target/i386: Add support for perfmon-v2, RAS bits and EPYC-Turin CPU model

[PATCH v3 5/7] target/i386: Expose bits related to SRSO vulnerability

Posted by Babu Moger 1 year, 3 months ago

Add following bits related Speculative Return Stack Overflow (SRSO).
Guests can make use of these bits if supported.

These bits are reported via CPUID Fn8000_0021_EAX.
===================================================================
Bit Feature Description
===================================================================
27  SBPB                Indicates support for the Selective Branch Predictor Barrier.
28  IBPB_BRTYPE         MSR_PRED_CMD[IBPB] flushes all branch type predictions.
29  SRSO_NO             Not vulnerable to SRSO.
30  SRSO_USER_KERNEL_NO Not vulnerable to SRSO at the user-kernel boundary.
===================================================================

Link: https://www.amd.com/content/dam/amd/en/documents/corporate/cr/speculative-return-stack-overflow-whitepaper.pdf
Link: https://www.amd.com/content/dam/amd/en/documents/epyc-technical-docs/programmer-references/57238.zip
Signed-off-by: Babu Moger <babu.moger@amd.com>
---
v3: New patch
---
 target/i386/cpu.c |  2 +-
 target/i386/cpu.h | 14 +++++++++++---
 2 files changed, 12 insertions(+), 4 deletions(-)

diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index 690efd4085..642e71b636 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -1221,7 +1221,7 @@ FeatureWordInfo feature_word_info[FEATURE_WORDS] = {
             NULL, NULL, NULL, NULL,
             NULL, NULL, NULL, NULL,
             NULL, NULL, NULL, "sbpb",
-            "ibpb-brtype", NULL, NULL, NULL,
+            "ibpb-brtype", "srso-no", "srso-user-kernel-no", NULL,
         },
         .cpuid = { .eax = 0x80000021, .reg = R_EAX, },
         .tcg_features = 0,
diff --git a/target/i386/cpu.h b/target/i386/cpu.h
index e0dea1ba54..792518b62d 100644
--- a/target/i386/cpu.h
+++ b/target/i386/cpu.h
@@ -1015,13 +1015,21 @@ uint64_t x86_cpu_get_supported_feature_word(X86CPU *cpu, FeatureWord w);
 #define CPUID_8000_0008_EBX_AMD_PSFD    (1U << 28)
 
 /* Processor ignores nested data breakpoints */
-#define CPUID_8000_0021_EAX_NO_NESTED_DATA_BP    (1U << 0)
+#define CPUID_8000_0021_EAX_NO_NESTED_DATA_BP            (1U << 0)
 /* LFENCE is always serializing */
 #define CPUID_8000_0021_EAX_LFENCE_ALWAYS_SERIALIZING    (1U << 2)
 /* Null Selector Clears Base */
-#define CPUID_8000_0021_EAX_NULL_SEL_CLR_BASE    (1U << 6)
+#define CPUID_8000_0021_EAX_NULL_SEL_CLR_BASE            (1U << 6)
 /* Automatic IBRS */
-#define CPUID_8000_0021_EAX_AUTO_IBRS   (1U << 8)
+#define CPUID_8000_0021_EAX_AUTO_IBRS                    (1U << 8)
+/* Selective Branch Predictor Barrier */
+#define CPUID_8000_0021_EAX_SBPB                         (1U << 27)
+/* IBPB includes branch type prediction flushing */
+#define CPUID_8000_0021_EAX_IBPB_BRTYPE                  (1U << 28)
+/* Not vulnerable to Speculative Return Stack Overflow */
+#define CPUID_8000_0021_EAX_SRSO_NO                      (1U << 29)
+/* Not vulnerable to SRSO at the user-kernel boundary */
+#define CPUID_8000_0021_EAX_SRSO_USER_KERNEL_NO          (1U << 30)
 
 /* Performance Monitoring Version 2 */
 #define CPUID_8000_0022_EAX_PERFMON_V2  (1U << 0)
-- 
2.34.1

