File xsa407-0b.patch of Package xen.26345
From: Andrew Cooper <andrew.cooper3@citrix.com>
Subject: x86/amd: Enumeration for speculative features/hints
There is a step change in speculation protections between the Zen1 and Zen2
microarchitectures.
Zen1 and older have no special support. Control bits in non-architectural
MSRs are used to make lfence be dispatch-serialising (Spectre v1), and to
disable Memory Disambiguation (Speculative Store Bypass). IBPB was
retrofitted in a microcode update, and software methods are required for
Spectre v2 protections.
Because the bit controlling Memory Disambiguation is model specific,
hypervisors are expected to expose a MSR_VIRT_SPEC_CTRL interface which
abstracts the model specific details.
Zen2 and later implement the MSR_SPEC_CTRL interface in hardware, and
virtualise the interface for HVM guests to use. A number of hint bits are
specified too to help guide OS software to the most efficient mitigation
strategy.
Zen3 introduced a new feature, Predictive Store Forwarding, along with a
control to disable it in sensitive code.
Add CPUID and VMCB details for all the new functionality.
Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
(cherry picked from commit 747424c664bb164a04e7a9f2ffbf02d4a1630d7d)
--- a/tools/libxl/libxl_cpuid.c
+++ b/tools/libxl/libxl_cpuid.c
@@ -247,6 +247,17 @@ int libxl_cpuid_parse_config(libxl_cpuid
{"invtsc", 0x80000007, NA, CPUID_REG_EDX, 8, 1},
{"ibpb", 0x80000008, NA, CPUID_REG_EBX, 12, 1},
+ {"ibrs", 0x80000008, NA, CPUID_REG_EBX, 14, 1},
+ {"amd-stibp", 0x80000008, NA, CPUID_REG_EBX, 15, 1},
+ {"ibrs-always", 0x80000008, NA, CPUID_REG_EBX, 16, 1},
+ {"stibp-always", 0x80000008, NA, CPUID_REG_EBX, 17, 1},
+ {"ibrs-fast", 0x80000008, NA, CPUID_REG_EBX, 18, 1},
+ {"ibrs-same-mode", 0x80000008, NA, CPUID_REG_EBX, 19, 1},
+ {"amd-ssbd", 0x80000008, NA, CPUID_REG_EBX, 24, 1},
+ {"virt-ssbd", 0x80000008, NA, CPUID_REG_EBX, 25, 1},
+ {"ssb-no", 0x80000008, NA, CPUID_REG_EBX, 26, 1},
+ {"psfd", 0x80000008, NA, CPUID_REG_EBX, 28, 1},
+
{"nc", 0x80000008, NA, CPUID_REG_ECX, 0, 8},
{"apicidsize", 0x80000008, NA, CPUID_REG_ECX, 12, 4},
--- a/tools/misc/xen-cpuid.c
+++ b/tools/misc/xen-cpuid.c
@@ -151,9 +151,18 @@ static const char *str_e8b[32] =
[1 ... 11] = "REZ",
- [12] = "ibpb",
+ [12] = "ibpb", [13] = "REZ",
+ [14] = "ibrs", [15] = "amd-stibp",
+ [16] = "ibrs-always", [17] = "stibp-always",
+ [18] = "ibrs-fast", [19] = "ibrs-same-mode",
- [13 ... 31] = "REZ",
+ [20 ... 23] = "REZ",
+
+ [24] = "amd-ssbd", [25] = "virt-ssbd",
+ [26] = "ssb-no", [27] = "REZ",
+ [28] = "psfd", [29] = "REZ",
+
+ [30 ... 31] = "REZ",
};
static const char *str_7d0[32] =
--- a/xen/arch/x86/hvm/svm/svm.c
+++ b/xen/arch/x86/hvm/svm/svm.c
@@ -1676,6 +1676,7 @@ const struct hvm_function_table * __init
P(cpu_has_svm_decode, "DecodeAssists");
P(cpu_has_pause_filter, "Pause-Intercept Filter");
P(cpu_has_tsc_ratio, "TSC Rate MSR");
+ P(cpu_has_svm_spec_ctrl, "MSR_SPEC_CTRL virtualisation");
#undef P
if ( !printed )
--- a/xen/include/asm-x86/cpufeature.h
+++ b/xen/include/asm-x86/cpufeature.h
@@ -100,6 +100,11 @@
/* CPUID level 0x80000007.edx */
#define cpu_has_itsc boot_cpu_has(X86_FEATURE_ITSC)
+/* CPUID level 0x80000008.ebx */
+#define cpu_has_amd_ssbd boot_cpu_has(X86_FEATURE_AMD_SSBD)
