| Message ID | 20180205094017.GI6265@brain |
|---|---|
| State | New |
| Headers | show |
| Series | [SRU,xenial/linux] switch Spectre V2 mitigation to retpoline | expand |
On 02/05/18 10:40, Andy Whitcroft wrote: > Now that retpoline has made it to stable it is appropriate we switch > over to this for mitigation of Spectre V2. This form is meant to have a > significantly lower performance penalty, and also does not require > microcode support from the processor. > > This is a large patchset as it has to revert the existing mitigations for > Spectre V1 and V2 as these are intertwined. We take advantage of this > to reapply a slightly updated Spectre V1 mitigation and to more clearly > identify those patches for when they are themselves replaced by final > upstream versions. > > The patches are split into 3 sections, each set has been marked up such > that they fall out separatly in the Ubuntu change (which is included in > the pull request at the end of this email). > > * CVE-2017-5715 (revert embargoed) // CVE-2017-5753 (revert embargoed) > * CVE-2017-5715 (Spectre v2 retpoline) > * CVE-2017-5753 (Spectre v1 Intel) > > Full pull-request is below. Proposing for SRU to xenial/linux. > > -apw > > The following changes since commit 63da13a92f24468262daef38150e069b908c3659: > > net: ipv4: fix for a race condition in raw_sendmsg (2018-02-02 15:01:03 +0100) > > are available in the Git repository at: > > https://git.launchpad.net/~apw/ubuntu/+source/linux/+git/pti pti/xenial-retpoline-intelv1--pull > > for you to fetch changes up to 2a7816e589e90e580390022c73c30a775a16b49c: > > arm: no osb() implementation yet (2018-02-04 15:11:02 +0000) 2a7816e589e90e580390022c73c30a775a16b49c is not reachable from pti/xenial-retpoline-intelv1--pull, it seems to be e267f1d0fc458cab3470fa54a6d573e2cb1994e5 instead. If that's the case: Acked-by: Kleber Sacilotto de Souza <kleber.souza@canonical.com> > > ---------------------------------------------------------------- > * CVE-2017-5753 (Spectre v1 Intel) > - x86/cpu/AMD: Make the LFENCE instruction serialized > - x86/cpu/AMD: Remove now unused definition of MFENCE_RDTSC feature > - SAUCE: reinstate MFENCE_RDTSC feature definition > - locking/barriers: introduce new observable speculation barrier > - bpf: prevent speculative execution in eBPF interpreter > - x86, bpf, jit: prevent speculative execution when JIT is enabled > - SAUCE: FIX: x86, bpf, jit: prevent speculative execution when JIT is enabled > - carl9170: prevent speculative execution > - qla2xxx: prevent speculative execution > - Thermal/int340x: prevent speculative execution > - ipv4: prevent speculative execution > - ipv6: prevent speculative execution > - fs: prevent speculative execution > - net: mpls: prevent speculative execution > - udf: prevent speculative execution > - userns: prevent speculative execution > - SAUCE: claim mitigation via observable speculation barrier > - powerpc: add osb barrier > - s390/spinlock: add osb memory barrier > - arm64: no osb() implementation yet > - arm: no osb() implementation yet > > * CVE-2017-5715 (Spectre v2 retpoline) > - x86/cpuid: Provide get_scattered_cpuid_leaf() > - x86/cpu: Factor out application of forced CPU caps > - x86/cpufeatures: Make CPU bugs sticky > - x86/cpufeatures: Add X86_BUG_CPU_INSECURE > - x86/cpu, x86/pti: Do not enable PTI on AMD processors > - x86/pti: Rename BUG_CPU_INSECURE to BUG_CPU_MELTDOWN > - x86/cpufeatures: Add X86_BUG_SPECTRE_V[12] > - x86/cpu: Merge bugs.c and bugs_64.c > - sysfs/cpu: Add vulnerability folder > - x86/cpu: Implement CPU vulnerabilites sysfs functions > - x86/alternatives: Add missing '\n' at end of ALTERNATIVE inline asm > - x86/mm/32: Move setup_clear_cpu_cap(X86_FEATURE_PCID) earlier > - x86/asm: Use register variable to get stack pointer value > - x86/kbuild: enable modversions for symbols exported from asm > - x86/asm: Make asm/alternative.h safe from assembly > - EXPORT_SYMBOL() for asm > - kconfig.h: use __is_defined() to check if MODULE is defined > - x86/retpoline: Add initial retpoline support > - x86/spectre: Add boot time option to select Spectre v2 mitigation > - x86/retpoline/crypto: Convert crypto assembler indirect jumps > - x86/retpoline/entry: Convert entry assembler indirect jumps > - x86/retpoline/ftrace: Convert ftrace assembler indirect jumps > - x86/retpoline/hyperv: Convert assembler indirect jumps > - x86/retpoline/xen: Convert Xen hypercall indirect jumps > - x86/retpoline/checksum32: Convert assembler indirect jumps > - x86/retpoline/irq32: Convert assembler indirect jumps > - x86/retpoline: Fill return stack buffer on vmexit > - x86/retpoline: Remove compile time warning > - x86/retpoline: Add LFENCE to the retpoline/RSB filling RSB macros > - module: Add retpoline tag to VERMAGIC > - x86/mce: Make machine check speculation protected > - retpoline: Introduce start/end markers of indirect thunk > - kprobes/x86: Blacklist indirect thunk functions for kprobes > - kprobes/x86: Disable optimizing on the function jumps to indirect thunk > - x86/retpoline: Optimize inline assembler for vmexit_fill_RSB > - [Config] CONFIG_RETPOLINE=y > - [Packaging] retpoline -- add call site validation > - [Config] disable retpoline checks for first upload > > * CVE-2017-5715 (revert embargoed) // CVE-2017-5753 (revert embargoed) > - Revert "UBUNTU: SAUCE: Fix spec_ctrl support in KVM" > - Revert "x86/cpuid: Provide get_scattered_cpuid_leaf()" > - Revert "kvm: vmx: Scrub hardware GPRs at VM-exit" > - Revert "Revert "x86/svm: Add code to clear registers on VM exit"" > - Revert "UBUNTU: SAUCE: x86/microcode: Extend post microcode reload to > support IBPB feature -- repair missmerge" > - Revert "arm: no gmb() implementation yet" > - Revert "arm64: no gmb() implementation yet" > - Revert "UBUNTU: SAUCE: x86/kvm: Fix stuff_RSB() for 32-bit" > - Revert "s390/spinlock: add gmb memory barrier" > - Revert "powerpc: add gmb barrier" > - Revert "x86/cpu/AMD: Remove now unused definition of MFENCE_RDTSC feature" > - Revert "x86/cpu/AMD: Make the LFENCE instruction serialized" > - Revert "x86/svm: Add code to clear registers on VM exit" > - Revert "x86/svm: Add code to clobber the RSB on VM exit" > - Revert "KVM: x86: Add speculative control CPUID support for guests" > - Revert "x86/svm: Set IBPB when running a different VCPU" > - Revert "x86/svm: Set IBRS value on VM entry and exit" > - Revert "KVM: SVM: Do not intercept new speculative control MSRs" > - Revert "x86/microcode: Extend post microcode reload to support IBPB feature" > - Revert "x86/cpu/AMD: Add speculative control support for AMD" > - Revert "x86/cpu/amd, kvm: Satisfy guest kernel reads of IC_CFG MSR" > - Revert "x86/entry: Use retpoline for syscall's indirect calls" > - Revert "x86/syscall: Clear unused extra registers on 32-bit compatible > syscall entrance" > - Revert "x86/syscall: Clear unused extra registers on syscall entrance" > - Revert "x86/spec_ctrl: Add lock to serialize changes to ibrs and ibpb > control" > - Revert "x86/spec_ctrl: Add sysctl knobs to enable/disable SPEC_CTRL feature" > - Revert "x86/kvm: Pad RSB on VM transition" > - Revert "x86/kvm: Toggle IBRS on VM entry and exit" > - Revert "x86/kvm: Set IBPB when switching VM" > - Revert "x86/kvm: add MSR_IA32_SPEC_CTRL and MSR_IA32_PRED_CMD to kvm" > - Revert "x86/entry: Stuff RSB for entry to kernel for non-SMEP platform" > - Revert "x86/mm: Only set IBPB when the new thread cannot ptrace current > thread" > - Revert "x86/mm: Set IBPB upon context switch" > - Revert "x86/idle: Disable IBRS when offlining cpu and re-enable on wakeup" > - Revert "x86/idle: Disable IBRS entering idle and enable it on wakeup" > - Revert "x86/enter: Use IBRS on syscall and interrupts" > - Revert "x86/enter: MACROS to set/clear IBRS and set IBPB" > - Revert "x86/feature: Report presence of IBPB and IBRS control" > - Revert "x86/feature: Enable the x86 feature to control Speculation" > - Revert "udf: prevent speculative execution" > - Revert "net: mpls: prevent speculative execution" > - Revert "fs: prevent speculative execution" > - Revert "ipv6: prevent speculative execution" > - Revert "userns: prevent speculative execution" > - Revert "Thermal/int340x: prevent speculative execution" > - Revert "qla2xxx: prevent speculative execution" > - Revert "carl9170: prevent speculative execution" > - Revert "uvcvideo: prevent speculative execution" > - Revert "x86, bpf, jit: prevent speculative execution when JIT is enabled" > - Revert "bpf: prevent speculative execution in eBPF interpreter" >
