[PATCH 0/2] x86emul: XCR0 handling

[PATCH 0/2] x86emul: XCR0 handling

[Jan Beulich]

Prompted by Andrew's report [1] I thought it may help if we accelerated two
of the patches I have pending as part of the (so far unposted) APX series.
We previously discussed latching some control register state once early, so
let's start with doing so for XCR0.

[1] https://lists.xen.org/archives/html/xen-devel/2026-08/msg01006.html

1: latch XCR0 early during decode
2: use latched XCR0 in x86emul_get_fpu()

Jan

[PATCH 1/2] x86emul: latch XCR0 early during decode

[Jan Beulich]

We'll need to consult it to decide whether to treat 0xD5 as a REX2
prefix, and whether to recognize extended EVEX encodings.

Utilize this in adjust_bnd() right away, but leave leveraging in
x86emul_get_fpu() for a separate change.

Signed-off-by: Jan Beulich <jbeulich@suse.com>
---
While not directly relevant in this series, should we perhaps latch CR4
into the state structure as well right away, since we need to read it
here anyway?

--- a/xen/arch/x86/x86_emulate/decode.c
+++ b/xen/arch/x86/x86_emulate/decode.c
@@ -1036,6 +1036,24 @@ int x86emul_decode(struct x86_emulate_st
 #endif
     }
 
+    /* Latch XCR0, if available. */
+    if ( ops->read_cr && ops->read_xcr )
+    {
+        unsigned long cr4;
+
+        rc = ops->read_cr(4, &cr4, ctxt);
+        if ( rc == X86EMUL_OKAY && (cr4 & X86_CR4_OSXSAVE) &&
+             ops->read_xcr(0, &s->xcr0, ctxt) != X86EMUL_OKAY )
+            s->xcr0 = 0;
+
+        /*
+         * To ease consuming, strip 64-bit-only state right away for non-64-bit
+         * environments.
+         */
+        if ( !mode_64bit() )
+            s->xcr0 &= ~(X86_XCR0_TILE_CFG | X86_XCR0_TILE_DATA);
+    }
+
     /* Prefix bytes. */
     for ( ; ; )
     {
--- a/xen/arch/x86/x86_emulate/private.h
+++ b/xen/arch/x86/x86_emulate/private.h
@@ -334,6 +334,8 @@ struct x86_emulate_state {
 
     unsigned long ip;
 
+    uint64_t xcr0;
+
     struct stub_exn *stub_exn;
 
 #ifndef NDEBUG
--- a/xen/arch/x86/x86_emulate/x86_emulate.c
+++ b/xen/arch/x86/x86_emulate/x86_emulate.c
@@ -1234,17 +1234,17 @@ static bool is_branch_step(struct x86_em
     return debugctl & IA32_DEBUGCTLMSR_BTF;
 }
 
-static void adjust_bnd(struct x86_emulate_ctxt *ctxt,
+static void adjust_bnd(const struct x86_emulate_state *s,
+                       struct x86_emulate_ctxt *ctxt,
                        const struct x86_emulate_ops *ops, enum vex_pfx pfx)
 {
-    uint64_t xcr0, bndcfg;
+    uint64_t bndcfg;
     int rc;
 
     if ( pfx == vex_f2 || !cpu_has_mpx || !vcpu_has_mpx() )
         return;
 
-    if ( !ops->read_xcr || ops->read_xcr(0, &xcr0, ctxt) != X86EMUL_OKAY ||
-         !(xcr0 & X86_XCR0_BNDREGS) || !(xcr0 & X86_XCR0_BNDCSR) )
+    if ( !(s->xcr0 & X86_XCR0_BNDREGS) || !(s->xcr0 & X86_XCR0_BNDCSR) )
     {
         ASSERT(!ctxt->event_pending);
         return;
@@ -1952,7 +1952,7 @@ x86_emulate(
     case 0x70 ... 0x7f: /* jcc (short) */
         if ( test_cc(b, _regs.eflags) )
             jmp_rel((int32_t)src.val);
-        adjust_bnd(ctxt, ops, vex.pfx);
+        adjust_bnd(state, ctxt, ops, vex.pfx);
         break;
 
     case 0x80: case 0x81: case 0x82: case 0x83: /* Grp1 */
@@ -2363,7 +2363,7 @@ x86_emulate(
              (rc = ops->insn_fetch(dst.val, NULL, 0, ctxt)) )
             goto done;
         _regs.r(ip) = dst.val;
-        adjust_bnd(ctxt, ops, vex.pfx);
+        adjust_bnd(state, ctxt, ops, vex.pfx);
         break;
 
     case 0xc4: /* les */
@@ -2594,7 +2594,7 @@ x86_emulate(
         op_bytes = ((op_bytes == 4) && mode_64bit()) ? 8 : op_bytes;
         src.val = _regs.r(ip);
         jmp_rel(rel);
-        adjust_bnd(ctxt, ops, vex.pfx);
+        adjust_bnd(state, ctxt, ops, vex.pfx);
         goto push;
     }
 
