Merged this Patch Tuesday were Linux kernel patches for helping fend off Branch History Injection when paired with updated CPU microcode. Unless I am overlooking something or there is some disclosures not yet published, it's not clear why these kernel patches were merged today: the Intel Security Center hasn't yet shown any new vulnerabilities today, there isn't any new Intel CPU microcode drop, nor any other new disclosures I've seen today yet around BHI.
Linus Torvalds merged this "nativebhi" branch providing this newest CPU security vulnerability mitigation. The merge message reads:
Mitigations for the native BHI hardware vulnerability:
Branch History Injection (BHI) attacks may allow a malicious application to influence indirect branch prediction in kernel by poisoning the branch history. eIBRS isolates indirect branch targets in ring0. The BHB can still influence the choice of indirect branch predictor entry, and although branch predictor entries are isolated between modes when eIBRS is enabled, the BHB itself is not isolated between modes.
Add mitigations against it either with the help of microcode or with software sequences for the affected CPUs"
[ This also ends up enabling the full mitigation by default despite the system call hardening, because apparently there are other indirect calls that are still sufficiently reachable, and the 'auto' case just isn't hardened enough.
We'll have some more inevitable tweaking in the future - Linus ]
The updated kernel documentation does point to new research motivating this BHI mitigation:
"Previously the only known real-world BHB attack vector was via unprivileged eBPF. Further research has found attacks that don't require unprivileged eBPF. For a full mitigation against BHB attacks it is recommended to set BHI_DIS_S or use the BHB clearing sequence."
The new code adds a spectre_bhi= boot time option for on/off/auto controls of this Branch History Injection mitigation. The controls affect the hardware BHI control and the software BHB clearing sequence. The patches do confirm that AMD, Zhaoxin, and Hygon processors are not affected, but seemingly just Intel of x86/x86_64 processors.
As for affected Intel processors, Alder Lake and newer have the BHI_DIS_S hardware control to mitigate BHI. Prior to Alder Lake Intel has released a software sequence to clear the branch history.
With the Linux mitigation the branch history is cleared at system call entry and VMexit. For now at least branch history is not cleared at interrupt entry but one of the patches do note:
"For now, branch history is not cleared at interrupt entry, as malicious applications are not believed to have sufficient control over the registers, since previous register state is cleared at interrupt entry. Researchers continue to poke at this area and it may become necessary to clear at interrupt entry as well in the future."
So as of a short time ago the Intel BHI mitigation code is merged to Git for Linux 6.9 and will be back-ported to stable kernel releases shortly. I'm still poking around to find out more information on why the BHI mitigation is now happening two years after the original BHI disclosure.