Inquiry on Zentool Instruction Coverage and Symbol-to-ROM Mapping

[kuchhu96]

Hi,
I was wondering if you have evaluated microcode patches for instructions other than RDRAND? I'm curious whether Zentool provides (or can generate) a canonical list of instructions eligible for patching on Zen2 or 4.

Additionally, when writing a patch, I see the 'edit' command accepts symbolic targets (e.g., --match 0=@rdrand) instead of raw ROM addresses. Is there a way to trace an instruction to its microcode footprint (ROM or RAM addresses), or a reference (e.g., symbol table, etc.) that maps each @ to its corresponding ROM address or entry index for match-register configuration?

Thanks,
Khushboo

[matrizzo]

Hi,

The symbolic targets come from files like these https://github.com/google/security-research/blob/master/pocs/cpus/entrysign/zentool/data/cpu8181_matchreg.json
We found that those addresses correspond to those instructions by trial and error or brute force scanning. If you would like to patch a different instruction you would have to find out where in the ROM it is implemented.

[kuchhu96]

Thank you for your reply, Matteo. I was wondering if it is possible to apply a microcode patch to all instructions in the Zen2 or Zen4 architecture, including hardwired instructions like ADD, MOV, etc. I would appreciate any thoughts or feedback on this.

Thanks,
Khushboo

[matrizzo]

It's possible to patch any microcoded instructions as long as the address in the ROM where they are implemented is known.

It's also be possible to patch fastpath (non-microcoded) instructions using the mask registers but we don't fully understand how those work yet. More research is needed to discover exactly how to use them and what the limitations are.

[kuchhu96]

Hi Matteo,

I'm curious if this applies to all Zen machines or just Zen 4 and 5. I would greatly appreciate it if you could point me toward any resources on utilizing mask registers for fast path instructions.

Thanks,
Khushboo

[matrizzo]

It should apply to at least Zen 2 and newer but possibly all generations. We don't have any examples of how to use them I'm afraid, our understanding of them is still very limited.

[kuchhu96]

Thanks for clarifying! I'll focus on Zen 2 and newer for now. I understand the documentation is limited. I'll experiment a bit and see what insights I can gather. I'll share any findings that might help build our understanding.

Best,
Khushboo