[SRU] NEO_DISABLE_MITIGATIONS flag default should be true

[Shane McKee]

[ Impact ]

 * Users can expect up to 20% performance improvement

[ Test Plan ]

 * Run Khronos's OpenCL conformance tests:
   https://github.com/KhronosGroup/OpenCL-CTS/tree/main/test_conformance

   This will be run via checkbox-gfx, so the commands would be:
   sudo snap install --classic snapcraft
   sudo snap install checkbox24
   lxd init --auto
   git clone https://github.com/canonical/checkbox-gfx
   cd checkbox-gfx
   snapcraft
   sudo snap install --dangerous --classic ./checkbox-gfx_1.0_amd64.snap
   checkbox-gfx.install-opencl
   checkbox-gfx.test-opencl

   The goal here is not a perfect pass rate. The bar will be no regressions on
   the new version without mitigations.

[ Where problems could occur ]

 * As we are proposing to eliminate a vulnerability mitigation, there is the possibility that this would open up an unknown avenue for attack. To provide some confidence for this sizable risk, both Intel and Canonical security have signed off on this change, and Intel even distributes without these mitigations from their Compute Runtime Github repo without any known exploits.
* As with any change, this change could open up some other bug that was covered up by the mitigations. As with the previous point, we have some confidence because Intel already publishes without these mitigations.
* As we have mentioned that Intel already includes this change, it is appropriate to mention that Intel statically links their builds for Compute Runtime and has some differences in their debian packaging, which means that we could have unknown behavioral differences between the archive version and the versions published in their Github repo.

[ Other Info ]

* PPA: https://launchpad.net/~mckeesh/+archive/ubuntu/lp2110131
* Converted original bug to an SRU. Original description below
* Targeting back to Noble

[ Original Description ]
After discussion between Intel and Canonical’s security teams, we are in agreement that Spectre no longer needs to be mitigated for the GPU at the Compute Runtime level. At this point, Spectre has been mitigated in the kernel, and a clear warning from the Compute Runtime build serves as a notification for those running modified kernels without those patches. For these reasons, we feel that Spectre mitigations in Compute Runtime no longer offer enough security impact to justify the current performance tradeoff.

Intel themselves have enabled this flag in their builds available on their Github release page upstream.

PPA: https://launchpad.net/~mckeesh/+archive/ubuntu/lp2110131

[Andreas Hasenack (ahasenack)]

Sponsored the second debdiff, with a small changelog modification in the text and the version:

diff --git a/debian/changelog b/debian/changelog
index c684de50..336101d7 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,9 @@
+intel-compute-runtime (24.52.32224.13-0ubuntu4) questing; urgency=medium
+
+ * d/rules: Disable GPU Spectre mitigations (LP: #2110131)
+
+ -- Shane McKee <email address hidden> Wed, 07 May 2025 18:06:08 +0400
+
 intel-compute-runtime (24.52.32224.13-0ubuntu3) plucky; urgency=medium

   * Backport patch to add Battlemage PCI ID 0xE211 (LP: #2106038)
diff --git a/debian/rules b/debian/rules
index 24d492ac..c050fff2 100755
--- a/debian/rules
+++ b/debian/rules
@@ -10,6 +10,7 @@ override_dh_auto_configure:
        dh_auto_configure -- \
                -DCMAKE_BUILD_TYPE=Release \
                -DSKIP_UNIT_TESTS=1 \
+ -DNEO_DISABLE_MITIGATIONS=TRUE \
                -Wno-dev

 override_dh_gencontrol:

Uploaded to questing:

Uploading intel-compute-runtime_24.52.32224.13-0ubuntu4.dsc
Uploading intel-compute-runtime_24.52.32224.13-0ubuntu4.debian.tar.xz
Uploading intel-compute-runtime_24.52.32224.13-0ubuntu4_source.buildinfo
Uploading intel-compute-runtime_24.52.32224.13-0ubuntu4_source.changes

[Launchpad Janitor (janitor)]

This bug was fixed in the package intel-compute-runtime - 24.52.32224.13-0ubuntu4

---------------
intel-compute-runtime (24.52.32224.13-0ubuntu4) questing; urgency=medium

  * d/rules: Disable GPU Spectre mitigations (LP: #2110131)

 -- Shane McKee <email address hidden> Wed, 07 May 2025 18:06:08 +0400

[Dave Jones (waveform)]

Targetting for SRU to plucky, oracular, and noble

[Shane McKee (mckeesh)]

Uploaded Plucky to a branch: https://code.launchpad.net/~mckeesh/ubuntu/+source/intel-compute-runtime/+git/intel-compute-runtime/+ref/rm_mitigations_plucky/

Package also built successfully in the PPA for Plucky

[Shane McKee (mckeesh)]

Uploaded the oracular version to a branch:
https://code.launchpad.net/~mckeesh/ubuntu/+source/intel-compute-runtime/+git/intel-compute-runtime/+ref/rm_mitigations_oracular

Package built successfully in the PPA