[PATCH RFC 0/1] Fix ICEBP handling after KVM debug exits

To: [email protected]
Cc: Paolo Bonzini <[email protected]>,
    Marcelo Tosatti <[email protected]>,
    [email protected]

KVM normally recognizes ICEBP, advances RIP, and injects #DB itself.
When userspace enables hardware breakpoints, however, KVM reports the
pre-skip #DB through KVM_EXIT_DEBUG.  QEMU currently reinjects it at the
old RIP, causing a debug-exit livelock.

The patch is marked RFC because KVM_EXIT_DEBUG does not preserve KVM's
exact ICEBP classification.  The proposed compatibility heuristic accepts
a causeless #DB whose instruction stream consists only of prefixes and
0xf1.  A durable long-term ABI might instead let KVM expose its exact
classification or advance the instruction before exiting; I would like
feedback from both QEMU and KVM reviewers on that direction.

Validation on an Intel VT-x host:

- Built x86_64-softmmu from current master (ae4f3443209).
- checkpatch reports zero errors and warnings.
- Ran a real Linux guest that executes kernel-mode ICEBP while an
  unrelated hardware breakpoint is installed through QEMU's GDB stub.
  Unpatched QEMU stalls after ICEBP_KERNEL_BEFORE; patched QEMU reaches
  ICEBP_KERNEL_AFTER.

I did not include the hardware reproduction in the patch because it needs
real VT-x, a matching guest kernel build, and a loadable module.  I can
turn the fixture into an optional avocado test if reviewers prefer.

Saul Freedman (1):
  target/i386: skip ICEBP before reinjecting #DB

 target/i386/kvm/kvm.c | 62 ++++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 61 insertions(+), 1 deletion(-)

-- 
2.55.0