From nobody Sat Feb 7 12:08:02 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 075586BB5C for ; Tue, 7 May 2024 05:30:15 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1715059816; cv=none; b=DGExgpTzdA/j4aEk0RdE0wD7IEX+acsfiUlc55hr9SuuifzR0BL956zrbDvL1xjg/Uta0Iji14dHPqbT87YF0aWu1fVOLhkNRjM1Blj2Uuewx8TeGvDKrAVQ5rYDU8vr2nKpN6Qa0yyJTjd8pWdApheFH1SGW+aF4HW3LrulXXs= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1715059816; c=relaxed/simple; bh=dhxD0BQmqAI706CsxHyKFe5uwn+sRIafwU06Kh0NXw4=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=WigpqKOCU5u6P4nEkQ7ITXhXs+8yUYckv4ziUYGIXzmW+Pf+yOPA7NusFvHcdbuPmOuewmThfeXZKUXyD/K3597SGS2VUj38qOkpeJBZA1J7l6Obj/2FTjLofGrngl96VsjkAqXil18jjSPgQgRAFqr/GvECdoBWu/XvFHRwAMw= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=lYdaz3zv; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="lYdaz3zv" Received: by smtp.kernel.org (Postfix) with ESMTPSA id CC77BC4AF68; Tue, 7 May 2024 05:30:14 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1715059815; bh=dhxD0BQmqAI706CsxHyKFe5uwn+sRIafwU06Kh0NXw4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=lYdaz3zvz+6R1+VsKAteD6VEepUrjlOJILbgrPdVhObtoC6LSIDnDPV1zVX+y6OvE JhIjYkWK8YLZkklgMJfm1ZCk4tMWRSszyV1d+q4rBvy4XBiEg/xjCwW7936d7YBkcj YRC7Rm7lVes5u6nT0LkBqD4byG/h7SUtMp/QeBdHDofNaHd3xGGW0DdfpY9TDS4W+t x2Ven+V/E7MbEZCltiGW1cBWhgtnipcx3EaVpjVQ5zVke4hEB/lsJVBQ3hMxZuB4wK 4D5g8oWyvL4qoB6RFPxpaz7THX7yFht2CyGmZe4yUpDm5ifxPt2mhOfsDGeXGWnD4C nR7uwNNjy+Viw== From: Josh Poimboeuf To: x86@kernel.org Cc: linux-kernel@vger.kernel.org, Linus Torvalds , Daniel Sneddon , Pawan Gupta , Thomas Gleixner , Alexandre Chartre , Konrad Rzeszutek Wilk , Peter Zijlstra , Greg Kroah-Hartman , Sean Christopherson , Andrew Cooper , Dave Hansen , Nikolay Borisov , KP Singh , Waiman Long , Borislav Petkov , Ingo Molnar , "Paul E. McKenney" Subject: [PATCH v5 1/3] x86/syscall: Mark exit[_group] syscall handlers __noreturn Date: Mon, 6 May 2024 22:30:04 -0700 Message-ID: <9ad251f6258adde596fb1f4d6826309b9f239ed3.1715059256.git.jpoimboe@kernel.org> X-Mailer: git-send-email 2.44.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" The direct-call syscall dispatch function doesn't know that the exit() and exit_group() syscall handlers don't return, so the call sites aren't optimized accordingly. Fix that by marking those exit syscall declarations __noreturn. Fixes the following warnings: vmlinux.o: warning: objtool: x64_sys_call+0x2804: __x64_sys_exit() is mis= sing a __noreturn annotation vmlinux.o: warning: objtool: ia32_sys_call+0x29b6: __ia32_sys_exit_group(= ) is missing a __noreturn annotation Fixes: 7390db8aea0d ("x86/bhi: Add support for clearing branch history at s= yscall entry") Reported-by: "Paul E. McKenney" Closes: https://lkml.kernel.org/lkml/6dba9b32-db2c-4e6d-9500-7a08852f17a3@p= aulmck-laptop Tested-by: Paul E. McKenney Signed-off-by: Josh Poimboeuf --- arch/x86/entry/syscall_32.c | 10 ++++++---- arch/x86/entry/syscall_64.c | 9 ++++++--- arch/x86/entry/syscall_x32.c | 7 +++++-- arch/x86/entry/syscalls/syscall_32.tbl | 6 +++--- arch/x86/entry/syscalls/syscall_64.tbl | 6 +++--- arch/x86/um/sys_call_table_32.c | 10 ++++++---- arch/x86/um/sys_call_table_64.c | 11 +++++++---- scripts/syscalltbl.sh | 18 ++++++++++++++++-- tools/objtool/noreturns.h | 4 ++++ 9 files changed, 56 insertions(+), 25 deletions(-) diff --git a/arch/x86/entry/syscall_32.c b/arch/x86/entry/syscall_32.c index c2235bae17ef..8cc9950d7104 100644 --- a/arch/x86/entry/syscall_32.c +++ b/arch/x86/entry/syscall_32.c @@ -14,9 +14,12 @@ #endif =20 #define __SYSCALL(nr, sym) extern long __ia32_##sym(const struct pt_regs *= ); - +#define __SYSCALL_NORETURN(nr, sym) extern long __noreturn __ia32_##sym(co= nst struct pt_regs *); #include -#undef __SYSCALL +#undef __SYSCALL + +#undef __SYSCALL_NORETURN +#define __SYSCALL_NORETURN __SYSCALL =20 /* * The sys_call_table[] is no longer used for system calls, but @@ -28,11 +31,10 @@ const sys_call_ptr_t sys_call_table[] =3D { #include }; -#undef __SYSCALL +#undef __SYSCALL #endif =20 #define __SYSCALL(nr, sym) case nr: return __ia32_##sym(regs); - long ia32_sys_call(const struct pt_regs *regs, unsigned int nr) { switch (nr) { diff --git a/arch/x86/entry/syscall_64.c b/arch/x86/entry/syscall_64.c index 33b3f09e6f15..ba8354424860 100644 --- a/arch/x86/entry/syscall_64.c +++ b/arch/x86/entry/syscall_64.c @@ -8,8 +8,12 @@ #include =20 #define __SYSCALL(nr, sym) extern long __x64_##sym(const struct pt_regs *); +#define __SYSCALL_NORETURN(nr, sym) extern long __noreturn __x64_##sym(con= st struct pt_regs *); #include -#undef __SYSCALL +#undef __SYSCALL + +#undef __SYSCALL_NORETURN +#define __SYSCALL_NORETURN __SYSCALL =20 /* * The sys_call_table[] is no longer used for system calls, but @@ -20,10 +24,9 @@ const sys_call_ptr_t sys_call_table[] =3D { #include }; -#undef __SYSCALL +#undef __SYSCALL =20 #define __SYSCALL(nr, sym) case nr: return __x64_##sym(regs); - long x64_sys_call(const struct pt_regs *regs, unsigned int nr) { switch (nr) { diff --git a/arch/x86/entry/syscall_x32.c b/arch/x86/entry/syscall_x32.c index 03de4a932131..fb77908f44f3 100644 --- a/arch/x86/entry/syscall_x32.c +++ b/arch/x86/entry/syscall_x32.c @@ -8,11 +8,14 @@ #include =20 #define __SYSCALL(nr, sym) extern long __x64_##sym(const struct pt_regs *); +#define __SYSCALL_NORETURN(nr, sym) extern long __noreturn __x64_##sym(con= st struct pt_regs *); #include -#undef __SYSCALL +#undef __SYSCALL + +#undef __SYSCALL_NORETURN +#define __SYSCALL_NORETURN __SYSCALL =20 #define __SYSCALL(nr, sym) case nr: return __x64_##sym(regs); - long x32_sys_call(const struct pt_regs *regs, unsigned int nr) { switch (nr) { diff --git a/arch/x86/entry/syscalls/syscall_32.tbl b/arch/x86/entry/syscal= ls/syscall_32.tbl index 5f8591ce7f25..9e9a908cd50d 100644 --- a/arch/x86/entry/syscalls/syscall_32.tbl +++ b/arch/x86/entry/syscalls/syscall_32.tbl @@ -2,7 +2,7 @@ # 32-bit system call numbers and entry vectors # # The format is: -# +# [ [noreturn]] # # The __ia32_sys and __ia32_compat_sys stubs are created on-the-fly for # sys_*() system calls and compat_sys_*() compat system calls if @@ -12,7 +12,7 @@ # The abi is always "i386" for this file. # 0 i386 restart_syscall sys_restart_syscall -1 i386 exit sys_exit +1 i386 exit sys_exit - noreturn 2 i386 fork sys_fork 3 i386 read sys_read 4 i386 write sys_write @@ -263,7 +263,7 @@ 249 i386 io_cancel sys_io_cancel 250 i386 fadvise64 sys_ia32_fadvise64 # 251 is available for