x86/retpoline/entry: Convert entry assembler indirect jumps

commit 2641f08bb7fc63a636a2b18173221d7040a3512e upstream.

Convert indirect jumps in core 32/64bit entry assembler code to use
non-speculative sequences when CONFIG_RETPOLINE is enabled.

Don't use CALL_NOSPEC in entry_SYSCALL_64_fastpath because the return
address after the 'call' instruction must be *precisely* at the
.Lentry_SYSCALL_64_after_fastpath label for stub_ptregs_64 to work,
and the use of alternatives will mess that up unless we play horrid
games to prepend with NOPs and make the variants the same length. It's
not worth it; in the case where we ALTERNATIVE out the retpoline, the
first instruction at __x86.indirect_thunk.rax is going to be a bare
jmp *%rax anyway.

Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Acked-by: Ingo Molnar <mingo@kernel.org>
Acked-by: Arjan van de Ven <arjan@linux.intel.com>
Cc: gnomes@lxorguk.ukuu.org.uk
Cc: Rik van Riel <riel@redhat.com>
Cc: Andi Kleen <ak@linux.intel.com>
Cc: Josh Poimboeuf <jpoimboe@redhat.com>
Cc: thomas.lendacky@amd.com
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Jiri Kosina <jikos@kernel.org>
Cc: Andy Lutomirski <luto@amacapital.net>
Cc: Dave Hansen <dave.hansen@intel.com>
Cc: Kees Cook <keescook@google.com>
Cc: Tim Chen <tim.c.chen@linux.intel.com>
Cc: Greg Kroah-Hartman <gregkh@linux-foundation.org>
Cc: Paul Turner <pjt@google.com>
Link: https://lkml.kernel.org/r/1515707194-20531-7-git-send-email-dwmw@amazon.co.uk
Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
Signed-off-by: Razvan Ghitulete <rga@amazon.de>
[bwh: Backported to 3.16:
 - Also update indirect jumps through system call table in entry_32.s and
   ia32entry.S
 - Adjust filenames, context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>

diff --git a/arch/x86/ia32/ia32entry.S b/arch/x86/ia32/ia32entry.S
index 88ceb07b5a2bd38a65563406e1a516f253dc6082..958ba8e0f5dbc3609f370526598caef55e8228f9 100644 (file)
--- a/arch/x86/ia32/ia32entry.S
+++ b/arch/x86/ia32/ia32entry.S
@@ -19,6 +19,7 @@
 #include <asm/kaiser.h>
 #include <linux/linkage.h>
 #include <linux/err.h>
+#include <asm/nospec-branch.h>
 
 /* Avoid __ASSEMBLER__'ifying <linux/audit.h> just for this.  */
 #include <linux/elf-em.h>
@@ -173,7 +174,12 @@ sysenter_flags_fixed:
 sysenter_do_call:
        IA32_ARG_FIXUP
 sysenter_dispatch:
+#ifdef CONFIG_RETPOLINE
+       movq    ia32_sys_call_table(,%rax,8),%rax
+       call    __x86_indirect_thunk_rax
+#else
        call    *ia32_sys_call_table(,%rax,8)
+#endif
        movq    %rax,RAX-ARGOFFSET(%rsp)
        DISABLE_INTERRUPTS(CLBR_NONE)
        TRACE_IRQS_OFF
@@ -338,7 +344,12 @@ ENTRY(ia32_cstar_target)
 cstar_do_call:
        IA32_ARG_FIXUP 1
 cstar_dispatch:
+#ifdef CONFIG_RETPOLINE
+       movq ia32_sys_call_table(,%rax,8),%rax
+       call __x86_indirect_thunk_rax
+#else
        call *ia32_sys_call_table(,%rax,8)
+#endif
        movq %rax,RAX-ARGOFFSET(%rsp)
        DISABLE_INTERRUPTS(CLBR_NONE)
        TRACE_IRQS_OFF
@@ -449,7 +460,12 @@ ENTRY(ia32_syscall)
        ja ia32_badsys
 ia32_do_call:
        IA32_ARG_FIXUP
+#ifdef CONFIG_RETPOLINE
+       movq ia32_sys_call_table(,%rax,8),%rax
+       call __x86_indirect_thunk_rax
+#else
        call *ia32_sys_call_table(,%rax,8) # xxx: rip relative
+#endif
 ia32_sysret:
        movq %rax,RAX-ARGOFFSET(%rsp)
 ia32_ret_from_sys_call:
@@ -515,7 +531,7 @@ ia32_ptregs_common:
        CFI_REL_OFFSET  rsp,RSP-ARGOFFSET
 /*     CFI_REL_OFFSET  ss,SS-ARGOFFSET*/
        SAVE_REST
-       call *%rax
+       CALL_NOSPEC %rax
        RESTORE_REST
        jmp  ia32_sysret        /* misbalances the return cache */
        CFI_ENDPROC

diff --git a/arch/x86/kernel/entry_32.S b/arch/x86/kernel/entry_32.S
index bfcc300d8b3c27d81b138761cea5aa9d4a11e87d..7f8572a28ca8634a0764f13d2e3cafd515b3870c 100644 (file)
--- a/arch/x86/kernel/entry_32.S
+++ b/arch/x86/kernel/entry_32.S
@@ -58,6 +58,7 @@
 #include <asm/alternative-asm.h>
 #include <asm/asm.h>
 #include <asm/smap.h>
+#include <asm/nospec-branch.h>
 
