Commit 8915aa27 authored by Marcelo Tosatti's avatar Marcelo Tosatti Committed by Gleb Natapov
Browse files

KVM: x86: handle idiv overflow at kvm_write_tsc 

Its possible that idivl overflows (due to large delta stored in usdiff,
valid scenario).

Create an exception handler to catch the overflow exception (division by zero
is protected by vcpu->arch.virtual_tsc_khz check), and interpret it accordingly
(delta is larger than USEC_PER_SEC).

Fixes https://bugzilla.redhat.com/show_bug.cgi?id=969644



Signed-off-by: default avatarMarcelo Tosatti <mtosatti@redhat.com>
Signed-off-by: default avatarGleb Natapov <gleb@redhat.com>
parent 05988d72

arch/x86/kvm/x86.c

+20 −3
Original line number Diff line number Diff line
@@ -1194,20 +1194,37 @@ void kvm_write_tsc(struct kvm_vcpu *vcpu, struct msr_data *msr) 
	elapsed = ns - kvm->arch.last_tsc_nsec;



	if (vcpu->arch.virtual_tsc_khz) {

		int faulted = 0;



		/* n.b - signed multiplication and division required */

		usdiff = data - kvm->arch.last_tsc_write;

#ifdef CONFIG_X86_64

		usdiff = (usdiff * 1000) / vcpu->arch.virtual_tsc_khz;

#else

		/* do_div() only does unsigned */

		asm("idivl %2; xor %%edx, %%edx"

		: "=A"(usdiff)

		: "A"(usdiff * 1000), "rm"(vcpu->arch.virtual_tsc_khz));

		asm("1: idivl %[divisor]\n"

		    "2: xor %%edx, %%edx\n"

		    "   movl $0, %[faulted]\n"

		    "3:\n"

		    ".section .fixup,\"ax\"\n"

		    "4: movl $1, %[faulted]\n"

		    "   jmp  3b\n"

		    ".previous\n"



		_ASM_EXTABLE(1b, 4b)



		: "=A"(usdiff), [faulted] "=r" (faulted)

		: "A"(usdiff * 1000), [divisor] "rm"(vcpu->arch.virtual_tsc_khz));



#endif

		do_div(elapsed, 1000);

		usdiff -= elapsed;

		if (usdiff < 0)

			usdiff = -usdiff;



		/* idivl overflow => difference is larger than USEC_PER_SEC */

		if (faulted)

			usdiff = USEC_PER_SEC;

	} else

		usdiff = USEC_PER_SEC; /* disable TSC match window below */

CRA Git | Maintained and supported by SUSTech CRA and CCSE