[Qemu-devel] [PATCH 0/5] Add Icelake CPU model

[Qemu-devel] [PATCH 0/5] Add Icelake CPU model

[Robert Hoo]

This patch set defines the new guest CPU models of Icelake.

The first patch adds support of IA32_PRED_CMD MSR (IBPB) and IA32_ARCH_CAPABILITIES MSR.
Other patches add CPUID bits feature words for new features, like PCONFIG,
WBNOINVD. The final patch defines Icelake-{Server,Client} CPU models.


Robert Hoo (5):
  i386: Add support for IA32_PRED_CMD and IA32_ARCH_CAPABILITIES MSRs
  i386: Add CPUID bit and feature words for IA32_ARCH_CAPABILITIES MSR
  i386: Add CPUID bit for PCONFIG
  i386: Add CPUID bit for WBNOINVD
  i386: Add new CPU model Icelake-{Server,Client}

 target/i386/cpu.c     | 122 ++++++++++++++++++++++++++++++++++++++++++++++++--
 target/i386/cpu.h     |   7 +++
 target/i386/kvm.c     |  27 ++++++++++-
 target/i386/machine.c |  40 +++++++++++++++++
 4 files changed, 192 insertions(+), 4 deletions(-)

-- 
1.8.3.1

[Qemu-devel] [PATCH 1/5] i386: Add support for IA32_PRED_CMD and IA32_ARCH_CAPABILITIES MSRs

[Robert Hoo]

IA32_PRED_CMD MSR gives software a way to issue commands that affect the state
of indirect branch predictors. Enumerated by CPUID.(EAX=7H,ECX=0):EDX[26].
IA32_ARCH_CAPABILITIES MSR enumerates architectural features of RDCL_NO and
IBRS_ALL. Enumerated by CPUID.(EAX=07H, ECX=0):EDX[29].

https://software.intel.com/sites/default/files/managed/c5/63/336996-Speculative-Execution-Side-Channel-Mitigations.pdf

Signed-off-by: Robert Hoo <robert.hu@linux.intel.com>
---
 target/i386/cpu.h     |  4 ++++
 target/i386/kvm.c     | 27 ++++++++++++++++++++++++++-
 target/i386/machine.c | 40 ++++++++++++++++++++++++++++++++++++++++
 3 files changed, 70 insertions(+), 1 deletion(-)

diff --git a/target/i386/cpu.h b/target/i386/cpu.h
index 89c82be..734a73e 100644
--- a/target/i386/cpu.h
+++ b/target/i386/cpu.h
@@ -352,6 +352,8 @@ typedef enum X86Seg {
 #define MSR_TSC_ADJUST                  0x0000003b
 #define MSR_IA32_SPEC_CTRL              0x48
 #define MSR_VIRT_SSBD                   0xc001011f
+#define MSR_IA32_PRED_CMD               0x49
+#define MSR_IA32_ARCH_CAPABILITIES      0x10a
 #define MSR_IA32_TSCDEADLINE            0x6e0
 
 #define FEATURE_CONTROL_LOCKED                    (1<<0)
@@ -1210,6 +1212,8 @@ typedef struct CPUX86State {
 
     uint64_t spec_ctrl;
     uint64_t virt_ssbd;
+    uint64_t pred_cmd;
+    uint64_t arch_capabilities;
 
     /* End of state preserved by INIT (dummy marker).  */
     struct {} end_init_save;
diff --git a/target/i386/kvm.c b/target/i386/kvm.c
index 445e0e0..5232446 100644
--- a/target/i386/kvm.c
+++ b/target/i386/kvm.c
@@ -93,6 +93,8 @@ static bool has_msr_hv_reenlightenment;
 static bool has_msr_xss;
 static bool has_msr_spec_ctrl;
 static bool has_msr_virt_ssbd;
+static bool has_msr_pred_cmd;
+static bool has_msr_arch_capabilities;
 static bool has_msr_smi_count;
 
 static uint32_t has_architectural_pmu_version;
@@ -1258,6 +1260,11 @@ static int kvm_get_supported_msrs(KVMState *s)
                     break;
                 case MSR_VIRT_SSBD:
                     has_msr_virt_ssbd = true;
+                case MSR_IA32_PRED_CMD:
+                    has_msr_pred_cmd = true;
+                    break;
+                case MSR_IA32_ARCH_CAPABILITIES:
+                    has_msr_arch_capabilities = true;
                     break;
                 }
             }
@@ -1750,7 +1757,13 @@ static int kvm_put_msrs(X86CPU *cpu, int level)
     if (has_msr_virt_ssbd) {
         kvm_msr_entry_add(cpu, MSR_VIRT_SSBD, env->virt_ssbd);
     }
-
+    if (has_msr_pred_cmd) {
+        kvm_msr_entry_add(cpu, MSR_IA32_PRED_CMD, env->pred_cmd);
+    }
+    if (has_msr_arch_capabilities) {
+        kvm_msr_entry_add(cpu, MSR_IA32_ARCH_CAPABILITIES,
+            env->arch_capabilities);
+    }
 #ifdef TARGET_X86_64
     if (lm_capable_kernel) {
         kvm_msr_entry_add(cpu, MSR_CSTAR, env->cstar);
@@ -2133,6 +2146,13 @@ static int kvm_get_msrs(X86CPU *cpu)
     if (has_msr_virt_ssbd) {
         kvm_msr_entry_add(cpu, MSR_VIRT_SSBD, 0);
     }
+    if (has_msr_pred_cmd) {
+        kvm_msr_entry_add(cpu, MSR_IA32_PRED_CMD, 0);
+    }
+    if (has_msr_arch_capabilities) {
+        kvm_msr_entry_add(cpu, MSR_IA32_ARCH_CAPABILITIES, 0);
+    }
+
     if (!env->tsc_valid) {
         kvm_msr_entry_add(cpu, MSR_IA32_TSC, 0);
         env->tsc_valid = !runstate_is_running();
@@ -2514,6 +2534,11 @@ static int kvm_get_msrs(X86CPU *cpu)
             break;
         case MSR_VIRT_SSBD:
             env->virt_ssbd = msrs[i].data;
+        case MSR_IA32_PRED_CMD:
+            env->pred_cmd = msrs[i].data;
+            break;
+        case MSR_IA32_ARCH_CAPABILITIES:
+            env->arch_capabilities = msrs[i].data;
             break;
         case MSR_IA32_RTIT_CTL:
             env->msr_rtit_ctrl = msrs[i].data;
diff --git a/target/i386/machine.c b/target/i386/machine.c
index 4d98d36..089aba0 100644
--- a/target/i386/machine.c
+++ b/target/i386/machine.c
@@ -879,6 +879,44 @@ static const VMStateDescription vmstate_spec_ctrl = {
     }
 };
 
