Re: [Qemu-devel] [RFC/BUG] xen-mapcache: buggy invalidate map cache?

[hrg]

On Sun, Apr 9, 2017 at 11:52 PM, hrg <address@hidden> wrote:
> Hi,
>
> In xen_map_cache_unlocked(), map to guest memory maybe in entry->next
> instead of first level entry (if map to rom other than guest memory
> comes first), while in xen_invalidate_map_cache(), when VM ballooned
> out memory, qemu did not invalidate cache entries in linked
> list(entry->next), so when VM balloon back in memory, gfns probably
> mapped to different mfns, thus if guest asks device to DMA to these
> GPA, qemu may DMA to stale MFNs.
>
> So I think in xen_invalidate_map_cache() linked lists should also be
> checked and invalidated.
>
> What’s your opinion? Is this a bug? Is my analyze correct?

Added Jun Nakajima and Alexander Graf