xen: mapcache: Fix finding matching entry

If we have request without lock and hit unlocked or invalid
entry during the search, we remap it immediately,
even if we have matching entry in next entries in bucket.
This leads to duplication of mappings of the same size,
and to possibility of selecting the wrong element
during invalidation and underflow it's entry->lock counter

Signed-off-by: Aleksandr Partanen <[email protected]>
Reviewed-by: Stefano Stabellini <[email protected]>
Reviewed-by: Edgar E. Iglesias <[email protected]>
Signed-off-by: Edgar E. Iglesias <[email protected]>
(cherry picked from commit a4b20f7)
Signed-off-by: Michael Tokarev <[email protected]>

Author: alex-pentagrid

hw/xen/xen-mapcache.c

@@ -376,12 +376,12 @@ static uint8_t *xen_map_cache_unlocked(MapCache *mc,
 
     entry = &mc->entry[address_index % mc->nr_buckets];
 
-    while (entry && (lock || entry->lock) && entry->vaddr_base &&
-            (entry->paddr_index != address_index || entry->size != cache_size ||
+    while (entry && (!entry->vaddr_base ||
+            entry->paddr_index != address_index || entry->size != cache_size ||
              !test_bits(address_offset >> XC_PAGE_SHIFT,
                  test_bit_size >> XC_PAGE_SHIFT,
                  entry->valid_mapping))) {
-        if (!free_entry && !entry->lock) {
+        if (!free_entry && (!entry->lock || !entry->vaddr_base)) {
             free_entry = entry;
             free_pentry = pentry;
         }