* [PATCH v10 0/6] x86emul: misc additions (MSR accesses)
@ 2026-08-05 9:21 Jan Beulich
2026-08-05 9:22 ` [PATCH v10 1/6] x86emul+VMX: support {RD,WR}MSRLIST Jan Beulich
` (5 more replies)
0 siblings, 6 replies; 7+ messages in thread
From: Jan Beulich @ 2026-08-05 9:21 UTC (permalink / raw)
To: xen-devel@lists.xenproject.org
Cc: Andrew Cooper, Teddy Astie, Roger Pau Monné
01: x86emul+VMX: support {RD,WR}MSRLIST
02: x86emul: support USER-MSR instructions
03: x86/cpu-policy: re-arrange no-VMX logic
04: VMX: support USER-MSR
05: x86emul: support MSR-IMM instructions
06: VMX: support MSR-IMM
Jan
^ permalink raw reply [flat|nested] 7+ messages in thread
* [PATCH v10 1/6] x86emul+VMX: support {RD,WR}MSRLIST
2026-08-05 9:21 [PATCH v10 0/6] x86emul: misc additions (MSR accesses) Jan Beulich
@ 2026-08-05 9:22 ` Jan Beulich
2026-08-05 9:23 ` [PATCH v10 2/6] x86emul: support USER-MSR instructions Jan Beulich
` (4 subsequent siblings)
5 siblings, 0 replies; 7+ messages in thread
From: Jan Beulich @ 2026-08-05 9:22 UTC (permalink / raw)
To: xen-devel@lists.xenproject.org
Cc: Andrew Cooper, Teddy Astie, Roger Pau Monné
These are "compound" instructions to issue a series of RDMSR / WRMSR
respectively. In the emulator we can therefore implement them by using
the existing msr_{read,write}() hooks. The memory accesses utilize that
the HVM ->read() / ->write() hooks are already linear-address
(x86_seg_none) aware (by way of hvmemul_virtual_to_linear() handling
this case).
Preemption is being checked for in WRMSRLIST handling only, as only MSR
writes are expected to possibly take long.
Signed-off-by: Jan Beulich <jbeulich@suse.com>
---
RFC: In vmx_vmexit_handler() handling is forwarded to the emulator
blindly. Alternatively we could consult the exit qualification and
process just a single MSR at a time (without involving the
emulator), exiting back to the guest after every iteration. (I
don't think a mix of both models makes a lot of sense.)
The precise behavior of MSR_BARRIER is still not spelled out in ISE 050,
so the (minimal) implementation continues to be a guess for now.
Wouldn't calculate_hvm_max_policy() for MPX better behave the same way
as done here, at least from an abstract perspective (assuming that AMD
won't add such functionality now that Intel have deprecated it)?
---
v10: fuzz_{read,write}() adjustment. Non-default-expose the feature.
Re-base.
v8: Re-base.
v6: Use MSR constants in test harness. Re-base.
v5: Add missing vmx_init_vmcs_config() and construct_vmcs() adjustments.
Avoid unnecessary uses of r(). Re-base.
v3: Add dependency on LM. Limit exposure to HVM. Utilize new info from
ISE 050. Re-base.
v2: Use X86_EXC_*. Add preemption checking to WRMSRLIST handling. Remove
the feature from "max" when the VMX counterpart isn't available.
--- a/tools/fuzz/x86_instruction_emulator/fuzz-emul.c
+++ b/tools/fuzz/x86_instruction_emulator/fuzz-emul.c
@@ -171,7 +171,7 @@ static int fuzz_read(
struct x86_emulate_ctxt *ctxt)
{
/* Reads expected for all user and system segments. */
- if ( is_x86_user_segment(seg) )
+ if ( is_x86_user_segment(seg) || seg == x86_seg_none )
assert(ctxt->addr_size == 64 || !(offset >> 32));
else if ( seg == x86_seg_tr )
/*
@@ -340,7 +340,7 @@ static int fuzz_write(
struct x86_emulate_ctxt *ctxt)
{
/* Writes not expected for any system segments. */
- assert(is_x86_user_segment(seg));
+ assert(is_x86_user_segment(seg) || seg == x86_seg_none);
assert(ctxt->addr_size == 64 || !(offset >> 32));
return maybe_fail(ctxt, "write", true);
--- a/tools/tests/x86_emulator/predicates.c
+++ b/tools/tests/x86_emulator/predicates.c
@@ -342,6 +342,8 @@ static const struct {
{ { 0x01, 0xc4 }, { 2, 2 }, F, N }, /* vmxoff */
{ { 0x01, 0xc5 }, { 2, 2 }, F, N }, /* pconfig */
{ { 0x01, 0xc6 }, { 2, 2 }, F, N }, /* wrmsrns */
+ { { 0x01, 0xc6 }, { 0, 2 }, F, W, pfx_f2 }, /* rdmsrlist */
+ { { 0x01, 0xc6 }, { 0, 2 }, F, R, pfx_f3 }, /* wrmsrlist */
{ { 0x01, 0xc8 }, { 2, 2 }, F, N }, /* monitor */
{ { 0x01, 0xc9 }, { 2, 2 }, F, N }, /* mwait */
{ { 0x01, 0xca }, { 2, 2 }, F, N }, /* clac */
--- a/tools/tests/x86_emulator/test_x86_emulator.c
+++ b/tools/tests/x86_emulator/test_x86_emulator.c
@@ -626,7 +626,7 @@ static int write(
if ( verbose )
printf("** %s(%u, %p,, %u,)\n", __func__, seg, (void *)offset, bytes);
- if ( !is_x86_user_segment(seg) )
+ if ( !is_x86_user_segment(seg) && seg != x86_seg_none )
return X86EMUL_UNHANDLEABLE;
memcpy((void *)offset, p_data, bytes);
return X86EMUL_OKAY;
@@ -713,6 +713,10 @@ static int read_msr(
{
switch ( reg )
{
+ case MSR_BARRIER:
+ *val = 0;
+ return X86EMUL_OKAY;
+
case MSR_EFER:
*val = ctxt->addr_size > 32 ? EFER_LME | EFER_LMA : 0;
return X86EMUL_OKAY;
@@ -1431,9 +1435,53 @@ int main(int argc, char **argv)
(gs_base != 0x0000111122224444UL) ||
gs_base_shadow )
goto fail;
+ printf("okay\n");
cpu_policy.extd.nscb = i;
emulops.write_segment = NULL;
+
+ printf("%-40s", "Testing rdmsrlist...");
+ instr[0] = 0xf2; instr[1] = 0x0f; instr[2] = 0x01; instr[3] = 0xc6;
+ regs.rip = (unsigned long)&instr[0];
+ regs.rsi = (unsigned long)(res + 0x80);
+ regs.rdi = (unsigned long)(res + 0x80 + 0x40 * 2);
+ regs.rcx = 0x0002000100008000UL;
+ gs_base_shadow = 0x0000222244446666UL;
+ memset(res + 0x80, ~0, 0x40 * 8 * 2);
+ res[0x80 + 0x0f * 2] = MSR_GS_BASE;
+ res[0x80 + 0x0f * 2 + 1] = 0;
+ res[0x80 + 0x20 * 2] = MSR_SHADOW_GS_BASE;
+ res[0x80 + 0x20 * 2 + 1] = 0;
+ res[0x80 + 0x31 * 2] = MSR_BARRIER;
+ res[0x80 + 0x31 * 2 + 1] = 0;
+ rc = x86_emulate(&ctxt, &emulops);
+ if ( (rc != X86EMUL_OKAY) ||
+ (regs.rip != (unsigned long)&instr[4]) ||
+ regs.rcx ||
+ (res[0x80 + (0x40 + 0x0f) * 2] != (unsigned int)gs_base) ||
+ (res[0x80 + (0x40 + 0x0f) * 2 + 1] != (gs_base >> (8 * sizeof(int)))) ||
+ (res[0x80 + (0x40 + 0x20) * 2] != (unsigned int)gs_base_shadow) ||
+ (res[0x80 + (0x40 + 0x20) * 2 + 1] != (gs_base_shadow >> (8 * sizeof(int)))) ||
+ res[0x80 + (0x40 + 0x31) * 2] || res[0x80 + (0x40 + 0x31) * 2 + 1] )
+ goto fail;
+ printf("okay\n");
+
+ printf("%-40s", "Testing wrmsrlist...");
+ instr[0] = 0xf3; instr[1] = 0x0f; instr[2] = 0x01; instr[3] = 0xc6;
+ regs.eip = (unsigned long)&instr[0];
+ regs.rsi -= 0x11 * 8;
+ regs.rdi -= 0x11 * 8;
+ regs.rcx = 0x0002000100000000UL;
+ res[0x80 + 0x0f * 2] = MSR_SHADOW_GS_BASE;
+ res[0x80 + 0x20 * 2] = MSR_GS_BASE;
