vmmon: use standard definition of CR3_PCID_MASK if available

The CR3_PCID_MASK is defined in mainline asm/processor-flags.h since
commit 6c690ee1039b ("x86/mm: Split read_cr3() into read_cr3_pa() and
__read_cr3()") in v4.13-rc1.

vmmon-only/common/cpuid.c

@@ -1,5 +1,5 @@
 /*********************************************************
- * Copyright (C) 1998, 2016-2017 VMware, Inc. All rights reserved.
+ * Copyright (C) 1998, 2016-2018 VMware, Inc. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms of the GNU General Public License as published by the
@@ -37,6 +37,7 @@
 uint32 cpuidFeatures;
 static CpuidVendor vendor = CPUID_NUM_VENDORS;
 static uint32 version;
+static Bool hasSpecCtrl;
 
 
 /*
@@ -99,6 +100,9 @@ CPUID_Init(void)
       Warning("VMMON CPUID: Unrecognized CPU\n");
       vendor = CPUID_VENDOR_UNKNOWN;
    }
+
+   __GET_CPUID2(7, 0, &regs);
+   hasSpecCtrl = vendor == CPUID_VENDOR_INTEL && ((regs.edx >> 26) & 0x3) != 0;
 }
 
 
@@ -176,3 +180,26 @@ CPUID_HostSupportsHV(void)
    return (vendor == CPUID_VENDOR_AMD   && SVM_CapableCPU()) ||
           (vendor == CPUID_VENDOR_INTEL && VT_CapableCPU());
 }
+
+
+/*
+ *-----------------------------------------------------------------------------
+ *
+ * CPUID_HostSupportsSpecCtrl --
+ *
+ *     Determine whether the processor supports MSR_SPEC_CTRL.
+ *
+ * Results:
+ *     True iff the processor supports the required features.
+ *
+ * Side effects:
+ *     None.
+ *
+ *-----------------------------------------------------------------------------
+ */
+
+Bool
+CPUID_HostSupportsSpecCtrl(void)
+{
+   return hasSpecCtrl;
+}

vmmon-only/common/cpuid.h

@@ -1,5 +1,5 @@
 /*********************************************************
- * Copyright (C) 1998, 2016-2017 VMware, Inc. All rights reserved.
+ * Copyright (C) 1998, 2016-2018 VMware, Inc. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms of the GNU General Public License as published by the
@@ -38,6 +38,7 @@ CpuidVendor CPUID_GetVendor(void);
 uint32 CPUID_GetVersion(void);
 Bool CPUID_AddressSizeSupported(void);
 Bool CPUID_HostSupportsHV(void);
+Bool CPUID_HostSupportsSpecCtrl(void);
 
 static INLINE uint32
 CPUID_GetFeatures(void)

vmmon-only/common/task.c

@@ -1,5 +1,5 @@
 /*********************************************************
- * Copyright (C) 1998-2017 VMware, Inc. All rights reserved.
+ * Copyright (C) 1998-2018 VMware, Inc. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms of the GNU General Public License as published by the
@@ -82,6 +82,9 @@
 #   define USE_TEMPORARY_GDT 0
 #endif
 
+/* Cycle through values of SPEC_CTRL and verify they survive world switch. */
+#undef CYCLE_SPEC_CTRL
+
 #define TS_ASSERT(t) do { \
    DEBUG_ONLY(if (!(t)) TaskAssertFail(__LINE__);)  \
 } while (0)
@@ -2371,6 +2374,11 @@ Task_Switch(VMDriver *vm,  // IN
    uint32 pCPU;
    MPN hvRootMPN;
    Descriptor *tempGDTBase;
+#ifdef CYCLE_SPEC_CTRL
+   Bool specCtrlEqual = FALSE;
+   uint64 readSpecCtrlValue = 0;
+   static volatile uint64 currentSpecCtrlValue = 0;
+#endif
 
