Fix map cache low/high/low bug

This small patch fixes an issue leading to a crash (segfault, although
with earlier changesets I was seeing sigbus - not sure what changed)
in qemu-dm when the following conditions occur:

1. A valid mapping for a bucket on a low address exists

2. Immediately after accessing memory mapped in this bucket, an access
occurs to a high (beyond assigned ram) address beyond the 1GB limit
for 32bit map cache wrapping around to the previous bucket's entry
number.

3. The next call to map cache again accesses the low address.

In this scenario, the guest mem for the low bucket has been unmapped
by the remap_bucket caused by 2., but because the valid_mapping
bit-test fails, map_cache returns before last_address_index has been
updated. The subsequent call to map_cache therefore never remaps the
low, valid bucket and instead returns a vaddr pointing to memory that
has failed to get mapped.

Signed-off-by: Trolle Selander <trolle.selander@eu.citrix.com>
(cherry picked from commit 77304a4b670e068e555385b7ed8a04ed0b8e9bac)

diff --git a/hw/xen_machine_fv.c b/hw/xen_machine_fv.c
index 149f00ed77003933f18503eced643a8c9af4dd70..1f85c5c933ab072d8ffdd768dc79c3c6f99776f6 100644 (file)
--- a/hw/xen_machine_fv.c
+++ b/hw/xen_machine_fv.c
@@ -144,8 +144,10 @@ uint8_t *qemu_map_cache(target_phys_addr_t phys_addr)
         !test_bit(address_offset>>XC_PAGE_SHIFT, entry->valid_mapping))
         qemu_remap_bucket(entry, address_index);
 
-    if (!test_bit(address_offset>>XC_PAGE_SHIFT, entry->valid_mapping))
+    if (!test_bit(address_offset>>XC_PAGE_SHIFT, entry->valid_mapping)) {
+        last_address_index = ~0UL;
         return NULL;
+    }
 
     last_address_index = address_index;
     last_address_vaddr = entry->vaddr_base;