+static bool pred_cmd_needed(void *opaque)
+{
+    X86CPU *cpu = opaque;
+    CPUX86State *env = &cpu->env;
+
+    return env->pred_cmd != 0;
+}
+
+static const VMStateDescription vmstate_pred_cmd = {
+    .name = "cpu/pred_cmd",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .needed = pred_cmd_needed,
+    .fields = (VMStateField[]){
+        VMSTATE_UINT64(env.arch_capabilities, X86CPU),
+        VMSTATE_END_OF_LIST()
+    }
+};
+
+static bool arch_capabilities_needed(void *opaque)
+{
+    X86CPU *cpu = opaque;
+    CPUX86State *env = &cpu->env;
+
+    return env->arch_capabilities != 0;
+}
+
+static const VMStateDescription vmstate_arch_capabilities = {
+    .name = "cpu/arch_capabilities",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .needed = arch_capabilities_needed,
+    .fields = (VMStateField[]){
+        VMSTATE_UINT64(env.arch_capabilities, X86CPU),
+        VMSTATE_END_OF_LIST()
+    }
+};
+
 static bool intel_pt_enable_needed(void *opaque)
 {
     X86CPU *cpu = opaque;
@@ -1056,6 +1094,8 @@ VMStateDescription vmstate_x86_cpu = {
         &vmstate_pkru,
 #endif
         &vmstate_spec_ctrl,
+        &vmstate_pred_cmd,
+        &vmstate_arch_capabilities,
         &vmstate_mcg_ext_ctl,
         &vmstate_msr_intel_pt,
         &vmstate_msr_virt_ssbd,
-- 
1.8.3.1

[Qemu-devel] [PATCH 2/5] i386: Add CPUID bit and feature words for IA32_ARCH_CAPABILITIES MSR

[Robert Hoo]

Support of IA32_PRED_CMD MSR already be enumerated by same CPUID bit as
SPEC_CTRL.

Signed-off-by: Robert Hoo <robert.hu@linux.intel.com>
---
 target/i386/cpu.c | 2 +-
 target/i386/cpu.h | 1 +
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index 1e69e68..3134af4 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -896,7 +896,7 @@ static FeatureWordInfo feature_word_info[FEATURE_WORDS] = {
             NULL, NULL, NULL, NULL,
             NULL, NULL, NULL, NULL,
             NULL, NULL, "spec-ctrl", NULL,
-            NULL, NULL, NULL, "ssbd",
+            NULL, "arch-capabilities", NULL, "ssbd",
         },
         .cpuid_eax = 7,
         .cpuid_needs_ecx = true, .cpuid_ecx = 0,
diff --git a/target/i386/cpu.h b/target/i386/cpu.h
index 734a73e..1ef2040 100644
--- a/target/i386/cpu.h
+++ b/target/i386/cpu.h
@@ -688,6 +688,7 @@ typedef uint32_t FeatureWordArray[FEATURE_WORDS];
 #define CPUID_7_0_EDX_AVX512_4VNNIW (1U << 2) /* AVX512 Neural Network Instructions */
 #define CPUID_7_0_EDX_AVX512_4FMAPS (1U << 3) /* AVX512 Multiply Accumulation Single Precision */
 #define CPUID_7_0_EDX_SPEC_CTRL     (1U << 26) /* Speculation Control */
+#define CPUID_7_0_EDX_ARCH_CAPABILITIES (1U << 29)  /*Arch Capabilities of RDCL_NO and IBRS_ALL*/
 #define CPUID_7_0_EDX_SPEC_CTRL_SSBD  (1U << 31) /* Speculative Store Bypass Disable */
 
 #define CPUID_8000_0008_EBX_IBPB    (1U << 12) /* Indirect Branch Prediction Barrier */
-- 
1.8.3.1

[Qemu-devel] [PATCH 3/5] i386: Add CPUID bit for PCONFIG

[Robert Hoo]

PCONFIG: Platform configuration, enumerated by CPUID.(EAX=07H, ECX=0):
EDX[bit18].

Reference:
https://software.intel.com/sites/default/files/managed/c5/15/architecture-instruction-set-extensions-programming-reference.pdf

Signed-off-by: Robert Hoo <robert.hu@linux.intel.com>
---
 target/i386/cpu.c | 2 +-
 target/i386/cpu.h | 1 +
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index 3134af4..9e038c3 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -893,7 +893,7 @@ static FeatureWordInfo feature_word_info[FEATURE_WORDS] = {
             NULL, NULL, NULL, NULL,
             NULL, NULL, NULL, NULL,
             NULL, NULL, NULL, NULL,
-            NULL, NULL, NULL, NULL,
+            NULL, NULL, "pconfig", NULL,
             NULL, NULL, NULL, NULL,
             NULL, NULL, "spec-ctrl", NULL,
             NULL, "arch-capabilities", NULL, "ssbd",
diff --git a/target/i386/cpu.h b/target/i386/cpu.h
index 1ef2040..61d23e5 100644
--- a/target/i386/cpu.h
+++ b/target/i386/cpu.h
@@ -687,6 +687,7 @@ typedef uint32_t FeatureWordArray[FEATURE_WORDS];
 
 #define CPUID_7_0_EDX_AVX512_4VNNIW (1U << 2) /* AVX512 Neural Network Instructions */
 #define CPUID_7_0_EDX_AVX512_4FMAPS (1U << 3) /* AVX512 Multiply Accumulation Single Precision */
+#define CPUID_7_0_EDX_PCONFIG (1U << 18)       /* Platform Configuration */
 #define CPUID_7_0_EDX_SPEC_CTRL     (1U << 26) /* Speculation Control */
 #define CPUID_7_0_EDX_ARCH_CAPABILITIES (1U << 29)  /*Arch Capabilities of RDCL_NO and IBRS_ALL*/
 #define CPUID_7_0_EDX_SPEC_CTRL_SSBD  (1U << 31) /* Speculative Store Bypass Disable */
-- 
1.8.3.1

[Qemu-devel] [PATCH 4/5] i386: Add CPUID bit for WBNOINVD

[Robert Hoo]

WBNOINVD: Write back and do not invalidate cache, enumerated by
CPUID.(EAX=80000008H, ECX=0):EBX[bit 9].

