From mboxrd@z Thu Jan 1 00:00:00 1970 From: Juergen Gross Subject: Single step in HVM domU on Intel machine may see wrong DB6 Date: Thu, 20 Feb 2014 09:36:47 +0100 Message-ID: <5305BE9F.2090600@ts.fujitsu.com> Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="------------020908080302050204050106" Return-path: Received: from mail6.bemta5.messagelabs.com ([195.245.231.135]) by lists.xen.org with esmtp (Exim 4.72) (envelope-from ) id 1WGP7i-0003JC-6L for xen-devel@lists.xenproject.org; Thu, 20 Feb 2014 08:36:50 +0000 List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: xen-devel-bounces@lists.xen.org Errors-To: xen-devel-bounces@lists.xen.org To: xen-devel , eddie.dong@intel.com, jun.nakajima@intel.com, yang.z.zhang@intel.com Cc: Jan Beulich List-Id: xen-devel@lists.xenproject.org This is a multi-part message in MIME format. --------------020908080302050204050106 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Hi, I think I've found a bug in debug trap handling in the Xen hypervisor in case of a HVM domu using single stepping: Debug registers are restored on vcpu switch only if db7 has any debug events activated or if the debug registers are marked to be used by the domU. This leads to problems if the domU uses single stepping and vcpu switch occurs between the single step trap and reading of db6 in the guest. db6 contents (single step indicator) are lost in this case. Jan suggested to intercept the debug trap in the hypervisor and mark the debug registers to be used by the domU to enable saving and restoring the debug registers in case of a context switch. I used the attached patch (applies to Xen 4.2.3) to verify this solution and it worked (without the patch a test was able to reproduce the bug once in about 3 hours, with the patch the test ran for more than 12 hours without problem). Obviously the patch isn't the final one, as I deactivated the "monitor trap flag" feature to avoid any strange dependencies. Jan wanted someone from the VMX folks to put together a proper fix to avoid overlooking some corner case. Juergen -- Juergen Gross Principal Developer Operating Systems PBG PDG ES&S SWE OS6 Telephone: +49 (0) 89 62060 2932 Fujitsu e-mail: juergen.gross@ts.fujitsu.com Mies-van-der-Rohe-Str. 8 Internet: ts.fujitsu.com D-80807 Muenchen Company details: ts.fujitsu.com/imprint.html --------------020908080302050204050106 Content-Type: text/x-patch; name="single-step.patch" Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename="single-step.patch" --- xen-4.2.3-testing.orig/xen/include/asm-x86/hvm/hvm.h 2014-02-14 19:05:59.000000000 +0100 +++ xen-4.2.3-testing/xen/include/asm-x86/hvm/hvm.h 2014-02-17 07:43:05.000000000 +0100 @@ -374,7 +374,8 @@ static inline int hvm_do_pmu_interrupt(s (cpu_has_xsave ? X86_CR4_OSXSAVE : 0)))) /* These exceptions must always be intercepted. */ -#define HVM_TRAP_MASK ((1U << TRAP_machine_check) | (1U << TRAP_invalid_op)) +#define HVM_TRAP_MASK ((1U << TRAP_machine_check) | (1U << TRAP_invalid_op) |\ + (1 << TRAP_debug)) /* * x86 event types. This enumeration is valid for: --- xen-4.2.3-testing.orig/xen/arch/x86/hvm/vmx/vmcs.c 2014-02-17 07:48:43.000000000 +0100 +++ xen-4.2.3-testing/xen/arch/x86/hvm/vmx/vmcs.c 2014-02-17 10:16:25.000000000 +0100 @@ -168,7 +168,7 @@ static int vmx_init_vmcs_config(void) CPU_BASED_RDTSC_EXITING); opt = (CPU_BASED_ACTIVATE_MSR_BITMAP | CPU_BASED_TPR_SHADOW | - CPU_BASED_MONITOR_TRAP_FLAG | + /* CPU_BASED_MONITOR_TRAP_FLAG | */ CPU_BASED_ACTIVATE_SECONDARY_CONTROLS); _vmx_cpu_based_exec_control = adjust_vmx_controls( "CPU-Based Exec Control", min, opt, --- xen-4.2.3-testing.orig/xen/arch/x86/hvm/vmx/vmx.c 2014-02-18 08:04:23.000000000 +0100 +++ xen-4.2.3-testing/xen/arch/x86/hvm/vmx/vmx.c 2014-02-18 10:45:42.000000000 +0100 @@ -2646,7 +2646,11 @@ void vmx_vmexit_handler(struct cpu_user_ HVMTRACE_1D(TRAP_DEBUG, exit_qualification); write_debugreg(6, exit_qualification | 0xffff0ff0); if ( !v->domain->debugger_attached || cpu_has_monitor_trap_flag ) - goto exit_and_crash; + { + __restore_debug_registers(v); + hvm_inject_hw_exception(TRAP_debug, HVM_DELIVER_NO_ERROR_CODE); + break; + } domain_pause_for_debugger(); break; case TRAP_int3: --------------020908080302050204050106 Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Xen-devel mailing list Xen-devel@lists.xen.org http://lists.xen.org/xen-devel --------------020908080302050204050106--