* [PATCH 2/2] kvm-unit-tests: Change two cases to use trap_emulator
2013-06-06 15:24 [PATCH 1/2] kvm-unit-tests: Add a func to run instruction in emulator Arthur Chunqi Li
@ 2013-06-06 15:24 ` Arthur Chunqi Li
2013-06-12 20:51 ` Paolo Bonzini
0 siblings, 1 reply; 20+ messages in thread
From: Arthur Chunqi Li @ 2013-06-06 15:24 UTC (permalink / raw)
To: kvm; +Cc: gleb, pbonzini, Arthur Chunqi Li
Change two functions (test_mmx_movq_mf and test_movabs) using
unified trap_emulator.
Signed-off-by: Arthur Chunqi Li <yzt356@gmail.com>
---
x86/emulator.c | 66 ++++++++++++--------------------------------------------
1 file changed, 14 insertions(+), 52 deletions(-)
diff --git a/x86/emulator.c b/x86/emulator.c
index 8ab9904..fa8993f 100644
--- a/x86/emulator.c
+++ b/x86/emulator.c
@@ -776,72 +776,34 @@ static void test_mmx_movq_mf(uint64_t *mem, uint8_t *insn_page,
uint8_t *alt_insn_page, void *insn_ram)
{
uint16_t fcw = 0; // all exceptions unmasked
- ulong *cr3 = (ulong *)read_cr3();
+ uint8_t alt_insn[] = {0x0f, 0x7f, 0x00}; // movq %mm0, (%rax)
write_cr0(read_cr0() & ~6); // TS, EM
- // Place a trapping instruction in the page to trigger a VMEXIT
- insn_page[0] = 0x89; // mov %eax, (%rax)
- insn_page[1] = 0x00;
- insn_page[2] = 0x90; // nop
- insn_page[3] = 0xc3; // ret
- // Place the instruction we want the hypervisor to see in the alternate page
- alt_insn_page[0] = 0x0f; // movq %mm0, (%rax)
- alt_insn_page[1] = 0x7f;
- alt_insn_page[2] = 0x00;
- alt_insn_page[3] = 0xc3; // ret
-
exceptions = 0;
handle_exception(MF_VECTOR, advance_rip_by_3_and_note_exception);
-
- // Load the code TLB with insn_page, but point the page tables at
- // alt_insn_page (and keep the data TLB clear, for AMD decode assist).
- // This will make the CPU trap on the insn_page instruction but the
- // hypervisor will see alt_insn_page.
- install_page(cr3, virt_to_phys(insn_page), insn_ram);
asm volatile("fninit; fldcw %0" : : "m"(fcw));
asm volatile("fldz; fldz; fdivp"); // generate exception
- invlpg(insn_ram);
- // Load code TLB
- asm volatile("call *%0" : : "r"(insn_ram + 3));
- install_page(cr3, virt_to_phys(alt_insn_page), insn_ram);
- // Trap, let hypervisor emulate at alt_insn_page
- asm volatile("call *%0" : : "r"(insn_ram), "a"(mem));
+
+ inregs = (struct regs){ 0 };
+ trap_emulator(mem, insn_page, alt_insn_page, insn_ram,
+ alt_insn, 3);
// exit MMX mode
asm volatile("fnclex; emms");
- report("movq mmx generates #MF", exceptions == 1);
+ report("movq mmx generates #MF2", exceptions == 1);
handle_exception(MF_VECTOR, 0);
}
static void test_movabs(uint64_t *mem, uint8_t *insn_page,
uint8_t *alt_insn_page, void *insn_ram)
{
- uint64_t val = 0;
- ulong *cr3 = (ulong *)read_cr3();
-
- // Pad with RET instructions
- memset(insn_page, 0xc3, 4096);
- memset(alt_insn_page, 0xc3, 4096);
- // Place a trapping instruction in the page to trigger a VMEXIT
- insn_page[0] = 0x89; // mov %eax, (%rax)
- insn_page[1] = 0x00;
- // Place the instruction we want the hypervisor to see in the alternate
- // page. A buggy hypervisor will fetch a 32-bit immediate and return
- // 0xffffffffc3c3c3c3.
- alt_insn_page[0] = 0x48; // mov $0xc3c3c3c3c3c3c3c3, %rcx
- alt_insn_page[1] = 0xb9;
-
- // Load the code TLB with insn_page, but point the page tables at
- // alt_insn_page (and keep the data TLB clear, for AMD decode assist).
- // This will make the CPU trap on the insn_page instruction but the
- // hypervisor will see alt_insn_page.
- install_page(cr3, virt_to_phys(insn_page), insn_ram);
- // Load code TLB
- invlpg(insn_ram);
- asm volatile("call *%0" : : "r"(insn_ram + 3));
- // Trap, let hypervisor emulate at alt_insn_page
- install_page(cr3, virt_to_phys(alt_insn_page), insn_ram);
- asm volatile("call *%1" : "=c"(val) : "r"(insn_ram), "a"(mem), "c"(0));
- report("64-bit mov imm", val == 0xc3c3c3c3c3c3c3c3);
+ // mov $0xc3c3c3c3c3c3c3c3, %rcx
+ uint8_t alt_insn[] = {0x48, 0xb9, 0xc3, 0xc3, 0xc3,
+ 0xc3, 0xc3, 0xc3, 0xc3, 0xc3};
+ inregs = (struct regs){ .rcx = 0 };
+
+ trap_emulator(mem, insn_page, alt_insn_page, insn_ram,
+ alt_insn, 10);
+ report("64-bit mov imm2", outregs.rcx == 0xc3c3c3c3c3c3c3c3);
}
static void test_crosspage_mmio(volatile uint8_t *mem)
--
1.7.9.5
^ permalink raw reply related [flat|nested] 20+ messages in thread
* [PATCH 2/2] kvm-unit-tests: Change two cases to use trap_emulator
2013-06-07 2:31 [PATCH 1/2] kvm-unit-tests: Add a func to run instruction in emulator Arthur Chunqi Li
@ 2013-06-07 2:31 ` Arthur Chunqi Li
0 siblings, 0 replies; 20+ messages in thread
From: Arthur Chunqi Li @ 2013-06-07 2:31 UTC (permalink / raw)
To: kvm; +Cc: gleb, pbonzini, Arthur Chunqi Li
Change two functions (test_mmx_movq_mf and test_movabs) using
unified trap_emulator.
Signed-off-by: Arthur Chunqi Li <yzt356@gmail.com>
---
x86/emulator.c | 66 ++++++++++++--------------------------------------------
1 file changed, 14 insertions(+), 52 deletions(-)
diff --git a/x86/emulator.c b/x86/emulator.c
index 770e8f7..f8a204e 100755
--- a/x86/emulator.c
+++ b/x86/emulator.c
@@ -762,72 +762,34 @@ static void test_mmx_movq_mf(uint64_t *mem, uint8_t *insn_page,
uint8_t *alt_insn_page, void *insn_ram)
{
uint16_t fcw = 0; // all exceptions unmasked
- ulong *cr3 = (ulong *)read_cr3();
+ uint8_t alt_insn[] = {0x0f, 0x7f, 0x00}; // movq %mm0, (%rax)
write_cr0(read_cr0() & ~6); // TS, EM
- // Place a trapping instruction in the page to trigger a VMEXIT
- insn_page[0] = 0x89; // mov %eax, (%rax)
- insn_page[1] = 0x00;
- insn_page[2] = 0x90; // nop
- insn_page[3] = 0xc3; // ret
- // Place the instruction we want the hypervisor to see in the alternate page
- alt_insn_page[0] = 0x0f; // movq %mm0, (%rax)
- alt_insn_page[1] = 0x7f;
- alt_insn_page[2] = 0x00;
- alt_insn_page[3] = 0xc3; // ret
-
exceptions = 0;
handle_exception(MF_VECTOR, advance_rip_by_3_and_note_exception);
-
- // Load the code TLB with insn_page, but point the page tables at
- // alt_insn_page (and keep the data TLB clear, for AMD decode assist).
- // This will make the CPU trap on the insn_page instruction but the
- // hypervisor will see alt_insn_page.
- install_page(cr3, virt_to_phys(insn_page), insn_ram);
asm volatile("fninit; fldcw %0" : : "m"(fcw));
asm volatile("fldz; fldz; fdivp"); // generate exception
- invlpg(insn_ram);
- // Load code TLB
- asm volatile("call *%0" : : "r"(insn_ram + 3));
- install_page(cr3, virt_to_phys(alt_insn_page), insn_ram);
- // Trap, let hypervisor emulate at alt_insn_page
- asm volatile("call *%0" : : "r"(insn_ram), "a"(mem));
+
+ inregs = (struct regs){ 0 };
+ trap_emulator(mem, insn_page, alt_insn_page, insn_ram,
+ alt_insn, 3);
// exit MMX mode
asm volatile("fnclex; emms");
- report("movq mmx generates #MF", exceptions == 1);
+ report("movq mmx generates #MF2", exceptions == 1);
handle_exception(MF_VECTOR, 0);
}
static void test_movabs(uint64_t *mem, uint8_t *insn_page,
uint8_t *alt_insn_page, void *insn_ram)
{
- uint64_t val = 0;
- ulong *cr3 = (ulong *)read_cr3();
-
- // Pad with RET instructions
- memset(insn_page, 0xc3, 4096);
- memset(alt_insn_page, 0xc3, 4096);
- // Place a trapping instruction in the page to trigger a VMEXIT
- insn_page[0] = 0x89; // mov %eax, (%rax)
- insn_page[1] = 0x00;
- // Place the instruction we want the hypervisor to see in the alternate
- // page. A buggy hypervisor will fetch a 32-bit immediate and return
- // 0xffffffffc3c3c3c3.
- alt_insn_page[0] = 0x48; // mov $0xc3c3c3c3c3c3c3c3, %rcx
- alt_insn_page[1] = 0xb9;
-
- // Load the code TLB with insn_page, but point the page tables at
- // alt_insn_page (and keep the data TLB clear, for AMD decode assist).
- // This will make the CPU trap on the insn_page instruction but the
- // hypervisor will see alt_insn_page.
- install_page(cr3, virt_to_phys(insn_page), insn_ram);
- // Load code TLB
- invlpg(insn_ram);
- asm volatile("call *%0" : : "r"(insn_ram + 3));
- // Trap, let hypervisor emulate at alt_insn_page
- install_page(cr3, virt_to_phys(alt_insn_page), insn_ram);
- asm volatile("call *%1" : "=c"(val) : "r"(insn_ram), "a"(mem), "c"(0));
- report("64-bit mov imm", val == 0xc3c3c3c3c3c3c3c3);
+ // mov $0xc3c3c3c3c3c3c3c3, %rcx
+ uint8_t alt_insn[] = {0x48, 0xb9, 0xc3, 0xc3, 0xc3,
+ 0xc3, 0xc3, 0xc3, 0xc3, 0xc3};
+ inregs = (struct regs){ .rcx = 0 };
+
+ trap_emulator(mem, insn_page, alt_insn_page, insn_ram,
+ alt_insn, 10);
+ report("64-bit mov imm2", outregs.rcx == 0xc3c3c3c3c3c3c3c3);
}
static void test_crosspage_mmio(volatile uint8_t *mem)
--
1.7.9.5
^ permalink raw reply related [flat|nested] 20+ messages in thread
* [PATCH 2/2] kvm-unit-tests: Change two cases to use trap_emulator
2013-06-10 13:38 [PATCH 1/2] kvm-unit-tests: Add a func to run instruction in emulator Arthur Chunqi Li
@ 2013-06-10 13:38 ` Arthur Chunqi Li
0 siblings, 0 replies; 20+ messages in thread
From: Arthur Chunqi Li @ 2013-06-10 13:38 UTC (permalink / raw)
To: kvm; +Cc: gleb, pbonzini, Arthur Chunqi Li
Change two functions (test_mmx_movq_mf and test_movabs) using
unified trap_emulator.
Signed-off-by: Arthur Chunqi Li <yzt356@gmail.com>
---
x86/emulator.c | 65 ++++++++++++--------------------------------------------
1 file changed, 13 insertions(+), 52 deletions(-)
diff --git a/x86/emulator.c b/x86/emulator.c
index a1bd92e..4ad6f5e 100644
--- a/x86/emulator.c
+++ b/x86/emulator.c
@@ -801,72 +801,33 @@ static void test_mmx_movq_mf(uint64_t *mem, uint8_t *insn_page,
uint8_t *alt_insn_page, void *insn_ram)
{
uint16_t fcw = 0; // all exceptions unmasked
- ulong *cr3 = (ulong *)read_cr3();
+ uint8_t alt_insn[] = {0x0f, 0x7f, 0x00}; // movq %mm0, (%rax)
write_cr0(read_cr0() & ~6); // TS, EM
- // Place a trapping instruction in the page to trigger a VMEXIT
- insn_page[0] = 0x89; // mov %eax, (%rax)
- insn_page[1] = 0x00;
- insn_page[2] = 0x90; // nop
- insn_page[3] = 0xc3; // ret
- // Place the instruction we want the hypervisor to see in the alternate page
- alt_insn_page[0] = 0x0f; // movq %mm0, (%rax)
- alt_insn_page[1] = 0x7f;
- alt_insn_page[2] = 0x00;
- alt_insn_page[3] = 0xc3; // ret
-
exceptions = 0;
handle_exception(MF_VECTOR, advance_rip_by_3_and_note_exception);
-
- // Load the code TLB with insn_page, but point the page tables at
- // alt_insn_page (and keep the data TLB clear, for AMD decode assist).
- // This will make the CPU trap on the insn_page instruction but the
- // hypervisor will see alt_insn_page.
- install_page(cr3, virt_to_phys(insn_page), insn_ram);
asm volatile("fninit; fldcw %0" : : "m"(fcw));
asm volatile("fldz; fldz; fdivp"); // generate exception
- invlpg(insn_ram);
- // Load code TLB
- asm volatile("call *%0" : : "r"(insn_ram + 3));
- install_page(cr3, virt_to_phys(alt_insn_page), insn_ram);
- // Trap, let hypervisor emulate at alt_insn_page
- asm volatile("call *%0" : : "r"(insn_ram), "a"(mem));
+
+ inregs = (struct regs){ 0 };
+ trap_emulator(mem, insn_page, alt_insn_page, insn_ram,
+ alt_insn, 3, 1);
// exit MMX mode
asm volatile("fnclex; emms");
- report("movq mmx generates #MF", exceptions == 1);
+ report("movq mmx generates #MF2", exceptions == 1);
handle_exception(MF_VECTOR, 0);
}
static void test_movabs(uint64_t *mem, uint8_t *insn_page,
uint8_t *alt_insn_page, void *insn_ram)
{
- uint64_t val = 0;
- ulong *cr3 = (ulong *)read_cr3();
-
- // Pad with RET instructions
- memset(insn_page, 0xc3, 4096);
- memset(alt_insn_page, 0xc3, 4096);
- // Place a trapping instruction in the page to trigger a VMEXIT
- insn_page[0] = 0x89; // mov %eax, (%rax)
- insn_page[1] = 0x00;
- // Place the instruction we want the hypervisor to see in the alternate
- // page. A buggy hypervisor will fetch a 32-bit immediate and return
- // 0xffffffffc3c3c3c3.
- alt_insn_page[0] = 0x48; // mov $0xc3c3c3c3c3c3c3c3, %rcx
- alt_insn_page[1] = 0xb9;
-
- // Load the code TLB with insn_page, but point the page tables at
- // alt_insn_page (and keep the data TLB clear, for AMD decode assist).
- // This will make the CPU trap on the insn_page instruction but the
- // hypervisor will see alt_insn_page.
