linux-kernel - Re: [RFC][PATCH 15/22] x86,vmx: Remove .fixup usage

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Sat, 6 Nov 2021 08:05:51 +0100
From:   Paolo Bonzini <pbonzini@...hat.com>
To:     Sean Christopherson <seanjc@...gle.com>,
        Peter Zijlstra <peterz@...radead.org>
Cc:     x86@...nel.org, linux-kernel@...r.kernel.org, jpoimboe@...hat.com,
        mark.rutland@....com, dvyukov@...gle.com, mbenes@...e.cz
Subject: Re: [RFC][PATCH 15/22] x86,vmx: Remove .fixup usage

On 11/5/21 19:17, Sean Christopherson wrote:
> On Thu, Nov 04, 2021, Peter Zijlstra wrote:
>> In the vmread exceptin path, use the, thus far, unused output register
>> to push the @fault argument onto the stack. This, in turn, enables the
>> exception handler to not do pushes and only modify that register when
>> an exception does occur.
>>
>> Signed-off-by: Peter Zijlstra (Intel) <peterz@...radead.org>
>> ---
>>   arch/x86/kvm/vmx/vmx_ops.h |   14 ++++++--------
>>   1 file changed, 6 insertions(+), 8 deletions(-)
>>
>> --- a/arch/x86/kvm/vmx/vmx_ops.h
>> +++ b/arch/x86/kvm/vmx/vmx_ops.h
>> @@ -80,9 +80,11 @@ static __always_inline unsigned long __v
>>   		      * @field, and bounce through the trampoline to preserve
>>   		      * volatile registers.
>>   		      */
>> -		     "push $0\n\t"
>> +		     "xorl %k1, %k1\n\t"
>> +		     "2:\n\t"
>> +		     "push %1\n\t"
>>   		     "push %2\n\t"
> 
> This trick doesn't work if the compiler selects the same GPR for %1 and %2, as
> the "field" will get lost.

Ouch, good catch.  It should be actually very simple to fix it, just 
mark "value" as an "early clobber" output:

       : ASM_CALL_CONSTRAINT, "=&r"(value) : "r"(field) : "cc");

That's an output which is written before the instruction is finished 
using the input operands.  The manual even says "this operand may not 
lie in a register that is read by the instruction or as part of any 
memory address", which is exactly what you caught with %1 and %2 both 
being the same GPR.

Paolo