qemu-dm: fix unregister_iomem()

This function (introduced quite a long time ago in
e7911109f4321e9ba0cc56a253b653600aa46bea - "disable qemu PCI
devices in HVM domains") appears to be completely broken, causing
the regression reported in
http://bugzilla.xensource.com/bugzilla/show_bug.cgi?id=1805 (due to
the newly added caller of it in
56d7747a3cf811910c4cf865e1ebcb8b82502005 - "qemu: clean up
MSI-X table handling"). It's unclear how the function can ever have
fulfilled its purpose: the value returned by iomem_index() is *not* an
index into mmio[].

Additionally, fix two problems:
- unregister_iomem() must not clear mmio[].start, otherwise
  cpu_register_physical_memory() won't be able to re-use the previous
  slot, thus causing a leak
- cpu_unregister_io_memory() must not check mmio[].size, otherwise it
  won't properly clean up entries (temporarily) squashed through
  unregister_iomem()

Signed-off-by: Jan Beulich <jbeulich@suse.com>
Tested-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
Tested-by: Yongjie Ren <yongjie.ren@intel.com>

diff --git a/i386-dm/exec-dm.c b/i386-dm/exec-dm.c
index 2158f7ca839de8c75321d08c1a130786c2b41cce..96274d9d7461dd79bd6167eb35ec1f513c5e6678 100644 (file)
--- a/i386-dm/exec-dm.c
+++ b/i386-dm/exec-dm.c
@@ -360,7 +360,7 @@ void cpu_unregister_io_memory(int io_table_address)
     int io_index = io_table_address >> IO_MEM_SHIFT;
 
     for (i = 0; i < mmio_cnt; i++) {
-       if (mmio[i].size && mmio[i].io_index == io_index) {
+       if (mmio[i].io_index == io_index) {
           mmio[i].start = mmio[i].size = 0;
           break;
        }
@@ -466,12 +466,16 @@ static int iomem_index(target_phys_addr_t addr)
 
 void unregister_iomem(target_phys_addr_t start)
 {
-    int index = iomem_index(start);
-    if (index) {
+    unsigned int index;
+
+    for (index = 0; index < mmio_cnt; index++)
+        if (start == mmio[index].start)
+            break;
+    if (index < mmio_cnt) {
         fprintf(logfile, "squash iomem [%lx, %lx).\n",
                (unsigned long)(mmio[index].start),
                 (unsigned long)(mmio[index].start + mmio[index].size));
-        mmio[index].start = mmio[index].size = 0;
+        mmio[index].size = 0;
     }
 }