[Top][All Lists]
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Qemu-devel] [memory] abort with head a8170e5
From: |
Avi Kivity |
Subject: |
Re: [Qemu-devel] [memory] abort with head a8170e5 |
Date: |
Thu, 25 Oct 2012 15:47:34 +0200 |
User-agent: |
Mozilla/5.0 (X11; Linux x86_64; rv:16.0) Gecko/20121016 Thunderbird/16.0.1 |
On 10/24/2012 04:00 PM, Aurelien Jarno wrote:
>
> mips is also broken but by commit 1c380f9460522f32c8dd2577b2a53d518ec91c6d:
>
> | [ 0.436000] PCI: Enabling device 0000:00:0a.1 (0000 -> 0001)
> | Segmentation fault (core dumped)
>
How do you reproduce it?
Does this patch fix it for you?
From: Avi Kivity <address@hidden>
Date: Thu, 11 Oct 2012 12:40:24 +0200
Subject: [PATCH] memory: limit sections in the radix tree to the actual
address space size
The radix tree is statically sized to fit TARGET_PHYS_ADDR_SPACE_BITS.
If a larger memory region is registered, it will overflow.
Fix by limiting any section in the radix tree to the supported size.
This problem was not observed earlier since artificial regions (containers
and aliases) are eliminated by the memory core, leaving only device regions
which have reasonable sizes. An IOMMU however cannot be eliminated by the
memory core, and may have an artificial size.
Signed-off-by: Avi Kivity <address@hidden>
diff --git a/exec.c b/exec.c
index b0ed593..deee8ec 100644
--- a/exec.c
+++ b/exec.c
@@ -2280,10 +2280,23 @@ static void register_multipage(AddressSpaceDispatch *d,
MemoryRegionSection *sec
section_index);
}
+static MemoryRegionSection limit(MemoryRegionSection section)
+{
+ unsigned practical_as_bits = MIN(TARGET_PHYS_ADDR_SPACE_BITS, 62);
+ hwaddr as_limit;
+
+ as_limit = (hwaddr)1 << practical_as_bits;
+
+ section.size = MIN(section.offset_within_address_space + section.size,
as_limit)
+ - section.offset_within_address_space;
+
+ return section;
+}
+
static void mem_add(MemoryListener *listener, MemoryRegionSection *section)
{
AddressSpaceDispatch *d = container_of(listener, AddressSpaceDispatch,
listener);
- MemoryRegionSection now = *section, remain = *section;
+ MemoryRegionSection now = limit(*section), remain = limit(*section);
if ((now.offset_within_address_space & ~TARGET_PAGE_MASK)
|| (now.size < TARGET_PAGE_SIZE)) {
--
error compiling committee.c: too many arguments to function
- [Qemu-devel] [memory] abort with head a8170e5, Richard Henderson, 2012/10/23
- Re: [Qemu-devel] [memory] abort with head a8170e5, Aurelien Jarno, 2012/10/24
- Re: [Qemu-devel] [memory] abort with head a8170e5,
Avi Kivity <=
- Re: [Qemu-devel] [memory] abort with head a8170e5, Aurelien Jarno, 2012/10/25
- Re: [Qemu-devel] [memory] abort with head a8170e5, Avi Kivity, 2012/10/25
- Re: [Qemu-devel] [memory] abort with head a8170e5, Aurelien Jarno, 2012/10/29
- Re: [Qemu-devel] [memory] abort with head a8170e5, Avi Kivity, 2012/10/29
- Re: [Qemu-devel] [memory] abort with head a8170e5, Aurelien Jarno, 2012/10/29
[Qemu-devel] [PATCH] pci: avoid destroying bridge address space windows in a transaction, Avi Kivity, 2012/10/25