5.15-stable patches

added patches:
	x86-bugs-do-not-enable-ibpb-at-firmware-entry-when-ibpb-is-not-available.patch

diff --git a/queue-5.15/series b/queue-5.15/series
index 02e2af6412bc613f3389b540ae8d7d5162199900..334a31313bc272d22327e238e1e70a1a9d4a6ffa 100644 (file)
--- a/queue-5.15/series
+++ b/queue-5.15/series
@@ -66,3 +66,4 @@ arm-9216-1-fix-max_dma_address-overflow.patch
 edac-ghes-set-the-dimm-label-unconditionally.patch
 docs-kernel-parameters-update-descriptions-for-mitigations-param-with-retbleed.patch
 locking-rwsem-allow-slowpath-writer-to-ignore-handoff-bit-if-not-set-by-first-waiter.patch
+x86-bugs-do-not-enable-ibpb-at-firmware-entry-when-ibpb-is-not-available.patch

diff --git a/queue-5.15/x86-bugs-do-not-enable-ibpb-at-firmware-entry-when-ibpb-is-not-available.patch b/queue-5.15/x86-bugs-do-not-enable-ibpb-at-firmware-entry-when-ibpb-is-not-available.patch
new file mode 100644 (file)
index 0000000..f062f51
--- /dev/null
+++ b/queue-5.15/x86-bugs-do-not-enable-ibpb-at-firmware-entry-when-ibpb-is-not-available.patch
@@ -0,0 +1,65 @@
+From 571c30b1a88465a1c85a6f7762609939b9085a15 Mon Sep 17 00:00:00 2001
+From: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
+Date: Thu, 28 Jul 2022 09:26:02 -0300
+Subject: x86/bugs: Do not enable IBPB at firmware entry when IBPB is not available
+
+From: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
+
+commit 571c30b1a88465a1c85a6f7762609939b9085a15 upstream.
+
+Some cloud hypervisors do not provide IBPB on very recent CPU processors,
+including AMD processors affected by Retbleed.
+
+Using IBPB before firmware calls on such systems would cause a GPF at boot
+like the one below. Do not enable such calls when IBPB support is not
+present.
+
+  EFI Variables Facility v0.08 2004-May-17
+  general protection fault, maybe for address 0x1: 0000 [#1] PREEMPT SMP NOPTI
+  CPU: 0 PID: 24 Comm: kworker/u2:1 Not tainted 5.19.0-rc8+ #7
+  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 0.0.0 02/06/2015
+  Workqueue: efi_rts_wq efi_call_rts
+  RIP: 0010:efi_call_rts
+  Code: e8 37 33 58 ff 41 bf 48 00 00 00 49 89 c0 44 89 f9 48 83 c8 01 4c 89 c2 48 c1 ea 20 66 90 b9 49 00 00 00 b8 01 00 00 00 31 d2 <0f> 30 e8 7b 9f 5d ff e8 f6 f8 ff ff 4c 89 f1 4c 89 ea 4c 89 e6 48
+  RSP: 0018:ffffb373800d7e38 EFLAGS: 00010246
+  RAX: 0000000000000001 RBX: 0000000000000006 RCX: 0000000000000049
+  RDX: 0000000000000000 RSI: ffff94fbc19d8fe0 RDI: ffff94fbc1b2b300
+  RBP: ffffb373800d7e70 R08: 0000000000000000 R09: 0000000000000000
+  R10: 000000000000000b R11: 000000000000000b R12: ffffb3738001fd78
+  R13: ffff94fbc2fcfc00 R14: ffffb3738001fd80 R15: 0000000000000048
+  FS:  0000000000000000(0000) GS:ffff94fc3da00000(0000) knlGS:0000000000000000
+  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+  CR2: ffff94fc30201000 CR3: 000000006f610000 CR4: 00000000000406f0
+  Call Trace:
+   <TASK>
+   ? __wake_up
+   process_one_work
+   worker_thread
+   ? rescuer_thread
+   kthread
+   ? kthread_complete_and_exit
+   ret_from_fork
+   </TASK>
+  Modules linked in:
+
+Fixes: 28a99e95f55c ("x86/amd: Use IBPB for firmware calls")
+Reported-by: Dimitri John Ledkov <dimitri.ledkov@canonical.com>
+Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20220728122602.2500509-1-cascardo@canonical.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/kernel/cpu/bugs.c |    1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/arch/x86/kernel/cpu/bugs.c
++++ b/arch/x86/kernel/cpu/bugs.c
+@@ -1513,6 +1513,7 @@ static void __init spectre_v2_select_mit
+        * enable IBRS around firmware calls.
+        */
+       if (boot_cpu_has_bug(X86_BUG_RETBLEED) &&
++          boot_cpu_has(X86_FEATURE_IBPB) &&
+           (boot_cpu_data.x86_vendor == X86_VENDOR_AMD ||
+            boot_cpu_data.x86_vendor == X86_VENDOR_HYGON)) {
+