From 166b4f33b02eb74509b66357e57453b924f15608 Mon Sep 17 00:00:00 2001 From: Ben Hutchings Date: Sat, 23 Jul 2022 17:28:13 +0200 Subject: [x86] speculation: Make all RETbleed mitigations depend on X86_64 The mitigations for RETBleed are currently ineffective on i386, but without this they would wrongly be reported as active. --- debian/changelog | 1 + ...tion-make-all-retbleed-mitigations-depend.patch | 56 ++++++++++++++++++++++ debian/patches/series | 1 + 3 files changed, 58 insertions(+) create mode 100644 debian/patches/bugfix/x86/x86-speculation-make-all-retbleed-mitigations-depend.patch diff --git a/debian/changelog b/debian/changelog index cc1ecefaf..fd9aeac29 100644 --- a/debian/changelog +++ b/debian/changelog @@ -794,6 +794,7 @@ linux (5.18.14-1) UNRELEASED; urgency=medium * udeb: Add SCSI device handlers to multipath-modules (Closes: #989079) * linux-source: Update Recommends to include all dependencies for deb-pkg target + * [x86] speculation: Make all RETbleed mitigations depend on X86_64 [ Vincent Blut ] * [armhf] drivers/crypto/caam: Enable CRYPTO_DEV_FSL_CAAM as module diff --git a/debian/patches/bugfix/x86/x86-speculation-make-all-retbleed-mitigations-depend.patch b/debian/patches/bugfix/x86/x86-speculation-make-all-retbleed-mitigations-depend.patch new file mode 100644 index 000000000..a6d04fca8 --- /dev/null +++ b/debian/patches/bugfix/x86/x86-speculation-make-all-retbleed-mitigations-depend.patch @@ -0,0 +1,56 @@ +From: Ben Hutchings +Date: Sat, 23 Jul 2022 16:20:34 +0200 +Subject: x86/speculation: Make all RETbleed mitigations depend on X86_64 +Forwarded: https://lore.kernel.org/lkml/YtwSR3NNsWp1ohfV@decadent.org.uk/T/ + +The mitigations for RETBleed are currently ineffective on x86_32 since +entry_32.S does not use the required macros. However, for an x86_32 +target, the kconfig symbols for them are still enabled by default and +/sys/devices/system/cpu/vulnerabilities/retbleed will wrongly report +that mitigations are in place. + +Make all of these symbols depend on X86_64, and only enable RETHUNK by +default on X86_64. + +Cc: stable@vger.kernel.org +Signed-off-by: Ben Hutchings +--- + arch/x86/Kconfig | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/arch/x86/Kconfig ++++ b/arch/x86/Kconfig +@@ -2469,7 +2469,7 @@ config RETPOLINE + config RETHUNK + bool "Enable return-thunks" + depends on RETPOLINE && CC_HAS_RETURN_THUNK +- default y ++ default y if X86_64 + help + Compile the kernel with the return-thunks compiler option to guard + against kernel-to-user data leaks by avoiding return speculation. +@@ -2478,21 +2478,21 @@ config RETHUNK + + config CPU_UNRET_ENTRY + bool "Enable UNRET on kernel entry" +- depends on CPU_SUP_AMD && RETHUNK ++ depends on CPU_SUP_AMD && RETHUNK && X86_64 + default y + help + Compile the kernel with support for the retbleed=unret mitigation. + + config CPU_IBPB_ENTRY + bool "Enable IBPB on kernel entry" +- depends on CPU_SUP_AMD ++ depends on CPU_SUP_AMD && X86_64 + default y + help + Compile the kernel with support for the retbleed=ibpb mitigation. + + config CPU_IBRS_ENTRY + bool "Enable IBRS on kernel entry" +- depends on CPU_SUP_INTEL ++ depends on CPU_SUP_INTEL && X86_64 + default y + help + Compile the kernel with support for the spectre_v2=ibrs mitigation. diff --git a/debian/patches/series b/debian/patches/series index 550311549..4f48a68d2 100644 --- a/debian/patches/series +++ b/debian/patches/series @@ -99,6 +99,7 @@ features/all/db-mok-keyring/KEYS-Make-use-of-platform-keyring-for-module-signatu # Security fixes debian/i386-686-pae-pci-set-pci-nobios-by-default.patch debian/ntfs-mark-it-as-broken.patch +bugfix/x86/x86-speculation-make-all-retbleed-mitigations-depend.patch # Fix exported symbol versions bugfix/all/module-disable-matching-missing-version-crc.patch -- cgit v1.2.3