S390 Architecture Gets Spectre Mitigation With "Expoline" & Other Patches

Even IBM System/390 "Linux on z" systems are prone to the Spectre security vulnerability. But with Linux 4.16, s390 is getting its initial Spectre Variant One and Two mitigation.

Linux on x86_64 has Retpoline for mitigating Spectre Variant Two while the s390 form of this is being called Expoline. The s390 architecture has no return instruction, so it's not "return trampolines" (Retpolines) but rather like an Execute Trampoline (Expoline).

The Expoline implementation for indirect branches uses an execute-type instruction with the indirect branch as the target of the execute, thereby turning off prediction for the indirect branch. There is also patches to scrub registers that contain user-controlled values to prevent the speculative use of those values.

The s390 code also has an array_index_mask_nospec function for defending against Spectre Variant One. There are also patches for new PPA-12/PPA-13 instructions to run the kernel and/or user-space with reduced branch prediction.

The complete list of s390 architecture changes for the Linux 4.16 kernel merge window can be found via this pull request.