On Intel systems when retpoline mitigation is enabled for spectre-v2,
retbleed=auto does not enable RSB stuffing. This may make the system
vulnerable to retbleed. Retpoline is not the default mitigation when
IBRS is present, but in virtualized cases a VMM can hide IBRS from
guests, resulting in guest deploying retpoline by default. Even if IBRS
is enumerated, a user can still select spectre_v2=retpoline.
As with other mitigations, mitigate retbleed by default. On Intel
systems when retpoline is enabled, and retbleed mitigation is set to
auto, enable Call Depth Tracking and RSB stuffing i.e. retbleed=stuff
mitigation. For AMD/Hygon auto mode already selects the appropriate
mitigation.
Reported-by: Alyssa Milburn <[email protected]>
Cc: [email protected]
Signed-off-by: Pawan Gupta <[email protected]>
---
v3:
- Rebased to v6.9-rc2
v2: https://lore.kernel.org/r/[email protected]
- Mitigate retbleed by default for spectre_v2=retpoline. (Josh)
- Add the missing ',' in the comment. (Josh)
- Rebased to v6.8-rc4
v1: https://lore.kernel.org/r/[email protected]
---
arch/x86/kernel/cpu/bugs.c | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
index e7ba936d798b..69d8ce58f244 100644
--- a/arch/x86/kernel/cpu/bugs.c
+++ b/arch/x86/kernel/cpu/bugs.c
@@ -1092,11 +1092,17 @@ static void __init retbleed_select_mitigation(void)
else if (IS_ENABLED(CONFIG_MITIGATION_IBPB_ENTRY) &&
boot_cpu_has(X86_FEATURE_IBPB))
retbleed_mitigation = RETBLEED_MITIGATION_IBPB;
+ } else if (boot_cpu_data.x86_vendor == X86_VENDOR_INTEL &&
+ spectre_v2_enabled == SPECTRE_V2_RETPOLINE) {
+ if (IS_ENABLED(CONFIG_CALL_DEPTH_TRACKING))
+ retbleed_mitigation = RETBLEED_MITIGATION_STUFF;
+ else
+ pr_err("WARNING: Retpoline enabled, but kernel not compiled with CALL_DEPTH_TRACKING.\n");
}
/*
- * The Intel mitigation (IBRS or eIBRS) was already selected in
- * spectre_v2_select_mitigation(). 'retbleed_mitigation' will
+ * If Intel mitigation (IBRS or eIBRS) was already selected in
+ * spectre_v2_select_mitigation(), 'retbleed_mitigation' will
* be set accordingly below.
*/
---
base-commit: 39cd87c4eb2b893354f3b850f916353f2658ae6f
change-id: 20240208-retbleed-auto-stuff-53e0fa91305e
On 3.04.24 г. 8:54 ч., Pawan Gupta wrote:
> On Intel systems when retpoline mitigation is enabled for spectre-v2,
> retbleed=auto does not enable RSB stuffing. This may make the system
> vulnerable to retbleed. Retpoline is not the default mitigation when
> IBRS is present, but in virtualized cases a VMM can hide IBRS from
> guests, resulting in guest deploying retpoline by default. Even if IBRS
> is enumerated, a user can still select spectre_v2=retpoline.
>
> As with other mitigations, mitigate retbleed by default. On Intel
> systems when retpoline is enabled, and retbleed mitigation is set to
> auto, enable Call Depth Tracking and RSB stuffing i.e. retbleed=stuff
> mitigation. For AMD/Hygon auto mode already selects the appropriate
> mitigation.
