Sign Up
Log In
Log In
or
Sign Up
Places
All Projects
Status Monitor
Collapse sidebar
SUSE:SLE-12-SP1:Update
xen.8426
xsa273-7.patch
Overview
Repositories
Revisions
Requests
Users
Attributes
Meta
File xsa273-7.patch of Package xen.8426
x86/msr: Virtualise MSR_FLUSH_CMD for guests Guests (outside of the nested virt case, which isn't supported yet) don't need L1D_FLUSH for their L1TF mitigations, but offering/emulating MSR_FLUSH_CMD is easy and doesn't pose an issue for Xen. The MSR is offered to HVM guests only. PV guests attempting to use it would trap for emulation, and the L1D cache would fill long before the return to guest context. As such, PV guests can't make any use of the L1D_FLUSH functionality. This is part of XSA-273 / CVE-2018-3646. Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com> Reviewed-by: Jan Beulich <jbeulich@suse.com> --- a/xen/arch/x86/hvm/hvm.c +++ b/xen/arch/x86/hvm/hvm.c @@ -4544,6 +4544,7 @@ int hvm_msr_read_intercept(unsigned int break; case MSR_PRED_CMD: + case MSR_FLUSH_CMD: /* Write-only */ goto gp_fault; @@ -4721,6 +4722,17 @@ int hvm_msr_write_intercept(unsigned int wrmsrl(MSR_PRED_CMD, msr_content); break; + case MSR_FLUSH_CMD: + hvm_cpuid(7, NULL, NULL, NULL, &edx); + if ( !(edx & cpufeat_mask(X86_FEATURE_L1D_FLUSH)) ) + goto gp_fault; /* MSR available? */ + + if ( msr_content & ~FLUSH_CMD_L1D ) + goto gp_fault; /* Rsvd bit set? */ + + wrmsrl(MSR_FLUSH_CMD, msr_content); + break; + case MSR_ARCH_CAPABILITIES: /* Read-only */ goto gp_fault; --- a/xen/arch/x86/hvm/vmx/vmcs.c +++ b/xen/arch/x86/hvm/vmx/vmcs.c @@ -1498,6 +1498,14 @@ void vmx_do_resume(struct vcpu *v) vmx_enable_intercept_for_msr(v, MSR_PRED_CMD, MSR_TYPE_R | MSR_TYPE_W); + /* MSR_FLUSH_CMD is safe to pass through if the guest knows about it. */ + if ( _7d0 & cpufeat_mask(X86_FEATURE_L1D_FLUSH) ) + vmx_disable_intercept_for_msr(v, MSR_FLUSH_CMD, + MSR_TYPE_R | MSR_TYPE_W); + else + vmx_enable_intercept_for_msr(v, MSR_FLUSH_CMD, + MSR_TYPE_R | MSR_TYPE_W); + v->arch.flags |= TF_launched; } --- a/xen/arch/x86/traps.c +++ b/xen/arch/x86/traps.c @@ -2696,6 +2696,9 @@ static int emulate_privileged_op(struct wrmsrl(MSR_PRED_CMD, msr_content); break; + case MSR_FLUSH_CMD: + goto fail; /* Not available to PV guests. */ + default: if ( wrmsr_hypervisor_regs(regs->ecx, msr_content) == 1 ) break; @@ -2801,6 +2804,7 @@ static int emulate_privileged_op(struct break; case MSR_PRED_CMD: + case MSR_FLUSH_CMD: /* Write-only */ goto fail;
Locations
Projects
Search
Status Monitor
Help
OpenBuildService.org
Documentation
API Documentation
Code of Conduct
Contact
Support
@OBShq
Terms
openSUSE Build Service is sponsored by
The Open Build Service is an
openSUSE project
.
Sign Up
Log In
Places
Places
All Projects
Status Monitor