Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Message-ID: <e72b4099-5098-67cd-d9c4-b111a7619808@suse.com>
Date:   Wed, 9 Aug 2023 18:45:55 +0300
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101
 Thunderbird/102.13.0
Subject: Re: [RFC][PATCH 02/17] x86/cpu: Clean up SRSO return thunk mess
Content-Language: en-US
To:     Peter Zijlstra <peterz@infradead.org>, x86@kernel.org
Cc:     linux-kernel@vger.kernel.org, David.Kaplan@amd.com,
        Andrew.Cooper3@citrix.com, jpoimboe@kernel.org,
        gregkh@linuxfoundation.org
References: <20230809071218.000335006@infradead.org>
 <20230809072200.543939260@infradead.org>
From:   Nikolay Borisov <nik.borisov@suse.com>
In-Reply-To: <20230809072200.543939260@infradead.org>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?ZEs4REtvWlV5ZlpCdzVxNllIVXpuVytZeWxvV051MXhia0sxQmpFc2U0bEtp?=
 =?utf-8?B?M0p6UlUwZTRxRktGN1lqSzVkZmlDYmh0MHNERS9qMTdEbmdyeTFkR3VnQVRO?=
 =?utf-8?B?ZzM4WTlLeUwyRnZ5WG9lUkhnM0ZySVhoYytnTUpDcUZsRFRXbmNuWkc5eHVZ?=
 =?utf-8?B?WFF1V3FEbjNhbmtNdFpiaVU3Q0hlczRsMXBSMHIxQThVR1lzbG85ZXFvUzJx?=
 =?utf-8?B?NUhmWDNDcjY1OC9UMW1YZXJGYW9NdU96VEpjSlBBNWZlYlN2N20xMUJpWXJE?=
 =?utf-8?B?bFQrQmc3d05tR0s3a3RFb0I5RklQaFNmRURMTUJ5bHFqbDgvYi9Qem5IS25u?=
 =?utf-8?B?MXpwU0JVaVVrNWhvMXF3RkF4WlowcmNXNks2VGdUUmphVWhxcDZqMW9UMStJ?=
 =?utf-8?B?R1owMFR3eHk0MFZ6NW56OGZMd080VVZNYXF0bm9ObUZ5Uzg0Tm9qM2FZYnhC?=
 =?utf-8?B?ZGdsWVpwenUyM0E4S3llem9lOEZibTJncXE2ay8wUW4wcnYvRXhlT3dsSFB5?=
 =?utf-8?B?bi95bTFiVlA2RDNKZUY0NWZkZnZJaER6YmlOWlVJeFBsK29hME56SkFRdVg0?=
 =?utf-8?B?bWJGazc5T21kSU5aelRwem92TjBDS3A4MHBhZFh5d3ZiNy9oNC9RZEIzMzZJ?=
 =?utf-8?B?Szh6azFCOFlRckhaVVg0R0ZERXdJN2FJVEtJa0xrY2lMS01Tc3psaUxBZ0Vy?=
 =?utf-8?B?cGxSWnVXVVRPL1d1RGQ3Ti9ySlpUMXFlaFpYZzZ1dTlFbU96RllrdEx2cHcz?=
 =?utf-8?B?czVxTkZsVXRQait5clpqZkdRVjB3RjRCbm0zMGd4TExtazExejRzM2JQZEda?=
 =?utf-8?B?ZFQrVjU5WG50emQ1VVlvUVRraFVETHFCUU1IYzJJcG56QUNlK1hOZ3N0aG9a?=
 =?utf-8?B?Z2pWcXRuRnlBK2xBRmFibHBmeXB6Y3dvVkp2Vk93VUlvK3VtbHN0aUhYS0o2?=
 =?utf-8?B?V0lhRThwc2ZVck9ya3EvZ04weTlPS3RZWTNhNHNJYnlHYk8wWDBzMHpYSFRa?=
 =?utf-8?B?d0hPOHNaQ2V1K3RSa1dreW5pRVUyU0JYQ1lmZU5JYlVmYmw3L0dJWHc5MVZ6?=
 =?utf-8?B?WVdoUm52TEttaWxUUXBRNkN2OWRqOGxzOEJqMFNxbyttYUV2elJ1NmNodUJa?=
 =?utf-8?B?YjVyZUROWUdHbmNOaXozMloydjdFYUNkQ2Q4VHdGWVYvWnRQbWViUlRxckVN?=
 =?utf-8?B?YVplUURLV1cySTI5Yk5va3JFTlM2L2grWjV3Zm8zR1NnQjZHd25qc1c0SzFz?=
 =?utf-8?B?VXpYamVXK2J6QjQ5VWVsSTRuQTlVK1lIeEt2V2lmV1RHSThzNHNqc3kwaEls?=
 =?utf-8?B?d0h0ZURDdFl2MXEzVlh3eit2enlVZHZNdUJIT3preDZEcFkrY2E1N2xzbnUr?=
 =?utf-8?B?Zm1rYzhLQnpXZ3UvN3hqcnp5K2wwbnVteHFvMnNhaUxaSXpOWThkanBFeEZ6?=
 =?utf-8?B?ejVwNEZJSTRXbFIwL0ZIV1dWM21CcUttVTZFY2F4SE1Gc1o1ZHpJWWk4M3dX?=
 =?utf-8?B?NnJEcTlmVHhsZ2Rha3RxdzZkdS96OHpUdUJQTUh3SVpJY3JBVnFnVkJJZUQv?=
 =?utf-8?B?Z2pKcDdyYUczdTJEcWY5eFpqMThCbno2MHNmMjhka2pNeEpvNjJDcXQ2SjBO?=
 =?utf-8?B?d0FUTGtQSm9ZUXl6Q1FzZCsxa3B4bXp2VFo0NHV2aXFXYnRWeXVkWmVEOVl4?=
 =?utf-8?B?Rit2VEkzV1NYaFEzMVViNGsxN2wvd0lLZG11NXoyd1FwNHZIMDd1SUtqS0li?=
 =?utf-8?B?SVBjVTBaeWdTM3dteDVjMngrYm1uNVNjYVZxdXR5T29mUkJVeXVrUHpMQzVh?=
 =?utf-8?B?WGRRdjhKWlI1N0NGWlJjNWFJbHVyMVdRQk1RTkl2aHpVT2xuRlBQSGE4Sk8z?=
 =?utf-8?B?UTFUdWNQUGF4TUt6NmVxcnZZQ3NZcldTcnF0ZExxZnJ6aWM5U0Y3QUN0KzRp?=
 =?utf-8?B?VmJSQUVxMlF2anlTQ202ZzVRUGIydlduWGp1aFZ6VmZoR3F6ZE1Jc1NLUExl?=
 =?utf-8?B?U09tK3JHWUs1ZUR4YklWQ3drKytQU045NGZGdm1heGJDVFk5VWRxaFNIL2ZH?=
 =?utf-8?B?cDdrY3lmWGdKNTl3YUJZZ2ZDSmEwUWlYQWJFYndiSTFhZ2tWbk5GczdMTW9N?=
 =?utf-8?Q?ks/Ac04sztSLTKnB+OeainKfJ?=
X-OriginatorOrg: suse.com
X-MS-Exchange-CrossTenant-Network-Message-Id: ec5e1cff-4a79-4c7d-04ce-08db98efb9fc
X-MS-Exchange-CrossTenant-AuthSource: PA4PR04MB7790.eurprd04.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 09 Aug 2023 15:45:58.9607
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: f7a17af6-1c5c-4a36-aa8b-f5be247aa4ba
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: 5fP+LcGmwiDDdThHv50YOzXFGKEVCtji317cQ+eDxus6/j+hMQhV6T7V/SUd/MiUZA0PrZgHEl8HUW4RWVMIEg==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: VI1PR04MB7120
X-Spam-Status: No, score=-2.9 required=5.0 tests=BAYES_00,DKIM_SIGNED,
        DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,NICE_REPLY_A,
        RCVD_IN_DNSWL_BLOCKED,RCVD_IN_MSPIKE_H2,SPF_HELO_PASS,SPF_PASS,
        URIBL_BLOCKED autolearn=ham autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org


