Commit 8b3641df authored by David Kaplan's avatar David Kaplan Committed by Borislav Petkov (AMD)
Browse files

x86/bugs: Add attack vector controls for SSB 



Attack vector controls for SSB were missed in the initial attack vector series.
The default mitigation for SSB requires user-space opt-in so it is only
relevant for user->user attacks.  Check with attack vector controls when
the command is auto - i.e., no explicit user selection has been done.

Fixes: 2d31d287 ("x86/bugs: Define attack vectors relevant for each bug")
Signed-off-by: default avatarDavid Kaplan <david.kaplan@amd.com>
Signed-off-by: default avatarBorislav Petkov (AMD) <bp@alien8.de>
Link: https://lore.kernel.org/20250819192200.2003074-5-david.kaplan@amd.com
parent c2415c40

Documentation/admin-guide/hw-vuln/attack_vector_controls.rst

+1 −4
Original line number Diff line number Diff line
@@ -215,7 +215,7 @@ Spectre_v2 X X 
Spectre_v2_user                      X                           X            *       (Note 1)

SRBDS                 X              X            X              X

SRSO                  X              X            X              X

SSB                                                                                   (Note 4)

SSB                                  X

TAA                   X              X            X              X            *       (Note 2)

TSA                   X              X            X              X

=============== ============== ============ ============= ============== ============ ========
@@ -229,9 +229,6 @@ Notes: 
   3 --  Disables SMT if cross-thread mitigations are fully enabled, the CPU is

   vulnerable, and STIBP is not supported



   4 --  Speculative store bypass is always enabled by default (no kernel

   mitigation applied) unless overridden with spec_store_bypass_disable option



When an attack-vector is disabled, all mitigations for the vulnerabilities

listed in the above table are disabled, unless mitigation is required for a

different enabled attack-vector or a mitigation is explicitly selected via a

arch/x86/kernel/cpu/bugs.c

+9 −0
Original line number Diff line number Diff line
@@ -416,6 +416,10 @@ static bool __init should_mitigate_vuln(unsigned int bug) 
		       cpu_attack_vector_mitigated(CPU_MITIGATE_USER_USER) ||

		       cpu_attack_vector_mitigated(CPU_MITIGATE_GUEST_GUEST) ||

		       (smt_mitigations != SMT_MITIGATIONS_OFF);



	case X86_BUG_SPEC_STORE_BYPASS:

		return cpu_attack_vector_mitigated(CPU_MITIGATE_USER_USER);



	default:

		WARN(1, "Unknown bug %x\n", bug);

		return false;
@@ -2710,6 +2714,11 @@ static void __init ssb_select_mitigation(void) 
		ssb_mode = SPEC_STORE_BYPASS_DISABLE;

		break;

	case SPEC_STORE_BYPASS_CMD_AUTO:

		if (should_mitigate_vuln(X86_BUG_SPEC_STORE_BYPASS))

			ssb_mode = SPEC_STORE_BYPASS_PRCTL;

		else

			ssb_mode = SPEC_STORE_BYPASS_NONE;

		break;

	case SPEC_STORE_BYPASS_CMD_PRCTL:

		ssb_mode = SPEC_STORE_BYPASS_PRCTL;

		break;