Patch "x86/retpoline: Add initial retpoline support" has been added to the 4.9-stable tree

This is a note to let you know that I've just added the patch titled

x86/retpoline: Add initial retpoline support

to the 4.9-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
x86-retpoline-add-initial-retpoline-support.patch
and it can be found in the queue-4.9 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: David Woodhouse <[email protected]>
Date: Thu, 11 Jan 2018 21:46:25 +0000
Subject: x86/retpoline: Add initial retpoline support

From: David Woodhouse <[email protected]>

commit 76b043848fd22dbf7f8bf3a1452f8c70d557b860 upstream.

Enable the use of -mindirect-branch=thunk-extern in newer GCC, and provide the corresponding thunks. Provide assembler macros for invoking the thunks in the same way that GCC does, from native and inline assembler.

This adds X86_FEATURE_RETPOLINE and sets it by default on all CPUs. In some circumstances, IBRS microcode features may be used instead, and the retpoline can be disabled.

On AMD CPUs if lfence is serialising, the retpoline can be dramatically simplified to a simple "lfence; jmp *\reg". A future patch, after it has been verified that lfence really is serialising in all circumstances, can enable this by setting the X86_FEATURE_RETPOLINE_AMD feature bit in addition to X86_FEATURE_RETPOLINE.

Do not align the retpoline in the altinstr section, because there is no guarantee that it stays aligned when it's copied over the oldinstr during alternative patching.

[ Andi Kleen: Rename the macros, add CONFIG_RETPOLINE option, export thunks] [ tglx: Put actual function CALL/JMP in front of the macros, convert to
symbolic labels ]
[ dwmw2: Convert back to numeric labels, merge objtool fixes ]

---
 arch/x86/Kconfig                      |   13 +++
 arch/x86/Makefile                     |   10 ++
 arch/x86/include/asm/asm-prototypes.h |   25 ++++++
 arch/x86/include/asm/cpufeatures.h    |    3 
 arch/x86/include/asm/nospec-branch.h  |  128 ++++++++++++++++++++++++++++++++++
 arch/x86/kernel/cpu/common.c          |    4 +
 arch/x86/lib/Makefile                 |    1 
 arch/x86/lib/retpoline.S              |   48 ++++++++++++
 8 files changed, 232 insertions(+)
 create mode 100644 arch/x86/include/asm/nospec-branch.h
 create mode 100644 arch/x86/lib/retpoline.S

@@ -408,6 +408,19 @@ config GOLDFISH
        def_bool y
        depends on X86_GOLDFISH
 
+config RETPOLINE
+	bool "Avoid speculative indirect branches in kernel"
+	default y
+	---help---
+	  Compile kernel with the retpoline compiler options to guard against
+	  kernel-to-user data leaks by avoiding speculative indirect
+	  branches. Requires a compiler with -mindirect-branch=thunk-extern
+	  support for full protection. The kernel may run slower.
+
+	  Without compiler support, at least indirect branches in assembler
+	  code are eliminated. Since this includes the syscall entry path,
+	  it is not entirely pointless.
+
 if X86_32
 config X86_EXTENDED_PLATFORM
 	bool "Support for extended (non-PC) x86 platforms"

@@ -182,6 +182,16 @@ KBUILD_CFLAGS += -fno-asynchronous-unwin
 KBUILD_CFLAGS += $(mflags-y)
 KBUILD_AFLAGS += $(mflags-y)
 
+# Avoid indirect branches in kernel to deal with Spectre
+ifdef CONFIG_RETPOLINE
+    RETPOLINE_CFLAGS += $(call cc-option,-mindirect-branch=thunk-extern -mindirect-branch-register)
+    ifneq ($(RETPOLINE_CFLAGS),)
+        KBUILD_CFLAGS += $(RETPOLINE_CFLAGS) -DRETPOLINE
+    else
+        $(warning CONFIG_RETPOLINE=y, but not supported by the compiler. Toolchain update recommended.)
+    endif
+endif
+
 archscripts: scripts_basic
 	$(Q)$(MAKE) $(build)=arch/x86/tools relocs
 

@@ -10,7 +10,32 @@
 #include <asm/pgtable.h>
 #include <asm/special_insns.h>
 #include <asm/preempt.h>
+#include <asm/asm.h>
 
 #ifndef CONFIG_X86_CMPXCHG64
 extern void cmpxchg8b_emu(void);
 #endif
+
+#ifdef CONFIG_RETPOLINE
+#ifdef CONFIG_X86_32
+#define INDIRECT_THUNK(reg) extern asmlinkage void __x86_indirect_thunk_e ## reg(void);
+#else
+#define INDIRECT_THUNK(reg) extern asmlinkage void __x86_indirect_thunk_r ## reg(void);
+INDIRECT_THUNK(8)
+INDIRECT_THUNK(9)
+INDIRECT_THUNK(10)
+INDIRECT_THUNK(11)
+INDIRECT_THUNK(12)
+INDIRECT_THUNK(13)
+INDIRECT_THUNK(14)
+INDIRECT_THUNK(15)
+#endif
+INDIRECT_THUNK(ax)
+INDIRECT_THUNK(bx)
+INDIRECT_THUNK(cx)
+INDIRECT_THUNK(dx)
+INDIRECT_THUNK(si)
+INDIRECT_THUNK(di)
+INDIRECT_THUNK(bp)
+INDIRECT_THUNK(sp)
+#endif /* CONFIG_RETPOLINE */