+ rc = x86_emulate(&ctxt, &emulops);
+ if ( (rc != X86EMUL_OKAY) ||
+ (regs.rip != (unsigned long)&instr[4]) ||
+ regs.rcx ||
+ (gs_base != 0x0000222244446666UL) ||
+ (gs_base_shadow != 0x0000111122224444UL) )
+ goto fail;
+
emulops.write_msr = NULL;
#endif
printf("okay\n");
--- a/tools/tests/x86_emulator/x86-emulate.c
+++ b/tools/tests/x86_emulator/x86-emulate.c
@@ -66,6 +66,7 @@ bool emul_test_init(void)
cpu_policy.feat.rdpid = true;
cpu_policy.feat.lkgs = true;
cpu_policy.feat.wrmsrns = true;
+ cpu_policy.feat.msrlist = true;
cpu_policy.extd.clzero = true;
if ( cpu_has_xsave )
--- a/xen/arch/x86/cpu-policy.c
+++ b/xen/arch/x86/cpu-policy.c
@@ -824,6 +824,9 @@ static void __init calculate_hvm_max_pol
__clear_bit(X86_FEATURE_XSAVES, fs);
}
+ if ( !cpu_has_vmx_msrlist )
+ __clear_bit(X86_FEATURE_MSRLIST, fs);
+
/*
* Xen doesn't use PKS, so the guest support for it has opted to not use
* the VMCS load/save controls for efficiency reasons. This depends on
--- a/xen/arch/x86/hvm/vmx/vmcs.c
+++ b/xen/arch/x86/hvm/vmx/vmcs.c
@@ -363,8 +363,9 @@ static int vmx_init_vmcs_config(bool bsp
if ( caps.cpu_based_exec_control & CPU_BASED_ACTIVATE_TERTIARY_CONTROLS )
{
- uint64_t opt = (TERTIARY_EXEC_VIRT_SPEC_CTRL |
- TERTIARY_EXEC_EPT_PAGING_WRITE);
+ uint64_t opt = TERTIARY_EXEC_EPT_PAGING_WRITE |
+ TERTIARY_EXEC_ENABLE_MSRLIST |
+ TERTIARY_EXEC_VIRT_SPEC_CTRL;
caps.tertiary_exec_control = adjust_vmx_controls2(
"Tertiary Exec Control", 0, opt,
@@ -1121,7 +1122,8 @@ static int construct_vmcs(struct vcpu *v
v->arch.hvm.vmx.exec_control |= CPU_BASED_RDTSC_EXITING;
v->arch.hvm.vmx.secondary_exec_control = vmx_caps.secondary_exec_control;
- v->arch.hvm.vmx.tertiary_exec_control = vmx_caps.tertiary_exec_control;
+ v->arch.hvm.vmx.tertiary_exec_control = vmx_caps.tertiary_exec_control &
+ ~TERTIARY_EXEC_ENABLE_MSRLIST;
/*
* Disable features which we don't want active by default:
--- a/xen/arch/x86/hvm/vmx/vmx.c
+++ b/xen/arch/x86/hvm/vmx/vmx.c
@@ -894,6 +894,20 @@ static void cf_check vmx_cpuid_policy_ch
else
vmx_set_msr_intercept(v, MSR_PKRS, VMX_MSR_RW);
+ if ( cp->feat.msrlist )
+ {
+ vmx_clear_msr_intercept(v, MSR_BARRIER, VMX_MSR_RW);
+ v->arch.hvm.vmx.tertiary_exec_control |= TERTIARY_EXEC_ENABLE_MSRLIST;
+ vmx_update_tertiary_exec_control(v);
+ }
+ else if ( v->arch.hvm.vmx.tertiary_exec_control &
+ TERTIARY_EXEC_ENABLE_MSRLIST )
+ {
+ vmx_set_msr_intercept(v, MSR_BARRIER, VMX_MSR_RW);
+ v->arch.hvm.vmx.tertiary_exec_control &= ~TERTIARY_EXEC_ENABLE_MSRLIST;
+ vmx_update_tertiary_exec_control(v);
+ }
+
out:
vmx_vmcs_exit(v);
@@ -3846,6 +3860,22 @@ gp_fault:
return X86EMUL_EXCEPTION;
}
+static bool cf_check is_msrlist(
+ const struct x86_emulate_state *state, const struct x86_emulate_ctxt *ctxt)
+{
+
+ if ( ctxt->opcode == X86EMUL_OPC(0x0f, 0x01) )
+ {
+ unsigned int rm, reg;
+ int mode = x86_insn_modrm(state, &rm, ®);
+
+ /* This also includes WRMSRNS; should be okay. */
+ return mode == 3 && rm == 6 && !reg;
+ }
+
+ return false;
+}
+
static void vmx_do_extint(struct cpu_user_regs *regs)
{
unsigned long vector;
@@ -4656,6 +4686,17 @@ void asmlinkage vmx_vmexit_handler(struc
}
break;
+ case EXIT_REASON_RDMSRLIST:
+ case EXIT_REASON_WRMSRLIST:
+ if ( vmx_guest_x86_mode(v) != 8 || !currd->arch.cpuid->feat.msrlist )
+ {
+ ASSERT_UNREACHABLE();
+ hvm_inject_hw_exception(X86_EXC_UD, X86_EVENT_NO_EC);
+ }
+ else if ( !hvm_emulate_one_insn(is_msrlist, "MSR list") )
+ hvm_inject_hw_exception(X86_EXC_GP, 0);
+ break;
+
case EXIT_REASON_VMXOFF:
case EXIT_REASON_VMXON:
case EXIT_REASON_VMCLEAR:
--- a/xen/arch/x86/include/asm/hvm/vmx/vmcs.h
+++ b/xen/arch/x86/include/asm/hvm/vmx/vmcs.h
@@ -275,8 +275,13 @@ void vmx_vmcs_reload(struct vcpu *v);
#define TERTIARY_EXEC_EPT_PAGING_WRITE BIT(2, UL)
#define TERTIARY_EXEC_GUEST_PAGING_VERIFY BIT(3, UL)
#define TERTIARY_EXEC_IPI_VIRT BIT(4, UL)
+#define TERTIARY_EXEC_ENABLE_MSRLIST BIT(6, UL)
#define TERTIARY_EXEC_VIRT_SPEC_CTRL BIT(7, UL)
+#define cpu_has_vmx_msrlist \
+ (IS_ENABLED(CONFIG_INTEL_VMX) && \
+ (vmx_caps.tertiary_exec_control & TERTIARY_EXEC_ENABLE_MSRLIST))
+
#define cpu_has_vmx_virt_spec_ctrl \
(vmx_caps.tertiary_exec_control & TERTIARY_EXEC_VIRT_SPEC_CTRL)
--- a/xen/arch/x86/include/asm/hvm/vmx/vmx.h
+++ b/xen/arch/x86/include/asm/hvm/vmx/vmx.h
@@ -201,6 +201,8 @@ static inline void pi_clear_sn(struct pi
#define EXIT_REASON_XRSTORS 64
#define EXIT_REASON_BUS_LOCK 74
#define EXIT_REASON_NOTIFY 75
+#define EXIT_REASON_RDMSRLIST 78
+#define EXIT_REASON_WRMSRLIST 79
/* Remember to also update VMX_PERF_EXIT_REASON_SIZE! */
/*
--- a/xen/arch/x86/include/asm/msr-index.h
+++ b/xen/arch/x86/include/asm/msr-index.h
@@ -24,6 +24,8 @@
#define APIC_BASE_ENABLE (_AC(1, ULL) << 11)
#define APIC_BASE_ADDR_MASK _AC(0x000ffffffffff000, ULL)
+#define MSR_BARRIER 0x0000002f
+
#define MSR_TEST_CTRL 0x00000033
#define TEST_CTRL_SPLITLOCK_DETECT (_AC(1, ULL) << 29)
#define TEST_CTRL_SPLITLOCK_DISABLE (_AC(1, ULL) << 31)
--- a/xen/arch/x86/include/asm/perfc_defn.h
+++ b/xen/arch/x86/include/asm/perfc_defn.h
@@ -6,7 +6,7 @@ PERFCOUNTER_ARRAY(exceptions,
#ifdef CONFIG_HVM
-#define VMX_PERF_EXIT_REASON_SIZE 76
+#define VMX_PERF_EXIT_REASON_SIZE 80
#define VMEXIT_NPF_PERFC 166
#define SVM_PERF_EXIT_REASON_SIZE (VMEXIT_NPF_PERFC + 1)
PERFCOUNTER_ARRAY(vmexits, "vmexits",
--- a/xen/arch/x86/msr.c
+++ b/xen/arch/x86/msr.c
@@ -148,6 +148,12 @@ int guest_rdmsr(struct vcpu *v, uint32_t
case MSR_AMD_PPIN:
goto gp_fault;
+ case MSR_BARRIER:
+ if ( !cp->feat.msrlist )
+ goto gp_fault;
+ *val = 0;
+ break;
+
case MSR_IA32_FEATURE_CONTROL:
/*
* Architecturally, availability of this MSR is enumerated by the
@@ -427,6 +433,7 @@ int guest_wrmsr(struct vcpu *v, uint32_t
uint64_t rsvd;
/* Read-only */
+ case MSR_BARRIER:
case MSR_IA32_PLATFORM_ID:
case MSR_CORE_CAPABILITIES:
case MSR_INTEL_CORE_THREAD_COUNT:
--- a/xen/arch/x86/x86_emulate/0f01.c
+++ b/xen/arch/x86/x86_emulate/0f01.c
@@ -11,6 +11,7 @@
#include "private.h"
#ifdef __XEN__
+#include <xen/event.h>
#include <asm/prot-key.h>
#endif
@@ -28,6 +29,7 @@ int x86emul_0f01(struct x86_emulate_stat
switch ( s->modrm )
{
unsigned long base, limit, cr0, cr0w, cr4;
+ unsigned int n;
struct segment_register sreg;
uint64_t msr_val;
@@ -42,6 +44,65 @@ int x86emul_0f01(struct x86_emulate_stat
((uint64_t)regs->r(dx) << 32) | regs->eax,
ctxt, true);
