On Wed, Jun 19, 2013 at 11:07:18PM +0800, 李春奇 <Arthur Chunqi Li> wrote:
> Hi Gleb,
> This version can set %rsp before trapping into emulator, because
> insn_page and alt_insn_page is statically defined and their relative
> position to (save) is fixed during execution.
>
The position of the code is not fixed during execution since you execute
it from a virtual address obtained dynamically by vmap() and the address
is definitely different from the one the code was compiled for, but if
you look at the code that compile actually produce you will see that it
uses absolute address to access "save" and this is why it works. I
wounder why compiler decided to use absolute address this time, Paolo?
> In this way, test case of test_mmx_movq_mf needs to pre-define its own
> stack, this change is in the next patch.
>
> In this version, insn_ram is initially mapped to insn_page and them
> each call to insn_page/alt_insn_page are all via insn_ram. This trick
> runs well but I don't know why my previous version causes error.
>
Because previous version tried to use install_page() on a large page
mapped region and the function does not know how to handle that.
> Arthur.
> On Wed, Jun 19, 2013 at 11:00 PM, Arthur Chunqi Li <yzt356@xxxxxxxxx> wrote:
> > Add a function trap_emulator to run an instruction in emulator.
> > Set inregs first (%rax is invalid because it is used as return
> > address), put instruction codec in alt_insn and call func with
> > alt_insn_length. Get results in outregs.
> >
> > Signed-off-by: Arthur Chunqi Li <yzt356@xxxxxxxxx>
> > ---
> > x86/emulator.c | 110 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++
> > 1 file changed, 110 insertions(+)
> > mode change 100644 => 100755 x86/emulator.c
> >
> > diff --git a/x86/emulator.c b/x86/emulator.c
> > old mode 100644
> > new mode 100755
> > index 96576e5..48d45c8
> > --- a/x86/emulator.c
> > +++ b/x86/emulator.c
> > @@ -11,6 +11,15 @@ int fails, tests;
> >
> > static int exceptions;
> >
> > +struct regs {
> > + u64 rax, rbx, rcx, rdx;
> > + u64 rsi, rdi, rsp, rbp;
> > + u64 r8, r9, r10, r11;
> > + u64 r12, r13, r14, r15;
> > + u64 rip, rflags;
> > +};
> > +struct regs inregs, outregs, save;
> > +
> > void report(const char *name, int result)
> > {
> > ++tests;
> > @@ -685,6 +694,107 @@ static void test_shld_shrd(u32 *mem)
> > report("shrd (cl)", *mem == ((0x12345678 >> 3) | (5u << 29)));
> > }
> >
> > +#define INSN_SAVE \
> > + "ret\n\t" \
> > + "pushf\n\t" \
> > + "push 136+save \n\t" \
> > + "popf \n\t" \
> > + "xchg %rax, 0+save \n\t" \
> > + "xchg %rbx, 8+save \n\t" \
> > + "xchg %rcx, 16+save \n\t" \
> > + "xchg %rdx, 24+save \n\t" \
> > + "xchg %rsi, 32+save \n\t" \
> > + "xchg %rdi, 40+save \n\t" \
> > + "xchg %rsp, 48+save \n\t" \
> > + "xchg %rbp, 56+save \n\t" \
> > + "xchg %r8, 64+save \n\t" \
> > + "xchg %r9, 72+save \n\t" \
> > + "xchg %r10, 80+save \n\t" \
> > + "xchg %r11, 88+save \n\t" \
> > + "xchg %r12, 96+save \n\t" \
> > + "xchg %r13, 104+save \n\t" \
> > + "xchg %r14, 112+save \n\t" \
> > + "xchg %r15, 120+save \n\t" \
> > +
> > +#define INSN_RESTORE \
> > + "xchg %rax, 0+save \n\t" \
> > + "xchg %rbx, 8+save \n\t" \
> > + "xchg %rcx, 16+save \n\t" \
> > + "xchg %rdx, 24+save \n\t" \
> > + "xchg %rsi, 32+save \n\t" \
> > + "xchg %rdi, 40+save \n\t" \
> > + "xchg %rsp, 48+save \n\t" \
> > + "xchg %rbp, 56+save \n\t" \
> > + "xchg %r8, 64+save \n\t" \
> > + "xchg %r9, 72+save \n\t" \
> > + "xchg %r10, 80+save \n\t" \
> > + "xchg %r11, 88+save \n\t" \
> > + "xchg %r12, 96+save \n\t" \
> > + "xchg %r13, 104+save \n\t" \
> > + "xchg %r14, 112+save \n\t" \
> > + "xchg %r15, 120+save \n\t" \
> > + "pushf \n\t" \
> > + "pop 136+save \n\t" \
> > + "popf \n\t" \
> > + "ret \n\t" \
> > +
> > +#define INSN_TRAP \
> > + "in (%dx),%al\n\t" \
> > + ". = . + 31\n\t" \
> > +
> > +asm(
> > + ".align 4096\n\t"
> > + "insn_page:\n\t"
> > + INSN_SAVE
> > + "test_insn:\n\t"
> > + INSN_TRAP
> > + "test_insn_end:\n\t"
> > + INSN_RESTORE
> > + "insn_page_end:\n\t"
> > + ".align 4096\n\t"
> > +
> > + "alt_insn_page:\n\t"
> > + INSN_SAVE
> > + "alt_test_insn:\n\t"
> > + INSN_TRAP
> > + "alt_test_insn_end:\n\t"
> > + INSN_RESTORE
> > + "alt_insn_page_end:\n\t"
> > + ".align 4096\n\t"
> > +);
> > +
> > +static void trap_emulator(uint64_t *mem, uint8_t* alt_insn, int alt_insn_length)
> > +{
> > + ulong *cr3 = (ulong *)read_cr3();
> > + void *insn_ram;
> > + int i;
> > + extern u8 insn_page[], test_insn[], test_insn_end[];
> > + extern u8 alt_insn_page[], alt_test_insn[];
> > +
> > + insn_ram = vmap(virt_to_phys(insn_page), 4096);
> > + for (i=1; i<test_insn_end - test_insn; i++)
> > + alt_test_insn[i] = test_insn[i] = 0x90; // nop
> > + for (i=0; i<alt_insn_length; i++)
> > + alt_test_insn[i] = alt_insn[i];
> > + for(;i<test_insn_end - test_insn; i++)
> > + alt_test_insn[i] = 0x90; // nop
> > + save = inregs;
> > +
> > + // Load the code TLB with insn_page, but point the page tables at
> > + // alt_insn_page (and keep the data TLB clear, for AMD decode assist).
> > + // This will make the CPU trap on the insn_page instruction but the
> > + // hypervisor will see alt_insn_page.
> > + install_page(cr3, virt_to_phys(insn_page), insn_ram);
> > + invlpg(insn_ram);
> > + // Load code TLB
> > + asm volatile("call *%0" : : "r"(insn_ram));
> > + install_page(cr3, virt_to_phys(alt_insn_page), insn_ram);
> > + // Trap, let hypervisor emulate at alt_insn_page
> > + asm volatile("call *%0": : "r"(insn_ram+1));
> > +
> > + outregs = save;
> > +}
> > +
> > static void advance_rip_by_3_and_note_exception(struct ex_regs *regs)
> > {
> > ++exceptions;
> > --
> > 1.7.9.5
> >
>
>
>
> --
> Arthur Chunqi Li
> Department of Computer Science
> School of EECS
> Peking University
> Beijing, China
--
Gleb.
--
To unsubscribe from this list: send the line "unsubscribe kvm" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
