Skip to content

Commit 79dac42

Browse files
PlaidCatPlaidCat
committed
x86/bugs: Clarify that syscall hardening isn't a BHI mitigation
jira LE-2015 cve CVE-2024-2201 Rebuild_History Non-Buildable kernel-5.14.0-427.42.1.el9_4 commit-author Josh Poimboeuf <jpoimboe@kernel.org> commit 5f882f3 Empty-Commit: Cherry-Pick Conflicts during history rebuild. Will be included in final tarball splat. Ref for failed cherry-pick at: ciq/ciq_backports/kernel-5.14.0-427.42.1.el9_4/5f882f3b.failed While syscall hardening helps prevent some BHI attacks, there's still other low-hanging fruit remaining. Don't classify it as a mitigation and make it clear that the system may still be vulnerable if it doesn't have a HW or SW mitigation enabled. Fixes: ec9404e ("x86/bhi: Add BHI mitigation knob") Signed-off-by: Josh Poimboeuf <jpoimboe@kernel.org> Signed-off-by: Ingo Molnar <mingo@kernel.org> Cc: Linus Torvalds <torvalds@linux-foundation.org> Cc: Sean Christopherson <seanjc@google.com> Link: https://lore.kernel.org/r/b5951dae3fdee7f1520d5136a27be3bdfe95f88b.1712813475.git.jpoimboe@kernel.org (cherry picked from commit 5f882f3) Signed-off-by: Jonathan Maple <jmaple@ciq.com> # Conflicts: # Documentation/admin-guide/hw-vuln/spectre.rst # Documentation/admin-guide/kernel-parameters.txt # arch/x86/kernel/cpu/bugs.c
1 parent 0819a7c commit 79dac42

