[xen stable-4.18] x86/amd: Mitigate AMD-SN-7052

[patchbot@xxxxxxx]

commit 581a10f8846768920e7f809e1c51cf2a9f13cbce
Author:     Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
AuthorDate: Tue Nov 4 18:08:07 2025 +0000
Commit:     Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
CommitDate: Wed May 6 15:32:57 2026 +0100

    x86/amd: Mitigate AMD-SN-7052
    
    This is XSA-490 / CVE-2025-54518.
    
    Signed-off-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
    Reviewed-by: Roger Pau Monné <roger.pau@xxxxxxxxxx>
    (cherry picked from commit 8070bdfa7220e772fae248abd3cbf5e87fc0fefb)
---
 xen/arch/x86/cpu/amd.c | 24 +++++++++++++++++++-----
 1 file changed, 19 insertions(+), 5 deletions(-)

diff --git a/xen/arch/x86/cpu/amd.c b/xen/arch/x86/cpu/amd.c
index 43cd3ae9ba..89284b740b 100644
--- a/xen/arch/x86/cpu/amd.c
+++ b/xen/arch/x86/cpu/amd.c
@@ -1049,11 +1049,25 @@ static void amd_check_bp_cfg(void)
 {
        uint64_t val, new = 0;
 
-       /*
-        * AMD Erratum #1485.  Set bit 5, as instructed.
-        */
-       if (!cpu_has_hypervisor && boot_cpu_data.x86 == 0x19 && is_zen4_uarch())
-               new |= (1 << 5);
+       if (!cpu_has_hypervisor) {
+               /*
+                * AMD Erratum #1485.  If SMT is enabled and STIBP disabled,
+                * the CPU may fetch incorrect instruction bytes.
+                *
+                * Set bit 5, as instructed.
+                */
+               if (boot_cpu_data.x86 == 0x19 && is_zen4_uarch())
+                       new |= (1 << 5);
+
+               /*
+                * AMD SB-7052.  CPU OP Cache corruption, causing instructions
+                * to be executed at a higher privilege.
+                *
+                * Set bit 33, as instructed.
+                */
+               if (boot_cpu_data.x86 == 0x17 && is_zen2_uarch())
+                       new |= (1UL << 33);
+       }
 
        /*
         * On hardware supporting SRSO_MSR_FIX, activate BP_SPEC_REDUCE by
--
generated by git-patchbot for /home/xen/git/xen.git#stable-4.18