- install_page(cr3, virt_to_phys(insn_page), insn_ram);
- // Load code TLB
- invlpg(insn_ram);
- asm volatile("call *%0" : : "r"(insn_ram + 3));
- // Trap, let hypervisor emulate at alt_insn_page
- install_page(cr3, virt_to_phys(alt_insn_page), insn_ram);
- asm volatile("call *%1" : "=c"(val) : "r"(insn_ram), "a"(mem), "c"(0));
- report("64-bit mov imm", val == 0xc3c3c3c3c3c3c3c3);
+ // mov $0xc3c3c3c3c3c3c3c3, %rcx
+ uint8_t alt_insn[] = {0x48, 0xb9, 0xc3, 0xc3, 0xc3,
+ 0xc3, 0xc3, 0xc3, 0xc3, 0xc3};
+ inregs = (struct regs){ .rcx = 0 };
+ trap_emulator(mem, insn_page, alt_insn_page, insn_ram,
+ alt_insn, 10, 1);
+ report("64-bit mov imm2", outregs.rcx == 0xc3c3c3c3c3c3c3c3);
}
static void test_crosspage_mmio(volatile uint8_t *mem)
--
1.7.9.5
^ permalink raw reply related [flat|nested] 20+ messages in thread
* [PATCH 2/2] kvm-unit-tests: Change two cases to use trap_emulator
@ 2013-06-10 13:45 Arthur Chunqi Li
2013-06-10 13:46 ` 李春奇 <Arthur Chunqi Li>
0 siblings, 1 reply; 20+ messages in thread
From: Arthur Chunqi Li @ 2013-06-10 13:45 UTC (permalink / raw)
To: kvm; +Cc: gleb, pbonzini, Arthur Chunqi Li
Change two functions (test_mmx_movq_mf and test_movabs) using
unified trap_emulator.
Signed-off-by: Arthur Chunqi Li <yzt356@gmail.com>
---
x86/emulator.c | 63 +++++++++++---------------------------------------------
1 file changed, 12 insertions(+), 51 deletions(-)
diff --git a/x86/emulator.c b/x86/emulator.c
index a1bd92e..c73c766 100644
--- a/x86/emulator.c
+++ b/x86/emulator.c
@@ -801,36 +801,17 @@ static void test_mmx_movq_mf(uint64_t *mem, uint8_t *insn_page,
uint8_t *alt_insn_page, void *insn_ram)
{
uint16_t fcw = 0; // all exceptions unmasked
- ulong *cr3 = (ulong *)read_cr3();
+ uint8_t alt_insn[] = {0x0f, 0x7f, 0x00}; // movq %mm0, (%rax)
write_cr0(read_cr0() & ~6); // TS, EM
- // Place a trapping instruction in the page to trigger a VMEXIT
- insn_page[0] = 0x89; // mov %eax, (%rax)
- insn_page[1] = 0x00;
- insn_page[2] = 0x90; // nop
- insn_page[3] = 0xc3; // ret
- // Place the instruction we want the hypervisor to see in the alternate page
- alt_insn_page[0] = 0x0f; // movq %mm0, (%rax)
- alt_insn_page[1] = 0x7f;
- alt_insn_page[2] = 0x00;
- alt_insn_page[3] = 0xc3; // ret
-
exceptions = 0;
handle_exception(MF_VECTOR, advance_rip_by_3_and_note_exception);
-
- // Load the code TLB with insn_page, but point the page tables at
- // alt_insn_page (and keep the data TLB clear, for AMD decode assist).
- // This will make the CPU trap on the insn_page instruction but the
- // hypervisor will see alt_insn_page.
- install_page(cr3, virt_to_phys(insn_page), insn_ram);
asm volatile("fninit; fldcw %0" : : "m"(fcw));
asm volatile("fldz; fldz; fdivp"); // generate exception
- invlpg(insn_ram);
- // Load code TLB
- asm volatile("call *%0" : : "r"(insn_ram + 3));
- install_page(cr3, virt_to_phys(alt_insn_page), insn_ram);
- // Trap, let hypervisor emulate at alt_insn_page
- asm volatile("call *%0" : : "r"(insn_ram), "a"(mem));
+
+ inregs = (struct regs){ 0 };
+ trap_emulator(mem, insn_page, alt_insn_page, insn_ram,
+ alt_insn, 3, 1);
// exit MMX mode
asm volatile("fnclex; emms");
report("movq mmx generates #MF", exceptions == 1);
@@ -840,33 +821,13 @@ static void test_mmx_movq_mf(uint64_t *mem, uint8_t *insn_page,
static void test_movabs(uint64_t *mem, uint8_t *insn_page,
uint8_t *alt_insn_page, void *insn_ram)
{
- uint64_t val = 0;
- ulong *cr3 = (ulong *)read_cr3();
-
- // Pad with RET instructions
- memset(insn_page, 0xc3, 4096);
- memset(alt_insn_page, 0xc3, 4096);
- // Place a trapping instruction in the page to trigger a VMEXIT
- insn_page[0] = 0x89; // mov %eax, (%rax)
- insn_page[1] = 0x00;
- // Place the instruction we want the hypervisor to see in the alternate
- // page. A buggy hypervisor will fetch a 32-bit immediate and return
- // 0xffffffffc3c3c3c3.
- alt_insn_page[0] = 0x48; // mov $0xc3c3c3c3c3c3c3c3, %rcx
- alt_insn_page[1] = 0xb9;
-
- // Load the code TLB with insn_page, but point the page tables at
- // alt_insn_page (and keep the data TLB clear, for AMD decode assist).
- // This will make the CPU trap on the insn_page instruction but the
- // hypervisor will see alt_insn_page.
- install_page(cr3, virt_to_phys(insn_page), insn_ram);
- // Load code TLB
- invlpg(insn_ram);
- asm volatile("call *%0" : : "r"(insn_ram + 3));
- // Trap, let hypervisor emulate at alt_insn_page
- install_page(cr3, virt_to_phys(alt_insn_page), insn_ram);
- asm volatile("call *%1" : "=c"(val) : "r"(insn_ram), "a"(mem), "c"(0));
- report("64-bit mov imm", val == 0xc3c3c3c3c3c3c3c3);
+ // mov $0xc3c3c3c3c3c3c3c3, %rcx
+ uint8_t alt_insn[] = {0x48, 0xb9, 0xc3, 0xc3, 0xc3,
+ 0xc3, 0xc3, 0xc3, 0xc3, 0xc3};
+ inregs = (struct regs){ .rcx = 0 };
+ trap_emulator(mem, insn_page, alt_insn_page, insn_ram,
+ alt_insn, 10, 1);
+ report("64-bit mov imm2", outregs.rcx == 0xc3c3c3c3c3c3c3c3);
}
static void test_crosspage_mmio(volatile uint8_t *mem)
--
1.7.9.5
^ permalink raw reply related [flat|nested] 20+ messages in thread
* Re: [PATCH 2/2] kvm-unit-tests: Change two cases to use trap_emulator
2013-06-10 13:45 Arthur Chunqi Li
@ 2013-06-10 13:46 ` 李春奇 <Arthur Chunqi Li>
0 siblings, 0 replies; 20+ messages in thread
From: 李春奇 <Arthur Chunqi Li> @ 2013-06-10 13:46 UTC (permalink / raw)
To: kvm; +Cc: Gleb Natapov, Paolo Bonzini, Arthur Chunqi Li
Sorry, there are some small mistakes in the first path, recommit it.
Arthur
On Mon, Jun 10, 2013 at 9:45 PM, Arthur Chunqi Li <yzt356@gmail.com> wrote:
> Change two functions (test_mmx_movq_mf and test_movabs) using
> unified trap_emulator.
>
> Signed-off-by: Arthur Chunqi Li <yzt356@gmail.com>
> ---
> x86/emulator.c | 63 +++++++++++---------------------------------------------
> 1 file changed, 12 insertions(+), 51 deletions(-)
>
> diff --git a/x86/emulator.c b/x86/emulator.c
> index a1bd92e..c73c766 100644
> --- a/x86/emulator.c
> +++ b/x86/emulator.c
> @@ -801,36 +801,17 @@ static void test_mmx_movq_mf(uint64_t *mem, uint8_t *insn_page,
> uint8_t *alt_insn_page, void *insn_ram)
> {
> uint16_t fcw = 0; // all exceptions unmasked
> - ulong *cr3 = (ulong *)read_cr3();
> + uint8_t alt_insn[] = {0x0f, 0x7f, 0x00}; // movq %mm0, (%rax)
>
> write_cr0(read_cr0() & ~6); // TS, EM
> - // Place a trapping instruction in the page to trigger a VMEXIT
> - insn_page[0] = 0x89; // mov %eax, (%rax)
> - insn_page[1] = 0x00;
> - insn_page[2] = 0x90; // nop
> - insn_page[3] = 0xc3; // ret
> - // Place the instruction we want the hypervisor to see in the alternate page
> - alt_insn_page[0] = 0x0f; // movq %mm0, (%rax)
> - alt_insn_page[1] = 0x7f;
> - alt_insn_page[2] = 0x00;
> - alt_insn_page[3] = 0xc3; // ret
> -
> exceptions = 0;
> handle_exception(MF_VECTOR, advance_rip_by_3_and_note_exception);
> -
> - // Load the code TLB with insn_page, but point the page tables at
> - // alt_insn_page (and keep the data TLB clear, for AMD decode assist).
> - // This will make the CPU trap on the insn_page instruction but the
> - // hypervisor will see alt_insn_page.
> - install_page(cr3, virt_to_phys(insn_page), insn_ram);
> asm volatile("fninit; fldcw %0" : : "m"(fcw));
> asm volatile("fldz; fldz; fdivp"); // generate exception
> - invlpg(insn_ram);
> - // Load code TLB
> - asm volatile("call *%0" : : "r"(insn_ram + 3));
> - install_page(cr3, virt_to_phys(alt_insn_page), insn_ram);
> - // Trap, let hypervisor emulate at alt_insn_page
> - asm volatile("call *%0" : : "r"(insn_ram), "a"(mem));
> +
> + inregs = (struct regs){ 0 };
> + trap_emulator(mem, insn_page, alt_insn_page, insn_ram,
> + alt_insn, 3, 1);
> // exit MMX mode
> asm volatile("fnclex; emms");
> report("movq mmx generates #MF", exceptions == 1);
> @@ -840,33 +821,13 @@ static void test_mmx_movq_mf(uint64_t *mem, uint8_t *insn_page,
> static void test_movabs(uint64_t *mem, uint8_t *insn_page,
> uint8_t *alt_insn_page, void *insn_ram)
> {
> - uint64_t val = 0;
> - ulong *cr3 = (ulong *)read_cr3();
> -
> - // Pad with RET instructions
> - memset(insn_page, 0xc3, 4096);
> - memset(alt_insn_page, 0xc3, 4096);
> - // Place a trapping instruction in the page to trigger a VMEXIT
> - insn_page[0] = 0x89; // mov %eax, (%rax)
> - insn_page[1] = 0x00;
> - // Place the instruction we want the hypervisor to see in the alternate
> - // page. A buggy hypervisor will fetch a 32-bit immediate and return
> - // 0xffffffffc3c3c3c3.
> - alt_insn_page[0] = 0x48; // mov $0xc3c3c3c3c3c3c3c3, %rcx
> - alt_insn_page[1] = 0xb9;
> -
> - // Load the code TLB with insn_page, but point the page tables at
> - // alt_insn_page (and keep the data TLB clear, for AMD decode assist).
> - // This will make the CPU trap on the insn_page instruction but the
> - // hypervisor will see alt_insn_page.
> - install_page(cr3, virt_to_phys(insn_page), insn_ram);
> - // Load code TLB
> - invlpg(insn_ram);
> - asm volatile("call *%0" : : "r"(insn_ram + 3));
> - // Trap, let hypervisor emulate at alt_insn_page
> - install_page(cr3, virt_to_phys(alt_insn_page), insn_ram);
> - asm volatile("call *%1" : "=c"(val) : "r"(insn_ram), "a"(mem), "c"(0));
> - report("64-bit mov imm", val == 0xc3c3c3c3c3c3c3c3);
> + // mov $0xc3c3c3c3c3c3c3c3, %rcx
> + uint8_t alt_insn[] = {0x48, 0xb9, 0xc3, 0xc3, 0xc3,
> + 0xc3, 0xc3, 0xc3, 0xc3, 0xc3};
> + inregs = (struct regs){ .rcx = 0 };
> + trap_emulator(mem, insn_page, alt_insn_page, insn_ram,
> + alt_insn, 10, 1);
> + report("64-bit mov imm2", outregs.rcx == 0xc3c3c3c3c3c3c3c3);
> }
>
> static void test_crosspage_mmio(volatile uint8_t *mem)
> --
> 1.7.9.5
>
--
Arthur Chunqi Li
Department of Computer Science
School of EECS
Peking University
Beijing, China
^ permalink raw reply [flat|nested] 20+ messages in thread
* Re: [PATCH 2/2] kvm-unit-tests: Change two cases to use trap_emulator
2013-06-06 15:24 ` [PATCH 2/2] kvm-unit-tests: Change two cases to use trap_emulator Arthur Chunqi Li
@ 2013-06-12 20:51 ` Paolo Bonzini
0 siblings, 0 replies; 20+ messages in thread
From: Paolo Bonzini @ 2013-06-12 20:51 UTC (permalink / raw)
To: Arthur Chunqi Li; +Cc: kvm, gleb
Il 06/06/2013 11:24, Arthur Chunqi Li ha scritto:
> Change two functions (test_mmx_movq_mf and test_movabs) using
> unified trap_emulator.
>
> Signed-off-by: Arthur Chunqi Li <yzt356@gmail.com>
> ---
> x86/emulator.c | 66 ++++++++++++--------------------------------------------
> 1 file changed, 14 insertions(+), 52 deletions(-)
>
> diff --git a/x86/emulator.c b/x86/emulator.c
> index 8ab9904..fa8993f 100644
> --- a/x86/emulator.c
> +++ b/x86/emulator.c
> @@ -776,72 +776,34 @@ static void test_mmx_movq_mf(uint64_t *mem, uint8_t *insn_page,
> uint8_t *alt_insn_page, void *insn_ram)
> {
> uint16_t fcw = 0; // all exceptions unmasked
> - ulong *cr3 = (ulong *)read_cr3();
> + uint8_t alt_insn[] = {0x0f, 0x7f, 0x00}; // movq %mm0, (%rax)
>
> write_cr0(read_cr0() & ~6); // TS, EM
> - // Place a trapping instruction in the page to trigger a VMEXIT
> - insn_page[0] = 0x89; // mov %eax, (%rax)
> - insn_page[1] = 0x00;
> - insn_page[2] = 0x90; // nop
> - insn_page[3] = 0xc3; // ret
> - // Place the instruction we want the hypervisor to see in the alternate page
> - alt_insn_page[0] = 0x0f; // movq %mm0, (%rax)
> - alt_insn_page[1] = 0x7f;
> - alt_insn_page[2] = 0x00;
> - alt_insn_page[3] = 0xc3; // ret
> -
> exceptions = 0;
> handle_exception(MF_VECTOR, advance_rip_by_3_and_note_exception);
> -
> - // Load the code TLB with insn_page, but point the page tables at
> - // alt_insn_page (and keep the data TLB clear, for AMD decode assist).
> - // This will make the CPU trap on the insn_page instruction but the
> - // hypervisor will see alt_insn_page.
> - install_page(cr3, virt_to_phys(insn_page), insn_ram);
> asm volatile("fninit; fldcw %0" : : "m"(fcw));
> asm volatile("fldz; fldz; fdivp"); // generate exception
> - invlpg(insn_ram);
> - // Load code TLB
> - asm volatile("call *%0" : : "r"(insn_ram + 3));
> - install_page(cr3, virt_to_phys(alt_insn_page), insn_ram);
> - // Trap, let hypervisor emulate at alt_insn_page
> - asm volatile("call *%0" : : "r"(insn_ram), "a"(mem));
> +
> + inregs = (struct regs){ 0 };
> + trap_emulator(mem, insn_page, alt_insn_page, insn_ram,
> + alt_insn, 3);
> // exit MMX mode
> asm volatile("fnclex; emms");
> - report("movq mmx generates #MF", exceptions == 1);
> + report("movq mmx generates #MF2", exceptions == 1);
Extra hunk that is not needed? Otherwise it looks good.
