From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Google-Smtp-Source: AH8x226ojW0AUie6PvzQvsk8vEeF+VioqrBfs+0U+fcuj7nXAYix6nso2P4cabLdm9W+P830uO+x ARC-Seal: i=1; a=rsa-sha256; t=1516610534; cv=none; d=google.com; s=arc-20160816; b=dcWgo7LaDLvTK5D/yOx/7Q9AjWL948WfIxJaGeWAtbdRxMa9jpLqBruF32l9sR4kj6 YbTFo3QsY9wVIOy/lXSG3E4ORGxj4bBz8xzteKwPj4wfvGyu+PqTm2l9MLGYB4f9qUXh +HWBqQLcMp2qJhRhC5EDijN9y/ofrgqI62O48hzbChY2ObTm1+aF9MKRWtKflXM9e8jT YPhxfVjQ1azLx8tyOogOja636rJaFbnFmH9s+1PuCXbnOmDojt+20VWnXvH2na9Jj8UT MEwZxSBx9s0l4bd5tvHYXAxHs1DB9KlfpCqqwY36dCJLgFOpcATamoGdjDq0fOZ6TNPm SwXw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=mime-version:user-agent:references:in-reply-to:message-id:date :subject:cc:to:from:arc-authentication-results; bh=BN6KRAXAYkA4NYwVHno4WMX03FLZmuybEtLx4q4/pYk=; b=EUDlGIvUubMmk9V2rKOD+JKmPXysQ/FX6ajdewZO5wB6wgkU/Bqiupj4tvIQrIBa3i meX145K8p7tQv8a9cwageEdqACD1Jm2Ubt8ea9IXyZOOz6Z2QOFBbImZKIThZquybbvs AknypcWeApBrdF48wSVEq0/jMzTcbFupR2dkcMyNa1x7Qk1X0fom1CyX17+jjBwcZHwX yxory1JznDzk6wX5m+C7TOaQuuos0QFmdBJZtfoOwDhuFn5DwLZ1YWcC9zunGaxtFgkc gaagLU+AhnCVi3k+FitYBr0nxfWu6ZbNHbRUDdJMS1o+gAuRKVyJfXRx2R+6t2I9SDAs i29A== ARC-Authentication-Results: i=1; mx.google.com; spf=softfail (google.com: domain of transitioning gregkh@linuxfoundation.org does not designate 90.92.71.90 as permitted sender) smtp.mailfrom=gregkh@linuxfoundation.org Authentication-Results: mx.google.com; spf=softfail (google.com: domain of transitioning gregkh@linuxfoundation.org does not designate 90.92.71.90 as permitted sender) smtp.mailfrom=gregkh@linuxfoundation.org From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Tom Lendacky , Thomas Gleixner , Borislav Petkov , David Woodhouse , Arjan van de Ven , Rik van Riel , Andi Kleen , Paul Turner , Peter Zijlstra , Tim Chen , Jiri Kosina , Dave Hansen , Andy Lutomirski , Josh Poimboeuf , Dan Williams , Linus Torvalds , Kees Cook , Greg Kroah-Hartman Subject: [PATCH 4.4 30/53] x86/retpoline: Add LFENCE to the retpoline/RSB filling RSB macros Date: Mon, 22 Jan 2018 09:40:22 +0100 Message-Id: <20180122083911.629117807@linuxfoundation.org> X-Mailer: git-send-email 2.16.0 In-Reply-To: <20180122083910.299610926@linuxfoundation.org> References: <20180122083910.299610926@linuxfoundation.org> User-Agent: quilt/0.65 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-LABELS: =?utf-8?b?IlxcU2VudCI=?= X-GMAIL-THRID: =?utf-8?q?1590281407196559740?= X-GMAIL-MSGID: =?utf-8?q?1590281407196559740?= X-Mailing-List: linux-kernel@vger.kernel.org List-ID: 4.4-stable review patch. If anyone has any objections, please let me know. ------------------ From: Tom Lendacky commit 28d437d550e1e39f805d99f9f8ac399c778827b7 upstream. The PAUSE instruction is currently used in the retpoline and RSB filling macros as a speculation trap. The use of PAUSE was originally suggested because it showed a very, very small difference in the amount of cycles/time used to execute the retpoline as compared to LFENCE. On AMD, the PAUSE instruction is not a serializing instruction, so the pause/jmp loop will use excess power as it is speculated over waiting for return to mispredict to the correct target. The RSB filling macro is applicable to AMD, and, if software is unable to verify that LFENCE is serializing on AMD (possible when running under a hypervisor), the generic retpoline support will be used and, so, is also applicable to AMD. Keep the current usage of PAUSE for Intel, but add an LFENCE instruction to the speculation trap for AMD. The same sequence has been adopted by GCC for the GCC generated retpolines. Signed-off-by: Tom Lendacky Signed-off-by: Thomas Gleixner Reviewed-by: Borislav Petkov Acked-by: David Woodhouse Acked-by: Arjan van de Ven Cc: Rik van Riel Cc: Andi Kleen Cc: Paul Turner Cc: Peter Zijlstra Cc: Tim Chen Cc: Jiri Kosina Cc: Dave Hansen Cc: Andy Lutomirski Cc: Josh Poimboeuf Cc: Dan Williams Cc: Linus Torvalds Cc: Greg Kroah-Hartman Cc: Kees Cook Link: https://lkml.kernel.org/r/20180113232730.31060.36287.stgit@tlendack-t1.amdoffice.net Signed-off-by: Greg Kroah-Hartman --- arch/x86/include/asm/nospec-branch.h | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) --- a/arch/x86/include/asm/nospec-branch.h +++ b/arch/x86/include/asm/nospec-branch.h @@ -11,7 +11,7 @@ * Fill the CPU return stack buffer. * * Each entry in the RSB, if used for a speculative 'ret', contains an - * infinite 'pause; jmp' loop to capture speculative execution. + * infinite 'pause; lfence; jmp' loop to capture speculative execution. * * This is required in various cases for retpoline and IBRS-based * mitigations for the Spectre variant 2 vulnerability. Sometimes to @@ -38,11 +38,13 @@ call 772f; \ 773: /* speculation trap */ \ pause; \ + lfence; \ jmp 773b; \ 772: \ call 774f; \ 775: /* speculation trap */ \ pause; \ + lfence; \ jmp 775b; \ 774: \ dec reg; \ @@ -60,6 +62,7 @@ call .Ldo_rop_\@ .Lspec_trap_\@: pause + lfence jmp .Lspec_trap_\@ .Ldo_rop_\@: mov \reg, (%_ASM_SP) @@ -142,6 +145,7 @@ " .align 16\n" \ "901: call 903f;\n" \ "902: pause;\n" \ + " lfence;\n" \ " jmp 902b;\n" \ " .align 16\n" \ "903: addl $4, %%esp;\n" \