exec: Atomic access to bounce buffer
There could be a race condition when two processes call address_space_map concurrently and both want to use the bounce buffer. Add an in_use flag in BounceBuffer to sync it. Signed-off-by: Fam Zheng <famz@redhat.com> Message-Id: <1426496617-10702-2-git-send-email-famz@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
This commit is contained in:
parent
e3a0abfda7
commit
c2cba0ffe4
4
exec.c
4
exec.c
@ -2482,6 +2482,7 @@ typedef struct {
|
||||
void *buffer;
|
||||
hwaddr addr;
|
||||
hwaddr len;
|
||||
bool in_use;
|
||||
} BounceBuffer;
|
||||
|
||||
static BounceBuffer bounce;
|
||||
@ -2570,7 +2571,7 @@ void *address_space_map(AddressSpace *as,
|
||||
l = len;
|
||||
mr = address_space_translate(as, addr, &xlat, &l, is_write);
|
||||
if (!memory_access_is_direct(mr, is_write)) {
|
||||
if (bounce.buffer) {
|
||||
if (atomic_xchg(&bounce.in_use, true)) {
|
||||
return NULL;
|
||||
}
|
||||
/* Avoid unbounded allocations */
|
||||
@ -2640,6 +2641,7 @@ void address_space_unmap(AddressSpace *as, void *buffer, hwaddr len,
|
||||
qemu_vfree(bounce.buffer);
|
||||
bounce.buffer = NULL;
|
||||
memory_region_unref(bounce.mr);
|
||||
atomic_mb_set(&bounce.in_use, false);
|
||||
cpu_notify_map_clients();
|
||||
}
|
||||
|
||||
|
Loading…
Reference in New Issue
Block a user