Received-SPF: pass (google.com: domain of linux-kernel+bounces-145434-linux.lists.archive=gmail.com@vger.kernel.org designates 139.178.88.99 as permitted sender) client-ip=139.178.88.99;
Message-ID: <2af16cb4-32ed-4b91-872b-f0cc9ed92e59@oracle.com>
Date: Mon, 15 Apr 2024 17:14:05 +0200
User-Agent: Mozilla Thunderbird
Cc: alexandre.chartre@oracle.com, x86@kernel.org, kvm@vger.kernel.org,
        linux-kernel@vger.kernel.org, daniel.sneddon@linux.intel.com,
        pawan.kumar.gupta@linux.intel.com, tglx@linutronix.de,
        konrad.wilk@oracle.com, peterz@infradead.org,
        gregkh@linuxfoundation.org, seanjc@google.com,
        dave.hansen@linux.intel.com, nik.borisov@suse.com, kpsingh@kernel.org,
        longman@redhat.com, bp@alien8.de, pbonzini@redhat.com
Subject: Re: [PATCH] KVM: x86: Set BHI_NO in guest when host is not affected
 by BHI
Content-Language: en-US
To: Chao Gao <chao.gao@intel.com>, Andrew Cooper <andrew.cooper3@citrix.com>
References: <20240411072445.522731-1-alexandre.chartre@oracle.com>
 <7f1faa48-6252-4409-aefc-2ed2f38fb1c3@citrix.com>
 <caa51938-c587-4403-a9cd-16e8b585bc13@oracle.com>
 <d47dcc77-3c8b-4f78-954a-a64d3a905224@citrix.com>
 <ZhfGHpAz7W7d/pSa@chao-email>
 <95902795-0c2c-43cc-8d87-89302a2eed2b@oracle.com>
From: Alexandre Chartre <alexandre.chartre@oracle.com>
Autocrypt: addr=alexandre.chartre@oracle.com; keydata=
 xsFNBGJDNGkBEACg7Xx1laJ1nI9Bp1l9KXjFNDAMy5gydTMpdiqPpPojJrit6FMbr6MziEMm
 T8U11oOmHlEqI24jtGLSzd74j+Y2qqREZb3GiaTlC1SiV9UfaO+Utrj6ik/DimGCPpPDjZUl
 X1cpveO2dtzoskTLS9Fg/40qlL2DMt1jNjDRLG3l6YK+6PA+T+1UttJoiuqUsWg3b3ckTGII
 y6yhhj2HvVaMPkjuadUTWPzS9q/YdVVtLnBdOk3ulnzSaUVQ2yo+OHaEOUFehuKb0VsP2z9c
 lnxSw1Gi1TOwATtoZLgyJs3cIk26WGegKcVdiMr0xUa615+OlEEKYacRk8RdVth8qK4ZOOTm
 PWAAFsNshPk9nDHJ3Ls0krdWllrGFZkV6ww6PVcUXW/APDsC4FiaT16LU8kz4Z1/pSgSsyxw
 bKlrCoyxtOfr/PFjmXhwGPGktzOq04p6GadljXLuq4KBzRqAynH0yd0kQMuPvQHie1yWVD0G
 /zS9z2tkARkR/UkO+HxfgA+HJapbYwhCmhtRdxMDFgk8rZNkaFZCj8eWRhCV8Bq7IW+1Mxrq
 a2q/tunQETek+lurM3/M6lljQs49V2cw7/yEYjbWfTMURBHXbUwJ/VkFoPT6Wr3DFiKUJ4Rq
 /y8sjkLSWKUcWcCAq5MGbMl+sqnlh5/XhLxsA44drqOZhfjFRQARAQABzTlBbGV4YW5kcmUg
 Q2hhcnRyZSAoT3JhY2xlKSA8YWxleGFuZHJlLmNoYXJ0cmVAb3JhY2xlLmNvbT7CwY4EEwEI
 ADgWIQRTYuq298qnHgO0VpNDF01Tug5U2AUCYkM0aQIbAwULCQgHAgYVCgkICwIEFgIDAQIe
 AQIXgAAKCRBDF01Tug5U2M0QD/9eqXBnu9oFqa5FpHC1ZwePN/1tfXzdW3L89cyS9jot79/j