On Mon, Feb 05, 2018 at 04:17:33PM +0100, Kleber Souza wrote: > On 02/05/18 10:40, Andy Whitcroft wrote: > > Now that retpoline has made it to stable it is appropriate we switch > > over to this for mitigation of Spectre V2. This form is meant to have a > > significantly lower performance penalty, and also does not require > > microcode support from the processor. > > > > This is a large patchset as it has to revert the existing mitigations for > > Spectre V1 and V2 as these are intertwined. We take advantage of this > > to reapply a slightly updated Spectre V1 mitigation and to more clearly > > identify those patches for when they are themselves replaced by final > > upstream versions. > > > > The patches are split into 3 sections, each set has been marked up such > > that they fall out separatly in the Ubuntu change (which is included in > > the pull request at the end of this email). > > > > * CVE-2017-5715 (revert embargoed) // CVE-2017-5753 (revert embargoed) > > * CVE-2017-5715 (Spectre v2 retpoline) > > * CVE-2017-5753 (Spectre v1 Intel) > > > > Full pull-request is below. Proposing for SRU to xenial/linux. > > > > -apw > > > > The following changes since commit 63da13a92f24468262daef38150e069b908c3659: > > > > net: ipv4: fix for a race condition in raw_sendmsg (2018-02-02 15:01:03 +0100) > > > > are available in the Git repository at: > > > > https://git.launchpad.net/~apw/ubuntu/+source/linux/+git/pti pti/xenial-retpoline-intelv1--pull > > > > for you to fetch changes up to 2a7816e589e90e580390022c73c30a775a16b49c: > > > > arm: no osb() implementation yet (2018-02-04 15:11:02 +0000) > > 2a7816e589e90e580390022c73c30a775a16b49c is not reachable from > pti/xenial-retpoline-intelv1--pull, it seems to be > e267f1d0fc458cab3470fa54a6d573e2cb1994e5 instead. > > If that's the case: > > Acked-by: Kleber Sacilotto de Souza <kleber.souza@canonical.com> That is indeed the correct updated sha1. I added the commit to disable the retpoline checks and slid it down and into the middle. Derp. -apw
Applied to xenial/master-next branch, folding the fixup commit into its patch. Thanks, Kleber On 02/05/18 10:40, Andy Whitcroft wrote: > Now that retpoline has made it to stable it is appropriate we switch > over to this for mitigation of Spectre V2. This form is meant to have a > significantly lower performance penalty, and also does not require > microcode support from the processor. > > This is a large patchset as it has to revert the existing mitigations for > Spectre V1 and V2 as these are intertwined. We take advantage of this > to reapply a slightly updated Spectre V1 mitigation and to more clearly > identify those patches for when they are themselves replaced by final > upstream versions. > > The patches are split into 3 sections, each set has been marked up such > that they fall out separatly in the Ubuntu change (which is included in > the pull request at the end of this email). > > * CVE-2017-5715 (revert embargoed) // CVE-2017-5753 (revert embargoed) > * CVE-2017-5715 (Spectre v2 retpoline) > * CVE-2017-5753 (Spectre v1 Intel) > > Full pull-request is below. Proposing for SRU to xenial/linux. > > -apw > > The following changes since commit 63da13a92f24468262daef38150e069b908c3659: > > net: ipv4: fix for a race condition in raw_sendmsg (2018-02-02 15:01:03 +0100) > > are available in the Git repository at: > > https://git.launchpad.net/~apw/ubuntu/+source/linux/+git/pti pti/xenial-retpoline-intelv1--pull > > for you to fetch changes up to 2a7816e589e90e580390022c73c30a775a16b49c: > > arm: no osb() implementation yet (2018-02-04 15:11:02 +0000) > > ---------------------------------------------------------------- > * CVE-2017-5753 (Spectre v1 Intel) > - x86/cpu/AMD: Make the LFENCE instruction serialized > - x86/cpu/AMD: Remove now unused definition of MFENCE_RDTSC feature > - SAUCE: reinstate MFENCE_RDTSC feature definition > - locking/barriers: introduce new observable speculation barrier > - bpf: prevent speculative execution in eBPF interpreter > - x86, bpf, jit: prevent speculative execution when JIT is enabled > - SAUCE: FIX: x86, bpf, jit: prevent speculative execution when JIT is enabled > - carl9170: prevent speculative execution > - qla2xxx: prevent speculative execution > - Thermal/int340x: prevent speculative execution > - ipv4: prevent speculative execution > - ipv6: prevent speculative execution > - fs: prevent speculative execution > - net: mpls: prevent speculative execution > - udf: prevent speculative execution > - userns: prevent speculative execution > - SAUCE: claim mitigation via observable speculation barrier > - powerpc: add osb barrier > - s390/spinlock: add osb memory barrier > - arm64: no osb() implementation yet > - arm: no osb() implementation yet > > * CVE-2017-5715 (Spectre v2 retpoline) > - x86/cpuid: Provide get_scattered_cpuid_leaf() > - x86/cpu: Factor out application of forced CPU caps > - x86/cpufeatures: Make CPU bugs sticky > - x86/cpufeatures: Add X86_BUG_CPU_INSECURE > - x86/cpu, x86/pti: Do not enable PTI on AMD processors > - x86/pti: Rename BUG_CPU_INSECURE to BUG_CPU_MELTDOWN > - x86/cpufeatures: Add X86_BUG_SPECTRE_V[12] > - x86/cpu: Merge bugs.c and bugs_64.c > - sysfs/cpu: Add vulnerability folder > - x86/cpu: Implement CPU vulnerabilites sysfs functions > - x86/alternatives: Add missing '\n' at end of ALTERNATIVE inline asm > - x86/mm/32: Move setup_clear_cpu_cap(X86_FEATURE_PCID) earlier > - x86/asm: Use register variable to get stack pointer value > - x86/kbuild: enable modversions for symbols exported from asm > - x86/asm: Make asm/alternative.h safe from assembly > - EXPORT_SYMBOL() for asm > - kconfig.h: use __is_defined() to check if MODULE is defined > - x86/retpoline: Add initial retpoline support > - x86/spectre: Add boot time option to select Spectre v2 mitigation > - x86/retpoline/crypto: Convert crypto assembler indirect jumps > - x86/retpoline/entry: Convert entry assembler indirect jumps > - x86/retpoline/ftrace: Convert ftrace assembler indirect jumps > - x86/retpoline/hyperv: Convert assembler indirect jumps > - x86/retpoline/xen: Convert Xen hypercall indirect jumps > - x86/retpoline/checksum32: Convert assembler indirect jumps > - x86/retpoline/irq32: Convert assembler indirect jumps > - x86/retpoline: Fill return stack buffer on vmexit > - x86/retpoline: Remove compile time warning > - x86/retpoline: Add LFENCE to the retpoline/RSB filling RSB macros > - module: Add retpoline tag to VERMAGIC > - x86/mce: Make machine check speculation protected > - retpoline: Introduce start/end markers of indirect thunk > - kprobes/x86: Blacklist indirect thunk functions for kprobes > - kprobes/x86: Disable optimizing on the function jumps to indirect thunk > - x86/retpoline: Optimize inline assembler for vmexit_fill_RSB > - [Config] CONFIG_RETPOLINE=y > - [Packaging] retpoline -- add call site validation > - [Config] disable retpoline checks for first upload > > * CVE-2017-5715 (revert embargoed) // CVE-2017-5753 (revert embargoed) > - Revert "UBUNTU: SAUCE: Fix spec_ctrl support in KVM" > - Revert "x86/cpuid: Provide get_scattered_cpuid_leaf()" > - Revert "kvm: vmx: Scrub hardware GPRs at VM-exit" > - Revert "Revert "x86/svm: Add code to clear registers on VM exit"" > - Revert "UBUNTU: SAUCE: x86/microcode: Extend post microcode reload to > support IBPB feature -- repair missmerge" > - Revert "arm: no gmb() implementation yet" > - Revert "arm64: no gmb() implementation yet" > - Revert "UBUNTU: SAUCE: x86/kvm: Fix stuff_RSB() for 32-bit" > - Revert "s390/spinlock: add gmb memory barrier" > - Revert "powerpc: add gmb barrier" > - Revert "x86/cpu/AMD: Remove now unused definition of MFENCE_RDTSC feature" > - Revert "x86/cpu/AMD: Make the LFENCE instruction serialized" > - Revert "x86/svm: Add code to clear registers on VM exit" > - Revert "x86/svm: Add code to clobber the RSB on VM exit" > - Revert "KVM: x86: Add speculative control CPUID support for guests" > - Revert "x86/svm: Set IBPB when running a different VCPU" > - Revert "x86/svm: Set IBRS value on VM entry and exit" > - Revert "KVM: SVM: Do not intercept new speculative control MSRs" > - Revert "x86/microcode: Extend post microcode reload to support IBPB feature" > - Revert "x86/cpu/AMD: Add speculative control support for AMD" > - Revert "x86/cpu/amd, kvm: Satisfy guest kernel reads of IC_CFG MSR" > - Revert "x86/entry: Use retpoline for syscall's indirect calls" > - Revert "x86/syscall: Clear unused extra registers on 32-bit compatible > syscall entrance" > - Revert "x86/syscall: Clear unused extra registers on syscall entrance" > - Revert "x86/spec_ctrl: Add lock to serialize changes to ibrs and ibpb > control" > - Revert "x86/spec_ctrl: Add sysctl knobs to enable/disable SPEC_CTRL feature" > - Revert "x86/kvm: Pad RSB on VM transition" > - Revert "x86/kvm: Toggle IBRS on VM entry and exit" > - Revert "x86/kvm: Set IBPB when switching VM" > - Revert "x86/kvm: add MSR_IA32_SPEC_CTRL and MSR_IA32_PRED_CMD to kvm" > - Revert "x86/entry: Stuff RSB for entry to kernel for