x86/bugs: Fix BHI documentation

commit dfe648903f42296866d79f10d03f8c85c9dfba30 upstream.

Fix up some inaccuracies in the BHI documentation.

Fixes: ec9404e40e8f ("x86/bhi: Add BHI mitigation knob")
Signed-off-by: Josh Poimboeuf <jpoimboe@kernel.org>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Reviewed-by: Nikolay Borisov <nik.borisov@suse.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Sean Christopherson <seanjc@google.com>
Link: https://lore.kernel.org/r/8c84f7451bfe0dd08543c6082a383f390d4aa7e2.1712813475.git.jpoimboe@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/Documentation/admin-guide/hw-vuln/spectre.rst b/Documentation/admin-guide/hw-vuln/spectre.rst
index fda00aac0d721f7d63c169508be47f5f075f31bd..06b27317638ae5db8450b6a3535d2cdce56fabc2 100644 (file)
--- a/Documentation/admin-guide/hw-vuln/spectre.rst
+++ b/Documentation/admin-guide/hw-vuln/spectre.rst
@@ -439,11 +439,11 @@ The possible values in this file are:
    - System is protected by retpoline
  * - BHI: BHI_DIS_S
    - System is protected by BHI_DIS_S
- * - BHI: SW loop; KVM SW loop
+ * - BHI: SW loop, KVM SW loop
    - System is protected by software clearing sequence
  * - BHI: Syscall hardening
    - Syscalls are hardened against BHI
- * - BHI: Syscall hardening; KVM: SW loop
+ * - BHI: Syscall hardening, KVM: SW loop
    - System is protected from userspace attacks by syscall hardening; KVM is protected by software clearing sequence
 
 Full mitigation might require a microcode update from the CPU
@@ -716,13 +716,14 @@ For user space mitigation:
                of the HW BHI control and the SW BHB clearing sequence.
 
                on
-                       unconditionally enable.
+                       (default) Enable the HW or SW mitigation as
+                       needed.
                off
-                       unconditionally disable.
+                       Disable the mitigation.
                auto
-                       enable if hardware mitigation
-                       control(BHI_DIS_S) is available, otherwise
-                       enable alternate mitigation in KVM.
+                       Enable the HW mitigation if needed, but
+                       *don't* enable the SW mitigation except for KVM.
+                       The system may be vulnerable.
 
 For spectre_v2_user see Documentation/admin-guide/kernel-parameters.txt
 

diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
index 7e9e655a715eabbe4f9fa1038f3ce3f3e02a1eca..0c63b64304c9d382320810394e610558a7c2e610 100644 (file)
--- a/Documentation/admin-guide/kernel-parameters.txt
+++ b/Documentation/admin-guide/kernel-parameters.txt
@@ -3093,6 +3093,7 @@
                                               reg_file_data_sampling=off [X86]
                                               retbleed=off [X86]
                                               spec_store_bypass_disable=off [X86,PPC]
+                                              spectre_bhi=off [X86]
                                               spectre_v2_user=off [X86]
                                               ssbd=force-off [ARM64]
                                               tsx_async_abort=off [X86]
@@ -5410,11 +5411,12 @@
                        deployment of the HW BHI control and the SW BHB
                        clearing sequence.
 
-                       on   - unconditionally enable.
-                       off  - unconditionally disable.
-                       auto - (default) enable hardware mitigation
-                              (BHI_DIS_S) if available, otherwise enable
-                              alternate mitigation in KVM.
+                       on   - (default) Enable the HW or SW mitigation
+                              as needed.
+                       off  - Disable the mitigation.
+                       auto - Enable the HW mitigation if needed, but
+                              *don't* enable the SW mitigation except
+                              for KVM.  The system may be vulnerable.
 
        spectre_v2=     [X86] Control mitigation of Spectre variant 2
                        (indirect branch speculation) vulnerability.