From mboxrd@z Thu Jan 1 00:00:00 1970 From: Eduardo Habkost Subject: [PATCH] Make page_find() return 0 for too-large addresses Date: Fri, 12 Sep 2008 15:58:56 -0300 Message-ID: <20080912185856.GM3982@blackpad> Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: QUOTED-PRINTABLE Cc: kvm@vger.kernel.org, gcosta@redhat.com To: qemu-devel@nongnu.org Return-path: Received: from mx2.redhat.com ([66.187.237.31]:53936 "EHLO mx2.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754797AbYILTAU (ORCPT ); Fri, 12 Sep 2008 15:00:20 -0400 Content-Disposition: inline Sender: kvm-owner@vger.kernel.org List-ID: On some cases, such as under KVM, tb_invalidate_phys_page_range() may be called for large addresses, when qemu is configured to more than 4GB of RAM. On these cases, qemu was crashing because it was using an index too large for l1_map[], that supports only 32-bit addresses when compiling without CONFIG_USER_ONLY. Below is a sample backtrace of this happening, under KVM. 'start' on tb_invalidate_phys_page_range() is 0x132b1c812, beyond 2^32, making page_find() return a bogus pointer. #0 tb_invalidate_phys_page_range (start=3D5145479186, end=3D514547924= 6, is_cpu_write_access=3D0) at /usr/src/debug/kvm-74/qemu/exec.c:877 #1 0x000000000049cd28 in cpu_physical_memory_rw (addr=3D5682350098, b= uf=3D0x7389dd10 "RT", len=3D60, is_write=3D1) at /usr/src/debug/kvm-74/= qemu/exec.c:2818 #2 0x0000000000428f54 in rtl8139_do_receive (opaque=3D0x1f472240, buf= =3D, size=3D60, do_interrupt=3D1) at ../cpu-all.h:= 929 #3 0x000000000040717b in qemu_send_packet (vc1=3D0x1e54f480, buf=3D0x= 7389ddc0 "RT", size=3D42) at /usr/src/debug/kvm-74/qemu/vl.c:4146 #4 0x0000000000480990 in slirp_input (pkt=3D0x1f4a9010 "=EF=BF=BD=EF=BF= =BD=EF=BF=BD=EF=BF=BD=EF=BF=BD=EF=BF=BDRT", pkt_len=3D42) at slirp/slir= p.c:597 #5 0x000000000040717b in qemu_send_packet (vc1=3D0x1f475d70, buf=3D0x= 1f4a9010 "=EF=BF=BD=EF=BF=BD=EF=BF=BD=EF=BF=BD=EF=BF=BD=EF=BF=BDRT", si= ze=3D42) at /usr/src/debug/kvm-74/qemu/vl.c:4146 #6 0x00000000004295bd in rtl8139_io_writeb (opaque=3D0x1f472240, addr= =3D, val=3D) at /usr/src/debu= g/kvm-74/qemu/hw/rtl8139.c:2299 #7 0x000000000049cb62 in cpu_physical_memory_rw (addr=3D4060090585, b= uf=3D0x2aaadcf11028
, len=3D1, is= _write=3D1) at /usr/src/debug/kvm-74/qemu/exec.c:2807 #8 0x00000000004eebf8 in kvm_mmio_write (opaque=3D, addr=3D5145479186, data=3D0x132b1c84e
, len=3D707232) at /usr/src/debug/kvm-74/qemu/qemu-kvm.c:689 #9 0x0000000000515646 in handle_mmio (kvm=3D0x1e54e040, kvm_run=3D0x2= aaadcf11000) at libkvm.c:849 #10 0x0000000000515b57 in kvm_run (kvm=3D0x1e54e040, vcpu=3D0) at libk= vm.c:975 The following patch makes page_find() safe for >32-bit addresses, by just returning 0 if the address is too large. The translation block handling code on exec.c still doesn't support addresses >32-bit if CONFIG_USER_ONLY is not defined (KVM qemu currentl= y crashes immediately when using -no-kvm with more than 4 GB of memory), but this is another issue. Signed-off-by: Eduardo Habkost --- diff -purN qemu.orig/exec.c qemu/exec.c --- qemu.orig/exec.c 2008-09-12 15:40:37.000000000 -0300 +++ qemu/exec.c 2008-09-12 15:40:37.000000000 -0300 @@ -317,8 +317,11 @@ static inline PageDesc *page_find_alloc( static inline PageDesc *page_find(target_ulong index) { PageDesc *p; + target_ulong l1_index =3D (index >> L2_BITS); + if (l1_index > L1_SIZE) + return 0; =20 - p =3D l1_map[index >> L2_BITS]; + p =3D l1_map[l1_index]; if (!p) return 0; return p + (index & (L2_SIZE - 1)); --=20 Eduardo