From 7f7a585d5bd3c7f1275d28c77d9d67513c1de36c Mon Sep 17 00:00:00 2001 From: Paolo Bonzini Date: Wed, 13 Nov 2019 15:54:35 +0100 Subject: target/i386: add PSCHANGE_NO bit for the ARCH_CAPABILITIES MSR This is required to disable ITLB multihit mitigations in nested hypervisors. Signed-off-by: Paolo Bonzini --- target/i386/cpu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'target') diff --git a/target/i386/cpu.c b/target/i386/cpu.c index a624163..2f60df3 100644 --- a/target/i386/cpu.c +++ b/target/i386/cpu.c @@ -1204,7 +1204,7 @@ static FeatureWordInfo feature_word_info[FEATURE_WORDS] = { .type = MSR_FEATURE_WORD, .feat_names = { "rdctl-no", "ibrs-all", "rsba", "skip-l1dfl-vmentry", - "ssb-no", "mds-no", NULL, NULL, + "ssb-no", "mds-no", "pschange-mc-no", NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, -- cgit v1.1 From 7fac38635e1cc5ebae34eb6530da1009bd5808e4 Mon Sep 17 00:00:00 2001 From: Pawan Gupta Date: Mon, 18 Nov 2019 23:23:27 -0800 Subject: target/i386: Export TAA_NO bit to guests TSX Async Abort (TAA) is a side channel attack on internal buffers in some Intel processors similar to Microachitectural Data Sampling (MDS). Some future Intel processors will use the ARCH_CAP_TAA_NO bit in the IA32_ARCH_CAPABILITIES MSR to report that they are not vulnerable to TAA. Make this bit available to guests. Signed-off-by: Pawan Gupta Signed-off-by: Paolo Bonzini --- target/i386/cpu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'target') diff --git a/target/i386/cpu.c b/target/i386/cpu.c index 2f60df3..296b491 100644 --- a/target/i386/cpu.c +++ b/target/i386/cpu.c @@ -1205,7 +1205,7 @@ static FeatureWordInfo feature_word_info[FEATURE_WORDS] = { .feat_names = { "rdctl-no", "ibrs-all", "rsba", "skip-l1dfl-vmentry", "ssb-no", "mds-no", "pschange-mc-no", NULL, - NULL, NULL, NULL, NULL, + "taa-no", NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, -- cgit v1.1 From 2f34ebf222d6a9367665a4bf78b8c861a988c1d0 Mon Sep 17 00:00:00 2001 From: Liam Merwick Date: Mon, 18 Nov 2019 11:13:25 +0000 Subject: hw/i386: Move save_tsc_khz from PCMachineClass to X86MachineClass Attempting to migrate a VM using the microvm machine class results in the source QEMU aborting with the following message/backtrace: target/i386/machine.c:955:tsc_khz_needed: Object 0x555556608fa0 is not an instance of type generic-pc-machine abort() object_class_dynamic_cast_assert() vmstate_save_state_v() vmstate_save_state() vmstate_save() qemu_savevm_state_complete_precopy() migration_thread() migration_thread() migration_thread() qemu_thread_start() start_thread() clone() The access to the machine class returned by MACHINE_GET_CLASS() in tsc_khz_needed() is crashing as it is trying to dereference a different type of machine class object (TYPE_PC_MACHINE) to that of this microVM. This can be resolved by extending the changes in the following commit f0bb276bf8d5 ("hw/i386: split PCMachineState deriving X86MachineState from it") and moving the save_tsc_khz field in PCMachineClass to X86MachineClass. Fixes: f0bb276bf8d5 ("hw/i386: split PCMachineState deriving X86MachineState from it") Signed-off-by: Liam Merwick Reviewed-by: Darren Kenny Message-Id: <1574075605-25215-1-git-send-email-liam.merwick@oracle.com> Reviewed-by: Sergio Lopez Signed-off-by: Paolo Bonzini --- target/i386/machine.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'target') diff --git a/target/i386/machine.c b/target/i386/machine.c index 6481f84..7bdeb78 100644 --- a/target/i386/machine.c +++ b/target/i386/machine.c @@ -988,8 +988,8 @@ static bool tsc_khz_needed(void *opaque) X86CPU *cpu = opaque; CPUX86State *env = &cpu->env; MachineClass *mc = MACHINE_GET_CLASS(qdev_get_machine()); - PCMachineClass *pcmc = PC_MACHINE_CLASS(mc); - return env->tsc_khz && pcmc->save_tsc_khz; + X86MachineClass *x86mc = X86_MACHINE_CLASS(mc); + return env->tsc_khz && x86mc->save_tsc_khz; } static const VMStateDescription vmstate_tsc_khz = { -- cgit v1.1