goto done;
+
+ case vex_f3: /* wrmsrlist */
+ vcpu_must_have(msrlist);
+ generate_exception_if(!mode_64bit(), X86_EXC_UD);
+ generate_exception_if(!mode_ring0() || (regs->esi & 7) ||
+ (regs->edi & 7),
+ X86_EXC_GP, 0);
+ fail_if(!ops->write_msr);
+ while ( regs->r(cx) )
+ {
+ n = __builtin_ffsl(regs->r(cx)) - 1;
+ if ( (rc = ops->read(x86_seg_none, regs->r(si) + n * 8,
+ &msr_val, 8, ctxt)) != X86EMUL_OKAY )
+ break;
+ generate_exception_if(msr_val != (uint32_t)msr_val,
+ X86_EXC_GP, 0);
+ base = msr_val;
+ if ( (rc = ops->read(x86_seg_none, regs->r(di) + n * 8,
+ &msr_val, 8, ctxt)) != X86EMUL_OKAY ||
+ (rc = ops->write_msr(base, msr_val, ctxt,
+ true)) != X86EMUL_OKAY )
+ break;
+ regs->r(cx) &= ~(1UL << n);
+
+#ifdef __XEN__
+ if ( regs->r(cx) && local_events_need_delivery() )
+ {
+ rc = X86EMUL_RETRY;
+ break;
+ }
+#endif
+ }
+ goto done;
+
+ case vex_f2: /* rdmsrlist */
+ vcpu_must_have(msrlist);
+ generate_exception_if(!mode_64bit(), X86_EXC_UD);
+ generate_exception_if(!mode_ring0() || (regs->esi & 7) ||
+ (regs->edi & 7),
+ X86_EXC_GP, 0);
+ fail_if(!ops->read_msr || !ops->write);
+ while ( regs->r(cx) )
+ {
+ n = __builtin_ffsl(regs->r(cx)) - 1;
+ if ( (rc = ops->read(x86_seg_none, regs->r(si) + n * 8,
+ &msr_val, 8, ctxt)) != X86EMUL_OKAY )
+ break;
+ generate_exception_if(msr_val != (uint32_t)msr_val,
+ X86_EXC_GP, 0);
+ if ( (rc = ops->read_msr(msr_val, &msr_val,
+ ctxt)) != X86EMUL_OKAY ||
+ (rc = ops->write(x86_seg_none, regs->r(di) + n * 8,
+ &msr_val, 8, ctxt)) != X86EMUL_OKAY )
+ break;
+ regs->r(cx) &= ~(1UL << n);
+ }
+ if ( rc != X86EMUL_OKAY )
+ ctxt->regs->r(cx) = regs->r(cx);
+ goto done;
}
generate_exception(X86_EXC_UD);
--- a/xen/arch/x86/x86_emulate/private.h
+++ b/xen/arch/x86/x86_emulate/private.h
@@ -612,6 +612,7 @@ amd_like(const struct x86_emulate_ctxt *
#define vcpu_has_lkgs() (ctxt->cpuid->feat.lkgs)
#define vcpu_has_wrmsrns() (ctxt->cpuid->feat.wrmsrns)
#define vcpu_has_avx_ifma() (ctxt->cpuid->feat.avx_ifma)
+#define vcpu_has_msrlist() (ctxt->cpuid->feat.msrlist)
#define vcpu_has_movrs() (ctxt->cpuid->feat.movrs)
#define vcpu_has_avx_vnni_int8() (ctxt->cpuid->feat.avx_vnni_int8)
#define vcpu_has_avx_ne_convert() (ctxt->cpuid->feat.avx_ne_convert)
--- a/xen/arch/x86/x86_emulate/util.c
+++ b/xen/arch/x86/x86_emulate/util.c
@@ -100,6 +100,9 @@ bool cf_check x86_insn_is_mem_access(con
break;
case X86EMUL_OPC(0x0f, 0x01):
+ /* {RD,WR}MSRLIST */
+ if ( mode_64bit() && s->modrm == 0xc6 )
+ return s->vex.pfx >= vex_f3;
/* Cover CLZERO. */
return (s->modrm_rm & 7) == 4 && (s->modrm_reg & 7) == 7;
}
@@ -160,7 +163,11 @@ bool cf_check x86_insn_is_mem_write(cons
case 0xff: /* Grp5 */
break;
- case X86EMUL_OPC(0x0f, 0x01): /* CLZERO is the odd one. */
+ case X86EMUL_OPC(0x0f, 0x01):
+ /* RDMSRLIST */
+ if ( mode_64bit() && s->modrm == 0xc6 )
+ return s->vex.pfx == vex_f2;
+ /* CLZERO is another odd one. */
return (s->modrm_rm & 7) == 4 && (s->modrm_reg & 7) == 7;
default:
--- a/xen/include/public/arch-x86/cpufeatureset.h
+++ b/xen/include/public/arch-x86/cpufeatureset.h
@@ -317,7 +317,7 @@ XEN_CPUFEATURE(NMI_SRC, 10*32+20) /
XEN_CPUFEATURE(AMX_FP16, 10*32+21) /* AMX FP16 instruction */
XEN_CPUFEATURE(AVX_IFMA, 10*32+23) /*A AVX-IFMA Instructions */
XEN_CPUFEATURE(LAM, 10*32+26) /* Linear Address Masking */
-XEN_CPUFEATURE(MSRLIST, 10*32+27) /* {RD,WR}MSRLIST instructions */
+XEN_CPUFEATURE(MSRLIST, 10*32+27) /*s {RD,WR}MSRLIST instructions */
XEN_CPUFEATURE(NO_INVD, 10*32+30) /* INVD instruction unusable */
XEN_CPUFEATURE(MOVRS, 10*32+31) /*a MOV-read-shared instructions */
--- a/xen/tools/gen-cpuid.py
+++ b/xen/tools/gen-cpuid.py
@@ -283,7 +283,7 @@ def crunch_numbers(state):
# NO_LMSL indicates the absense of Long Mode Segment Limits, which
# have been dropped in hardware.
LM: [CX16, PCID, LAHF_LM, PAGE1GB, PKU, NO_LMSL, AMX_TILE, CMPCCXADD,
- LKGS, MOVRS],
+ LKGS, MOVRS, MSRLIST],
# AMD K6-2+ and K6-III processors shipped with 3DNow+, beyond the
# standard 3DNow in the earlier K6 processors.
^ permalink raw reply [flat|nested] 7+ messages in thread
* [PATCH v10 2/6] x86emul: support USER-MSR instructions
2026-08-05 9:21 [PATCH v10 0/6] x86emul: misc additions (MSR accesses) Jan Beulich
2026-08-05 9:22 ` [PATCH v10 1/6] x86emul+VMX: support {RD,WR}MSRLIST Jan Beulich
@ 2026-08-05 9:23 ` Jan Beulich
2026-08-05 9:23 ` [PATCH v10 3/6] x86/cpu-policy: re-arrange no-VMX logic Jan Beulich
` (3 subsequent siblings)
5 siblings, 0 replies; 7+ messages in thread
From: Jan Beulich @ 2026-08-05 9:23 UTC (permalink / raw)
To: xen-devel@lists.xenproject.org
Cc: Andrew Cooper, Teddy Astie, Roger Pau Monné
While UWRMSR probably isn't of much use as long as we don't support
UINTR, URDMSR may well be useful to guests even without that (depending
on what OSes are willing to permit access to).
Since the two VEX encodings introduce a lonely opcode point in map 7,
for now don't bother introducing a full 256-entry table.
In the test harness use the UINTR_TIMER MSR despite the UINTR and UTMR
features being removed from the architecture. Using UARCH_MISC_CTL would
constrain usable values overly much.
Signed-off-by: Jan Beulich <jbeulich@suse.com>
---
The retaining of (possible) #PF from the bitmap access is "speculative"
(the spec doesn't mention #PF as a possible exception; conceivably this
might also need converting to #GP).
I'm a little wary of the "MSRs Writeable by UWRMSR" table that the spec
has, and that our code thus also enforces: As new MSRs are added to that
table, we'll need piecemeal updates to that switch() statement.
The forced setting of cpu_policy.feat.utmr could likely be done
globally, i.e. early in main(). Limiting its scope is merely "just in
case". Thoughts?
---
v10: Use msr-index.h constants also in x86_emulate(). Re-base.
v8: Switch to using fallthrough pseudo-keyword. Re-base.
v7.1: Add MSR-specific feature checks for UWRMSR (incl the UTMR feature
bit and its overriding in the test harness).
v7: Add missing vcpu_must_have() and override in emul_test_init(). Use
MSR constants even more.
v6: Add MSR_UINTR_TIMER to header. Use MSR constants in test harness.
Re-base.
v5: Correct ModR/M.reg check for VEX-encoded forms. Cosmetic test
harness adjustment. Re-base.
v4: MSR index input regs are 64-bit (albeit only the APX spec has it
this way for now).
v3: New.
