]> git.ipfire.org Git - thirdparty/kernel/stable-queue.git/commitdiff
4.9-stable patches
authorGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 8 Feb 2018 01:40:28 +0000 (19:40 -0600)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 8 Feb 2018 01:40:28 +0000 (19:40 -0600)
added patches:
kvm-vmx-make-indirect-call-speculation-safe.patch
kvm-x86-make-indirect-calls-in-emulator-speculation-safe.patch
module-retpoline-warn-about-missing-retpoline-in-module.patch
x86-cpufeature-blacklist-spec_ctrl-pred_cmd-on-early-spectre-v2-microcodes.patch
x86-cpufeatures-add-amd-feature-bits-for-speculation-control.patch
x86-cpufeatures-add-cpuid_7_edx-cpuid-leaf.patch
x86-cpufeatures-add-intel-feature-bits-for-speculation-control.patch
x86-msr-add-definitions-for-new-speculation-control-msrs.patch
x86-pti-do-not-enable-pti-on-cpus-which-are-not-vulnerable-to-meltdown.patch
x86-retpoline-remove-the-esp-rsp-thunk.patch

queue-4.9/kvm-vmx-make-indirect-call-speculation-safe.patch [new file with mode: 0644]
queue-4.9/kvm-x86-make-indirect-calls-in-emulator-speculation-safe.patch [new file with mode: 0644]
queue-4.9/module-retpoline-warn-about-missing-retpoline-in-module.patch [new file with mode: 0644]
queue-4.9/series
queue-4.9/x86-cpufeature-blacklist-spec_ctrl-pred_cmd-on-early-spectre-v2-microcodes.patch [new file with mode: 0644]
queue-4.9/x86-cpufeatures-add-amd-feature-bits-for-speculation-control.patch [new file with mode: 0644]
queue-4.9/x86-cpufeatures-add-cpuid_7_edx-cpuid-leaf.patch [new file with mode: 0644]
queue-4.9/x86-cpufeatures-add-intel-feature-bits-for-speculation-control.patch [new file with mode: 0644]
queue-4.9/x86-msr-add-definitions-for-new-speculation-control-msrs.patch [new file with mode: 0644]
queue-4.9/x86-pti-do-not-enable-pti-on-cpus-which-are-not-vulnerable-to-meltdown.patch [new file with mode: 0644]
queue-4.9/x86-retpoline-remove-the-esp-rsp-thunk.patch [new file with mode: 0644]

diff --git a/queue-4.9/kvm-vmx-make-indirect-call-speculation-safe.patch b/queue-4.9/kvm-vmx-make-indirect-call-speculation-safe.patch
new file mode 100644 (file)
index 0000000..a981c11
--- /dev/null
@@ -0,0 +1,57 @@
+From foo@baz Wed Feb  7 19:38:23 CST 2018
+From: Peter Zijlstra <peterz@infradead.org>
+Date: Thu, 25 Jan 2018 10:58:14 +0100
+Subject: KVM: VMX: Make indirect call speculation safe
+
+From: Peter Zijlstra <peterz@infradead.org>
+
+(cherry picked from commit c940a3fb1e2e9b7d03228ab28f375fb5a47ff699)
+
+Replace indirect call with CALL_NOSPEC.
+
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Reviewed-by: David Woodhouse <dwmw@amazon.co.uk>
+Cc: Andrea Arcangeli <aarcange@redhat.com>
+Cc: Andi Kleen <ak@linux.intel.com>
+Cc: Ashok Raj <ashok.raj@intel.com>
+Cc: Greg KH <gregkh@linuxfoundation.org>
+Cc: Jun Nakajima <jun.nakajima@intel.com>
+Cc: David Woodhouse <dwmw2@infradead.org>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: rga@amazon.de
+Cc: Dave Hansen <dave.hansen@intel.com>
+Cc: Asit Mallick <asit.k.mallick@intel.com>
+Cc: Andy Lutomirski <luto@kernel.org>
+Cc: Josh Poimboeuf <jpoimboe@redhat.com>
+Cc: Jason Baron <jbaron@akamai.com>
+Cc: Paolo Bonzini <pbonzini@redhat.com>
+Cc: Dan Williams <dan.j.williams@intel.com>
+Cc: Arjan Van De Ven <arjan.van.de.ven@intel.com>
+Cc: Tim Chen <tim.c.chen@linux.intel.com>
+Link: https://lkml.kernel.org/r/20180125095843.645776917@infradead.org
+Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/kvm/vmx.c |    4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -8676,14 +8676,14 @@ static void vmx_handle_external_intr(str
+ #endif
+                       "pushf\n\t"
+                       __ASM_SIZE(push) " $%c[cs]\n\t"
+-                      "call *%[entry]\n\t"
++                      CALL_NOSPEC
+                       :
+ #ifdef CONFIG_X86_64
+                       [sp]"=&r"(tmp),
+ #endif
+                       "+r"(__sp)
+                       :
+-                      [entry]"r"(entry),
++                      THUNK_TARGET(entry),
+                       [ss]"i"(__KERNEL_DS),
+                       [cs]"i"(__KERNEL_CS)
+                       );
diff --git a/queue-4.9/kvm-x86-make-indirect-calls-in-emulator-speculation-safe.patch b/queue-4.9/kvm-x86-make-indirect-calls-in-emulator-speculation-safe.patch
new file mode 100644 (file)
index 0000000..86fb749
--- /dev/null
@@ -0,0 +1,78 @@
+From foo@baz Wed Feb  7 19:38:23 CST 2018
+From: Peter Zijlstra <peterz@infradead.org>
+Date: Thu, 25 Jan 2018 10:58:13 +0100
+Subject: KVM: x86: Make indirect calls in emulator speculation safe
+
+From: Peter Zijlstra <peterz@infradead.org>
+
+(cherry picked from commit 1a29b5b7f347a1a9230c1e0af5b37e3e571588ab)
+
+Replace the indirect calls with CALL_NOSPEC.
