public inbox for linux-kernel@vger.kernel.org
 help / color / mirror / Atom feed
* [RFC PATCH 0/7] KVM: SVM: move MSR_IA32_SPEC_CTRL save/restore to assembly
@ 2022-10-28 23:07 Paolo Bonzini
  2022-10-28 23:07 ` [PATCH 1/7] KVM: VMX: remove regs argument of __vmx_vcpu_run Paolo Bonzini
                   ` (6 more replies)
  0 siblings, 7 replies; 17+ messages in thread
From: Paolo Bonzini @ 2022-10-28 23:07 UTC (permalink / raw)
  To: linux-kernel, kvm; +Cc: jmattson, seanjc, jpoimboe

On the Intel side, restoration of the guest's IA32_SPEC_CTRL is done
as late as possible before vmentry, with the comment:

* IMPORTANT: To avoid RSB underflow attacks and any other nastiness,
* there must not be any returns or indirect branches between this code
* and vmentry.

On AMD, there is no need to avoid returns or indirect branches between
wrmsr and vmrun because Linux doesn't use IBRS; however, restoration
of the host IA32_SPEC_CTRL value is definitely way too late. With
respect to the user/kernel boundary, AMD says, "If software chooses to
toggle STIBP (e.g., set STIBP on kernel entry, and clear it on kernel
exit), software should set STIBP to 1 before executing the return thunk
training sequence." Assuming the same requirements apply to the guest/host
boundary, KVM does not respect this recommendation: the return thunk
training sequence is in vmenter.S, quite close to the VM-exit, while
the host's IA32_SPEC_CTRL value is only restored much later for hosts
without V_SPEC_CTRL.

In the absence of clarifications for AMD, move all the SPEC_CTRL
handling to assembly code and, in passing, also make the Intel and AMD
code a bit more similar to each other.

Patches 1-2 are the Intel side, which is just a cleanup.

Patch 3 prepares for adding asm-offsets.c entries in arch/x86/kvm/svm/svm.h,
and patches 4-5 are a similar cleanup to the earlier VMX ones.

Patch 6 is the bulk of the change, and finally patch 7 removes now
dead code in asm/spec-ctrl.h and arch/x86/kernel/.

This is RFC because I haven't tested SEV-ES or 32-bit yet.

Paolo

Paolo Bonzini (7):
  KVM: VMX: remove regs argument of __vmx_vcpu_run
  KVM: VMX: more cleanups to __vmx_vcpu_run
  KVM: SVM: extract VMCB accessors to a new file
  KVM: SVM: replace argument of __svm_vcpu_run with vcpu_svm
  KVM: SVM: adjust register allocation for __svm_vcpu_run
  KVM: SVM: move MSR_IA32_SPEC_CTRL save/restore to assembly
  x86, KVM: remove unnecessary argument to x86_virt_spec_ctrl and
    callers

 arch/x86/include/asm/spec-ctrl.h |  10 +-
 arch/x86/kernel/asm-offsets.c    |   8 ++
 arch/x86/kernel/cpu/bugs.c       |  15 +--
 arch/x86/kvm/svm/avic.c          |   1 +
 arch/x86/kvm/svm/nested.c        |   1 +
 arch/x86/kvm/svm/sev.c           |   1 +
 arch/x86/kvm/svm/svm.c           |  39 +++---
 arch/x86/kvm/svm/svm.h           | 204 +-----------------------------
 arch/x86/kvm/svm/svm_onhyperv.c  |   1 +
 arch/x86/kvm/svm/vmcb.h          | 211 +++++++++++++++++++++++++++++++
 arch/x86/kvm/svm/vmenter.S       | 164 ++++++++++++++++++------
 arch/x86/kvm/vmx/nested.c        |   3 +-
 arch/x86/kvm/vmx/vmenter.S       |  92 ++++++--------
 arch/x86/kvm/vmx/vmx.c           |   3 +-
 arch/x86/kvm/vmx/vmx.h           |   3 +-
 15 files changed, 419 insertions(+), 337 deletions(-)
 create mode 100644 arch/x86/kvm/svm/vmcb.h

-- 
2.31.1


^ permalink raw reply	[flat|nested] 17+ messages in thread
* [PATCH 0/7] KVM: VMX/SVM: use the same SPEC_CTRL assembly code
@ 2026-04-08 18:22 Paolo Bonzini
  2026-04-08 18:22 ` [PATCH 1/7] KVM: VMX: remove regs argument of __vmx_vcpu_run Paolo Bonzini
  0 siblings, 1 reply; 17+ messages in thread
From: Paolo Bonzini @ 2026-04-08 18:22 UTC (permalink / raw)
  To: linux-kernel, kvm; +Cc: seanjc, chang.seok.bae

As discussed in the APX thread, this series moves the SPEC_CTRL
handling for VMX entirely to vmenter.S, and while at it improves
the code reuse between SVM and VMX.