 nwPK9slfRfhm93i0GR46iriSYJWEhCtMKi9ptFdVuDLCM3p4lRAeuaGT2H++lrayZCObmZxN
 UlVhZAK/rYic25fQYjxJD9T1E0pCqlVGDXr2yutaJJxml5/jL58LUlDcGfIeNpfNmrwOmtUi
 7Gkk+/NXU/yCY17vQgXXtfOATgusyjTFqHvdKgvYsJWfWZnDIkJslsGXjnC8PCqiLayCPHs+
 v+8RX5oawRuacXAcOM66MM3424SGK5shY4D0vgwTL8m0au5MVbkbkbg/aKDYLN33RNUdnTiz
 0eqIGxupzAIG9Tk46UnZ/4uDjdjmqJt1ol+1FvBlJCg+1iGGJ7cX5sWgx85BC63SpKBukaNu
 3BpQNPEJ4Kf+DIBvfq6Vf+GZcLT2YExXqDksh08eAIterYaVgO7vxq6eLOJjaQWZvZmR94br
 HIPjnpVT9whG1XHWNp2Cirh9PRKKYCn+otkuGiulXgRizRRq2z9WVVQddvCDBDpcBoSlj5n5
 97UG0bpLQ65yaNt5o30mqj4IgNWH4TO0VJlmNDFEW0EqCBqL1vZ2l97JktJosVQYCiW20/Iv
 GiRcr8RAIK8Yvs+pBjL6cL/l9dCpwfIphRI8KLhP8HsgaY2yIgLnGWFpseI3h87BTQRiQzRp
 ARAAxUJ7UpDLoKIVG0bF4BngeODzgcL4bsiuZO+TnZzDPna3/QV629cWcjVVjwOubh2xJZN2
 JfudWi2gz5rAVVxEW7iiQc3uvxRM9v+t3XmpfaUQSkFb7scSxn4eYB8mM0q0Vqbfek5h1VLx
 svbqutZV8ogeKfWJZgtbv8kjNMQ9rLhyZzFNioSrU3x9R8miZJXU6ZEqXzXPnYXMRuK0ISE9
 R7KMbgm4om+VL0DgGSxJDbPkG9pJJBe2CoKT/kIpb68yduc+J+SRQqDmBmk4CWzP2p7iVtNr
 xXin503e1IWjGS7iC/JpkVZew+3Wb5ktK1/SY0zwWhKS4Qge3S0iDBj5RPkpRu8u0fZsoATt
 DLRCTIRcOuUBmruwyR9FZnVXw68N3qJZsRqhp/q//enB1zHBsU1WQdyaavMKx6fi1DrF9KDp
 1qbOqYk2n1f8XLfnizuzY8YvWjcxnIH5NHYawjPAbA5l/8ZCYzX4yUvoBakYLWdmYsZyHKV7
 Y1cjJTMY2a/w1Y+twKbnArxxzNPY0rrwZPIOgej31IBo3JyA7fih1ZTuL7jdgFIGFxK3/mpn
 qwfZxrM76giRAoV+ueD/ioB5/HgqO1D09182sqTqKDnrkZlZK1knw2d/vMHSmUjbHXGykhN+
 j5XeOZ9IeBkA9A4Zw9H27QSoQK72Lw6mkGMEa4cAEQEAAcLBdgQYAQgAIBYhBFNi6rb3yqce
 A7RWk0MXTVO6DlTYBQJiQzRpAhsMAAoJEEMXTVO6DlTYaS0P/REYu5sVuY8+YmrS9PlLsLgQ
 U7hEnMt0MdeHhWYbqI5c2zhxgP0ZoJ7UkBjpK/zMAwpm+IonXM1W0xuD8ykiIZuV7OzEJeEm
 BXPc1hHV5+9DTIhYRt8KaOU6c4r0oIHkGbedkn9WSo631YluxEXPXdPp7olId5BOPwqkrz4r
 3vexwIAIVBpUNGb5DTvOYz1Tt42f7pmhCx2PPUBdKVLivwSdFGsxEtO5BaerDlitkKTpVlaK
 jnJ7uOvoYwVDYjKbrmNDYSckduJCBYBZzMvRW346i4b1sDMIAoZ0prKs2Sol7DyXGUoztGeO
 +64JguNXc9uBp3gkNfk1sfQpwKqUVLFt5r9mimNuj1L3Sw9DIRpEuEhXz3U3JkHvRHN5aM+J
 ATLmm4lbF0kt2kd5FxvXPBskO2Ged3YY/PBT6LhhNettIRQLJkq5eHfQy0I1xtdlv2X+Yq8N
 9AWQ+rKrpeBaTypUnxZAgJ8memFoZd4i4pkXa0F2Q808bL7YrZa++cOg2+oEJhhHeZEctbPV
 rVx8JtRRUqZyoBcpZqpS+75ORI9N5OcbodxXr8AEdSXIpAdGwLamXR02HCuhqWAxk+tCv209
 ivTJtkxPvmmMNb1kilwYVd2j6pIdYIx8tvH0GPNwbno97BwpxTNkkVPoPEgeCHskYvjasM1e
 swLliy6PdpST
In-Reply-To: <95902795-0c2c-43cc-8d87-89302a2eed2b@oracle.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
Precedence: bulk
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: 
	=?utf-8?B?WmZYQm1NUVFGUkN3dTNmRlBjRDVPTEJ6N2xjYmUrWFhFR3ppN3prSmNhSFph?=
