x86/bugs: Do not use UNTRAIN_RET with IBPB on entry

JIRA: https://issues.redhat.com/browse/RHEL-88224

commit c62fa11
Author: Johannes Wikner <kwikner@ethz.ch>
Date:   Tue, 8 Oct 2024 12:58:03 +0200

    x86/bugs: Do not use UNTRAIN_RET with IBPB on entry

    Since X86_FEATURE_ENTRY_IBPB will invalidate all harmful predictions
    with IBPB, no software-based untraining of returns is needed anymore.
    Currently, this change affects retbleed and SRSO mitigations so if
    either of the mitigations is doing IBPB and the other one does the
    software sequence, the latter is not needed anymore.

      [ bp: Massage commit message. ]

    Suggested-by: Borislav Petkov <bp@alien8.de>
    Signed-off-by: Johannes Wikner <kwikner@ethz.ch>
    Cc: <stable@kernel.org>

Signed-off-by: Waiman Long <longman@redhat.com>

Author: Waiman-Long

arch/x86/kernel/cpu/bugs.c

@@ -1122,6 +1122,15 @@ static void __init retbleed_select_mitigation(void)
 
 	case RETBLEED_MITIGATION_IBPB:
 		setup_force_cpu_cap(X86_FEATURE_ENTRY_IBPB);
+
+		/*
+		 * IBPB on entry already obviates the need for
+		 * software-based untraining so clear those in case some
+		 * other mitigation like SRSO has selected them.
+		 */
+		setup_clear_cpu_cap(X86_FEATURE_UNRET);
+		setup_clear_cpu_cap(X86_FEATURE_RETHUNK);
+
 		setup_force_cpu_cap(X86_FEATURE_IBPB_ON_VMEXIT);
 		mitigate_smt = true;
 
@@ -2720,6 +2729,14 @@ static void __init srso_select_mitigation(void)
 			if (has_microcode) {
 				setup_force_cpu_cap(X86_FEATURE_ENTRY_IBPB);
 				srso_mitigation = SRSO_MITIGATION_IBPB;
+
+				/*
+				 * IBPB on entry already obviates the need for
+				 * software-based untraining so clear those in case some
+				 * other mitigation like Retbleed has selected them.
+				 */
+				setup_clear_cpu_cap(X86_FEATURE_UNRET);
+				setup_clear_cpu_cap(X86_FEATURE_RETHUNK);
 			}
 		} else {
 			pr_err("WARNING: kernel not compiled with MITIGATION_IBPB_ENTRY.\n");