x86/bugs: Add 'spectre_bhi=vmexit' cmdline option

In cloud environments it can be useful to *only* enable the vmexit
mitigation and leave syscalls vulnerable.  Add that as an option.

This is similar to the old spectre_bhi=auto option which was removed
with the following commit:

  36d4fe147c87 ("x86/bugs: Remove CONFIG_BHI_MITIGATION_AUTO and spectre_bhi=auto")

with the main difference being that this has a more descriptive name and
is disabled by default.

Mitigation switch requested by Maksim Davydov <davydov-max@yandex-team.ru>.

  [ bp: Massage. ]

Signed-off-by: Josh Poimboeuf <jpoimboe@kernel.org>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Reviewed-by: Daniel Sneddon <daniel.sneddon@linux.intel.com>
Reviewed-by: Nikolay Borisov <nik.borisov@suse.com>
Link: https://lore.kernel.org/r/2cbad706a6d5e1da2829e5e123d8d5c80330148c.1719381528.git.jpoimboe@kernel.org

diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
index 11e57ba2985ccd55c395a6a4c4d856fd25714721..ddf4eff727ab827a7841e638794f5dfd4fab3f82 100644 (file)
--- a/Documentation/admin-guide/kernel-parameters.txt
+++ b/Documentation/admin-guide/kernel-parameters.txt
@@ -6136,9 +6136,15 @@
                        deployment of the HW BHI control and the SW BHB
                        clearing sequence.
 
-                       on   - (default) Enable the HW or SW mitigation
-                              as needed.
-                       off  - Disable the mitigation.
+                       on     - (default) Enable the HW or SW mitigation as
+                                needed.  This protects the kernel from
+                                both syscalls and VMs.
+                       vmexit - On systems which don't have the HW mitigation
+                                available, enable the SW mitigation on vmexit
+                                ONLY.  On such systems, the host kernel is
+                                protected from VM-originated BHI attacks, but
+                                may still be vulnerable to syscall attacks.
+                       off    - Disable the mitigation.
 
        spectre_v2=     [X86,EARLY] Control mitigation of Spectre variant 2
                        (indirect branch speculation) vulnerability.

diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
index b6f927f6c567e1a0086f5b31ea86abd1ea6af84f..45675da354f33d98123d843f7256f141a461498a 100644 (file)
--- a/arch/x86/kernel/cpu/bugs.c
+++ b/arch/x86/kernel/cpu/bugs.c
@@ -1625,6 +1625,7 @@ static bool __init spec_ctrl_bhi_dis(void)
 enum bhi_mitigations {
        BHI_MITIGATION_OFF,
        BHI_MITIGATION_ON,
+       BHI_MITIGATION_VMEXIT_ONLY,
 };
 
 static enum bhi_mitigations bhi_mitigation __ro_after_init =
@@ -1639,6 +1640,8 @@ static int __init spectre_bhi_parse_cmdline(char *str)
                bhi_mitigation = BHI_MITIGATION_OFF;
        else if (!strcmp(str, "on"))
                bhi_mitigation = BHI_MITIGATION_ON;
+       else if (!strcmp(str, "vmexit"))
+               bhi_mitigation = BHI_MITIGATION_VMEXIT_ONLY;
        else
                pr_err("Ignoring unknown spectre_bhi option (%s)", str);
 
@@ -1659,19 +1662,22 @@ static void __init bhi_select_mitigation(void)
                        return;
        }
 
+       /* Mitigate in hardware if supported */
        if (spec_ctrl_bhi_dis())
                return;
 
        if (!IS_ENABLED(CONFIG_X86_64))
                return;
 
-       /* Mitigate KVM by default */
-       setup_force_cpu_cap(X86_FEATURE_CLEAR_BHB_LOOP_ON_VMEXIT);
-       pr_info("Spectre BHI mitigation: SW BHB clearing on vm exit\n");
+       if (bhi_mitigation == BHI_MITIGATION_VMEXIT_ONLY) {
+               pr_info("Spectre BHI mitigation: SW BHB clearing on VM exit only\n");
+               setup_force_cpu_cap(X86_FEATURE_CLEAR_BHB_LOOP_ON_VMEXIT);
+               return;
+       }
 
-       /* Mitigate syscalls when the mitigation is forced =on */
+       pr_info("Spectre BHI mitigation: SW BHB clearing on syscall and VM exit\n");
        setup_force_cpu_cap(X86_FEATURE_CLEAR_BHB_LOOP);
-       pr_info("Spectre BHI mitigation: SW BHB clearing on syscall\n");
+       setup_force_cpu_cap(X86_FEATURE_CLEAR_BHB_LOOP_ON_VMEXIT);
 }
 
 static void __init spectre_v2_select_mitigation(void)