Linux Fixes Faulty Mitigation Selection For BHI Vulnerability

This week's batch of x86 fixes have been sent out ahead of the Linux 7.4-rc2 kernel releasing later today. Among the fixes this week is ensuring that the Branch History Injection (BHI) mitigation is properly applied as there were some configurations where it wasn't being applied as needed by many generations of Intel CPUs and certain ARM and AMD CPUs. Debian developer Breno Leitao realized that the BHI mitigation for Linux wasn't always being applied when needed. For example, if building the Linux kernel without KVM virtualization support the BHI mitigation would be automatically disabled even though exploit vectors still exist. Leitao explained: "The BHI mitigation selection is inconsistent with the documentation (attack_vector_controls.rst), which lists BHI under both the user->kernel and guest->host attack vectors. bhi_select_mitigation() only enables it when CPU_MITIGATE_GUEST_HOST is set; otherwise it selects BHI_MITIGATION_OFF, even if CPU_MITIGATE_USER_KERNEL is set. As a result, a kernel compiled with KVM disabled gets BHI automatically disabled, since CPU_MITIGATE_GUEST_HOST defaults to off without KVM. This is a bug, given that CPU_MITIGATE_USER_KERNEL still needs it: on affected Intel CPUs these kernels lose BHI_DIS_S or the BHB clearing loop by default. Booting with mitigations=auto,no_guest_host has the same effect." That fix is now in place via the x86 fixes pull request. It will be merged today before Linux 7.4-rc2 and is also marked to be back-ported to supported Linux kernel patches since 2022 when BHI was introduced. The x86 fixes this week also has some improved handling around the recent AMD RMPOPT feature for clearing it when RMP is disabled by the system firmware and also only setting up SEV RMPOPT on active SEV-SNP hosts. Plus some other random x86 fixes as well in today's pull request.