From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-ed1-f51.google.com (mail-ed1-f51.google.com [209.85.208.51]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4F0422F0C78 for ; Wed, 19 Nov 2025 10:33:11 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.208.51 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1763548393; cv=none; b=APhlS4oCF1GPDH0GYZau2e0/nd5kdXgzjbxfXw1QFPOez+tz64RN8AA5ldG15W/nkfAOXHFxII+z6Fe6xmpNcZmhQEZVQscjDP6Y0PJB957oirldo8upQmJ7VMJi8B28ffwzm7YbqC8B85rY9GLT8PsmW3+4cYMz7pO3oYxacq4= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1763548393; c=relaxed/simple; bh=KYLRHghd1Ft3FmD8U8yM89qqJxbzVYC92BGjSGnyaOI=; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From: In-Reply-To:Content-Type; b=iL6dlKb6kfF3sM0fG4ykWHOmkeYJu13oe6GH8K75FxdCgXrObmCimcCsDsCdkOaFwaKRstPjJvzOw5Jub2e35XCIk6X1wnTrsf449SWEE+aidO8elwAr1OPWK845Qw/3nu7e1Cj/BbxIZj/XsxHAkJjM8Z/1nQSH1YbiicantTU= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=suse.com; spf=pass smtp.mailfrom=suse.com; dkim=pass (2048-bit key) header.d=suse.com header.i=@suse.com header.b=AFZy2o0L; arc=none smtp.client-ip=209.85.208.51 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=suse.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=suse.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=suse.com header.i=@suse.com header.b="AFZy2o0L" Received: by mail-ed1-f51.google.com with SMTP id 4fb4d7f45d1cf-64180bd67b7so8921413a12.0 for ; Wed, 19 Nov 2025 02:33:10 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=suse.com; s=google; t=1763548389; x=1764153189; darn=vger.kernel.org; h=content-transfer-encoding:in-reply-to:autocrypt:content-language :from:references:cc:to:subject:user-agent:mime-version:date :message-id:from:to:cc:subject:date:message-id:reply-to; bh=B0YdXtRcS8os3PJL3hVj9G4DxbppYK6sYzqe/7yQaRo=; b=AFZy2o0Lk5x7yvds5S4VM9GwPr1kjf63JcX/XH4JoEAGEuUHHHFenp0aKOzICSuFLU txlvFw9dO7efPc/tpVHP9q67clHW3FjQ5rSsWiXv4LVsu0xqYLzTt/IicY4fCgQep6K5 MbFbZrUNTXpSCZaqcbO5HZ8HA3p219Z2/0YlUq3uoEh1yj5GqNM2IoT6Px+y+4PXPbJA DpQ/k+Vk2jEZcvUT4F118nTa3efHA4BDSRQr3d8iWOe4x2cv3Cv7A9Ts6H9hg7NeBofi rFKAQBOAJQ528JakFRLlM8TxtxlgOiMHT8pD7TST4IoVkd3WBGPGefg1hXh9Ry9hDvYl 0SiA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1763548389; x=1764153189; h=content-transfer-encoding:in-reply-to:autocrypt:content-language :from:references:cc:to:subject:user-agent:mime-version:date :message-id:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=B0YdXtRcS8os3PJL3hVj9G4DxbppYK6sYzqe/7yQaRo=; b=FmBCbXvlAefzacLDAQk0f9rmDcFJRlwB+h72xZaSLNj5PH6NuuFDeF2J583lGsbfov sMP158GzBGRol59Y5ntun3zOgFB/XOlWsjsVZbFB/YOJnWFyBo0NFqLxwgjscZBBQ1Ce 