[PATCH] KVM: cpuid: mask more bits in leaf 0xd and subleaves

[PATCH] KVM: cpuid: mask more bits in leaf 0xd and subleaves

[Paolo Bonzini]

- EAX=0Dh, ECX=1: output registers EBX/ECX/EDX are reserved.

- EAX=0Dh, ECX>1: output register ECX is zero for all the CPUID leaves
we support, because variable "supported" comes from XCR0 and not XSS.
However, only bits above 0 are reserved.  Output register EDX is reserved.

Source: Intel Architecture Instruction Set Extensions Programming
Reference, ref. number 319433-022

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 arch/x86/kvm/cpuid.c | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/arch/x86/kvm/cpuid.c b/arch/x86/kvm/cpuid.c
index 0d919bc33b02..b1366743a728 100644
--- a/arch/x86/kvm/cpuid.c
+++ b/arch/x86/kvm/cpuid.c
@@ -470,10 +470,17 @@ static inline int __do_cpuid_ent(struct kvm_cpuid_entry2 *entry, u32 function,
 				goto out;
 
 			do_cpuid_1_ent(&entry[i], function, idx);
-			if (idx == 1)
+			if (idx == 1) {
 				entry[i].eax &= kvm_supported_word10_x86_features;
-			else if (entry[i].eax == 0 || !(supported & mask))
-				continue;
+				entry[i].ebx = 0;
+				entry[i].ecx = 0;
+			} else {
+				if (entry[i].eax == 0 || !(supported & mask))
+					continue;
+				WARN_ON_ONCE(entry[i].ecx & 1);
+				entry[i].ecx &= 1;
+			}
+			entry[i].edx = 0;
 			entry[i].flags |=
 			       KVM_CPUID_FLAG_SIGNIFCANT_INDEX;
 			++*nent;
-- 
1.8.3.1

Re: [PATCH] KVM: cpuid: mask more bits in leaf 0xd and subleaves

[Radim Krčmář]

2014-12-02 14:09+0100, Paolo Bonzini:
> - EAX=0Dh, ECX=1: output registers EBX/ECX/EDX are reserved.

(As good as reserved without XSAVES/IA32_XSS.)

> - EAX=0Dh, ECX>1: output register ECX is zero for all the CPUID leaves
> we support, because variable "supported" comes from XCR0 and not XSS.
> However, only bits above 0 are reserved.  Output register EDX is reserved.

(Yes.  Well, EDX is 0 when the sub-leaf is invalid.)

> Source: Intel Architecture Instruction Set Extensions Programming
> Reference, ref. number 319433-022
> 
> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
> --
>  arch/x86/kvm/cpuid.c | 13 ++++++++++---
>  1 file changed, 10 insertions(+), 3 deletions(-)
> 
> diff --git a/arch/x86/kvm/cpuid.c b/arch/x86/kvm/cpuid.c
> index 0d919bc33b02..b1366743a728 100644
> --- a/arch/x86/kvm/cpuid.c
> +++ b/arch/x86/kvm/cpuid.c
> @@ -470,10 +470,17 @@ static inline int __do_cpuid_ent(struct kvm_cpuid_entry2 *entry, u32 function,
>  				goto out;
>  
>  			do_cpuid_1_ent(&entry[i], function, idx);
> -			if (idx == 1)
> +			if (idx == 1) {
>  				entry[i].eax &= kvm_supported_word10_x86_features;
> -			else if (entry[i].eax == 0 || !(supported & mask))
> -				continue;
> +				entry[i].ebx = 0;
> +				entry[i].ecx = 0;
> +			} else {
> +				if (entry[i].eax == 0 || !(supported & mask))
> +					continue;
> +				WARN_ON_ONCE(entry[i].ecx & 1);
> +				entry[i].ecx &= 1;

 ECX  Bit 0 is set if the sub-leaf index, n, maps to a valid bit in the
      IA32_XSS MSR and bit 0 is clear if n maps to a valid bit in XCR0.

ECX should be set to 0 instead, we definitely don't map to a valid bit
in IA32_XSS now.
(Having only one part of cpuid ready for it is weird ...)

> +			}
> +			entry[i].edx = 0;
>  			entry[i].flags |=
>  			       KVM_CPUID_FLAG_SIGNIFCANT_INDEX;

(Unrelated, I have yet to understand how this flag translates
 * If ECX contains an invalid sub-leaf index, EAX/EBX/ECX/EDX return 0.)

>  			++*nent;

Forcing a change of the XSAVES implementation is a likely purpose of
this patch and it is correct after changing the ecx handling, so then,

Reviewed-by: Radim Krčmář <rkrcmar@redhat.com>

Re: [PATCH] KVM: cpuid: mask more bits in leaf 0xd and subleaves

[Paolo Bonzini]

