x86/its: Add support for ITS-safe return thunk

commit a75bf27fe41abe658c53276a0c486c4bf9adecfc upstream.

RETs in the lower half of cacheline may be affected by ITS bug,
specifically when the RSB-underflows. Use ITS-safe return thunk for such
RETs.

RETs that are not patched:

- RET in retpoline sequence does not need to be patched, because the
  sequence itself fills an RSB before RET.
- RET in Call Depth Tracking (CDT) thunks __x86_indirect_{call|jump}_thunk
  and call_depth_return_thunk are not patched because CDT by design
  prevents RSB-underflow.
- RETs in .init section are not reachable after init.
- RETs that are explicitly marked safe with ANNOTATE_UNRET_SAFE.

Signed-off-by: Pawan Gupta <pawan.kumar.gupta@linux.intel.com>
Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
Reviewed-by: Josh Poimboeuf <jpoimboe@kernel.org>
Reviewed-by: Alexandre Chartre <alexandre.chartre@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/arch/x86/include/asm/alternative.h b/arch/x86/include/asm/alternative.h
index cb9ce0f9e78e0502a429e8ac7b59840d77e9eead..7e879b5217265c5f296b658a52a55c6e0ea3611e 100644 (file)
--- a/arch/x86/include/asm/alternative.h
+++ b/arch/x86/include/asm/alternative.h
@@ -130,6 +130,20 @@ static __always_inline int x86_call_depth_emit_accounting(u8 **pprog,
 }
 #endif
 
+#if defined(CONFIG_RETHUNK) && defined(CONFIG_OBJTOOL)
+extern bool cpu_wants_rethunk(void);
+extern bool cpu_wants_rethunk_at(void *addr);
+#else
+static __always_inline bool cpu_wants_rethunk(void)
+{
+       return false;
+}
+static __always_inline bool cpu_wants_rethunk_at(void *addr)
+{
+       return false;
+}
+#endif
+
 #ifdef CONFIG_SMP
 extern void alternatives_smp_module_add(struct module *mod, char *name,
                                        void *locks, void *locks_end,

diff --git a/arch/x86/include/asm/nospec-branch.h b/arch/x86/include/asm/nospec-branch.h
index 8633f7bff764a73bb23fd6ba0e42b3961753c370..1668ae8b71bbf58f7883168e529326b0a63f3184 100644 (file)
--- a/arch/x86/include/asm/nospec-branch.h
+++ b/arch/x86/include/asm/nospec-branch.h
@@ -395,6 +395,12 @@ static inline void srso_return_thunk(void) {}
 static inline void srso_alias_return_thunk(void) {}
 #endif
 
+#ifdef CONFIG_MITIGATION_ITS
+extern void its_return_thunk(void);
+#else
+static inline void its_return_thunk(void) {}
+#endif
+
 extern void retbleed_return_thunk(void);
 extern void srso_return_thunk(void);
 extern void srso_alias_return_thunk(void);

diff --git a/arch/x86/kernel/alternative.c b/arch/x86/kernel/alternative.c
index 9be01147727e9edf7e0e545a808450756a2a7ee9..ecf105f37de79271d444c096e9e2b175dbe158fa 100644 (file)
--- a/arch/x86/kernel/alternative.c
+++ b/arch/x86/kernel/alternative.c
@@ -749,6 +749,21 @@ void __init_or_module noinline apply_retpolines(s32 *start, s32 *end)
 
 #ifdef CONFIG_RETHUNK
 
+bool cpu_wants_rethunk(void)
+{
+       return cpu_feature_enabled(X86_FEATURE_RETHUNK);
+}
+
+bool cpu_wants_rethunk_at(void *addr)
+{
+       if (!cpu_feature_enabled(X86_FEATURE_RETHUNK))
+               return false;
+       if (x86_return_thunk != its_return_thunk)
+               return true;
+
+       return !((unsigned long)addr & 0x20);
+}
+
 /*
  * Rewrite the compiler generated return thunk tail-calls.
  *
@@ -765,7 +780,7 @@ static int patch_return(void *addr, struct insn *insn, u8 *bytes)
        int i = 0;
 
        /* Patch the custom return thunks... */
-       if (cpu_feature_enabled(X86_FEATURE_RETHUNK)) {
+       if (cpu_wants_rethunk_at(addr)) {
                i = JMP32_INSN_SIZE;
                __text_gen_insn(bytes, JMP32_INSN_OPCODE, addr, x86_return_thunk, i);
        } else {
@@ -782,7 +797,7 @@ void __init_or_module noinline apply_returns(s32 *start, s32 *end)
 {
        s32 *s;
 
