Messages in this thread | | | Date | Thu, 22 Nov 2018 10:07:33 +0100 (CET) | From | Thomas Gleixner <> | Subject | Re: [patch 15/24] x86/speculation: Add command line control for indirect branch speculation |
| |
On Thu, 22 Nov 2018, Thomas Gleixner wrote: > On Thu, 22 Nov 2018, Borislav Petkov wrote: > > > + > > > + /* Initialize Indirect Branch Prediction Barrier */ > > > + if (boot_cpu_has(X86_FEATURE_IBPB)) { > > > + setup_force_cpu_cap(X86_FEATURE_USE_IBPB); > > > + pr_info("Spectre v2 mitigation: Enabling Indirect Branch Prediction Barrier\n"); > > > + } > > > > So AFAICT, if coming in here with AUTO, we won't enable IBPB and I > > *think* AMD wants IBPB enabled. At least the whitepaper says: > > > > "IBPB combined with Reptoline software support is the AMD recommended > > setting for Linux mitigation of Google Project Zero Variant 2 > > (Spectre)." > > Ok. That's indeed a step backwards, because we don't do IBPB in KVM > anymore. I'll fix that tomorrow morning when brain is more awake.
OTOH, off means that all of it is disabled. Which was the case already before this when spectre_v2=off is on the command line.
Now with the default to prctl/seccomp the IBPB in KVM is enabled. So no change there.
> IBPB on context switch is controlled separately anyway now, so that's a > nobrainer to sort out. > > Though I wait for Toms answer whether we really want IBPB on context switch > for AMD by default.
That still stands. But if we want to do that, then we need to optimize it a bit. Isn't that hard, but ...
Thanks,
tglx
| |