From: Peter Zijlstra <peterz@infradead.org>

Date: Tue, 14 Jun 2022 23:15:58 +0200

Subject: intel_idle: Disable IBRS during long idle

Git-commit: bf5835bcdb9635c97f85120dba9bfa21e111130f

Patch-mainline: v5.19-rc4

References: bsc#1199657 CVE-2022-29900 CVE-2022-29901

Having IBRS enabled while the SMT sibling is idle unnecessarily slows

down the running sibling. OTOH, disabling IBRS around idle takes two

MSR writes, which will increase the idle latency.

Therefore, only disable IBRS around deeper idle states. Shallow idle

states are bounded by the tick in duration, since NOHZ is not allowed

for them by virtue of their short target residency.

Only do this for mwait-driven idle, since that keeps interrupts disabled

across idle, which makes disabling IBRS vs IRQ-entry a non-issue.

Note: C6 is a random threshold, most importantly C1 probably shouldn't

disable IBRS, benchmarking needed.

Suggested-by: Tim Chen <tim.c.chen@linux.intel.com>

Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>

Signed-off-by: Borislav Petkov <bp@suse.de>

Reviewed-by: Josh Poimboeuf <jpoimboe@kernel.org>

Signed-off-by: Borislav Petkov <bp@suse.de>

---

 arch/x86/include/asm/nospec-branch.h |    1 

 arch/x86/kernel/cpu/bugs.c           |    6 +++

 drivers/idle/intel_idle.c            |   64 +++++++++++++++++++++++++++++++----

 3 files changed, 65 insertions(+), 6 deletions(-)

--- a/arch/x86/include/asm/nospec-branch.h

+++ b/arch/x86/include/asm/nospec-branch.h

@@ -345,6 +345,7 @@ static inline void unrestrict_branch_spe

 /* The Intel SPEC CTRL MSR base value cache */

 extern u64 x86_spec_ctrl_base;

 extern void write_spec_ctrl_current(u64 val, bool force);

+extern u64 spec_ctrl_current(void);

 /*

  * With retpoline, we must use IBRS to restrict branch prediction

--- a/arch/x86/kernel/cpu/bugs.c

+++ b/arch/x86/kernel/cpu/bugs.c

@@ -76,6 +76,12 @@ void write_spec_ctrl_current(u64 val, bo

 		wrmsrl(MSR_IA32_SPEC_CTRL, val);

 }

+u64 spec_ctrl_current(void)

+{

+	return this_cpu_read(x86_spec_ctrl_current);

+}

+EXPORT_SYMBOL_GPL(spec_ctrl_current);

+

 /*

  * The vendor and possibly platform specific bits which can be modified in

  * x86_spec_ctrl_base.

--- a/drivers/idle/intel_idle.c

+++ b/drivers/idle/intel_idle.c

@@ -56,11 +56,13 @@

 #include <linux/tick.h>

 #include <trace/events/power.h>

 #include <linux/sched.h>

+#include <linux/sched/smt.h>

 #include <linux/notifier.h>

 #include <linux/cpu.h>

 #include <linux/moduleparam.h>

 #include <asm/cpu_device_id.h>

 #include <asm/intel-family.h>

+#include <asm/nospec-branch.h>

 #include <asm/mwait.h>

 #include <asm/msr.h>

@@ -101,6 +103,12 @@ static void intel_idle_freeze(struct cpu

 static struct cpuidle_state *cpuidle_state_table;

 /*

+ * Disable IBRS across idle (when KERNEL_IBRS), is exclusive vs IRQ_ENABLE

+ * above.

+ */

+#define CPUIDLE_FLAG_IBRS		BIT(16)

+

+/*

  * Set this flag for states where the HW flushes the TLB for us

  * and so we don't need cross-calls to keep it consistent.

