From mboxrd@z Thu Jan 1 00:00:00 1970 Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752047AbeANRym (ORCPT + 1 other); Sun, 14 Jan 2018 12:54:42 -0500 Received: from terminus.zytor.com ([65.50.211.136]:55103 "EHLO terminus.zytor.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751726AbeANRyk (ORCPT ); Sun, 14 Jan 2018 12:54:40 -0500 Date: Sun, 14 Jan 2018 09:48:55 -0800 From: tip-bot for Tom Lendacky Message-ID: Cc: thomas.lendacky@amd.com, keescook@google.com, jikos@kernel.org, arjan@linux.intel.com, jpoimboe@redhat.com, riel@redhat.com, dave.hansen@intel.com, mingo@kernel.org, hpa@zytor.com, ak@linux.intel.com, torvalds@linux-foundation.org, gregkh@linux-foundation.org, luto@kernel.org, pjt@google.com, peterz@infradead.org, dwmw@amazon.co.uk, tglx@linutronix.de, bp@alien8.de, linux-kernel@vger.kernel.org, tim.c.chen@linux.intel.com, dan.j.williams@intel.com Reply-To: hpa@zytor.com, mingo@kernel.org, jpoimboe@redhat.com, riel@redhat.com, dave.hansen@intel.com, thomas.lendacky@amd.com, keescook@google.com, arjan@linux.intel.com, jikos@kernel.org, dan.j.williams@intel.com, tim.c.chen@linux.intel.com, tglx@linutronix.de, bp@alien8.de, linux-kernel@vger.kernel.org, ak@linux.intel.com, pjt@google.com, luto@kernel.org, gregkh@linux-foundation.org, torvalds@linux-foundation.org, peterz@infradead.org, dwmw@amazon.co.uk In-Reply-To: <20180113232730.31060.36287.stgit@tlendack-t1.amdoffice.net> References: <20180113232730.31060.36287.stgit@tlendack-t1.amdoffice.net> To: linux-tip-commits@vger.kernel.org Subject: [tip:x86/pti] x86/retpoline: Add LFENCE to the retpoline/RSB filling RSB macros Git-Commit-ID: 607d93a2658a0075047e87e47fde5bcc626a1918 X-Mailer: tip-git-log-daemon Robot-ID: Robot-Unsubscribe: Contact to get blacklisted from these emails MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Content-Type: text/plain; charset=UTF-8 Content-Disposition: inline Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Return-Path: Commit-ID: 607d93a2658a0075047e87e47fde5bcc626a1918 Gitweb: https://git.kernel.org/tip/607d93a2658a0075047e87e47fde5bcc626a1918 Author: Tom Lendacky AuthorDate: Sat, 13 Jan 2018 17:27:30 -0600 Committer: Thomas Gleixner CommitDate: Sun, 14 Jan 2018 18:22:15 +0100 x86/retpoline: Add LFENCE to the retpoline/RSB filling RSB macros The PAUSE instruction is currently used in the retpoline and RSB filling macros as a speculation trap. The use of PAUSE was originally suggested because it showed a very, very small difference in the amount of cycles/time used to execute the retpoline as compared to LFENCE. On AMD, the PAUSE instruction is not a serializing instruction, so the pause/jmp loop will use excess power as it is speculated over waiting for return to mispredict to the correct target. The RSB filling macro is applicable to AMD, and, if software is unable to verify that LFENCE is serializing on AMD (possible when running under a hypervisor), the generic retpoline support will be used and, so, is also applicable to AMD. Keep the current usage of PAUSE for Intel, but add an LFENCE instruction to the speculation trap for AMD. The same sequence has been adopted by GCC for the GCC generated retpolines. Signed-off-by: Tom Lendacky Signed-off-by: Thomas Gleixner Reviewed-by: Borislav Petkov Acked-by: David Woodhouse Acked-by: Arjan van de Ven Cc: Rik van Riel Cc: Andi Kleen Cc: Paul Turner Cc: Peter Zijlstra Cc: Tim Chen Cc: Jiri Kosina Cc: Dave Hansen Cc: Andy Lutomirski Cc: Josh Poimboeuf Cc: Dan Williams Cc: Linus Torvalds Cc: Greg Kroah-Hartman Cc: Kees Cook Link: https://lkml.kernel.org/r/20180113232730.31060.36287.stgit@tlendack-t1.amdoffice.net --- arch/x86/include/asm/nospec-branch.h | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/arch/x86/include/asm/nospec-branch.h b/arch/x86/include/asm/nospec-branch.h index 402a11c..7b45d84 100644 --- a/arch/x86/include/asm/nospec-branch.h +++ b/arch/x86/include/asm/nospec-branch.h @@ -11,7 +11,7 @@ * Fill the CPU return stack buffer. * * Each entry in the RSB, if used for a speculative 'ret', contains an - * infinite 'pause; jmp' loop to capture speculative execution. + * infinite 'pause; lfence; jmp' loop to capture speculative execution. * * This is required in various cases for retpoline and IBRS-based * mitigations for the Spectre variant 2 vulnerability. Sometimes to @@ -38,11 +38,13 @@ call 772f; \ 773: /* speculation trap */ \ pause; \ + lfence; \ jmp 773b; \ 772: \ call 774f; \ 775: /* speculation trap */ \ pause; \ + lfence; \ jmp 775b; \ 774: \ dec reg; \ @@ -73,6 +75,7 @@ call .Ldo_rop_\@ .Lspec_trap_\@: pause + lfence jmp .Lspec_trap_\@ .Ldo_rop_\@: mov \reg, (%_ASM_SP) @@ -165,6 +168,7 @@ " .align 16\n" \ "901: call 903f;\n" \ "902: pause;\n" \ + " lfence;\n" \ " jmp 902b;\n" \ " .align 16\n" \ "903: addl $4, %%esp;\n" \