[SRU,xenial/linux] switch Spectre V2 mitigation to retpoline

Message ID 20180205094017.GI6265@brain
State New
Headers show
Series
  • [SRU,xenial/linux] switch Spectre V2 mitigation to retpoline
Related show

Pull-request

https://git.launchpad.net/~apw/ubuntu/+source/linux/+git/pti pti/xenial-retpoline-intelv1--pull

Message

Andy Whitcroft Feb. 5, 2018, 9:40 a.m.
Now that retpoline has made it to stable it is appropriate we switch
over to this for mitigation of Spectre V2.  This form is meant to have a
significantly lower performance penalty, and also does not require
microcode support from the processor.

This is a large patchset as it has to revert the existing mitigations for
Spectre V1 and V2 as these are intertwined.  We take advantage of this
to reapply a slightly updated Spectre V1 mitigation and to more clearly
identify those patches for when they are themselves replaced by final
upstream versions.

The patches are split into 3 sections, each set has been marked up such
that they fall out separatly in the Ubuntu change (which is included in
the pull request at the end of this email).

  * CVE-2017-5715 (revert embargoed) // CVE-2017-5753 (revert embargoed)
  * CVE-2017-5715 (Spectre v2 retpoline)
  * CVE-2017-5753 (Spectre v1 Intel)

Full pull-request is below.  Proposing for SRU to xenial/linux.

-apw

The following changes since commit 63da13a92f24468262daef38150e069b908c3659:

  net: ipv4: fix for a race condition in raw_sendmsg (2018-02-02 15:01:03 +0100)

are available in the Git repository at:

  https://git.launchpad.net/~apw/ubuntu/+source/linux/+git/pti pti/xenial-retpoline-intelv1--pull

for you to fetch changes up to 2a7816e589e90e580390022c73c30a775a16b49c:

  arm: no osb() implementation yet (2018-02-04 15:11:02 +0000)

----------------------------------------------------------------
  * CVE-2017-5753 (Spectre v1 Intel)
    - x86/cpu/AMD: Make the LFENCE instruction serialized
    - x86/cpu/AMD: Remove now unused definition of MFENCE_RDTSC feature
    - SAUCE: reinstate MFENCE_RDTSC feature definition
    - locking/barriers: introduce new observable speculation barrier
    - bpf: prevent speculative execution in eBPF interpreter
    - x86, bpf, jit: prevent speculative execution when JIT is enabled
    - SAUCE: FIX: x86, bpf, jit: prevent speculative execution when JIT is enabled
    - carl9170: prevent speculative execution
    - qla2xxx: prevent speculative execution
    - Thermal/int340x: prevent speculative execution
    - ipv4: prevent speculative execution
    - ipv6: prevent speculative execution
    - fs: prevent speculative execution
    - net: mpls: prevent speculative execution
    - udf: prevent speculative execution
    - userns: prevent speculative execution
    - SAUCE: claim mitigation via observable speculation barrier
    - powerpc: add osb barrier
    - s390/spinlock: add osb memory barrier
    - arm64: no osb() implementation yet
    - arm: no osb() implementation yet

  * CVE-2017-5715 (Spectre v2 retpoline)
    - x86/cpuid: Provide get_scattered_cpuid_leaf()
    - x86/cpu: Factor out application of forced CPU caps
    - x86/cpufeatures: Make CPU bugs sticky
    - x86/cpufeatures: Add X86_BUG_CPU_INSECURE
    - x86/cpu, x86/pti: Do not enable PTI on AMD processors
    - x86/pti: Rename BUG_CPU_INSECURE to BUG_CPU_MELTDOWN
    - x86/cpufeatures: Add X86_BUG_SPECTRE_V[12]
    - x86/cpu: Merge bugs.c and bugs_64.c
    - sysfs/cpu: Add vulnerability folder
    - x86/cpu: Implement CPU vulnerabilites sysfs functions
    - x86/alternatives: Add missing '\n' at end of ALTERNATIVE inline asm
    - x86/mm/32: Move setup_clear_cpu_cap(X86_FEATURE_PCID) earlier
    - x86/asm: Use register variable to get stack pointer value
    - x86/kbuild: enable modversions for symbols exported from asm
    - x86/asm: Make asm/alternative.h safe from assembly
    - EXPORT_SYMBOL() for asm
    - kconfig.h: use __is_defined() to check if MODULE is defined
    - x86/retpoline: Add initial retpoline support
    - x86/spectre: Add boot time option to select Spectre v2 mitigation
    - x86/retpoline/crypto: Convert crypto assembler indirect jumps
    - x86/retpoline/entry: Convert entry assembler indirect jumps
    - x86/retpoline/ftrace: Convert ftrace assembler indirect jumps
    - x86/retpoline/hyperv: Convert assembler indirect jumps
    - x86/retpoline/xen: Convert Xen hypercall indirect jumps
    - x86/retpoline/checksum32: Convert assembler indirect jumps
    - x86/retpoline/irq32: Convert assembler indirect jumps
    - x86/retpoline: Fill return stack buffer on vmexit
    - x86/retpoline: Remove compile time warning
    - x86/retpoline: Add LFENCE to the retpoline/RSB filling RSB macros
    - module: Add retpoline tag to VERMAGIC
    - x86/mce: Make machine check speculation protected
    - retpoline: Introduce start/end markers of indirect thunk
    - kprobes/x86: Blacklist indirect thunk functions for kprobes
    - kprobes/x86: Disable optimizing on the function jumps to indirect thunk
    - x86/retpoline: Optimize inline assembler for vmexit_fill_RSB
    - [Config] CONFIG_RETPOLINE=y
    - [Packaging] retpoline -- add call site validation
    - [Config] disable retpoline checks for first upload