  * If this flag is set, SW flushes the TLB, so even if the

@@ -616,7 +624,7 @@ static struct cpuidle_state skl_cstates[

 	{

 		.name = "C6",

 		.desc = "MWAIT 0x20",

-		.flags = MWAIT2flg(0x20) | CPUIDLE_FLAG_TLB_FLUSHED,

+		.flags = MWAIT2flg(0x20) | CPUIDLE_FLAG_TLB_FLUSHED | CPUIDLE_FLAG_IBRS,

 		.exit_latency = 85,

 		.target_residency = 200,

 		.enter = &intel_idle,

@@ -624,7 +632,7 @@ static struct cpuidle_state skl_cstates[

 	{

 		.name = "C7s",

 		.desc = "MWAIT 0x33",

-		.flags = MWAIT2flg(0x33) | CPUIDLE_FLAG_TLB_FLUSHED,

+		.flags = MWAIT2flg(0x33) | CPUIDLE_FLAG_TLB_FLUSHED | CPUIDLE_FLAG_IBRS,

 		.exit_latency = 124,

 		.target_residency = 800,

 		.enter = &intel_idle,

@@ -632,7 +640,7 @@ static struct cpuidle_state skl_cstates[

 	{

 		.name = "C8",

 		.desc = "MWAIT 0x40",

-		.flags = MWAIT2flg(0x40) | CPUIDLE_FLAG_TLB_FLUSHED,

+		.flags = MWAIT2flg(0x40) | CPUIDLE_FLAG_TLB_FLUSHED | CPUIDLE_FLAG_IBRS,

 		.exit_latency = 200,

 		.target_residency = 800,

 		.enter = &intel_idle,

@@ -640,7 +648,7 @@ static struct cpuidle_state skl_cstates[

 	{

 		.name = "C9",

 		.desc = "MWAIT 0x50",

-		.flags = MWAIT2flg(0x50) | CPUIDLE_FLAG_TLB_FLUSHED,

+		.flags = MWAIT2flg(0x50) | CPUIDLE_FLAG_TLB_FLUSHED | CPUIDLE_FLAG_IBRS,

 		.exit_latency = 480,

 		.target_residency = 5000,

 		.enter = &intel_idle,

@@ -648,7 +656,7 @@ static struct cpuidle_state skl_cstates[

 	{

 		.name = "C10",

 		.desc = "MWAIT 0x60",

-		.flags = MWAIT2flg(0x60) | CPUIDLE_FLAG_TLB_FLUSHED,

+		.flags = MWAIT2flg(0x60) | CPUIDLE_FLAG_TLB_FLUSHED | CPUIDLE_FLAG_IBRS,

 		.exit_latency = 890,

 		.target_residency = 5000,

 		.enter = &intel_idle,

@@ -677,7 +685,7 @@ static struct cpuidle_state skx_cstates[

 	{

 		.name = "C6",

 		.desc = "MWAIT 0x20",

-		.flags = MWAIT2flg(0x20) | CPUIDLE_FLAG_TLB_FLUSHED,

+		.flags = MWAIT2flg(0x20) | CPUIDLE_FLAG_TLB_FLUSHED | CPUIDLE_FLAG_IBRS,

 		.exit_latency = 133,

 		.target_residency = 600,

 		.enter = &intel_idle,

@@ -934,6 +942,46 @@ static __cpuidle int intel_idle(struct c

 	return index;

 }

+/*

+ * MWAIT takes an 8-bit "hint" in EAX "suggesting"

+ * the C-state (top nibble) and sub-state (bottom nibble)

+ * 0x00 means "MWAIT(C1)", 0x10 means "MWAIT(C2)" etc.

+ *

+ * We store the hint at the top of our "flags" for each state.

+ */

+#define flg2MWAIT(flags) (((flags) >> 24) & 0xFF)

+#define MWAIT2flg(eax) ((eax & 0xFF) << 24)

+

+static __always_inline int __intel_idle(struct cpuidle_device *dev,

+					struct cpuidle_driver *drv, int index)

+{

+	struct cpuidle_state *state = &drv->states[index];

+	unsigned long eax = flg2MWAIT(state->flags);

+	unsigned long ecx = 1; /* break on interrupt flag */

+

+	mwait_idle_with_hints(eax, ecx);

+

+	return index;

+}

+

+static __cpuidle int intel_idle_ibrs(struct cpuidle_device *dev,

+				     struct cpuidle_driver *drv, int index)

+{

+	bool smt_active = sched_smt_active();

+	u64 spec_ctrl = spec_ctrl_current();

+	int ret;

+

+	if (smt_active)

+		wrmsrl(MSR_IA32_SPEC_CTRL, 0);

+

+	ret = __intel_idle(dev, drv, index);

+

+	if (smt_active)

+		wrmsrl(MSR_IA32_SPEC_CTRL, spec_ctrl);

+

+	return ret;

+}

+

 /**

  * intel_idle_freeze - simplified "enter" callback routine for suspend-to-idle

  * @dev: cpuidle_device

@@ -1366,6 +1414,10 @@ static void __init intel_idle_cpuidle_dr

 			continue;

 		}

+		if (cpu_feature_enabled(X86_FEATURE_KERNEL_IBRS) &&

+		    cpuidle_state_table[cstate].flags & CPUIDLE_FLAG_IBRS) {

+			drv->states[drv->state_count].enter = intel_idle_ibrs;

+		}

 		if (((mwait_cstate + 1) > 2) &&

 			!boot_cpu_has(X86_FEATURE_NONSTOP_TSC))