[PATCH 0/2] KVM: x86: minimal debugging support during emulation

[PATCH 0/2] KVM: x86: minimal debugging support during emulation

[Paolo Bonzini]

The switch to emulate_invalid_guest_state brought one slightly unwelcome
change; the debugging interface does not work in the initial boot phase
because KVM_SET_GUEST_DEBUG is basically ignored.

These two patches bring some initial support for debugging, namely for
hardware breakpoints and single-stepping.  Software breakpoints and
hardware watchpoints are still ignored.

Paolo

Paolo Bonzini (2):
  KVM: x86: handle hardware breakpoints during emulation
  KVM: x86: handle singlestep during emulation

 arch/x86/include/asm/kvm_emulate.h |   1 +
 arch/x86/include/asm/kvm_host.h    |   3 +-
 arch/x86/kvm/emulate.c             |   1 +
 arch/x86/kvm/x86.c                 | 106 ++++++++++++++++++++++++++++++++++++-
 4 files changed, 109 insertions(+), 2 deletions(-)

-- 
1.8.1.4

[PATCH 1/2] KVM: x86: handle hardware breakpoints during emulation

[Paolo Bonzini]

This lets debugging work better during emulation of invalid
guest state.

The check is done before emulating the instruction, and (in the case
of guest debugging) reuses EMULATE_DO_MMIO to exit with KVM_EXIT_DEBUG.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 arch/x86/include/asm/kvm_host.h |  3 +-
 arch/x86/kvm/x86.c              | 65 +++++++++++++++++++++++++++++++++++++++++
 2 files changed, 67 insertions(+), 1 deletion(-)

diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
index e2e09f3..aefd8c2 100644
--- a/arch/x86/include/asm/kvm_host.h
+++ b/arch/x86/include/asm/kvm_host.h
@@ -788,9 +788,10 @@ extern u32  kvm_min_guest_tsc_khz;
 extern u32  kvm_max_guest_tsc_khz;
 
 enum emulation_result {
-	EMULATE_DONE,       /* no further processing */
-	EMULATE_DO_MMIO,      /* kvm_run filled with mmio request */
+	EMULATE_DONE,         /* no further processing */
+	EMULATE_DO_MMIO,      /* kvm_run ready for userspace exit */
 	EMULATE_FAIL,         /* can't emulate this instruction */
+	EMULATE_PROCEED,      /* proceed with rest of emulation */
 };
 
 #define EMULTYPE_NO_DECODE	    (1 << 0)
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 1d928af..33b51bc 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -4872,6 +4872,60 @@ static bool retry_instruction(struct x86_emulate_ctxt *ctxt,
 static int complete_emulated_mmio(struct kvm_vcpu *vcpu);
 static int complete_emulated_pio(struct kvm_vcpu *vcpu);
 
+static int kvm_vcpu_check_hw_bp(unsigned long addr, u32 type, u32 dr7,
+				unsigned long *db)
+{
+	u32 dr6 = 0;
+	int i;
+	u32 enable, rwlen;
+
+	enable = dr7;
+	rwlen = dr7 >> 16;
+	for (i = 0; i < 4; i++, enable >>= 2, rwlen >>= 4)
+		if ((enable & 3) && (rwlen & 15) == type && db[i] == addr)
+			dr6 |= (1 << i);
+	return dr6;
+}
+
+static int kvm_vcpu_check_breakpoint(struct kvm_vcpu *vcpu)
+{
+	struct kvm_run *kvm_run = vcpu->run;
+	unsigned long eip = vcpu->arch.emulate_ctxt.eip;
+	u32 dr6 = 0;
+
+	if (unlikely(vcpu->guest_debug & KVM_GUESTDBG_USE_HW_BP) &&
+	    (vcpu->arch.guest_debug_dr7 & DR7_BP_EN_MASK)) {
+		dr6 = kvm_vcpu_check_hw_bp(eip, 0,
+					   vcpu->arch.guest_debug_dr7,
+					   vcpu->arch.eff_db);
+
+		if (dr6 != 0) {
+			kvm_run->debug.arch.dr6 = dr6 | DR6_FIXED_1;
+			kvm_run->debug.arch.pc = kvm_rip_read(vcpu) +
+				get_segment_base(vcpu, VCPU_SREG_CS);
+
+			kvm_run->debug.arch.exception = DB_VECTOR;
+			kvm_run->exit_reason = KVM_EXIT_DEBUG;
+			return EMULATE_DO_MMIO;
+		}
+	}
+
+	if (unlikely(vcpu->arch.dr7 & DR7_BP_EN_MASK)) {
+		dr6 = kvm_vcpu_check_hw_bp(eip, 0,
+					   vcpu->arch.dr7,
+					   vcpu->arch.db);
+
+		if (dr6 != 0) {
+			vcpu->arch.dr6 &= ~15;
+			vcpu->arch.dr6 |= dr6;
+			kvm_queue_exception(vcpu, DB_VECTOR);
+			return EMULATE_DONE;
+		}
+	}
+
+	return EMULATE_PROCEED;
+}
+
 int x86_emulate_instruction(struct kvm_vcpu *vcpu,
 			    unsigned long cr2,
 			    int emulation_type,
@@ -4892,6 +4946,17 @@ int x86_emulate_instruction(struct kvm_vcpu *vcpu,
 
 	if (!(emulation_type & EMULTYPE_NO_DECODE)) {
 		init_emulate_ctxt(vcpu);
+
+		/*
+		 * We will reenter on the same instruction since
+		 * we do not set complete_userspace_io.  This does not
+		 * handle watchpoints yet, those would be handled in
+		 * the emulate_ops.
+		 */
+		r = kvm_vcpu_check_breakpoint(vcpu);
+		if (r != EMULATE_PROCEED)
+			return r;
+
 		ctxt->interruptibility = 0;
 		ctxt->have_exception = false;
 		ctxt->perm_ok = false;
-- 
1.8.1.4

[PATCH 2/2] KVM: x86: handle singlestep during emulation

[Paolo Bonzini]

This lets debugging work better during emulation of invalid
guest state.

