From nobody Wed Dec 17 20:54:02 2025 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 2B237144D1D for ; Wed, 26 Jun 2024 06:02:13 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1719381734; cv=none; b=XSZxCs6yBHg7CowWxBdcArTmRg+OBcm9RpL12DIKV/dHcHDZVO7AGUmsgNtboRH2fkZIpRh0ZbONe+qyJU6Kc+HDTvFyKOZhchys20Y4x3DeN3emlYoxa0G+TCGc9Nu5LQvLfSM8TTaoZX7emNizvBFmhpJXHOJV8UQ56iLlfd8= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1719381734; c=relaxed/simple; bh=2FNAkdARH4wELXeQSHSIOIJ6Gy2Oc87YO3Bf52Mks24=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=IkHmQXWOx2sHfDalet11djY8IVKZPFNjq987XCQBpMWUEIkpLQU4QfbvDXZb7m5eXePJA5RhCr2GwNryDT92kFy/F2tnDTPWo6jaJGZGzcZPniKG1D6GDoRDS24k8nruLX8IMZ1EdMoGSZeJpVBJlLunyHOfduo/WVO8J4WUrf0= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=XcqnWVsH; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="XcqnWVsH" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 243C5C4AF0C; Wed, 26 Jun 2024 06:02:13 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1719381733; bh=2FNAkdARH4wELXeQSHSIOIJ6Gy2Oc87YO3Bf52Mks24=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=XcqnWVsH1xxhOG8d9fd2e7BFGoXbpkYpzf0ETT2zA6ICJneYlz4HSMIxGYv87xoTW oX+spXx5AyiI7ielhjDeg7Fnu0rheAD+JHzjev+cKKS4USffFMKsfUzmMuaqcCQtzI 9WgSlHiI+cyvC4r8gOWPb4dRvkwKL2FxfVtkiLKDCqTVIS6UfRsqVQkfLFVjU9sS4S A9e+mymfy4rCtk+SUEsgMFBsJQPJMjygk1O5B8VuahGkfnFMYYnDrycQYBkCXO8zSA b7yIDwXmoidpbWq85kuTQj311yW8WQD+yW5AByTl+8jrlEYPZHeo52RqoMVz/4Mjed 8vmo3uVgHriWw== From: Josh Poimboeuf To: x86@kernel.org Cc: linux-kernel@vger.kernel.org, Linus Torvalds , Daniel Sneddon , Pawan Gupta , Thomas Gleixner , Alexandre Chartre , Konrad Rzeszutek Wilk , Peter Zijlstra , Greg Kroah-Hartman , Sean Christopherson , Andrew Cooper , Dave Hansen , Nikolay Borisov , KP Singh , Waiman Long , Borislav Petkov , Ingo Molnar , "Paul E. McKenney" Subject: [PATCH v6 1/3] x86/syscall: Mark exit[_group] syscall handlers __noreturn Date: Tue, 25 Jun 2024 23:02:00 -0700 Message-ID: <5d8882bc077d8eadcc7fd1740b56dfb781f12288.1719381528.git.jpoimboe@kernel.org> X-Mailer: git-send-email 2.45.1 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" The direct-call syscall dispatch function doesn't know that the exit() and exit_group() syscall handlers don't return, so the call sites aren't optimized accordingly. Fix that by marking the exit syscall declarations __noreturn. Fixes the following warnings: vmlinux.o: warning: objtool: x64_sys_call+0x2804: __x64_sys_exit() is mis= sing a __noreturn annotation vmlinux.o: warning: objtool: ia32_sys_call+0x29b6: __ia32_sys_exit_group(= ) is missing a __noreturn annotation Fixes: 7390db8aea0d ("x86/bhi: Add support for clearing branch history at s= yscall entry") Reported-by: "Paul E. McKenney" Closes: https://lkml.kernel.org/lkml/6dba9b32-db2c-4e6d-9500-7a08852f17a3@p= aulmck-laptop Tested-by: Paul E. McKenney Signed-off-by: Josh Poimboeuf --- arch/x86/entry/syscall_32.c | 10 ++++++---- arch/x86/entry/syscall_64.c | 9 ++++++--- arch/x86/entry/syscall_x32.c | 7 +++++-- arch/x86/entry/syscalls/syscall_32.tbl | 6 +++--- arch/x86/entry/syscalls/syscall_64.tbl | 6 +++--- arch/x86/um/sys_call_table_32.c | 10 ++++++---- arch/x86/um/sys_call_table_64.c | 11 +++++++---- scripts/syscalltbl.sh | 18 ++++++++++++++++-- tools/objtool/noreturns.h | 4 ++++ 9 files changed, 56 insertions(+), 25 deletions(-) diff --git a/arch/x86/entry/syscall_32.c b/arch/x86/entry/syscall_32.c index c2235bae17ef..8cc9950d7104 100644 --- a/arch/x86/entry/syscall_32.c +++ b/arch/x86/entry/syscall_32.c @@ -14,9 +14,12 @@ #endif =20 #define __SYSCALL(nr, sym) extern long __ia32_##sym(const struct pt_regs *= ); - +#define __SYSCALL_NORETURN(nr, sym) extern long __noreturn __ia32_##sym(co= nst struct pt_regs *); #include -#undef __SYSCALL +#undef __SYSCALL + +#undef __SYSCALL_NORETURN +#define __SYSCALL_NORETURN __SYSCALL =20 /* * The sys_call_table[] is no longer used for system calls, but @@ -28,11 +31,10 @@ const sys_call_ptr_t sys_call_table[] =3D { #include }; -#undef __SYSCALL +#undef __SYSCALL #endif =20 #define __SYSCALL(nr, sym) case nr: return __ia32_##sym(regs); - long ia32_sys_call(const struct pt_regs *regs, unsigned int nr) { switch (nr) { diff --git a/arch/x86/entry/syscall_64.c b/arch/x86/entry/syscall_64.c index 33b3f09e6f15..ba8354424860 100644 --- a/arch/x86/entry/syscall_64.c +++ b/arch/x86/entry/syscall_64.c @@ -8,8 +8,12 @@ #include =20 #define __SYSCALL(nr, sym) extern long __x64_##sym(const struct pt_regs *); +#define __SYSCALL_NORETURN(nr, sym) extern long __noreturn __x64_##sym(con= st struct pt_regs *); #include -#undef __SYSCALL +#undef __SYSCALL + +#undef __SYSCALL_NORETURN +#define __SYSCALL_NORETURN __SYSCALL =20 /* * The sys_call_table[] is no longer used for system calls, but @@ -20,10 +24,9 @@ const sys_call_ptr_t sys_call_table[] =3D { #include }; -#undef __SYSCALL +#undef __SYSCALL =20 #define __SYSCALL(nr, sym) case nr: return __x64_##sym(regs); - long x64_sys_call(const struct pt_regs *regs, unsigned int nr) { switch (nr) { diff --git a/arch/x86/entry/syscall_x32.c b/arch/x86/entry/syscall_x32.c index 03de4a932131..fb77908f44f3 100644 --- a/arch/x86/entry/syscall_x32.c +++ b/arch/x86/entry/syscall_x32.c @@ -8,11 +8,14 @@ #include =20 #define __SYSCALL(nr, sym) extern long __x64_##sym(const struct pt_regs *); +#define __SYSCALL_NORETURN(nr, sym) extern long __noreturn __x64_##sym(con= st struct pt_regs *); #include -#undef __SYSCALL +#undef __SYSCALL + +#undef __SYSCALL_NORETURN +#define __SYSCALL_NORETURN __SYSCALL =20 #define __SYSCALL(nr, sym) case nr: return __x64_##sym(regs); - long x32_sys_call(const struct pt_regs *regs, unsigned int nr) { switch (nr) { diff --git a/arch/x86/entry/syscalls/syscall_32.tbl b/arch/x86/entry/syscal= ls/syscall_32.tbl index 7fd1f57ad3d3..09ca75bb51a0 100644 --- a/arch/x86/entry/syscalls/syscall_32.tbl +++ b/arch/x86/entry/syscalls/syscall_32.tbl @@ -2,7 +2,7 @@ # 32-bit system call numbers and entry vectors # # The format is: -# +# [ [noreturn]] # # The __ia32_sys and __ia32_compat_sys stubs are created on-the-fly for # sys_*() system calls and compat_sys_*() compat system calls if @@ -12,7 +12,7 @@ # The abi is always "i386" for this file. # 0 i386 restart_syscall sys_restart_syscall -1 i386 exit sys_exit +1 i386 exit sys_exit - noreturn 2 i386 fork sys_fork 3 i386 read sys_read 4 i386 write sys_write @@ -263,7 +263,7 @@ 249 i386 io_cancel sys_io_cancel 250 i386 fadvise64 sys_ia32_fadvise64 # 251 is available for reuse (was briefly sys_set_zone_reclaim) -252 