+#define cpu_has_virt_ssbd boot_cpu_has(X86_FEATURE_VIRT_SSBD)
+#define cpu_has_ssb_no boot_cpu_has(X86_FEATURE_SSB_NO)
+
/* CPUID level 0x00000007:0.edx */
#define cpu_has_tsx_force_abort boot_cpu_has(X86_FEATURE_TSX_FORCE_ABORT)
--- a/xen/include/asm-x86/hvm/svm/svm.h
+++ b/xen/include/asm-x86/hvm/svm/svm.h
@@ -64,6 +64,7 @@ extern u32 svm_feature_flags;
#define SVM_FEATURE_FLUSHBYASID 6 /* TLB flush by ASID support */
#define SVM_FEATURE_DECODEASSISTS 7 /* Decode assists support */
#define SVM_FEATURE_PAUSEFILTER 10 /* Pause intercept filter support */
+#define SVM_FEATURE_SPEC_CTRL 20 /* MSR_SPEC_CTRL virtualisation */
#define cpu_has_svm_feature(f) test_bit(f, &svm_feature_flags)
#define cpu_has_svm_npt cpu_has_svm_feature(SVM_FEATURE_NPT)
@@ -74,6 +75,7 @@ extern u32 svm_feature_flags;
#define cpu_has_svm_decode cpu_has_svm_feature(SVM_FEATURE_DECODEASSISTS)
#define cpu_has_pause_filter cpu_has_svm_feature(SVM_FEATURE_PAUSEFILTER)
#define cpu_has_tsc_ratio cpu_has_svm_feature(SVM_FEATURE_TSCRATEMSR)
+#define cpu_has_svm_spec_ctrl cpu_has_svm_feature(SVM_FEATURE_SPEC_CTRL)
#define SVM_PAUSEFILTER_INIT 3000
--- a/xen/include/asm-x86/hvm/svm/vmcb.h
+++ b/xen/include/asm-x86/hvm/svm/vmcb.h
@@ -486,7 +486,9 @@ struct vmcb_struct {
u64 _lastbranchtoip; /* cleanbit 10 */
u64 _lastintfromip; /* cleanbit 10 */
u64 _lastinttoip; /* cleanbit 10 */
- u64 res16[301];
+ u64 res16[9];
+ u64 spec_ctrl;
+ u64 res17[291];
};
struct svm_domain {
--- a/xen/include/asm-x86/msr-index.h
+++ b/xen/include/asm-x86/msr-index.h
@@ -43,6 +43,7 @@
#define SPEC_CTRL_IBRS (_AC(1, ULL) << 0)
#define SPEC_CTRL_STIBP (_AC(1, ULL) << 1)
#define SPEC_CTRL_SSBD (_AC(1, ULL) << 2)
+#define SPEC_CTRL_PSFD (_AC(1, ULL) << 7)
#define MSR_PRED_CMD 0x00000049
#define PRED_CMD_IBPB (_AC(1, ULL) << 0)
@@ -257,6 +258,9 @@
#define MSR_F15H_CU_POWER 0xc001007a
#define MSR_F15H_CU_MAX_POWER 0xc001007b
+
+#define MSR_VIRT_SPEC_CTRL 0xc001011f /* Layout matches MSR_SPEC_CTRL */
+
#define MSR_AMD_FAM15H_EVNTSEL0 0xc0010200
#define MSR_AMD_FAM15H_PERFCTR0 0xc0010201
#define MSR_AMD_FAM15H_EVNTSEL1 0xc0010202
--- a/xen/include/public/arch-x86/cpufeatureset.h
+++ b/xen/include/public/arch-x86/cpufeatureset.h
@@ -238,6 +238,16 @@ XEN_CPUFEATURE(EFRO, 7*32+10) /
/* AMD-defined CPU features, CPUID level 0x80000008.ebx, word 8 */
XEN_CPUFEATURE(CLZERO, 8*32+ 0) /*A CLZERO instruction */
XEN_CPUFEATURE(IBPB, 8*32+12) /*A IBPB support only (no IBRS, used by AMD) */
+XEN_CPUFEATURE(IBRS, 8*32+14) /* MSR_SPEC_CTRL.IBRS */
+XEN_CPUFEATURE(AMD_STIBP, 8*32+15) /* MSR_SPEC_CTRL.STIBP */
+XEN_CPUFEATURE(IBRS_ALWAYS, 8*32+16) /* IBRS preferred always on */
+XEN_CPUFEATURE(STIBP_ALWAYS, 8*32+17) /* STIBP preferred always on */
+XEN_CPUFEATURE(IBRS_FAST, 8*32+18) /* IBRS preferred over software options */
+XEN_CPUFEATURE(IBRS_SAME_MODE, 8*32+19) /* IBRS provides same-mode protection */
+XEN_CPUFEATURE(AMD_SSBD, 8*32+24) /* MSR_SPEC_CTRL.SSBD available */
+XEN_CPUFEATURE(VIRT_SSBD, 8*32+25) /* MSR_VIRT_SPEC_CTRL.SSBD */
+XEN_CPUFEATURE(SSB_NO, 8*32+26) /* Hardware not vulnerable to SSB */
+XEN_CPUFEATURE(PSFD, 8*32+28) /* MSR_SPEC_CTRL.PSFD */
/* Intel-defined CPU features, CPUID level 0x00000007:0.edx, word 9 */
XEN_CPUFEATURE(AVX512_4VNNIW, 9*32+ 2) /*A AVX512 Neural Network Instructions */
