Re: [RFC PATCH] x86/bugs: Remove 'force' options for retbleed/ITS

[Nikolay Borisov]

On 6/26/25 17:40, Peter Zijlstra wrote:
> On Thu, Jun 26, 2025 at 09:27:03AM -0500, David Kaplan wrote:
> > Command line options which force-enable a mitigation on an unaffected
> > processor provide arguably no security value but do create the potential
> > for problems due to the increased set of mitigation interactions.
> >
> > For example, setting "indirect_target_selection=force" on an AMD
> > Retbleed-affected CPU (e.g., Zen2) results in a configuration where the
> > kernel reports that both ITS and Retbleed are mitigated, but Retbleed is
> > not in fact mitigated.  In this configuration, untraining of the retbleed
> > return thunk is enabled but the its_return_thunk is active, rendering the
> > untraining ineffective.
> >
> > It is wrong for the kernel to report that a bug is mitigated when it is
> > not.  While this specific interaction could be directly fixed, the ability
> > to force-enable these bugs creates unneeded complexity, so remove it.
> >
> > If removing these options entirely is unacceptable, perhaps for
> > compatibility reasons, another option could be to only allow forcing on the
> > affected vendor (i.e., only allow forcing ITS on Intel CPUs), which would
> > at least limit the potential interactions that need to be analyzed.
> > Tagging as RFC to prompt discussion on this point.
>
> Testing; I use these things for testing. Makes I don't have to run on
> affected hardware, I can just force the feature on and inspect the code
> and ensures it runs.
>
> If you use force, you get to keep all pieces -- no warranties.

I concur, however using force won't always guarantee that the code runs 
though, because there can be other condition that must/must not be met 
i.e trying to run ITS on AMD hw (yeah, yeah I know :) ) also required 
commenting out some checks in patch_retpoline.
>