Support the tpause instruction.

Fixes #4074

Author: khuey

CMakeLists.txt

@@ -1456,6 +1456,7 @@ set(BASIC_TESTS
   timer
   timerfd
   times
+  x86/tpause
   truncate_temp
   tty_tostop
   tun

src/Registers.h

@@ -22,6 +22,7 @@ namespace rr {
 
 class ReplayTask;
 
+const uintptr_t X86_CF_FLAG = 1 << 0;
 const uintptr_t X86_RESERVED_FLAG = 1 << 1;
 const uintptr_t X86_ZF_FLAG = 1 << 6;
 const uintptr_t X86_TF_FLAG = 1 << 8;
@@ -30,6 +31,8 @@ const uintptr_t X86_DF_FLAG = 1 << 10;
 const uintptr_t X86_RF_FLAG = 1 << 16;
 const uintptr_t X86_ID_FLAG = 1 << 21;
 
+const uintptr_t X86_ALL_ARITH_FLAGS = 0x8D5;
+
 const uintptr_t AARCH64_DBG_SPSR_SS = 1 << 21;
 const uintptr_t AARCH64_DBG_SPSR_11 = 1 << 11;
 

src/record_signal.cc

@@ -85,6 +85,8 @@ static bool try_handle_trapped_instruction(RecordTask* t, siginfo_t* si) {
     case SpecialInstOpcode::ARM_MRS_CNTVCTSS_EL0:
     case SpecialInstOpcode::X86_RDTSC:
     case SpecialInstOpcode::X86_RDTSCP:
+    case SpecialInstOpcode::X86_TPAUSE:
+    case SpecialInstOpcode::X86_TPAUSE_REX:
       if (t->tsc_mode == PR_TSC_SIGSEGV) {
         return false;
       }
@@ -136,6 +138,34 @@ static bool try_handle_trapped_instruction(RecordTask* t, siginfo_t* si) {
     r.set_cpuid_output(cpuid_data.eax, cpuid_data.ebx, cpuid_data.ecx,
                        cpuid_data.edx);
     LOG(debug) << " trapped for cpuid: " << HEX(eax) << ":" << HEX(ecx);
+  } else if (special_instruction.opcode == SpecialInstOpcode::X86_TPAUSE ||
+             special_instruction.opcode == SpecialInstOpcode::X86_TPAUSE_REX) {
+    // The Intel SDM states:
+    //
+    // > Prior to executing the TPAUSE instruction, an operating system may
+    // > specify the maximum delay it allows the processor to suspend its
+    // > operation. It can do so by writing TSC-quanta value to the following
+    // > 32-bit MSR (IA32_UMWAIT_CONTROL at MSR index E1H):
+    // >
+    // > - IA32_UMWAIT_CONTROL[31:2] — Determines the maximum time in TSC-quanta
+    // >   that the processor can reside in either C0.1 or C0.2. A zero value
+    // >   indicates no maximum time. The maximum time value is a 32-bit value
+    // >   where the upper 30 bits come from this field and the lower two bits are zero.
+    // > - IA32_UMWAIT_CONTROL[1] — Reserved.
+    // > - IA32_UMWAIT_CONTROL[0] — C0.2 is not allowed by the OS. Value of “1”
+    // >   means all C0.2 requests revert to C0.1.
+    // >
+    // > If the processor that executed a TPAUSE instruction wakes due to the
+    // > expiration of the operating system time-limit, the instructions sets
+    // > RFLAGS.CF; otherwise, that flag is cleared.
+    //
+    // As the "operating system", we choose a time-limit of zero. The point of
+    // TPAUSE is to make spin-wait loops more efficient without yielding to the
+    // operating system scheduler and triggering a full context switch. But
+    // because we serialize all execution to a single physical core, no progress
+    // will ever be made without yielding, and of course we've already paid the
+    // cost of a context switch and then some.
+    r.set_flags((r.flags() & ~X86_ALL_ARITH_FLAGS) | X86_CF_FLAG);
   }
 
   r.set_ip(r.ip() + len);

