Subject: Re: Avoid speculative indirect calls in kernel
To: David Woodhouse <dwmw2@infradead.org>,
        Andrew Cooper <andrew.cooper3@citrix.com>,
        Paolo Bonzini <pbonzini@redhat.com>,
        "pavel@ucw.cz" <pavel@ucw.cz>
Cc: "tim.c.chen@linux.intel.com" <tim.c.chen@linux.intel.com>,
        "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
        "torvalds@linux-foundation.org" <torvalds@linux-foundation.org>,
        "tglx@linutronix.de" <tglx@linutronix.de>,
        "andi@firstfloor.org" <andi@firstfloor.org>,
        "gnomes@lxorguk.ukuu.org.uk" <gnomes@lxorguk.ukuu.org.uk>,
        "dave.hansen@intel.com" <dave.hansen@intel.com>,
        "gregkh@linux-foundation.org" <gregkh@linux-foundation.org>,
        Andrea Arcangeli <aarcange@redhat.com>
References: <20180103230934.15788-1-andi@firstfloor.org>
 <CA+55aFzCocoK+4kxAUEhaxxba4RTv3ewBmhiZ8Osc9iDkBtCEQ@mail.gmail.com>
 <e64025e6-9c4f-703d-cb69-29eeb9cc16bd@redhat.com> <20180104114231.GB1702@amd>
 <1515066469.12987.112.camel@amazon.co.uk>
 <94b12025-b27c-04d2-8726-c07a3af6b265@redhat.com>
 <7a3584c6-0c00-d807-5130-13d1f4b34102@citrix.com>
 <1515079777.12987.149.camel@amazon.co.uk>
 <1515082507.12987.159.camel@infradead.org>
 <cc2711b0-0278-986f-0fe9-9a993506c47d@amd.com>
 <1515096331.29312.35.camel@infradead.org>
From: Tom Lendacky <thomas.lendacky@amd.com>
Message-ID: <d28f9218-4234-3173-d9ab-1873c8c3ef75@amd.com>
Date: Thu, 4 Jan 2018 17:47:15 -0600
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101
 Thunderbird/52.5.2
MIME-Version: 1.0
In-Reply-To: <1515096331.29312.35.camel@infradead.org>
Content-Type: text/plain; charset=utf-8
Content-Language: en-US
Content-Transfer-Encoding: 8bit
SpamDiagnosticOutput: 1:99
SpamDiagnosticMetadata: NSPM
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 04 Jan 2018 23:47:19.2349 (UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: 470580dc-e144-4db4-506b-08d553cd7efd
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d
X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY4PR12MB1143
Sender: linux-kernel-owner@vger.kernel.org
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org
Return-Path: <linux-kernel-owner@vger.kernel.org>

On 1/4/2018 2:05 PM, David Woodhouse wrote:
> On Thu, 2018-01-04 at 14:00 -0600, Tom Lendacky wrote:
>> Yes, lfence is sufficient.  As long as the target is in the register
>> before the lfence and we jump through the register all is good, i.e.:
> 
> Thanks. Can I have a Reviewed-by: for this then please:

Reviewed-by: Tom Lendacky <thomas.lendacky@amd.com>

While this works, a more efficient way to do the lfence support would be
to not use the retpoline in this case.  Changing the indirect jumps to
do the "mov [rax], rax; lfence; jmp *rax" sequence would be quicker. I'm
not sure if this is feasible given the need to do a retpoline if you can't
use lfence, though.

Thanks,
Tom

> 
> http://git.infradead.org/users/dwmw2/linux-retpoline.git/commitdiff/08d9eda03
> 
> From: David Woodhouse <dwmw@amazon.co.uk>
> Date: Thu, 4 Jan 2018 20:01:53 +0000
> Subject: [PATCH] x86/retpoline: Simplify AMD variant of retpoline thunk
> 
> On AMD (which is X86_FEATURE_K8), just the lfence is sufficient.
> 
> Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
> ---
>  arch/x86/lib/retpoline.S | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/arch/x86/lib/retpoline.S b/arch/x86/lib/retpoline.S
> index bbdda5cc136e..26070976bff0 100644
> --- a/arch/x86/lib/retpoline.S
> +++ b/arch/x86/lib/retpoline.S
> @@ -11,7 +11,7 @@
>  
>  ENTRY(__x86.indirect_thunk.\reg)
>  	CFI_STARTPROC
> -	ALTERNATIVE "call 2f", __stringify(jmp *%\reg), X86_BUG_NO_RETPOLINE
> +	ALTERNATIVE_2 "call 2f", __stringify(lfence;jmp *%\reg), X86_FEATURE_K8, __stringify(jmp *%\reg), X86_BUG_NO_RETPOLINE
>  1:
>  	lfence
>  	jmp	1b
> -- 
> 2.14.3
>