This time the check is done after emulation, but before writeback
of the flags; we need to check the flags *before* execution of the
instruction, we cannot check singlestep_rip because the CS base may
have already been modified.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 arch/x86/kvm/x86.c                 | 41 +++++++++++++++++++++++++++++++++++++-
 1 files changed, 40 insertions(+), 1 deletion(-)

diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 33b51bc..0728096 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -4887,6 +4887,43 @@ static int kvm_vcpu_check_hw_bp(unsigned long addr, u32 type, u32 dr7,
 	return dr6;
 }
 
+static int kvm_vcpu_check_singlestep(struct kvm_vcpu *vcpu)
+{
+	struct kvm_run *kvm_run = vcpu->run;
+
+	/*
+	 * Use the "raw" value to see if TF was passed to the processor.
+	 * Note that the new value of the flags has not been saved yet.
+	 *
+	 * This is correct even for TF set by the guest, because "the
+	 * processor will not generate this exception after the instruction
+	 * that sets the TF flag".
+	 */
+	unsigned long rflags = kvm_x86_ops->get_rflags(vcpu);
+
+	if (unlikely(rflags & X86_EFLAGS_TF)) {
+		if (vcpu->guest_debug & KVM_GUESTDBG_SINGLESTEP) {
+			kvm_run->debug.arch.dr6 = DR6_BS | DR6_FIXED_1;
+			kvm_run->debug.arch.pc = vcpu->arch.singlestep_rip;
+			kvm_run->debug.arch.exception = DB_VECTOR;
+			kvm_run->exit_reason = KVM_EXIT_DEBUG;
+			return EMULATE_DO_MMIO;
+		} else {
+			vcpu->arch.emulate_ctxt.eflags &= ~X86_EFLAGS_TF;
+			/*
+			 * "Certain debug exceptions may clear bit 0-3.  The
+			 * remaining contents of the DR6 register are never
+			 * cleared by the processor".
+			 */
+			vcpu->arch.dr6 &= ~15;
+			vcpu->arch.dr6 |= DR6_BS;
+			kvm_queue_exception(vcpu, DB_VECTOR);
+		}
+	}
+
+	return EMULATE_DONE;
+}
+
 static int kvm_vcpu_check_breakpoint(struct kvm_vcpu *vcpu)
 {
 	struct kvm_run *kvm_run = vcpu->run;
@@ -5031,10 +5068,12 @@ restart:
 
 	if (writeback) {
 		toggle_interruptibility(vcpu, ctxt->interruptibility);
-		kvm_set_rflags(vcpu, ctxt->eflags);
 		kvm_make_request(KVM_REQ_EVENT, vcpu);
 		vcpu->arch.emulate_regs_need_sync_to_vcpu = false;
 		kvm_rip_write(vcpu, ctxt->eip);
+		if (r == EMULATE_DONE)
+			r = kvm_vcpu_check_singlestep(vcpu);
+		kvm_set_rflags(vcpu, ctxt->eflags);
 	} else
 		vcpu->arch.emulate_regs_need_sync_to_vcpu = true;
 
-- 
1.8.1.4

Re: [PATCH 1/2] KVM: x86: handle hardware breakpoints during emulation

[Gleb Natapov]

On Thu, May 30, 2013 at 06:00:30PM +0200, Paolo Bonzini wrote:
> This lets debugging work better during emulation of invalid
> guest state.
> 
> The check is done before emulating the instruction, and (in the case
> of guest debugging) reuses EMULATE_DO_MMIO to exit with KVM_EXIT_DEBUG.
> 
> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
> ---
>  arch/x86/include/asm/kvm_host.h |  3 +-
>  arch/x86/kvm/x86.c              | 65 +++++++++++++++++++++++++++++++++++++++++
>  2 files changed, 67 insertions(+), 1 deletion(-)
> 
> diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
> index e2e09f3..aefd8c2 100644
> --- a/arch/x86/include/asm/kvm_host.h
> +++ b/arch/x86/include/asm/kvm_host.h
> @@ -788,9 +788,10 @@ extern u32  kvm_min_guest_tsc_khz;
>  extern u32  kvm_max_guest_tsc_khz;
>  
>  enum emulation_result {
> -	EMULATE_DONE,       /* no further processing */
> -	EMULATE_DO_MMIO,      /* kvm_run filled with mmio request */
> +	EMULATE_DONE,         /* no further processing */
> +	EMULATE_DO_MMIO,      /* kvm_run ready for userspace exit */
If it no longer means MMIO (or PIO) lest rename it to something more
meaningful. EMULATE_EXIT? EMULATE_USER_EXIT?

>  	EMULATE_FAIL,         /* can't emulate this instruction */
> +	EMULATE_PROCEED,      /* proceed with rest of emulation */
I think we can do without this. Have to function: check_bp(),
handle_bp(). Do:

 if (check_bp())
   return handle_bp();