Re: [PATCH v3 5/7] target/i386: Expose bits related to SRSO vulnerability

Posted by Zhao Liu 1 year, 3 months ago

Hi Babu

On Thu, Oct 24, 2024 at 05:18:23PM -0500, Babu Moger wrote:
> Date: Thu, 24 Oct 2024 17:18:23 -0500
> From: Babu Moger <babu.moger@amd.com>
> Subject: [PATCH v3 5/7] target/i386: Expose bits related to SRSO
>  vulnerability
> X-Mailer: git-send-email 2.34.1
> 
> Add following bits related Speculative Return Stack Overflow (SRSO).
> Guests can make use of these bits if supported.
> 
> These bits are reported via CPUID Fn8000_0021_EAX.
> ===================================================================
> Bit Feature Description
> ===================================================================
> 27  SBPB                Indicates support for the Selective Branch Predictor Barrier.
> 28  IBPB_BRTYPE         MSR_PRED_CMD[IBPB] flushes all branch type predictions.
> 29  SRSO_NO             Not vulnerable to SRSO.
> 30  SRSO_USER_KERNEL_NO Not vulnerable to SRSO at the user-kernel boundary.
> ===================================================================
> 
> Link: https://www.amd.com/content/dam/amd/en/documents/corporate/cr/speculative-return-stack-overflow-whitepaper.pdf
> Link: https://www.amd.com/content/dam/amd/en/documents/epyc-technical-docs/programmer-references/57238.zip

I suggest updating the description of SRSO-related mitigations in the
"Important CPU features for AMD x86 hosts" section of docs/system/
cpu-models-x86.rst.inc.

If you could also synchronize the CPU model (you added in this series)
in the "Preferred CPU models for AMD x86 hosts" section, that would be
even better. :-)

> Signed-off-by: Babu Moger <babu.moger@amd.com>
> ---
> v3: New patch
> ---
>  target/i386/cpu.c |  2 +-
>  target/i386/cpu.h | 14 +++++++++++---
>  2 files changed, 12 insertions(+), 4 deletions(-)
> 
> diff --git a/target/i386/cpu.c b/target/i386/cpu.c
> index 690efd4085..642e71b636 100644
> --- a/target/i386/cpu.c
> +++ b/target/i386/cpu.c
> @@ -1221,7 +1221,7 @@ FeatureWordInfo feature_word_info[FEATURE_WORDS] = {
>              NULL, NULL, NULL, NULL,
>              NULL, NULL, NULL, NULL,
>              NULL, NULL, NULL, "sbpb",
> -            "ibpb-brtype", NULL, NULL, NULL,
> +            "ibpb-brtype", "srso-no", "srso-user-kernel-no", NULL,
>          },
>          .cpuid = { .eax = 0x80000021, .reg = R_EAX, },
>          .tcg_features = 0,
> diff --git a/target/i386/cpu.h b/target/i386/cpu.h
> index e0dea1ba54..792518b62d 100644
> --- a/target/i386/cpu.h
> +++ b/target/i386/cpu.h
> @@ -1015,13 +1015,21 @@ uint64_t x86_cpu_get_supported_feature_word(X86CPU *cpu, FeatureWord w);
>  #define CPUID_8000_0008_EBX_AMD_PSFD    (1U << 28)
>  
>  /* Processor ignores nested data breakpoints */
> -#define CPUID_8000_0021_EAX_NO_NESTED_DATA_BP    (1U << 0)
> +#define CPUID_8000_0021_EAX_NO_NESTED_DATA_BP            (1U << 0)
>  /* LFENCE is always serializing */
>  #define CPUID_8000_0021_EAX_LFENCE_ALWAYS_SERIALIZING    (1U << 2)
>  /* Null Selector Clears Base */
> -#define CPUID_8000_0021_EAX_NULL_SEL_CLR_BASE    (1U << 6)
> +#define CPUID_8000_0021_EAX_NULL_SEL_CLR_BASE            (1U << 6)
>  /* Automatic IBRS */
> -#define CPUID_8000_0021_EAX_AUTO_IBRS   (1U << 8)
> +#define CPUID_8000_0021_EAX_AUTO_IBRS                    (1U << 8)
> +/* Selective Branch Predictor Barrier */
> +#define CPUID_8000_0021_EAX_SBPB                         (1U << 27)
> +/* IBPB includes branch type prediction flushing */
> +#define CPUID_8000_0021_EAX_IBPB_BRTYPE                  (1U << 28)
> +/* Not vulnerable to Speculative Return Stack Overflow */
> +#define CPUID_8000_0021_EAX_SRSO_NO                      (1U << 29)
> +/* Not vulnerable to SRSO at the user-kernel boundary */
> +#define CPUID_8000_0021_EAX_SRSO_USER_KERNEL_NO          (1U << 30)

