Module xstate_probe 

The startup qualification of --cpu-profile x86-64-v3 (https://github.com/rrnewton/hermit/issues/4243).

Under v3 a guest may execute XSAVE. The XSTATE_BV bits a plain XSAVE writes come from the processor’s in-use tracking (XINUSE), which Hermit cannot trap on the ptrace backend. The host kernel saves and restores a task’s registers at moments Hermit does not control. If such a save and restore changed a bit the guest can read, a guest’s output would depend on host timing.

This probe checks, for a fixed set of cases, that it does not. Each case dirties every register of every enabled component, brings some components to their initial state by one path, and then runs plain XSAVE three ways:

• reference: directly, with a certificate that nothing reloaded the registers in between (no context switch or fault, by getrusage; no interrupt, by the per-thread PMU counter in irq_counter);
• reload: after a handoff to a peer thread on the same CPU, so the kernel saves this thread’s state, runs the peer’s, and restores ours, with exactly two new timeslices on the CPU (the peer’s, then ours);
• forced exit (under a hypervisor): after CPUID, which exits to it.

The arms must write identical save images (all of it, not only the header) and the same PKRU, and every repetition must agree. Anything inconclusive refuses. The probe samples a fixed set of paths; it cannot exclude a CPU or hypervisor that behaves differently only on others, and that limit is stated wherever v3 is offered.

Modules

asm

The probe’s measured windows, written in assembly (https://github.com/rrnewton/hermit/issues/4243).

irq_counter

A per-thread count of the interrupts the probe thread takes, from the core PMU (https://github.com/rrnewton/hermit/issues/4243), condition C11).

Structs

Case

One probe case: its initializing step, the components it brings to their initial state, and the components it leaves live (both as XCR0 bit masks).

Layout

Where each component lives in a standard-format save area (CPUID 0xD).

ProbeOptions

How the probe is run.

ProbeReport

What the probe found, bound into a run’s manifest and printed on request.

Constants

COVERED_XCR0

The XCR0 components the probe covers: x87, SSE, AVX, opmask, ZMM_Hi256, Hi16_ZMM and PKRU.

MAX_REPETITIONS

The most repetitions accepted, checked before any narrowing.

MIN_REPETITIONS

The fewest repetitions per cell (the design’s retained minimum).

MXCSR_VALUES

The MXCSR values each case runs under: the default, and a legal non-default value (the SSE header bit is forced by the kernel’s XSAVES when MXCSR is not the default).

Functions

case_list

The closed case list for an admitted XCR0 (condition C6): every case whose instructions and components exist on it.

check_xcr0

The admitted component sets: x87, SSE and AVX are required by v3; the three AVX-512 components come together or not at all; PKRU is optional. Any other bit refuses, over all 64 bits.

expected_case_count

The number of cases case_list must produce for xcr0, derived independently of it (gate 5).

parse_schedstat_timeslices

Parses a /proc/schedstat version 15-17 text for cpu’s timeslice count: the ninth field of its cpuN line, which sched_info_switch advances for each task that starts running there (the idle task excluded).

pkru_usable

Whether the probe may run RDPKRU and WRPKRU: exactly when XCR0 enables the PKRU component and the kernel enables protection keys (CPUID.7.0:ECX.OSPKE, from CR4.PKE); either instruction raises #UD without the latter. A host whose XCR0 has PKRU but whose kernel does not enable it is refused, since the PKRU cases could not run there.

qualify

Runs the qualification on a new thread pinned to an idle, low-numbered CPU. Returns the report, or the reason v3 cannot be offered on this host.

Type Aliases

ProbeRefusal

Why the host cannot use the v3 profile, as one sentence for the refusal.