i386 exit_group sys_exit_group +252 i386 exit_group sys_exit_group - noreturn 253 i386 lookup_dcookie 254 i386 epoll_create sys_epoll_create 255 i386 epoll_ctl sys_epoll_ctl diff --git a/arch/x86/entry/syscalls/syscall_64.tbl b/arch/x86/entry/syscal= ls/syscall_64.tbl index a396f6e6ab5b..a8068f937290 100644 --- a/arch/x86/entry/syscalls/syscall_64.tbl +++ b/arch/x86/entry/syscalls/syscall_64.tbl @@ -2,7 +2,7 @@ # 64-bit system call numbers and entry vectors # # The format is: -# +# [ [noreturn]] # # The __x64_sys_*() stubs are created on-the-fly for sys_*() system calls # @@ -68,7 +68,7 @@ 57 common fork sys_fork 58 common vfork sys_vfork 59 64 execve sys_execve -60 common exit sys_exit +60 common exit sys_exit - noreturn 61 common wait4 sys_wait4 62 common kill sys_kill 63 common uname sys_newuname @@ -239,7 +239,7 @@ 228 common clock_gettime sys_clock_gettime 229 common clock_getres sys_clock_getres 230 common clock_nanosleep sys_clock_nanosleep -231 common exit_group sys_exit_group +231 common exit_group sys_exit_group - noreturn 232 common epoll_wait sys_epoll_wait 233 common epoll_ctl sys_epoll_ctl 234 common tgkill sys_tgkill diff --git a/arch/x86/um/sys_call_table_32.c b/arch/x86/um/sys_call_table_3= 2.c index 89df5d89d664..51655133eee3 100644 --- a/arch/x86/um/sys_call_table_32.c +++ b/arch/x86/um/sys_call_table_32.c @@ -9,6 +9,10 @@ #include #include =20 +extern asmlinkage long sys_ni_syscall(unsigned long, unsigned long, + unsigned long, unsigned long, + unsigned long, unsigned long); + /* * Below you can see, in terms of #define's, the differences between the x= 86-64 * and the UML syscall table. @@ -22,15 +26,13 @@ #define sys_vm86 sys_ni_syscall =20 #define __SYSCALL_WITH_COMPAT(nr, native, compat) __SYSCALL(nr, native) +#define __SYSCALL_NORETURN __SYSCALL =20 #define __SYSCALL(nr, sym) extern asmlinkage long sym(unsigned long, unsig= ned long, unsigned long, unsigned long, unsigned long, unsigned long); #include +#undef __SYSCALL =20 -#undef __SYSCALL #define __SYSCALL(nr, sym) sym, - -extern asmlinkage long sys_ni_syscall(unsigned long, unsigned long, unsign= ed long, unsigned long, unsigned long, unsigned long); - const sys_call_ptr_t sys_call_table[] ____cacheline_aligned =3D { #include }; diff --git a/arch/x86/um/sys_call_table_64.c b/arch/x86/um/sys_call_table_6= 4.c index b0b4cfd2308c..943d414f2109 100644 --- a/arch/x86/um/sys_call_table_64.c +++ b/arch/x86/um/sys_call_table_64.c @@ -9,6 +9,10 @@ #include #include =20 +extern asmlinkage long sys_ni_syscall(unsigned long, unsigned long, + unsigned long, unsigned long, + unsigned long, unsigned long); + /* * Below you can see, in terms of #define's, the differences between the x= 86-64 * and the UML syscall table. @@ -18,14 +22,13 @@ #define sys_iopl sys_ni_syscall #define sys_ioperm sys_ni_syscall =20 +#define __SYSCALL_NORETURN __SYSCALL + #define __SYSCALL(nr, sym) extern asmlinkage long sym(unsigned long, unsig= ned long, unsigned long, unsigned long, unsigned long, unsigned long); #include +#undef __SYSCALL =20 -#undef __SYSCALL #define __SYSCALL(nr, sym) sym, - -extern asmlinkage long sys_ni_syscall(unsigned long, unsigned long, unsign= ed long, unsigned long, unsigned long, unsigned long); - const