From mboxrd@z Thu Jan 1 00:00:00 1970 From: Keir Fraser Subject: Re: Invalid op code emulation for HVM guest and GPF Date: Fri, 23 Mar 2012 19:17:47 +0000 Message-ID: References: <20120323114425.07bd6db7@mantra.us.oracle.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <20120323114425.07bd6db7@mantra.us.oracle.com> List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: xen-devel-bounces@lists.xen.org Errors-To: xen-devel-bounces@lists.xen.org To: Mukesh Rathor , "Xen-devel@lists.xensource.com" , kris.van.hees@oracle.com List-Id: xen-devel@lists.xenproject.org On 23/03/2012 18:44, "Mukesh Rathor" wrote: > Hey Keir, > > DTRACE in linux/solaris guests use invalid op code sequence: > > opcode trap is: 0xF0 0x90 0x90 0x90 0x90 (LOCK NOP NOP NOP NOP) > > to receive UD, but they get GPF instead. (xen 4.1.2) > > Looking at hvm_emulate_one() I see place where it generates GPF if not > expected sequence. Do you know quickly what can be done to deliver UD > for the above sequence, or what single byte they can use to generate > UD? (int 6 is two byte instr and doesn't work for them). You'll have to point out the path taken. AFAICS the sequence will cause a #UD trap into Xen, which will execute vmx_vmexit_ud_intercept(), should get X86EMUL_UNHANDLEABLE from hvm_emulate_one() and then inject the #UD back up into the guest. I don't see where the #GP would come from: certainly hvm_emulate_one() itself doesn't appear to generate any guest exceptions. Is it coming from the emulator itself? Might be a bug to be fixed if so. -- Keir > thanks a lot, > Mukesh