>  };
>  
>  #define EMULTYPE_NO_DECODE	    (1 << 0)
> diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
> index 1d928af..33b51bc 100644
> --- a/arch/x86/kvm/x86.c
> +++ b/arch/x86/kvm/x86.c
> @@ -4872,6 +4872,60 @@ static bool retry_instruction(struct x86_emulate_ctxt *ctxt,
>  static int complete_emulated_mmio(struct kvm_vcpu *vcpu);
>  static int complete_emulated_pio(struct kvm_vcpu *vcpu);
>  
> +static int kvm_vcpu_check_hw_bp(unsigned long addr, u32 type, u32 dr7,
> +				unsigned long *db)
> +{
> +	u32 dr6 = 0;
> +	int i;
> +	u32 enable, rwlen;
> +
> +	enable = dr7;
> +	rwlen = dr7 >> 16;
> +	for (i = 0; i < 4; i++, enable >>= 2, rwlen >>= 4)
> +		if ((enable & 3) && (rwlen & 15) == type && db[i] == addr)
> +			dr6 |= (1 << i);
> +	return dr6;
> +}
> +
> +static int kvm_vcpu_check_breakpoint(struct kvm_vcpu *vcpu)
> +{
> +	struct kvm_run *kvm_run = vcpu->run;
> +	unsigned long eip = vcpu->arch.emulate_ctxt.eip;
> +	u32 dr6 = 0;
> +
> +	if (unlikely(vcpu->guest_debug & KVM_GUESTDBG_USE_HW_BP) &&
> +	    (vcpu->arch.guest_debug_dr7 & DR7_BP_EN_MASK)) {
> +		dr6 = kvm_vcpu_check_hw_bp(eip, 0,
> +					   vcpu->arch.guest_debug_dr7,
> +					   vcpu->arch.eff_db);
> +
> +		if (dr6 != 0) {
> +			kvm_run->debug.arch.dr6 = dr6 | DR6_FIXED_1;
> +			kvm_run->debug.arch.pc = kvm_rip_read(vcpu) +
> +				get_segment_base(vcpu, VCPU_SREG_CS);
> +
> +			kvm_run->debug.arch.exception = DB_VECTOR;
> +			kvm_run->exit_reason = KVM_EXIT_DEBUG;
> +			return EMULATE_DO_MMIO;
> +		}
> +	}
> +
> +	if (unlikely(vcpu->arch.dr7 & DR7_BP_EN_MASK)) {
> +		dr6 = kvm_vcpu_check_hw_bp(eip, 0,
> +					   vcpu->arch.dr7,
> +					   vcpu->arch.db);
> +
> +		if (dr6 != 0) {
> +			vcpu->arch.dr6 &= ~15;
> +			vcpu->arch.dr6 |= dr6;
> +			kvm_queue_exception(vcpu, DB_VECTOR);
> +			return EMULATE_DONE;
> +		}
> +	}
> +
> +	return EMULATE_PROCEED;
> +}
> +
>  int x86_emulate_instruction(struct kvm_vcpu *vcpu,
>  			    unsigned long cr2,
>  			    int emulation_type,
> @@ -4892,6 +4946,17 @@ int x86_emulate_instruction(struct kvm_vcpu *vcpu,
>  
>  	if (!(emulation_type & EMULTYPE_NO_DECODE)) {
>  		init_emulate_ctxt(vcpu);
> +
> +		/*
> +		 * We will reenter on the same instruction since
> +		 * we do not set complete_userspace_io.  This does not
> +		 * handle watchpoints yet, those would be handled in
> +		 * the emulate_ops.
> +		 */
> +		r = kvm_vcpu_check_breakpoint(vcpu);
> +		if (r != EMULATE_PROCEED)
> +			return r;
> +
>  		ctxt->interruptibility = 0;
>  		ctxt->have_exception = false;
>  		ctxt->perm_ok = false;
> -- 
> 1.8.1.4
> 

--
			Gleb.

Re: [PATCH 1/2] KVM: x86: handle hardware breakpoints during emulation

[Paolo Bonzini]

Il 04/06/2013 13:28, Gleb Natapov ha scritto:
> On Thu, May 30, 2013 at 06:00:30PM +0200, Paolo Bonzini wrote:
>> This lets debugging work better during emulation of invalid
>> guest state.
>>
>> The check is done before emulating the instruction, and (in the case
>> of guest debugging) reuses EMULATE_DO_MMIO to exit with KVM_EXIT_DEBUG.
>>
>> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
>> ---
>>  arch/x86/include/asm/kvm_host.h |  3 +-
>>  arch/x86/kvm/x86.c              | 65 +++++++++++++++++++++++++++++++++++++++++
>>  2 files changed, 67 insertions(+), 1 deletion(-)
>>
>> diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
>> index e2e09f3..aefd8c2 100644
>> --- a/arch/x86/include/asm/kvm_host.h
>> +++ b/arch/x86/include/asm/kvm_host.h
>> @@ -788,9 +788,10 @@ extern u32  kvm_min_guest_tsc_khz;
>>  extern u32  kvm_max_guest_tsc_khz;
>>  
>>  enum emulation_result {
>> -	EMULATE_DONE,       /* no further processing */
>> -	EMULATE_DO_MMIO,      /* kvm_run filled with mmio request */
>> +	EMULATE_DONE,         /* no further processing */
>> +	EMULATE_DO_MMIO,      /* kvm_run ready for userspace exit */
> If it no longer means MMIO (or PIO) lest rename it to something more
> meaningful. EMULATE_EXIT? EMULATE_USER_EXIT?

I'll go with EMULATE_USER_EXIT.

>>  	EMULATE_FAIL,         /* can't emulate this instruction */
>> +	EMULATE_PROCEED,      /* proceed with rest of emulation */
> I think we can do without this. Have to function: check_bp(),
> handle_bp(). Do:
> 
>  if (check_bp())
>    return handle_bp();

I tried this, but it doesn't work because you need to pass the computed
dr6 from check_bp to handle_bp.  It becomes really ugly.

If you do not want EMULATE_PROCEED, I can just use -1 instead in
kvm_vcpu_check_breakpoint, and return if r < 0.