sys_call_ptr_t sys_call_table[] ____cacheline_aligned =3D { #include }; diff --git a/scripts/syscalltbl.sh b/scripts/syscalltbl.sh index 6abe143889ef..6a903b87a7c2 100755 --- a/scripts/syscalltbl.sh +++ b/scripts/syscalltbl.sh @@ -54,7 +54,7 @@ nxt=3D0 =20 grep -E "^[0-9]+[[:space:]]+$abis" "$infile" | { =20 - while read nr abi name native compat ; do + while read nr abi name native compat noreturn; do =20 if [ $nxt -gt $nr ]; then echo "error: $infile: syscall table is not sorted or duplicates the sam= e syscall number" >&2 @@ -66,7 +66,21 @@ grep -E "^[0-9]+[[:space:]]+$abis" "$infile" | { nxt=3D$((nxt + 1)) done =20 - if [ -n "$compat" ]; then + if [ "$compat" =3D "-" ]; then + unset compat + fi + + if [ -n "$noreturn" ]; then + if [ "$noreturn" !=3D "noreturn" ]; then + echo "error: $infile: invalid string \"$noreturn\" in 'noreturn' colum= n" + exit 1 + fi + if [ -n "$compat" ]; then + echo "__SYSCALL_COMPAT_NORETURN($nr, $native, $compat)" + else + echo "__SYSCALL_NORETURN($nr, $native)" + fi + elif [ -n "$compat" ]; then echo "__SYSCALL_WITH_COMPAT($nr, $native, $compat)" elif [ -n "$native" ]; then echo "__SYSCALL($nr, $native)" diff --git a/tools/objtool/noreturns.h b/tools/objtool/noreturns.h index 7ebf29c91184..1e8141ef1b15 100644 --- a/tools/objtool/noreturns.h +++ b/tools/objtool/noreturns.h @@ -7,12 +7,16 @@ * Yes, this is unfortunate. A better solution is in the works. */ NORETURN(__fortify_panic) +NORETURN(__ia32_sys_exit) +NORETURN(__ia32_sys_exit_group) NORETURN(__kunit_abort) NORETURN(__module_put_and_kthread_exit) NORETURN(__reiserfs_panic) NORETURN(__stack_chk_fail) NORETURN(__tdx_hypercall_failed) NORETURN(__ubsan_handle_builtin_unreachable) +NORETURN(__x64_sys_exit) +NORETURN(__x64_sys_exit_group) NORETURN(arch_cpu_idle_dead) NORETURN(bch2_trans_in_restart_error) NORETURN(bch2_trans_restart_error) --=20 2.45.1 From nobody Wed Dec 17 20:54:02 2025 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6075F14AD1A for ; Wed, 26 Jun 2024 06:02:15 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1719381735; cv=none; b=RYRQ4Ar3iWghMQGRZiLl9Xu6xUgqcGcmsjrMWL5/qVFjEltYsr9yNEPLIrClz/rA3RgZtcsL3YHIZQaZaY20fF0jjwY04aB3/cjllpJfUbARNvtDgD2eME8uUHqopRX5SY/btAQorMUZwZGajjjcROKg5Zgvao4LckKjmysVVKQ= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1719381735; c=relaxed/simple; bh=k+dtPWzbOil1sgDKHTHJbXRZWoGn2dqcKS5r+PR978U=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=c/nnrO9zl35Nc6KqM7yO5Mz3iCltncy+vvYSGBkhMjwB6p3533P9iO1uPPKb5v6A1ZS1dL0aELptV+rWm4lWlfzuDOpZCDO+SYVlboUKuXFrtNn1GicIa1a7RVq47ZSAGcF4hwJigPe+xymvbfJkjmiPHr5rVRxxVhhAcxoqFNY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=TAMRDTZF; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="TAMRDTZF" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 04632C4AF0F; Wed, 26 Jun 2024 06:02:13 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1719381735; bh=k+dtPWzbOil1sgDKHTHJbXRZWoGn2dqcKS5r+PR978U=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=TAMRDTZFcCNUVbNB55B/ickGz8X62DAu0mm5AGOndWUZmagWDpnUzcZ5O52LhdfyY p+CoBsaU2jbbpLsNA2CKaDfkKm4Eqac4rTS8NsKr+Q+eloIJ3K5CSeawAu1cD7ucuV 4evnJn9nbdEv7bKZs1qk8g058f1cL8fvFEpODndobhFuawW3Up7FcfbiSJlnbOJ+kQ 6QTXZkivJbKFVCTYSpXk15T763eUeSxx3vKZnfQWpRAKcO/icFs5Lm16PGpI6CP3uu