exec: Handle multipage ranges in invalidate_and_set_dirty()

The code in invalidate_and_set_dirty() needs to handle addr/length
combinations which cross guest physical page boundaries. This can happen,
for example, when disk I/O reads large blocks into guest RAM which previously
held code that we have cached translations for. Unfortunately we were only
checking the clean/dirty status of the first page in the range, and then
were calling a tb_invalidate function which only handles ranges that don't
cross page boundaries. Fix the function to deal with multipage ranges.

The symptoms of this bug were that guest code would misbehave (eg segfault),
in particular after a guest reboot but potentially any time the guest
reused a page of its physical RAM for new code.

Cc: qemu-stable@nongnu.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Message-id: 1416167061-13203-1-git-send-email-peter.maydell@linaro.org
2 files changed
tree: 58087fda992c5575ee59f92627293235077b760e
  1. audio/
  2. backends/
  3. block/
  4. bsd-user/
  5. default-configs/
  6. disas/
  7. docs/
  8. fpu/
  9. fsdev/
  10. gdb-xml/
  11. hw/
  12. include/
  13. libcacard/
  14. libdecnumber/
  15. linux-headers/
  16. linux-user/
  17. net/
  18. pc-bios/
  19. po/
  20. qapi/
  21. qga/
  22. qobject/
  23. qom/
  24. roms/
  25. scripts/
  26. slirp/
  27. stubs/
  28. sysconfigs/
  29. target-alpha/
  30. target-arm/
  31. target-cris/
  32. target-i386/
  33. target-lm32/
  34. target-m68k/
  35. target-microblaze/
  36. target-mips/
  37. target-moxie/
  38. target-openrisc/
  39. target-ppc/
  40. target-s390x/
  41. target-sh4/
  42. target-sparc/
  43. target-tricore/
  44. target-unicore32/
  45. target-xtensa/
  46. tcg/
  47. tests/
  48. trace/
  49. ui/
  50. util/
  51. .exrc
  52. .gitignore
  53. .gitmodules
  54. .mailmap
  55. .travis.yml
  56. accel.c
  57. aio-posix.c
  58. aio-win32.c
  59. arch_init.c
  60. async.c
  61. balloon.c
  62. block-migration.c
  63. block.c
  64. blockdev-nbd.c
  65. blockdev.c
  66. blockjob.c
  67. bootdevice.c
  68. bt-host.c
  69. bt-vhci.c
  70. Changelog
  71. CODING_STYLE
  72. configure
  73. COPYING
  74. COPYING.LIB
  75. coroutine-gthread.c
  76. coroutine-sigaltstack.c
  77. coroutine-ucontext.c
  78. coroutine-win32.c
  79. cpu-exec.c
  80. cpus.c
  81. cputlb.c
  82. device-hotplug.c
  83. device_tree.c
  84. disas.c
  85. dma-helpers.c
  86. dump.c
  87. exec.c
  88. gdbstub.c
  89. HACKING
  90. hmp-commands.hx
  91. hmp.c
  92. hmp.h
  93. iohandler.c
  94. ioport.c
  95. iothread.c
  96. kvm-all.c
  97. kvm-stub.c
  98. LICENSE
  99. main-loop.c
  100. MAINTAINERS
  101. Makefile
  102. Makefile.objs
  103. Makefile.target
  104. memory.c
  105. memory_mapping.c
  106. migration-exec.c
  107. migration-fd.c
  108. migration-rdma.c
  109. migration-tcp.c
  110. migration-unix.c
  111. migration.c
  112. module-common.c
  113. monitor.c
  114. nbd.c
  115. numa.c
  116. os-posix.c
  117. os-win32.c
  118. page_cache.c
  119. qapi-schema.json
  120. qdev-monitor.c
  121. qdict-test-data.txt
  122. qemu-bridge-helper.c
  123. qemu-char.c
  124. qemu-coroutine-io.c
  125. qemu-coroutine-lock.c
  126. qemu-coroutine-sleep.c
  127. qemu-coroutine.c
  128. qemu-doc.texi
  129. qemu-file-stdio.c
  130. qemu-file-unix.c
  131. qemu-file.c
  132. qemu-img-cmds.hx
  133. qemu-img.c
  134. qemu-img.texi
  135. qemu-io-cmds.c
  136. qemu-io.c
  137. qemu-log.c
  138. qemu-nbd.c
  139. qemu-nbd.texi
  140. qemu-options-wrapper.h
  141. qemu-options.h
  142. qemu-options.hx
  143. qemu-seccomp.c
  144. qemu-tech.texi
  145. qemu-timer.c
  146. qemu.nsi
  147. qemu.sasl
  148. qmp-commands.hx
  149. qmp.c
  150. qtest.c
  151. README
  152. rules.mak
  153. savevm.c
  154. softmmu_template.h
  155. spice-qemu-char.c
  156. tcg-runtime.c
  157. tci.c
  158. thread-pool.c
  159. thunk.c
  160. tpm.c
  161. trace-events
  162. translate-all.c
  163. translate-all.h
  164. user-exec.c
  165. VERSION
  166. version.rc
  167. vl.c
  168. vmstate.c
  169. xbzrle.c
  170. xen-common-stub.c
  171. xen-common.c
  172. xen-hvm-stub.c
  173. xen-hvm.c
  174. xen-mapcache.c