Re: [PATCH RFC] KVM: inject #UD if instruction emulation fails while vcpu is in cpl==3

[Gleb Natapov <gleb@redhat.com>]

On Thu, May 06, 2010 at 01:13:30PM +0300, Avi Kivity wrote:
> On 05/06/2010 01:06 PM, Gleb Natapov wrote:
> >On Thu, May 06, 2010 at 12:15:58PM +0300, Avi Kivity wrote:
> >>On 04/29/2010 02:58 PM, Gleb Natapov wrote:
> >>>Do not kill VM If instruction emulation fails while vcpu is in
> >>>userspace. Inject #UD instead in a hope that guest OS will kill offending
> >>>process. Emulation failure is still traced by ftrace point to help
> >>>analyze the problem.
> >>Still there's the risk here that a critical failure goes unnoticed.
> >>ftrace isn't on at all times.
> >>
> >Kvm_stat will still show that there was emulation failure, so if strange
> >application behaviour is reported kvm_stat output will have hints where
> >to look. Next step in analyzing the problem will be enabling emulator
> >tracing.
> 
> We can expect that from a developer or a user subscribed to kvm@.
> But what about some random user running virt-manager?
> 
What virt-manager would do about such error?

> dmesg and kvm_stat will not go up the management stack.
> 
> >>We can probably inject a #UD unconditionally and exit to userspace.
> >>Userspace would then report the problem to the user and reenter the
> >>guest, which would then recover or not.
> >>
> >By "unconditionally" you mean even if guest is in kernel mode?
> 
> Yes.
> 
> >There is
> >no point in trying to continue after that happens. Instead of getting
> >paused VM at exact place where problem happened and easily analyzable we
> >will get misbehaved VM with undefined state.
> 
> True.  But the same problem exists with cpl>0 #UD.  It may be a
> critical driver in userspace (say, video driver).
> 
> Also need to think consider nested kernels (which are userspace for
> this purpose).
Ugh, we can check if vcpu is in nested mode.

> 
> How about default to unconditional #UD and report, and pause if
> requested (in userspace)?  Usually emulation failures will be 100%
> reproducible, so the user can rerun their workload.
> 
Didn't what to involve userspace in this, but it can be done of course.
 
--
			Gleb.