 =?utf-8?B?NDJ4YS9MUnR2WGdxSDdFVngxbVFDS0lwMFhNdlA5MGVNSFFnRUdaT3BSdm1F?=
 =?utf-8?B?SXZWcU92bGVWRnFETDFKcWNrUmk1c2cycFZMMU5NTFBtclI2UFQ2NWJnbHhp?=
 =?utf-8?B?TFBQT2ZvNS9hdXQwRXpyZmhOK1dlWUs5czRoTDl2OERqQk9CQzk4MW1JdkFz?=
 =?utf-8?B?Y1ZxcTJVL2x3M2ZSU1A1UEVIMkRqME9tQmVvbk9uamxudWtMZm5TOXNXMUZZ?=
 =?utf-8?B?Ny9MSlRTajlMbnhwb1FYcTcrZzFGTndER1E5VUVycm9SN09TUTZ6K09QendQ?=
 =?utf-8?B?dExONHZMcDMySzBDWlYyQlJTMTdtWm1xejh2TXNDRWR4cFVkV2liRDN1VWs4?=
 =?utf-8?B?UGRHakpTMWRHcGV5NFhlamx5Y0FiYXdLRm5mZW9xRkRKN0dJT2JhVEtjTE5L?=
 =?utf-8?B?QmNKMVA3V2hzQlozRithc3FRVXpjSXJuSDdUS3grUlY2TkRnY2IyT2xHNlJt?=
 =?utf-8?B?OE9CVjRYQlhTK1Q2S0Q3N3VmVGpBL05PRVN0U3RRSGpSYmRqQ29YMGtYSzZq?=
 =?utf-8?B?MzBBNm54ZnFyaGoyOXhPdGw1Vk1NMkJyYXB5YnoyaU9EblJXb3plbk9TV1M1?=
 =?utf-8?B?K0oveW5Da0xhc2ErMFhPdFliSGs2ak5mN1pyVlRpYyt2bXJ0YXMvaGtJKzAy?=
 =?utf-8?B?TlFiMlpTWjRxMVl5cXNjMDVyRWlrcXY3NGZzazJ3K1FrMDZjU0o2ejVQcG1L?=
 =?utf-8?B?WXNMM2hwNkRIRVV6OUZxNm95dExQaDZudC9VMEx0emVJUGVkUU9WcEZ1NDd3?=
 =?utf-8?B?RlVBU2V3T0d5eVo3aEVJV2EyZ2JhUEV2cEh2aU9NOWEzRVRVTEZ0LzdrbHZH?=
 =?utf-8?B?eEVHVkNCWmcvcHlaai9IN2Fpb2cvVFAzZ2F4WldiNzJCMWt3TnZCMjJiellu?=
 =?utf-8?B?eGtmYUlTd3o0eDBtZjVoTnI4WlR4Y05rekk1a0RtZ0ZFZDFmMGZ0SERyUm53?=
 =?utf-8?B?bTRHUVVIclZQTWhWOTdqMXF1SnBvOGU0alJDbU5sUUs1SDF5cmFiYlRtcmlt?=
 =?utf-8?B?NW9iOTFSSjlBVnRTMUUxdE1MT1NJNStJVk1jNlBHQkJOZER5bWFRMVJNeUhl?=
 =?utf-8?B?MWMrUTYzTXJ0L3M0eUtEbWx5YmFOZHZIcWtsVXdaTCtBaEhOYm9uOHUxeHNC?=
 =?utf-8?B?aWtCUEF3TkRLNGlLcnRGaHpJU0ZreXZscDUwam96ODhHYzFqQS9oVG13MTg5?=
 =?utf-8?B?bDRaSTYvZHFpeWY4djNCSloxVFF5SDIrN2RqSGFmSzJRRUIvaG1pWU1IcWV6?=
 =?utf-8?B?OHdOaTVQc0w1cm5SSkI1bGRaR005ZmpPVVRmMjZ4cnNGZnZNVFpsM0ZnNkpF?=
 =?utf-8?B?c3N5dWtCUXVxNUVMdThOQ0tpUDNBODh4amJYcGdLWEVOalFrcUk2aXMybXJP?=
 =?utf-8?B?MmhWR3FDeXU3Y0pJWDB6aXQwVDlOT21SS2lIc2VXVGhvOXR2MjRMOWh2aWtK?=
 =?utf-8?B?eGtJUDl4ZlFvSWpUNCtQWWxwSWtHWTlIMVVoeDIvOTdZbzdLL0IzYXZBRllI?=
 =?utf-8?B?cWROU2h5WTZHZ2QvcU81enFXcGNMekt4TDRWellDeG9YUjJCM1crcUhaNUUx?=
 =?utf-8?B?NG40ZVUwOW5WQStQelZGNFYyVmJ4cE1hUCtvN2pZQUJkYkVVN0tTMzBDLzVq?=
 =?utf-8?B?dHVtTDRBSU55MFNNSjh3QmZoaUptQ0NYcnZEZHloQUhoYklHZ3NZZitOOVdR?=
 =?utf-8?B?OEdBRHBnckdkbjNRbFRWc2hHZDBMRVcxMDNGNnVxVjNvTGtwbFRHQ2djOWNW?=
 =?utf-8?B?M0VIVmwvMXJPRVRjb1FndkZxVGpHWkRxM3drcXkrbW5wQkRlRUVkL3hCeXFy?=
 =?utf-8?B?UDZiMS95LzkxRXBwRGRIN3FZTTFsdCtxYXUrbUtyMWY5c0tzUE5WU29zaHFR?=
