diff options
| author | David Kaplan <david.kaplan@amd.com> | 2025-07-07 13:33:09 -0500 |
|---|---|---|
| committer | Borislav Petkov (AMD) <bp@alien8.de> | 2025-07-11 17:56:41 +0200 |
| commit | ddcd4d3cb37c8ad60cdbaaffe93f85e15e2babb5 (patch) | |
| tree | b6a178416a64b52b586f2b30b749d47ae9e0cbb8 | |
| parent | 07a659edcf6eb56f7906fc415f46e3a7f37d5383 (diff) | |
x86/bugs: Add attack vector controls for BHI
Use attack vector controls to determine if BHI mitigation is required.
Signed-off-by: David Kaplan <david.kaplan@amd.com>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Link: https://lore.kernel.org/20250707183316.1349127-15-david.kaplan@amd.com
| -rw-r--r-- | arch/x86/kernel/cpu/bugs.c | 15 |
1 files changed, 12 insertions, 3 deletions
diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c index ff5625164f6d..2022f05a2ce7 100644 --- a/arch/x86/kernel/cpu/bugs.c +++ b/arch/x86/kernel/cpu/bugs.c @@ -2217,11 +2217,20 @@ early_param("spectre_bhi", spectre_bhi_parse_cmdline); static void __init bhi_select_mitigation(void) { - if (!boot_cpu_has(X86_BUG_BHI) || cpu_mitigations_off()) + if (!boot_cpu_has(X86_BUG_BHI)) bhi_mitigation = BHI_MITIGATION_OFF; - if (bhi_mitigation == BHI_MITIGATION_AUTO) - bhi_mitigation = BHI_MITIGATION_ON; + if (bhi_mitigation != BHI_MITIGATION_AUTO) + return; + + if (cpu_attack_vector_mitigated(CPU_MITIGATE_GUEST_HOST)) { + if (cpu_attack_vector_mitigated(CPU_MITIGATE_USER_KERNEL)) + bhi_mitigation = BHI_MITIGATION_ON; + else + bhi_mitigation = BHI_MITIGATION_VMEXIT_ONLY; + } else { + bhi_mitigation = BHI_MITIGATION_OFF; + } } static void __init bhi_update_mitigation(void) |