From: Avi Kivity <avi@redhat.com>
To: "Roedel, Joerg" <Joerg.Roedel@amd.com>
Cc: Marcelo Tosatti <mtosatti@redhat.com>,
"kvm@vger.kernel.org" <kvm@vger.kernel.org>
Subject: Re: [PATCH 12/13] KVM: SVM: Add checks for IO instructions
Date: Thu, 31 Mar 2011 12:03:37 +0200 [thread overview]
Message-ID: <4D945179.1050800@redhat.com> (raw)
In-Reply-To: <20110331094252.GA2207@amd.com>
On 03/31/2011 11:42 AM, Roedel, Joerg wrote:
> On Thu, Mar 31, 2011 at 05:18:28AM -0400, Avi Kivity wrote:
> > On 03/31/2011 09:14 AM, Roedel, Joerg wrote:
> > > On Mon, Mar 28, 2011 at 08:28:12AM -0400, Avi Kivity wrote:
> > > > The spec indicates we need to check the TSS and IOPL based permissions
> > > > before the intercept (vmx agrees). With the code as is, it happens
> > > > afterwards.
> > > >
> > > > One way to do this is to have an ExtraChecks bit in the opcode::flags.
> > > > Then opcode::u.xcheck->perms() is the pre-intercept check and
> > > > opcode::u.xcheck->execute() is the post-intercept execution. Should
> > > > work for monitor/mwait/rdtsc(p)/rdpmc/other crap x86 throws at us.
> > >
> > > Okay, as you suggested, I put these checks into the instruction emulator
> > > and let the hard work of implementing per-arch checks to the nested-vmx
> > > people ;)
> > > I doubt that this makes the opcode-tables more readable, but lets see :)
> >
> > I think we're miscommunicating. I'm talking about x86 checks, not virt
> > vendor specific checks.
>
> The place of the intercept check may be vendor specific. I havn't looked
> at the Intel spec, though. But there are probably differences.
That's why there are three hooks: pre-ex, post-ex, post-mem. If an
intercept fits in between, use the pre-ex hook and duplicate the checks
in the intercept.
As far as I recall, everything should fit into those three, though.
> > For example, the flow for IOIO would be:
> >
> > #UD check (lock prefix)
> > PE/IOPL/CPL/VM check
> > TSS bitmap check (can cause #PF)
> > Intercept check
> > Operand segment check
> > Possible #PF
> > Execution
> >
> > We need to make sure the TSS bitmap check happens before the intercept,
> > so we need to split ->execute() into two.
>
> Right. For the generic case, how about factor out the checks (for the
> POST_EX intercept case) into a seperate excp_check-callback (similar to the
> execute-callback) and execute it before the post-exception-intercept
> check?
That is exactly my suggestion.
--
error compiling committee.c: too many arguments to function
next prev parent reply other threads:[~2011-03-31 10:03 UTC|newest]
Thread overview: 28+ messages / expand[flat|nested] mbox.gz Atom feed top
2011-03-28 10:46 [PATCH 0/13] KVM: Make the instruction emulator aware of Nested Virtualization v3 Joerg Roedel
2011-03-28 10:46 ` [PATCH 01/13] KVM: x86 emulator: add framework for instruction intercepts Joerg Roedel
2011-03-28 10:46 ` [PATCH 02/13] KVM: x86 emulator: add SVM intercepts Joerg Roedel
2011-03-28 10:46 ` [PATCH 03/13] KVM: X86: Don't write-back cpu-state on X86EMUL_INTERCEPTED Joerg Roedel
2011-03-28 10:46 ` [PATCH 04/13] KVM: X86: Add x86 callback for intercept check Joerg Roedel
2011-03-28 10:46 ` [PATCH 05/13] KVM: SVM: Add intercept check for emulated cr accesses Joerg Roedel
2011-03-28 10:46 ` [PATCH 06/13] KVM: SVM: Add intercept check for accessing dr registers Joerg Roedel
2011-03-28 10:46 ` [PATCH 07/13] KVM: SVM: Add intercept checks for descriptor table accesses Joerg Roedel
2011-03-28 12:35 ` Avi Kivity
2011-03-28 13:56 ` Roedel, Joerg
2011-03-28 14:34 ` Avi Kivity
2011-03-28 10:46 ` [PATCH 08/13] KVM: SVM: Add intercept checks for SVM instructions Joerg Roedel
2011-03-28 12:08 ` Avi Kivity
2011-03-28 12:18 ` Roedel, Joerg
2011-03-28 10:46 ` [PATCH 09/13] KVM: SVM: Add intercept checks for remaining group7 instructions Joerg Roedel
2011-03-28 12:15 ` Avi Kivity
2011-03-28 10:46 ` [PATCH 10/13] KVM: SVM: Add intercept checks for remaining twobyte instructions Joerg Roedel
2011-03-28 12:29 ` Avi Kivity
2011-03-28 10:46 ` [PATCH 11/13] KVM: SVM: Add intercept checks for one-byte instructions Joerg Roedel
2011-03-28 10:46 ` [PATCH 12/13] KVM: SVM: Add checks for IO instructions Joerg Roedel
2011-03-28 12:28 ` Avi Kivity
2011-03-31 7:14 ` Roedel, Joerg
2011-03-31 9:18 ` Avi Kivity
2011-03-31 9:42 ` Roedel, Joerg
2011-03-31 10:03 ` Avi Kivity [this message]
2011-03-31 10:28 ` Roedel, Joerg
2011-03-28 10:46 ` [PATCH 13/13] KVM: SVM: Remove nested sel_cr0_write handling code Joerg Roedel
-- strict thread matches above, loose matches on Subject: below --
2011-03-25 9:29 [PATCH 0/13] KVM: Make the instruction emulator aware of Nested Virtualization v2 Joerg Roedel
2011-03-25 9:29 ` [PATCH 12/13] KVM: SVM: Add checks for IO instructions Joerg Roedel
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=4D945179.1050800@redhat.com \
--to=avi@redhat.com \
--cc=Joerg.Roedel@amd.com \
--cc=kvm@vger.kernel.org \
--cc=mtosatti@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.