Re: [PATCH 4/7] x86/idle: Disable IBRS entering idle and enable it on wakeup

[Peter Zijlstra]

On Thu, Jan 04, 2018 at 09:56:45AM -0800, Tim Chen wrote:
> @@ -100,15 +101,33 @@ static inline void __sti_mwait(unsigned long eax, unsigned long ecx)
>  static inline void mwait_idle_with_hints(unsigned long eax, unsigned long ecx)
>  {
>  	if (static_cpu_has_bug(X86_BUG_MONITOR) || !current_set_polling_and_test()) {
> +		bool can_toggle_ibrs = false;
>  		if (static_cpu_has_bug(X86_BUG_CLFLUSH_MONITOR)) {
>  			mb();
>  			clflush((void *)&current_thread_info()->flags);
>  			mb();
>  		}
>  
> +		if (irqs_disabled()) {
> +		       /*
> +			* CPUs run faster with speculation protection
> +			* disabled.  All CPU threads in a core must
> +			* disable speculation protection for it to be
> +			* disabled.  Disable it while we are idle so the
> +			* other hyperthread can run fast.
> +			*
> +			* nmi uses the save_paranoid model which
> +			* always enables ibrs on exception entry
> +			* before any indirect jump can run.
> +			*/
> +			can_toggle_ibrs = true;
> +			unprotected_speculation_begin();
> +		}
>  		__monitor((void *)&current_thread_info()->flags, 0, 0);
>  		if (!need_resched())
>  			__mwait(eax, ecx);
> +		if (can_toggle_ibrs)
> +			unprotected_speculation_end();
>  	}
>  	current_clr_polling();
>  }

Argh.. no. Who is calling this with IRQs enabled? And why can't we frob
the MSR with IRQs enabled? That comment doesn't seem to explain
anything.

> diff --git a/arch/x86/include/asm/spec_ctrl.h b/arch/x86/include/asm/spec_ctrl.h
> index 16fc4f58..28b0314 100644
> --- a/arch/x86/include/asm/spec_ctrl.h
> +++ b/arch/x86/include/asm/spec_ctrl.h
> @@ -76,5 +76,42 @@
>  10:
>  .endm
>  
> +#else
> +#include <asm/microcode.h>
> +
> +static inline void __disable_indirect_speculation(void)
> +{
> +        native_wrmsrl(MSR_IA32_SPEC_CTRL, SPEC_CTRL_FEATURE_ENABLE_IBRS);
> +}
> +
> +static inline void __enable_indirect_speculation(void)
> +{
> +        native_wrmsrl(MSR_IA32_SPEC_CTRL, SPEC_CTRL_FEATURE_DISABLE_IBRS);
> +}
> +
> +/*
> + * Interrupts must be disabled to begin unprotected speculation.
> + * Otherwise interrupts could be running in unprotected mode.
> + */
> +static inline void unprotected_speculation_begin(void)
> +{
> +	WARN_ON_ONCE(!irqs_disabled());

lockdep_assert_irqs_disabled()

> +	if (boot_cpu_has(X86_FEATURE_SPEC_CTRL))
> +		__enable_indirect_speculation();
> +}
> +
> +static inline void unprotected_speculation_end(void)
> +{
> +	if (boot_cpu_has(X86_FEATURE_SPEC_CTRL))
> +		__disable_indirect_speculation();
> +	else
> +		/*
> +		 * If we intended to disable indirect speculation
> +		 * but come here due to mis-speculation, we need
> +		 * to stop the mis-speculation with rmb.
> +		 */
> +		rmb();

Code is lacking {}, also the comment doesn't make sense. If we don't
have the MSR, why are we doing an LFENCE?

And why are these boot_cpu_has() and not static_cpu_has() ?