Received-SPF: pass (google.com: domain of linux-kernel+bounces-129970-linux.lists.archive=gmail.com@vger.kernel.org designates 147.75.48.161 as permitted sender) client-ip=147.75.48.161;
Message-ID: <6ffcc9bd-039a-4ab4-a84d-eeedbc6fa1cc@suse.com>
Date: Wed, 3 Apr 2024 17:32:40 +0300
Precedence: bulk
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
Subject: Re: [PATCH v3] x86/bugs: Default retbleed to =stuff when retpoline is
 enabled
To: Pawan Gupta <pawan.kumar.gupta@linux.intel.com>,
 Thomas Gleixner <tglx@linutronix.de>, Borislav Petkov <bp@alien8.de>,
 Peter Zijlstra <peterz@infradead.org>, Josh Poimboeuf <jpoimboe@kernel.org>,
 Ingo Molnar <mingo@redhat.com>, Dave Hansen <dave.hansen@linux.intel.com>,
 x86@kernel.org, "H. Peter Anvin" <hpa@zytor.com>
Cc: Daniel Sneddon <daniel.sneddon@linux.intel.com>,
 antonio.gomez.iglesias@linux.intel.com, alyssa.milburn@linux.intel.com,
 andrew.cooper3@citrix.com, linux-kernel@vger.kernel.org,
 Alyssa Milburn <alyssa.milburn@intel.com>, stable@kernel.org
References: <20240402-retbleed-auto-stuff-v3-1-e65f275a8ec8@linux.intel.com>
From: Nikolay Borisov <nik.borisov@suse.com>
Content-Language: en-US
In-Reply-To: <20240402-retbleed-auto-stuff-v3-1-e65f275a8ec8@linux.intel.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit


On 3.04.24 г. 8:54 ч., Pawan Gupta wrote:
> On Intel systems when retpoline mitigation is enabled for spectre-v2,
> retbleed=auto does not enable RSB stuffing. This may make the system
> vulnerable to retbleed. Retpoline is not the default mitigation when
> IBRS is present, but in virtualized cases a VMM can hide IBRS from
> guests, resulting in guest deploying retpoline by default. Even if IBRS
> is enumerated, a user can still select spectre_v2=retpoline.
> 
> As with other mitigations, mitigate retbleed by default. On Intel
> systems when retpoline is enabled, and retbleed mitigation is set to
> auto, enable Call Depth Tracking and RSB stuffing i.e. retbleed=stuff
> mitigation. For AMD/Hygon auto mode already selects the appropriate
> mitigation.
> 
> Reported-by: Alyssa Milburn <alyssa.milburn@intel.com>
> Cc: stable@kernel.org
> Signed-off-by: Pawan Gupta <pawan.kumar.gupta@linux.intel.com>

Reviewed-by: Nikolay Borisov <nik.borisov@suse.com>
> ---
> v3:
> - Rebased to v6.9-rc2
> 
> v2: https://lore.kernel.org/r/20240212-retbleed-auto-stuff-v2-1-89401649341a@linux.intel.com
> - Mitigate retbleed by default for spectre_v2=retpoline. (Josh)
> - Add the missing ',' in the comment. (Josh)
> - Rebased to v6.8-rc4
> 
> v1: https://lore.kernel.org/r/20240208-retbleed-auto-stuff-v1-1-6f12e513868f@linux.intel.com
> ---
>   arch/x86/kernel/cpu/bugs.c | 10 ++++++++--
>   1 file changed, 8 insertions(+), 2 deletions(-)
> 
> diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
> index e7ba936d798b..69d8ce58f244 100644
> --- a/arch/x86/kernel/cpu/bugs.c
> +++ b/arch/x86/kernel/cpu/bugs.c
> @@ -1092,11 +1092,17 @@ static void __init retbleed_select_mitigation(void)
>   			else if (IS_ENABLED(CONFIG_MITIGATION_IBPB_ENTRY) &&
>   				 boot_cpu_has(X86_FEATURE_IBPB))
>   				retbleed_mitigation = RETBLEED_MITIGATION_IBPB;
> +		} else if (boot_cpu_data.x86_vendor == X86_VENDOR_INTEL &&
> +			   spectre_v2_enabled == SPECTRE_V2_RETPOLINE) {
> +			if (IS_ENABLED(CONFIG_CALL_DEPTH_TRACKING))
> +				retbleed_mitigation = RETBLEED_MITIGATION_STUFF;
> +			else
> +				pr_err("WARNING: Retpoline enabled, but kernel not compiled with CALL_DEPTH_TRACKING.\n");
>   		}
>   
>   		/*
> -		 * The Intel mitigation (IBRS or eIBRS) was already selected in
> -		 * spectre_v2_select_mitigation().  'retbleed_mitigation' will
> +		 * If Intel mitigation (IBRS or eIBRS) was already selected in
> +		 * spectre_v2_select_mitigation(),  'retbleed_mitigation' will
>   		 * be set accordingly below.
>   		 */
>   

nit: I think those outer 'ifs' might be a bit easier to grok if
they are turned into a switch:


26 do_cmd_auto:
     25         case RETBLEED_CMD_AUTO:
     24                 switch(boot_cpu_data.x86_vendor) {
     23                 case X86_VENDOR_AMD:
     22                 case X86_VENDOR_HYGON:
     21                         if (IS_ENABLED(CONFIG_MITIGATION_UNRET_ENTRY))
     20                                 retbleed_mitigation = RETBLEED_MITIGATION_UNRET;
     19                         else if (IS_ENABLED(CONFIG_MITIGATION_IBPB_ENTRY) &&
     18                                  boot_cpu_has(X86_FEATURE_IBPB))
     17                                 retbleed_mitigation = RETBLEED_MITIGATION_IBPB;
     16                         break;
     15                 case X86_VENDOR_INTEL:
     14                         if (spectre_v2_enabled == SPECTRE_V2_RETPOLINE) {
     13                                 if (IS_ENABLED(CONFIG_CALL_DEPTH_TRACKING))
     12                                         retbleed_mitigation = RETBLEED_MITIGATION_STUFF;
     11                                 else
     10                                         pr_err("WARNING: Retpoline enabled, but kernel not compiled with CALL_DEPTH_TRACKING.\n");
      9                         }
      8
      7                         /*
      6                          * The Intel mitigation (IBRS or eIBRS) was already selected in
      5                          * spectre_v2_select_mitigation().  'retbleed_mitigation' will
      4                          * be set accordingly below.
      3                          */
      2                 default:
      1                         break;
   1112                 }


> 
> ---
> base-commit: 39cd87c4eb2b893354f3b850f916353f2658ae6f
> change-id: 20240208-retbleed-auto-stuff-53e0fa91305e
> 
>