kvm-unit-tests: Add a func to run instruction in emulator
PATCH 1/2 kvm-unit-tests: Add a func to run instruction in emulator
Add a function trap_emulator to run an instruction in emulator. Set inregs first (%rax is invalid because it is used as return address), put instruction codec in alt_insn and call func with alt_insn_length. Get results in outregs.
--- x86/emulator.c | 110 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 110 insertions(+) mode change 100644 => 100755 x86/emulator.c
x86/emulator.c +110 -0
@@ -11,6 +11,15 @@ int fails, tests;static int exceptions; +struct regs { +u64 rax, rbx, rcx, rdx; +u64 rsi, rdi, rsp, rbp; +u64 r8, r9, r10, r11; +u64 r12, r13, r14, r15; +u64 rip, rflags; +}; +struct regs inregs, outregs, save; +void report (const char *name,int result) { ++tests;
@@ -685,6 +694,107 @@ static void test_shld_shrd(u32 *mem)report ("shrd (cl)" , *mem == ((0x12345678 >>3 ) | (5u <<29 ))); } +#define INSN_SAVE \ + "ret\n\t" \ + "pushf\n\t" \ + "push 136+save \n\t" \ + "popf \n\t" \ + "xchg %rax, 0+save \n\t" \ + "xchg %rbx, 8+save \n\t" \ + "xchg %rcx, 16+save \n\t" \ + "xchg %rdx, 24+save \n\t" \ + "xchg %rsi, 32+save \n\t" \ + "xchg %rdi, 40+save \n\t" \ + "xchg %rsp, 48+save \n\t" \ + "xchg %rbp, 56+save \n\t" \ + "xchg %r8, 64+save \n\t" \ + "xchg %r9, 72+save \n\t" \ + "xchg %r10, 80+save \n\t" \ + "xchg %r11, 88+save \n\t" \ + "xchg %r12, 96+save \n\t" \ + "xchg %r13, 104+save \n\t" \ + "xchg %r14, 112+save \n\t" \ + "xchg %r15, 120+save \n\t" \ + +#define INSN_RESTORE \ + "xchg %rax, 0+save \n\t" \ + "xchg %rbx, 8+save \n\t" \ + "xchg %rcx, 16+save \n\t" \ + "xchg %rdx, 24+save \n\t" \ + "xchg %rsi, 32+save \n\t" \ + "xchg %rdi, 40+save \n\t" \ + "xchg %rsp, 48+save \n\t" \ + "xchg %rbp, 56+save \n\t" \ + "xchg %r8, 64+save \n\t" \ + "xchg %r9, 72+save \n\t" \ + "xchg %r10, 80+save \n\t" \ + "xchg %r11, 88+save \n\t" \ + "xchg %r12, 96+save \n\t" \ + "xchg %r13, 104+save \n\t" \ + "xchg %r14, 112+save \n\t" \ + "xchg %r15, 120+save \n\t" \ + "pushf \n\t" \ + "pop 136+save \n\t" \ + "popf \n\t" \ + "ret \n\t" \ + +#define INSN_TRAP \ + "in (%dx),%al\n\t" \ + ". = . + 31\n\t" \ + +asm( +".align 4096\n\t" +"insn_page:\n\t" +INSN_SAVE +"test_insn:\n\t" +INSN_TRAP +"test_insn_end:\n\t" +INSN_RESTORE +"insn_page_end:\n\t" +".align 4096\n\t" + +"alt_insn_page:\n\t" +INSN_SAVE +"alt_test_insn:\n\t" +INSN_TRAP +"alt_test_insn_end:\n\t" +INSN_RESTORE +"alt_insn_page_end:\n\t" +".align 4096\n\t" +); + +static void trap_emulator (uint64_t *mem,uint8_t * alt_insn,int alt_insn_length) +{ +ulong *cr3 = (ulong *)read_cr3 (); +void *insn_ram; +int i; +extern u8 insn_page[], test_insn[], test_insn_end[]; +extern u8 alt_insn_page[], alt_test_insn[]; + + insn_ram =vmap (virt_to_phys (insn_page),4096 ); +for (i=1 ; i<test_insn_end - test_insn; i++) + alt_test_insn[i] = test_insn[i] =0x90 ;// nop +for (i=0 ; i<alt_insn_length; i++) + alt_test_insn[i] = alt_insn[i]; +for (;i<test_insn_end - test_insn; i++) + alt_test_insn[i] =0x90 ;// nop + save = inregs; + +// Load the code TLB with insn_page, but point the page tables at +// alt_insn_page (and keep the data TLB clear, for AMD decode assist). +// This will make the CPU trap on the insn_page instruction but the +// hypervisor will see alt_insn_page. +install_page (cr3,virt_to_phys (insn_page), insn_ram); +invlpg (insn_ram); +// Load code TLB + asmvolatile ("call *%0" : :"r" (insn_ram)); +install_page (cr3,virt_to_phys (alt_insn_page), insn_ram); +// Trap, let hypervisor emulate at alt_insn_page + asmvolatile ("call *%0" : :"r" (insn_ram+1 )); + + outregs = save; +} +static void advance_rip_by_3_and_note_exception (struct ex_regs *regs) { ++exceptions;
Signature · 1 line
1.7.9.5
PATCH 2/2 kvm-unit-tests: Change two cases to use trap_emulator
Change two functions (test_mmx_movq_mf and test_movabs) using unified trap_emulator.
