Revision 8764ed55c9705e426d889ff16c26f398bba70b9b authored by Sean Christopherson on 29 April 2019, 14:04:15 UTC, committed by Paolo Bonzini on 30 April 2019, 19:03:42 UTC
KVM's recent bug fix to update %rip after emulating I/O broke userspace
that relied on the previous behavior of incrementing %rip prior to
exiting to userspace.  When running a Windows XP guest on AMD hardware,
Qemu may patch "OUT 0x7E" instructions in reaction to the OUT itself.
Because KVM's old behavior was to increment %rip before exiting to
userspace to handle the I/O, Qemu manually adjusted %rip to account for
the OUT instruction.

Arguably this is a userspace bug as KVM requires userspace to re-enter
the kernel to complete instruction emulation before taking any other
actions.  That being said, this is a bit of a grey area and breaking
userspace that has worked for many years is bad.

Pre-increment %rip on OUT to port 0x7e before exiting to userspace to
hack around the issue.

Fixes: 45def77ebf79e ("KVM: x86: update %rip after emulating IO")
Reported-by: Simon Becherer <simon@becherer.de>
Reported-and-tested-by: Iakov Karpov <srid@rkmail.ru>
Reported-by: Gabriele Balducci <balducci@units.it>
Reported-by: Antti Antinoja <reader@fennosys.fi>
Cc: stable@vger.kernel.org
Cc: Takashi Iwai <tiwai@suse.com>
Cc: Jiri Slaby <jslaby@suse.com>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sean Christopherson <sean.j.christopherson@intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
1 parent dbcdae1
History
File Mode Size
Makefile -rw-r--r-- 361 bytes
compat.c -rw-r--r-- 2.2 KB
ipc_sysctl.c -rw-r--r-- 5.9 KB
mq_sysctl.c -rw-r--r-- 2.9 KB
mqueue.c -rw-r--r-- 40.1 KB
msg.c -rw-r--r-- 30.5 KB
msgutil.c -rw-r--r-- 3.6 KB
namespace.c -rw-r--r-- 4.6 KB
sem.c -rw-r--r-- 62.1 KB
shm.c -rw-r--r-- 43.0 KB
syscall.c -rw-r--r-- 5.1 KB
util.c -rw-r--r-- 22.1 KB
util.h -rw-r--r-- 8.9 KB

back to top