[vbox-dev] Virtualbox don't restore FPU segments with 32-bit guests while using xsave/xrstor

Fri May 13 13:39:54 GMT 2016

Hi Quentin, 

Please add a bit more detail... we're on a 64-bit system the whole time so that's not useful in explaining what happens. When we're running a 32-bit executable, it's executing a 32-bit FNSTENV and the segment registers should be saved. Where exactly are they lost? By the way, feel free to point to the relevant sections of the Intel SDM. 

Also, am I understanding correctly that this problem only affects Sandy Bridge and Ivy Bridge generation CPUs? Older CPUs shouldn't be affected because they have no AVX, and Haswell and later are broken by design and never save the CS/DS at all. 

Regards, 
Michal 

----- Original Message ----- 
From: qbuathier at tetrane.com 
To: vbox-dev at virtualbox.org 
Sent: Friday, May 13, 2016 2:55:20 PM GMT +01:00 Amsterdam / Berlin / Bern / Rome / Stockholm / Vienna 
Subject: Re: [vbox-dev] Virtualbox don't restore FPU segments with 32-bit guests while using xsave/xrstor 

Hi Frank, 

When we run a FPU instruction on a x86 system, FPU CS and DS are set to the same value as the CS and DS registers. This is an historical reason where FPU is an individual chip with its own registers. So, the expected behaviour of this sample is to run forever on a guest x86. 

On a x86_64 system, this is different because it removes this historical behavior and the FPU segments are always set to 0. So, if you run this sample on a x86_64 system, it's the normal behaviour to have "segs unset 1". 

The problem is that Virtualbox doesn't restore properly FPU CS and DS when it uses xsave/xrstor, but does it if it uses fxsave/fxrstor. The problem happens randomly and I think that it's cause by the switch between guest code execution and host code execution (when Virtualbox save the guest state, restore the host state and after the host code execution repeated those operations in reverse order). 

My patch fixes that problem by using the same behaviour than for fxsave / fxrstor to save CS and DS when using xsave / xrstor in that particular case. 

Regards, 

2016-05-13 14:53 GMT+02:00 quentin buathier < qbuathier at tetrane.com > : 

Hi Frank, 

When we run a FPU instruction on a x86 system, FPU CS and DS are set to the same value as the CS and DS registers. This is an historical reason where FPU is an individual chip with its own registers. So, the expected behaviour of this sample is to run forever on a guest x86. 

On a x86_64 system, this is different because it removes this historical behavior and the FPU segments are always set to 0. So, if you run this sample on a x86_64 system, it's the normal behaviour to have "segs unset 1". 

The problem is that Virtualbox doesn't restore properly FPU CS and DS when it uses xsave/xrstor, but does it if it uses fxsave/fxrstor. The problem happens randomly and I think that it's cause by the switch between guest code execution and host code execution (when Virtualbox save the guest state, restore the host state and after the host code execution repeated those operations in reverse order). 

My patch fixes that problem by using the same behaviour than for fxsave / fxrstor to save CS and DS when using xsave / xrstor in that particular case. 

Regards, 

2016-05-13 9:14 GMT+02:00 Frank Mehnert < frank.mehnert at oracle.com > : 

Hi Quentin, 

what is the expected behaviour of this sample? Should it run forever? 
Running this sample in a 32-bit guests stops with "segs unset" after 
a short time. After applying your patch and running the example in the 
guest, it runs forever. 

But: If I run this sample on the host (Linux 4.5.4), it will always 
stop with "segs unset 1" after the first turn. 

