Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Date:   Tue, 30 Jan 2018 13:57:21 +0100 (CET)
From:   Thomas Gleixner <tglx@linutronix.de>
To:     David Woodhouse <dwmw2@infradead.org>
cc:     Borislav Petkov <bp@alien8.de>, arjan@linux.intel.com,
        karahmed@amazon.de, x86@kernel.org, linux-kernel@vger.kernel.org,
        tim.c.chen@linux.intel.com, peterz@infradead.org,
        pbonzini@redhat.com, ak@linux.intel.com,
        torvalds@linux-foundation.org, gregkh@linux-foundation.org
Subject: Re: [PATCH] x86/cpuid: Fix up "virtual" IBRS/IBPB/STIBP feature bits
 on Intel
In-Reply-To: <1517314193.18619.115.camel@infradead.org>
Message-ID: <alpine.DEB.2.20.1801301349140.1797@nanos>
References: <1517269773-16750-1-git-send-email-dwmw@amazon.co.uk>  <20180130105814.m5zd43dyx2o2ius2@pd.tnic>  <1517310230.18619.86.camel@infradead.org>  <20180130111848.zjv2dngfzcz35lyt@pd.tnic>  <1517311693.18619.102.camel@infradead.org> 
 <alpine.DEB.2.20.1801301235500.1797@nanos> <1517314193.18619.115.camel@infradead.org>
User-Agent: Alpine 2.20 (DEB 67 2015-01-07)
MIME-Version: 1.0
Content-Type: multipart/mixed; BOUNDARY="8323329-632665815-1517317041=:1797"
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

  This message is in MIME format.  The first part should be readable text,
  while the remaining parts are likely unreadable without MIME-aware tools.

--8323329-632665815-1517317041=:1797
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8BIT

On Tue, 30 Jan 2018, David Woodhouse wrote:

> On Tue, 2018-01-30 at 12:37 +0100, Thomas Gleixner wrote:
> 
> > In any case, if there is ucode mismatch between CPUs the whole thing is
> > hosed anyway no matter what. So can you please agree on a solution so we
> > can unbreak the current state of affairs?
> 
> If there is µcode mismatch between CPUs then the inconsistent bits
> should be filtered down to the lowest common denominator and we
> shouldn't use the features that are not consistently present. That much
> ought to work already with my patch.
> 
> Boris's version uses setup_force_cpu_cap() and forces the bit to be set
> even on secondary CPUs which don't really have it, and thus it won't
> get filtered out. We'll try to use it, and it will fault on the CPUs
> which don't have it.

So much for the theory. That's not going to work. If the boot cpu has the
feature then the alternatives will have been applied. So even if the flag
mismatch can be observed when a secondary CPU comes up the outcome will be
access to a non existing MSR and #GP.

The whole per cpu feature flag magic in x86 is just an empty shell
providing the illusion of supporting heterogenous systems. If that "works" in
a particular constellation then by pure chance and not by design.

All you can reasonably do is to detect the mismatch once the CPU is brought
up and then immediately aborting the hotplug operation _before_ it has the
chance to touch anything. But that does not necessarily require per cpu
storage.

Thanks,

	tglx


--8323329-632665815-1517317041=:1797--