Re: [PATCH kvm-unit-tests] emulator: test 64-bit mov with immediate operand

Gleb Natapov
2012-12-13T21:26:38Z

On Thu, Dec 13, 2012 at 06:45:26PM -0200, Marcelo Tosatti wrote:
> On Thu, Dec 13, 2012 at 02:24:18PM +0200, Gleb Natapov wrote:
> > On Thu, Dec 13, 2012 at 01:11:55PM +0100, Paolo Bonzini wrote:
> > > MOV immediate instruction (opcodes 0xB8-0xBF) may take 64-bit operand.
> > > Some hypervisor implementations assumed the operand is 32-bit. This
> > > should never happen because the instruction has no memory operand, but
> > > (like the existing test_mmx_movq_mf) the testcase tricks the emulator
> > > into executing one by mismatching the page tables and the corresponding
> > > TLB entry.
> > >
> > BTW how the bug was found? Why instruction was emulated at all? May be
> > there is bug somewhere that makes KVM emulate something it should not.
>
> During switch to protected mode. SS.DPL=3, SS.RPL=0.
Yes, looks like a bug. We set SS.DPL to 3 to enter vm86 and this leaks
to protected mode. There are a lot of those. I am trying to fix this
mess.

--
Gleb.