Re: [PATCH v5 1/8] x86/bugs: Allow forcing Automatic IBRS with SNP active using spectre_v2=eibrs

[Kim Phillips]

On 9/23/26 8:45 PM, Borislav Petkov wrote:
> On Fri, Sep 18, 2026 at 06:00:21PM -0500, Kim Phillips wrote:
> > That fallback cannot be overridden.  An admin running an SNP host whose
> > workload is dominated by guest activity rather than host userspace may
> > well prefer AutoIBRS
> Why would she/he prefer to do that? Any persuasive arguments to make her/him
> do that?
On the same silicon with SNP off, the kernel's own default is AutoIBRS, not
retpoline. Enabling SNP doesn't make retpoline the better mitigation; it 
just
adds a host-userspace cost to AutoIBRS. So the admin is being pushed off the
recommended hardware mitigation onto a software one, with no say in
it.

What each side actually costs: retpoline taxes every indirect call in the
kernel, and a virtualization host lives in the kernel - VM exit handling,
networking, storage. AutoIBRS costs nothing on entry/exit and additionally
covers indirect branches the kernel never compiled (EFI runtime services,
prebuilt out-of-tree modules). Its penalty falls on host userspace, 
which on a
dedicated SNP host is thin and mostly parked in KVM_RUN.

For a guest-dominated host that trade plausibly goes the other way, and 
only
the admin knows their deployment.

Kim