--- a/tools/tests/x86_emulator/predicates.c
+++ b/tools/tests/x86_emulator/predicates.c
@@ -867,7 +867,9 @@ static const struct {
{ { 0xf6 }, { 2, 2 }, T, R, pfx_66 }, /* adcx */
{ { 0xf6 }, { 2, 2 }, T, R, pfx_f3 }, /* adox */
{ { 0xf8 }, { 2, 2 }, F, W, pfx_66 }, /* movdir64b */
+ { { 0xf8, 0xc0 }, { 0, 2 }, F, N, pfx_f3 }, /* uwrmsr */
{ { 0xf8 }, { 2, 2 }, F, W, pfx_f3 }, /* enqcmds */
+ { { 0xf8, 0xc0 }, { 0, 2 }, F, N, pfx_f2 }, /* urdmsr */
{ { 0xf8 }, { 2, 2 }, F, W, pfx_f2 }, /* enqcmd */
{ { 0xf9 }, { 2, 2 }, F, W }, /* movdiri */
};
@@ -1519,6 +1521,9 @@ static const struct vex {
{ { 0xde }, 3, T, R, pfx_66, W0, L0 }, /* vsm3rnds2 */
{ { 0xdf }, 3, T, R, pfx_66, WIG, Ln }, /* vaeskeygenassist */
{ { 0xf0 }, 3, T, R, pfx_f2, Wn, L0 }, /* rorx */
+}, vex_map7[] = {
+ { { 0xf8, 0xc0 }, 6, F, N, pfx_f3, W0, L0 }, /* uwrmsr */
+ { { 0xf8, 0xc0 }, 6, F, N, pfx_f2, W0, L0 }, /* urdmsr */
};
static const struct {
@@ -1528,6 +1533,10 @@ static const struct {
{ vex_0f, ARRAY_SIZE(vex_0f) },
{ vex_0f38, ARRAY_SIZE(vex_0f38) },
{ vex_0f3a, ARRAY_SIZE(vex_0f3a) },
+ { NULL, 0 }, /* map 4 */
+ { NULL, 0 }, /* map 5 */
+ { NULL, 0 }, /* map 6 */
+ { vex_map7, ARRAY_SIZE(vex_map7) },
};
static const struct xop {
@@ -2426,7 +2435,8 @@ void predicates_test(void *instr, struct
if ( vex[x].tbl[t].w == WIG || (vex[x].tbl[t].w & W0) )
{
- memcpy(ptr, vex[x].tbl[t].opc, vex[x].tbl[t].len);
+ memcpy(ptr, vex[x].tbl[t].opc,
+ MIN(vex[x].tbl[t].len, ARRAY_SIZE(vex->tbl->opc)));
if ( vex[x].tbl[t].l == LIG || (vex[x].tbl[t].l & L0) )
do_test(instr, vex[x].tbl[t].len + ((void *)ptr - instr),
@@ -2436,7 +2446,8 @@ void predicates_test(void *instr, struct
if ( vex[x].tbl[t].l == LIG || (vex[x].tbl[t].l & L1) )
{
ptr[-1] |= 4;
- memcpy(ptr, vex[x].tbl[t].opc, vex[x].tbl[t].len);
+ memcpy(ptr, vex[x].tbl[t].opc,
+ MIN(vex[x].tbl[t].len, ARRAY_SIZE(vex->tbl->opc)));
do_test(instr, vex[x].tbl[t].len + ((void *)ptr - instr),
vex[x].tbl[t].modrm ? (void *)ptr - instr + 1 : 0,
@@ -2447,7 +2458,8 @@ void predicates_test(void *instr, struct
if ( vex[x].tbl[t].w == WIG || (vex[x].tbl[t].w & W1) )
{
ptr[-1] = 0xf8 | vex[x].tbl[t].pfx;
- memcpy(ptr, vex[x].tbl[t].opc, vex[x].tbl[t].len);
+ memcpy(ptr, vex[x].tbl[t].opc,
+ MIN(vex[x].tbl[t].len, ARRAY_SIZE(vex->tbl->opc)));
if ( vex[x].tbl[t].l == LIG || (vex[x].tbl[t].l & L0) )
do_test(instr, vex[x].tbl[t].len + ((void *)ptr - instr),
@@ -2457,7 +2469,8 @@ void predicates_test(void *instr, struct
if ( vex[x].tbl[t].l == LIG || (vex[x].tbl[t].l & L1) )
{
ptr[-1] |= 4;
- memcpy(ptr, vex[x].tbl[t].opc, vex[x].tbl[t].len);
+ memcpy(ptr, vex[x].tbl[t].opc,
+ MIN(vex[x].tbl[t].len, ARRAY_SIZE(vex->tbl->opc)));
do_test(instr, vex[x].tbl[t].len + ((void *)ptr - instr),
vex[x].tbl[t].modrm ? (void *)ptr - instr + 1 : 0,
--- a/tools/tests/x86_emulator/test_x86_emulator.c
+++ b/tools/tests/x86_emulator/test_x86_emulator.c
@@ -675,6 +675,7 @@ static int blk(
#ifdef __x86_64__
static unsigned long gs_base, gs_base_shadow;
+static unsigned long uintr_timer;
#endif
static int read_segment(
@@ -704,6 +705,15 @@ static int write_segment(
return X86EMUL_OKAY;
}
+
+static const uint8_t __attribute__((aligned(0x1000))) umsr_bitmap[0x1000] = {
+#define RD(msr) [(msr) >> 3] = 1 << ((msr) & 7)
+#define WR(msr) [0x800 + ((msr) >> 3)] = 1 << ((msr) & 7)
+ RD(MSR_IA32_APERF),
+ WR(MSR_UINTR_TIMER),
+#undef WR
+#undef RD
+};
#endif
static int read_msr(
@@ -713,10 +723,22 @@ static int read_msr(
{
switch ( reg )
{
+#ifdef __x86_64__
+ case MSR_USER_MSR_CTL:
+ *val = (unsigned long)umsr_bitmap | 1;
+ return X86EMUL_OKAY;
+#endif
+
case MSR_BARRIER:
*val = 0;
return X86EMUL_OKAY;
+ case MSR_IA32_APERF:
+#define APERF_LO_VALUE 0xAEAEAEAE
+#define APERF_HI_VALUE 0xEAEAEAEA
+ *val = ((uint64_t)APERF_HI_VALUE << 32) | APERF_LO_VALUE;
+ return X86EMUL_OKAY;
+
case MSR_EFER:
*val = ctxt->addr_size > 32 ? EFER_LME | EFER_LMA : 0;
return X86EMUL_OKAY;
@@ -753,6 +775,12 @@ static int write_msr(
{
switch ( reg )
{
+ case MSR_UINTR_TIMER:
+ if ( ctxt->addr_size < 64 )
+ break;
+ uintr_timer = val;
+ return X86EMUL_OKAY;
+
case MSR_GS_BASE:
if ( ctxt->addr_size < 64 || !is_canonical_address(val) )
break;
@@ -1481,6 +1509,68 @@ int main(int argc, char **argv)
(gs_base != 0x0000222244446666UL) ||
(gs_base_shadow != 0x0000111122224444UL) )
goto fail;
+ printf("okay\n");
+
+ printf("%-40s", "Testing urdmsr %rdx,%rcx...");
+ instr[0] = 0xf2; instr[1] = 0x0f; instr[2] = 0x38; instr[3] = 0xf8; instr[4] = 0xd1;
+ regs.rip = (unsigned long)&instr[0];
+ regs.rdx = MSR_IA32_APERF;
+ rc = x86_emulate(&ctxt, &emulops);
+ if ( (rc != X86EMUL_OKAY) ||
+ (regs.rip != (unsigned long)&instr[5]) ||
+ (regs.rcx != (((uint64_t)APERF_HI_VALUE << 32) | APERF_LO_VALUE)) )
+ goto fail;
+ printf("okay\n");
+
+ printf("%-40s", "Testing urdmsr $MSR_IA32_APERF,%rdx...");
+ instr[0] = 0xc4; instr[1] = 0xe7; instr[2] = 0x7b; instr[3] = 0xf8; instr[4] = 0xc2;
+ *(uint32_t *)&instr[5] = MSR_IA32_APERF;
+ regs.rip = (unsigned long)&instr[0];
+ rc = x86_emulate(&ctxt, &emulops);
+ if ( (rc != X86EMUL_OKAY) ||
+ (regs.rip != (unsigned long)&instr[9]) ||
+ (regs.rdx != (((uint64_t)APERF_HI_VALUE << 32) | APERF_LO_VALUE)) )
+ goto fail;
+ printf("okay\n");
+
+ /* Our write_msr() knows of MSR_UINTR_TIMER. */
+ i = cpu_policy.feat.utmr;
+ cpu_policy.feat.utmr = true;
+
+ printf("%-40s", "Testing uwrmsr %rdi,%rsi...");
+ instr[0] = 0xf3; instr[1] = 0x0f; instr[2] = 0x38; instr[3] = 0xf8; instr[4] = 0xf7;
+ regs.rip = (unsigned long)&instr[0];
+ regs.rsi = MSR_UINTR_TIMER;
+ regs.rdi = 0x0011223344556677UL;
+ rc = x86_emulate(&ctxt, &emulops);
+ if ( (rc != X86EMUL_OKAY) ||
+ (regs.rip != (unsigned long)&instr[5]) ||
+ (uintr_timer != 0x0011223344556677UL) )
+ goto fail;
+ printf("okay\n");
+
+ printf("%-40s", "Testing uwrmsr %rsi,$MSR_UINTR_TIMER...");
+ instr[0] = 0xc4; instr[1] = 0xe7; instr[2] = 0x7a; instr[3] = 0xf8; instr[4] = 0xc6;
+ *(uint32_t *)&instr[5] = MSR_UINTR_TIMER;
+ regs.rip = (unsigned long)&instr[0];
+ regs.rsi = 0x8877665544332211UL;
+ rc = x86_emulate(&ctxt, &emulops);
+ if ( (rc != X86EMUL_OKAY) ||
+ (regs.rip != (unsigned long)&instr[9]) ||
+ (uintr_timer != 0x8877665544332211UL) )
+ goto fail;
+ printf("okay\n");
+
+ cpu_policy.feat.utmr = i;
+
+ printf("%-40s", "Testing uwrmsr %rsi,$MSR_UARCH_MISC_CTRL...");
+ *(uint32_t *)&instr[5] = MSR_UARCH_MISC_CTRL;
+ regs.rip = (unsigned long)&instr[0];
+ regs.rsi = 0;
+ rc = x86_emulate(&ctxt, &emulops);
+ if ( (rc != X86EMUL_EXCEPTION) ||
+ (regs.rip != (unsigned long)&instr[0]) )
+ goto fail;
emulops.write_msr = NULL;
#endif
--- a/tools/tests/x86_emulator/x86-emulate.c
+++ b/tools/tests/x86_emulator/x86-emulate.c
@@ -67,6 +67,7 @@ bool emul_test_init(void)
cpu_policy.feat.lkgs = true;
cpu_policy.feat.wrmsrns = true;
cpu_policy.feat.msrlist = true;
+ cpu_policy.feat.user_msr = true;
cpu_policy.extd.clzero = true;
if ( cpu_has_xsave )
--- a/xen/arch/x86/include/asm/msr-index.h
+++ b/xen/arch/x86/include/asm/msr-index.h
@@ -24,6 +24,10 @@
#define APIC_BASE_ENABLE (_AC(1, ULL) << 11)
#define APIC_BASE_ADDR_MASK _AC(0x000ffffffffff000, ULL)
+#define MSR_USER_MSR_CTL 0x0000001c
+#define USER_MSR_ENABLE (_AC(1, ULL) << 0)
+#define USER_MSR_ADDR_MASK 0xfffffffffffff000ULL
+
#define MSR_BARRIER 0x0000002f
#define MSR_TEST_CTRL 0x00000033
@@ -209,6 +213,8 @@
#define MCU_CONTROL_DIS_MCU_LOAD (_AC(1, ULL) << 1)
#define MCU_CONTROL_EN_SMM_BYPASS (_AC(1, ULL) << 2)
+#define MSR_UINTR_TIMER 0x00001b00
+
#define MSR_UARCH_MISC_CTRL 0x00001b01
#define UARCH_CTRL_DOITM (_AC(1, ULL) << 0)
--- a/xen/arch/x86/x86_emulate/decode.c
+++ b/xen/arch/x86/x86_emulate/decode.c
@@ -905,7 +905,7 @@ decode_0f38(struct x86_emulate_state *s,
case 0x00 ... 0x89:
case 0x8c ... 0xef:
case 0xf2 ... 0xf5:
- case 0xf7 ... 0xf8:
+ case 0xf7:
case 0xfa ... 0xff:
s->op_bytes = 0;
/* fall through */
@@ -957,6 +957,18 @@ decode_0f38(struct x86_emulate_state *s,
case X86EMUL_OPC_VEX_F2(0, 0xf7): /* shrx */
break;
+ case 0xf8:
+ if ( s->modrm_mod == 3 ) /* u{rd,wr}msr */
+ {
+ s->desc = DstMem | SrcReg | Mov;
+ s->op_bytes = 8;
+ s->simd_size = simd_none;
+ }
+ else /* movdir64b / enqcmd{,s} */
+ s->op_bytes = 0;
+ ctxt->opcode |= MASK_INSR(s->vex.pfx, X86EMUL_OPC_PFX_MASK);
+ break;
+
default:
s->op_bytes = 0;
break;
@@ -1255,6 +1267,16 @@ int x86emul_decode(struct x86_emulate_st
*/
d = twobyte_table[0x38].desc;
break;
+
+ case vex_map7:
+ opcode |= MASK_INSR(7, X86EMUL_OPC_EXT_MASK);
+ /*
+ * No table lookup here for now, as there's only a single
+ * opcode point (0xf8) populated in map 7.
