Re: Avoid speculative indirect calls in kernel

[Tom Lendacky]

On 1/4/2018 2:05 PM, David Woodhouse wrote:
> On Thu, 2018-01-04 at 14:00 -0600, Tom Lendacky wrote:
>> Yes, lfence is sufficient. As long as the target is in the register
>> before the lfence and we jump through the register all is good, i.e.:
> 
> Thanks. Can I have a Reviewed-by: for this then please:

Reviewed-by: Tom Lendacky <thomas.lendacky@xxxxxxx>

While this works, a more efficient way to do the lfence support would be
to not use the retpoline in this case.  Changing the indirect jumps to
do the "mov [rax], rax; lfence; jmp *rax" sequence would be quicker. I'm
not sure if this is feasible given the need to do a retpoline if you can't
use lfence, though.

Thanks,
Tom

> 
> http://git.infradead.org/users/dwmw2/linux-retpoline.git/commitdiff/08d9eda03
> 
> From: David Woodhouse <dwmw@xxxxxxxxxxxx>
> Date: Thu, 4 Jan 2018 20:01:53 +0000
> Subject: [PATCH] x86/retpoline: Simplify AMD variant of retpoline thunk
> 
> On AMD (which is X86_FEATURE_K8), just the lfence is sufficient.
> 
> Signed-off-by: David Woodhouse <dwmw@xxxxxxxxxxxx>
> ---
> Âarch/x86/lib/retpoline.S | 2 +-
> Â1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/arch/x86/lib/retpoline.S b/arch/x86/lib/retpoline.S
> index bbdda5cc136e..26070976bff0 100644
> --- a/arch/x86/lib/retpoline.S
> +++ b/arch/x86/lib/retpoline.S
> @@ -11,7 +11,7 @@
> Â
> ÂENTRY(__x86.indirect_thunk.\reg)
> Â	CFI_STARTPROC
> -	ALTERNATIVE "call 2f", __stringify(jmp *%\reg), X86_BUG_NO_RETPOLINE
> +	ALTERNATIVE_2 "call 2f", __stringify(lfence;jmp *%\reg), X86_FEATURE_K8, __stringify(jmp *%\reg), X86_BUG_NO_RETPOLINE
> Â1:
> Â	lfence
> Â	jmp	1b
> --Â
> 2.14.3
>