@@ -2602,7 +2602,7 @@ x86_emulate(
     case 0xeb: /* jmp (short) */
         jmp_rel((int32_t)src.val);
         if ( !(b & 2) )
-            adjust_bnd(ctxt, ops, vex.pfx);
+            adjust_bnd(state, ctxt, ops, vex.pfx);
         break;
 
     case 0xea: /* jmp (far, absolute) */
@@ -2885,14 +2885,14 @@ x86_emulate(
                 goto done;
             _regs.r(ip) = src.val;
             src.val = dst.val;
-            adjust_bnd(ctxt, ops, vex.pfx);
+            adjust_bnd(state, ctxt, ops, vex.pfx);
             goto push;
         case 4: /* jmp (near) */
             if ( (rc = ops->insn_fetch(src.val, NULL, 0, ctxt)) )
                 goto done;
             _regs.r(ip) = src.val;
             dst.type = OP_NONE;
-            adjust_bnd(ctxt, ops, vex.pfx);
+            adjust_bnd(state, ctxt, ops, vex.pfx);
             break;
         case 3: /* call (far, absolute indirect) */
         case 5: /* jmp (far, absolute indirect) */
@@ -4981,7 +4981,7 @@ x86_emulate(
     case X86EMUL_OPC(0x0f, 0x80) ... X86EMUL_OPC(0x0f, 0x8f): /* jcc (near) */
         if ( test_cc(b, _regs.eflags) )
             jmp_rel((int32_t)src.val);
-        adjust_bnd(ctxt, ops, vex.pfx);
+        adjust_bnd(state, ctxt, ops, vex.pfx);
         break;
 
     case X86EMUL_OPC(0x0f, 0x90) ... X86EMUL_OPC(0x0f, 0x9f): /* setcc */

[PATCH 2/2] x86emul: use latched XCR0 in x86emul_get_fpu()

[Jan Beulich]

Avoid re-reading, and instead pass state into the function. For
get_fpu() to use "s" as new argument, we need a new local variable in
x86_emulate() though.

Signed-off-by: Jan Beulich <jbeulich@suse.com>
---
That new local "s" can likely be leveraged to replace explicit uses of
"state" in the function (past the point where the alias #define is).
Long term we probably want to aim at consistently using "s" everywhere
where a struct x86_emulate_state * variable/parameter is needed.
x86emul_get_fpu() isn't using "s" right away just because that would end
up inconsistent with adjacent code (put_fpu() first and foremost). I
could certainly change that.

--- a/xen/arch/x86/x86_emulate/private.h
+++ b/xen/arch/x86/x86_emulate/private.h
@@ -743,12 +743,13 @@ int x86emul_get_cpl(struct x86_emulate_c
                     const struct x86_emulate_ops *ops);
 
 int x86emul_get_fpu(enum x86_emulate_fpu_type type,
+                    const struct x86_emulate_state *state,
                     struct x86_emulate_ctxt *ctxt,
                     const struct x86_emulate_ops *ops);
 
 #define get_fpu(type)                                           \
 do {                                                            \
-    rc = x86emul_get_fpu(fpu_type = (type), ctxt, ops);         \
+    rc = x86emul_get_fpu(fpu_type = (type), s, ctxt, ops);      \
     if ( rc ) goto done;                                        \
 } while (0)
 
--- a/xen/arch/x86/x86_emulate/x86_emulate.c
+++ b/xen/arch/x86/x86_emulate/x86_emulate.c
@@ -394,36 +394,30 @@ do {
 
 int x86emul_get_fpu(
     enum x86_emulate_fpu_type type,
+    const struct x86_emulate_state *state,
     struct x86_emulate_ctxt *ctxt,
     const struct x86_emulate_ops *ops)
 {
-    uint64_t xcr0;
     int rc;
 
     fail_if(!ops->get_fpu);
     ASSERT(type != X86EMUL_FPU_none);
 
-    if ( type < X86EMUL_FPU_ymm || !ops->read_xcr ||
-         ops->read_xcr(0, &xcr0, ctxt) != X86EMUL_OKAY )
-    {
-        ASSERT(!ctxt->event_pending);
-        xcr0 = 0;
-    }
-
     switch ( type )
     {
     case X86EMUL_FPU_zmm:
-        if ( !(xcr0 & X86_XCR0_ZMM) || !(xcr0 & X86_XCR0_HI_ZMM) ||
-             !(xcr0 & X86_XCR0_OPMASK) )
+        if ( !(state->xcr0 & X86_XCR0_ZMM) ||
+             !(state->xcr0 & X86_XCR0_HI_ZMM) ||
+             !(state->xcr0 & X86_XCR0_OPMASK) )
             return X86EMUL_UNHANDLEABLE;
         /* fall through */
     case X86EMUL_FPU_ymm:
-        if ( !(xcr0 & X86_XCR0_SSE) || !(xcr0 & X86_XCR0_YMM) )
+        if ( !(state->xcr0 & X86_XCR0_SSE) || !(state->xcr0 & X86_XCR0_YMM) )
             return X86EMUL_UNHANDLEABLE;
         break;
 
     case X86EMUL_FPU_opmask:
-        if ( !(xcr0 & X86_XCR0_SSE) || !(xcr0 & X86_XCR0_OPMASK) )
+        if ( !(state->xcr0 & X86_XCR0_SSE) || !(state->xcr0 & X86_XCR0_OPMASK) )
             return X86EMUL_UNHANDLEABLE;
         break;
 
@@ -1310,7 +1304,7 @@ x86_emulate(
     /* Shadow copy of register state. Committed on successful emulation. */
     struct cpu_user_regs _regs = *ctxt->regs;
     const struct cpu_policy *__maybe_unused cp = ctxt->cpu_policy;
-    struct x86_emulate_state state;
+    struct x86_emulate_state state, *s = &state;
     int rc;
     uint8_t b, d, *opc = NULL;
     unsigned int first_byte = 0, elem_bytes, insn_bytes = 0;
@@ -1439,7 +1433,7 @@ x86_emulate(
     /* With a memory operand, fetch the mask register in use (if any). */
     if ( ea.type == OP_MEM && evex.opmsk &&
          x86emul_get_fpu(fpu_type = X86EMUL_FPU_opmask,
-                         ctxt, ops) == X86EMUL_OKAY )
+                         s, ctxt, ops) == X86EMUL_OKAY )
     {
         uint8_t *stb = get_stub(stub);