[PATCH v2] x86/bugs: Default retbleed to =stuff when retpoline is enabled

[PATCH v2] x86/bugs: Default retbleed to =stuff when retpoline is enabled

[Pawan Gupta]

On Intel systems when retpoline mitigation is enabled for spectre-v2,
retbleed=auto does not enable RSB stuffing. This may make the system
vulnerable to retbleed. Retpoline is not the default mitigation when
IBRS is present, but in virtualized cases a VMM can hide IBRS from
guests, resulting in guest deploying retpoline by default. Even if IBRS
is enumerated, a user can still select spectre_v2=retpoline.

As with other mitigations, mitigate retbleed by default. On Intel
systems when retpoline is enabled, and retbleed mitigation is set to
auto, enable Call Depth Tracking and RSB stuffing i.e. retbleed=stuff
mitigation. For AMD/Hygon auto mode already selects the appropriate
mitigation.

Reported-by: Alyssa Milburn <alyssa.milburn@intel.com>
Cc: stable@kernel.org
Signed-off-by: Pawan Gupta <pawan.kumar.gupta@linux.intel.com>
---
v2:
- Mitigate retbleed by default for spectre_v2=retpoline. (Josh)
- Add the missing ',' in the comment. (Josh)
- Rebased to v6.8-rc4

v1: https://lore.kernel.org/r/20240208-retbleed-auto-stuff-v1-1-6f12e513868f@linux.intel.com
---
 arch/x86/kernel/cpu/bugs.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
index bb0ab8466b91..3aa473b08d6e 100644
--- a/arch/x86/kernel/cpu/bugs.c
+++ b/arch/x86/kernel/cpu/bugs.c
@@ -1025,11 +1025,17 @@ static void __init retbleed_select_mitigation(void)
 				retbleed_mitigation = RETBLEED_MITIGATION_UNRET;
 			else if (IS_ENABLED(CONFIG_CPU_IBPB_ENTRY) && boot_cpu_has(X86_FEATURE_IBPB))
 				retbleed_mitigation = RETBLEED_MITIGATION_IBPB;
+		} else if (boot_cpu_data.x86_vendor == X86_VENDOR_INTEL &&
+			   spectre_v2_enabled == SPECTRE_V2_RETPOLINE) {
+			if (IS_ENABLED(CONFIG_CALL_DEPTH_TRACKING))
+				retbleed_mitigation = RETBLEED_MITIGATION_STUFF;
+			else
+				pr_err("WARNING: Retpoline enabled, but kernel not compiled with CALL_DEPTH_TRACKING.\n");
 		}
 
 		/*
-		 * The Intel mitigation (IBRS or eIBRS) was already selected in
-		 * spectre_v2_select_mitigation().  'retbleed_mitigation' will
+		 * If Intel mitigation (IBRS or eIBRS) was already selected in
+		 * spectre_v2_select_mitigation(),  'retbleed_mitigation' will
 		 * be set accordingly below.
 		 */
 

---
base-commit: 841c35169323cd833294798e58b9bf63fa4fa1de
change-id: 20240208-retbleed-auto-stuff-53e0fa91305e

[PATCH v2] x86/bugs: Default retbleed to =stuff when retpoline is enabled

[Pawan Gupta]

On Intel systems when retpoline mitigation is enabled for spectre-v2,
retbleed=auto does not enable RSB stuffing. This may make the system
vulnerable to retbleed. Retpoline is not the default mitigation when
IBRS is present, but in virtualized cases a VMM can hide IBRS from
guests, resulting in guest deploying retpoline by default. Even if IBRS
is enumerated, a user can still select spectre_v2=retpoline.

As with other mitigations, mitigate retbleed by default. On Intel
systems when retpoline is enabled, and retbleed mitigation is set to
auto, enable Call Depth Tracking and RSB stuffing i.e. retbleed=stuff
mitigation. For AMD/Hygon auto mode already selects the appropriate
mitigation.

Reported-by: Alyssa Milburn <alyssa.milburn@intel.com>
Cc: stable@kernel.org
Signed-off-by: Pawan Gupta <pawan.kumar.gupta@linux.intel.com>
---
v2:
- Mitigate retbleed by default for spectre_v2=retpoline. (Josh)
- Add the missing ',' in the comment. (Josh)
- Rebased to v6.8-rc4

v1: https://lore.kernel.org/r/20240208-retbleed-auto-stuff-v1-1-6f12e513868f@linux.intel.com
---
 arch/x86/kernel/cpu/bugs.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
index bb0ab8466b91..3aa473b08d6e 100644
--- a/arch/x86/kernel/cpu/bugs.c
+++ b/arch/x86/kernel/cpu/bugs.c
@@ -1025,11 +1025,17 @@ static void __init retbleed_select_mitigation(void)
 				retbleed_mitigation = RETBLEED_MITIGATION_UNRET;
 			else if (IS_ENABLED(CONFIG_CPU_IBPB_ENTRY) && boot_cpu_has(X86_FEATURE_IBPB))
 				retbleed_mitigation = RETBLEED_MITIGATION_IBPB;
+		} else if (boot_cpu_data.x86_vendor == X86_VENDOR_INTEL &&
+			   spectre_v2_enabled == SPECTRE_V2_RETPOLINE) {
+			if (IS_ENABLED(CONFIG_CALL_DEPTH_TRACKING))
+				retbleed_mitigation = RETBLEED_MITIGATION_STUFF;
+			else
+				pr_err("WARNING: Retpoline enabled, but kernel not compiled with CALL_DEPTH_TRACKING.\n");
 		}
 
 		/*
-		 * The Intel mitigation (IBRS or eIBRS) was already selected in
-		 * spectre_v2_select_mitigation().  'retbleed_mitigation' will
+		 * If Intel mitigation (IBRS or eIBRS) was already selected in
+		 * spectre_v2_select_mitigation(),  'retbleed_mitigation' will
 		 * be set accordingly below.
 		 */
 

---
base-commit: 841c35169323cd833294798e58b9bf63fa4fa1de
change-id: 20240208-retbleed-auto-stuff-53e0fa91305e

Re: [PATCH v2] x86/bugs: Default retbleed to =stuff when retpoline is enabled

[Pawan Gupta]

On Mon, Feb 12, 2024 at 05:23:21PM -0800, Pawan Gupta wrote:
> On Intel systems when retpoline mitigation is enabled for spectre-v2,
> retbleed=auto does not enable RSB stuffing. This may make the system
> vulnerable to retbleed. Retpoline is not the default mitigation when
> IBRS is present, but in virtualized cases a VMM can hide IBRS from
> guests, resulting in guest deploying retpoline by default. Even if IBRS
> is enumerated, a user can still select spectre_v2=retpoline.
> 
> As with other mitigations, mitigate retbleed by default. On Intel
> systems when retpoline is enabled, and retbleed mitigation is set to
> auto, enable Call Depth Tracking and RSB stuffing i.e. retbleed=stuff
> mitigation. For AMD/Hygon auto mode already selects the appropriate
> mitigation.

By mistake I sent this patch twice, please ignore the duplicate:

  https://lore.kernel.org/lkml/20240213042453.6j01GG4kjjcdTev7AtniyPHPRNH3RFHNGgVJ5nIXho4@z/