Thanks,
Paolo
> handle_exception(MF_VECTOR, 0);
> }
>
> static void test_movabs(uint64_t *mem, uint8_t *insn_page,
> uint8_t *alt_insn_page, void *insn_ram)
> {
> - uint64_t val = 0;
> - ulong *cr3 = (ulong *)read_cr3();
> -
> - // Pad with RET instructions
> - memset(insn_page, 0xc3, 4096);
> - memset(alt_insn_page, 0xc3, 4096);
> - // Place a trapping instruction in the page to trigger a VMEXIT
> - insn_page[0] = 0x89; // mov %eax, (%rax)
> - insn_page[1] = 0x00;
> - // Place the instruction we want the hypervisor to see in the alternate
> - // page. A buggy hypervisor will fetch a 32-bit immediate and return
> - // 0xffffffffc3c3c3c3.
> - alt_insn_page[0] = 0x48; // mov $0xc3c3c3c3c3c3c3c3, %rcx
> - alt_insn_page[1] = 0xb9;
> -
> - // Load the code TLB with insn_page, but point the page tables at
> - // alt_insn_page (and keep the data TLB clear, for AMD decode assist).
> - // This will make the CPU trap on the insn_page instruction but the
> - // hypervisor will see alt_insn_page.
> - install_page(cr3, virt_to_phys(insn_page), insn_ram);
> - // Load code TLB
> - invlpg(insn_ram);
> - asm volatile("call *%0" : : "r"(insn_ram + 3));
> - // Trap, let hypervisor emulate at alt_insn_page
> - install_page(cr3, virt_to_phys(alt_insn_page), insn_ram);
> - asm volatile("call *%1" : "=c"(val) : "r"(insn_ram), "a"(mem), "c"(0));
> - report("64-bit mov imm", val == 0xc3c3c3c3c3c3c3c3);
> + // mov $0xc3c3c3c3c3c3c3c3, %rcx
> + uint8_t alt_insn[] = {0x48, 0xb9, 0xc3, 0xc3, 0xc3,
> + 0xc3, 0xc3, 0xc3, 0xc3, 0xc3};
> + inregs = (struct regs){ .rcx = 0 };
> +
> + trap_emulator(mem, insn_page, alt_insn_page, insn_ram,
> + alt_insn, 10);
> + report("64-bit mov imm2", outregs.rcx == 0xc3c3c3c3c3c3c3c3);
> }
>
> static void test_crosspage_mmio(volatile uint8_t *mem)
>
^ permalink raw reply [flat|nested] 20+ messages in thread
* [PATCH 2/2] kvm-unit-tests: Change two cases to use trap_emulator
2013-06-13 15:16 [PATCH 1/2] kvm-unit-tests: Add a func to run instruction in emulator Arthur Chunqi Li
@ 2013-06-13 15:16 ` Arthur Chunqi Li
0 siblings, 0 replies; 20+ messages in thread
From: Arthur Chunqi Li @ 2013-06-13 15:16 UTC (permalink / raw)
To: kvm; +Cc: gleb, pbonzini, jan.kiszka, Arthur Chunqi Li
Change two functions (test_mmx_movq_mf and test_movabs) using
unified trap_emulator.
Signed-off-by: Arthur Chunqi Li <yzt356@gmail.com>
---
x86/emulator.c | 85 +++++++++++++++-----------------------------------------
1 file changed, 23 insertions(+), 62 deletions(-)
diff --git a/x86/emulator.c b/x86/emulator.c
index 4981bfb..7698f56 100644
--- a/x86/emulator.c
+++ b/x86/emulator.c
@@ -826,73 +826,34 @@ static void advance_rip_by_3_and_note_exception(struct ex_regs *regs)
static void test_mmx_movq_mf(uint64_t *mem, uint8_t *insn_page,
uint8_t *alt_insn_page, void *insn_ram)
{
- uint16_t fcw = 0; // all exceptions unmasked
- ulong *cr3 = (ulong *)read_cr3();
-
- write_cr0(read_cr0() & ~6); // TS, EM
- // Place a trapping instruction in the page to trigger a VMEXIT
- insn_page[0] = 0x89; // mov %eax, (%rax)
- insn_page[1] = 0x00;
- insn_page[2] = 0x90; // nop
- insn_page[3] = 0xc3; // ret
- // Place the instruction we want the hypervisor to see in the alternate page
- alt_insn_page[0] = 0x0f; // movq %mm0, (%rax)
- alt_insn_page[1] = 0x7f;
- alt_insn_page[2] = 0x00;
- alt_insn_page[3] = 0xc3; // ret
-
- exceptions = 0;
- handle_exception(MF_VECTOR, advance_rip_by_3_and_note_exception);
-
- // Load the code TLB with insn_page, but point the page tables at
- // alt_insn_page (and keep the data TLB clear, for AMD decode assist).
- // This will make the CPU trap on the insn_page instruction but the
- // hypervisor will see alt_insn_page.
- install_page(cr3, virt_to_phys(insn_page), insn_ram);
- asm volatile("fninit; fldcw %0" : : "m"(fcw));
- asm volatile("fldz; fldz; fdivp"); // generate exception
- invlpg(insn_ram);
- // Load code TLB
- asm volatile("call *%0" : : "r"(insn_ram + 3));
- install_page(cr3, virt_to_phys(alt_insn_page), insn_ram);
- // Trap, let hypervisor emulate at alt_insn_page
- asm volatile("call *%0" : : "r"(insn_ram), "a"(mem));
- // exit MMX mode
- asm volatile("fnclex; emms");
- report("movq mmx generates #MF", exceptions == 1);
- handle_exception(MF_VECTOR, 0);
+ uint16_t fcw = 0; // all exceptions unmasked
+ uint8_t alt_insn[] = {0x0f, 0x7f, 0x00}; // movq %mm0, (%rax)
+
+ write_cr0(read_cr0() & ~6); // TS, EM
+ exceptions = 0;
+ handle_exception(MF_VECTOR, advance_rip_by_3_and_note_exception);
+ asm volatile("fninit; fldcw %0" : : "m"(fcw));
+ asm volatile("fldz; fldz; fdivp"); // generate exception
+
+ inregs = (struct regs){ 0 };
+ trap_emulator(mem, insn_page, alt_insn_page, insn_ram,
+ alt_insn, 3, 1);
+ // exit MMX mode
+ asm volatile("fnclex; emms");
+ report("movq mmx generates #MF", exceptions == 1);
+ handle_exception(MF_VECTOR, 0);
}
static void test_movabs(uint64_t *mem, uint8_t *insn_page,
uint8_t *alt_insn_page, void *insn_ram)
{
- uint64_t val = 0;
- ulong *cr3 = (ulong *)read_cr3();
-
- // Pad with RET instructions
- memset(insn_page, 0xc3, 4096);
- memset(alt_insn_page, 0xc3, 4096);
- // Place a trapping instruction in the page to trigger a VMEXIT
- insn_page[0] = 0x89; // mov %eax, (%rax)
- insn_page[1] = 0x00;
- // Place the instruction we want the hypervisor to see in the alternate
- // page. A buggy hypervisor will fetch a 32-bit immediate and return
- // 0xffffffffc3c3c3c3.
- alt_insn_page[0] = 0x48; // mov $0xc3c3c3c3c3c3c3c3, %rcx
- alt_insn_page[1] = 0xb9;
-
- // Load the code TLB with insn_page, but point the page tables at
- // alt_insn_page (and keep the data TLB clear, for AMD decode assist).
- // This will make the CPU trap on the insn_page instruction but the
- // hypervisor will see alt_insn_page.
- install_page(cr3, virt_to_phys(insn_page), insn_ram);
- // Load code TLB
- invlpg(insn_ram);
- asm volatile("call *%0" : : "r"(insn_ram + 3));
- // Trap, let hypervisor emulate at alt_insn_page
- install_page(cr3, virt_to_phys(alt_insn_page), insn_ram);
- asm volatile("call *%1" : "=c"(val) : "r"(insn_ram), "a"(mem), "c"(0));
- report("64-bit mov imm", val == 0xc3c3c3c3c3c3c3c3);
+ // mov $0xc3c3c3c3c3c3c3c3, %rcx
+ uint8_t alt_insn[] = {0x48, 0xb9, 0xc3, 0xc3, 0xc3,
+ 0xc3, 0xc3, 0xc3, 0xc3, 0xc3};
+ inregs = (struct regs){ .rbx = 0x5678, .rcx = 0x1234 };
+ trap_emulator(mem, insn_page, alt_insn_page, insn_ram,
+ alt_insn, 10, 1);
+ report("64-bit mov imm2", outregs.rcx == 0xc3c3c3c3c3c3c3c3);
}
static void test_crosspage_mmio(volatile uint8_t *mem)
--
1.7.9.5
^ permalink raw reply related [flat|nested] 20+ messages in thread
* [PATCH 1/2] kvm-unit-tests: Add a func to run instruction in emulator
@ 2013-06-19 15:00 Arthur Chunqi Li
2013-06-19 15:00 ` [PATCH 2/2] kvm-unit-tests: Change two cases to use trap_emulator Arthur Chunqi Li
` (2 more replies)
0 siblings, 3 replies; 20+ messages in thread
From: Arthur Chunqi Li @ 2013-06-19 15:00 UTC (permalink / raw)
To: kvm; +Cc: gleb, pbonzini, jan.kiszka, Arthur Chunqi Li
Add a function trap_emulator to run an instruction in emulator.
Set inregs first (%rax is invalid because it is used as return
address), put instruction codec in alt_insn and call func with
alt_insn_length. Get results in outregs.
Signed-off-by: Arthur Chunqi Li <yzt356@gmail.com>
---
x86/emulator.c | 110 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++
1 file changed, 110 insertions(+)
mode change 100644 => 100755 x86/emulator.c
diff --git a/x86/emulator.c b/x86/emulator.c
old mode 100644
new mode 100755
index 96576e5..48d45c8
--- a/x86/emulator.c
+++ b/x86/emulator.c
@@ -11,6 +11,15 @@ int fails, tests;
static int exceptions;
+struct regs {
+ u64 rax, rbx, rcx, rdx;
+ u64 rsi, rdi, rsp, rbp;
+ u64 r8, r9, r10, r11;
+ u64 r12, r13, r14, r15;
+ u64 rip, rflags;
+};
+struct regs inregs, outregs, save;
+
void report(const char *name, int result)
{
++tests;
@@ -685,6 +694,107 @@ static void test_shld_shrd(u32 *mem)
report("shrd (cl)", *mem == ((0x12345678 >> 3) | (5u << 29)));
}
+#define INSN_SAVE \
+ "ret\n\t" \
+ "pushf\n\t" \
+ "push 136+save \n\t" \
+ "popf \n\t" \
+ "xchg %rax, 0+save \n\t" \
+ "xchg %rbx, 8+save \n\t" \
+ "xchg %rcx, 16+save \n\t" \
+ "xchg %rdx, 24+save \n\t" \
+ "xchg %rsi, 32+save \n\t" \
+ "xchg %rdi, 40+save \n\t" \
+ "xchg %rsp, 48+save \n\t" \
+ "xchg %rbp, 56+save \n\t" \
+ "xchg %r8, 64+save \n\t" \
+ "xchg %r9, 72+save \n\t" \
+ "xchg %r10, 80+save \n\t" \
+ "xchg %r11, 88+save \n\t" \
+ "xchg %r12, 96+save \n\t" \
+ "xchg %r13, 104+save \n\t" \
+ "xchg %r14, 112+save \n\t" \
+ "xchg %r15, 120+save \n\t" \
+
+#define INSN_RESTORE \
+ "xchg %rax, 0+save \n\t" \
+ "xchg %rbx, 8+save \n\t" \
+ "xchg %rcx, 16+save \n\t" \
+ "xchg %rdx, 24+save \n\t" \
+ "xchg %rsi, 32+save \n\t" \
+ "xchg %rdi, 40+save \n\t" \
+ "xchg %rsp, 48+save \n\t" \
+ "xchg %rbp, 56+save \n\t" \
+ "xchg %r8, 64+save \n\t" \
+ "xchg %r9, 72+save \n\t" \
+ "xchg %r10, 80+save \n\t" \
+ "xchg %r11, 88+save \n\t" \
+ "xchg %r12, 96+save \n\t" \
+ "xchg %r13, 104+save \n\t" \
+ "xchg %r14, 112+save \n\t" \
+ "xchg %r15, 120+save \n\t" \
+ "pushf \n\t" \
+ "pop 136+save \n\t" \
+ "popf \n\t" \
+ "ret \n\t" \
+
+#define INSN_TRAP \
+ "in (%dx),%al\n\t" \
+ ". = . + 31\n\t" \
+
+asm(
+ ".align 4096\n\t"
+ "insn_page:\n\t"
+ INSN_SAVE
+ "test_insn:\n\t"
+ INSN_TRAP
+ "test_insn_end:\n\t"
+ INSN_RESTORE
+ "insn_page_end:\n\t"
+ ".align 4096\n\t"
+
+ "alt_insn_page:\n\t"
+ INSN_SAVE
+ "alt_test_insn:\n\t"
+ INSN_TRAP
+ "alt_test_insn_end:\n\t"
+ INSN_RESTORE
+ "alt_insn_page_end:\n\t"
+ ".align 4096\n\t"
+);
+
+static void trap_emulator(uint64_t *mem, uint8_t* alt_insn, int alt_insn_length)
+{
+ ulong *cr3 = (ulong *)read_cr3();
+ void *insn_ram;
+ int i;
+ extern u8 insn_page[], test_insn[], test_insn_end[];
+ extern u8 alt_insn_page[], alt_test_insn[];
+
+ insn_ram = vmap(virt_to_phys(insn_page), 4096);
+ for (i=1; i<test_insn_end - test_insn; i++)
+ alt_test_insn[i] = test_insn[i] = 0x90; // nop
+ for (i=0; i<alt_insn_length; i++)
+ alt_test_insn[i] = alt_insn[i];
+ for(;i<test_insn_end - test_insn; i++)
+ alt_test_insn[i] = 0x90; // nop
+ save = inregs;
+
+ // Load the code TLB with insn_page, but point the page tables at
+ // alt_insn_page (and keep the data TLB clear, for AMD decode assist).
+ // This will make the CPU trap on the insn_page instruction but the
+ // hypervisor will see alt_insn_page.
+ install_page(cr3, virt_to_phys(insn_page), insn_ram);
+ invlpg(insn_ram);
+ // Load code TLB
+ asm volatile("call *%0" : : "r"(insn_ram));
+ install_page(cr3, virt_to_phys(alt_insn_page), insn_ram);
+ // Trap, let hypervisor emulate at alt_insn_page
+ asm volatile("call *%0": : "r"(insn_ram+1));
+
+ outregs = save;
+}
+
static void advance_rip_by_3_and_note_exception(struct ex_regs *regs)
{
++exceptions;
--
1.7.9.5
^ permalink raw reply related [flat|nested] 20+ messages in thread
* [PATCH 2/2] kvm-unit-tests: Change two cases to use trap_emulator
2013-06-19 15:00 [PATCH 1/2] kvm-unit-tests: Add a func to run instruction in emulator Arthur Chunqi Li
@ 2013-06-19 15:00 ` Arthur Chunqi Li
2013-06-20 8:25 ` Paolo Bonzini
2013-06-19 15:07 ` [PATCH 1/2] kvm-unit-tests: Add a func to run instruction in emulator 李春奇 <Arthur Chunqi Li>
2013-06-20 8:48 ` Gleb Natapov
2 siblings, 1 reply; 20+ messages in thread
From: Arthur Chunqi Li @ 2013-06-19 15:00 UTC (permalink / raw)
To: kvm; +Cc: gleb, pbonzini, jan.kiszka, Arthur Chunqi Li
Change two functions (test_mmx_movq_mf and test_movabs) using
unified trap_emulator.
