[tip: x86/bugs] Revert "x86/retpoline: Remove .text..__x86.return_thunk section"

[tip-bot2 for Borislav Petkov (AMD)]

The following commit has been merged into the x86/bugs branch of tip:

Commit-ID:     59e6ce1eaaa2d9b2f9c89a108ce3fc7510bcd7ea
Gitweb:        https://git.kernel.org/tip/59e6ce1eaaa2d9b2f9c89a108ce3fc7510bcd7ea
Author:        Borislav Petkov (AMD) <bp@xxxxxxxxx>
AuthorDate:    Thu, 19 Oct 2023 11:09:41 +02:00
Committer:     Borislav Petkov (AMD) <bp@xxxxxxxxx>
CommitterDate: Thu, 19 Oct 2023 11:25:19 +02:00

Revert "x86/retpoline: Remove .text..__x86.return_thunk section"

This reverts commit e92626af3234708fe30f53b269d210d202b95206.

David Howells reported his box freezing without being able to see
a panic. However, it managed to issue a warning beforehand:

  missing return thunk: __x86_indirect_thunk_r15+0xa/0x5f-0x0: eb 74 66 66 2e
  WARNING: CPU: 0 PID: 0 at arch/x86/kernel/alternative.c:755 apply_returns+0xca/0x247
  Modules linked in:
  CPU: 0 PID: 0 Comm: swapper/0 Not tainted 6.6.0-rc5-next-20231013-build3+ #3044
  Hardware name: ASUS All Series/H97-PLUS, BIOS 2306 10/09/2014
  RIP: 0010:apply_returns+0xca/0x247

this happened with linux-next and with gcc 13. Looking at the compiler
output and particularly paying attention to the two JMP instructions:

  <__x86_indirect_thunk_r14>:
         e8 01 00 00 00          call   ffffffff81d71206 <__x86_indirect_thunk_r14+0x6>
         cc                      int3
         4c 89 34 24             mov    %r14,(%rsp)
         e9 91 00 00 00          jmp    ffffffff81d712a0 <__x86_return_thunk>
         66 66 2e 0f 1f 84 00    data16 cs nopw 0x0(%rax,%rax,1)
         00 00 00 00
         66 0f 1f 44 00 00       nopw   0x0(%rax,%rax,1)

  <__x86_indirect_thunk_r15>:
         e8 01 00 00 00          call   ffffffff81d71226 <__x86_indirect_thunk_r15+0x6>
         cc                      int3
         4c 89 3c 24             mov    %r15,(%rsp)
         eb 74                   jmp    ffffffff81d712a0 <__x86_return_thunk>

the second JMP is a short JMP one. This is likely some new gcc
optimization to size the JMP offsets and generate a small one if it
fits.

However, the apply_returns() logic does not expect a short JMP:

  if (op == JMP32_INSN_OPCODE)
        dest = addr + insn.length + insn.immediate.value;

and that JMP32_INSN_OPCODE is 0xe9.

Now, if __x86_return_thunk is in another section, the compiler cannot do
those shortcuts and will have to generate a JMP with a s32 offset.

As a matter of fact, the removal of the section  broke another case, see

  https://lore.kernel.org/r/20231010171020.462211-2-david.kaplan@xxxxxxx

so revert for now until all the possible code generation issues have
been assessed, addressed and verified properly.

Reported-by: David Howells <dhowells@xxxxxxxxxx>
Tested-by: David Howells <dhowells@xxxxxxxxxx>
Signed-off-by: Borislav Petkov (AMD) <bp@xxxxxxxxx>
Cc: Josh Poimboeuf <jpoimboe@xxxxxxxxxx>
Link: https://lore.kernel.org/r/20231018175531.GEZTAcE2p92U1AuVp1@fat_crate.local
---
 arch/x86/kernel/vmlinux.lds.S | 3 +++
 arch/x86/lib/retpoline.S      | 2 ++
 2 files changed, 5 insertions(+)

diff --git a/arch/x86/kernel/vmlinux.lds.S b/arch/x86/kernel/vmlinux.lds.S
index 9cdb1a7..54a5596 100644
--- a/arch/x86/kernel/vmlinux.lds.S
+++ b/arch/x86/kernel/vmlinux.lds.S
@@ -132,7 +132,10 @@ SECTIONS
 		LOCK_TEXT
 		KPROBES_TEXT
 		SOFTIRQENTRY_TEXT
+#ifdef CONFIG_RETPOLINE
 		*(.text..__x86.indirect_thunk)
+		*(.text..__x86.return_thunk)
+#endif
 		STATIC_CALL_TEXT
 
 		ALIGN_ENTRY_TEXT_BEGIN
diff --git a/arch/x86/lib/retpoline.S b/arch/x86/lib/retpoline.S
index 6376d01..d410aba 100644
--- a/arch/x86/lib/retpoline.S
+++ b/arch/x86/lib/retpoline.S
@@ -129,6 +129,8 @@ SYM_CODE_END(__x86_indirect_jump_thunk_array)
 
 #ifdef CONFIG_RETHUNK
 
+	.section .text..__x86.return_thunk
+
 #ifdef CONFIG_CPU_SRSO
 
 /*