[v2] x86/kvm/emulate: Avoid RET for FASTOPs

[PATCH v2 10/12] x86,nospec: Simplify {JMP,CALL}_NOSPEC (part 2)

Posted by Peter Zijlstra 1 week, 5 days ago

Counterpart to 09d09531a51a ("x86,nospec: Simplify
{JMP,CALL}_NOSPEC"), x86_64 will rewrite all this anyway, see
apply_retpoline.

Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
---
 arch/x86/include/asm/nospec-branch.h |   29 +++++++++++------------------
 1 file changed, 11 insertions(+), 18 deletions(-)

--- a/arch/x86/include/asm/nospec-branch.h
+++ b/arch/x86/include/asm/nospec-branch.h
@@ -429,31 +429,24 @@ static inline void call_depth_return_thu
 
 #ifdef CONFIG_X86_64
 
+#define __CS_PREFIX						\
+	".irp rs,r8,r9,r10,r11,r12,r13,r14,r15\n"		\
+	".ifc %V[thunk_target],\\rs\n"				\
+	".byte 0x2e\n"						\
+	".endif\n"						\
+	".endr\n"
+
 /*
  * Inline asm uses the %V modifier which is only in newer GCC
  * which is ensured when CONFIG_MITIGATION_RETPOLINE is defined.
  */
 # define CALL_NOSPEC						\
-	ALTERNATIVE_2(						\
-	ANNOTATE_RETPOLINE_SAFE					\
-	"call *%[thunk_target]\n",				\
-	"call __x86_indirect_thunk_%V[thunk_target]\n",		\
-	X86_FEATURE_RETPOLINE,					\
-	"lfence;\n"						\
-	ANNOTATE_RETPOLINE_SAFE					\
-	"call *%[thunk_target]\n",				\
-	X86_FEATURE_RETPOLINE_LFENCE)
+	__CS_PREFIX						\
+	"call __x86_indirect_thunk_%V[thunk_target]\n"
 
 # define JMP_NOSPEC						\
-	ALTERNATIVE_2(						\
-	ANNOTATE_RETPOLINE_SAFE					\
-	"jmp *%[thunk_target]\n",				\
-	"jmp __x86_indirect_thunk_%V[thunk_target]\n",		\
-	X86_FEATURE_RETPOLINE,					\
-	"lfence;\n"						\
-	ANNOTATE_RETPOLINE_SAFE					\
-	"jmp *%[thunk_target]\n",				\
-	X86_FEATURE_RETPOLINE_LFENCE)
+	__CS_PREFIX						\
+	"jmp __x86_indirect_thunk_%V[thunk_target]\n"
 
 # define THUNK_TARGET(addr) [thunk_target] "r" (addr)

Re: [PATCH v2 10/12] x86,nospec: Simplify {JMP,CALL}_NOSPEC (part 2)

Posted by Josh Poimboeuf 1 week, 1 day ago

On Mon, Nov 11, 2024 at 12:59:45PM +0100, Peter Zijlstra wrote:
> Counterpart to 09d09531a51a ("x86,nospec: Simplify
> {JMP,CALL}_NOSPEC"), x86_64 will rewrite all this anyway, see
> apply_retpoline.
> 
> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
> ---
>  arch/x86/include/asm/nospec-branch.h |   29 +++++++++++------------------
>  1 file changed, 11 insertions(+), 18 deletions(-)
> 
> --- a/arch/x86/include/asm/nospec-branch.h
> +++ b/arch/x86/include/asm/nospec-branch.h
> @@ -429,31 +429,24 @@ static inline void call_depth_return_thu
>  
>  #ifdef CONFIG_X86_64
>  
> +#define __CS_PREFIX						\
> +	".irp rs,r8,r9,r10,r11,r12,r13,r14,r15\n"		\
> +	".ifc %V[thunk_target],\\rs\n"				\
> +	".byte 0x2e\n"						\
> +	".endif\n"						\
> +	".endr\n"

After staring at this for some minutes I'm thinking it would be helpful
to add a comment saying this is equivalent to
-mindirect-branch-cs-prefix.

-- 
Josh

Re: [PATCH v2 10/12] x86,nospec: Simplify {JMP,CALL}_NOSPEC (part 2)

Posted by Peter Zijlstra 1 week ago

On Fri, Nov 15, 2024 at 10:40:56AM -0800, Josh Poimboeuf wrote:
> On Mon, Nov 11, 2024 at 12:59:45PM +0100, Peter Zijlstra wrote:
> > Counterpart to 09d09531a51a ("x86,nospec: Simplify
> > {JMP,CALL}_NOSPEC"), x86_64 will rewrite all this anyway, see
> > apply_retpoline.
> > 
> > Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
> > ---
> >  arch/x86/include/asm/nospec-branch.h |   29 +++++++++++------------------
> >  1 file changed, 11 insertions(+), 18 deletions(-)
> > 
> > --- a/arch/x86/include/asm/nospec-branch.h
> > +++ b/arch/x86/include/asm/nospec-branch.h
> > @@ -429,31 +429,24 @@ static inline void call_depth_return_thu
> >  
> >  #ifdef CONFIG_X86_64
> >  
> > +#define __CS_PREFIX						\
> > +	".irp rs,r8,r9,r10,r11,r12,r13,r14,r15\n"		\
> > +	".ifc %V[thunk_target],\\rs\n"				\
> > +	".byte 0x2e\n"						\
> > +	".endif\n"						\
> > +	".endr\n"
> 
> After staring at this for some minutes I'm thinking it would be helpful
> to add a comment saying this is equivalent to
> -mindirect-branch-cs-prefix.

I'll just copy-paste the comment from the other __CS_PREFIX elsewhere in
this file :-)