From nobody Sun Feb 8 14:07:33 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id CBE576E602 for ; Tue, 7 May 2024 05:30:17 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1715059817; cv=none; b=RhmYhY7L8I+pPRZZHrW1mbGWou0h8uSpXBdOoi3eVt8HD199V1LyWj7HpqyI4Q2rVx3dtjSINMn3JIJlwabNzJV1Yv4sQigtuwrP3CfGTzmPYXQFbVMkyHz+dwb73c87dVhQQuNdo0u3ajJ2lzJeegP5wUILVwFNhQkhl/Nzjtk= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1715059817; c=relaxed/simple; bh=rjjbb87qU0Az3V5tnqRivUixNJ5fK4IwNpaXSwSoEyg=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=qHj6Jsum50M97HoKti/tR+BeUX8U1Ov49g8pDkz/kpGFE5GOE9fbVMswY8/GkTKeEJV0+pFFaGoShGzqTVUrAKGXGDrKC0qQ2DmWbXA1f5+rNTG+uJ5RdSi9cQ2NSohjA92eiUw3Hc0WtPo2cPU3TaOEwpxKODKe9D5I/bdMEvw= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=prRdCP2g; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="prRdCP2g" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 958C1C4AF65; Tue, 7 May 2024 05:30:16 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1715059817; bh=rjjbb87qU0Az3V5tnqRivUixNJ5fK4IwNpaXSwSoEyg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=prRdCP2g1WIHQ6TnRGJ6c13LybTEElCD1qSCXAh1DwIp1eLggps4Ipp1zdZ/QCsLG Zlj29uzTwEjaAXplnphLtVCnNc0NMpvhlAPk11Rsx/fQBesEl0feWPHW1uY/OI4sBD jzUbNKk1xIr/tPPFe/k4JMHudCfCXtUGlP28GjTaAKc5FNs+cIsvMo9I4bxNlSdhjJ PihDmFqvhphN1nXSiZpnNPUhb65kkKPt1SdaQMpWkLf+tsora9Mf0ekmuMJs2ji6Ol WoFy0nh7J6I7W/CQq3Y5gVis5sJMfHmOKStLF3BvNB7H5esJ9GRIm/VToFvtgrn7hj x42M3c+sU1wwg== From: Josh Poimboeuf To: x86@kernel.org Cc: linux-kernel@vger.kernel.org, Linus Torvalds , Daniel Sneddon , Pawan Gupta , Thomas Gleixner , Alexandre Chartre , Konrad Rzeszutek Wilk , Peter Zijlstra , Greg Kroah-Hartman , Sean Christopherson , Andrew Cooper , Dave Hansen , Nikolay Borisov , KP Singh , Waiman Long , Borislav Petkov , Ingo Molnar , Maksim Davydov Subject: [PATCH v5 3/3] x86/bugs: Add 'spectre_bhi=vmexit' cmdline option Date: Mon, 6 May 2024 22:30:06 -0700 Message-ID: <66327dcf87284a09ed17ac24227695ea3ba1f287.1715059256.git.jpoimboe@kernel.org> X-Mailer: git-send-email 2.44.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" In cloud environments it can be useful to *only* enable the vmexit mitigation and leave syscalls vulnerable. Add that as an option. This is similar to the old spectre_bhi=3Dauto option which was removed with the following commit: 36d4fe147c87 ("x86/bugs: Remove CONFIG_BHI_MITIGATION_AUTO and spectre_bh= i=3Dauto") with the main difference being that this has a more descriptive name and is disabled by default. Requested-by: Maksim Davydov Signed-off-by: Josh Poimboeuf Reviewed-by: Daniel Sneddon Reviewed-by: Nikolay Borisov --- Documentation/admin-guide/kernel-parameters.txt | 12 +++++++++--- arch/x86/kernel/cpu/bugs.c | 16 +++++++++++----- 2 files changed, 20 insertions(+), 8 deletions(-) diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentatio= n/admin-guide/kernel-parameters.txt index 213d0719e2b7..9c1f63f04502 100644 --- a/Documentation/admin-guide/kernel-parameters.txt +++ b/Documentation/admin-guide/kernel-parameters.txt @@ -6072,9 +6072,15 @@ deployment of the HW BHI control and the SW BHB clearing sequence. =20 - on - (default) Enable the HW or SW mitigation - as needed. - off - Disable the mitigation. + on - (default) Enable the HW or SW mitigation as + needed. This protects the kernel from + both syscalls and VMs. + vmexit - On systems which don't have the HW mitigation + available, enable the SW mitigation on vmexit + ONLY. On such systems, the host kernel is + protected from VM-originated BHI attacks, but + may still be vulnerable to syscall attacks. + off - Disable the mitigation. =20 spectre_v2=3D [X86,EARLY] Control mitigation of Spectre variant 2 (indirect branch speculation) vulnerability. diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c index ab18185894df..6974c8c9792d 100644 --- a/arch/x86/kernel/cpu/bugs.c +++ b/arch/x86/kernel/cpu/bugs.c @@ -1625,6 +1625,7 @@ static bool __init spec_ctrl_bhi_dis(void) enum bhi_mitigations { BHI_MITIGATION_OFF, BHI_MITIGATION_ON, + BHI_MITIGATION_VMEXIT_ONLY, }; =20 static enum bhi_mitigations bhi_mitigation __ro_after_init =3D @@ -1639,6 +1640,8 @@ static int __init spectre_bhi_parse_cmdline(char *str) bhi_mitigation =3D BHI_MITIGATION_OFF; else if (!strcmp(str, "on")) bhi_mitigation =3D BHI_MITIGATION_ON; + else if (!strcmp(str, "vmexit")) + bhi_mitigation =3D BHI_MITIGATION_VMEXIT_ONLY; else pr_err("Ignoring unknown spectre_bhi option (%s)", str); =20 @@ -1659,19 +1662,22 @@ static void __init bhi_select_mitigation(void) return; } =20 + /* Mitigate in hardware if supported */ if (spec_ctrl_bhi_dis()) return; =20 if (!IS_ENABLED(CONFIG_X86_64)) return; =20 - /* Mitigate KVM by default */ - setup_force_cpu_cap(X86_FEATURE_CLEAR_BHB_LOOP_ON_VMEXIT); - pr_info("Spectre BHI mitigation: SW BHB clearing on vm exit\n"); + if (bhi_mitigation =3D=3D BHI_MITIGATION_VMEXIT_ONLY) { + pr_info("Spectre BHI mitigation: SW BHB clearing on vm exit only\n"); + setup_force_cpu_cap(X86_FEATURE_CLEAR_BHB_LOOP_ON_VMEXIT); + return; + } =20 - /* Mitigate syscalls when the mitigation is forced =3Don */ + pr_info("Spectre BHI mitigation: SW BHB clearing on syscall and vm exit\n= "); setup_force_cpu_cap(X86_FEATURE_CLEAR_BHB_LOOP); - pr_info("Spectre BHI mitigation: SW BHB clearing on syscall\n"); + setup_force_cpu_cap(X86_FEATURE_CLEAR_BHB_LOOP_ON_VMEXIT); } =20 static void __init spectre_v2_select_mitigation(void) --=20 2.44.0