From: Paolo Bonzini <pbonzini@redhat.com>
To: David Woodhouse <dwmw2@infradead.org>,
tglx@linutronix.de, x86@kernel.org, kvm@vger.kernel.org,
torvalds@linux-foundation.org, linux-kernel@vger.kernel.org,
arjan.van.de.ven@intel.com, dave.hansen@intel.com
Cc: Ingo Molnar <mingo@kernel.org>
Subject: Re: [PATCH 2/2] x86/speculation: Support "Enhanced IBRS" on future CPUs
Date: Fri, 16 Feb 2018 11:08:49 +0100 [thread overview]
Message-ID: <75287047-77a0-e0ff-c2e8-61c81641251e@redhat.com> (raw)
In-Reply-To: <1518775136.7876.13.camel@infradead.org>
On 16/02/2018 10:58, David Woodhouse wrote:
> On Tue, 2018-02-13 at 11:41 +0100, Paolo Bonzini wrote:
>
>> On 13/02/2018 11:36, David Woodhouse wrote:
>>>>> - if the VM has IBRS_ALL, pass through the MSR when it is zero and
>>>>> intercept writes when it is one (no writes should happen)
>>>>>
>>>>> - if the VM doesn't have IBRS_ALL, do as we are doing now, independent
>>>>> of what the host spectre_v2_ibrs_all() setting is.
>>>>
>>>> We end up having to turn IBRS on again on vmexit then, taking care that
>>>> no conditional branch can go round it. So that becomes an
>>>> *unconditional* wrmsr or lfence in the vmexit path. We really don't
>>>> want that.
>>>>
>>> Note that being able to keep it simple in KVM was basically what made
>>> the difference between me tolerating IBRS_ALL as Intel currently define
>>> it, and throwing my toys out of the pram (as I had done in the first
>>> iterations of this patch).
>>
>> You have my vote. :)
>
> I was taking that as assent to the patch... could I trouble you for an
> explicit ack, please?
No, it's a vote for throwing the toys out of the pram (or running away
with the ball, if you prefer).
Unfortunately, if you want to have a higher-performance mode for
IBRS_ALL that avoids rdmsr on vmexit, you have to do it as sketched above.
Alternatively, if IBRS_ALL is 1, and you don't care about migration
between machines that have IBRS_ALL and those that don't, the host can
simply not enable the SPEC_CTRL CPUID bit in the guest, and instead use
the AMD IBPB flag only. Need to check if Windows obeys the AMD flag on
Intel machines (or in general) though.
Paolo
next prev parent reply other threads:[~2018-02-16 10:08 UTC|newest]
Thread overview: 18+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-02-12 15:27 [PATCH 1/2] x86/speculation: Correct Speculation Control microcode blacklist again David Woodhouse
2018-02-12 15:27 ` [PATCH 2/2] x86/speculation: Support "Enhanced IBRS" on future CPUs David Woodhouse
2018-02-13 7:47 ` Ingo Molnar
2018-02-13 8:12 ` David Woodhouse
2018-02-13 8:02 ` Paolo Bonzini
2018-02-13 8:15 ` David Woodhouse
2018-02-13 9:58 ` Paolo Bonzini
2018-02-13 10:21 ` David Woodhouse
2018-02-13 10:36 ` David Woodhouse
2018-02-13 10:41 ` Paolo Bonzini
2018-02-13 10:53 ` David Woodhouse
2018-02-13 10:55 ` Paolo Bonzini
2018-02-16 9:58 ` David Woodhouse
2018-02-16 10:08 ` Paolo Bonzini [this message]
2018-02-16 10:21 ` David Woodhouse
2018-02-16 11:04 ` Paolo Bonzini
2018-02-16 12:10 ` David Woodhouse
2018-02-15 15:21 ` Pavel Machek
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=75287047-77a0-e0ff-c2e8-61c81641251e@redhat.com \
--to=pbonzini@redhat.com \
--cc=arjan.van.de.ven@intel.com \
--cc=dave.hansen@intel.com \
--cc=dwmw2@infradead.org \
--cc=kvm@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=mingo@kernel.org \
--cc=tglx@linutronix.de \
--cc=torvalds@linux-foundation.org \
--cc=x86@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).