Paolo

>>  };
>>  
>>  #define EMULTYPE_NO_DECODE	    (1 << 0)
>> diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
>> index 1d928af..33b51bc 100644
>> --- a/arch/x86/kvm/x86.c
>> +++ b/arch/x86/kvm/x86.c
>> @@ -4872,6 +4872,60 @@ static bool retry_instruction(struct x86_emulate_ctxt *ctxt,
>>  static int complete_emulated_mmio(struct kvm_vcpu *vcpu);
>>  static int complete_emulated_pio(struct kvm_vcpu *vcpu);
>>  
>> +static int kvm_vcpu_check_hw_bp(unsigned long addr, u32 type, u32 dr7,
>> +				unsigned long *db)
>> +{
>> +	u32 dr6 = 0;
>> +	int i;
>> +	u32 enable, rwlen;
>> +
>> +	enable = dr7;
>> +	rwlen = dr7 >> 16;
>> +	for (i = 0; i < 4; i++, enable >>= 2, rwlen >>= 4)
>> +		if ((enable & 3) && (rwlen & 15) == type && db[i] == addr)
>> +			dr6 |= (1 << i);
>> +	return dr6;
>> +}
>> +
>> +static int kvm_vcpu_check_breakpoint(struct kvm_vcpu *vcpu)
>> +{
>> +	struct kvm_run *kvm_run = vcpu->run;
>> +	unsigned long eip = vcpu->arch.emulate_ctxt.eip;
>> +	u32 dr6 = 0;
>> +
>> +	if (unlikely(vcpu->guest_debug & KVM_GUESTDBG_USE_HW_BP) &&
>> +	    (vcpu->arch.guest_debug_dr7 & DR7_BP_EN_MASK)) {
>> +		dr6 = kvm_vcpu_check_hw_bp(eip, 0,
>> +					   vcpu->arch.guest_debug_dr7,
>> +					   vcpu->arch.eff_db);
>> +
>> +		if (dr6 != 0) {
>> +			kvm_run->debug.arch.dr6 = dr6 | DR6_FIXED_1;
>> +			kvm_run->debug.arch.pc = kvm_rip_read(vcpu) +
>> +				get_segment_base(vcpu, VCPU_SREG_CS);
>> +
>> +			kvm_run->debug.arch.exception = DB_VECTOR;
>> +			kvm_run->exit_reason = KVM_EXIT_DEBUG;
>> +			return EMULATE_DO_MMIO;
>> +		}
>> +	}
>> +
>> +	if (unlikely(vcpu->arch.dr7 & DR7_BP_EN_MASK)) {
>> +		dr6 = kvm_vcpu_check_hw_bp(eip, 0,
>> +					   vcpu->arch.dr7,
>> +					   vcpu->arch.db);
>> +
>> +		if (dr6 != 0) {
>> +			vcpu->arch.dr6 &= ~15;
>> +			vcpu->arch.dr6 |= dr6;
>> +			kvm_queue_exception(vcpu, DB_VECTOR);
>> +			return EMULATE_DONE;
>> +		}
>> +	}
>> +
>> +	return EMULATE_PROCEED;
>> +}
>> +
>>  int x86_emulate_instruction(struct kvm_vcpu *vcpu,
>>  			    unsigned long cr2,
>>  			    int emulation_type,
>> @@ -4892,6 +4946,17 @@ int x86_emulate_instruction(struct kvm_vcpu *vcpu,
>>  
>>  	if (!(emulation_type & EMULTYPE_NO_DECODE)) {
>>  		init_emulate_ctxt(vcpu);
>> +
>> +		/*
>> +		 * We will reenter on the same instruction since
>> +		 * we do not set complete_userspace_io.  This does not
>> +		 * handle watchpoints yet, those would be handled in
>> +		 * the emulate_ops.
>> +		 */
>> +		r = kvm_vcpu_check_breakpoint(vcpu);
>> +		if (r != EMULATE_PROCEED)
>> +			return r;
>> +
>>  		ctxt->interruptibility = 0;
>>  		ctxt->have_exception = false;
>>  		ctxt->perm_ok = false;
>> -- 
>> 1.8.1.4
>>
> 
> --
> 			Gleb.
> 

Re: [PATCH 1/2] KVM: x86: handle hardware breakpoints during emulation

[Gleb Natapov]

On Tue, Jun 04, 2013 at 01:33:20PM +0200, Paolo Bonzini wrote:
> Il 04/06/2013 13:28, Gleb Natapov ha scritto:
> > On Thu, May 30, 2013 at 06:00:30PM +0200, Paolo Bonzini wrote:
> >> This lets debugging work better during emulation of invalid
> >> guest state.
> >>
> >> The check is done before emulating the instruction, and (in the case
> >> of guest debugging) reuses EMULATE_DO_MMIO to exit with KVM_EXIT_DEBUG.
> >>
> >> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
> >> ---
> >>  arch/x86/include/asm/kvm_host.h |  3 +-
> >>  arch/x86/kvm/x86.c              | 65 +++++++++++++++++++++++++++++++++++++++++
> >>  2 files changed, 67 insertions(+), 1 deletion(-)
> >>
> >> diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
> >> index e2e09f3..aefd8c2 100644
> >> --- a/arch/x86/include/asm/kvm_host.h
> >> +++ b/arch/x86/include/asm/kvm_host.h
> >> @@ -788,9 +788,10 @@ extern u32  kvm_min_guest_tsc_khz;
> >>  extern u32  kvm_max_guest_tsc_khz;
> >>  
> >>  enum emulation_result {
> >> -	EMULATE_DONE,       /* no further processing */
> >> -	EMULATE_DO_MMIO,      /* kvm_run filled with mmio request */
> >> +	EMULATE_DONE,         /* no further processing */
> >> +	EMULATE_DO_MMIO,      /* kvm_run ready for userspace exit */
> > If it no longer means MMIO (or PIO) lest rename it to something more
> > meaningful. EMULATE_EXIT? EMULATE_USER_EXIT?
> 
> I'll go with EMULATE_USER_EXIT.
> 
> >>  	EMULATE_FAIL,         /* can't emulate this instruction */
> >> +	EMULATE_PROCEED,      /* proceed with rest of emulation */
> > I think we can do without this. Have to function: check_bp(),
> > handle_bp(). Do:
> > 
> >  if (check_bp())
> >    return handle_bp();
> 
> I tried this, but it doesn't work because you need to pass the computed
> dr6 from check_bp to handle_bp.  It becomes really ugly.
> 
Can't check_bp() return dr6?

 if ((dr6 = check_bp())
    return handle_bp(dr6);

> If you do not want EMULATE_PROCEED, I can just use -1 instead in
> kvm_vcpu_check_breakpoint, and return if r < 0.
> 
But you need to know what to return EMULATE_DONE or EMULATE_USER_EXIT.