    ASSERT_ON_COMPILE(sizeof(VMCrossPage) == PAGE_SIZE);
    TaskDisableNMI(&vm->hostAPIC, &lint0NMI, &lint1NMI, &pcNMI, &thermalNMI);
@@ -2588,6 +2596,14 @@ Task_Switch(VMDriver *vm,  // IN
          TS_ASSERT(SELECTOR_TABLE(ds) == SELECTOR_GDT);
          TS_ASSERT(SELECTOR_TABLE(ss) == SELECTOR_GDT);
 
+         if (CPUID_HostSupportsSpecCtrl()) {
+#ifdef CYCLE_SPEC_CTRL
+            currentSpecCtrlValue = (currentSpecCtrlValue + 1) % 4;
+            __SET_MSR(MSR_SPEC_CTRL, currentSpecCtrlValue);
+#endif
+            crosspage->crosspageData.specCtrl = __GET_MSR(MSR_SPEC_CTRL);
+         }
+
          DEBUG_ONLY(crosspage->crosspageData.tinyStack[0] = 0xDEADBEEF;)
          /* Running in host context prior to TaskSwitchToMonitor() */
          TaskSwitchToMonitor(crosspage);
@@ -2595,6 +2611,16 @@ Task_Switch(VMDriver *vm,  // IN
 
          TS_ASSERT(crosspage->crosspageData.tinyStack[0] == 0xDEADBEEF);
 
+#ifdef CYCLE_SPEC_CTRL
+         if (CPUID_HostSupportsSpecCtrl()) {
+            readSpecCtrlValue = __GET_MSR(MSR_SPEC_CTRL);
+            specCtrlEqual = readSpecCtrlValue ==
+                            crosspage->crosspageData.specCtrl;
+            /* Do not leak cycling SPEC_CTRL value back to host. */
+            __SET_MSR(MSR_SPEC_CTRL, 0);
+         }
+#endif
+
          /*
           * Temporarily disable single-step stress as VMX/VMCS change code
           * ASSERTS on RFLAGS content without allowing TF/RF to be set.
@@ -2732,6 +2758,12 @@ Task_Switch(VMDriver *vm,  // IN
          if (UNLIKELY(TaskGotException(crosspage, EXC_UD))) {
             Warning("#UD occurred on switch back to host; dumping core");
          }
+#ifdef CYCLE_SPEC_CTRL
+         if (UNLIKELY(!specCtrlEqual)) {
+            Warning("SpecCtrl not equal: expected %"FMT64"x, got %"FMT64"x\n",
+                    crosspage->crosspageData.specCtrl, readSpecCtrlValue);
+         }
+#endif
          /*
           * The NMI/MCE checks above are special cases for interrupts
           * received during worldswitch.  Here is the more generic case

vmmon-only/include/iocontrols.h

@@ -1,5 +1,5 @@
 /*********************************************************
- * Copyright (C) 1998-2017 VMware, Inc. All rights reserved.
+ * Copyright (C) 1998-2018 VMware, Inc. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms of the GNU General Public License as published by the
@@ -144,7 +144,7 @@ PtrToVA64(void const *ptr) // IN
  *
  */
 
-#define VMMON_VERSION           (329 << 16 | 0)
+#define VMMON_VERSION           (330 << 16 | 0)
 #define VMMON_VERSION_MAJOR(v)  ((uint32) (v) >> 16)
 #define VMMON_VERSION_MINOR(v)  ((uint16) (v))
 

vmmon-only/include/modulecall.h

@@ -1,5 +1,5 @@
 /*********************************************************
- * Copyright (C) 1998-2017 VMware, Inc. All rights reserved.
+ * Copyright (C) 1998-2018 VMware, Inc. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms of the GNU General Public License as published by the
@@ -374,6 +374,7 @@ struct VMCrossPageData {
 
    volatile Bool wsException[NUM_EXCEPTIONS]; // Tracks faults in worldswitch.
    uint64        wsUD2;                       // IP of ud2 instr or 0 if unset.
+   uint64        specCtrl; /* host MSR_SPEC_CTRL value before world switch. */
 }
 #include "vmware_pack_end.h"
 VMCrossPageData;
@@ -430,7 +431,7 @@ struct VMCrossPage {
 #include "vmware_pack_end.h"
 VMCrossPage;
 
