From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Google-Smtp-Source: AH8x227tHumLGTguOoVKOCM3OPMKbRoRDcGncAvXCuk8wCmilQajVOjrF8irxfKxSzimLcE5MtZH ARC-Seal: i=1; a=rsa-sha256; t=1516610467; cv=none; d=google.com; s=arc-20160816; b=WddjQ122kU2/bE3VEL01smwaOmNGhxXcojnjGrVWcLqGl0Bp0iqDcgTjR+yLna2+bE vd3GPyfo1P/mDILEG+R/Xs3Osfqs6IepkwB3GcnNOXKmY72TYTcOQCVR/c/9MF7K6hhD jadXr3aX0iTydcm9Dj9nbxFLnvqiTx8vgHEpTjg0di7nYSq0KeBUWiOMxaAHxgw6ag4O 67uEGbnNibRRNV4k+MrOf62gWteOGUCSQCLqBEW2a37ZM+Xk0omCk0PU9R9dHsh+BThP bpKqw8dl5LoPFeBELK396VkWqGngDn+zP/xPai91azPRx6D9wIUPtiDpyWtJjqpO3H+8 Or1g== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=mime-version:user-agent:references:in-reply-to:message-id:date :subject:cc:to:from:arc-authentication-results; bh=dTFUDHDLPsuEFekrOqrCXJIdbHIaYi7N1fUaYRNTyeM=; b=ypf+hq7+RPnuv0G9U/v9+ZjAtdUGI4uzBTIgRg4TQJn0ikmDINcl6c4VREBnURHAg2 ItE2X/3icr9/fBKGdjFXSXxRA0EEP3Umq6aYtBXEAflll1PbsCVhWVooLHY35LfF1Y5Y V4vJCxBVdp/2jXNM5Lzw9hK0MsuM8Q0zfn2RMPx5vB+ga6AAqAENiSlbw2EKwe+Wn2pV jAO5tF/StVJJ7+qvZGf4o8RdMjp+b+X85xCD8+85lNpCGWFtK8HfBpPTWSQRPylzhA6z gitX9Kt0AxugkNV6gzsQO+jD2KVWMXqp4yIPgg+CYyV6OkVldLpCsglnJmvPeAhRbF9v QSxQ== ARC-Authentication-Results: i=1; mx.google.com; spf=softfail (google.com: domain of transitioning gregkh@linuxfoundation.org does not designate 90.92.71.90 as permitted sender) smtp.mailfrom=gregkh@linuxfoundation.org Authentication-Results: mx.google.com; spf=softfail (google.com: domain of transitioning gregkh@linuxfoundation.org does not designate 90.92.71.90 as permitted sender) smtp.mailfrom=gregkh@linuxfoundation.org From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, David Woodhouse , Thomas Gleixner , Ingo Molnar , Arjan van de Ven , gnomes@lxorguk.ukuu.org.uk, Rik van Riel , Andi Kleen , Josh Poimboeuf , thomas.lendacky@amd.com, Peter Zijlstra , Linus Torvalds , Jiri Kosina , Andy Lutomirski , Dave Hansen , Kees Cook , Tim Chen , Paul Turner , Razvan Ghitulete , Greg Kroah-Hartman Subject: [PATCH 4.4 13/53] x86/retpoline/entry: Convert entry assembler indirect jumps Date: Mon, 22 Jan 2018 09:40:05 +0100 Message-Id: <20180122083910.850243957@linuxfoundation.org> X-Mailer: git-send-email 2.16.0 In-Reply-To: <20180122083910.299610926@linuxfoundation.org> References: <20180122083910.299610926@linuxfoundation.org> User-Agent: quilt/0.65 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-LABELS: =?utf-8?b?IlxcU2VudCI=?= X-GMAIL-THRID: =?utf-8?q?1590281337510073705?= X-GMAIL-MSGID: =?utf-8?q?1590281337510073705?