Re: [RFC PATCH] x86/bugs: Remove 'force' options for retbleed/ITS

[Nikolay Borisov <nik.borisov@suse.com>]

On 6/26/25 17:40, Peter Zijlstra wrote:
> On Thu, Jun 26, 2025 at 09:27:03AM -0500, David Kaplan wrote:
>> Command line options which force-enable a mitigation on an unaffected
>> processor provide arguably no security value but do create the potential
>> for problems due to the increased set of mitigation interactions.
>>
>> For example, setting "indirect_target_selection=force" on an AMD
>> Retbleed-affected CPU (e.g., Zen2) results in a configuration where the
>> kernel reports that both ITS and Retbleed are mitigated, but Retbleed is
>> not in fact mitigated.  In this configuration, untraining of the retbleed
>> return thunk is enabled but the its_return_thunk is active, rendering the
>> untraining ineffective.
>>
>> It is wrong for the kernel to report that a bug is mitigated when it is
>> not.  While this specific interaction could be directly fixed, the ability
>> to force-enable these bugs creates unneeded complexity, so remove it.
>>
>> If removing these options entirely is unacceptable, perhaps for
>> compatibility reasons, another option could be to only allow forcing on the
>> affected vendor (i.e., only allow forcing ITS on Intel CPUs), which would
>> at least limit the potential interactions that need to be analyzed.
>> Tagging as RFC to prompt discussion on this point.
> 
> Testing; I use these things for testing. Makes I don't have to run on
> affected hardware, I can just force the feature on and inspect the code
> and ensures it runs.
> 
> If you use force, you get to keep all pieces -- no warranties.

I concur, however using force won't always guarantee that the code runs 
though, because there can be other condition that must/must not be met 
i.e trying to run ITS on AMD hw (yeah, yeah I know :) ) also required 
commenting out some checks in patch_retpoline.
>