src/test/x86/tpause.c

@@ -0,0 +1,66 @@
+/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */
+
+#include "util.h"
+
+enum cpuid_requests {
+  CPUID_GETEXTENDEDFEATURES = 0x07,
+};
+
+static void cpuid(int code, int subrequest, unsigned int* a, unsigned int* c,
+                  unsigned int* d) {
+  asm volatile("cpuid"
+               : "=a"(*a), "=c"(*c), "=d"(*d)
+               : "a"(code), "c"(subrequest)
+               : "ebx");
+}
+
+int main(void) {
+  uint32_t eax, ecx, edx, state = 0;
+#ifdef __x86_64__
+  register uint32_t r15d __asm__("r15") = state;
+#endif
+  uint64_t tsc;
+
+  cpuid(CPUID_GETEXTENDEDFEATURES, 0, &eax, &ecx, &edx);
+  if (!(ecx & (1 << 5))) {
+    // WAITPKG not present.
+    atomic_puts("tpause not supported on this system, skipping");
+    atomic_puts("EXIT-SUCCESS");
+    return 0;
+  }
+
+  tsc = __rdtsc() + 1000;
+  eax = tsc;
+  edx = tsc >> 32;
+
+  asm volatile(
+    ".byte 0x66, 0x0f, 0xae, 0xf7;"  // tpause %edi
+    "lahf;"
+    : "+a"(eax), "+d"(edx)
+    : "D"(state)
+    : "cc", "memory");
+
+  // All the arith flags should be cleared except CF, which should be set.
+  test_assert((uint8_t)(eax >> 8) == 0x3);
+
+#ifdef __x86_64__
+  tsc = __rdtsc() + 1000;
+  eax = tsc;
+  edx = tsc >> 32;
+
+  // Test tpause with a REX prefix since the instruction length
+  // is different.
+  asm volatile(
+    ".byte 0x66, 0x41, 0x0f, 0xae, 0xf7;"  // tpause %r15d
+    "lahf;"
+    : "+a"(eax), "+d"(edx)
+    : "r"(r15d)
+    : "cc", "memory");
+
+  // All the arith flags should be cleared except CF, which should be set.
+  test_assert((uint8_t)(eax >> 8) == 0x3);
+#endif
+
+  atomic_puts("EXIT-SUCCESS");
+  return 0;
+}

src/util.cc

@@ -1925,6 +1925,8 @@ vector<string> current_env() {
 const uint8_t rdtsc_insn[2] = { 0x0f, 0x31 };
 
 static const uint8_t rdtscp_insn[] = { 0x0f, 0x01, 0xf9 };
+static const uint8_t tpause_insn[] = { 0x66, 0x0f, 0xae, 0xf0 };
+static const uint8_t tpause_rex_insn[] = { 0x66, 0x41, 0x0f, 0xae, 0xf0 };
 static const uint8_t cpuid_insn[] = { 0x0f, 0xa2 };
 static const uint8_t int3_insn[] = { 0xcc };
 static const uint8_t pushf_insn[] = { 0x9c };
@@ -1933,7 +1935,7 @@ static const uint8_t pushf16_insn[] = { 0x66, 0x9c };
 // XXX this probably needs to be extended to decode ignored prefixes
 SpecialInst special_instruction_at(Task* t, remote_code_ptr ip) {
   if (is_x86ish(t->arch())) {
-    uint8_t insn[sizeof(rdtscp_insn)];
+    uint8_t insn[sizeof(tpause_rex_insn)];
     ssize_t ret =
         t->read_bytes_fallible(ip.to_data_ptr<uint8_t>(), sizeof(insn), insn);
     if (ret < 0) {
@@ -1964,6 +1966,21 @@ SpecialInst special_instruction_at(Task* t, remote_code_ptr ip) {
         !memcmp(insn, pushf16_insn, sizeof(pushf16_insn))) {
       return {SpecialInstOpcode::X86_PUSHF16};
     }
+    // NB: These need to be last because they're destructive!
+    if (len >= sizeof(tpause_rex_insn)) {
+      // Mask off the register selector.
+      insn[4] &= ~0x07;
+      if (!memcmp(insn, tpause_rex_insn, sizeof(tpause_rex_insn))) {
+        return {SpecialInstOpcode::X86_TPAUSE_REX};
+      }
+    }
+    if (len >= sizeof(tpause_insn)) {
+      // Mask off the register selector.
+      insn[3] &= ~0x07;
+      if (!memcmp(insn, tpause_insn, sizeof(tpause_insn))) {
+        return {SpecialInstOpcode::X86_TPAUSE};
+      }
+    }
   } else if (t->arch() == aarch64) {
     uint8_t insn[4];
     ssize_t ret =
@@ -1999,6 +2016,10 @@ size_t special_instruction_len(SpecialInstOpcode insn) {
     return sizeof(pushf_insn);
   } else if (insn == SpecialInstOpcode::X86_PUSHF16) {
     return sizeof(pushf16_insn);
+  } else if (insn == SpecialInstOpcode::X86_TPAUSE) {
+    return sizeof(tpause_insn);
+  } else if (insn == SpecialInstOpcode::X86_TPAUSE_REX) {
+    return sizeof(tpause_rex_insn);
   } else if (insn == SpecialInstOpcode::ARM_MRS_CNTFRQ_EL0 ||
              insn == SpecialInstOpcode::ARM_MRS_CNTVCT_EL0 ||
              insn == SpecialInstOpcode::ARM_MRS_CNTVCTSS_EL0) {

src/util.h

@@ -493,6 +493,8 @@ enum class SpecialInstOpcode {
   X86_INT3,
   X86_PUSHF,
   X86_PUSHF16,
+  X86_TPAUSE,
+  X86_TPAUSE_REX,
 };
 
 struct SpecialInst {