+
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Reviewed-by: David Woodhouse <dwmw@amazon.co.uk>
+Cc: Andrea Arcangeli <aarcange@redhat.com>
+Cc: Andi Kleen <ak@linux.intel.com>
+Cc: Ashok Raj <ashok.raj@intel.com>
+Cc: Greg KH <gregkh@linuxfoundation.org>
+Cc: Jun Nakajima <jun.nakajima@intel.com>
+Cc: David Woodhouse <dwmw2@infradead.org>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: rga@amazon.de
+Cc: Dave Hansen <dave.hansen@intel.com>
+Cc: Asit Mallick <asit.k.mallick@intel.com>
+Cc: Andy Lutomirski <luto@kernel.org>
+Cc: Josh Poimboeuf <jpoimboe@redhat.com>
+Cc: Jason Baron <jbaron@akamai.com>
+Cc: Paolo Bonzini <pbonzini@redhat.com>
+Cc: Dan Williams <dan.j.williams@intel.com>
+Cc: Arjan Van De Ven <arjan.van.de.ven@intel.com>
+Cc: Tim Chen <tim.c.chen@linux.intel.com>
+Link: https://lkml.kernel.org/r/20180125095843.595615683@infradead.org
+[dwmw2: Use ASM_CALL_CONSTRAINT like upstream, now we have it]
+Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/kvm/emulate.c |   10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+--- a/arch/x86/kvm/emulate.c
++++ b/arch/x86/kvm/emulate.c
+@@ -25,6 +25,7 @@
+ #include <asm/kvm_emulate.h>
+ #include <linux/stringify.h>
+ #include <asm/debugreg.h>
++#include <asm/nospec-branch.h>
+ #include "x86.h"
+ #include "tss.h"
+@@ -1012,8 +1013,8 @@ static __always_inline u8 test_cc(unsign
+       void (*fop)(void) = (void *)em_setcc + 4 * (condition & 0xf);
+       flags = (flags & EFLAGS_MASK) | X86_EFLAGS_IF;
+-      asm("push %[flags]; popf; call *%[fastop]"
+-          : "=a"(rc) : [fastop]"r"(fop), [flags]"r"(flags));
++      asm("push %[flags]; popf; " CALL_NOSPEC
++          : "=a"(rc) : [thunk_target]"r"(fop), [flags]"r"(flags));
+       return rc;
+ }
+@@ -5306,15 +5307,14 @@ static void fetch_possible_mmx_operand(s
+ static int fastop(struct x86_emulate_ctxt *ctxt, void (*fop)(struct fastop *))
+ {
+-      register void *__sp asm(_ASM_SP);
+       ulong flags = (ctxt->eflags & EFLAGS_MASK) | X86_EFLAGS_IF;
+       if (!(ctxt->d & ByteOp))
+               fop += __ffs(ctxt->dst.bytes) * FASTOP_SIZE;
+-      asm("push %[flags]; popf; call *%[fastop]; pushf; pop %[flags]\n"
++      asm("push %[flags]; popf; " CALL_NOSPEC " ; pushf; pop %[flags]\n"
+           : "+a"(ctxt->dst.val), "+d"(ctxt->src.val), [flags]"+D"(flags),
+-            [fastop]"+S"(fop), "+r"(__sp)
++            [thunk_target]"+S"(fop), ASM_CALL_CONSTRAINT
+           : "c"(ctxt->src2.val));
+       ctxt->eflags = (ctxt->eflags & ~EFLAGS_MASK) | (flags & EFLAGS_MASK);
diff --git a/queue-4.9/module-retpoline-warn-about-missing-retpoline-in-module.patch b/queue-4.9/module-retpoline-warn-about-missing-retpoline-in-module.patch
new file mode 100644 (file)
index 0000000..23a00b6
--- /dev/null
@@ -0,0 +1,149 @@
+From foo@baz Wed Feb  7 19:38:23 CST 2018
+From: Andi Kleen <ak@linux.intel.com>
+Date: Thu, 25 Jan 2018 15:50:28 -0800
+Subject: module/retpoline: Warn about missing retpoline in module
+
+From: Andi Kleen <ak@linux.intel.com>
+
+(cherry picked from commit caf7501a1b4ec964190f31f9c3f163de252273b8)
+
+There's a risk that a kernel which has full retpoline mitigations becomes
+vulnerable when a module gets loaded that hasn't been compiled with the
+right compiler or the right option.
+
+To enable detection of that mismatch at module load time, add a module info
+string "retpoline" at build time when the module was compiled with
+retpoline support. This only covers compiled C source, but assembler source
+or prebuilt object files are not checked.
+
+If a retpoline enabled kernel detects a non retpoline protected module at
+load time, print a warning and report it in the sysfs vulnerability file.
+
+[ tglx: Massaged changelog ]
+
+Signed-off-by: Andi Kleen <ak@linux.intel.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Cc: David Woodhouse <dwmw2@infradead.org>
+Cc: gregkh@linuxfoundation.org
+Cc: torvalds@linux-foundation.org
+Cc: jeyu@kernel.org
+Cc: arjan@linux.intel.com
+Link: https://lkml.kernel.org/r/20180125235028.31211-1-andi@firstfloor.org
+Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/kernel/cpu/bugs.c |   17 ++++++++++++++++-
+ include/linux/module.h     |    9 +++++++++
+ kernel/module.c            |   11 +++++++++++
+ scripts/mod/modpost.c      |    9 +++++++++
+ 4 files changed, 45 insertions(+), 1 deletion(-)
+
+--- a/arch/x86/kernel/cpu/bugs.c
++++ b/arch/x86/kernel/cpu/bugs.c
+@@ -10,6 +10,7 @@
+ #include <linux/init.h>
+ #include <linux/utsname.h>
+ #include <linux/cpu.h>
++#include <linux/module.h>
+ #include <asm/nospec-branch.h>
+ #include <asm/cmdline.h>
+@@ -92,6 +93,19 @@ static const char *spectre_v2_strings[]
+ #define pr_fmt(fmt)     "Spectre V2 mitigation: " fmt
+ static enum spectre_v2_mitigation spectre_v2_enabled = SPECTRE_V2_NONE;
++static bool spectre_v2_bad_module;
++
++#ifdef RETPOLINE
++bool retpoline_module_ok(bool has_retpoline)
++{
++      if (spectre_v2_enabled == SPECTRE_V2_NONE || has_retpoline)
++              return true;
++
++      pr_err("System may be vunerable to spectre v2\n");
++      spectre_v2_bad_module = true;
++      return false;
++}
++#endif
