From: Jon Kohler Date: Wed, 8 Oct 2025 20:25:57 +0000 (-0700) Subject: i386/kvm: Expose ARCH_CAP_FB_CLEAR when invulnerable to MDS X-Git-Tag: v10.1.2~10 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=9ca80ff5278a081f56e3fdbb058e70da3c160e42;p=thirdparty%2Fqemu.git i386/kvm: Expose ARCH_CAP_FB_CLEAR when invulnerable to MDS Newer Intel hardware (Sapphire Rapids and higher) sets multiple MDS immunity bits in MSR_IA32_ARCH_CAPABILITIES but lacks the hardware-level MSR_ARCH_CAP_FB_CLEAR (bit 17): ARCH_CAP_MDS_NO ARCH_CAP_TAA_NO ARCH_CAP_PSDP_NO ARCH_CAP_FBSDP_NO ARCH_CAP_SBDR_SSDP_NO This prevents VMs with fb-clear=on from migrating from older hardware (Cascade Lake, Ice Lake) to newer hardware, limiting live migration capabilities. Note fb-clear was first introduced in v8.1.0 [1]. Expose MSR_ARCH_CAP_FB_CLEAR for MDS-invulnerable systems to enable seamless migration between hardware generations. Note: There is no impact when a guest migrates to newer hardware as the existing bit combinations already mark the host as MMIO-immune and disable FB_CLEAR operations in the kernel (see Linux's arch_cap_mmio_immune() and vmx_update_fb_clear_dis()). See kernel side discussion for [2] for additional context. [1] 22e1094ca82 ("target/i386: add support for FB_CLEAR feature") [2] https://patchwork.kernel.org/project/kvm/patch/20250401044931.793203-1-jon@nutanix.com/ Cc: Pawan Gupta Suggested-by: Sean Christopherson Signed-off-by: Jon Kohler Link: https://lore.kernel.org/r/20251008202557.4141285-1-jon@nutanix.com Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini (cherry picked from commit 00001a22d183ce96c110690987bf9dd6a8548552) Signed-off-by: Michael Tokarev --- diff --git a/target/i386/kvm/kvm.c b/target/i386/kvm/kvm.c index 96035c27cd..7137b46be1 100644 --- a/target/i386/kvm/kvm.c +++ b/target/i386/kvm/kvm.c @@ -653,6 +653,23 @@ uint64_t kvm_arch_get_supported_msr_feature(KVMState *s, uint32_t index) must_be_one = (uint32_t)value; can_be_one = (uint32_t)(value >> 32); return can_be_one & ~must_be_one; + case MSR_IA32_ARCH_CAPABILITIES: + /* + * Special handling for fb-clear bit in ARCH_CAPABILITIES MSR. + * KVM will only report the bit if it is enabled in the host, + * but, for live migration capability purposes, we want to + * expose the bit to the guest even if it is disabled in the + * host, as long as the host itself is not vulnerable to + * the issue that the fb-clear bit is meant to mitigate. + */ + if ((value & MSR_ARCH_CAP_MDS_NO) && + (value & MSR_ARCH_CAP_TAA_NO) && + (value & MSR_ARCH_CAP_SBDR_SSDP_NO) && + (value & MSR_ARCH_CAP_FBSDP_NO) && + (value & MSR_ARCH_CAP_PSDP_NO)) { + value |= MSR_ARCH_CAP_FB_CLEAR; + } + return value; default: return value;