Re: [PATCH] KVM: VMX: Update instruction length on intercepted BP

[Jan Kiszka <jan.kiszka@web.de>]

[-- Attachment #1: Type: text/plain, Size: 2482 bytes --]

Gleb Natapov wrote:
> On Sun, Feb 14, 2010 at 11:47:58AM +0100, Jan Kiszka wrote:
>> Gleb Natapov wrote:
>>> On Sun, Feb 14, 2010 at 11:26:31AM +0100, Jan Kiszka wrote:
>>>> Gleb Natapov wrote:
>>>>> On Sat, Feb 13, 2010 at 10:31:12AM +0100, Jan Kiszka wrote:
>>>>>> From: Jan Kiszka <jan.kiszka@siemens.com>
>>>>>>
>>>>>> We intercept #BP while in guest debugging mode. As VM exists due to
>>>>>> intercepted exceptions do not necessarily come with valid
>>>>>> idt_vectoring, we have to update event_exit_inst_len explicitly in such
>>>>>> cases. At least in the absence of migration, this ensures that
>>>>>> re-injections of #BP will find and use the correct instruction length.
>>>>>>
>>>>> event_exit_inst_len is only used for event reinjection. Since event
>>>>> intercepted here will not be reinjected why updating event_exit_inst_len
>>>>> is needed here?
>>>> In guest debugging mode a #BP exception is always reported to user space
>>>> to find out what caused it. If it was the guest itself, the exception is
>>>> reinjected, on older kernels via KVM_SET_GUEST_DEBUG and since 2.6.33
>>>> via KVM_SET_VCPU_EVENTS (the latter requires some qemu patch that I will
>>>> post later).
>>>>
>>>> As we currently do not update event_exit_inst_len on #BP exits,
>>>> reinjecting fails unless event_exit_inst_len happens to be 1 from some
>>>> other exit.
>>>>
>>> Hmm, how does it work on SVM then where we do not have
>>> event_exit_inst_len so execution will resume on the same rip that caused
>>> #BP after event reinjection?
>>>
>> Maybe not at all. I don't think I've tested this scenario on amd so far.
>> Guess it needs some special handling in svm to move rip after the int3
>> when requesting to inject #BP.
>>
> This will work for VMX too, no? So may be we should design something
> that will work for both VMX and SVM before applying patches that make
> oly VMX work?

VMX used to work, so my patch is actually a regression fix. I bet this
was accidentally broken while cleaning up the interrupt handling of VMX.

> How about disabling #BP intercept and reenter guest (may
> be single step it at this point to reenable #BP interception ASAP)?

If there were be some "sticky" single-step that is pushed into exception
handlers as well...

> 
> PS: moving rip after int3 may lead to wrong rip to be pushed on
> exception stack if exception happens during event delivery.
> 

Hmm, would have been too easy.

Jan


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 257 bytes --]