7clM9wHaZtCiFzzJtTIFqKryr+OoZqYKkBBrsppZ3OBKzfCjnVdFFaiJj0Y1KLwinbHO 0bPFQTKFkr+ANbUUqqPgd4VmkQAhP/ak9OLKa6EhXTon1kiH7zlY6l36wsmVNlTxh4Tf l/OdCoh6aEXpEMTeQ0V/uHtUw+K+13MecE9DZIEH/9JV/FSpKIPlwyBDYPbWJAytTo4T mg7w== X-Forwarded-Encrypted: i=1; AJvYcCVPmbKiOOZXIQWcsAO20d5PnXT7BFnA2HTIuT9BYAE3YJgCxTZ++w2/NpgkIEby/61pREv232Uq8FcsqXE=@vger.kernel.org X-Gm-Message-State: AOJu0YzSh7D5InFN9vdlJF2TiV+p4Q+YtUBXLqdxPXd2vJK5Li1y2GxS kJV5EWPaTGDMX/vJPuH0f42MMiXEcblMKvnIHI2dkOpjb2yzxUdJCFURfmTBbYBbx8M= X-Gm-Gg: ASbGncvSED0zg91lzgpxmd0As2yJ29LsKGbTx2oYiUo5+ASafzVKlMN5AyMOdbEjEMd jc7x3qoPAxwUcOc3PiT40tQ5vdHuq1qOgxiBDVrEXNKwuIwY70ckZnmm+WRWqwA4g+s4uddqo8N vLO+mpn63K0DQ1zFJT54bXFARV3p/rEO9UolVKfg0h7WhpMbvfU9CcLOE4uRhRyKZTOASfy6m3K CNdfG+YdQrhUGfCLiCyX3XP0bsF0eDX68ZUux1JXmH/K2MYhifsuUc2xtM11e2NU1sjddrdiQf2 mlu5Pfr+JOw/MOdzbyIeoNBL19+CT8PEdrVcqm/IlAG3nvOZsictYVshra1i3BUmFq9LZ1QGe4s vcscVTC0wT16MswRQzlQF9gAjL0KlWRRjA18PvstvSPn58U4Fq//KjGcR0pxGXTzZxTzidvzFwQ HGnYwzesc99DN9OGG11WzEtjzvO6Rhf2ymGxNSXzZbTCju/kQ= X-Google-Smtp-Source: AGHT+IHZOSQ73VV5I/Rb482rwGQgTOMYTFla03maKxSXUiAVVdb6oiAo9BjkAhQbR7/07nMvHenlUg== X-Received: by 2002:a17:906:b357:b0:b73:780d:2bcf with SMTP id a640c23a62f3a-b73780d2d63mr1326634266b.16.1763548389512; Wed, 19 Nov 2025 02:33:09 -0800 (PST) Received: from [192.168.0.20] (nborisov.ddns.nbis.net. [85.187.216.236]) by smtp.gmail.com with ESMTPSA id a640c23a62f3a-b734fedb2eesm1577294066b.68.2025.11.19.02.33.06 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Wed, 19 Nov 2025 02:33:08 -0800 (PST) Message-ID: <6a7ad323-657d-4cda-83e2-58492394f44c@suse.com> Date: Wed, 19 Nov 2025 12:33:05 +0200 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH v3 2/3] x86/vmscape: Replace IBPB with branch history clear on exit to userspace To: Pawan Gupta , Dave Hansen Cc: x86@kernel.org, "H. Peter Anvin" , Josh Poimboeuf , David Kaplan , Sean Christopherson , Paolo Bonzini , Borislav Petkov , Dave Hansen , linux-kernel@vger.kernel.org, kvm@vger.kernel.org, Asit Mallick , Tao Zhang References: <20251027-vmscape-bhb-v3-0-5793c2534e93@linux.intel.com> <20251027-vmscape-bhb-v3-2-5793c2534e93@linux.intel.com> <20251106234055.ftahbvqxrfzjwr6t@desk> From: Nikolay Borisov Content-Language: en-US Autocrypt: addr=nik.borisov@suse.com; keydata= xsFNBGcrpvIBEAD5cAR5+qu30GnmPrK9veWX5RVzzbgtkk9C/EESHy9Yz0+HWgCVRoNyRQsZ 7DW7vE1KhioDLXjDmeu8/0A8u5nFMqv6d1Gt1lb7XzSAYw7uSWXLPEjFBtz9+fBJJLgbYU7G OpTKy6gRr6GaItZze+r04PGWjeyVUuHZuncTO7B2huxcwIk9tFtRX21gVSOOC96HcxSVVA7X N/LLM2EOL7kg4/yDWEhAdLQDChswhmdpHkp5g6ytj9TM8bNlq9I41hl/3cBEeAkxtb/eS5YR 88LBb/2FkcGnhxkGJPNB+4Siku7K8Mk2Y6elnkOctJcDvk29DajYbQnnW4nhfelZuLNupb1O