Re: [PATCH] x86/bugs: Restore RETBleed IBRS selection for spectre_v2=on

[secureblueadmin]

spectre_v2_user=on is more appropriate with the current buggy behavior, but it doesn't work around the bug per se because if spectre_v2=on, the bug persists no matter what. spectre_v2_user=on only helps if spectre_v2=auto. So the bug remains present for all spectre_v2=on users.

On Tuesday, October 13th, 2026 at 11:46 PM, Pawan Gupta <pawan.kumar.gupta@xxxxxxxxxxxxxxx> wrote:

> On Tue, Oct 13, 2026 at 11:01:43PM +0000, RoyalOughtness via B4 Relay wrote:
> > From: RoyalOughtness <secureblueadmin@xxxxxxxxx>
> >
> > On Intel CPUs which are affected by RETBleed and support IBRS but not
> > eIBRS, the Spectre v2 mitigation is switched from retpoline to IBRS,
> > because IBRS also mitigates RETBleed on these CPUs. Up to v6.15, the
> > default (SPECTRE_V2_CMD_AUTO) and spectre_v2=on (SPECTRE_V2_CMD_FORCE)
> > shared this selection.
> >
> > The restructuring of the spectre_v2 mitigation moved the switch to IBRS
> > into spectre_v2_update_mitigation() and made it depend on
> > SPECTRE_V2_CMD_AUTO only. With spectre_v2=on these CPUs now stay on
> > retpoline, and retbleed_update_mitigation() then sets the RETBleed
> > mitigation to none:
> >
> >   RETBleed: WARNING: Spectre v2 mitigation leaves CPU vulnerable to RETBleed attacks, data leaks possible!
> >   /sys/devices/system/cpu/vulnerabilities/retbleed:Vulnerable
> >
> > The same system booted with spectre_v2=auto reports "Mitigation: IBRS".
> > So requesting the mitigation to be unconditionally enabled results in
> > weaker protection than the default, which contradicts the documented
> > meaning of spectre_v2=on.
> >
> > Select IBRS for SPECTRE_V2_CMD_FORCE as well, as was done before the
> > restructuring.
> >
> > Fixes: 480e803dacf8 ("x86/bugs: Restructure spectre_v2 mitigation")
> > Cc: stable@xxxxxxxxxxxxxxx
> > Assisted-by: Claude:claude-opus-5-5
> > Signed-off-by: RoyalOughtness <secureblueadmin@xxxxxxxxx>
> 
> (Not sure if this is an acceptable sign-off)
> 
> > ---
> > How this was found: secureblue, a distribution built on top of Fedora
> > Atomic, puts spectre_v2=on on the kernel command line. While auditing it
> 
> The change looks correct to me. I believe the intent with spectre_v2=on is
> to get the forced-on IBPB for userspace? If so, spectre_v2_user=on would be
> more appropriate, also it works around the bug this patch fixes.
>