Skip to content

Commit a99ddaf

Browse files
PlaidCatPlaidCat
committed
x86/bugs: Remove CONFIG_BHI_MITIGATION_AUTO and spectre_bhi=auto
jira LE-2015 cve CVE-2024-2201 Rebuild_History Non-Buildable kernel-5.14.0-427.42.1.el9_4 commit-author Josh Poimboeuf <[email protected]> commit 36d4fe1 Empty-Commit: Cherry-Pick Conflicts during history rebuild. Will be included in final tarball splat. Ref for failed cherry-pick at: ciq/ciq_backports/kernel-5.14.0-427.42.1.el9_4/36d4fe14.failed Unlike most other mitigations' "auto" options, spectre_bhi=auto only mitigates newer systems, which is confusing and not particularly useful. Remove it. Signed-off-by: Josh Poimboeuf <[email protected]> Signed-off-by: Ingo Molnar <[email protected]> Reviewed-by: Nikolay Borisov <[email protected]> Cc: Sean Christopherson <[email protected]> Cc: Linus Torvalds <[email protected]> Link: https://lore.kernel.org/r/412e9dc87971b622bbbaf64740ebc1f140bff343.1712813475.git.jpoimboe@kernel.org (cherry picked from commit 36d4fe1) Signed-off-by: Jonathan Maple <[email protected]> # Conflicts: # Documentation/admin-guide/hw-vuln/spectre.rst # Documentation/admin-guide/kernel-parameters.txt # arch/x86/Kconfig # arch/x86/kernel/cpu/bugs.c
1 parent 79dac42 commit a99ddaf