-#define CROSSPAGE_VERSION_BASE 0xbfb /* increment by 1 */
+#define CROSSPAGE_VERSION_BASE 0xbfc /* increment by 1 */
 #define CROSSPAGE_VERSION    ((CROSSPAGE_VERSION_BASE << 1) + WS_INTR_STRESS)
 
 #if !defined(VMX86_SERVER) && defined(VMM)

vmmon-only/include/x86_basic_defs.h

@@ -35,6 +35,8 @@
 #define INCLUDE_ALLOW_VMCORE
 #include "includeCheck.h"
 
+#include <asm/processor-flags.h>
+
 #define X86_MAX_INSTR_LEN  15   /* Max byte length of an x86 instruction. */
 
 #define NUM_IDT_VECTORS 256
@@ -75,7 +77,9 @@
 #define CR3_PDB_MASK   0xfffff000
 #define CR3_IGNORE     0xFFF
 #define PAE_CR3_IGNORE 0x1F
+#ifndef CR3_PCID_MASK
 #define CR3_PCID_MASK  0xFFF
+#endif
 #define CR3_NO_FLUSH   (1ULL << 63)
 
 #define CR4_VME        0x00000001

vmmon-only/include/x86cpuid.h

@@ -460,6 +460,10 @@ FLAG(   6,  0, ECX,  0,  1, HW_COORD_FEEDBACK,                 NO,   0, FALSE) \
 FLAG(   6,  0, ECX,  1,  1, ACNT2,                             ANY, 13, FALSE) \
 FLAG(   6,  0, ECX,  3,  1, ENERGY_PERF_BIAS,                  NO,   0, FALSE)
 
+#define CPUID_7_EDX_26 \
+FLAG(   7,  0, EDX, 26,  1, LEVEL7EDX_RSVD1,                    NO,  0, FALSE)
+#define CPUID_7_EDX_27 \
+FLAG(   7,  0, EDX, 27,  1, LEVEL7EDX_RSVD2,                    NO,  0, FALSE)
 
 /*    LEVEL, SUB-LEVEL, REG, POS, SIZE, NAME,             MON SUPP, HWV, CPL3 */
 #define CPUID_FIELD_DATA_LEVEL_7                                               \
@@ -499,7 +503,8 @@ FLAG(   7,  0, ECX,  1,  1, AVX512VBMI,                        YES, 15, TRUE)  \
 FLAG(   7,  0, ECX,  3,  1, PKU,                               YES, 13, TRUE)  \
 FLAG(   7,  0, ECX,  4,  1, OSPKE,                             ANY, 13, TRUE)  \
 FLAG(   7,  0, ECX, 30,  1, SGX_LC,                            NO,   0, FALSE) \
-
+CPUID_7_EDX_26 \
+CPUID_7_EDX_27
 
 /*    LEVEL, SUB-LEVEL, REG, POS, SIZE, NAME,             MON SUPP, HWV, CPL3 */
 #define CPUID_FIELD_DATA_LEVEL_A                                               \
@@ -941,6 +946,9 @@ FLAG(  87,  0, EDX,  7,  1, HWPSTATE,                          NA,   0, FALSE) \
 FLAG(  87,  0, EDX,  8,  1, TSC_INVARIANT,                     NA,   0, FALSE) \
 FLAG(  87,  0, EDX,  9,  1, CORE_PERF_BOOST,                   NA,   0, FALSE)
 
+#define CPUID_88_EBX_12 \
+FLAG(  88,  0, EBX, 12,  1, LEVEL88EBX_RSVD1,                  NO,   0, FALSE)
+
 /*    LEVEL, REG, POS, SIZE, NAME,                        MON SUPP, HWV, CPL3 */
 #define CPUID_FIELD_DATA_LEVEL_88                                              \
 FIELD( 88,  0, EAX,  0,  8, PHYS_BITS,                         YES,  4, FALSE) \
@@ -949,6 +957,7 @@ FIELD( 88,  0, EAX, 16,  8, GUEST_PHYS_ADDR_SZ,                YES,  8, FALSE) \
 FLAG(  88,  0, EBX,  0,  1, CLZERO,                            YES, 14, TRUE)  \
 FLAG(  88,  0, EBX,  1,  1, IRPERF,                            NO,   0, FALSE) \
 FLAG(  88,  0, EBX,  2,  1, XSAVE_ERR_PTR,                     NO,   0, FALSE) \
+CPUID_88_EBX_12 \
 FIELD( 88,  0, ECX,  0,  8, LEAF88_CORE_COUNT,                 YES,  4, FALSE) \
 FIELD( 88,  0, ECX, 12,  4, APICID_COREID_SIZE,                YES,  7, FALSE) \
 FIELD( 88,  0, ECX, 16,  2, PERFTSC_SIZE,                      NO,   0, FALSE)

vmmon-only/include/x86msr.h

@@ -1,5 +1,5 @@
 /*********************************************************
- * Copyright (C) 1998-2017 VMware, Inc. All rights reserved.
+ * Copyright (C) 1998-2018 VMware, Inc. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms of the GNU General Public License as published by the
@@ -24,6 +24,7 @@
 
 #ifndef _X86MSR_H_
 #define _X86MSR_H_
+#include <asm/msr-index.h>
 #define INCLUDE_ALLOW_USERLEVEL
 #define INCLUDE_ALLOW_VMX
 
@@ -84,6 +85,7 @@ MSRQuery;
 #define MSR_SMI_COUNT         0x00000034 // Intel Nehalem Family
 #define MSR_FEATCTL           0x0000003a
 #define MSR_TSC_ADJUST        0x0000003b
+#define MSR_SPEC_CTRL         0x00000048
 #define MSR_BIOS_UPDT_TRIG    0x00000079
 #define MSR_BIOS_SIGN_ID      0x0000008b
 #define MSR_PERFCTR0          0x000000c1
@@ -112,7 +114,10 @@ MSRQuery;
 #define MSR_TSC_AUX           0xc0000103
 #define MSR_BD_TSC_RATIO      0xc0000104
 
+
+#ifndef MSR_MISC_FEATURES_ENABLES
 #define MSR_MISC_FEATURES_ENABLES            0x140
+#endif
 
 /* Intel Core Architecture and later: use only architected counters. */
 #define IA32_MSR_PERF_CAPABILITIES                0x345
@@ -478,6 +483,8 @@ typedef enum {
 #define MSR_VM_CR_SVME_DISABLE     0x0000000000000010ULL
 #define MSR_VM_CR_RESERVED         0xffffffffffffffe0ULL
 
+#define MSR_AMD_DE_CFG           0xc0011029  // Decode configuration
+#define MSR_AMD_DE_CFG_BIT1      (1ULL<<1)
 
 /* Syscall/Sysret related MSRs (x86_64) */
 #define MSR_STAR             0xc0000081 // Also present on Athlons.
@@ -612,7 +619,11 @@ typedef enum {
 /*
  * MISC_FEATURES_ENABLES bits
  */
+#ifdef MSR_MISC_FEATURES_ENABLES_CPUID_FAULT
+#define MSR_MISC_FEATURES_ENABLES_CPUID_FAULTING MSR_MISC_FEATURES_ENABLES_CPUID_FAULT
+#else
 #define MSR_MISC_FEATURES_ENABLES_CPUID_FAULTING 1
+#endif
 
 
 

vmmon-only/linux/driver.c

@@ -216,7 +216,7 @@ LinuxDriverEstimateTSCkHz(void)
  *----------------------------------------------------------------------
  */
 static void
-LinuxDriverEstimateTSCkHzDeferred(unsigned long data)
+LinuxDriverEstimateTSCkHzDeferred(struct timer_list *data)
 {
    LinuxDriverEstimateTSCkHz();
 }
@@ -251,9 +251,7 @@ LinuxDriverInitTSCkHz(void)
    }
 
