public inbox for kvm@vger.kernel.org
 help / color / mirror / Atom feed
* [GIT PULL] kvm oops fix
@ 2007-04-19 15:50 Avi Kivity
       [not found] ` <1176997839110-git-send-email-avi-atKUWr5tajBWk0Htik3J/w@public.gmane.org>
  0 siblings, 1 reply; 10+ messages in thread
From: Avi Kivity @ 2007-04-19 15:50 UTC (permalink / raw)
  To: Linus Torvalds
  Cc: kvm-devel-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f,
	linux-kernel-u79uwXL29TY76Z2rM5mHXA

Linus,

Please pull from the 'linus' branch of

  git://git.kernel.org/pub/scm/linux/kernel/git/avi/kvm.git

To get a one-liner fixing a host oops running  non-pae guests.

Avi Kivity (1):
      KVM: Fix off-by-one when writing to a nonpae guest pde

---

 drivers/kvm/mmu.c |    1 +
 1 files changed, 1 insertions(+), 0 deletions(-)
commit 6b8d0f9b180cb93513bb65f705b299370f0357a1
Author: Avi Kivity <avi-atKUWr5tajBWk0Htik3J/w@public.gmane.org>
Date:   Wed Apr 18 11:18:18 2007 +0300

    KVM: Fix off-by-one when writing to a nonpae guest pde
    
    Nonpae guest pdes are shadowed by two pae ptes, so we double the offset
    twice: once to account for the pte size difference, and once because we
    need to shadow pdes for a single guest pde.
    
    But when writing to the upper guest pde we also need to truncate the
    lower bits, otherwise the multiply shifts these bits into the pde index
    and causes an access to the wrong shadow pde.  If we're at the end of the
    page (accessing the very last guest pde) we can even overflow into the
    next host page and oops.
    
    Signed-off-by: Avi Kivity <avi-atKUWr5tajBWk0Htik3J/w@public.gmane.org>

diff --git a/drivers/kvm/mmu.c b/drivers/kvm/mmu.c
index e85b4c7..cab26f3 100644
--- a/drivers/kvm/mmu.c
+++ b/drivers/kvm/mmu.c
@@ -1171,6 +1171,7 @@ void kvm_mmu_pre_write(struct kvm_vcpu *vcpu, gpa_t gpa, int bytes)
 			 * and zap two pdes instead of one.
 			 */
 			if (level == PT32_ROOT_LEVEL) {
+				page_offset &= ~7; /* kill rounding error */
 				page_offset <<= 1;
 				npte = 2;
 			}

-------------------------------------------------------------------------
This SF.net email is sponsored by DB2 Express
Download DB2 Express C - the FREE version of DB2 express and take
control of your XML. No limits. Just data. Click to get it now.
http://sourceforge.net/powerbar/db2/

^ permalink raw reply related	[flat|nested] 10+ messages in thread

end of thread, other threads:[~2007-04-22  5:52 UTC | newest]

Thread overview: 10+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2007-04-19 15:50 [GIT PULL] kvm oops fix Avi Kivity
     [not found] ` <1176997839110-git-send-email-avi-atKUWr5tajBWk0Htik3J/w@public.gmane.org>
2007-04-19 16:53   ` Linus Torvalds
     [not found]     ` <alpine.LFD.0.98.0704190949580.9964-5CScLwifNT1QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org>
2007-04-19 19:09       ` Jeff Garzik
     [not found]         ` <4627BE6B.8030006-o2qLIJkoznsdnm+yROfE0A@public.gmane.org>
2007-04-19 19:24           ` David Brown
     [not found]             ` <9c21eeae0704191224g104f4an96b330c6b77c29a7-JsoAwUIsXosN+BqQ9rBEUg@public.gmane.org>
2007-04-19 19:34               ` Jeff Garzik
     [not found]                 ` <4627C429.2020500-o2qLIJkoznsdnm+yROfE0A@public.gmane.org>
2007-04-19 19:40                   ` J. Bruce Fields
2007-04-19 20:30           ` Linus Torvalds
     [not found]             ` <alpine.LFD.0.98.0704191325000.9964-5CScLwifNT1QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org>
2007-04-19 22:59               ` Linus Torvalds
2007-04-20  4:54   ` David Brown
     [not found]     ` <9c21eeae0704192154r5abec14ax242f9c40bab09728-JsoAwUIsXosN+BqQ9rBEUg@public.gmane.org>
2007-04-22  5:52       ` Avi Kivity

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox