From: Pawan Gupta <pawan.kumar.gupta@linux.intel.com>
Date: Wed, 3 Apr 2024 15:15:31 -0700
Subject: x86/bhi: Mitigate KVM by default
Patch-mainline: Not yet, embargoed patch
References: bsc#1217339 CVE-2024-2201
BHI mitigation mode spectre_bhi=auto does not deploy the software
mitigation by default. In a cloud environment, it is a likely scenario
where userspace is trusted but the guests are not trusted. Deploying
system wide mitigation in such cases is not desirable.
Update the auto mode to unconditionally mitigate against malicious
guests. Deploy the software sequence at VMexit in auto mode also, when
hardware mitigation is not available. Unlike the force =on mode,
software sequence is not deployed at syscalls in auto mode.
Suggested-by: Alexandre Chartre <alexandre.chartre@oracle.com>
Signed-off-by: Pawan Gupta <pawan.kumar.gupta@linux.intel.com>
Signed-off-by: Daniel Sneddon <daniel.sneddon@linux.intel.com>
Reviewed-by: Alexandre Chartre <alexandre.chartre@oracle.com>
Acked-by: Nikolay Borisov <nik.borisov@suse.com>
---
Documentation/admin-guide/kernel-parameters.txt | 6 ++++--
arch/x86/include/asm/cpufeatures.h | 1 +
arch/x86/include/asm/nospec-branch.h | 7 ++++---
arch/x86/kernel/cpu/bugs.c | 7 +++++++
arch/x86/kvm/vmx.c | 2 +-
5 files changed, 17 insertions(+), 6 deletions(-)
--- a/Documentation/admin-guide/kernel-parameters.txt
+++ b/Documentation/admin-guide/kernel-parameters.txt
@@ -4273,8 +4273,10 @@
on - unconditionally enable.
off - unconditionally disable.
- auto - (default) enable only if hardware mitigation
- control(BHI_DIS_S) is available.
+ auto - (default) enable hardware mitigation
+ (BHI_DIS_S) if available, otherwise enable
+ alternate mitigation in KVM. Syscalls are not
+ mitigated if hardware mitigation is not present.
spectre_v2= [X86] Control mitigation of Spectre variant 2
(indirect branch speculation) vulnerability.
--- a/arch/x86/include/asm/cpufeatures.h
+++ b/arch/x86/include/asm/cpufeatures.h
@@ -389,6 +389,7 @@
#define X86_FEATURE_CLEAR_BHB_LOOP (22*32+ 0) /* "" Clear branch history at syscall entry using SW loop */
#define X86_FEATURE_BHI_CTRL (22*32+ 1) /* "" BHI_DIS_S HW control available */
#define X86_FEATURE_CLEAR_BHB_HW (22*32+ 2) /* "" BHI_DIS_S HW control enabled */
+#define X86_FEATURE_CLEAR_BHB_LOOP_ON_VMEXIT (22*32+ 3) /* "" Clear branch history at vmexit using SW loop */
/*
* BUG word(s)
--- a/arch/x86/include/asm/nospec-branch.h
+++ b/arch/x86/include/asm/nospec-branch.h
@@ -222,6 +222,7 @@
call clear_bhb_loop
.Lskip_bhb_loop_\@:
.endm
+
#else
#define CLEAR_BRANCH_HISTORY
#endif
@@ -229,12 +230,12 @@
#else /* __ASSEMBLY__ */
#ifdef CONFIG_X86_64
-#define CLEAR_BRANCH_HISTORY \
- ALTERNATIVE("jmp 1f\t\n", "", X86_FEATURE_CLEAR_BHB_LOOP) \
+#define CLEAR_BRANCH_HISTORY_VMEXIT \
+ ALTERNATIVE("jmp 1f\t\n", "", X86_FEATURE_CLEAR_BHB_LOOP_ON_VMEXIT) \
"call clear_bhb_loop\t\n" \
"1:\t\n"
#else
-#define CLEAR_BRANCH_HISTORY
+#define CLEAR_BRANCH_HISTORY_VMEXIT
#endif
#define CLEAR_CPU_BUFFERS \
--- a/arch/x86/kernel/cpu/bugs.c
+++ b/arch/x86/kernel/cpu/bugs.c
@@ -1604,9 +1604,14 @@ static void __init bhi_select_mitigation
if (!IS_ENABLED(CONFIG_X86_64))
return;
+ /* Mitigate KVM by default */
+ setup_force_cpu_cap(X86_FEATURE_CLEAR_BHB_LOOP_ON_VMEXIT);
+ pr_info("Spectre BHI mitigation: SW BHB clearing on vm exit\n");
+
if (bhi_mitigation == BHI_MITIGATION_AUTO)
return;
+ /* Mitigate syscalls when the mitigation is forced =on */
setup_force_cpu_cap(X86_FEATURE_CLEAR_BHB_LOOP);
pr_info("Spectre BHI mitigation: SW BHB clearing on syscall\n");
}
@@ -2698,6 +2703,8 @@ static const char * const spectre_bhi_st
else if (boot_cpu_has(X86_FEATURE_RETPOLINE) &&
!(x86_read_arch_cap_msr() & ARCH_CAP_RRSBA))
return ", BHI: Retpoline";
+ else if (boot_cpu_has(X86_FEATURE_CLEAR_BHB_LOOP_ON_VMEXIT))
+ return ", BHI: Vulnerable; KVM: SW loop";
return ", BHI: Vulnerable";
}
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -10024,7 +10024,7 @@ static void __noclone vmx_vcpu_run(struc
"mov %%cr2, %%" _ASM_AX " \n\t"
"mov %%" _ASM_AX ", %c[cr2](%0) \n\t"
- CLEAR_BRANCH_HISTORY
+ CLEAR_BRANCH_HISTORY_VMEXIT
"xor %%eax, %%eax \n\t"
"xor %%ebx, %%ebx \n\t"