M0912EvzOVI0dIVgR+xtosp66bYTOpX4Xb0fylED9kYGiuEAeoQZaDQ2eICDcHPiaLzh+6cc pkVTB0sXkWHUsPamtPum6/PgWLE9vGI5s+FaqBaqBYDKyvtJfLK4BdZng0Uc3ijycPs3bpbQ bOnK9LD8TYmYaeTenoNILQ7Ut54CCEXkP446skUMKrEo/HabvkykyWqWiIE/UlAYAx9+Ckho TT1d2QsmsAiYYWwjU8igXBecIbC0uRtF/cTfelNGrQwbICUT6kJjcOTpQDaVyIgRSlUMrlNZ XPVEQ6Zq3/aENA8ObhFxE5PLJPizJH6SC89BMKF3zg6SKx0qzQARAQABzSZOaWtvbGF5IEJv cmlzb3YgPG5pay5ib3Jpc292QHN1c2UuY29tPsLBkQQTAQoAOxYhBDuWB8EJLBUZCPjT3SRn XZEnyhfsBQJnK6byAhsDBQsJCAcCAiICBhUKCQgLAgQWAgMBAh4HAheAAAoJECRnXZEnyhfs XbIQAJxuUnelGdXbSbtovBNm+HF3LtT0XnZ0+DoR0DemUGuA1bZAlaOXGr5mvVbTgaoGUQIJ 3Ejx3UBEG7ZSJcfJobB34w1qHEDO0pN9orGIFT9Bic3lqhawD2r85QMcWwjsZH5FhyRx7P2o DTuUClLMO95GuHYQngBF2rHHl8QMJPVKsR18w4IWAhALpEApxa3luyV7pAAqKllfCNt7tmed uKmclf/Sz6qoP75CvEtRbfAOqYgG1Uk9A62C51iAPe35neMre3WGLsdgyMj4/15jPYi+tOUX Tc7AAWgc95LXyPJo8069MOU73htZmgH4OYy+S7f+ArXD7h8lTLT1niff2bCPi6eiAQq6b5CJ Ka4/27IiZo8tm1XjLYmoBmaCovqx5y5Xt2koibIWG3ZGD2I+qRwZ0UohKRH6kKVHGcrmCv0J YO8yIprxgoYmA7gq21BpTqw3D4+8xujn/6LgndLKmGESM1FuY3ymXgj5983eqaxicKpT9iq8 /a1j31tms4azR7+6Dt8H4SagfN6VbJ0luPzobrrNFxUgpjR4ZyQQ++G7oSRdwjfIh1wuCF6/ mDUNcb6/kA0JS9otiC3omfht47yQnvod+MxFk1lTNUu3hePJUwg1vT1te3vO5oln8lkUo9BU knlYpQ7QA2rDEKs+YWqUstr4pDtHzwQ6mo0rqP+zzsFNBGcrpvIBEADGYTFkNVttZkt6e7yA LNkv3Q39zQCt8qe7qkPdlj3CqygVXfw+h7GlcT9fuc4kd7YxFys4/Wd9icj9ZatGMwffONmi LnUotIq2N7+xvc4Xu76wv+QJpiuGEfCDB+VdZOmOzUPlmMkcJc/EDSH4qGogIYRu72uweKEq VfBI43PZIGpGJ7TjS3THX5WVI2YNSmuwqxnQF/iVqDtD2N72ObkBwIf9GnrOgxEyJ/SQq2R0 g7hd6IYk7SOKt1a8ZGCN6hXXKzmM6gHRC8fyWeTqJcK4BKSdX8PzEuYmAJjSfx4w6DoxdK5/ 9sVrNzaVgDHS0ThH/5kNkZ65KNR7K2nk45LT5Crjbg7w5/kKDY6/XiXDx7v/BOR/a+Ryo+lM MffN3XSnAex8cmIhNINl5Z8CAvDLUtItLcbDOv7hdXt6DSyb65CdyY8JwOt6CWno1tdjyDEG 5ANwVPYY878IFkOJLRTJuUd5ltybaSWjKIwjYJfIXuoyzE7OL63856MC/Os8PcLfY7vYY2LB cvKH1qOcs+an86DWX17+dkcKD/YLrpzwvRMur5+kTgVfXcC0TAl39N4YtaCKM/3ugAaVS1Mw MrbyGnGqVMqlCpjnpYREzapSk8XxbO2kYRsZQd8J9ei98OSqgPf8xM7NCULd/xaZLJUydql1 JdSREId2C15jut21aQARAQABwsF2BBgBCgAgFiEEO5YHwQksFRkI+NPdJGddkSfKF+wFAmcr pvICGwwACgkQJGddkSfKF+xuuxAA4F9iQc61wvAOAidktv4Rztn4QKy8TAyGN3M8zYf/A5Zx VcGgX4J4MhRUoPQNrzmVlrrtE2KILHxQZx5eQyPgixPXri42oG5ePEXZoLU5GFRYSPjjTYmP ypyTPN7uoWLfw4TxJqWCGRLsjnkwvyN3R4161Dty4Uhzqp1IkNhl3ifTDYEvbnmHaNvlvvna 7+9jjEBDEFYDMuO/CA8UtoVQXjy5gtOhZZkEsptfwQYc+E9U99yxGofDul7xH41VdXGpIhUj 4wjd3IbgaCiHxxj/M9eM99ybu5asvHyMo3EFPkyWxZsBlUN/riFXGspG4sT0cwOUhG2ZnExv XXhOGKs/y3VGhjZeCDWZ+0ZQHPCL3HUebLxW49wwLxvXU6sLNfYnTJxdqn58Aq4sBXW5Un0Q vfbd9VFV/bKFfvUscYk2UKPi9vgn1hY38IfmsnoS8b0uwDq75IBvup9pYFyNyPf5SutxhFfP JDjakbdjBoYDWVoaPbp5KAQ2VQRiR54lir/inyqGX+dwzPX/F4OHfB5RTiAFLJliCxniKFsM d8eHe88jWjm6/ilx4IlLl9/MdVUGjLpBi18X7ejLz3U2quYD8DBAGzCjy49wJ4Di4qQjblb2 