These feature bits defination could be added in patch 7 because only
patch 7 uses these macros.

BTW, which platform supports CPUID_8000_0021_EAX_SRSO_NO? I found that
even the Turin model added in patch 7 does not support this feature.

Thanks,
Zhao

>  /* Performance Monitoring Version 2 */
>  #define CPUID_8000_0022_EAX_PERFMON_V2  (1U << 0)
> -- 
> 2.34.1
> 
>

Re: [PATCH v3 5/7] target/i386: Expose bits related to SRSO vulnerability

Posted by Moger, Babu 1 year, 3 months ago

Hi Zhao,

Thanks for the review.

On 10/28/24 03:56, Zhao Liu wrote:
> Hi Babu
> 
> On Thu, Oct 24, 2024 at 05:18:23PM -0500, Babu Moger wrote:
>> Date: Thu, 24 Oct 2024 17:18:23 -0500
>> From: Babu Moger <babu.moger@amd.com>
>> Subject: [PATCH v3 5/7] target/i386: Expose bits related to SRSO
>>  vulnerability
>> X-Mailer: git-send-email 2.34.1
>>
>> Add following bits related Speculative Return Stack Overflow (SRSO).
>> Guests can make use of these bits if supported.
>>
>> These bits are reported via CPUID Fn8000_0021_EAX.
>> ===================================================================
>> Bit Feature Description
>> ===================================================================
>> 27  SBPB                Indicates support for the Selective Branch Predictor Barrier.
>> 28  IBPB_BRTYPE         MSR_PRED_CMD[IBPB] flushes all branch type predictions.
>> 29  SRSO_NO             Not vulnerable to SRSO.
>> 30  SRSO_USER_KERNEL_NO Not vulnerable to SRSO at the user-kernel boundary.
>> ===================================================================
>>
>> Link: https://www.amd.com/content/dam/amd/en/documents/corporate/cr/speculative-return-stack-overflow-whitepaper.pdf
>> Link: https://www.amd.com/content/dam/amd/en/documents/epyc-technical-docs/programmer-references/57238.zip
> 
> I suggest updating the description of SRSO-related mitigations in the
> "Important CPU features for AMD x86 hosts" section of docs/system/
> cpu-models-x86.rst.inc.
> 
> If you could also synchronize the CPU model (you added in this series)
> in the "Preferred CPU models for AMD x86 hosts" section, that would be
> even better. :-)

Sure. Will look into both of these.