+ */
+ d = DstMem | SrcImm | ModRM | Mov;
+ s->op_bytes = 8;
+ break;
}
}
else if ( s->ext < ext_8f08 + ARRAY_SIZE(xop_table) )
@@ -1611,6 +1633,7 @@ int x86emul_decode(struct x86_emulate_st
s->simd_size = ext8f09_table[b].simd_size;
break;
+ case ext_map7:
case ext_8f08:
case ext_8f0a:
/*
@@ -1825,6 +1848,7 @@ int x86emul_decode(struct x86_emulate_st
case ext_map5:
case ext_map6:
+ case ext_map7:
case ext_8f09:
case ext_8f0a:
break;
--- a/xen/arch/x86/x86_emulate/private.h
+++ b/xen/arch/x86/x86_emulate/private.h
@@ -202,6 +202,7 @@ enum vex_opcx {
vex_0f3a,
evex_map5 = 5,
evex_map6,
+ vex_map7,
};
enum vex_pfx {
@@ -259,6 +260,7 @@ struct x86_emulate_state {
ext_0f3a = vex_0f3a,
ext_map5 = evex_map5,
ext_map6 = evex_map6,
+ ext_map7 = vex_map7,
/*
* For XOP use values such that the respective instruction field
* can be used without adjustment.
@@ -617,6 +619,7 @@ amd_like(const struct x86_emulate_ctxt *
#define vcpu_has_avx_vnni_int8() (ctxt->cpuid->feat.avx_vnni_int8)
#define vcpu_has_avx_ne_convert() (ctxt->cpuid->feat.avx_ne_convert)
#define vcpu_has_avx_vnni_int16() (ctxt->cpuid->feat.avx_vnni_int16)
+#define vcpu_has_user_msr() (ctxt->cpuid->feat.user_msr)
#define vcpu_must_have(feat) \
generate_exception_if(!vcpu_has_##feat(), X86_EXC_UD)
--- a/xen/arch/x86/x86_emulate/x86_emulate.c
+++ b/xen/arch/x86/x86_emulate/x86_emulate.c
@@ -7086,10 +7086,74 @@ x86_emulate(
state->simd_size = simd_none;
break;
- case X86EMUL_OPC_F2(0x0f38, 0xf8): /* enqcmd r,m512 */
- case X86EMUL_OPC_F3(0x0f38, 0xf8): /* enqcmds r,m512 */
+ case X86EMUL_OPC_F3(0x0f38, 0xf8): /* enqcmds r,m512 / uwrmsr r64,r32 */
+ case X86EMUL_OPC_F2(0x0f38, 0xf8): /* enqcmd r,m512 / urdmsr r32,r64 */
+ if ( ea.type == OP_MEM )
+ goto enqcmd;
+ imm1 = src.val;
+ fallthrough;
+ case X86EMUL_OPC_VEX_F3(7, 0xf8): /* uwrmsr r64,imm32 */
+ case X86EMUL_OPC_VEX_F2(7, 0xf8): /* urdmsr imm32,r64 */
+ generate_exception_if(!mode_64bit() || ea.type != OP_REG, X86_EXC_UD);
+ generate_exception_if(vex.l || vex.w, X86_EXC_UD);
+ generate_exception_if(vex.opcx && ((modrm_reg & 7) || vex.reg != 0xf),
+ X86_EXC_UD);
+ vcpu_must_have(user_msr);
+ fail_if(!ops->read_msr);
+ if ( ops->read_msr(MSR_USER_MSR_CTL, &msr_val, ctxt) != X86EMUL_OKAY )
+ {
+ x86_emul_reset_event(ctxt);
+ msr_val = 0;
+ }
+ generate_exception_if(!(msr_val & USER_MSR_ENABLE), X86_EXC_UD);
+ generate_exception_if(imm1 & ~0x3fff, X86_EXC_GP, 0);
+
+ /* Check the corresponding bitmap. */
+ ea.mem.off = msr_val & ~0xfff;
+ if ( vex.pfx != vex_f2 )
+ ea.mem.off += 0x800;
+ ea.mem.off += imm1 >> 3;
+ if ( (rc = ops->read(x86_seg_sys, ea.mem.off, &b, 1,
+ ctxt)) != X86EMUL_OKAY )
+ goto done;
+ generate_exception_if(!(b & (1 << (imm1 & 7))), X86_EXC_GP, 0);
+
+ /* Carry out the actual MSR access. */
+ if ( vex.pfx == vex_f2 )
+ {
+ /* urdmsr */
+ if ( (rc = ops->read_msr(imm1, &msr_val, ctxt)) != X86EMUL_OKAY )
+ goto done;
+ dst.val = msr_val;
+ ASSERT(dst.type == OP_REG);
+ dst.bytes = 8;
+ }
+ else
+ {
+ /* uwrmsr */
+ switch ( imm1 )
+ {
+ case MSR_UINTR_TIMER:
+ generate_exception_if(!cp->feat.utmr, X86_EXC_GP, 0);
+ break;
+
+ case MSR_UARCH_MISC_CTRL:
+ generate_exception_if(!cp->arch_caps.doitm, X86_EXC_GP, 0);
+ break;
+
+ default:
+ generate_exception(X86_EXC_GP, 0);
+ }
+ fail_if(!ops->write_msr);
+ if ( (rc = ops->write_msr(imm1, dst.val, ctxt,
+ true)) != X86EMUL_OKAY )
+ goto done;
+ dst.type = OP_NONE;
+ }
+ break;
+
+ enqcmd:
vcpu_must_have(enqcmd);
- generate_exception_if(ea.type != OP_MEM, X86_EXC_UD);
generate_exception_if(vex.pfx != vex_f2 && !mode_ring0(), X86_EXC_GP, 0);
src.val = truncate_ea(*dst.reg);
generate_exception_if(!is_aligned(x86_seg_es, src.val, 64, ctxt, ops),
--- a/xen/include/public/arch-x86/cpufeatureset.h
+++ b/xen/include/public/arch-x86/cpufeatureset.h
@@ -360,7 +360,9 @@ XEN_CPUFEATURE(AVX_VNNI_INT8, 15*32
XEN_CPUFEATURE(AVX_NE_CONVERT, 15*32+ 5) /*A AVX-NE-CONVERT Instructions */
XEN_CPUFEATURE(AMX_COMPLEX, 15*32+ 8) /* AMX Complex Instructions */
XEN_CPUFEATURE(AVX_VNNI_INT16, 15*32+10) /*A AVX-VNNI-INT16 Instructions */
+XEN_CPUFEATURE(UTMR, 15*32+13) /* User Timer */
XEN_CPUFEATURE(PREFETCHI, 15*32+14) /*A PREFETCHIT{0,1} Instructions */
+XEN_CPUFEATURE(USER_MSR, 15*32+15) /* U{RD,WR}MSR Instructions */
XEN_CPUFEATURE(UIRET_UIF, 15*32+17) /* UIRET updates UIF */
XEN_CPUFEATURE(CET_SSS, 15*32+18) /* CET Supervisor Shadow Stacks safe to use */
XEN_CPUFEATURE(SLSM, 15*32+24) /* Static Lockstep Mode */
--- a/xen/tools/gen-cpuid.py
+++ b/xen/tools/gen-cpuid.py
@@ -283,7 +283,7 @@ def crunch_numbers(state):
# NO_LMSL indicates the absense of Long Mode Segment Limits, which
# have been dropped in hardware.
LM: [CX16, PCID, LAHF_LM, PAGE1GB, PKU, NO_LMSL, AMX_TILE, CMPCCXADD,
- LKGS, MOVRS, MSRLIST],
+ LKGS, MOVRS, MSRLIST, USER_MSR],
# AMD K6-2+ and K6-III processors shipped with 3DNow+, beyond the
# standard 3DNow in the earlier K6 processors.
^ permalink raw reply [flat|nested] 7+ messages in thread
* [PATCH v10 3/6] x86/cpu-policy: re-arrange no-VMX logic
2026-08-05 9:21 [PATCH v10 0/6] x86emul: misc additions (MSR accesses) Jan Beulich
2026-08-05 9:22 ` [PATCH v10 1/6] x86emul+VMX: support {RD,WR}MSRLIST Jan Beulich
2026-08-05 9:23 ` [PATCH v10 2/6] x86emul: support USER-MSR instructions Jan Beulich
@ 2026-08-05 9:23 ` Jan Beulich
2026-08-05 9:24 ` [PATCH v10 4/6] VMX: support USER-MSR Jan Beulich
` (2 subsequent siblings)
5 siblings, 0 replies; 7+ messages in thread
From: Jan Beulich @ 2026-08-05 9:23 UTC (permalink / raw)
To: xen-devel@lists.xenproject.org
Cc: Andrew Cooper, Teddy Astie, Roger Pau Monné
Move the PKS check into an "else" for the corresponding "if()", such
that further adjustments (like for USER_MSR) can easily be put there as
well.
Signed-off-by: Jan Beulich <jbeulich@suse.com>
---
v5: Re-base.
v4: New.
--- a/xen/arch/x86/cpu-policy.c
+++ b/xen/arch/x86/cpu-policy.c
@@ -823,19 +823,20 @@ static void __init calculate_hvm_max_pol
if ( !cpu_has_vmx_xsaves )
__clear_bit(X86_FEATURE_XSAVES, fs);
}
+ else
+ {
+ /*
+ * Xen doesn't use PKS, so the guest support for it has opted to not use
+ * the VMCS load/save controls for efficiency reasons. This depends on
+ * the exact vmentry/exit behaviour, so don't expose PKS in other
+ * situations until someone has cross-checked the behaviour for safety.
+ */
+ __clear_bit(X86_FEATURE_PKS, fs);
+ }
if ( !cpu_has_vmx_msrlist )
__clear_bit(X86_FEATURE_MSRLIST, fs);
- /*
- * Xen doesn't use PKS, so the guest support for it has opted to not use
- * the VMCS load/save controls for efficiency reasons. This depends on
- * the exact vmentry/exit behaviour, so don't expose PKS in other
- * situations until someone has cross-checked the behaviour for safety.
- */
- if ( !cpu_has_vmx )
- __clear_bit(X86_FEATURE_PKS, fs);
-
/*
* Make adjustments to possible (nested) virtualization features exposed
* to the guest
^ permalink raw reply [flat|nested] 7+ messages in thread
* [PATCH v10 4/6] VMX: support USER-MSR
2026-08-05 9:21 [PATCH v10 0/6] x86emul: misc additions (MSR accesses) Jan Beulich
` (2 preceding siblings ...)
2026-08-05 9:23 ` [PATCH v10 3/6] x86/cpu-policy: re-arrange no-VMX logic Jan Beulich
@ 2026-08-05 9:24 ` Jan Beulich
2026-08-05 9:24 ` [PATCH v10 5/6] x86emul: support MSR-IMM instructions Jan Beulich
2026-08-05 9:24 ` [PATCH v10 6/6] VMX: support MSR-IMM Jan Beulich
5 siblings, 0 replies; 7+ messages in thread
From: Jan Beulich @ 2026-08-05 9:24 UTC (permalink / raw)
To: xen-devel@lists.xenproject.org
Cc: Andrew Cooper, Teddy Astie, Roger Pau Monné
Hook up the new VM exit codes and handle guest accesses, context switch,
and save/restore. At least for now don't allow the guest direct access
to the control MSR; this may need changing if guests were to frequently
access it (e.g. on their own context switch path).
While there also correct a one-off in union ldt_or_tr_instr_info's
comment.
Signed-off-by: Jan Beulich <jbeulich@suse.com>
---
Needing to change two places in hvm.c continues to be unhelpful; I
recall I already did forget to also adjust hvm_load_cpu_msrs() for XFD.
Considering that MSRs typically arrive in the order the table has it,
couldn't we incrementally look up the incoming MSR index there, falling
back to a full lookup only when the incremental lookup failed (and thus
not normally re-iterating through the initial part of the array)?
Said comment in union ldt_or_tr_instr_info is further odd (same for
union gdt_or_idt_instr_info's) in that Instruction Information is only a
32-bit field. Hence bits 32-63 aren't undefined, but simply don't exist.
RFC: The wee attempt to "deal" with nested is likely wrong, but I'm
afraid I simply don't know where such enforcement would be done
properly. Returning an error there is also commented out, for
domain_cpu_policy_changed() returning void without "x86/xstate:
re-size save area when CPUID policy changes" in place.
---
v10: Replace __vmread() by vmread(). Add commentsto case labels in
vmx_vmexit_handler(). Re-base.
v9: Use wrmsrns(). Do renames where bits are also going to be used for
MSR-IMM. Re-base.
v8: Re-base.
v5: Introduce user_msr_gpr().
v4: New.
--- a/xen/arch/x86/cpu-policy.c
+++ b/xen/arch/x86/cpu-policy.c
@@ -832,6 +832,12 @@ static void __init calculate_hvm_max_pol
* situations until someone has cross-checked the behaviour for safety.
*/
__clear_bit(X86_FEATURE_PKS, fs);
+
+ /*
+ * Don't expose USER-MSR until it is known how (if at all) it is
+ * virtualized on SVM.
+ */
+ __clear_bit(X86_FEATURE_USER_MSR, fs);
}
if ( !cpu_has_vmx_msrlist )
--- a/xen/arch/x86/domain.c
+++ b/xen/arch/x86/domain.c
@@ -452,6 +452,10 @@ void domain_cpu_policy_changed(struct do
}
}
+ /* Nested doesn't have the necessary processing, yet. */
+ if ( nestedhvm_enabled(d) && p->feat.user_msr )
+ return /* -EINVAL */;
+
for_each_vcpu ( d, v )
{
cpu_policy_updated(v);
--- a/xen/arch/x86/hvm/hvm.c
+++ b/xen/arch/x86/hvm/hvm.c
@@ -1393,6 +1393,7 @@ static int cf_check hvm_load_cpu_xsave_s
#define HVM_CPU_MSR_SIZE(cnt) offsetof(struct hvm_msr, msr[cnt])
static const uint32_t msrs_to_send[] = {
+ MSR_USER_MSR_CTL,
MSR_SPEC_CTRL,
MSR_INTEL_MISC_FEATURES_ENABLES,
MSR_PKRS,
@@ -1547,6 +1548,7 @@ static int cf_check hvm_load_cpu_msrs(st
{
int rc;
+ case MSR_USER_MSR_CTL:
case MSR_SPEC_CTRL:
case MSR_INTEL_MISC_FEATURES_ENABLES:
case MSR_PKRS:
--- a/xen/arch/x86/hvm/vmx/vmx.c
+++ b/xen/arch/x86/hvm/vmx/vmx.c
@@ -696,13 +696,18 @@ static void cf_check vmx_vcpu_destroy(st
}
/*
- * To avoid MSR save/restore at every VM exit/entry time, we restore
- * the x86_64 specific MSRs at domain switch time. Since these MSRs
- * are not modified once set for para domains, we don't save them,
- * but simply reset them to values set in percpu_traps_init().
+ * To avoid MSR save/restore at every VM exit/entry time, we restore the
+ * x86_64 specific MSRs at vcpu switch time. Since these MSRs are not
+ * modified once set for para domains, we don't save them, but simply clear
+ * them or reset them to values set in percpu_traps_init().
*/
-static void vmx_restore_host_msrs(void)
+static void vmx_restore_host_msrs(const struct vcpu *v)
{
+ const struct vcpu_msrs *msrs = v->arch.msrs;
+
+ if ( msrs->user_msr_ctl.enable )
+ wrmsrns(MSR_USER_MSR_CTL, 0);
+
/* No PV guests? No need to restore host SYSCALL infrastructure. */
if ( !IS_ENABLED(CONFIG_PV) )
return;
@@ -760,6 +765,9 @@ static void vmx_restore_guest_msrs(struc
if ( cp->feat.pks )
wrpkrs(msrs->pkrs);
+
+ if ( msrs->user_msr_ctl.enable )
+ wrmsrns(MSR_USER_MSR_CTL, msrs->user_msr_ctl.raw);
}
void vmx_update_cpu_exec_control(struct vcpu *v)
@@ -1165,7 +1173,7 @@ static void cf_check vmx_ctxt_switch_fro
}
vmx_save_guest_msrs(v);
- vmx_restore_host_msrs();
+ vmx_restore_host_msrs(v);
vmx_save_dr(v);
if ( v->domain->arch.hvm.pi_ops.flags & PI_CSW_FROM )
@@ -4194,6 +4202,13 @@ static int vmx_handle_apic_write(void)
return vlapic_apicv_write(current, exit_qualification & 0xfff);
}
+static unsigned int msr_imm_gpr(void)
+{
+ msr_imm_instr_info_t info = { .raw = vmread(VMX_INSTRUCTION_INFO) };
+
+ return info.gpr;
+}
+
static void undo_nmis_unblocked_by_iret(void)
{
unsigned long guest_info;
@@ -4697,6 +4712,41 @@ void asmlinkage vmx_vmexit_handler(struc
hvm_inject_hw_exception(X86_EXC_GP, 0);
break;
+ case EXIT_REASON_URDMSR: /* NB: User-MSR bitmap was checked by the CPU. */
+ {
+ uint64_t msr_content = 0;
+
+ switch ( hvm_msr_read_intercept(vmread(EXIT_QUALIFICATION),
+ &msr_content) )
+ {
+ case X86EMUL_OKAY:
+ *decode_gpr(regs, msr_imm_gpr()) = msr_content;
+ update_guest_eip(); /* Safe: URDMSR */
+ break;
+
+ case X86EMUL_EXCEPTION:
+ hvm_inject_hw_exception(X86_EXC_GP, 0);
+ break;
+ }
+ break;
+ }
+
+ case EXIT_REASON_UWRMSR: /* NB: User-MSR bitmap was checked by the CPU. */
+ exit_qualification = vmread(EXIT_QUALIFICATION);
+ switch ( hvm_msr_write_intercept(exit_qualification,
+ *decode_gpr(regs, msr_imm_gpr()),
+ true) )
+ {
+ case X86EMUL_OKAY:
+ update_guest_eip(); /* Safe: UWRMSR */
+ break;
+
+ case X86EMUL_EXCEPTION:
+ hvm_inject_hw_exception(X86_EXC_GP, 0);
+ break;
+ }
+ break;
+
case EXIT_REASON_VMXOFF:
case EXIT_REASON_VMXON:
case EXIT_REASON_VMCLEAR:
--- a/xen/arch/x86/include/asm/hvm/vmx/vmx.h
+++ b/xen/arch/x86/include/asm/hvm/vmx/vmx.h
@@ -203,6 +203,8 @@ static inline void pi_clear_sn(struct pi
#define EXIT_REASON_NOTIFY 75
#define EXIT_REASON_RDMSRLIST 78
#define EXIT_REASON_WRMSRLIST 79
+#define EXIT_REASON_URDMSR 80
+#define EXIT_REASON_UWRMSR 81
/* Remember to also update VMX_PERF_EXIT_REASON_SIZE! */
/*
@@ -578,8 +580,18 @@ typedef union ldt_or_tr_instr_info {
base_reg_invalid :1, /* bit 27 - Base register invalid */
instr_identity :1, /* bit 28 - 0:LDT, 1:TR */
instr_write :1, /* bit 29 - 0:store, 1:load */
- :34; /* bits 31:63 - Undefined */
+ :34; /* bits 30:63 - Undefined */
};
} ldt_or_tr_instr_info_t;
+/* VM-Exit instruction info for URDMSR and UWRMSR */
+typedef union msr_imm_instr_info {
+ unsigned long raw;
+ struct {
+ unsigned int :3, /* Bits 0:2 - Undefined */
+ gpr :4, /* Bits 3:6 - Source/Destination register */
+ :25; /* bits 7:31 - Undefined */
+ };
+} msr_imm_instr_info_t;
+
#endif /* __ASM_X86_HVM_VMX_VMX_H__ */
--- a/xen/arch/x86/include/asm/guest-msr.h
+++ b/xen/arch/x86/include/asm/guest-msr.h
@@ -8,6 +8,20 @@
struct vcpu_msrs
{
/*
+ * 0x0000001c - MSR_USER_MSR_CTL
+ *
+ * Value is guest chosen, and always loaded in vcpu context.
