[Pedro Henrique Penna (ppenna)]

Pins amd.genoa.v2, a second revision of the Genoa CPU profile, for the Genoa hosts whose hypervisor presents nothing in 0x80000021 and no basic leaf above 0xd: the nested-MSHV host of microsoft/nvx#409 and the nested-WHP host of microsoft/nvx#928, both Azure VMs with an AMD EPYC 9V74. On both, every cold boot with --cpu-profile auto fails before the guest runs:

[E_PROFILE_UNSUPPORTED] the hypervisor's processor features cannot present CPU profile amd.genoa.v1: they lack tsa_l1_no_support, tsa_sq_no_support

Based on feature/microvm/dev. This branch is two commits directly on 57d0a18b3, the head of feature/microvm/dev since #4767 landed, and the revision that NVX's dev pins. It was rebased there from e68871cc6 after #4767 landed: git range-diff shows identical patches, and only the first commit's port note changed, to name the new base.

Cause

amd.genoa.v1 pins what one GitHub-hosted runner's KVM offers on an Azure VM with an EPYC 9V74: the maximum basic leaf 0x1c, LFENCE serialization and NoSmmCtlMsr in 0x80000021 EAX (0x204), and the TSA immunities, TSA_SQ_NO and TSA_L1_NO, in 0x80000021 ECX (0x6). The Microsoft hypervisor presents none of them to the partitions of these hosts, under nested MSHV (Microsoft Hv 10.0.26100.9444, Standard_D64als_v6) and nested WHP (10.0.26100.32522, Standard_D8ads_v5) alike, so both hosts' fingerprints fail amd.genoa.v1 on all three, and their processor features lack both TSA immunities.

amd.genoa.v2 (689577604)

Enrique Saurez's commit d946e7a8 from nanvix/openvmm, cherry-picked with its authorship; its message describes it in full. amd.genoa.v2 (sha256:8ee00e9ee8fd5defe3eebdc343733195d477f5f3449defa403f616d530a84839) derives from the runner's KVM fingerprint and the MSHV host's under the unchanged policy, openvmm-cpu-profile-policy/v1, and is amd.genoa.v1 but for two differences:

• 0x80000021 reads zero, as under amd.milan.v1. Linux guests still serialize LFENCE through DE_CFG, whose LFENCE bit reads set under every AMD profile, and report TSA as vulnerable.
• The maximum basic leaf is 0xd. The leaves 0xe to 0x1c, which amd.genoa.v1 lists as zero, are out of range.

Deriving it needed one fix to the registers' classes: 0x80000008 EDX, AMD's INVLPGB page count and RDPRU's largest register index, is now a limit, whose derivation takes the minimum, instead of a descriptive register, on which the two hosts' single votes tied. Every pinned profile clears that register, so every pinned profile rederives identically.

auto selects a generation's latest revision, so it selects amd.genoa.v2 on every Genoa host, GitHub's runners included. amd.genoa.v1 stays pinned: --cpu-profile amd.genoa.v1 still selects it, and its snapshots still restore where it is supported.

The cherry-pick conflicted only in the snapshot guide, whose paragraph on the pinned profiles this branch's base has reworded since. The resolution keeps the commit's sentences on Genoa's revisions and the base's on auto's fallback to a host profile. pinned_data.rs regenerates byte-identically with generate_pinned.

The WHP host (d2338ea22)

Records the nested-WHP host of microsoft/nvx#928 as test_support::GENOA_WHP_CPUID and GENOA_WHP_HOST, from its --cpu-fingerprint (surface digest sha256:16be9bd6dcff0e889003df7c287ae9acf34d3a801edc2e4b31d6f8b2a3ebfd23). That WHP offers exactly the processor features of the Milan WHP host that amd.milan.v1 derives from, and its CPUID is that host's but for the CPU's identity and its cache and TLB descriptors.

• hv_banks::tests::the_genoa_mshv_and_whp_hosts_present_the_second_genoa_profile, which extends the MSHV host's test: neither host's processor features can present amd.genoa.v1, both lacking tsa_l1_no_support and tsa_sq_no_support, and both present amd.genoa.v2.
• check::tests::the_genoa_whp_host_supports_the_second_genoa_profile: the fingerprint fails amd.genoa.v1 with exactly the violations that the host reported, and passes amd.genoa.v2, which auto selects, once a partition configured from the profile reads zero at CET's XSAVE components, 0xd.11 and 0xd.12, as on the Milan WHP host.
• derive::tests::the_whp_host_adds_nothing_to_the_second_genoa_profile: deriving revision 2 from the KVM, MSHV, and WHP hosts gives amd.genoa.v2's CPUID, XSAVE state, and MSRs, so the WHP host constrains nothing that the others do not, and amd.genoa.v2 keeps its digest and its provenance.

Validation

• On Windows with Rust 1.95.0, at d2338ea22: cargo clippy --all-targets -p cpu_profile -p virt_whp -- -D warnings, cargo doc --no-deps -p cpu_profile -p virt_whp with -D warnings, cargo nextest run --profile agent -p cpu_profile -p virt_whp (162 passed, 17 skipped), and cargo xtask fmt --fix (clean). Before the rebase, the same checks passed at b61b4b363 and, with 160 tests, at 8bd425136.
• d946e7a8's author validated it, on an earlier base, on the MSHV host of Qualify the AMD CPU profiles on MSHV, WHP, and bare-metal hosts, and pin profiles for AMD client CPUs nvx#409, all on auto: the fingerprint check, the time ABI preflight with 1 and 4 VPs, a 2-VP boot, and 15 snapshot captures and restores.
• Not run: the WHP host of CPU profile: Standard_D8ads_v5 / EPYC 9V74 fails amd.genoa.v1 on WHP nvx#928, whose reporter is asked to qualify it, and Linux builds and tests, the Guide build, and the VMM tests, which CI covers.
• openvmm: pin amd.genoa.v2 for Genoa hosts without the TSA immunities nvx#935 pins this branch's head, d2338ea22, with the coordinated changes to NVX's copies of the catalog, and runs NVX's CI matrix with it.

Part of microsoft/nvx#409 and microsoft/nvx#928.

[github-actions]

28 Petri tests failed (29 unstable)

[github-actions]

1 Petri tests failed (2 unstable)