Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S965209AbeALSqE (ORCPT + 1 other); Fri, 12 Jan 2018 13:46:04 -0500 Received: from mga02.intel.com ([134.134.136.20]:9148 "EHLO mga02.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S965134AbeALSqB (ORCPT ); Fri, 12 Jan 2018 13:46:01 -0500 X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.46,350,1511856000"; d="scan'208";a="166313624" From: Andi Kleen To: tglx@linutronix.de Cc: x86@kernel.org, dwmw@amazon.co.uk, linux-kernel@vger.kernel.org, pjt@google.com, torvalds@linux-foundation.org, gregkh@linux-foundation.org, peterz@infradead.org, luto@amacapital.net, thomas.lendacky@amd.com, arjan.van.de.ven@intel.com, Andi Kleen Subject: [PATCH 3/4] x86/retpoline: Fill return buffer after idle Date: Fri, 12 Jan 2018 10:45:49 -0800 Message-Id: <20180112184550.6573-4-andi@firstfloor.org> X-Mailer: git-send-email 2.14.3 In-Reply-To: <20180112184550.6573-1-andi@firstfloor.org> References: <20180112184550.6573-1-andi@firstfloor.org> Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Return-Path: From: Andi Kleen When we go into deeper idle states the return buffer could be cleared in MWAIT, but then another thread which wakes up earlier might be poisoning the indirect branch predictor. Then when the return buffer underflows there might an uncontrolled indirect branch. To guard against this always fill the return buffer when exiting idle. This is only enabled on Skylake. v2: Switch to using inline fill_return_buffer macro Also handle mwait_idle Port to new fill_return_buffer infrastructure Signed-off-by: Andi Kleen --- arch/x86/include/asm/mwait.h | 10 +++++++++- arch/x86/kernel/process.c | 1 + 2 files changed, 10 insertions(+), 1 deletion(-) diff --git a/arch/x86/include/asm/mwait.h b/arch/x86/include/asm/mwait.h index 39a2fb29378a..632b6b39fe01 100644 --- a/arch/x86/include/asm/mwait.h +++ b/arch/x86/include/asm/mwait.h @@ -6,6 +6,7 @@ #include #include +#include #define MWAIT_SUBSTATE_MASK 0xf #define MWAIT_CSTATE_MASK 0xf @@ -107,8 +108,15 @@ static inline void mwait_idle_with_hints(unsigned long eax, unsigned long ecx) } __monitor((void *)¤t_thread_info()->flags, 0, 0); - if (!need_resched()) + if (!need_resched()) { __mwait(eax, ecx); + /* + * idle could have cleared the return buffer, + * so fill it to prevent uncontrolled + * speculation. + */ + fill_return_buffer(); + } } current_clr_polling(); } diff --git a/arch/x86/kernel/process.c b/arch/x86/kernel/process.c index 3cb2486c47e4..9a7c1bb0e001 100644 --- a/arch/x86/kernel/process.c +++ b/arch/x86/kernel/process.c @@ -466,6 +466,7 @@ static __cpuidle void mwait_idle(void) __sti_mwait(0, 0); else local_irq_enable(); + fill_return_buffer(); trace_cpu_idle_rcuidle(PWR_EVENT_EXIT, smp_processor_id()); } else { local_irq_enable(); -- 2.14.3