[Lguest] lguest: unhandled trap 13 and CONFIG_MICROCODE_INTEL_EARLY

[Paul Bolle]

0) Since v3.9 launching a guest kernel with the lguest tool triggers an
"unhandled trap 13" error if CONFIG_MICROCODE_INTEL_EARLY is set (and
one runs on an Intel CPU). That option was introduced in v3.9.

1) For instance, on qemu I ran into this error:
    lguest: unhandled trap 13 at 0x97087d (0x0)

2) Disassembling that address (with the page offset added) in vmlinux
(in gdb) showed:

Dump of assembler code for function collect_cpu_info_early:
   0xc09707e4 <+0>:     push   %ebp
   [...]
   0xc097087d <+153>:   wrmsr  
   [...]
   0xc09708a5 <+193>:   ret    
End of assembler dump.

3) The internet tells me wrmsr will trigger a general protection fault
if the CPU is not running in ring 0. And a guest kernel seems to do that
since v3.9:

arch/x86/kernel/head_32.S:call load_ucode_bsp
     arch/x86/kernel/microcode_core_early.c:load_ucode_bsp()
         arch/x86/kernel/microcode_intel_early.c:_load_ucode_intel_bsp()
                                                     collect_cpu_info_early()

4) If I tell qemu to emulate an AMD processor this error isn't hit
anymore.

(5) Annoyingly, the error differs on actual Intel hardware. Then I get:
    lguest: unhandled trap 13 at 0xc4b875 (0x0)

And disassembling that address (with the page offset added in gdb)
gives:

Dump of assembler code for function load_ucode_intel_bsp:
   0xc0c4b867 <+0>:     push   %ebp
   [...]
   0xc0c4b875 <+14>:    mov    %gs:0x14,%eax
   [...]
   0xc0c4b90b <+164>:   ret
End of assembler dump.

Does an actual Intel CPU perhaps scan ahead for privileged instructions?
Quite strange ...)

6) Is there an elegant way to skip all this "load microcode early" code
when running as a guest kernel?


Paul Bolle