linux-kernel - Re: [RFC PATCH] x86/bugs: Remove 'force' options for retbleed/ITS

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250626144047.GN1613200@noisy.programming.kicks-ass.net>
Date: Thu, 26 Jun 2025 16:40:47 +0200
From: Peter Zijlstra <peterz@...radead.org>
To: David Kaplan <david.kaplan@....com>
Cc: Thomas Gleixner <tglx@...utronix.de>, Borislav Petkov <bp@...en8.de>,
	Josh Poimboeuf <jpoimboe@...nel.org>,
	Pawan Gupta <pawan.kumar.gupta@...ux.intel.com>,
	Ingo Molnar <mingo@...hat.com>,
	Dave Hansen <dave.hansen@...ux.intel.com>, x86@...nel.org,
	"H. Peter Anvin" <hpa@...or.com>, linux-kernel@...r.kernel.org
Subject: Re: [RFC PATCH] x86/bugs: Remove 'force' options for retbleed/ITS

On Thu, Jun 26, 2025 at 09:27:03AM -0500, David Kaplan wrote:
> Command line options which force-enable a mitigation on an unaffected
> processor provide arguably no security value but do create the potential
> for problems due to the increased set of mitigation interactions.
> 
> For example, setting "indirect_target_selection=force" on an AMD
> Retbleed-affected CPU (e.g., Zen2) results in a configuration where the
> kernel reports that both ITS and Retbleed are mitigated, but Retbleed is
> not in fact mitigated.  In this configuration, untraining of the retbleed
> return thunk is enabled but the its_return_thunk is active, rendering the
> untraining ineffective.
> 
> It is wrong for the kernel to report that a bug is mitigated when it is
> not.  While this specific interaction could be directly fixed, the ability
> to force-enable these bugs creates unneeded complexity, so remove it.
> 
> If removing these options entirely is unacceptable, perhaps for
> compatibility reasons, another option could be to only allow forcing on the
> affected vendor (i.e., only allow forcing ITS on Intel CPUs), which would
> at least limit the potential interactions that need to be analyzed.
> Tagging as RFC to prompt discussion on this point.

Testing; I use these things for testing. Makes I don't have to run on
affected hardware, I can just force the feature on and inspect the code
and ensures it runs.

If you use force, you get to keep all pieces -- no warranties.