    LinuxDriverReadTSCAndUptime(&tsckHzStartTime);
-   tscTimer.function = LinuxDriverEstimateTSCkHzDeferred;
    tscTimer.expires  = jiffies + 4 * HZ;
-   tscTimer.data     = 0;
    add_timer(&tscTimer);
 }
 
@@ -335,7 +333,13 @@ init_module(void)
        linuxState.deviceName, linuxState.major, linuxState.minor);
 
    HostIF_InitUptime();
+#if LINUX_VERSION_CODE < KERNEL_VERSION(4, 15, 0) && !defined(timer_setup)
    init_timer(&tscTimer);
+   tscTimer.function = (void *)LinuxDriverEstimateTSCkHzDeferred;
+   tscTimer.data = (unsigned long)&tscTimer;
+#else
+   timer_setup(&tscTimer, LinuxDriverEstimateTSCkHzDeferred, 0);
+#endif
    LinuxDriverInitTSCkHz();
    Vmx86_InitIDList();
 

vmmon-only/linux/hostif.c

@@ -1637,9 +1637,6 @@ HostIFReadUptimeWork(unsigned long *j)  // OUT: current jiffies
    unsigned long jifs, jifBase;
    unsigned int attempts = 0;
 
-   /* Assert that HostIF_InitUptime has been called. */
-   ASSERT(uptimeState.timer.function);
-
  retry:
    do {
       version  = VersionedAtomic_BeginTryRead(&uptimeState.version);
@@ -1705,7 +1702,7 @@ HostIFReadUptimeWork(unsigned long *j)  // OUT: current jiffies
  */
 
 static void
-HostIFUptimeResyncMono(unsigned long data)  // IN: ignored
+HostIFUptimeResyncMono(struct timer_list *timer)  // IN: ignored
 {
    unsigned long jifs;
    uintptr_t flags;
@@ -1767,8 +1764,13 @@ HostIF_InitUptime(void)
                   -(tv.tv_usec * (UPTIME_FREQ / 1000000) +
                     tv.tv_sec * UPTIME_FREQ));
 
+#if LINUX_VERSION_CODE < KERNEL_VERSION(4, 15, 0) && !defined(timer_setup)
    init_timer(&uptimeState.timer);
-   uptimeState.timer.function = HostIFUptimeResyncMono;
+   uptimeState.timer.function = (void *)HostIFUptimeResyncMono;
+   uptimeState.timer.data = (unsigned long)&uptimeState.timer;
+#else
+   timer_setup(&uptimeState.timer, HostIFUptimeResyncMono, 0);
+#endif
    mod_timer(&uptimeState.timer, jiffies + HZ);
 }
 

vmnet-only/vm_device_version.h

@@ -35,6 +35,8 @@
 #endif
 #endif
 
+#include <linux/pci_ids.h>
+
 /* LSILogic 53C1030 Parallel SCSI controller
  * LSILogic SAS1068 SAS controller
  */
@@ -53,7 +55,10 @@
  *    VMware HD Audio codec
  *    VMware HD Audio controller
  */
+#ifndef PCI_VENDOR_ID_VMWARE
 #define PCI_VENDOR_ID_VMWARE                    0x15AD
+#endif
+
 #define PCI_DEVICE_ID_VMWARE_SVGA2              0x0405
 #define PCI_DEVICE_ID_VMWARE_SVGA               0x0710
 #define PCI_DEVICE_ID_VMWARE_VGA                0x0711
@@ -70,7 +75,11 @@
 #define PCI_DEVICE_ID_VMWARE_1394               0x0780
 #define PCI_DEVICE_ID_VMWARE_BRIDGE             0x0790
 #define PCI_DEVICE_ID_VMWARE_ROOTPORT           0x07A0
+
+#ifndef PCI_DEVICE_ID_VMWARE_VMXNET3
 #define PCI_DEVICE_ID_VMWARE_VMXNET3            0x07B0
+#endif
+
 #define PCI_DEVICE_ID_VMWARE_PVSCSI             0x07C0
 #define PCI_DEVICE_ID_VMWARE_82574              0x07D0
 #define PCI_DEVICE_ID_VMWARE_AHCI               0x07E0