Bug 848325 - kvm emulates instructions with rip-relative addressing incorrectly
kvm emulates instructions with rip-relative addressing incorrectly
Status: CLOSED NOTABUG
Product: Red Hat Enterprise Linux 5
Classification: Red Hat
Component: kvm (Show other bugs)
5.9
x86_64 Linux
unspecified Severity low
: rc
: ---
Assigned To: Andrew Jones
Virtualization Bugs
:
Depends On:
Blocks: 848328
  Show dependency treegraph
 
Reported: 2012-08-15 05:30 EDT by Avi Kivity
Modified: 2013-04-18 03:16 EDT (History)
6 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
: 848328 (view as bug list)
Environment:
Last Closed: 2013-04-18 03:16:26 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Avi Kivity 2012-08-15 05:30:42 EDT
Description of problem:

The KVM x86 emulator does calculates rip-relative addresses incorrectly: if they contain an immediate operand, then the memory operand's address will be off by the size of the immediate operand.

Example:

  movl $0, somewhere(%rip)

Version-Release number of selected component (if applicable):
kvm-83-259.el5

How reproducible:
Never

Steps to Reproduce:
1. Find a guest which accesses mmio using an rip-relative instruction with an immediate
2. Run guest
3. Watch guest malfunction
  
Actual results:

Guest malfunctions

Expected results:

Guest works correctly

Additional info:
Comment 1 Avi Kivity 2012-08-15 05:33:58 EDT
Upstream fix:

commit cb16c348760ad2bc79b67b20aefac05529569ed7
Author: Avi Kivity <avi@redhat.com>
Date:   Sun Jun 19 19:21:11 2011 +0300

    KVM: x86 emulator: fix %rip-relative addressing with immediate source operand
    
    %rip-relative addressing is relative to the first byte of the next instruction,
    so we need to add %rip only after we've fetched any immediate bytes.
    
    Based on original patch by Li Xin <xin.li@intel.com>.
    
    Signed-off-by: Avi Kivity <avi@redhat.com>
    Acked-by: Li Xin <xin.li@intel.com>
    Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
Comment 2 Ronen Hod 2012-08-16 07:09:30 EDT
Postponed to RHEL5.10, and then maybe to 5.11.
This bug fix is not trivial, and since we never encountered it in the field let's keep it in the pipeline.
Comment 4 Andrew Jones 2013-04-02 10:02:17 EDT
Same analysis as bug 848328. afaict, we don't need this. Gleb, please confirm.

Note You need to log in before you can comment on or make changes to this bug.