--- x86/emulator.c | 62 ++++++++++---------------------------------------------- 1 file changed, 11 insertions(+), 51 deletions(-)
x86/emulator.c +11 -51
@@ -805,36 +805,17 @@ static void test_mmx_movq_mf(uint64_t *mem, uint8_t *insn_page, uint8_t *alt_insn_page, void *insn_ram) { uint16_t fcw = 0; // all exceptions unmasked -ulong *cr3 = (ulong *)read_cr3 (); +u8 alt_insn[] = {0x0f ,0x7f ,0x00 };// movq %mm0, (%rax) +void *stack =alloc_page ();write_cr0 (read_cr0 () & ~6 );// TS, EM -// Place a trapping instruction in the page to trigger a VMEXIT - insn_page[0 ] =0x89 ;// mov %eax, (%rax) - insn_page[1 ] =0x00 ; - insn_page[2 ] =0x90 ;// nop - insn_page[3 ] =0xc3 ;// ret -// Place the instruction we want the hypervisor to see in the alternate page - alt_insn_page[0 ] =0x0f ;// movq %mm0, (%rax) - alt_insn_page[1 ] =0x7f ; - alt_insn_page[2 ] =0x00 ; - alt_insn_page[3 ] =0xc3 ;// ret - exceptions =0 ;handle_exception (MF_VECTOR , advance_rip_by_3_and_note_exception); - -// Load the code TLB with insn_page, but point the page tables at -// alt_insn_page (and keep the data TLB clear, for AMD decode assist). -// This will make the CPU trap on the insn_page instruction but the -// hypervisor will see alt_insn_page. -install_page (cr3,virt_to_phys (insn_page), insn_ram); asmvolatile ("fninit; fldcw %0" : :"m" (fcw)); asmvolatile ("fldz; fldz; fdivp" );// generate exception -invlpg (insn_ram); -// Load code TLB - asmvolatile ("call *%0" : :"r" (insn_ram +3 )); -install_page (cr3,virt_to_phys (alt_insn_page), insn_ram); -// Trap, let hypervisor emulate at alt_insn_page - asmvolatile ("call *%0" : :"r" (insn_ram),"a" (mem)); + + inregs = (struct regs ){ .rsp=(u64 )stack+1024 }; +trap_emulator (mem, alt_insn,3 );// exit MMX mode asmvolatile ("fnclex; emms" );report ("movq mmx generates #MF" , exceptions ==1 );
@@ -844,33 +825,12 @@ static void test_mmx_movq_mf(uint64_t *mem, uint8_t *insn_page,static void test_movabs (uint64_t *mem,uint8_t *insn_page,uint8_t *alt_insn_page,void *insn_ram) { -uint64_t val =0 ; -ulong *cr3 = (ulong *)read_cr3 (); - -// Pad with RET instructions -memset (insn_page,0xc3 ,4096 ); -memset (alt_insn_page,0xc3 ,4096 ); -// Place a trapping instruction in the page to trigger a VMEXIT - insn_page[0 ] =0x89 ;// mov %eax, (%rax) - insn_page[1 ] =0x00 ; -// Place the instruction we want the hypervisor to see in the alternate -// page. A buggy hypervisor will fetch a 32-bit immediate and return -// 0xffffffffc3c3c3c3. - alt_insn_page[0 ] =0x48 ;// mov $0xc3c3c3c3c3c3c3c3, %rcx - alt_insn_page[1 ] =0xb9 ; - -// Load the code TLB with insn_page, but point the page tables at -// alt_insn_page (and keep the data TLB clear, for AMD decode assist). -// This will make the CPU trap on the insn_page instruction but the -// hypervisor will see alt_insn_page. -install_page (cr3,virt_to_phys (insn_page), insn_ram); -// Load code TLB -invlpg (insn_ram); - asmvolatile ("call *%0" : :"r" (insn_ram +3 )); -// Trap, let hypervisor emulate at alt_insn_page -install_page (cr3,virt_to_phys (alt_insn_page), insn_ram); - asmvolatile ("call *%1" :"=c" (val) :"r" (insn_ram),"a" (mem),"c" (0 )); -report ("64-bit mov imm" , val ==0xc3c3c3c3c3c3c3c3 ); +// mov $0xc3c3c3c3c3c3c3c3, %rcx +uint8_t alt_insn[] = {0x48 ,0xb9 ,0xc3 ,0xc3 ,0xc3 , +0xc3 ,0xc3 ,0xc3 ,0xc3 ,0xc3 }; + inregs = (struct regs ){0 }; +trap_emulator (mem, alt_insn,10 ); +report ("64-bit mov imm2" , outregs.rcx ==0xc3c3c3c3c3c3c3c3 ); }static void test_crosspage_mmio (volatile uint8_t *mem)
Signature · 1 line
1.7.9.5
Paolo Bonzini
maintainerRe: [PATCH 2/2] kvm-unit-tests: Change two cases to use trap_emulator
Il 19/06/2013 17:00, Arthur Chunqi Li ha scritto:
Quoted 27 lines
static void test_movabs(uint64_t *mem,
uint8_t*insn_page,x86/emulator.c +0
-24uint8_t *alt_insn_page, void *insn_ram) { - uint64_t val = 0; -ulong *cr3 = (ulong *)read_cr3 (); - -// Pad with RET instructions -memset (insn_page,0xc3 ,4096 ); -memset (alt_insn_page,0xc3 ,4096 ); -// Place a trapping instruction in the page to trigger a VMEXIT - insn_page[0 ] =0x89 ;// mov %eax, (%rax) - insn_page[1 ] =0x00 ; -// Place the instruction we want the hypervisor to see in the alternate -// page. A buggy hypervisor will fetch a 32-bit immediate and return -// 0xffffffffc3c3c3c3. - alt_insn_page[0 ] =0x48 ;// mov $0xc3c3c3c3c3c3c3c3, %rcx - alt_insn_page[1 ] =0xb9 ; - -// Load the code TLB with insn_page, but point the page tables at -// alt_insn_page (and keep the data TLB clear, for AMD decode assist). -// This will make the CPU trap on the insn_page instruction but the -// hypervisor will see alt_insn_page. -install_page (cr3,virt_to_phys (insn_page), insn_ram); -// Load code TLB -invlpg (insn_ram); - asmvolatile ("call *%0" : :"r" (insn_ram +3 )); -// Trap, let hypervisor emulate at alt_insn_page
x86/emulator.c static void test_mmx_movq_mf(uint64_t *mem, uint8_t *insn_page, · line 834
Quoted 10 lines
x86/emulator.c +6
-3-install_page (cr3,virt_to_phys (alt_insn_page), insn_ram); - asmvolatile ("call *%1" :"=c" (val) :"r" (insn_ram),"a" (mem),"c" (0 )); -report ("64-bit mov imm" , val ==0xc3c3c3c3c3c3c3c3 ); +// mov $0xc3c3c3c3c3c3c3c3, %rcx +uint8_t alt_insn[] = {0x48 ,0xb9 ,0xc3 ,0xc3 ,0xc3 , +0xc3 ,0xc3 ,0xc3 ,0xc3 ,0xc3 }; + inregs = (struct regs ){0 }; +trap_emulator (mem, alt_insn,10 ); +report ("64-bit mov imm2" , outregs.rcx ==0xc3c3c3c3c3c3c3c3 ); }
0xc3 is ret and it may mess up the test case if the buggy hypervisor sees it as
mov $0xc3c3c3c3, %rcx (sign extended, no such instruction exists)
ret
ret
ret
retI suggest changing it to 0x90 as part of this patch.
Paolo
Hi Gleb,
This version can set %rsp before trapping into emulator, because insn_page and alt_insn_page is statically defined and their relative position to (save) is fixed during execution.
In this way, test case of test_mmx_movq_mf needs to pre-define its own stack, this change is in the next patch.
In this version, insn_ram is initially mapped to insn_page and them each call to insn_page/alt_insn_page are all via insn_ram. This trick runs well but I don't know why my previous version causes error.
Arthur.
