Commit b1b19cfc authored by Josh Poimboeuf's avatar Josh Poimboeuf Committed by Ingo Molnar
Browse files

x86/bugs: Fix RSB clearing in indirect_branch_prediction_barrier() 



IBPB is expected to clear the RSB.  However, if X86_BUG_IBPB_NO_RET is
set, that doesn't happen.  Make indirect_branch_prediction_barrier()
take that into account by calling write_ibpb() which clears RSB on
X86_BUG_IBPB_NO_RET:

	/* Make sure IBPB clears return stack preductions too. */
	FILL_RETURN_BUFFER %rax, RSB_CLEAR_LOOPS, X86_BUG_IBPB_NO_RET

Note that, as of the previous patch, write_ibpb() also reads
'x86_pred_cmd' in order to use SBPB when applicable:

	movl	_ASM_RIP(x86_pred_cmd), %eax

Therefore that existing behavior in indirect_branch_prediction_barrier()
is not lost.

Fixes: 50e4b3b9 ("x86/entry: Have entry_ibpb() invalidate return predictions")
Signed-off-by: default avatarJosh Poimboeuf <jpoimboe@kernel.org>
Signed-off-by: default avatarIngo Molnar <mingo@kernel.org>
Reviewed-by: default avatarNikolay Borisov <nik.borisov@suse.com>
Link: https://lore.kernel.org/r/bba68888c511743d4cd65564d1fc41438907523f.1744148254.git.jpoimboe@kernel.org
parent fc9fd3f9

arch/x86/include/asm/nospec-branch.h

+3 −3
Original line number Diff line number Diff line
@@ -514,11 +514,11 @@ void alternative_msr_write(unsigned int msr, u64 val, unsigned int feature) 
		: "memory");

}



extern u64 x86_pred_cmd;



static inline void indirect_branch_prediction_barrier(void)

{

	alternative_msr_write(MSR_IA32_PRED_CMD, x86_pred_cmd, X86_FEATURE_IBPB);

	asm_inline volatile(ALTERNATIVE("", "call write_ibpb", X86_FEATURE_IBPB)

			    : ASM_CALL_CONSTRAINT

			    :: "rax", "rcx", "rdx", "memory");

}



/* The Intel SPEC CTRL MSR base value cache */

arch/x86/kernel/cpu/bugs.c

+0 −1
Original line number Diff line number Diff line
@@ -59,7 +59,6 @@ DEFINE_PER_CPU(u64, x86_spec_ctrl_current); 
EXPORT_PER_CPU_SYMBOL_GPL(x86_spec_ctrl_current);



u64 x86_pred_cmd __ro_after_init = PRED_CMD_IBPB;

EXPORT_SYMBOL_GPL(x86_pred_cmd);



static u64 __ro_after_init x86_arch_cap_msr;