Re: [PATCH 4/7] x86/idle: Disable IBRS entering idle and enable it on wakeup

Peter Zijlstra
2018-01-04T22:47:40Z

On Thu, Jan 04, 2018 at 09:56:45AM -0800, Tim Chen wrote:
> @@ -100,15 +101,33 @@ static inline void __sti_mwait(unsigned long eax, unsigned long ecx)
> static inline void mwait_idle_with_hints(unsigned long eax, unsigned long ecx)
> {
> if (static_cpu_has_bug(X86_BUG_MONITOR) || !current_set_polling_and_test()) {
> + bool can_toggle_ibrs = false;
> if (static_cpu_has_bug(X86_BUG_CLFLUSH_MONITOR)) {
> mb();
> clflush((void *)&current_thread_info()->flags);
> mb();
> }
>
> + if (irqs_disabled()) {
> + /*
> + * CPUs run faster with speculation protection
> + * disabled. All CPU threads in a core must
> + * disable speculation protection for it to be
> + * disabled. Disable it while we are idle so the
> + * other hyperthread can run fast.
> + *
> + * nmi uses the save_paranoid model which
> + * always enables ibrs on exception entry
> + * before any indirect jump can run.
> + */
> + can_toggle_ibrs = true;
> + unprotected_speculation_begin();
> + }
> __monitor((void *)&current_thread_info()->flags, 0, 0);
> if (!need_resched())
> __mwait(eax, ecx);
> + if (can_toggle_ibrs)
> + unprotected_speculation_end();
> }
> current_clr_polling();
> }

Argh.. no. Who is calling this with IRQs enabled? And why can't we frob
the MSR with IRQs enabled? That comment doesn't seem to explain
anything.

> diff --git a/arch/x86/include/asm/spec_ctrl.h b/arch/x86/include/asm/spec_ctrl.h
> index 16fc4f58..28b0314 100644
> --- a/arch/x86/include/asm/spec_ctrl.h
> +++ b/arch/x86/include/asm/spec_ctrl.h
> @@ -76,5 +76,42 @@
> 10:
> .endm
>
> +#else
> +#include <asm/microcode.h>
> +
> +static inline void __disable_indirect_speculation(void)
> +{
> + native_wrmsrl(MSR_IA32_SPEC_CTRL, SPEC_CTRL_FEATURE_ENABLE_IBRS);
> +}
> +
> +static inline void __enable_indirect_speculation(void)
> +{
> + native_wrmsrl(MSR_IA32_SPEC_CTRL, SPEC_CTRL_FEATURE_DISABLE_IBRS);
> +}
> +
> +/*
> + * Interrupts must be disabled to begin unprotected speculation.
> + * Otherwise interrupts could be running in unprotected mode.
> + */
> +static inline void unprotected_speculation_begin(void)
> +{
> + WARN_ON_ONCE(!irqs_disabled());

lockdep_assert_irqs_disabled()

> + if (boot_cpu_has(X86_FEATURE_SPEC_CTRL))
> + __enable_indirect_speculation();
> +}
> +
> +static inline void unprotected_speculation_end(void)
> +{
> + if (boot_cpu_has(X86_FEATURE_SPEC_CTRL))
> + __disable_indirect_speculation();
> + else
> + /*
> + * If we intended to disable indirect speculation
> + * but come here due to mis-speculation, we need
> + * to stop the mis-speculation with rmb.
> + */
> + rmb();

Code is lacking {}, also the comment doesn't make sense. If we don't
have the MSR, why are we doing an LFENCE?

And why are these boot_cpu_has() and not static_cpu_has() ?