 =?utf-8?B?aUl5d2F3TER3M0hlTTM4aFhBUG1aN296MWxMVVJlSCtyd3JRci92ZnNsbk50?=
 =?utf-8?B?OFcvVGxIVUVlOFI5d2FQUC9yNlVBVzgrNmhQOXRVMGx2TWYvamFwTGloVjhk?=
 =?utf-8?B?RXV5SlpBclV6aXJZS3E4bGlPYmU1YkxDYnY1aGtKcEtVckNPcDl2dERLcFpW?=
 =?utf-8?B?aUlNZi9idmYzYXpJaG5UdDZPcXJZdk4xTVJjZXZ1Z0NLUi9rQW94di9sbkp1?=
 =?utf-8?B?aHc9PQ==?=
X-MS-Exchange-AntiSpam-ExternalHop-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-ExternalHop-MessageData-0: 
	PIYRj0/bkcWi9Adn6zErub4ZMgCCzkRFT/P6qUa/gpqlngYOXy7wgLjLAmAM21ZzkOyywBhjoxcnaC8zQjTUtCg/x8tmZ+9JfTAigsZAk1gl+S8H9cy7nFwDjCOfgX2r9j9mbWMHjl+VRixBV0KsRaqG2u95OK6iqtfFkpsjup58yWz8BZKWQhmI7ZhaYFvP6M5PncEuvGUwyXzkNJiuntlRcdddI9vmghFjIdvmqZs94z3wGtnFw7/iIUWjTTJy6bMQWgt7xlhasYIgtFe5DjHSiiINDTpjcOVG5NCT/SFqSW1TaTF8PlFHSclrA+9jn3PJiNW/4NmsTEBN4TbLKf8yFmx52NcTshvRnW8JONWCawXeuS4DMq1KI2l3CoZj6+8VzTPFxwOXV0sKWhRYCr04TVhSA+6MtEyNjZP4cSBeC/4t6b+fD0P8B29mILRIsZE5MS7CvmZvQ8lTPpJzpBCvByLbgjbgfmWxr2eu/qrEaUyYjz93nikv/VuPbD7T90uEelm1QUxjSZyoSafSpS5hwRx0Dw54iHtEMlpwbq+g+0L9yTQnlFRqhj9FkCs6QXM0cnePpYGaOZl+oz30Iwrg5NtDQ4HDUgsFSNIsZzc=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 7a9625c4-54d3-47bc-4bb9-08dc5d5eb449
X-MS-Exchange-CrossTenant-AuthSource: SN4PR10MB5622.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 15 Apr 2024 15:14:12.3592
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: 0H0TNVGus6lrTHwamrIzB0q8+Z5ahiq/mWKg0v/QW45Az9RjpZlrvYAoRCce7dAP6+h9YeXturwpT+/dbyaj5bwUVbNlOjXCIIpxD9ZwpQg=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BLAPR10MB4996
X-Proofpoint-Virus-Version: vendor=baseguard
 engine=ICAP:2.0.272,Aquarius:18.0.1011,Hydra:6.0.619,FMLib:17.11.176.26
 definitions=2024-04-15_12,2024-04-15_01,2023-05-22_02
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 mlxlogscore=999 adultscore=0
 phishscore=0 bulkscore=0 spamscore=0 malwarescore=0 mlxscore=0
 suspectscore=0 classifier=spam adjust=0 reason=mlx scancount=1
 engine=8.12.0-2404010000 definitions=main-2404150099
X-Proofpoint-GUID: PjMT1sC5CcGKWyfxT51DdJJigAZBtWp-
X-Proofpoint-ORIG-GUID: PjMT1sC5CcGKWyfxT51DdJJigAZBtWp-


On 4/11/24 15:20, Alexandre Chartre wrote:
> 
> On 4/11/24 13:14, Chao Gao wrote:
>>>> The problem is that we can end up with a guest running extra BHI
>>>> mitigations
>>>> while this is not needed. Could we inform the guest that eIBRS is not
>>>> available
>>>> on the system so a Linux guest doesn't run with extra BHI mitigations?