reuse (was briefly sys_set_zone_reclaim) -252 i386 exit_group sys_exit_group +252 i386 exit_group sys_exit_group - noreturn 253 i386 lookup_dcookie 254 i386 epoll_create sys_epoll_create 255 i386 epoll_ctl sys_epoll_ctl diff --git a/arch/x86/entry/syscalls/syscall_64.tbl b/arch/x86/entry/syscal= ls/syscall_64.tbl index 7e8d46f4147f..5ea7387c1aa1 100644 --- a/arch/x86/entry/syscalls/syscall_64.tbl +++ b/arch/x86/entry/syscalls/syscall_64.tbl @@ -2,7 +2,7 @@ # 64-bit system call numbers and entry vectors # # The format is: -# +# [ [noreturn]] # # The __x64_sys_*() stubs are created on-the-fly for sys_*() system calls # @@ -68,7 +68,7 @@ 57 common fork sys_fork 58 common vfork sys_vfork 59 64 execve sys_execve -60 common exit sys_exit +60 common exit sys_exit - noreturn 61 common wait4 sys_wait4 62 common kill sys_kill 63 common uname sys_newuname @@ -239,7 +239,7 @@ 228 common clock_gettime sys_clock_gettime 229 common clock_getres sys_clock_getres 230 common clock_nanosleep sys_clock_nanosleep -231 common exit_group sys_exit_group +231 common exit_group sys_exit_group - noreturn 232 common epoll_wait sys_epoll_wait 233 common epoll_ctl sys_epoll_ctl 234 common tgkill sys_tgkill diff --git a/arch/x86/um/sys_call_table_32.c b/arch/x86/um/sys_call_table_3= 2.c index 89df5d89d664..51655133eee3 100644 --- a/arch/x86/um/sys_call_table_32.c +++ b/arch/x86/um/sys_call_table_32.c @@ -9,6 +9,10 @@ #include #include =20 +extern asmlinkage long sys_ni_syscall(unsigned long, unsigned long, + unsigned long, unsigned long, + unsigned long, unsigned long); + /* * Below you can see, in terms of #define's, the differences between the x= 86-64 * and the UML syscall table. @@ -22,15 +26,13 @@ #define sys_vm86 sys_ni_syscall =20 #define __SYSCALL_WITH_COMPAT(nr, native, compat) __SYSCALL(nr, native) +#define __SYSCALL_NORETURN __SYSCALL =20 #define __SYSCALL(nr, sym) extern asmlinkage long sym(unsigned long, unsig= ned long, unsigned long, unsigned long, unsigned long, unsigned long); #include +#undef __SYSCALL =20 -#undef __SYSCALL #define __SYSCALL(nr, sym) sym, - -extern asmlinkage long sys_ni_syscall(unsigned long, unsigned long, unsign= ed long, unsigned long, unsigned long, unsigned long); - const sys_call_ptr_t sys_call_table[] ____cacheline_aligned =3D { #include }; diff --git a/arch/x86/um/sys_call_table_64.c b/arch/x86/um/sys_call_table_6= 4.c index b0b4cfd2308c..943d414f2109 100644 --- a/arch/x86/um/sys_call_table_64.c +++ b/arch/x86/um/sys_call_table_64.c @@ -9,6 +9,10 @@ #include #include =20 +extern asmlinkage long sys_ni_syscall(unsigned long, unsigned long, + unsigned long, unsigned long, + unsigned long, unsigned long); + /* * Below you can see, in terms of #define's, the differences between the x= 86-64 * and the UML syscall table. @@ -18,14 +22,13 @@ #define sys_iopl sys_ni_syscall #define sys_ioperm sys_ni_syscall =20 +#define __SYSCALL_NORETURN __SYSCALL + #define __SYSCALL(nr, sym) extern asmlinkage long sym(unsigned long, unsig= ned long, unsigned long, unsigned long, unsigned long, unsigned long); #include +#undef __SYSCALL =20 -#undef __SYSCALL #define __SYSCALL(nr, sym) sym, - -extern asmlinkage long sys_ni_syscall(unsigned long, unsigned long, unsign= ed long, unsigned