non-SMEP platform" > - Revert "x86/mm: Only set IBPB when the new thread cannot ptrace current > thread" > - Revert "x86/mm: Set IBPB upon context switch" > - Revert "x86/idle: Disable IBRS when offlining cpu and re-enable on wakeup" > - Revert "x86/idle: Disable IBRS entering idle and enable it on wakeup" > - Revert "x86/enter: Use IBRS on syscall and interrupts" > - Revert "x86/enter: MACROS to set/clear IBRS and set IBPB" > - Revert "x86/feature: Report presence of IBPB and IBRS control" > - Revert "x86/feature: Enable the x86 feature to control Speculation" > - Revert "udf: prevent speculative execution" > - Revert "net: mpls: prevent speculative execution" > - Revert "fs: prevent speculative execution" > - Revert "ipv6: prevent speculative execution" > - Revert "userns: prevent speculative execution" > - Revert "Thermal/int340x: prevent speculative execution" > - Revert "qla2xxx: prevent speculative execution" > - Revert "carl9170: prevent speculative execution" > - Revert "uvcvideo: prevent speculative execution" > - Revert "x86, bpf, jit: prevent speculative execution when JIT is enabled" > - Revert "bpf: prevent speculative execution in eBPF interpreter" >
On 02/05/18 17:25, Kleber Souza wrote: > Applied to xenial/master-next branch, folding the fixup commit into its > patch. That comment regarding the fixup commit was meant to xenial, the comment for artful should be: Applied changes since commit 63da13a92f24468262daef38150e069b908c3659 up to 2a7816e589e90e580390022c73c30a775a16b49c. Thanks, Kleber > > Thanks, > Kleber > > On 02/05/18 10:40, Andy Whitcroft wrote: >> Now that retpoline has made it to stable it is appropriate we switch >> over to this for mitigation of Spectre V2. This form is meant to have a >> significantly lower performance penalty, and also does not require >> microcode support from the processor. >> >> This is a large patchset as it has to revert the existing mitigations for >> Spectre V1 and V2 as these are intertwined. We take advantage of this >> to reapply a slightly updated Spectre V1 mitigation and to more clearly >> identify those patches for when they are themselves replaced by final >> upstream versions. >> >> The patches are split into 3 sections, each set has been marked up such >> that they fall out separatly in the Ubuntu change (which is included in >> the pull request at the end of this email). >> >> * CVE-2017-5715 (revert embargoed) // CVE-2017-5753 (revert embargoed) >> * CVE-2017-5715 (Spectre v2 retpoline) >> * CVE-2017-5753 (Spectre v1 Intel) >> >> Full pull-request is below. Proposing for SRU to xenial/linux. >> >> -apw >> >> The following changes since commit 63da13a92f24468262daef38150e069b908c3659: >> >> net: ipv4: fix for a race condition in raw_sendmsg (2018-02-02 15:01:03 +0100) >> >> are available in the Git repository at: >> >> https://git.launchpad.net/~apw/ubuntu/+source/linux/+git/pti pti/xenial-retpoline-intelv1--pull >> >> for you to fetch changes up to 2a7816e589e90e580390022c73c30a775a16b49c: >> >> arm: no osb() implementation yet (2018-02-04 15:11:02 +0000) >> >> ---------------------------------------------------------------- >> * CVE-2017-5753 (Spectre v1 Intel) >> - x86/cpu/AMD: Make the LFENCE instruction serialized >> - x86/cpu/AMD: Remove now unused definition of MFENCE_RDTSC feature >> - SAUCE: reinstate MFENCE_RDTSC feature definition >> - locking/barriers: introduce new observable speculation barrier >> - bpf: prevent speculative execution in eBPF interpreter >> - x86, bpf, jit: prevent speculative execution when JIT is enabled >> - SAUCE: FIX: x86, bpf, jit: prevent speculative execution when JIT is enabled >> - carl9170: prevent speculative execution >> - qla2xxx: prevent speculative execution >> - Thermal/int340x: prevent speculative execution >> - ipv4: prevent speculative execution >> - ipv6: prevent speculative execution >> - fs: prevent speculative execution >> - net: mpls: prevent speculative execution >> - udf: prevent speculative execution >> - userns: prevent speculative execution >> - SAUCE: claim mitigation via observable speculation barrier >> - powerpc: add osb barrier >> - s390/spinlock: add osb memory barrier >> - arm64: no osb() implementation yet >> - arm: no osb() implementation yet >> >> * CVE-2017-5715 (Spectre v2 retpoline) >> - x86/cpuid: Provide get_scattered_cpuid_leaf() >> - x86/cpu: Factor out application of forced