[PATCH v2] hvf: guard xgetbv call.

[PATCH v2] hvf: guard xgetbv call.

[Hill Ma]

This prevents illegal instruction on cpus do not support xgetbv.

Buglink: https://bugs.launchpad.net/qemu/+bug/1758819
Signed-off-by: Hill Ma <maahiuzeon@gmail.com>
---
 v2: xgetbv() modified based on feedback.

 target/i386/hvf/x86_cpuid.c | 28 +++++++++++++++++++---------
 1 file changed, 19 insertions(+), 9 deletions(-)

diff --git a/target/i386/hvf/x86_cpuid.c b/target/i386/hvf/x86_cpuid.c
index a6842912f5..edaa1b7da2 100644
--- a/target/i386/hvf/x86_cpuid.c
+++ b/target/i386/hvf/x86_cpuid.c
@@ -27,15 +27,22 @@
 #include "vmx.h"
 #include "sysemu/hvf.h"
 
-static uint64_t xgetbv(uint32_t xcr)
+static bool xgetbv(uint32_t cpuid_ecx, uint32_t idx, uint64_t *xcr)
 {
-    uint32_t eax, edx;
+    uint32_t xcrl, xcrh;
 
-    __asm__ volatile ("xgetbv"
-                      : "=a" (eax), "=d" (edx)
-                      : "c" (xcr));
+    if (cpuid_ecx & CPUID_EXT_OSXSAVE) {
+        /*
+         * The xgetbv instruction is not available to older versions of
+         * the assembler, so we encode the instruction manually.
+         */
+        asm(".byte 0x0f, 0x01, 0xd0" : "=a" (xcrl), "=d" (xcrh) : "c" (idx));
 
-    return (((uint64_t)edx) << 32) | eax;
+        *xcr = (((uint64_t)xcrh) << 32) | xcrl;
+        return true;
+    }
+
+    return false;
 }
 
 uint32_t hvf_get_supported_cpuid(uint32_t func, uint32_t idx,
@@ -100,11 +107,14 @@ uint32_t hvf_get_supported_cpuid(uint32_t func, uint32_t idx,
         break;
     case 0xD:
         if (idx == 0) {
-            uint64_t host_xcr0 = xgetbv(0);
-            uint64_t supp_xcr0 = host_xcr0 & (XSTATE_FP_MASK | XSTATE_SSE_MASK |
+            uint64_t supp_xcr0 = XSTATE_FP_MASK | XSTATE_SSE_MASK |
                                   XSTATE_YMM_MASK | XSTATE_BNDREGS_MASK |
                                   XSTATE_BNDCSR_MASK | XSTATE_OPMASK_MASK |
-                                  XSTATE_ZMM_Hi256_MASK | XSTATE_Hi16_ZMM_MASK);
+                                  XSTATE_ZMM_Hi256_MASK | XSTATE_Hi16_ZMM_MASK;
+            uint64_t host_xcr0;
+            if (xgetbv(ecx, 0, &host_xcr0)) {
+                supp_xcr0 &= host_xcr0;
+            }
             eax &= supp_xcr0;
         } else if (idx == 1) {
             hv_vmx_read_capability(HV_VMX_CAP_PROCBASED2, &cap);
-- 
2.20.1 (Apple Git-117)

Re: [PATCH v2] hvf: guard xgetbv call.

[Roman Bolshakov]

