You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
69 lines
2.6 KiB
69 lines
2.6 KiB
2 months ago
|
From fe60f8d47b6e14f17dd6c06b03bd00e6bcdbeefb Mon Sep 17 00:00:00 2001
|
||
|
|
From: Zhenzhong Duan <zhenzhong.duan@intel.com>
|
||
|
|
Date: Wed, 20 Mar 2024 17:31:38 +0800
|
||
|
|
Subject: [PATCH 005/100] target/i386: Introduce Icelake-Server-v7 to enable
|
||
|
|
TSX
|
||
|
|
|
||
|
|
RH-Author: Paolo Bonzini <pbonzini@redhat.com>
|
||
|
|
RH-MergeRequest: 245: SEV-SNP support
|
||
|
|
RH-Jira: RHEL-39544
|
||
|
|
RH-Acked-by: Thomas Huth <thuth@redhat.com>
|
||
|
|
RH-Acked-by: Bandan Das <bdas@redhat.com>
|
||
|
|
RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
|
||
|
|
RH-Commit: [5/91] 66d865899e0d510b6c86763422d6b28b904b208a (bonzini/rhel-qemu-kvm)
|
||
|
|
|
||
|
|
When start L2 guest with both L1/L2 using Icelake-Server-v3 or above,
|
||
|
|
QEMU reports below warning:
|
||
|
|
|
||
|
|
"warning: host doesn't support requested feature: MSR(10AH).taa-no [bit 8]"
|
||
|
|
|
||
|
|
Reason is QEMU Icelake-Server-v3 has TSX feature disabled but enables taa-no
|
||
|
|
bit. It's meaningless that TSX isn't supported but still claim TSX is secure.
|
||
|
|
So L1 KVM doesn't expose taa-no to L2 if TSX is unsupported, then starting L2
|
||
|
|
triggers the warning.
|
||
|
|
|
||
|
|
Fix it by introducing a new version Icelake-Server-v7 which has both TSX
|
||
|
|
and taa-no features. Then guest can use TSX securely when it see taa-no.
|
||
|
|
|
||
|
|
This matches the production Icelake which supports TSX and isn't susceptible
|
||
|
|
to TSX Async Abort (TAA) vulnerabilities, a.k.a, taa-no.
|
||
|
|
|
||
|
|
Ideally, TSX should have being enabled together with taa-no since v3, but for
|
||
|
|
compatibility, we'd better to add v7 to enable it.
|
||
|
|
|
||
|
|
Fixes: d965dc35592d ("target/i386: Add ARCH_CAPABILITIES related bits into Icelake-Server CPU model")
|
||
|
|
Tested-by: Xiangfei Ma <xiangfeix.ma@intel.com>
|
||
|
|
Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
|
||
|
|
Message-ID: <20240320093138.80267-2-zhenzhong.duan@intel.com>
|
||
|
|
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
|
||
|
|
(cherry picked from commit c895fa54e3060c5ac6f3888dce96c9b78626072b)
|
||
|
|
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
|
||
|
|
---
|
||
|
|
target/i386/cpu.c | 10 ++++++++++
|
||
|
|
1 file changed, 10 insertions(+)
|
||
|
|
|
||
|
|
diff --git a/target/i386/cpu.c b/target/i386/cpu.c
|
||
|
|
index a7f71422ea..0aa88d9b48 100644
|
||
|
|
--- a/target/i386/cpu.c
|
||
|
|
+++ b/target/i386/cpu.c
|
||
|
|
@@ -3840,6 +3840,16 @@ static const X86CPUDefinition builtin_x86_defs[] = {
|
||
|
|
{ /* end of list */ }
|
||
|
|
},
|
||
|
|
},
|
||
|
|
+ {
|
||
|
|
+ .version = 7,
|
||
|
|
+ .note = "TSX, taa-no",
|
||
|
|
+ .props = (PropValue[]) {
|
||
|
|
+ /* Restore TSX features removed by -v2 above */
|
||
|
|
+ { "hle", "on" },
|
||
|
|
+ { "rtm", "on" },
|
||
|
|
+ { /* end of list */ }
|
||
|
|
+ },
|
||
|
|
+ },
|
||
|
|
{ /* end of list */ }
|
||
|
|
}
|
||
|
|
},
|
||
|
|
--
|
||
|
|
2.39.3
|
||
|
|
|