Kind regards, 

Frank 

On Thursday 12 May 2016 14:47:01 quentin buathier wrote: 
> This is a sample in C++ which reproduce the problem randomly (1 ~ 2 
> seconds). 
> On the same host / guest / cpu that my previous mail. 
> 
> 2016-05-12 12:20 GMT+02:00 quentin buathier < qbuathier at tetrane.com >: 
> > Hi Michal, 
> > 
> > I can't now give a way to reproduce the bug but I'll send an executable if 
> > I manage to reproduce the problem on something minimalist. 
> > 
> > But I can give you the context of the problem: 
> > Host OS: Debian jessie 64-bits 
> > Guest OS: Debian jessie 32-bits 
> > Processor: i7-2600 (and all i7 tested) 
> > 
> > PS: Sorry for the previous mail that was accidently sent 
> > 
> > Regards, 
> > 
> > 2016-05-12 12:18 GMT+02:00 quentin buathier < qbuathier at tetrane.com >: 
> >> Hi Michal, 
> >> 
> >> I can't now give a way to reproduce the bug. I'll send an executable if I 
> >> manage to reproduce the problem on something minimalist. 
> >> 
> >> But I can give you the context of the problem: 
> >> Host OS: Debian jessie 64-bits 
> >> 
> >> 2016-05-12 11:52 GMT+02:00 Michal Necasek < michal.necasek at oracle.com >: 
> >>> Hi Quentin, 
> >>> 
> >>> Thank you for the patch! 
> >>> 
> >>> Unfortunately (?) I can't reproduce the problem that was originally 
> >>> 
> >>> fixed. Could you please provide a bit more information? What's the host 
> >>> OS, 
> >>> guest OS, host CPU type? How to reproduce the problem? 
> >>> 
> >>> Regards, 
> >>> 
> >>> Michal 
> >>> 
> >>> On 5/12/2016 11:26 AM, quentin buathier wrote: 
> >>>> Hi, 
> >>>> 
> >>>> As I understand it, there used to be a problem with restoring the FPU 
> >>>> segments in case of a 64-bit hosts with a 32-bit guest. This issue has 
> >>>> been fixed by using the macros "SAVE_32_OR_64_FPU" and 
> >>>> "RESTORE_32_OR_64_FPU" in "src/VBox/VMM/VMMR0/CPUMR0A.asm" (when 
> >>>> Virtualbox was using fxsave and fxrstor to save and restore the FPU 
> >>>> context). 
> >>>> 
> >>>> But along with the recent support of xsave / xrstor, the bug was 
> >>>> reintroduced: if the CPU supports xsave/xrstor, Virtualbox uses these 
> >>>> instructions and the guest's FPU segments are not restored properly. 
> >>>> 
> >>>> Please find attached a possible patch to fix this issue (MIT licence). 
> >>>> 
> >>>> Regards, 
> >>>> 
> >>>> 
> >>>> _______________________________________________ 
> >>>> vbox-dev mailing list 
> >>>> vbox-dev at virtualbox.org 
> >>>> https://www.virtualbox.org/mailman/listinfo/vbox-dev 
> >>> 
> >>> _______________________________________________ 
> >>> vbox-dev mailing list 
> >>> vbox-dev at virtualbox.org 
> >>> https://www.virtualbox.org/mailman/listinfo/vbox-dev 

-- 
Dr.-Ing. Frank Mehnert | Software Development Director, VirtualBox 
ORACLE Deutschland B.V. & Co. KG | Werkstr. 24 | 71384 Weinstadt, Germany 

ORACLE Deutschland B.V. & Co. KG 
Hauptverwaltung: Riesstraße 25, D-80992 München 
Registergericht: Amtsgericht München, HRA 95603 

Komplementärin: ORACLE Deutschland Verwaltung B.V. 
Hertogswetering 163/167, 3543 AS Utrecht, Niederlande 
Handelsregister der Handelskammer Midden-Niederlande, Nr. 30143697 
Geschäftsführer: Alexander van der Ven, Jan Schultheiss, Val Maher 

_______________________________________________ 
vbox-dev mailing list 
vbox-dev at virtualbox.org 
https://www.virtualbox.org/mailman/listinfo/vbox-dev 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://www.virtualbox.org/pipermail/vbox-dev/attachments/20160513/1af37c3a/attachment.html>