Re: Invalid op code emulation for HVM guest and GPF

[Andrew Cooper <andrew.cooper3@citrix.com>]

On 23/03/12 18:44, Mukesh Rathor wrote:
> Hey Keir,
>
> DTRACE in linux/solaris guests use invalid op code sequence:
>
> opcode trap is: 0xF0 0x90 0x90 0x90 0x90 (LOCK NOP NOP NOP NOP) 
>
> to receive UD, but they get GPF instead. (xen 4.1.2)
>
> Looking at hvm_emulate_one() I see place where it generates GPF if not
> expected sequence. Do you know quickly what can be done to deliver UD
> for the above sequence, or what single byte they can use to generate
> UD? (int 6 is two byte instr and doesn't work for them).
>
> thanks a lot,
> Mukesh

There is the UD2 instruction 0x0F 0x0B which is specifically designed to
cause a #UD exception.

I am not sure what you mean by "single byte", as the example sequence is
not a single byte instruction.  The LOCK is an instruction prefix,
making the first NOP a 2 byte instruction, followed by three 1byte
instructions.

As for the operation of LOCK NOP, Intel manual 2B defines this to cause
an #UD exception, so that is a bug in Xen.

It has been long time since I have played about in that code - I will
see if I can remember enough to fix this issue, but others will probably
be faster.

~Andrew

> _______________________________________________
> Xen-devel mailing list
> Xen-devel@lists.xen.org
> http://lists.xen.org/xen-devel

-- 
Andrew Cooper - Dom0 Kernel Engineer, Citrix XenServer
T: +44 (0)1223 225 900, http://www.citrix.com