Re: [Xen-devel] Is there a bug in the emulation of fucomip instruction?

[Keir Fraser <keir@xxxxxxx>]

On 15/06/2011 12:51, "Wangzhenguo" <wangzhenguo@xxxxxxxxxx> wrote:

> It's different between the implementation of the fucomip instruction in the
> function of x86_emulate and the spec of the fucomip in Intel 64 and IA-32
> architectures Software Developer's Manual Volume 2A. The opcode of the fucomip
> is described "DF E8+i", but in the implementation in the function of
> 86_emulate it's "df f8+i":

Good catch. Fixed as of xen-unstable:23546. I'll backport it to our
maintained stable branches too.

 Thanks,
 Keir

> ---------------------------------------------------------
>     case 0xdf: /* FPU 0xdf */
>         switch ( modrm )
>         {
>         case 0xe0:
>             /* fnstsw %ax */
>             dst.bytes = 2;
>             dst.type = OP_REG;
>             dst.reg = (unsigned long *)&_regs.eax;
>             emulate_fpu_insn_memdst("fnstsw", dst.val);
>             break;
>         case 0xf0 ... 0xf7: /* fcomip %stN */
>         case 0xf8 ... 0xff: /* fucomip %stN */            <--here-->
>             emulate_fpu_insn_stub(0xdf, modrm);
>             break;
>         default:
>             fail_if(modrm >= 0xc0);
> ---------------------------------------------------------
> So, xen will panic and say it's an invalid opcode if the guest executes the
> invalid instruction, "fd ff", for example.
> Is it right?
> 
> There is the panic message as follow:
> (XEN) RIP:    e008:[<ffff83203fd1fae8>] ???
> (XEN) RFLAGS: 0000000000010246   CONTEXT: hypervisor
> (XEN) rax: ffff83203fd1fae8   rbx: 00000000000000df   rcx: ffff83203fd1fda8
> (XEN) rdx: 0000000000000000   rsi: ffff83203fd1fc78   rdi: ffff82c480179bf0
> (XEN) rbp: 0000000000000000   rsp: ffff83203fd1f910   r8:  ffff82c48019c9f0
> (XEN) r9:  0000000000000000   r10: 00000000000000c8   r11: 0000000000000000
> (XEN) r12: 0000000000000004   r13: 00000000000000df   r14: ffff83203fd1fda8
> (XEN) r15: 0000000000000004   cr0: 0000000080050033   cr4: 00000000000026b0
> (XEN) cr3: 0000001f10da5000   cr2: 00000000fffe0080
> (XEN) ds: 0000   es: 0000   fs: 0000   gs: 0000   ss: 0000   cs: e008
> (XEN) Xen stack trace from rsp=ffff83203fd1f910:
> (XEN)    ffff82c48018248e 0000000000000022 ffff82c480179daf 0000ffff009322f4
> (XEN)    00000000000000c8 0000000000000000 ffff82c480180234 000000023fd1fde8
> (XEN)    ffff83203fd1fca0 0000000000000001 00000000000000df 0000000000000000
> (XEN)    ffff83203fd1fa18 0000000400000000 ffff82c48022e800 000000003fd1fa1c
> (XEN)    0000000000000022 ffff83203fd1fc78 00c883203fd1fa48 00000004000000ff
> (XEN)    ffff8200000000004
> (XEN)    0000000000000000 0000000800000000 0000000000040041 0000000000000000
> (XEN)    0000000000000002 0000000000000000 0000000000000000 0000000000000000
> (XEN)    0000000000000000 000000000004006c 0000000000040148 0000000000000000
> (XEN)    0000000000000000 0000000000000000 0000000000000000 000000008055d0c0
> (XEN)    0000000000000000 000000000000001f 0000000000000000 00000000fffe0080
> (XEN)    0000000000000000 000000008055d5a4 0000000000000000 0000000000010246
> (XEN)    000000000004001c 0000000000000000 0000000000000000 0000000000000000
> (XEN)    0000000000000000 0000000000000000 0000000000000001 0000000000c3ffdf
> (XEN)    ffff82c4801ea708 0000000300000000 ffff83203fd1fb20 ffff83203fd1fb9c
> (XEN)    000000093fd1fb2c 0000000000000002 0000000000000bc5 0000000000000000
> (XEN)    0000000000000000 0000000000000000 0000000000000000 0000000000000000
> (XEN)    ffff83203fd1fa8808 0000000300000003
> (XEN)    ffff83203fd1fb90 ffff83203fd1fc24 0000000910dca000 0000000000000002
> (XEN) Xen call trace:
> (XEN)    [<ffff83203fd1fae8>] ???
> (XEN)    [<ffff82c48018248e>] x86_emulate+0x7e9e/0x11b10
> (XEN)    [<ffff82c480179daf>] get_cpl+0x3f/0x60
> (XEN)    [<ffff82c480180234>] x86_emulate+0x5c44/0x11b10
> (XEN)    [<ffff82c4801ea708>] ept_get_entry+0xd8/0x230
> (XEN)    [<ffff82c4801ea708>] ept_get_entry+0xd8/0x230
> (XEN)    [<ffff82c4801ea708>] ept_get_entry+0xd8/0x230
> (XEN)    [<ffff82c4801ea708>] ept_get_entry+0xd8/0x230
> (XEN)    [<ffff82c4801a352e>] __hvm_copy+0x30e/0x3e0
> (XEN)    [<ffff82c48019cec9>] hvm_emulate_one+0xc9/0x1b0
> (XEN)    [<ffff82c4801bd895>] vmx_vmexit_handler+0x10b5/0x1d70
> (XEN)    [<ffff82c480118a0d>] _csched_cpu_pick+0xfd/0x360
> (XEN)    [<ffff82c480118c80>] csched_tick+0x0/0x250pt_update_irq+0x33/0x230
> (XEN)    [<ffff82c48011f6b4>] execute_timer+0x34/0x50
> (XEN)    [<ffff82c4801a87eb>] hvm_vcpu_has_pending_irq+0x6b/0xb0
> (XEN)    [<ffff82c4801b67bc>] vmx_intr_assist+0x5c/0x240
> (XEN)    [<ffff82c4801b9bfb>] vmx_vmenter_helper+0x5b/0x140
> (XEN)    [<ffff82c4801b6573>] vmx_asm_do_vmentry+0x0/0xdd
> (XEN)    
> (XEN) 
> (XEN) ****************************************
> (XEN) Panic on CPU 8:
> (XEN) FATAL TRAP: vector = 6 (invalid opcode)
> (XEN) ****************************************
> 
> 
> _______________________________________________
> Xen-devel mailing list
> Xen-devel@xxxxxxxxxxxxxxxxxxx
> http://lists.xensource.com/xen-devel



_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-devel