| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-Id: <20240703095712.64202-16-dapeng1.mi@linux.intel.com>
Date: Wed, 3 Jul 2024 09:57:09 +0000
From: Dapeng Mi <dapeng1.mi@...ux.intel.com>
To: Sean Christopherson <seanjc@...gle.com>,
Paolo Bonzini <pbonzini@...hat.com>
Cc: kvm@...r.kernel.org,
linux-kernel@...r.kernel.org,
Jim Mattson <jmattson@...gle.com>,
Mingwei Zhang <mizhang@...gle.com>,
Xiong Zhang <xiong.y.zhang@...el.com>,
Zhenyu Wang <zhenyuw@...ux.intel.com>,
Like Xu <like.xu.linux@...il.com>,
Jinrong Liang <cloudliang@...cent.com>,
Dapeng Mi <dapeng1.mi@...el.com>,
Dapeng Mi <dapeng1.mi@...ux.intel.com>
Subject: [Patch v5 15/18] x86: pmu: Add IBPB indirect jump asm blob
Currently the lower boundary of branch misses event is set to 0.
Strictly speaking 0 shouldn't be a valid count since it can't tell us if
branch misses event counter works correctly or even disabled. Whereas
it's also possible and reasonable that branch misses event count is 0
especailly for such simple loop() program with advanced branch
predictor.
To eliminate such ambiguity and make branch misses event verification
more acccurately, an extra IBPB indirect jump asm blob is appended and
IBPB command is leveraged to clear the branch target buffer and force to
cause a branch miss for the indirect jump.
Suggested-by: Jim Mattson <jmattson@...gle.com>
Signed-off-by: Dapeng Mi <dapeng1.mi@...ux.intel.com>
---
x86/pmu.c | 71 +++++++++++++++++++++++++++++++++++++++++++------------
1 file changed, 56 insertions(+), 15 deletions(-)
diff --git a/x86/pmu.c b/x86/pmu.c
index c9c5fc19..498b18d0 100644
--- a/x86/pmu.c
+++ b/x86/pmu.c
@@ -19,25 +19,52 @@
#define EXPECTED_INSTR 17
#define EXPECTED_BRNCH 5
-
-/* Enable GLOBAL_CTRL + disable GLOBAL_CTRL + clflush/mfence instructions */
-#define EXTRA_INSTRNS (3 + 3 + 2)
+#define IBPB_JMP_INSTRNS 9
+#define IBPB_JMP_BRANCHES 2
+
+#if defined(__i386__) || defined(_M_IX86) /* i386 */
+#define IBPB_JMP_ASM(_wrmsr) \
+ "mov $1, %%eax; xor %%edx, %%edx;\n\t" \
+ "mov $73, %%ecx;\n\t" \
+ _wrmsr "\n\t" \
+ "call 1f\n\t" \
+ "1: pop %%eax\n\t" \
+ "add $(2f-1b), %%eax\n\t" \
+ "jmp *%%eax;\n\t" \
+ "nop;\n\t" \
+ "2: nop;\n\t"
+#else /* x86_64 */
+#define IBPB_JMP_ASM(_wrmsr) \
+ "mov $1, %%eax; xor %%edx, %%edx;\n\t" \
+ "mov $73, %%ecx;\n\t" \
+ _wrmsr "\n\t" \
+ "call 1f\n\t" \
+ "1: pop %%rax\n\t" \
+ "add $(2f-1b), %%rax\n\t" \
+ "jmp *%%rax;\n\t" \
+ "nop;\n\t" \
+ "2: nop;\n\t"
+#endif
+
+/* GLOBAL_CTRL enable + disable + clflush/mfence + IBPB_JMP */
+#define EXTRA_INSTRNS (3 + 3 + 2 + IBPB_JMP_INSTRNS)
#define LOOP_INSTRNS (N * 10 + EXTRA_INSTRNS)
-#define LOOP_BRANCHES (N)
-#define LOOP_ASM(_wrmsr, _clflush) \
- _wrmsr "\n\t" \
+#define LOOP_BRANCHES (N + IBPB_JMP_BRANCHES)
+#define LOOP_ASM(_wrmsr1, _clflush, _wrmsr2) \
+ _wrmsr1 "\n\t" \
"mov %%ecx, %%edi; mov %%ebx, %%ecx;\n\t" \
_clflush "\n\t" \
"mfence;\n\t" \
"1: mov (%1), %2; add $64, %1;\n\t" \
"nop; nop; nop; nop; nop; nop; nop;\n\t" \
"loop 1b;\n\t" \
+ IBPB_JMP_ASM(_wrmsr2) \
"mov %%edi, %%ecx; xor %%eax, %%eax; xor %%edx, %%edx;\n\t" \
- _wrmsr "\n\t"
+ _wrmsr1 "\n\t"
-#define _loop_asm(_wrmsr, _clflush) \
+#define _loop_asm(_wrmsr1, _clflush, _wrmsr2) \
do { \
- asm volatile(LOOP_ASM(_wrmsr, _clflush) \
+ asm volatile(LOOP_ASM(_wrmsr1, _clflush, _wrmsr2) \
: "=b"(tmp), "=r"(tmp2), "=r"(tmp3) \
: "a"(eax), "d"(edx), "c"(global_ctl), \
"0"(N), "1"(buf) \
@@ -100,6 +127,12 @@ char *buf;
static struct pmu_event *gp_events;
static unsigned int gp_events_size;
+static int has_ibpb(void)
+{
+ return this_cpu_has(X86_FEATURE_SPEC_CTRL) ||
+ this_cpu_has(X86_FEATURE_AMD_IBPB);
+}
+
static inline void __loop(void)
{
unsigned long tmp, tmp2, tmp3;
@@ -107,10 +140,14 @@ static inline void __loop(void)
u32 eax = 0;
u32 edx = 0;
- if (this_cpu_has(X86_FEATURE_CLFLUSH))
- _loop_asm("nop", "clflush (%1)");
+ if (this_cpu_has(X86_FEATURE_CLFLUSH) && has_ibpb())
+ _loop_asm("nop", "clflush (%1)", "wrmsr");
+ else if (this_cpu_has(X86_FEATURE_CLFLUSH))
+ _loop_asm("nop", "clflush (%1)", "nop");
+ else if (has_ibpb())
+ _loop_asm("nop", "nop", "wrmsr");
else
- _loop_asm("nop", "nop");
+ _loop_asm("nop", "nop", "nop");
}
/*
@@ -127,10 +164,14 @@ static inline void __precise_loop(u64 cntrs)
u32 eax = cntrs & (BIT_ULL(32) - 1);
u32 edx = cntrs >> 32;
- if (this_cpu_has(X86_FEATURE_CLFLUSH))
- _loop_asm("wrmsr", "clflush (%1)");
+ if (this_cpu_has(X86_FEATURE_CLFLUSH) && has_ibpb())
+ _loop_asm("wrmsr", "clflush (%1)", "wrmsr");
+ else if (this_cpu_has(X86_FEATURE_CLFLUSH))
+ _loop_asm("wrmsr", "clflush (%1)", "nop");
+ else if (has_ibpb())
+ _loop_asm("wrmsr", "nop", "wrmsr");
else
- _loop_asm("wrmsr", "nop");
+ _loop_asm("wrmsr", "nop", "nop");
}
static inline void loop(u64 cntrs)
--
2.40.1
Powered by blists - more mailing lists