On 9.08.23 г. 10:12 ч., Peter Zijlstra wrote:
> Use the existing configurable return thunk. There is absolute no
> justification for having created this __x86_return_thunk alternative.
> 
> To clarify, the whole thing looks like:
> 
> Zen3/4 does:
> 
>    srso_alias_untrain_ret:
> 	  nop2
> 	  lfence
> 	  jmp srso_alias_return_thunk
> 	  int3
> 
>    srso_alias_safe_ret: // aliasses srso_alias_untrain_ret just so
> 	  add $8, %rsp
> 	  ret
> 	  int3
> 
>    srso_alias_return_thunk:
> 	  call srso_alias_safe_ret
> 	  ud2
> 
> While Zen1/2 does:
> 
>    srso_untrain_ret:
> 	  movabs $foo, %rax
> 	  lfence
> 	  call srso_safe_ret           (jmp srso_return_thunk ?)
> 	  int3
> 
>    srso_safe_ret: // embedded in movabs immediate
> 	  add $8,%rsp
>            ret
>            int3
> 
>    srso_return_thunk:
> 	  call srso_safe_ret
> 	  ud2
> 
> While retbleed does:
> 
>    zen_untrain_ret:
> 	  test $0xcc, %bl
> 	  lfence
> 	  jmp zen_return_thunk
>            int3
> 
>    zen_return_thunk: // embedded in the test instruction
> 	  ret
>            int3
> 
> Where Zen1/2 flush the BTB using the instruction decoder trick
> (test,movabs) Zen3/4 use instruction aliasing. SRSO adds RSB (RAP in
> AMD speak) stuffing to force a return mis-predict.
> 
> That is; the AMD retbleed is a form of Speculative-Type-Confusion
> where the branch predictor is trained to use the BTB to predict the
> RET address, while AMD inception/SRSO is a form of
> Speculative-Type-Confusion where another instruction is trained to be
> treated like a CALL instruction and poison the RSB (RAP).
> 
> Pick one of three options at boot.
> 


So this boils down to simply removing one level of indirection, instead 
of patching the body of __x86_return_thunk you directly patch the return 
sites with the correct thunk.


Reviewed-by: Nikolay Borisov <nik.borisov@suse.com>