> Paolo
> 
> >>  };
> >>  
> >>  #define EMULTYPE_NO_DECODE	    (1 << 0)
> >> diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
> >> index 1d928af..33b51bc 100644
> >> --- a/arch/x86/kvm/x86.c
> >> +++ b/arch/x86/kvm/x86.c
> >> @@ -4872,6 +4872,60 @@ static bool retry_instruction(struct x86_emulate_ctxt *ctxt,
> >>  static int complete_emulated_mmio(struct kvm_vcpu *vcpu);
> >>  static int complete_emulated_pio(struct kvm_vcpu *vcpu);
> >>  
> >> +static int kvm_vcpu_check_hw_bp(unsigned long addr, u32 type, u32 dr7,
> >> +				unsigned long *db)
> >> +{
> >> +	u32 dr6 = 0;
> >> +	int i;
> >> +	u32 enable, rwlen;
> >> +
> >> +	enable = dr7;
> >> +	rwlen = dr7 >> 16;
> >> +	for (i = 0; i < 4; i++, enable >>= 2, rwlen >>= 4)
> >> +		if ((enable & 3) && (rwlen & 15) == type && db[i] == addr)
> >> +			dr6 |= (1 << i);
> >> +	return dr6;
> >> +}
> >> +
> >> +static int kvm_vcpu_check_breakpoint(struct kvm_vcpu *vcpu)
> >> +{
> >> +	struct kvm_run *kvm_run = vcpu->run;
> >> +	unsigned long eip = vcpu->arch.emulate_ctxt.eip;
> >> +	u32 dr6 = 0;
> >> +
> >> +	if (unlikely(vcpu->guest_debug & KVM_GUESTDBG_USE_HW_BP) &&
> >> +	    (vcpu->arch.guest_debug_dr7 & DR7_BP_EN_MASK)) {
> >> +		dr6 = kvm_vcpu_check_hw_bp(eip, 0,
> >> +					   vcpu->arch.guest_debug_dr7,
> >> +					   vcpu->arch.eff_db);
> >> +
> >> +		if (dr6 != 0) {
> >> +			kvm_run->debug.arch.dr6 = dr6 | DR6_FIXED_1;
> >> +			kvm_run->debug.arch.pc = kvm_rip_read(vcpu) +
> >> +				get_segment_base(vcpu, VCPU_SREG_CS);
> >> +
> >> +			kvm_run->debug.arch.exception = DB_VECTOR;
> >> +			kvm_run->exit_reason = KVM_EXIT_DEBUG;
> >> +			return EMULATE_DO_MMIO;
> >> +		}
> >> +	}
> >> +
> >> +	if (unlikely(vcpu->arch.dr7 & DR7_BP_EN_MASK)) {
> >> +		dr6 = kvm_vcpu_check_hw_bp(eip, 0,
> >> +					   vcpu->arch.dr7,
> >> +					   vcpu->arch.db);
> >> +
> >> +		if (dr6 != 0) {
> >> +			vcpu->arch.dr6 &= ~15;
> >> +			vcpu->arch.dr6 |= dr6;
> >> +			kvm_queue_exception(vcpu, DB_VECTOR);
> >> +			return EMULATE_DONE;
> >> +		}
> >> +	}
> >> +
> >> +	return EMULATE_PROCEED;
> >> +}
> >> +
> >>  int x86_emulate_instruction(struct kvm_vcpu *vcpu,
> >>  			    unsigned long cr2,
> >>  			    int emulation_type,
> >> @@ -4892,6 +4946,17 @@ int x86_emulate_instruction(struct kvm_vcpu *vcpu,
> >>  
> >>  	if (!(emulation_type & EMULTYPE_NO_DECODE)) {
> >>  		init_emulate_ctxt(vcpu);
> >> +
> >> +		/*
> >> +		 * We will reenter on the same instruction since
> >> +		 * we do not set complete_userspace_io.  This does not
> >> +		 * handle watchpoints yet, those would be handled in
> >> +		 * the emulate_ops.
> >> +		 */
> >> +		r = kvm_vcpu_check_breakpoint(vcpu);
> >> +		if (r != EMULATE_PROCEED)
> >> +			return r;
> >> +
> >>  		ctxt->interruptibility = 0;
> >>  		ctxt->have_exception = false;
> >>  		ctxt->perm_ok = false;
> >> -- 
> >> 1.8.1.4
> >>
> > 
> > --
> > 			Gleb.
> > 

--
			Gleb.

Re: [PATCH 1/2] KVM: x86: handle hardware breakpoints during emulation

[Paolo Bonzini]

