|
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index] [Xen-changelog] [xen stable-4.8] x86/msr: Emulation of MSR_{SPEC_CTRL, PRED_CMD} for guests
commit 29e7171e9dd0aa8e35f790157d781dff22f6a970
Author: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
AuthorDate: Thu Feb 8 12:52:37 2018 +0100
Commit: Jan Beulich <jbeulich@xxxxxxxx>
CommitDate: Thu Feb 8 12:52:37 2018 +0100
x86/msr: Emulation of MSR_{SPEC_CTRL,PRED_CMD} for guests
As per the spec currently available here:
https://software.intel.com/sites/default/files/managed/c5/63/336996-Speculative-Execution-Side-Channel-Mitigations.pdf
MSR_ARCH_CAPABILITIES will only come into existence on new hardware, but is
implemented as a straight #GP for now to avoid being leaky when new hardware
arrives.
Signed-off-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
Reviewed-by: Jan Beulich <jbeulich@xxxxxxxx>
master commit: ea58a679a6190e714a592f1369b660769a48a80c
master date: 2018-01-26 14:10:21 +0000
---
xen/arch/x86/domain.c | 5 ++--
xen/arch/x86/hvm/hvm.c | 54 +++++++++++++++++++++++++++++++++++++++--
xen/arch/x86/traps.c | 49 +++++++++++++++++++++++++++++++++++++
xen/include/asm-x86/domain.h | 4 ++-
xen/include/asm-x86/msr-index.h | 2 ++
5 files changed, 108 insertions(+), 6 deletions(-)
diff --git a/xen/arch/x86/domain.c b/xen/arch/x86/domain.c
index 7e74832..db2e57e 100644
--- a/xen/arch/x86/domain.c
+++ b/xen/arch/x86/domain.c
@@ -2684,7 +2684,7 @@ void arch_dump_vcpu_info(struct vcpu *v)
}
void domain_cpuid(
- struct domain *d,
+ const struct domain *d,
unsigned int input,
unsigned int sub_input,
unsigned int *eax,
@@ -2692,12 +2692,11 @@ void domain_cpuid(
unsigned int *ecx,
unsigned int *edx)
{
- cpuid_input_t *cpuid;
int i;
for ( i = 0; i < MAX_CPUID_INPUT; i++ )
{
- cpuid = &d->arch.cpuids[i];
+ const cpuid_input_t *cpuid = &d->arch.cpuids[i];
if ( (cpuid->input[0] == input) &&
((cpuid->input[1] == XEN_CPUID_INPUT_UNUSED) ||
diff --git a/xen/arch/x86/hvm/hvm.c b/xen/arch/x86/hvm/hvm.c
index a5ad7ca..876dcfe 100644
--- a/xen/arch/x86/hvm/hvm.c
+++ b/xen/arch/x86/hvm/hvm.c
@@ -3840,7 +3840,7 @@ int hvm_msr_read_intercept(unsigned int msr, uint64_t
*msr_content)
switch ( msr )
{
- unsigned int eax, ebx, ecx, index;
+ unsigned int eax, ebx, ecx, edx, index;
case MSR_EFER:
*msr_content = v->arch.hvm_vcpu.guest_efer;
@@ -3927,6 +3927,21 @@ int hvm_msr_read_intercept(unsigned int msr, uint64_t
*msr_content)
goto gp_fault;
break;
+ case MSR_PRED_CMD:
+ /* Write-only */
+ goto gp_fault;
+
+ case MSR_SPEC_CTRL:
+ hvm_cpuid(7, NULL, NULL, NULL, &edx);
+ if ( !(edx & cpufeat_mask(X86_FEATURE_IBRSB)) )
+ goto gp_fault;
+ *msr_content = v->arch.spec_ctrl;
+ break;
+
+ case MSR_ARCH_CAPABILITIES:
+ /* Not implemented yet. */
+ goto gp_fault;
+
case MSR_K8_ENABLE_C1E:
case MSR_AMD64_NB_CFG:
/*
@@ -3993,7 +4008,7 @@ int hvm_msr_write_intercept(unsigned int msr, uint64_t
msr_content,
switch ( msr )
{
- unsigned int eax, ebx, ecx, index;
+ unsigned int eax, ebx, ecx, edx, index;
case MSR_EFER:
if ( hvm_set_efer(msr_content) )
@@ -4094,6 +4109,41 @@ int hvm_msr_write_intercept(unsigned int msr, uint64_t
msr_content,
goto gp_fault;
break;
+ case MSR_SPEC_CTRL:
+ hvm_cpuid(7, NULL, NULL, NULL, &edx);
+ if ( !(edx & cpufeat_mask(X86_FEATURE_IBRSB)) )
+ goto gp_fault; /* MSR available? */
+
+ /*
+ * Note: SPEC_CTRL_STIBP is specified as safe to use (i.e. ignored)
+ * when STIBP isn't enumerated in hardware.
