From 73fac9c9beb00cc462eaae8589b4b2261142a8b2 Mon Sep 17 00:00:00 2001 From: Eduardo Habkost Date: Wed, 4 Dec 2019 01:48:29 +0100 Subject: [PATCH 2/2] target/i386: add support for MSR_IA32_TSX_CTRL RH-Author: Eduardo Habkost Message-id: <20191204014829.608318-3-ehabkost@redhat.com> Patchwork-id: 92854 O-Subject: [RHEL-7.8 qemu-kvm PATCH 2/2] target/i386: add support for MSR_IA32_TSX_CTRL Bugzilla: 1771961 RH-Acked-by: Paolo Bonzini RH-Acked-by: Dr. David Alan Gilbert RH-Acked-by: Igor Mammedov From: Paolo Bonzini The MSR_IA32_TSX_CTRL MSR can be used to hide TSX (also known as the Trusty Side-channel Extension). By virtualizing the MSR, KVM guests can disable TSX and avoid paying the price of mitigating TSX-based attacks on microarchitectural side channels. Backport notes: * MSR code had to be rewritten * .needed is inside VMStateSubsection Reviewed-by: Eduardo Habkost Signed-off-by: Paolo Bonzini Signed-off-by: Eduardo Habkost (cherry picked from commit 2a9758c51e2c2d13fc3845c3d603c11df98b8823) Signed-off-by: Eduardo Habkost Signed-off-by: Miroslav Rezanina --- target-i386/cpu.c | 2 +- target-i386/cpu.h | 5 +++++ target-i386/kvm.c | 14 ++++++++++++++ target-i386/machine.c | 21 +++++++++++++++++++++ 4 files changed, 41 insertions(+), 1 deletion(-) diff --git a/target-i386/cpu.c b/target-i386/cpu.c index 120df73..57f5364 100644 --- a/target-i386/cpu.c +++ b/target-i386/cpu.c @@ -211,7 +211,7 @@ static const char *cpuid_apm_edx_feature_name[] = { static const char *cpuid_arch_capabilities_feature_name[] = { "rdctl-no", "ibrs-all", "rsba", "skip-l1dfl-vmentry", - "ssb-no", "mds-no", NULL, NULL, + "ssb-no", "mds-no", NULL, "tsx-ctrl", "taa-no", NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, diff --git a/target-i386/cpu.h b/target-i386/cpu.h index 8f73af7..c9bcdd5 100644 --- a/target-i386/cpu.h +++ b/target-i386/cpu.h @@ -307,7 +307,11 @@ #define MSR_IA32_SPEC_CTRL 0x48 #define MSR_VIRT_SSBD 0xc001011f #define MSR_IA32_PRED_CMD 0x49 + #define MSR_IA32_ARCH_CAPABILITIES 0x10a +#define ARCH_CAP_TSX_CTRL_MSR (1<<7) + +#define MSR_IA32_TSX_CTRL 0x122 #define MSR_IA32_TSCDEADLINE 0x6e0 #define MSR_P6_PERFCTR0 0xc1 @@ -1067,6 +1071,7 @@ typedef struct CPUX86State { uint64_t xss; uint32_t pkru; + uint32_t tsx_ctrl; uint64_t spec_ctrl; uint64_t virt_ssbd; diff --git a/target-i386/kvm.c b/target-i386/kvm.c index c79b0ea..7df2b28 100644 --- a/target-i386/kvm.c +++ b/target-i386/kvm.c @@ -80,6 +80,7 @@ static bool has_msr_hv_tsc; static bool has_msr_mtrr; static bool has_msr_xss; static bool has_msr_spec_ctrl; +static bool has_msr_tsx_ctrl; static bool has_msr_virt_ssbd; static bool has_msr_arch_capabs; @@ -908,6 +909,10 @@ static int kvm_get_supported_msrs(KVMState *s) has_msr_spec_ctrl = true; continue; } + if (kvm_msr_list->indices[i] == MSR_IA32_TSX_CTRL) { + has_msr_tsx_ctrl = true; + continue; + } if (kvm_msr_list->indices[i] == MSR_VIRT_SSBD) { has_msr_virt_ssbd = true; continue; @@ -1330,6 +1335,9 @@ static int kvm_put_msrs(X86CPU *cpu, int level) if (has_msr_spec_ctrl) { kvm_msr_entry_set(&msrs[n++], MSR_IA32_SPEC_CTRL, env->spec_ctrl); } + if (has_msr_tsx_ctrl) { + kvm_msr_entry_set(&msrs[n++], MSR_IA32_TSX_CTRL, env->tsx_ctrl); + } if (has_msr_virt_ssbd) { kvm_msr_entry_set(&msrs[n++], MSR_VIRT_SSBD, env->virt_ssbd); } @@ -1699,6 +1707,9 @@ static int kvm_get_msrs(X86CPU *cpu) if (has_msr_spec_ctrl) { msrs[n++].index = MSR_IA32_SPEC_CTRL; } + if (has_msr_tsx_ctrl) { + msrs[n++].index = MSR_IA32_TSX_CTRL; + } if (has_msr_virt_ssbd) { msrs[n++].index = MSR_VIRT_SSBD; } @@ -1945,6 +1956,9 @@ static int kvm_get_msrs(X86CPU *cpu) case MSR_IA32_SPEC_CTRL: env->spec_ctrl = msrs[i].data; break; + case MSR_IA32_TSX_CTRL: + env->tsx_ctrl = msrs[i].data; + break; case MSR_VIRT_SSBD: env->virt_ssbd = msrs[i].data; break; diff --git a/target-i386/machine.c b/target-i386/machine.c index cd2cf6f..892c8f4 100644 --- a/target-i386/machine.c +++ b/target-i386/machine.c @@ -778,6 +778,24 @@ static const VMStateDescription vmstate_msr_virt_ssbd = { } }; +static bool msr_tsx_ctrl_needed(void *opaque) +{ + X86CPU *cpu = opaque; + CPUX86State *env = &cpu->env; + + return env->features[FEAT_ARCH_CAPABILITIES] & ARCH_CAP_TSX_CTRL_MSR; +} + +static const VMStateDescription vmstate_msr_tsx_ctrl = { + .name = "cpu/msr_tsx_ctrl", + .version_id = 1, + .minimum_version_id = 1, + .fields = (VMStateField[]) { + VMSTATE_UINT32(env.tsx_ctrl, X86CPU), + VMSTATE_END_OF_LIST() + } +}; + VMStateDescription vmstate_x86_cpu = { .name = "cpu", .version_id = 12, @@ -938,6 +956,9 @@ VMStateDescription vmstate_x86_cpu = { }, { .vmsd = &vmstate_msr_virt_ssbd, .needed = virt_ssbd_needed, + }, { + .vmsd = &vmstate_msr_tsx_ctrl, + .needed = msr_tsx_ctrl_needed, } , { /* empty */ } -- 1.8.3.1