Re: [PATCH v3 1/3] x86/bhi: Add BHB clearing for CPUs with larger branch history

[Pawan Gupta]

On Mon, Nov 03, 2025 at 12:04:50PM -0800, Dave Hansen wrote:
> On 10/27/25 16:43, Pawan Gupta wrote:
> > Add a version of clear_bhb_loop() that works on CPUs with larger branch
> > history table such as Alder Lake and newer. This could serve as a cheaper
> > alternative to IBPB mitigation for VMSCAPE.
> 
> This is missing a bit of background about clear_bhb_loop(). What does it
> mitigate? This is also a better place to talk about why this loop exists
> if it doesn't work on newer CPUs.
> 
> In other words, please mention BHI_DIS_S here.

Sure, will add the background on clear_bhb_loop() and BHI_DIS_S.

> > clear_bhb_loop() and the new clear_bhb_long_loop() only differ in the loop
> > counter. Convert the asm implementation of clear_bhb_loop() into a macro
> > that is used by both the variants, passing counter as an argument.
> 
> I find these a lot easier to review if you separate out the refactoring
> from the new work. I know it's not a lot of code, but refactor first,
> then add he new function in a separate patch.

Ya, thats a better way to do it, I will split the patch.

> > +/*
> > + * A longer version of clear_bhb_loop to ensure that the BHB is cleared on CPUs
> 
> "clear_bhb_loop()", please.

Will fix.

> > + * with larger branch history tables (i.e. Alder Lake and newer). BHI_DIS_S
> > + * protects the kernel, but to mitigate the guest influence on the host
> > + * userspace either IBPB or this sequence should be used. See VMSCAPE bug.
> > + */
> > +SYM_FUNC_START(clear_bhb_long_loop)
> > +	__CLEAR_BHB_LOOP 12, 7
> > +SYM_FUNC_END(clear_bhb_long_loop)
> > +EXPORT_SYMBOL_GPL(clear_bhb_long_loop)
> > +STACK_FRAME_NON_STANDARD(clear_bhb_long_loop)
> 
> All the pieces are out there, but I feel like we need this in one place,
> somewhere:
> 
> BHI_DIS_S:  Mitigates user=>kernel attacks on new CPUs. Faster than the
>             long loop.
> Long Loop:  Mitigates guest=>host userspace attacks on new CPUs. Would
> 	    also work for user=>kernel, but BHI_DIS_S is faster.
> Short Loop: The only choice on older CPUs. Used for both user=>kernel
> 	    and guest=>host userspace mitigation.

Sure, I will capture them in one place. I guess this should also go in the
documentation.