blob: 2a6fc2b56bda0a6fc8309b8b32b3af3090674382 (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
|
device: 0.785
graphic: 0.726
permissions: 0.686
performance: 0.619
semantic: 0.424
network: 0.321
PID: 0.317
other: 0.309
vnc: 0.298
debug: 0.237
socket: 0.207
KVM: 0.199
boot: 0.154
files: 0.125
Throws a #GP when it should throw a #SS
Description of problem:
When stacks are switched as part of a 64-bit mode privilege-level change (resulting from an interrupt), IA-32e mode loads only an inner-level RSP from the TSS. If the value of rsp from tss is a non-canonical form. It will trigger #SS. But when I test it in qemu it throws #GP instead of #SS
Steps to reproduce:
In order to confirm that it is the #SS triggered by the non-canonical address, We can verify on a real machine.
1. Set the value of the current core's `TSS.IST7` to the the non-canonical address.
2. Set the `ist` field of the interrupt 4 (Overflow Exception) descriptor to 7.
3. Execute the `INT 4` instruction in Ring 3 and it will be taken over by the #SS handler.
Repeat the above steps in qemu this exception will be taken over by #GP
Additional information:
|