Quoted 142 lines · Arthur Chunqi Li
Add a function
trap_emulatorto run an instruction in emulator. Set inregs first (%rax is invalid because it is used as return address), put instruction codec inalt_insnand call func withalt_insn_length. Get results in outregs.Signed-off-by Arthur Chunqi Li <[email protected]>--- x86/emulator.c | 110 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 110 insertions(+) mode change 100644 => 100755 x86/emulator.cx86/emulator.c +110
-1@@ -11,6 +11,15 @@ int fails, tests;static int exceptions; +struct regs { +u64 rax, rbx, rcx, rdx; +u64 rsi, rdi, rsp, rbp; +u64 r8, r9, r10, r11; +u64 r12, r13, r14, r15; +u64 rip, rflags; +}; +struct regs inregs, outregs, save; +void report (const char *name,int result) { ++tests;@@ -685,6 +694,107 @@ static void test_shld_shrd(u32 *mem)report ("shrd (cl)" , *mem == ((0x12345678 >>3 ) | (5u <<29 ))); } +#define INSN_SAVE \ + "ret\n\t" \ + "pushf\n\t" \ + "push 136+save \n\t" \ + "popf \n\t" \ + "xchg %rax, 0+save \n\t" \ + "xchg %rbx, 8+save \n\t" \ + "xchg %rcx, 16+save \n\t" \ + "xchg %rdx, 24+save \n\t" \ + "xchg %rsi, 32+save \n\t" \ + "xchg %rdi, 40+save \n\t" \ + "xchg %rsp, 48+save \n\t" \ + "xchg %rbp, 56+save \n\t" \ + "xchg %r8, 64+save \n\t" \ + "xchg %r9, 72+save \n\t" \ + "xchg %r10, 80+save \n\t" \ + "xchg %r11, 88+save \n\t" \ + "xchg %r12, 96+save \n\t" \ + "xchg %r13, 104+save \n\t" \ + "xchg %r14, 112+save \n\t" \ + "xchg %r15, 120+save \n\t" \ + +#define INSN_RESTORE \ + "xchg %rax, 0+save \n\t" \ + "xchg %rbx, 8+save \n\t" \ + "xchg %rcx, 16+save \n\t" \ + "xchg %rdx, 24+save \n\t" \ + "xchg %rsi, 32+save \n\t" \ + "xchg %rdi, 40+save \n\t" \ + "xchg %rsp, 48+save \n\t" \ + "xchg %rbp, 56+save \n\t" \ + "xchg %r8, 64+save \n\t" \ + "xchg %r9, 72+save \n\t" \ + "xchg %r10, 80+save \n\t" \ + "xchg %r11, 88+save \n\t" \ + "xchg %r12, 96+save \n\t" \ + "xchg %r13, 104+save \n\t" \ + "xchg %r14, 112+save \n\t" \ + "xchg %r15, 120+save \n\t" \ + "pushf \n\t" \ + "pop 136+save \n\t" \ + "popf \n\t" \ + "ret \n\t" \ + +#define INSN_TRAP \ + "in (%dx),%al\n\t" \ + ". = . + 31\n\t" \ + +asm( +".align 4096\n\t" +"insn_page:\n\t" +INSN_SAVE +"test_insn:\n\t" +INSN_TRAP +"test_insn_end:\n\t" +INSN_RESTORE +"insn_page_end:\n\t" +".align 4096\n\t" + +"alt_insn_page:\n\t" +INSN_SAVE +"alt_test_insn:\n\t" +INSN_TRAP +"alt_test_insn_end:\n\t" +INSN_RESTORE +"alt_insn_page_end:\n\t" +".align 4096\n\t" +); + +static void trap_emulator (uint64_t *mem,uint8_t * alt_insn,int alt_insn_length) +{ +ulong *cr3 = (ulong *)read_cr3 (); +void *insn_ram; +int i; +extern u8 insn_page[], test_insn[], test_insn_end[]; +extern u8 alt_insn_page[], alt_test_insn[]; + + insn_ram =vmap (virt_to_phys (insn_page),4096 ); +for (i=1 ; i<test_insn_end - test_insn; i++) + alt_test_insn[i] = test_insn[i] =0x90 ;// nop +for (i=0 ; i<alt_insn_length; i++) + alt_test_insn[i] = alt_insn[i]; +for (;i<test_insn_end - test_insn; i++) + alt_test_insn[i] =0x90 ;// nop + save = inregs; + +// Load the code TLB with insn_page, but point the page tables at +// alt_insn_page (and keep the data TLB clear, for AMD decode assist). +// This will make the CPU trap on the insn_page instruction but the +// hypervisor will see alt_insn_page. +install_page (cr3,virt_to_phys (insn_page), insn_ram); +invlpg (insn_ram); +// Load code TLB + asmvolatile ("call *%0" : :"r" (insn_ram)); +install_page (cr3,virt_to_phys (alt_insn_page), insn_ram); +// Trap, let hypervisor emulate at alt_insn_page + asmvolatile ("call *%0" : :"r" (insn_ram+1 )); + + outregs = save; +} +static void advance_rip_by_3_and_note_exception (struct ex_regs *regs) { ++exceptions; --
Quoted 2 lines
1.7.9.5
--
Arthur Chunqi Li
Department of Computer Science
School of EECS
Peking University
Beijing, China
Quoted 5 lines · 李春奇
Hi Gleb,
This version can set %rsp before trapping into emulator, becauseinsn_pageandalt_insn_pageis statically defined and their relative position to (save) is fixed during execution.
The position of the code is not fixed during execution since you execute it from a virtual address obtained dynamically by vmap() and the address is definitely different from the one the code was compiled for, but if you look at the code that compile actually produce you will see that it uses absolute address to access "save" and this is why it works. I wounder why compiler decided to use absolute address this time, Paolo?
Quoted 7 lines
In this way, test case of
test_mmx_movq_mfneeds to pre-define its own stack, this change is in the next patch.In this version,
insn_ramis initially mapped toinsn_pageand them each call to insn_page/alt_insn_page are all viainsn_ram. This trick runs well but I don't know why my previous version causes error.
Because previous version tried to use install_page() on a large page mapped region and the function does not know how to handle that.
Quoted 149 lines
Arthur.
Quoted 142 lines · Arthur Chunqi Li
Add a function
trap_emulatorto run an instruction in emulator. Set inregs first (%rax is invalid because it is used as return address), put instruction codec inalt_insnand call func withalt_insn_length. Get results in outregs.Signed-off-by Arthur Chunqi Li <[email protected]>--- x86/emulator.c | 110 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 110 insertions(+) mode change 100644 => 100755 x86/emulator.cx86/emulator.c +110
-1@@ -11,6 +11,15 @@ int fails, tests;static int exceptions; +struct regs { +u64 rax, rbx, rcx, rdx; +u64 rsi, rdi, rsp, rbp; +u64 r8, r9, r10, r11; +u64 r12, r13, r14, r15; +u64 rip, rflags; +}; +struct regs inregs, outregs, save; +void report (const char *name,int result) { ++tests;@@ -685,6 +694,107 @@ static void test_shld_shrd(u32 *mem)report ("shrd (cl)" , *mem == ((0x12345678 >>3 ) | (5u <<29 ))); } +#define INSN_SAVE \ + "ret\n\t" \ + "pushf\n\t" \ + "push 136+save \n\t" \ + "popf \n\t" \ + "xchg %rax, 0+save \n\t" \ + "xchg %rbx, 8+save \n\t" \ + "xchg %rcx, 16+save \n\t" \ + "xchg %rdx, 24+save \n\t" \ + "xchg %rsi, 32+save \n\t" \ + "xchg %rdi, 40+save \n\t" \ + "xchg %rsp, 48+save \n\t" \ + "xchg %rbp, 56+save \n\t" \ + "xchg %r8, 64+save \n\t" \ + "xchg %r9, 72+save \n\t" \ + "xchg %r10, 80+save \n\t" \ + "xchg %r11, 88+save \n\t" \ + "xchg %r12, 96+save \n\t" \ + "xchg %r13, 104+save \n\t" \ + "xchg %r14, 112+save \n\t" \ + "xchg %r15, 120+save \n\t" \ + +#define INSN_RESTORE \ + "xchg %rax, 0+save \n\t" \ + "xchg %rbx, 8+save \n\t" \ + "xchg %rcx, 16+save \n\t" \ + "xchg %rdx, 24+save \n\t" \ + "xchg %rsi, 32+save \n\t" \ + "xchg %rdi, 40+save \n\t" \ + "xchg %rsp, 48+save \n\t" \ + "xchg %rbp, 56+save \n\t" \ + "xchg %r8, 64+save \n\t" \ + "xchg %r9, 72+save \n\t" \ + "xchg %r10, 80+save \n\t" \ + "xchg %r11, 88+save \n\t" \ + "xchg %r12, 96+save \n\t" \ + "xchg %r13, 104+save \n\t" \ + "xchg %r14, 112+save \n\t" \ + "xchg %r15, 120+save \n\t" \ + "pushf \n\t" \ + "pop 136+save \n\t" \ + "popf \n\t" \ + "ret \n\t" \ + +#define INSN_TRAP \ + "in (%dx),%al\n\t" \ + ". = . + 31\n\t" \ + +asm( +".align 4096\n\t" +"insn_page:\n\t" +INSN_SAVE +"test_insn:\n\t" +INSN_TRAP +"test_insn_end:\n\t" +INSN_RESTORE +"insn_page_end:\n\t" +".align 4096\n\t" + +"alt_insn_page:\n\t" +INSN_SAVE +"alt_test_insn:\n\t" +INSN_TRAP +"alt_test_insn_end:\n\t" +INSN_RESTORE +"alt_insn_page_end:\n\t" +".align 4096\n\t" +); + +static void trap_emulator (uint64_t *mem,uint8_t * alt_insn,int alt_insn_length) +{ +ulong *cr3 = (ulong *)read_cr3 (); +void *insn_ram; +int i; +extern u8 insn_page[], test_insn[], test_insn_end[]; +extern u8 alt_insn_page[], alt_test_insn[]; + + insn_ram =vmap (virt_to_phys (insn_page),4096 ); +for (i=1 ; i<test_insn_end - test_insn; i++) + alt_test_insn[i] = test_insn[i] =0x90 ;// nop +for (i=0 ; i<alt_insn_length; i++) + alt_test_insn[i] = alt_insn[i]; +for (;i<test_insn_end - test_insn; i++) + alt_test_insn[i] =0x90 ;// nop + save = inregs; + +// Load the code TLB with insn_page, but point the page tables at +// alt_insn_page (and keep the data TLB clear, for AMD decode assist). +// This will make the CPU trap on the insn_page instruction but the +// hypervisor will see alt_insn_page. +install_page (cr3,virt_to_phys (insn_page), insn_ram); +invlpg (insn_ram); +// Load code TLB + asmvolatile ("call *%0" : :"r" (insn_ram)); +install_page (cr3,virt_to_phys (alt_insn_page), insn_ram); +// Trap, let hypervisor emulate at alt_insn_page + asmvolatile ("call *%0" : :"r" (insn_ram+1 )); + + outregs = save; +} +static void advance_rip_by_3_and_note_exception (struct ex_regs *regs) { ++exceptions; --Quoted 2 lines
1.7.9.5
Quoted 6 lines
--
Arthur Chunqi Li
Department of Computer Science
School of EECS
Peking University
Beijing, China
--
Gleb.
Quoted 12 lines · 在 2013-6-20，0:03，Gleb Natapov <[email protected]> 写道：
Quoted 4 lines · 李春奇
Hi Gleb,
This version can set %rsp before trapping into emulator, becauseinsn_pageandalt_insn_pageis statically defined and their relative position to (save) is fixed during execution.The position of the code is not fixed during execution since you execute it from a virtual address obtained dynamically by
vmap()and the address is definitely different from the one the code was compiled for, but if you look at the code that compile actually produce you will see that it uses absolute address to access "save" and this is why it works. I wounder why compiler decided to use absolute address this time, Paolo?
Quoted 8 lines
Quoted 6 lines
In this way, test case of
test_mmx_movq_mfneeds to pre-define its own stack, this change is in the next patch.In this version,
insn_ramis initially mapped toinsn_pageand them each call to insn_page/alt_insn_page are all viainsn_ram. This trick runs well but I don't know why my previous version causes error.Because previous version tried to use
install_page()on a large page mapped region and the function does not know how to handle that.
I don't quite understand what you mean here. What is the differences between large page and 4k page in this test case? Maybe I don't understand the differences of install_pte() with 4k page and 2m pages.
Quoted 158 lines
Quoted 149 lines
Arthur.
Quoted 142 lines · Arthur Chunqi Li
Add a function
trap_emulatorto run an instruction in emulator. Set inregs first (%rax is invalid because it is used as return address), put instruction codec inalt_insnand call func withalt_insn_length. Get results in outregs.Signed-off-by Arthur Chunqi Li <[email protected]>---
x86/emulator.c| 110 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++1 file changed, 110 insertions(+)mode change 100644 => 100755
x86/emulator.cx86/emulator.c +110
-1@@ -11,6 +11,15 @@ int fails, tests;static int exceptions; +struct regs { +u64 rax, rbx, rcx, rdx; +u64 rsi, rdi, rsp, rbp; +u64 r8, r9, r10, r11; +u64 r12, r13, r14, r15; +u64 rip, rflags; +}; +struct regs inregs, outregs, save; +void report (const char *name,int result) { ++tests;@@ -685,6 +694,107 @@ static void test_shld_shrd(u32 *mem)report ("shrd (cl)" , *mem == ((0x12345678 >>3 ) | (5u <<29 ))); } +#define INSN_SAVE \ + "ret\n\t" \ + "pushf\n\t" \ + "push 136+save \n\t" \ + "popf \n\t" \ + "xchg %rax, 0+save \n\t" \ + "xchg %rbx, 8+save \n\t" \ + "xchg %rcx, 16+save \n\t" \ + "xchg %rdx, 24+save \n\t" \ + "xchg %rsi, 32+save \n\t" \ + "xchg %rdi, 40+save \n\t" \ + "xchg %rsp, 48+save \n\t" \ + "xchg %rbp, 56+save \n\t" \ + "xchg %r8, 64+save \n\t" \ + "xchg %r9, 72+save \n\t" \ + "xchg %r10, 80+save \n\t" \ + "xchg %r11, 88+save \n\t" \ + "xchg %r12, 96+save \n\t" \ + "xchg %r13, 104+save \n\t" \ + "xchg %r14, 112+save \n\t" \ + "xchg %r15, 120+save \n\t" \ + +#define INSN_RESTORE \ + "xchg %rax, 0+save \n\t" \ + "xchg %rbx, 8+save \n\t" \ + "xchg %rcx, 16+save \n\t" \ + "xchg %rdx, 24+save \n\t" \ + "xchg %rsi, 32+save \n\t" \ + "xchg %rdi, 40+save \n\t" \ + "xchg %rsp, 48+save \n\t" \ + "xchg %rbp, 56+save \n\t" \ + "xchg %r8, 64+save \n\t" \ + "xchg %r9, 72+save \n\t" \ + "xchg %r10, 80+save \n\t" \ + "xchg %r11, 88+save \n\t" \ + "xchg %r12, 96+save \n\t" \ + "xchg %r13, 104+save \n\t" \ + "xchg %r14, 112+save \n\t" \ + "xchg %r15, 120+save \n\t" \ + "pushf \n\t" \ + "pop 136+save \n\t" \ + "popf \n\t" \ + "ret \n\t" \ + +#define INSN_TRAP \ + "in (%dx),%al\n\t" \ + ". = . + 31\n\t" \ + +asm( +".align 4096\n\t" +"insn_page:\n\t" +INSN_SAVE +"test_insn:\n\t" +INSN_TRAP +"test_insn_end:\n\t" +INSN_RESTORE +"insn_page_end:\n\t" +".align 4096\n\t" + +"alt_insn_page:\n\t" +INSN_SAVE +"alt_test_insn:\n\t" +INSN_TRAP +"alt_test_insn_end:\n\t" +INSN_RESTORE +"alt_insn_page_end:\n\t" +".align 4096\n\t" +); + +static void trap_emulator (uint64_t *mem,uint8_t * alt_insn,int alt_insn_length) +{ +ulong *cr3 = (ulong *)read_cr3 (); +void *insn_ram; +int i; +extern u8 insn_page[], test_insn[], test_insn_end[]; +extern u8 alt_insn_page[], alt_test_insn[]; + + insn_ram =vmap (virt_to_phys (insn_page),4096 ); +for (i=1 ; i<test_insn_end - test_insn; i++) + alt_test_insn[i] = test_insn[i] =0x90 ;// nop +for (i=0 ; i<alt_insn_length; i++) + alt_test_insn[i] = alt_insn[i]; +for (;i<test_insn_end - test_insn; i++) + alt_test_insn[i] =0x90 ;// nop + save = inregs; + +// Load the code TLB with insn_page, but point the page tables at +// alt_insn_page (and keep the data TLB clear, for AMD decode assist). +// This will make the CPU trap on the insn_page instruction but the +// hypervisor will see alt_insn_page. +install_page (cr3,virt_to_phys (insn_page), insn_ram); +invlpg (insn_ram); +// Load code TLB + asmvolatile ("call *%0" : :"r" (insn_ram)); +install_page (cr3,virt_to_phys (alt_insn_page), insn_ram); +// Trap, let hypervisor emulate at alt_insn_page + asmvolatile ("call *%0" : :"r" (insn_ram+1 )); + + outregs = save; +} +static void advance_rip_by_3_and_note_exception (struct ex_regs *regs) { ++exceptions; --Quoted 1 line
1.7.9.5
Quoted 6 lines
--
Arthur Chunqi Li
Department of Computer Science
School of EECS
Peking University
Beijing, China--
Gleb.
