Re: [Qemu-stable] [PATCH for v2.3.1] exec: Respect as_translate_internal length clamp

[Paolo Bonzini]

On 27/01/2016 20:16, P J P wrote:
> +-- On Wed, 27 Jan 2016, P J P wrote --+
> | +-- On Wed, 27 Jan 2016, Paolo Bonzini wrote --+
> | | but you'll need to look at the archives for all the conversations going 
> on.
> | 
> |   Okay, I'll go through the archives and confirm here.
> 
> ===
> * exec: skip MMIO regions correctly in cpu_physical_memory_write_rom_internal
>   -> https://lists.gnu.org/archive/html/qemu-devel/2015-07/msg00967.html
> 
> * exec: do not clamp accesses to MMIO regions
>   -> https://lists.gnu.org/archive/html/qemu-devel/2015-06/msg05005.html
> 
> * exec: clamp accesses against the MemoryRegionSection
>   -> https://lists.gnu.org/archive/html/qemu-devel/2015-06/msg05004.html
> 
> * exec: Respect as_translate_internal length clamp
>   -> https://lists.gnu.org/archive/html/qemu-devel/2015-03/msg03888.html
> 
> Going through these threads, patches to the 'exec: *' file above seem to be 
> relevant to the proposed fix patch '23820dbfc79d1c9'. But others below not so 
> much. (maybe I'm missing something).
> 
> * ioport: reserve the whole range of an I/O port in the AddressSpace
>   -> https://lists.gnu.org/archive/html/qemu-devel/2015-03/msg05949.html
> 
> * ioport: loosen assertions on emulation of 16-bit ports
>   -> https://lists.gnu.org/archive/html/qemu-devel/2015-03/msg05948.html
> 
> * ioport: remove wrong comment
>   -> https://lists.gnu.org/archive/html/qemu-devel/2015-03/msg05947.html
> 
> * ide: there is only one data port
>   -> https://lists.gnu.org/archive/html/qemu-devel/2015-03/msg05945.html
> 
> * gus: clean up MemoryRegionPortio
>   -> https://lists.gnu.org/archive/html/qemu-devel/2015-03/msg05946.html
> 
> * sb16: remove useless mixer_write_indexw
>   -> https://lists.gnu.org/archive/html/qemu-devel/2015-03/msg05950.html
> ===

You can see that
https://lists.gnu.org/archive/html/qemu-devel/2015-03/msg05944.html says
that they fix an issue with commit c3c1bb99, which is the original
installment of "exec: Respect as_translate_internal length clamp" (later
reverted, and then reapplied).

In any case, it should be clear that this is a pretty dangerous backport.

Paolo