Re: [Xen-devel] [Qemu-devel] [RFC/BUG] xen-mapcache: buggy invalidate map cache?

[hrg <hrgstephen@xxxxxxxxx>]

On Sun, Apr 9, 2017 at 11:55 PM, hrg <hrgstephen@xxxxxxxxx> wrote:
> On Sun, Apr 9, 2017 at 11:52 PM, hrg <hrgstephen@xxxxxxxxx> wrote:
>> Hi,
>>
>> In xen_map_cache_unlocked(), map to guest memory maybe in entry->next
>> instead of first level entry (if map to rom other than guest memory
>> comes first), while in xen_invalidate_map_cache(), when VM ballooned
>> out memory, qemu did not invalidate cache entries in linked
>> list(entry->next), so when VM balloon back in memory, gfns probably
>> mapped to different mfns, thus if guest asks device to DMA to these
>> GPA, qemu may DMA to stale MFNs.
>>
>> So I think in xen_invalidate_map_cache() linked lists should also be
>> checked and invalidated.
>>
>> What’s your opinion? Is this a bug? Is my analyze correct?
>
> Added Jun Nakajima and Alexander Graf
And correct Stefano Stabellini's email address.

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
https://lists.xen.org/xen-devel