The following commit has been merged into the x86/bugs branch of tip:
Commit-ID: 59e6ce1eaaa2d9b2f9c89a108ce3fc7510bcd7ea
Gitweb: https://git.kernel.org/tip/59e6ce1eaaa2d9b2f9c89a108ce3fc7510bcd7ea
Author: Borislav Petkov (AMD) <bp@xxxxxxxxx>
AuthorDate: Thu, 19 Oct 2023 11:09:41 +02:00
Committer: Borislav Petkov (AMD) <bp@xxxxxxxxx>
CommitterDate: Thu, 19 Oct 2023 11:25:19 +02:00
Revert "x86/retpoline: Remove .text..__x86.return_thunk section"
This reverts commit e92626af3234708fe30f53b269d210d202b95206.
David Howells reported his box freezing without being able to see
a panic. However, it managed to issue a warning beforehand:
missing return thunk: __x86_indirect_thunk_r15+0xa/0x5f-0x0: eb 74 66 66 2e
WARNING: CPU: 0 PID: 0 at arch/x86/kernel/alternative.c:755 apply_returns+0xca/0x247
Modules linked in:
CPU: 0 PID: 0 Comm: swapper/0 Not tainted 6.6.0-rc5-next-20231013-build3+ #3044
Hardware name: ASUS All Series/H97-PLUS, BIOS 2306 10/09/2014
RIP: 0010:apply_returns+0xca/0x247
this happened with linux-next and with gcc 13. Looking at the compiler
output and particularly paying attention to the two JMP instructions:
<__x86_indirect_thunk_r14>:
e8 01 00 00 00 call ffffffff81d71206 <__x86_indirect_thunk_r14+0x6>
cc int3
4c 89 34 24 mov %r14,(%rsp)
e9 91 00 00 00 jmp ffffffff81d712a0 <__x86_return_thunk>
66 66 2e 0f 1f 84 00 data16 cs nopw 0x0(%rax,%rax,1)
00 00 00 00
66 0f 1f 44 00 00 nopw 0x0(%rax,%rax,1)
<__x86_indirect_thunk_r15>:
e8 01 00 00 00 call ffffffff81d71226 <__x86_indirect_thunk_r15+0x6>
cc int3
4c 89 3c 24 mov %r15,(%rsp)
eb 74 jmp ffffffff81d712a0 <__x86_return_thunk>
the second JMP is a short JMP one. This is likely some new gcc
optimization to size the JMP offsets and generate a small one if it
fits.
However, the apply_returns() logic does not expect a short JMP:
if (op == JMP32_INSN_OPCODE)
dest = addr + insn.length + insn.immediate.value;
and that JMP32_INSN_OPCODE is 0xe9.
Now, if __x86_return_thunk is in another section, the compiler cannot do
those shortcuts and will have to generate a JMP with a s32 offset.
As a matter of fact, the removal of the section broke another case, see
https://lore.kernel.org/r/20231010171020.462211-2-david.kaplan@xxxxxxx
so revert for now until all the possible code generation issues have
been assessed, addressed and verified properly.
Reported-by: David Howells <dhowells@xxxxxxxxxx>
Tested-by: David Howells <dhowells@xxxxxxxxxx>
Signed-off-by: Borislav Petkov (AMD) <bp@xxxxxxxxx>
Cc: Josh Poimboeuf <jpoimboe@xxxxxxxxxx>
Link: https://lore.kernel.org/r/20231018175531.GEZTAcE2p92U1AuVp1@fat_crate.local
---
arch/x86/kernel/vmlinux.lds.S | 3 +++
arch/x86/lib/retpoline.S | 2 ++
2 files changed, 5 insertions(+)
diff --git a/arch/x86/kernel/vmlinux.lds.S b/arch/x86/kernel/vmlinux.lds.S
index 9cdb1a7..54a5596 100644
--- a/arch/x86/kernel/vmlinux.lds.S
+++ b/arch/x86/kernel/vmlinux.lds.S
@@ -132,7 +132,10 @@ SECTIONS
LOCK_TEXT
KPROBES_TEXT
SOFTIRQENTRY_TEXT
+#ifdef CONFIG_RETPOLINE
*(.text..__x86.indirect_thunk)
+ *(.text..__x86.return_thunk)
+#endif
STATIC_CALL_TEXT
ALIGN_ENTRY_TEXT_BEGIN
diff --git a/arch/x86/lib/retpoline.S b/arch/x86/lib/retpoline.S
index 6376d01..d410aba 100644
--- a/arch/x86/lib/retpoline.S
+++ b/arch/x86/lib/retpoline.S
@@ -129,6 +129,8 @@ SYM_CODE_END(__x86_indirect_jump_thunk_array)
#ifdef CONFIG_RETHUNK
+ .section .text..__x86.return_thunk
+
#ifdef CONFIG_CPU_SRSO
/*
|