From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mgamail.intel.com (mgamail.intel.com [198.175.65.14]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 281AA3E1D0C; Thu, 19 Mar 2026 15:42:17 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=198.175.65.14 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1773934939; cv=none; b=nU9gGFt5+OuZU+/83E6ZBa/Az+gNNfqpAkbvL06CVOFD/mBWU7MY6JynLJeCowpaIwOV3UkDeEe8zM3ZWbath/55a6VgaQG9CkYMjz5Il8RfYXXGJzaCO0a7R0Wy1H6Qx38SNx3cfSImqpSIeAru3p8+dObbJdUvTyQsFX5b86c= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1773934939; c=relaxed/simple; bh=BFZLIPx0Jd361rgKkA2osKNdEiIw0VSF8Insthm0G6Q=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=lH0C5c0UToakh8sCCbf2WWjs0llMIxuqO4rJcvRH4F5eIz6U1IYKxXY/OGLKqFpFIMQa1xI/i8rjoTrqZOaYrx6ohf4Lo286gu8djZKojpk0LMVM/ADMkQgLEkdgHBM6V353yKq2i4Hs5K9UJeaEVpnU2YSRrh7wIEOguA6E3XM= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.intel.com; spf=pass smtp.mailfrom=linux.intel.com; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b=n2rNFwX2; arc=none smtp.client-ip=198.175.65.14 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.intel.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.intel.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b="n2rNFwX2" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1773934938; x=1805470938; h=date:from:to:cc:subject:message-id:references: mime-version:in-reply-to; bh=BFZLIPx0Jd361rgKkA2osKNdEiIw0VSF8Insthm0G6Q=; b=n2rNFwX20TP10iV3Xqhg74UiS6DsNA5X6p4L7OVYf5OI7LSKccSW8RVz roBNrTgXXelR9G3spZAQ+x4fjya1zAU6rOPzz0l37PgtTCGd4Qh1DKqyh hHEOUzjacDQczQGofSS8911/7Wrp/lSfujRYBvJJHvAbJR9am8BIDsOdS U5zOMtnnofzDocKmJWf49ZnMn5Dg14/zdK7JbpvERuXKMJ5Hze/AaLt0f cUtatnu8CjIbhNxdFcWXhHj/7tRmoyFzCSa75LaDrDFFGzAuRt+4ojarC ET/WG55cD/ylOeBxgDnO1//N6h+UBDBXALLzgp1HhAbl+SplHTYt2cjOq A==; X-CSE-ConnectionGUID: cZncScRETDCKakItJRe5Dw== X-CSE-MsgGUID: lEa4pNmvQnaE+xfCByTapA== X-IronPort-AV: E=McAfee;i="6800,10657,11734"; a="78869219" X-IronPort-AV: E=Sophos;i="6.23,129,1770624000"; d="scan'208";a="78869219" Received: from fmviesa003.fm.intel.com ([10.60.135.143]) by orvoesa106.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 19 Mar 2026 08:42:18 -0700 X-CSE-ConnectionGUID: jUjK6BZsT6GHKRiGe9pKqA== X-CSE-MsgGUID: zgGOfyRmRb2hm5pUU5Wgog== X-ExtLoop1: 1 Received: from guptapa-desk.jf.intel.com (HELO desk) ([10.165.239.46]) by fmviesa003-auth.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 19 Mar 2026 08:42:15 -0700 Date: Thu, 19 Mar 2026 08:42:09 -0700 From: Pawan Gupta To: x86@kernel.org, Nikolay Borisov , "H. Peter Anvin" , Josh Poimboeuf , David Kaplan , Sean Christopherson , Borislav Petkov , Dave Hansen , Peter Zijlstra , Alexei Starovoitov , Daniel Borkmann , Andrii Nakryiko , KP Singh , Jiri Olsa , "David S. Miller" , David Laight , Andy Lutomirski , Thomas Gleixner , Ingo Molnar , David Ahern , Martin KaFai Lau , Eduard Zingerman , Song Liu , Yonghong Song , John Fastabend , Stanislav Fomichev , Hao Luo , Paolo Bonzini , Jonathan Corbet Cc: linux-kernel@vger.kernel.org, kvm@vger.kernel.org, Asit Mallick , Tao Zhang , bpf@vger.kernel.org, netdev@vger.kernel.org, linux-doc@vger.kernel.org Subject: [PATCH v7 08/10] x86/vmscape: Deploy BHB clearing mitigation Message-ID: <20260319-vmscape-bhb-v7-8-b76a777a98af@linux.intel.com> X-Mailer: b4 0.15-dev References: <20260319-vmscape-bhb-v7-0-b76a777a98af@linux.intel.com> Precedence: bulk X-Mailing-List: netdev@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20260319-vmscape-bhb-v7-0-b76a777a98af@linux.intel.com> IBPB mitigation for VMSCAPE is an overkill on CPUs that are only affected by the BHI variant of VMSCAPE. On such CPUs, eIBRS already provides indirect branch isolation between guest and host userspace. However, branch history from guest may also influence the indirect branches in host userspace. To mitigate the BHI aspect, use the BHB clearing sequence. Reviewed-by: Nikolay Borisov Signed-off-by: Pawan Gupta --- Documentation/admin-guide/hw-vuln/vmscape.rst | 4 ++++ arch/x86/include/asm/nospec-branch.h | 2 ++ arch/x86/kernel/cpu/bugs.c | 28 ++++++++++++++++++++------- 3 files changed, 27 insertions(+), 7 deletions(-) diff --git a/Documentation/admin-guide/hw-vuln/vmscape.rst b/Documentation/admin-guide/hw-vuln/vmscape.rst index d9b9a2b6c114..dc63a0bac03d 100644 --- a/Documentation/admin-guide/hw-vuln/vmscape.rst +++ b/Documentation/admin-guide/hw-vuln/vmscape.rst @@ -86,6 +86,10 @@ The possible values in this file are: run a potentially malicious guest and issues an IBPB before the first exit to userspace after VM-exit. + * 'Mitigation: Clear BHB before exit to userspace': + + As above, conditional BHB clearing mitigation is enabled. + * 'Mitigation: IBPB on VMEXIT': IBPB is issued on every VM-exit. This occurs when other mitigations like diff --git a/arch/x86/include/asm/nospec-branch.h b/arch/x86/include/asm/nospec-branch.h index e45e49f1e0c9..7be812a73326 100644 --- a/arch/x86/include/asm/nospec-branch.h +++ b/arch/x86/include/asm/nospec-branch.h @@ -390,6 +390,8 @@ extern void write_ibpb(void); #ifdef CONFIG_X86_64 extern void clear_bhb_loop_nofence(void); +#else +static inline void clear_bhb_loop_nofence(void) {} #endif extern void (*x86_return_thunk)(void); diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c index b75eda114503..444b41302533 100644 --- a/arch/x86/kernel/cpu/bugs.c +++ b/arch/x86/kernel/cpu/bugs.c @@ -61,9 +61,8 @@ DEFINE_PER_CPU(u64, x86_spec_ctrl_current); EXPORT_PER_CPU_SYMBOL_GPL(x86_spec_ctrl_current); /* - * Set when the CPU has run a potentially malicious guest. An IBPB will - * be needed to before running userspace. That IBPB will flush the branch - * predictor content. + * Set when the CPU has run a potentially malicious guest. Indicates that a + * branch predictor flush is needed before running userspace. */ DEFINE_PER_CPU(bool, x86_predictor_flush_exit_to_user); EXPORT_PER_CPU_SYMBOL_GPL(x86_predictor_flush_exit_to_user); @@ -3061,13 +3060,15 @@ enum vmscape_mitigations { VMSCAPE_MITIGATION_AUTO, VMSCAPE_MITIGATION_IBPB_EXIT_TO_USER, VMSCAPE_MITIGATION_IBPB_ON_VMEXIT, + VMSCAPE_MITIGATION_BHB_CLEAR_EXIT_TO_USER, }; static const char * const vmscape_strings[] = { - [VMSCAPE_MITIGATION_NONE] = "Vulnerable", + [VMSCAPE_MITIGATION_NONE] = "Vulnerable", /* [VMSCAPE_MITIGATION_AUTO] */ - [VMSCAPE_MITIGATION_IBPB_EXIT_TO_USER] = "Mitigation: IBPB before exit to userspace", - [VMSCAPE_MITIGATION_IBPB_ON_VMEXIT] = "Mitigation: IBPB on VMEXIT", + [VMSCAPE_MITIGATION_IBPB_EXIT_TO_USER] = "Mitigation: IBPB before exit to userspace", + [VMSCAPE_MITIGATION_IBPB_ON_VMEXIT] = "Mitigation: IBPB on VMEXIT", + [VMSCAPE_MITIGATION_BHB_CLEAR_EXIT_TO_USER] = "Mitigation: Clear BHB before exit to userspace", }; static enum vmscape_mitigations vmscape_mitigation __ro_after_init = @@ -3114,7 +3115,17 @@ static void __init vmscape_select_mitigation(void) break; case VMSCAPE_MITIGATION_AUTO: - if (boot_cpu_has(X86_FEATURE_IBPB)) + /* + * CPUs with BHI_CTRL(ADL and newer) can avoid the IBPB and use + * BHB clear sequence. These CPUs are only vulnerable to the BHI + * variant of the VMSCAPE attack, and thus they do not require a + * full predictor flush. + * + * Note, in 32-bit mode BHB clear sequence is not supported. + */ + if (boot_cpu_has(X86_FEATURE_BHI_CTRL) && IS_ENABLED(CONFIG_X86_64)) + vmscape_mitigation = VMSCAPE_MITIGATION_BHB_CLEAR_EXIT_TO_USER; + else if (boot_cpu_has(X86_FEATURE_IBPB)) vmscape_mitigation = VMSCAPE_MITIGATION_IBPB_EXIT_TO_USER; else vmscape_mitigation = VMSCAPE_MITIGATION_NONE; @@ -3141,6 +3152,8 @@ static void __init vmscape_apply_mitigation(void) { if (vmscape_mitigation == VMSCAPE_MITIGATION_IBPB_EXIT_TO_USER) static_call_update(vmscape_predictor_flush, write_ibpb); + else if (vmscape_mitigation == VMSCAPE_MITIGATION_BHB_CLEAR_EXIT_TO_USER) + static_call_update(vmscape_predictor_flush, clear_bhb_loop_nofence); } #undef pr_fmt @@ -3232,6 +3245,7 @@ void cpu_bugs_smt_update(void) break; case VMSCAPE_MITIGATION_IBPB_ON_VMEXIT: case VMSCAPE_MITIGATION_IBPB_EXIT_TO_USER: + case VMSCAPE_MITIGATION_BHB_CLEAR_EXIT_TO_USER: /* * Hypervisors can be attacked across-threads, warn for SMT when * STIBP is not already enabled system-wide. -- 2.34.1