Commit 95a6ccbd authored by Pawan Gupta's avatar Pawan Gupta Committed by Thomas Gleixner

x86/bhi: Mitigate KVM by default

BHI mitigation mode spectre_bhi=auto does not deploy the software
mitigation by default. In a cloud environment, it is a likely scenario
where userspace is trusted but the guests are not trusted. Deploying
system wide mitigation in such cases is not desirable.

Update the auto mode to unconditionally mitigate against malicious
guests. Deploy the software sequence at VMexit in auto mode also, when
hardware mitigation is not available. Unlike the force =on mode,
software sequence is not deployed at syscalls in auto mode.
Suggested-by: default avatarAlexandre Chartre <alexandre.chartre@oracle.com>
Signed-off-by: default avatarPawan Gupta <pawan.kumar.gupta@linux.intel.com>
Signed-off-by: default avatarDaniel Sneddon <daniel.sneddon@linux.intel.com>
Signed-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
Reviewed-by: default avatarAlexandre Chartre <alexandre.chartre@oracle.com>
Reviewed-by: default avatarJosh Poimboeuf <jpoimboe@kernel.org>
parent ec9404e4
...@@ -439,10 +439,12 @@ The possible values in this file are: ...@@ -439,10 +439,12 @@ The possible values in this file are:
- System is protected by retpoline - System is protected by retpoline
* - BHI: BHI_DIS_S * - BHI: BHI_DIS_S
- System is protected by BHI_DIS_S - System is protected by BHI_DIS_S
* - BHI: SW loop * - BHI: SW loop; KVM SW loop
- System is protected by software clearing sequence - System is protected by software clearing sequence
* - BHI: Syscall hardening * - BHI: Syscall hardening
- Syscalls are hardened against BHI - Syscalls are hardened against BHI
* - BHI: Syscall hardening; KVM: SW loop
- System is protected from userspace attacks by syscall hardening; KVM is protected by software clearing sequence
Full mitigation might require a microcode update from the CPU Full mitigation might require a microcode update from the CPU
vendor. When the necessary microcode is not available, the kernel will vendor. When the necessary microcode is not available, the kernel will
...@@ -669,7 +671,8 @@ kernel command line. ...@@ -669,7 +671,8 @@ kernel command line.
unconditionally disable. unconditionally disable.
auto auto
enable if hardware mitigation enable if hardware mitigation
control(BHI_DIS_S) is available. control(BHI_DIS_S) is available, otherwise
enable alternate mitigation in KVM.
For spectre_v2_user see Documentation/admin-guide/kernel-parameters.txt For spectre_v2_user see Documentation/admin-guide/kernel-parameters.txt
......
...@@ -6071,8 +6071,9 @@ ...@@ -6071,8 +6071,9 @@
on - unconditionally enable. on - unconditionally enable.
off - unconditionally disable. off - unconditionally disable.
auto - (default) enable only if hardware mitigation auto - (default) enable hardware mitigation
control(BHI_DIS_S) is available. (BHI_DIS_S) if available, otherwise enable
alternate mitigation in KVM.
spectre_v2= [X86,EARLY] Control mitigation of Spectre variant 2 spectre_v2= [X86,EARLY] Control mitigation of Spectre variant 2
(indirect branch speculation) vulnerability. (indirect branch speculation) vulnerability.
......
...@@ -469,6 +469,7 @@ ...@@ -469,6 +469,7 @@
