL(ADL and newer) can avoid the IBPB and use * BHB clear sequence. These CPUs are only vulnerable to the BHI @@ -3242,6 +3245,7 @@ void cpu_bugs_smt_update(void) switch (vmscape_mitigation) { case VMSCAPE_MITIGATION_NONE: case VMSCAPE_MITIGATION_AUTO: + case VMSCAPE_MITIGATION_ON: break; case VMSCAPE_MITIGATION_IBPB_ON_VMEXIT: case VMSCAPE_MITIGATION_IBPB_EXIT_TO_USER: --=20 2.34.1