From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mgamail.intel.com (mgamail.intel.com [198.175.65.13]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9D11033D503; Tue, 7 Apr 2026 16:40:23 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=198.175.65.13 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775580025; cv=none; b=Fl620CBWXWtV6AGNdUdpwftslP8XmXD3DtW+lOE7c0fPoFnYMYHA0uwyLo45ppiGWJdWa5bUeR46WYesHU6EvabmKEkntqL6BTmbRHRz9IzyQMKkG4XaO1tGDAuBb3XMc481BBdKzLVZDYBmTkhJmWRS4Yg89Sq4iyge9fjGYbc= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775580025; c=relaxed/simple; bh=nsNk+m1U1O7MBKbu/CYvzHo0+/vkOLwcKiiXUS1DM8c=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=kpwFkESLg7wxpa2o0Rpa8VPm51+Ivnk7pImWUSl++ttnuWmeU7kiLcEV1zBbjzbHEyNvzarbVoiNFRGn8E4iUNugEVu8f4f4w3ZJVQ6XzLQkDDVMu5KxH+sOMEanwhNSZyvxeAoxnFyOCYKw0/2hu8J1Iqr7o9cGBXYXlD8/e9c= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.intel.com; spf=pass smtp.mailfrom=linux.intel.com; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b=ecyyYJ9O; arc=none smtp.client-ip=198.175.65.13 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.intel.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.intel.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b="ecyyYJ9O" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1775580024; x=1807116024; h=date:from:to:cc:subject:message-id:references: mime-version:in-reply-to; bh=nsNk+m1U1O7MBKbu/CYvzHo0+/vkOLwcKiiXUS1DM8c=; b=ecyyYJ9O/K42ZK951+V34dwod3nsnLIK7y4Mx1V5Wm4O1L7HxkJ+SZB8 Q+NlMk82JPHitQSHFQ1+SDahyoXrZtdeIArgcMnNzYfconnE/tmtLhYPx ooE+qZjwUtdOX5+iFoVHkQ6VS6plWgj9EhkLOopGlv6og2piwGqZ07LBn 681UDThANjhak9zaxKwYwp+MUlz9mw6qhoVZh5PWfjPUF8jBLJ8xb9XA7 47Tz8yyb8F4WlrI3vceCvJ9nykY+reJzRf3MPxBQXHVbe4QAnaMy8nm5d xEx0+DmBidSZNYfJ2sjjTFiW4K3zzxUjxqzkgBI4PrRQQ46h0NupjhPbx g==; X-CSE-ConnectionGUID: Yk7xXxzVQ6u1z/cOkYJSYA== X-CSE-MsgGUID: nw2gMkEVSG+Ve5+jZNlFgQ== X-IronPort-AV: E=McAfee;i="6800,10657,11752"; a="87621811" X-IronPort-AV: E=Sophos;i="6.23,165,1770624000"; d="scan'208";a="87621811" Received: from fmviesa006.fm.intel.com ([10.60.135.146]) by orvoesa105.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 07 Apr 2026 09:40:23 -0700 X-CSE-ConnectionGUID: 8idVG0XDSsGlJyor670AcA== X-CSE-MsgGUID: emyxsDskSa+EHfSdwjhCvg== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="6.23,165,1770624000"; d="scan'208";a="223437849" Received: from guptapa-desk.jf.intel.com (HELO desk) ([10.165.239.46]) by fmviesa006-auth.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 07 Apr 2026 09:40:21 -0700 Date: Tue, 7 Apr 2026 09:39:58 -0700 From: Pawan Gupta To: Jim Mattson Cc: x86@kernel.org, Jon Kohler , Nikolay Borisov , "H. Peter Anvin" , Josh Poimboeuf , David Kaplan , Sean Christopherson , Borislav Petkov , Dave Hansen , Peter Zijlstra , Alexei Starovoitov , Daniel Borkmann , Andrii Nakryiko , KP Singh , Jiri Olsa , "David S. Miller" , David Laight , Andy Lutomirski , Thomas Gleixner , Ingo Molnar , David Ahern , Martin KaFai Lau , Eduard Zingerman , Song Liu , Yonghong Song , John Fastabend , Stanislav Fomichev , Hao Luo , Paolo Bonzini , Jonathan Corbet , linux-kernel@vger.kernel.org, kvm@vger.kernel.org, Asit Mallick , Tao Zhang , bpf@vger.kernel.org, netdev@vger.kernel.org, linux-doc@vger.kernel.org, chao.gao@intel.com Subject: Re: [PATCH v9 02/10] x86/bhi: Make clear_bhb_loop() effective on newer CPUs Message-ID: <20260407163943.y6tkh26z2rfktn3y@desk> References: <20260403213445.xzb4rxbfbg5un7li@desk> <20260403231608.zopnhnypdclzqlx7@desk> <20260403233329.fb2ppifgwm3um6ny@desk> <20260404002149.wtayv6a64vzuppgp@desk> <20260404034954.t7iapenzvhdpagxp@desk> Precedence: bulk X-Mailing-List: netdev@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: On Mon, Apr 06, 2026 at 07:23:25AM -0700, Jim Mattson wrote: > Yes, but the guest needs a way to determine whether the hypervisor > will do what's necessary to make the short sequence effective. And, in > particular, no KVM hypervisor today is prepared to do that. > > When running under a hypervisor, without BHI_CTRL and without any > evidence to the contrary, the guest must assume that the longer > sequence is necessary. At the very least, we need a CPUID or MSR bit > that says, "the short BHB clearing sequence is adequate for this > vCPU." After discussing this internally, the consensus is that the best path forward is to add virtual SPEC_CTRL support to KVM, which also aligns with Intel's guidance. In the long term, virtual SPEC_CTRL can benefit future mitigations as well. As with many other mitigations (e.g. microcode), the guest would rely on the host to enforce the appropriate protections.