[lkml]   [2021]   [Nov]   [26]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
Patch in this message
Subject[PATCH V6 01/49] x86/entry: Add fence for kernel entry swapgs in paranoid_entry()
From: Lai Jiangshan <>

Commit 18ec54fdd6d18 ("x86/speculation: Prepare entry code for Spectre
v1 swapgs mitigations") adds FENCE_SWAPGS_{KERNEL|USER}_ENTRY
for conditional swapgs. And in paranoid_entry(), it uses only
FENCE_SWAPGS_KERNEL_ENTRY for both branches. It is because the fence
is required for both cases since the CR3 write is conditinal even PTI
is enabled.

But commit 96b2371413e8f ("x86/entry/64: Switch CR3 before SWAPGS in
paranoid entry") switches the code order and changes the branches.
And it misses the needed FENCE_SWAPGS_KERNEL_ENTRY for user gsbase case.

Add it back by changing the branches so that FENCE_SWAPGS_KERNEL_ENTRY
can cover both branches.

Fixes: Commit 96b2371413e8f ("x86/entry/64: Switch CR3 before SWAPGS in paranoid entry")
Cc: Josh Poimboeuf <>
Cc: Chang S. Bae <>
Cc: Sasha Levin <>
Signed-off-by: Lai Jiangshan <>
arch/x86/entry/entry_64.S | 10 ++++------
1 file changed, 4 insertions(+), 6 deletions(-)

diff --git a/arch/x86/entry/entry_64.S b/arch/x86/entry/entry_64.S
index e38a4cf795d9..8582709576bf 100644
--- a/arch/x86/entry/entry_64.S
+++ b/arch/x86/entry/entry_64.S
@@ -897,11 +897,12 @@ SYM_CODE_START_LOCAL(paranoid_entry)
movl $MSR_GS_BASE, %ecx
testl %edx, %edx
- jns .Lparanoid_entry_swapgs
- ret
+ js .Lparanoid_kernel_gsbase

+ /* EBX = 0 -> SWAPGS required on exit */
+ xorl %ebx, %ebx

* The above SAVE_AND_SWITCH_TO_KERNEL_CR3 macro doesn't do an
@@ -909,9 +910,6 @@ SYM_CODE_START_LOCAL(paranoid_entry)
* to prevent GS speculation, regardless of whether PTI is enabled.
- /* EBX = 0 -> SWAPGS required on exit */
- xorl %ebx, %ebx

 \ /
  Last update: 2021-11-26 11:23    [W:0.201 / U:0.272 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site