From 93bce41b7709fd95eb3f4eecee3108f48cf356c1 Mon Sep 17 00:00:00 2001 From: Keir Fraser Date: Tue, 9 Sep 2008 15:05:58 +0100 Subject: [PATCH] ioemu: Fix bug in map cache This small patch fixes an issue leading to a crash (segfault, although with earlier changesets I was seeing sigbus - not sure what changed) in qemu-dm when the following conditions occur: 1. A valid mapping for a bucket on a low address exists 2. Immediately after accessing memory mapped in this bucket, an access occurs to a high (beyond assigned ram) address beyond the 1GB limit for 32bit map cache wrapping around to the previous bucket's entry number. 3. The next call to map cache again accesses the low address. In this scenario, the guest mem for the low bucket has been unmapped by the remap_bucket caused by 2., but because the valid_mapping bit-test fails, map_cache returns before last_address_index has been updated. The subsequent call to map_cache therefore never remaps the low, valid bucket and instead returns a vaddr pointing to memory that has failed to get mapped. Signed-off-by: Trolle Selander --- tools/ioemu/hw/xen_machine_fv.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/tools/ioemu/hw/xen_machine_fv.c b/tools/ioemu/hw/xen_machine_fv.c index 448a8fecf6..036fbc4e99 100644 --- a/tools/ioemu/hw/xen_machine_fv.c +++ b/tools/ioemu/hw/xen_machine_fv.c @@ -139,8 +139,10 @@ uint8_t *qemu_map_cache(target_phys_addr_t phys_addr) !test_bit(address_offset>>XC_PAGE_SHIFT, entry->valid_mapping)) qemu_remap_bucket(entry, address_index); - if (!test_bit(address_offset>>XC_PAGE_SHIFT, entry->valid_mapping)) + if (!test_bit(address_offset>>XC_PAGE_SHIFT, entry->valid_mapping)) { + last_address_index = ~0UL; return NULL; + } last_address_index = address_index; last_address_vaddr = entry->vaddr_base; -- 2.30.2