On 17 November 2014 11:03, Paolo Bonzini <pbonz...@redhat.com> wrote: > > > On 16/11/2014 20:44, Peter Maydell wrote: >> The code in invalidate_and_set_dirty() needs to handle addr/length >> combinations which cross guest physical page boundaries. This can happen, >> for example, when disk I/O reads large blocks into guest RAM which previously >> held code that we have cached translations for. Unfortunately we were only >> checking the clean/dirty status of the first page in the range, and then >> were calling a tb_invalidate function which only handles ranges that don't >> cross page boundaries. Fix the function to deal with multipage ranges. >> >> The symptoms of this bug were that guest code would misbehave (eg segfault), >> in particular after a guest reboot but potentially any time the guest >> reused a page of its physical RAM for new code. >> >> Cc: qemu-sta...@nongnu.org >> Signed-off-by: Peter Maydell <peter.mayd...@linaro.org> >> --- >> This seems pretty nasty, and I have no idea why it hasn't been wreaking >> more havoc than this before. I'm not entirely sure why we invalidate TBs >> if any of the dirty bits is set rather than only if the code bit is set, >> but I left that logic as it is. > > I think it's a remain of when we had a single bitmap with three bits in > it. We can clean up in 2.3. > >> Review appreciated -- it would be nice to get this into rc2 if >> we can, I think. > > Reviewed-by: Paolo Bonzini <pbonz...@redhat.com>
Applied to master; thanks. -- PMM