Skip to content

Commit 3142cfb

Browse files
PlaidCatPlaidCat
committed
x86/vmscape: Warn when STIBP is disabled with SMT
jira LE-4704 cve CVE-2025-40300 Rebuild_History Non-Buildable kernel-4.18.0-553.83.1.el8_10 commit-author Pawan Gupta <pawan.kumar.gupta@linux.intel.com> commit b7cc988 Empty-Commit: Cherry-Pick Conflicts during history rebuild. Will be included in final tarball splat. Ref for failed cherry-pick at: ciq/ciq_backports/kernel-4.18.0-553.83.1.el8_10/b7cc9887.failed Cross-thread attacks are generally harder as they require the victim to be co-located on a core. However, with VMSCAPE the adversary targets belong to the same guest execution, that are more likely to get co-located. In particular, a thread that is currently executing userspace hypervisor (after the IBPB) may still be targeted by a guest execution from a sibling thread. Issue a warning about the potential risk, except when: - SMT is disabled - STIBP is enabled system-wide - Intel eIBRS is enabled (which implies STIBP protection) Signed-off-by: Pawan Gupta <pawan.kumar.gupta@linux.intel.com> Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com> (cherry picked from commit b7cc988) Signed-off-by: Jonathan Maple <jmaple@ciq.com> # Conflicts: # arch/x86/kernel/cpu/bugs.c
1 parent cc2fdb8 commit 3142cfb

