harden indirect calls against BHI attacks

[Thadeu Lima de Souza Cascardo]

[Impact]
Branch History Injection is made easier when all indirect calls are funneled through very few points where the retpolines were. By replacing the retpoline jumps by indirect calls whenever retpolines are disabled, BHI attacks are more difficult to execute as the BTB is not as fixed as before.

[Fixes]
Though there are fixes that allow retpoline,lfence to be directly replaced in the indirect calls, given that mitigation is not recommended for most of the situations, that hardening is not as important as the one that works for the spectre_v2=off option (the default one for systems with eIBRS). This latter one is present starting with 5.13, but backporting to 5.4 might be a good measure.

[Ubuntu Kernel Bot (ubuntu-kernel-bot)]

This bug is missing log files that will aid in diagnosing the problem. While running an Ubuntu kernel (not a mainline or third-party kernel) please enter the following command in a terminal window:

apport-collect 1967579

and then change the status of the bug to 'Confirmed'.

If, due to the nature of the issue you have encountered, you are unable to run this command, please add a comment stating that fact and change the bug status to 'Confirmed'.

This change has been made by an automated script, maintained by the Ubuntu Kernel Team.

[Ubuntu Kernel Bot (ubuntu-kernel-bot)]

This bug is awaiting verification that the linux-lowlatency/5.15.0-27.28 kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-jammy' to 'verification-done-jammy'. If the problem still exists, change the tag 'verification-needed-jammy' to 'verification-failed-jammy'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux - 5.15.0-27.28

---------------
linux (5.15.0-27.28) jammy; urgency=medium

  * jammy/linux: 5.15.0-27.28 -proposed tracker (LP: #1968954)

 -- Paolo Pisati <email address hidden> Thu, 14 Apr 2022 06:46:57 +0200

[Juerg Haefliger (juergh)]

Fix released so adding tag 'verification-done-jammy'.

[Ubuntu Kernel Bot (ubuntu-kernel-bot)]

This bug is awaiting verification that the linux-hwe-5.15/5.15.0-32.33~20.04.1 kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-focal' to 'verification-done-focal'. If the problem still exists, change the tag 'verification-needed-focal' to 'verification-failed-focal'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!