Expose bits related to SRSO vulnerability

[Markus Schade]

[Impact]

According to AMD's Speculative Return Stack Overflow whitepaper the hypervisor should synthesize the value of IBPB_BRTYPE and SBPB CPUID bits to the guest.

Support for this is already present in noble kernel with commit e47d86083c66 ("KVM: x86: Add SBPB support") and commit 6f0f23ef76be ("KVM: x86: Add IBPB_BRTYPE support").

Add support in QEMU to expose the bits to the guest OS.

[Test Plan]

 * First of all we'll (and have in advance) run general regression tests
 * Qemu shall show to be aware of the new flags
   #qemu-system-x86_64 -cpu ? | grep -E 'sbpb|ibpb-brtype'
     gfni hle ht hypervisor ia64 ibpb ibpb-brtype ibrs ibrs-all ibs intel-pt
     sbdr-ssdp-no sbpb sep serialize sgx sgx-aex-notify sgx-debug sgx-edeccssa
 * host:
  # cat /sys/devices/system/cpu/vulnerabilities/spec_rstack_overflow
  Mitigation: Safe RET

 * before (guest):
   $ cpuid -l 0x80000021 -1 -r
   0x80000021 0x00: eax=0x00000045 ebx=0x00000000 ecx=0x00000000 edx=0x00000000
                            ^
   $ cat /sys/devices/system/cpu/vulnerabilities/spec_rstack_overflow
   Vulnerable: Safe RET, no microcode

 * after (guest) with CPU flags added:
   $ cpuid -l 0x80000021 -1 -r
   0x80000021 0x00: eax=0x18000045 ebx=0x00000000 ecx=0x00000000 edx=0x00000000
                            ^
   $ cat /sys/devices/system/cpu/vulnerabilities/spec_rstack_overflow
   Mitigation: Safe RET

[Where problems could occur]

  * None to be expected as these flags are not (yet) included in any predefined CPU model

---

Relevant patches needed for qemu 8.2 in noble:

target/i386: Expose IBPB-BRTYPE and SBPB CPUID bits to the guest:
* https://gitlab.com/qemu-project/qemu/-/commit/0701abbf9880b5ab1cf44e0caa6ad173aec840e7.patch

target/i386: Fix minor typo in NO_NESTED_DATA_BP feature bit:
* https://gitlab.com/qemu-project/qemu/-/commit/9c882ad4dc96f658ff9f92b88b3749d0398e6fa2.patch

target/i386: Expose bits related to SRSO vulnerability
* https://gitlab.com/qemu-project/qemu/-/commit/2ec282b8eaaddf5c136f7566b5f61d80288a2065.patch

[Christian Ehrhardt (paelzer)]

Hi Markus and thanks for the always great prep when reporting such.

The patches are already in upstream qemu v9.2 which we have in Plucky.
Let us check if they can be backported without breakage to the most recent LTS.

In this particular case it will indeed be more regression tests, as I'd want to make sure this does not break e.g. migration of fixed<->unfixed systemd, on a matrix of intel (unlikely to have any effect) and AMD (potential) hardware.

But totally yes, if we can make this work out it allows the guests to not apply the mitigations if exposed as fixed by HW/FW already.

P.S. I'll be out a few days, so this won't be super quick

[Lukas Märdian (slyon)]

The patches apply cleanly, I prepared a PPA for testing and MRs for Noble & Oracular.

PPA: https://launchpad.net/~slyon/+archive/ubuntu/lp-2101944-srso/+packages

Noble: https://code.launchpad.net/~slyon/ubuntu/+source/qemu/+git/qemu/+merge/483036
Oracular: https://code.launchpad.net/~slyon/ubuntu/+source/qemu/+git/qemu/+merge/483037