Il 04/06/2013 13:47, Gleb Natapov ha scritto:
> On Tue, Jun 04, 2013 at 01:33:20PM +0200, Paolo Bonzini wrote:
>> Il 04/06/2013 13:28, Gleb Natapov ha scritto:
>>> On Thu, May 30, 2013 at 06:00:30PM +0200, Paolo Bonzini wrote:
>>>> This lets debugging work better during emulation of invalid
>>>> guest state.
>>>>
>>>> The check is done before emulating the instruction, and (in the case
>>>> of guest debugging) reuses EMULATE_DO_MMIO to exit with KVM_EXIT_DEBUG.
>>>>
>>>> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
>>>> ---
>>>>  arch/x86/include/asm/kvm_host.h |  3 +-
>>>>  arch/x86/kvm/x86.c              | 65 +++++++++++++++++++++++++++++++++++++++++
>>>>  2 files changed, 67 insertions(+), 1 deletion(-)
>>>>
>>>> diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
>>>> index e2e09f3..aefd8c2 100644
>>>> --- a/arch/x86/include/asm/kvm_host.h
>>>> +++ b/arch/x86/include/asm/kvm_host.h
>>>> @@ -788,9 +788,10 @@ extern u32  kvm_min_guest_tsc_khz;
>>>>  extern u32  kvm_max_guest_tsc_khz;
>>>>  
>>>>  enum emulation_result {
>>>> -	EMULATE_DONE,       /* no further processing */
>>>> -	EMULATE_DO_MMIO,      /* kvm_run filled with mmio request */
>>>> +	EMULATE_DONE,         /* no further processing */
>>>> +	EMULATE_DO_MMIO,      /* kvm_run ready for userspace exit */
>>> If it no longer means MMIO (or PIO) lest rename it to something more
>>> meaningful. EMULATE_EXIT? EMULATE_USER_EXIT?
>>
>> I'll go with EMULATE_USER_EXIT.
>>
>>>>  	EMULATE_FAIL,         /* can't emulate this instruction */
>>>> +	EMULATE_PROCEED,      /* proceed with rest of emulation */
>>> I think we can do without this. Have to function: check_bp(),
>>> handle_bp(). Do:
>>>
>>>  if (check_bp())
>>>    return handle_bp();
>>
>> I tried this, but it doesn't work because you need to pass the computed
>> dr6 from check_bp to handle_bp.  It becomes really ugly.
>>
> Can't check_bp() return dr6?
> 
>  if ((dr6 = check_bp())
>     return handle_bp(dr6);

It also needs to know if debugging the guest vs. in the guest.  Thus
there is duplicate code between check and handle.

>> If you do not want EMULATE_PROCEED, I can just use -1 instead in
>> kvm_vcpu_check_breakpoint, and return if r < 0.
>>
> But you need to know what to return EMULATE_DONE or EMULATE_USER_EXIT.

Sorry, _not_ return if r < 0.

Paolo

>> Paolo
>>
>>>>  };
>>>>  
>>>>  #define EMULTYPE_NO_DECODE	    (1 << 0)
>>>> diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
>>>> index 1d928af..33b51bc 100644
>>>> --- a/arch/x86/kvm/x86.c
>>>> +++ b/arch/x86/kvm/x86.c
>>>> @@ -4872,6 +4872,60 @@ static bool retry_instruction(struct x86_emulate_ctxt *ctxt,
>>>>  static int complete_emulated_mmio(struct kvm_vcpu *vcpu);
>>>>  static int complete_emulated_pio(struct kvm_vcpu *vcpu);
>>>>  
>>>> +static int kvm_vcpu_check_hw_bp(unsigned long addr, u32 type, u32 dr7,
>>>> +				unsigned long *db)
>>>> +{
>>>> +	u32 dr6 = 0;
>>>> +	int i;
>>>> +	u32 enable, rwlen;
>>>> +
>>>> +	enable = dr7;
>>>> +	rwlen = dr7 >> 16;
>>>> +	for (i = 0; i < 4; i++, enable >>= 2, rwlen >>= 4)
>>>> +		if ((enable & 3) && (rwlen & 15) == type && db[i] == addr)
>>>> +			dr6 |= (1 << i);
>>>> +	return dr6;
>>>> +}
>>>> +
>>>> +static int kvm_vcpu_check_breakpoint(struct kvm_vcpu *vcpu)
>>>> +{
>>>> +	struct kvm_run *kvm_run = vcpu->run;
>>>> +	unsigned long eip = vcpu->arch.emulate_ctxt.eip;
>>>> +	u32 dr6 = 0;
>>>> +
>>>> +	if (unlikely(vcpu->guest_debug & KVM_GUESTDBG_USE_HW_BP) &&
>>>> +	    (vcpu->arch.guest_debug_dr7 & DR7_BP_EN_MASK)) {
>>>> +		dr6 = kvm_vcpu_check_hw_bp(eip, 0,
>>>> +					   vcpu->arch.guest_debug_dr7,
>>>> +					   vcpu->arch.eff_db);
>>>> +
>>>> +		if (dr6 != 0) {
>>>> +			kvm_run->debug.arch.dr6 = dr6 | DR6_FIXED_1;
>>>> +			kvm_run->debug.arch.pc = kvm_rip_read(vcpu) +
>>>> +				get_segment_base(vcpu, VCPU_SREG_CS);
>>>> +
>>>> +			kvm_run->debug.arch.exception = DB_VECTOR;
>>>> +			kvm_run->exit_reason = KVM_EXIT_DEBUG;
>>>> +			return EMULATE_DO_MMIO;
>>>> +		}
>>>> +	}
>>>> +
>>>> +	if (unlikely(vcpu->arch.dr7 & DR7_BP_EN_MASK)) {
>>>> +		dr6 = kvm_vcpu_check_hw_bp(eip, 0,
>>>> +					   vcpu->arch.dr7,
>>>> +					   vcpu->arch.db);
>>>> +
>>>> +		if (dr6 != 0) {
>>>> +			vcpu->arch.dr6 &= ~15;
>>>> +			vcpu->arch.dr6 |= dr6;
>>>> +			kvm_queue_exception(vcpu, DB_VECTOR);
>>>> +			return EMULATE_DONE;
>>>> +		}
>>>> +	}
>>>> +
>>>> +	return EMULATE_PROCEED;
>>>> +}
>>>> +
>>>>  int x86_emulate_instruction(struct kvm_vcpu *vcpu,
>>>>  			    unsigned long cr2,
>>>>  			    int emulation_type,
>>>> @@ -4892,6 +4946,17 @@ int x86_emulate_instruction(struct kvm_vcpu *vcpu,
>>>>  
>>>>  	if (!(emulation_type & EMULTYPE_NO_DECODE)) {
>>>>  		init_emulate_ctxt(vcpu);
>>>> +
>>>> +		/*
>>>> +		 * We will reenter on the same instruction since
>>>> +		 * we do not set complete_userspace_io.  This does not
>>>> +		 * handle watchpoints yet, those would be handled in
>>>> +		 * the emulate_ops.
>>>> +		 */
>>>> +		r = kvm_vcpu_check_breakpoint(vcpu);
>>>> +		if (r != EMULATE_PROCEED)
>>>> +			return r;
>>>> +
>>>>  		ctxt->interruptibility = 0;
>>>>  		ctxt->have_exception = false;
>>>>  		ctxt->perm_ok = false;
>>>> -- 
>>>> 1.8.1.4
>>>>
>>>
>>> --
>>> 			Gleb.
>>>
> 
> --
> 			Gleb.
> 