+ */
+ union {
+ uint64_t raw;
+ struct {
+ bool enable:1;
+ unsigned int :11;
+ unsigned long bitmap:52;
+ };
+ } user_msr_ctl;
+
+ /*
* 0x00000048 - MSR_SPEC_CTRL
* 0xc001011f - MSR_VIRT_SPEC_CTRL (if X86_FEATURE_AMD_SSBD)
*
--- a/xen/arch/x86/include/asm/perfc_defn.h
+++ b/xen/arch/x86/include/asm/perfc_defn.h
@@ -6,7 +6,7 @@ PERFCOUNTER_ARRAY(exceptions,
#ifdef CONFIG_HVM
-#define VMX_PERF_EXIT_REASON_SIZE 80
+#define VMX_PERF_EXIT_REASON_SIZE 82
#define VMEXIT_NPF_PERFC 166
#define SVM_PERF_EXIT_REASON_SIZE (VMEXIT_NPF_PERFC + 1)
PERFCOUNTER_ARRAY(vmexits, "vmexits",
--- a/xen/arch/x86/msr.c
+++ b/xen/arch/x86/msr.c
@@ -278,6 +278,12 @@ int guest_rdmsr(struct vcpu *v, uint32_t
*val = msrs->xss.raw;
break;
+ case MSR_USER_MSR_CTL:
+ if ( !cp->feat.user_msr )
+ goto gp_fault;
+ *val = msrs->user_msr_ctl.raw;
+ break;
+
case 0x40000000 ... 0x400001ff:
if ( is_viridian_domain(d) )
{
@@ -616,6 +622,19 @@ int guest_wrmsr(struct vcpu *v, uint32_t
msrs->xss.raw = val;
break;
+ case MSR_USER_MSR_CTL:
+ if ( !cp->feat.user_msr )
+ goto gp_fault;
+
+ if ( (val & ~(USER_MSR_ENABLE | USER_MSR_ADDR_MASK)) ||
+ !is_canonical_address(val) )
+ goto gp_fault;
+
+ msrs->user_msr_ctl.raw = val;
+ if ( v == curr )
+ wrmsrns(MSR_USER_MSR_CTL, val);
+ break;
+
case 0x40000000 ... 0x400001ff:
if ( is_viridian_domain(d) )
{
--- a/xen/include/public/arch-x86/cpufeatureset.h
+++ b/xen/include/public/arch-x86/cpufeatureset.h
@@ -362,7 +362,7 @@ XEN_CPUFEATURE(AMX_COMPLEX, 15*32
XEN_CPUFEATURE(AVX_VNNI_INT16, 15*32+10) /*A AVX-VNNI-INT16 Instructions */
XEN_CPUFEATURE(UTMR, 15*32+13) /* User Timer */
XEN_CPUFEATURE(PREFETCHI, 15*32+14) /*A PREFETCHIT{0,1} Instructions */
-XEN_CPUFEATURE(USER_MSR, 15*32+15) /* U{RD,WR}MSR Instructions */
+XEN_CPUFEATURE(USER_MSR, 15*32+15) /*s U{RD,WR}MSR Instructions */
XEN_CPUFEATURE(UIRET_UIF, 15*32+17) /* UIRET updates UIF */
XEN_CPUFEATURE(CET_SSS, 15*32+18) /* CET Supervisor Shadow Stacks safe to use */
XEN_CPUFEATURE(SLSM, 15*32+24) /* Static Lockstep Mode */
^ permalink raw reply [flat|nested] 7+ messages in thread
* [PATCH v10 5/6] x86emul: support MSR-IMM instructions
2026-08-05 9:21 [PATCH v10 0/6] x86emul: misc additions (MSR accesses) Jan Beulich
` (3 preceding siblings ...)
2026-08-05 9:24 ` [PATCH v10 4/6] VMX: support USER-MSR Jan Beulich
@ 2026-08-05 9:24 ` Jan Beulich
2026-08-05 9:24 ` [PATCH v10 6/6] VMX: support MSR-IMM Jan Beulich
5 siblings, 0 replies; 7+ messages in thread
From: Jan Beulich @ 2026-08-05 9:24 UTC (permalink / raw)
To: xen-devel@lists.xenproject.org
Cc: Andrew Cooper, Teddy Astie, Roger Pau Monné
Encoding-wise these are very similar to URDMSR/UWRMSR, so existing logic
is easy to extend.
Signed-off-by: Jan Beulich <jbeulich@suse.com>
---
v10: Drop vex.opcx part of #UD check (wrongly copied from USER-MSR code).
Re-base.
v8: Don't mark the feature 's' just yet. Re-base.
v7: New.
--- a/tools/tests/x86_emulator/predicates.c
+++ b/tools/tests/x86_emulator/predicates.c
@@ -1522,6 +1522,8 @@ static const struct vex {
{ { 0xdf }, 3, T, R, pfx_66, WIG, Ln }, /* vaeskeygenassist */
{ { 0xf0 }, 3, T, R, pfx_f2, Wn, L0 }, /* rorx */
}, vex_map7[] = {
+ { { 0xf6, 0xc0 }, 6, F, N, pfx_f3, W0, L0 }, /* wrmsrns */
+ { { 0xf6, 0xc0 }, 6, F, N, pfx_f2, W0, L0 }, /* rdmsr */
{ { 0xf8, 0xc0 }, 6, F, N, pfx_f3, W0, L0 }, /* uwrmsr */
{ { 0xf8, 0xc0 }, 6, F, N, pfx_f2, W0, L0 }, /* urdmsr */
};
--- a/tools/tests/x86_emulator/test_x86_emulator.c
+++ b/tools/tests/x86_emulator/test_x86_emulator.c
@@ -1571,6 +1571,30 @@ int main(int argc, char **argv)
if ( (rc != X86EMUL_EXCEPTION) ||
(regs.rip != (unsigned long)&instr[0]) )
goto fail;
+ printf("okay\n");
+
+ printf("%-40s", "Testing rdmsr $MSR_GS_BASE,%rdx...");
+ instr[0] = 0xc4; instr[1] = 0xe7; instr[2] = 0x7b; instr[3] = 0xf6; instr[4] = 0xc2;
+ *(uint32_t *)&instr[5] = MSR_GS_BASE;
+ regs.rip = (unsigned long)&instr[0];
+ regs.rdx = ~gs_base;
+ rc = x86_emulate(&ctxt, &emulops);
+ if ( (rc != X86EMUL_OKAY) ||
+ (regs.rip != (unsigned long)&instr[9]) ||
+ (regs.rdx != gs_base) )
+ goto fail;
+ printf("okay\n");
+
+ printf("%-40s", "Testing wrmsrns %rsi,$MSR_SHADOW_GS_BASE...");
+ instr[0] = 0xc4; instr[1] = 0xe7; instr[2] = 0x7a; instr[3] = 0xf6; instr[4] = 0xc6;
+ *(uint32_t *)&instr[5] = MSR_SHADOW_GS_BASE;
+ regs.rip = (unsigned long)&instr[0];
+ regs.rsi = 0x665544332211UL;
+ rc = x86_emulate(&ctxt, &emulops);
+ if ( (rc != X86EMUL_OKAY) ||
+ (regs.rip != (unsigned long)&instr[9]) ||
+ (gs_base_shadow != 0x665544332211UL) )
+ goto fail;
emulops.write_msr = NULL;
#endif
--- a/tools/tests/x86_emulator/x86-emulate.c
+++ b/tools/tests/x86_emulator/x86-emulate.c
@@ -67,6 +67,7 @@ bool emul_test_init(void)
cpu_policy.feat.lkgs = true;
cpu_policy.feat.wrmsrns = true;
cpu_policy.feat.msrlist = true;
+ cpu_policy.feat.msr_imm = true;
cpu_policy.feat.user_msr = true;
cpu_policy.extd.clzero = true;
--- a/xen/arch/x86/x86_emulate/decode.c
+++ b/xen/arch/x86/x86_emulate/decode.c
@@ -1271,8 +1271,9 @@ int x86emul_decode(struct x86_emulate_st
case vex_map7:
opcode |= MASK_INSR(7, X86EMUL_OPC_EXT_MASK);
/*
- * No table lookup here for now, as there's only a single
- * opcode point (0xf8) populated in map 7.
+ * No table lookup here for now, as there are only two
+ * (very similar) opcode points (0xf6, 0xf8) populated
+ * in map 7.