fMjIpToH9J46lvsTkt8YcoUbfB3lkOQVMNL6FcbYEU6VT9Kyd4hjplt8NF3WaPujAt wSxVlUAD07mAQ== From: Josh Poimboeuf To: x86@kernel.org Cc: linux-kernel@vger.kernel.org, Linus Torvalds , Daniel Sneddon , Pawan Gupta , Thomas Gleixner , Alexandre Chartre , Konrad Rzeszutek Wilk , Peter Zijlstra , Greg Kroah-Hartman , Sean Christopherson , Andrew Cooper , Dave Hansen , Nikolay Borisov , KP Singh , Waiman Long , Borislav Petkov , Ingo Molnar Subject: [PATCH v6 2/3] x86/bugs: Remove duplicate Spectre cmdline option descriptions Date: Tue, 25 Jun 2024 23:02:01 -0700 Message-ID: <450b5f4ffe891a8cc9736ec52b0c6f225bab3f4b.1719381528.git.jpoimboe@kernel.org> X-Mailer: git-send-email 2.45.1 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Duplicating the documentation of all the Spectre kernel cmdline options in two separate files is unwieldy and error-prone. Instead just add a reference to kernel-parameters.txt from spectre.rst. Reviewed-by: Daniel Sneddon Signed-off-by: Josh Poimboeuf --- Documentation/admin-guide/hw-vuln/spectre.rst | 86 +++---------------- 1 file changed, 10 insertions(+), 76 deletions(-) diff --git a/Documentation/admin-guide/hw-vuln/spectre.rst b/Documentation/= admin-guide/hw-vuln/spectre.rst index 25a04cda4c2c..132e0bc6007e 100644 --- a/Documentation/admin-guide/hw-vuln/spectre.rst +++ b/Documentation/admin-guide/hw-vuln/spectre.rst @@ -592,85 +592,19 @@ Spectre variant 2 Mitigation control on the kernel command line --------------------------------------------- =20 -Spectre variant 2 mitigation can be disabled or force enabled at the -kernel command line. +In general the kernel selects reasonable default mitigations for the +current CPU. =20 - nospectre_v1 +Spectre default mitigations can be disabled or changed at the kernel +command line with the following options: =20 - [X86,PPC] Disable mitigations for Spectre Variant 1 - (bounds check bypass). With this option data leaks are - possible in the system. + - nospectre_v1 + - nospectre_v2 + - spectre_v2=3D{option} + - spectre_v2_user=3D{option} + - spectre_bhi=3D{option} =20 - nospectre_v2 - - [X86] Disable all mitigations for the Spectre variant 2 - (indirect branch prediction) vulnerability. System may - allow data leaks with this option, which is equivalent - to spectre_v2=3Doff. - - - spectre_v2=3D - - [X86] Control mitigation of Spectre variant 2 - (indirect branch speculation) vulnerability. - The default operation protects the kernel from - user space attacks. - - on - unconditionally enable, implies - spectre_v2_user=3Don - off - unconditionally disable, implies - spectre_v2_user=3Doff - auto - kernel detects whether your CPU model is - vulnerable - - Selecting 'on' will, and 'auto' may, choose a - mitigation method at run time according to the - CPU, the available microcode, the setting of the - CONFIG_MITIGATION_RETPOLINE configuration option, - and the compiler with which the kernel was built. - - Selecting 'on' will also enable the mitigation - against user space to user space task attacks. - - Selecting 'off' will disable both the kernel and - the user space protections. - - Specific mitigations can also be selected manually: - - retpoline auto pick between generic,lfence - retpoline,generic Retpolines - retpoline,lfence