From: Gleb Natapov <gleb@redhat.com>
To: Marcelo Tosatti <mtosatti@redhat.com>
Cc: Paolo Bonzini <pbonzini@redhat.com>,
kvm@vger.kernel.org, Nadav Amit <nadav.amit@gmail.com>
Subject: Re: [PATCH kvm-unit-tests] emulator: test 64-bit mov with immediate operand
Date: Thu, 13 Dec 2012 23:26:36 +0200 [thread overview]
Message-ID: <20121213212636.GL29003@redhat.com> (raw)
In-Reply-To: <20121213204526.GA1529@amt.cnet>
On Thu, Dec 13, 2012 at 06:45:26PM -0200, Marcelo Tosatti wrote:
> On Thu, Dec 13, 2012 at 02:24:18PM +0200, Gleb Natapov wrote:
> > On Thu, Dec 13, 2012 at 01:11:55PM +0100, Paolo Bonzini wrote:
> > > MOV immediate instruction (opcodes 0xB8-0xBF) may take 64-bit operand.
> > > Some hypervisor implementations assumed the operand is 32-bit. This
> > > should never happen because the instruction has no memory operand, but
> > > (like the existing test_mmx_movq_mf) the testcase tricks the emulator
> > > into executing one by mismatching the page tables and the corresponding
> > > TLB entry.
> > >
> > BTW how the bug was found? Why instruction was emulated at all? May be
> > there is bug somewhere that makes KVM emulate something it should not.
>
> During switch to protected mode. SS.DPL=3, SS.RPL=0.
Yes, looks like a bug. We set SS.DPL to 3 to enter vm86 and this leaks
to protected mode. There are a lot of those. I am trying to fix this
mess.
--
Gleb.
next prev parent reply other threads:[~2012-12-13 21:26 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2012-12-13 12:11 [PATCH kvm-unit-tests] emulator: test 64-bit mov with immediate operand Paolo Bonzini
2012-12-13 12:24 ` Gleb Natapov
2012-12-13 20:45 ` Marcelo Tosatti
2012-12-13 21:26 ` Gleb Natapov [this message]
2012-12-13 21:47 ` Marcelo Tosatti
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20121213212636.GL29003@redhat.com \
--to=gleb@redhat.com \
--cc=kvm@vger.kernel.org \
--cc=mtosatti@redhat.com \
--cc=nadav.amit@gmail.com \
--cc=pbonzini@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.