Re: [PATCH] x86/bugs: Restore RETBleed IBRS selection for spectre_v2=on

[Pawan Gupta]

On Tue, Oct 13, 2026 at 11:01:43PM +0000, RoyalOughtness via B4 Relay wrote:
> From: RoyalOughtness <secureblueadmin@xxxxxxxxx>
> 
> On Intel CPUs which are affected by RETBleed and support IBRS but not
> eIBRS, the Spectre v2 mitigation is switched from retpoline to IBRS,
> because IBRS also mitigates RETBleed on these CPUs. Up to v6.15, the
> default (SPECTRE_V2_CMD_AUTO) and spectre_v2=on (SPECTRE_V2_CMD_FORCE)
> shared this selection.
> 
> The restructuring of the spectre_v2 mitigation moved the switch to IBRS
> into spectre_v2_update_mitigation() and made it depend on
> SPECTRE_V2_CMD_AUTO only. With spectre_v2=on these CPUs now stay on
> retpoline, and retbleed_update_mitigation() then sets the RETBleed
> mitigation to none:
> 
>   RETBleed: WARNING: Spectre v2 mitigation leaves CPU vulnerable to RETBleed attacks, data leaks possible!
>   /sys/devices/system/cpu/vulnerabilities/retbleed:Vulnerable
> 
> The same system booted with spectre_v2=auto reports "Mitigation: IBRS".
> So requesting the mitigation to be unconditionally enabled results in
> weaker protection than the default, which contradicts the documented
> meaning of spectre_v2=on.
> 
> Select IBRS for SPECTRE_V2_CMD_FORCE as well, as was done before the
> restructuring.
> 
> Fixes: 480e803dacf8 ("x86/bugs: Restructure spectre_v2 mitigation")
> Cc: stable@xxxxxxxxxxxxxxx
> Assisted-by: Claude:claude-opus-5-5
> Signed-off-by: RoyalOughtness <secureblueadmin@xxxxxxxxx>

(Not sure if this is an acceptable sign-off)

> ---
> How this was found: secureblue, a distribution built on top of Fedora
> Atomic, puts spectre_v2=on on the kernel command line. While auditing it

The change looks correct to me. I believe the intent with spectre_v2=on is
to get the forced-on IBPB for userspace? If so, spectre_v2_user=on would be
more appropriate, also it works around the bug this patch fixes.