long, unsigned long, unsigned long); - const sys_call_ptr_t sys_call_table[] ____cacheline_aligned =3D { #include }; diff --git a/scripts/syscalltbl.sh b/scripts/syscalltbl.sh index 6abe143889ef..6a903b87a7c2 100755 --- a/scripts/syscalltbl.sh +++ b/scripts/syscalltbl.sh @@ -54,7 +54,7 @@ nxt=3D0 =20 grep -E "^[0-9]+[[:space:]]+$abis" "$infile" | { =20 - while read nr abi name native compat ; do + while read nr abi name native compat noreturn; do =20 if [ $nxt -gt $nr ]; then echo "error: $infile: syscall table is not sorted or duplicates the sam= e syscall number" >&2 @@ -66,7 +66,21 @@ grep -E "^[0-9]+[[:space:]]+$abis" "$infile" | { nxt=3D$((nxt + 1)) done =20 - if [ -n "$compat" ]; then + if [ "$compat" =3D "-" ]; then + unset compat + fi + + if [ -n "$noreturn" ]; then + if [ "$noreturn" !=3D "noreturn" ]; then + echo "error: $infile: invalid string \"$noreturn\" in 'noreturn' colum= n" + exit 1 + fi + if [ -n "$compat" ]; then + echo "__SYSCALL_COMPAT_NORETURN($nr, $native, $compat)" + else + echo "__SYSCALL_NORETURN($nr, $native)" + fi + elif [ -n "$compat" ]; then echo "__SYSCALL_WITH_COMPAT($nr, $native, $compat)" elif [ -n "$native" ]; then echo "__SYSCALL($nr, $native)" diff --git a/tools/objtool/noreturns.h b/tools/objtool/noreturns.h index 7ebf29c91184..1e8141ef1b15 100644 --- a/tools/objtool/noreturns.h +++ b/tools/objtool/noreturns.h @@ -7,12 +7,16 @@ * Yes, this is unfortunate. A better solution is in the works. */ NORETURN(__fortify_panic) +NORETURN(__ia32_sys_exit) +NORETURN(__ia32_sys_exit_group) NORETURN(__kunit_abort) NORETURN(__module_put_and_kthread_exit) NORETURN(__reiserfs_panic) NORETURN(__stack_chk_fail) NORETURN(__tdx_hypercall_failed) NORETURN(__ubsan_handle_builtin_unreachable) +NORETURN(__x64_sys_exit) +NORETURN(__x64_sys_exit_group) NORETURN(arch_cpu_idle_dead) NORETURN(bch2_trans_in_restart_error) NORETURN(bch2_trans_restart_error) --=20 2.44.0 From nobody Sat Feb 7 12:08:02 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id EB1766CDA0 for ; Tue, 7 May 2024 05:30:16 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1715059817; cv=none; b=gPa2nD1gfMwK71wSRSTWwNC5qATImsWplOSREeEAooYiw1uK74KBOCmD1wqO+NKiDPiDI6sRfLDrzToiiCEpKXTsVpQjDZ6HQYSIkjGwEHdKf8Vv0HlgvP8wYQX/tLNnaj+oFdaZs39aaj/HZ2oPxZj6hi0KydaLKaCarq2E8CI= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1715059817; c=relaxed/simple; bh=2XWzJuggqdkJpIwIhJYrHAlr+6tDiUNf1CJRhn6Hg/U=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=o1cMzt0XW8LHK50+9KNdPvwD3gqxhuk4R/OyRedSbZIdO5oCNCCcU+4VvBWGiWmdI4OOtawD6ZDNMfobViOLkPeEZS+JeP/WAJA45124WW0sgaMV2T31rAg4SsPM0FWKuvziU/GMC9t6eMgGfQH05IFOuc4B36DjK3LCXPMgY2Y= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=LFouRxV1; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="LFouRxV1" Received: by smtp.kernel.org (Postfix) with ESMTPSA id B82CAC2BBFC; Tue, 7 May 2024 05:30:15 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1715059816; bh=2XWzJuggqdkJpIwIhJYrHAlr+6tDiUNf1CJRhn6Hg/U=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=LFouRxV1SP6C7lHXFAJ9qwPjuT7MqVhEDOAQ0cuKyPEw9Javd0m9EITQ9LX2ortYv PClEWv3ZlKxVuwuZMcqwnlzl7Kjx2jXwh+02ts3T/ezfPJkupQdd/Hgj7Ca0w34Xws fJJb0GBdlYgkYMtcFk0h98yPcZxGirDXUVd+RvgV4r2ZHCMEHREiwr+CVpvmRKtwS1 