On 03/12/2014 00:05, Radim Krčmář wrote:
> 2014-12-02 14:09+0100, Paolo Bonzini:
>> - EAX=0Dh, ECX=1: output registers EBX/ECX/EDX are reserved.
> 
> (As good as reserved without XSAVES/IA32_XSS.)
> 
>> - EAX=0Dh, ECX>1: output register ECX is zero for all the CPUID leaves
>> we support, because variable "supported" comes from XCR0 and not XSS.
>> However, only bits above 0 are reserved.  Output register EDX is reserved.
> 
> (Yes.  Well, EDX is 0 when the sub-leaf is invalid.)
> 
>> Source: Intel Architecture Instruction Set Extensions Programming
>> Reference, ref. number 319433-022
>>
>> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
>> --
>>  arch/x86/kvm/cpuid.c | 13 ++++++++++---
>>  1 file changed, 10 insertions(+), 3 deletions(-)
>>
>> diff --git a/arch/x86/kvm/cpuid.c b/arch/x86/kvm/cpuid.c
>> index 0d919bc33b02..b1366743a728 100644
>> --- a/arch/x86/kvm/cpuid.c
>> +++ b/arch/x86/kvm/cpuid.c
>> @@ -470,10 +470,17 @@ static inline int __do_cpuid_ent(struct kvm_cpuid_entry2 *entry, u32 function,
>>  				goto out;
>>  
>>  			do_cpuid_1_ent(&entry[i], function, idx);
>> -			if (idx == 1)
>> +			if (idx == 1) {
>>  				entry[i].eax &= kvm_supported_word10_x86_features;
>> -			else if (entry[i].eax == 0 || !(supported & mask))
>> -				continue;
>> +				entry[i].ebx = 0;
>> +				entry[i].ecx = 0;
>> +			} else {
>> +				if (entry[i].eax == 0 || !(supported & mask))
>> +					continue;
>> +				WARN_ON_ONCE(entry[i].ecx & 1);
>> +				entry[i].ecx &= 1;
> 
>  ECX  Bit 0 is set if the sub-leaf index, n, maps to a valid bit in the
>       IA32_XSS MSR and bit 0 is clear if n maps to a valid bit in XCR0.
> 
> ECX should be set to 0 instead, we definitely don't map to a valid bit
> in IA32_XSS now.

Well, there is a WARN just above. :)  But I can change it to zero instead.

> (Having only one part of cpuid ready for it is weird ...)
> 
>> +			}
>> +			entry[i].edx = 0;
>>  			entry[i].flags |=
>>  			       KVM_CPUID_FLAG_SIGNIFCANT_INDEX;
> 
> (Unrelated, I have yet to understand how this flag translates
>  * If ECX contains an invalid sub-leaf index, EAX/EBX/ECX/EDX return 0.)

If the index is invalid, entry[i].eax is zero and we do not return
anything at all.

Paolo

>>  			++*nent;
> 
> Forcing a change of the XSAVES implementation is a likely purpose of
> this patch and it is correct after changing the ecx handling, so then,
> 
> Reviewed-by: Radim Krčmář <rkrcmar@redhat.com>
> 

Re: [PATCH] KVM: cpuid: mask more bits in leaf 0xd and subleaves

[Radim Krčmář]

2014-12-03 09:04+0100, Paolo Bonzini:
> On 03/12/2014 00:05, Radim Krčmář wrote:
> > 2014-12-02 14:09+0100, Paolo Bonzini:
> >> +			} else {
> >> +				if (entry[i].eax == 0 || !(supported & mask))
> >> +					continue;
> >> +				WARN_ON_ONCE(entry[i].ecx & 1);
> >> +				entry[i].ecx &= 1;
> > 
> >  ECX  Bit 0 is set if the sub-leaf index, n, maps to a valid bit in the
> >       IA32_XSS MSR and bit 0 is clear if n maps to a valid bit in XCR0.
> > 
> > ECX should be set to 0 instead, we definitely don't map to a valid bit
> > in IA32_XSS now.
> 
> Well, there is a WARN just above. :)  But I can change it to zero instead.

Yeah, I wasn't sure about the WARN ... I can only see it trigger after
host xcr0 changes and we are much more screwed in that case anyway :)
(But it has a chance of catching a bug, so it isn't only bad.)

The guest expects 0 here, so I'd rather have it ...

> > (Having only one part of cpuid ready for it is weird ...)
> > 
> >> +			}
> >> +			entry[i].edx = 0;
> >>  			entry[i].flags |=
> >>  			       KVM_CPUID_FLAG_SIGNIFCANT_INDEX;
> > 
> > (Unrelated, I have yet to understand how this flag translates
> >  * If ECX contains an invalid sub-leaf index, EAX/EBX/ECX/EDX return 0.)
> 
> If the index is invalid, entry[i].eax is zero and we do not return
> anything at all.

I see, the field is sparse and "++*nent; ++i;", not the flag, does it,
thanks.

Re: [PATCH] KVM: cpuid: mask more bits in leaf 0xd and subleaves

[Paolo Bonzini]

On 03/12/2014 13:07, Radim Krčmář wrote:
>> > Well, there is a WARN just above. :)  But I can change it to zero instead.
> Yeah, I wasn't sure about the WARN ... I can only see it trigger after
> host xcr0 changes and we are much more screwed in that case anyway :)
> (But it has a chance of catching a bug, so it isn't only bad.)
> 
> The guest expects 0 here, so I'd rather have it ...

Ok, I'll have

		if (WARN_ON_ONCE(entry[i].ecx & 1))
			continue;
	}
	entry[i].ecx = 0;
	entry[i].edx = 0;
	...

Thanks for the review!

Paolo