File 5ad4948b-x86-correct-MSR_PRED_CMD-emulation.patch of Package xen.7673

Overview Repositories Revisions Requests Users Attributes Meta

File 5ad4948b-x86-correct-MSR_PRED_CMD-emulation.patch of Package xen.7673

# Commit a6aa678fa380e9369cc44701a181142322b3a4b0
# Date 2018-04-16 13:18:19 +0100
# Author Andrew Cooper <andrew.cooper3@citrix.com>
# Committer Andrew Cooper <andrew.cooper3@citrix.com>
x86/msr: Correct the emulation behaviour of MSR_PRED_CMD

Experimentally, the behaviour of reserved bits in MSR_PRED_CMD changed between
beta and production microcode, and now raises a #GP fault for set reserved
bits.  The AMD spec for future hardware also specifies this behaviour, and it
is the more sensible behaviour to implement.

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>

# Commit a996273d1fc10d14598985703227bfa35a91f681
# Date 2018-04-18 11:16:37 +0200
# Author Jan Beulich <jbeulich@suse.com>
# Committer Jan Beulich <jbeulich@suse.com>
x86/msr: further correct the emulation behaviour of MSR_PRED_CMD

Following commit a6aa678fa3 ("x86/msr: Correct the emulation behaviour
of MSR_PRED_CMD") we may end up writing the low bit with the wrong
value. While it's unlikely for a guest to want to write zero there, we
should still permit (this without incurring the overhead of an actual
barrier). Correcting this right away will also help whenever further
bits in the MSR might become defined.

Signed-off-by: Jan Beulich <jbeulich@suse.com>
Acked-by: Andrew Cooper <andrew.cooper3@citrix.com>

--- a/xen/arch/x86/hvm/hvm.c
+++ b/xen/arch/x86/hvm/hvm.c
@@ -3542,12 +3542,10 @@ int hvm_msr_write_intercept(unsigned int
              !(ebx & cpufeat_mask(X86_FEATURE_IBPB)) )
             goto gp_fault; /* MSR available? */
 
-        /*
-         * The only defined behaviour is when writing PRED_CMD_IBPB.  In
-         * practice, real hardware accepts any value without faulting.
-         */
-        if ( msr_content & PRED_CMD_IBPB )
-            wrmsrl(MSR_PRED_CMD, PRED_CMD_IBPB);
+        if ( msr_content & ~PRED_CMD_IBPB )
+            goto gp_fault; /* Rsvd bit set? */
+
+        wrmsrl(MSR_PRED_CMD, msr_content);
         break;
 
     case MSR_ARCH_CAPABILITIES:
--- a/xen/arch/x86/traps.c
+++ b/xen/arch/x86/traps.c
@@ -2608,12 +2608,10 @@ static int emulate_privileged_op(struct
                  !(ebx & cpufeat_mask(X86_FEATURE_IBPB)) )
                 goto fail; /* MSR available? */
 
-            /*
-             * The only defined behaviour is when writing PRED_CMD_IBPB.  In
-             * practice, real hardware accepts any value without faulting.
-             */
-            if ( eax & PRED_CMD_IBPB )
-                wrmsrl(MSR_PRED_CMD, PRED_CMD_IBPB);
+            if ( msr_content & ~PRED_CMD_IBPB )
+                goto fail; /* Rsvd bit set? */
+
+            wrmsrl(MSR_PRED_CMD, msr_content);
             break;
         default:
             if ( wrmsr_hypervisor_regs(regs->ecx, msr_content) == 1 )

Places

File 5ad4948b-x86-correct-MSR_PRED_CMD-emulation.patch of Package xen.7673

Places