Print this page 
16413 Post-barrier Return Stack Buffer (consider no-eIBRS cases)
Split Close
Expand all
Collapse all
          --- old/usr/src/uts/intel/ml/retpoline.S
          +++ new/usr/src/uts/intel/ml/retpoline.S
↓ open down ↓ 3 lines elided ↑ open up ↑ 
   4    4   * You may only use this file in accordance with the terms of version
   5    5   * 1.0 of the CDDL.
   6    6   *
   7    7   * A full copy of the text of the CDDL should have accompanied this
   8    8   * source.  A copy of the CDDL is also available via the Internet at
   9    9   * http://www.illumos.org/license/CDDL.
  10   10   */
  11   11  
  12   12  /*
  13   13   * Copyright 2019 Joyent, Inc.
       14 + * Copyright 2024 MNX Cloud, Inc.
  14   15   */
  15   16  
  16   17          .file   "retpoline.s"
  17   18  
  18   19  /*
  19   20   * This file implements the various hooks that are needed for retpolines and
  20   21   * return stack buffer (RSB) stuffing. For more information, please see the
  21   22   * 'Speculative Execution CPU Side Channel Security' section of the
  22   23   * uts/i86pc/os/cpuid.c big theory statement.
  23   24   */
↓ open down ↓ 88 lines elided ↑ open up ↑ 
 112  113          RETPOLINE_MKJUMP(r8)
 113  114          RETPOLINE_MKJUMP(r9)
 114  115          RETPOLINE_MKJUMP(r10)
 115  116          RETPOLINE_MKJUMP(r11)
 116  117          RETPOLINE_MKJUMP(r12)
 117  118          RETPOLINE_MKJUMP(r13)
 118  119          RETPOLINE_MKJUMP(r14)
 119  120          RETPOLINE_MKJUMP(r15)
 120  121  
 121  122          /*
 122      -         * The x86_rsb_stuff function is called from pretty arbitrary
 123      -         * contexts. It's much easier for us to save and restore all the
 124      -         * registers we touch rather than clobber them for callers. You must
 125      -         * preserve this property or the system will panic at best.
      123 +         * The x86_rsb_stuff{,_vmexit} functions can be called from pretty
      124 +         * arbitrary contexts. It's much easier for us to save and restore all
      125 +         * the registers we touch rather than clobber them for callers. You
      126 +         * must preserve this property or the system will panic at best.
      127 +         *
      128 +         * The two entry points are because the need to RSB stuff on Intel
      129 +         * depends greatly on factors that are different in the VMEXIT case,
      130 +         * vs. the other switching cases.  See cpuid.c's cpuid_patch_rsb()
      131 +         * for details.
 126  132           */
 127      -        ENTRY(x86_rsb_stuff)
 128      -        /*
 129      -         * These nops are present so we can patch a ret instruction if we need
 130      -         * to disable RSB stuffing because enhanced IBRS is present or we're
 131      -         * disabling mitigations.
 132      -         */
      133 +        ENTRY(x86_rsb_stuff_vmexit)
 133  134          nop
      135 +        ALTENTRY(x86_rsb_stuff)
 134  136          nop
 135  137          pushq   %rdi
 136  138          pushq   %rax
 137  139          movl    $16, %edi
 138  140          movq    %rsp, %rax
 139  141  rsb_loop:
 140  142          call    2f
 141  143  1:
 142  144          pause
 143  145          call    1b
↓ open down ↓ 3 lines elided ↑ open up ↑ 
 147  149          pause
 148  150          call    1b
 149  151  2:
 150  152          subl    $1, %edi
 151  153          jnz     rsb_loop
 152  154          movq    %rax, %rsp
 153  155          popq    %rax
 154  156          popq    %rdi
 155  157          ret
 156  158          SET_SIZE(x86_rsb_stuff)
      159 +        SET_SIZE(x86_rsb_stuff_vmexit)
 157  160  
 158  161  #elif defined(__i386)
 159  162  
 160  163  /*
 161  164   * While the kernel is 64-bit only, dboot is still 32-bit, so there are a
 162  165   * limited number of variants that are used for 32-bit. However as dboot is
 163  166   * short lived and uses them sparingly, we only do the full variant and do not
 164  167   * have an AMD specific version.
 165  168   */
 166  169
↓ open down ↓ 18 lines elided ↑ open up ↑ 
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX