File 5b72fbbf-7-x86-virtualise-MSR_FLUSH_CMD-for-guests.patch of Package xen.10697

# Commit fd9823faf9df057a69a9a53c2e100691d3f4267c
# Date 2018-08-14 16:56:47 +0100
# Author Andrew Cooper <andrew.cooper3@citrix.com>
# Committer Andrew Cooper <andrew.cooper3@citrix.com>
x86/msr: Virtualise MSR_FLUSH_CMD for guests

Guests (outside of the nested virt case, which isn't supported yet) don't need
L1D_FLUSH for their L1TF mitigations, but offering/emulating MSR_FLUSH_CMD is
easy and doesn't pose an issue for Xen.

The MSR is offered to HVM guests only.  PV guests attempting to use it would
trap for emulation, and the L1D cache would fill long before the return to
guest context.  As such, PV guests can't make any use of the L1D_FLUSH
functionality.

This is part of XSA-273 / CVE-2018-3646.

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>

--- a/xen/arch/x86/hvm/hvm.c
+++ b/xen/arch/x86/hvm/hvm.c
@@ -3377,6 +3377,7 @@ int hvm_msr_read_intercept(unsigned int
     case MSR_AMD_PATCHLOADER:
     case MSR_IA32_UCODE_WRITE:
     case MSR_PRED_CMD:
+    case MSR_FLUSH_CMD:
         /* Write-only */
         goto gp_fault;
 
@@ -3571,6 +3572,17 @@ int hvm_msr_write_intercept(unsigned int
         wrmsrl(MSR_PRED_CMD, msr_content);
         break;
 
+    case MSR_FLUSH_CMD:
+        hvm_cpuid(7, NULL, NULL, NULL, &edx);
+        if ( !(edx & cpufeat_mask(X86_FEATURE_L1D_FLUSH)) )
+            goto gp_fault; /* MSR available? */
+
+        if ( msr_content & ~FLUSH_CMD_L1D )
+            goto gp_fault; /* Rsvd bit set? */
+
+        wrmsrl(MSR_FLUSH_CMD, msr_content);
+        break;
+
     case MSR_ARCH_CAPABILITIES:
         /* Read-only */
         goto gp_fault;
--- a/xen/arch/x86/hvm/vmx/vmcs.c
+++ b/xen/arch/x86/hvm/vmx/vmcs.c
@@ -1477,6 +1477,14 @@ void vmx_do_resume(struct vcpu *v)
             vmx_enable_intercept_for_msr(v, MSR_PRED_CMD,
                                          MSR_TYPE_R | MSR_TYPE_W);
 
+        /* MSR_FLUSH_CMD is safe to pass through if the guest knows about it. */
+        if ( _7d0 & cpufeat_mask(X86_FEATURE_L1D_FLUSH) )
+            vmx_disable_intercept_for_msr(v, MSR_FLUSH_CMD,
+                                          MSR_TYPE_R | MSR_TYPE_W);
+        else
+            vmx_enable_intercept_for_msr(v, MSR_FLUSH_CMD,
+                                         MSR_TYPE_R | MSR_TYPE_W);
+
         v->arch.flags |= TF_launched;
     }
 
--- a/xen/arch/x86/traps.c
+++ b/xen/arch/x86/traps.c
@@ -2625,6 +2625,10 @@ static int emulate_privileged_op(struct
 
             wrmsrl(MSR_PRED_CMD, msr_content);
             break;
+
+        case MSR_FLUSH_CMD:
+            goto fail; /* Not available to PV guests. */
+
         default:
             if ( wrmsr_hypervisor_regs(regs->ecx, msr_content) == 1 )
                 break;
@@ -2715,6 +2719,7 @@ static int emulate_privileged_op(struct
             regs->edx = (uint32_t)(msr_content >> 32);
             break;
         case MSR_PRED_CMD:
+        case MSR_FLUSH_CMD:
             /* Write-only */
             goto fail;