Re: [PATCH 1/3] KVM: x86 emulator: Fix task switch privilege checks

[Kevin Wolf <kwolf@redhat.com>]

Am 25.01.2012 17:00, schrieb Joerg Roedel:
> On Tue, Jan 24, 2012 at 06:23:50PM +0200, Gleb Natapov wrote:
>> On Tue, Jan 24, 2012 at 03:24:50PM +0100, Kevin Wolf wrote:
> 
>>> However, task_switch_interception() itself does some more based on the
>>> value of reason, for example it decides whether or not to call
>>> skip_emulated_instruction().
>>>
>> Joerg need to help us here. If intercept of task switch happens before
>> rip is advanced past instruction that cause it we have to know somehow
>> that task switch was caused by instruction. It is not enough that HW
>> checks permission, we still lack essential info.
> 
> Hmm, the RIP in the VMCB points to the instruction causing the task
> switch. This is also true for lcall and ljmp. But in my experiments I
> have seen exit_int_info.valid = 1 for task-switches that went through
> the IDT. But I havn't tested the VM86 case, though.
> 
> Kevin, can you please re-verify that exit_int_info.valid is always 0 in
> your experiment? On what hardware have you tested this?

I just retried. I use kvm-kmod and kvm.git with HEAD at ff92e9b5 plus
the tree patches of this series plus a printk to output exit_int_info in
task_switch_intercept(). I ran taskswitch2 from kvm-unittests and got
two failures and my VM86 unit test which hung when trying to return from
VM86. I also ran the kernel that made me aware of the issue initially.
All debug messages show exit_int_info = 0.

This is the /proc/cpuinfo snippet for the first core:

processor       : 0
vendor_id       : AuthenticAMD
cpu family      : 15
model           : 107
model name      : AMD Athlon(tm) 64 X2 Dual Core Processor 5200+
stepping        : 2
cpu MHz         : 1800.000
cache size      : 512 KB
physical id     : 0
siblings        : 2
core id         : 0
cpu cores       : 2
apicid          : 0
initial apicid  : 0
fpu             : yes
fpu_exception   : yes
cpuid level     : 1
wp              : yes
flags           : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge
mca cmov pat pse36 clflush mmx fxsr sse sse2 ht syscall nx mmxext
fxsr_opt rdtscp lm 3dnowext 3dnow rep_good nopl extd_apicid pni cx16
lahf_lm cmp_legacy svm extapic cr8_legacy 3dnowprefetch lbrv
bogomips        : 3592.64
TLB size        : 1024 4K pages
clflush size    : 64
cache_alignment : 64
address sizes   : 40 bits physical, 48 bits virtual
power management: ts fid vid ttp tm stc 100mhzsteps

Kevin