LFENCE; indirect branch - retpoline,amd alias for retpoline,lfence - eibrs Enhanced/Auto IBRS - eibrs,retpoline Enhanced/Auto IBRS + Retpolines - eibrs,lfence Enhanced/Auto IBRS + LFENCE - ibrs use IBRS to protect kernel - - Not specifying this option is equivalent to - spectre_v2=3Dauto. - - In general the kernel by default selects - reasonable mitigations for the current CPU. To - disable Spectre variant 2 mitigations, boot with - spectre_v2=3Doff. Spectre variant 1 mitigations - cannot be disabled. - - spectre_bhi=3D - - [X86] Control mitigation of Branch History Injection - (BHI) vulnerability. This setting affects the deployment - of the HW BHI control and the SW BHB clearing sequence. - - on - (default) Enable the HW or SW mitigation as - needed. - off - Disable the mitigation. - -For spectre_v2_user see Documentation/admin-guide/kernel-parameters.txt +For more details on the available options, refer to Documentation/admin-gu= ide/kernel-parameters.txt =20 Mitigation selection guide -------------------------- --=20 2.45.1 From nobody Wed Dec 17 20:54:02 2025 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4C9DD14D447 for ; Wed, 26 Jun 2024 06:02:15 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1719381736; cv=none; b=patFyJ4VZihfdN5388NTGAu6xTpJNLc8RD9tMofuxNfzoBuvnZEW4+a01uvoYtcZldRRii2LoljoNU66B5IlRy1AqY6/V07eHQcYUHnFpL9OLJy+PvcVDapFv1PEzNOq1phz1vfeDBv1RZkBz8CETv6Ek/FgMcC/nRQQg08zZ2A= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1719381736; c=relaxed/simple; bh=2YVTDZYyZc5toIi6/I5KvVx6buG4jkWRmRMdivrW5yU=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=RjThSpwbE4LxDj6QVDKP4twTwoq7TM0ge+v7V9qwRkSK8WVcsSPpGnm8zZ+dBW8N6VxuxMxok1bxLl48X5jQkXskiE/yz+XFVDKuyBw7Xr2VtSJ7UEhUVSCf0eqMGEhwdnv14vvP9R738WGz1+XzVqEs78/ZSL5Q2QUSoMBakN8= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=gmr7lgFp; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="gmr7lgFp" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 270D5C4AF07; Wed, 26 Jun 2024 06:02:15 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1719381735; bh=2YVTDZYyZc5toIi6/I5KvVx6buG4jkWRmRMdivrW5yU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=gmr7lgFp/4VuoKNtB/Gz+oFsiKhrh7YqV2vjDYNcku2YIKq+e8Ag5tAVD/91XDpue +kAPuKXe78aXPFRNm8xSIp7IGzw0lfvhdGJCUOmBRw63kSXEjjg7hM7agsU+NkKdVG OervrTjUYlWbV+j5R3ygIbOFMeh1PdMSLOcTjFguK0m5imR8EHXsHdbUVT4ZVo9Zde PtmuXpdl3hfkSVgxf4ub9P3Jw0R8nfovrzjqWQIohsbODG+McwFBHoPO7dTyeQL7kT JD/vfXRt78fWMPKn/87EIX6F7qpOuc8AU5p3NBOEY3HS4sUEHHi5WK9YO0hrwXKeDq oSnHH66gh67dQ== From: Josh Poimboeuf To: x86@kernel.org Cc: linux-kernel@vger.kernel.org, Linus Torvalds , Daniel Sneddon , Pawan Gupta , Thomas Gleixner , Alexandre Chartre , Konrad Rzeszutek Wilk , Peter Zijlstra , Greg Kroah-Hartman , Sean Christopherson , Andrew Cooper , Dave Hansen , Nikolay Borisov , KP Singh , Waiman Long , Borislav Petkov , Ingo Molnar , Maksim Davydov Subject: [PATCH v6 3/3] x86/bugs: Add 'spectre_bhi=vmexit' cmdline option Date: Tue, 25 Jun 2024 23:02:02 -0700 Message-ID: <2cbad706a6d5e1da2829e5e123d8d5c80330148c.1719381528.git.jpoimboe@kernel.org> X-Mailer: git-send-email 2.45.1 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" In cloud environments it can be useful to *only* enable the vmexit mitigation and