x86/bugs: Add attack vector controls for VMSCAPE

Use attack vector controls to select whether VMSCAPE requires mitigation,
similar to other bugs.

Signed-off-by: David Kaplan <david.kaplan@amd.com>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>

diff --git a/Documentation/admin-guide/hw-vuln/attack_vector_controls.rst b/Documentation/admin-guide/hw-vuln/attack_vector_controls.rst
index 5964901d66e317eec0c6b283f4ea868ca95008cd..d0bdbd81dcf9f2ace7b2868142f35b4c47ddb002 100644 (file)
--- a/Documentation/admin-guide/hw-vuln/attack_vector_controls.rst
+++ b/Documentation/admin-guide/hw-vuln/attack_vector_controls.rst
@@ -218,6 +218,7 @@ SRSO                  X              X            X              X
 SSB                                  X
 TAA                   X              X            X              X            *       (Note 2)
 TSA                   X              X            X              X
+VMSCAPE                                           X
 =============== ============== ============ ============= ============== ============ ========
 
 Notes:

diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
index 36dcfc5105be9acb6d67a0481949ff03874d5f5d..e817bbae01591b73d7868ccf56cd459c436654f4 100644 (file)
--- a/arch/x86/kernel/cpu/bugs.c
+++ b/arch/x86/kernel/cpu/bugs.c
@@ -434,6 +434,9 @@ static bool __init should_mitigate_vuln(unsigned int bug)
        case X86_BUG_SPEC_STORE_BYPASS:
                return cpu_attack_vector_mitigated(CPU_MITIGATE_USER_USER);
 
+       case X86_BUG_VMSCAPE:
+               return cpu_attack_vector_mitigated(CPU_MITIGATE_GUEST_HOST);
+
        default:
                WARN(1, "Unknown bug %x\n", bug);
                return false;
@@ -3304,15 +3307,18 @@ early_param("vmscape", vmscape_parse_cmdline);
 
 static void __init vmscape_select_mitigation(void)
 {
-       if (cpu_mitigations_off() ||
-           !boot_cpu_has_bug(X86_BUG_VMSCAPE) ||
+       if (!boot_cpu_has_bug(X86_BUG_VMSCAPE) ||
            !boot_cpu_has(X86_FEATURE_IBPB)) {
                vmscape_mitigation = VMSCAPE_MITIGATION_NONE;
                return;
        }
 
-       if (vmscape_mitigation == VMSCAPE_MITIGATION_AUTO)
-               vmscape_mitigation = VMSCAPE_MITIGATION_IBPB_EXIT_TO_USER;
+       if (vmscape_mitigation == VMSCAPE_MITIGATION_AUTO) {
+               if (should_mitigate_vuln(X86_BUG_VMSCAPE))
+                       vmscape_mitigation = VMSCAPE_MITIGATION_IBPB_EXIT_TO_USER;
+               else
+                       vmscape_mitigation = VMSCAPE_MITIGATION_NONE;
+       }
 }
 
 static void __init vmscape_update_mitigation(void)