Re: [PATCH 3/3] x86/bugs: Remove support for Spectre v2 LFENCE "retpolines"

[Josh Poimboeuf <jpoimboe@kernel.org>]

On Fri, Apr 12, 2024 at 09:49:33PM +0100, Andrew Cooper wrote:
> On 12/04/2024 7:10 pm, Josh Poimboeuf wrote:
> > I found several bugs where code assumes that X86_FEATURE_RETPOLINE
> > actually means retpolines (imagine that!).
> 
> Yeah :(   One could also imagine a past where that was pointed out, or
> just read about it in the archives.
> 
> >   In fact that feature also
> > includes the original AMD LFENCE "retpolines", which aren't in fact
> > retpolines.
> >
> > Really, those "retpolines" should just be removed.  They're already
> > considered vulnerable due to the fact that the speculative window after
> > the indirect branch can still be long enough to do multiple dependent
> > loads.  And recent tooling makes such gadgets easier to find.
> 
> There are two Atom CPUs which are not repotline safe, and for which
> Intel released a statement saying "use lfence/jmp" on these.
> 
> I'm still trying to find it...

Any luck finding it?  The only thing I found [1] isn't exactly a ringing
endorsement of LFENCE;JMP over retpolines.

[1] https://www.intel.com/content/www/us/en/developer/articles/technical/software-security-guidance/technical-documentation/branch-history-injection.html

-- 
Josh