2023-06-12 05:31:28

by Michael Roth

Subject: [PATCH RFC v9 08/51] x86/speculation: Do not enable Automatic IBRS if SEV SNP is enabled

From: Kim Phillips <[email protected]>

A hardware limitation prevents the host from enabling Automatic IBRS
when SNP is enabled. Instead, fall back to retpolines.

Signed-off-by: Kim Phillips <[email protected]>
Signed-off-by: Michael Roth <[email protected]>
---
arch/x86/kernel/cpu/bugs.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
index f9d060e71c3e..3fba3623ff64 100644
--- a/arch/x86/kernel/cpu/bugs.c
+++ b/arch/x86/kernel/cpu/bugs.c
@@ -1507,7 +1507,12 @@ static void __init spectre_v2_select_mitigation(void)

if (spectre_v2_in_ibrs_mode(mode)) {
if (boot_cpu_has(X86_FEATURE_AUTOIBRS)) {
- msr_set_bit(MSR_EFER, _EFER_AUTOIBRS);
+ if (!cpu_feature_enabled(X86_FEATURE_SEV_SNP)) {
+ msr_set_bit(MSR_EFER, _EFER_AUTOIBRS);
+ } else {
+ pr_err("SNP feature available, not enabling AutoIBRS on the host.\n");
+ mode = spectre_v2_select_retpoline();
+ }
} else {
x86_spec_ctrl_base |= SPEC_CTRL_IBRS;
update_spec_ctrl(x86_spec_ctrl_base);
--
2.25.1

2023-06-12 15:55:58

by Dave Hansen

Subject: Re: [PATCH RFC v9 08/51] x86/speculation: Do not enable Automatic IBRS if SEV SNP is enabled

On 6/11/23 21:25, Michael Roth wrote:
> A hardware limitation prevents the host from enabling Automatic IBRS
> when SNP is enabled. Instead, fall back to retpolines.

"Hardware limitation"? As in, it is a documented, architectural
restriction? Or, it's a CPU bug?

> diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
> index f9d060e71c3e..3fba3623ff64 100644
> --- a/arch/x86/kernel/cpu/bugs.c
> +++ b/arch/x86/kernel/cpu/bugs.c
> @@ -1507,7 +1507,12 @@ static void __init spectre_v2_select_mitigation(void)
>
> if (spectre_v2_in_ibrs_mode(mode)) {
> if (boot_cpu_has(X86_FEATURE_AUTOIBRS)) {
> - msr_set_bit(MSR_EFER, _EFER_AUTOIBRS);
> + if (!cpu_feature_enabled(X86_FEATURE_SEV_SNP)) {
> + msr_set_bit(MSR_EFER, _EFER_AUTOIBRS);
> + } else {
> + pr_err("SNP feature available, not enabling AutoIBRS on the host.\n");
> + mode = spectre_v2_select_retpoline();
> + }

I think this would be nicer if you did something like:

if (cpu_feature_enabled(X86_FEATURE_SEV_SNP))
setup_clear_cpu_cap(X86_FEATURE_AUTOIBRS);

somewhere _else_ in the code instead of smack-dab in the middle of the
mitigation selection.