x86/nospec: Fix i386 RSB stuffing
commit 332924973725e8cdcc783c175f68cf7e162cb9e5 upstream. Turns out that i386 doesn't unconditionally have LFENCE, as such the loop in __FILL_RETURN_BUFFER isn't actually speculation safe on such chips. Fixes: ba6e31af2be9 ("x86/speculation: Add LFENCE to RSB fill sequence") Reported-by: Ben Hutchings <ben@decadent.org.uk> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Link: https://lkml.kernel.org/r/Yv9tj9vbQ9nNlXoY@worktop.programming.kicks-ass.net [bwh: Backported to 4.19/5.4: - __FILL_RETURN_BUFFER takes an sp parameter - Open-code __FILL_RETURN_SLOT] Signed-off-by: Ben Hutchings <ben@decadent.org.uk> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
64f9755b40
commit
4e8d7039cf
@ -44,6 +44,7 @@
|
|||||||
* the optimal version — two calls, each with their own speculation
|
* the optimal version — two calls, each with their own speculation
|
||||||
* trap should their return address end up getting used, in a loop.
|
* trap should their return address end up getting used, in a loop.
|
||||||
*/
|
*/
|
||||||
|
#ifdef CONFIG_X86_64
|
||||||
#define __FILL_RETURN_BUFFER(reg, nr, sp) \
|
#define __FILL_RETURN_BUFFER(reg, nr, sp) \
|
||||||
mov $(nr/2), reg; \
|
mov $(nr/2), reg; \
|
||||||
771: \
|
771: \
|
||||||
@ -64,6 +65,19 @@
|
|||||||
add $(BITS_PER_LONG/8) * nr, sp; \
|
add $(BITS_PER_LONG/8) * nr, sp; \
|
||||||
/* barrier for jnz misprediction */ \
|
/* barrier for jnz misprediction */ \
|
||||||
lfence;
|
lfence;
|
||||||
|
#else
|
||||||
|
/*
|
||||||
|
* i386 doesn't unconditionally have LFENCE, as such it can't
|
||||||
|
* do a loop.
|
||||||
|
*/
|
||||||
|
#define __FILL_RETURN_BUFFER(reg, nr, sp) \
|
||||||
|
.rept nr; \
|
||||||
|
call 772f; \
|
||||||
|
int3; \
|
||||||
|
772:; \
|
||||||
|
.endr; \
|
||||||
|
add $(BITS_PER_LONG/8) * nr, sp;
|
||||||
|
#endif
|
||||||
|
|
||||||
#define __ISSUE_UNBALANCED_RET_GUARD(sp) \
|
#define __ISSUE_UNBALANCED_RET_GUARD(sp) \
|
||||||
call 881f; \
|
call 881f; \
|
||||||
|
Loading…
Reference in New Issue
Block a user