File tree

1 file changed

+201
-0
lines changed

1 file changed

+201
-0
lines changed

‎ciq/ciq_backports/kernel-5.14.0-427.42.1.el9_4/36d4fe14.failed

Lines changed: 201 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,201 @@
1+
x86/bugs: Remove CONFIG_BHI_MITIGATION_AUTO and spectre_bhi=auto
2+
3+
jira LE-2015
4+
cve CVE-2024-2201
5+
Rebuild_History Non-Buildable kernel-5.14.0-427.42.1.el9_4
6+
commit-author Josh Poimboeuf <[email protected]>
7+
commit 36d4fe147c870f6d3f6602befd7ef44393a1c87a
8+
Empty-Commit: Cherry-Pick Conflicts during history rebuild.
9+
Will be included in final tarball splat. Ref for failed cherry-pick at:
10+
ciq/ciq_backports/kernel-5.14.0-427.42.1.el9_4/36d4fe14.failed
11+
12+
Unlike most other mitigations' "auto" options, spectre_bhi=auto only
13+
mitigates newer systems, which is confusing and not particularly useful.
14+
15+
Remove it.
16+
17+
Signed-off-by: Josh Poimboeuf <[email protected]>
18+
Signed-off-by: Ingo Molnar <[email protected]>
19+
Reviewed-by: Nikolay Borisov <[email protected]>
20+
Cc: Sean Christopherson <[email protected]>
21+
Cc: Linus Torvalds <[email protected]>
22+
Link: https://lore.kernel.org/r/412e9dc87971b622bbbaf64740ebc1f140bff343.1712813475.git.jpoimboe@kernel.org
23+
(cherry picked from commit 36d4fe147c870f6d3f6602befd7ef44393a1c87a)
24+
Signed-off-by: Jonathan Maple <[email protected]>
25+
26+
# Conflicts:
27+
# Documentation/admin-guide/hw-vuln/spectre.rst
28+
# Documentation/admin-guide/kernel-parameters.txt
29+
# arch/x86/Kconfig
30+
# arch/x86/kernel/cpu/bugs.c
31+
diff --cc Documentation/admin-guide/hw-vuln/spectre.rst
32+
index 166facdabe9f,25a04cda4c2c..000000000000
33+
--- a/Documentation/admin-guide/hw-vuln/spectre.rst
34+
+++ b/Documentation/admin-guide/hw-vuln/spectre.rst
35+
@@@ -638,6 -658,18 +638,21 @@@ kernel command line
36+
spectre_v2=off. Spectre variant 1 mitigations
37+
cannot be disabled.
38+
39+
++<<<<<<< HEAD
40+
++=======
41+
+ spectre_bhi=
42+
+
43+
+ [X86] Control mitigation of Branch History Injection
44+
+ (BHI) vulnerability. This setting affects the deployment
45+
+ of the HW BHI control and the SW BHB clearing sequence.
46+
+
47+
+ on
48+
+ (default) Enable the HW or SW mitigation as
49+
+ needed.
50+
+ off
51+
+ Disable the mitigation.
52+
+
53+
++>>>>>>> 36d4fe147c87 (x86/bugs: Remove CONFIG_BHI_MITIGATION_AUTO and spectre_bhi=auto)
54+
For spectre_v2_user see Documentation/admin-guide/kernel-parameters.txt
55+
56+
Mitigation selection guide
57+
diff --cc Documentation/admin-guide/kernel-parameters.txt
58+
index f74f25f00a14,902ecd92a29f..000000000000
59+
--- a/Documentation/admin-guide/kernel-parameters.txt
60+
+++ b/Documentation/admin-guide/kernel-parameters.txt
61+
@@@ -5722,7 -6064,16 +5722,20 @@@
62+
sonypi.*= [HW] Sony Programmable I/O Control Device driver
63+
See Documentation/admin-guide/laptops/sonypi.rst
64+
65+
++<<<<<<< HEAD
66+
+ spectre_v2= [X86] Control mitigation of Spectre variant 2
67+
++=======
68+
+ spectre_bhi= [X86] Control mitigation of Branch History Injection
69+
+ (BHI) vulnerability. This setting affects the
70+
+ deployment of the HW BHI control and the SW BHB
71+
+ clearing sequence.
72+
+
73+
+ on - (default) Enable the HW or SW mitigation
74+
+ as needed.
75+
+ off - Disable the mitigation.
76+
+
77+
+ spectre_v2= [X86,EARLY] Control mitigation of Spectre variant 2
78+
++>>>>>>> 36d4fe147c87 (x86/bugs: Remove CONFIG_BHI_MITIGATION_AUTO and spectre_bhi=auto)
79+
(indirect branch speculation) vulnerability.
80+
The default operation protects the kernel from
81+
user space attacks.
82+
diff --cc arch/x86/Kconfig
83+
index 2e3190218496,b63b6767a63d..000000000000
84+
--- a/arch/x86/Kconfig
85+
+++ b/arch/x86/Kconfig
86+
@@@ -2641,6 -2633,27 +2641,30 @@@ config MITIGATION_RFD
87+
stored in floating point, vector and integer registers.
