From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mgamail.intel.com (mgamail.intel.com [198.175.65.20]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6829F33C182; Wed, 25 Mar 2026 18:45:00 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=198.175.65.20 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774464302; cv=none; b=H2N2PLRIvGiuXjMIkwpLQpUTRDsvz8pCaMTgV0Qf+QO7gr6lh1r7oTZJArLJvL80mmXNIRe1tWbPm2ife/brLwvgngJSeaSLaMnm8hPWPFE+baqJ0qm8ILrMecTp7AYViDkkV+/XX3MWs8mNzmHFrTasxi6RFg4dE24Orbkgc3I= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774464302; c=relaxed/simple; bh=zalW9eqZ+xlnOVkgVJJnOnpqxej4tDRqBlTwGTbwGXA=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=IlaBvwouzLJs0g0dOoebn5fxGE0PEefhaPEbhzqVobPfxQAPVgComqV6jC1ugYgyB/wqeKuKOY8lZNKHtGx5n+pUXSg3hyWfG8w/2+IFntBqPVSN7AX0mALGavXktcumgjRP17Ter/ABBPblBiEmtL2op6yiHfLu3hYxX21dTIk= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.intel.com; spf=pass smtp.mailfrom=linux.intel.com; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b=WUt5dQSU; arc=none smtp.client-ip=198.175.65.20 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.intel.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.intel.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b="WUt5dQSU" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1774464300; x=1806000300; h=date:from:to:cc:subject:message-id:references: mime-version:content-transfer-encoding:in-reply-to; bh=zalW9eqZ+xlnOVkgVJJnOnpqxej4tDRqBlTwGTbwGXA=; b=WUt5dQSUwdhnKs5f+h1FzxGDpfYfDWJa1X4PQEwkaf2qnvLLM6kzyHCY CiT8i04cYGVxHLT7wB5KmbiqcrBDauqLaFvCHzk0SiiR0wgWKiBL4PjMz rsSmnHMcqV6wb8usbtXNmHcQvmwdeTUfQPCk1bAiXez+70qq8Ys0g6IOb /FN4rcog65ao6R5XolTysD6YFPGB16Wlj1dDAtHOrShsmerPEp6uXK4dQ k9g0kgRRlzpUthUulVboohDVgm8ItN+bBJb7cAYjX2xtrI21BaB6b0DMr vv8cX/5oUah1FS9eJjpp5f3qPEpJcUEw9DiWKwMvB3l7v1cX1it1b+2sr w==; X-CSE-ConnectionGUID: JcA/kONdRI+RQpXrVNditQ== X-CSE-MsgGUID: JrbVpbSHToqLMsQQq6viww== X-IronPort-AV: E=McAfee;i="6800,10657,11740"; a="75229053" X-IronPort-AV: E=Sophos;i="6.23,140,1770624000"; d="scan'208";a="75229053" Received: from fmviesa005.fm.intel.com ([10.60.135.145]) by orvoesa112.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 25 Mar 2026 11:44:59 -0700 X-CSE-ConnectionGUID: mrpuvO0tQcSc5PUPJGSn3w== X-CSE-MsgGUID: Rm90cqjAREWRCqh81LoaDg== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="6.23,140,1770624000"; d="scan'208";a="229541708" Received: from guptapa-desk.jf.intel.com (HELO desk) ([10.165.239.46]) by fmviesa005-auth.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 25 Mar 2026 11:44:59 -0700 Date: Wed, 25 Mar 2026 11:44:53 -0700 From: Pawan Gupta To: Jim Mattson Cc: x86@kernel.org, Jon Kohler , Nikolay Borisov , "H. Peter Anvin" , Josh Poimboeuf , David Kaplan , Sean Christopherson , Borislav Petkov , Dave Hansen , Peter Zijlstra , Alexei Starovoitov , Daniel Borkmann , Andrii Nakryiko , KP Singh , Jiri Olsa , "David S. Miller" , David Laight , Andy Lutomirski , Thomas Gleixner , Ingo Molnar , David Ahern , Martin KaFai Lau , Eduard Zingerman , Song Liu , Yonghong Song , John Fastabend , Stanislav Fomichev , Hao Luo , Paolo Bonzini , Jonathan Corbet , linux-kernel@vger.kernel.org, kvm@vger.kernel.org, Asit Mallick , Tao Zhang , bpf@vger.kernel.org, netdev@vger.kernel.org, linux-doc@vger.kernel.org Subject: Re: [PATCH v8 02/10] x86/bhi: Make clear_bhb_loop() effective on newer CPUs Message-ID: <20260325184453.njfyuhqdamu7ihzi@desk> References: <20260324-vmscape-bhb-v8-0-68bb524b3ab9@linux.intel.com> <20260324-vmscape-bhb-v8-2-68bb524b3ab9@linux.intel.com> Precedence: bulk X-Mailing-List: netdev@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: On Wed, Mar 25, 2026 at 10:50:58AM -0700, Jim Mattson wrote: > On Tue, Mar 24, 2026 at 11:19 AM Pawan Gupta > wrote: > > > > As a mitigation for BHI, clear_bhb_loop() executes branches that overwrites > > the Branch History Buffer (BHB). On Alder Lake and newer parts this > > sequence is not sufficient because it doesn't clear enough entries. This > > was not an issue because these CPUs have a hardware control (BHI_DIS_S) > > that mitigates BHI in kernel. > > > > BHI variant of VMSCAPE requires isolating branch history between guests and > > userspace. Note that there is no equivalent hardware control for userspace. > > To effectively isolate branch history on newer CPUs, clear_bhb_loop() > > should execute sufficient number of branches to clear a larger BHB. > > > > Dynamically set the loop count of clear_bhb_loop() such that it is > > effective on newer CPUs too. Use the hardware control enumeration > > X86_FEATURE_BHI_CTRL to select the appropriate loop count. > > > > Suggested-by: Dave Hansen > > Reviewed-by: Nikolay Borisov > > Signed-off-by: Pawan Gupta > > --- > > arch/x86/entry/entry_64.S | 21 ++++++++++++++++----- > > arch/x86/net/bpf_jit_comp.c | 7 ------- > > 2 files changed, 16 insertions(+), 12 deletions(-) > > > > diff --git a/arch/x86/entry/entry_64.S b/arch/x86/entry/entry_64.S > > index 3a180a36ca0e..8128e00ca73f 100644 > > --- a/arch/x86/entry/entry_64.S > > +++ b/arch/x86/entry/entry_64.S > > @@ -1535,8 +1535,17 @@ SYM_CODE_END(rewind_stack_and_make_dead) > > SYM_FUNC_START(clear_bhb_loop) > > ANNOTATE_NOENDBR > > push %rbp > > + /* BPF caller may require %rax to be preserved */ > > + push %rax > > Shouldn't the "push %rax" come after "mov %rsp, %rbp"? Right, thanks for catching that. > > mov %rsp, %rbp > > - movl $5, %ecx