+ static void __init spec2_print_if_insecure(const char *reason)
+ {
+@@ -277,6 +291,7 @@ ssize_t cpu_show_spectre_v2(struct devic
+       if (!boot_cpu_has_bug(X86_BUG_SPECTRE_V2))
+               return sprintf(buf, "Not affected\n");
+-      return sprintf(buf, "%s\n", spectre_v2_strings[spectre_v2_enabled]);
++      return sprintf(buf, "%s%s\n", spectre_v2_strings[spectre_v2_enabled],
++                     spectre_v2_bad_module ? " - vulnerable module loaded" : "");
+ }
+ #endif
+--- a/include/linux/module.h
++++ b/include/linux/module.h
+@@ -791,6 +791,15 @@ static inline void module_bug_finalize(c
+ static inline void module_bug_cleanup(struct module *mod) {}
+ #endif        /* CONFIG_GENERIC_BUG */
++#ifdef RETPOLINE
++extern bool retpoline_module_ok(bool has_retpoline);
++#else
++static inline bool retpoline_module_ok(bool has_retpoline)
++{
++      return true;
++}
++#endif
++
+ #ifdef CONFIG_MODULE_SIG
+ static inline bool module_sig_ok(struct module *module)
+ {
+--- a/kernel/module.c
++++ b/kernel/module.c
+@@ -2817,6 +2817,15 @@ static int check_modinfo_livepatch(struc
+ }
+ #endif /* CONFIG_LIVEPATCH */
++static void check_modinfo_retpoline(struct module *mod, struct load_info *info)
++{
++      if (retpoline_module_ok(get_modinfo(info, "retpoline")))
++              return;
++
++      pr_warn("%s: loading module not compiled with retpoline compiler.\n",
++              mod->name);
++}
++
+ /* Sets info->hdr and info->len. */
+ static int copy_module_from_user(const void __user *umod, unsigned long len,
+                                 struct load_info *info)
+@@ -2969,6 +2978,8 @@ static int check_modinfo(struct module *
+               add_taint_module(mod, TAINT_OOT_MODULE, LOCKDEP_STILL_OK);
+       }
++      check_modinfo_retpoline(mod, info);
++
+       if (get_modinfo(info, "staging")) {
+               add_taint_module(mod, TAINT_CRAP, LOCKDEP_STILL_OK);
+               pr_warn("%s: module is from the staging directory, the quality "
+--- a/scripts/mod/modpost.c
++++ b/scripts/mod/modpost.c
+@@ -2130,6 +2130,14 @@ static void add_intree_flag(struct buffe
+               buf_printf(b, "\nMODULE_INFO(intree, \"Y\");\n");
+ }
++/* Cannot check for assembler */
++static void add_retpoline(struct buffer *b)
++{
++      buf_printf(b, "\n#ifdef RETPOLINE\n");
++      buf_printf(b, "MODULE_INFO(retpoline, \"Y\");\n");
++      buf_printf(b, "#endif\n");
++}
++
+ static void add_staging_flag(struct buffer *b, const char *name)
+ {
+       static const char *staging_dir = "drivers/staging";
+@@ -2474,6 +2482,7 @@ int main(int argc, char **argv)
+               add_header(&buf, mod);
+               add_intree_flag(&buf, !external_module);
++              add_retpoline(&buf);
+               add_staging_flag(&buf, mod->name);
+               err |= add_versions(&buf, mod);
+               add_depends(&buf, mod, modules);
index ac9f24ba2c01f5d4defcf61a3275cda584e45376..d487eb871be2d4080793394caac84207f72ee319 100644 (file)
@@ -32,6 +32,16 @@ x86-microcode-amd-do-not-load-when-running-on-a-hypervisor.patch
 media-soc_camera-soc_scale_crop-add-missing-module_description-author-license.patch
 b43-add-missing-module_firmware.patch
 keys-encrypted-fix-buffer-overread-in-valid_master_desc.patch
+x86-retpoline-remove-the-esp-rsp-thunk.patch
+kvm-x86-make-indirect-calls-in-emulator-speculation-safe.patch
+kvm-vmx-make-indirect-call-speculation-safe.patch
+module-retpoline-warn-about-missing-retpoline-in-module.patch
+x86-cpufeatures-add-cpuid_7_edx-cpuid-leaf.patch
+x86-cpufeatures-add-intel-feature-bits-for-speculation-control.patch
+x86-cpufeatures-add-amd-feature-bits-for-speculation-control.patch
+x86-msr-add-definitions-for-new-speculation-control-msrs.patch
+x86-pti-do-not-enable-pti-on-cpus-which-are-not-vulnerable-to-meltdown.patch
+x86-cpufeature-blacklist-spec_ctrl-pred_cmd-on-early-spectre-v2-microcodes.patch
 kvm-nvmx-vmx_complete_nested_posted_interrupt-can-t-fail.patch
 kvm-nvmx-mark-vmcs12-pages-dirty-on-l2-exit.patch
 kvm-nvmx-eliminate-vmcs02-pool.patch
diff --git a/queue-4.9/x86-cpufeature-blacklist-spec_ctrl-pred_cmd-on-early-spectre-v2-microcodes.patch b/queue-4.9/x86-cpufeature-blacklist-spec_ctrl-pred_cmd-on-early-spectre-v2-microcodes.patch
new file mode 100644 (file)
index 0000000..6397ee8
--- /dev/null
@@ -0,0 +1,167 @@
+From foo@baz Wed Feb  7 19:38:23 CST 2018
+From: David Woodhouse <dwmw@amazon.co.uk>
+Date: Thu, 25 Jan 2018 16:14:14 +0000
+Subject: x86/cpufeature: Blacklist SPEC_CTRL/PRED_CMD on early Spectre v2 microcodes
+
+From: David Woodhouse <dwmw@amazon.co.uk>
+
+(cherry picked from commit a5b2966364538a0e68c9fa29bc0a3a1651799035)
+
+This doesn't refuse to load the affected microcodes; it just refuses to
+use the Spectre v2 mitigation features if they're detected, by clearing
+the appropriate feature bits.
+
+The AMD CPUID bits are handled here too, because hypervisors *may* have
+been exposing those bits even on Intel chips, for fine-grained control
+of what's available.
+
+It is non-trivial to use x86_match_cpu() for this table because that
+doesn't handle steppings. And the approach taken in commit bd9240a18
+almost made me lose my lunch.
