Re: [PATCH v2 2/2] target/i386: Add TSA feature flag verw-clear

[Paolo Bonzini <pbonzini@redhat.com>]

On 7/10/25 21:46, Babu Moger wrote:
> Transient Scheduler Attacks (TSA) are new speculative side channel attacks
> related to the execution timing of instructions under specific
> microarchitectural conditions. In some cases, an attacker may be able to
> use this timing information to infer data from other contexts, resulting in
> information leakage
> 
> CPUID Fn8000_0021 EAX[5] (VERW_CLEAR). If this bit is 1, the memory form of
> the VERW instruction may be used to help mitigate TSA.
> 
> Link: https://www.amd.com/content/dam/amd/en/documents/resources/bulletin/technical-guidance-for-mitigating-transient-scheduler-attacks.pdf
> Co-developed-by: Borislav Petkov (AMD) <bp@alien8.de>
> Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
> Signed-off-by: Babu Moger <babu.moger@amd.com>

Applied, thanks.

Paolo

> ---
> v2: Split the patches into two.
>      Not adding the feature bit in CPU model now. Users can add the feature
>      bits by using the option "-cpu EPYC-Genoa,+verw-clear".
> 
> v1: https://lore.kernel.org/qemu-devel/20250709104956.GAaG5JVO-74EF96hHO@fat_crate.local/
> ---
>   target/i386/cpu.c | 2 +-
>   target/i386/cpu.h | 2 ++
>   2 files changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/target/i386/cpu.c b/target/i386/cpu.c
> index 2cd07b86b5..d46bc65e44 100644
> --- a/target/i386/cpu.c
> +++ b/target/i386/cpu.c
> @@ -1274,7 +1274,7 @@ FeatureWordInfo feature_word_info[FEATURE_WORDS] = {
>           .type = CPUID_FEATURE_WORD,
>           .feat_names = {
>               "no-nested-data-bp", "fs-gs-base-ns", "lfence-always-serializing", NULL,
> -            NULL, NULL, "null-sel-clr-base", NULL,
> +            NULL, "verw-clear", "null-sel-clr-base", NULL,
>               "auto-ibrs", NULL, NULL, NULL,
>               NULL, NULL, NULL, NULL,
>               NULL, NULL, NULL, NULL,
> diff --git a/target/i386/cpu.h b/target/i386/cpu.h
> index 6a9eb2dbf7..4127acf1b1 100644
> --- a/target/i386/cpu.h
> +++ b/target/i386/cpu.h
> @@ -1102,6 +1102,8 @@ uint64_t x86_cpu_get_supported_feature_word(X86CPU *cpu, FeatureWord w);
>   #define CPUID_8000_0021_EAX_FS_GS_BASE_NS                (1U << 1)
>   /* LFENCE is always serializing */
>   #define CPUID_8000_0021_EAX_LFENCE_ALWAYS_SERIALIZING    (1U << 2)
> +/* Memory form of VERW mitigates TSA */
> +#define CPUID_8000_0021_EAX_VERW_CLEAR                   (1U << 5)
>   /* Null Selector Clears Base */
>   #define CPUID_8000_0021_EAX_NULL_SEL_CLR_BASE            (1U << 6)
>   /* Automatic IBRS */