exec: Atomic access to bounce buffer

There could be a race condition when two processes call
address_space_map concurrently and both want to use the bounce buffer.

Add an in_use flag in BounceBuffer to sync it.

Backports commit c2cba0ffe495b60c4cc58080281e99c7a6580d4b from qemu
This commit is contained in:
Paolo Bonzini 2018-02-12 20:59:51 -05:00 committed by Lioncash
parent 141754beea
commit 5c85c564b5
No known key found for this signature in database
GPG key ID: 4E3C3CC1031BA9C7
2 changed files with 3 additions and 1 deletions

View file

@ -38,6 +38,7 @@ typedef struct {
void *buffer;
hwaddr addr;
hwaddr len;
bool in_use;
} BounceBuffer;
typedef struct RAMList {

View file

@ -1891,7 +1891,7 @@ void *address_space_map(AddressSpace *as,
l = len;
mr = address_space_translate(as, addr, &xlat, &l, is_write);
if (!memory_access_is_direct(mr, is_write)) {
if (as->uc->bounce.buffer) {
if (atomic_xchg(&as->uc->bounce.in_use, true)) {
return NULL;
}
/* Avoid unbounded allocations */
@ -1960,6 +1960,7 @@ void address_space_unmap(AddressSpace *as, void *buffer, hwaddr len,
qemu_vfree(as->uc->bounce.buffer);
as->uc->bounce.buffer = NULL;
memory_region_unref(as->uc->bounce.mr);
atomic_mb_set(&as->uc->bounce.in_use, false);
}
void *cpu_physical_memory_map(AddressSpace *as, hwaddr addr,