>>>
>>> Well, that's why Intel specified some MSRs at 0x5000xxxx.
>>
>> Yes. But note that there is a subtle difference. Those MSRs are used for guest
>> to communicate in-used software mitigations to the host. Such information is
>> stable across migration. Here we need the host to communicate that eIBRS isn't
>> available to the guest. this isn't stable as the guest may be migrated from
>> a host without eIBRS to one with it.
>>
>>>
>>> Except I don't know anyone currently interested in implementing them,
>>> and I'm still not sure if they work correctly for some of the more
>>> complicated migration cases.
>>
>> Looks you have the same opinion on the Intel-defined virtual MSRs as Sean.
>> If we all agree the issue here and the effectivenss problem of the short
>> BHB-clearing sequence need to be resolved and don't think the Intel-defined
>> virtual MSRs can handle all cases correctly, we have to define a better
>> interface through community collaboration as Sean suggested.
> 
> Another solution could be to add cpus to cpu_vuln_whitelist with BHI_NO.
> (e.g. explicitly add cpus which have eIBRS). That way, the kernel will
> figure out the right mitigation on the host and guest.
> 

More precisely we could something like this (this is just an example, obviously
the list is clearly incomplete):

diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
index 754d91857d63..80477170ccc0 100644
--- a/arch/x86/kernel/cpu/common.c
+++ b/arch/x86/kernel/cpu/common.c
@@ -1182,6 +1182,24 @@ static const __initconst struct x86_cpu_id cpu_vuln_whitelist[] = {
         VULNWL_INTEL(ATOM_TREMONT_L,            NO_EIBRS_PBRSB),
         VULNWL_INTEL(ATOM_TREMONT_D,            NO_ITLB_MULTIHIT | NO_EIBRS_PBRSB),
  
+       /*
+        * The following Intel CPUs are affected by BHI, but they don't have
+        * the eIBRS feature. In that case, the default Spectre v2 mitigations
+        * are enough to also mitigate BHI. We mark these CPUs with NO_BHI so
+        * that X86_BUG_BHI doesn't get set and no extra BHI mitigation is
+        * enabled.
+        *
+        * This avoids guest VMs from enabling extra BHI mitigation when this
+        * is not needed. For guest, X86_BUG_BHI is never set for CPUs which
+        * don't have the eIBRS feature. But this doesn't happen in guest VMs
+        * as the virtualization can hide the eIBRS feature.
+        */
+       VULNWL_INTEL(IVYBRIDGE_X,               NO_BHI),
+       VULNWL_INTEL(HASWELL_X,                 NO_BHI),
+       VULNWL_INTEL(BROADWELL_X,               NO_BHI),
+       VULNWL_INTEL(SKYLAKE_X,                 NO_BHI),
+       VULNWL_INTEL(SKYLAKE_X,                 NO_BHI),
+
         /* AMD Family 0xf - 0x12 */
         VULNWL_AMD(0x0f,        NO_MELTDOWN | NO_SSB | NO_L1TF | NO_MDS | NO_SWAPGS | NO_ITLB_MULTIHIT | NO_MMIO | NO_BHI),
         VULNWL_AMD(0x10,        NO_MELTDOWN | NO_SSB | NO_L1TF | NO_MDS | NO_SWAPGS | NO_ITLB_MULTIHIT | NO_MMIO | NO_BH


alex.