Patch "x86/retpoline/entry: Convert entry assembler indirect jumps" has been added to the 4.4-stable tree

PATCH [email protected] 1 participant 1 message Jan 17, 2018

Subsystems (3)

Stable branch x86 x86 entry code

lore

Share & tools

lore

[email protected]

author maintainer Applied

2018-01-17 10:56 UTC #0 lore raw

This is a note to let you know that I've just added the patch titled

x86/retpoline/entry: Convert entry assembler indirect jumps

to the 4.4-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
x86-retpoline-entry-convert-entry-assembler-indirect-jumps.patch
and it can be found in the queue-4.4 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

Quoted 1 line

From 2641f08bb7fc63a636a2b18173221d7040a3512e Mon Sep 17 00:00:00 2001

From: David Woodhouse <[email protected]>
Date: Thu, 11 Jan 2018 21:46:28 +0000
Subject: x86/retpoline/entry: Convert entry assembler indirect jumps

From: David Woodhouse <[email protected]>

commit 2641f08bb7fc63a636a2b18173221d7040a3512e upstream.

Convert indirect jumps in core 32/64bit entry assembler code to use non-speculative sequences when CONFIG_RETPOLINE is enabled.

Don't use CALL_NOSPEC in entry_SYSCALL_64_fastpath because the return address after the 'call' instruction must be *precisely* at the .Lentry_SYSCALL_64_after_fastpath label for stub_ptregs_64 to work, and the use of alternatives will mess that up unless we play horrid games to prepend with NOPs and make the variants the same length. It's not worth it; in the case where we ALTERNATIVE out the retpoline, the first instruction at __x86.indirect_thunk.rax is going to be a bare jmp *%rax anyway.

Signed-off-by David Woodhouse <[email protected]>

Signed-off-by Thomas Gleixner <[email protected]>

Acked-by Ingo Molnar <[email protected]>

Acked-by Arjan van de Ven <[email protected]>

Cc [email protected]

Cc Rik van Riel <[email protected]>

Cc Andi Kleen <[email protected]>

Cc Josh Poimboeuf <[email protected]>

Cc [email protected]

Cc Peter Zijlstra <[email protected]>

Cc Linus Torvalds <[email protected]>

Cc Jiri Kosina <[email protected]>

Cc Andy Lutomirski <[email protected]>

Cc Dave Hansen <[email protected]>

Cc Kees Cook <[email protected]>

Cc Tim Chen <[email protected]>

Cc Greg Kroah-Hartman <[email protected]>

Cc Paul Turner <[email protected]>

Link https://lkml.kernel.org/r/[email protected] open here

Signed-off-by David Woodhouse <[email protected]>

Signed-off-by Razvan Ghitulete <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 arch/x86/entry/entry_32.S |    5 +++--
 arch/x86/entry/entry_64.S |   14 +++++++++++++-
 2 files changed, 16 insertions(+), 3 deletions(-)

arch/x86/entry/entry_32.S +3 -2

@@ -44,6 +44,7 @@
 #include <asm/alternative-asm.h>
 #include <asm/asm.h>
 #include <asm/smap.h>
+#include <asm/nospec-branch.h>
 
 	.section .entry.text, "ax"

@@ -226,7 +227,7 @@ ENTRY(ret_from_kernel_thread)
 	pushl	$0x0202				# Reset kernel eflags
 	popfl
 	movl	PT_EBP(%esp), %eax
-	call	*PT_EBX(%esp)
+	CALL_NOSPEC PT_EBX(%esp)
 	movl	$0, PT_EAX(%esp)
 
 	/*

@@ -938,7 +939,7 @@ error_code:
 	movl	%ecx, %es
 	TRACE_IRQS_OFF
 	movl	%esp, %eax			# pt_regs pointer
-	call	*%edi
+	CALL_NOSPEC %edi
 	jmp	ret_from_exception
 END(page_fault)

arch/x86/entry/entry_64.S +13 -1

@@ -36,6 +36,7 @@
 #include <asm/smap.h>
 #include <asm/pgtable_types.h>
 #include <asm/kaiser.h>
+#include <asm/nospec-branch.h>
 #include <linux/err.h>
 
 /* Avoid __ASSEMBLER__'ifying <linux/audit.h> just for this.  */

@@ -184,7 +185,13 @@ entry_SYSCALL_64_fastpath:
 #endif
 	ja	1f				/* return -ENOSYS (already in pt_regs->ax) */
 	movq	%r10, %rcx
+#ifdef CONFIG_RETPOLINE
+	movq	sys_call_table(, %rax, 8), %rax
+	call	__x86_indirect_thunk_rax
+#else
 	call	*sys_call_table(, %rax, 8)
+#endif
+
 	movq	%rax, RAX(%rsp)
 1:
 /*

@@ -276,7 +283,12 @@ tracesys_phase2:
 #endif
 	ja	1f				/* return -ENOSYS (already in pt_regs->ax) */
 	movq	%r10, %rcx			/* fixup for C */
+#ifdef CONFIG_RETPOLINE
+	movq	sys_call_table(, %rax, 8), %rax
+	call	__x86_indirect_thunk_rax
+#else
 	call	*sys_call_table(, %rax, 8)
+#endif
 	movq	%rax, RAX(%rsp)
 1:
 	/* Use IRET because user could have changed pt_regs->foo */

@@ -491,7 +503,7 @@ ENTRY(ret_from_fork)
 	 * nb: we depend on RESTORE_EXTRA_REGS above
 	 */
 	movq	%rbp, %rdi
-	call	*%rbx
+	CALL_NOSPEC %rbx
 	movl	$0, RAX(%rsp)
 	RESTORE_EXTRA_REGS
 	jmp	int_ret_from_sys_call

Patches currently in stable-queue which might be from [email protected] are

queue-4.4/x86-spectre-add-boot-time-option-to-select-spectre-v2-mitigation.patch queue-4.4/x86-retpoline-irq32-convert-assembler-indirect-jumps.patch queue-4.4/x86-retpoline-hyperv-convert-assembler-indirect-jumps.patch queue-4.4/x86-retpoline-entry-convert-entry-assembler-indirect-jumps.patch queue-4.4/x86-cpu-amd-make-lfence-a-serializing-instruction.patch queue-4.4/x86-retpoline-ftrace-convert-ftrace-assembler-indirect-jumps.patch queue-4.4/x86-retpoline-crypto-convert-crypto-assembler-indirect-jumps.patch queue-4.4/x86-retpoline-xen-convert-xen-hypercall-indirect-jumps.patch queue-4.4/x86-retpoline-checksum32-convert-assembler-indirect-jumps.patch queue-4.4/x86-mm-32-move-setup_clear_cpu_cap-x86_feature_pcid-earlier.patch queue-4.4/x86-retpoline-fill-return-stack-buffer-on-vmexit.patch queue-4.4/x86-retpoline-remove-compile-time-warning.patch queue-4.4/x86-cpu-amd-use-lfence_rdtsc-in-preference-to-mfence_rdtsc.patch queue-4.4/x86-retpoline-add-initial-retpoline-support.patch