From: Jonathan Gray <jsg@jsg.id.au>
Subject: mitigate AMD Zen-2 op cache corruption
To: tech@openbsd.org
Date: Wed, 13 May 2026 11:25:37 +1000

https://www.amd.com/en/resources/product-security/bulletin/amd-sb-7052.html

"Improper isolation of shared resources within the CPU operation cache
on Zen 2-based products could allow an attacker to corrupt instructions
executed at a different privilege level, potentially resulting in
privilege escalation."

fails to mention the related chicken bit which can be seen in
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=c21b90f77687075115d989e53a8ec5e2bb427ab1

tested on Renoir:
cpu0: AMD Ryzen 5 PRO 4650U with Radeon Graphics, 2100.00 MHz, 17-60-01

Index: sys/arch/amd64/include/specialreg.h
===================================================================
RCS file: /cvs/src/sys/arch/amd64/include/specialreg.h,v
diff -u -p -r1.122 specialreg.h
--- sys/arch/amd64/include/specialreg.h	19 Apr 2026 01:10:28 -0000	1.122
+++ sys/arch/amd64/include/specialreg.h	13 May 2026 00:37:08 -0000
@@ -710,6 +710,9 @@
 #define DE_CFG_SERIALIZE_LFENCE	(1 << 1)	/* Enable serializing lfence */
 #define DE_CFG_SERIALIZE_9 (1 << 9)	/* Zenbleed chickenbit */
 
+#define MSR_BP_CFG	0xc001102e
+#define BP_CFG_33	(1ULL << 33)	/* op cache chickenbit, AMD-SB-7052 */
+
 #define IPM_C1E_CMP_HLT	0x10000000
 #define IPM_SMI_CMP_HLT	0x08000000
 
Index: sys/arch/amd64/amd64/cpu.c
===================================================================
RCS file: /cvs/src/sys/arch/amd64/amd64/cpu.c,v
diff -u -p -r1.205 cpu.c
--- sys/arch/amd64/amd64/cpu.c	19 Apr 2026 01:10:28 -0000	1.205
+++ sys/arch/amd64/amd64/cpu.c	13 May 2026 00:43:19 -0000
@@ -1292,12 +1292,18 @@ cpu_fix_msrs(struct cpu_info *ci)
 			if (msr != nmsr)
 				wrmsr(MSR_DE_CFG, nmsr);
 		}
+		/* Zen 2 mitigations: Zenbleed, op cache corruption */
 		if (family == 0x17 && ci->ci_model >= 0x31 &&
 		    (cpu_ecxfeature & CPUIDECX_HV) == 0) {
 			nmsr = msr = rdmsr(MSR_DE_CFG);
 			nmsr |= DE_CFG_SERIALIZE_9;
 			if (msr != nmsr)
 				wrmsr(MSR_DE_CFG, nmsr);
+
+			nmsr = msr = rdmsr(MSR_BP_CFG);
+			nmsr |= BP_CFG_33;
+			if (msr != nmsr)
+				wrmsr(MSR_BP_CFG, nmsr);
 		}
 		/*
 		 * Mitigation for Floating Point Divider State Sampling
Index: sys/arch/i386/include/specialreg.h
===================================================================
RCS file: /cvs/src/sys/arch/i386/include/specialreg.h,v
diff -u -p -r1.86 specialreg.h
--- sys/arch/i386/include/specialreg.h	19 Apr 2026 01:10:28 -0000	1.86
+++ sys/arch/i386/include/specialreg.h	13 May 2026 00:44:59 -0000
@@ -535,6 +535,9 @@
 #define	DE_CFG_SERIALIZE_LFENCE	(1 << 1)	/* Enable serializing lfence */
 #define DE_CFG_SERIALIZE_9 (1 << 9)		/* Zenbleed chickenbit */
 
+#define MSR_BP_CFG	0xc001102e
+#define BP_CFG_33	(1ULL << 33)	/* op cache chickenbit, AMD-SB-7052 */
+
 #define IPM_C1E_CMP_HLT	0x10000000
 #define IPM_SMI_CMP_HLT	0x08000000
 
Index: sys/arch/i386/i386/machdep.c
===================================================================
RCS file: /cvs/src/sys/arch/i386/i386/machdep.c,v
diff -u -p -r1.679 machdep.c
--- sys/arch/i386/i386/machdep.c	19 Apr 2026 01:10:28 -0000	1.679
+++ sys/arch/i386/i386/machdep.c	13 May 2026 00:46:16 -0000
@@ -2019,12 +2019,18 @@ identifycpu(struct cpu_info *ci)
 			if (msr != nmsr)
 				wrmsr(MSR_DE_CFG, nmsr);
 		}
+		/* Zen 2 mitigations: Zenbleed, op cache corruption */
 		if (ci->ci_family == 0x17 && ci->ci_model >= 0x31 &&
 		    (cpu_ecxfeature & CPUIDECX_HV) == 0) {
 			nmsr = msr = rdmsr(MSR_DE_CFG);
 			nmsr |= DE_CFG_SERIALIZE_9;
 			if (msr != nmsr)
 				wrmsr(MSR_DE_CFG, nmsr);
+
+			nmsr = msr = rdmsr(MSR_BP_CFG);
+			nmsr |= BP_CFG_33;
+			if (msr != nmsr)
+				wrmsr(MSR_BP_CFG, nmsr);
 		}
 		/*
 		 * Mitigation for Floating Point Divider State Sampling