From mboxrd@z Thu Jan 1 00:00:00 1970 From: Chris Lalancette Subject: Re: [PATCH]: Fix memory corruption in-kernel IOAPIC emulation Date: Tue, 05 Feb 2008 10:58:05 -0500 Message-ID: <47A8878D.6020907@redhat.com> References: <479FB5C6.6060204@redhat.com> <47A0E613.7080408@redhat.com> <47A177BE.6020300@qumranet.com> Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="------------070700030009060401080208" Cc: kvm-devel-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org To: Avi Kivity Return-path: In-Reply-To: <47A177BE.6020300-atKUWr5tajBWk0Htik3J/w@public.gmane.org> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: kvm-devel-bounces-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org Errors-To: kvm-devel-bounces-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org List-Id: kvm.vger.kernel.org This is a multi-part message in MIME format. --------------070700030009060401080208 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Another version of the patch, taking into account more of Avi's comments. This one was tested the same way as the previous one, by doing all the combinations of new and old QEMU versions; the results were the same as last time: old -> old: Bug old -> new: Sane values, but not transferred over the wire new -> old: Graceful fail, version mismatch new -> new: Fixed values, taken from the wire Signed-off-by: Chris Lalancette --------------070700030009060401080208 Content-Type: text/x-patch; name="kvm-60-qemu-fix-ioapic-migration4.patch" Content-Transfer-Encoding: 7bit Content-Disposition: inline; filename="kvm-60-qemu-fix-ioapic-migration4.patch" diff --git a/qemu/hw/apic.c b/qemu/hw/apic.c index a47c366..21e5790 100644 --- a/qemu/hw/apic.c +++ b/qemu/hw/apic.c @@ -64,6 +64,7 @@ extern kvm_context_t kvm_context; /* FIXME: it's now hard coded to be equal with KVM_IOAPIC_NUM_PINS */ #define IOAPIC_NUM_PINS 0x18 +#define IOAPIC_DEFAULT_BASE_ADDRESS 0xfec00000 #define ESR_ILLEGAL_ADDRESS (1 << 7) @@ -98,6 +99,7 @@ typedef struct APICState { struct IOAPICState { uint8_t id; uint8_t ioregsel; + uint64_t base_address; uint32_t irr; uint64_t ioredtbl[IOAPIC_NUM_PINS]; @@ -1145,6 +1147,8 @@ static void kvm_kernel_ioapic_save_to_user(IOAPICState *s) s->id = kioapic->id; s->ioregsel = kioapic->ioregsel; + s->base_address = kioapic->base_address; + s->irr = kioapic->irr; for (i = 0; i < IOAPIC_NUM_PINS; i++) { s->ioredtbl[i] = kioapic->redirtbl[i].bits; } @@ -1163,6 +1167,8 @@ static void kvm_kernel_ioapic_load_from_user(IOAPICState *s) kioapic->id = s->id; kioapic->ioregsel = s->ioregsel; + kioapic->base_address = s->base_address; + kioapic->irr = s->irr; for (i = 0; i < IOAPIC_NUM_PINS; i++) { kioapic->redirtbl[i].bits = s->ioredtbl[i]; } @@ -1185,6 +1191,8 @@ static void ioapic_save(QEMUFile *f, void *opaque) qemu_put_8s(f, &s->id); qemu_put_8s(f, &s->ioregsel); + qemu_put_be64s(f, &s->base_address); + qemu_put_be32s(f, &s->irr); for (i = 0; i < IOAPIC_NUM_PINS; i++) { qemu_put_be64s(f, &s->ioredtbl[i]); } @@ -1195,11 +1203,21 @@ static int ioapic_load(QEMUFile *f, void *opaque, int version_id) IOAPICState *s = opaque; int i; - if (version_id != 1) + if (version_id < 1 || version_id > 2) return -EINVAL; qemu_get_8s(f, &s->id); qemu_get_8s(f, &s->ioregsel); + if (version_id == 2) { + /* for version 2, we get this data off of the wire */ + qemu_get_be64s(f, &s->base_address); + qemu_get_be32s(f, &s->irr); + } + else { + /* in case we are doing version 1, we just set these to sane values */ + s->base_address = IOAPIC_DEFAULT_BASE_ADDRESS; + s->irr = 0; + } for (i = 0; i < IOAPIC_NUM_PINS; i++) { qemu_get_be64s(f, &s->ioredtbl[i]); } @@ -1250,7 +1268,7 @@ IOAPICState *ioapic_init(void) ioapic_mem_write, s); cpu_register_physical_memory(0xfec00000, 0x1000, io_memory); - register_savevm("ioapic", 0, 1, ioapic_save, ioapic_load, s); + register_savevm("ioapic", 0, 2, ioapic_save, ioapic_load, s); qemu_register_reset(ioapic_reset, s); return s; --------------070700030009060401080208 Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline ------------------------------------------------------------------------- This SF.net email is sponsored by: Microsoft Defy all challenges. Microsoft(R) Visual Studio 2008. http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/ --------------070700030009060401080208 Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ kvm-devel mailing list kvm-devel-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org https://lists.sourceforge.net/lists/listinfo/kvm-devel --------------070700030009060401080208--