Signed-off-by: Arthur Chunqi Li <yzt356@gmail.com>
---
x86/emulator.c | 62 ++++++++++----------------------------------------------
1 file changed, 11 insertions(+), 51 deletions(-)
diff --git a/x86/emulator.c b/x86/emulator.c
index 48d45c8..701c578 100755
--- a/x86/emulator.c
+++ b/x86/emulator.c
@@ -805,36 +805,17 @@ static void test_mmx_movq_mf(uint64_t *mem, uint8_t *insn_page,
uint8_t *alt_insn_page, void *insn_ram)
{
uint16_t fcw = 0; // all exceptions unmasked
- ulong *cr3 = (ulong *)read_cr3();
+ u8 alt_insn[] = {0x0f, 0x7f, 0x00}; // movq %mm0, (%rax)
+ void *stack = alloc_page();
write_cr0(read_cr0() & ~6); // TS, EM
- // Place a trapping instruction in the page to trigger a VMEXIT
- insn_page[0] = 0x89; // mov %eax, (%rax)
- insn_page[1] = 0x00;
- insn_page[2] = 0x90; // nop
- insn_page[3] = 0xc3; // ret
- // Place the instruction we want the hypervisor to see in the alternate page
- alt_insn_page[0] = 0x0f; // movq %mm0, (%rax)
- alt_insn_page[1] = 0x7f;
- alt_insn_page[2] = 0x00;
- alt_insn_page[3] = 0xc3; // ret
-
exceptions = 0;
handle_exception(MF_VECTOR, advance_rip_by_3_and_note_exception);
-
- // Load the code TLB with insn_page, but point the page tables at
- // alt_insn_page (and keep the data TLB clear, for AMD decode assist).
- // This will make the CPU trap on the insn_page instruction but the
- // hypervisor will see alt_insn_page.
- install_page(cr3, virt_to_phys(insn_page), insn_ram);
asm volatile("fninit; fldcw %0" : : "m"(fcw));
asm volatile("fldz; fldz; fdivp"); // generate exception
- invlpg(insn_ram);
- // Load code TLB
- asm volatile("call *%0" : : "r"(insn_ram + 3));
- install_page(cr3, virt_to_phys(alt_insn_page), insn_ram);
- // Trap, let hypervisor emulate at alt_insn_page
- asm volatile("call *%0" : : "r"(insn_ram), "a"(mem));
+
+ inregs = (struct regs){ .rsp=(u64)stack+1024 };
+ trap_emulator(mem, alt_insn, 3);
// exit MMX mode
asm volatile("fnclex; emms");
report("movq mmx generates #MF", exceptions == 1);
@@ -844,33 +825,12 @@ static void test_mmx_movq_mf(uint64_t *mem, uint8_t *insn_page,
static void test_movabs(uint64_t *mem, uint8_t *insn_page,
uint8_t *alt_insn_page, void *insn_ram)
{
- uint64_t val = 0;
- ulong *cr3 = (ulong *)read_cr3();
-
- // Pad with RET instructions
- memset(insn_page, 0xc3, 4096);
- memset(alt_insn_page, 0xc3, 4096);
- // Place a trapping instruction in the page to trigger a VMEXIT
- insn_page[0] = 0x89; // mov %eax, (%rax)
- insn_page[1] = 0x00;
- // Place the instruction we want the hypervisor to see in the alternate
- // page. A buggy hypervisor will fetch a 32-bit immediate and return
- // 0xffffffffc3c3c3c3.
- alt_insn_page[0] = 0x48; // mov $0xc3c3c3c3c3c3c3c3, %rcx
- alt_insn_page[1] = 0xb9;
-
- // Load the code TLB with insn_page, but point the page tables at
- // alt_insn_page (and keep the data TLB clear, for AMD decode assist).
- // This will make the CPU trap on the insn_page instruction but the
- // hypervisor will see alt_insn_page.
- install_page(cr3, virt_to_phys(insn_page), insn_ram);
- // Load code TLB
- invlpg(insn_ram);
- asm volatile("call *%0" : : "r"(insn_ram + 3));
- // Trap, let hypervisor emulate at alt_insn_page
- install_page(cr3, virt_to_phys(alt_insn_page), insn_ram);
- asm volatile("call *%1" : "=c"(val) : "r"(insn_ram), "a"(mem), "c"(0));
- report("64-bit mov imm", val == 0xc3c3c3c3c3c3c3c3);
+ // mov $0xc3c3c3c3c3c3c3c3, %rcx
+ uint8_t alt_insn[] = {0x48, 0xb9, 0xc3, 0xc3, 0xc3,
+ 0xc3, 0xc3, 0xc3, 0xc3, 0xc3};
+ inregs = (struct regs){ 0 };
+ trap_emulator(mem, alt_insn, 10);
+ report("64-bit mov imm2", outregs.rcx == 0xc3c3c3c3c3c3c3c3);
}
static void test_crosspage_mmio(volatile uint8_t *mem)
--
1.7.9.5
^ permalink raw reply related [flat|nested] 20+ messages in thread
* Re: [PATCH 1/2] kvm-unit-tests: Add a func to run instruction in emulator
2013-06-19 15:00 [PATCH 1/2] kvm-unit-tests: Add a func to run instruction in emulator Arthur Chunqi Li
2013-06-19 15:00 ` [PATCH 2/2] kvm-unit-tests: Change two cases to use trap_emulator Arthur Chunqi Li
@ 2013-06-19 15:07 ` 李春奇 <Arthur Chunqi Li>
2013-06-19 16:03 ` Gleb Natapov
2013-06-20 8:48 ` Gleb Natapov
2 siblings, 1 reply; 20+ messages in thread
From: 李春奇 <Arthur Chunqi Li> @ 2013-06-19 15:07 UTC (permalink / raw)
To: kvm; +Cc: Gleb Natapov, Paolo Bonzini, Jan Kiszka, Arthur Chunqi Li
Hi Gleb,
This version can set %rsp before trapping into emulator, because
insn_page and alt_insn_page is statically defined and their relative
position to (save) is fixed during execution.
In this way, test case of test_mmx_movq_mf needs to pre-define its own
stack, this change is in the next patch.
In this version, insn_ram is initially mapped to insn_page and them
each call to insn_page/alt_insn_page are all via insn_ram. This trick
runs well but I don't know why my previous version causes error.
Arthur.
On Wed, Jun 19, 2013 at 11:00 PM, Arthur Chunqi Li <yzt356@gmail.com> wrote:
> Add a function trap_emulator to run an instruction in emulator.
> Set inregs first (%rax is invalid because it is used as return
> address), put instruction codec in alt_insn and call func with
> alt_insn_length. Get results in outregs.
>
> Signed-off-by: Arthur Chunqi Li <yzt356@gmail.com>
> ---
> x86/emulator.c | 110 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++
> 1 file changed, 110 insertions(+)
> mode change 100644 => 100755 x86/emulator.c
>
> diff --git a/x86/emulator.c b/x86/emulator.c
> old mode 100644
> new mode 100755
> index 96576e5..48d45c8
> --- a/x86/emulator.c
> +++ b/x86/emulator.c
> @@ -11,6 +11,15 @@ int fails, tests;
>
> static int exceptions;
>
> +struct regs {
> + u64 rax, rbx, rcx, rdx;
> + u64 rsi, rdi, rsp, rbp;
> + u64 r8, r9, r10, r11;
> + u64 r12, r13, r14, r15;
> + u64 rip, rflags;
> +};
> +struct regs inregs, outregs, save;
> +
> void report(const char *name, int result)
> {
> ++tests;
> @@ -685,6 +694,107 @@ static void test_shld_shrd(u32 *mem)
> report("shrd (cl)", *mem == ((0x12345678 >> 3) | (5u << 29)));
> }
>
> +#define INSN_SAVE \
> + "ret\n\t" \
> + "pushf\n\t" \
> + "push 136+save \n\t" \
> + "popf \n\t" \
> + "xchg %rax, 0+save \n\t" \
> + "xchg %rbx, 8+save \n\t" \
> + "xchg %rcx, 16+save \n\t" \
> + "xchg %rdx, 24+save \n\t" \
> + "xchg %rsi, 32+save \n\t" \
> + "xchg %rdi, 40+save \n\t" \
> + "xchg %rsp, 48+save \n\t" \
> + "xchg %rbp, 56+save \n\t" \
> + "xchg %r8, 64+save \n\t" \
> + "xchg %r9, 72+save \n\t" \
> + "xchg %r10, 80+save \n\t" \
> + "xchg %r11, 88+save \n\t" \
> + "xchg %r12, 96+save \n\t" \
> + "xchg %r13, 104+save \n\t" \
> + "xchg %r14, 112+save \n\t" \
> + "xchg %r15, 120+save \n\t" \
> +
> +#define INSN_RESTORE \
> + "xchg %rax, 0+save \n\t" \
> + "xchg %rbx, 8+save \n\t" \
> + "xchg %rcx, 16+save \n\t" \
> + "xchg %rdx, 24+save \n\t" \
> + "xchg %rsi, 32+save \n\t" \
> + "xchg %rdi, 40+save \n\t" \
> + "xchg %rsp, 48+save \n\t" \
> + "xchg %rbp, 56+save \n\t" \
> + "xchg %r8, 64+save \n\t" \
> + "xchg %r9, 72+save \n\t" \
> + "xchg %r10, 80+save \n\t" \
> + "xchg %r11, 88+save \n\t" \
> + "xchg %r12, 96+save \n\t" \
> + "xchg %r13, 104+save \n\t" \
> + "xchg %r14, 112+save \n\t" \
> + "xchg %r15, 120+save \n\t" \
> + "pushf \n\t" \
> + "pop 136+save \n\t" \
> + "popf \n\t" \
> + "ret \n\t" \
> +
> +#define INSN_TRAP \
> + "in (%dx),%al\n\t" \
> + ". = . + 31\n\t" \
> +
> +asm(
> + ".align 4096\n\t"
> + "insn_page:\n\t"
> + INSN_SAVE
> + "test_insn:\n\t"
> + INSN_TRAP
> + "test_insn_end:\n\t"
> + INSN_RESTORE
> + "insn_page_end:\n\t"
> + ".align 4096\n\t"
> +
> + "alt_insn_page:\n\t"
> + INSN_SAVE
> + "alt_test_insn:\n\t"
> + INSN_TRAP
> + "alt_test_insn_end:\n\t"
> + INSN_RESTORE
> + "alt_insn_page_end:\n\t"
> + ".align 4096\n\t"
> +);
> +
> +static void trap_emulator(uint64_t *mem, uint8_t* alt_insn, int alt_insn_length)
> +{
> + ulong *cr3 = (ulong *)read_cr3();
> + void *insn_ram;
> + int i;
> + extern u8 insn_page[], test_insn[], test_insn_end[];
> + extern u8 alt_insn_page[], alt_test_insn[];
> +
> + insn_ram = vmap(virt_to_phys(insn_page), 4096);
> + for (i=1; i<test_insn_end - test_insn; i++)
> + alt_test_insn[i] = test_insn[i] = 0x90; // nop
> + for (i=0; i<alt_insn_length; i++)
> + alt_test_insn[i] = alt_insn[i];
> + for(;i<test_insn_end - test_insn; i++)
> + alt_test_insn[i] = 0x90; // nop
> + save = inregs;
> +
> + // Load the code TLB with insn_page, but point the page tables at
> + // alt_insn_page (and keep the data TLB clear, for AMD decode assist).
> + // This will make the CPU trap on the insn_page instruction but the
> + // hypervisor will see alt_insn_page.
> + install_page(cr3, virt_to_phys(insn_page), insn_ram);
> + invlpg(insn_ram);
> + // Load code TLB
> + asm volatile("call *%0" : : "r"(insn_ram));
> + install_page(cr3, virt_to_phys(alt_insn_page), insn_ram);
> + // Trap, let hypervisor emulate at alt_insn_page
> + asm volatile("call *%0": : "r"(insn_ram+1));
> +
> + outregs = save;
> +}
> +
> static void advance_rip_by_3_and_note_exception(struct ex_regs *regs)
> {
> ++exceptions;
> --
> 1.7.9.5
>
--
Arthur Chunqi Li
Department of Computer Science
School of EECS
Peking University
Beijing, China
^ permalink raw reply [flat|nested] 20+ messages in thread
* Re: [PATCH 1/2] kvm-unit-tests: Add a func to run instruction in emulator
2013-06-19 15:07 ` [PATCH 1/2] kvm-unit-tests: Add a func to run instruction in emulator 李春奇 <Arthur Chunqi Li>
@ 2013-06-19 16:03 ` Gleb Natapov
2013-06-19 17:48 ` Gmail
2013-06-20 8:29 ` Paolo Bonzini
0 siblings, 2 replies; 20+ messages in thread
From: Gleb Natapov @ 2013-06-19 16:03 UTC (permalink / raw)
To: 李春奇 <Arthur Chunqi Li>
Cc: kvm, Paolo Bonzini, Jan Kiszka
On Wed, Jun 19, 2013 at 11:07:18PM +0800, 李春奇 <Arthur Chunqi Li> wrote:
> Hi Gleb,
> This version can set %rsp before trapping into emulator, because
> insn_page and alt_insn_page is statically defined and their relative
> position to (save) is fixed during execution.
>
The position of the code is not fixed during execution since you execute
it from a virtual address obtained dynamically by vmap() and the address
is definitely different from the one the code was compiled for, but if
you look at the code that compile actually produce you will see that it
uses absolute address to access "save" and this is why it works. I
wounder why compiler decided to use absolute address this time, Paolo?
> In this way, test case of test_mmx_movq_mf needs to pre-define its own
> stack, this change is in the next patch.
>
> In this version, insn_ram is initially mapped to insn_page and them
> each call to insn_page/alt_insn_page are all via insn_ram. This trick
> runs well but I don't know why my previous version causes error.
>
Because previous version tried to use install_page() on a large page
mapped region and the function does not know how to handle that.
> Arthur.
> On Wed, Jun 19, 2013 at 11:00 PM, Arthur Chunqi Li <yzt356@gmail.com> wrote:
> > Add a function trap_emulator to run an instruction in emulator.
> > Set inregs first (%rax is invalid because it is used as return
> > address), put instruction codec in alt_insn and call func with
> > alt_insn_length. Get results in outregs.
> >
> > Signed-off-by: Arthur Chunqi Li <yzt356@gmail.com>
> > ---
> > x86/emulator.c | 110 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++
> > 1 file changed, 110 insertions(+)
> > mode change 100644 => 100755 x86/emulator.c
> >
> > diff --git a/x86/emulator.c b/x86/emulator.c
> > old mode 100644
> > new mode 100755
> > index 96576e5..48d45c8
> > --- a/x86/emulator.c
> > +++ b/x86/emulator.c
> > @@ -11,6 +11,15 @@ int fails, tests;
> >
> > static int exceptions;
> >
> > +struct regs {
> > + u64 rax, rbx, rcx, rdx;
> > + u64 rsi, rdi, rsp, rbp;
> > + u64 r8, r9, r10, r11;
> > + u64 r12, r13, r14, r15;
> > + u64 rip, rflags;
> > +};
> > +struct regs inregs, outregs, save;
> > +
> > void report(const char *name, int result)
> > {
> > ++tests;
> > @@ -685,6 +694,107 @@ static void test_shld_shrd(u32 *mem)
> > report("shrd (cl)", *mem == ((0x12345678 >> 3) | (5u << 29)));
> > }
> >
> > +#define INSN_SAVE \
> > + "ret\n\t" \
> > + "pushf\n\t" \
> > + "push 136+save \n\t" \
> > + "popf \n\t" \
> > + "xchg %rax, 0+save \n\t" \
> > + "xchg %rbx, 8+save \n\t" \
> > + "xchg %rcx, 16+save \n\t" \
> > + "xchg %rdx, 24+save \n\t" \
> > + "xchg %rsi, 32+save \n\t" \
> > + "xchg %rdi, 40+save \n\t" \
> > + "xchg %rsp, 48+save \n\t" \
> > + "xchg %rbp, 56+save \n\t" \
> > + "xchg %r8, 64+save \n\t" \
> > + "xchg %r9, 72+save \n\t" \
> > + "xchg %r10, 80+save \n\t" \
> > + "xchg %r11, 88+save \n\t" \
> > + "xchg %r12, 96+save \n\t" \
> > + "xchg %r13, 104+save \n\t" \
> > + "xchg %r14, 112+save \n\t" \
> > + "xchg %r15, 120+save \n\t" \
> > +
> > +#define INSN_RESTORE \
> > + "xchg %rax, 0+save \n\t" \
> > + "xchg %rbx, 8+save \n\t" \
> > + "xchg %rcx, 16+save \n\t" \
> > + "xchg %rdx, 24+save \n\t" \
> > + "xchg %rsi, 32+save \n\t" \
> > + "xchg %rdi, 40+save \n\t" \
> > + "xchg %rsp, 48+save \n\t" \
> > + "xchg %rbp, 56+save \n\t" \
> > + "xchg %r8, 64+save \n\t" \
> > + "xchg %r9, 72+save \n\t" \
> > + "xchg %r10, 80+save \n\t" \
> > + "xchg %r11, 88+save \n\t" \
> > + "xchg %r12, 96+save \n\t" \
> > + "xchg %r13, 104+save \n\t" \
> > + "xchg %r14, 112+save \n\t" \
> > + "xchg %r15, 120+save \n\t" \
> > + "pushf \n\t" \
> > + "pop 136+save \n\t" \
> > + "popf \n\t" \
> > + "ret \n\t" \
> > +
> > +#define INSN_TRAP \
> > + "in (%dx),%al\n\t" \
> > + ". = . + 31\n\t" \
> > +
> > +asm(
> > + ".align 4096\n\t"
> > + "insn_page:\n\t"
> > + INSN_SAVE
> > + "test_insn:\n\t"
> > + INSN_TRAP
> > + "test_insn_end:\n\t"
> > + INSN_RESTORE
> > + "insn_page_end:\n\t"
> > + ".align 4096\n\t"
> > +
> > + "alt_insn_page:\n\t"
> > + INSN_SAVE
> > + "alt_test_insn:\n\t"
> > + INSN_TRAP
> > + "alt_test_insn_end:\n\t"
> > + INSN_RESTORE
> > + "alt_insn_page_end:\n\t"
> > + ".align 4096\n\t"
> > +);
> > +
> > +static void trap_emulator(uint64_t *mem, uint8_t* alt_insn, int alt_insn_length)
> > +{
> > + ulong *cr3 = (ulong *)read_cr3();
> > + void *insn_ram;
> > + int i;
> > + extern u8 insn_page[], test_insn[], test_insn_end[];
> > + extern u8 alt_insn_page[], alt_test_insn[];
> > +
> > + insn_ram = vmap(virt_to_phys(insn_page), 4096);
> > + for (i=1; i<test_insn_end - test_insn; i++)
> > + alt_test_insn[i] = test_insn[i] = 0x90; // nop
> > + for (i=0; i<alt_insn_length; i++)
> > + alt_test_insn[i] = alt_insn[i];
> > + for(;i<test_insn_end - test_insn; i++)
> > + alt_test_insn[i] = 0x90; // nop
> > + save = inregs;
> > +
> > + // Load the code TLB with insn_page, but point the page tables at
> > + // alt_insn_page (and keep the data TLB clear, for AMD decode assist).