On Sun, Jan 10, 2021 at 01:08:54PM -0800, Hill Ma wrote:
> This prevents illegal instruction on cpus do not support xgetbv.
> 
> Buglink: https://bugs.launchpad.net/qemu/+bug/1758819
> Signed-off-by: Hill Ma <maahiuzeon@gmail.com>
> ---
>  v2: xgetbv() modified based on feedback.
> 
>  target/i386/hvf/x86_cpuid.c | 28 +++++++++++++++++++---------
>  1 file changed, 19 insertions(+), 9 deletions(-)
> 
> diff --git a/target/i386/hvf/x86_cpuid.c b/target/i386/hvf/x86_cpuid.c
> index a6842912f5..edaa1b7da2 100644
> --- a/target/i386/hvf/x86_cpuid.c
> +++ b/target/i386/hvf/x86_cpuid.c
> @@ -27,15 +27,22 @@
>  #include "vmx.h"
>  #include "sysemu/hvf.h"
>  
> -static uint64_t xgetbv(uint32_t xcr)
> +static bool xgetbv(uint32_t cpuid_ecx, uint32_t idx, uint64_t *xcr)
>  {
> -    uint32_t eax, edx;
> +    uint32_t xcrl, xcrh;
>  
> -    __asm__ volatile ("xgetbv"
> -                      : "=a" (eax), "=d" (edx)
> -                      : "c" (xcr));
> +    if (cpuid_ecx & CPUID_EXT_OSXSAVE) {
> +        /*
> +         * The xgetbv instruction is not available to older versions of
> +         * the assembler, so we encode the instruction manually.
> +         */
> +        asm(".byte 0x0f, 0x01, 0xd0" : "=a" (xcrl), "=d" (xcrh) : "c" (idx));
>  
> -    return (((uint64_t)edx) << 32) | eax;
> +        *xcr = (((uint64_t)xcrh) << 32) | xcrl;
> +        return true;
> +    }
> +
> +    return false;
>  }
>  
>  uint32_t hvf_get_supported_cpuid(uint32_t func, uint32_t idx,
> @@ -100,11 +107,14 @@ uint32_t hvf_get_supported_cpuid(uint32_t func, uint32_t idx,
>          break;
>      case 0xD:
>          if (idx == 0) {
> -            uint64_t host_xcr0 = xgetbv(0);
> -            uint64_t supp_xcr0 = host_xcr0 & (XSTATE_FP_MASK | XSTATE_SSE_MASK |
> +            uint64_t supp_xcr0 = XSTATE_FP_MASK | XSTATE_SSE_MASK |
>                                    XSTATE_YMM_MASK | XSTATE_BNDREGS_MASK |
>                                    XSTATE_BNDCSR_MASK | XSTATE_OPMASK_MASK |
> -                                  XSTATE_ZMM_Hi256_MASK | XSTATE_Hi16_ZMM_MASK);
> +                                  XSTATE_ZMM_Hi256_MASK | XSTATE_Hi16_ZMM_MASK;
> +            uint64_t host_xcr0;
> +            if (xgetbv(ecx, 0, &host_xcr0)) {
> +                supp_xcr0 &= host_xcr0;

Hi Hill,

I'm not sure if eax should be modified with mask because the mask has no
value per se. I.e. eax &= supp_xcr0 from below should be placed inside
the if. It'd express clearly that eax is not modified unless xgetbv is
supported.

Thanks,
Roman

> +            }
>              eax &= supp_xcr0;
>          } else if (idx == 1) {
>              hv_vmx_read_capability(HV_VMX_CAP_PROCBASED2, &cap);
> -- 
> 2.20.1 (Apple Git-117)
> 

Re: [PATCH v2] hvf: guard xgetbv call.

[Hill Ma]

On Sun, Jan 10, 2021 at 8:38 PM Roman Bolshakov <r.bolshakov@yadro.com> wrote:
> I'm not sure if eax should be modified with mask because the mask has no
> value per se. I.e. eax &= supp_xcr0 from below should be placed inside
> the if. It'd express clearly that eax is not modified unless xgetbv is
> supported.

Like this?

-            uint64_t host_xcr0 = xgetbv(0);
-            uint64_t supp_xcr0 = host_xcr0 & (XSTATE_FP_MASK |
XSTATE_SSE_MASK |
+            uint64_t host_xcr0;
+            if (xgetbv(ecx, 0, &host_xcr0)) {
+                uint64_t supp_xcr0 = host_xcr0 & (XSTATE_FP_MASK |
XSTATE_SSE_MASK |
                                   XSTATE_YMM_MASK | XSTATE_BNDREGS_MASK |
                                   XSTATE_BNDCSR_MASK | XSTATE_OPMASK_MASK |
                                   XSTATE_ZMM_Hi256_MASK |
XSTATE_Hi16_ZMM_MASK);
-            eax &= supp_xcr0;
+                eax &= supp_xcr0;
+            }

Re: [PATCH v2] hvf: guard xgetbv call.

[Roman Bolshakov]

On Mon, Jan 11, 2021 at 09:44:40PM -0800, Hill Ma wrote:
> On Sun, Jan 10, 2021 at 8:38 PM Roman Bolshakov <r.bolshakov@yadro.com> wrote:
> > I'm not sure if eax should be modified with mask because the mask has no
> > value per se. I.e. eax &= supp_xcr0 from below should be placed inside
> > the if. It'd express clearly that eax is not modified unless xgetbv is
> > supported.
> 
> Like this?
> 
> -            uint64_t host_xcr0 = xgetbv(0);
> -            uint64_t supp_xcr0 = host_xcr0 & (XSTATE_FP_MASK |
> XSTATE_SSE_MASK |
> +            uint64_t host_xcr0;
> +            if (xgetbv(ecx, 0, &host_xcr0)) {
> +                uint64_t supp_xcr0 = host_xcr0 & (XSTATE_FP_MASK |
> XSTATE_SSE_MASK |
>                                    XSTATE_YMM_MASK | XSTATE_BNDREGS_MASK |
>                                    XSTATE_BNDCSR_MASK | XSTATE_OPMASK_MASK |
>                                    XSTATE_ZMM_Hi256_MASK |
> XSTATE_Hi16_ZMM_MASK);
> -            eax &= supp_xcr0;
> +                eax &= supp_xcr0;
> +            }

Yes.

Thanks,
Roman