From: Sean Christopherson <seanjc@google.com>
To: Mathias Krause <minipli@grsecurity.net>
Cc: kvm@vger.kernel.org
Subject: Re: [kvm-unit-tests PATCH v3 3/4] x86/access: Forced emulation support
Date: Mon, 3 Apr 2023 12:06:15 -0700 [thread overview]
Message-ID: <ZCsjp0666b9DOj+n@google.com> (raw)
In-Reply-To: <dc285a74-9cce-2886-f8aa-f10e1a94f6f5@grsecurity.net>
On Mon, Apr 03, 2023, Mathias Krause wrote:
> On 03.04.23 12:56, Mathias Krause wrote:
> > Add support to enforce access tests to be handled by the emulator, if
> > supported by KVM. Exclude it from the ac_test_exec() test, though, to
> > not slow it down too much.
>
> I tend to read a lot of objdumps and when initially looking at the
> generated code it was kinda hard to recognize the FEP instruction, as
> the FEP actually decodes to UD2 followed by some IMUL instruction that
> lacks a byte, so when objdump does its linear disassembly, it eats a
> byte from the to-be-emulated instruction. Like, "FEP; int $0xc3" would
> decode to:
> 0: 0f 0b ud2
> 2: 6b 76 6d cd imul $0xffffffcd,0x6d(%rsi),%esi
> 6: c3 retq
> This is slightly confusing, especially when the shortened instruction is
> actually a valid one as above ("retq" vs "int $0xc3").
>
> I have the below diff to "fix" that. It adds 0x3e to the FEP which would
> restore objdump's ability to generate a proper disassembly that won't
> destroy the to-be-emulated instruction. As 0x3e decodes to the DS prefix
> byte, which the emulator assumes by default anyways, this should mostly
> be a no-op. However, it helped me to get a proper code dump.a
I agree that the objdump output is annoying, but I don't love the idea of cramming
in a prefix that's _mostly_ a nop.
Given that FEP utilizes extremely specialized, off-by-default KVM code, what about
reworking FEP in KVM itself to play nice with objdump (and other disasm tools)?
E.g. "officially" change the magic prefix to include a trailing 0x3e. Though IMO,
even better would be a magic value that decodes to a multi-byte nop, e.g.
0F 1F 44 00 00. The only "requirement" is that the magic value doesn't get
false positives, and I can't imagine any of our test environments generate a ud2
followed by a multi-byte nop.
Keeping KVM-Unit-Tests and KVM synchronized on the correct FEP value would be a
pain, but disconnects between KVM and KUT are nothing new.
next prev parent reply other threads:[~2023-04-03 19:06 UTC|newest]
Thread overview: 13+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-04-03 10:56 [kvm-unit-tests PATCH v3 0/4] Tests for CR0.WP=0/1 r/o write access Mathias Krause
2023-04-03 10:56 ` [kvm-unit-tests PATCH v3 1/4] x86: Use existing CR0.WP / CR4.SMEP bit definitions Mathias Krause
2023-04-03 10:56 ` [kvm-unit-tests PATCH v3 2/4] x86/access: CR0.WP toggling write to r/o data test Mathias Krause
2023-04-03 10:56 ` [kvm-unit-tests PATCH v3 3/4] x86/access: Forced emulation support Mathias Krause
2023-04-03 11:28 ` Mathias Krause
2023-04-03 19:06 ` Sean Christopherson [this message]
2023-04-03 20:06 ` Mathias Krause
2023-04-04 0:08 ` Sean Christopherson
2023-04-04 0:04 ` Sean Christopherson
2023-04-04 7:27 ` Mathias Krause
2023-04-04 16:36 ` Sean Christopherson
2023-04-05 8:01 ` Mathias Krause
2023-04-03 10:56 ` [kvm-unit-tests PATCH v3 4/4] x86/access: Try emulation for CR0.WP test as well Mathias Krause
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=ZCsjp0666b9DOj+n@google.com \
--to=seanjc@google.com \
--cc=kvm@vger.kernel.org \
--cc=minipli@grsecurity.net \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.