#define X86_FEATURE_CLEAR_BHB_LOOP (21*32+ 1) /* "" Clear branch history at syscall entry using SW loop */ #define X86_FEATURE_CLEAR_BHB_LOOP (21*32+ 1) /* "" Clear branch history at syscall entry using SW loop */
#define X86_FEATURE_BHI_CTRL (21*32+ 2) /* "" BHI_DIS_S HW control available */ #define X86_FEATURE_BHI_CTRL (21*32+ 2) /* "" BHI_DIS_S HW control available */
#define X86_FEATURE_CLEAR_BHB_HW (21*32+ 3) /* "" BHI_DIS_S HW control enabled */ #define X86_FEATURE_CLEAR_BHB_HW (21*32+ 3) /* "" BHI_DIS_S HW control enabled */
#define X86_FEATURE_CLEAR_BHB_LOOP_ON_VMEXIT (21*32+ 4) /* "" Clear branch history at vmexit using SW loop */
/* /*
* BUG word(s) * BUG word(s)
......
...@@ -330,8 +330,13 @@ ...@@ -330,8 +330,13 @@
.macro CLEAR_BRANCH_HISTORY .macro CLEAR_BRANCH_HISTORY
ALTERNATIVE "", "call clear_bhb_loop", X86_FEATURE_CLEAR_BHB_LOOP ALTERNATIVE "", "call clear_bhb_loop", X86_FEATURE_CLEAR_BHB_LOOP
.endm .endm
.macro CLEAR_BRANCH_HISTORY_VMEXIT
ALTERNATIVE "", "call clear_bhb_loop", X86_FEATURE_CLEAR_BHB_LOOP_ON_VMEXIT
.endm
#else #else
#define CLEAR_BRANCH_HISTORY #define CLEAR_BRANCH_HISTORY
#define CLEAR_BRANCH_HISTORY_VMEXIT
#endif #endif
#else /* __ASSEMBLY__ */ #else /* __ASSEMBLY__ */
......
...@@ -1668,9 +1668,14 @@ static void __init bhi_select_mitigation(void) ...@@ -1668,9 +1668,14 @@ static void __init bhi_select_mitigation(void)
if (!IS_ENABLED(CONFIG_X86_64)) if (!IS_ENABLED(CONFIG_X86_64))
return; return;
/* Mitigate KVM by default */
setup_force_cpu_cap(X86_FEATURE_CLEAR_BHB_LOOP_ON_VMEXIT);
pr_info("Spectre BHI mitigation: SW BHB clearing on vm exit\n");
if (bhi_mitigation == BHI_MITIGATION_AUTO) if (bhi_mitigation == BHI_MITIGATION_AUTO)
return; return;
/* Mitigate syscalls when the mitigation is forced =on */
setup_force_cpu_cap(X86_FEATURE_CLEAR_BHB_LOOP); setup_force_cpu_cap(X86_FEATURE_CLEAR_BHB_LOOP);
pr_info("Spectre BHI mitigation: SW BHB clearing on syscall\n"); pr_info("Spectre BHI mitigation: SW BHB clearing on syscall\n");
} }
...@@ -2811,10 +2816,12 @@ static const char * const spectre_bhi_state(void) ...@@ -2811,10 +2816,12 @@ static const char * const spectre_bhi_state(void)
else if (boot_cpu_has(X86_FEATURE_CLEAR_BHB_HW)) else if (boot_cpu_has(X86_FEATURE_CLEAR_BHB_HW))
return "; BHI: BHI_DIS_S"; return "; BHI: BHI_DIS_S";
else if (boot_cpu_has(X86_FEATURE_CLEAR_BHB_LOOP)) else if (boot_cpu_has(X86_FEATURE_CLEAR_BHB_LOOP))
return "; BHI: SW loop"; return "; BHI: SW loop, KVM: SW loop";
else if (boot_cpu_has(X86_FEATURE_RETPOLINE) && else if (boot_cpu_has(X86_FEATURE_RETPOLINE) &&
!(x86_read_arch_cap_msr() & ARCH_CAP_RRSBA)) !(x86_read_arch_cap_msr() & ARCH_CAP_RRSBA))
return "; BHI: Retpoline"; return "; BHI: Retpoline";
else if (boot_cpu_has(X86_FEATURE_CLEAR_BHB_LOOP_ON_VMEXIT))
return "; BHI: Syscall hardening, KVM: SW loop";
return "; BHI: Vulnerable (Syscall hardening enabled)"; return "; BHI: Vulnerable (Syscall hardening enabled)";
} }
......
...@@ -275,7 +275,7 @@ SYM_INNER_LABEL_ALIGN(vmx_vmexit, SYM_L_GLOBAL) ...@@ -275,7 +275,7 @@ SYM_INNER_LABEL_ALIGN(vmx_vmexit, SYM_L_GLOBAL)
call vmx_spec_ctrl_restore_host call vmx_spec_ctrl_restore_host
CLEAR_BRANCH_HISTORY CLEAR_BRANCH_HISTORY_VMEXIT
/* Put return value in AX */ /* Put return value in AX */
mov %_ASM_BX, %_ASM_AX mov %_ASM_BX, %_ASM_AX
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment