On Tue, Aug 16, 2022 at 02:28:36PM +0200, Peter Zijlstra wrote:
Replying here, because obviously there's no actual posting of this patch... :/
{sigh} True :(
--- a/arch/x86/include/asm/nospec-branch.h +++ b/arch/x86/include/asm/nospec-branch.h @@ -118,13 +118,28 @@ #endif .endm +.macro ISSUE_UNBALANCED_RET_GUARD
- ANNOTATE_INTRA_FUNCTION_CALL
- call .Lunbalanced_ret_guard_@
- int3
+.Lunbalanced_ret_guard_@:
- add $(BITS_PER_LONG/8), %_ASM_SP
- lfence
+.endm
- /*
*/
- A simpler FILL_RETURN_BUFFER macro. Don't make people use the CPP
- monstrosity above, manually.
-.macro FILL_RETURN_BUFFER reg:req nr:req ftr:req +.macro FILL_RETURN_BUFFER reg:req nr:req ftr:req ftr2 +.ifb \ftr2 ALTERNATIVE "jmp .Lskip_rsb_@", "", \ftr +.else
- ALTERNATIVE_2 "jmp .Lskip_rsb_@", "", \ftr, "jmp .Lunbalanced_@", \ftr2
+.endif __FILL_RETURN_BUFFER(\reg,\nr,%_ASM_SP) +.Lunbalanced_@:
- ISSUE_UNBALANCED_RET_GUARD
.Lskip_rsb_@: .endm
(/me deletes all the swear words and starts over)
This must absolutely be the most horrible patch you could come up with, no? I suppose that's the price of me taking PTO :-(
Could you please test this; I've only compiled it.
Subject: x86/nospec: Unwreck the RSB stuffing
Commit 2b1299322016 ("x86/speculation: Add RSB VM Exit protections") made a right mess of the RSB stuffing, rewrite the whole thing to not suck.
Thanks to Andrew for the enlightening comment about Post-Barrier RSB things so we can make this code less magical.
Signed-off-by: Peter Zijlstra (Intel) peterz@infradead.org
I need an Intel person to test this as I have no idea how to do so as this is an issue in Linus's tree.
thanks,
greg k-h