[PATCH] x86/bugs: Keep BHI mitigation when only user->kernel is mitigated

[PATCH] x86/bugs: Keep BHI mitigation when only user->kernel is mitigated

[Breno Leitao]

The BHI mitigation selection is inconsistent with the documentation
(attack_vector_controls.rst), which lists BHI under both the
user->kernel and guest->host attack vectors. bhi_select_mitigation()
only enables it when CPU_MITIGATE_GUEST_HOST is set; otherwise it
selects BHI_MITIGATION_OFF, even if CPU_MITIGATE_USER_KERNEL is set.

As a result, a kernel compiled with KVM disabled gets BHI automatically
disabled, since CPU_MITIGATE_GUEST_HOST defaults to off without KVM.
This is a bug, given that CPU_MITIGATE_USER_KERNEL still needs it: on
affected Intel CPUs these kernels lose BHI_DIS_S or the BHB clearing
loop by default. Booting with mitigations=auto,no_guest_host has the
same effect.

Select BHI_MITIGATION_ON whenever user->kernel is mitigated, and keep
BHI_MITIGATION_VMEXIT_ONLY for the guest->host-only case.

Fixes: ddcd4d3cb37c ("x86/bugs: Add attack vector controls for BHI")
Cc: David Kaplan <david.kaplan@amd.com>
Signed-off-by: Breno Leitao <leitao@debian.org>
---
 arch/x86/kernel/cpu/bugs.c | 12 +++++-------
 1 file changed, 5 insertions(+), 7 deletions(-)

diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
index 000ebee2d247b1..4ced10c6ba0db9 100644
--- a/arch/x86/kernel/cpu/bugs.c
+++ b/arch/x86/kernel/cpu/bugs.c
@@ -2088,14 +2088,12 @@ static void __init bhi_select_mitigation(void)
 	if (bhi_mitigation != BHI_MITIGATION_AUTO)
 		return;
 
-	if (cpu_attack_vector_mitigated(CPU_MITIGATE_GUEST_HOST)) {
-		if (cpu_attack_vector_mitigated(CPU_MITIGATE_USER_KERNEL))
-			bhi_mitigation = BHI_MITIGATION_ON;
-		else
-			bhi_mitigation = BHI_MITIGATION_VMEXIT_ONLY;
-	} else {
+	if (cpu_attack_vector_mitigated(CPU_MITIGATE_USER_KERNEL))
+		bhi_mitigation = BHI_MITIGATION_ON;
+	else if (cpu_attack_vector_mitigated(CPU_MITIGATE_GUEST_HOST))
+		bhi_mitigation = BHI_MITIGATION_VMEXIT_ONLY;
+	else
 		bhi_mitigation = BHI_MITIGATION_OFF;
-	}
 }
 
 static void __init bhi_update_mitigation(void)

---
base-commit: 6d0933ae9d46674a6ea63a87e9e9ab4e662670c9
change-id: 20261029-bhi-attack-vector-c36ea6854904

Best regards,
--  
Breno Leitao <leitao@debian.org>

RE: [PATCH] x86/bugs: Keep BHI mitigation when only user->kernel is mitigated

[Kaplan, David]

AMD General

> -----Original Message-----
> From: Breno Leitao <leitao@debian.org>
> Sent: Thursday, October 29, 2026 9:45 AM
> To: Thomas Gleixner <tglx@kernel.org>; Borislav Petkov <bp@alien8.de>; Peter
> Zijlstra <peterz@infradead.org>; Josh Poimboeuf <jpoimboe@kernel.org>;
> Pawan Gupta <pawan.kumar.gupta@linux.intel.com>; Ingo Molnar
> <mingo@redhat.com>; Dave Hansen <dave.hansen@linux.intel.com>;
> x86@kernel.org; H. Peter Anvin <hpa@zytor.com>; Kaplan, David
> <David.Kaplan@amd.com>
> Cc: linux-kernel@vger.kernel.org; kernel-team@meta.com; Breno Leitao
> <leitao@debian.org>
> Subject: [PATCH] x86/bugs: Keep BHI mitigation when only user->kernel is
> mitigated
>
> [You don't often get email from leitao@debian.org. Learn why this is
> important at https://aka.ms/LearnAboutSenderIdentification ]
>
> Caution: This message originated from an External Source. Use proper caution
> when opening attachments, clicking links, or responding.
>
>
> The BHI mitigation selection is inconsistent with the documentation
> (attack_vector_controls.rst), which lists BHI under both the
> user->kernel and guest->host attack vectors. bhi_select_mitigation()
> only enables it when CPU_MITIGATE_GUEST_HOST is set; otherwise it
> selects BHI_MITIGATION_OFF, even if CPU_MITIGATE_USER_KERNEL is set.
>
> As a result, a kernel compiled with KVM disabled gets BHI automatically
> disabled, since CPU_MITIGATE_GUEST_HOST defaults to off without KVM.
> This is a bug, given that CPU_MITIGATE_USER_KERNEL still needs it: on
> affected Intel CPUs these kernels lose BHI_DIS_S or the BHB clearing
> loop by default. Booting with mitigations=auto,no_guest_host has the
> same effect.
>
> Select BHI_MITIGATION_ON whenever user->kernel is mitigated, and keep
> BHI_MITIGATION_VMEXIT_ONLY for the guest->host-only case.
>
> Fixes: ddcd4d3cb37c ("x86/bugs: Add attack vector controls for BHI")
> Cc: David Kaplan <david.kaplan@amd.com>
> Signed-off-by: Breno Leitao <leitao@debian.org>
> ---
>  arch/x86/kernel/cpu/bugs.c | 12 +++++-------
>  1 file changed, 5 insertions(+), 7 deletions(-)
>
> diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
> index 000ebee2d247b1..4ced10c6ba0db9 100644
> --- a/arch/x86/kernel/cpu/bugs.c
> +++ b/arch/x86/kernel/cpu/bugs.c
> @@ -2088,14 +2088,12 @@ static void __init bhi_select_mitigation(void)
>         if (bhi_mitigation != BHI_MITIGATION_AUTO)
>                 return;
>
> -       if (cpu_attack_vector_mitigated(CPU_MITIGATE_GUEST_HOST)) {
> -               if (cpu_attack_vector_mitigated(CPU_MITIGATE_USER_KERNEL))
> -                       bhi_mitigation = BHI_MITIGATION_ON;
> -               else
> -                       bhi_mitigation = BHI_MITIGATION_VMEXIT_ONLY;
> -       } else {
> +       if (cpu_attack_vector_mitigated(CPU_MITIGATE_USER_KERNEL))
> +               bhi_mitigation = BHI_MITIGATION_ON;
> +       else if (cpu_attack_vector_mitigated(CPU_MITIGATE_GUEST_HOST))
> +               bhi_mitigation = BHI_MITIGATION_VMEXIT_ONLY;
> +       else
>                 bhi_mitigation = BHI_MITIGATION_OFF;
> -       }
>  }
>
>  static void __init bhi_update_mitigation(void)
>
> ---
> base-commit: 6d0933ae9d46674a6ea63a87e9e9ab4e662670c9
> change-id: 20261029-bhi-attack-vector-c36ea6854904
>
> Best regards,
> --
> Breno Leitao <leitao@debian.org>

Acked-by: David Kaplan <david.kaplan@amd.com>

Looks like I had done this correctly up through v5 of my attack vector series but the final version messed it up when I tried to simplify it.  Fix looks good to me.

--David Kaplan