linux-kernel - Re: Bug in HPET RTC emulation.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <1266880258.1147.7.camel@promb-2n-dhcp251.eng.vmware.com>
Date:	Mon, 22 Feb 2010 15:10:58 -0800
From:	Alok Kataria <akataria@...are.com>
To:	Andrew Morton <akpm@...ux-foundation.org>
Cc:	"venkatesh.pallipadi@...el.com" <venkatesh.pallipadi@...el.com>,
	"vojtech@...e.cz" <vojtech@...e.cz>,
	Daniel Hecht <dhecht@...are.com>,
	LKML <linux-kernel@...r.kernel.org>
Subject: Re: Bug in HPET RTC emulation.


On Mon, 2010-02-22 at 14:24 -0800, Andrew Morton wrote:
> On Thu, 18 Feb 2010 14:30:08 -0800 Alok Kataria <akataria@...are.com> wrote:
> 
> > [Copying LKML]
> 
> Please do that all the time!
> 
> > <ping>
> > 
> > Not sure if you guys got a chance to look at this patch, the fix is
> > pretty trivial too.
> > 
> 
> Please resend everything, including a Signed-off-by: as per
> Documentation/SubmittingPatches.

Hi Andrew,

Here it is.

--

We think there exists a bug in the HPET code that emulates the RTC. 

In the normal case, when the RTC frequency is set, the rtc driver tells
the hpet code about it here:

int hpet_set_periodic_freq(unsigned long freq)
{
        uint64_t clc;

        if (!is_hpet_enabled())
                return 0;

        if (freq <= DEFAULT_RTC_INT_FREQ)
                hpet_pie_limit = DEFAULT_RTC_INT_FREQ / freq;
        else {
                clc = (uint64_t) hpet_clockevent.mult * NSEC_PER_SEC;
                do_div(clc, freq);
                clc >>= hpet_clockevent.shift;
                hpet_pie_delta = (unsigned long) clc;
        }
        return 1;
}

If freq is set to 64Hz (DEFAULT_RTC_INT_FREQ) or lower, then
hpet_pie_limit (a static) is set to non-zero.
Then, on every one-shot HPET interrupt, hpet_rtc_timer_reinit is called
to compute the next timeout. Well, that function has this logic:

        if (!(hpet_rtc_flags & RTC_PIE) || hpet_pie_limit)
                delta = hpet_default_delta;
        else
                delta = hpet_pie_delta;

Since hpet_pie_limit is not 0, hpet_default_delta is used. That
corresponds to 64Hz.

Now, if you set a different rtc frequency, you'll take the else path
through hpet_set_periodic_freq, but unfortunately no one resets
hpet_pie_limit back to 0.

Boom....now you are stuck with 64Hz RTC interrupts forever. 

The patch below just resets the hpet_pie_limit value when requested freq
is greater than DEFAULT_RTC_INT_FREQ, which we think fixes this problem.

Signed-off-by: Alok N Kataria <akataria@...are.com>
Signed-off-by: Daniel Hecht <dhecht@...are.com>

---

 arch/x86/kernel/hpet.c |    1 +
 1 files changed, 1 insertions(+), 0 deletions(-)


diff --git a/arch/x86/kernel/hpet.c b/arch/x86/kernel/hpet.c
index ad80a1c..a79a358 100644
--- a/arch/x86/kernel/hpet.c
+++ b/arch/x86/kernel/hpet.c
@@ -1143,6 +1143,7 @@ int hpet_set_periodic_freq(unsigned long freq)
 		do_div(clc, freq);
 		clc >>= hpet_clockevent.shift;
 		hpet_pie_delta = clc;
+		hpet_pie_limit = 0;
 	}
 	return 1;
 }


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/