Reference:
https://software.intel.com/sites/default/files/managed/c5/15/architecture-instruction-set-extensions-programming-reference.pdf

Signed-off-by: Robert Hoo <robert.hu@linux.intel.com>
---
 target/i386/cpu.c | 2 +-
 target/i386/cpu.h | 1 +
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index 9e038c3..821b7bd 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -923,7 +923,7 @@ static FeatureWordInfo feature_word_info[FEATURE_WORDS] = {
         .feat_names = {
             NULL, NULL, NULL, NULL,
             NULL, NULL, NULL, NULL,
-            NULL, NULL, NULL, NULL,
+            NULL, "wbnoinvd", NULL, NULL,
             "ibpb", NULL, NULL, NULL,
             NULL, NULL, NULL, NULL,
             NULL, NULL, NULL, NULL,
diff --git a/target/i386/cpu.h b/target/i386/cpu.h
index 61d23e5..c67216d 100644
--- a/target/i386/cpu.h
+++ b/target/i386/cpu.h
@@ -692,6 +692,7 @@ typedef uint32_t FeatureWordArray[FEATURE_WORDS];
 #define CPUID_7_0_EDX_ARCH_CAPABILITIES (1U << 29)  /*Arch Capabilities of RDCL_NO and IBRS_ALL*/
 #define CPUID_7_0_EDX_SPEC_CTRL_SSBD  (1U << 31) /* Speculative Store Bypass Disable */
 
+#define CPUID_8000_0008_EBX_WBNOINVD  (1U << 9)  /* Write back and do not invalidate cache */
 #define CPUID_8000_0008_EBX_IBPB    (1U << 12) /* Indirect Branch Prediction Barrier */
 
 #define CPUID_XSAVE_XSAVEOPT   (1U << 0)
-- 
1.8.3.1

[Qemu-devel] [PATCH 5/5] i386: Add new CPU model Icelake-{Server, Client}

[Robert Hoo]

New CPU models mostly inherit features from ancestor Skylake, while addin new
features: UMIP, New Instructions ( PCONIFIG (server only), WBNOINVD,
AVX512_VBMI2, GFNI, AVX512_VNNI, VPCLMULQDQ, VAES, AVX512_BITALG),
Intel PT and 5-level paging (Server only). As well as
IA32_PRED_CMD and IA32_ARCH_CAPABILITIES MSRs, SSBD support for speculative execution
side channel mitigations.

Note: For 5-level paging, Guest physical address width can be configured, with
parameter "phys-bits". Unless explicitly specified, we still use its default
value, even for Icelake-Server cpu model.

Signed-off-by: Robert Hoo <robert.hu@linux.intel.com>
---
 target/i386/cpu.c | 116 ++++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 116 insertions(+)

diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index 821b7bd..2613e1a 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -2276,6 +2276,122 @@ static X86CPUDefinition builtin_x86_defs[] = {
         .model_id = "Intel Xeon Processor (Skylake, IBRS)",
     },
     {
+        .name = "Icelake-Client",
+        .level = 0xd,
+        .vendor = CPUID_VENDOR_INTEL,
+        .family = 6,
+        .model = 126,
+        .stepping = 0,
+        .features[FEAT_1_EDX] =
+            CPUID_VME | CPUID_SSE2 | CPUID_SSE | CPUID_FXSR | CPUID_MMX |
+            CPUID_CLFLUSH | CPUID_PSE36 | CPUID_PAT | CPUID_CMOV | CPUID_MCA |
+            CPUID_PGE | CPUID_MTRR | CPUID_SEP | CPUID_APIC | CPUID_CX8 |
+            CPUID_MCE | CPUID_PAE | CPUID_MSR | CPUID_TSC | CPUID_PSE |
+            CPUID_DE | CPUID_FP87,
+        .features[FEAT_1_ECX] =
+            CPUID_EXT_AVX | CPUID_EXT_XSAVE | CPUID_EXT_AES |
+            CPUID_EXT_POPCNT | CPUID_EXT_X2APIC | CPUID_EXT_SSE42 |
+            CPUID_EXT_SSE41 | CPUID_EXT_CX16 | CPUID_EXT_SSSE3 |
+            CPUID_EXT_PCLMULQDQ | CPUID_EXT_SSE3 |
+            CPUID_EXT_TSC_DEADLINE_TIMER | CPUID_EXT_FMA | CPUID_EXT_MOVBE |
+            CPUID_EXT_PCID | CPUID_EXT_F16C | CPUID_EXT_RDRAND,
+        .features[FEAT_8000_0001_EDX] =
+            CPUID_EXT2_LM | CPUID_EXT2_RDTSCP | CPUID_EXT2_NX |
+            CPUID_EXT2_SYSCALL,
+        .features[FEAT_8000_0001_ECX] =
+            CPUID_EXT3_ABM | CPUID_EXT3_LAHF_LM | CPUID_EXT3_3DNOWPREFETCH,
+        .features[FEAT_8000_0008_EBX] =
+            CPUID_8000_0008_EBX_WBNOINVD,
+        .features[FEAT_7_0_EBX] =
+            CPUID_7_0_EBX_FSGSBASE | CPUID_7_0_EBX_BMI1 |
+            CPUID_7_0_EBX_HLE | CPUID_7_0_EBX_AVX2 | CPUID_7_0_EBX_SMEP |
+            CPUID_7_0_EBX_BMI2 | CPUID_7_0_EBX_ERMS | CPUID_7_0_EBX_INVPCID |
+            CPUID_7_0_EBX_RTM | CPUID_7_0_EBX_RDSEED | CPUID_7_0_EBX_ADX |
+            CPUID_7_0_EBX_SMAP | CPUID_7_0_EBX_MPX | CPUID_7_0_EBX_INTEL_PT,
+        .features[FEAT_7_0_ECX] =
+            CPUID_7_0_ECX_VBMI | CPUID_7_0_ECX_UMIP | CPUID_7_0_ECX_PKU |
+            CPUID_7_0_ECX_OSPKE | CPUID_7_0_ECX_VBMI2 | CPUID_7_0_ECX_GFNI |
+            CPUID_7_0_ECX_VAES | CPUID_7_0_ECX_VPCLMULQDQ |
+            CPUID_7_0_ECX_AVX512VNNI | CPUID_7_0_ECX_AVX512BITALG |
+            CPUID_7_0_ECX_AVX512_VPOPCNTDQ,
+        .features[FEAT_7_0_EDX] =
+            CPUID_7_0_EDX_SPEC_CTRL | CPUID_7_0_EDX_ARCH_CAPABILITIES |
+            CPUID_7_0_EDX_SPEC_CTRL_SSBD,
+        /* Missing: XSAVES (not supported by some Linux versions,
+                * including v4.1 to v4.12).
+                * KVM doesn't yet expose any XSAVES state save component,
+                * and the only one defined in Skylake (processor tracing)
+                * probably will block migration anyway.
+                */
+        .features[FEAT_XSAVE] =
+            CPUID_XSAVE_XSAVEOPT | CPUID_XSAVE_XSAVEC |
+            CPUID_XSAVE_XGETBV1,
+        .features[FEAT_6_EAX] =
+            CPUID_6_EAX_ARAT,
+        .xlevel = 0x80000008,
+        .model_id = "Intel Core Processor (Icelake)",
+    },
+    {
+        .name = "Icelake-Server",
+        .level = 0xd,
+        .vendor = CPUID_VENDOR_INTEL,
+        .family = 6,
+        .model = 134,
+        .stepping = 0,
+        .features[FEAT_1_EDX] =
+            CPUID_VME | CPUID_SSE2 | CPUID_SSE | CPUID_FXSR | CPUID_MMX |
+            CPUID_CLFLUSH | CPUID_PSE36 | CPUID_PAT | CPUID_CMOV | CPUID_MCA |
+            CPUID_PGE | CPUID_MTRR | CPUID_SEP | CPUID_APIC | CPUID_CX8 |
+            CPUID_MCE | CPUID_PAE | CPUID_MSR | CPUID_TSC | CPUID_PSE |
+            CPUID_DE | CPUID_FP87,
+        .features[FEAT_1_ECX] =
+            CPUID_EXT_AVX | CPUID_EXT_XSAVE | CPUID_EXT_AES |
+            CPUID_EXT_POPCNT | CPUID_EXT_X2APIC | CPUID_EXT_SSE42 |
+            CPUID_EXT_SSE41 | CPUID_EXT_CX16 | CPUID_EXT_SSSE3 |
+            CPUID_EXT_PCLMULQDQ | CPUID_EXT_SSE3 |
+            CPUID_EXT_TSC_DEADLINE_TIMER | CPUID_EXT_FMA | CPUID_EXT_MOVBE |
+            CPUID_EXT_PCID | CPUID_EXT_F16C | CPUID_EXT_RDRAND,
+        .features[FEAT_8000_0001_EDX] =
+            CPUID_EXT2_LM | CPUID_EXT2_PDPE1GB | CPUID_EXT2_RDTSCP |
+            CPUID_EXT2_NX | CPUID_EXT2_SYSCALL,
+        .features[FEAT_8000_0001_ECX] =
+            CPUID_EXT3_ABM | CPUID_EXT3_LAHF_LM | CPUID_EXT3_3DNOWPREFETCH,
+        .features[FEAT_8000_0008_EBX] =
+            CPUID_8000_0008_EBX_WBNOINVD,
+        .features[FEAT_7_0_EBX] =
+            CPUID_7_0_EBX_FSGSBASE | CPUID_7_0_EBX_BMI1 |
+            CPUID_7_0_EBX_HLE | CPUID_7_0_EBX_AVX2 | CPUID_7_0_EBX_SMEP |
+            CPUID_7_0_EBX_BMI2 | CPUID_7_0_EBX_ERMS | CPUID_7_0_EBX_INVPCID |
+            CPUID_7_0_EBX_RTM | CPUID_7_0_EBX_RDSEED | CPUID_7_0_EBX_ADX |
+            CPUID_7_0_EBX_SMAP | CPUID_7_0_EBX_MPX | CPUID_7_0_EBX_CLWB |
+            CPUID_7_0_EBX_AVX512F | CPUID_7_0_EBX_AVX512DQ |
+            CPUID_7_0_EBX_AVX512BW | CPUID_7_0_EBX_AVX512CD |
+            CPUID_7_0_EBX_AVX512VL | CPUID_7_0_EBX_CLFLUSHOPT |
+            CPUID_7_0_EBX_INTEL_PT,
+        .features[FEAT_7_0_ECX] =
+            CPUID_7_0_ECX_VBMI | CPUID_7_0_ECX_UMIP | CPUID_7_0_ECX_PKU |
+            CPUID_7_0_ECX_OSPKE | CPUID_7_0_ECX_VBMI2 | CPUID_7_0_ECX_GFNI |
+            CPUID_7_0_ECX_VAES | CPUID_7_0_ECX_VPCLMULQDQ |
+            CPUID_7_0_ECX_AVX512VNNI | CPUID_7_0_ECX_AVX512BITALG |
+            CPUID_7_0_ECX_AVX512_VPOPCNTDQ | CPUID_7_0_ECX_LA57,
+        .features[FEAT_7_0_EDX] =
+            CPUID_7_0_EDX_PCONFIG | CPUID_7_0_EDX_SPEC_CTRL |
+            CPUID_7_0_EDX_ARCH_CAPABILITIES | CPUID_7_0_EDX_SPEC_CTRL_SSBD,
+        /* Missing: XSAVES (not supported by some Linux versions,
+                * including v4.1 to v4.12).
+                * KVM doesn't yet expose any XSAVES state save component,
+                * and the only one defined in Skylake (processor tracing)
+                * probably will block migration anyway.
+                */
+        .features[FEAT_XSAVE] =
+            CPUID_XSAVE_XSAVEOPT | CPUID_XSAVE_XSAVEC |
+            CPUID_XSAVE_XGETBV1,
+        .features[FEAT_6_EAX] =
+            CPUID_6_EAX_ARAT,
+        .xlevel = 0x80000008,
+        .model_id = "Intel Xeon Processor (Icelake)",
+    },
+    {
         .name = "KnightsMill",
         .level = 0xd,
         .vendor = CPUID_VENDOR_INTEL,
-- 
1.8.3.1

Re: [Qemu-devel] [PATCH 1/5] i386: Add support for IA32_PRED_CMD and IA32_ARCH_CAPABILITIES MSRs

[Paolo Bonzini]