Quoted 18 lines · Gmail
Quoted 15 lines · 在 2013-6-20，0:03，Gleb Natapov <[email protected]> 写道：
Quoted 4 lines · 李春奇
Hi Gleb,
This version can set %rsp before trapping into emulator, becauseinsn_pageandalt_insn_pageis statically defined and their relative position to (save) is fixed during execution.The position of the code is not fixed during execution since you execute it from a virtual address obtained dynamically by
vmap()and the address is definitely different from the one the code was compiled for, but if you look at the code that compile actually produce you will see that it uses absolute address to access "save" and this is why it works. I wounder why compiler decided to use absolute address this time, Paolo?Quoted 3 lines
In this way, test case of
test_mmx_movq_mfneeds to pre-define its own stack, this change is in the next patch.
Quoted 6 lines
Quoted 5 lines
Quoted 3 lines
In this version,
insn_ramis initially mapped toinsn_pageand them each call to insn_page/alt_insn_page are all viainsn_ram. This trick runs well but I don't know why my previous version causes error.Because previous version tried to use
install_page()on a large page mapped region and the function does not know how to handle that.I don't quite understand what you mean here. What is the differences between large page and 4k page in this test case?
Test assumes 4k page size.
Quoted 1 line
Maybe I don't understand the differences of
install_pte()with 4k page and 2m pages.
May be. You cannot install 4k page in place of 2m page before breaking the later to 512 4k pages.
--
Gleb.
Paolo Bonzini
maintainerIl 19/06/2013 18:03, Gleb Natapov ha scritto:
Quoted 6 lines · 李春奇
Quoted 5 lines
Hi Gleb,
This version can set %rsp before trapping into emulator, becauseinsn_pageandalt_insn_pageis statically defined and their relative position to (save) is fixed during execution.
Quoted 6 lines
The position of the code is not fixed during execution since you execute it from a virtual address obtained dynamically by
vmap()and the address is definitely different from the one the code was compiled for, but if you look at the code that compile actually produce you will see that it uses absolute address to access "save" and this is why it works. I wounder why compiler decided to use absolute address this time, Paolo?
Because he's using assembly with operands that he wrote himself. Before he was using "m" and the compiler decided to express the memory operand as "save(%rip)".
The assembler then emits different opcodes (of course) and also different relocations. In the current code, it tells the linker to place an absolute address. In the previous one, it tells the linker to place a delta from %rip.
Paolo
Quoted 173 lines
Quoted 7 lines
In this way, test case of
test_mmx_movq_mfneeds to pre-define its own stack, this change is in the next patch.In this version,
insn_ramis initially mapped toinsn_pageand them each call to insn_page/alt_insn_page are all viainsn_ram. This trick runs well but I don't know why my previous version causes error.Because previous version tried to use
install_page()on a large page mapped region and the function does not know how to handle that.Quoted 149 lines
Arthur.
Quoted 142 lines · Arthur Chunqi Li
Add a function
trap_emulatorto run an instruction in emulator. Set inregs first (%rax is invalid because it is used as return address), put instruction codec inalt_insnand call func withalt_insn_length. Get results in outregs.Signed-off-by Arthur Chunqi Li <[email protected]>--- x86/emulator.c | 110 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 110 insertions(+) mode change 100644 => 100755 x86/emulator.cx86/emulator.c +110
-1@@ -11,6 +11,15 @@ int fails, tests;static int exceptions; +struct regs { +u64 rax, rbx, rcx, rdx; +u64 rsi, rdi, rsp, rbp; +u64 r8, r9, r10, r11; +u64 r12, r13, r14, r15; +u64 rip, rflags; +}; +struct regs inregs, outregs, save; +void report (const char *name,int result) { ++tests;@@ -685,6 +694,107 @@ static void test_shld_shrd(u32 *mem)report ("shrd (cl)" , *mem == ((0x12345678 >>3 ) | (5u <<29 ))); } +#define INSN_SAVE \ + "ret\n\t" \ + "pushf\n\t" \ + "push 136+save \n\t" \ + "popf \n\t" \ + "xchg %rax, 0+save \n\t" \ + "xchg %rbx, 8+save \n\t" \ + "xchg %rcx, 16+save \n\t" \ + "xchg %rdx, 24+save \n\t" \ + "xchg %rsi, 32+save \n\t" \ + "xchg %rdi, 40+save \n\t" \ + "xchg %rsp, 48+save \n\t" \ + "xchg %rbp, 56+save \n\t" \ + "xchg %r8, 64+save \n\t" \ + "xchg %r9, 72+save \n\t" \ + "xchg %r10, 80+save \n\t" \ + "xchg %r11, 88+save \n\t" \ + "xchg %r12, 96+save \n\t" \ + "xchg %r13, 104+save \n\t" \ + "xchg %r14, 112+save \n\t" \ + "xchg %r15, 120+save \n\t" \ + +#define INSN_RESTORE \ + "xchg %rax, 0+save \n\t" \ + "xchg %rbx, 8+save \n\t" \ + "xchg %rcx, 16+save \n\t" \ + "xchg %rdx, 24+save \n\t" \ + "xchg %rsi, 32+save \n\t" \ + "xchg %rdi, 40+save \n\t" \ + "xchg %rsp, 48+save \n\t" \ + "xchg %rbp, 56+save \n\t" \ + "xchg %r8, 64+save \n\t" \ + "xchg %r9, 72+save \n\t" \ + "xchg %r10, 80+save \n\t" \ + "xchg %r11, 88+save \n\t" \ + "xchg %r12, 96+save \n\t" \ + "xchg %r13, 104+save \n\t" \ + "xchg %r14, 112+save \n\t" \ + "xchg %r15, 120+save \n\t" \ + "pushf \n\t" \ + "pop 136+save \n\t" \ + "popf \n\t" \ + "ret \n\t" \ + +#define INSN_TRAP \ + "in (%dx),%al\n\t" \ + ". = . + 31\n\t" \ + +asm( +".align 4096\n\t" +"insn_page:\n\t" +INSN_SAVE +"test_insn:\n\t" +INSN_TRAP +"test_insn_end:\n\t" +INSN_RESTORE +"insn_page_end:\n\t" +".align 4096\n\t" + +"alt_insn_page:\n\t" +INSN_SAVE +"alt_test_insn:\n\t" +INSN_TRAP +"alt_test_insn_end:\n\t" +INSN_RESTORE +"alt_insn_page_end:\n\t" +".align 4096\n\t" +); + +static void trap_emulator (uint64_t *mem,uint8_t * alt_insn,int alt_insn_length) +{ +ulong *cr3 = (ulong *)read_cr3 (); +void *insn_ram; +int i; +extern u8 insn_page[], test_insn[], test_insn_end[]; +extern u8 alt_insn_page[], alt_test_insn[]; + + insn_ram =vmap (virt_to_phys (insn_page),4096 ); +for (i=1 ; i<test_insn_end - test_insn; i++) + alt_test_insn[i] = test_insn[i] =0x90 ;// nop +for (i=0 ; i<alt_insn_length; i++) + alt_test_insn[i] = alt_insn[i]; +for (;i<test_insn_end - test_insn; i++) + alt_test_insn[i] =0x90 ;// nop + save = inregs; + +// Load the code TLB with insn_page, but point the page tables at +// alt_insn_page (and keep the data TLB clear, for AMD decode assist). +// This will make the CPU trap on the insn_page instruction but the +// hypervisor will see alt_insn_page. +install_page (cr3,virt_to_phys (insn_page), insn_ram); +invlpg (insn_ram); +// Load code TLB + asmvolatile ("call *%0" : :"r" (insn_ram)); +install_page (cr3,virt_to_phys (alt_insn_page), insn_ram); +// Trap, let hypervisor emulate at alt_insn_page + asmvolatile ("call *%0" : :"r" (insn_ram+1 )); + + outregs = save; +} +static void advance_rip_by_3_and_note_exception (struct ex_regs *regs) { ++exceptions; --Quoted 2 lines
1.7.9.5
Quoted 6 lines
--
Arthur Chunqi Li
Department of Computer Science
School of EECS
Peking University
Beijing, China--
Gleb.
--
To unsubscribe from this list: send the line "unsubscribe kvm" in the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
Quoted 14 lines · Paolo Bonzini
Il 19/06/2013 18:03, Gleb Natapov ha scritto:
Quoted 6 lines · 李春奇
Quoted 5 lines
Hi Gleb,
This version can set %rsp before trapping into emulator, becauseinsn_pageandalt_insn_pageis statically defined and their relative position to (save) is fixed during execution.Quoted 6 lines
The position of the code is not fixed during execution since you execute it from a virtual address obtained dynamically by
vmap()and the address is definitely different from the one the code was compiled for, but if you look at the code that compile actually produce you will see that it uses absolute address to access "save" and this is why it works. I wounder why compiler decided to use absolute address this time, Paolo?
Quoted 9 lines
Because he's using assembly with operands that he wrote himself. Before he was using "m" and the compiler decided to express the memory operand as "save(%rip)".
The assembler then emits different opcodes (of course) and also different relocations. In the current code, it tells the linker to place an absolute address. In the previous one, it tells the linker to place a delta from %rip.
Heh, make sense. OK, so we will go with that. Will comment on the patch itself.
Quoted 175 lines
Paolo
Quoted 173 lines
Quoted 7 lines
In this way, test case of
test_mmx_movq_mfneeds to pre-define its own stack, this change is in the next patch.In this version,
insn_ramis initially mapped toinsn_pageand them each call to insn_page/alt_insn_page are all viainsn_ram. This trick runs well but I don't know why my previous version causes error.Because previous version tried to use
install_page()on a large page mapped region and the function does not know how to handle that.Quoted 149 lines
Arthur.
Quoted 142 lines · Arthur Chunqi Li
Add a function
trap_emulatorto run an instruction in emulator. Set inregs first (%rax is invalid because it is used as return address), put instruction codec inalt_insnand call func withalt_insn_length. Get results in outregs.Signed-off-by Arthur Chunqi Li <[email protected]>--- x86/emulator.c | 110 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 110 insertions(+) mode change 100644 => 100755 x86/emulator.cx86/emulator.c +110
-1@@ -11,6 +11,15 @@ int fails, tests;static int exceptions; +struct regs { +u64 rax, rbx, rcx, rdx; +u64 rsi, rdi, rsp, rbp; +u64 r8, r9, r10, r11; +u64 r12, r13, r14, r15; +u64 rip, rflags; +}; +struct regs inregs, outregs, save; +void report (const char *name,int result) { ++tests;@@ -685,6 +694,107 @@ static void test_shld_shrd(u32 *mem)report ("shrd (cl)" , *mem == ((0x12345678 >>3 ) | (5u <<29 ))); } +#define INSN_SAVE \ + "ret\n\t" \ + "pushf\n\t" \ + "push 136+save \n\t" \ + "popf \n\t" \ + "xchg %rax, 0+save \n\t" \ + "xchg %rbx, 8+save \n\t" \ + "xchg %rcx, 16+save \n\t" \ + "xchg %rdx, 24+save \n\t" \ + "xchg %rsi, 32+save \n\t" \ + "xchg %rdi, 40+save \n\t" \ + "xchg %rsp, 48+save \n\t" \ + "xchg %rbp, 56+save \n\t" \ + "xchg %r8, 64+save \n\t" \ + "xchg %r9, 72+save \n\t" \ + "xchg %r10, 80+save \n\t" \ + "xchg %r11, 88+save \n\t" \ + "xchg %r12, 96+save \n\t" \ + "xchg %r13, 104+save \n\t" \ + "xchg %r14, 112+save \n\t" \ + "xchg %r15, 120+save \n\t" \ + +#define INSN_RESTORE \ + "xchg %rax, 0+save \n\t" \ + "xchg %rbx, 8+save \n\t" \ + "xchg %rcx, 16+save \n\t" \ + "xchg %rdx, 24+save \n\t" \ + "xchg %rsi, 32+save \n\t" \ + "xchg %rdi, 40+save \n\t" \ + "xchg %rsp, 48+save \n\t" \ + "xchg %rbp, 56+save \n\t" \ + "xchg %r8, 64+save \n\t" \ + "xchg %r9, 72+save \n\t" \ + "xchg %r10, 80+save \n\t" \ + "xchg %r11, 88+save \n\t" \ + "xchg %r12, 96+save \n\t" \ + "xchg %r13, 104+save \n\t" \ + "xchg %r14, 112+save \n\t" \ + "xchg %r15, 120+save \n\t" \ + "pushf \n\t" \ + "pop 136+save \n\t" \ + "popf \n\t" \ + "ret \n\t" \ + +#define INSN_TRAP \ + "in (%dx),%al\n\t" \ + ". = . + 31\n\t" \ + +asm( +".align 4096\n\t" +"insn_page:\n\t" +INSN_SAVE +"test_insn:\n\t" +INSN_TRAP +"test_insn_end:\n\t" +INSN_RESTORE +"insn_page_end:\n\t" +".align 4096\n\t" + +"alt_insn_page:\n\t" +INSN_SAVE +"alt_test_insn:\n\t" +INSN_TRAP +"alt_test_insn_end:\n\t" +INSN_RESTORE +"alt_insn_page_end:\n\t" +".align 4096\n\t" +); + +static void trap_emulator (uint64_t *mem,uint8_t * alt_insn,int alt_insn_length) +{ +ulong *cr3 = (ulong *)read_cr3 (); +void *insn_ram; +int i; +extern u8 insn_page[], test_insn[], test_insn_end[]; +extern u8 alt_insn_page[], alt_test_insn[]; + + insn_ram =vmap (virt_to_phys (insn_page),4096 ); +for (i=1 ; i<test_insn_end - test_insn; i++) + alt_test_insn[i] = test_insn[i] =0x90 ;// nop +for (i=0 ; i<alt_insn_length; i++) + alt_test_insn[i] = alt_insn[i]; +for (;i<test_insn_end - test_insn; i++) + alt_test_insn[i] =0x90 ;// nop + save = inregs; + +// Load the code TLB with insn_page, but point the page tables at +// alt_insn_page (and keep the data TLB clear, for AMD decode assist). +// This will make the CPU trap on the insn_page instruction but the +// hypervisor will see alt_insn_page. +install_page (cr3,virt_to_phys (insn_page), insn_ram); +invlpg (insn_ram); +// Load code TLB + asmvolatile ("call *%0" : :"r" (insn_ram)); +install_page (cr3,virt_to_phys (alt_insn_page), insn_ram); +// Trap, let hypervisor emulate at alt_insn_page + asmvolatile ("call *%0" : :"r" (insn_ram+1 )); + + outregs = save; +} +static void advance_rip_by_3_and_note_exception (struct ex_regs *regs) { ++exceptions; --Quoted 2 lines
1.7.9.5
Quoted 6 lines
--
Arthur Chunqi Li
Department of Computer Science
School of EECS
Peking University
Beijing, China--
Gleb.
--
To unsubscribe from this list: send the line "unsubscribe kvm" in the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
--
Gleb.
Quoted 34 lines · Arthur Chunqi Li
Add a function
trap_emulatorto run an instruction in emulator. Set inregs first (%rax is invalid because it is used as return address), put instruction codec inalt_insnand call func withalt_insn_length. Get results in outregs.Signed-off-by Arthur Chunqi Li <[email protected]>--- x86/emulator.c | 110 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 110 insertions(+) mode change 100644 => 100755 x86/emulator.cx86/emulator.c +9
-0@@ -11,6 +11,15 @@ int fails, tests;static int exceptions; +struct regs { +u64 rax, rbx, rcx, rdx; +u64 rsi, rdi, rsp, rbp; +u64 r8, r9, r10, r11; +u64 r12, r13, r14, r15; +u64 rip, rflags; +}; +struct regs inregs, outregs, save; +void report (const char *name,int result) { ++tests;
x86/emulator.c static void test_shld_shrd(u32 *mem) · line 697
Quoted 4 lines
x86/emulator.c +1
-0@@ -685,6 +694,107 @@ static void test_shld_shrd(u32 *mem)report ("shrd (cl)" , *mem == ((0x12345678 >>3 ) | (5u <<29 ))); } +#define INSN_SAVE \
No need for all the defines. Put all the code into insn_page, allocate alt_insn_page dynamically and copy the code there by memcpy.
Quoted 36 lines
x86/emulator.c +36
-0+"ret\n\t" \ +"pushf\n\t" \ +"push 136+save \n\t" \ +"popf \n\t" \ +"xchg %rax, 0+save \n\t" \ +"xchg %rbx, 8+save \n\t" \ +"xchg %rcx, 16+save \n\t" \ +"xchg %rdx, 24+save \n\t" \ +"xchg %rsi, 32+save \n\t" \ +"xchg %rdi, 40+save \n\t" \ +"xchg %rsp, 48+save \n\t" \ +"xchg %rbp, 56+save \n\t" \ +"xchg %r8, 64+save \n\t" \ +"xchg %r9, 72+save \n\t" \ +"xchg %r10, 80+save \n\t" \ +"xchg %r11, 88+save \n\t" \ +"xchg %r12, 96+save \n\t" \ +"xchg %r13, 104+save \n\t" \ +"xchg %r14, 112+save \n\t" \ +"xchg %r15, 120+save \n\t" \ + +#define INSN_RESTORE \ +"xchg %rax, 0+save \n\t" \ +"xchg %rbx, 8+save \n\t" \ +"xchg %rcx, 16+save \n\t" \ +"xchg %rdx, 24+save \n\t" \ +"xchg %rsi, 32+save \n\t" \ +"xchg %rdi, 40+save \n\t" \ +"xchg %rsp, 48+save \n\t" \ +"xchg %rbp, 56+save \n\t" \ +"xchg %r8, 64+save \n\t" \ +"xchg %r9, 72+save \n\t" \ +"xchg %r10, 80+save \n\t" \ +"xchg %r11, 88+save \n\t" \ +"xchg %r12, 96+save \n\t" \ +"xchg %r13, 104+save \n\t" \
x86/emulator.c static void test_shld_shrd(u32 *mem) · line 743
Quoted 10 lines
x86/emulator.c +10
-0+"xchg %r14, 112+save \n\t" \ +"xchg %r15, 120+save \n\t" \ +"pushf \n\t" \ +"pop 136+save \n\t" \ +"popf \n\t" \ +"ret \n\t" \ + +#define INSN_TRAP \ +"in (%dx),%al\n\t" \ +". = . + 31\n\t" \
If you will do ".skip 31, 0x90\n\t" instead you can drop loop that inserts nops bellow.
Quoted 33 lines
x86/emulator.c +33
-0+ +asm( +".align 4096\n\t" +"insn_page:\n\t" +INSN_SAVE +"test_insn:\n\t" +INSN_TRAP +"test_insn_end:\n\t" +INSN_RESTORE +"insn_page_end:\n\t" +".align 4096\n\t" + +"alt_insn_page:\n\t" +INSN_SAVE +"alt_test_insn:\n\t" +INSN_TRAP +"alt_test_insn_end:\n\t" +INSN_RESTORE +"alt_insn_page_end:\n\t" +".align 4096\n\t" +); + +static void trap_emulator (uint64_t *mem,uint8_t * alt_insn,int alt_insn_length) +{ +ulong *cr3 = (ulong *)read_cr3 (); +void *insn_ram; +int i; +extern u8 insn_page[], test_insn[], test_insn_end[]; +extern u8 alt_insn_page[], alt_test_insn[]; + + insn_ram =vmap (virt_to_phys (insn_page),4096 ); +for (i=1 ; i<test_insn_end - test_insn; i++) + alt_test_insn[i] = test_insn[i] =0x90 ;// nop
x86/emulator.c static void test_shld_shrd(u32 *mem) · line 786
Quoted 10 lines
x86/emulator.c +10
-0+for (i=0 ; i<alt_insn_length; i++) + alt_test_insn[i] = alt_insn[i]; +for (;i<test_insn_end - test_insn; i++) + alt_test_insn[i] =0x90 ;// nop + save = inregs; + +// Load the code TLB with insn_page, but point the page tables at +// alt_insn_page (and keep the data TLB clear, for AMD decode assist). +// This will make the CPU trap on the insn_page instruction but the +// hypervisor will see alt_insn_page.
