| Message ID | dadbd70c38f4e165418d193918a3747bd715c5f4.1729807947.git.babu.moger@amd.com (mailing list archive) |
|---|---|
| State | New |
| Headers | show |
| Series | target/i386: Add support for perfmon-v2, RAS bits and EPYC-Turin CPU model | expand |
Hi Babu On Thu, Oct 24, 2024 at 05:18:23PM -0500, Babu Moger wrote: > Date: Thu, 24 Oct 2024 17:18:23 -0500 > From: Babu Moger <babu.moger@amd.com> > Subject: [PATCH v3 5/7] target/i386: Expose bits related to SRSO > vulnerability > X-Mailer: git-send-email 2.34.1 > > Add following bits related Speculative Return Stack Overflow (SRSO). > Guests can make use of these bits if supported. > > These bits are reported via CPUID Fn8000_0021_EAX. > =================================================================== > Bit Feature Description > =================================================================== > 27 SBPB Indicates support for the Selective Branch Predictor Barrier. > 28 IBPB_BRTYPE MSR_PRED_CMD[IBPB] flushes all branch type predictions. > 29 SRSO_NO Not vulnerable to SRSO. > 30 SRSO_USER_KERNEL_NO Not vulnerable to SRSO at the user-kernel boundary. > =================================================================== > > Link: https://www.amd.com/content/dam/amd/en/documents/corporate/cr/speculative-return-stack-overflow-whitepaper.pdf > Link: https://www.amd.com/content/dam/amd/en/documents/epyc-technical-docs/programmer-references/57238.zip I suggest updating the description of SRSO-related mitigations in the "Important CPU features for AMD x86 hosts" section of docs/system/ cpu-models-x86.rst.inc. If you could also synchronize the CPU model (you added in this series) in the "Preferred CPU models for AMD x86 hosts" section, that would be even better. :-) > Signed-off-by: Babu Moger <babu.moger@amd.com> > --- > v3: New patch > --- > target/i386/cpu.c | 2 +- > target/i386/cpu.h | 14 +++++++++++--- > 2 files changed, 12 insertions(+), 4 deletions(-) > > diff --git a/target/i386/cpu.c b/target/i386/cpu.c > index 690efd4085..642e71b636 100644 > --- a/target/i386/cpu.c > +++ b/target/i386/cpu.c > @@ -1221,7 +1221,7 @@ FeatureWordInfo feature_word_info[FEATURE_WORDS] = { > NULL, NULL, NULL, NULL, > NULL, NULL, NULL, NULL, > NULL, NULL, NULL, "sbpb", > - "ibpb-brtype", NULL, NULL, NULL, > + "ibpb-brtype", "srso-no", "srso-user-kernel-no", NULL, > }, > .cpuid = { .eax = 0x80000021, .reg = R_EAX, }, > .tcg_features = 0, > diff --git a/target/i386/cpu.h b/target/i386/cpu.h > index e0dea1ba54..792518b62d 100644 > --- a/target/i386/cpu.h > +++ b/target/i386/cpu.h > @@ -1015,13 +1015,21 @@ uint64_t x86_cpu_get_supported_feature_word(X86CPU *cpu, FeatureWord w); > #define CPUID_8000_0008_EBX_AMD_PSFD (1U << 28) > > /* Processor ignores nested data breakpoints */ > -#define CPUID_8000_0021_EAX_NO_NESTED_DATA_BP (1U << 0) > +#define CPUID_8000_0021_EAX_NO_NESTED_DATA_BP (1U << 0) > /* LFENCE is always serializing */ > #define CPUID_8000_0021_EAX_LFENCE_ALWAYS_SERIALIZING (1U << 2) > /* Null Selector Clears Base */ > -#define CPUID_8000_0021_EAX_NULL_SEL_CLR_BASE (1U << 6) > +#define CPUID_8000_0021_EAX_NULL_SEL_CLR_BASE (1U << 6) > /* Automatic IBRS */ > -#define CPUID_8000_0021_EAX_AUTO_IBRS (1U << 8) > +#define CPUID_8000_0021_EAX_AUTO_IBRS (1U << 8) > +/* Selective Branch Predictor Barrier */ > +#define CPUID_8000_0021_EAX_SBPB (1U << 27) > +/* IBPB includes branch type prediction flushing */ > +#define CPUID_8000_0021_EAX_IBPB_BRTYPE (1U << 28) > +/* Not vulnerable to Speculative Return Stack Overflow */ > +#define CPUID_8000_0021_EAX_SRSO_NO (1U << 29) > +/* Not vulnerable to SRSO at the user-kernel boundary */ > +#define CPUID_8000_0021_EAX_SRSO_USER_KERNEL_NO (1U << 30) These feature bits defination could be added in patch 7 because only patch 7 uses these macros. BTW, which platform supports CPUID_8000_0021_EAX_SRSO_NO? I found that even the Turin model added in patch 7 does not support this feature. Thanks, Zhao > /* Performance Monitoring Version 2 */ > #define CPUID_8000_0022_EAX_PERFMON_V2 (1U << 0) > -- > 2.34.1 > >