On 25/06/2018 05:39, Robert Hoo wrote:
> IA32_PRED_CMD MSR gives software a way to issue commands that affect the state
> of indirect branch predictors. Enumerated by CPUID.(EAX=7H,ECX=0):EDX[26].
> IA32_ARCH_CAPABILITIES MSR enumerates architectural features of RDCL_NO and
> IBRS_ALL. Enumerated by CPUID.(EAX=07H, ECX=0):EDX[29].
> 
> https://software.intel.com/sites/default/files/managed/c5/63/336996-Speculative-Execution-Side-Channel-Mitigations.pdf
> 
> Signed-off-by: Robert Hoo <robert.hu@linux.intel.com>
> ---
>  target/i386/cpu.h     |  4 ++++
>  target/i386/kvm.c     | 27 ++++++++++++++++++++++++++-
>  target/i386/machine.c | 40 ++++++++++++++++++++++++++++++++++++++++
>  3 files changed, 70 insertions(+), 1 deletion(-)
> 
> diff --git a/target/i386/cpu.h b/target/i386/cpu.h
> index 89c82be..734a73e 100644
> --- a/target/i386/cpu.h
> +++ b/target/i386/cpu.h
> @@ -352,6 +352,8 @@ typedef enum X86Seg {
>  #define MSR_TSC_ADJUST                  0x0000003b
>  #define MSR_IA32_SPEC_CTRL              0x48
>  #define MSR_VIRT_SSBD                   0xc001011f
> +#define MSR_IA32_PRED_CMD               0x49
> +#define MSR_IA32_ARCH_CAPABILITIES      0x10a
>  #define MSR_IA32_TSCDEADLINE            0x6e0
>  
>  #define FEATURE_CONTROL_LOCKED                    (1<<0)
> @@ -1210,6 +1212,8 @@ typedef struct CPUX86State {
>  
>      uint64_t spec_ctrl;
>      uint64_t virt_ssbd;
> +    uint64_t pred_cmd;
> +    uint64_t arch_capabilities;
>  
>      /* End of state preserved by INIT (dummy marker).  */
>      struct {} end_init_save;
> diff --git a/target/i386/kvm.c b/target/i386/kvm.c
> index 445e0e0..5232446 100644
> --- a/target/i386/kvm.c
> +++ b/target/i386/kvm.c
> @@ -93,6 +93,8 @@ static bool has_msr_hv_reenlightenment;
>  static bool has_msr_xss;
>  static bool has_msr_spec_ctrl;
>  static bool has_msr_virt_ssbd;
> +static bool has_msr_pred_cmd;
> +static bool has_msr_arch_capabilities;
>  static bool has_msr_smi_count;
>  
>  static uint32_t has_architectural_pmu_version;
> @@ -1258,6 +1260,11 @@ static int kvm_get_supported_msrs(KVMState *s)
>                      break;
>                  case MSR_VIRT_SSBD:
>                      has_msr_virt_ssbd = true;
> +                case MSR_IA32_PRED_CMD:
> +                    has_msr_pred_cmd = true;
> +                    break;
> +                case MSR_IA32_ARCH_CAPABILITIES:
> +                    has_msr_arch_capabilities = true;
>                      break;
>                  }
>              }
> @@ -1750,7 +1757,13 @@ static int kvm_put_msrs(X86CPU *cpu, int level)
>      if (has_msr_virt_ssbd) {
>          kvm_msr_entry_add(cpu, MSR_VIRT_SSBD, env->virt_ssbd);
>      }
> -
> +    if (has_msr_pred_cmd) {
> +        kvm_msr_entry_add(cpu, MSR_IA32_PRED_CMD, env->pred_cmd);
> +    }
> +    if (has_msr_arch_capabilities) {
> +        kvm_msr_entry_add(cpu, MSR_IA32_ARCH_CAPABILITIES,
> +            env->arch_capabilities);
> +    }
>  #ifdef TARGET_X86_64
>      if (lm_capable_kernel) {
>          kvm_msr_entry_add(cpu, MSR_CSTAR, env->cstar);
> @@ -2133,6 +2146,13 @@ static int kvm_get_msrs(X86CPU *cpu)
>      if (has_msr_virt_ssbd) {
>          kvm_msr_entry_add(cpu, MSR_VIRT_SSBD, 0);
>      }
> +    if (has_msr_pred_cmd) {
> +        kvm_msr_entry_add(cpu, MSR_IA32_PRED_CMD, 0);
> +    }
> +    if (has_msr_arch_capabilities) {
> +        kvm_msr_entry_add(cpu, MSR_IA32_ARCH_CAPABILITIES, 0);
> +    }
> +
>      if (!env->tsc_valid) {
>          kvm_msr_entry_add(cpu, MSR_IA32_TSC, 0);
>          env->tsc_valid = !runstate_is_running();
> @@ -2514,6 +2534,11 @@ static int kvm_get_msrs(X86CPU *cpu)
>              break;
>          case MSR_VIRT_SSBD:
>              env->virt_ssbd = msrs[i].data;
> +        case MSR_IA32_PRED_CMD:
> +            env->pred_cmd = msrs[i].data;
> +            break;
> +        case MSR_IA32_ARCH_CAPABILITIES:
> +            env->arch_capabilities = msrs[i].data;
>              break;
>          case MSR_IA32_RTIT_CTL:
>              env->msr_rtit_ctrl = msrs[i].data;
> diff --git a/target/i386/machine.c b/target/i386/machine.c
> index 4d98d36..089aba0 100644
> --- a/target/i386/machine.c
> +++ b/target/i386/machine.c
> @@ -879,6 +879,44 @@ static const VMStateDescription vmstate_spec_ctrl = {
>      }
>  };
>  
> +static bool pred_cmd_needed(void *opaque)
> +{
> +    X86CPU *cpu = opaque;
> +    CPUX86State *env = &cpu->env;
> +
> +    return env->pred_cmd != 0;
> +}
> +
> +static const VMStateDescription vmstate_pred_cmd = {
> +    .name = "cpu/pred_cmd",
> +    .version_id = 1,
> +    .minimum_version_id = 1,
> +    .needed = pred_cmd_needed,
> +    .fields = (VMStateField[]){
> +        VMSTATE_UINT64(env.arch_capabilities, X86CPU),
> +        VMSTATE_END_OF_LIST()
> +    }
> +};
> +
> +static bool arch_capabilities_needed(void *opaque)
> +{
> +    X86CPU *cpu = opaque;
> +    CPUX86State *env = &cpu->env;
> +
> +    return env->arch_capabilities != 0;
> +}
> +
> +static const VMStateDescription vmstate_arch_capabilities = {
> +    .name = "cpu/arch_capabilities",
> +    .version_id = 1,
> +    .minimum_version_id = 1,
> +    .needed = arch_capabilities_needed,
> +    .fields = (VMStateField[]){
> +        VMSTATE_UINT64(env.arch_capabilities, X86CPU),
> +        VMSTATE_END_OF_LIST()
> +    }
> +};
> +
>  static bool intel_pt_enable_needed(void *opaque)
>  {
>      X86CPU *cpu = opaque;
> @@ -1056,6 +1094,8 @@ VMStateDescription vmstate_x86_cpu = {
>          &vmstate_pkru,
>  #endif
>          &vmstate_spec_ctrl,
> +        &vmstate_pred_cmd,
> +        &vmstate_arch_capabilities,
>          &vmstate_mcg_ext_ctl,
>          &vmstate_msr_intel_pt,
>          &vmstate_msr_virt_ssbd,
> 

This is not needed, because pred_cmd is write only and arch_capabilities
is read only.  The guest cannot modify any of them.

