public inbox for kvm@vger.kernel.org
 help / color / mirror / Atom feed
From: Sean Christopherson <seanjc@google.com>
To: Mathias Krause <minipli@grsecurity.net>
Cc: kvm@vger.kernel.org
Subject: Re: [kvm-unit-tests PATCH v3 3/4] x86/access: Forced emulation support
Date: Mon, 3 Apr 2023 12:06:15 -0700	[thread overview]
Message-ID: <ZCsjp0666b9DOj+n@google.com> (raw)
In-Reply-To: <dc285a74-9cce-2886-f8aa-f10e1a94f6f5@grsecurity.net>

On Mon, Apr 03, 2023, Mathias Krause wrote:
> On 03.04.23 12:56, Mathias Krause wrote:
> > Add support to enforce access tests to be handled by the emulator, if
> > supported by KVM. Exclude it from the ac_test_exec() test, though, to
> > not slow it down too much.
> 
> I tend to read a lot of objdumps and when initially looking at the
> generated code it was kinda hard to recognize the FEP instruction, as
> the FEP actually decodes to UD2 followed by some IMUL instruction that
> lacks a byte, so when objdump does its linear disassembly, it eats a
> byte from the to-be-emulated instruction. Like, "FEP; int $0xc3" would
> decode to:
>    0:	0f 0b                	ud2
>    2:	6b 76 6d cd          	imul   $0xffffffcd,0x6d(%rsi),%esi
>    6:	c3                   	retq
> This is slightly confusing, especially when the shortened instruction is
> actually a valid one as above ("retq" vs "int $0xc3").
> 
> I have the below diff to "fix" that. It adds 0x3e to the FEP which would
> restore objdump's ability to generate a proper disassembly that won't
> destroy the to-be-emulated instruction. As 0x3e decodes to the DS prefix
> byte, which the emulator assumes by default anyways, this should mostly
> be a no-op. However, it helped me to get a proper code dump.a

I agree that the objdump output is annoying, but I don't love the idea of cramming
in a prefix that's _mostly_ a nop.

Given that FEP utilizes extremely specialized, off-by-default KVM code, what about
reworking FEP in KVM itself to play nice with objdump (and other disasm tools)?
E.g. "officially" change the magic prefix to include a trailing 0x3e.  Though IMO,
even better would be a magic value that decodes to a multi-byte nop, e.g.
0F 1F 44 00 00.  The only "requirement" is that the magic value doesn't get
false positives, and I can't imagine any of our test environments generate a ud2
followed by a multi-byte nop.

Keeping KVM-Unit-Tests and KVM synchronized on the correct FEP value would be a
pain, but disconnects between KVM and KUT are nothing new.

  reply	other threads:[~2023-04-03 19:06 UTC|newest]

Thread overview: 13+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2023-04-03 10:56 [kvm-unit-tests PATCH v3 0/4] Tests for CR0.WP=0/1 r/o write access Mathias Krause
2023-04-03 10:56 ` [kvm-unit-tests PATCH v3 1/4] x86: Use existing CR0.WP / CR4.SMEP bit definitions Mathias Krause
2023-04-03 10:56 ` [kvm-unit-tests PATCH v3 2/4] x86/access: CR0.WP toggling write to r/o data test Mathias Krause
2023-04-03 10:56 ` [kvm-unit-tests PATCH v3 3/4] x86/access: Forced emulation support Mathias Krause
2023-04-03 11:28   ` Mathias Krause
2023-04-03 19:06     ` Sean Christopherson [this message]
2023-04-03 20:06       ` Mathias Krause
2023-04-04  0:08         ` Sean Christopherson
2023-04-04  0:04   ` Sean Christopherson
2023-04-04  7:27     ` Mathias Krause
2023-04-04 16:36       ` Sean Christopherson
2023-04-05  8:01         ` Mathias Krause
2023-04-03 10:56 ` [kvm-unit-tests PATCH v3 4/4] x86/access: Try emulation for CR0.WP test as well Mathias Krause

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=ZCsjp0666b9DOj+n@google.com \
    --to=seanjc@google.com \
    --cc=kvm@vger.kernel.org \
    --cc=minipli@grsecurity.net \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox