qemu-dm: fix unregister_iomem() This function (introduced quite a long time ago in e7911109f4321e9ba0cc56a253b653600aa46bea - "disable qemu PCI devices in HVM domains") appears to be completely broken, causing the regression reported in http://bugzilla.xensource.com/bugzilla/show_bug.cgi?id=1805 (due to the newly added caller of it in 56d7747a3cf811910c4cf865e1ebcb8b82502005 - "qemu: clean up MSI-X table handling"). It's unclear how the function can ever have fulfilled its purpose: the value returned by iomem_index() is *not* an index into mmio[]. Additionally, fix two problems: - unregister_iomem() must not clear mmio[].start, otherwise cpu_register_physical_memory() won't be able to re-use the previous slot, thus causing a leak - cpu_unregister_io_memory() must not check mmio[].size, otherwise it won't properly clean up entries (temporarily) squashed through unregister_iomem() Signed-off-by: Jan Beulich Tested-by: Stefano Stabellini Tested-by: Yongjie Ren --- a/i386-dm/exec-dm.c +++ b/i386-dm/exec-dm.c @@ -360,7 +360,7 @@ void cpu_unregister_io_memory(int io_tab int io_index = io_table_address >> IO_MEM_SHIFT; for (i = 0; i < mmio_cnt; i++) { - if (mmio[i].size && mmio[i].io_index == io_index) { + if (mmio[i].io_index == io_index) { mmio[i].start = mmio[i].size = 0; break; } @@ -466,12 +466,16 @@ static int iomem_index(target_phys_addr_ void unregister_iomem(target_phys_addr_t start) { - int index = iomem_index(start); - if (index) { + unsigned int index; + + for (index = 0; index < mmio_cnt; index++) + if (start == mmio[index].start) + break; + if (index < mmio_cnt) { fprintf(logfile, "squash iomem [%lx, %lx).\n", (unsigned long)(mmio[index].start), (unsigned long)(mmio[index].start + mmio[index].size)); - mmio[index].start = mmio[index].size = 0; + mmio[index].size = 0; } }