Commit bef64b59 authored Jan 31, 2023 by Peter Zijlstra Committed by Jialin Zhang Feb 01, 2023

x86/nospec: Fix i386 RSB stuffing

stable inclusion
from stable-v5.10.141
commit e5796ff9acc5e922be3b1a599e004534e4fe23cf
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I685FC

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=e5796ff9acc5e922be3b1a599e004534e4fe23cf



--------------------------------

commit 33292497 upstream.

Turns out that i386 doesn't unconditionally have LFENCE, as such the
loop in __FILL_RETURN_BUFFER isn't actually speculation safe on such
chips.

Fixes: ba6e31af ("x86/speculation: Add LFENCE to RSB fill sequence")
Reported-by: Ben Hutchings <ben@decadent.org.uk>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://lkml.kernel.org/r/Yv9tj9vbQ9nNlXoY@worktop.programming.kicks-ass.net


Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Jialin Zhang <zhangjialin11@huawei.com>
Reviewed-by: Zheng Zengkai <zhengzengkai@huawei.com>

parent 4b944c0f

arch/x86/include/asm/nospec-branch.h

+12 −0

Original line number	Diff line number	Diff line
		@@ -50,6 +50,7 @@
		* the optimal version — two calls, each with their own speculation
		* trap should their return address end up getting used, in a loop.
		*/
		#ifdef CONFIG_X86_64
		#define __FILL_RETURN_BUFFER(reg, nr) \
		mov $(nr/2), reg; \
		771: \
		@@ -60,6 +61,17 @@
		jnz 771b; \
		/* barrier for jnz misprediction */ \
		lfence;
		#else
		/*
		* i386 doesn't unconditionally have LFENCE, as such it can't
		* do a loop.
		*/
		#define __FILL_RETURN_BUFFER(reg, nr) \
		.rept nr; \
		__FILL_RETURN_SLOT; \
		.endr; \
		add $(BITS_PER_LONG/8) * nr, %_ASM_SP;
		#endif

		/*
		* Stuff a single RSB slot.