Paolo

Re: [Qemu-devel] [PATCH 2/5] i386: Add CPUID bit and feature words for IA32_ARCH_CAPABILITIES MSR

[Paolo Bonzini]

On 25/06/2018 05:39, Robert Hoo wrote:
> Support of IA32_PRED_CMD MSR already be enumerated by same CPUID bit as
> SPEC_CTRL.
> 
> Signed-off-by: Robert Hoo <robert.hu@linux.intel.com>
> ---
>  target/i386/cpu.c | 2 +-
>  target/i386/cpu.h | 1 +
>  2 files changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/target/i386/cpu.c b/target/i386/cpu.c
> index 1e69e68..3134af4 100644
> --- a/target/i386/cpu.c
> +++ b/target/i386/cpu.c
> @@ -896,7 +896,7 @@ static FeatureWordInfo feature_word_info[FEATURE_WORDS] = {
>              NULL, NULL, NULL, NULL,
>              NULL, NULL, NULL, NULL,
>              NULL, NULL, "spec-ctrl", NULL,
> -            NULL, NULL, NULL, "ssbd",
> +            NULL, "arch-capabilities", NULL, "ssbd",
>          },
>          .cpuid_eax = 7,
>          .cpuid_needs_ecx = true, .cpuid_ecx = 0,
> diff --git a/target/i386/cpu.h b/target/i386/cpu.h
> index 734a73e..1ef2040 100644
> --- a/target/i386/cpu.h
> +++ b/target/i386/cpu.h
> @@ -688,6 +688,7 @@ typedef uint32_t FeatureWordArray[FEATURE_WORDS];
>  #define CPUID_7_0_EDX_AVX512_4VNNIW (1U << 2) /* AVX512 Neural Network Instructions */
>  #define CPUID_7_0_EDX_AVX512_4FMAPS (1U << 3) /* AVX512 Multiply Accumulation Single Precision */
>  #define CPUID_7_0_EDX_SPEC_CTRL     (1U << 26) /* Speculation Control */
> +#define CPUID_7_0_EDX_ARCH_CAPABILITIES (1U << 29)  /*Arch Capabilities of RDCL_NO and IBRS_ALL*/
>  #define CPUID_7_0_EDX_SPEC_CTRL_SSBD  (1U << 31) /* Speculative Store Bypass Disable */
>  
>  #define CPUID_8000_0008_EBX_IBPB    (1U << 12) /* Indirect Branch Prediction Barrier */
> 

For migration to work, you need to add new "features" corresponding to
the bits in the MSR, and include them in the Icelake-Server and
Icelake-Client models.  Unfortunately there is no code for this in QEMU
yet, though the API is there in KVM.

I have just sent the KVM patch to pass the MSR value down to QEMU ("KVM:
VMX: support MSR_IA32_ARCH_CAPABILITIES as a feature MSR").

Paolo

Re: [Qemu-devel] [PATCH 1/5] i386: Add support for IA32_PRED_CMD and IA32_ARCH_CAPABILITIES MSRs

[Robert Hoo]

On Mon, 2018-06-25 at 13:51 +0200, Paolo Bonzini wrote:
> On 25/06/2018 05:39, Robert Hoo wrote:
> > IA32_PRED_CMD MSR gives software a way to issue commands that affect the state
> > of indirect branch predictors. Enumerated by CPUID.(EAX=7H,ECX=0):EDX[26].
> > IA32_ARCH_CAPABILITIES MSR enumerates architectural features of RDCL_NO and
> > IBRS_ALL. Enumerated by CPUID.(EAX=07H, ECX=0):EDX[29].
> > 
> > https://software.intel.com/sites/default/files/managed/c5/63/336996-Speculative-Execution-Side-Channel-Mitigations.pdf
> > 
> > Signed-off-by: Robert Hoo <robert.hu@linux.intel.com>
> > ---
> >  target/i386/cpu.h     |  4 ++++
> >  target/i386/kvm.c     | 27 ++++++++++++++++++++++++++-
> >  target/i386/machine.c | 40 ++++++++++++++++++++++++++++++++++++++++
> >  3 files changed, 70 insertions(+), 1 deletion(-)
> > 
> > diff --git a/target/i386/cpu.h b/target/i386/cpu.h
> > index 89c82be..734a73e 100644
> > --- a/target/i386/cpu.h
> > +++ b/target/i386/cpu.h
> > @@ -352,6 +352,8 @@ typedef enum X86Seg {
> >  #define MSR_TSC_ADJUST                  0x0000003b
> >  #define MSR_IA32_SPEC_CTRL              0x48
> >  #define MSR_VIRT_SSBD                   0xc001011f
> > +#define MSR_IA32_PRED_CMD               0x49
> > +#define MSR_IA32_ARCH_CAPABILITIES      0x10a
> >  #define MSR_IA32_TSCDEADLINE            0x6e0
> >  
> >  #define FEATURE_CONTROL_LOCKED                    (1<<0)
> > @@ -1210,6 +1212,8 @@ typedef struct CPUX86State {
> >  
> >      uint64_t spec_ctrl;
> >      uint64_t virt_ssbd;
> > +    uint64_t pred_cmd;
> > +    uint64_t arch_capabilities;
> >  
> >      /* End of state preserved by INIT (dummy marker).  */
> >      struct {} end_init_save;
> > diff --git a/target/i386/kvm.c b/target/i386/kvm.c
> > index 445e0e0..5232446 100644
> > --- a/target/i386/kvm.c
> > +++ b/target/i386/kvm.c
> > @@ -93,6 +93,8 @@ static bool has_msr_hv_reenlightenment;
> >  static bool has_msr_xss;
> >  static bool has_msr_spec_ctrl;
> >  static bool has_msr_virt_ssbd;
> > +static bool has_msr_pred_cmd;
> > +static bool has_msr_arch_capabilities;
> >  static bool has_msr_smi_count;
> >  
> >  static uint32_t has_architectural_pmu_version;
> > @@ -1258,6 +1260,11 @@ static int kvm_get_supported_msrs(KVMState *s)
> >                      break;
> >                  case MSR_VIRT_SSBD:
> >                      has_msr_virt_ssbd = true;
> > +                case MSR_IA32_PRED_CMD:
> > +                    has_msr_pred_cmd = true;
> > +                    break;
> > +                case MSR_IA32_ARCH_CAPABILITIES:
> > +                    has_msr_arch_capabilities = true;
> >                      break;
> >                  }
> >              }
> > @@ -1750,7 +1757,13 @@ static int kvm_put_msrs(X86CPU *cpu, int level)
> >      if (has_msr_virt_ssbd) {
> >          kvm_msr_entry_add(cpu, MSR_VIRT_SSBD, env->virt_ssbd);
> >      }
> > -
> > +    if (has_msr_pred_cmd) {
> > +        kvm_msr_entry_add(cpu, MSR_IA32_PRED_CMD, env->pred_cmd);
> > +    }
> > +    if (has_msr_arch_capabilities) {
> > +        kvm_msr_entry_add(cpu, MSR_IA32_ARCH_CAPABILITIES,
> > +            env->arch_capabilities);
> > +    }
> >  #ifdef TARGET_X86_64
> >      if (lm_capable_kernel) {
> >          kvm_msr_entry_add(cpu, MSR_CSTAR, env->cstar);
> > @@ -2133,6 +2146,13 @@ static int kvm_get_msrs(X86CPU *cpu)
> >      if (has_msr_virt_ssbd) {
> >          kvm_msr_entry_add(cpu, MSR_VIRT_SSBD, 0);
> >      }
> > +    if (has_msr_pred_cmd) {
> > +        kvm_msr_entry_add(cpu, MSR_IA32_PRED_CMD, 0);
> > +    }
> > +    if (has_msr_arch_capabilities) {
> > +        kvm_msr_entry_add(cpu, MSR_IA32_ARCH_CAPABILITIES, 0);
> > +    }
> > +
> >      if (!env->tsc_valid) {
> >          kvm_msr_entry_add(cpu, MSR_IA32_TSC, 0);
> >          env->tsc_valid = !runstate_is_running();
> > @@ -2514,6 +2534,11 @@ static int kvm_get_msrs(X86CPU *cpu)
> >              break;
> >          case MSR_VIRT_SSBD:
> >              env->virt_ssbd = msrs[i].data;
> > +        case MSR_IA32_PRED_CMD:
> > +            env->pred_cmd = msrs[i].data;
> > +            break;
> > +        case MSR_IA32_ARCH_CAPABILITIES:
> > +            env->arch_capabilities = msrs[i].data;
> >              break;
> >          case MSR_IA32_RTIT_CTL:
> >              env->msr_rtit_ctrl = msrs[i].data;
> > diff --git a/target/i386/machine.c b/target/i386/machine.c
> > index 4d98d36..089aba0 100644
> > --- a/target/i386/machine.c
> > +++ b/target/i386/machine.c
> > @@ -879,6 +879,44 @@ static const VMStateDescription vmstate_spec_ctrl = {
> >      }
> >  };
> >  
> > +static bool pred_cmd_needed(void *opaque)
> > +{
> > +    X86CPU *cpu = opaque;
> > +    CPUX86State *env = &cpu->env;
> > +
> > +    return env->pred_cmd != 0;
> > +}
> > +
> > +static const VMStateDescription vmstate_pred_cmd = {
> > +    .name = "cpu/pred_cmd",
> > +    .version_id = 1,
> > +    .minimum_version_id = 1,
> > +    .needed = pred_cmd_needed,
> > +    .fields = (VMStateField[]){
> > +        VMSTATE_UINT64(env.arch_capabilities, X86CPU),
> > +        VMSTATE_END_OF_LIST()
> > +    }
> > +};
> > +
> > +static bool arch_capabilities_needed(void *opaque)
> > +{
> > +    X86CPU *cpu = opaque;
> > +    CPUX86State *env = &cpu->env;
> > +
> > +    return env->arch_capabilities != 0;
> > +}
> > +
> > +static const VMStateDescription vmstate_arch_capabilities = {
> > +    .name = "cpu/arch_capabilities",
> > +    .version_id = 1,
> > +    .minimum_version_id = 1,
> > +    .needed = arch_capabilities_needed,
> > +    .fields = (VMStateField[]){
> > +        VMSTATE_UINT64(env.arch_capabilities, X86CPU),
> > +        VMSTATE_END_OF_LIST()
> > +    }
> > +};
> > +
> >  static bool intel_pt_enable_needed(void *opaque)
> >  {
> >      X86CPU *cpu = opaque;
> > @@ -1056,6 +1094,8 @@ VMStateDescription vmstate_x86_cpu = {
> >          &vmstate_pkru,
> >  #endif
> >          &vmstate_spec_ctrl,
> > +        &vmstate_pred_cmd,
> > +        &vmstate_arch_capabilities,
> >          &vmstate_mcg_ext_ctl,
> >          &vmstate_msr_intel_pt,
> >          &vmstate_msr_virt_ssbd,
> > 
> 
> This is not needed, because pred_cmd is write only and arch_capabilities
> is read only.  The guest cannot modify any of them.
> 
Thanks Paolo. Yes, indeed unnecessary.
I looked into the
336996-Speculative-Execution-Side-Channel-Mitigations.pdf again, looks
like the vmstate_spec_ctrl is similar to pred_cmd, wirte only. Shall I
remove it as well in v2 patch?
> Paolo