Hi Zhao, Thanks for the review. On 10/28/24 03:56, Zhao Liu wrote: > Hi Babu > > On Thu, Oct 24, 2024 at 05:18:23PM -0500, Babu Moger wrote: >> Date: Thu, 24 Oct 2024 17:18:23 -0500 >> From: Babu Moger <babu.moger@amd.com> >> Subject: [PATCH v3 5/7] target/i386: Expose bits related to SRSO >> vulnerability >> X-Mailer: git-send-email 2.34.1 >> >> Add following bits related Speculative Return Stack Overflow (SRSO). >> Guests can make use of these bits if supported. >> >> These bits are reported via CPUID Fn8000_0021_EAX. >> =================================================================== >> Bit Feature Description >> =================================================================== >> 27 SBPB Indicates support for the Selective Branch Predictor Barrier. >> 28 IBPB_BRTYPE MSR_PRED_CMD[IBPB] flushes all branch type predictions. >> 29 SRSO_NO Not vulnerable to SRSO. >> 30 SRSO_USER_KERNEL_NO Not vulnerable to SRSO at the user-kernel boundary. >> =================================================================== >> >> Link: https://www.amd.com/content/dam/amd/en/documents/corporate/cr/speculative-return-stack-overflow-whitepaper.pdf >> Link: https://www.amd.com/content/dam/amd/en/documents/epyc-technical-docs/programmer-references/57238.zip > > I suggest updating the description of SRSO-related mitigations in the > "Important CPU features for AMD x86 hosts" section of docs/system/ > cpu-models-x86.rst.inc. > > If you could also synchronize the CPU model (you added in this series) > in the "Preferred CPU models for AMD x86 hosts" section, that would be > even better. :-) Sure. Will look into both of these. > >> Signed-off-by: Babu Moger <babu.moger@amd.com> >> --- >> v3: New patch >> --- >> target/i386/cpu.c | 2 +- >> target/i386/cpu.h | 14 +++++++++++--- >> 2 files changed, 12 insertions(+), 4 deletions(-) >> >> diff --git a/target/i386/cpu.c b/target/i386/cpu.c >> index 690efd4085..642e71b636 100644 >> --- a/target/i386/cpu.c >> +++ b/target/i386/cpu.c >> @@ -1221,7 +1221,7 @@ FeatureWordInfo feature_word_info[FEATURE_WORDS] = { >> NULL, NULL, NULL, NULL, >> NULL, NULL, NULL, NULL, >> NULL, NULL, NULL, "sbpb", >> - "ibpb-brtype", NULL, NULL, NULL, >> + "ibpb-brtype", "srso-no", "srso-user-kernel-no", NULL, >> }, >> .cpuid = { .eax = 0x80000021, .reg = R_EAX, }, >> .tcg_features = 0, >> diff --git a/target/i386/cpu.h b/target/i386/cpu.h >> index e0dea1ba54..792518b62d 100644 >> --- a/target/i386/cpu.h >> +++ b/target/i386/cpu.h >> @@ -1015,13 +1015,21 @@ uint64_t x86_cpu_get_supported_feature_word(X86CPU *cpu, FeatureWord w); >> #define CPUID_8000_0008_EBX_AMD_PSFD (1U << 28) >> >> /* Processor ignores nested data breakpoints */ >> -#define CPUID_8000_0021_EAX_NO_NESTED_DATA_BP (1U << 0) >> +#define CPUID_8000_0021_EAX_NO_NESTED_DATA_BP (1U << 0) >> /* LFENCE is always serializing */ >> #define CPUID_8000_0021_EAX_LFENCE_ALWAYS_SERIALIZING (1U << 2) >> /* Null Selector Clears Base */ >> -#define CPUID_8000_0021_EAX_NULL_SEL_CLR_BASE (1U << 6) >> +#define CPUID_8000_0021_EAX_NULL_SEL_CLR_BASE (1U << 6) >> /* Automatic IBRS */ >> -#define CPUID_8000_0021_EAX_AUTO_IBRS (1U << 8) >> +#define CPUID_8000_0021_EAX_AUTO_IBRS (1U << 8) >> +/* Selective Branch Predictor Barrier */ >> +#define CPUID_8000_0021_EAX_SBPB (1U << 27) >> +/* IBPB includes branch type prediction