[PATCH v2 for-4.21 2/2] x86/AMD: disable RDSEED on most of Zen5

[Jan Beulich <jbeulich@xxxxxxxx>]

This particular variant has an error that causes 16- and 32-bit forms of
RDSEED to frequently return 0 while still signaling success (CF=1). Refer
to AMD-SB-7055 / CVE-2025-62626.

Relevant data taken from Linux commit <TBD, see [1]>
("x86/CPU/AMD: Add RDSEED fix for Zen5").

As for the other RDSEED issue, the same command line override can be used
to keep RDSEED enabled.

[1] 
https://lore.kernel.org/lkml/176165291198.2601451.3074910014537130674.tip-bot2@tip-bot2/T/#u

Signed-off-by: Jan Beulich <jbeulich@xxxxxxxx>
---
See "x86/AMD: disable RDSEED on Fam17 model 47 stepping 0" for pending
opens.
---
v2: New.

--- a/xen/arch/x86/cpu/amd.c
+++ b/xen/arch/x86/cpu/amd.c
@@ -1246,6 +1246,43 @@ static void cf_check init_amd(struct cpu
                if (!cpu_has_hypervisor && !cpu_has(c, X86_FEATURE_BTC_NO))
                        __set_bit(X86_FEATURE_BTC_NO, c->x86_capability);
                break;
+
+       case 0x1a:
+               /*
+                * Zen5 have an error that causes the 16- and 32-bit forms of
+                * RDSEED to frequently return 0 while signaling success (CF=1).
+                * Sadly at the time of writing the fixed microcode revision is
+                * known for only two of the models.
+                */
+               if (c == &boot_cpu_data &&
+                   cpu_has(c, X86_FEATURE_RDSEED) &&
+                   !is_forced_cpu_cap(X86_FEATURE_RDSEED)) {
+                       static const char __initconst text[] =
+                               "RDSEED32 is unreliable on this hardware; 
disabling its exposure\n";
+                       bool good = false;
+
+                       switch (c->model) {
+                       case 0x02:
+                               if (c->stepping == 1 &&
+                                   this_cpu(cpu_sig).rev >= 0x0b00215a)
+                                       good = true;
+                               break;
+
+                       case 0x11:
+                               if (c->stepping == 0 &&
+                                   this_cpu(cpu_sig).rev >= 0x0b101054)
+                                       good = true;
+                               break;
+                       }
+
+                       if (good)
+                               break;
+
+                       setup_clear_cpu_cap(X86_FEATURE_RDSEED);
+                       cpuidmask_defaults._7ab0 &= 
~cpufeat_mask(X86_FEATURE_RDSEED);
+                       warning_add(text);
+               }
+               break;
        }
 
        display_cacheinfo(c);