Re: (xen 4.6 unstable) triple fault when execute fxsave during the procedure of guest iso install

[Razvan Cojocaru <rcojocaru@bitdefender.com>]

On 06/24/2015 12:31 PM, Andrew Cooper wrote:
> On 24/06/15 10:25, Razvan Cojocaru wrote:
>> On 06/24/2015 12:14 PM, Fanhenglong wrote:
>>> I want to debug the procedure of windows os install with windbg,
>>>
>>> windbg executes instruction(fxsave) after the blank vm is started and
>>> before guest iso start to install,
>>>
>>> fxsave trigger the following code path:
>>> vmx_vmexit_handler(EXIT_REASON_EPT_VIOLATION)
>>> ->ept_handle_violation
>>> ->hvm_hap_nested_page_fault
>>> ->handle_mmio_with_translation
>>> ->handle_mmio
>>> ->hvm_emulate_one
>>> ->x86_emulate
>>>
>>> *X86_emulate return X86EMUL_UNHANDLEABLE*
>> How are you using Xen in this case? Are you by any chance using the
>> vm_event system in a way that sends back an "emulate" vm_event response
>> from userspace?
>>
>> You might want to look at x86_emulate() in
>> xen/arch/x86/x86_emulate/x86_emulate.c and see if (and how) fxsave is
>> being handled.
> 
> The fxsave instruction has no emulation implementation.
> 
> "0f ae 07" is "fxsave (%rdi)" which means that either introspection is
> active, or %rdi is a pointer into an MMIO region.

I see, these are the cases we wanted to treat with the old patch (I
thick it was called "xen: Handle resumed instruction based on previous
mem_event reply" - the early versions, with RFC) that sometimes bypassed
the emulator in the introspection case. Without that, there's always
going to be a potential current or future instruction not emulated, and
then something like this happens.


Cheers,
Razvan