Il 19/06/2013 18:03, Gleb Natapov ha scritto:
> On Wed, Jun 19, 2013 at 11:07:18PM +0800, 李春奇 <Arthur Chunqi Li> wrote:
>> Hi Gleb,
>> This version can set %rsp before trapping into emulator, because
>> insn_page and alt_insn_page is statically defined and their relative
>> position to (save) is fixed during execution.
>>
> The position of the code is not fixed during execution since you execute
> it from a virtual address obtained dynamically by vmap() and the address
> is definitely different from the one the code was compiled for, but if
> you look at the code that compile actually produce you will see that it
> uses absolute address to access "save" and this is why it works. I
> wounder why compiler decided to use absolute address this time, Paolo?
Because he's using assembly with operands that he wrote himself. Before
he was using "m" and the compiler decided to express the memory operand
as "save(%rip)".
The assembler then emits different opcodes (of course) and also
different relocations. In the current code, it tells the linker to
place an absolute address. In the previous one, it tells the linker to
place a delta from %rip.
Paolo
>> In this way, test case of test_mmx_movq_mf needs to pre-define its own
>> stack, this change is in the next patch.
>>
>> In this version, insn_ram is initially mapped to insn_page and them
>> each call to insn_page/alt_insn_page are all via insn_ram. This trick
>> runs well but I don't know why my previous version causes error.
>>
> Because previous version tried to use install_page() on a large page
> mapped region and the function does not know how to handle that.
>
>> Arthur.
>> On Wed, Jun 19, 2013 at 11:00 PM, Arthur Chunqi Li <yzt...@gmail.com> wrote:
>>> Add a function trap_emulator to run an instruction in emulator.
>>> Set inregs first (%rax is invalid because it is used as return
>>> address), put instruction codec in alt_insn and call func with
>>> alt_insn_length. Get results in outregs.
>>>
>>> Signed-off-by: Arthur Chunqi Li <yzt...@gmail.com>
>>> ---
>>> x86/emulator.c | 110
>>> ++++++++++++++++++++++++++++++++++++++++++++++++++++++++
>>> 1 file changed, 110 insertions(+)
>>> mode change 100644 => 100755 x86/emulator.c
>>>
>>> diff --git a/x86/emulator.c b/x86/emulator.c
>>> old mode 100644
>>> new mode 100755
>>> index 96576e5..48d45c8
>>> --- a/x86/emulator.c
>>> +++ b/x86/emulator.c
>>> @@ -11,6 +11,15 @@ int fails, tests;
>>>
>>> static int exceptions;
>>>
>>> +struct regs {
>>> + u64 rax, rbx, rcx, rdx;
>>> + u64 rsi, rdi, rsp, rbp;
>>> + u64 r8, r9, r10, r11;
>>> + u64 r12, r13, r14, r15;
>>> + u64 rip, rflags;
>>> +};
>>> +struct regs inregs, outregs, save;
>>> +
>>> void report(const char *name, int result)
>>> {
>>> ++tests;
>>> @@ -685,6 +694,107 @@ static void test_shld_shrd(u32 *mem)
>>> report("shrd (cl)", *mem == ((0x12345678 >> 3) | (5u << 29)));
>>> }
>>>
>>> +#define INSN_SAVE \
>>> + "ret\n\t" \
>>> + "pushf\n\t" \
>>> + "push 136+save \n\t" \
>>> + "popf \n\t" \
>>> + "xchg %rax, 0+save \n\t" \
>>> + "xchg %rbx, 8+save \n\t" \
>>> + "xchg %rcx, 16+save \n\t" \
>>> + "xchg %rdx, 24+save \n\t" \
>>> + "xchg %rsi, 32+save \n\t" \
>>> + "xchg %rdi, 40+save \n\t" \
>>> + "xchg %rsp, 48+save \n\t" \
>>> + "xchg %rbp, 56+save \n\t" \
>>> + "xchg %r8, 64+save \n\t" \
