Gleb Natapov wrote: > On Sun, Feb 14, 2010 at 11:47:58AM +0100, Jan Kiszka wrote: >> Gleb Natapov wrote: >>> On Sun, Feb 14, 2010 at 11:26:31AM +0100, Jan Kiszka wrote: >>>> Gleb Natapov wrote: >>>>> On Sat, Feb 13, 2010 at 10:31:12AM +0100, Jan Kiszka wrote: >>>>>> From: Jan Kiszka <jan.kiszka@xxxxxxxxxxx> >>>>>> >>>>>> We intercept #BP while in guest debugging mode. As VM exists due to >>>>>> intercepted exceptions do not necessarily come with valid >>>>>> idt_vectoring, we have to update event_exit_inst_len explicitly in such >>>>>> cases. At least in the absence of migration, this ensures that >>>>>> re-injections of #BP will find and use the correct instruction length. >>>>>> >>>>> event_exit_inst_len is only used for event reinjection. Since event >>>>> intercepted here will not be reinjected why updating event_exit_inst_len >>>>> is needed here? >>>> In guest debugging mode a #BP exception is always reported to user space >>>> to find out what caused it. If it was the guest itself, the exception is >>>> reinjected, on older kernels via KVM_SET_GUEST_DEBUG and since 2.6.33 >>>> via KVM_SET_VCPU_EVENTS (the latter requires some qemu patch that I will >>>> post later). >>>> >>>> As we currently do not update event_exit_inst_len on #BP exits, >>>> reinjecting fails unless event_exit_inst_len happens to be 1 from some >>>> other exit. >>>> >>> Hmm, how does it work on SVM then where we do not have >>> event_exit_inst_len so execution will resume on the same rip that caused >>> #BP after event reinjection? >>> >> Maybe not at all. I don't think I've tested this scenario on amd so far. >> Guess it needs some special handling in svm to move rip after the int3 >> when requesting to inject #BP. >> > This will work for VMX too, no? So may be we should design something > that will work for both VMX and SVM before applying patches that make > oly VMX work? VMX used to work, so my patch is actually a regression fix. I bet this was accidentally broken while cleaning up the interrupt handling of VMX. > How about disabling #BP intercept and reenter guest (may > be single step it at this point to reenable #BP interception ASAP)? If there were be some "sticky" single-step that is pushed into exception handlers as well... > > PS: moving rip after int3 may lead to wrong rip to be pushed on > exception stack if exception happens during event delivery. > Hmm, would have been too easy. Jan
Attachment:
signature.asc
Description: OpenPGP digital signature