File tree

1 file changed

+147
-0
lines changed

1 file changed

+147
-0
lines changed

‎ciq/ciq_backports/kernel-5.14.0-427.42.1.el9_4/5f882f3b.failed‎

Lines changed: 147 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,147 @@
1+
x86/bugs: Clarify that syscall hardening isn't a BHI mitigation
2+
3+
jira LE-2015
4+
cve CVE-2024-2201
5+
Rebuild_History Non-Buildable kernel-5.14.0-427.42.1.el9_4
6+
commit-author Josh Poimboeuf <jpoimboe@kernel.org>
7+
commit 5f882f3b0a8bf0788d5a0ee44b1191de5319bb8a
8+
Empty-Commit: Cherry-Pick Conflicts during history rebuild.
9+
Will be included in final tarball splat. Ref for failed cherry-pick at:
10+
ciq/ciq_backports/kernel-5.14.0-427.42.1.el9_4/5f882f3b.failed
11+
12+
While syscall hardening helps prevent some BHI attacks, there's still
13+
other low-hanging fruit remaining. Don't classify it as a mitigation
14+
and make it clear that the system may still be vulnerable if it doesn't
15+
have a HW or SW mitigation enabled.
16+
17+
Fixes: ec9404e40e8f ("x86/bhi: Add BHI mitigation knob")
18+
Signed-off-by: Josh Poimboeuf <jpoimboe@kernel.org>
19+
Signed-off-by: Ingo Molnar <mingo@kernel.org>
20+
Cc: Linus Torvalds <torvalds@linux-foundation.org>
21+
Cc: Sean Christopherson <seanjc@google.com>
22+
Link: https://lore.kernel.org/r/b5951dae3fdee7f1520d5136a27be3bdfe95f88b.1712813475.git.jpoimboe@kernel.org
23+
(cherry picked from commit 5f882f3b0a8bf0788d5a0ee44b1191de5319bb8a)
24+
Signed-off-by: Jonathan Maple <jmaple@ciq.com>
25+
26+
# Conflicts:
27+
# Documentation/admin-guide/hw-vuln/spectre.rst
28+
# Documentation/admin-guide/kernel-parameters.txt
29+
# arch/x86/kernel/cpu/bugs.c
30+
diff --cc Documentation/admin-guide/hw-vuln/spectre.rst
31+
index 166facdabe9f,5a39acf82483..000000000000
32+
--- a/Documentation/admin-guide/hw-vuln/spectre.rst
33+
+++ b/Documentation/admin-guide/hw-vuln/spectre.rst
34+
@@@ -430,6 -429,23 +430,26 @@@ The possible values in this file are
35+
'PBRSB-eIBRS: Not affected' CPU is not affected by PBRSB
36+
=========================== =======================================================
37+
38+
++<<<<<<< HEAD
39+
++=======
40+
+ - Branch History Injection (BHI) protection status:
41+
+
42+
+ .. list-table::
43+
+
44+
+ * - BHI: Not affected
45+
+ - System is not affected
46+
+ * - BHI: Retpoline
47+
+ - System is protected by retpoline
48+
+ * - BHI: BHI_DIS_S
49+
+ - System is protected by BHI_DIS_S
50+
+ * - BHI: SW loop, KVM SW loop
51+
+ - System is protected by software clearing sequence
52+
+ * - BHI: Vulnerable
53+
+ - System is vulnerable to BHI
54+
+ * - BHI: Vulnerable, KVM: SW loop
55+
+ - System is vulnerable; KVM is protected by software clearing sequence
56+
+
57+
++>>>>>>> 5f882f3b0a8b (x86/bugs: Clarify that syscall hardening isn't a BHI mitigation)
58+
Full mitigation might require a microcode update from the CPU
59+
vendor. When the necessary microcode is not available, the kernel will
60+
report vulnerability.
61+
@@@ -638,6 -658,22 +658,25 @@@ kernel command line
62+
spectre_v2=off. Spectre variant 1 mitigations
63+
cannot be disabled.
64+
65+
++<<<<<<< HEAD
66+
++=======
67+
+ spectre_bhi=
68+
+
69+
+ [X86] Control mitigation of Branch History Injection
70+
+ (BHI) vulnerability. This setting affects the deployment
71+
+ of the HW BHI control and the SW BHB clearing sequence.
72+
+
73+
+ on
74+
+ (default) Enable the HW or SW mitigation as
75+
+ needed.
76+
+ off
77+
+ Disable the mitigation.
78+
+ auto
79+
+ Enable the HW mitigation if needed, but
80+
+ *don't* enable the SW mitigation except for KVM.
81+
+ The system may be vulnerable.
82+
+
83+
++>>>>>>> 5f882f3b0a8b (x86/bugs: Clarify that syscall hardening isn't a BHI mitigation)
84+
For spectre_v2_user see Documentation/admin-guide/kernel-parameters.txt
85+
86+
Mitigation selection guide
87+
diff --cc Documentation/admin-guide/kernel-parameters.txt
88+
index f74f25f00a14,a3874cc97892..000000000000
89+
--- a/Documentation/admin-guide/kernel-parameters.txt
90+
+++ b/Documentation/admin-guide/kernel-parameters.txt
91+
@@@ -5722,7 -6064,19 +5722,23 @@@
92+
sonypi.*= [HW] Sony Programmable I/O Control Device driver
93+
See Documentation/admin-guide/laptops/sonypi.rst
94+
95+
++<<<<<<< HEAD
96+
+ spectre_v2= [X86] Control mitigation of Spectre variant 2
97+
++=======
98+
+ spectre_bhi= [X86] Control mitigation of Branch History Injection
99+
+ (BHI) vulnerability. This setting affects the
100+
+ deployment of the HW BHI control and the SW BHB
101+
+ clearing sequence.
102+
+
103+
+ on - (default) Enable the HW or SW mitigation
104+
+ as needed.
105+
+ off - Disable the mitigation.
106+
+ auto - Enable the HW mitigation if needed, but
107+
+ *don't* enable the SW mitigation except
108+
+ for KVM. The system may be vulnerable.
109+
+
110+
+ spectre_v2= [X86,EARLY] Control mitigation of Spectre variant 2
111+
++>>>>>>> 5f882f3b0a8b (x86/bugs: Clarify that syscall hardening isn't a BHI mitigation)
112+
(indirect branch speculation) vulnerability.
113+
The default operation protects the kernel from
114+
user space attacks.
115+
diff --cc arch/x86/kernel/cpu/bugs.c
116+
index d1c0c8f6898b,9eeb60f5fbb3..000000000000
117+
--- a/arch/x86/kernel/cpu/bugs.c
118+
+++ b/arch/x86/kernel/cpu/bugs.c
119+
@@@ -2814,6 -2808,22 +2814,25 @@@ static char *pbrsb_eibrs_state(void
120+
}
121+
}
122+
123+
++<<<<<<< HEAD
124+
++=======
125+
+ static const char *spectre_bhi_state(void)
126+
+ {
127+
+ if (!boot_cpu_has_bug(X86_BUG_BHI))
128+
+ return "; BHI: Not affected";
129+
+ else if (boot_cpu_has(X86_FEATURE_CLEAR_BHB_HW))
130+
+ return "; BHI: BHI_DIS_S";
131+
+ else if (boot_cpu_has(X86_FEATURE_CLEAR_BHB_LOOP))
132+
+ return "; BHI: SW loop, KVM: SW loop";
133+
+ else if (boot_cpu_has(X86_FEATURE_RETPOLINE) && rrsba_disabled)
134+
+ return "; BHI: Retpoline";
135+
+ else if (boot_cpu_has(X86_FEATURE_CLEAR_BHB_LOOP_ON_VMEXIT))
136+
+ return "; BHI: Vulnerable, KVM: SW loop";
137+
+
138+
+ return "; BHI: Vulnerable";
139+
+ }
140+
+
141+
++>>>>>>> 5f882f3b0a8b (x86/bugs: Clarify that syscall hardening isn't a BHI mitigation)
142+
static ssize_t spectre_v2_show_state(char *buf)
143+
{
144+
if (spectre_v2_enabled == SPECTRE_V2_LFENCE)
145+
* Unmerged path Documentation/admin-guide/hw-vuln/spectre.rst
146+
* Unmerged path Documentation/admin-guide/kernel-parameters.txt
147+
* Unmerged path arch/x86/kernel/cpu/bugs.c

0 commit comments

Comments
 (0)