>>> + "xchg %r9, 72+save \n\t" \
>>> + "xchg %r10, 80+save \n\t" \
>>> + "xchg %r11, 88+save \n\t" \
>>> + "xchg %r12, 96+save \n\t" \
>>> + "xchg %r13, 104+save \n\t" \
>>> + "xchg %r14, 112+save \n\t" \
>>> + "xchg %r15, 120+save \n\t" \
>>> +
>>> +#define INSN_RESTORE \
>>> + "xchg %rax, 0+save \n\t" \
>>> + "xchg %rbx, 8+save \n\t" \
>>> + "xchg %rcx, 16+save \n\t" \
>>> + "xchg %rdx, 24+save \n\t" \
>>> + "xchg %rsi, 32+save \n\t" \
>>> + "xchg %rdi, 40+save \n\t" \
>>> + "xchg %rsp, 48+save \n\t" \
>>> + "xchg %rbp, 56+save \n\t" \
>>> + "xchg %r8, 64+save \n\t" \
>>> + "xchg %r9, 72+save \n\t" \
>>> + "xchg %r10, 80+save \n\t" \
>>> + "xchg %r11, 88+save \n\t" \
>>> + "xchg %r12, 96+save \n\t" \
>>> + "xchg %r13, 104+save \n\t" \
>>> + "xchg %r14, 112+save \n\t" \
>>> + "xchg %r15, 120+save \n\t" \
>>> + "pushf \n\t" \
>>> + "pop 136+save \n\t" \
>>> + "popf \n\t" \
>>> + "ret \n\t" \
>>> +
>>> +#define INSN_TRAP \
>>> + "in (%dx),%al\n\t" \
>>> + ". = . + 31\n\t" \
>>> +
>>> +asm(
>>> + ".align 4096\n\t"
>>> + "insn_page:\n\t"
>>> + INSN_SAVE
>>> + "test_insn:\n\t"
>>> + INSN_TRAP
>>> + "test_insn_end:\n\t"
>>> + INSN_RESTORE
>>> + "insn_page_end:\n\t"
>>> + ".align 4096\n\t"
>>> +
>>> + "alt_insn_page:\n\t"
>>> + INSN_SAVE
>>> + "alt_test_insn:\n\t"
>>> + INSN_TRAP
>>> + "alt_test_insn_end:\n\t"
>>> + INSN_RESTORE
>>> + "alt_insn_page_end:\n\t"
>>> + ".align 4096\n\t"
>>> +);
>>> +
>>> +static void trap_emulator(uint64_t *mem, uint8_t* alt_insn, int
>>> alt_insn_length)
>>> +{
>>> + ulong *cr3 = (ulong *)read_cr3();
>>> + void *insn_ram;
>>> + int i;
>>> + extern u8 insn_page[], test_insn[], test_insn_end[];
>>> + extern u8 alt_insn_page[], alt_test_insn[];
>>> +
>>> + insn_ram = vmap(virt_to_phys(insn_page), 4096);
>>> + for (i=1; i<test_insn_end - test_insn; i++)
>>> + alt_test_insn[i] = test_insn[i] = 0x90; // nop
>>> + for (i=0; i<alt_insn_length; i++)
>>> + alt_test_insn[i] = alt_insn[i];
>>> + for(;i<test_insn_end - test_insn; i++)
>>> + alt_test_insn[i] = 0x90; // nop
>>> + save = inregs;
>>> +
>>> + // Load the code TLB with insn_page, but point the page tables at
>>> + // alt_insn_page (and keep the data TLB clear, for AMD decode
>>> assist).
>>> + // This will make the CPU trap on the insn_page instruction but the
>>> + // hypervisor will see alt_insn_page.
>>> + install_page(cr3, virt_to_phys(insn_page), insn_ram);
>>> + invlpg(insn_ram);
>>> + // Load code TLB
>>> + asm volatile("call *%0" : : "r"(insn_ram));
>>> + install_page(cr3, virt_to_phys(alt_insn_page), insn_ram);
>>> + // Trap, let hypervisor emulate at alt_insn_page
>>> + asm volatile("call *%0": : "r"(insn_ram+1));
>>> +
>>> + outregs = save;
>>> +}
>>> +
>>> static void advance_rip_by_3_and_note_exception(struct ex_regs *regs)
>>> {
>>> ++exceptions;
>>> --
>>> 1.7.9.5
>>>
>>
>>
>>
>> --
>> Arthur Chunqi Li
>> Department of Computer Science
>> School of EECS
>> Peking University
>> Beijing, China
>
> --
> Gleb.
> --
> To unsubscribe from this list: send the line "unsubscribe kvm" in
> the body of a message to majord...@vger.kernel.org
> More majordomo info at http://vger.kernel.org/majordomo-info.html
>
--
To unsubscribe from this list: send the line "unsubscribe kvm" in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
