Throws a #GP when it should throw a #SS
Host environment
- Operating system: Ubuntu 20.04.3 LTS
- OS/kernel version: Linux vvgcfd 5.4.0-94-generic Ubuntu SMP
- Architecture: x86
- QEMU flavor: qemu-system-x86_64
- QEMU version: QEMU emulator version 6.2.0
- QEMU command line:
./qemu-system-x86_64 -M q35 -m 4G -cpu Nehalem-v2 -smp 1 -accel tcg disk.img
Emulated/Virtualized environment
- Operating system: Custom
- OS/kernel version: Custom
- Architecture: x86
Description of problem
When stacks are switched as part of a 64-bit mode privilege-level change (resulting from an interrupt), IA-32e mode loads only an inner-level RSP from the TSS. If the value of rsp from tss is a non-canonical form. It will trigger #SS. But when I test it in qemu it throws #GP instead of #SS
Steps to reproduce
In order to confirm that it is the #SS triggered by the non-canonical address, We can verify on a real machine.
- Set the value of the current core's
TSS.IST7
to the the non-canonical address. - Set the
ist
field of the interrupt 4 (Overflow Exception) descriptor to 7. - Execute the
INT 4
instruction in Ring 3 and it will be taken over by the #SS handler.
Repeat the above steps in qemu this exception will be taken over by #GP