+
+Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Cc: gnomes@lxorguk.ukuu.org.uk
+Cc: ak@linux.intel.com
+Cc: ashok.raj@intel.com
+Cc: dave.hansen@intel.com
+Cc: karahmed@amazon.de
+Cc: arjan@linux.intel.com
+Cc: torvalds@linux-foundation.org
+Cc: peterz@infradead.org
+Cc: bp@alien8.de
+Cc: pbonzini@redhat.com
+Cc: tim.c.chen@linux.intel.com
+Cc: gregkh@linux-foundation.org
+Link: https://lkml.kernel.org/r/1516896855-7642-7-git-send-email-dwmw@amazon.co.uk
+Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/include/asm/intel-family.h |    7 ++-
+ arch/x86/kernel/cpu/intel.c         |   66 ++++++++++++++++++++++++++++++++++++
+ 2 files changed, 71 insertions(+), 2 deletions(-)
+
+--- a/arch/x86/include/asm/intel-family.h
++++ b/arch/x86/include/asm/intel-family.h
+@@ -12,6 +12,7 @@
+  */
+ #define INTEL_FAM6_CORE_YONAH         0x0E
++
+ #define INTEL_FAM6_CORE2_MEROM                0x0F
+ #define INTEL_FAM6_CORE2_MEROM_L      0x16
+ #define INTEL_FAM6_CORE2_PENRYN               0x17
+@@ -21,6 +22,7 @@
+ #define INTEL_FAM6_NEHALEM_G          0x1F /* Auburndale / Havendale */
+ #define INTEL_FAM6_NEHALEM_EP         0x1A
+ #define INTEL_FAM6_NEHALEM_EX         0x2E
++
+ #define INTEL_FAM6_WESTMERE           0x25
+ #define INTEL_FAM6_WESTMERE_EP                0x2C
+ #define INTEL_FAM6_WESTMERE_EX                0x2F
+@@ -36,9 +38,9 @@
+ #define INTEL_FAM6_HASWELL_GT3E               0x46
+ #define INTEL_FAM6_BROADWELL_CORE     0x3D
+-#define INTEL_FAM6_BROADWELL_XEON_D   0x56
+ #define INTEL_FAM6_BROADWELL_GT3E     0x47
+ #define INTEL_FAM6_BROADWELL_X                0x4F
++#define INTEL_FAM6_BROADWELL_XEON_D   0x56
+ #define INTEL_FAM6_SKYLAKE_MOBILE     0x4E
+ #define INTEL_FAM6_SKYLAKE_DESKTOP    0x5E
+@@ -57,9 +59,10 @@
+ #define INTEL_FAM6_ATOM_SILVERMONT2   0x4D /* Avaton/Rangely */
+ #define INTEL_FAM6_ATOM_AIRMONT               0x4C /* CherryTrail / Braswell */
+ #define INTEL_FAM6_ATOM_MERRIFIELD    0x4A /* Tangier */
+-#define INTEL_FAM6_ATOM_MOOREFIELD    0x5A /* Annidale */
++#define INTEL_FAM6_ATOM_MOOREFIELD    0x5A /* Anniedale */
+ #define INTEL_FAM6_ATOM_GOLDMONT      0x5C
+ #define INTEL_FAM6_ATOM_DENVERTON     0x5F /* Goldmont Microserver */
++#define INTEL_FAM6_ATOM_GEMINI_LAKE   0x7A
+ /* Xeon Phi */
+--- a/arch/x86/kernel/cpu/intel.c
++++ b/arch/x86/kernel/cpu/intel.c
+@@ -61,6 +61,59 @@ void check_mpx_erratum(struct cpuinfo_x8
+       }
+ }
++/*
++ * Early microcode releases for the Spectre v2 mitigation were broken.
++ * Information taken from;
++ * - https://newsroom.intel.com/wp-content/uploads/sites/11/2018/01/microcode-update-guidance.pdf
++ * - https://kb.vmware.com/s/article/52345
++ * - Microcode revisions observed in the wild
++ * - Release note from 20180108 microcode release
++ */
++struct sku_microcode {
++      u8 model;
++      u8 stepping;
++      u32 microcode;
++};
++static const struct sku_microcode spectre_bad_microcodes[] = {
++      { INTEL_FAM6_KABYLAKE_DESKTOP,  0x0B,   0x84 },
++      { INTEL_FAM6_KABYLAKE_DESKTOP,  0x0A,   0x84 },
++      { INTEL_FAM6_KABYLAKE_DESKTOP,  0x09,   0x84 },
++      { INTEL_FAM6_KABYLAKE_MOBILE,   0x0A,   0x84 },
++      { INTEL_FAM6_KABYLAKE_MOBILE,   0x09,   0x84 },
++      { INTEL_FAM6_SKYLAKE_X,         0x03,   0x0100013e },
++      { INTEL_FAM6_SKYLAKE_X,         0x04,   0x0200003c },
++      { INTEL_FAM6_SKYLAKE_MOBILE,    0x03,   0xc2 },
++      { INTEL_FAM6_SKYLAKE_DESKTOP,   0x03,   0xc2 },
++      { INTEL_FAM6_BROADWELL_CORE,    0x04,   0x28 },
++      { INTEL_FAM6_BROADWELL_GT3E,    0x01,   0x1b },
++      { INTEL_FAM6_BROADWELL_XEON_D,  0x02,   0x14 },
++      { INTEL_FAM6_BROADWELL_XEON_D,  0x03,   0x07000011 },
++      { INTEL_FAM6_BROADWELL_X,       0x01,   0x0b000025 },
++      { INTEL_FAM6_HASWELL_ULT,       0x01,   0x21 },
++      { INTEL_FAM6_HASWELL_GT3E,      0x01,   0x18 },
++      { INTEL_FAM6_HASWELL_CORE,      0x03,   0x23 },
++      { INTEL_FAM6_HASWELL_X,         0x02,   0x3b },
++      { INTEL_FAM6_HASWELL_X,         0x04,   0x10 },
++      { INTEL_FAM6_IVYBRIDGE_X,       0x04,   0x42a },
++      /* Updated in the 20180108 release; blacklist until we know otherwise */
++      { INTEL_FAM6_ATOM_GEMINI_LAKE,  0x01,   0x22 },
++      /* Observed in the wild */
++      { INTEL_FAM6_SANDYBRIDGE_X,     0x06,   0x61b },
++      { INTEL_FAM6_SANDYBRIDGE_X,     0x07,   0x712 },
++};
++
++static bool bad_spectre_microcode(struct cpuinfo_x86 *c)
++{
++      int i;
++
++      for (i = 0; i < ARRAY_SIZE(spectre_bad_microcodes); i++) {
++              if (c->x86_model == spectre_bad_microcodes[i].model &&
++                  c->x86_mask == spectre_bad_microcodes[i].stepping)
++                      return (c->microcode <= spectre_bad_microcodes[i].microcode);
++      }
++      return false;
++}
++
+ static void early_init_intel(struct cpuinfo_x86 *c)
+ {
+       u64 misc_enable;
+@@ -87,6 +140,19 @@ static void early_init_intel(struct cpui
+               rdmsr(MSR_IA32_UCODE_REV, lower_word, c->microcode);
+       }
++      if ((cpu_has(c, X86_FEATURE_SPEC_CTRL) ||
++           cpu_has(c, X86_FEATURE_STIBP) ||
++           cpu_has(c, X86_FEATURE_AMD_SPEC_CTRL) ||
++           cpu_has(c, X86_FEATURE_AMD_PRED_CMD) ||
++           cpu_has(c, X86_FEATURE_AMD_STIBP)) && bad_spectre_microcode(c)) {
++              pr_warn("Intel Spectre v2 broken microcode detected; disabling SPEC_CTRL\n");
++              clear_cpu_cap(c, X86_FEATURE_SPEC_CTRL);
++              clear_cpu_cap(c, X86_FEATURE_STIBP);
++              clear_cpu_cap(c, X86_FEATURE_AMD_SPEC_CTRL);
++              clear_cpu_cap(c, X86_FEATURE_AMD_PRED_CMD);
++              clear_cpu_cap(c, X86_FEATURE_AMD_STIBP);
++      }
++
+       /*
+        * Atom erratum AAE44/AAF40/AAG38/AAH41:
+        *
diff --git a/queue-4.9/x86-cpufeatures-add-amd-feature-bits-for-speculation-control.patch b/queue-4.9/x86-cpufeatures-add-amd-feature-bits-for-speculation-control.patch
new file mode 100644 (file)
index 0000000..7b48105
--- /dev/null
@@ -0,0 +1,47 @@
+From foo@baz Wed Feb  7 19:38:23 CST 2018
+From: David Woodhouse <dwmw@amazon.co.uk>
+Date: Thu, 25 Jan 2018 16:14:11 +0000
+Subject: x86/cpufeatures: Add AMD feature bits for Speculation Control
+
+From: David Woodhouse <dwmw@amazon.co.uk>
+
+(cherry picked from commit 5d10cbc91d9eb5537998b65608441b592eec65e7)
+
+AMD exposes the PRED_CMD/SPEC_CTRL MSRs slightly differently to Intel.