 /* Avoid __ASSEMBLER__'ifying <linux/audit.h> just for this.  */
 #include <linux/elf-em.h>
@@ -308,7 +309,8 @@ ENTRY(ret_from_kernel_thread)
        pushl_cfi $0x0202               # Reset kernel eflags
        popfl_cfi
        movl PT_EBP(%esp),%eax
-       call *PT_EBX(%esp)
+       movl    PT_EBX(%esp), %edx
+       CALL_NOSPEC %edx
        movl $0,PT_EAX(%esp)
        jmp syscall_exit
        CFI_ENDPROC
@@ -424,7 +426,12 @@ sysenter_past_esp:
 sysenter_do_call:
        cmpl $(NR_syscalls), %eax
        jae sysenter_badsys
+#ifdef CONFIG_RETPOLINE
+       movl sys_call_table(,%eax,4),%eax
+       call __x86_indirect_thunk_eax
+#else
        call *sys_call_table(,%eax,4)
+#endif
 sysenter_after_call:
        movl %eax,PT_EAX(%esp)
        LOCKDEP_SYS_EXIT
@@ -501,7 +508,12 @@ ENTRY(system_call)
        cmpl $(NR_syscalls), %eax
        jae syscall_badsys
 syscall_call:
+#ifdef CONFIG_RETPOLINE
+       movl sys_call_table(,%eax,4),%eax
+       call __x86_indirect_thunk_eax
+#else
        call *sys_call_table(,%eax,4)
+#endif
 syscall_after_call:
        movl %eax,PT_EAX(%esp)          # store the return value
 syscall_exit:
@@ -1277,7 +1289,7 @@ error_code:
        movl %ecx, %es
        TRACE_IRQS_OFF
        movl %esp,%eax                  # pt_regs pointer
-       call *%edi
+       CALL_NOSPEC %edi
        jmp ret_from_exception
        CFI_ENDPROC
 END(page_fault)

diff --git a/arch/x86/kernel/entry_64.S b/arch/x86/kernel/entry_64.S
index 0706553873e756bc1f20a4c73472b9d3e042658d..4cab30fb45c93e281569509afae255e5ba342665 100644 (file)
--- a/arch/x86/kernel/entry_64.S
+++ b/arch/x86/kernel/entry_64.S
@@ -59,6 +59,7 @@
 #include <asm/smap.h>
 #include <asm/pgtable_types.h>
 #include <asm/kaiser.h>
+#include <asm/nospec-branch.h>
 #include <linux/err.h>
 
 /* Avoid __ASSEMBLER__'ifying <linux/audit.h> just for this.  */
@@ -375,7 +376,7 @@ ENTRY(ret_from_fork)
        subq $REST_SKIP, %rsp   # leave space for volatiles
        CFI_ADJUST_CFA_OFFSET   REST_SKIP
        movq %rbp, %rdi
-       call *%rbx
+       CALL_NOSPEC %rbx
        movl $0, RAX(%rsp)
        RESTORE_REST
        jmp int_ret_from_sys_call
@@ -451,7 +452,12 @@ system_call_fastpath:
 #endif
        ja badsys
        movq %r10,%rcx
+#ifdef CONFIG_RETPOLINE
+       movq    sys_call_table(, %rax, 8), %rax
+       call    __x86_indirect_thunk_rax
+#else
        call *sys_call_table(,%rax,8)  # XXX:    rip relative
+#endif
        movq %rax,RAX-ARGOFFSET(%rsp)
 /*
  * Syscall return path ending with SYSRET (fast path)
@@ -578,7 +584,12 @@ tracesys:
 #endif
        ja   int_ret_from_sys_call      /* RAX(%rsp) set to -ENOSYS above */
        movq %r10,%rcx  /* fixup for C */
+#ifdef CONFIG_RETPOLINE
+       movq    sys_call_table(, %rax, 8), %rax
+       call    __x86_indirect_thunk_rax
+#else
        call *sys_call_table(,%rax,8)
+#endif
        movq %rax,RAX-ARGOFFSET(%rsp)
        /* Use IRET because user could have changed frame */