@@ -194,6 +194,9 @@
 #define X86_FEATURE_HW_PSTATE	( 7*32+ 8) /* AMD HW-PState */
 #define X86_FEATURE_PROC_FEEDBACK ( 7*32+ 9) /* AMD ProcFeedbackInterface */
 
+#define X86_FEATURE_RETPOLINE	( 7*32+12) /* Generic Retpoline mitigation for Spectre variant 2 */
+#define X86_FEATURE_RETPOLINE_AMD ( 7*32+13) /* AMD Retpoline mitigation for Spectre variant 2 */
+
 #define X86_FEATURE_INTEL_PT	( 7*32+15) /* Intel Processor Trace */
 #define X86_FEATURE_AVX512_4VNNIW (7*32+16) /* AVX-512 Neural Network Instructions */
 #define X86_FEATURE_AVX512_4FMAPS (7*32+17) /* AVX-512 Multiply Accumulation Single precision */

@@ -889,6 +889,10 @@ static void __init early_identify_cpu(st
 	setup_force_cpu_bug(X86_BUG_SPECTRE_V1);
 	setup_force_cpu_bug(X86_BUG_SPECTRE_V2);
 
+#ifdef CONFIG_RETPOLINE
+	setup_force_cpu_cap(X86_FEATURE_RETPOLINE);
+#endif
+
 	fpu__init_system(c);
 
 #ifdef CONFIG_X86_32

@@ -25,6 +25,7 @@ lib-y += memcpy_$(BITS).o
 lib-$(CONFIG_RWSEM_XCHGADD_ALGORITHM) += rwsem.o
 lib-$(CONFIG_INSTRUCTION_DECODER) += insn.o inat.o
 lib-$(CONFIG_RANDOMIZE_BASE) += kaslr.o
+lib-$(CONFIG_RETPOLINE) += retpoline.o
 
 obj-y += msr.o msr-reg.o msr-reg-export.o hweight.o
 

Patches currently in stable-queue which might be from [email protected] are

queue-4.9/x86-spectre-add-boot-time-option-to-select-spectre-v2-mitigation.patch queue-4.9/x86-retpoline-irq32-convert-assembler-indirect-jumps.patch queue-4.9/objtool-detect-jumps-to-retpoline-thunks.patch queue-4.9/x86-cpufeatures-add-x86_bug_spectre_v.patch queue-4.9/x86-alternatives-add-missing-n-at-end-of-alternative-inline-asm.patch queue-4.9/x86-retpoline-hyperv-convert-assembler-indirect-jumps.patch queue-4.9/x86-retpoline-entry-convert-entry-assembler-indirect-jumps.patch queue-4.9/sysfs-cpu-fix-typos-in-vulnerability-documentation.patch queue-4.9/x86-cpufeatures-add-x86_bug_cpu_insecure.patch queue-4.9/x86-cpufeatures-make-cpu-bugs-sticky.patch queue-4.9/x86-cpu-amd-make-lfence-a-serializing-instruction.patch queue-4.9/x86-retpoline-ftrace-convert-ftrace-assembler-indirect-jumps.patch queue-4.9/objtool-allow-alternatives-to-be-ignored.patch queue-4.9/x86-cpu-implement-cpu-vulnerabilites-sysfs-functions.patch queue-4.9/x86-retpoline-crypto-convert-crypto-assembler-indirect-jumps.patch queue-4.9/x86-cpu-factor-out-application-of-forced-cpu-caps.patch queue-4.9/x86-retpoline-xen-convert-xen-hypercall-indirect-jumps.patch queue-4.9/x86-retpoline-checksum32-convert-assembler-indirect-jumps.patch queue-4.9/x86-mm-32-move-setup_clear_cpu_cap-x86_feature_pcid-earlier.patch queue-4.9/sysfs-cpu-add-vulnerability-folder.patch queue-4.9/x86-retpoline-fill-return-stack-buffer-on-vmexit.patch queue-4.9/x86-pti-rename-bug_cpu_insecure-to-bug_cpu_meltdown.patch queue-4.9/x86-retpoline-remove-compile-time-warning.patch queue-4.9/x86-alternatives-fix-optimize_nops-checking.patch queue-4.9/x86-cpu-amd-use-lfence_rdtsc-in-preference-to-mfence_rdtsc.patch queue-4.9/x86-retpoline-add-initial-retpoline-support.patch