From mboxrd@z Thu Jan 1 00:00:00 1970 Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753291AbeADOh3 (ORCPT + 1 other); Thu, 4 Jan 2018 09:37:29 -0500 Received: from bombadil.infradead.org ([65.50.211.133]:52609 "EHLO bombadil.infradead.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753215AbeADOhX (ORCPT ); Thu, 4 Jan 2018 09:37:23 -0500 From: David Woodhouse To: ak@linux.intel.com Cc: David Woodhouse , Paul Turner , LKML , Linus Torvalds , Greg Kroah-Hartman , Tim Chen , Dave Hansen , tglx@linutronix.de, Kees Cook , Rik van Riel , Peter Zijlstra , Andy Lutomirski , Jiri Kosina , gnomes@lxorguk.ukuu.org.uk Subject: [PATCH v3 03/13] x86/retpoline/entry: Convert entry assembler indirect jumps Date: Thu, 4 Jan 2018 14:37:00 +0000 Message-Id: <20180104143710.8961-3-dwmw@amazon.co.uk> X-Mailer: git-send-email 2.14.3 In-Reply-To: <20180104143710.8961-1-dwmw@amazon.co.uk> References: <20180104143710.8961-1-dwmw@amazon.co.uk> In-Reply-To: <1515058213.12987.89.camel@amazon.co.uk> References: <1515058213.12987.89.camel@amazon.co.uk> X-SRS-Rewrite: SMTP reverse-path rewritten from by bombadil.infradead.org. See http://www.infradead.org/rpr.html Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Return-Path: Convert indirect jumps in core 32/64bit entry assembler code to use non-speculative sequences when CONFIG_RETPOLINE is enabled. KPTI complicates this a little; the one in entry_SYSCALL_64_trampoline can't just jump to the thunk because the thunk isn't mapped. So it gets its own copy of the thunk, inline. Signed-off-by: David Woodhouse --- arch/x86/entry/entry_32.S | 5 +++-- arch/x86/entry/entry_64.S | 20 ++++++++++++++++---- 2 files changed, 19 insertions(+), 6 deletions(-) diff --git a/arch/x86/entry/entry_32.S b/arch/x86/entry/entry_32.S index ace8f321a5a1..abd1e5dd487d 100644 --- a/arch/x86/entry/entry_32.S +++ b/arch/x86/entry/entry_32.S @@ -44,6 +44,7 @@ #include #include #include +#include .section .entry.text, "ax" @@ -290,7 +291,7 @@ ENTRY(ret_from_fork) /* kernel thread */ 1: movl %edi, %eax - call *%ebx + NOSPEC_CALL ebx /* * A kernel thread is allowed to return here after successfully * calling do_execve(). Exit to userspace to complete the execve() @@ -919,7 +920,7 @@ common_exception: movl %ecx, %es TRACE_IRQS_OFF movl %esp, %eax # pt_regs pointer - call *%edi + NOSPEC_CALL edi jmp ret_from_exception END(common_exception) diff --git a/arch/x86/entry/entry_64.S b/arch/x86/entry/entry_64.S index f048e384ff54..9e449701115a 100644 --- a/arch/x86/entry/entry_64.S +++ b/arch/x86/entry/entry_64.S @@ -37,6 +37,7 @@ #include #include #include +#include #include #include "calling.h" @@ -191,7 +192,17 @@ ENTRY(entry_SYSCALL_64_trampoline) */ pushq %rdi movq $entry_SYSCALL_64_stage2, %rdi - jmp *%rdi + /* + * Open-code the retpoline from retpoline.S, because we can't + * just jump to it directly. + */ + ALTERNATIVE "call 2f", "jmp *%rdi", X86_BUG_NO_RETPOLINE +1: + lfence + jmp 1b +2: + mov %rdi, (%rsp) + ret END(entry_SYSCALL_64_trampoline) .popsection @@ -270,7 +281,8 @@ entry_SYSCALL_64_fastpath: * It might end up jumping to the slow path. If it jumps, RAX * and all argument registers are clobbered. */ - call *sys_call_table(, %rax, 8) + movq sys_call_table(, %rax, 8), %rax + NOSPEC_CALL rax .Lentry_SYSCALL_64_after_fastpath_call: movq %rax, RAX(%rsp) @@ -442,7 +454,7 @@ ENTRY(stub_ptregs_64) jmp entry_SYSCALL64_slow_path 1: - jmp *%rax /* Called from C */ + NOSPEC_JMP rax /* Called from C */ END(stub_ptregs_64) .macro ptregs_stub func @@ -521,7 +533,7 @@ ENTRY(ret_from_fork) 1: /* kernel thread */ movq %r12, %rdi - call *%rbx + NOSPEC_CALL rbx /* * A kernel thread is allowed to return here after successfully * calling do_execve(). Exit to userspace to complete the execve() -- 2.14.3