  * CVE-2017-5715 (revert embargoed) // CVE-2017-5753 (revert embargoed)
    - Revert "UBUNTU: SAUCE: Fix spec_ctrl support in KVM"
    - Revert "x86/cpuid: Provide get_scattered_cpuid_leaf()"
    - Revert "kvm: vmx: Scrub hardware GPRs at VM-exit"
    - Revert "Revert "x86/svm: Add code to clear registers on VM exit""
    - Revert "UBUNTU: SAUCE: x86/microcode: Extend post microcode reload to
      support IBPB feature -- repair missmerge"
    - Revert "arm: no gmb() implementation yet"
    - Revert "arm64: no gmb() implementation yet"
    - Revert "UBUNTU: SAUCE: x86/kvm: Fix stuff_RSB() for 32-bit"
    - Revert "s390/spinlock: add gmb memory barrier"
    - Revert "powerpc: add gmb barrier"
    - Revert "x86/cpu/AMD: Remove now unused definition of MFENCE_RDTSC feature"
    - Revert "x86/cpu/AMD: Make the LFENCE instruction serialized"
    - Revert "x86/svm: Add code to clear registers on VM exit"
    - Revert "x86/svm: Add code to clobber the RSB on VM exit"
    - Revert "KVM: x86: Add speculative control CPUID support for guests"
    - Revert "x86/svm: Set IBPB when running a different VCPU"
    - Revert "x86/svm: Set IBRS value on VM entry and exit"
    - Revert "KVM: SVM: Do not intercept new speculative control MSRs"
    - Revert "x86/microcode: Extend post microcode reload to support IBPB feature"
    - Revert "x86/cpu/AMD: Add speculative control support for AMD"
    - Revert "x86/cpu/amd, kvm: Satisfy guest kernel reads of IC_CFG MSR"
    - Revert "x86/entry: Use retpoline for syscall's indirect calls"
    - Revert "x86/syscall: Clear unused extra registers on 32-bit compatible
      syscall entrance"
    - Revert "x86/syscall: Clear unused extra registers on syscall entrance"
    - Revert "x86/spec_ctrl: Add lock to serialize changes to ibrs and ibpb
      control"
    - Revert "x86/spec_ctrl: Add sysctl knobs to enable/disable SPEC_CTRL feature"
    - Revert "x86/kvm: Pad RSB on VM transition"
    - Revert "x86/kvm: Toggle IBRS on VM entry and exit"
    - Revert "x86/kvm: Set IBPB when switching VM"
    - Revert "x86/kvm: add MSR_IA32_SPEC_CTRL and MSR_IA32_PRED_CMD to kvm"
    - Revert "x86/entry: Stuff RSB for entry to kernel for non-SMEP platform"
    - Revert "x86/mm: Only set IBPB when the new thread cannot ptrace current
      thread"
    - Revert "x86/mm: Set IBPB upon context switch"
    - Revert "x86/idle: Disable IBRS when offlining cpu and re-enable on wakeup"
    - Revert "x86/idle: Disable IBRS entering idle and enable it on wakeup"
    - Revert "x86/enter: Use IBRS on syscall and interrupts"
    - Revert "x86/enter: MACROS to set/clear IBRS and set IBPB"
    - Revert "x86/feature: Report presence of IBPB and IBRS control"
    - Revert "x86/feature: Enable the x86 feature to control Speculation"
    - Revert "udf: prevent speculative execution"
    - Revert "net: mpls: prevent speculative execution"
    - Revert "fs: prevent speculative execution"
    - Revert "ipv6: prevent speculative execution"
    - Revert "userns: prevent speculative execution"
    - Revert "Thermal/int340x: prevent speculative execution"
    - Revert "qla2xxx: prevent speculative execution"
    - Revert "carl9170: prevent speculative execution"
    - Revert "uvcvideo: prevent speculative execution"
    - Revert "x86, bpf, jit: prevent speculative execution when JIT is enabled"
    - Revert "bpf: prevent speculative execution in eBPF interpreter"

Comments

Kleber Souza Feb. 5, 2018, 3:17 p.m. | #1
On 02/05/18 10:40, Andy Whitcroft wrote:
> Now that retpoline has made it to stable it is appropriate we switch
> over to this for mitigation of Spectre V2.  This form is meant to have a
> significantly lower performance penalty, and also does not require
> microcode support from the processor.
> 
> This is a large patchset as it has to revert the existing mitigations for
> Spectre V1 and V2 as these are intertwined.  We take advantage of this
> to reapply a slightly updated Spectre V1 mitigation and to more clearly
> identify those patches for when they are themselves replaced by final
> upstream versions.
> 
> The patches are split into 3 sections, each set has been marked up such
> that they fall out separatly in the Ubuntu change (which is included in
> the pull request at the end of this email).
> 
>   * CVE-2017-5715 (revert embargoed) // CVE-2017-5753 (revert embargoed)
>   * CVE-2017-5715 (Spectre v2 retpoline)
>   * CVE-2017-5753 (Spectre v1 Intel)
> 
> Full pull-request is below.  Proposing for SRU to xenial/linux.
> 
> -apw
> 
> The following changes since commit 63da13a92f24468262daef38150e069b908c3659:
> 
>   net: ipv4: fix for a race condition in raw_sendmsg (2018-02-02 15:01:03 +0100)
> 
> are available in the Git repository at:
> 
>   https://git.launchpad.net/~apw/ubuntu/+source/linux/+git/pti pti/xenial-retpoline-intelv1--pull
> 
> for you to fetch changes up to 2a7816e589e90e580390022c73c30a775a16b49c:
> 
>   arm: no osb() implementation yet (2018-02-04 15:11:02 +0000)

