Re: [PATCH v8 04/12] x86/spectre: Add boot time option to select Spectre v2 mitigation

From: David Woodhouse <dwmw2@infradead.org>
To: Borislav Petkov <bp@alien8.de>
Cc: Andi Kleen <ak@linux.intel.com>, Paul Turner <pjt@google.com>,
	LKML <linux-kernel@vger.kernel.org>,
	Linus Torvalds <torvalds@linux-foundation.org>,
	 Greg Kroah-Hartman <gregkh@linux-foundation.org>,
	Tim Chen <tim.c.chen@linux.intel.com>,
	Dave Hansen <dave.hansen@intel.com>,
	tglx@linutronix.de, Kees Cook <keescook@google.com>,
	 Rik van Riel <riel@redhat.com>,
	Peter Zijlstra <peterz@infradead.org>,
	Andy Lutomirski <luto@amacapital.net>,
	 Jiri Kosina <jikos@kernel.org>,
	gnomes@lxorguk.ukuu.org.uk, x86@kernel.org,
	thomas.lendacky@amd.com, Josh Poimboeuf <jpoimboe@redhat.com>
Subject: Re: [PATCH v8 04/12] x86/spectre: Add boot time option to select Spectre v2 mitigation
Date: Tue, 23 Jan 2018 22:53:54 +0000	[thread overview]
Message-ID: <1516748034.13558.15.camel@infradead.org> (raw)
In-Reply-To: <20180123224014.dsbzps4hydt6h7ed@pd.tnic>

[-- Attachment #1: Type: text/plain, Size: 2165 bytes --]

On Tue, 2018-01-23 at 23:40 +0100, Borislav Petkov wrote:
> 
> Btw, this came up today: do we have an idea how to detect objects built
> with gcc which has retpoline support?
> 
> The only way I could think of is boot the respective kernel and stare at
> dmesg:
> 
> [    0.064006] Spectre V2 mitigation: LFENCE not serializing. Switching to generic retpoline
> [    0.068003] Spectre V2 mitigation: Vulnerable: Minimal generic ASM retpoline
> 
> and then deduce that it is not a retpoline-enabled compiler:

Right. There *was* a warning during build but we removed that. At the
time, the plan (at least in my head) was to use IBRS instead, if the
retpoline compiler wasn't available. For now we're just going to remain
vulnerable. I'm now wondering if we should reinstate that warning.

> > +retpoline_auto:
> > +     if (boot_cpu_data.x86_vendor == X86_VENDOR_AMD) {
> > +     retpoline_amd:
> > +             if (!boot_cpu_has(X86_FEATURE_LFENCE_RDTSC)) {
> > +                     pr_err("LFENCE not serializing. Switching to generic retpoline\n");
> > +                     goto retpoline_generic;
> > +             }
> > +             mode = retp_compiler() ? SPECTRE_V2_RETPOLINE_AMD :
> > +                                      SPECTRE_V2_RETPOLINE_MINIMAL_AMD;
> > +             setup_force_cpu_cap(X86_FEATURE_RETPOLINE_AMD);
> > +             setup_force_cpu_cap(X86_FEATURE_RETPOLINE);
> > +     } else {
> > +     retpoline_generic:
> > +             mode = retp_compiler() ? SPECTRE_V2_RETPOLINE_GENERIC :
> > +                                      SPECTRE_V2_RETPOLINE_MINIMAL;
>                                         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^
> 
> but that might not always be an option.
> 
> And it probably should be a more reliable method which we probably could
> use to detect !retpolined modules too.

Andi actually implemented this, but it ended up being watered down
somewhat.

[-- Attachment #2: smime.p7s --]
[-- Type: application/x-pkcs7-signature, Size: 5213 bytes --]