[Qemu-devel] [patch] fix mmap 0.9.1 mmap regression in linux-user

[Qemu-devel] [patch] fix mmap 0.9.1 mmap regression in linux-user

[Vince Weaver]

Hello

The 0.9.1 release segfaults on certain benchmarks under linux-user
emulation (x86 on x86).

Specifically "facerec" from the SPEC2000 benchmarks, and over half of the
SPEC2006 benchmarks.

I tracked this down to a problem in the mmap() code in linux-user.

I've attached a patch that reverts behavior back to that from 0.9.0, which
makes the benchmarks all run for me.

The problem is that after a large number of mmap() calls, the
mmap_find_vma() fuction sometimes completely destroys the memory map
table.  I can produce debug info on this if needed.  What the patch does
is make the code ignore the results of mmap_find_vma().

I'm not familiar enough with the qemu mmap() code to fix this properly...

Thanks

Vince

--- ./qemu-0.9.1-stock/linux-user/mmap.c	2008-01-06 14:38:42.000000000 -0500
+++ ./qemu-0.9.1/linux-user/mmap.c	2008-01-17 13:27:11.000000000 -0500
@@ -250,8 +250,8 @@
         /* Note: we prefer to control the mapping address. It is
            especially important if qemu_host_page_size >
            qemu_real_host_page_size */
-        p = mmap(g2h(mmap_start),
-                 host_len, prot, flags | MAP_FIXED, fd, host_offset);
+        p = mmap(real_start ? g2h(real_start) : NULL,
+                 host_len, prot, flags, fd, host_offset);
         if (p == MAP_FAILED)
             return -1;
         /* update start so that it points to the file position at 'offset' */

Re: [Qemu-devel] [patch] fix mmap 0.9.1 mmap regression in linux-user

[Mulyadi Santosa]

Hello..

On Jan 18, 2008 1:35 AM, Vince Weaver <vince@csl.cornell.edu> wrote:
> Hello
>
> The 0.9.1 release segfaults on certain benchmarks under linux-user
> emulation (x86 on x86).
>
> Specifically "facerec" from the SPEC2000 benchmarks, and over half of the
> SPEC2006 benchmarks.
>
> I tracked this down to a problem in the mmap() code in linux-user.
>
> I've attached a patch that reverts behavior back to that from 0.9.0, which
> makes the benchmarks all run for me.
>
> The problem is that after a large number of mmap() calls, the
> mmap_find_vma() fuction sometimes completely destroys the memory map
> table.  I can produce debug info on this if needed.  What the patch does
> is make the code ignore the results of mmap_find_vma().
>
> I'm not familiar enough with the qemu mmap() code to fix this properly...
>
> Thanks
>
> Vince
>
> --- ./qemu-0.9.1-stock/linux-user/mmap.c        2008-01-06 14:38:42.000000000 -0500
> +++ ./qemu-0.9.1/linux-user/mmap.c      2008-01-17 13:27:11.000000000 -0500
> @@ -250,8 +250,8 @@
>          /* Note: we prefer to control the mapping address. It is
>             especially important if qemu_host_page_size >
>             qemu_real_host_page_size */
> -        p = mmap(g2h(mmap_start),
> -                 host_len, prot, flags | MAP_FIXED, fd, host_offset);
> +        p = mmap(real_start ? g2h(real_start) : NULL,
> +                 host_len, prot, flags, fd, host_offset);

urmmm, sure we need to throw out MAP_FIXED flag? sounds like from the
upper "Notes", it's need to control the start address of mapped
VMA..in the case of must-on-real_start.

CMIIW too..just dumb static code analysis.

regards,

Mulyadi.