Received-SPF: pass (google.com: domain of linux-kernel+bounces-146016-linux.lists.archive=gmail.com@vger.kernel.org designates 139.178.88.99 as permitted sender) client-ip=139.178.88.99;
Date: Mon, 15 Apr 2024 16:44:15 -0700
From: Josh Poimboeuf <jpoimboe@kernel.org>
To: Andrew Cooper <andrew.cooper3@citrix.com>
Cc: x86@kernel.org, linux-kernel@vger.kernel.org,
	Linus Torvalds <torvalds@linux-foundation.org>,
	Daniel Sneddon <daniel.sneddon@linux.intel.com>,
	Pawan Gupta <pawan.kumar.gupta@linux.intel.com>,
	Thomas Gleixner <tglx@linutronix.de>,
	Alexandre Chartre <alexandre.chartre@oracle.com>,
	Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>,
	Peter Zijlstra <peterz@infradead.org>,
	Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	Sean Christopherson <seanjc@google.com>,
	Dave Hansen <dave.hansen@linux.intel.com>,
	Nikolay Borisov <nik.borisov@suse.com>,
	KP Singh <kpsingh@kernel.org>, Waiman Long <longman@redhat.com>,
	Borislav Petkov <bp@alien8.de>, Ingo Molnar <mingo@kernel.org>
Subject: Re: [PATCH 3/3] x86/bugs: Remove support for Spectre v2 LFENCE
 "retpolines"
Message-ID: <20240415234415.6labhhhbllinzyvp@treble>
References: <cover.1712944776.git.jpoimboe@kernel.org>
 <e5356c0e018cd0a96aabe719f685c237ac519403.1712944776.git.jpoimboe@kernel.org>
 <b0074626-8e98-4573-8047-08916fbb5537@citrix.com>
Precedence: bulk
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
In-Reply-To: <b0074626-8e98-4573-8047-08916fbb5537@citrix.com>

On Fri, Apr 12, 2024 at 09:49:33PM +0100, Andrew Cooper wrote:
> On 12/04/2024 7:10 pm, Josh Poimboeuf wrote:
> > I found several bugs where code assumes that X86_FEATURE_RETPOLINE
> > actually means retpolines (imagine that!).
> 
> Yeah :(   One could also imagine a past where that was pointed out, or
> just read about it in the archives.
> 
> >   In fact that feature also
> > includes the original AMD LFENCE "retpolines", which aren't in fact
> > retpolines.
> >
> > Really, those "retpolines" should just be removed.  They're already
> > considered vulnerable due to the fact that the speculative window after
> > the indirect branch can still be long enough to do multiple dependent
> > loads.  And recent tooling makes such gadgets easier to find.
> 
> There are two Atom CPUs which are not repotline safe, and for which
> Intel released a statement saying "use lfence/jmp" on these.
> 
> I'm still trying to find it...

Any luck finding it?  The only thing I found [1] isn't exactly a ringing
endorsement of LFENCE;JMP over retpolines.

[1] https://www.intel.com/content/www/us/en/developer/articles/technical/software-security-guidance/technical-documentation/branch-history-injection.html

-- 
Josh