Re: [Xen-devel] [SVM] Getting the length of the current instruction in svm_vmexit_handler()

[Razvan Cojocaru <rcojocaru@xxxxxxxxxxxxxxx>]

On 03/14/2018 07:06 PM, Andrew Cooper wrote:
> On 14/03/18 15:53, Jan Beulich wrote:
>>>>> On 14.03.18 at 15:56, <rcojocaru@xxxxxxxxxxxxxxx> wrote:
>>> We'd like to retrieve the length of the current instruction in
>>> svm_vmexit_handler(), specifically for the VMEXIT_EXCEPTION_DB and
>>> VMEXIT_EXCEPTION_BP cases.
>>>
>>> We've combed the vmcb to no avail. Everything we've thought to check
>>> (exitinfo1, exitinfo2, exitintinfo) turns out to be zero there while
>>> testing.
>>>
>>> There's __get_instruction_length(vcpu, instr), but it expects to be fed
>>> the exact instruction we want the length for, which obviously defeats
>>> the purpose here.
>>>
>>> Is there a clean way to get the current instruction length like we do in
>>> the VMX case (__vmread(VM_EXIT_INSTRUCTION_LEN, &insn_len)) that we're
>>> overlooking?
>> Just like Intel's, AMD's is available in a subset of cases only
>> (look for vmcb->guest_ins_len), which don't include the
>> exception intercepts you talk about. For #DB I think there's
>> no difference between both anyway.
> 
> On non-first-gen hardware, the difference between RIP and NextRIP should
> give you the instruction length.  ISTR NextRIP is written on all exits,
> and consumed on all entries.

Thanks!

vmcb->nextrip - vmcb->rip seems to work well for the instruction length.

Shouldn't vmcb->exitintinfo also be filled in properly on SVM? I'm
getting this on VMEXIT_EXCEPTION_BP:

(XEN) Dumping guest's current state at svm_vmexit_handler...
(XEN) Size of VMCB = 4096, paddr = 0000000c1cc7e000, vaddr =
ffff830c1cc7e000
(XEN) cr_intercepts = 0xfef3fef3 dr_intercepts = 0xffffffff
exception_intercepts = 0x6000a
(XEN) general1_intercepts = 0xbdc4000f general2_intercepts = 0x2f7f
(XEN) iopm_base_pa = 0xdbf79000 msrpm_base_pa = 0xc1cc7c000 tsc_offset =
0xffffffa40f20290d
(XEN) tlb_control = 0 vintr = 0x1000000 interrupt_shadow = 0
(XEN) eventinj 0000000000000000, valid? 0, ec? 0, type 0, vector 0
(XEN) exitcode = 0x43 exitintinfo = 0
(XEN) exitinfo1 = 0 exitinfo2 = 0
(XEN) np_enable = 0x1 guest_asid = 0x4
(XEN) virtual vmload/vmsave = 0, virt_ext = 0
(XEN) cpl = 0 efer = 0x1500 star = 0 lstar = 0
(XEN) CR0 = 0x0000000080010011 CR2 = 0x0000000000000000
(XEN) CR3 = 0x000000000010d000 CR4 = 0x0000000000000060
(XEN) RSP = 0x000000000011afa8  RIP = 0x0000000000104b01
(XEN) RAX = 0x0000000000104b02  RFLAGS=0x0000000000000046
(XEN) DR6 = 0x0000000000000000, DR7 = 0x0000000000000000
(XEN) CSTAR = 0x0000000000000000 SFMask = 0x0000000000000000
(XEN) KernGSBase = 0x0000000000000000 PAT = 0x0007040600070406
(XEN) H_CR3 = 0x00000003b912a000 CleanBits = 0xffffffff
(XEN)        sel attr  limit   base
(XEN)   CS: 0008 029b ffffffff 0000000000000000
(XEN)   DS: 0033 0cf3 ffffffff 0000000000000000
(XEN)   SS: 0000 0400 ffffffff 0000000000000000
(XEN)   ES: 0033 0cf3 ffffffff 0000000000000000
(XEN)   FS: 0000 0000 00000000 0000000000000000
(XEN)   GS: 0000 0000 00000000 0000000000000000
(XEN) GDTR: 0000 0000 00000077 00000000001060c0
(XEN) LDTR: 0000 0000 00000000 0000000000000000
(XEN) IDTR: 0000 0000 00000fff 0000000000115900
(XEN)   TR: 0000 008b 00000067 0000000000000000

and this on (newly added for testing purposes) VMEXIT_ICEBP:

(XEN) Dumping guest's current state at svm_vmexit_handler...
(XEN) Size of VMCB = 4096, paddr = 0000000c1cc7e000, vaddr =
ffff830c1cc7e000
(XEN) cr_intercepts = 0xfef3fef3 dr_intercepts = 0xffffffff
exception_intercepts = 0x6000a
(XEN) general1_intercepts = 0xbdc4000f general2_intercepts = 0x2f7f
(XEN) iopm_base_pa = 0xdbf79000 msrpm_base_pa = 0xc1cc7c000 tsc_offset =
0xffffffa40f20290d
(XEN) tlb_control = 0 vintr = 0x1000000 interrupt_shadow = 0
(XEN) eventinj 0000000000000000, valid? 0, ec? 0, type 0, vector 0
(XEN) exitcode = 0x88 exitintinfo = 0
(XEN) exitinfo1 = 0 exitinfo2 = 0
(XEN) np_enable = 0x1 guest_asid = 0x4
(XEN) virtual vmload/vmsave = 0, virt_ext = 0
(XEN) cpl = 0 efer = 0x1500 star = 0 lstar = 0
(XEN) CR0 = 0x0000000080010011 CR2 = 0x0000000000000000
(XEN) CR3 = 0x000000000010d000 CR4 = 0x0000000000000060
(XEN) RSP = 0x000000000011afa8  RIP = 0x0000000000104b81
(XEN) RAX = 0x0000000000104b82  RFLAGS=0x0000000000000046
(XEN) DR6 = 0x0000000000000000, DR7 = 0x0000000000000000
(XEN) CSTAR = 0x0000000000000000 SFMask = 0x0000000000000000
(XEN) KernGSBase = 0x0000000000000000 PAT = 0x0007040600070406
(XEN) H_CR3 = 0x00000003b912a000 CleanBits = 0xffffffff
(XEN)        sel attr  limit   base
(XEN)   CS: 0008 029b ffffffff 0000000000000000
(XEN)   DS: 0033 0cf3 ffffffff 0000000000000000
(XEN)   SS: 0000 0400 ffffffff 0000000000000000
(XEN)   ES: 0033 0cf3 ffffffff 0000000000000000
(XEN)   FS: 0000 0000 00000000 0000000000000000
(XEN)   GS: 0000 0000 00000000 0000000000000000
(XEN) GDTR: 0000 0000 00000077 00000000001060c0
(XEN) LDTR: 0000 0000 00000000 0000000000000000
(XEN) IDTR: 0000 0000 00000fff 0000000000115900
(XEN)   TR: 0000 008b 00000067 0000000000000000

Not a lot of useful information there.


Thanks,
Razvan

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxxx
https://lists.xenproject.org/mailman/listinfo/xen-devel