Re: [Qemu-devel] [PATCH 1/5] i386: Add support for IA32_PRED_CMD and IA32_ARCH_CAPABILITIES MSRs

[Paolo Bonzini]

On 26/06/2018 10:58, Robert Hoo wrote:
>> This is not needed, because pred_cmd is write only and arch_capabilities
>> is read only.  The guest cannot modify any of them.
>>
> Thanks Paolo. Yes, indeed unnecessary.
> I looked into the
> 336996-Speculative-Execution-Side-Channel-Mitigations.pdf again, looks
> like the vmstate_spec_ctrl is similar to pred_cmd, wirte only. Shall I
> remove it as well in v2 patch?

No, spec_ctrl is read-write.

Paolo

Re: [Qemu-devel] [PATCH 2/5] i386: Add CPUID bit and feature words for IA32_ARCH_CAPABILITIES MSR

[Robert Hoo]

On Mon, 2018-06-25 at 14:06 +0200, Paolo Bonzini wrote:
> On 25/06/2018 05:39, Robert Hoo wrote:
> > Support of IA32_PRED_CMD MSR already be enumerated by same CPUID bit as
> > SPEC_CTRL.
> > 
> > Signed-off-by: Robert Hoo <robert.hu@linux.intel.com>
> > ---
> >  target/i386/cpu.c | 2 +-
> >  target/i386/cpu.h | 1 +
> >  2 files changed, 2 insertions(+), 1 deletion(-)
> > 
> > diff --git a/target/i386/cpu.c b/target/i386/cpu.c
> > index 1e69e68..3134af4 100644
> > --- a/target/i386/cpu.c
> > +++ b/target/i386/cpu.c
> > @@ -896,7 +896,7 @@ static FeatureWordInfo feature_word_info[FEATURE_WORDS] = {
> >              NULL, NULL, NULL, NULL,
> >              NULL, NULL, NULL, NULL,
> >              NULL, NULL, "spec-ctrl", NULL,
> > -            NULL, NULL, NULL, "ssbd",
> > +            NULL, "arch-capabilities", NULL, "ssbd",
> >          },
> >          .cpuid_eax = 7,
> >          .cpuid_needs_ecx = true, .cpuid_ecx = 0,
> > diff --git a/target/i386/cpu.h b/target/i386/cpu.h
> > index 734a73e..1ef2040 100644
> > --- a/target/i386/cpu.h
> > +++ b/target/i386/cpu.h
> > @@ -688,6 +688,7 @@ typedef uint32_t FeatureWordArray[FEATURE_WORDS];
> >  #define CPUID_7_0_EDX_AVX512_4VNNIW (1U << 2) /* AVX512 Neural Network Instructions */
> >  #define CPUID_7_0_EDX_AVX512_4FMAPS (1U << 3) /* AVX512 Multiply Accumulation Single Precision */
> >  #define CPUID_7_0_EDX_SPEC_CTRL     (1U << 26) /* Speculation Control */
> > +#define CPUID_7_0_EDX_ARCH_CAPABILITIES (1U << 29)  /*Arch Capabilities of RDCL_NO and IBRS_ALL*/
> >  #define CPUID_7_0_EDX_SPEC_CTRL_SSBD  (1U << 31) /* Speculative Store Bypass Disable */
> >  
> >  #define CPUID_8000_0008_EBX_IBPB    (1U << 12) /* Indirect Branch Prediction Barrier */
> > 
> 
> For migration to work, you need to add new "features" corresponding to
> the bits in the MSR, and include them in the Icelake-Server and
> Icelake-Client models.  Unfortunately there is no code for this in QEMU
> yet, though the API is there in KVM.
> 
> I have just sent the KVM patch to pass the MSR value down to QEMU ("KVM:
> VMX: support MSR_IA32_ARCH_CAPABILITIES as a feature MSR").
> 
Thanks Paolo.
> Paolo