2a7816e589e90e580390022c73c30a775a16b49c is not reachable from
pti/xenial-retpoline-intelv1--pull, it seems to be
e267f1d0fc458cab3470fa54a6d573e2cb1994e5 instead.

If that's the case:

Acked-by: Kleber Sacilotto de Souza <kleber.souza@canonical.com>

> 
> ----------------------------------------------------------------
>   * CVE-2017-5753 (Spectre v1 Intel)
>     - x86/cpu/AMD: Make the LFENCE instruction serialized
>     - x86/cpu/AMD: Remove now unused definition of MFENCE_RDTSC feature
>     - SAUCE: reinstate MFENCE_RDTSC feature definition
>     - locking/barriers: introduce new observable speculation barrier
>     - bpf: prevent speculative execution in eBPF interpreter
>     - x86, bpf, jit: prevent speculative execution when JIT is enabled
>     - SAUCE: FIX: x86, bpf, jit: prevent speculative execution when JIT is enabled
>     - carl9170: prevent speculative execution
>     - qla2xxx: prevent speculative execution
>     - Thermal/int340x: prevent speculative execution
>     - ipv4: prevent speculative execution
>     - ipv6: prevent speculative execution
>     - fs: prevent speculative execution
>     - net: mpls: prevent speculative execution
>     - udf: prevent speculative execution
>     - userns: prevent speculative execution
>     - SAUCE: claim mitigation via observable speculation barrier
>     - powerpc: add osb barrier
>     - s390/spinlock: add osb memory barrier
>     - arm64: no osb() implementation yet
>     - arm: no osb() implementation yet
> 
>   * CVE-2017-5715 (Spectre v2 retpoline)
>     - x86/cpuid: Provide get_scattered_cpuid_leaf()
>     - x86/cpu: Factor out application of forced CPU caps
>     - x86/cpufeatures: Make CPU bugs sticky
>     - x86/cpufeatures: Add X86_BUG_CPU_INSECURE
>     - x86/cpu, x86/pti: Do not enable PTI on AMD processors
>     - x86/pti: Rename BUG_CPU_INSECURE to BUG_CPU_MELTDOWN
>     - x86/cpufeatures: Add X86_BUG_SPECTRE_V[12]
>     - x86/cpu: Merge bugs.c and bugs_64.c
>     - sysfs/cpu: Add vulnerability folder
>     - x86/cpu: Implement CPU vulnerabilites sysfs functions
>     - x86/alternatives: Add missing '\n' at end of ALTERNATIVE inline asm
>     - x86/mm/32: Move setup_clear_cpu_cap(X86_FEATURE_PCID) earlier
>     - x86/asm: Use register variable to get stack pointer value
>     - x86/kbuild: enable modversions for symbols exported from asm
>     - x86/asm: Make asm/alternative.h safe from assembly
>     - EXPORT_SYMBOL() for asm
>     - kconfig.h: use __is_defined() to check if MODULE is defined
>     - x86/retpoline: Add initial retpoline support
>     - x86/spectre: Add boot time option to select Spectre v2 mitigation
>     - x86/retpoline/crypto: Convert crypto assembler indirect jumps
>     - x86/retpoline/entry: Convert entry assembler indirect jumps
>     - x86/retpoline/ftrace: Convert ftrace assembler indirect jumps
>     - x86/retpoline/hyperv: Convert assembler indirect jumps
>     - x86/retpoline/xen: Convert Xen hypercall indirect jumps
>     - x86/retpoline/checksum32: Convert assembler indirect jumps
>     - x86/retpoline/irq32: Convert assembler indirect jumps
>     - x86/retpoline: Fill return stack buffer on vmexit
>     - x86/retpoline: Remove compile time warning
>     - x86/retpoline: Add LFENCE to the retpoline/RSB filling RSB macros
>     - module: Add retpoline tag to VERMAGIC
>     - x86/mce: Make machine check speculation protected
>     - retpoline: Introduce start/end markers of indirect thunk
>     - kprobes/x86: Blacklist indirect thunk functions for kprobes
>     - kprobes/x86: Disable optimizing on the function jumps to indirect thunk
>     - x86/retpoline: Optimize inline assembler for vmexit_fill_RSB
>     - [Config] CONFIG_RETPOLINE=y
>     - [Packaging] retpoline -- add call site validation
>     - [Config] disable retpoline checks for first upload
> 
>   * CVE-2017-5715 (revert embargoed) // CVE-2017-5753 (revert embargoed)
>     - Revert "UBUNTU: SAUCE: Fix spec_ctrl support in KVM"
>     - Revert "x86/cpuid: Provide get_scattered_cpuid_leaf()"
>     - Revert "kvm: vmx: Scrub hardware GPRs at VM-exit"
>     - Revert "Revert "x86/svm: Add code to clear registers on VM exit""
>     - Revert "UBUNTU: SAUCE: x86/microcode: Extend post microcode reload to
>       support IBPB feature -- repair missmerge"
>     - Revert "arm: no gmb() implementation yet"
>     - Revert "arm64: no gmb() implementation yet"
>     - Revert "UBUNTU: SAUCE: x86/kvm: Fix stuff_RSB() for 32-bit"
>     - Revert "s390/spinlock: add gmb memory barrier"
>     - Revert "powerpc: add gmb barrier"
>     - Revert "x86/cpu/AMD: Remove now unused definition of MFENCE_RDTSC feature"