88+
See also <file:Documentation/admin-guide/hw-vuln/reg-file-data-sampling.rst>
89+
90+
++<<<<<<< HEAD
91+
++=======
92+
+ choice
93+
+ prompt "Clear branch history"
94+
+ depends on CPU_SUP_INTEL
95+
+ default SPECTRE_BHI_ON
96+
+ help
97+
+ Enable BHI mitigations. BHI attacks are a form of Spectre V2 attacks
98+
+ where the branch history buffer is poisoned to speculatively steer
99+
+ indirect branches.
100+
+ See <file:Documentation/admin-guide/hw-vuln/spectre.rst>
101+
+
102+
+ config SPECTRE_BHI_ON
103+
+ bool "on"
104+
+ help
105+
+ Equivalent to setting spectre_bhi=on command line parameter.
106+
+ config SPECTRE_BHI_OFF
107+
+ bool "off"
108+
+ help
109+
+ Equivalent to setting spectre_bhi=off command line parameter.
110+
+
111+
+ endchoice
112+
+
113+
++>>>>>>> 36d4fe147c87 (x86/bugs: Remove CONFIG_BHI_MITIGATION_AUTO and spectre_bhi=auto)
114+
endif
115+
116+
config ARCH_HAS_ADD_PAGES
117+
diff --cc arch/x86/kernel/cpu/bugs.c
118+
index d1c0c8f6898b,6af4780a18ed..000000000000
119+
--- a/arch/x86/kernel/cpu/bugs.c
120+
+++ b/arch/x86/kernel/cpu/bugs.c
121+
@@@ -1612,6 -1606,73 +1612,76 @@@ static void __init spectre_v2_determine
122+
dump_stack();
123+
}
124+
125+
++<<<<<<< HEAD
126+
++=======
127+
+ /*
128+
+ * Set BHI_DIS_S to prevent indirect branches in kernel to be influenced by
129+
+ * branch history in userspace. Not needed if BHI_NO is set.
130+
+ */
131+
+ static bool __init spec_ctrl_bhi_dis(void)
132+
+ {
133+
+ if (!boot_cpu_has(X86_FEATURE_BHI_CTRL))
134+
+ return false;
135+
+
136+
+ x86_spec_ctrl_base |= SPEC_CTRL_BHI_DIS_S;
137+
+ update_spec_ctrl(x86_spec_ctrl_base);
138+
+ setup_force_cpu_cap(X86_FEATURE_CLEAR_BHB_HW);
139+
+
140+
+ return true;
141+
+ }
142+
+
143+
+ enum bhi_mitigations {
144+
+ BHI_MITIGATION_OFF,
145+
+ BHI_MITIGATION_ON,
146+
+ };
147+
+
148+
+ static enum bhi_mitigations bhi_mitigation __ro_after_init =
149+
+ IS_ENABLED(CONFIG_SPECTRE_BHI_ON) ? BHI_MITIGATION_ON : BHI_MITIGATION_OFF;
150+
+
151+
+ static int __init spectre_bhi_parse_cmdline(char *str)
152+
+ {
153+
+ if (!str)
154+
+ return -EINVAL;
155+
+
156+
+ if (!strcmp(str, "off"))
157+
+ bhi_mitigation = BHI_MITIGATION_OFF;
158+
+ else if (!strcmp(str, "on"))
159+
+ bhi_mitigation = BHI_MITIGATION_ON;
160+
+ else
161+
+ pr_err("Ignoring unknown spectre_bhi option (%s)", str);
162+
+
163+
+ return 0;
164+
+ }
165+
+ early_param("spectre_bhi", spectre_bhi_parse_cmdline);
166+
+
167+
+ static void __init bhi_select_mitigation(void)
168+
+ {
169+
+ if (bhi_mitigation == BHI_MITIGATION_OFF)
170+
+ return;
171+
+
172+
+ /* Retpoline mitigates against BHI unless the CPU has RRSBA behavior */
173+
+ if (cpu_feature_enabled(X86_FEATURE_RETPOLINE)) {
174+
+ spec_ctrl_disable_kernel_rrsba();
175+
+ if (rrsba_disabled)
176+
+ return;
177+
+ }
178+
+
179+
+ if (spec_ctrl_bhi_dis())
180+
+ return;
181+
+
182+
+ if (!IS_ENABLED(CONFIG_X86_64))
183+
+ return;
184+
+
185+
+ /* Mitigate KVM by default */
186+
+ setup_force_cpu_cap(X86_FEATURE_CLEAR_BHB_LOOP_ON_VMEXIT);
187+
+ pr_info("Spectre BHI mitigation: SW BHB clearing on vm exit\n");
188+
+
189+
+ /* Mitigate syscalls when the mitigation is forced =on */
190+
+ setup_force_cpu_cap(X86_FEATURE_CLEAR_BHB_LOOP);
191+
+ pr_info("Spectre BHI mitigation: SW BHB clearing on syscall\n");
192+
+ }
193+
+
194+
++>>>>>>> 36d4fe147c87 (x86/bugs: Remove CONFIG_BHI_MITIGATION_AUTO and spectre_bhi=auto)
195+
static void __init spectre_v2_select_mitigation(void)
196+
{
197+
enum spectre_v2_mitigation_cmd cmd = spectre_v2_parse_cmdline();
198+
* Unmerged path Documentation/admin-guide/hw-vuln/spectre.rst
199+
* Unmerged path Documentation/admin-guide/kernel-parameters.txt
200+
* Unmerged path arch/x86/Kconfig
201+
* Unmerged path arch/x86/kernel/cpu/bugs.c

0 commit comments

Comments
 (0)