From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id C017BC001B0 for ; Sat, 12 Aug 2023 03:00:02 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234632AbjHLDAB (ORCPT ); Fri, 11 Aug 2023 23:00:01 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:53074 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234317AbjHLDAA (ORCPT ); Fri, 11 Aug 2023 23:00:00 -0400 Received: from mail-pj1-x104a.google.com (mail-pj1-x104a.google.com [IPv6:2607:f8b0:4864:20::104a]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 605D230EC for ; Fri, 11 Aug 2023 19:59:59 -0700 (PDT) Received: by mail-pj1-x104a.google.com with SMTP id 98e67ed59e1d1-268136a93b3so2913842a91.3 for ; Fri, 11 Aug 2023 19:59:59 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20221208; t=1691809199; x=1692413999; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:from:to:cc:subject:date:message-id:reply-to; bh=lYtGFhRIF3a7yomMcivmbgdKn93U1qRaBLx6Bg8h8rk=; b=E+MYHTAy1msmFnQy4eHSPpLWsDNzx24BKdirkeIUx+yl2SzuIfz8TD7Rm6EN23Dhyj dKnH48eiCYdcKvHjNJUlKvovq7PgKRC2yltx9tnW6KGwHFXEk5ZFjsRQ96WZo6Rj/aFx 4wzfMiqhJ5LCsP/inbTpol8L5m3jBRFSdXVPkywPaXe9jVkSxgDZDkwvlCa21bXK4/2M XUn12FxeooPUfzEOA/qB+anXA3KwCOLyKEKR0hpdlvMdDfxMuD/yfkR/6NpN4prChZtM Ba7417gebkaN/g0y+pUoF6FwTWyxqccEj051j640rpNiUcZi/4fkvIywiugeXLGjlNP5 Zieg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1691809199; x=1692413999; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=lYtGFhRIF3a7yomMcivmbgdKn93U1qRaBLx6Bg8h8rk=; b=PQV1VeEwSwpAL8zpiagddyy/NY/itQr8xTgRyQ4g+2mnhNeZaetsD6ZtL8BTRdw59P NLbPrOF8cjeZFMc92DYu2XxRkArj2uRj/a/Z5hQvTBT4Ap8dmbf3kS3oiSeozHryaOZm mxyChg22TFwmVTZvaT4Y6eA6XWzDF9rky9gPAqpC8b1OJarjcfYAXxkrntmJDYhMYXmy Y3357Fim5XdHA3SWCeeoEOfVD/hdaMirCuBal8NBznEd5243qEY6pyTR+Q79SLO2oxQH P/BNh/tV7JB3mcKsduRzrXUJfo7T3sFWu5MhfyBdZZLRgoND4Y5DVc5tk4kktha56vAZ lLrA== X-Gm-Message-State: AOJu0Yz85Pw/2vyg8mo6vk7x6nqRLACg+l0emP9YzvdRNHzZM2/JaFmh Rel5IIjcA9lpriuXKxn1jNxDdGNhqXk= X-Google-Smtp-Source: AGHT+IHRNQFfk8YmRBI7eNsxZhwUc6Xw54mH9pKv6vQ6lZ4kaC4BEdmwJgdAhYvxJJzYUFVu9ATUFsySxPs= X-Received: from zagreus.c.googlers.com ([fda3:e722:ac3:cc00:7f:e700:c0a8:5c37]) (user=seanjc job=sendgmr) by 2002:a17:90a:4615:b0:268:776:e26 with SMTP id w21-20020a17090a461500b0026807760e26mr792296pjg.5.1691809198717; Fri, 11 Aug 2023 19:59:58 -0700 (PDT) Date: Fri, 11 Aug 2023 19:59:57 -0700 In-Reply-To: <20230811180528.GJZNZ4aIHCn3zMaida@fat_crate.local> Mime-Version: 1.0 References: <20230811155255.250835-1-seanjc@google.com> <20230811180528.GJZNZ4aIHCn3zMaida@fat_crate.local> Message-ID: Subject: Re: [PATCH] x86/retpoline: Don't clobber RFLAGS during srso_safe_ret() From: Sean Christopherson To: Borislav Petkov Cc: Thomas Gleixner , Ingo Molnar , Dave Hansen , x86@kernel.org, linux-kernel@vger.kernel.org, Srikanth Aithal , kvm@vger.kernel.org, Paolo Bonzini Content-Type: text/plain; charset="us-ascii" Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Fri, Aug 11, 2023, Borislav Petkov wrote: > On Fri, Aug 11, 2023 at 08:52:55AM -0700, Sean Christopherson wrote: > > A major motivation for doing fast emulation is to leverage the CPU to > > handle consumption and manipulation of arithmetic flags, i.e. RFLAGS is > > both an input and output to the target of the call. fastop() collects > > the RFLAGS result by pushing RFLAGS onto the stack and popping them back > > into a variable (held in RDI in this case) > > > > asm("push %[flags]; popf; " CALL_NOSPEC " ; pushf; pop %[flags]\n" > > Right, and I've tested this countless times with gcc-built host and > guest. > > But Nathan's case where the host is built with gcc but the guest with > clang, would trigger this. And as he confirms, that fixes it so I wonder > what is the difference in code generation to make this rFLAGS corruption > noticeable in that particular configuration. Might be I/O APIC accesses? Unless things have changed, the I/O APIC code uses a struct overlay to access the I/O APIC, i.e. when doing emulated MMIO accesses. If clang generates an ADD or whatever and consumes flags, e.g. instead of a straight MOV, that would explain the problems.