8wCbnaQJb8HyQgivbQ2neRcRhFy2OcCgtB22P7cEnGk8+AUIIl0gBrIh+Np+0eqPy6 e+QNSTzvsuADcOhTcGi0zoBBP+sSLD/6XAFLVlSTwnbcTMw8RF1E4xKulqu77FkT1K m69kB/pspqq4A== From: Josh Poimboeuf To: x86@kernel.org Cc: linux-kernel@vger.kernel.org, Linus Torvalds , Daniel Sneddon , Pawan Gupta , Thomas Gleixner , Alexandre Chartre , Konrad Rzeszutek Wilk , Peter Zijlstra , Greg Kroah-Hartman , Sean Christopherson , Andrew Cooper , Dave Hansen , Nikolay Borisov , KP Singh , Waiman Long , Borislav Petkov , Ingo Molnar Subject: [PATCH v5 2/3] x86/bugs: Remove duplicate Spectre cmdline option descriptions Date: Mon, 6 May 2024 22:30:05 -0700 Message-ID: X-Mailer: git-send-email 2.44.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Duplicating the documentation of all the Spectre kernel cmdline options in two separate files is unwieldy and error-prone. Instead just add a reference to kernel-parameters.txt from spectre.rst. Signed-off-by: Josh Poimboeuf Reviewed-by: Daniel Sneddon --- Documentation/admin-guide/hw-vuln/spectre.rst | 84 ++----------------- 1 file changed, 9 insertions(+), 75 deletions(-) diff --git a/Documentation/admin-guide/hw-vuln/spectre.rst b/Documentation/= admin-guide/hw-vuln/spectre.rst index 25a04cda4c2c..f9797ab6b38f 100644 --- a/Documentation/admin-guide/hw-vuln/spectre.rst +++ b/Documentation/admin-guide/hw-vuln/spectre.rst @@ -592,85 +592,19 @@ Spectre variant 2 Mitigation control on the kernel command line --------------------------------------------- =20 -Spectre variant 2 mitigation can be disabled or force enabled at the -kernel command line. +In general the kernel selects reasonable default mitigations for the +current CPU. + +Spectre default mitigations can be disabled or changed at the kernel +command line with the following options: =20 nospectre_v1 - - [X86,PPC] Disable mitigations for Spectre Variant 1 - (bounds check bypass). With this option data leaks are - possible in the system. - nospectre_v2 + spectre_v2=3D{option} + spectre_v2_user=3D{option} + spectre_bhi=3D{option} =20 - [X86] Disable all mitigations for the Spectre variant 2 - (indirect branch prediction) vulnerability. System may - allow data leaks with this option, which is equivalent - to spectre_v2=3Doff. - - - spectre_v2=3D - - [X86] Control mitigation of Spectre variant 2 - (indirect branch speculation) vulnerability. - The default operation protects the kernel from - user space attacks. - - on - unconditionally enable, implies - spectre_v2_user=3Don - off - unconditionally disable, implies - spectre_v2_user=3Doff - auto - kernel detects whether your CPU model is - vulnerable - - Selecting 'on' will, and 'auto' may, choose a - mitigation method at run time according to the - CPU, the available microcode, the setting of the - CONFIG_MITIGATION_RETPOLINE configuration option, - and the compiler with which the kernel was built. - - Selecting 'on' will also enable the mitigation - against user space to user space task attacks. - - Selecting 'off' will disable both the kernel and - the user space protections. - - Specific mitigations can also be selected manually: - - retpoline auto pick between generic,lfence - retpoline,generic Retpolines - retpoline,lfence LFENCE; indirect branch - retpoline,amd