lkml.org 
[lkml]   [2015]   [Mar]   [17]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 3.12 109/175] KVM: emulate: fix CMPXCHG8B on 32-bit hosts
    Date
    From: Paolo Bonzini <pbonzini@redhat.com>

    3.12-stable review patch. If anyone has any objections, please let me know.

    ===============

    commit 4ff6f8e61eb7f96d3ca535c6d240f863ccd6fb7d upstream.

    This has been broken for a long time: it broke first in 2.6.35, then was
    almost fixed in 2.6.36 but this one-liner slipped through the cracks.
    The bug shows up as an infinite loop in Windows 7 (and newer) boot on
    32-bit hosts without EPT.

    Windows uses CMPXCHG8B to write to page tables, which causes a
    page fault if running without EPT; the emulator is then called from
    kvm_mmu_page_fault. The loop then happens if the higher 4 bytes are
    not 0; the common case for this is that the NX bit (bit 63) is 1.

    Fixes: 6550e1f165f384f3a46b60a1be9aba4bc3c2adad
    Fixes: 16518d5ada690643453eb0aef3cc7841d3623c2d
    Reported-by: Erik Rull <erik.rull@rdsoftware.de>
    Tested-by: Erik Rull <erik.rull@rdsoftware.de>
    Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
    Signed-off-by: Jiri Slaby <jslaby@suse.cz>
    ---
    arch/x86/kvm/emulate.c | 3 ++-
    1 file changed, 2 insertions(+), 1 deletion(-)

    diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
    index 8ab43ac68f06..c412bab82d1f 100644
    --- a/arch/x86/kvm/emulate.c
    +++ b/arch/x86/kvm/emulate.c
    @@ -4617,7 +4617,8 @@ int x86_emulate_insn(struct x86_emulate_ctxt *ctxt)
    if (rc != X86EMUL_CONTINUE)
    goto done;
    }
    - ctxt->dst.orig_val = ctxt->dst.val;
    + /* Copy full 64-bit value for CMPXCHG8B. */
    + ctxt->dst.orig_val64 = ctxt->dst.val64;

    special_insn:

    --
    2.3.0


    \
     
     \ /
      Last update: 2015-03-17 10:21    [W:4.084 / U:0.068 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site