+ */
+
+ if ( msr_content & ~(SPEC_CTRL_IBRS | SPEC_CTRL_STIBP) )
+ goto gp_fault; /* Rsvd bit set? */
+
+ v->arch.spec_ctrl = msr_content;
+ break;
+
+ case MSR_PRED_CMD:
+ hvm_cpuid(7, NULL, NULL, NULL, &edx);
+ hvm_cpuid(0x80000008, NULL, &ebx, NULL, NULL);
+ if ( !(edx & cpufeat_mask(X86_FEATURE_IBRSB)) &&
+ !(ebx & cpufeat_mask(X86_FEATURE_IBPB)) )
+ goto gp_fault; /* MSR available? */
+
+ /*
+ * The only defined behaviour is when writing PRED_CMD_IBPB. In
+ * practice, real hardware accepts any value without faulting.
+ */
+ if ( msr_content & PRED_CMD_IBPB )
+ wrmsrl(MSR_PRED_CMD, PRED_CMD_IBPB);
+ break;
+
+ case MSR_ARCH_CAPABILITIES:
+ /* Read-only */
+ goto gp_fault;
+
case MSR_AMD64_NB_CFG:
/* ignore the write */
break;
diff --git a/xen/arch/x86/traps.c b/xen/arch/x86/traps.c
index 5d6ccde..7c6af70 100644
--- a/xen/arch/x86/traps.c
+++ b/xen/arch/x86/traps.c
@@ -2431,6 +2431,7 @@ static int priv_op_read_msr(unsigned int reg, uint64_t
*val,
switch ( reg )
{
int rc;
+ uint32_t edx, dummy;
case MSR_FS_BASE:
if ( is_pv_32bit_domain(currd) )
@@ -2504,6 +2505,17 @@ static int priv_op_read_msr(unsigned int reg, uint64_t
*val,
*val = 0;
return X86EMUL_OKAY;
+ case MSR_PRED_CMD:
+ /* Write-only */
+ break;
+
+ case MSR_SPEC_CTRL:
+ domain_cpuid(currd, 7, 0, &dummy, &dummy, &dummy, &edx);
+ if ( !(edx & cpufeat_mask(X86_FEATURE_IBRSB)) )
+ break;
+ *val = curr->arch.spec_ctrl;
+ return X86EMUL_OKAY;
+
case MSR_INTEL_PLATFORM_INFO:
if ( !boot_cpu_has(X86_FEATURE_MSR_PLATFORM_INFO) )
break;
@@ -2512,6 +2524,10 @@ static int priv_op_read_msr(unsigned int reg, uint64_t
*val,
*val |= MSR_PLATFORM_INFO_CPUID_FAULTING;
return X86EMUL_OKAY;
+ case MSR_ARCH_CAPABILITIES:
+ /* Not implemented yet. */
+ break;
+
case MSR_INTEL_MISC_FEATURES_ENABLES:
if ( !boot_cpu_has(X86_FEATURE_MSR_MISC_FEATURES) )
break;
@@ -2577,6 +2593,7 @@ static int priv_op_write_msr(unsigned int reg, uint64_t
val,
{
uint64_t temp;
int rc;
+ uint32_t ebx, edx, dummy;
case MSR_FS_BASE:
if ( is_pv_32bit_domain(currd) || !is_canonical_address(val) )
@@ -2716,9 +2733,41 @@ static int priv_op_write_msr(unsigned int reg, uint64_t
val,
return X86EMUL_OKAY;
case MSR_INTEL_PLATFORM_INFO:
+ case MSR_ARCH_CAPABILITIES:
/* The MSR is read-only. */
break;
+ case MSR_SPEC_CTRL:
+ domain_cpuid(currd, 7, 0, &dummy, &dummy, &dummy, &edx);
+ if ( !(edx & cpufeat_mask(X86_FEATURE_IBRSB)) )
+ break; /* MSR available? */
+
+ /*
+ * Note: SPEC_CTRL_STIBP is specified as safe to use (i.e. ignored)
+ * when STIBP isn't enumerated in hardware.
