arch/x86/kernel/cpu/bugs.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
On Intel systems when retpoline mitigation is enabled for spectre-v2,
retbleed=auto does not enable RSB stuffing. This may make the system
vulnerable to retbleed. Retpoline is not the default mitigation when
IBRS is present, but in virtualized cases a VMM can hide IBRS from
guests, resulting in guest deploying retpoline by default. Even if IBRS
is enumerated, a user can still select spectre_v2=retpoline.
As with other mitigations, mitigate retbleed by default. On Intel
systems when retpoline is enabled, and retbleed mitigation is set to
auto, enable Call Depth Tracking and RSB stuffing i.e. retbleed=stuff
mitigation. For AMD/Hygon auto mode already selects the appropriate
mitigation.
Reported-by: Alyssa Milburn <alyssa.milburn@intel.com>
Cc: stable@kernel.org
Signed-off-by: Pawan Gupta <pawan.kumar.gupta@linux.intel.com>
---
v3:
- Rebased to v6.9-rc2
v2: https://lore.kernel.org/r/20240212-retbleed-auto-stuff-v2-1-89401649341a@linux.intel.com
- Mitigate retbleed by default for spectre_v2=retpoline. (Josh)
- Add the missing ',' in the comment. (Josh)
- Rebased to v6.8-rc4
v1: https://lore.kernel.org/r/20240208-retbleed-auto-stuff-v1-1-6f12e513868f@linux.intel.com
---
arch/x86/kernel/cpu/bugs.c | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
index e7ba936d798b..69d8ce58f244 100644
--- a/arch/x86/kernel/cpu/bugs.c
+++ b/arch/x86/kernel/cpu/bugs.c
@@ -1092,11 +1092,17 @@ static void __init retbleed_select_mitigation(void)
else if (IS_ENABLED(CONFIG_MITIGATION_IBPB_ENTRY) &&
boot_cpu_has(X86_FEATURE_IBPB))
retbleed_mitigation = RETBLEED_MITIGATION_IBPB;
+ } else if (boot_cpu_data.x86_vendor == X86_VENDOR_INTEL &&
+ spectre_v2_enabled == SPECTRE_V2_RETPOLINE) {
+ if (IS_ENABLED(CONFIG_CALL_DEPTH_TRACKING))
+ retbleed_mitigation = RETBLEED_MITIGATION_STUFF;
+ else
+ pr_err("WARNING: Retpoline enabled, but kernel not compiled with CALL_DEPTH_TRACKING.\n");
}
/*
- * The Intel mitigation (IBRS or eIBRS) was already selected in
- * spectre_v2_select_mitigation(). 'retbleed_mitigation' will
+ * If Intel mitigation (IBRS or eIBRS) was already selected in
+ * spectre_v2_select_mitigation(), 'retbleed_mitigation' will
* be set accordingly below.
*/
---
base-commit: 39cd87c4eb2b893354f3b850f916353f2658ae6f
change-id: 20240208-retbleed-auto-stuff-53e0fa91305e
On 3.04.24 г. 8:54 ч., Pawan Gupta wrote: > On Intel systems when retpoline mitigation is enabled for spectre-v2, > retbleed=auto does not enable RSB stuffing. This may make the system > vulnerable to retbleed. Retpoline is not the default mitigation when > IBRS is present, but in virtualized cases a VMM can hide IBRS from > guests, resulting in guest deploying retpoline by default. Even if IBRS > is enumerated, a user can still select spectre_v2=retpoline. > > As with other mitigations, mitigate retbleed by default. On Intel > systems when retpoline is enabled, and retbleed mitigation is set to > auto, enable Call Depth Tracking and RSB stuffing i.e. retbleed=stuff > mitigation. For AMD/Hygon auto mode already selects the appropriate > mitigation. > > Reported-by: Alyssa Milburn <alyssa.milburn@intel.com> > Cc: stable@kernel.org > Signed-off-by: Pawan Gupta <pawan.kumar.gupta@linux.intel.com> Reviewed-by: Nikolay Borisov <nik.borisov@suse.com> > --- > v3: > - Rebased to v6.9-rc2 > > v2: https://lore.kernel.org/r/20240212-retbleed-auto-stuff-v2-1-89401649341a@linux.intel.com > - Mitigate retbleed by default for spectre_v2=retpoline. (Josh) > - Add the missing ',' in the comment. (Josh) > - Rebased to v6.8-rc4 > > v1: https://lore.kernel.org/r/20240208-retbleed-auto-stuff-v1-1-6f12e513868f@linux.intel.com > --- > arch/x86/kernel/cpu/bugs.c | 10 ++++++++-- > 1 file changed, 8 insertions(+), 2 deletions(-) > > diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c > index e7ba936d798b..69d8ce58f244 100644 > --- a/arch/x86/kernel/cpu/bugs.c > +++ b/arch/x86/kernel/cpu/bugs.c > @@ -1092,11 +1092,17 @@ static void __init retbleed_select_mitigation(void) > else if (IS_ENABLED(CONFIG_MITIGATION_IBPB_ENTRY) && > boot_cpu_has(X86_FEATURE_IBPB)) > retbleed_mitigation = RETBLEED_MITIGATION_IBPB; > + } else if (boot_cpu_data.x86_vendor == X86_VENDOR_INTEL && > + spectre_v2_enabled == SPECTRE_V2_RETPOLINE) { > + if (IS_ENABLED(CONFIG_CALL_DEPTH_TRACKING)) > + retbleed_mitigation = RETBLEED_MITIGATION_STUFF; > + else > + pr_err("WARNING: Retpoline enabled, but kernel not compiled with CALL_DEPTH_TRACKING.\n"); > } > > /* > - * The Intel mitigation (IBRS or eIBRS) was already selected in > - * spectre_v2_select_mitigation(). 'retbleed_mitigation' will > + * If Intel mitigation (IBRS or eIBRS) was already selected in > + * spectre_v2_select_mitigation(), 'retbleed_mitigation' will > * be set accordingly below. > */ > nit: I think those outer 'ifs' might be a bit easier to grok if they are turned into a switch: 26 do_cmd_auto: 25 case RETBLEED_CMD_AUTO: 24 switch(boot_cpu_data.x86_vendor) { 23 case X86_VENDOR_AMD: 22 case X86_VENDOR_HYGON: 21 if (IS_ENABLED(CONFIG_MITIGATION_UNRET_ENTRY)) 20 retbleed_mitigation = RETBLEED_MITIGATION_UNRET; 19 else if (IS_ENABLED(CONFIG_MITIGATION_IBPB_ENTRY) && 18 boot_cpu_has(X86_FEATURE_IBPB)) 17 retbleed_mitigation = RETBLEED_MITIGATION_IBPB; 16 break; 15 case X86_VENDOR_INTEL: 14 if (spectre_v2_enabled == SPECTRE_V2_RETPOLINE) { 13 if (IS_ENABLED(CONFIG_CALL_DEPTH_TRACKING)) 12 retbleed_mitigation = RETBLEED_MITIGATION_STUFF; 11 else 10 pr_err("WARNING: Retpoline enabled, but kernel not compiled with CALL_DEPTH_TRACKING.\n"); 9 } 8 7 /* 6 * The Intel mitigation (IBRS or eIBRS) was already selected in 5 * spectre_v2_select_mitigation(). 'retbleed_mitigation' will 4 * be set accordingly below. 3 */ 2 default: 1 break; 1112 } > > --- > base-commit: 39cd87c4eb2b893354f3b850f916353f2658ae6f > change-id: 20240208-retbleed-auto-stuff-53e0fa91305e > >
On Wed, Apr 03, 2024 at 05:32:40PM +0300, Nikolay Borisov wrote: > > > On 3.04.24 г. 8:54 ч., Pawan Gupta wrote: > > On Intel systems when retpoline mitigation is enabled for spectre-v2, > > retbleed=auto does not enable RSB stuffing. This may make the system > > vulnerable to retbleed. Retpoline is not the default mitigation when > > IBRS is present, but in virtualized cases a VMM can hide IBRS from > > guests, resulting in guest deploying retpoline by default. Even if IBRS > > is enumerated, a user can still select spectre_v2=retpoline. > > > > As with other mitigations, mitigate retbleed by default. On Intel > > systems when retpoline is enabled, and retbleed mitigation is set to > > auto, enable Call Depth Tracking and RSB stuffing i.e. retbleed=stuff > > mitigation. For AMD/Hygon auto mode already selects the appropriate > > mitigation. > > > > Reported-by: Alyssa Milburn <alyssa.milburn@intel.com> > > Cc: stable@kernel.org > > Signed-off-by: Pawan Gupta <pawan.kumar.gupta@linux.intel.com> > > Reviewed-by: Nikolay Borisov <nik.borisov@suse.com> Thanks.
© 2016 - 2024 Red Hat, Inc.