>
> Reported-by: Alyssa Milburn <[email protected]>
> Cc: [email protected]
> Signed-off-by: Pawan Gupta <[email protected]>
Reviewed-by: Nikolay Borisov <[email protected]>
> ---
> v3:
> - Rebased to v6.9-rc2
>
> v2: https://lore.kernel.org/r/[email protected]
> - Mitigate retbleed by default for spectre_v2=retpoline. (Josh)
> - Add the missing ',' in the comment. (Josh)
> - Rebased to v6.8-rc4
>
> v1: https://lore.kernel.org/r/[email protected]
> ---
> arch/x86/kernel/cpu/bugs.c | 10 ++++++++--
> 1 file changed, 8 insertions(+), 2 deletions(-)
>
> diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
> index e7ba936d798b..69d8ce58f244 100644
> --- a/arch/x86/kernel/cpu/bugs.c
> +++ b/arch/x86/kernel/cpu/bugs.c
> @@ -1092,11 +1092,17 @@ static void __init retbleed_select_mitigation(void)
> else if (IS_ENABLED(CONFIG_MITIGATION_IBPB_ENTRY) &&
> boot_cpu_has(X86_FEATURE_IBPB))
> retbleed_mitigation = RETBLEED_MITIGATION_IBPB;
> + } else if (boot_cpu_data.x86_vendor == X86_VENDOR_INTEL &&
> + spectre_v2_enabled == SPECTRE_V2_RETPOLINE) {
> + if (IS_ENABLED(CONFIG_CALL_DEPTH_TRACKING))
> + retbleed_mitigation = RETBLEED_MITIGATION_STUFF;
> + else
> + pr_err("WARNING: Retpoline enabled, but kernel not compiled with CALL_DEPTH_TRACKING.\n");
> }
>
> /*
> - * The Intel mitigation (IBRS or eIBRS) was already selected in
> - * spectre_v2_select_mitigation(). 'retbleed_mitigation' will
> + * If Intel mitigation (IBRS or eIBRS) was already selected in
> + * spectre_v2_select_mitigation(), 'retbleed_mitigation' will
> * be set accordingly below.
> */
>
nit: I think those outer 'ifs' might be a bit easier to grok if
they are turned into a switch:
26 do_cmd_auto:
25 case RETBLEED_CMD_AUTO:
24 switch(boot_cpu_data.x86_vendor) {
23 case X86_VENDOR_AMD:
22 case X86_VENDOR_HYGON:
21 if (IS_ENABLED(CONFIG_MITIGATION_UNRET_ENTRY))
20 retbleed_mitigation = RETBLEED_MITIGATION_UNRET;
19 else if (IS_ENABLED(CONFIG_MITIGATION_IBPB_ENTRY) &&
18 boot_cpu_has(X86_FEATURE_IBPB))
17 retbleed_mitigation = RETBLEED_MITIGATION_IBPB;
16 break;
15 case X86_VENDOR_INTEL:
14 if (spectre_v2_enabled == SPECTRE_V2_RETPOLINE) {
13 if (IS_ENABLED(CONFIG_CALL_DEPTH_TRACKING))
12 retbleed_mitigation = RETBLEED_MITIGATION_STUFF;
11 else
10 pr_err("WARNING: Retpoline enabled, but kernel not compiled with CALL_DEPTH_TRACKING.\n");
9 }
8
7 /*
6 * The Intel mitigation (IBRS or eIBRS) was already selected in
5 * spectre_v2_select_mitigation(). 'retbleed_mitigation' will
4 * be set accordingly below.
3 */
2 default:
1 break;
1112 }
>
> ---
> base-commit: 39cd87c4eb2b893354f3b850f916353f2658ae6f
> change-id: 20240208-retbleed-auto-stuff-53e0fa91305e
>
>
On Wed, Apr 03, 2024 at 05:32:40PM +0300, Nikolay Borisov wrote:
>
>
> On 3.04.24 г. 8:54 ч., Pawan Gupta wrote:
> > On Intel systems when retpoline mitigation is enabled for spectre-v2,
> > retbleed=auto does not enable RSB stuffing. This may make the system
> > vulnerable to retbleed. Retpoline is not the default mitigation when
> > IBRS is present, but in virtualized cases a VMM can hide IBRS from
> > guests, resulting in guest deploying retpoline by default. Even if IBRS
> > is enumerated, a user can still select spectre_v2=retpoline.
> >
> > As with other mitigations, mitigate retbleed by default. On Intel
> > systems when retpoline is enabled, and retbleed mitigation is set to
> > auto, enable Call Depth Tracking and RSB stuffing i.e. retbleed=stuff
> > mitigation. For AMD/Hygon auto mode already selects the appropriate
> > mitigation.
> >
> > Reported-by: Alyssa Milburn <[email protected]>
> > Cc: [email protected]
> > Signed-off-by: Pawan Gupta <[email protected]>
>
> Reviewed-by: Nikolay Borisov <[email protected]>
Thanks.