Messages in this thread | | | Subject | Re: Dealing with the NMI mess | From | Paolo Bonzini <> | Date | Fri, 31 Jul 2015 11:27:13 +0200 |
| |
On 31/07/2015 10:03, Borislav Petkov wrote: > $ ./icebp > Trace/breakpoint trap > > ^ this in qemu.
Is the strace different between KVM and baremetal? QEMU dynamic translation is broken I think, but KVM should be the same as baremetal.
>> Fortunately, it looks like the vm86 case is correct (or as correct as >> any of the vm86 junk can be), although I haven't tested it. I bet >> that icebp is like int3 in that it punches through vm86 mode instead >> of sending #GP. > > Yeah, INT 1. I wonder whether INT 1, i.e. CD imm8 does the same thing.
No, it sends #GP.
> But why do you say it is special - it simply raises #DB, i.e. vector 1. > Web page seems to say so when interrupt redirection is disabled. It > sounds like a nice and quick way to generate a breakpoint. You can do > that with INT 01, i.e., the CD opcode, too. > > If I'd had to guess, it isn't documented because of the proprietary ICE > aspect. And no one uses ICEs anymore so it is going to be forgotten with > people popping off and on and asking about the undocumented opcode.
The reason why it isn't documented is probably hidden within Intel. Besides ICEBP, which is a bit fringe, there's no reason not to document SALC which Thomas mentioned. SALC all has been there since the 8086, and has been undocumented for thirty-odd years.
The AAM/AAD variants with immediates other than 10 also have been undocumented for fifteen years or so (an instruction doing a division by 10 where the second byte of the opcode is 10? oh, certainly no one is going to try changing the second byte...)
Paolo
| |