x86/srso: Fix return thunks in generated code

Set X86_FEATURE_RETHUNK when enabling the SRSO mitigation so that
generated code (e.g., ftrace, static call, eBPF) generates "jmp
__x86_return_thunk" instead of RET.

  [ bp: Add a comment. ]

Fixes: fb3bd914b3ec ("x86/srso: Add a Speculative RAS Overflow mitigation")
Signed-off-by: Josh Poimboeuf <jpoimboe@kernel.org>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>

diff --git a/arch/x86/kernel/alternative.c b/arch/x86/kernel/alternative.c
index 920a8ca7a8f83a7d41fdc549f7dac363d6fa9c1f..2dcf3a06af0908b6dc67594daff54d7555b9fc83 100644 (file)
--- a/arch/x86/kernel/alternative.c
+++ b/arch/x86/kernel/alternative.c
@@ -707,9 +707,7 @@ static int patch_return(void *addr, struct insn *insn, u8 *bytes)
        int i = 0;
 
        /* Patch the custom return thunks... */
-       if (cpu_feature_enabled(X86_FEATURE_RETHUNK) ||
-           cpu_feature_enabled(X86_FEATURE_SRSO) ||
-           cpu_feature_enabled(X86_FEATURE_SRSO_ALIAS)) {
+       if (cpu_feature_enabled(X86_FEATURE_RETHUNK)) {
                i = JMP32_INSN_SIZE;
                __text_gen_insn(bytes, JMP32_INSN_OPCODE, addr, x86_return_thunk, i);
        } else {

diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
index d4109eb5eb2e3bee14f74fdec52a3e5284b1d2d4..7314a6bdc862b637cb4a49e6eeb61d9548c8d8e5 100644 (file)
--- a/arch/x86/kernel/cpu/bugs.c
+++ b/arch/x86/kernel/cpu/bugs.c
@@ -2297,6 +2297,12 @@ static void __init srso_select_mitigation(void)
 
        case SRSO_CMD_SAFE_RET:
                if (IS_ENABLED(CONFIG_CPU_SRSO)) {
+                       /*
+                        * Enable the return thunk for generated code
+                        * like ftrace, static_call, etc.
+                        */
+                       setup_force_cpu_cap(X86_FEATURE_RETHUNK);
+
                        if (boot_cpu_data.x86 == 0x19)
                                setup_force_cpu_cap(X86_FEATURE_SRSO_ALIAS);
                        else