x86/entry: Have entry_ibpb() invalidate return predictions

entry_ibpb() should invalidate all indirect predictions, including return
target predictions. Not all IBPB implementations do this, in which case the
fallback is RSB filling.

Prevent SRSO-style hijacks of return predictions following IBPB, as the return
target predictor can be corrupted before the IBPB completes.

  [ bp: Massage. ]

Signed-off-by: Johannes Wikner <kwikner@ethz.ch>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Cc: <stable@kernel.org>

diff --git a/arch/x86/entry/entry.S b/arch/x86/entry/entry.S
index d9feadffa972dadf0e2dcf5804ac50f9827d6c07..324686bca36813a16168fda28bf0875b23457efc 100644 (file)
--- a/arch/x86/entry/entry.S
+++ b/arch/x86/entry/entry.S
@@ -9,6 +9,8 @@
 #include <asm/unwind_hints.h>
 #include <asm/segment.h>
 #include <asm/cache.h>
+#include <asm/cpufeatures.h>
+#include <asm/nospec-branch.h>
 
 #include "calling.h"
 
@@ -19,6 +21,9 @@ SYM_FUNC_START(entry_ibpb)
        movl    $PRED_CMD_IBPB, %eax
        xorl    %edx, %edx
        wrmsr
+
+       /* Make sure IBPB clears return stack preductions too. */
+       FILL_RETURN_BUFFER %rax, RSB_CLEAR_LOOPS, X86_BUG_IBPB_NO_RET
        RET
 SYM_FUNC_END(entry_ibpb)
 /* For KVM */