> > + // This will make the CPU trap on the insn_page instruction but the
> > + // hypervisor will see alt_insn_page.
> > + install_page(cr3, virt_to_phys(insn_page), insn_ram);
> > + invlpg(insn_ram);
> > + // Load code TLB
> > + asm volatile("call *%0" : : "r"(insn_ram));
> > + install_page(cr3, virt_to_phys(alt_insn_page), insn_ram);
> > + // Trap, let hypervisor emulate at alt_insn_page
> > + asm volatile("call *%0": : "r"(insn_ram+1));
> > +
> > + outregs = save;
> > +}
> > +
> > static void advance_rip_by_3_and_note_exception(struct ex_regs *regs)
> > {
> > ++exceptions;
> > --
> > 1.7.9.5
> >
>
>
>
> --
> Arthur Chunqi Li
> Department of Computer Science
> School of EECS
> Peking University
> Beijing, China
--
Gleb.
^ permalink raw reply [flat|nested] 20+ messages in thread
* Re: [PATCH 1/2] kvm-unit-tests: Add a func to run instruction in emulator
2013-06-19 16:03 ` Gleb Natapov
@ 2013-06-19 17:48 ` Gmail
2013-06-20 5:42 ` Gleb Natapov
2013-06-20 8:29 ` Paolo Bonzini
1 sibling, 1 reply; 20+ messages in thread
From: Gmail @ 2013-06-19 17:48 UTC (permalink / raw)
To: Gleb Natapov; +Cc: kvm, Paolo Bonzini, Jan Kiszka
在 2013-6-20，0:03，Gleb Natapov <gleb@redhat.com> 写道：
> On Wed, Jun 19, 2013 at 11:07:18PM +0800, 李春奇 <Arthur Chunqi Li> wrote:
>> Hi Gleb,
>> This version can set %rsp before trapping into emulator, because
>> insn_page and alt_insn_page is statically defined and their relative
>> position to (save) is fixed during execution.
> The position of the code is not fixed during execution since you execute
> it from a virtual address obtained dynamically by vmap() and the address
> is definitely different from the one the code was compiled for, but if
> you look at the code that compile actually produce you will see that it
> uses absolute address to access "save" and this is why it works. I
> wounder why compiler decided to use absolute address this time, Paolo?
>
>> In this way, test case of test_mmx_movq_mf needs to pre-define its own
>> stack, this change is in the next patch.
>>
>> In this version, insn_ram is initially mapped to insn_page and them
>> each call to insn_page/alt_insn_page are all via insn_ram. This trick
>> runs well but I don't know why my previous version causes error.
> Because previous version tried to use install_page() on a large page
> mapped region and the function does not know how to handle that.
I don't quite understand what you mean here. What is the differences between large page and 4k page in this test case? Maybe I don't understand the differences of install_pte() with 4k page and 2m pages.
>
>> Arthur.
>> On Wed, Jun 19, 2013 at 11:00 PM, Arthur Chunqi Li <yzt356@gmail.com> wrote:
>>> Add a function trap_emulator to run an instruction in emulator.
>>> Set inregs first (%rax is invalid because it is used as return
>>> address), put instruction codec in alt_insn and call func with
>>> alt_insn_length. Get results in outregs.
>>>
>>> Signed-off-by: Arthur Chunqi Li <yzt356@gmail.com>
>>> ---
>>> x86/emulator.c | 110 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++
>>> 1 file changed, 110 insertions(+)
>>> mode change 100644 => 100755 x86/emulator.c
>>>
>>> diff --git a/x86/emulator.c b/x86/emulator.c
>>> old mode 100644
>>> new mode 100755
>>> index 96576e5..48d45c8
>>> --- a/x86/emulator.c
>>> +++ b/x86/emulator.c
>>> @@ -11,6 +11,15 @@ int fails, tests;
>>>
>>> static int exceptions;
>>>
>>> +struct regs {
>>> + u64 rax, rbx, rcx, rdx;
>>> + u64 rsi, rdi, rsp, rbp;
>>> + u64 r8, r9, r10, r11;
>>> + u64 r12, r13, r14, r15;
>>> + u64 rip, rflags;
>>> +};
>>> +struct regs inregs, outregs, save;
>>> +
>>> void report(const char *name, int result)
>>> {
>>> ++tests;
>>> @@ -685,6 +694,107 @@ static void test_shld_shrd(u32 *mem)
>>> report("shrd (cl)", *mem == ((0x12345678 >> 3) | (5u << 29)));
>>> }
>>>
>>> +#define INSN_SAVE \
>>> + "ret\n\t" \
>>> + "pushf\n\t" \
>>> + "push 136+save \n\t" \
>>> + "popf \n\t" \
>>> + "xchg %rax, 0+save \n\t" \
>>> + "xchg %rbx, 8+save \n\t" \
>>> + "xchg %rcx, 16+save \n\t" \
>>> + "xchg %rdx, 24+save \n\t" \
>>> + "xchg %rsi, 32+save \n\t" \
>>> + "xchg %rdi, 40+save \n\t" \
>>> + "xchg %rsp, 48+save \n\t" \
>>> + "xchg %rbp, 56+save \n\t" \
>>> + "xchg %r8, 64+save \n\t" \
>>> + "xchg %r9, 72+save \n\t" \
>>> + "xchg %r10, 80+save \n\t" \
>>> + "xchg %r11, 88+save \n\t" \
>>> + "xchg %r12, 96+save \n\t" \
>>> + "xchg %r13, 104+save \n\t" \
>>> + "xchg %r14, 112+save \n\t" \
>>> + "xchg %r15, 120+save \n\t" \
>>> +
>>> +#define INSN_RESTORE \
>>> + "xchg %rax, 0+save \n\t" \
>>> + "xchg %rbx, 8+save \n\t" \
>>> + "xchg %rcx, 16+save \n\t" \
>>> + "xchg %rdx, 24+save \n\t" \
>>> + "xchg %rsi, 32+save \n\t" \
>>> + "xchg %rdi, 40+save \n\t" \
>>> + "xchg %rsp, 48+save \n\t" \
>>> + "xchg %rbp, 56+save \n\t" \
>>> + "xchg %r8, 64+save \n\t" \
>>> + "xchg %r9, 72+save \n\t" \
>>> + "xchg %r10, 80+save \n\t" \
>>> + "xchg %r11, 88+save \n\t" \
>>> + "xchg %r12, 96+save \n\t" \
>>> + "xchg %r13, 104+save \n\t" \
>>> + "xchg %r14, 112+save \n\t" \
>>> + "xchg %r15, 120+save \n\t" \
>>> + "pushf \n\t" \
>>> + "pop 136+save \n\t" \
>>> + "popf \n\t" \
>>> + "ret \n\t" \
>>> +
>>> +#define INSN_TRAP \
>>> + "in (%dx),%al\n\t" \
>>> + ". = . + 31\n\t" \
>>> +
>>> +asm(
>>> + ".align 4096\n\t"
>>> + "insn_page:\n\t"
>>> + INSN_SAVE
>>> + "test_insn:\n\t"
>>> + INSN_TRAP
>>> + "test_insn_end:\n\t"
>>> + INSN_RESTORE
>>> + "insn_page_end:\n\t"
>>> + ".align 4096\n\t"
>>> +
>>> + "alt_insn_page:\n\t"
>>> + INSN_SAVE
>>> + "alt_test_insn:\n\t"
>>> + INSN_TRAP
>>> + "alt_test_insn_end:\n\t"
>>> + INSN_RESTORE
>>> + "alt_insn_page_end:\n\t"
>>> + ".align 4096\n\t"
>>> +);
>>> +
>>> +static void trap_emulator(uint64_t *mem, uint8_t* alt_insn, int alt_insn_length)
>>> +{
>>> + ulong *cr3 = (ulong *)read_cr3();
>>> + void *insn_ram;
>>> + int i;
>>> + extern u8 insn_page[], test_insn[], test_insn_end[];
>>> + extern u8 alt_insn_page[], alt_test_insn[];
>>> +
>>> + insn_ram = vmap(virt_to_phys(insn_page), 4096);
>>> + for (i=1; i<test_insn_end - test_insn; i++)
>>> + alt_test_insn[i] = test_insn[i] = 0x90; // nop
>>> + for (i=0; i<alt_insn_length; i++)
>>> + alt_test_insn[i] = alt_insn[i];
>>> + for(;i<test_insn_end - test_insn; i++)
>>> + alt_test_insn[i] = 0x90; // nop
>>> + save = inregs;
>>> +
>>> + // Load the code TLB with insn_page, but point the page tables at
>>> + // alt_insn_page (and keep the data TLB clear, for AMD decode assist).
>>> + // This will make the CPU trap on the insn_page instruction but the
>>> + // hypervisor will see alt_insn_page.
>>> + install_page(cr3, virt_to_phys(insn_page), insn_ram);
>>> + invlpg(insn_ram);
>>> + // Load code TLB
>>> + asm volatile("call *%0" : : "r"(insn_ram));
>>> + install_page(cr3, virt_to_phys(alt_insn_page), insn_ram);
>>> + // Trap, let hypervisor emulate at alt_insn_page
>>> + asm volatile("call *%0": : "r"(insn_ram+1));
>>> +
>>> + outregs = save;
>>> +}
>>> +
>>> static void advance_rip_by_3_and_note_exception(struct ex_regs *regs)
>>> {
>>> ++exceptions;
>>> --
>>> 1.7.9.5
>>
>>
>>
>> --
>> Arthur Chunqi Li
>> Department of Computer Science
>> School of EECS
>> Peking University
>> Beijing, China
>
> --
> Gleb.
^ permalink raw reply [flat|nested] 20+ messages in thread
* Re: [PATCH 1/2] kvm-unit-tests: Add a func to run instruction in emulator
2013-06-19 17:48 ` Gmail
@ 2013-06-20 5:42 ` Gleb Natapov
0 siblings, 0 replies; 20+ messages in thread
From: Gleb Natapov @ 2013-06-20 5:42 UTC (permalink / raw)
To: Gmail; +Cc: kvm, Paolo Bonzini, Jan Kiszka
On Thu, Jun 20, 2013 at 01:48:39AM +0800, Gmail wrote:
>
> 在 2013-6-20，0:03，Gleb Natapov <gleb@redhat.com> 写道：
>
> > On Wed, Jun 19, 2013 at 11:07:18PM +0800, 李春奇 <Arthur Chunqi Li> wrote:
> >> Hi Gleb,
> >> This version can set %rsp before trapping into emulator, because
> >> insn_page and alt_insn_page is statically defined and their relative
> >> position to (save) is fixed during execution.
> > The position of the code is not fixed during execution since you execute
> > it from a virtual address obtained dynamically by vmap() and the address
> > is definitely different from the one the code was compiled for, but if
> > you look at the code that compile actually produce you will see that it
> > uses absolute address to access "save" and this is why it works. I
> > wounder why compiler decided to use absolute address this time, Paolo?
> >
> >> In this way, test case of test_mmx_movq_mf needs to pre-define its own
> >> stack, this change is in the next patch.
> >>
> >> In this version, insn_ram is initially mapped to insn_page and them
> >> each call to insn_page/alt_insn_page are all via insn_ram. This trick
> >> runs well but I don't know why my previous version causes error.
> > Because previous version tried to use install_page() on a large page
> > mapped region and the function does not know how to handle that.
> I don't quite understand what you mean here. What is the differences between large page and 4k page in this test case?
Test assumes 4k page size.
> Maybe I don't understand the differences of install_pte() with 4k page and 2m pages.
May be. You cannot install 4k page in place of 2m page before breaking
the later to 512 4k pages.
--
Gleb.
^ permalink raw reply [flat|nested] 20+ messages in thread
* Re: [PATCH 2/2] kvm-unit-tests: Change two cases to use trap_emulator
2013-06-19 15:00 ` [PATCH 2/2] kvm-unit-tests: Change two cases to use trap_emulator Arthur Chunqi Li
@ 2013-06-20 8:25 ` Paolo Bonzini
0 siblings, 0 replies; 20+ messages in thread
From: Paolo Bonzini @ 2013-06-20 8:25 UTC (permalink / raw)
To: Arthur Chunqi Li; +Cc: kvm, gleb, jan.kiszka
Il 19/06/2013 17:00, Arthur Chunqi Li ha scritto:
> static void test_movabs(uint64_t *mem, uint8_t *insn_page,
> uint8_t *alt_insn_page, void *insn_ram)
> {
> - uint64_t val = 0;
> - ulong *cr3 = (ulong *)read_cr3();
> -
> - // Pad with RET instructions
> - memset(insn_page, 0xc3, 4096);
> - memset(alt_insn_page, 0xc3, 4096);
> - // Place a trapping instruction in the page to trigger a VMEXIT
> - insn_page[0] = 0x89; // mov %eax, (%rax)
> - insn_page[1] = 0x00;
> - // Place the instruction we want the hypervisor to see in the alternate
> - // page. A buggy hypervisor will fetch a 32-bit immediate and return
> - // 0xffffffffc3c3c3c3.
> - alt_insn_page[0] = 0x48; // mov $0xc3c3c3c3c3c3c3c3, %rcx
> - alt_insn_page[1] = 0xb9;
> -
> - // Load the code TLB with insn_page, but point the page tables at
> - // alt_insn_page (and keep the data TLB clear, for AMD decode assist).
> - // This will make the CPU trap on the insn_page instruction but the
> - // hypervisor will see alt_insn_page.
