This is an archived copy of the Xen.org mailing list, which we have preserved to ensure that existing links to archives are not broken. The live archive, which contains the latest emails, can be found at http://lists.xen.org/
Home Products Support Community News


[Xen-devel] [PATCH] [IOEMU] Fix bug in map cache

To: xen-devel <xen-devel@xxxxxxxxxxxxxxxxxxx>, "Ian Jackson" <Ian.Jackson@xxxxxxxxxxxxx>, "Keir Fraser" <keir.fraser@xxxxxxxxxxxxx>
Subject: [Xen-devel] [PATCH] [IOEMU] Fix bug in map cache
From: "Trolle Selander" <trolle.selander@xxxxxxxxx>
Date: Tue, 9 Sep 2008 13:25:23 +0100
Delivery-date: Tue, 09 Sep 2008 05:25:46 -0700
Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from:to :subject:mime-version:content-type; bh=8uKAyM0ok26l6AEq9Sqxcu9EAeib0ctXTdAzCtOYfrQ=; b=s9Kkz9CtaGUgkkKv40t+NktlHYSyj1DEC6F1nAT55ViwbJU7N3nu6ykypaddzlLZw6 pFNcwTQMzBFxzb12qGAigAxQ8YupdnNzzIAYmNH4kR+mNCurQqRXx1lmoiYlekEO1tnq nP1yDVV5PdvTmpLaUteUJ555R8wNtRpJyaL14=
Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:date:from:to:subject:mime-version:content-type; b=SHOCgL5G+2Fjsi4YbmX+F6nROUbsPoqc/Dvfl3y37tjNta0s0snlwzhubswKqCJ5pU WA4wcDJoy7u4TQiOE4Qg84Q9OLI8YrtqB1ob3dpmPVc4sYn3Q2gq+Z06Tze273wXsGUU teWAWuN9rGuGQhEJkdEf12aPWv82Hi6LPvceg=
Envelope-to: www-data@xxxxxxxxxxxxxxxxxxx
List-help: <mailto:xen-devel-request@lists.xensource.com?subject=help>
List-id: Xen developer discussion <xen-devel.lists.xensource.com>
List-post: <mailto:xen-devel@lists.xensource.com>
List-subscribe: <http://lists.xensource.com/mailman/listinfo/xen-devel>, <mailto:xen-devel-request@lists.xensource.com?subject=subscribe>
List-unsubscribe: <http://lists.xensource.com/mailman/listinfo/xen-devel>, <mailto:xen-devel-request@lists.xensource.com?subject=unsubscribe>
Sender: xen-devel-bounces@xxxxxxxxxxxxxxxxxxx
This small patch fixes an issue leading to a crash (segfault, although
with earlier changesets I was seeing sigbus - not sure what changed)
in qemu-dm when the following conditions occur:

1. A valid mapping for a bucket on a low address exists

2. Immediately after accessing memory mapped in this bucket, an access
occurs to a high (beyond assigned ram) address beyond the 1GB limit
for 32bit map cache wrapping around to the previous bucket's entry

3. The next call to map cache again accesses the low address.

In this scenario, the guest mem for the low bucket has been unmapped
by the remap_bucket caused by 2., but because the valid_mapping
bit-test fails, map_cache returns before last_address_index has been
updated. The subsequent call to map_cache therefore never remaps the
low, valid bucket and instead returns a vaddr pointing to memory that
has failed to get mapped.

The patch is against ioemu-remote, but should be applied to the
in-tree ioemu as well (and applies without problem).

Signed-off-by: Trolle Selander <trolle.selander@xxxxxxxxxxxxx>

Attachment: map_cache_wraparound_fix.patch
Description: Text Data

Xen-devel mailing list
<Prev in Thread] Current Thread [Next in Thread>