From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mailman by lists.gnu.org with tmda-scanned (Exim 4.43) id 1KeDsJ-0002zf-6U for qemu-devel@nongnu.org; Fri, 12 Sep 2008 15:00:11 -0400 Received: from exim by lists.gnu.org with spam-scanned (Exim 4.43) id 1KeDsI-0002zN-25 for qemu-devel@nongnu.org; Fri, 12 Sep 2008 15:00:10 -0400 Received: from [199.232.76.173] (port=55031 helo=monty-python.gnu.org) by lists.gnu.org with esmtp (Exim 4.43) id 1KeDsH-0002zI-WC for qemu-devel@nongnu.org; Fri, 12 Sep 2008 15:00:10 -0400 Received: from mx2.redhat.com ([66.187.237.31]:59829) by monty-python.gnu.org with esmtp (Exim 4.60) (envelope-from ) id 1KeDsI-0002Hi-8l for qemu-devel@nongnu.org; Fri, 12 Sep 2008 15:00:10 -0400 Date: Fri, 12 Sep 2008 15:58:56 -0300 From: Eduardo Habkost Message-ID: <20080912185856.GM3982@blackpad> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: quoted-printable Subject: [Qemu-devel] [PATCH] Make page_find() return 0 for too-large addresses Reply-To: qemu-devel@nongnu.org List-Id: qemu-devel.nongnu.org List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: kvm@vger.kernel.org, gcosta@redhat.com On some cases, such as under KVM, tb_invalidate_phys_page_range() may be called for large addresses, when qemu is configured to more than 4GB of RAM. On these cases, qemu was crashing because it was using an index too large for l1_map[], that supports only 32-bit addresses when compiling without CONFIG_USER_ONLY. Below is a sample backtrace of this happening, under KVM. 'start' on tb_invalidate_phys_page_range() is 0x132b1c812, beyond 2^32, making page_find() return a bogus pointer. #0 tb_invalidate_phys_page_range (start=3D5145479186, end=3D5145479246,= is_cpu_write_access=3D0) at /usr/src/debug/kvm-74/qemu/exec.c:877 #1 0x000000000049cd28 in cpu_physical_memory_rw (addr=3D5682350098, buf= =3D0x7389dd10 "RT", len=3D60, is_write=3D1) at /usr/src/debug/kvm-74/qemu= /exec.c:2818 #2 0x0000000000428f54 in rtl8139_do_receive (opaque=3D0x1f472240, buf=3D= , size=3D60, do_interrupt=3D1) at ../cpu-all.h:929 #3 0x000000000040717b in qemu_send_packet (vc1=3D0x1e54f480, buf=3D0x73= 89ddc0 "RT", size=3D42) at /usr/src/debug/kvm-74/qemu/vl.c:4146 #4 0x0000000000480990 in slirp_input (pkt=3D0x1f4a9010 "=EF=BF=BD=EF=BF= =BD=EF=BF=BD=EF=BF=BD=EF=BF=BD=EF=BF=BDRT", pkt_len=3D42) at slirp/slirp.= c:597 #5 0x000000000040717b in qemu_send_packet (vc1=3D0x1f475d70, buf=3D0x1f= 4a9010 "=EF=BF=BD=EF=BF=BD=EF=BF=BD=EF=BF=BD=EF=BF=BD=EF=BF=BDRT", size=3D= 42) at /usr/src/debug/kvm-74/qemu/vl.c:4146 #6 0x00000000004295bd in rtl8139_io_writeb (opaque=3D0x1f472240, addr=3D= , val=3D) at /usr/src/debug/kvm= -74/qemu/hw/rtl8139.c:2299 #7 0x000000000049cb62 in cpu_physical_memory_rw (addr=3D4060090585, buf= =3D0x2aaadcf11028
, len=3D1, is_wri= te=3D1) at /usr/src/debug/kvm-74/qemu/exec.c:2807 #8 0x00000000004eebf8 in kvm_mmio_write (opaque=3D= , addr=3D5145479186, data=3D0x132b1c84e
, len=3D707232) at /usr/src/debug/kvm-74/qemu/qemu-kvm.c:689 #9 0x0000000000515646 in handle_mmio (kvm=3D0x1e54e040, kvm_run=3D0x2aa= adcf11000) at libkvm.c:849 #10 0x0000000000515b57 in kvm_run (kvm=3D0x1e54e040, vcpu=3D0) at libkvm= .c:975 The following patch makes page_find() safe for >32-bit addresses, by just returning 0 if the address is too large. The translation block handling code on exec.c still doesn't support addresses >32-bit if CONFIG_USER_ONLY is not defined (KVM qemu currently crashes immediately when using -no-kvm with more than 4 GB of memory), but this is another issue. Signed-off-by: Eduardo Habkost --- diff -purN qemu.orig/exec.c qemu/exec.c --- qemu.orig/exec.c 2008-09-12 15:40:37.000000000 -0300 +++ qemu/exec.c 2008-09-12 15:40:37.000000000 -0300 @@ -317,8 +317,11 @@ static inline PageDesc *page_find_alloc( static inline PageDesc *page_find(target_ulong index) { PageDesc *p; + target_ulong l1_index =3D (index >> L2_BITS); + if (l1_index > L1_SIZE) + return 0; =20 - p =3D l1_map[index >> L2_BITS]; + p =3D l1_map[l1_index]; if (!p) return 0; return p + (index & (L2_SIZE - 1)); --=20 Eduardo