<div dir="ltr"><div>LGTM</div><div> </div><div>Acked-by: Andy Whitcroft <<a href="mailto:apw@canonical.com">apw@canonical.com</a>></div><div> </div><div>-apw </div></div> <div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Tue, Apr 16, 2024 at 3:54 PM Stefan Bader <<a href="mailto:stefan.bader@canonical.com">stefan.bader@canonical.com</a>> wrote: </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">[Impact] Native BHI attack, a Spectre v2 variant, allows local unprivileged attackers to obtain kernel memory information without the help of unprivileged eBPF, negating to the previous belief that unprivileged eBPF is the only real-world source of such an attack. Also, this vulnerability affects KVM as well. [Backport] In order to minimize effort with future upstream stable ports I only used patches from linux-5.15.y which have not yet picked up. This allowed the BHI set from linux-5.15.y to be applied with just 4 simple context changes. The missing prerequisite commits are: 1. 1d30800c0c0a (“x86/bugs: Use sysfs_emit()”) This one solves the conflict in [1/8] 0cd01ac5dcb1 (“x86/bugs: Change commas to semicolons in 'spectre_v2' sysfs file”) by substitute sprintf() with sysfs_emit() 2. eefe5e668209 (“KVM: x86: Advertise CPUID.(EAX=7,ECX=2):EDX[5:0] to userspace“) This commit introduced CPUID_7_2_EDX, a flag used by [4/8] 0f4a837615ff (“x86/bhi: Define SPEC_CTRL_BHI_DIS_S“) 3. 047c72299061 (“KVM: x86: Update KVM-only leaf handling to allow for 100% KVM-only leafs”) This one introduced kvm_cpu_cap_init_kvm_defined(), solving a build error caused by the commit above. No functional change as noted by the commit message, safe to backport. 4. 3de7708607e5 ("KVM: x86: Use a switch statement and macros in __feature_translate()") This changes __feature_translate in reverse-cpuid.h to use macros and by that allows ("x86/bhi: Define SPEC_CTRL_BHI_DIS_S") to be applied without changes. [Test] Compiled only. [Where things could go wrong] This patch is more about enabling CPU features and reducing branch history exposed, therefore, that the system is able to boot and run should denote that it is not introducing any regression. For KVM, the most significant impact is the performance regression due to system call substitution since branch prediction probably won't perform as fast as the previous version for users who do not care about the mitigation. For this reason we are right now only enable this in auto mode which means only if firmware supports it. Borislav Petkov (1): x86/bugs: Use sysfs_emit() Daniel Sneddon (2): x86/bhi: Define SPEC_CTRL_BHI_DIS_S KVM: x86: Add BHI_NO Jim Mattson (2): KVM: x86: Advertise CPUID.(EAX=7,ECX=2):EDX[5:0] to userspace KVM: x86: Use a switch statement and macros in __feature_translate() Josh Poimboeuf (1): x86/bugs: Change commas to semicolons in 'spectre_v2' sysfs file Linus Torvalds (1): x86/syscall: Don't force use of indirect calls for system calls Pawan Gupta (4): x86/bhi: Add support for clearing branch history at syscall entry x86/bhi: Enumerate Branch History Injection (BHI) bug x86/bhi: Add BHI mitigation knob x86/bhi: Mitigate KVM by default Sean Christopherson (1): KVM: x86: Update KVM-only leaf handling to allow for 100% KVM-only leafs Stefan Bader (1): UBUNTU: [Config] Set CONFIG_BHI to enabled (auto) Documentation/admin-guide/hw-vuln/spectre.rst | 51 +++- .../admin-guide/kernel-parameters.txt | 12 + arch/x86/Kconfig | 25 ++ arch/x86/entry/common.c | 6 +- arch/x86/entry/entry_64.S | 61 +++++ arch/x86/entry/entry_64_compat.S | 3 + arch/x86/entry/syscall_32.c | 21 +- arch/x86/entry/syscall_64.c | 19 +- arch/x86/entry/syscall_x32.c | 10 +- arch/x86/include/asm/cpufeatures.h | 12 + arch/x86/include/asm/msr-index.h | 9 +- arch/x86/include/asm/nospec-branch.h | 17 ++ arch/x86/include/asm/syscall.h | 10 +- arch/x86/kernel/cpu/bugs.c | 218 +++++++++++++----- arch/x86/kernel/cpu/common.c | 24 +- arch/x86/kernel/cpu/scattered.c | 1 + arch/x86/kvm/cpuid.c | 29 ++- arch/x86/kvm/reverse_cpuid.h | 45 +++- arch/x86/kvm/vmx/vmenter.S | 2 + arch/x86/kvm/x86.c | 3 +- debian.master/config/annotations | 3 + 21 files changed, 470 insertions(+), 111 deletions(-) -- 2.34.1 -- kernel-team mailing list <a href="mailto:kernel-team@lists.ubuntu.com" target="_blank">kernel-team@lists.ubuntu.com</a> <a href="https://lists.ubuntu.com/mailman/listinfo/kernel-team" rel="noreferrer" target="_blank">https://lists.ubuntu.com/mailman/listinfo/kernel-team</a> </blockquote></div>