+ */
+
+ if ( val & ~(SPEC_CTRL_IBRS | SPEC_CTRL_STIBP) )
+ break; /* Rsvd bit set? */
+
+ curr->arch.spec_ctrl = val;
+ return X86EMUL_OKAY;
+
+ case MSR_PRED_CMD:
+ domain_cpuid(currd, 7, 0, &dummy, &dummy, &dummy, &edx);
+ domain_cpuid(currd, 0x80000008, 0, &dummy, &ebx, &dummy, &dummy);
+ if ( !(edx & cpufeat_mask(X86_FEATURE_IBRSB)) &&
+ !(ebx & cpufeat_mask(X86_FEATURE_IBPB)) )
+ break; /* MSR available? */
+
+ /*
+ * The only defined behaviour is when writing PRED_CMD_IBPB. In
+ * practice, real hardware accepts any value without faulting.
+ */
+ if ( val & PRED_CMD_IBPB )
+ wrmsrl(MSR_PRED_CMD, PRED_CMD_IBPB);
+ return X86EMUL_OKAY;
+
case MSR_INTEL_MISC_FEATURES_ENABLES:
if ( !boot_cpu_has(X86_FEATURE_MSR_MISC_FEATURES) ||
(val & ~MSR_MISC_FEATURES_CPUID_FAULTING) )
diff --git a/xen/include/asm-x86/domain.h b/xen/include/asm-x86/domain.h
index 33f1c88..8699fa3 100644
--- a/xen/include/asm-x86/domain.h
+++ b/xen/include/asm-x86/domain.h
@@ -576,6 +576,8 @@ struct arch_vcpu
struct paging_vcpu paging;
+ uint32_t spec_ctrl;
+
uint32_t gdbsx_vcpu_event;
/* A secondary copy of the vcpu time info. */
@@ -615,7 +617,7 @@ unsigned long pv_guest_cr4_fixup(const struct vcpu *,
unsigned long guest_cr4);
X86_CR4_OSXSAVE | X86_CR4_SMEP | \
X86_CR4_FSGSBASE | X86_CR4_SMAP))
-void domain_cpuid(struct domain *d,
+void domain_cpuid(const struct domain *d,
unsigned int input,
unsigned int sub_input,
unsigned int *eax,
diff --git a/xen/include/asm-x86/msr-index.h b/xen/include/asm-x86/msr-index.h
index fc5bf79..05ad0b9 100644
--- a/xen/include/asm-x86/msr-index.h
+++ b/xen/include/asm-x86/msr-index.h
@@ -39,6 +39,8 @@
#define MSR_PRED_CMD 0x00000049
#define PRED_CMD_IBPB (_AC(1, ULL) << 0)
+#define MSR_ARCH_CAPABILITIES 0x0000010a
+
/* Intel MSRs. Some also available on other CPUs */
#define MSR_IA32_PERFCTR0 0x000000c1
#define MSR_IA32_A_PERFCTR0 0x000004c1
--
generated by git-patchbot for /home/xen/git/xen.git#stable-4.8
_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxxxxxxxxx
https://lists.xenproject.org/xen-changelog
|
 |
Lists.xenproject.org is hosted with RackSpace, monitoring our |