> - install_page(cr3, virt_to_phys(insn_page), insn_ram);
> - // Load code TLB
> - invlpg(insn_ram);
> - asm volatile("call *%0" : : "r"(insn_ram + 3));
> - // Trap, let hypervisor emulate at alt_insn_page
> - install_page(cr3, virt_to_phys(alt_insn_page), insn_ram);
> - asm volatile("call *%1" : "=c"(val) : "r"(insn_ram), "a"(mem), "c"(0));
> - report("64-bit mov imm", val == 0xc3c3c3c3c3c3c3c3);
> + // mov $0xc3c3c3c3c3c3c3c3, %rcx
> + uint8_t alt_insn[] = {0x48, 0xb9, 0xc3, 0xc3, 0xc3,
> + 0xc3, 0xc3, 0xc3, 0xc3, 0xc3};
> + inregs = (struct regs){ 0 };
> + trap_emulator(mem, alt_insn, 10);
> + report("64-bit mov imm2", outregs.rcx == 0xc3c3c3c3c3c3c3c3);
> }
0xc3 is ret and it may mess up the test case if the buggy hypervisor
sees it as
mov $0xc3c3c3c3, %rcx (sign extended, no such instruction exists)
ret
ret
ret
ret
I suggest changing it to 0x90 as part of this patch.
Paolo
^ permalink raw reply [flat|nested] 20+ messages in thread
* Re: [PATCH 1/2] kvm-unit-tests: Add a func to run instruction in emulator
2013-06-19 16:03 ` Gleb Natapov
2013-06-19 17:48 ` Gmail
@ 2013-06-20 8:29 ` Paolo Bonzini
2013-06-20 8:31 ` Gleb Natapov
1 sibling, 1 reply; 20+ messages in thread
From: Paolo Bonzini @ 2013-06-20 8:29 UTC (permalink / raw)
To: Gleb Natapov
Cc: "李春奇 <Arthur Chunqi Li>", kvm,
Jan Kiszka
Il 19/06/2013 18:03, Gleb Natapov ha scritto:
> On Wed, Jun 19, 2013 at 11:07:18PM +0800, 李春奇 <Arthur Chunqi Li> wrote:
>> Hi Gleb,
>> This version can set %rsp before trapping into emulator, because
>> insn_page and alt_insn_page is statically defined and their relative
>> position to (save) is fixed during execution.
>>
> The position of the code is not fixed during execution since you execute
> it from a virtual address obtained dynamically by vmap() and the address
> is definitely different from the one the code was compiled for, but if
> you look at the code that compile actually produce you will see that it
> uses absolute address to access "save" and this is why it works. I
> wounder why compiler decided to use absolute address this time, Paolo?
Because he's using assembly with operands that he wrote himself. Before
he was using "m" and the compiler decided to express the memory operand
as "save(%rip)".
The assembler then emits different opcodes (of course) and also
different relocations. In the current code, it tells the linker to
place an absolute address. In the previous one, it tells the linker to
place a delta from %rip.
Paolo
>> In this way, test case of test_mmx_movq_mf needs to pre-define its own
>> stack, this change is in the next patch.
>>
>> In this version, insn_ram is initially mapped to insn_page and them
>> each call to insn_page/alt_insn_page are all via insn_ram. This trick
>> runs well but I don't know why my previous version causes error.
>>
> Because previous version tried to use install_page() on a large page
> mapped region and the function does not know how to handle that.
>
>> Arthur.
>> On Wed, Jun 19, 2013 at 11:00 PM, Arthur Chunqi Li <yzt356@gmail.com> wrote:
>>> Add a function trap_emulator to run an instruction in emulator.
>>> Set inregs first (%rax is invalid because it is used as return
>>> address), put instruction codec in alt_insn and call func with
>>> alt_insn_length. Get results in outregs.
>>>
>>> Signed-off-by: Arthur Chunqi Li <yzt356@gmail.com>
>>> ---
>>> x86/emulator.c | 110 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++
>>> 1 file changed, 110 insertions(+)
>>> mode change 100644 => 100755 x86/emulator.c
>>>
>>> diff --git a/x86/emulator.c b/x86/emulator.c
>>> old mode 100644
>>> new mode 100755
>>> index 96576e5..48d45c8
>>> --- a/x86/emulator.c
>>> +++ b/x86/emulator.c
>>> @@ -11,6 +11,15 @@ int fails, tests;
>>>
>>> static int exceptions;
>>>
>>> +struct regs {
>>> + u64 rax, rbx, rcx, rdx;
>>> + u64 rsi, rdi, rsp, rbp;
>>> + u64 r8, r9, r10, r11;
>>> + u64 r12, r13, r14, r15;
>>> + u64 rip, rflags;
>>> +};
>>> +struct regs inregs, outregs, save;
>>> +
>>> void report(const char *name, int result)
>>> {
>>> ++tests;
>>> @@ -685,6 +694,107 @@ static void test_shld_shrd(u32 *mem)
>>> report("shrd (cl)", *mem == ((0x12345678 >> 3) | (5u << 29)));
>>> }
>>>
>>> +#define INSN_SAVE \
>>> + "ret\n\t" \
>>> + "pushf\n\t" \
>>> + "push 136+save \n\t" \
>>> + "popf \n\t" \
>>> + "xchg %rax, 0+save \n\t" \
>>> + "xchg %rbx, 8+save \n\t" \
>>> + "xchg %rcx, 16+save \n\t" \
>>> + "xchg %rdx, 24+save \n\t" \
>>> + "xchg %rsi, 32+save \n\t" \
>>> + "xchg %rdi, 40+save \n\t" \
>>> + "xchg %rsp, 48+save \n\t" \
>>> + "xchg %rbp, 56+save \n\t" \
>>> + "xchg %r8, 64+save \n\t" \
>>> + "xchg %r9, 72+save \n\t" \
>>> + "xchg %r10, 80+save \n\t" \
>>> + "xchg %r11, 88+save \n\t" \
>>> + "xchg %r12, 96+save \n\t" \
>>> + "xchg %r13, 104+save \n\t" \
>>> + "xchg %r14, 112+save \n\t" \
>>> + "xchg %r15, 120+save \n\t" \
>>> +
>>> +#define INSN_RESTORE \
>>> + "xchg %rax, 0+save \n\t" \
>>> + "xchg %rbx, 8+save \n\t" \
>>> + "xchg %rcx, 16+save \n\t" \
>>> + "xchg %rdx, 24+save \n\t" \
>>> + "xchg %rsi, 32+save \n\t" \
>>> + "xchg %rdi, 40+save \n\t" \
>>> + "xchg %rsp, 48+save \n\t" \
>>> + "xchg %rbp, 56+save \n\t" \
>>> + "xchg %r8, 64+save \n\t" \
>>> + "xchg %r9, 72+save \n\t" \
>>> + "xchg %r10, 80+save \n\t" \
>>> + "xchg %r11, 88+save \n\t" \
>>> + "xchg %r12, 96+save \n\t" \
>>> + "xchg %r13, 104+save \n\t" \
>>> + "xchg %r14, 112+save \n\t" \
>>> + "xchg %r15, 120+save \n\t" \
>>> + "pushf \n\t" \
>>> + "pop 136+save \n\t" \
>>> + "popf \n\t" \
>>> + "ret \n\t" \
>>> +
>>> +#define INSN_TRAP \
>>> + "in (%dx),%al\n\t" \
>>> + ". = . + 31\n\t" \
>>> +
>>> +asm(
>>> + ".align 4096\n\t"
>>> + "insn_page:\n\t"
>>> + INSN_SAVE
>>> + "test_insn:\n\t"
>>> + INSN_TRAP
>>> + "test_insn_end:\n\t"
>>> + INSN_RESTORE
>>> + "insn_page_end:\n\t"
>>> + ".align 4096\n\t"
>>> +
>>> + "alt_insn_page:\n\t"
>>> + INSN_SAVE
>>> + "alt_test_insn:\n\t"
>>> + INSN_TRAP
>>> + "alt_test_insn_end:\n\t"
>>> + INSN_RESTORE
>>> + "alt_insn_page_end:\n\t"
>>> + ".align 4096\n\t"
>>> +);
>>> +
>>> +static void trap_emulator(uint64_t *mem, uint8_t* alt_insn, int alt_insn_length)
>>> +{
>>> + ulong *cr3 = (ulong *)read_cr3();
>>> + void *insn_ram;
>>> + int i;
>>> + extern u8 insn_page[], test_insn[], test_insn_end[];
>>> + extern u8 alt_insn_page[], alt_test_insn[];
>>> +
>>> + insn_ram = vmap(virt_to_phys(insn_page), 4096);
>>> + for (i=1; i<test_insn_end - test_insn; i++)
>>> + alt_test_insn[i] = test_insn[i] = 0x90; // nop
>>> + for (i=0; i<alt_insn_length; i++)
>>> + alt_test_insn[i] = alt_insn[i];
>>> + for(;i<test_insn_end - test_insn; i++)
>>> + alt_test_insn[i] = 0x90; // nop
>>> + save = inregs;
>>> +
>>> + // Load the code TLB with insn_page, but point the page tables at
>>> + // alt_insn_page (and keep the data TLB clear, for AMD decode assist).
>>> + // This will make the CPU trap on the insn_page instruction but the
>>> + // hypervisor will see alt_insn_page.
>>> + install_page(cr3, virt_to_phys(insn_page), insn_ram);
>>> + invlpg(insn_ram);
>>> + // Load code TLB
>>> + asm volatile("call *%0" : : "r"(insn_ram));
>>> + install_page(cr3, virt_to_phys(alt_insn_page), insn_ram);
>>> + // Trap, let hypervisor emulate at alt_insn_page
>>> + asm volatile("call *%0": : "r"(insn_ram+1));
>>> +
>>> + outregs = save;
>>> +}
>>> +
>>> static void advance_rip_by_3_and_note_exception(struct ex_regs *regs)
>>> {
>>> ++exceptions;
>>> --
>>> 1.7.9.5
>>>
>>
>>
>>
>> --
>> Arthur Chunqi Li
>> Department of Computer Science
>> School of EECS
>> Peking University
>> Beijing, China
>
> --
> Gleb.
> --
> To unsubscribe from this list: send the line "unsubscribe kvm" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at http://vger.kernel.org/majordomo-info.html
>
^ permalink raw reply [flat|nested] 20+ messages in thread
* Re: [PATCH 1/2] kvm-unit-tests: Add a func to run instruction in emulator
2013-06-20 8:29 ` Paolo Bonzini
@ 2013-06-20 8:31 ` Gleb Natapov
0 siblings, 0 replies; 20+ messages in thread
From: Gleb Natapov @ 2013-06-20 8:31 UTC (permalink / raw)
To: Paolo Bonzini
Cc: "李春奇 <Arthur Chunqi Li>", kvm,
Jan Kiszka
On Thu, Jun 20, 2013 at 10:29:42AM +0200, Paolo Bonzini wrote:
> Il 19/06/2013 18:03, Gleb Natapov ha scritto:
> > On Wed, Jun 19, 2013 at 11:07:18PM +0800, 李春奇 <Arthur Chunqi Li> wrote:
> >> Hi Gleb,
> >> This version can set %rsp before trapping into emulator, because
> >> insn_page and alt_insn_page is statically defined and their relative
> >> position to (save) is fixed during execution.
> >>
> > The position of the code is not fixed during execution since you execute
> > it from a virtual address obtained dynamically by vmap() and the address
> > is definitely different from the one the code was compiled for, but if
> > you look at the code that compile actually produce you will see that it
> > uses absolute address to access "save" and this is why it works. I
> > wounder why compiler decided to use absolute address this time, Paolo?
>
> Because he's using assembly with operands that he wrote himself. Before
> he was using "m" and the compiler decided to express the memory operand
> as "save(%rip)".
>
> The assembler then emits different opcodes (of course) and also
> different relocations. In the current code, it tells the linker to
> place an absolute address. In the previous one, it tells the linker to
> place a delta from %rip.
>
Heh, make sense. OK, so we will go with that. Will comment on the patch
itself.
> Paolo
>
> >> In this way, test case of test_mmx_movq_mf needs to pre-define its own
> >> stack, this change is in the next patch.
> >>
> >> In this version, insn_ram is initially mapped to insn_page and them
> >> each call to insn_page/alt_insn_page are all via insn_ram. This trick
> >> runs well but I don't know why my previous version causes error.
> >>
> > Because previous version tried to use install_page() on a large page
> > mapped region and the function does not know how to handle that.
> >
> >> Arthur.
> >> On Wed, Jun 19, 2013 at 11:00 PM, Arthur Chunqi Li <yzt356@gmail.com> wrote:
> >>> Add a function trap_emulator to run an instruction in emulator.
> >>> Set inregs first (%rax is invalid because it is used as return
> >>> address), put instruction codec in alt_insn and call func with
> >>> alt_insn_length. Get results in outregs.
> >>>
> >>> Signed-off-by: Arthur Chunqi Li <yzt356@gmail.com>
> >>> ---
> >>> x86/emulator.c | 110 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++
> >>> 1 file changed, 110 insertions(+)
> >>> mode change 100644 => 100755 x86/emulator.c
> >>>
> >>> diff --git a/x86/emulator.c b/x86/emulator.c
> >>> old mode 100644
> >>> new mode 100755
> >>> index 96576e5..48d45c8
> >>> --- a/x86/emulator.c
> >>> +++ b/x86/emulator.c
> >>> @@ -11,6 +11,15 @@ int fails, tests;
> >>>
> >>> static int exceptions;
> >>>
> >>> +struct regs {
> >>> + u64 rax, rbx, rcx, rdx;
> >>> + u64 rsi, rdi, rsp, rbp;
> >>> + u64 r8, r9, r10, r11;
> >>> + u64 r12, r13, r14, r15;
> >>> + u64 rip, rflags;
> >>> +};
> >>> +struct regs inregs, outregs, save;
> >>> +
> >>> void report(const char *name, int result)
> >>> {
> >>> ++tests;
> >>> @@ -685,6 +694,107 @@ static void test_shld_shrd(u32 *mem)
> >>> report("shrd (cl)", *mem == ((0x12345678 >> 3) | (5u << 29)));
> >>> }
> >>>
> >>> +#define INSN_SAVE \
> >>> + "ret\n\t" \
> >>> + "pushf\n\t" \
> >>> + "push 136+save \n\t" \
> >>> + "popf \n\t" \
> >>> + "xchg %rax, 0+save \n\t" \
> >>> + "xchg %rbx, 8+save \n\t" \
> >>> + "xchg %rcx, 16+save \n\t" \
> >>> + "xchg %rdx, 24+save \n\t" \
> >>> + "xchg %rsi, 32+save \n\t" \
> >>> + "xchg %rdi, 40+save \n\t" \
> >>> + "xchg %rsp, 48+save \n\t" \
> >>> + "xchg %rbp, 56+save \n\t" \
> >>> + "xchg %r8, 64+save \n\t" \
> >>> + "xchg %r9, 72+save \n\t" \
> >>> + "xchg %r10, 80+save \n\t" \
> >>> + "xchg %r11, 88+save \n\t" \
> >>> + "xchg %r12, 96+save \n\t" \
> >>> + "xchg %r13, 104+save \n\t" \
> >>> + "xchg %r14, 112+save \n\t" \
> >>> + "xchg %r15, 120+save \n\t" \
> >>> +
> >>> +#define INSN_RESTORE \
> >>> + "xchg %rax, 0+save \n\t" \
> >>> + "xchg %rbx, 8+save \n\t" \
> >>> + "xchg %rcx, 16+save \n\t" \
> >>> + "xchg %rdx, 24+save \n\t" \
> >>> + "xchg %rsi, 32+save \n\t" \
> >>> + "xchg %rdi, 40+save \n\t" \
> >>> + "xchg %rsp, 48+save \n\t" \
> >>> + "xchg %rbp, 56+save \n\t" \
> >>> + "xchg %r8, 64+save \n\t" \
> >>> + "xchg %r9, 72+save \n\t" \
> >>> + "xchg %r10, 80+save \n\t" \
> >>> + "xchg %r11, 88+save \n\t" \
> >>> + "xchg %r12, 96+save \n\t" \
> >>> + "xchg %r13, 104+save \n\t" \
> >>> + "xchg %r14, 112+save \n\t" \
> >>> + "xchg %r15, 120+save \n\t" \
> >>> + "pushf \n\t" \
> >>> + "pop 136+save \n\t" \
> >>> + "popf \n\t" \
> >>> + "ret \n\t" \
> >>> +
> >>> +#define INSN_TRAP \
> >>> + "in (%dx),%al\n\t" \
> >>> + ". = . + 31\n\t" \
> >>> +
> >>> +asm(
> >>> + ".align 4096\n\t"
> >>> + "insn_page:\n\t"
> >>> + INSN_SAVE
> >>> + "test_insn:\n\t"
> >>> + INSN_TRAP
> >>> + "test_insn_end:\n\t"
> >>> + INSN_RESTORE
> >>> + "insn_page_end:\n\t"
> >>> + ".align 4096\n\t"
> >>> +
> >>> + "alt_insn_page:\n\t"
> >>> + INSN_SAVE
> >>> + "alt_test_insn:\n\t"
> >>> + INSN_TRAP
> >>> + "alt_test_insn_end:\n\t"
> >>> + INSN_RESTORE
> >>> + "alt_insn_page_end:\n\t"
> >>> + ".align 4096\n\t"
> >>> +);
> >>> +
> >>> +static void trap_emulator(uint64_t *mem, uint8_t* alt_insn, int alt_insn_length)
> >>> +{
> >>> + ulong *cr3 = (ulong *)read_cr3();
> >>> + void *insn_ram;
> >>> + int i;
> >>> + extern u8 insn_page[], test_insn[], test_insn_end[];
> >>> + extern u8 alt_insn_page[], alt_test_insn[];
> >>> +
> >>> + insn_ram = vmap(virt_to_phys(insn_page), 4096);
> >>> + for (i=1; i<test_insn_end - test_insn; i++)
> >>> + alt_test_insn[i] = test_insn[i] = 0x90; // nop
> >>> + for (i=0; i<alt_insn_length; i++)
> >>> + alt_test_insn[i] = alt_insn[i];
> >>> + for(;i<test_insn_end - test_insn; i++)
> >>> + alt_test_insn[i] = 0x90; // nop
> >>> + save = inregs;
> >>> +
> >>> + // Load the code TLB with insn_page, but point the page tables at
> >>> + // alt_insn_page (and keep the data TLB clear, for AMD decode assist).