>     - Revert "x86/cpu/AMD: Make the LFENCE instruction serialized"
>     - Revert "x86/svm: Add code to clear registers on VM exit"
>     - Revert "x86/svm: Add code to clobber the RSB on VM exit"
>     - Revert "KVM: x86: Add speculative control CPUID support for guests"
>     - Revert "x86/svm: Set IBPB when running a different VCPU"
>     - Revert "x86/svm: Set IBRS value on VM entry and exit"
>     - Revert "KVM: SVM: Do not intercept new speculative control MSRs"
>     - Revert "x86/microcode: Extend post microcode reload to support IBPB feature"
>     - Revert "x86/cpu/AMD: Add speculative control support for AMD"
>     - Revert "x86/cpu/amd, kvm: Satisfy guest kernel reads of IC_CFG MSR"
>     - Revert "x86/entry: Use retpoline for syscall's indirect calls"
>     - Revert "x86/syscall: Clear unused extra registers on 32-bit compatible
>       syscall entrance"
>     - Revert "x86/syscall: Clear unused extra registers on syscall entrance"
>     - Revert "x86/spec_ctrl: Add lock to serialize changes to ibrs and ibpb
>       control"
>     - Revert "x86/spec_ctrl: Add sysctl knobs to enable/disable SPEC_CTRL feature"
>     - Revert "x86/kvm: Pad RSB on VM transition"
>     - Revert "x86/kvm: Toggle IBRS on VM entry and exit"
>     - Revert "x86/kvm: Set IBPB when switching VM"
>     - Revert "x86/kvm: add MSR_IA32_SPEC_CTRL and MSR_IA32_PRED_CMD to kvm"
>     - Revert "x86/entry: Stuff RSB for entry to kernel for non-SMEP platform"
>     - Revert "x86/mm: Only set IBPB when the new thread cannot ptrace current
>       thread"
>     - Revert "x86/mm: Set IBPB upon context switch"
>     - Revert "x86/idle: Disable IBRS when offlining cpu and re-enable on wakeup"
>     - Revert "x86/idle: Disable IBRS entering idle and enable it on wakeup"
>     - Revert "x86/enter: Use IBRS on syscall and interrupts"
>     - Revert "x86/enter: MACROS to set/clear IBRS and set IBPB"
>     - Revert "x86/feature: Report presence of IBPB and IBRS control"
>     - Revert "x86/feature: Enable the x86 feature to control Speculation"
>     - Revert "udf: prevent speculative execution"
>     - Revert "net: mpls: prevent speculative execution"
>     - Revert "fs: prevent speculative execution"
>     - Revert "ipv6: prevent speculative execution"
>     - Revert "userns: prevent speculative execution"
>     - Revert "Thermal/int340x: prevent speculative execution"
>     - Revert "qla2xxx: prevent speculative execution"
>     - Revert "carl9170: prevent speculative execution"
>     - Revert "uvcvideo: prevent speculative execution"
>     - Revert "x86, bpf, jit: prevent speculative execution when JIT is enabled"
>     - Revert "bpf: prevent speculative execution in eBPF interpreter"
>
Andy Whitcroft Feb. 5, 2018, 3:48 p.m. | #2
On Mon, Feb 05, 2018 at 04:17:33PM +0100, Kleber Souza wrote:
> On 02/05/18 10:40, Andy Whitcroft wrote:
> > Now that retpoline has made it to stable it is appropriate we switch
> > over to this for mitigation of Spectre V2.  This form is meant to have a
> > significantly lower performance penalty, and also does not require
> > microcode support from the processor.
> > 
> > This is a large patchset as it has to revert the existing mitigations for
> > Spectre V1 and V2 as these are intertwined.  We take advantage of this
> > to reapply a slightly updated Spectre V1 mitigation and to more clearly
> > identify those patches for when they are themselves replaced by final
> > upstream versions.
> > 
> > The patches are split into 3 sections, each set has been marked up such
> > that they fall out separatly in the Ubuntu change (which is included in
> > the pull request at the end of this email).
> > 
> >   * CVE-2017-5715 (revert embargoed) // CVE-2017-5753 (revert embargoed)
> >   * CVE-2017-5715 (Spectre v2 retpoline)
> >   * CVE-2017-5753 (Spectre v1 Intel)
> > 
> > Full pull-request is below.  Proposing for SRU to xenial/linux.
> > 
> > -apw
> > 
> > The following changes since commit 63da13a92f24468262daef38150e069b908c3659:
> > 
> >   net: ipv4: fix for a race condition in raw_sendmsg (2018-02-02 15:01:03 +0100)
> > 
> > are available in the Git repository at:
> > 
> >   https://git.launchpad.net/~apw/ubuntu/+source/linux/+git/pti pti/xenial-retpoline-intelv1--pull
> > 
> > for you to fetch changes up to 2a7816e589e90e580390022c73c30a775a16b49c:
> > 
> >   arm: no osb() implementation yet (2018-02-04 15:11:02 +0000)
> 
> 2a7816e589e90e580390022c73c30a775a16b49c is not reachable from
> pti/xenial-retpoline-intelv1--pull, it seems to be
> e267f1d0fc458cab3470fa54a6d573e2cb1994e5 instead.
> 
> If that's the case:
> 
> Acked-by: Kleber Sacilotto de Souza <kleber.souza@canonical.com>

