Subject: Re: Avoid speculative indirect calls in kernel
From: Tom Lendacky <thomas.lendacky@amd.com>
To: David Woodhouse <dwmw2@infradead.org>,
        Andrew Cooper <andrew.cooper3@citrix.com>,
        Paolo Bonzini <pbonzini@redhat.com>,
        "pavel@ucw.cz" <pavel@ucw.cz>
Cc: "tim.c.chen@linux.intel.com" <tim.c.chen@linux.intel.com>,
        "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
        "torvalds@linux-foundation.org" <torvalds@linux-foundation.org>,
        "tglx@linutronix.de" <tglx@linutronix.de>,
        "andi@firstfloor.org" <andi@firstfloor.org>,
        "gnomes@lxorguk.ukuu.org.uk" <gnomes@lxorguk.ukuu.org.uk>,
        "dave.hansen@intel.com" <dave.hansen@intel.com>,
        "gregkh@linux-foundation.org" <gregkh@linux-foundation.org>,
        Andrea Arcangeli <aarcange@redhat.com>
References: <20180103230934.15788-1-andi@firstfloor.org>
 <CA+55aFzCocoK+4kxAUEhaxxba4RTv3ewBmhiZ8Osc9iDkBtCEQ@mail.gmail.com>
 <e64025e6-9c4f-703d-cb69-29eeb9cc16bd@redhat.com> <20180104114231.GB1702@amd>
 <1515066469.12987.112.camel@amazon.co.uk>
 <94b12025-b27c-04d2-8726-c07a3af6b265@redhat.com>
 <7a3584c6-0c00-d807-5130-13d1f4b34102@citrix.com>
 <1515079777.12987.149.camel@amazon.co.uk>
 <1515082507.12987.159.camel@infradead.org>
 <cc2711b0-0278-986f-0fe9-9a993506c47d@amd.com>
 <1515096331.29312.35.camel@infradead.org>
 <d28f9218-4234-3173-d9ab-1873c8c3ef75@amd.com>
Message-ID: <0ede46c2-5e40-4364-7740-fdb8325ef1a7@amd.com>
Date: Thu, 4 Jan 2018 18:26:55 -0600
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101
 Thunderbird/52.5.2
MIME-Version: 1.0
In-Reply-To: <d28f9218-4234-3173-d9ab-1873c8c3ef75@amd.com>
Content-Type: text/plain; charset=utf-8
Content-Language: en-US
Content-Transfer-Encoding: 8bit
SpamDiagnosticOutput: 1:99
SpamDiagnosticMetadata: NSPM
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 05 Jan 2018 00:26:58.4725 (UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: de0aa47b-17d9-4889-5355-08d553d308ca
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM5PR12MB1145
Sender: linux-kernel-owner@vger.kernel.org
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org
Return-Path: <linux-kernel-owner@vger.kernel.org>

On 1/4/2018 5:47 PM, Tom Lendacky wrote:
> On 1/4/2018 2:05 PM, David Woodhouse wrote:
>> On Thu, 2018-01-04 at 14:00 -0600, Tom Lendacky wrote:
>>> Yes, lfence is sufficient.  As long as the target is in the register
>>> before the lfence and we jump through the register all is good, i.e.:
>>
>> Thanks. Can I have a Reviewed-by: for this then please:
> 
> Reviewed-by: Tom Lendacky <thomas.lendacky@amd.com>
> 
> While this works, a more efficient way to do the lfence support would be
> to not use the retpoline in this case.  Changing the indirect jumps to
> do the "mov [rax], rax; lfence; jmp *rax" sequence would be quicker. I'm
> not sure if this is feasible given the need to do a retpoline if you can't
> use lfence, though.
> 
> Thanks,
> Tom
> 

I do need to send the patches that make lfence a serializing instruction
for AMD.  I'll get those out as soon as I can.

Thanks,
Tom

>>
>> http://git.infradead.org/users/dwmw2/linux-retpoline.git/commitdiff/08d9eda03
>>
>> From: David Woodhouse <dwmw@amazon.co.uk>
>> Date: Thu, 4 Jan 2018 20:01:53 +0000
>> Subject: [PATCH] x86/retpoline: Simplify AMD variant of retpoline thunk
>>
>> On AMD (which is X86_FEATURE_K8), just the lfence is sufficient.
>>
>> Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
>> ---
>>  arch/x86/lib/retpoline.S | 2 +-
>>  1 file changed, 1 insertion(+), 1 deletion(-)
>>
>> diff --git a/arch/x86/lib/retpoline.S b/arch/x86/lib/retpoline.S
>> index bbdda5cc136e..26070976bff0 100644
>> --- a/arch/x86/lib/retpoline.S
>> +++ b/arch/x86/lib/retpoline.S
>> @@ -11,7 +11,7 @@
>>  
>>  ENTRY(__x86.indirect_thunk.\reg)
>>  	CFI_STARTPROC
>> -	ALTERNATIVE "call 2f", __stringify(jmp *%\reg), X86_BUG_NO_RETPOLINE
>> +	ALTERNATIVE_2 "call 2f", __stringify(lfence;jmp *%\reg), X86_FEATURE_K8, __stringify(jmp *%\reg), X86_BUG_NO_RETPOLINE
>>  1:
>>  	lfence
>>  	jmp	1b
>> -- 
>> 2.14.3
>>