File tree

1 file changed

+151
-0
lines changed

1 file changed

+151
-0
lines changed

‎ciq/ciq_backports/kernel-4.18.0-553.83.1.el8_10/b7cc9887.failed‎

Lines changed: 151 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,151 @@
1+
x86/vmscape: Warn when STIBP is disabled with SMT
2+
3+
jira LE-4704
4+
cve CVE-2025-40300
5+
Rebuild_History Non-Buildable kernel-4.18.0-553.83.1.el8_10
6+
commit-author Pawan Gupta <pawan.kumar.gupta@linux.intel.com>
7+
commit b7cc9887231526ca4fa89f3fa4119e47c2dc7b1e
8+
Empty-Commit: Cherry-Pick Conflicts during history rebuild.
9+
Will be included in final tarball splat. Ref for failed cherry-pick at:
10+
ciq/ciq_backports/kernel-4.18.0-553.83.1.el8_10/b7cc9887.failed
11+
12+
Cross-thread attacks are generally harder as they require the victim to be
13+
co-located on a core. However, with VMSCAPE the adversary targets belong to
14+
the same guest execution, that are more likely to get co-located. In
15+
particular, a thread that is currently executing userspace hypervisor
16+
(after the IBPB) may still be targeted by a guest execution from a sibling
17+
thread.
18+
19+
Issue a warning about the potential risk, except when:
20+
21+
- SMT is disabled
22+
- STIBP is enabled system-wide
23+
- Intel eIBRS is enabled (which implies STIBP protection)
24+
25+
Signed-off-by: Pawan Gupta <pawan.kumar.gupta@linux.intel.com>
26+
Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
27+
(cherry picked from commit b7cc9887231526ca4fa89f3fa4119e47c2dc7b1e)
28+
Signed-off-by: Jonathan Maple <jmaple@ciq.com>
29+
30+
# Conflicts:
31+
# arch/x86/kernel/cpu/bugs.c
32+
diff --cc arch/x86/kernel/cpu/bugs.c
33+
index a556e8ade674,fa32615db71d..000000000000
34+
--- a/arch/x86/kernel/cpu/bugs.c
35+
+++ b/arch/x86/kernel/cpu/bugs.c
36+
@@@ -2707,6 -3320,111 +2707,114 @@@ out
37+
#undef pr_fmt
38+
#define pr_fmt(fmt) fmt
39+
40+
++<<<<<<< HEAD
41+
++=======
42+
+ #define MDS_MSG_SMT "MDS CPU bug present and SMT on, data leak possible. See https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/mds.html for more details.\n"
43+
+ #define TAA_MSG_SMT "TAA CPU bug present and SMT on, data leak possible. See https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/tsx_async_abort.html for more details.\n"
44+
+ #define MMIO_MSG_SMT "MMIO Stale Data CPU bug present and SMT on, data leak possible. See https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/processor_mmio_stale_data.html for more details.\n"
45+
+ #define VMSCAPE_MSG_SMT "VMSCAPE: SMT on, STIBP is required for full protection. See https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/vmscape.html for more details.\n"
46+
+
47+
+ void cpu_bugs_smt_update(void)
48+
+ {
49+
+ mutex_lock(&spec_ctrl_mutex);
50+
+
51+
+ if (sched_smt_active() && unprivileged_ebpf_enabled() &&
52+
+ spectre_v2_enabled == SPECTRE_V2_EIBRS_LFENCE)
53+
+ pr_warn_once(SPECTRE_V2_EIBRS_LFENCE_EBPF_SMT_MSG);
54+
+
55+
+ switch (spectre_v2_user_stibp) {
56+
+ case SPECTRE_V2_USER_NONE:
57+
+ break;
58+
+ case SPECTRE_V2_USER_STRICT:
59+
+ case SPECTRE_V2_USER_STRICT_PREFERRED:
60+
+ update_stibp_strict();
61+
+ break;
62+
+ case SPECTRE_V2_USER_PRCTL:
63+
+ case SPECTRE_V2_USER_SECCOMP:
64+
+ update_indir_branch_cond();
65+
+ break;
66+
+ }
67+
+
68+
+ switch (mds_mitigation) {
69+
+ case MDS_MITIGATION_FULL:
70+
+ case MDS_MITIGATION_AUTO:
71+
+ case MDS_MITIGATION_VMWERV:
72+
+ if (sched_smt_active() && !boot_cpu_has(X86_BUG_MSBDS_ONLY))
73+
+ pr_warn_once(MDS_MSG_SMT);
74+
+ update_mds_branch_idle();
75+
+ break;
76+
+ case MDS_MITIGATION_OFF:
77+
+ break;
78+
+ }
79+
+
80+
+ switch (taa_mitigation) {
81+
+ case TAA_MITIGATION_VERW:
82+
+ case TAA_MITIGATION_AUTO:
83+
+ case TAA_MITIGATION_UCODE_NEEDED:
84+
+ if (sched_smt_active())
85+
+ pr_warn_once(TAA_MSG_SMT);
86+
+ break;
87+
+ case TAA_MITIGATION_TSX_DISABLED:
88+
+ case TAA_MITIGATION_OFF:
89+
+ break;
90+
+ }
91+
+
92+
+ switch (mmio_mitigation) {
93+
+ case MMIO_MITIGATION_VERW:
94+
+ case MMIO_MITIGATION_AUTO:
95+
+ case MMIO_MITIGATION_UCODE_NEEDED:
96+
+ if (sched_smt_active())
97+
+ pr_warn_once(MMIO_MSG_SMT);
98+
+ break;
99+
+ case MMIO_MITIGATION_OFF:
100+
+ break;
101+
+ }
102+
+
103+
+ switch (tsa_mitigation) {
104+
+ case TSA_MITIGATION_USER_KERNEL:
105+
+ case TSA_MITIGATION_VM:
106+
+ case TSA_MITIGATION_AUTO:
107+
+ case TSA_MITIGATION_FULL:
108+
+ /*
109+
+ * TSA-SQ can potentially lead to info leakage between
110+
+ * SMT threads.
111+
+ */
112+
+ if (sched_smt_active())
113+
+ static_branch_enable(&cpu_buf_idle_clear);
114+
+ else
115+
+ static_branch_disable(&cpu_buf_idle_clear);
116+
+ break;
117+
+ case TSA_MITIGATION_NONE:
118+
+ case TSA_MITIGATION_UCODE_NEEDED:
119+
+ break;
120+
+ }
121+
+
122+
+ switch (vmscape_mitigation) {
123+
+ case VMSCAPE_MITIGATION_NONE:
124+
+ case VMSCAPE_MITIGATION_AUTO:
125+
+ break;
126+
+ case VMSCAPE_MITIGATION_IBPB_ON_VMEXIT:
127+
+ case VMSCAPE_MITIGATION_IBPB_EXIT_TO_USER:
128+
+ /*
129+
+ * Hypervisors can be attacked across-threads, warn for SMT when
130+
+ * STIBP is not already enabled system-wide.
131+
+ *
132+
+ * Intel eIBRS (!AUTOIBRS) implies STIBP on.
133+
+ */
134+
+ if (!sched_smt_active() ||
135+
+ spectre_v2_user_stibp == SPECTRE_V2_USER_STRICT ||
136+
+ spectre_v2_user_stibp == SPECTRE_V2_USER_STRICT_PREFERRED ||
137+
+ (spectre_v2_in_eibrs_mode(spectre_v2_enabled) &&
138+
+ !boot_cpu_has(X86_FEATURE_AUTOIBRS)))
139+
+ break;
140+
+ pr_warn_once(VMSCAPE_MSG_SMT);
141+
+ break;
142+
+ }
143+
+
144+
+ mutex_unlock(&spec_ctrl_mutex);
145+
+ }
146+
+
147+
++>>>>>>> b7cc98872315 (x86/vmscape: Warn when STIBP is disabled with SMT)
148+
#ifdef CONFIG_SYSFS
149+
150+
#define L1TF_DEFAULT_MSG "Mitigation: PTE Inversion"
151+
* Unmerged path arch/x86/kernel/cpu/bugs.c

0 commit comments

Comments
 (0)