Re: Invalid op code emulation for HVM guest and GPF

[Keir Fraser <keir.xen@gmail.com>]

On 23/03/2012 18:44, "Mukesh Rathor" <mukesh.rathor@oracle.com> wrote:

> Hey Keir,
> 
> DTRACE in linux/solaris guests use invalid op code sequence:
> 
> opcode trap is: 0xF0 0x90 0x90 0x90 0x90 (LOCK NOP NOP NOP NOP)
> 
> to receive UD, but they get GPF instead. (xen 4.1.2)
> 
> Looking at hvm_emulate_one() I see place where it generates GPF if not
> expected sequence. Do you know quickly what can be done to deliver UD
> for the above sequence, or what single byte they can use to generate
> UD? (int 6 is two byte instr and doesn't work for them).

You'll have to point out the path taken. AFAICS the sequence will cause a
#UD trap into Xen, which will execute vmx_vmexit_ud_intercept(), should get
X86EMUL_UNHANDLEABLE from hvm_emulate_one() and then inject the #UD back up
into the guest.

I don't see where the #GP would come from: certainly hvm_emulate_one()
itself doesn't appear to generate any guest exceptions. Is it coming from
the emulator itself? Might be a bug to be fixed if so.

 -- Keir

> thanks a lot,
> Mukesh