system calls are vulnerable to Spectre V1 attacks on CPUs with speculative execution

[andrewboie]

Describe the bug
This paper is a good summary:
https://arxiv.org/pdf/1902.05178.pdf

We have, either in-tree or in code review, mitigations for Meltdown, Foreshadow, Spectre V2, Spectre V4. Although recent research has a poor prognosis on ever mitigating all of these attacks on affected CPUs, we would like to at least ensure that bounds-check-bypass style attacks (Spectre V1) cannot be performed with system call arguments which index some array.

[andrewboie]

I spent much time looking at system calls.

For drivers, in my analysis the only APIs that seemed concerning were:

• DMA driver channel argument
• GPIO pin arguments
• Flash driver offsets/lengths

For x86 minnowboard and upsquared apollo lake, didn't find any relevant drivers except apollo lake GPIO, which I patched.

Socket syscall fds also needed to be patched.