Re: [PATCH 1/2] KVM: x86: handle hardware breakpoints during emulation

[Gleb Natapov]

On Tue, Jun 04, 2013 at 02:19:13PM +0200, Paolo Bonzini wrote:
> Il 04/06/2013 13:47, Gleb Natapov ha scritto:
> > On Tue, Jun 04, 2013 at 01:33:20PM +0200, Paolo Bonzini wrote:
> >> Il 04/06/2013 13:28, Gleb Natapov ha scritto:
> >>> On Thu, May 30, 2013 at 06:00:30PM +0200, Paolo Bonzini wrote:
> >>>> This lets debugging work better during emulation of invalid
> >>>> guest state.
> >>>>
> >>>> The check is done before emulating the instruction, and (in the case
> >>>> of guest debugging) reuses EMULATE_DO_MMIO to exit with KVM_EXIT_DEBUG.
> >>>>
> >>>> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
> >>>> ---
> >>>>  arch/x86/include/asm/kvm_host.h |  3 +-
> >>>>  arch/x86/kvm/x86.c              | 65 +++++++++++++++++++++++++++++++++++++++++
> >>>>  2 files changed, 67 insertions(+), 1 deletion(-)
> >>>>
> >>>> diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
> >>>> index e2e09f3..aefd8c2 100644
> >>>> --- a/arch/x86/include/asm/kvm_host.h
> >>>> +++ b/arch/x86/include/asm/kvm_host.h
> >>>> @@ -788,9 +788,10 @@ extern u32  kvm_min_guest_tsc_khz;
> >>>>  extern u32  kvm_max_guest_tsc_khz;
> >>>>  
> >>>>  enum emulation_result {
> >>>> -	EMULATE_DONE,       /* no further processing */
> >>>> -	EMULATE_DO_MMIO,      /* kvm_run filled with mmio request */
> >>>> +	EMULATE_DONE,         /* no further processing */
> >>>> +	EMULATE_DO_MMIO,      /* kvm_run ready for userspace exit */
> >>> If it no longer means MMIO (or PIO) lest rename it to something more
> >>> meaningful. EMULATE_EXIT? EMULATE_USER_EXIT?
> >>
> >> I'll go with EMULATE_USER_EXIT.
> >>
> >>>>  	EMULATE_FAIL,         /* can't emulate this instruction */
> >>>> +	EMULATE_PROCEED,      /* proceed with rest of emulation */
> >>> I think we can do without this. Have to function: check_bp(),
> >>> handle_bp(). Do:
> >>>
> >>>  if (check_bp())
> >>>    return handle_bp();
> >>
> >> I tried this, but it doesn't work because you need to pass the computed
> >> dr6 from check_bp to handle_bp.  It becomes really ugly.
> >>
> > Can't check_bp() return dr6?
> > 
> >  if ((dr6 = check_bp())
> >     return handle_bp(dr6);
> 
> It also needs to know if debugging the guest vs. in the guest.  Thus
> there is duplicate code between check and handle.
> 
Yeah. What about:
 if ((dr6 = guest_debug()))
   return handle_gues_debug();
 else if ((dr6 = check_bp()))
   return handle_bp(dr6);
    
> >> If you do not want EMULATE_PROCEED, I can just use -1 instead in
> >> kvm_vcpu_check_breakpoint, and return if r < 0.
> >>
> > But you need to know what to return EMULATE_DONE or EMULATE_USER_EXIT.
> 
> Sorry, _not_ return if r < 0.
> 
Function that returns enum or -1? This is worse IMO. Return
EMULATE_DONE/EMULATE_USER_EXIT via a pointer will be better.