alias for retpoline,lfence - eibrs Enhanced/Auto IBRS - eibrs,retpoline Enhanced/Auto IBRS + Retpolines - eibrs,lfence Enhanced/Auto IBRS + LFENCE - ibrs use IBRS to protect kernel - - Not specifying this option is equivalent to - spectre_v2=3Dauto. - - In general the kernel by default selects - reasonable mitigations for the current CPU. To - disable Spectre variant 2 mitigations, boot with - spectre_v2=3Doff. Spectre variant 1 mitigations - cannot be disabled. - - spectre_bhi=3D - - [X86] Control mitigation of Branch History Injection - (BHI) vulnerability. This setting affects the deployment - of the HW BHI control and the SW BHB clearing sequence. - - on - (default) Enable the HW or SW mitigation as - needed. - off - Disable the mitigation. - -For spectre_v2_user see Documentation/admin-guide/kernel-parameters.txt +For more details on the available options, refer to Documentation/admin-gu= ide/kernel-parameters.txt =20 Mitigation selection guide -------------------------- --=20 2.44.0 From nobody Sat Feb 7 12:08:02 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id CBE576E602 for ; Tue, 7 May 2024 05:30:17 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1715059817; cv=none; b=RhmYhY7L8I+pPRZZHrW1mbGWou0h8uSpXBdOoi3eVt8HD199V1LyWj7HpqyI4Q2rVx3dtjSINMn3JIJlwabNzJV1Yv4sQigtuwrP3CfGTzmPYXQFbVMkyHz+dwb73c87dVhQQuNdo0u3ajJ2lzJeegP5wUILVwFNhQkhl/Nzjtk= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1715059817; c=relaxed/simple; bh=rjjbb87qU0Az3V5tnqRivUixNJ5fK4IwNpaXSwSoEyg=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=qHj6Jsum50M97HoKti/tR+BeUX8U1Ov49g8pDkz/kpGFE5GOE9fbVMswY8/GkTKeEJV0+pFFaGoShGzqTVUrAKGXGDrKC0qQ2DmWbXA1f5+rNTG+uJ5RdSi9cQ2NSohjA92eiUw3Hc0WtPo2cPU3TaOEwpxKODKe9D5I/bdMEvw= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=prRdCP2g; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="prRdCP2g" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 958C1C4AF65; Tue, 7 May 2024 05:30:16 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1715059817; bh=rjjbb87qU0Az3V5tnqRivUixNJ5fK4IwNpaXSwSoEyg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=prRdCP2g1WIHQ6TnRGJ6c13LybTEElCD1qSCXAh1DwIp1eLggps4Ipp1zdZ/QCsLG Zlj29uzTwEjaAXplnphLtVCnNc0NMpvhlAPk11Rsx/fQBesEl0feWPHW1uY/OI4sBD jzUbNKk1xIr/tPPFe/k4JMHudCfCXtUGlP28GjTaAKc5FNs+cIsvMo9I4bxNlSdhjJ PihDmFqvhphN1nXSiZpnNPUhb65kkKPt1SdaQMpWkLf+tsora9Mf0ekmuMJs2ji6Ol WoFy0nh7J6I7W/CQq3Y5gVis5sJMfHmOKStLF3BvNB7H5esJ9GRIm/VToFvtgrn7hj x42M3c+sU1wwg== From: Josh Poimboeuf To: x86@kernel.org Cc: linux-kernel@vger.kernel.org, Linus Torvalds , Daniel Sneddon , Pawan Gupta , Thomas Gleixner , Alexandre Chartre , Konrad Rzeszutek Wilk , Peter Zijlstra , Greg Kroah-Hartman , Sean Christopherson , Andrew Cooper , Dave Hansen , Nikolay Borisov , KP Singh , Waiman Long , Borislav Petkov , Ingo Molnar , Maksim Davydov Subject: [PATCH v5 3/3] x86/bugs: Add 'spectre_bhi=vmexit' cmdline option Date: Mon, 6 May 2024 22:30:06 -0700 Message-ID: <66327dcf87284a09ed17ac24227695ea3ba1f287.1715059256.git.jpoimboe@kernel.org> X-Mailer: git-send-email 2.44.