Commit:     6b8d0f9b180cb93513bb65f705b299370f0357a1
Parent:     80d74d5123bf3aecd32302809c4e61bb8a16786b
Author:     Avi Kivity <[EMAIL PROTECTED]>
AuthorDate: Wed Apr 18 11:18:18 2007 +0300
Committer:  Avi Kivity <[EMAIL PROTECTED]>
CommitDate: Thu Apr 19 18:39:26 2007 +0300

    KVM: Fix off-by-one when writing to a nonpae guest pde
    Nonpae guest pdes are shadowed by two pae ptes, so we double the offset
    twice: once to account for the pte size difference, and once because we
    need to shadow pdes for a single guest pde.
    But when writing to the upper guest pde we also need to truncate the
    lower bits, otherwise the multiply shifts these bits into the pde index
    and causes an access to the wrong shadow pde.  If we're at the end of the
    page (accessing the very last guest pde) we can even overflow into the
    next host page and oops.
    Signed-off-by: Avi Kivity <[EMAIL PROTECTED]>
 drivers/kvm/mmu.c |    1 +
 1 files changed, 1 insertions(+), 0 deletions(-)

diff --git a/drivers/kvm/mmu.c b/drivers/kvm/mmu.c
index e85b4c7..cab26f3 100644
--- a/drivers/kvm/mmu.c
+++ b/drivers/kvm/mmu.c
@@ -1171,6 +1171,7 @@ void kvm_mmu_pre_write(struct kvm_vcpu *vcpu, gpa_t gpa, 
int bytes)
                         * and zap two pdes instead of one.
                        if (level == PT32_ROOT_LEVEL) {
+                               page_offset &= ~7; /* kill rounding error */
                                page_offset <<= 1;
                                npte = 2;
To unsubscribe from this list: send the line "unsubscribe git-commits-head" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at

Reply via email to