]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
x86/bugs: Fix RSB clearing in indirect_branch_prediction_barrier()
authorJosh Poimboeuf <jpoimboe@kernel.org>
Tue, 8 Apr 2025 21:47:32 +0000 (14:47 -0700)
committerIngo Molnar <mingo@kernel.org>
Wed, 9 Apr 2025 10:41:30 +0000 (12:41 +0200)
commitb1b19cfcf4656c75088dc06b7499f493e0dec3e5
tree07b618cf223066705f26c761cdc18c9a2b47ec97
parentfc9fd3f98423367c79e0bd85a9515df26dc1b3cc
x86/bugs: Fix RSB clearing in indirect_branch_prediction_barrier()

IBPB is expected to clear the RSB.  However, if X86_BUG_IBPB_NO_RET is
set, that doesn't happen.  Make indirect_branch_prediction_barrier()
take that into account by calling write_ibpb() which clears RSB on
X86_BUG_IBPB_NO_RET:

/* Make sure IBPB clears return stack preductions too. */
FILL_RETURN_BUFFER %rax, RSB_CLEAR_LOOPS, X86_BUG_IBPB_NO_RET

Note that, as of the previous patch, write_ibpb() also reads
'x86_pred_cmd' in order to use SBPB when applicable:

movl _ASM_RIP(x86_pred_cmd), %eax

Therefore that existing behavior in indirect_branch_prediction_barrier()
is not lost.

Fixes: 50e4b3b94090 ("x86/entry: Have entry_ibpb() invalidate return predictions")
Signed-off-by: Josh Poimboeuf <jpoimboe@kernel.org>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Reviewed-by: Nikolay Borisov <nik.borisov@suse.com>
Link: https://lore.kernel.org/r/bba68888c511743d4cd65564d1fc41438907523f.1744148254.git.jpoimboe@kernel.org
arch/x86/include/asm/nospec-branch.h
arch/x86/kernel/cpu/bugs.c