linux-kernel - Re: [PATCH 5/6] x86/mm/kaiser: Optimize RESTORE

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 29 Nov 2017 21:06:08 +0100
From:   Peter Zijlstra <peterz@...radead.org>
To:     Borislav Petkov <bp@...en8.de>
Cc:     linux-kernel@...r.kernel.org, Thomas Gleixner <tglx@...utronix.de>,
        Dave Hansen <dave.hansen@...ux.intel.com>,
        Andy Lutomirski <luto@...nel.org>,
        Ingo Molnar <mingo@...nel.org>,
        Brian Gerst <brgerst@...il.com>,
        Denys Vlasenko <dvlasenk@...hat.com>,
        "H. Peter Anvin" <hpa@...or.com>,
        Josh Poimboeuf <jpoimboe@...hat.com>,
        Linus Torvalds <torvalds@...ux-foundation.org>,
        Rik van Riel <riel@...hat.com>, daniel.gruss@...k.tugraz.at,
        hughd@...gle.com, keescook@...gle.com, linux-mm@...ck.org,
        michael.schwarz@...k.tugraz.at, moritz.lipp@...k.tugraz.at,
        richard.fellner@...dent.tugraz.at
Subject: Re: [PATCH 5/6] x86/mm/kaiser: Optimize RESTORE_CR3

On Wed, Nov 29, 2017 at 09:02:12PM +0100, Borislav Petkov wrote:
> On Wed, Nov 29, 2017 at 11:33:06AM +0100, Peter Zijlstra wrote:
> > +.macro RESTORE_CR3 scratch_reg:req save_reg:req
> >  	STATIC_JUMP_IF_FALSE .Lend_\@, kaiser_enabled_key, def=1
> > +
> > +	/* ASID bit 11 is for user */
> > +	bt	$11, \save_reg
> 
> <---- newline here.

Seems weird to me, the bt and jnc are a pair.

> > +	/*
> > +	 * KERNEL pages can always resume with NOFLUSH as we do
> > +	 * explicit flushes.
> > +	 */
> > +	jnc	.Lnoflush_\@
> > +
> > +	/*
> > +	 * Check if there's a pending flush for the user ASID we're
> > +	 * about to set.
> > +	 */
> > +	movq	\save_reg, \scratch_reg
> > +	andq	$(0x7FF), \scratch_reg
> > +	bt	\scratch_reg, PER_CPU_VAR(user_asid_flush_mask)
> > +	jnc	.Lnoflush_\@
> > +
> > +	btr	\scratch_reg, PER_CPU_VAR(user_asid_flush_mask)
> > +	jmp	.Ldo_\@
> 
> Can you save yourself one of the BT-insns?
> 
> 	...
> 	andq	$(0x7FF), \scratch_reg
> 	btr     \scratch_reg, PER_CPU_VAR(user_asid_flush_mask)
> 	jnc	.Lnoflush_\@
> 	jmp     .Ldo_\@
> 	...
> 
> or am I missing a case?

BTR is an unconditional write and will modify the line and cause a
write-back later. The common case is the bit not set, so BT, which is a
pure read, avoids all that overhead.