= X-Mailing-List: linux-kernel@vger.kernel.org List-ID: 4.4-stable review patch. If anyone has any objections, please let me know. ------------------ From: David Woodhouse commit 2641f08bb7fc63a636a2b18173221d7040a3512e upstream. Convert indirect jumps in core 32/64bit entry assembler code to use non-speculative sequences when CONFIG_RETPOLINE is enabled. Don't use CALL_NOSPEC in entry_SYSCALL_64_fastpath because the return address after the 'call' instruction must be *precisely* at the .Lentry_SYSCALL_64_after_fastpath label for stub_ptregs_64 to work, and the use of alternatives will mess that up unless we play horrid games to prepend with NOPs and make the variants the same length. It's not worth it; in the case where we ALTERNATIVE out the retpoline, the first instruction at __x86.indirect_thunk.rax is going to be a bare jmp *%rax anyway. Signed-off-by: David Woodhouse Signed-off-by: Thomas Gleixner Acked-by: Ingo Molnar Acked-by: Arjan van de Ven Cc: gnomes@lxorguk.ukuu.org.uk Cc: Rik van Riel Cc: Andi Kleen Cc: Josh Poimboeuf Cc: thomas.lendacky@amd.com Cc: Peter Zijlstra Cc: Linus Torvalds Cc: Jiri Kosina Cc: Andy Lutomirski Cc: Dave Hansen Cc: Kees Cook Cc: Tim Chen Cc: Greg Kroah-Hartman Cc: Paul Turner Link: https://lkml.kernel.org/r/1515707194-20531-7-git-send-email-dwmw@amazon.co.uk Signed-off-by: David Woodhouse Signed-off-by: Razvan Ghitulete Signed-off-by: Greg Kroah-Hartman --- arch/x86/entry/entry_32.S | 6 ++++-- arch/x86/entry/entry_64.S | 14 +++++++++++++- 2 files changed, 17 insertions(+), 3 deletions(-) --- a/arch/x86/entry/entry_32.S +++ b/arch/x86/entry/entry_32.S @@ -44,6 +44,7 @@ #include #include #include +#include .section .entry.text, "ax" @@ -226,7 +227,8 @@ ENTRY(ret_from_kernel_thread) pushl $0x0202 # Reset kernel eflags popfl movl PT_EBP(%esp), %eax - call *PT_EBX(%esp) + movl PT_EBX(%esp), %edx + CALL_NOSPEC %edx movl $0, PT_EAX(%esp) /* @@ -938,7 +940,7 @@ error_code: movl %ecx, %es TRACE_IRQS_OFF movl %esp, %eax # pt_regs pointer - call *%edi + CALL_NOSPEC %edi jmp ret_from_exception END(page_fault) --- a/arch/x86/entry/entry_64.S +++ b/arch/x86/entry/entry_64.S @@ -36,6 +36,7 @@ #include #include #include +#include #include /* Avoid __ASSEMBLER__'ifying just for this. */ @@ -184,7 +185,13 @@ entry_SYSCALL_64_fastpath: #endif ja 1f /* return -ENOSYS (already in pt_regs->ax) */ movq %r10, %rcx +#ifdef CONFIG_RETPOLINE + movq sys_call_table(, %rax, 8), %rax + call __x86_indirect_thunk_rax +#else call *sys_call_table(, %rax, 8) +#endif + movq %rax, RAX(%rsp) 1: /* @@ -276,7 +283,12 @@ tracesys_phase2: #endif ja 1f /* return -ENOSYS (already in pt_regs->ax) */ movq %r10, %rcx /* fixup for C */ +#ifdef CONFIG_RETPOLINE + movq sys_call_table(, %rax, 8), %rax + call __x86_indirect_thunk_rax +#else call *sys_call_table(, %rax, 8) +#endif movq %rax, RAX(%rsp) 1: /* Use IRET because user could have changed pt_regs->foo */ @@ -491,7 +503,7 @@ ENTRY(ret_from_fork) * nb: we depend on RESTORE_EXTRA_REGS above */ movq %rbp, %rdi - call *%rbx + CALL_NOSPEC %rbx movl $0, RAX(%rsp) RESTORE_EXTRA_REGS jmp int_ret_from_sys_call