2

Consider the following sequence of guest VM instructions:

701: 55     push %rbp 
702: 41 54  push %r12 
704: 41 55  push %r13

For any of the above instruction is an EXIT is possible for any reason? I think YES it is possible because PUSH can raise a page fault if a stack is not present.

Am I correct or wrong?

BeeOnRope
  • 60,350
  • 16
  • 207
  • 386
Nachiket Joshi
  • 23
  • 5
  • 1
    Yes. It can raise a page [fault][1]. [1]:http://stackoverflow.com/questions/4584089/what-is-the-function-of-the-push-pop-instructions-used-on-registers-in-x86-ass – suneet saini Mar 20 '17 at 03:25
  • 1
    @Johan If the page that `RSP - 8` points to isn't present (or isn't writable or is invalid) then the CPU will generate a page fault when executing these instructions. – Ross Ridge Mar 20 '17 at 18:04

1 Answers1

1

I'm quoting Intel and thus implicitly referring to the VT-x technology.
AMD-v is similar, though (Particularly, exceptions are still intercepted).

Exceptions can cause a VMExit if the VMM (the program running in VMX root mode) has configured the VMCS to allow it:

Exceptions. Exceptions (faults, traps, and aborts) cause VM exits based on the exception bitmap (see Section 24.6.3). If an exception occurs, its vector (in the range 0–31) is used to select a bit in the exception bitmap. If the bit is 1, a VM exit occurs; if the bit is 0, the exception is delivered normally through the guest IDT.

So if the sequence of instruction generates any exception, it opens the possibility of a VMExit.

Besides the #PF there are other exceptions that a push can generate:

#GP(0) If the memory address is in a non-canonical form.
#SS(0) If the stack address is in a non-canonical form.
#PF(fault-code) If a page fault occurs.
#AC(0) If alignment checking is enabled and an unaligned memory reference is made while the current privilege level is 3.

As Ross Ridge pointed out in the comments, a VMExit can also occur due to an EPT (nested pages in AMD terminology if IIRC) fault.
Also, the #GP is not relevant for the snippet posted.

Margaret Bloom
  • 41,768
  • 5
  • 78
  • 124
  • #GP can't happen with the given instructions because they don't have a memory operand. The instructions can also cause EPT violation/misconfiguration VM exits, which are basically meta-page-faults. – Ross Ridge Mar 20 '17 at 09:33