pTXoEyM2L6E604NbDu0VDvHg7EXh1WwmijEu28c/hEB6DwtzslLpBSsJV0s1/jE= In-Reply-To: <20251106234055.ftahbvqxrfzjwr6t@desk> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit On 11/7/25 01:40, Pawan Gupta wrote: > [ I drafted the reply this this email earlier, but forgot to send it, sorry. ] > > On Mon, Nov 03, 2025 at 12:31:09PM -0800, Dave Hansen wrote: >> On 10/27/25 16:43, Pawan Gupta wrote: >>> IBPB mitigation for VMSCAPE is an overkill for CPUs that are only affected >>> by the BHI variant of VMSCAPE. On such CPUs, eIBRS already provides >>> indirect branch isolation between guest and host userspace. But, a guest >>> could still poison the branch history. >> >> This is missing a wee bit of background about how branch history and >> indirect branch prediction are involved in VMSCAPE. > > Adding more background to this. > >>> To mitigate that, use the recently added clear_bhb_long_loop() to isolate >>> the branch history between guest and userspace. Add cmdline option >>> 'vmscape=on' that automatically selects the appropriate mitigation based >>> on the CPU. >> >> Is "=on" the right thing here as opposed to "=auto"? > > v1 had it as =auto, David Kaplan made a point that for attack vector controls > "auto" means "defer to attack vector controls": > > https://lore.kernel.org/all/LV3PR12MB9265B1C6D9D36408539B68B9941EA@LV3PR12MB9265.namprd12.prod.outlook.com/ > > "Maybe a better solution instead is to add a new option 'vmscape=on'. > > If we look at the other most recently added bugs like TSA and ITS, neither > have an explicit 'auto' cmdline option. But they do have 'on' cmdline > options. > > The difference between 'auto' and 'on' is that 'auto' defers to the attack > vector controls while 'on' means 'enable this mitigation if the CPU is > vulnerable' (as opposed to 'force' which will enable it even if not > vulnerable). > > An explicit 'vmscape=on' could give users an option to ensure the > mitigation is used (regardless of attack vectors) and could choose the best > mitigation (BHB clear if available, otherwise IBPB). I thought the whole idea of attack vectors was because the gazillion options for gazillion mitigation became untenable over time. Now, what you are saying is - on top of the simplification, let's add yet more options to override the attack vectors o_O. IMO, having 'force' is sufficient to cover scenarios where people really want this mitigation - either because they know better, or because they want to test something. Force also covers the "on" case, so let's leave it at "on" for attack vector support, and 'force' for everything else