[xen staging] x86/emul: Emulate %cr8 accesses

[patchbot@xxxxxxx]

commit 14fd9b5642cd4805b49fbe716bf2cd577e724169
Author:     Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
AuthorDate: Mon Mar 17 17:48:51 2025 +0000
Commit:     Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
CommitDate: Wed Mar 26 11:54:59 2025 +0000

    x86/emul: Emulate %cr8 accesses
    
    Petr reports:
    
      (XEN) MMIO emulation failed (1): d12v1 64bit @ 0010:fffff8057ba7dfbf -> 
45 0f 20 c2 ...
    
    during introspection.
    
    This is MOV %cr8, which is wired up for hvm_mov_{to,from}_cr(); the VMExit
    fastpaths, but not for the full emulation slowpaths.
    
    Xen's handling of %cr8 turns out to be quite wrong.  At a minimum, we need
    storage for %cr8 separate to APIC_TPR, and to alter intercepts based on
    whether the vLAPIC is enabled or not.  But that's more work than there is 
time
    for in the short term, so make a stopgap fix.
    
    Extend hvmemul_{read,write}_cr() with %cr8 cases.  Unlike hvm_mov_to_cr(),
    hardware hasn't filtered out invalid values (#GP checks are ahead of
    intercepts), so introduce X86_CR8_VALID_MASK.
    
    Reported-by: Petr Beneš <w1benny@xxxxxxxxx>
    Signed-off-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
    Reviewed-by: Jan Beulich <jbeulich@xxxxxxxx>
---
 xen/arch/x86/hvm/emulate.c           | 15 +++++++++++++++
 xen/arch/x86/include/asm/x86-defns.h |  2 ++
 2 files changed, 17 insertions(+)

diff --git a/xen/arch/x86/hvm/emulate.c b/xen/arch/x86/hvm/emulate.c
index 7e18e70c27..04d07ccaf6 100644
--- a/xen/arch/x86/hvm/emulate.c
+++ b/xen/arch/x86/hvm/emulate.c
@@ -2288,6 +2288,10 @@ static int cf_check hvmemul_read_cr(
         val = curr->arch.hvm.guest_cr[reg];
         break;
 
+    case 8:
+        val = (vlapic_get_reg(vcpu_vlapic(curr), APIC_TASKPRI) & 0xf0) >> 4;
+        break;
+
     default:
         return X86EMUL_UNHANDLEABLE;
     }
@@ -2333,6 +2337,17 @@ static int cf_check hvmemul_write_cr(
         rc = hvm_set_cr4(val, true);
         break;
 
+    case 8:
+        if ( val & ~X86_CR8_VALID_MASK )
+        {
+            rc = X86EMUL_EXCEPTION;
+            break;
+        }
+
+        vlapic_set_reg(vcpu_vlapic(curr), APIC_TASKPRI, val << 4);
+        rc = X86EMUL_OKAY;
+        break;
+
     default:
         rc = X86EMUL_UNHANDLEABLE;
         break;
diff --git a/xen/arch/x86/include/asm/x86-defns.h 
b/xen/arch/x86/include/asm/x86-defns.h
index 61b0cea8f3..23579c471f 100644
--- a/xen/arch/x86/include/asm/x86-defns.h
+++ b/xen/arch/x86/include/asm/x86-defns.h
@@ -76,6 +76,8 @@
 #define X86_CR4_CET        0x00800000 /* Control-flow Enforcement Technology */
 #define X86_CR4_PKS        0x01000000 /* Protection Key Supervisor */
 
+#define X86_CR8_VALID_MASK 0xf
+
 /*
  * XSTATE component flags in XCR0 | MSR_XSS
  */
--
generated by git-patchbot for /home/xen/git/xen.git#staging