leave syscalls vulnerable. Add that as an option. This is similar to the old spectre_bhi=3Dauto option which was removed with the following commit: 36d4fe147c87 ("x86/bugs: Remove CONFIG_BHI_MITIGATION_AUTO and spectre_bh= i=3Dauto") with the main difference being that this has a more descriptive name and is disabled by default. Requested-by: Maksim Davydov Reviewed-by: Daniel Sneddon Reviewed-by: Nikolay Borisov Signed-off-by: Josh Poimboeuf --- Documentation/admin-guide/kernel-parameters.txt | 12 +++++++++--- arch/x86/kernel/cpu/bugs.c | 16 +++++++++++----- 2 files changed, 20 insertions(+), 8 deletions(-) diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentatio= n/admin-guide/kernel-parameters.txt index 11e57ba2985c..ddf4eff727ab 100644 --- a/Documentation/admin-guide/kernel-parameters.txt +++ b/Documentation/admin-guide/kernel-parameters.txt @@ -6136,9 +6136,15 @@ deployment of the HW BHI control and the SW BHB clearing sequence. =20 - on - (default) Enable the HW or SW mitigation - as needed. - off - Disable the mitigation. + on - (default) Enable the HW or SW mitigation as + needed. This protects the kernel from + both syscalls and VMs. + vmexit - On systems which don't have the HW mitigation + available, enable the SW mitigation on vmexit + ONLY. On such systems, the host kernel is + protected from VM-originated BHI attacks, but + may still be vulnerable to syscall attacks. + off - Disable the mitigation. =20 spectre_v2=3D [X86,EARLY] Control mitigation of Spectre variant 2 (indirect branch speculation) vulnerability. diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c index b6f927f6c567..94bcf29df465 100644 --- a/arch/x86/kernel/cpu/bugs.c +++ b/arch/x86/kernel/cpu/bugs.c @@ -1625,6 +1625,7 @@ static bool __init spec_ctrl_bhi_dis(void) enum bhi_mitigations { BHI_MITIGATION_OFF, BHI_MITIGATION_ON, + BHI_MITIGATION_VMEXIT_ONLY, }; =20 static enum bhi_mitigations bhi_mitigation __ro_after_init =3D @@ -1639,6 +1640,8 @@ static int __init spectre_bhi_parse_cmdline(char *str) bhi_mitigation =3D BHI_MITIGATION_OFF; else if (!strcmp(str, "on")) bhi_mitigation =3D BHI_MITIGATION_ON; + else if (!strcmp(str, "vmexit")) + bhi_mitigation =3D BHI_MITIGATION_VMEXIT_ONLY; else pr_err("Ignoring unknown spectre_bhi option (%s)", str); =20 @@ -1659,19 +1662,22 @@ static void __init bhi_select_mitigation(void) return; } =20 + /* Mitigate in hardware if supported */ if (spec_ctrl_bhi_dis()) return; =20 if (!IS_ENABLED(CONFIG_X86_64)) return; =20 - /* Mitigate KVM by default */ - setup_force_cpu_cap(X86_FEATURE_CLEAR_BHB_LOOP_ON_VMEXIT); - pr_info("Spectre BHI mitigation: SW BHB clearing on vm exit\n"); + if (bhi_mitigation =3D=3D BHI_MITIGATION_VMEXIT_ONLY) { + pr_info("Spectre BHI mitigation: SW BHB clearing on vm exit only\n"); + setup_force_cpu_cap(X86_FEATURE_CLEAR_BHB_LOOP_ON_VMEXIT); + return; + } =20 - /* Mitigate syscalls when the mitigation is forced =3Don */ + pr_info("Spectre BHI mitigation: SW BHB clearing on syscall and vm exit\n= "); setup_force_cpu_cap(X86_FEATURE_CLEAR_BHB_LOOP); - pr_info("Spectre BHI mitigation: SW BHB clearing on syscall\n"); + setup_force_cpu_cap(X86_FEATURE_CLEAR_BHB_LOOP_ON_VMEXIT); } =20 static void __init spectre_v2_select_mitigation(void) --=20 2.45.1