diff options
| author | Pawan Gupta <pawan.kumar.gupta@linux.intel.com> | 2026-06-29 22:38:07 -0700 |
|---|---|---|
| committer | Daniel Borkmann <daniel@iogearbox.net> | 2026-07-01 10:33:38 +0200 |
| commit | a3af84b0fa00ead01fcd0e28b5d773ff25990a0d (patch) | |
| tree | 4d6a2c70d98f256dc4999298e27a89783ab33a96 /arch/x86/include | |
| parent | 96cce16e26dd02a8678f1e87f88a4b5cdb63b995 (diff) | |
x86/bugs: Enable IBPB flush on BPF JIT allocation
Enable hardening against JIT spraying when Spectre-v2 mitigations are in
use. Specifically, issue an IBPB flush on BPF JIT memory reuse. Skip
enabling the IBPB flush if the BPF dispatcher is already using a retpoline
sequence.
This hardening applies only when BPF-JIT is in use. Guard the enabling
under CONFIG_BPF_JIT so that bugs.c still builds with CONFIG_BPF_JIT=n.
Signed-off-by: Pawan Gupta <pawan.kumar.gupta@linux.intel.com>
Acked-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Dave Hansen <dave.hansen@linux.intel.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Diffstat (limited to 'arch/x86/include')
| -rw-r--r-- | arch/x86/include/asm/nospec-branch.h | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/arch/x86/include/asm/nospec-branch.h b/arch/x86/include/asm/nospec-branch.h index 4f4b5e8a1574..b68892e6d58c 100644 --- a/arch/x86/include/asm/nospec-branch.h +++ b/arch/x86/include/asm/nospec-branch.h @@ -388,6 +388,10 @@ extern void srso_alias_return_thunk(void); extern void entry_untrain_ret(void); extern void write_ibpb(void); +#ifdef CONFIG_BPF_JIT +extern void bpf_arch_ibpb(void); +#endif + #ifdef CONFIG_X86_64 extern void clear_bhb_loop(void); #endif |