That is indeed the correct updated sha1.  I added the commit to disable
the retpoline checks and slid it down and into the middle.  Derp.

-apw
Kleber Souza Feb. 5, 2018, 4:25 p.m. | #3
Applied to xenial/master-next branch, folding the fixup commit into its
patch.

Thanks,
Kleber

On 02/05/18 10:40, Andy Whitcroft wrote:
> Now that retpoline has made it to stable it is appropriate we switch
> over to this for mitigation of Spectre V2.  This form is meant to have a
> significantly lower performance penalty, and also does not require
> microcode support from the processor.
> 
> This is a large patchset as it has to revert the existing mitigations for
> Spectre V1 and V2 as these are intertwined.  We take advantage of this
> to reapply a slightly updated Spectre V1 mitigation and to more clearly
> identify those patches for when they are themselves replaced by final
> upstream versions.
> 
> The patches are split into 3 sections, each set has been marked up such
> that they fall out separatly in the Ubuntu change (which is included in
> the pull request at the end of this email).
> 
>   * CVE-2017-5715 (revert embargoed) // CVE-2017-5753 (revert embargoed)
>   * CVE-2017-5715 (Spectre v2 retpoline)
>   * CVE-2017-5753 (Spectre v1 Intel)
> 
> Full pull-request is below.  Proposing for SRU to xenial/linux.
> 
> -apw
> 
> The following changes since commit 63da13a92f24468262daef38150e069b908c3659:
> 
>   net: ipv4: fix for a race condition in raw_sendmsg (2018-02-02 15:01:03 +0100)
> 
> are available in the Git repository at:
> 
>   https://git.launchpad.net/~apw/ubuntu/+source/linux/+git/pti pti/xenial-retpoline-intelv1--pull
> 
> for you to fetch changes up to 2a7816e589e90e580390022c73c30a775a16b49c:
> 
>   arm: no osb() implementation yet (2018-02-04 15:11:02 +0000)
> 
> ----------------------------------------------------------------
>   * CVE-2017-5753 (Spectre v1 Intel)
>     - x86/cpu/AMD: Make the LFENCE instruction serialized
>     - x86/cpu/AMD: Remove now unused definition of MFENCE_RDTSC feature
>     - SAUCE: reinstate MFENCE_RDTSC feature definition
>     - locking/barriers: introduce new observable speculation barrier
>     - bpf: prevent speculative execution in eBPF interpreter
>     - x86, bpf, jit: prevent speculative execution when JIT is enabled
>     - SAUCE: FIX: x86, bpf, jit: prevent speculative execution when JIT is enabled
>     - carl9170: prevent speculative execution
>     - qla2xxx: prevent speculative execution
>     - Thermal/int340x: prevent speculative execution
>     - ipv4: prevent speculative execution
>     - ipv6: prevent speculative execution
>     - fs: prevent speculative execution
>     - net: mpls: prevent speculative execution
>     - udf: prevent speculative execution
>     - userns: prevent speculative execution
>     - SAUCE: claim mitigation via observable speculation barrier
>     - powerpc: add osb barrier
>     - s390/spinlock: add osb memory barrier
>     - arm64: no osb() implementation yet
>     - arm: no osb() implementation yet
> 
>   * CVE-2017-5715 (Spectre v2 retpoline)
>     - x86/cpuid: Provide get_scattered_cpuid_leaf()
>     - x86/cpu: Factor out application of forced CPU caps
>     - x86/cpufeatures: Make CPU bugs sticky
>     - x86/cpufeatures: Add X86_BUG_CPU_INSECURE
>     - x86/cpu, x86/pti: Do not enable PTI on AMD processors
>     - x86/pti: Rename BUG_CPU_INSECURE to BUG_CPU_MELTDOWN
>     - x86/cpufeatures: Add X86_BUG_SPECTRE_V[12]
>     - x86/cpu: Merge bugs.c and bugs_64.c
>     - sysfs/cpu: Add vulnerability folder
>     - x86/cpu: Implement CPU vulnerabilites sysfs functions
>     - x86/alternatives: Add missing '\n' at end of ALTERNATIVE inline asm
>     - x86/mm/32: Move setup_clear_cpu_cap(X86_FEATURE_PCID) earlier
>     - x86/asm: Use register variable to get stack pointer value
>     - x86/kbuild: enable modversions for symbols exported from asm
>     - x86/asm: Make asm/alternative.h safe from assembly
>     - EXPORT_SYMBOL() for asm
>     - kconfig.h: use __is_defined() to check if MODULE is defined
>     - x86/retpoline: Add initial retpoline support
>     - x86/spectre: Add boot time option to select Spectre v2 mitigation
>     - x86/retpoline/crypto: Convert crypto assembler indirect jumps
>     - x86/retpoline/entry: Convert entry assembler indirect jumps
>     - x86/retpoline/ftrace: Convert ftrace assembler indirect jumps
>     - x86/retpoline/hyperv: Convert assembler indirect jumps
>     - x86/retpoline/xen: Convert Xen hypercall indirect jumps