-       if (cpu_feature_enabled(X86_FEATURE_RETHUNK))
+       if (cpu_wants_rethunk())
                static_call_force_reinit();
 
        for (s = start; s < end; s++) {

diff --git a/arch/x86/kernel/ftrace.c b/arch/x86/kernel/ftrace.c
index 12df54ff0e817188d384affee8d98a515d6db471..50f8c8a8483be2ea1849edc1b534de55aa150d9a 100644 (file)
--- a/arch/x86/kernel/ftrace.c
+++ b/arch/x86/kernel/ftrace.c
@@ -363,7 +363,7 @@ create_trampoline(struct ftrace_ops *ops, unsigned int *tramp_size)
                goto fail;
 
        ip = trampoline + size;
-       if (cpu_feature_enabled(X86_FEATURE_RETHUNK))
+       if (cpu_wants_rethunk_at(ip))
                __text_gen_insn(ip, JMP32_INSN_OPCODE, ip, x86_return_thunk, JMP32_INSN_SIZE);
        else
                memcpy(ip, retq, sizeof(retq));

diff --git a/arch/x86/kernel/static_call.c b/arch/x86/kernel/static_call.c
index 07961b362e2a0ccdd567356c0394ddf76e764989..bcea882e022f50e3fd8f3334bb35f536a5bd02f2 100644 (file)
--- a/arch/x86/kernel/static_call.c
+++ b/arch/x86/kernel/static_call.c
@@ -81,7 +81,7 @@ static void __ref __static_call_transform(void *insn, enum insn_type type,
                break;
 
        case RET:
-               if (cpu_feature_enabled(X86_FEATURE_RETHUNK))
+               if (cpu_wants_rethunk_at(insn))
                        code = text_gen_insn(JMP32_INSN_OPCODE, insn, x86_return_thunk);
                else
                        code = &retinsn;
@@ -90,7 +90,7 @@ static void __ref __static_call_transform(void *insn, enum insn_type type,
        case JCC:
                if (!func) {
                        func = __static_call_return;
-                       if (cpu_feature_enabled(X86_FEATURE_RETHUNK))
+                       if (cpu_wants_rethunk())
                                func = x86_return_thunk;
                }
 

diff --git a/arch/x86/kernel/vmlinux.lds.S b/arch/x86/kernel/vmlinux.lds.S
index 27323cda907aef1ef1157a14d24a3c6fcf819b40..c57d5df1abc6037f96ceb3ca4095ce0cbb8e45ec 100644 (file)
--- a/arch/x86/kernel/vmlinux.lds.S
+++ b/arch/x86/kernel/vmlinux.lds.S
@@ -547,4 +547,8 @@ INIT_PER_CPU(irq_stack_backing_store);
 . = ASSERT(__x86_indirect_its_thunk_array == __x86_indirect_its_thunk_rax, "Gap in ITS thunk array");
 #endif
 
+#if defined(CONFIG_MITIGATION_ITS) && !defined(CONFIG_DEBUG_FORCE_FUNCTION_ALIGN_64B)
+. = ASSERT(its_return_thunk & 0x20, "its_return_thunk not in second half of cacheline");
+#endif
+
 #endif /* CONFIG_X86_64 */

diff --git a/arch/x86/lib/retpoline.S b/arch/x86/lib/retpoline.S
index 40d17f27499f3501a4d2929cbb8da9f556973d97..91ce427d5af1911395c224431d941d77a58e812b 100644 (file)
--- a/arch/x86/lib/retpoline.S
+++ b/arch/x86/lib/retpoline.S
@@ -386,7 +386,18 @@ SYM_CODE_START(__x86_indirect_its_thunk_array)
        .align 64, 0xcc
 SYM_CODE_END(__x86_indirect_its_thunk_array)
 
-#endif
+.align 64, 0xcc
+.skip 32, 0xcc
+SYM_CODE_START(its_return_thunk)
+       UNWIND_HINT_FUNC
+       ANNOTATE_NOENDBR
+       ANNOTATE_UNRET_SAFE
+       ret
+       int3
+SYM_CODE_END(its_return_thunk)
+EXPORT_SYMBOL(its_return_thunk)
+
+#endif /* CONFIG_MITIGATION_ITS */
 
 /*
  * This function name is magical and is used by -mfunction-return=thunk-extern

diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c
index 0d4218741e0d800d3fd42e101661f895edd1b226..9b7df9d7b22bf9b95fe95ed349472931ff04d118 100644 (file)
--- a/arch/x86/net/bpf_jit_comp.c
+++ b/arch/x86/net/bpf_jit_comp.c
@@ -498,7 +498,7 @@ static void emit_return(u8 **pprog, u8 *ip)
 {
        u8 *prog = *pprog;
 
-       if (cpu_feature_enabled(X86_FEATURE_RETHUNK)) {
+       if (cpu_wants_rethunk()) {
                emit_jump(&prog, x86_return_thunk, ip);
        } else {
                EMIT1(0xC3);            /* ret */