Re: Intended behavior/usage of SSBD setting

[Jan Beulich <jbeulich@xxxxxxxx>]

On 20.10.2022 14:37, Roger Pau Monné wrote:
> On Thu, Oct 20, 2022 at 01:22:20PM +0200, Jan Beulich wrote:
>> On 20.10.2022 13:01, Roger Pau Monné wrote:
>>> Hello,
>>>
>>> As part of some follow up improvements to my VIRT_SPEC_CTRL series we
>>> have been discussing what the usage of SSBD should be for the
>>> hypervisor itself.  There's currently a `spec-ctrl=ssbd` option [0],
>>> that has an out of date description, as now SSBD is always offered to
>>> guests on AMD hardware, either using SPEC_CTRL or VIRT_SPEC_CTRL.
>>>
>>> It has been pointed out by Andrew that toggling SSBD on AMD using
>>> VIRT_SPEC_CTRL or the non-architectural way (MSR_AMD64_LS_CFG) can
>>> have a high impact on performance, and hence switching it on every
>>> guest <-> hypervisor context switch is likely a very high
>>> performance penalty.
>>>
>>> It's been suggested that it could be more appropriate to run Xen with
>>> the guest SSBD selection on those systems, however that clashes with
>>> the current intent of the `spec-ctrl=ssbd` option.
>>>
>>> I hope I have captured the expressed opinions correctly in the text
>>> above.
>>>
>>> I see two ways to solve this:
>>>
>>>  * Keep the current logic for switching SSBD on guest <-> hypervisor
>>>    context switch, but only use it if `spec-ctrl=ssbd` is set on the
>>>    command line.
>>>
>>>  * Remove the logic for switching SSBD on guest <-> hypervisor context
>>>    switch, ignore setting of `spec-ctrl=ssbd` on those systems and run
>>>    hypervisor code with the guest selection of SSBD.
>>
>> * Give the guest the illusion of controlling the behavior, but run with
>>   SSBD always enabled when "spec-ctrl=ssbd" is in effect.
> 
> Right, I've also thought about this option but forgot to add it to the
> list. That would limit to only allowing enabling ssbd for the
> hypervisor code, but not explicitly disabling it, ie:
> `spec-ctrl=no-ssbd` won't be a valid option.

Well, it would be valid to use to override an earlier "spec-ctrl=ssbd",
to revert back to whatever the behavior is when no option is specified
at all. It wouldn't strictly mean "no SSBD at all".

>> * Give the guest the illusion of controlling the behavior when
>>   "spec-ctrl=ssbd" is in effect, running with the OR of guest and host
>>   settings (switched, if necessary, as vCPU-s are context-switched).
> 
> Right, this could somehow reduce the number of toggling, but would
> still require having code to handle guest <-> hypervisor context
> switches.

Why? When we're running with the OR of both values, there's no need to
switch when exiting or entering guest context. The only time an
adjustment would be needed is when the guest setting changes (because
of the guest altering the setting, or when switching vCPU-s); obviously
never when the host setting is "on".

Actually I now think that the two points I added actually describe the
same mode, just by somewhat different wording.

Jan