>     - x86/retpoline/checksum32: Convert assembler indirect jumps
>     - x86/retpoline/irq32: Convert assembler indirect jumps
>     - x86/retpoline: Fill return stack buffer on vmexit
>     - x86/retpoline: Remove compile time warning
>     - x86/retpoline: Add LFENCE to the retpoline/RSB filling RSB macros
>     - module: Add retpoline tag to VERMAGIC
>     - x86/mce: Make machine check speculation protected
>     - retpoline: Introduce start/end markers of indirect thunk
>     - kprobes/x86: Blacklist indirect thunk functions for kprobes
>     - kprobes/x86: Disable optimizing on the function jumps to indirect thunk
>     - x86/retpoline: Optimize inline assembler for vmexit_fill_RSB
>     - [Config] CONFIG_RETPOLINE=y
>     - [Packaging] retpoline -- add call site validation
>     - [Config] disable retpoline checks for first upload
> 
>   * CVE-2017-5715 (revert embargoed) // CVE-2017-5753 (revert embargoed)
>     - Revert "UBUNTU: SAUCE: Fix spec_ctrl support in KVM"
>     - Revert "x86/cpuid: Provide get_scattered_cpuid_leaf()"
>     - Revert "kvm: vmx: Scrub hardware GPRs at VM-exit"
>     - Revert "Revert "x86/svm: Add code to clear registers on VM exit""
>     - Revert "UBUNTU: SAUCE: x86/microcode: Extend post microcode reload to
>       support IBPB feature -- repair missmerge"
>     - Revert "arm: no gmb() implementation yet"
>     - Revert "arm64: no gmb() implementation yet"
>     - Revert "UBUNTU: SAUCE: x86/kvm: Fix stuff_RSB() for 32-bit"
>     - Revert "s390/spinlock: add gmb memory barrier"
>     - Revert "powerpc: add gmb barrier"
>     - Revert "x86/cpu/AMD: Remove now unused definition of MFENCE_RDTSC feature"
>     - Revert "x86/cpu/AMD: Make the LFENCE instruction serialized"
>     - Revert "x86/svm: Add code to clear registers on VM exit"
>     - Revert "x86/svm: Add code to clobber the RSB on VM exit"
>     - Revert "KVM: x86: Add speculative control CPUID support for guests"
>     - Revert "x86/svm: Set IBPB when running a different VCPU"
>     - Revert "x86/svm: Set IBRS value on VM entry and exit"
>     - Revert "KVM: SVM: Do not intercept new speculative control MSRs"
>     - Revert "x86/microcode: Extend post microcode reload to support IBPB feature"
>     - Revert "x86/cpu/AMD: Add speculative control support for AMD"
>     - Revert "x86/cpu/amd, kvm: Satisfy guest kernel reads of IC_CFG MSR"
>     - Revert "x86/entry: Use retpoline for syscall's indirect calls"
>     - Revert "x86/syscall: Clear unused extra registers on 32-bit compatible
>       syscall entrance"
>     - Revert "x86/syscall: Clear unused extra registers on syscall entrance"
>     - Revert "x86/spec_ctrl: Add lock to serialize changes to ibrs and ibpb
>       control"
>     - Revert "x86/spec_ctrl: Add sysctl knobs to enable/disable SPEC_CTRL feature"
>     - Revert "x86/kvm: Pad RSB on VM transition"
>     - Revert "x86/kvm: Toggle IBRS on VM entry and exit"
>     - Revert "x86/kvm: Set IBPB when switching VM"
>     - Revert "x86/kvm: add MSR_IA32_SPEC_CTRL and MSR_IA32_PRED_CMD to kvm"
>     - Revert "x86/entry: Stuff RSB for entry to kernel for non-SMEP platform"
>     - Revert "x86/mm: Only set IBPB when the new thread cannot ptrace current
>       thread"
>     - Revert "x86/mm: Set IBPB upon context switch"
>     - Revert "x86/idle: Disable IBRS when offlining cpu and re-enable on wakeup"
>     - Revert "x86/idle: Disable IBRS entering idle and enable it on wakeup"
>     - Revert "x86/enter: Use IBRS on syscall and interrupts"
>     - Revert "x86/enter: MACROS to set/clear IBRS and set IBPB"
>     - Revert "x86/feature: Report presence of IBPB and IBRS control"
>     - Revert "x86/feature: Enable the x86 feature to control Speculation"
>     - Revert "udf: prevent speculative execution"
>     - Revert "net: mpls: prevent speculative execution"
>     - Revert "fs: prevent speculative execution"
>     - Revert "ipv6: prevent speculative execution"
>     - Revert "userns: prevent speculative execution"
>     - Revert "Thermal/int340x: prevent speculative execution"
>     - Revert "qla2xxx: prevent speculative execution"
>     - Revert "carl9170: prevent speculative execution"
>     - Revert "uvcvideo: prevent speculative execution"
>     - Revert "x86, bpf, jit: prevent speculative execution when JIT is enabled"
>     - Revert "bpf: prevent speculative execution in eBPF interpreter"
>
Kleber Souza Feb. 5, 2018, 4:40 p.m. | #4
On 02/05/18 17:25, Kleber Souza wrote:
> Applied to xenial/master-next branch, folding the fixup commit into its
> patch.

That comment regarding the fixup commit was meant to xenial, the comment
for artful should be:

Applied changes since commit 63da13a92f24468262daef38150e069b908c3659 up
to 2a7816e589e90e580390022c73c30a775a16b49c.


Thanks,
Kleber

> 
> Thanks,
> Kleber
> 
> On 02/05/18 10:40, Andy Whitcroft wrote:
>> Now that retpoline has made it to stable it is appropriate we switch
>> over to this for mitigation of Spectre V2.  This form is meant to have a
>> significantly lower performance penalty, and also does not require
>> microcode support from the processor.
>>
>> This is a large patchset as it has to revert the existing mitigations for
>> Spectre V1 and V2 as these are intertwined.  We take advantage of this
>> to reapply a slightly updated Spectre V1 mitigation and to more clearly
>> identify those patches for when they are themselves replaced by final
>> upstream versions.
>>
>> The patches are split into 3 sections, each set has been marked up such
>> that they fall out separatly in the Ubuntu change (which is included in
>> the pull request at the end of this email).
>>
>>   * CVE-2017-5715 (revert embargoed) // CVE-2017-5753 (revert embargoed)
>>   * CVE-2017-5715 (Spectre v2 retpoline)
>>   * CVE-2017-5753 (Spectre v1 Intel)
>>
>> Full pull-request is below.  Proposing for SRU to xenial/linux.
>>
>> -apw
>>
>> The following changes since commit 63da13a92f24468262daef38150e069b908c3659:
>>
>>   net: ipv4: fix for a race condition in raw_sendmsg (2018-02-02 15:01:03 +0100)
>>
>> are available in the Git repository at:
>>
>>   https://git.launchpad.net/~apw/ubuntu/+source/linux/+git/pti pti/xenial-retpoline-intelv1--pull
>>
>> for you to fetch changes up to 2a7816e589e90e580390022c73c30a775a16b49c:
>>
>>   arm: no osb() implementation yet (2018-02-04 15:11:02 +0000)
>>
>> ----------------------------------------------------------------
>>   * CVE-2017-5753 (Spectre v1 Intel)
>>     - x86/cpu/AMD: Make the LFENCE instruction serialized
>>     - x86/cpu/AMD: Remove now unused definition of MFENCE_RDTSC feature
>>     - SAUCE: reinstate MFENCE_RDTSC feature definition
>>     - locking/barriers: introduce new observable speculation barrier
>>     - bpf: prevent speculative execution in eBPF interpreter
>>     - x86, bpf, jit: prevent speculative execution when JIT is enabled
>>     - SAUCE: FIX: x86, bpf, jit: prevent speculative execution when JIT is enabled
>>     - carl9170: prevent speculative execution
>>     - qla2xxx: prevent speculative execution
>>     - Thermal/int340x: prevent speculative execution
>>     - ipv4: prevent speculative execution
>>     - ipv6: prevent speculative execution
>>     - fs: prevent speculative execution
>>     - net: mpls: prevent speculative execution
>>     - udf: prevent speculative execution
>>     - userns: prevent speculative execution
>>     - SAUCE: claim mitigation via observable speculation barrier
>>     - powerpc: add osb barrier
>>     - s390/spinlock: add osb memory barrier
>>     - arm64: no osb() implementation yet
>>     - arm: no osb() implementation yet
>>
>>   * CVE-2017-5715 (Spectre v2 retpoline)
>>     - x86/cpuid: Provide get_scattered_cpuid_leaf()
>>     - x86/cpu: Factor out application of forced CPU caps
>>     - x86/cpufeatures: Make CPU bugs sticky
>>     - x86/cpufeatures: Add X86_BUG_CPU_INSECURE
>>     - x86/cpu, x86/pti: Do not enable PTI on AMD processors
>>     - x86/pti: Rename BUG_CPU_INSECURE to BUG_CPU_MELTDOWN
>>     - x86/cpufeatures: Add X86_BUG_SPECTRE_V[12]
>>     - x86/cpu: Merge bugs.c and bugs_64.c
>>     - sysfs/cpu: Add vulnerability folder
>>     - x86/cpu: Implement CPU vulnerabilites sysfs functions
>>     - x86/alternatives: Add missing '\n' at end of ALTERNATIVE inline asm
>>     - x86/mm/32: Move setup_clear_cpu_cap(X86_FEATURE_PCID) earlier
>>     - x86/asm: Use register variable to get stack pointer value
>>     - x86/kbuild: enable modversions for symbols exported from asm
>>     - x86/asm: Make asm/alternative.h safe from assembly
>>     - EXPORT_SYMBOL() for asm
>>     - kconfig.h: use __is_defined() to check if MODULE is defined
>>     - x86/retpoline: Add initial retpoline support
>>     - x86/spectre: Add boot time option to select Spectre v2 mitigation
>>     - x86/retpoline/crypto: Convert crypto assembler indirect jumps
>>     - x86/retpoline/entry: Convert entry assembler indirect jumps
>>     - x86/retpoline/ftrace: Convert ftrace assembler indirect jumps
>>     - x86/retpoline/hyperv: Convert assembler indirect jumps
