linux-kernel - Re: [PATCH v5 1/9] KVM: VMX: Use on-stack copy of @flags in __vmx_vcpu

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <6908a285-b7b7-457a-baaf-fd01c55fe571@gmail.com>
Date: Fri, 14 Nov 2025 16:06:49 +0100
From: Uros Bizjak <ubizjak@...il.com>
To: Sean Christopherson <seanjc@...gle.com>,
 Paolo Bonzini <pbonzini@...hat.com>, Thomas Gleixner <tglx@...utronix.de>,
 Borislav Petkov <bp@...en8.de>, Peter Zijlstra <peterz@...radead.org>,
 Josh Poimboeuf <jpoimboe@...nel.org>
Cc: kvm@...r.kernel.org, linux-kernel@...r.kernel.org,
 Pawan Gupta <pawan.kumar.gupta@...ux.intel.com>,
 Brendan Jackman <jackmanb@...gle.com>
Subject: Re: [PATCH v5 1/9] KVM: VMX: Use on-stack copy of @flags in
 __vmx_vcpu_run()



On 11/14/25 00:37, Sean Christopherson wrote:
> When testing for VMLAUNCH vs. VMRESUME, use the copy of @flags from the
> stack instead of first moving it to EBX, and then propagating
> VMX_RUN_VMRESUME to RFLAGS.CF (because RBX is clobbered with the guest
> value prior to the conditional branch to VMLAUNCH).  Stashing information
> in RFLAGS is gross, especially with the writer and reader being bifurcated
> by yet more gnarly assembly code.
> 
> Opportunistically drop the SHIFT macros as they existed purely to allow
> the VM-Enter flow to use Bit Test.
> 
> Suggested-by: Borislav Petkov <bp@...en8.de>
> Signed-off-by: Sean Christopherson <seanjc@...gle.com>
> ---
>   arch/x86/kvm/vmx/run_flags.h | 10 +++-------
>   arch/x86/kvm/vmx/vmenter.S   | 13 ++++---------
>   2 files changed, 7 insertions(+), 16 deletions(-)
> 
> diff --git a/arch/x86/kvm/vmx/run_flags.h b/arch/x86/kvm/vmx/run_flags.h
> index 2f20fb170def..6a87a12135fb 100644
> --- a/arch/x86/kvm/vmx/run_flags.h
> +++ b/arch/x86/kvm/vmx/run_flags.h
> @@ -2,12 +2,8 @@
>   #ifndef __KVM_X86_VMX_RUN_FLAGS_H
>   #define __KVM_X86_VMX_RUN_FLAGS_H
>   
> -#define VMX_RUN_VMRESUME_SHIFT				0
> -#define VMX_RUN_SAVE_SPEC_CTRL_SHIFT			1
> -#define VMX_RUN_CLEAR_CPU_BUFFERS_FOR_MMIO_SHIFT	2
> -
> -#define VMX_RUN_VMRESUME			BIT(VMX_RUN_VMRESUME_SHIFT)
> -#define VMX_RUN_SAVE_SPEC_CTRL			BIT(VMX_RUN_SAVE_SPEC_CTRL_SHIFT)
> -#define VMX_RUN_CLEAR_CPU_BUFFERS_FOR_MMIO	BIT(VMX_RUN_CLEAR_CPU_BUFFERS_FOR_MMIO_SHIFT)
> +#define VMX_RUN_VMRESUME			BIT(0)
> +#define VMX_RUN_SAVE_SPEC_CTRL			BIT(1)
> +#define VMX_RUN_CLEAR_CPU_BUFFERS_FOR_MMIO	BIT(2)
>   
>   #endif /* __KVM_X86_VMX_RUN_FLAGS_H */
> diff --git a/arch/x86/kvm/vmx/vmenter.S b/arch/x86/kvm/vmx/vmenter.S
> index 574159a84ee9..93cf2ca7919a 100644
> --- a/arch/x86/kvm/vmx/vmenter.S
> +++ b/arch/x86/kvm/vmx/vmenter.S
> @@ -92,7 +92,7 @@ SYM_FUNC_START(__vmx_vcpu_run)
>   	/* Save @vmx for SPEC_CTRL handling */
>   	push %_ASM_ARG1
>   
> -	/* Save @flags for SPEC_CTRL handling */
> +	/* Save @flags (used for VMLAUNCH vs. VMRESUME and mitigations). */
>   	push %_ASM_ARG3
>   
>   	/*
> @@ -101,9 +101,6 @@ SYM_FUNC_START(__vmx_vcpu_run)
>   	 */
>   	push %_ASM_ARG2
>   
> -	/* Copy @flags to EBX, _ASM_ARG3 is volatile. */
> -	mov %_ASM_ARG3L, %ebx
> -
>   	lea (%_ASM_SP), %_ASM_ARG2
>   	call vmx_update_host_rsp
>   
> @@ -147,9 +144,6 @@ SYM_FUNC_START(__vmx_vcpu_run)
>   	/* Load @regs to RAX. */
>   	mov (%_ASM_SP), %_ASM_AX
>   
> -	/* Check if vmlaunch or vmresume is needed */
> -	bt   $VMX_RUN_VMRESUME_SHIFT, %ebx
> -
>   	/* Load guest registers.  Don't clobber flags. */
>   	mov VCPU_RCX(%_ASM_AX), %_ASM_CX
>   	mov VCPU_RDX(%_ASM_AX), %_ASM_DX
> @@ -173,8 +167,9 @@ SYM_FUNC_START(__vmx_vcpu_run)
>   	/* Clobbers EFLAGS.ZF */
>   	CLEAR_CPU_BUFFERS
>   
> -	/* Check EFLAGS.CF from the VMX_RUN_VMRESUME bit test above. */
> -	jnc .Lvmlaunch
> +	/* Check @flags to see if vmlaunch or vmresume is needed. */
> +	testl $VMX_RUN_VMRESUME, WORD_SIZE(%_ASM_SP)
> +	jz .Lvmlaunch


You could use TESTB instead of TESTL in the above code to save 3 bytes
of code and some memory bandwidth.

Assembler will report unwanted truncation if VMX_RUN_VRESUME ever
becomes larger than 255.

BR,
Uros.