Sean Christopherson b63f20a778 x86/retpoline: Don't clobber RFLAGS during CALL_NOSPEC on i386 ... Use 'lea' instead of 'add' when adjusting %rsp in CALL_NOSPEC so as to avoid clobbering flags. KVM's emulator makes indirect calls into a jump table of sorts, where the destination of the CALL_NOSPEC is a small blob of code that performs fast emulation by executing the target instruction with fixed operands. adcb_al_dl: 0x000339f8 <+0>: adc %dl,%al 0x000339fa <+2>: ret A major motiviation for doing fast emulation is to leverage the CPU to handle consumption and manipulation of arithmetic flags, i.e. RFLAGS is both an input and output to the target of CALL_NOSPEC. Clobbering flags results in all sorts of incorrect emulation, e.g. Jcc instructions often take the wrong path. Sans the nops... asm("push %[flags]; popf; " CALL_NOSPEC " ; pushf; pop %[flags]\n" 0x0003595a <+58>: mov 0xc0(%ebx),%eax 0x00035960 <+64>: mov 0x60(%ebx),%edx 0x00035963 <+67>: mov 0x90(%ebx),%ecx 0x00035969 <+73>: push %edi 0x0003596a <+74>: popf 0x0003596b <+75>: call *%esi 0x000359a0 <+128>: pushf 0x000359a1 <+129>: pop %edi 0x000359a2 <+130>: mov %eax,0xc0(%ebx) 0x000359b1 <+145>: mov %edx,0x60(%ebx) ctxt->eflags = (ctxt->eflags & ~EFLAGS_MASK) | (flags & EFLAGS_MASK); 0x000359a8 <+136>: mov -0x10(%ebp),%eax 0x000359ab <+139>: and $0x8d5,%edi 0x000359b4 <+148>: and $0xfffff72a,%eax 0x000359b9 <+153>: or %eax,%edi 0x000359bd <+157>: mov %edi,0x4(%ebx) For the most part this has gone unnoticed as emulation of guest code that can trigger fast emulation is effectively limited to MMIO when running on modern hardware, and MMIO is rarely, if ever, accessed by instructions that affect or consume flags. Breakage is almost instantaneous when running with unrestricted guest disabled, in which case KVM must emulate all instructions when the guest has invalid state, e.g. when the guest is in Big Real Mode during early BIOS. Fixes: 776b043848fd2 ("x86/retpoline: Add initial retpoline support") Fixes: 1a29b5b7f3 ("KVM: x86: Make indirect calls in emulator speculation safe") Signed-off-by: Sean Christopherson <sean.j.christopherson@intel.com> Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org> Cc: stable@vger.kernel.org Link: https://lkml.kernel.org/r/20190822211122.27579-1-sean.j.christopherson@intel.com		2019-08-23 17:38:13 +02:00
..
boot	x86/boot/compressed/64: Fix boot on machines with broken E820 table	2019-08-19 15:59:13 +02:00
configs
crypto
entry	Merge branch master from git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git	2019-07-28 22:22:40 +02:00
events	perf/x86/intel: Mark expected switch fall-throughs	2019-07-25 20:10:05 -05:00
hyperv
ia32
include	x86/retpoline: Don't clobber RFLAGS during CALL_NOSPEC on i386	2019-08-23 17:38:13 +02:00
kernel	x86/CPU/AMD: Clear RDRAND CPUID bit on AMD family 15h/16h	2019-08-19 19:42:52 +02:00
kvm	KVM/arm fixes for 5.3	2019-08-09 16:53:39 +02:00
lib	x86/lib/cpu: Address missing prototypes warning	2019-08-08 08:25:53 +02:00
math-emu	x86/fpu/math-emu: Address fallthrough warnings	2019-08-12 20:35:05 +02:00
mm	x86/mm: Sync also unmappings in vmalloc_sync_all()	2019-07-22 10:18:30 +02:00
net
oprofile
pci
platform
power	x86/CPU/AMD: Clear RDRAND CPUID bit on AMD family 15h/16h	2019-08-19 19:42:52 +02:00
purgatory	x86/purgatory: Use CFLAGS_REMOVE rather than reset KBUILD_CFLAGS	2019-08-08 08:25:53 +02:00
ras
realmode
tools
um
video
xen	Merge branch 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2019-07-20 11:24:49 -07:00
.gitignore
Kbuild
Kconfig	dma-mapping fixes for 5.3-rc1	2019-07-20 12:09:52 -07:00
Kconfig.cpu
Kconfig.debug
Makefile
Makefile_32.cpu
Makefile.um