>>     - x86/retpoline/xen: Convert Xen hypercall indirect jumps
>>     - x86/retpoline/checksum32: Convert assembler indirect jumps
>>     - x86/retpoline/irq32: Convert assembler indirect jumps
>>     - x86/retpoline: Fill return stack buffer on vmexit
>>     - x86/retpoline: Remove compile time warning
>>     - x86/retpoline: Add LFENCE to the retpoline/RSB filling RSB macros
>>     - module: Add retpoline tag to VERMAGIC
>>     - x86/mce: Make machine check speculation protected
>>     - retpoline: Introduce start/end markers of indirect thunk
>>     - kprobes/x86: Blacklist indirect thunk functions for kprobes
>>     - kprobes/x86: Disable optimizing on the function jumps to indirect thunk
>>     - x86/retpoline: Optimize inline assembler for vmexit_fill_RSB
>>     - [Config] CONFIG_RETPOLINE=y
>>     - [Packaging] retpoline -- add call site validation
>>     - [Config] disable retpoline checks for first upload
>>
>>   * CVE-2017-5715 (revert embargoed) // CVE-2017-5753 (revert embargoed)
>>     - Revert "UBUNTU: SAUCE: Fix spec_ctrl support in KVM"
>>     - Revert "x86/cpuid: Provide get_scattered_cpuid_leaf()"
>>     - Revert "kvm: vmx: Scrub hardware GPRs at VM-exit"
>>     - Revert "Revert "x86/svm: Add code to clear registers on VM exit""
>>     - Revert "UBUNTU: SAUCE: x86/microcode: Extend post microcode reload to
>>       support IBPB feature -- repair missmerge"
>>     - Revert "arm: no gmb() implementation yet"
>>     - Revert "arm64: no gmb() implementation yet"
>>     - Revert "UBUNTU: SAUCE: x86/kvm: Fix stuff_RSB() for 32-bit"
>>     - Revert "s390/spinlock: add gmb memory barrier"
>>     - Revert "powerpc: add gmb barrier"
>>     - Revert "x86/cpu/AMD: Remove now unused definition of MFENCE_RDTSC feature"
>>     - Revert "x86/cpu/AMD: Make the LFENCE instruction serialized"
>>     - Revert "x86/svm: Add code to clear registers on VM exit"
>>     - Revert "x86/svm: Add code to clobber the RSB on VM exit"
>>     - Revert "KVM: x86: Add speculative control CPUID support for guests"
>>     - Revert "x86/svm: Set IBPB when running a different VCPU"
>>     - Revert "x86/svm: Set IBRS value on VM entry and exit"
>>     - Revert "KVM: SVM: Do not intercept new speculative control MSRs"
>>     - Revert "x86/microcode: Extend post microcode reload to support IBPB feature"
>>     - Revert "x86/cpu/AMD: Add speculative control support for AMD"
>>     - Revert "x86/cpu/amd, kvm: Satisfy guest kernel reads of IC_CFG MSR"
>>     - Revert "x86/entry: Use retpoline for syscall's indirect calls"
>>     - Revert "x86/syscall: Clear unused extra registers on 32-bit compatible
>>       syscall entrance"
>>     - Revert "x86/syscall: Clear unused extra registers on syscall entrance"
>>     - Revert "x86/spec_ctrl: Add lock to serialize changes to ibrs and ibpb
>>       control"
>>     - Revert "x86/spec_ctrl: Add sysctl knobs to enable/disable SPEC_CTRL feature"
>>     - Revert "x86/kvm: Pad RSB on VM transition"
>>     - Revert "x86/kvm: Toggle IBRS on VM entry and exit"
>>     - Revert "x86/kvm: Set IBPB when switching VM"
>>     - Revert "x86/kvm: add MSR_IA32_SPEC_CTRL and MSR_IA32_PRED_CMD to kvm"
>>     - Revert "x86/entry: Stuff RSB for entry to kernel for non-SMEP platform"
>>     - Revert "x86/mm: Only set IBPB when the new thread cannot ptrace current
>>       thread"
>>     - Revert "x86/mm: Set IBPB upon context switch"
>>     - Revert "x86/idle: Disable IBRS when offlining cpu and re-enable on wakeup"
>>     - Revert "x86/idle: Disable IBRS entering idle and enable it on wakeup"
>>     - Revert "x86/enter: Use IBRS on syscall and interrupts"
>>     - Revert "x86/enter: MACROS to set/clear IBRS and set IBPB"
>>     - Revert "x86/feature: Report presence of IBPB and IBRS control"
>>     - Revert "x86/feature: Enable the x86 feature to control Speculation"
>>     - Revert "udf: prevent speculative execution"
>>     - Revert "net: mpls: prevent speculative execution"
>>     - Revert "fs: prevent speculative execution"
>>     - Revert "ipv6: prevent speculative execution"
>>     - Revert "userns: prevent speculative execution"
>>     - Revert "Thermal/int340x: prevent speculative execution"
>>     - Revert "qla2xxx: prevent speculative execution"
>>     - Revert "carl9170: prevent speculative execution"
>>     - Revert "uvcvideo: prevent speculative execution"
>>     - Revert "x86, bpf, jit: prevent speculative execution when JIT is enabled"
>>     - Revert "bpf: prevent speculative execution in eBPF interpreter"
>>