I prefer all the comments to be changed to /**/ style while we are at it.
Quoted 16 lines
x86/emulator.c +11
-0+install_page (cr3,virt_to_phys (insn_page), insn_ram); +invlpg (insn_ram); +// Load code TLB + asmvolatile ("call *%0" : :"r" (insn_ram)); +install_page (cr3,virt_to_phys (alt_insn_page), insn_ram); +// Trap, let hypervisor emulate at alt_insn_page + asmvolatile ("call *%0" : :"r" (insn_ram+1 )); + + outregs = save; +} +static void advance_rip_by_3_and_note_exception (struct ex_regs *regs) { ++exceptions;Signature · 1 line
1.7.9.5
--
Gleb.
ok, I will handle all above in the following commit.
Arthur Chunqi Li
Department of Computer Science
School of EECS
Peking University
Beijing, China
From my iPhone
Quoted 155 lines · 在 2013-6-20，16:48，Gleb Natapov <[email protected]> 写道：
Quoted 34 lines · Arthur Chunqi Li
Add a function
trap_emulatorto run an instruction in emulator. Set inregs first (%rax is invalid because it is used as return address), put instruction codec inalt_insnand call func withalt_insn_length. Get results in outregs.Signed-off-by Arthur Chunqi Li <[email protected]>---
x86/emulator.c| 110 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++1 file changed, 110 insertions(+)mode change 100644 => 100755
x86/emulator.cx86/emulator.c +9
-0@@ -11,6 +11,15 @@ int fails, tests;static int exceptions; +struct regs { +u64 rax, rbx, rcx, rdx; +u64 rsi, rdi, rsp, rbp; +u64 r8, r9, r10, r11; +u64 r12, r13, r14, r15; +u64 rip, rflags; +}; +struct regs inregs, outregs, save; +void report (const char *name,int result) { ++tests;x86/emulator.c static void test_shld_shrd(u32 *mem) · line 697
Quoted 4 lines
x86/emulator.c +1
-0@@ -685,6 +694,107 @@ static void test_shld_shrd(u32 *mem)report ("shrd (cl)" , *mem == ((0x12345678 >>3 ) | (5u <<29 ))); } +#define INSN_SAVE \No need for all the defines. Put all the code into
insn_page, allocatealt_insn_pagedynamically and copy the code there by memcpy.Quoted 36 lines
x86/emulator.c +36
-0+"ret\n\t" \ +"pushf\n\t" \ +"push 136+save \n\t" \ +"popf \n\t" \ +"xchg %rax, 0+save \n\t" \ +"xchg %rbx, 8+save \n\t" \ +"xchg %rcx, 16+save \n\t" \ +"xchg %rdx, 24+save \n\t" \ +"xchg %rsi, 32+save \n\t" \ +"xchg %rdi, 40+save \n\t" \ +"xchg %rsp, 48+save \n\t" \ +"xchg %rbp, 56+save \n\t" \ +"xchg %r8, 64+save \n\t" \ +"xchg %r9, 72+save \n\t" \ +"xchg %r10, 80+save \n\t" \ +"xchg %r11, 88+save \n\t" \ +"xchg %r12, 96+save \n\t" \ +"xchg %r13, 104+save \n\t" \ +"xchg %r14, 112+save \n\t" \ +"xchg %r15, 120+save \n\t" \ + +#define INSN_RESTORE \ +"xchg %rax, 0+save \n\t" \ +"xchg %rbx, 8+save \n\t" \ +"xchg %rcx, 16+save \n\t" \ +"xchg %rdx, 24+save \n\t" \ +"xchg %rsi, 32+save \n\t" \ +"xchg %rdi, 40+save \n\t" \ +"xchg %rsp, 48+save \n\t" \ +"xchg %rbp, 56+save \n\t" \ +"xchg %r8, 64+save \n\t" \ +"xchg %r9, 72+save \n\t" \ +"xchg %r10, 80+save \n\t" \ +"xchg %r11, 88+save \n\t" \ +"xchg %r12, 96+save \n\t" \ +"xchg %r13, 104+save \n\t" \x86/emulator.c static void test_shld_shrd(u32 *mem) · line 743
Quoted 10 lines
x86/emulator.c +10
-0+"xchg %r14, 112+save \n\t" \ +"xchg %r15, 120+save \n\t" \ +"pushf \n\t" \ +"pop 136+save \n\t" \ +"popf \n\t" \ +"ret \n\t" \ + +#define INSN_TRAP \ +"in (%dx),%al\n\t" \ +". = . + 31\n\t" \If you will do ".skip 31, 0x90\n\t" instead you can drop loop that inserts nops bellow.
Quoted 33 lines
x86/emulator.c +33
-0+ +asm( +".align 4096\n\t" +"insn_page:\n\t" +INSN_SAVE +"test_insn:\n\t" +INSN_TRAP +"test_insn_end:\n\t" +INSN_RESTORE +"insn_page_end:\n\t" +".align 4096\n\t" + +"alt_insn_page:\n\t" +INSN_SAVE +"alt_test_insn:\n\t" +INSN_TRAP +"alt_test_insn_end:\n\t" +INSN_RESTORE +"alt_insn_page_end:\n\t" +".align 4096\n\t" +); + +static void trap_emulator (uint64_t *mem,uint8_t * alt_insn,int alt_insn_length) +{ +ulong *cr3 = (ulong *)read_cr3 (); +void *insn_ram; +int i; +extern u8 insn_page[], test_insn[], test_insn_end[]; +extern u8 alt_insn_page[], alt_test_insn[]; + + insn_ram =vmap (virt_to_phys (insn_page),4096 ); +for (i=1 ; i<test_insn_end - test_insn; i++) + alt_test_insn[i] = test_insn[i] =0x90 ;// nop x86/emulator.c static void test_shld_shrd(u32 *mem) · line 786
Quoted 10 lines
x86/emulator.c +10
-0+for (i=0 ; i<alt_insn_length; i++) + alt_test_insn[i] = alt_insn[i]; +for (;i<test_insn_end - test_insn; i++) + alt_test_insn[i] =0x90 ;// nop + save = inregs; + +// Load the code TLB with insn_page, but point the page tables at +// alt_insn_page (and keep the data TLB clear, for AMD decode assist). +// This will make the CPU trap on the insn_page instruction but the +// hypervisor will see alt_insn_page. I prefer all the comments to be changed to /**/ style while we are at it.
Quoted 16 lines
x86/emulator.c +11
-0+install_page (cr3,virt_to_phys (insn_page), insn_ram); +invlpg (insn_ram); +// Load code TLB + asmvolatile ("call *%0" : :"r" (insn_ram)); +install_page (cr3,virt_to_phys (alt_insn_page), insn_ram); +// Trap, let hypervisor emulate at alt_insn_page + asmvolatile ("call *%0" : :"r" (insn_ram+1 )); + + outregs = save; +} +static void advance_rip_by_3_and_note_exception (struct ex_regs *regs) { ++exceptions;Signature · 1 line
1.7.9.5--
Gleb.