+See http://lkml.kernel.org/r/2b3e25cc-286d-8bd0-aeaf-9ac4aae39de8@amd.com
+
+Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Cc: Tom Lendacky <thomas.lendacky@amd.com>
+Cc: gnomes@lxorguk.ukuu.org.uk
+Cc: ak@linux.intel.com
+Cc: ashok.raj@intel.com
+Cc: dave.hansen@intel.com
+Cc: karahmed@amazon.de
+Cc: arjan@linux.intel.com
+Cc: torvalds@linux-foundation.org
+Cc: peterz@infradead.org
+Cc: bp@alien8.de
+Cc: pbonzini@redhat.com
+Cc: tim.c.chen@linux.intel.com
+Cc: gregkh@linux-foundation.org
+Link: https://lkml.kernel.org/r/1516896855-7642-4-git-send-email-dwmw@amazon.co.uk
+Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/include/asm/cpufeatures.h |    3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/arch/x86/include/asm/cpufeatures.h
++++ b/arch/x86/include/asm/cpufeatures.h
+@@ -258,6 +258,9 @@
+ /* AMD-defined CPU features, CPUID level 0x80000008 (ebx), word 13 */
+ #define X86_FEATURE_CLZERO    (13*32+0) /* CLZERO instruction */
+ #define X86_FEATURE_IRPERF    (13*32+1) /* Instructions Retired Count */
++#define X86_FEATURE_AMD_PRED_CMD (13*32+12) /* Prediction Command MSR (AMD) */
++#define X86_FEATURE_AMD_SPEC_CTRL (13*32+14) /* Speculation Control MSR only (AMD) */
++#define X86_FEATURE_AMD_STIBP (13*32+15) /* Single Thread Indirect Branch Predictors (AMD) */
+ /* Thermal and Power Management Leaf, CPUID level 0x00000006 (eax), word 14 */
+ #define X86_FEATURE_DTHERM    (14*32+ 0) /* Digital Thermal Sensor */
diff --git a/queue-4.9/x86-cpufeatures-add-cpuid_7_edx-cpuid-leaf.patch b/queue-4.9/x86-cpufeatures-add-cpuid_7_edx-cpuid-leaf.patch
new file mode 100644 (file)
index 0000000..a47b816
--- /dev/null
@@ -0,0 +1,149 @@
+From foo@baz Wed Feb  7 19:38:23 CST 2018
+From: David Woodhouse <dwmw@amazon.co.uk>
+Date: Thu, 25 Jan 2018 16:14:09 +0000
+Subject: x86/cpufeatures: Add CPUID_7_EDX CPUID leaf
+
+From: David Woodhouse <dwmw@amazon.co.uk>
+
+(cherry picked from commit 95ca0ee8636059ea2800dfbac9ecac6212d6b38f)
+
+This is a pure feature bits leaf. There are two AVX512 feature bits in it
+already which were handled as scattered bits, and three more from this leaf
+are going to be added for speculation control features.
+
+Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Reviewed-by: Borislav Petkov <bp@suse.de>
+Cc: gnomes@lxorguk.ukuu.org.uk
+Cc: ak@linux.intel.com
+Cc: ashok.raj@intel.com
+Cc: dave.hansen@intel.com
+Cc: karahmed@amazon.de
+Cc: arjan@linux.intel.com
+Cc: torvalds@linux-foundation.org
+Cc: peterz@infradead.org
+Cc: bp@alien8.de
+Cc: pbonzini@redhat.com
+Cc: tim.c.chen@linux.intel.com
+Cc: gregkh@linux-foundation.org
+Link: https://lkml.kernel.org/r/1516896855-7642-2-git-send-email-dwmw@amazon.co.uk
+Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/include/asm/cpufeature.h        |    7 +++++--
+ arch/x86/include/asm/cpufeatures.h       |   10 ++++++----
+ arch/x86/include/asm/disabled-features.h |    3 ++-
+ arch/x86/include/asm/required-features.h |    3 ++-
+ arch/x86/kernel/cpu/common.c             |    1 +
+ arch/x86/kernel/cpu/scattered.c          |    2 --
+ 6 files changed, 16 insertions(+), 10 deletions(-)
+
+--- a/arch/x86/include/asm/cpufeature.h
++++ b/arch/x86/include/asm/cpufeature.h
+@@ -28,6 +28,7 @@ enum cpuid_leafs
+       CPUID_8000_000A_EDX,
+       CPUID_7_ECX,
+       CPUID_8000_0007_EBX,
++      CPUID_7_EDX,
+ };
+ #ifdef CONFIG_X86_FEATURE_NAMES
+@@ -78,8 +79,9 @@ extern const char * const x86_bug_flags[
+          CHECK_BIT_IN_MASK_WORD(REQUIRED_MASK, 15, feature_bit) ||    \
+          CHECK_BIT_IN_MASK_WORD(REQUIRED_MASK, 16, feature_bit) ||    \
+          CHECK_BIT_IN_MASK_WORD(REQUIRED_MASK, 17, feature_bit) ||    \
++         CHECK_BIT_IN_MASK_WORD(REQUIRED_MASK, 18, feature_bit) ||    \
+          REQUIRED_MASK_CHECK                                    ||    \
+-         BUILD_BUG_ON_ZERO(NCAPINTS != 18))
++         BUILD_BUG_ON_ZERO(NCAPINTS != 19))
+ #define DISABLED_MASK_BIT_SET(feature_bit)                            \
+        ( CHECK_BIT_IN_MASK_WORD(DISABLED_MASK,  0, feature_bit) ||    \
+@@ -100,8 +102,9 @@ extern const char * const x86_bug_flags[
+          CHECK_BIT_IN_MASK_WORD(DISABLED_MASK, 15, feature_bit) ||    \
+          CHECK_BIT_IN_MASK_WORD(DISABLED_MASK, 16, feature_bit) ||    \
+          CHECK_BIT_IN_MASK_WORD(DISABLED_MASK, 17, feature_bit) ||    \
++         CHECK_BIT_IN_MASK_WORD(DISABLED_MASK, 18, feature_bit) ||    \
+          DISABLED_MASK_CHECK                                    ||    \
+-         BUILD_BUG_ON_ZERO(NCAPINTS != 18))
++         BUILD_BUG_ON_ZERO(NCAPINTS != 19))
+ #define cpu_has(c, bit)                                                       \
+       (__builtin_constant_p(bit) && REQUIRED_MASK_BIT_SET(bit) ? 1 :  \
+--- a/arch/x86/include/asm/cpufeatures.h
++++ b/arch/x86/include/asm/cpufeatures.h
+@@ -12,7 +12,7 @@
+ /*
+  * Defines x86 CPU feature bits
+  */
+-#define NCAPINTS      18      /* N 32-bit words worth of info */
++#define NCAPINTS      19      /* N 32-bit words worth of info */
+ #define NBUGINTS      1       /* N 32-bit bug flags */
+ /*
+@@ -197,9 +197,7 @@
+ #define X86_FEATURE_RETPOLINE ( 7*32+12) /* Generic Retpoline mitigation for Spectre variant 2 */
+ #define X86_FEATURE_RETPOLINE_AMD ( 7*32+13) /* AMD Retpoline mitigation for Spectre variant 2 */
+-#define X86_FEATURE_AVX512_4VNNIW (7*32+16) /* AVX-512 Neural Network Instructions */
+-#define X86_FEATURE_AVX512_4FMAPS (7*32+17) /* AVX-512 Multiply Accumulation Single precision */
+-#define X86_FEATURE_RSB_CTXSW         ( 7*32+19) /* Fill RSB on context switches */
++#define X86_FEATURE_RSB_CTXSW ( 7*32+19) /* Fill RSB on context switches */
+ /* Because the ALTERNATIVE scheme is for members of the X86_FEATURE club... */
+ #define X86_FEATURE_KAISER    ( 7*32+31) /* CONFIG_PAGE_TABLE_ISOLATION w/o nokaiser */
+@@ -295,6 +293,10 @@
+ #define X86_FEATURE_SUCCOR    (17*32+1) /* Uncorrectable error containment and recovery */
+ #define X86_FEATURE_SMCA      (17*32+3) /* Scalable MCA */
++/* Intel-defined CPU features, CPUID level 0x00000007:0 (EDX), word 18 */
++#define X86_FEATURE_AVX512_4VNNIW     (18*32+ 2) /* AVX-512 Neural Network Instructions */
++#define X86_FEATURE_AVX512_4FMAPS     (18*32+ 3) /* AVX-512 Multiply Accumulation Single precision */
++
+ /*
+  * BUG word(s)
+  */
+--- a/arch/x86/include/asm/disabled-features.h
++++ b/arch/x86/include/asm/disabled-features.h
+@@ -59,6 +59,7 @@
+ #define DISABLED_MASK15       0
+ #define DISABLED_MASK16       (DISABLE_PKU|DISABLE_OSPKE)
+ #define DISABLED_MASK17       0
+-#define DISABLED_MASK_CHECK BUILD_BUG_ON_ZERO(NCAPINTS != 18)
++#define DISABLED_MASK18       0
++#define DISABLED_MASK_CHECK BUILD_BUG_ON_ZERO(NCAPINTS != 19)
+ #endif /* _ASM_X86_DISABLED_FEATURES_H */
+--- a/arch/x86/include/asm/required-features.h
++++ b/arch/x86/include/asm/required-features.h
+@@ -100,6 +100,7 @@
+ #define REQUIRED_MASK15       0
+ #define REQUIRED_MASK16       0
+ #define REQUIRED_MASK17       0
+-#define REQUIRED_MASK_CHECK BUILD_BUG_ON_ZERO(NCAPINTS != 18)
++#define REQUIRED_MASK18       0
++#define REQUIRED_MASK_CHECK BUILD_BUG_ON_ZERO(NCAPINTS != 19)
+ #endif /* _ASM_X86_REQUIRED_FEATURES_H */
+--- a/arch/x86/kernel/cpu/common.c
++++ b/arch/x86/kernel/cpu/common.c
+@@ -737,6 +737,7 @@ void get_cpu_cap(struct cpuinfo_x86 *c)
+               cpuid_count(0x00000007, 0, &eax, &ebx, &ecx, &edx);
+               c->x86_capability[CPUID_7_0_EBX] = ebx;
+               c->x86_capability[CPUID_7_ECX] = ecx;
++              c->x86_capability[CPUID_7_EDX] = edx;
+       }
+       /* Extended state features: level 0x0000000d */
+--- a/arch/x86/kernel/cpu/scattered.c
++++ b/arch/x86/kernel/cpu/scattered.c
+@@ -31,8 +31,6 @@ void init_scattered_cpuid_features(struc
+       const struct cpuid_bit *cb;
+       static const struct cpuid_bit cpuid_bits[] = {
+-              { X86_FEATURE_AVX512_4VNNIW,    CR_EDX, 2, 0x00000007, 0 },
+-              { X86_FEATURE_AVX512_4FMAPS,    CR_EDX, 3, 0x00000007, 0 },
+               { X86_FEATURE_APERFMPERF,       CR_ECX, 0, 0x00000006, 0 },
+               { X86_FEATURE_EPB,              CR_ECX, 3, 0x00000006, 0 },
+               { X86_FEATURE_HW_PSTATE,        CR_EDX, 7, 0x80000007, 0 },
diff --git a/queue-4.9/x86-cpufeatures-add-intel-feature-bits-for-speculation-control.patch b/queue-4.9/x86-cpufeatures-add-intel-feature-bits-for-speculation-control.patch
new file mode 100644 (file)
index 0000000..568f3bf
--- /dev/null
@@ -0,0 +1,47 @@
+From foo@baz Wed Feb  7 19:38:23 CST 2018
+From: David Woodhouse <dwmw@amazon.co.uk>
+Date: Thu, 25 Jan 2018 16:14:10 +0000
+Subject: x86/cpufeatures: Add Intel feature bits for Speculation Control
+
+From: David Woodhouse <dwmw@amazon.co.uk>
+
+(cherry picked from commit fc67dd70adb711a45d2ef34e12d1a8be75edde61)
+
+Add three feature bits exposed by new microcode on Intel CPUs for
+speculation control.
+
+Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Reviewed-by: Borislav Petkov <bp@suse.de>
+Cc: gnomes@lxorguk.ukuu.org.uk
+Cc: ak@linux.intel.com
+Cc: ashok.raj@intel.com
+Cc: dave.hansen@intel.com
+Cc: karahmed@amazon.de
+Cc: arjan@linux.intel.com
+Cc: torvalds@linux-foundation.org
+Cc: peterz@infradead.org
+Cc: bp@alien8.de
+Cc: pbonzini@redhat.com
+Cc: tim.c.chen@linux.intel.com
+Cc: gregkh@linux-foundation.org
+Link: https://lkml.kernel.org/r/1516896855-7642-3-git-send-email-dwmw@amazon.co.uk
+Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/include/asm/cpufeatures.h |    3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/arch/x86/include/asm/cpufeatures.h
++++ b/arch/x86/include/asm/cpufeatures.h
+@@ -296,6 +296,9 @@
+ /* Intel-defined CPU features, CPUID level 0x00000007:0 (EDX), word 18 */
+ #define X86_FEATURE_AVX512_4VNNIW     (18*32+ 2) /* AVX-512 Neural Network Instructions */
+ #define X86_FEATURE_AVX512_4FMAPS     (18*32+ 3) /* AVX-512 Multiply Accumulation Single precision */
++#define X86_FEATURE_SPEC_CTRL         (18*32+26) /* Speculation Control (IBRS + IBPB) */
++#define X86_FEATURE_STIBP             (18*32+27) /* Single Thread Indirect Branch Predictors */
++#define X86_FEATURE_ARCH_CAPABILITIES (18*32+29) /* IA32_ARCH_CAPABILITIES MSR (Intel) */
+ /*
+  * BUG word(s)
diff --git a/queue-4.9/x86-msr-add-definitions-for-new-speculation-control-msrs.patch b/queue-4.9/x86-msr-add-definitions-for-new-speculation-control-msrs.patch
new file mode 100644 (file)
index 0000000..884d448
--- /dev/null
@@ -0,0 +1,63 @@
+From foo@baz Wed Feb  7 19:38:23 CST 2018
+From: David Woodhouse <dwmw@amazon.co.uk>
+Date: Thu, 25 Jan 2018 16:14:12 +0000
+Subject: x86/msr: Add definitions for new speculation control MSRs
+
+From: David Woodhouse <dwmw@amazon.co.uk>
+
+(cherry picked from commit 1e340c60d0dd3ae07b5bedc16a0469c14b9f3410)
+
+Add MSR and bit definitions for SPEC_CTRL, PRED_CMD and ARCH_CAPABILITIES.
+
+See Intel's 336996-Speculative-Execution-Side-Channel-Mitigations.pdf
+
+Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Cc: gnomes@lxorguk.ukuu.org.uk
+Cc: ak@linux.intel.com
+Cc: ashok.raj@intel.com
+Cc: dave.hansen@intel.com
+Cc: karahmed@amazon.de
+Cc: arjan@linux.intel.com
+Cc: torvalds@linux-foundation.org
+Cc: peterz@infradead.org
+Cc: bp@alien8.de
+Cc: pbonzini@redhat.com
+Cc: tim.c.chen@linux.intel.com
+Cc: gregkh@linux-foundation.org
+Link: https://lkml.kernel.org/r/1516896855-7642-5-git-send-email-dwmw@amazon.co.uk
+Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/include/asm/msr-index.h |   12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+--- a/arch/x86/include/asm/msr-index.h
++++ b/arch/x86/include/asm/msr-index.h
+@@ -37,6 +37,13 @@
+ #define EFER_FFXSR            (1<<_EFER_FFXSR)
+ /* Intel MSRs. Some also available on other CPUs */
++#define MSR_IA32_SPEC_CTRL            0x00000048 /* Speculation Control */
++#define SPEC_CTRL_IBRS                        (1 << 0)   /* Indirect Branch Restricted Speculation */
++#define SPEC_CTRL_STIBP                       (1 << 1)   /* Single Thread Indirect Branch Predictors */
++
++#define MSR_IA32_PRED_CMD             0x00000049 /* Prediction Command */
++#define PRED_CMD_IBPB                 (1 << 0)   /* Indirect Branch Prediction Barrier */
++
+ #define MSR_IA32_PERFCTR0             0x000000c1
+ #define MSR_IA32_PERFCTR1             0x000000c2
+ #define MSR_FSB_FREQ                  0x000000cd
+@@ -50,6 +57,11 @@
+ #define SNB_C3_AUTO_UNDEMOTE          (1UL << 28)
+ #define MSR_MTRRcap                   0x000000fe
++
++#define MSR_IA32_ARCH_CAPABILITIES    0x0000010a
++#define ARCH_CAP_RDCL_NO              (1 << 0)   /* Not susceptible to Meltdown */
++#define ARCH_CAP_IBRS_ALL             (1 << 1)   /* Enhanced IBRS support */
++
+ #define MSR_IA32_BBL_CR_CTL           0x00000119
+ #define MSR_IA32_BBL_CR_CTL3          0x0000011e
diff --git a/queue-4.9/x86-pti-do-not-enable-pti-on-cpus-which-are-not-vulnerable-to-meltdown.patch b/queue-4.9/x86-pti-do-not-enable-pti-on-cpus-which-are-not-vulnerable-to-meltdown.patch
new file mode 100644 (file)
index 0000000..ffbcbc7
--- /dev/null
@@ -0,0 +1,112 @@
+From foo@baz Wed Feb  7 19:38:23 CST 2018
+From: David Woodhouse <dwmw@amazon.co.uk>
+Date: Thu, 25 Jan 2018 16:14:13 +0000
+Subject: x86/pti: Do not enable PTI on CPUs which are not vulnerable to Meltdown
+
+From: David Woodhouse <dwmw@amazon.co.uk>
+
+(cherry picked from commit fec9434a12f38d3aeafeb75711b71d8a1fdef621)
+
+Also, for CPUs which don't speculate at all, don't report that they're
+vulnerable to the Spectre variants either.
+
+Leave the cpu_no_meltdown[] match table with just X86_VENDOR_AMD in it
+for now, even though that could be done with a simple comparison, on the
+assumption that we'll have more to add.
+
+Based on suggestions from Dave Hansen and Alan Cox.