CPU caps >> - x86/cpufeatures: Make CPU bugs sticky >> - x86/cpufeatures: Add X86_BUG_CPU_INSECURE >> - x86/cpu, x86/pti: Do not enable PTI on AMD processors >> - x86/pti: Rename BUG_CPU_INSECURE to BUG_CPU_MELTDOWN >> - x86/cpufeatures: Add X86_BUG_SPECTRE_V[12] >> - x86/cpu: Merge bugs.c and bugs_64.c >> - sysfs/cpu: Add vulnerability folder >> - x86/cpu: Implement CPU vulnerabilites sysfs functions >> - x86/alternatives: Add missing '\n' at end of ALTERNATIVE inline asm >> - x86/mm/32: Move setup_clear_cpu_cap(X86_FEATURE_PCID) earlier >> - x86/asm: Use register variable to get stack pointer value >> - x86/kbuild: enable modversions for symbols exported from asm >> - x86/asm: Make asm/alternative.h safe from assembly >> - EXPORT_SYMBOL() for asm >> - kconfig.h: use __is_defined() to check if MODULE is defined >> - x86/retpoline: Add initial retpoline support >> - x86/spectre: Add boot time option to select Spectre v2 mitigation >> - x86/retpoline/crypto: Convert crypto assembler indirect jumps >> - x86/retpoline/entry: Convert entry assembler indirect jumps >> - x86/retpoline/ftrace: Convert ftrace assembler indirect jumps >> - x86/retpoline/hyperv: Convert assembler indirect jumps >> - x86/retpoline/xen: Convert Xen hypercall indirect jumps >> - x86/retpoline/checksum32: Convert assembler indirect jumps >> - x86/retpoline/irq32: Convert assembler indirect jumps >> - x86/retpoline: Fill return stack buffer on vmexit >> - x86/retpoline: Remove compile time warning >> - x86/retpoline: Add LFENCE to the retpoline/RSB filling RSB macros >> - module: Add retpoline tag to VERMAGIC >> - x86/mce: Make machine check speculation protected >> - retpoline: Introduce start/end markers of indirect thunk >> - kprobes/x86: Blacklist indirect thunk functions for kprobes >> - kprobes/x86: Disable optimizing on the function jumps to indirect thunk >> - x86/retpoline: Optimize inline assembler for vmexit_fill_RSB >> - [Config] CONFIG_RETPOLINE=y >> - [Packaging] retpoline -- add call site validation >> - [Config] disable retpoline checks for first upload >> >> * CVE-2017-5715 (revert embargoed) // CVE-2017-5753 (revert embargoed) >> - Revert "UBUNTU: SAUCE: Fix spec_ctrl support in KVM" >> - Revert "x86/cpuid: Provide get_scattered_cpuid_leaf()" >> - Revert "kvm: vmx: Scrub hardware GPRs at VM-exit" >> - Revert "Revert "x86/svm: Add code to clear registers on VM exit"" >> - Revert "UBUNTU: SAUCE: x86/microcode: Extend post microcode reload to >> support IBPB feature -- repair missmerge" >> - Revert "arm: no gmb() implementation yet" >> - Revert "arm64: no gmb() implementation yet" >> - Revert "UBUNTU: SAUCE: x86/kvm: Fix stuff_RSB() for 32-bit" >> - Revert "s390/spinlock: add gmb memory barrier" >> - Revert "powerpc: add gmb barrier" >> - Revert "x86/cpu/AMD: Remove now unused definition of MFENCE_RDTSC feature" >> - Revert "x86/cpu/AMD: Make the LFENCE instruction serialized" >> - Revert "x86/svm: Add code to clear registers on VM exit" >> - Revert "x86/svm: Add code to clobber the RSB on VM exit" >> - Revert "KVM: x86: Add speculative control CPUID support for guests" >> - Revert "x86/svm: Set IBPB when running a different VCPU" >> - Revert "x86/svm: Set IBRS value on VM entry and exit" >> - Revert "KVM: SVM: Do not intercept new speculative control MSRs" >> - Revert "x86/microcode: Extend post microcode reload to support IBPB feature" >> - Revert "x86/cpu/AMD: Add speculative control support for AMD" >> - Revert "x86/cpu/amd, kvm: Satisfy guest kernel reads of IC_CFG MSR" >> - Revert "x86/entry: Use retpoline for syscall's indirect calls" >> - Revert "x86/syscall: Clear unused extra registers on 32-bit compatible >> syscall entrance" >> - Revert "x86/syscall: Clear unused extra registers on syscall entrance" >> - Revert "x86/spec_ctrl: Add lock to serialize changes to ibrs and ibpb >> control" >> - Revert "x86/spec_ctrl: Add sysctl knobs to enable/disable SPEC_CTRL feature" >> - Revert "x86/kvm: Pad RSB on VM transition" >> - Revert "x86/kvm: Toggle IBRS on VM entry and exit" >> - Revert "x86/kvm: Set IBPB when switching VM" >> - Revert "x86/kvm: add MSR_IA32_SPEC_CTRL and MSR_IA32_PRED_CMD to kvm" >> - Revert "x86/entry: Stuff RSB for entry to kernel for non-SMEP platform" >> - Revert "x86/mm: Only set IBPB when the new thread cannot ptrace current >> thread" >> - Revert "x86/mm: Set IBPB upon context switch" >> - Revert "x86/idle: Disable IBRS when offlining cpu and re-enable on wakeup" >> - Revert "x86/idle: Disable IBRS entering idle and enable it on wakeup" >> - Revert "x86/enter: Use IBRS on syscall and interrupts" >> - Revert "x86/enter: MACROS to set/clear IBRS and set IBPB" >> - Revert "x86/feature: Report presence of IBPB and IBRS control" >> - Revert "x86/feature: Enable the x86 feature to control Speculation" >> - Revert "udf: prevent speculative execution" >> - Revert "net: mpls: prevent speculative execution" >> - Revert "fs: prevent speculative execution" >> - Revert "ipv6: prevent speculative execution" >> - Revert "userns: prevent speculative execution" >> - Revert "Thermal/int340x: prevent speculative execution" >> - Revert "qla2xxx: prevent speculative execution" >> - Revert "carl9170: prevent speculative execution" >> - Revert "uvcvideo: prevent speculative execution" >> - Revert "x86, bpf, jit: prevent speculative execution when JIT is enabled" >> - Revert "bpf: prevent speculative execution in eBPF interpreter" >>
Now that retpoline has made it to stable it is appropriate we switch over to this for mitigation of Spectre V2. This form is meant to have a significantly lower performance penalty, and also does not require microcode support from the processor. This is a large patchset as it has to revert the existing mitigations for Spectre V1 and V2 as these are intertwined. We take advantage of this to reapply a slightly updated Spectre V1 mitigation and to more clearly identify those patches for when they are themselves replaced by final upstream versions. The patches are split into 3 sections, each set has been marked up such that they fall out separatly in the Ubuntu change (which is included in the pull request at the end of this email). * CVE-2017-5715 (revert embargoed) // CVE-2017-5753 (revert embargoed) * CVE-2017-5715 (Spectre v2 retpoline) * CVE-2017-5753 (Spectre v1 Intel) Full pull-request is below. Proposing for SRU to xenial/linux. -apw The following changes since commit 63da13a92f24468262daef38150e069b908c3659: net: ipv4: fix for a race condition in raw_sendmsg (2018-02-02 15:01:03 +0100) are available in the Git repository at: https://git.launchpad.net/~apw/ubuntu/+source/linux/+git/pti pti/xenial-retpoline-intelv1--pull for you to fetch changes up to 2a7816e589e90e580390022c73c30a775a16b49c: arm: no osb() implementation yet (2018-02-04 15:11:02 +0000) ---------------------------------------------------------------- * CVE-2017-5753 (Spectre v1 Intel) - x86/cpu/AMD: Make the LFENCE instruction serialized - x86/cpu/AMD: Remove now unused definition of MFENCE_RDTSC feature - SAUCE: reinstate MFENCE_RDTSC feature definition - locking/barriers: introduce new observable speculation barrier - bpf: prevent speculative execution in eBPF interpreter - x86, bpf, jit: prevent speculative execution when JIT is enabled - SAUCE: FIX: x86, bpf, jit: prevent speculative execution when JIT is enabled - carl9170: prevent speculative execution - qla2xxx: prevent speculative execution - Thermal/int340x: prevent speculative execution - ipv4: prevent speculative execution - ipv6: prevent speculative execution - fs: prevent speculative execution - net: mpls: prevent speculative execution - udf: prevent speculative execution - userns: prevent speculative execution - SAUCE: claim mitigation via observable speculation barrier - powerpc: add osb barrier - s390/spinlock: add osb memory barrier - arm64: no osb() implementation yet - arm: no osb() implementation yet * CVE-2017-5715 (Spectre v2 retpoline) - x86/cpuid: Provide get_scattered_cpuid_leaf() - x86/cpu: Factor out application of forced CPU caps - x86/cpufeatures: Make CPU bugs sticky - x86/cpufeatures: Add X86_BUG_CPU_INSECURE - x86/cpu, x86/pti: Do not enable PTI on AMD processors - x86/pti: Rename BUG_CPU_INSECURE to BUG_CPU_MELTDOWN - x86/cpufeatures: Add X86_BUG_SPECTRE_V[12] - x86/cpu: Merge bugs.c and bugs_64.c - sysfs/cpu: Add vulnerability folder - x86/cpu: Implement CPU vulnerabilites sysfs functions - x86/alternatives: Add missing '\n' at end of ALTERNATIVE inline asm - x86/mm/32: Move setup_clear_cpu_cap(X86_FEATURE_PCID) earlier - x86/asm: Use register variable to get stack pointer value - x86/kbuild: enable modversions for symbols exported from asm - x86/asm: Make asm/alternative.h safe from assembly - EXPORT_SYMBOL() for asm - kconfig.h: use __is_defined() to