Re: [Qemu-stable] [PATCH for v2.3.1] exec: Respect as_translate_internal length clamp

[Paolo Bonzini]

This is not enough.  This patch caused a huge fallout back when it was applied.

You need these too, I think:

    exec: skip MMIO regions correctly in cpu_physical_memory_write_rom_internal
    exec: clamp accesses against the MemoryRegionSection
    exec: do not clamp accesses to MMIO regions
    exec: Respect as_translate_internal length clamp
    ioport: reserve the whole range of an I/O port in the AddressSpace
    ioport: loosen assertions on emulation of 16-bit ports
    ioport: remove wrong comment
    ide: there is only one data port
    gus: clean up MemoryRegionPortio
    sb16: remove useless mixer_write_indexw

but you'll need to look at the archives for all the conversations going on.

Paolo

On 27/01/2016 10:48, P J P wrote:
> From: Peter Crosthwaite <address@hidden>
>  
> address_space_translate_internal will clamp the *plen length argument
> based on the size of the memory region being queried. The iommu walker
> logic in addresss_space_translate was ignoring this by discarding the
> post fn call value of *plen. Fix by just always using *plen as the
> length argument throughout the fn, removing the len local variable.
> 
> This fixes a bootloader bug when a single elf section spans multiple
> QEMU memory regions.
> 
> Signed-off-by: Peter Crosthwaite <address@hidden>
> Message-Id: <address@hidden>
> Signed-off-by: Paolo Bonzini <address@hidden>
> (cherry picked from commit 23820dbfc79d1c9dce090b4c555994f2bb6a69b3)
> Signed-off-by: Prasad J Pandit <address@hidden>
> ---
>  exec.c | 6 ++----
>  1 file changed, 2 insertions(+), 4 deletions(-)
> 
> diff --git a/exec.c b/exec.c
> index 874ecfc..6d1e1e4 100644
> --- a/exec.c
> +++ b/exec.c
> @@ -380,7 +380,6 @@ MemoryRegion *address_space_translate(AddressSpace *as, 
> hwaddr addr,
>      IOMMUTLBEntry iotlb;
>      MemoryRegionSection *section;
>      MemoryRegion *mr;
> -    hwaddr len = *plen;
>  
>      rcu_read_lock();
>      for (;;) {
> @@ -395,7 +394,7 @@ MemoryRegion *address_space_translate(AddressSpace *as, 
> hwaddr addr,
>          iotlb = mr->iommu_ops->translate(mr, addr, is_write);
>          addr = ((iotlb.translated_addr & ~iotlb.addr_mask)
>                  | (addr & iotlb.addr_mask));
> -        len = MIN(len, (addr | iotlb.addr_mask) - addr + 1);
> +        *plen = MIN(*plen, (addr | iotlb.addr_mask) - addr + 1);
>          if (!(iotlb.perm & (1 << is_write))) {
>              mr = &io_mem_unassigned;
>              break;
> @@ -406,10 +405,9 @@ MemoryRegion *address_space_translate(AddressSpace *as, 
> hwaddr addr,
>  
>      if (xen_enabled() && memory_access_is_direct(mr, is_write)) {
>          hwaddr page = ((addr & TARGET_PAGE_MASK) + TARGET_PAGE_SIZE) - addr;
> -        len = MIN(page, len);
> +        *plen = MIN(page, *plen);
>      }
>  
> -    *plen = len;
>      *xlat = addr;
>      rcu_read_unlock();
>      return mr;
>