lkml.org 
[lkml]   [2022]   [Nov]   [7]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH 7/8] KVM: SVM: move MSR_IA32_SPEC_CTRL save/restore to assembly
On 11/7/22 19:45, Jim Mattson wrote:
>> +.macro RESTORE_GUEST_SPEC_CTRL
>> + /* No need to do anything if SPEC_CTRL is unset or V_SPEC_CTRL is set */
>> + ALTERNATIVE_2 "jmp 999f", \
>> + "", X86_FEATURE_MSR_SPEC_CTRL, \
>> + "jmp 999f", X86_FEATURE_V_SPEC_CTRL
>> +
>> + /*
>> + * SPEC_CTRL handling: if the guest's SPEC_CTRL value differs from the
>> + * host's, write the MSR.
>> + *
>> + * IMPORTANT: To avoid RSB underflow attacks and any other nastiness,
>> + * there must not be any returns or indirect branches between this code
>> + * and vmentry.
>> + */
>> + movl SVM_spec_ctrl(%_ASM_DI), %eax
>> + cmp PER_CPU_VAR(x86_spec_ctrl_current), %eax
>> + je 999f
>> + mov $MSR_IA32_SPEC_CTRL, %ecx
>> + xor %edx, %edx
>> + wrmsr
>> +999:
>> +
>> +.endm
>> +
>> +.macro RESTORE_HOST_SPEC_CTRL
>> + /* No need to do anything if SPEC_CTRL is unset or V_SPEC_CTRL is set */
>> + ALTERNATIVE_2 "jmp 999f", \
>> + "", X86_FEATURE_MSR_SPEC_CTRL, \
>> + "jmp 999f", X86_FEATURE_V_SPEC_CTRL
>> +
>> + mov $MSR_IA32_SPEC_CTRL, %ecx
>> +
>> + /*
>> + * Load the value that the guest had written into MSR_IA32_SPEC_CTRL,
>> + * if it was not intercepted during guest execution.
>> + */
>> + cmpb $0, (%_ASM_SP)
>> + jnz 998f
>> + rdmsr
>> + movl %eax, SVM_spec_ctrl(%_ASM_DI)
>> +998:
>> +
>> + /* Now restore the host value of the MSR if different from the guest's. */
>> + movl PER_CPU_VAR(x86_spec_ctrl_current), %eax
>> + cmp SVM_spec_ctrl(%_ASM_DI), %eax
>> + je 999f
>> + xor %edx, %edx
>> + wrmsr
>> +999:
>> +
>> +.endm
>> +
>> +
>
> It seems unfortunate to have the unconditional branches in the more
> common cases.

One way to do it could be something like

.macro RESTORE_HOST_SPEC_CTRL
ALTERNATIVE_2 "", \
"jmp 900f", X86_FEATURE_MSR_SPEC_CTRL, \
"", X86_FEATURE_V_SPEC_CTRL \
901:
.endm

.macro RESTORE_SPEC_CTRL_BODY \
800:
/* restore guest spec ctrl ... */
jmp 801b

900:
/* save guest spec ctrl + restore host ... */
jmp 901b
.endm

The cmp/je pair can also jump back to 801b/901b.

What do you think? I'll check if objtool is happy and if so include it
in v2.

Paolo

\
 
 \ /
  Last update: 2022-11-07 20:12    [W:0.578 / U:1.292 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site