Re: [PATCH 2/2] x86/vmscape: Replace IBPB with branch history clear on exit to userspace

[Pawan Gupta]

On Fri, Sep 26, 2025 at 01:39:37PM +0000, Kaplan, David wrote:
> > > > --- a/Documentation/admin-guide/kernel-parameters.txt
> > > > +++ b/Documentation/admin-guide/kernel-parameters.txt
> > > > @@ -8048,9 +8048,11 @@
> > > >
> > > >                         off             - disable the mitigation
> > > >                         ibpb            - use Indirect Branch Prediction Barrier
> > > > -                                         (IBPB) mitigation (default)
> > > > +                                         (IBPB) mitigation
> > > >                         force           - force vulnerability detection even on
> > > >                                           unaffected processors
> > > > +                       auto            - (default) automatically select IBPB
> > > > +                                         or BHB clear mitigation based on CPU
> > >
> > > Many of the other bugs (like srso, l1tf, bhi, etc.) do not have explicit
> > > 'auto' options as 'auto' is implied by the lack of an explicit option.
> > > Is there really value in creating an explicit 'auto' option here?
> >
> > Hmm, so to get the BHB clear mitigation do we advise the users to remove
> > the vmscape= parameter? That feels a bit weird to me. Also, with
> > CONFIG_MITIGATION_VMSCAPE=n a user can get IBPB mitigation with
> > vmscape=ibpb, but there is no way to get the BHB clear mitigation.
> >
> 
> Maybe a better solution instead is to add a new option 'vmscape=on'.
> 
> If we look at the other most recently added bugs like TSA and ITS,
> neither have an explicit 'auto' cmdline option.  But they do have 'on'
> cmdline options.
> 
> The difference between 'auto' and 'on' is that 'auto' defers to the
> attack vector controls while 'on' means 'enable this mitigation if the
> CPU is vulnerable' (as opposed to 'force' which will enable it even if
> not vulnerable).
> 
> An explicit 'vmscape=on' could give users an option to ensure the
> mitigation is used (regardless of attack vectors) and could choose the
> best mitigation (BHB clear if available, otherwise IBPB).
> 
> I'd still advise users to not specify any option here unless they know
> what they're doing.  But an 'on' option would arguably be more consistent
> with the other recent bugs and maybe meets the needs you're after?

Sounds good to me. I'll update the patch.