> >>> + // This will make the CPU trap on the insn_page instruction but the
> >>> + // hypervisor will see alt_insn_page.
> >>> + install_page(cr3, virt_to_phys(insn_page), insn_ram);
> >>> + invlpg(insn_ram);
> >>> + // Load code TLB
> >>> + asm volatile("call *%0" : : "r"(insn_ram));
> >>> + install_page(cr3, virt_to_phys(alt_insn_page), insn_ram);
> >>> + // Trap, let hypervisor emulate at alt_insn_page
> >>> + asm volatile("call *%0": : "r"(insn_ram+1));
> >>> +
> >>> + outregs = save;
> >>> +}
> >>> +
> >>> static void advance_rip_by_3_and_note_exception(struct ex_regs *regs)
> >>> {
> >>> ++exceptions;
> >>> --
> >>> 1.7.9.5
> >>>
> >>
> >>
> >>
> >> --
> >> Arthur Chunqi Li
> >> Department of Computer Science
> >> School of EECS
> >> Peking University
> >> Beijing, China
> >
> > --
> > Gleb.
> > --
> > To unsubscribe from this list: send the line "unsubscribe kvm" in
> > the body of a message to majordomo@vger.kernel.org
> > More majordomo info at http://vger.kernel.org/majordomo-info.html
> >
--
Gleb.
^ permalink raw reply [flat|nested] 20+ messages in thread
* Re: [PATCH 1/2] kvm-unit-tests: Add a func to run instruction in emulator
2013-06-19 15:00 [PATCH 1/2] kvm-unit-tests: Add a func to run instruction in emulator Arthur Chunqi Li
2013-06-19 15:00 ` [PATCH 2/2] kvm-unit-tests: Change two cases to use trap_emulator Arthur Chunqi Li
2013-06-19 15:07 ` [PATCH 1/2] kvm-unit-tests: Add a func to run instruction in emulator 李春奇 <Arthur Chunqi Li>
@ 2013-06-20 8:48 ` Gleb Natapov
2013-06-20 8:58 ` Gmail
2 siblings, 1 reply; 20+ messages in thread
From: Gleb Natapov @ 2013-06-20 8:48 UTC (permalink / raw)
To: Arthur Chunqi Li; +Cc: kvm, pbonzini, jan.kiszka
On Wed, Jun 19, 2013 at 11:00:56PM +0800, Arthur Chunqi Li wrote:
> Add a function trap_emulator to run an instruction in emulator.
> Set inregs first (%rax is invalid because it is used as return
> address), put instruction codec in alt_insn and call func with
> alt_insn_length. Get results in outregs.
>
> Signed-off-by: Arthur Chunqi Li <yzt356@gmail.com>
> ---
> x86/emulator.c | 110 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++
> 1 file changed, 110 insertions(+)
> mode change 100644 => 100755 x86/emulator.c
>
> diff --git a/x86/emulator.c b/x86/emulator.c
> old mode 100644
> new mode 100755
> index 96576e5..48d45c8
> --- a/x86/emulator.c
> +++ b/x86/emulator.c
> @@ -11,6 +11,15 @@ int fails, tests;
>
> static int exceptions;
>
> +struct regs {
> + u64 rax, rbx, rcx, rdx;
> + u64 rsi, rdi, rsp, rbp;
> + u64 r8, r9, r10, r11;
> + u64 r12, r13, r14, r15;
> + u64 rip, rflags;
> +};
> +struct regs inregs, outregs, save;
> +
> void report(const char *name, int result)
> {
> ++tests;
> @@ -685,6 +694,107 @@ static void test_shld_shrd(u32 *mem)
> report("shrd (cl)", *mem == ((0x12345678 >> 3) | (5u << 29)));
> }
>
> +#define INSN_SAVE \
No need for all the defines. Put all the code into insn_page, allocate
alt_insn_page dynamically and copy the code there by memcpy.
> + "ret\n\t" \
> + "pushf\n\t" \
> + "push 136+save \n\t" \
> + "popf \n\t" \
> + "xchg %rax, 0+save \n\t" \
> + "xchg %rbx, 8+save \n\t" \
> + "xchg %rcx, 16+save \n\t" \
> + "xchg %rdx, 24+save \n\t" \
> + "xchg %rsi, 32+save \n\t" \
> + "xchg %rdi, 40+save \n\t" \
> + "xchg %rsp, 48+save \n\t" \
> + "xchg %rbp, 56+save \n\t" \
> + "xchg %r8, 64+save \n\t" \
> + "xchg %r9, 72+save \n\t" \
> + "xchg %r10, 80+save \n\t" \
> + "xchg %r11, 88+save \n\t" \
> + "xchg %r12, 96+save \n\t" \
> + "xchg %r13, 104+save \n\t" \
> + "xchg %r14, 112+save \n\t" \
> + "xchg %r15, 120+save \n\t" \
> +
> +#define INSN_RESTORE \
> + "xchg %rax, 0+save \n\t" \
> + "xchg %rbx, 8+save \n\t" \
> + "xchg %rcx, 16+save \n\t" \
> + "xchg %rdx, 24+save \n\t" \
> + "xchg %rsi, 32+save \n\t" \
> + "xchg %rdi, 40+save \n\t" \
> + "xchg %rsp, 48+save \n\t" \
> + "xchg %rbp, 56+save \n\t" \
> + "xchg %r8, 64+save \n\t" \
> + "xchg %r9, 72+save \n\t" \
> + "xchg %r10, 80+save \n\t" \
> + "xchg %r11, 88+save \n\t" \
> + "xchg %r12, 96+save \n\t" \
> + "xchg %r13, 104+save \n\t" \
> + "xchg %r14, 112+save \n\t" \
> + "xchg %r15, 120+save \n\t" \
> + "pushf \n\t" \
> + "pop 136+save \n\t" \
> + "popf \n\t" \
> + "ret \n\t" \
> +
> +#define INSN_TRAP \
> + "in (%dx),%al\n\t" \
> + ". = . + 31\n\t" \
If you will do ".skip 31, 0x90\n\t" instead you can drop loop
that inserts nops bellow.
> +
> +asm(
> + ".align 4096\n\t"
> + "insn_page:\n\t"
> + INSN_SAVE
> + "test_insn:\n\t"
> + INSN_TRAP
> + "test_insn_end:\n\t"
> + INSN_RESTORE
> + "insn_page_end:\n\t"
> + ".align 4096\n\t"
> +
> + "alt_insn_page:\n\t"
> + INSN_SAVE
> + "alt_test_insn:\n\t"
> + INSN_TRAP
> + "alt_test_insn_end:\n\t"
> + INSN_RESTORE
> + "alt_insn_page_end:\n\t"
> + ".align 4096\n\t"
> +);
> +
> +static void trap_emulator(uint64_t *mem, uint8_t* alt_insn, int alt_insn_length)
> +{
> + ulong *cr3 = (ulong *)read_cr3();
> + void *insn_ram;
> + int i;
> + extern u8 insn_page[], test_insn[], test_insn_end[];
> + extern u8 alt_insn_page[], alt_test_insn[];
> +
> + insn_ram = vmap(virt_to_phys(insn_page), 4096);
> + for (i=1; i<test_insn_end - test_insn; i++)
> + alt_test_insn[i] = test_insn[i] = 0x90; // nop
> + for (i=0; i<alt_insn_length; i++)
> + alt_test_insn[i] = alt_insn[i];
> + for(;i<test_insn_end - test_insn; i++)
> + alt_test_insn[i] = 0x90; // nop
> + save = inregs;
> +
> + // Load the code TLB with insn_page, but point the page tables at
> + // alt_insn_page (and keep the data TLB clear, for AMD decode assist).
> + // This will make the CPU trap on the insn_page instruction but the
> + // hypervisor will see alt_insn_page.
I prefer all the comments to be changed to /**/ style while we are at it.
> + install_page(cr3, virt_to_phys(insn_page), insn_ram);
> + invlpg(insn_ram);
> + // Load code TLB
> + asm volatile("call *%0" : : "r"(insn_ram));
> + install_page(cr3, virt_to_phys(alt_insn_page), insn_ram);
> + // Trap, let hypervisor emulate at alt_insn_page
> + asm volatile("call *%0": : "r"(insn_ram+1));
> +
> + outregs = save;
> +}
> +
> static void advance_rip_by_3_and_note_exception(struct ex_regs *regs)
> {
> ++exceptions;
> --
> 1.7.9.5
--
Gleb.
^ permalink raw reply [flat|nested] 20+ messages in thread
* Re: [PATCH 1/2] kvm-unit-tests: Add a func to run instruction in emulator
2013-06-20 8:48 ` Gleb Natapov
@ 2013-06-20 8:58 ` Gmail
0 siblings, 0 replies; 20+ messages in thread
From: Gmail @ 2013-06-20 8:58 UTC (permalink / raw)
To: Gleb Natapov; +Cc: kvm@vger.kernel.org, pbonzini@redhat.com, jan.kiszka@web.de
ok, I will handle all above in the following commit.
Arthur Chunqi Li
Department of Computer Science
School of EECS
Peking University
Beijing, China
From my iPhone
在 2013-6-20，16:48，Gleb Natapov <gleb@redhat.com> 写道：
> On Wed, Jun 19, 2013 at 11:00:56PM +0800, Arthur Chunqi Li wrote:
>> Add a function trap_emulator to run an instruction in emulator.
>> Set inregs first (%rax is invalid because it is used as return
>> address), put instruction codec in alt_insn and call func with
>> alt_insn_length. Get results in outregs.
>>
>> Signed-off-by: Arthur Chunqi Li <yzt356@gmail.com>
>> ---
>> x86/emulator.c | 110 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++
>> 1 file changed, 110 insertions(+)
>> mode change 100644 => 100755 x86/emulator.c
>>
>> diff --git a/x86/emulator.c b/x86/emulator.c
>> old mode 100644
>> new mode 100755
>> index 96576e5..48d45c8
>> --- a/x86/emulator.c
>> +++ b/x86/emulator.c
>> @@ -11,6 +11,15 @@ int fails, tests;
>>
>> static int exceptions;
>>
>> +struct regs {
>> + u64 rax, rbx, rcx, rdx;
>> + u64 rsi, rdi, rsp, rbp;
>> + u64 r8, r9, r10, r11;
>> + u64 r12, r13, r14, r15;
>> + u64 rip, rflags;
>> +};
>> +struct regs inregs, outregs, save;
>> +
>> void report(const char *name, int result)
>> {
>> ++tests;
>> @@ -685,6 +694,107 @@ static void test_shld_shrd(u32 *mem)
>> report("shrd (cl)", *mem == ((0x12345678 >> 3) | (5u << 29)));
>> }
>>
>> +#define INSN_SAVE \
> No need for all the defines. Put all the code into insn_page, allocate
> alt_insn_page dynamically and copy the code there by memcpy.
>
>> + "ret\n\t" \
>> + "pushf\n\t" \
>> + "push 136+save \n\t" \
>> + "popf \n\t" \
>> + "xchg %rax, 0+save \n\t" \
>> + "xchg %rbx, 8+save \n\t" \
>> + "xchg %rcx, 16+save \n\t" \
>> + "xchg %rdx, 24+save \n\t" \
>> + "xchg %rsi, 32+save \n\t" \
>> + "xchg %rdi, 40+save \n\t" \
>> + "xchg %rsp, 48+save \n\t" \
>> + "xchg %rbp, 56+save \n\t" \
>> + "xchg %r8, 64+save \n\t" \
>> + "xchg %r9, 72+save \n\t" \
>> + "xchg %r10, 80+save \n\t" \
>> + "xchg %r11, 88+save \n\t" \
>> + "xchg %r12, 96+save \n\t" \
>> + "xchg %r13, 104+save \n\t" \
>> + "xchg %r14, 112+save \n\t" \
>> + "xchg %r15, 120+save \n\t" \
>> +
>> +#define INSN_RESTORE \
>> + "xchg %rax, 0+save \n\t" \
>> + "xchg %rbx, 8+save \n\t" \
>> + "xchg %rcx, 16+save \n\t" \
>> + "xchg %rdx, 24+save \n\t" \
>> + "xchg %rsi, 32+save \n\t" \
>> + "xchg %rdi, 40+save \n\t" \
>> + "xchg %rsp, 48+save \n\t" \
>> + "xchg %rbp, 56+save \n\t" \
>> + "xchg %r8, 64+save \n\t" \
>> + "xchg %r9, 72+save \n\t" \
>> + "xchg %r10, 80+save \n\t" \
>> + "xchg %r11, 88+save \n\t" \
>> + "xchg %r12, 96+save \n\t" \
>> + "xchg %r13, 104+save \n\t" \
>> + "xchg %r14, 112+save \n\t" \
>> + "xchg %r15, 120+save \n\t" \
>> + "pushf \n\t" \
>> + "pop 136+save \n\t" \
>> + "popf \n\t" \
>> + "ret \n\t" \
>> +
>> +#define INSN_TRAP \
>> + "in (%dx),%al\n\t" \
>> + ". = . + 31\n\t" \
> If you will do ".skip 31, 0x90\n\t" instead you can drop loop
> that inserts nops bellow.
>
>> +
>> +asm(
>> + ".align 4096\n\t"
>> + "insn_page:\n\t"
>> + INSN_SAVE
>> + "test_insn:\n\t"
>> + INSN_TRAP
>> + "test_insn_end:\n\t"
>> + INSN_RESTORE
>> + "insn_page_end:\n\t"
>> + ".align 4096\n\t"
>> +
>> + "alt_insn_page:\n\t"
>> + INSN_SAVE
>> + "alt_test_insn:\n\t"
>> + INSN_TRAP
>> + "alt_test_insn_end:\n\t"
>> + INSN_RESTORE
>> + "alt_insn_page_end:\n\t"
>> + ".align 4096\n\t"
>> +);
>> +
>> +static void trap_emulator(uint64_t *mem, uint8_t* alt_insn, int alt_insn_length)
>> +{
>> + ulong *cr3 = (ulong *)read_cr3();
>> + void *insn_ram;
>> + int i;
>> + extern u8 insn_page[], test_insn[], test_insn_end[];
>> + extern u8 alt_insn_page[], alt_test_insn[];
>> +
>> + insn_ram = vmap(virt_to_phys(insn_page), 4096);
>> + for (i=1; i<test_insn_end - test_insn; i++)
>> + alt_test_insn[i] = test_insn[i] = 0x90; // nop
>> + for (i=0; i<alt_insn_length; i++)
>> + alt_test_insn[i] = alt_insn[i];
>> + for(;i<test_insn_end - test_insn; i++)
>> + alt_test_insn[i] = 0x90; // nop
>> + save = inregs;
>> +
>> + // Load the code TLB with insn_page, but point the page tables at
>> + // alt_insn_page (and keep the data TLB clear, for AMD decode assist).
