Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Date:   Mon, 5 Jun 2023 11:31:34 -0700
In-Reply-To: <20230605173101.iflfly3bt6ydvvyk@desk>
Mime-Version: 1.0
References: <20230531231820.trrs2uugc24gegj4@treble> <F4BEBCAF-CBFC-4C3E-8B01-2ED84CF2E13A@nutanix.com>
 <20230601004202.63yulqs73kuh3ep6@treble> <846dd0c5-d431-e20e-fdb3-a4a26b6a22ca@citrix.com>
 <20230601012323.36te7hfv366danpf@desk> <20230601042345.52s5337uz62p6aow@treble>
 <21D1D290-7DE9-4864-A05B-A36779D9DC26@nutanix.com> <20230605163552.hi5kvh5wijegmus6@treble>
 <E704D6D6-3B03-40FA-8CDB-5FB58871BABC@nutanix.com> <20230605173101.iflfly3bt6ydvvyk@desk>
Message-ID: <ZH4qBjLi0egsuC1D@google.com>
Subject: Re: [PATCH] KVM: VMX: remove LFENCE in vmx_spec_ctrl_restore_host()
From:   Sean Christopherson <seanjc@google.com>
To:     Pawan Gupta <pawan.kumar.gupta@linux.intel.com>
Cc:     Jon Kohler <jon@nutanix.com>, Josh Poimboeuf <jpoimboe@kernel.org>,
        Andrew Cooper <andrew.cooper3@citrix.com>,
        Paolo Bonzini <pbonzini@redhat.com>,
        Thomas Gleixner <tglx@linutronix.de>,
        Ingo Molnar <mingo@redhat.com>, Borislav Petkov <bp@alien8.de>,
        Dave Hansen <dave.hansen@linux.intel.com>,
        X86 ML <x86@kernel.org>, "H. Peter Anvin" <hpa@zytor.com>,
        "Peter Zijlstra (Intel)" <peterz@infradead.org>,
        Daniel Sneddon <daniel.sneddon@linux.intel.com>,
        "kvm @ vger . kernel . org" <kvm@vger.kernel.org>,
        LKML <linux-kernel@vger.kernel.org>
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable
Precedence: bulk

On Mon, Jun 05, 2023, Pawan Gupta wrote:
> On Mon, Jun 05, 2023 at 04:39:02PM +0000, Jon Kohler wrote:
> > >>> Yes.  Though in practice it might not make much of a difference.  W=
ith
> > >>> wrmsr+lfence, the lfence has nothing to do so it might be almost
> > >>> instantaneous anyway.
> > >>>=20
> > >>> --=20
> > >>> Josh
> > >>=20
> > >> Coming back to this, what if we hoisted call vmx_spec_ctrl_restore_h=
ost above
> > >> FILL_RETURN_BUFFER, and dropped this LFENCE as I did here?
> > >>=20
> > >> That way, we wouldn=E2=80=99t have to mess with the internal LFENCE =
in nospec-branch.h,
> > >> and that would act as the =E2=80=9Cfinal line of defense=E2=80=9D LF=
ENCE.
> > >>=20
> > >> Would that be acceptable? Or does FILL_RETURN_BUFFER *need* to occur
> > >> before any sort of calls no matter what?
> > >=20
> > > If we go by Intel's statement that only unbalanced RETs are a concern=
,
> > > that *might* be ok as long as there's a nice comment above the
> > > FILL_RETURN_BUFFER usage site describing the two purposes for the
> > > LFENCE.
>=20
> We would then need FILL_RETURN_BUFFER to unconditionally execute LFENCE
> to account for wrmsr branch misprediction. Currently LFENCE is not
> executed for !X86_BUG_EIBRS_PBRSB.
>=20
> > > However, based on Andy's concerns, which I've discussed with him
> > > privately (but I'm not qualified to agree or disagree with), we may w=
ant
> > > to just convert vmx_spec_ctrl_restore_host() to asm.  Better safe tha=
n
> > > sorry.  My original implementation of that function was actually asm.=
  I
> > > can try to dig up that code.
>=20
> Note:
>=20
>   VMexit
>   CALL
>     RET
>   RET    <---- This is also a problem if the first call hasn't retired ye=
t.
>   LFENCE
>=20
> Converting vmx_spec_ctrl_restore_host() to ASM should be able to take car=
e
> of this.

Is there an actual bug here, or are we just micro-optimizing something that=
 may or
may not need additional optimization?  Unless there's a bug to be fixed, mo=
ving
code into ASM and increasing complexity doesn't seem worthwhile.