linux-kernel - Re: [PATCH] kvm: fix i8254 counter 0 wraparound

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20121217194104.GA24959@amt.cnet>
Date:	Mon, 17 Dec 2012 17:41:05 -0200
From:	Marcelo Tosatti <mtosatti@...hat.com>
To:	Nickolai Zeldovich <nickolai@...il.mit.edu>
Cc:	Gleb Natapov <gleb@...hat.com>,
	Thomas Gleixner <tglx@...utronix.de>,
	Ingo Molnar <mingo@...hat.com>,
	"H. Peter Anvin" <hpa@...or.com>, x86@...nel.org,
	kvm@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] kvm: fix i8254 counter 0 wraparound

On Sat, Dec 15, 2012 at 06:34:37AM -0500, Nickolai Zeldovich wrote:
> The kvm i8254 emulation for counter 0 (but not for counters 1 and 2)
> has at least two bugs in mode 0:
> 
> 1. The OUT bit, computed by pit_get_out(), is never set high.
> 
> 2. The counter value, computed by pit_get_count(), wraps back around to
>    the initial counter value, rather than wrapping back to 0xFFFF
>    (which is the behavior described in the comment in __kpit_elapsed,
>    the behavior implemented by qemu, and the behavior observed on AMD
>    hardware).
> 
> The bug stems from __kpit_elapsed computing the elapsed time mod the
> initial counter value (stored as nanoseconds in ps->period).  This is both
> unnecessary (none of the callers of kpit_elapsed expect the value to be
> at most the initial counter value) and incorrect (it causes pit_get_count
> to appear to wrap around to the initial counter value rather than 0xFFFF).
> Removing this mod from __kpit_elapsed fixes both of the above bugs.
> 
> Signed-off-by: Nickolai Zeldovich <nickolai@...il.mit.edu>
> ---
>  arch/x86/kvm/i8254.c |    1 -
>  1 file changed, 1 deletion(-)
> 
> diff --git a/arch/x86/kvm/i8254.c b/arch/x86/kvm/i8254.c
> index 11300d2..c1d30b2 100644
> --- a/arch/x86/kvm/i8254.c
> +++ b/arch/x86/kvm/i8254.c
> @@ -122,7 +122,6 @@ static s64 __kpit_elapsed(struct kvm *kvm)
>  	 */
>  	remaining = hrtimer_get_remaining(&ps->timer);
>  	elapsed = ps->period - ktime_to_ns(remaining);
> -	elapsed = mod_64(elapsed, ps->period);
>  
>  	return elapsed;
>  }

Reviewed-by: Marcelo Tosatti <mtosatti@...hat.com>
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/