From: Sean Christopherson <seanjc@google.com>
To: Mathias Krause <minipli@grsecurity.net>
Cc: kvm@vger.kernel.org
Subject: Re: [kvm-unit-tests PATCH v3 3/4] x86/access: Forced emulation support
Date: Mon, 3 Apr 2023 12:06:15 -0700 [thread overview]
Message-ID: <ZCsjp0666b9DOj+n@google.com> (raw)
In-Reply-To: <dc285a74-9cce-2886-f8aa-f10e1a94f6f5@grsecurity.net>
On Mon, Apr 03, 2023, Mathias Krause wrote:
> On 03.04.23 12:56, Mathias Krause wrote:
> > Add support to enforce access tests to be handled by the emulator, if
> > supported by KVM. Exclude it from the ac_test_exec() test, though, to
> > not slow it down too much.
>
> I tend to read a lot of objdumps and when initially looking at the
> generated code it was kinda hard to recognize the FEP instruction, as
> the FEP actually decodes to UD2 followed by some IMUL instruction that
> lacks a byte, so when objdump does its linear disassembly, it eats a
> byte from the to-be-emulated instruction. Like, "FEP; int $0xc3" would
> decode to:
> 0: 0f 0b ud2
> 2: 6b 76 6d cd imul $0xffffffcd,0x6d(%rsi),%esi
> 6: c3 retq
> This is slightly confusing, especially when the shortened instruction is
> actually a valid one as above ("retq" vs "int $0xc3").
>
> I have the below diff to "fix" that. It adds 0x3e to the FEP which would
> restore objdump's ability to generate a proper disassembly that won't
> destroy the to-be-emulated instruction. As 0x3e decodes to the DS prefix
> byte, which the emulator assumes by default anyways, this should mostly
> be a no-op. However, it helped me to get a proper code dump.a
I agree that the objdump output is annoying, but I don't love the idea of cramming
in a prefix that's _mostly_ a nop.
Given that FEP utilizes extremely specialized, off-by-default KVM code, what about
reworking FEP in KVM itself to play nice with objdump (and other disasm tools)?
E.g. "officially" change the magic prefix to include a trailing 0x3e. Though IMO,
even better would be a magic value that decodes to a multi-byte nop, e.g.
0F 1F 44 00 00. The only "requirement" is that the magic value doesn't get
false positives, and I can't imagine any of our test environments generate a ud2
followed by a multi-byte nop.
Keeping KVM-Unit-Tests and KVM synchronized on the correct FEP value would be a
pain, but disconnects between KVM and KUT are nothing new.
next prev parent reply other threads:[~2023-04-03 19:06 UTC|newest]
Thread overview: 13+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-04-03 10:56 [kvm-unit-tests PATCH v3 0/4] Tests for CR0.WP=0/1 r/o write access Mathias Krause
2023-04-03 10:56 ` [kvm-unit-tests PATCH v3 1/4] x86: Use existing CR0.WP / CR4.SMEP bit definitions Mathias Krause
2023-04-03 10:56 ` [kvm-unit-tests PATCH v3 2/4] x86/access: CR0.WP toggling write to r/o data test Mathias Krause
2023-04-03 10:56 ` [kvm-unit-tests PATCH v3 3/4] x86/access: Forced emulation support Mathias Krause
2023-04-03 11:28 ` Mathias Krause
2023-04-03 19:06 ` Sean Christopherson [this message]
2023-04-03 20:06 ` Mathias Krause
2023-04-04 0:08 ` Sean Christopherson
2023-04-04 0:04 ` Sean Christopherson
2023-04-04 7:27 ` Mathias Krause
2023-04-04 16:36 ` Sean Christopherson
2023-04-05 8:01 ` Mathias Krause
2023-04-03 10:56 ` [kvm-unit-tests PATCH v3 4/4] x86/access: Try emulation for CR0.WP test as well Mathias Krause
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=ZCsjp0666b9DOj+n@google.com \
--to=seanjc@google.com \
--cc=kvm@vger.kernel.org \
--cc=minipli@grsecurity.net \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox