From mboxrd@z Thu Jan 1 00:00:00 1970 From: Gleb Natapov Subject: Re: [PATCH] KVM: VMX: Update instruction length on intercepted BP Date: Wed, 17 Feb 2010 15:03:25 +0200 Message-ID: <20100217130325.GU2995@redhat.com> References: <4B77E0E2.7030704@web.de> <20100214144501.GN2511@redhat.com> <4B7826D3.7080201@web.de> <20100214165319.GA19246@redhat.com> <4B782D97.9030304@web.de> <20100214172613.GB19246@redhat.com> <4B7837A3.4040607@web.de> <4B794A1F.7050009@siemens.com> <20100217105527.GQ2995@redhat.com> <4B7BD3B5.2080207@siemens.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Cc: Avi Kivity , Marcelo Tosatti , kvm To: Jan Kiszka Return-path: Received: from mx1.redhat.com ([209.132.183.28]:3297 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751017Ab0BQNDa (ORCPT ); Wed, 17 Feb 2010 08:03:30 -0500 Content-Disposition: inline In-Reply-To: <4B7BD3B5.2080207@siemens.com> Sender: kvm-owner@vger.kernel.org List-ID: On Wed, Feb 17, 2010 at 12:32:05PM +0100, Jan Kiszka wrote: > Gleb Natapov wrote: > > On Mon, Feb 15, 2010 at 02:20:31PM +0100, Jan Kiszka wrote: > >> Jan Kiszka wrote: > >>> Gleb Natapov wrote: > >>>> Lets check if SVM works. I can do that if you tell me how. > >>> - Fire up some Linux guest with gdb installed > >>> - Attach gdb to gdbstub of the VM > >>> - Set a soft breakpoint in guest kernel, ideally where it does not > >>> immediately trigger, e.g. on sys_reboot (use grep sys_reboot > >>> /proc/kallsyms if you don't have symbols for the guest kernel) > >>> - Start gdb /bin/true in the guest > >>> - run > >>> > >>> As gdb sets some automatic breakpoints, this already exercises the > >>> reinjection of #BP. > >> I just did this on our primary AMD platform (Embedded Opteron, 13KS EE), > >> and it just worked. > >> > > I tested it on processor without NextRIP and your test case works there too, > > but it shouldn't have, so I looked deeper into that and what I see is > > that GDB outsmart us. It doesn't matter if we inject event before int3 > > inserted by GDB or after it GDB correctly finds breakpoint that > > triggered and restart instruction correctly. I assume it doesn't use > > exact match between rip where int3 was inserted and where exceptions > > triggers. > > At latest when you have two successive breakpoints on single-byte > instructions, gdb will reach its limits (for it failed earlier, BTW). > And other debuggers under other OSes may become unhappy as well. Yes, and that is why I am saying checking with GDB is not a good test. GDB may work, but it doesn't mean injection works correctly. It took me some time to write test that finally confused gdb. It was like this: 1: int main(int argc, char **argv) 2: { 3: if (argc == 1) 4: goto a; 5: asm("cmc"); 6: a: 7: asm("cmc"); 8: return 0; 9: } If you set breakpoint on lines 5 and 7 when breakpoint triggers GDB thinks it is on line 5. So can you run int3 test below on master on AMD with NextRIP support? I doubt the result will be correct. > > > But if I run program below on latest kernel which prints rip > > where #DB was delivered in dmesg I get different results with and > > without external breakpoint inserted. > > Does applying v2 of my patch corrects the picture? > Of course, since it now injects #DB at correct address. If exception will happen during #DB processing thins will go wrong, but we can do only so much on broken SVM without emulating int3 in software. > > > > int main(int argc, char **argv) > > { > > asm("int3"); > > return 0; > > } > > -- Gleb.