> 
>> Signed-off-by: Babu Moger <babu.moger@amd.com>
>> ---
>> v3: New patch
>> ---
>>  target/i386/cpu.c |  2 +-
>>  target/i386/cpu.h | 14 +++++++++++---
>>  2 files changed, 12 insertions(+), 4 deletions(-)
>>
>> diff --git a/target/i386/cpu.c b/target/i386/cpu.c
>> index 690efd4085..642e71b636 100644
>> --- a/target/i386/cpu.c
>> +++ b/target/i386/cpu.c
>> @@ -1221,7 +1221,7 @@ FeatureWordInfo feature_word_info[FEATURE_WORDS] = {
>>              NULL, NULL, NULL, NULL,
>>              NULL, NULL, NULL, NULL,
>>              NULL, NULL, NULL, "sbpb",
>> -            "ibpb-brtype", NULL, NULL, NULL,
>> +            "ibpb-brtype", "srso-no", "srso-user-kernel-no", NULL,
>>          },
>>          .cpuid = { .eax = 0x80000021, .reg = R_EAX, },
>>          .tcg_features = 0,
>> diff --git a/target/i386/cpu.h b/target/i386/cpu.h
>> index e0dea1ba54..792518b62d 100644
>> --- a/target/i386/cpu.h
>> +++ b/target/i386/cpu.h
>> @@ -1015,13 +1015,21 @@ uint64_t x86_cpu_get_supported_feature_word(X86CPU *cpu, FeatureWord w);
>>  #define CPUID_8000_0008_EBX_AMD_PSFD    (1U << 28)
>>  
>>  /* Processor ignores nested data breakpoints */
>> -#define CPUID_8000_0021_EAX_NO_NESTED_DATA_BP    (1U << 0)
>> +#define CPUID_8000_0021_EAX_NO_NESTED_DATA_BP            (1U << 0)
>>  /* LFENCE is always serializing */
>>  #define CPUID_8000_0021_EAX_LFENCE_ALWAYS_SERIALIZING    (1U << 2)
>>  /* Null Selector Clears Base */
>> -#define CPUID_8000_0021_EAX_NULL_SEL_CLR_BASE    (1U << 6)
>> +#define CPUID_8000_0021_EAX_NULL_SEL_CLR_BASE            (1U << 6)
>>  /* Automatic IBRS */
>> -#define CPUID_8000_0021_EAX_AUTO_IBRS   (1U << 8)
>> +#define CPUID_8000_0021_EAX_AUTO_IBRS                    (1U << 8)
>> +/* Selective Branch Predictor Barrier */
>> +#define CPUID_8000_0021_EAX_SBPB                         (1U << 27)
>> +/* IBPB includes branch type prediction flushing */
>> +#define CPUID_8000_0021_EAX_IBPB_BRTYPE                  (1U << 28)
>> +/* Not vulnerable to Speculative Return Stack Overflow */
>> +#define CPUID_8000_0021_EAX_SRSO_NO                      (1U << 29)
>> +/* Not vulnerable to SRSO at the user-kernel boundary */
>> +#define CPUID_8000_0021_EAX_SRSO_USER_KERNEL_NO          (1U << 30)
> 
> These feature bits defination could be added in patch 7 because only
> patch 7 uses these macros.

Sure. Looks like Paolo already pulled this in. I will take care of this if
there is another revision.


> BTW, which platform supports CPUID_8000_0021_EAX_SRSO_NO? I found that
> even the Turin model added in patch 7 does not support this feature.

SRSO_NO is not supported in Turin. I added it for completion as it is in
the same CPUID fn.

> 
> Thanks,
> Zhao
> 
>>  /* Performance Monitoring Version 2 */
>>  #define CPUID_8000_0022_EAX_PERFMON_V2  (1U << 0)
>> -- 
>> 2.34.1
>>
>>
> 

-- 
Thanks
Babu Moger

[PATCH v3 1/7] target/i386: Fix minor typo in NO_NESTED_DATA_BP feature bit
[PATCH v3 2/7] target/i386: Add RAS feature bits on EPYC CPU models
[PATCH v3 3/7] target/i386: Add PerfMonV2 feature bit
[PATCH v3 4/7] target/i386: Enable perfmon-v2 and RAS feature bits on EPYC-Genoa
[PATCH v3 5/7] target/i386: Expose bits related to SRSO vulnerability
[PATCH v3 6/7] target/i386: Expose new feature bits in CPUID 8000_0021_EAX/EBX
[PATCH v3 7/7] target/i386: Add support for EPYC-Turin model