+
+Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Reviewed-by: Borislav Petkov <bp@suse.de>
+Acked-by: Dave Hansen <dave.hansen@intel.com>
+Cc: gnomes@lxorguk.ukuu.org.uk
+Cc: ak@linux.intel.com
+Cc: ashok.raj@intel.com
+Cc: karahmed@amazon.de
+Cc: arjan@linux.intel.com
+Cc: torvalds@linux-foundation.org
+Cc: peterz@infradead.org
+Cc: bp@alien8.de
+Cc: pbonzini@redhat.com
+Cc: tim.c.chen@linux.intel.com
+Cc: gregkh@linux-foundation.org
+Link: https://lkml.kernel.org/r/1516896855-7642-6-git-send-email-dwmw@amazon.co.uk
+Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/kernel/cpu/common.c |   48 ++++++++++++++++++++++++++++++++++++++-----
+ 1 file changed, 43 insertions(+), 5 deletions(-)
+
+--- a/arch/x86/kernel/cpu/common.c
++++ b/arch/x86/kernel/cpu/common.c
+@@ -44,6 +44,8 @@
+ #include <asm/pat.h>
+ #include <asm/microcode.h>
+ #include <asm/microcode_intel.h>
++#include <asm/intel-family.h>
++#include <asm/cpu_device_id.h>
+ #ifdef CONFIG_X86_LOCAL_APIC
+ #include <asm/uv/uv.h>
+@@ -838,6 +840,41 @@ static void identify_cpu_without_cpuid(s
+ #endif
+ }
++static const __initdata struct x86_cpu_id cpu_no_speculation[] = {
++      { X86_VENDOR_INTEL,     6, INTEL_FAM6_ATOM_CEDARVIEW,   X86_FEATURE_ANY },
++      { X86_VENDOR_INTEL,     6, INTEL_FAM6_ATOM_CLOVERVIEW,  X86_FEATURE_ANY },
++      { X86_VENDOR_INTEL,     6, INTEL_FAM6_ATOM_LINCROFT,    X86_FEATURE_ANY },
++      { X86_VENDOR_INTEL,     6, INTEL_FAM6_ATOM_PENWELL,     X86_FEATURE_ANY },
++      { X86_VENDOR_INTEL,     6, INTEL_FAM6_ATOM_PINEVIEW,    X86_FEATURE_ANY },
++      { X86_VENDOR_CENTAUR,   5 },
++      { X86_VENDOR_INTEL,     5 },
++      { X86_VENDOR_NSC,       5 },
++      { X86_VENDOR_ANY,       4 },
++      {}
++};
++
++static const __initdata struct x86_cpu_id cpu_no_meltdown[] = {
++      { X86_VENDOR_AMD },
++      {}
++};
++
++static bool __init cpu_vulnerable_to_meltdown(struct cpuinfo_x86 *c)
++{
++      u64 ia32_cap = 0;
++
++      if (x86_match_cpu(cpu_no_meltdown))
++              return false;
++
++      if (cpu_has(c, X86_FEATURE_ARCH_CAPABILITIES))
++              rdmsrl(MSR_IA32_ARCH_CAPABILITIES, ia32_cap);
++
++      /* Rogue Data Cache Load? No! */
++      if (ia32_cap & ARCH_CAP_RDCL_NO)
++              return false;
++
++      return true;
++}
++
+ /*
+  * Do minimum CPU detection early.
+  * Fields really needed: vendor, cpuid_level, family, model, mask,
+@@ -884,11 +921,12 @@ static void __init early_identify_cpu(st
+       setup_force_cpu_cap(X86_FEATURE_ALWAYS);
+-      if (c->x86_vendor != X86_VENDOR_AMD)
+-              setup_force_cpu_bug(X86_BUG_CPU_MELTDOWN);
+-
+-      setup_force_cpu_bug(X86_BUG_SPECTRE_V1);
+-      setup_force_cpu_bug(X86_BUG_SPECTRE_V2);
++      if (!x86_match_cpu(cpu_no_speculation)) {
++              if (cpu_vulnerable_to_meltdown(c))
++                      setup_force_cpu_bug(X86_BUG_CPU_MELTDOWN);
++              setup_force_cpu_bug(X86_BUG_SPECTRE_V1);
++              setup_force_cpu_bug(X86_BUG_SPECTRE_V2);
++      }
+       fpu__init_system(c);
diff --git a/queue-4.9/x86-retpoline-remove-the-esp-rsp-thunk.patch b/queue-4.9/x86-retpoline-remove-the-esp-rsp-thunk.patch
new file mode 100644 (file)
index 0000000..f0d2444
--- /dev/null
@@ -0,0 +1,58 @@
+From foo@baz Wed Feb  7 19:38:23 CST 2018
+From: Waiman Long <longman@redhat.com>
+Date: Mon, 22 Jan 2018 17:09:34 -0500
+Subject: x86/retpoline: Remove the esp/rsp thunk
+
+From: Waiman Long <longman@redhat.com>
+
+(cherry picked from commit 1df37383a8aeabb9b418698f0bcdffea01f4b1b2)
+
+It doesn't make sense to have an indirect call thunk with esp/rsp as
+retpoline code won't work correctly with the stack pointer register.
+Removing it will help compiler writers to catch error in case such
+a thunk call is emitted incorrectly.
+
+Fixes: 76b043848fd2 ("x86/retpoline: Add initial retpoline support")
+Suggested-by: Jeff Law <law@redhat.com>
+Signed-off-by: Waiman Long <longman@redhat.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Acked-by: David Woodhouse <dwmw@amazon.co.uk>
+Cc: Tom Lendacky <thomas.lendacky@amd.com>
+Cc: Kees Cook <keescook@google.com>
+Cc: Andi Kleen <ak@linux.intel.com>
+Cc: Tim Chen <tim.c.chen@linux.intel.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Jiri Kosina <jikos@kernel.org>
+Cc: Andy Lutomirski <luto@amacapital.net>
+Cc: Dave Hansen <dave.hansen@intel.com>
+Cc: Josh Poimboeuf <jpoimboe@redhat.com>
+Cc: Arjan van de Ven <arjan@linux.intel.com>
+Cc: Greg Kroah-Hartman <gregkh@linux-foundation.org>
+Cc: Paul Turner <pjt@google.com>
+Link: https://lkml.kernel.org/r/1516658974-27852-1-git-send-email-longman@redhat.com
+Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/include/asm/asm-prototypes.h |    1 -
+ arch/x86/lib/retpoline.S              |    1 -
+ 2 files changed, 2 deletions(-)
+
+--- a/arch/x86/include/asm/asm-prototypes.h
++++ b/arch/x86/include/asm/asm-prototypes.h
+@@ -37,5 +37,4 @@ INDIRECT_THUNK(dx)
+ INDIRECT_THUNK(si)
+ INDIRECT_THUNK(di)
+ INDIRECT_THUNK(bp)
+-INDIRECT_THUNK(sp)
+ #endif /* CONFIG_RETPOLINE */
+--- a/arch/x86/lib/retpoline.S
++++ b/arch/x86/lib/retpoline.S
+@@ -36,7 +36,6 @@ GENERATE_THUNK(_ASM_DX)
+ GENERATE_THUNK(_ASM_SI)
+ GENERATE_THUNK(_ASM_DI)
+ GENERATE_THUNK(_ASM_BP)
+-GENERATE_THUNK(_ASM_SP)
+ #ifdef CONFIG_64BIT
+ GENERATE_THUNK(r8)
+ GENERATE_THUNK(r9)