Commit 0b53c374 authored by Peter Zijlstra's avatar Peter Zijlstra Committed by Borislav Petkov
Browse files

x86/retpoline: Use -mfunction-return 



Utilize -mfunction-return=thunk-extern when available to have the
compiler replace RET instructions with direct JMPs to the symbol
__x86_return_thunk. This does not affect assembler (.S) sources, only C
sources.

-mfunction-return=thunk-extern has been available since gcc 7.3 and
clang 15.

Signed-off-by: default avatarPeter Zijlstra (Intel) <peterz@infradead.org>
Signed-off-by: default avatarBorislav Petkov <bp@suse.de>
Reviewed-by: default avatarNick Desaulniers <ndesaulniers@google.com>
Reviewed-by: default avatarJosh Poimboeuf <jpoimboe@kernel.org>
Tested-by: default avatarNick Desaulniers <ndesaulniers@google.com>
Signed-off-by: default avatarBorislav Petkov <bp@suse.de>
parent 00e15333

arch/x86/Makefile

+2 −0
Original line number Diff line number Diff line
@@ -15,11 +15,13 @@ endif 
ifdef CONFIG_CC_IS_GCC

RETPOLINE_CFLAGS	:= $(call cc-option,-mindirect-branch=thunk-extern -mindirect-branch-register)

RETPOLINE_CFLAGS	+= $(call cc-option,-mindirect-branch-cs-prefix)

RETPOLINE_CFLAGS	+= $(call cc-option,-mfunction-return=thunk-extern)

RETPOLINE_VDSO_CFLAGS	:= $(call cc-option,-mindirect-branch=thunk-inline -mindirect-branch-register)

endif

ifdef CONFIG_CC_IS_CLANG

RETPOLINE_CFLAGS	:= -mretpoline-external-thunk

RETPOLINE_VDSO_CFLAGS	:= -mretpoline

RETPOLINE_CFLAGS	+= $(call cc-option,-mfunction-return=thunk-extern)

endif

export RETPOLINE_CFLAGS

export RETPOLINE_VDSO_CFLAGS

arch/x86/include/asm/nospec-branch.h

+2 −0
Original line number Diff line number Diff line
@@ -123,6 +123,8 @@ 
typedef u8 retpoline_thunk_t[RETPOLINE_THUNK_SIZE];

extern retpoline_thunk_t __x86_indirect_thunk_array[];



extern void __x86_return_thunk(void);



#ifdef CONFIG_RETPOLINE



#define GEN(reg) \

arch/x86/lib/retpoline.S

+13 −0
Original line number Diff line number Diff line
@@ -67,3 +67,16 @@ SYM_CODE_END(__x86_indirect_thunk_array) 
#define GEN(reg) EXPORT_THUNK(reg)

#include <asm/GEN-for-each-reg.h>

#undef GEN



/*

 * This function name is magical and is used by -mfunction-return=thunk-extern

 * for the compiler to generate JMPs to it.

 */

SYM_CODE_START(__x86_return_thunk)

	UNWIND_HINT_EMPTY

	ANNOTATE_NOENDBR

	ret

	int3

SYM_CODE_END(__x86_return_thunk)



__EXPORT_THUNK(__x86_return_thunk)