From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from mailman by lists.gnu.org with tmda-scanned (Exim 4.43)
	id 1KeFWf-0006Hm-0P
	for qemu-devel@nongnu.org; Fri, 12 Sep 2008 16:45:57 -0400
Received: from exim by lists.gnu.org with spam-scanned (Exim 4.43)
	id 1KeFWd-0006GD-Bn
	for qemu-devel@nongnu.org; Fri, 12 Sep 2008 16:45:56 -0400
Received: from [199.232.76.173] (port=44305 helo=monty-python.gnu.org)
	by lists.gnu.org with esmtp (Exim 4.43) id 1KeFWd-0006GA-4y
	for qemu-devel@nongnu.org; Fri, 12 Sep 2008 16:45:55 -0400
Received: from mx2.redhat.com ([66.187.237.31]:44192)
	by monty-python.gnu.org with esmtp (Exim 4.60)
	(envelope-from <ehabkost@redhat.com>) id 1KeFWc-0008GY-LH
	for qemu-devel@nongnu.org; Fri, 12 Sep 2008 16:45:54 -0400
Date: Fri, 12 Sep 2008 17:44:05 -0300
From: Eduardo Habkost <ehabkost@redhat.com>
Subject: Re: [Qemu-devel] Re: [PATCH] Make page_find() return 0 for
	too-large addresses
Message-ID: <20080912204404.GB10147@blackpad>
References: <20080912185856.GM3982@blackpad> <48CAC809.5000901@codemonkey.ws>
	<20080912201406.GA10147@blackpad>
MIME-Version: 1.0
Content-Type: text/plain; charset=iso-8859-1
Content-Disposition: inline
In-Reply-To: <20080912201406.GA10147@blackpad>
Content-Transfer-Encoding: quoted-printable
Reply-To: qemu-devel@nongnu.org
List-Id: qemu-devel.nongnu.org
List-Unsubscribe: <http://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=unsubscribe>
List-Archive: <http://lists.gnu.org/pipermail/qemu-devel>
List-Post: <mailto:qemu-devel@nongnu.org>
List-Help: <mailto:qemu-devel-request@nongnu.org?subject=help>
List-Subscribe: <http://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=subscribe>
To: Anthony Liguori <anthony@codemonkey.ws>
Cc: qemu-devel@nongnu.org, kvm@vger.kernel.org, gcosta@redhat.com

On Fri, Sep 12, 2008 at 05:14:06PM -0300, Eduardo Habkost wrote:
> On Fri, Sep 12, 2008 at 02:50:33PM -0500, Anthony Liguori wrote:
> > Eduardo Habkost wrote:
> >> On some cases, such as under KVM, tb_invalidate_phys_page_range()
> >> may be called for large addresses, when qemu is configured to more t=
han
> >> 4GB of RAM.
> >>
> >> On these cases, qemu was crashing because it was using an index too
> >> large for l1_map[], that supports only 32-bit addresses when compili=
ng
> >> without CONFIG_USER_ONLY.
> >>  =20
<snip>
>=20
> BTW, I've just noticed page_find_alloc() has this:
>=20
> #if TARGET_LONG_BITS > 32
>     /* Host memory outside guest VM.  For 32-bit targets we have alread=
y
>        excluded high addresses.  */
>     if (index > ((target_ulong)L2_SIZE * L1_SIZE))
>         return NULL;
> #endif
>=20
> So, we can just use a similar check on page_find().

New patch, reusing the range check from page_find_alloc() on
page_find(). Untested.


Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
---
Index: qemu/exec.c
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
--- qemu/exec.c	(revis=E3o 5200)
+++ qemu/exec.c	(c=F3pia de trabalho)
@@ -279,17 +279,24 @@ static void page_init(void)
 #endif
 }
=20
-static inline PageDesc *page_find_alloc(target_ulong index)
+static inline PageDesc **page_l1_map(target_ulong index)
 {
-    PageDesc **lp, *p;
-
 #if TARGET_LONG_BITS > 32
     /* Host memory outside guest VM.  For 32-bit targets we have already
        excluded high addresses.  */
     if (index > ((target_ulong)L2_SIZE * L1_SIZE))
         return NULL;
 #endif
-    lp =3D &l1_map[index >> L2_BITS];
+    return &l1_map[index >> L2_BITS];
+}
+
+static inline PageDesc *page_find_alloc(target_ulong index)
+{
+    PageDesc **lp, *p;
+    lp =3D page_l1_map(index);
+    if (!lp)
+        return NULL;
+
     p =3D *lp;
     if (!p) {
         /* allocate if not found */
@@ -316,9 +323,12 @@ static inline PageDesc *page_find_alloc(
=20
 static inline PageDesc *page_find(target_ulong index)
 {
-    PageDesc *p;
+    PageDesc **lp, *p;
+    lp =3D page_l1_map(index);
+    if (!lp)
+        return NULL;
=20
-    p =3D l1_map[index >> L2_BITS];
+    p =3D *lp;
     if (!p)
         return 0;
     return p + (index & (L2_SIZE - 1));


--=20
Eduardo