*/
d = DstMem | SrcImm | ModRM | Mov;
s->op_bytes = 8;
--- a/xen/arch/x86/x86_emulate/private.h
+++ b/xen/arch/x86/x86_emulate/private.h
@@ -616,6 +616,7 @@ amd_like(const struct x86_emulate_ctxt *
#define vcpu_has_avx_ifma() (ctxt->cpuid->feat.avx_ifma)
#define vcpu_has_msrlist() (ctxt->cpuid->feat.msrlist)
#define vcpu_has_movrs() (ctxt->cpuid->feat.movrs)
+#define vcpu_has_msr_imm() (ctxt->cpuid->feat.msr_imm)
#define vcpu_has_avx_vnni_int8() (ctxt->cpuid->feat.avx_vnni_int8)
#define vcpu_has_avx_ne_convert() (ctxt->cpuid->feat.avx_ne_convert)
#define vcpu_has_avx_vnni_int16() (ctxt->cpuid->feat.avx_vnni_int16)
--- a/xen/arch/x86/x86_emulate/x86_emulate.c
+++ b/xen/arch/x86/x86_emulate/x86_emulate.c
@@ -7086,6 +7086,35 @@ x86_emulate(
state->simd_size = simd_none;
break;
+ case X86EMUL_OPC_VEX_F3(7, 0xf6): /* wrmsrns r64,imm32 */
+ case X86EMUL_OPC_VEX_F2(7, 0xf6): /* rdmsr imm32,r64 */
+ generate_exception_if((!mode_64bit() || ea.type != OP_REG ||
+ (modrm_reg & 7) ||
+ vex.l || vex.w || vex.reg != 0xf),
+ X86_EXC_UD);
+ vcpu_must_have(msr_imm);
+ generate_exception_if(!mode_ring0(), X86_EXC_GP, 0);
+ if ( vex.pfx == vex_f2 )
+ {
+ /* urdmsr */
+ fail_if(!ops->read_msr);
+ if ( (rc = ops->read_msr(imm1, &msr_val, ctxt)) != X86EMUL_OKAY )
+ goto done;
+ dst.val = msr_val;
+ ASSERT(dst.type == OP_REG);
+ dst.bytes = 8;
+ }
+ else
+ {
+ /* wrmsrns */
+ fail_if(!ops->write_msr);
+ if ( (rc = ops->write_msr(imm1, dst.val, ctxt,
+ true)) != X86EMUL_OKAY )
+ goto done;
+ dst.type = OP_NONE;
+ }
+ break;
+
case X86EMUL_OPC_F3(0x0f38, 0xf8): /* enqcmds r,m512 / uwrmsr r64,r32 */
case X86EMUL_OPC_F2(0x0f38, 0xf8): /* enqcmd r,m512 / urdmsr r32,r64 */
if ( ea.type == OP_MEM )
--- a/xen/include/public/arch-x86/cpufeatureset.h
+++ b/xen/include/public/arch-x86/cpufeatureset.h
@@ -354,6 +354,7 @@ XEN_CPUFEATURE(MCDT_NO, 13*32
XEN_CPUFEATURE(UC_LOCK_DIS, 13*32+ 6) /* UC-lock disable */
/* Intel-defined CPU features, CPUID level 0x00000007:1.ecx, word 14 */
+XEN_CPUFEATURE(MSR_IMM, 14*32+ 5) /* RDMSR/WRMSRNS with immediate operand */
/* Intel-defined CPU features, CPUID level 0x00000007:1.edx, word 15 */
XEN_CPUFEATURE(AVX_VNNI_INT8, 15*32+ 4) /*A AVX-VNNI-INT8 Instructions */
--- a/xen/tools/gen-cpuid.py
+++ b/xen/tools/gen-cpuid.py
@@ -283,7 +283,7 @@ def crunch_numbers(state):
# NO_LMSL indicates the absense of Long Mode Segment Limits, which
# have been dropped in hardware.
LM: [CX16, PCID, LAHF_LM, PAGE1GB, PKU, NO_LMSL, AMX_TILE, CMPCCXADD,
- LKGS, MOVRS, MSRLIST, USER_MSR],
+ LKGS, MOVRS, MSRLIST, USER_MSR, MSR_IMM],
# AMD K6-2+ and K6-III processors shipped with 3DNow+, beyond the
# standard 3DNow in the earlier K6 processors.
^ permalink raw reply [flat|nested] 7+ messages in thread
* [PATCH v10 6/6] VMX: support MSR-IMM
2026-08-05 9:21 [PATCH v10 0/6] x86emul: misc additions (MSR accesses) Jan Beulich
` (4 preceding siblings ...)
2026-08-05 9:24 ` [PATCH v10 5/6] x86emul: support MSR-IMM instructions Jan Beulich
@ 2026-08-05 9:24 ` Jan Beulich
5 siblings, 0 replies; 7+ messages in thread
From: Jan Beulich @ 2026-08-05 9:24 UTC (permalink / raw)
To: xen-devel@lists.xenproject.org
Cc: Andrew Cooper, Teddy Astie, Roger Pau Monné
Hook up the new VM exit codes and handle guest uses of the insns.
Signed-off-by: Jan Beulich <jbeulich@suse.com>
---
v10: Check feature bit in exit handler.
v9: New.
---
The lack of an enable bit is concerning; at least for the nested case
that's a security issue afaict (when L0 isn't aware of the insns, or more
specifically the exit codes).
--- a/xen/arch/x86/cpu-policy.c
+++ b/xen/arch/x86/cpu-policy.c
@@ -834,10 +834,11 @@ static void __init calculate_hvm_max_pol
__clear_bit(X86_FEATURE_PKS, fs);
/*
- * Don't expose USER-MSR until it is known how (if at all) it is
- * virtualized on SVM.
+ * Don't expose USER-MSR and MSR-IMM until it is known how (if at all)
+ * they are virtualized on SVM.
*/
__clear_bit(X86_FEATURE_USER_MSR, fs);
+ __clear_bit(X86_FEATURE_MSR_IMM, fs);
}
if ( !cpu_has_vmx_msrlist )
--- a/xen/arch/x86/domain.c
+++ b/xen/arch/x86/domain.c
@@ -453,7 +453,7 @@ void domain_cpu_policy_changed(struct do
}
/* Nested doesn't have the necessary processing, yet. */
- if ( nestedhvm_enabled(d) && p->feat.user_msr )
+ if ( nestedhvm_enabled(d) && (p->feat.user_msr || p->feat.msr_imm) )
return /* -EINVAL */;
for_each_vcpu ( d, v )
--- a/xen/arch/x86/hvm/vmx/vmx.c
+++ b/xen/arch/x86/hvm/vmx/vmx.c
@@ -4712,6 +4712,14 @@ void asmlinkage vmx_vmexit_handler(struc
hvm_inject_hw_exception(X86_EXC_GP, 0);
break;
+ case EXIT_REASON_RDMSR_IMM:
+ /* Check the feature bit in lieu of an enable one. */
+ if ( !currd->arch.cpuid->feat.msr_imm )
+ {
+ hvm_inject_hw_exception(X86_EXC_UD, X86_EVENT_NO_EC);
+ break;
+ }
+ fallthrough;
case EXIT_REASON_URDMSR: /* NB: User-MSR bitmap was checked by the CPU. */
{
uint64_t msr_content = 0;
@@ -4721,7 +4729,7 @@ void asmlinkage vmx_vmexit_handler(struc
{
case X86EMUL_OKAY:
*decode_gpr(regs, msr_imm_gpr()) = msr_content;
- update_guest_eip(); /* Safe: URDMSR */
+ update_guest_eip(); /* Safe: URDMSR / RDMSR <imm> */
break;
case X86EMUL_EXCEPTION:
@@ -4731,6 +4739,14 @@ void asmlinkage vmx_vmexit_handler(struc
break;
}
+ case EXIT_REASON_WRMSRNS_IMM:
+ /* Check the feature bit in lieu of an enable one. */
+ if ( !currd->arch.cpuid->feat.msr_imm )
+ {
+ hvm_inject_hw_exception(X86_EXC_UD, X86_EVENT_NO_EC);
+ break;
+ }
+ fallthrough;
case EXIT_REASON_UWRMSR: /* NB: User-MSR bitmap was checked by the CPU. */
exit_qualification = vmread(EXIT_QUALIFICATION);
switch ( hvm_msr_write_intercept(exit_qualification,
@@ -4738,7 +4754,7 @@ void asmlinkage vmx_vmexit_handler(struc
true) )
{
case X86EMUL_OKAY:
- update_guest_eip(); /* Safe: UWRMSR */
+ update_guest_eip(); /* Safe: UWRMSR / WRMSRNS <imm> */
break;
case X86EMUL_EXCEPTION:
--- a/xen/arch/x86/include/asm/hvm/vmx/vmx.h
+++ b/xen/arch/x86/include/asm/hvm/vmx/vmx.h
@@ -205,6 +205,8 @@ static inline void pi_clear_sn(struct pi
#define EXIT_REASON_WRMSRLIST 79
#define EXIT_REASON_URDMSR 80
#define EXIT_REASON_UWRMSR 81
+#define EXIT_REASON_RDMSR_IMM 84
+#define EXIT_REASON_WRMSRNS_IMM 85
/* Remember to also update VMX_PERF_EXIT_REASON_SIZE! */
/*
--- a/xen/arch/x86/include/asm/perfc_defn.h
+++ b/xen/arch/x86/include/asm/perfc_defn.h
@@ -6,7 +6,7 @@ PERFCOUNTER_ARRAY(exceptions,
#ifdef CONFIG_HVM
-#define VMX_PERF_EXIT_REASON_SIZE 82
+#define VMX_PERF_EXIT_REASON_SIZE 86
#define VMEXIT_NPF_PERFC 166
#define SVM_PERF_EXIT_REASON_SIZE (VMEXIT_NPF_PERFC + 1)
PERFCOUNTER_ARRAY(vmexits, "vmexits",
--- a/xen/include/public/arch-x86/cpufeatureset.h
+++ b/xen/include/public/arch-x86/cpufeatureset.h
@@ -354,7 +354,7 @@ XEN_CPUFEATURE(MCDT_NO, 13*32
XEN_CPUFEATURE(UC_LOCK_DIS, 13*32+ 6) /* UC-lock disable */
/* Intel-defined CPU features, CPUID level 0x00000007:1.ecx, word 14 */
-XEN_CPUFEATURE(MSR_IMM, 14*32+ 5) /* RDMSR/WRMSRNS with immediate operand */
+XEN_CPUFEATURE(MSR_IMM, 14*32+ 5) /*s RDMSR/WRMSRNS with immediate operand */
/* Intel-defined CPU features, CPUID level 0x00000007:1.edx, word 15 */
XEN_CPUFEATURE(AVX_VNNI_INT8, 15*32+ 4) /*A AVX-VNNI-INT8 Instructions */
^ permalink raw reply [flat|nested] 7+ messages in thread
end of thread, other threads:[~2026-08-05 9:25 UTC | newest]
Thread overview: 7+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-08-05 9:21 [PATCH v10 0/6] x86emul: misc additions (MSR accesses) Jan Beulich
2026-08-05 9:22 ` [PATCH v10 1/6] x86emul+VMX: support {RD,WR}MSRLIST Jan Beulich
2026-08-05 9:23 ` [PATCH v10 2/6] x86emul: support USER-MSR instructions Jan Beulich
2026-08-05 9:23 ` [PATCH v10 3/6] x86/cpu-policy: re-arrange no-VMX logic Jan Beulich
2026-08-05 9:24 ` [PATCH v10 4/6] VMX: support USER-MSR Jan Beulich
2026-08-05 9:24 ` [PATCH v10 5/6] x86emul: support MSR-IMM instructions Jan Beulich
2026-08-05 9:24 ` [PATCH v10 6/6] VMX: support MSR-IMM Jan Beulich
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.