Commit 33292497 authored by Peter Zijlstra's avatar Peter Zijlstra
Browse files

x86/nospec: Fix i386 RSB stuffing 



Turns out that i386 doesn't unconditionally have LFENCE, as such the
loop in __FILL_RETURN_BUFFER isn't actually speculation safe on such
chips.

Fixes: ba6e31af ("x86/speculation: Add LFENCE to RSB fill sequence")
Reported-by: default avatarBen Hutchings <ben@decadent.org.uk>
Signed-off-by: default avatarPeter Zijlstra (Intel) <peterz@infradead.org>
Link: https://lkml.kernel.org/r/Yv9tj9vbQ9nNlXoY@worktop.programming.kicks-ass.net
parent 4e3aa923

arch/x86/include/asm/nospec-branch.h

+12 −0
Original line number Diff line number Diff line
@@ -50,6 +50,7 @@ 
 * the optimal version - two calls, each with their own speculation

 * trap should their return address end up getting used, in a loop.

 */

#ifdef CONFIG_X86_64

#define __FILL_RETURN_BUFFER(reg, nr)			\

	mov	$(nr/2), reg;				\

771:							\
@@ -60,6 +61,17 @@ 
	jnz	771b;					\

	/* barrier for jnz misprediction */		\

	lfence;

#else

/*

 * i386 doesn't unconditionally have LFENCE, as such it can't

 * do a loop.

 */

#define __FILL_RETURN_BUFFER(reg, nr)			\

	.rept nr;					\

	__FILL_RETURN_SLOT;				\

	.endr;						\

	add	$(BITS_PER_LONG/8) * nr, %_ASM_SP;

#endif



/*

 * Stuff a single RSB slot.