The Spectre-BHB loop of the epilogue and BPF_NOSPEC on cores without FEAT_SB end in an ISB, which the JIT took from aarch64_insn_get_isb_value(), the template of the instruction matcher with CRm 0. The Arm ARM lists every CRm other than 0b1111 as reserved: those encodings execute as a full system barrier, but must not be relied upon by software. Emit ISB SY with CRm 0b1111, as the assembler does for the isb of the kernel's own barriers. Before/after: d50330df isb #0 d5033fdf isb Fixes: 0dfefc2ea2f2 ("arm64: bpf: Add BHB mitigation to the epilogue for cBPF programs") Fixes: dff883d9e93a ("bpf, arm64, powerpc: Change nospec to include v1 barrier") Signed-off-by: Daniel Borkmann Tested-by: Luis Gerhorst --- arch/arm64/net/bpf_jit.h | 2 +- arch/arm64/net/bpf_jit_comp.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/arch/arm64/net/bpf_jit.h b/arch/arm64/net/bpf_jit.h index 70fc329c661d..b2fe05fcdef0 100644 --- a/arch/arm64/net/bpf_jit.h +++ b/arch/arm64/net/bpf_jit.h @@ -347,6 +347,6 @@ /* Barriers */ #define A64_SB aarch64_insn_get_sb_value() #define A64_DSB_NSH (aarch64_insn_get_dsb_base_value() | 0x7 << 8) -#define A64_ISB aarch64_insn_get_isb_value() +#define A64_ISB (aarch64_insn_get_isb_value() | 0xf << 8) #endif /* _BPF_JIT_H */ diff --git a/arch/arm64/net/bpf_jit_comp.c b/arch/arm64/net/bpf_jit_comp.c index 27f0194ce0fd..fe6c8bf3dc02 100644 --- a/arch/arm64/net/bpf_jit_comp.c +++ b/arch/arm64/net/bpf_jit_comp.c @@ -1037,7 +1037,7 @@ static void __maybe_unused build_bhb_mitigation(struct jit_ctx *ctx) emit(A64_SUBS_I(true, r1, r1, 1), ctx); emit(A64_B_(A64_COND_NE, -2), ctx); emit(aarch64_insn_gen_dsb(AARCH64_INSN_MB_ISH), ctx); - emit(aarch64_insn_get_isb_value(), ctx); + emit(A64_ISB, ctx); } if (is_spectre_bhb_fw_mitigated()) { -- 2.43.0