From nobody Sun Feb 8 07:21:43 2026 Received: from galois.linutronix.de (Galois.linutronix.de [193.142.43.55]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7EF9B25E46A; Wed, 9 Apr 2025 11:44:26 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=193.142.43.55 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1744199069; cv=none; b=NwyNtWlQVxTXXcyMWnOdC4SXHTptRIFaZZAzRKKOHzse4pyCwm5hAGi5iAGnlkUdTIY30hZXt1hieG76rX+CbV1Iozhbz/wn05NBbiUBsnW3MvAkK27fUe1HGWWK7urrczbXElWyaP3SDrauuADNZNu8kFp1IbWOl+r/t1aRAPM= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1744199069; c=relaxed/simple; bh=Y6GcMKcCqNyBbDIDQwbvNYStMieKcZ2jn7prB87kqjY=; h=Date:From:To:Subject:Cc:In-Reply-To:References:MIME-Version: Message-ID:Content-Type; b=S21mEoouWMadVBmE4RINP4drfvHMOWGwSO6Zi5wFoWetpOumfhRrLfBQnCrs8SLsDiWl0WxbOsKClJROmw1aZZx4rklKwQmoepiiLTTqWVmBUr5V7BKCBus2Op2mDD3zCRAwZ40sGb9lXEWpOI5Y82TwAL5Brecj7AjX6xLZ1hg= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linutronix.de; spf=pass smtp.mailfrom=linutronix.de; dkim=pass (2048-bit key) header.d=linutronix.de header.i=@linutronix.de header.b=EghB5Ni2; dkim=permerror (0-bit key) header.d=linutronix.de header.i=@linutronix.de header.b=OBItUrza; arc=none smtp.client-ip=193.142.43.55 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linutronix.de Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linutronix.de Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=linutronix.de header.i=@linutronix.de header.b="EghB5Ni2"; dkim=permerror (0-bit key) header.d=linutronix.de header.i=@linutronix.de header.b="OBItUrza" Date: Wed, 09 Apr 2025 11:44:24 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linutronix.de; s=2020; t=1744199065; h=from:from:sender:sender:reply-to:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=s5N4SIsMP1iBn0ZhJ/u3AKuEDGC7TFeKQOEOaIYX6d4=; b=EghB5Ni20uKa+7CVQ4lLH3W7c7Do8WgmS/vNjfhkAvlR7g1PZvryUXop3Fo20tpu7yhQoH I05MeWyLJ7XtTMJQUrWWrZprfho5ZZTOd5FLJDmVhsFayPCB/QTpPa1xpRi/zzN2/tarpW XpozeVEMhtuqBW+y97/JsuYhWjSkWOBWW3P7GNQ5fN3gdMvU+JgIBH04JZTgcCxdDX3Rmc foyJk9BpkBqOxa15b12Au3LEwYorKtwtsOVOmrSOjV5bmoJRkk8PRvR/SrurqlOtdHC8EC SVfvBMNLF66STzYMB7RDfZZlmXZXqxvvINU3edK18yzDHRjdmfZQkKrvCUTqMg== DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=linutronix.de; s=2020e; t=1744199065; h=from:from:sender:sender:reply-to:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=s5N4SIsMP1iBn0ZhJ/u3AKuEDGC7TFeKQOEOaIYX6d4=; b=OBItUrzazz4/iPQQ2rXbWClPmUgXfi0NyfUQM3CVJ+lonrpZ3HewAMRlnxoiHrLNbd+mwd PecZnN/JPDZepeCQ== From: "tip-bot2 for Josh Poimboeuf" Sender: tip-bot2@linutronix.de Reply-to: linux-kernel@vger.kernel.org To: linux-tip-commits@vger.kernel.org Subject: [tip: x86/urgent] x86/bugs: Fix RSB clearing in indirect_branch_prediction_barrier() Cc: Josh Poimboeuf , Ingo Molnar , Nikolay Borisov , x86@kernel.org, linux-kernel@vger.kernel.org In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Message-ID: <174419906465.31282.1403799089359507668.tip-bot2@tip-bot2> Robot-ID: Robot-Unsubscribe: Contact to get blacklisted from these emails Precedence: bulk Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable The following commit has been merged into the x86/urgent branch of tip: Commit-ID: b1b19cfcf4656c75088dc06b7499f493e0dec3e5 Gitweb: https://git.kernel.org/tip/b1b19cfcf4656c75088dc06b7499f493e= 0dec3e5 Author: Josh Poimboeuf AuthorDate: Tue, 08 Apr 2025 14:47:32 -07:00 Committer: Ingo Molnar CommitterDate: Wed, 09 Apr 2025 12:41:30 +02:00 x86/bugs: Fix RSB clearing in indirect_branch_prediction_barrier() IBPB is expected to clear the RSB. However, if X86_BUG_IBPB_NO_RET is set, that doesn't happen. Make indirect_branch_prediction_barrier() take that into account by calling write_ibpb() which clears RSB on X86_BUG_IBPB_NO_RET: /* Make sure IBPB clears return stack preductions too. */ FILL_RETURN_BUFFER %rax, RSB_CLEAR_LOOPS, X86_BUG_IBPB_NO_RET Note that, as of the previous patch, write_ibpb() also reads 'x86_pred_cmd' in order to use SBPB when applicable: movl _ASM_RIP(x86_pred_cmd), %eax Therefore that existing behavior in indirect_branch_prediction_barrier() is not lost. Fixes: 50e4b3b94090 ("x86/entry: Have entry_ibpb() invalidate return predic= tions") Signed-off-by: Josh Poimboeuf Signed-off-by: Ingo Molnar Reviewed-by: Nikolay Borisov Link: https://lore.kernel.org/r/bba68888c511743d4cd65564d1fc41438907523f.17= 44148254.git.jpoimboe@kernel.org --- arch/x86/include/asm/nospec-branch.h | 6 +++--- arch/x86/kernel/cpu/bugs.c | 1 - 2 files changed, 3 insertions(+), 4 deletions(-) diff --git a/arch/x86/include/asm/nospec-branch.h b/arch/x86/include/asm/no= spec-branch.h index 591d1db..5c43f14 100644 --- a/arch/x86/include/asm/nospec-branch.h +++ b/arch/x86/include/asm/nospec-branch.h @@ -514,11 +514,11 @@ void alternative_msr_write(unsigned int msr, u64 val,= unsigned int feature) : "memory"); } =20 -extern u64 x86_pred_cmd; - static inline void indirect_branch_prediction_barrier(void) { - alternative_msr_write(MSR_IA32_PRED_CMD, x86_pred_cmd, X86_FEATURE_IBPB); + asm_inline volatile(ALTERNATIVE("", "call write_ibpb", X86_FEATURE_IBPB) + : ASM_CALL_CONSTRAINT + :: "rax", "rcx", "rdx", "memory"); } =20 /* The Intel SPEC CTRL MSR base value cache */ diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c index 608bbe6..9926509 100644 --- a/arch/x86/kernel/cpu/bugs.c +++ b/arch/x86/kernel/cpu/bugs.c @@ -59,7 +59,6 @@ DEFINE_PER_CPU(u64, x86_spec_ctrl_current); EXPORT_PER_CPU_SYMBOL_GPL(x86_spec_ctrl_current); =20 u64 x86_pred_cmd __ro_after_init =3D PRED_CMD_IBPB; -EXPORT_SYMBOL_GPL(x86_pred_cmd); =20 static u64 __ro_after_init x86_arch_cap_msr;