Skip to content

AC97 can allocate ~500MB of host RAM

This bug has been copied automatically from: https://bugs.launchpad.net/qemu/+bug/1603779

While working with qtest test cases generated via fuzzing with QEMU 2.5.0,
I discovered some odd behavior for the AC97 virtual device with qemu-
system-i386. If AC97_MIC_ADC_RATE is set to the value of 1, the QEMU
process allocates over 500MB of additional host RAM. You probably would
not normally notice this on a modern PC, except that I was using a
"ulimit" command to restrict the maximum amount of virtual memory allowed
for the QEMU process, so the process would crash with a SIGTRAP (signal 5)
on the failed memory allocation.

My minimized qtest code to reproduce the issue is:

static void test_crash(void)
{
  uint64_t barsize;
  dev = get_device();

  dev_base[0] = qpci_iomap(dev, 0, &barsize);
  dev_base[1] = qpci_iomap(dev, 1, &barsize);
  qpci_device_enable(dev);
  qpci_io_writew(dev, dev_base[0]+0x32, 0x00000001);
}

I ran a "ulimit -sv 650000" command and then launched the tests/ac97-test
binary with this crash test case included in it. I can then see the QEMU
process crash on an allocation of 722538464 bytes. I can gradually
increase the ulimit memory limit to ~1200000 and then no longer see the
issue, hence my estimate of 500 MB of RAM allocated by the device.
To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information