Multiplexing RFLAGS.TF

static int db_interception(struct vcpu_svm *svm)

{
    struct kvm_run *kvm_run = svm->vcpu.run;

    if (!(svm->vcpu.guest_debug &
          (KVM_GUESTDBG_SINGLESTEP | KVM_GUESTDBG_USE_HW_BP)) &&
        !svm->nmi_singlestep) {
        kvm_queue_exception(&svm->vcpu, DB_VECTOR);
        return 1;
    }

    if (svm->nmi_singlestep) {
        svm->nmi_singlestep = false;
        if (!(svm->vcpu.guest_debug & KVM_GUESTDBG_SINGLESTEP))
            svm->vmcb->save.rflags &=
                ~(X86_EFLAGS_TF | X86_EFLAGS_RF);
        update_db_intercept(&svm->vcpu);
    }

This code assumes that either the guest is debugging itself, or (nmi_singlestep | guest debugging). However if the guest is debugging itself and takes an NMI, or if both host and guest are debugging the guest, things will go wrong.

So we need an rflags_guest_owned_bits, usually set to -1ULL, but sometimes (NMI, host debugging) clearing EFLAGS_TF. When we do that, we need to intercept instructions that influence RFLAGS.TF (POPF, IRET, INTn) and emulate them. Otherwise, the guest can disable tracing which was enabled on behalf of the host.

We also need to drop the 'return 1' on the top of the function to allow both guest and host tracing.

On Intel, the situation is harder. We can't trap POPF or IRET. What we can do, is use the Monitor Trap Flag on hosts that have it.

Comments? Perhaps I missed something. Maybe I'll try writing a test case to prove the brokenness, it's fashionable these days.

Jan, as this is your code, are you interested in doing this?

Quoted 7 lines

So we need an rflags_guest_owned_bits, usually set to -1ULL, but sometimes (NMI, host debugging) clearing EFLAGS_TF. When we do that, we need to intercept instructions that influence RFLAGS.TF (POPF, IRET, INTn) and emulate them. Otherwise, the guest can disable tracing which was enabled on behalf of the host.

I was still waiting on some smart idea from AMD how to properly implement NMIs without having to fully emulate IRET. Probably there is no alternative...

Quoted 2 lines

We also need to drop the 'return 1' on the top of the function to allow both guest and host tracing.

Support for host and guest-initiated tracing at the same time would be nice, but I would not spend to much effort on this corner case of the corner cases. If it happens to fall off from the NMI fix, OK. But otherwise let the host rule TF if it wants to.

Quoted 2 lines

On Intel, the situation is harder. We can't trap POPF or IRET. What we can do, is use the Monitor Trap Flag on hosts that have it.

Setting TF before POPF and IRET should give us at least the chance to provide host-overrules-guest tracing support. Adding monitor trap support would be nice. It would allow more things actually, but it may then require some additional knob in the user/kernel interface to control the mode (MTF steps into exceptions/interrupts, TF not).

Quoted 4 lines

Comments? Perhaps I missed something. Maybe I'll try writing a test case to prove the brokenness, it's fashionable these days.

Jan, as this is your code, are you interested in doing this?

I'm not very keen on writing complex and error-prone opcode emulations, but in principle resolving the AMD issue is on my long to-do list - with moderate prio though.