>> + // This will make the CPU trap on the insn_page instruction but the
>> + // hypervisor will see alt_insn_page.
> I prefer all the comments to be changed to /**/ style while we are at it.
>
>> + install_page(cr3, virt_to_phys(insn_page), insn_ram);
>> + invlpg(insn_ram);
>> + // Load code TLB
>> + asm volatile("call *%0" : : "r"(insn_ram));
>> + install_page(cr3, virt_to_phys(alt_insn_page), insn_ram);
>> + // Trap, let hypervisor emulate at alt_insn_page
>> + asm volatile("call *%0": : "r"(insn_ram+1));
>> +
>> + outregs = save;
>> +}
>> +
>> static void advance_rip_by_3_and_note_exception(struct ex_regs *regs)
>> {
>> ++exceptions;
>> --
>> 1.7.9.5
>
> --
> Gleb.
^ permalink raw reply [flat|nested] 20+ messages in thread
* [PATCH 2/2] kvm-unit-tests: Change two cases to use trap_emulator
2013-06-20 10:45 Arthur Chunqi Li
@ 2013-06-20 10:45 ` Arthur Chunqi Li
2013-06-20 12:33 ` Gleb Natapov
0 siblings, 1 reply; 20+ messages in thread
From: Arthur Chunqi Li @ 2013-06-20 10:45 UTC (permalink / raw)
To: kvm; +Cc: gleb, pbonzini, jan.kiszka, Arthur Chunqi Li
Change two functions (test_mmx_movq_mf and test_movabs) using
unified trap_emulator.
Signed-off-by: Arthur Chunqi Li <yzt356@gmail.com>
---
x86/emulator.c | 70 ++++++++++++--------------------------------------------
1 file changed, 15 insertions(+), 55 deletions(-)
diff --git a/x86/emulator.c b/x86/emulator.c
index b3626fa..16d63e0 100644
--- a/x86/emulator.c
+++ b/x86/emulator.c
@@ -772,38 +772,19 @@ static void advance_rip_by_3_and_note_exception(struct ex_regs *regs)
static void test_mmx_movq_mf(uint64_t *mem, uint8_t *insn_page,
uint8_t *alt_insn_page, void *insn_ram)
{
- uint16_t fcw = 0; // all exceptions unmasked
- ulong *cr3 = (ulong *)read_cr3();
-
- write_cr0(read_cr0() & ~6); // TS, EM
- // Place a trapping instruction in the page to trigger a VMEXIT
- insn_page[0] = 0x89; // mov %eax, (%rax)
- insn_page[1] = 0x00;
- insn_page[2] = 0x90; // nop
- insn_page[3] = 0xc3; // ret
- // Place the instruction we want the hypervisor to see in the alternate page
- alt_insn_page[0] = 0x0f; // movq %mm0, (%rax)
- alt_insn_page[1] = 0x7f;
- alt_insn_page[2] = 0x00;
- alt_insn_page[3] = 0xc3; // ret
+ uint16_t fcw = 0; /* all exceptions unmasked */
+ u8 alt_insn[] = {0x0f, 0x7f, 0x00}; /* movq %mm0, (%rax) */
+ void *stack = alloc_page();
+ write_cr0(read_cr0() & ~6); /* TS, EM */
exceptions = 0;
handle_exception(MF_VECTOR, advance_rip_by_3_and_note_exception);
-
- // Load the code TLB with insn_page, but point the page tables at
- // alt_insn_page (and keep the data TLB clear, for AMD decode assist).
- // This will make the CPU trap on the insn_page instruction but the
- // hypervisor will see alt_insn_page.
- install_page(cr3, virt_to_phys(insn_page), insn_ram);
asm volatile("fninit; fldcw %0" : : "m"(fcw));
- asm volatile("fldz; fldz; fdivp"); // generate exception
- invlpg(insn_ram);
- // Load code TLB
- asm volatile("call *%0" : : "r"(insn_ram + 3));
- install_page(cr3, virt_to_phys(alt_insn_page), insn_ram);
- // Trap, let hypervisor emulate at alt_insn_page
- asm volatile("call *%0" : : "r"(insn_ram), "a"(mem));
- // exit MMX mode
+ asm volatile("fldz; fldz; fdivp"); /* generate exception */
+
+ inregs = (struct regs){ .rsp=(u64)stack+1024 };
+ trap_emulator(mem, alt_insn, 3);
+ /* exit MMX mode */
asm volatile("fnclex; emms");
report("movq mmx generates #MF", exceptions == 1);
handle_exception(MF_VECTOR, 0);
@@ -812,33 +793,12 @@ static void test_mmx_movq_mf(uint64_t *mem, uint8_t *insn_page,
static void test_movabs(uint64_t *mem, uint8_t *insn_page,
uint8_t *alt_insn_page, void *insn_ram)
{
- uint64_t val = 0;
- ulong *cr3 = (ulong *)read_cr3();
-
- // Pad with RET instructions
- memset(insn_page, 0xc3, 4096);
- memset(alt_insn_page, 0xc3, 4096);
- // Place a trapping instruction in the page to trigger a VMEXIT
- insn_page[0] = 0x89; // mov %eax, (%rax)
- insn_page[1] = 0x00;
- // Place the instruction we want the hypervisor to see in the alternate
- // page. A buggy hypervisor will fetch a 32-bit immediate and return
- // 0xffffffffc3c3c3c3.
- alt_insn_page[0] = 0x48; // mov $0xc3c3c3c3c3c3c3c3, %rcx
- alt_insn_page[1] = 0xb9;
-
- // Load the code TLB with insn_page, but point the page tables at
- // alt_insn_page (and keep the data TLB clear, for AMD decode assist).
- // This will make the CPU trap on the insn_page instruction but the
- // hypervisor will see alt_insn_page.
- install_page(cr3, virt_to_phys(insn_page), insn_ram);
- // Load code TLB
- invlpg(insn_ram);
- asm volatile("call *%0" : : "r"(insn_ram + 3));
- // Trap, let hypervisor emulate at alt_insn_page
- install_page(cr3, virt_to_phys(alt_insn_page), insn_ram);
- asm volatile("call *%1" : "=c"(val) : "r"(insn_ram), "a"(mem), "c"(0));
- report("64-bit mov imm", val == 0xc3c3c3c3c3c3c3c3);
+ /* mov $0x9090909090909090, %rcx */
+ uint8_t alt_insn[] = {0x48, 0xb9, 0x90, 0x90, 0x90,
+ 0x90, 0x90, 0x90, 0x90, 0x90};
+ inregs = (struct regs){ 0 };
+ trap_emulator(mem, alt_insn, 10);
+ report("64-bit mov imm2", outregs.rcx == 0x9090909090909090);
}
static void test_crosspage_mmio(volatile uint8_t *mem)
--
1.7.9.5
^ permalink raw reply related [flat|nested] 20+ messages in thread
* Re: [PATCH 2/2] kvm-unit-tests: Change two cases to use trap_emulator
2013-06-20 10:45 ` [PATCH 2/2] kvm-unit-tests: Change two cases to use trap_emulator Arthur Chunqi Li
@ 2013-06-20 12:33 ` Gleb Natapov
0 siblings, 0 replies; 20+ messages in thread
From: Gleb Natapov @ 2013-06-20 12:33 UTC (permalink / raw)
To: Arthur Chunqi Li; +Cc: kvm, pbonzini, jan.kiszka
On Thu, Jun 20, 2013 at 06:45:22PM +0800, Arthur Chunqi Li wrote:
> Change two functions (test_mmx_movq_mf and test_movabs) using
> unified trap_emulator.
>
> Signed-off-by: Arthur Chunqi Li <yzt356@gmail.com>
> ---
> x86/emulator.c | 70 ++++++++++++--------------------------------------------
> 1 file changed, 15 insertions(+), 55 deletions(-)
>
> diff --git a/x86/emulator.c b/x86/emulator.c
> index b3626fa..16d63e0 100644
> --- a/x86/emulator.c
> +++ b/x86/emulator.c
> @@ -772,38 +772,19 @@ static void advance_rip_by_3_and_note_exception(struct ex_regs *regs)
> static void test_mmx_movq_mf(uint64_t *mem, uint8_t *insn_page,
> uint8_t *alt_insn_page, void *insn_ram)
> {
> - uint16_t fcw = 0; // all exceptions unmasked
> - ulong *cr3 = (ulong *)read_cr3();
> -
> - write_cr0(read_cr0() & ~6); // TS, EM
> - // Place a trapping instruction in the page to trigger a VMEXIT
> - insn_page[0] = 0x89; // mov %eax, (%rax)
> - insn_page[1] = 0x00;
> - insn_page[2] = 0x90; // nop
> - insn_page[3] = 0xc3; // ret
> - // Place the instruction we want the hypervisor to see in the alternate page
> - alt_insn_page[0] = 0x0f; // movq %mm0, (%rax)
> - alt_insn_page[1] = 0x7f;
> - alt_insn_page[2] = 0x00;
> - alt_insn_page[3] = 0xc3; // ret
> + uint16_t fcw = 0; /* all exceptions unmasked */
> + u8 alt_insn[] = {0x0f, 0x7f, 0x00}; /* movq %mm0, (%rax) */
Lets introduce something akin to MK_INSN in x86/realmode.c.
> + void *stack = alloc_page();
>
> + write_cr0(read_cr0() & ~6); /* TS, EM */
> exceptions = 0;
> handle_exception(MF_VECTOR, advance_rip_by_3_and_note_exception);
> -
> - // Load the code TLB with insn_page, but point the page tables at
> - // alt_insn_page (and keep the data TLB clear, for AMD decode assist).
> - // This will make the CPU trap on the insn_page instruction but the
> - // hypervisor will see alt_insn_page.
> - install_page(cr3, virt_to_phys(insn_page), insn_ram);
> asm volatile("fninit; fldcw %0" : : "m"(fcw));
> - asm volatile("fldz; fldz; fdivp"); // generate exception
> - invlpg(insn_ram);
> - // Load code TLB
> - asm volatile("call *%0" : : "r"(insn_ram + 3));
> - install_page(cr3, virt_to_phys(alt_insn_page), insn_ram);
> - // Trap, let hypervisor emulate at alt_insn_page
> - asm volatile("call *%0" : : "r"(insn_ram), "a"(mem));
> - // exit MMX mode
> + asm volatile("fldz; fldz; fdivp"); /* generate exception */
> +
> + inregs = (struct regs){ .rsp=(u64)stack+1024 };
> + trap_emulator(mem, alt_insn, 3);
> + /* exit MMX mode */
> asm volatile("fnclex; emms");
> report("movq mmx generates #MF", exceptions == 1);
> handle_exception(MF_VECTOR, 0);
> @@ -812,33 +793,12 @@ static void test_mmx_movq_mf(uint64_t *mem, uint8_t *insn_page,
> static void test_movabs(uint64_t *mem, uint8_t *insn_page,
> uint8_t *alt_insn_page, void *insn_ram)
> {
> - uint64_t val = 0;
> - ulong *cr3 = (ulong *)read_cr3();
> -
> - // Pad with RET instructions
> - memset(insn_page, 0xc3, 4096);
> - memset(alt_insn_page, 0xc3, 4096);
> - // Place a trapping instruction in the page to trigger a VMEXIT
> - insn_page[0] = 0x89; // mov %eax, (%rax)
> - insn_page[1] = 0x00;
> - // Place the instruction we want the hypervisor to see in the alternate
> - // page. A buggy hypervisor will fetch a 32-bit immediate and return
> - // 0xffffffffc3c3c3c3.
> - alt_insn_page[0] = 0x48; // mov $0xc3c3c3c3c3c3c3c3, %rcx
> - alt_insn_page[1] = 0xb9;
> -
> - // Load the code TLB with insn_page, but point the page tables at
> - // alt_insn_page (and keep the data TLB clear, for AMD decode assist).
> - // This will make the CPU trap on the insn_page instruction but the
> - // hypervisor will see alt_insn_page.
> - install_page(cr3, virt_to_phys(insn_page), insn_ram);
> - // Load code TLB
> - invlpg(insn_ram);
> - asm volatile("call *%0" : : "r"(insn_ram + 3));
> - // Trap, let hypervisor emulate at alt_insn_page
> - install_page(cr3, virt_to_phys(alt_insn_page), insn_ram);
> - asm volatile("call *%1" : "=c"(val) : "r"(insn_ram), "a"(mem), "c"(0));
> - report("64-bit mov imm", val == 0xc3c3c3c3c3c3c3c3);
> + /* mov $0x9090909090909090, %rcx */
> + uint8_t alt_insn[] = {0x48, 0xb9, 0x90, 0x90, 0x90,
> + 0x90, 0x90, 0x90, 0x90, 0x90};
> + inregs = (struct regs){ 0 };
> + trap_emulator(mem, alt_insn, 10);
> + report("64-bit mov imm2", outregs.rcx == 0x9090909090909090);
> }
>
> static void test_crosspage_mmio(volatile uint8_t *mem)
> --
> 1.7.9.5
--
Gleb.
^ permalink raw reply [flat|nested] 20+ messages in thread
end of thread, other threads:[~2013-06-20 12:33 UTC | newest]
Thread overview: 20+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2013-06-19 15:00 [PATCH 1/2] kvm-unit-tests: Add a func to run instruction in emulator Arthur Chunqi Li
2013-06-19 15:00 ` [PATCH 2/2] kvm-unit-tests: Change two cases to use trap_emulator Arthur Chunqi Li
2013-06-20 8:25 ` Paolo Bonzini
2013-06-19 15:07 ` [PATCH 1/2] kvm-unit-tests: Add a func to run instruction in emulator 李春奇 <Arthur Chunqi Li>
2013-06-19 16:03 ` Gleb Natapov
2013-06-19 17:48 ` Gmail
2013-06-20 5:42 ` Gleb Natapov
2013-06-20 8:29 ` Paolo Bonzini
2013-06-20 8:31 ` Gleb Natapov
2013-06-20 8:48 ` Gleb Natapov
2013-06-20 8:58 ` Gmail
-- strict thread matches above, loose matches on Subject: below --
2013-06-20 10:45 Arthur Chunqi Li
2013-06-20 10:45 ` [PATCH 2/2] kvm-unit-tests: Change two cases to use trap_emulator Arthur Chunqi Li
2013-06-20 12:33 ` Gleb Natapov
2013-06-13 15:16 [PATCH 1/2] kvm-unit-tests: Add a func to run instruction in emulator Arthur Chunqi Li
2013-06-13 15:16 ` [PATCH 2/2] kvm-unit-tests: Change two cases to use trap_emulator Arthur Chunqi Li
2013-06-10 13:45 Arthur Chunqi Li
2013-06-10 13:46 ` 李春奇 <Arthur Chunqi Li>
2013-06-10 13:38 [PATCH 1/2] kvm-unit-tests: Add a func to run instruction in emulator Arthur Chunqi Li
2013-06-10 13:38 ` [PATCH 2/2] kvm-unit-tests: Change two cases to use trap_emulator Arthur Chunqi Li
2013-06-07 2:31 [PATCH 1/2] kvm-unit-tests: Add a func to run instruction in emulator Arthur Chunqi Li
2013-06-07 2:31 ` [PATCH 2/2] kvm-unit-tests: Change two cases to use trap_emulator Arthur Chunqi Li
2013-06-06 15:24 [PATCH 1/2] kvm-unit-tests: Add a func to run instruction in emulator Arthur Chunqi Li
2013-06-06 15:24 ` [PATCH 2/2] kvm-unit-tests: Change two cases to use trap_emulator Arthur Chunqi Li
2013-06-12 20:51 ` Paolo Bonzini
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).