flushing */ >> +#define CPUID_8000_0021_EAX_IBPB_BRTYPE (1U << 28) >> +/* Not vulnerable to Speculative Return Stack Overflow */ >> +#define CPUID_8000_0021_EAX_SRSO_NO (1U << 29) >> +/* Not vulnerable to SRSO at the user-kernel boundary */ >> +#define CPUID_8000_0021_EAX_SRSO_USER_KERNEL_NO (1U << 30) > > These feature bits defination could be added in patch 7 because only > patch 7 uses these macros. Sure. Looks like Paolo already pulled this in. I will take care of this if there is another revision. > BTW, which platform supports CPUID_8000_0021_EAX_SRSO_NO? I found that > even the Turin model added in patch 7 does not support this feature. SRSO_NO is not supported in Turin. I added it for completion as it is in the same CPUID fn. > > Thanks, > Zhao > >> /* Performance Monitoring Version 2 */ >> #define CPUID_8000_0022_EAX_PERFMON_V2 (1U << 0) >> -- >> 2.34.1 >> >> >
diff --git a/target/i386/cpu.c b/target/i386/cpu.c index 690efd4085..642e71b636 100644 --- a/target/i386/cpu.c +++ b/target/i386/cpu.c @@ -1221,7 +1221,7 @@ FeatureWordInfo feature_word_info[FEATURE_WORDS] = { NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, "sbpb", - "ibpb-brtype", NULL, NULL, NULL, + "ibpb-brtype", "srso-no", "srso-user-kernel-no", NULL, }, .cpuid = { .eax = 0x80000021, .reg = R_EAX, }, .tcg_features = 0, diff --git a/target/i386/cpu.h b/target/i386/cpu.h index e0dea1ba54..792518b62d 100644 --- a/target/i386/cpu.h +++ b/target/i386/cpu.h @@ -1015,13 +1015,21 @@ uint64_t x86_cpu_get_supported_feature_word(X86CPU *cpu, FeatureWord w); #define CPUID_8000_0008_EBX_AMD_PSFD (1U << 28) /* Processor ignores nested data breakpoints */ -#define CPUID_8000_0021_EAX_NO_NESTED_DATA_BP (1U << 0) +#define CPUID_8000_0021_EAX_NO_NESTED_DATA_BP (1U << 0) /* LFENCE is always serializing */ #define CPUID_8000_0021_EAX_LFENCE_ALWAYS_SERIALIZING (1U << 2) /* Null Selector Clears Base */ -#define CPUID_8000_0021_EAX_NULL_SEL_CLR_BASE (1U << 6) +#define CPUID_8000_0021_EAX_NULL_SEL_CLR_BASE (1U << 6) /* Automatic IBRS */ -#define CPUID_8000_0021_EAX_AUTO_IBRS (1U << 8) +#define CPUID_8000_0021_EAX_AUTO_IBRS (1U << 8) +/* Selective Branch Predictor Barrier */ +#define CPUID_8000_0021_EAX_SBPB (1U << 27) +/* IBPB includes branch type prediction flushing */ +#define CPUID_8000_0021_EAX_IBPB_BRTYPE (1U << 28) +/* Not vulnerable to Speculative Return Stack Overflow */ +#define CPUID_8000_0021_EAX_SRSO_NO (1U << 29) +/* Not vulnerable to SRSO at the user-kernel boundary */ +#define CPUID_8000_0021_EAX_SRSO_USER_KERNEL_NO (1U << 30) /* Performance Monitoring Version 2 */ #define CPUID_8000_0022_EAX_PERFMON_V2 (1U << 0)
Add following bits related Speculative Return Stack Overflow (SRSO). Guests can make use of these bits if supported. These bits are reported via CPUID Fn8000_0021_EAX. =================================================================== Bit Feature Description =================================================================== 27 SBPB Indicates support for the Selective Branch Predictor Barrier. 28 IBPB_BRTYPE MSR_PRED_CMD[IBPB] flushes all branch type predictions. 29 SRSO_NO Not vulnerable to SRSO. 30 SRSO_USER_KERNEL_NO Not vulnerable to SRSO at the user-kernel boundary. =================================================================== Link: https://www.amd.com/content/dam/amd/en/documents/corporate/cr/speculative-return-stack-overflow-whitepaper.pdf Link: https://www.amd.com/content/dam/amd/en/documents/epyc-technical-docs/programmer-references/57238.zip Signed-off-by: Babu Moger <babu.moger@amd.com> --- v3: New patch --- target/i386/cpu.c | 2 +- target/i386/cpu.h | 14 +++++++++++--- 2 files changed, 12 insertions(+), 4 deletions(-)