From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753236AbXJULLN (ORCPT ); Sun, 21 Oct 2007 07:11:13 -0400 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S1751870AbXJULIA (ORCPT ); Sun, 21 Oct 2007 07:08:00 -0400 Received: from il.qumranet.com ([82.166.9.18]:58448 "EHLO il.qumranet.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751507AbXJULHz (ORCPT ); Sun, 21 Oct 2007 07:07:55 -0400 From: Avi Kivity To: kvm-devel@lists.sourceforge.net Cc: linux-kernel@vger.kernel.org, Kevin Pedretti , Avi Kivity Subject: [PATCH 10/11] KVM: Fix local apic timer divide by zero Date: Sun, 21 Oct 2007 13:08:11 +0200 Message-Id: <11929648921713-git-send-email-avi@qumranet.com> X-Mailer: git-send-email 1.5.3 In-Reply-To: <1192964892617-git-send-email-avi@qumranet.com> References: <1192964892617-git-send-email-avi@qumranet.com> Sender: linux-kernel-owner@vger.kernel.org X-Mailing-List: linux-kernel@vger.kernel.org From: Kevin Pedretti kvm_lapic_reset() was initializing apic->timer.divide_count to 0, which could potentially lead to a divide by zero error in apic_get_tmcct(). Any guest that reads the APIC's CCR (current count) register before setting DCR (divide configuration) would trigger a divide by zero exception in the host kernel, leading to a host-OS crash. This patch results in apic->timer.divide_count being initialized to 2 at reset, eliminating the bug (DCR=0 at reset, meaning divide by 2). Signed-off-by: Kevin Pedretti Signed-off-by: Avi Kivity --- drivers/kvm/lapic.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/drivers/kvm/lapic.c b/drivers/kvm/lapic.c index a190587..443730e 100644 --- a/drivers/kvm/lapic.c +++ b/drivers/kvm/lapic.c @@ -853,7 +853,7 @@ void kvm_lapic_reset(struct kvm_vcpu *vcpu) apic_set_reg(apic, APIC_ISR + 0x10 * i, 0); apic_set_reg(apic, APIC_TMR + 0x10 * i, 0); } - apic->timer.divide_count = 0; + update_divide_count(apic); atomic_set(&apic->timer.pending, 0); if (vcpu->vcpu_id == 0) vcpu->apic_base |= MSR_IA32_APICBASE_BSP; -- 1.5.3 From mboxrd@z Thu Jan 1 00:00:00 1970 From: Avi Kivity Subject: [PATCH 10/11] KVM: Fix local apic timer divide by zero Date: Sun, 21 Oct 2007 13:08:11 +0200 Message-ID: <11929648921713-git-send-email-avi@qumranet.com> References: <1192964892617-git-send-email-avi@qumranet.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Cc: Kevin Pedretti , linux-kernel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org, Avi Kivity To: kvm-devel-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org Return-path: In-Reply-To: <1192964892617-git-send-email-avi-atKUWr5tajBWk0Htik3J/w@public.gmane.org> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: kvm-devel-bounces-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org Errors-To: kvm-devel-bounces-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org List-Id: kvm.vger.kernel.org From: Kevin Pedretti kvm_lapic_reset() was initializing apic->timer.divide_count to 0, which could potentially lead to a divide by zero error in apic_get_tmcct(). Any guest that reads the APIC's CCR (current count) register before setting DCR (divide configuration) would trigger a divide by zero exception in the host kernel, leading to a host-OS crash. This patch results in apic->timer.divide_count being initialized to 2 at reset, eliminating the bug (DCR=0 at reset, meaning divide by 2). Signed-off-by: Kevin Pedretti Signed-off-by: Avi Kivity --- drivers/kvm/lapic.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/drivers/kvm/lapic.c b/drivers/kvm/lapic.c index a190587..443730e 100644 --- a/drivers/kvm/lapic.c +++ b/drivers/kvm/lapic.c @@ -853,7 +853,7 @@ void kvm_lapic_reset(struct kvm_vcpu *vcpu) apic_set_reg(apic, APIC_ISR + 0x10 * i, 0); apic_set_reg(apic, APIC_TMR + 0x10 * i, 0); } - apic->timer.divide_count = 0; + update_divide_count(apic); atomic_set(&apic->timer.pending, 0); if (vcpu->vcpu_id == 0) vcpu->apic_base |= MSR_IA32_APICBASE_BSP; -- 1.5.3 ------------------------------------------------------------------------- This SF.net email is sponsored by: Splunk Inc. Still grepping through log files to find problems? Stop. Now Search log events and configuration files using AJAX and a browser. Download your FREE copy of Splunk now >> http://get.splunk.com/