> Paolo
> 
> >> Paolo
> >>
> >>>>  };
> >>>>  
> >>>>  #define EMULTYPE_NO_DECODE	    (1 << 0)
> >>>> diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
> >>>> index 1d928af..33b51bc 100644
> >>>> --- a/arch/x86/kvm/x86.c
> >>>> +++ b/arch/x86/kvm/x86.c
> >>>> @@ -4872,6 +4872,60 @@ static bool retry_instruction(struct x86_emulate_ctxt *ctxt,
> >>>>  static int complete_emulated_mmio(struct kvm_vcpu *vcpu);
> >>>>  static int complete_emulated_pio(struct kvm_vcpu *vcpu);
> >>>>  
> >>>> +static int kvm_vcpu_check_hw_bp(unsigned long addr, u32 type, u32 dr7,
> >>>> +				unsigned long *db)
> >>>> +{
> >>>> +	u32 dr6 = 0;
> >>>> +	int i;
> >>>> +	u32 enable, rwlen;
> >>>> +
> >>>> +	enable = dr7;
> >>>> +	rwlen = dr7 >> 16;
> >>>> +	for (i = 0; i < 4; i++, enable >>= 2, rwlen >>= 4)
> >>>> +		if ((enable & 3) && (rwlen & 15) == type && db[i] == addr)
> >>>> +			dr6 |= (1 << i);
> >>>> +	return dr6;
> >>>> +}
> >>>> +
> >>>> +static int kvm_vcpu_check_breakpoint(struct kvm_vcpu *vcpu)
> >>>> +{
> >>>> +	struct kvm_run *kvm_run = vcpu->run;
> >>>> +	unsigned long eip = vcpu->arch.emulate_ctxt.eip;
> >>>> +	u32 dr6 = 0;
> >>>> +
> >>>> +	if (unlikely(vcpu->guest_debug & KVM_GUESTDBG_USE_HW_BP) &&
> >>>> +	    (vcpu->arch.guest_debug_dr7 & DR7_BP_EN_MASK)) {
> >>>> +		dr6 = kvm_vcpu_check_hw_bp(eip, 0,
> >>>> +					   vcpu->arch.guest_debug_dr7,
> >>>> +					   vcpu->arch.eff_db);
> >>>> +
> >>>> +		if (dr6 != 0) {
> >>>> +			kvm_run->debug.arch.dr6 = dr6 | DR6_FIXED_1;
> >>>> +			kvm_run->debug.arch.pc = kvm_rip_read(vcpu) +
> >>>> +				get_segment_base(vcpu, VCPU_SREG_CS);
> >>>> +
> >>>> +			kvm_run->debug.arch.exception = DB_VECTOR;
> >>>> +			kvm_run->exit_reason = KVM_EXIT_DEBUG;
> >>>> +			return EMULATE_DO_MMIO;
> >>>> +		}
> >>>> +	}
> >>>> +
> >>>> +	if (unlikely(vcpu->arch.dr7 & DR7_BP_EN_MASK)) {
> >>>> +		dr6 = kvm_vcpu_check_hw_bp(eip, 0,
> >>>> +					   vcpu->arch.dr7,
> >>>> +					   vcpu->arch.db);
> >>>> +
> >>>> +		if (dr6 != 0) {
> >>>> +			vcpu->arch.dr6 &= ~15;
> >>>> +			vcpu->arch.dr6 |= dr6;
> >>>> +			kvm_queue_exception(vcpu, DB_VECTOR);
> >>>> +			return EMULATE_DONE;
> >>>> +		}
> >>>> +	}
> >>>> +
> >>>> +	return EMULATE_PROCEED;
> >>>> +}
> >>>> +
> >>>>  int x86_emulate_instruction(struct kvm_vcpu *vcpu,
> >>>>  			    unsigned long cr2,
> >>>>  			    int emulation_type,
> >>>> @@ -4892,6 +4946,17 @@ int x86_emulate_instruction(struct kvm_vcpu *vcpu,
> >>>>  
> >>>>  	if (!(emulation_type & EMULTYPE_NO_DECODE)) {
> >>>>  		init_emulate_ctxt(vcpu);
> >>>> +
> >>>> +		/*
> >>>> +		 * We will reenter on the same instruction since
> >>>> +		 * we do not set complete_userspace_io.  This does not
> >>>> +		 * handle watchpoints yet, those would be handled in
> >>>> +		 * the emulate_ops.
> >>>> +		 */
> >>>> +		r = kvm_vcpu_check_breakpoint(vcpu);
> >>>> +		if (r != EMULATE_PROCEED)
> >>>> +			return r;
> >>>> +
> >>>>  		ctxt->interruptibility = 0;
> >>>>  		ctxt->have_exception = false;
> >>>>  		ctxt->perm_ok = false;
> >>>> -- 
> >>>> 1.8.1.4
> >>>>
> >>>
> >>> --
> >>> 			Gleb.
> >>>
> > 
> > --
> > 			Gleb.
> > 

--
			Gleb.

Re: [PATCH 1/2] KVM: x86: handle hardware breakpoints during emulation

[Paolo Bonzini]

Il 04/06/2013 14:53, Gleb Natapov ha scritto:
>> > 
> Yeah. What about:
>  if ((dr6 = guest_debug()))
>    return handle_gues_debug();
>  else if ((dr6 = check_bp()))
>    return handle_bp(dr6);

I'll try either this...

>>>> > >> If you do not want EMULATE_PROCEED, I can just use -1 instead in
>>>> > >> kvm_vcpu_check_breakpoint, and return if r < 0.
>>>> > >>
>>> > > But you need to know what to return EMULATE_DONE or EMULATE_USER_EXIT.
>> > 
>> > Sorry, _not_ return if r < 0.
>> > 
> Function that returns enum or -1? This is worse IMO. Return
> EMULATE_DONE/EMULATE_USER_EXIT via a pointer will be better.

... or this, and see what looks nicer.  But I like

   if (check_bp(&r))
       return r;

Thanks for the review.

Paolo

[PATCH 0/2] KVM: x86: minimal debugging support during emulation

[Paolo Bonzini]

The switch to emulate_invalid_guest_state brought one slightly unwelcome
change; the debugging interface does not work in the initial boot phase
because KVM_SET_GUEST_DEBUG is basically ignored.

These two patches bring some initial support for debugging, namely for
hardware breakpoints and single-stepping.  Software breakpoints and
hardware watchpoints are still ignored.

Paolo

v1->v2: rename EMULATE_DO_MMIO to EMULATE_USER_EXIT;
    return EMULATE_* value via pointer-to-int argument.

Paolo Bonzini (3):
  KVM: x86: rename EMULATE_DO_MMIO
  KVM: x86: handle hardware breakpoints during emulation
  KVM: x86: handle singlestep during emulation

 arch/x86/include/asm/kvm_host.h |   4 +-
 arch/x86/kvm/mmu.c              |   2 +-
 arch/x86/kvm/vmx.c              |   2 +-
 arch/x86/kvm/x86.c              | 109 ++++++++++++++++++++++++++++++++++++++--
 4 files changed, 110 insertions(+), 7 deletions(-)

-- 
1.8.1.4