diff mbox

[07/18] linux-user: Fix the computation of the requested heap size

Message ID c446f7899621098be99a0e767f746007c3ba6da2.1308583801.git.riku.voipio@iki.fi
State New
Headers show

Commit Message

Riku Voipio June 20, 2011, 4:20 p.m. UTC 
From: Cédric VINCENT <cedric.vincent@st.com>

There were two remaining bugs in the previous implementation of
do_brk():

    1. the value of "new_alloc_size" was one page too large when the
       requested brk was aligned on a host page boundary.

    2. no new pages should be (re-)allocated when the requested brk is
       in the range of the pages that were already allocated
       previsouly (for the same purpose).  Technically these pages are
       never unmapped in the current implementation.

The problem/fix can be reproduced/validated with the following test
case:

    #include <unistd.h>       /* syscall(2),      */
    #include <sys/syscall.h>  /* SYS_brk,         */
    #include <stdio.h>        /* puts(3),         */
    #include <stdlib.h>       /* exit(3), EXIT_*, */

    int main()
    {
        int current_brk = 0;
        int new_brk;
        int failure = 0;

        void test(int increment) {
            static int test_number = 0;
            test_number++;

            new_brk = syscall(SYS_brk, current_brk + increment);
            if (new_brk == current_brk) {
                printf("test %d fails\n", test_number);
                failure++;
            }

            current_brk = new_brk;
        }

        /* Initialization.  */
        test(0);

        /* Does QEMU overlap host pages?  */
        test(HOST_PAGE_SIZE);
        test(HOST_PAGE_SIZE);

        /* Does QEMU allocate the same host page twice?  */
        test(-HOST_PAGE_SIZE);
        test(HOST_PAGE_SIZE);

        if (!failure) {
            printf("success\n");
            exit(EXIT_SUCCESS);
        }
        else {
            exit(EXIT_FAILURE);
        }
    }

Signed-off-by: Cédric VINCENT <cedric.vincent@st.com>
Reviewed-by: Christophe Guillon <christophe.guillon@st.com>
Signed-off-by: Riku Voipio <riku.voipio@iki.fi>
---
 linux-user/syscall.c |   11 ++++++-----
 1 files changed, 6 insertions(+), 5 deletions(-)

Comments

vincent June 21, 2011, 7:11 a.m. UTC | #1 
On Mon, Jun 20, 2011 at 06:20:12PM +0200, riku.voipio@iki.fi wrote:
>  linux-user/syscall.c |   11 ++++++-----
>  1 files changed, 6 insertions(+), 5 deletions(-)

This is not the latest version of the patch (that one introduced some
regressions):

    http://patchwork.ozlabs.org/patch/100492/
Riku Voipio June 21, 2011, 5:50 p.m. UTC | #2 
On Tue, Jun 21, 2011 at 09:11:00AM +0200, cedric.vincent@st.com wrote:
> On Mon, Jun 20, 2011 at 06:20:12PM +0200, riku.voipio@iki.fi wrote:
> >  linux-user/syscall.c |   11 ++++++-----
> >  1 files changed, 6 insertions(+), 5 deletions(-)

> This is not the latest version of the patch (that one introduced some
> regressions):
> 
>     http://patchwork.ozlabs.org/patch/100492/

Thanks. replaced the older patch with that one. Linux-user-for-upstream branch 
has been refreshed with this patch updated and the commit message changes
you requested.

Riku
diff mbox

Patch

diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index b975730..be27f53 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -709,16 +709,17 @@  char *target_strerror(int err)
 
 static abi_ulong target_brk;
 static abi_ulong target_original_brk;
+static abi_ulong brk_page;
 
 void target_set_brk(abi_ulong new_brk)
 {
     target_original_brk = target_brk = HOST_PAGE_ALIGN(new_brk);
+    brk_page = HOST_PAGE_ALIGN(target_brk);
 }
 
 /* do_brk() must return target values and target errnos. */
 abi_long do_brk(abi_ulong new_brk)
 {
-    abi_ulong brk_page;
     abi_long mapped_addr;
     int	new_alloc_size;
 
@@ -727,9 +728,8 @@  abi_long do_brk(abi_ulong new_brk)
     if (new_brk < target_original_brk)
         return target_brk;
 
-    brk_page = HOST_PAGE_ALIGN(target_brk);
-
-    /* If the new brk is less than this, set it and we're done... */
+    /* If the new brk is less than the highest page reserved to the
+     * target heap allocation, set it and we're done... */
     if (new_brk < brk_page) {
 	target_brk = new_brk;
     	return target_brk;
@@ -741,13 +741,14 @@  abi_long do_brk(abi_ulong new_brk)
      * itself); instead we treat "mapped but at wrong address" as
      * a failure and unmap again.
      */
-    new_alloc_size = HOST_PAGE_ALIGN(new_brk - brk_page + 1);
+    new_alloc_size = HOST_PAGE_ALIGN(new_brk - brk_page);
     mapped_addr = get_errno(target_mmap(brk_page, new_alloc_size,
                                         PROT_READ|PROT_WRITE,
                                         MAP_ANON|MAP_PRIVATE, 0, 0));
 
     if (mapped_addr == brk_page) {
         target_brk = new_brk;
+        brk_page = HOST_PAGE_ALIGN(target_brk);
         return target_brk;
     } else if (mapped_addr != -1) {
         /* Mapped but at wrong address, meaning there wasn't actually