linux-kernel - Re: [PATCH 2/2] x86/vmscape: Replace IBPB with branch history clear on exit to userspace

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20250926161459.gdcdag4gr6imeyfk@desk>
Date: Fri, 26 Sep 2025 09:14:59 -0700
From: Pawan Gupta <pawan.kumar.gupta@...ux.intel.com>
To: "Kaplan, David" <David.Kaplan@....com>
Cc: "x86@...nel.org" <x86@...nel.org>, "H. Peter Anvin" <hpa@...or.com>,
	Josh Poimboeuf <jpoimboe@...nel.org>,
	Sean Christopherson <seanjc@...gle.com>,
	Paolo Bonzini <pbonzini@...hat.com>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
	"kvm@...r.kernel.org" <kvm@...r.kernel.org>,
	Asit Mallick <asit.k.mallick@...el.com>,
	Tao Zhang <tao1.zhang@...el.com>
Subject: Re: [PATCH 2/2] x86/vmscape: Replace IBPB with branch history clear
 on exit to userspace

On Fri, Sep 26, 2025 at 01:39:37PM +0000, Kaplan, David wrote:
> > > > --- a/Documentation/admin-guide/kernel-parameters.txt
> > > > +++ b/Documentation/admin-guide/kernel-parameters.txt
> > > > @@ -8048,9 +8048,11 @@
> > > >
> > > >                         off             - disable the mitigation
> > > >                         ibpb            - use Indirect Branch Prediction Barrier
> > > > -                                         (IBPB) mitigation (default)
> > > > +                                         (IBPB) mitigation
> > > >                         force           - force vulnerability detection even on
> > > >                                           unaffected processors
> > > > +                       auto            - (default) automatically select IBPB
> > > > +                                         or BHB clear mitigation based on CPU
> > >
> > > Many of the other bugs (like srso, l1tf, bhi, etc.) do not have explicit
> > > 'auto' options as 'auto' is implied by the lack of an explicit option.
> > > Is there really value in creating an explicit 'auto' option here?
> >
> > Hmm, so to get the BHB clear mitigation do we advise the users to remove
> > the vmscape= parameter? That feels a bit weird to me. Also, with
> > CONFIG_MITIGATION_VMSCAPE=n a user can get IBPB mitigation with
> > vmscape=ibpb, but there is no way to get the BHB clear mitigation.
> >
> 
> Maybe a better solution instead is to add a new option 'vmscape=on'.
> 
> If we look at the other most recently added bugs like TSA and ITS,
> neither have an explicit 'auto' cmdline option.  But they do have 'on'
> cmdline options.
> 
> The difference between 'auto' and 'on' is that 'auto' defers to the
> attack vector controls while 'on' means 'enable this mitigation if the
> CPU is vulnerable' (as opposed to 'force' which will enable it even if
> not vulnerable).
> 
> An explicit 'vmscape=on' could give users an option to ensure the
> mitigation is used (regardless of attack vectors) and could choose the
> best mitigation (BHB clear if available, otherwise IBPB).
> 
> I'd still advise users to not specify any option here unless they know
> what they're doing.  But an 'on' option would arguably be more consistent
> with the other recent bugs and maybe meets the needs you're after?

Sounds good to me. I'll update the patch.