x86/bugs: Do not enable IBPB-on-entry when IBPB is not supported

commit 2259da159fbe5dba8ac00b560cf00b6a6537fa18 upstream.

There are some VM configurations which have Skylake model but do not
support IBPB. In those cases, when using retbleed=ibpb, userspace is going
to be killed and kernel is going to panic.

If the CPU does not support IBPB, warn and proceed with the auto option. Also,
do not fallback to IBPB on AMD/Hygon systems if it is not supported.

Fixes: 3ebc17006888 ("x86/bugs: Add retbleed=ibpb")
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
Signed-off-by: Borislav Petkov <bp@suse.de>
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
index 95219eb8e45cc66893e5fe9d3ee0f6e0abe15e14..921d718e7f028c9821477fa6029fc2274d5c17e6 100644 (file)
--- a/arch/x86/kernel/cpu/bugs.c
+++ b/arch/x86/kernel/cpu/bugs.c
@@ -858,7 +858,10 @@ static void __init retbleed_select_mitigation(void)
                break;
 
        case RETBLEED_CMD_IBPB:
-               if (IS_ENABLED(CONFIG_CPU_IBPB_ENTRY)) {
+               if (!boot_cpu_has(X86_FEATURE_IBPB)) {
+                       pr_err("WARNING: CPU does not support IBPB.\n");
+                       goto do_cmd_auto;
+               } else if (IS_ENABLED(CONFIG_CPU_IBPB_ENTRY)) {
                        retbleed_mitigation = RETBLEED_MITIGATION_IBPB;
                } else {
                        pr_err("WARNING: kernel not compiled with CPU_IBPB_ENTRY.\n");
@@ -873,7 +876,7 @@ do_cmd_auto:
                    boot_cpu_data.x86_vendor == X86_VENDOR_HYGON) {
                        if (IS_ENABLED(CONFIG_CPU_UNRET_ENTRY))
                                retbleed_mitigation = RETBLEED_MITIGATION_UNRET;
-                       else if (IS_ENABLED(CONFIG_CPU_IBPB_ENTRY))
+                       else if (IS_ENABLED(CONFIG_CPU_IBPB_ENTRY) && boot_cpu_has(X86_FEATURE_IBPB))
                                retbleed_mitigation = RETBLEED_MITIGATION_IBPB;
                }