The prototype of __vmx_vcpu_run() and __svm_vcpu_run() becomes
the same, with a set of bit flags for the second argument (which
can be augmented with an extra bit for whether to save/restore APX).
The register allocation also becomes very similar, with %edi/%rdi
pointing to the vmx (resp. svm) argument (patches 1-4).

(In fact, most of this was already done at the time of commit 9f2febf3f04d
and predecessors, but I had never tested it and submitted it... because
well, assembly is scary).

Thanks to this, the code to restore the guest SPEC_CTRL value is the
same up to the register names and can be dropped into vmx/vmenter.S.
On the vmexit side the only change required is support for
X86_FEATURE_KERNEL_IBRS, which is a single ALTERNATIVE macro.

Paolo

Paolo Bonzini (7):
  KVM: VMX: remove regs argument of __vmx_vcpu_run
  KVM: VMX: more cleanups to __vmx_vcpu_run
  KVM: SVM: prepare for making SPEC_CTRL switch common with VMX
  KVM: SVM: adopt the same VMX_RUN_* flags as VMX
  KVM: SVM: extract RESTORE_*_SPEC_CTRL_BODY out of svm/vmenter.S
  KVM: VMX: switch to RESTORE_GUEST_SPEC_CTRL_BODY
  KVM: VMX: replace vmx_spec_ctrl_restore_host with
    RESTORE_HOST_SPEC_CTRL_BODY

 arch/x86/kvm/kvm-asm-offsets.c |   1 +
 arch/x86/kvm/svm/svm.c         |  14 ++-
 arch/x86/kvm/svm/vmenter.S     | 103 +++++--------------
 arch/x86/kvm/vmenter.h         |  75 ++++++++++++++
 arch/x86/kvm/vmx/run_flags.h   |   9 --
 arch/x86/kvm/vmx/vmenter.S     | 181 ++++++++++++++-------------------
 arch/x86/kvm/vmx/vmx.c         |  39 ++-----
 arch/x86/kvm/vmx/vmx.h         |   7 +-
 8 files changed, 194 insertions(+), 235 deletions(-)
 create mode 100644 arch/x86/kvm/vmenter.h
 delete mode 100644 arch/x86/kvm/vmx/run_flags.h

-- 
2.52.0


^ permalink raw reply	[flat|nested] 17+ messages in thread
end of thread, other threads:[~2026-04-08 18:22 UTC | newest]

Thread overview: 17+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2022-10-28 23:07 [RFC PATCH 0/7] KVM: SVM: move MSR_IA32_SPEC_CTRL save/restore to assembly Paolo Bonzini
2022-10-28 23:07 ` [PATCH 1/7] KVM: VMX: remove regs argument of __vmx_vcpu_run Paolo Bonzini
2022-10-31 17:37   ` Sean Christopherson
2022-11-01 17:32     ` Josh Poimboeuf
2022-11-01 18:03       ` Sean Christopherson
2022-11-02 17:42     ` Paolo Bonzini
2022-10-28 23:07 ` [PATCH 2/7] KVM: VMX: more cleanups to __vmx_vcpu_run Paolo Bonzini
2022-10-28 23:07 ` [PATCH 3/7] KVM: SVM: extract VMCB accessors to a new file Paolo Bonzini
2022-10-28 23:07 ` [PATCH 4/7] KVM: SVM: replace argument of __svm_vcpu_run with vcpu_svm Paolo Bonzini
2022-10-29 22:10   ` kernel test robot
2022-10-28 23:07 ` [PATCH 5/7] KVM: SVM: adjust register allocation for __svm_vcpu_run Paolo Bonzini
2022-10-28 23:07 ` [PATCH 6/7] KVM: SVM: move MSR_IA32_SPEC_CTRL save/restore to assembly Paolo Bonzini
2022-10-30  8:36   ` kernel test robot
2022-11-02 15:28   ` Josh Poimboeuf
2022-11-02 16:02     ` Paolo Bonzini
2022-10-28 23:07 ` [PATCH 7/7] x86, KVM: remove unnecessary argument to x86_virt_spec_ctrl and callers Paolo Bonzini
  -- strict thread matches above, loose matches on Subject: below --
2026-04-08 18:22 [PATCH 0/7] KVM: VMX/SVM: use the same SPEC_CTRL assembly code Paolo Bonzini
2026-04-08 18:22 ` [PATCH 1/7] KVM: VMX: remove regs argument of __vmx_vcpu_run Paolo Bonzini

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox