fix double free the memslot in kvm_set_phys_mem

[qemu.git] / xen-all.c

diff --git a/xen-all.c b/xen-all.c
index e3a51ccc81eaf7775af9ee26768fb7ab0732ea55..539a1549a5cee3b313dbb67dad636735a194e8a5 100644 (file)
--- a/xen-all.c
+++ b/xen-all.c
@@ -11,15 +11,16 @@
 #include <sys/mman.h>
 
 #include "hw/pci/pci.h"
 #include <sys/mman.h>
 
 #include "hw/pci/pci.h"

-#include "hw/pc.h"
-#include "hw/xen_common.h"
-#include "hw/xen_backend.h"
+#include "hw/i386/pc.h"
+#include "hw/xen/xen_common.h"
+#include "hw/xen/xen_backend.h"

 #include "qmp-commands.h"
 
 #include "qmp-commands.h"
 

-#include "range.h"
-#include "xen-mapcache.h"
+#include "sysemu/char.h"
+#include "qemu/range.h"
+#include "sysemu/xen-mapcache.h"

 #include "trace.h"
 #include "trace.h"

-#include "exec-memory.h"
+#include "exec/address-spaces.h"

 
 #include <xen/hvm/ioreq.h>
 #include <xen/hvm/params.h>
 
 #include <xen/hvm/ioreq.h>
 #include <xen/hvm/params.h>


@@ -292,7 +293,8 @@ static int xen_add_to_physmap(XenIOState *state,
     return -1;
 
 go_physmap:
     return -1;
 
 go_physmap:

-    DPRINTF("mapping vram to %llx - %llx\n", start_addr, start_addr + size);
+    DPRINTF("mapping vram to %"HWADDR_PRIx" - %"HWADDR_PRIx"\n",
+            start_addr, start_addr + size);

 
     pfn = phys_offset >> TARGET_PAGE_BITS;
     start_gpfn = start_addr >> TARGET_PAGE_BITS;
 
     pfn = phys_offset >> TARGET_PAGE_BITS;
     start_gpfn = start_addr >> TARGET_PAGE_BITS;


@@ -365,8 +367,8 @@ static int xen_remove_from_physmap(XenIOState *state,
     phys_offset = physmap->phys_offset;
     size = physmap->size;
 
     phys_offset = physmap->phys_offset;
     size = physmap->size;
 

-    DPRINTF("unmapping vram to %llx - %llx, from %llx\n",
-            phys_offset, phys_offset + size, start_addr);
+    DPRINTF("unmapping vram to %"HWADDR_PRIx" - %"HWADDR_PRIx", from ",
+            "%"HWADDR_PRIx"\n", phys_offset, phys_offset + size, start_addr);

 
     size >>= TARGET_PAGE_BITS;
     start_addr >>= TARGET_PAGE_BITS;
 
     size >>= TARGET_PAGE_BITS;
     start_addr >>= TARGET_PAGE_BITS;


@@ -576,18 +578,18 @@ void qmp_xen_set_global_dirty_log(bool enable, Error **errp)
 
 static void xen_reset_vcpu(void *opaque)
 {
 
 static void xen_reset_vcpu(void *opaque)
 {

-    CPUArchState *env = opaque;
+    CPUState *cpu = opaque;

 
 

-    env->halted = 1;
+    cpu->halted = 1;

 }
 
 void xen_vcpu_init(void)
 {
 }
 
 void xen_vcpu_init(void)
 {

-    CPUArchState *first_cpu;
+    if (first_cpu != NULL) {
+        CPUState *cpu = ENV_GET_CPU(first_cpu);

 
 

-    if ((first_cpu = qemu_get_cpu(0))) {
-        qemu_register_reset(xen_reset_vcpu, first_cpu);
-        xen_reset_vcpu(first_cpu);
+        qemu_register_reset(xen_reset_vcpu, cpu);
+        xen_reset_vcpu(cpu);

     }
     /* if rtc_clock is left to default (host_clock), disable it */
     if (rtc_clock == host_clock) {
     }
     /* if rtc_clock is left to default (host_clock), disable it */
     if (rtc_clock == host_clock) {


@@ -682,11 +684,45 @@ static void do_outp(pio_addr_t addr,
     }
 }
 
     }
 }
 

-static void cpu_ioreq_pio(ioreq_t *req)
+/*
+ * Helper functions which read/write an object from/to physical guest
+ * memory, as part of the implementation of an ioreq.
+ *
+ * Equivalent to
+ *   cpu_physical_memory_rw(addr + (req->df ? -1 : +1) * req->size * i,
+ *                          val, req->size, 0/1)
+ * except without the integer overflow problems.
+ */
+static void rw_phys_req_item(hwaddr addr,
+                             ioreq_t *req, uint32_t i, void *val, int rw)
+{
+    /* Do everything unsigned so overflow just results in a truncated result
+     * and accesses to undesired parts of guest memory, which is up
+     * to the guest */
+    hwaddr offset = (hwaddr)req->size * i;
+    if (req->df) {
+        addr -= offset;
+    } else {
+        addr += offset;
+    }
+    cpu_physical_memory_rw(addr, val, req->size, rw);
+}
+
+static inline void read_phys_req_item(hwaddr addr,
+                                      ioreq_t *req, uint32_t i, void *val)
+{
+    rw_phys_req_item(addr, req, i, val, 0);
+}
+static inline void write_phys_req_item(hwaddr addr,
+                                       ioreq_t *req, uint32_t i, void *val)

 {
 {

-    int i, sign;
+    rw_phys_req_item(addr, req, i, val, 1);
+}

 
 

-    sign = req->df ? -1 : 1;
+
+static void cpu_ioreq_pio(ioreq_t *req)
+{
+    uint32_t i;

 
     if (req->dir == IOREQ_READ) {
         if (!req->data_is_ptr) {
 
     if (req->dir == IOREQ_READ) {
         if (!req->data_is_ptr) {


@@ -696,9 +732,7 @@ static void cpu_ioreq_pio(ioreq_t *req)
 
             for (i = 0; i < req->count; i++) {
                 tmp = do_inp(req->addr, req->size);
 
             for (i = 0; i < req->count; i++) {
                 tmp = do_inp(req->addr, req->size);

-                cpu_physical_memory_write(
-                        req->data + (sign * i * (int64_t)req->size),
-                        (uint8_t *) &tmp, req->size);
+                write_phys_req_item(req->data, req, i, &tmp);

             }
         }
     } else if (req->dir == IOREQ_WRITE) {
             }
         }
     } else if (req->dir == IOREQ_WRITE) {


@@ -708,9 +742,7 @@ static void cpu_ioreq_pio(ioreq_t *req)
             for (i = 0; i < req->count; i++) {
                 uint32_t tmp = 0;
 
             for (i = 0; i < req->count; i++) {
                 uint32_t tmp = 0;
 

-                cpu_physical_memory_read(
-                        req->data + (sign * i * (int64_t)req->size),
-                        (uint8_t*) &tmp, req->size);
+                read_phys_req_item(req->data, req, i, &tmp);

                 do_outp(req->addr, req->size, tmp);
             }
         }
                 do_outp(req->addr, req->size, tmp);
             }
         }


@@ -719,22 +751,16 @@ static void cpu_ioreq_pio(ioreq_t *req)
 
 static void cpu_ioreq_move(ioreq_t *req)
 {
 
 static void cpu_ioreq_move(ioreq_t *req)
 {

-    int i, sign;
-
-    sign = req->df ? -1 : 1;
+    uint32_t i;

 
     if (!req->data_is_ptr) {
         if (req->dir == IOREQ_READ) {
             for (i = 0; i < req->count; i++) {
 
     if (!req->data_is_ptr) {
         if (req->dir == IOREQ_READ) {
             for (i = 0; i < req->count; i++) {

-                cpu_physical_memory_read(
-                        req->addr + (sign * i * (int64_t)req->size),
-                        (uint8_t *) &req->data, req->size);
+                read_phys_req_item(req->addr, req, i, &req->data);

             }
         } else if (req->dir == IOREQ_WRITE) {
             for (i = 0; i < req->count; i++) {
             }
         } else if (req->dir == IOREQ_WRITE) {
             for (i = 0; i < req->count; i++) {

-                cpu_physical_memory_write(
-                        req->addr + (sign * i * (int64_t)req->size),
-                        (uint8_t *) &req->data, req->size);
+                write_phys_req_item(req->addr, req, i, &req->data);

             }
         }
     } else {
             }
         }
     } else {


@@ -742,21 +768,13 @@ static void cpu_ioreq_move(ioreq_t *req)
 
         if (req->dir == IOREQ_READ) {
             for (i = 0; i < req->count; i++) {
 
         if (req->dir == IOREQ_READ) {
             for (i = 0; i < req->count; i++) {

-                cpu_physical_memory_read(
-                        req->addr + (sign * i * (int64_t)req->size),
-                        (uint8_t*) &tmp, req->size);
-                cpu_physical_memory_write(
-                        req->data + (sign * i * (int64_t)req->size),
-                        (uint8_t*) &tmp, req->size);
+                read_phys_req_item(req->addr, req, i, &tmp);
+                write_phys_req_item(req->data, req, i, &tmp);

             }
         } else if (req->dir == IOREQ_WRITE) {
             for (i = 0; i < req->count; i++) {
             }
         } else if (req->dir == IOREQ_WRITE) {
             for (i = 0; i < req->count; i++) {

-                cpu_physical_memory_read(
-                        req->data + (sign * i * (int64_t)req->size),
-                        (uint8_t*) &tmp, req->size);
-                cpu_physical_memory_write(
-                        req->addr + (sign * i * (int64_t)req->size),
-                        (uint8_t*) &tmp, req->size);
+                read_phys_req_item(req->data, req, i, &tmp);
+                write_phys_req_item(req->addr, req, i, &tmp);

             }
         }
     }
             }
         }
     }