check if MODULE is defined - x86/retpoline: Add initial retpoline support - x86/spectre: Add boot time option to select Spectre v2 mitigation - x86/retpoline/crypto: Convert crypto assembler indirect jumps - x86/retpoline/entry: Convert entry assembler indirect jumps - x86/retpoline/ftrace: Convert ftrace assembler indirect jumps - x86/retpoline/hyperv: Convert assembler indirect jumps - x86/retpoline/xen: Convert Xen hypercall indirect jumps - x86/retpoline/checksum32: Convert assembler indirect jumps - x86/retpoline/irq32: Convert assembler indirect jumps - x86/retpoline: Fill return stack buffer on vmexit - x86/retpoline: Remove compile time warning - x86/retpoline: Add LFENCE to the retpoline/RSB filling RSB macros - module: Add retpoline tag to VERMAGIC - x86/mce: Make machine check speculation protected - retpoline: Introduce start/end markers of indirect thunk - kprobes/x86: Blacklist indirect thunk functions for kprobes - kprobes/x86: Disable optimizing on the function jumps to indirect thunk - x86/retpoline: Optimize inline assembler for vmexit_fill_RSB - [Config] CONFIG_RETPOLINE=y - [Packaging] retpoline -- add call site validation - [Config] disable retpoline checks for first upload * CVE-2017-5715 (revert embargoed) // CVE-2017-5753 (revert embargoed) - Revert "UBUNTU: SAUCE: Fix spec_ctrl support in KVM" - Revert "x86/cpuid: Provide get_scattered_cpuid_leaf()" - Revert "kvm: vmx: Scrub hardware GPRs at VM-exit" - Revert "Revert "x86/svm: Add code to clear registers on VM exit"" - Revert "UBUNTU: SAUCE: x86/microcode: Extend post microcode reload to support IBPB feature -- repair missmerge" - Revert "arm: no gmb() implementation yet" - Revert "arm64: no gmb() implementation yet" - Revert "UBUNTU: SAUCE: x86/kvm: Fix stuff_RSB() for 32-bit" - Revert "s390/spinlock: add gmb memory barrier" - Revert "powerpc: add gmb barrier" - Revert "x86/cpu/AMD: Remove now unused definition of MFENCE_RDTSC feature" - Revert "x86/cpu/AMD: Make the LFENCE instruction serialized" - Revert "x86/svm: Add code to clear registers on VM exit" - Revert "x86/svm: Add code to clobber the RSB on VM exit" - Revert "KVM: x86: Add speculative control CPUID support for guests" - Revert "x86/svm: Set IBPB when running a different VCPU" - Revert "x86/svm: Set IBRS value on VM entry and exit" - Revert "KVM: SVM: Do not intercept new speculative control MSRs" - Revert "x86/microcode: Extend post microcode reload to support IBPB feature" - Revert "x86/cpu/AMD: Add speculative control support for AMD" - Revert "x86/cpu/amd, kvm: Satisfy guest kernel reads of IC_CFG MSR" - Revert "x86/entry: Use retpoline for syscall's indirect calls" - Revert "x86/syscall: Clear unused extra registers on 32-bit compatible syscall entrance" - Revert "x86/syscall: Clear unused extra registers on syscall entrance" - Revert "x86/spec_ctrl: Add lock to serialize changes to ibrs and ibpb control" - Revert "x86/spec_ctrl: Add sysctl knobs to enable/disable SPEC_CTRL feature" - Revert "x86/kvm: Pad RSB on VM transition" - Revert "x86/kvm: Toggle IBRS on VM entry and exit" - Revert "x86/kvm: Set IBPB when switching VM" - Revert "x86/kvm: add MSR_IA32_SPEC_CTRL and MSR_IA32_PRED_CMD to kvm" - Revert "x86/entry: Stuff RSB for entry to kernel for non-SMEP platform" - Revert "x86/mm: Only set IBPB when the new thread cannot ptrace current thread" - Revert "x86/mm: Set IBPB upon context switch" - Revert "x86/idle: Disable IBRS when offlining cpu and re-enable on wakeup" - Revert "x86/idle: Disable IBRS entering idle and enable it on wakeup" - Revert "x86/enter: Use IBRS on syscall and interrupts" - Revert "x86/enter: MACROS to set/clear IBRS and set IBPB" - Revert "x86/feature: Report presence of IBPB and IBRS control" - Revert "x86/feature: Enable the x86 feature to control Speculation" - Revert "udf: prevent speculative execution" - Revert "net: mpls: prevent speculative execution" - Revert "fs: prevent speculative execution" - Revert "ipv6: prevent speculative execution" - Revert "userns: prevent speculative execution" - Revert "Thermal/int340x: prevent speculative execution" - Revert "qla2xxx: prevent speculative execution" - Revert "carl9170: prevent speculative execution" - Revert "uvcvideo: prevent speculative execution" - Revert "x86, bpf, jit: prevent speculative execution when JIT is enabled" - Revert "bpf: prevent speculative execution in eBPF interpreter"