From mboxrd@z Thu Jan 1 00:00:00 1970 From: Gleb Natapov Subject: Re: [PATCH 2/2] kvm-unit-tests: Change two cases to use trap_emulator Date: Thu, 20 Jun 2013 15:33:13 +0300 Message-ID: <20130620123313.GK5832@redhat.com> References: <1371725122-6111-1-git-send-email-yzt356@gmail.com> <1371725122-6111-2-git-send-email-yzt356@gmail.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Cc: kvm@vger.kernel.org, pbonzini@redhat.com, jan.kiszka@web.de To: Arthur Chunqi Li Return-path: Received: from mx1.redhat.com ([209.132.183.28]:39414 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S965031Ab3FTMdR (ORCPT ); Thu, 20 Jun 2013 08:33:17 -0400 Content-Disposition: inline In-Reply-To: <1371725122-6111-2-git-send-email-yzt356@gmail.com> Sender: kvm-owner@vger.kernel.org List-ID: On Thu, Jun 20, 2013 at 06:45:22PM +0800, Arthur Chunqi Li wrote: > Change two functions (test_mmx_movq_mf and test_movabs) using > unified trap_emulator. > > Signed-off-by: Arthur Chunqi Li > --- > x86/emulator.c | 70 ++++++++++++-------------------------------------------- > 1 file changed, 15 insertions(+), 55 deletions(-) > > diff --git a/x86/emulator.c b/x86/emulator.c > index b3626fa..16d63e0 100644 > --- a/x86/emulator.c > +++ b/x86/emulator.c > @@ -772,38 +772,19 @@ static void advance_rip_by_3_and_note_exception(struct ex_regs *regs) > static void test_mmx_movq_mf(uint64_t *mem, uint8_t *insn_page, > uint8_t *alt_insn_page, void *insn_ram) > { > - uint16_t fcw = 0; // all exceptions unmasked > - ulong *cr3 = (ulong *)read_cr3(); > - > - write_cr0(read_cr0() & ~6); // TS, EM > - // Place a trapping instruction in the page to trigger a VMEXIT > - insn_page[0] = 0x89; // mov %eax, (%rax) > - insn_page[1] = 0x00; > - insn_page[2] = 0x90; // nop > - insn_page[3] = 0xc3; // ret > - // Place the instruction we want the hypervisor to see in the alternate page > - alt_insn_page[0] = 0x0f; // movq %mm0, (%rax) > - alt_insn_page[1] = 0x7f; > - alt_insn_page[2] = 0x00; > - alt_insn_page[3] = 0xc3; // ret > + uint16_t fcw = 0; /* all exceptions unmasked */ > + u8 alt_insn[] = {0x0f, 0x7f, 0x00}; /* movq %mm0, (%rax) */ Lets introduce something akin to MK_INSN in x86/realmode.c. > + void *stack = alloc_page(); > > + write_cr0(read_cr0() & ~6); /* TS, EM */ > exceptions = 0; > handle_exception(MF_VECTOR, advance_rip_by_3_and_note_exception); > - > - // Load the code TLB with insn_page, but point the page tables at > - // alt_insn_page (and keep the data TLB clear, for AMD decode assist). > - // This will make the CPU trap on the insn_page instruction but the > - // hypervisor will see alt_insn_page. > - install_page(cr3, virt_to_phys(insn_page), insn_ram); > asm volatile("fninit; fldcw %0" : : "m"(fcw)); > - asm volatile("fldz; fldz; fdivp"); // generate exception > - invlpg(insn_ram); > - // Load code TLB > - asm volatile("call *%0" : : "r"(insn_ram + 3)); > - install_page(cr3, virt_to_phys(alt_insn_page), insn_ram); > - // Trap, let hypervisor emulate at alt_insn_page > - asm volatile("call *%0" : : "r"(insn_ram), "a"(mem)); > - // exit MMX mode > + asm volatile("fldz; fldz; fdivp"); /* generate exception */ > + > + inregs = (struct regs){ .rsp=(u64)stack+1024 }; > + trap_emulator(mem, alt_insn, 3); > + /* exit MMX mode */ > asm volatile("fnclex; emms"); > report("movq mmx generates #MF", exceptions == 1); > handle_exception(MF_VECTOR, 0); > @@ -812,33 +793,12 @@ static void test_mmx_movq_mf(uint64_t *mem, uint8_t *insn_page, > static void test_movabs(uint64_t *mem, uint8_t *insn_page, > uint8_t *alt_insn_page, void *insn_ram) > { > - uint64_t val = 0; > - ulong *cr3 = (ulong *)read_cr3(); > - > - // Pad with RET instructions > - memset(insn_page, 0xc3, 4096); > - memset(alt_insn_page, 0xc3, 4096); > - // Place a trapping instruction in the page to trigger a VMEXIT > - insn_page[0] = 0x89; // mov %eax, (%rax) > - insn_page[1] = 0x00; > - // Place the instruction we want the hypervisor to see in the alternate > - // page. A buggy hypervisor will fetch a 32-bit immediate and return > - // 0xffffffffc3c3c3c3. > - alt_insn_page[0] = 0x48; // mov $0xc3c3c3c3c3c3c3c3, %rcx > - alt_insn_page[1] = 0xb9; > - > - // Load the code TLB with insn_page, but point the page tables at > - // alt_insn_page (and keep the data TLB clear, for AMD decode assist). > - // This will make the CPU trap on the insn_page instruction but the > - // hypervisor will see alt_insn_page. > - install_page(cr3, virt_to_phys(insn_page), insn_ram); > - // Load code TLB > - invlpg(insn_ram); > - asm volatile("call *%0" : : "r"(insn_ram + 3)); > - // Trap, let hypervisor emulate at alt_insn_page > - install_page(cr3, virt_to_phys(alt_insn_page), insn_ram); > - asm volatile("call *%1" : "=c"(val) : "r"(insn_ram), "a"(mem), "c"(0)); > - report("64-bit mov imm", val == 0xc3c3c3c3c3c3c3c3); > + /* mov $0x9090909090909090, %rcx */ > + uint8_t alt_insn[] = {0x48, 0xb9, 0x90, 0x90, 0x90, > + 0x90, 0x90, 0x90, 0x90, 0x90}; > + inregs = (struct regs){ 0 }; > + trap_emulator(mem, alt_insn, 10); > + report("64-bit mov imm2", outregs.rcx == 0x9090909090909090); > } > > static void test_crosspage_mmio(volatile uint8_t *mem) > -- > 1.7.9.5 -- Gleb.