File 5a6b36cd-2-x86-msr-emulation-of-SPEC_CTRL-PRED_CMD.patch of Package xen.openSUSE_Leap_42.3_Update

# Commit ea58a679a6190e714a592f1369b660769a48a80c
# Date 2018-01-26 14:10:21 +0000
# Author Andrew Cooper <andrew.cooper3@citrix.com>
# Committer Andrew Cooper <andrew.cooper3@citrix.com>
x86/msr: Emulation of MSR_{SPEC_CTRL,PRED_CMD} for guests

As per the spec currently available here:

https://software.intel.com/sites/default/files/managed/c5/63/336996-Speculative-Execution-Side-Channel-Mitigations.pdf

MSR_ARCH_CAPABILITIES will only come into existence on new hardware, but is
implemented as a straight #GP for now to avoid being leaky when new hardware
arrives.

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>

--- a/xen/arch/x86/hvm/hvm.c
+++ b/xen/arch/x86/hvm/hvm.c
@@ -3422,6 +3422,20 @@ int hvm_msr_read_intercept(unsigned int
             goto gp_fault;
         break;
 
+    case MSR_PRED_CMD:
+        /* Write-only */
+        goto gp_fault;
+
+    case MSR_SPEC_CTRL:
+        if ( !d->arch.cpuid->feat.ibrsb )
+            goto gp_fault;
+        *msr_content = v->arch.spec_ctrl;
+        break;
+
+    case MSR_ARCH_CAPABILITIES:
+        /* Not implemented yet. */
+        goto gp_fault;
+
     case MSR_K8_ENABLE_C1E:
     case MSR_AMD64_NB_CFG:
          /*
@@ -3574,6 +3588,37 @@ int hvm_msr_write_intercept(unsigned int
             goto gp_fault;
         break;
 
+    case MSR_SPEC_CTRL:
+        if ( !d->arch.cpuid->feat.ibrsb )
+            goto gp_fault; /* MSR available? */
+
+        /*
+         * Note: SPEC_CTRL_STIBP is specified as safe to use (i.e. ignored)
+         * when STIBP isn't enumerated in hardware.
+         */
+
+        if ( msr_content & ~(SPEC_CTRL_IBRS | SPEC_CTRL_STIBP) )
+            goto gp_fault; /* Rsvd bit set? */
+
+        v->arch.spec_ctrl = msr_content;
+        break;
+
+    case MSR_PRED_CMD:
+        if ( !d->arch.cpuid->feat.ibrsb && !d->arch.cpuid->extd.ibpb )
+            goto gp_fault; /* MSR available? */
+
+        /*
+         * The only defined behaviour is when writing PRED_CMD_IBPB.  In
+         * practice, real hardware accepts any value without faulting.
+         */
+        if ( msr_content & PRED_CMD_IBPB )
+            wrmsrl(MSR_PRED_CMD, PRED_CMD_IBPB);
+        break;
+
+    case MSR_ARCH_CAPABILITIES:
+        /* Read-only */
+        goto gp_fault;
+
     case MSR_AMD64_NB_CFG:
         /* ignore the write */
         break;
--- a/xen/arch/x86/traps.c
+++ b/xen/arch/x86/traps.c
@@ -2636,6 +2636,16 @@ static int priv_op_read_msr(unsigned int
         *val = 0;
         return X86EMUL_OKAY;
 
+    case MSR_PRED_CMD:
+        /* Write-only */
+        break;
+
+    case MSR_SPEC_CTRL:
+        if ( !currd->arch.cpuid->feat.ibrsb )
+            break;
+        *val = curr->arch.spec_ctrl;
+        return X86EMUL_OKAY;
+
     case MSR_INTEL_PLATFORM_INFO:
         if ( !boot_cpu_has(X86_FEATURE_MSR_PLATFORM_INFO) )
             break;
@@ -2644,6 +2654,10 @@ static int priv_op_read_msr(unsigned int
             *val |= MSR_PLATFORM_INFO_CPUID_FAULTING;
         return X86EMUL_OKAY;
 
+    case MSR_ARCH_CAPABILITIES:
+        /* Not implemented yet. */
+        break;
+
     case MSR_INTEL_MISC_FEATURES_ENABLES:
         if ( !boot_cpu_has(X86_FEATURE_MSR_MISC_FEATURES) )
             break;
@@ -2843,9 +2857,37 @@ static int priv_op_write_msr(unsigned in
         return X86EMUL_OKAY;
 
     case MSR_INTEL_PLATFORM_INFO:
+    case MSR_ARCH_CAPABILITIES:
         /* The MSR is read-only. */
         break;
 
+    case MSR_SPEC_CTRL:
+        if ( !currd->arch.cpuid->feat.ibrsb )
+            break; /* MSR available? */
+
+        /*
+         * Note: SPEC_CTRL_STIBP is specified as safe to use (i.e. ignored)
+         * when STIBP isn't enumerated in hardware.
+         */
+
+        if ( val & ~(SPEC_CTRL_IBRS | SPEC_CTRL_STIBP) )
+            break; /* Rsvd bit set? */
+
+        curr->arch.spec_ctrl = val;
+        return X86EMUL_OKAY;
+
+    case MSR_PRED_CMD:
+        if ( !currd->arch.cpuid->feat.ibrsb && !currd->arch.cpuid->extd.ibpb )
+            break; /* MSR available? */
+
+        /*
+         * The only defined behaviour is when writing PRED_CMD_IBPB.  In
+         * practice, real hardware accepts any value without faulting.
+         */
+        if ( val & PRED_CMD_IBPB )
+            wrmsrl(MSR_PRED_CMD, PRED_CMD_IBPB);
+        return X86EMUL_OKAY;
+
     case MSR_INTEL_MISC_FEATURES_ENABLES:
         if ( !boot_cpu_has(X86_FEATURE_MSR_MISC_FEATURES) ||
              (val & ~MSR_MISC_FEATURES_CPUID_FAULTING) )
--- a/xen/include/asm-x86/domain.h
+++ b/xen/include/asm-x86/domain.h
@@ -572,6 +572,8 @@ struct arch_vcpu
 
     struct paging_vcpu paging;
 
+    uint32_t spec_ctrl;
+
     uint32_t gdbsx_vcpu_event;
 
     /* A secondary copy of the vcpu time info. */
--- a/xen/include/asm-x86/msr-index.h
+++ b/xen/include/asm-x86/msr-index.h
@@ -39,6 +39,8 @@
 #define MSR_PRED_CMD			0x00000049
 #define PRED_CMD_IBPB			(_AC(1, ULL) << 0)
 
+#define MSR_ARCH_CAPABILITIES		0x0000010a
+
 /* Intel MSRs. Some also available on other CPUs */
 #define MSR_IA32_PERFCTR0		0x000000c1
 #define MSR_IA32_A_PERFCTR0		0x000004c1