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" In cloud environments it can be useful to *only* enable the vmexit mitigation and leave syscalls vulnerable. Add that as an option. This is similar to the old spectre_bhi=3Dauto option which was removed with the following commit: 36d4fe147c87 ("x86/bugs: Remove CONFIG_BHI_MITIGATION_AUTO and spectre_bh= i=3Dauto") with the main difference being that this has a more descriptive name and is disabled by default. Requested-by: Maksim Davydov Signed-off-by: Josh Poimboeuf Reviewed-by: Daniel Sneddon Reviewed-by: Nikolay Borisov --- Documentation/admin-guide/kernel-parameters.txt | 12 +++++++++--- arch/x86/kernel/cpu/bugs.c | 16 +++++++++++----- 2 files changed, 20 insertions(+), 8 deletions(-) diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentatio= n/admin-guide/kernel-parameters.txt index 213d0719e2b7..9c1f63f04502 100644 --- a/Documentation/admin-guide/kernel-parameters.txt +++ b/Documentation/admin-guide/kernel-parameters.txt @@ -6072,9 +6072,15 @@ deployment of the HW BHI control and the SW BHB clearing sequence. =20 - on - (default) Enable the HW or SW mitigation - as needed. - off - Disable the mitigation. + on - (default) Enable the HW or SW mitigation as + needed. This protects the kernel from + both syscalls and VMs. + vmexit - On systems which don't have the HW mitigation + available, enable the SW mitigation on vmexit + ONLY. On such systems, the host kernel is + protected from VM-originated BHI attacks, but + may still be vulnerable to syscall attacks. + off - Disable the mitigation. =20 spectre_v2=3D [X86,EARLY] Control mitigation of Spectre variant 2 (indirect branch speculation) vulnerability. diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c index ab18185894df..6974c8c9792d 100644 --- a/arch/x86/kernel/cpu/bugs.c +++ b/arch/x86/kernel/cpu/bugs.c @@ -1625,6 +1625,7 @@ static bool __init spec_ctrl_bhi_dis(void) enum bhi_mitigations { BHI_MITIGATION_OFF, BHI_MITIGATION_ON, + BHI_MITIGATION_VMEXIT_ONLY, }; =20 static enum bhi_mitigations bhi_mitigation __ro_after_init =3D @@ -1639,6 +1640,8 @@ static int __init spectre_bhi_parse_cmdline(char *str) bhi_mitigation =3D BHI_MITIGATION_OFF; else if (!strcmp(str, "on")) bhi_mitigation =3D BHI_MITIGATION_ON; + else if (!strcmp(str, "vmexit")) + bhi_mitigation =3D BHI_MITIGATION_VMEXIT_ONLY; else pr_err("Ignoring unknown spectre_bhi option (%s)", str); =20 @@ -1659,19 +1662,22 @@ static void __init bhi_select_mitigation(void) return; } =20 + /* Mitigate in hardware if supported */ if (spec_ctrl_bhi_dis()) return; =20 if (!IS_ENABLED(CONFIG_X86_64)) return; =20 - /* Mitigate KVM by default */ - setup_force_cpu_cap(X86_FEATURE_CLEAR_BHB_LOOP_ON_VMEXIT); - pr_info("Spectre BHI mitigation: SW BHB clearing on vm exit\n"); + if (bhi_mitigation =3D=3D BHI_MITIGATION_VMEXIT_ONLY) { + pr_info("Spectre BHI mitigation: SW BHB clearing on vm exit only\n"); + setup_force_cpu_cap(X86_FEATURE_CLEAR_BHB_LOOP_ON_VMEXIT); + return; + } =20 - /* Mitigate syscalls when the mitigation is forced =3Don */ + pr_info("Spectre BHI mitigation: SW BHB clearing on syscall and vm exit\n= "); setup_force_cpu_cap(X86_FEATURE_CLEAR_BHB_LOOP); - pr_info("Spectre BHI mitigation: SW BHB clearing on syscall\n"); + setup_force_cpu_cap(X86_FEATURE_CLEAR_BHB_LOOP_ON_VMEXIT); } =20 static void __init spectre_v2_select_mitigation(void) --=20 2.44.0