From: Linus Torvalds <torvalds@linux-foundation.org>
Date: Tue, 9 Apr 2024 03:07:51 +0000 (-0700)
Subject: Merge tag 'nativebhi' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
X-Git-Tag: v6.9-rc4-pxa1908~67
X-Git-Url: https://git.dujemihanovic.xyz/?a=commitdiff_plain;h=2bb69f5fc72183e1c62547d900f560d0e9334925;p=linux.git

Merge tag 'nativebhi' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull x86 mitigations from Thomas Gleixner:
 "Mitigations for the native BHI hardware vulnerabilty:

  Branch History Injection (BHI) attacks may allow a malicious
  application to influence indirect branch prediction in kernel by
  poisoning the branch history. eIBRS isolates indirect branch targets
  in ring0. The BHB can still influence the choice of indirect branch
  predictor entry, and although branch predictor entries are isolated
  between modes when eIBRS is enabled, the BHB itself is not isolated
  between modes.

  Add mitigations against it either with the help of microcode or with
  software sequences for the affected CPUs"

[ This also ends up enabling the full mitigation by default despite the
  system call hardening, because apparently there are other indirect
  calls that are still sufficiently reachable, and the 'auto' case just
  isn't hardened enough.

  We'll have some more inevitable tweaking in the future    - Linus ]

* tag 'nativebhi' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  KVM: x86: Add BHI_NO
  x86/bhi: Mitigate KVM by default
  x86/bhi: Add BHI mitigation knob
  x86/bhi: Enumerate Branch History Injection (BHI) bug
  x86/bhi: Define SPEC_CTRL_BHI_DIS_S
  x86/bhi: Add support for clearing branch history at syscall entry
  x86/syscall: Don't force use of indirect calls for system calls
  x86/bugs: Change commas to semicolons in 'spectre_v2' sysfs file
---

2bb69f5fc72183e1c62547d900f560d0e9334925
diff --cc arch/x86/Kconfig
index 4fff6ed46e90,29a7b69a1316..10a6251f58f3
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@@ -2633,6 -2633,31 +2633,32 @@@ config MITIGATION_RFD
  	  stored in floating point, vector and integer registers.
  	  See also <file:Documentation/admin-guide/hw-vuln/reg-file-data-sampling.rst>
  
+ choice
+ 	prompt "Clear branch history"
+ 	depends on CPU_SUP_INTEL
 -	default SPECTRE_BHI_AUTO
++	default SPECTRE_BHI_ON
+ 	help
+ 	  Enable BHI mitigations. BHI attacks are a form of Spectre V2 attacks
+ 	  where the branch history buffer is poisoned to speculatively steer
+ 	  indirect branches.
+ 	  See <file:Documentation/admin-guide/hw-vuln/spectre.rst>
+ 
+ config SPECTRE_BHI_ON
+ 	bool "on"
+ 	help
+ 	  Equivalent to setting spectre_bhi=on command line parameter.
+ config SPECTRE_BHI_OFF
+ 	bool "off"
+ 	help
+ 	  Equivalent to setting spectre_bhi=off command line parameter.
+ config SPECTRE_BHI_AUTO
+ 	bool "auto"
++	depends on BROKEN
+ 	help
+ 	  Equivalent to setting spectre_bhi=auto command line parameter.
+ 
+ endchoice
+ 
  endif
  
  config ARCH_HAS_ADD_PAGES