Re: [Qemu-devel] [PATCH 2/5] i386: Add CPUID bit and feature words for IA32_ARCH_CAPABILITIES MSR

[Eduardo Habkost]

On Mon, Jun 25, 2018 at 02:06:15PM +0200, Paolo Bonzini wrote:
> On 25/06/2018 05:39, Robert Hoo wrote:
> > Support of IA32_PRED_CMD MSR already be enumerated by same CPUID bit as
> > SPEC_CTRL.
> > 
> > Signed-off-by: Robert Hoo <robert.hu@linux.intel.com>
> > ---
> >  target/i386/cpu.c | 2 +-
> >  target/i386/cpu.h | 1 +
> >  2 files changed, 2 insertions(+), 1 deletion(-)
> > 
> > diff --git a/target/i386/cpu.c b/target/i386/cpu.c
> > index 1e69e68..3134af4 100644
> > --- a/target/i386/cpu.c
> > +++ b/target/i386/cpu.c
> > @@ -896,7 +896,7 @@ static FeatureWordInfo feature_word_info[FEATURE_WORDS] = {
> >              NULL, NULL, NULL, NULL,
> >              NULL, NULL, NULL, NULL,
> >              NULL, NULL, "spec-ctrl", NULL,
> > -            NULL, NULL, NULL, "ssbd",
> > +            NULL, "arch-capabilities", NULL, "ssbd",
> >          },
> >          .cpuid_eax = 7,
> >          .cpuid_needs_ecx = true, .cpuid_ecx = 0,
> > diff --git a/target/i386/cpu.h b/target/i386/cpu.h
> > index 734a73e..1ef2040 100644
> > --- a/target/i386/cpu.h
> > +++ b/target/i386/cpu.h
> > @@ -688,6 +688,7 @@ typedef uint32_t FeatureWordArray[FEATURE_WORDS];
> >  #define CPUID_7_0_EDX_AVX512_4VNNIW (1U << 2) /* AVX512 Neural Network Instructions */
> >  #define CPUID_7_0_EDX_AVX512_4FMAPS (1U << 3) /* AVX512 Multiply Accumulation Single Precision */
> >  #define CPUID_7_0_EDX_SPEC_CTRL     (1U << 26) /* Speculation Control */
> > +#define CPUID_7_0_EDX_ARCH_CAPABILITIES (1U << 29)  /*Arch Capabilities of RDCL_NO and IBRS_ALL*/
> >  #define CPUID_7_0_EDX_SPEC_CTRL_SSBD  (1U << 31) /* Speculative Store Bypass Disable */
> >  
> >  #define CPUID_8000_0008_EBX_IBPB    (1U << 12) /* Indirect Branch Prediction Barrier */
> > 
> 
> For migration to work, you need to add new "features" corresponding to
> the bits in the MSR, and include them in the Icelake-Server and
> Icelake-Client models.  Unfortunately there is no code for this in QEMU
> yet, though the API is there in KVM.

Will all Icelake VCPUs of a given model have the same value on
MSR_IA32_ARCH_CAPABILITIES?

If not, we can't choose a value that will work on all cases, and
it will require management software to be smarter and explicitly
configure some of the MSR bits on the command-line.

-- 
Eduardo

Re: [Qemu-devel] [PATCH 2/5] i386: Add CPUID bit and feature words for IA32_ARCH_CAPABILITIES MSR

[Paolo Bonzini]

On 28/06/2018 20:30, Eduardo Habkost wrote:
>> For migration to work, you need to add new "features" corresponding to
>> the bits in the MSR, and include them in the Icelake-Server and
>> Icelake-Client models.  Unfortunately there is no code for this in QEMU
>> yet, though the API is there in KVM.
> Will all Icelake VCPUs of a given model have the same value on
> MSR_IA32_ARCH_CAPABILITIES?
> 
> If not, we can't choose a value that will work on all cases, and
> it will require management software to be smarter and explicitly
> configure some of the MSR bits on the command-line.

We can expect that it will change as more vulnerabilities are found and
more microcode updates are issued.  We should get it right from the
beginning.

Paolo

Re: [Qemu-devel] [PATCH 2/5] i386: Add CPUID bit and feature words for IA32_ARCH_CAPABILITIES MSR

[Eduardo Habkost]

On Fri, Jun 29, 2018 at 01:34:04PM +0200, Paolo Bonzini wrote:
> On 28/06/2018 20:30, Eduardo Habkost wrote:
> >> For migration to work, you need to add new "features" corresponding to
> >> the bits in the MSR, and include them in the Icelake-Server and
> >> Icelake-Client models.  Unfortunately there is no code for this in QEMU
> >> yet, though the API is there in KVM.
> > Will all Icelake VCPUs of a given model have the same value on
> > MSR_IA32_ARCH_CAPABILITIES?
> > 
> > If not, we can't choose a value that will work on all cases, and
> > it will require management software to be smarter and explicitly
> > configure some of the MSR bits on the command-line.
> 
> We can expect that it will change as more vulnerabilities are found and
> more microcode updates are issued.  We should get it right from the
> beginning.

Right.  Also, we probably want to enable arch-capabilities on
CPUID by default whenever possible, even if using an old CPU
model.  I expect Daniel's versioned CPU model proposal to help us
address this.

I'm worried about the soft freeze deadline (next Tuesday),
though.  I wouldn't like Icelake to miss QEMU 3.0 just because we
couldn't decide on a default MSR_IA32_ARCH_CAPABILITIES value in
time.

-- 
Eduardo