From edbc6f199c14ccce574a6c408e9f739727003766 Mon Sep 17 00:00:00 2001 From: Peter Crosthwaite Date: Mon, 12 Feb 2018 21:04:52 -0500 Subject: [PATCH] exec: Respect as_translate_internal length clamp address_space_translate_internal will clamp the *plen length argument based on the size of the memory region being queried. The iommu walker logic in addresss_space_translate was ignoring this by discarding the post fn call value of *plen. Fix by just always using *plen as the length argument throughout the fn, removing the len local variable. This fixes a bootloader bug when a single elf section spans multiple QEMU memory regions. Backports commit 23820dbfc79d1c9dce090b4c555994f2bb6a69b3 from qemu --- qemu/exec.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/qemu/exec.c b/qemu/exec.c index 1b5bf500..ae0c7b83 100644 --- a/qemu/exec.c +++ b/qemu/exec.c @@ -341,7 +341,6 @@ MemoryRegion *address_space_translate(AddressSpace *as, hwaddr addr, IOMMUTLBEntry iotlb; MemoryRegionSection *section; MemoryRegion *mr; - hwaddr len = *plen; for (;;) { section = address_space_translate_internal(as->dispatch, addr, &addr, plen, true); @@ -356,7 +355,7 @@ MemoryRegion *address_space_translate(AddressSpace *as, hwaddr addr, iotlb = mr->iommu_ops->translate(mr, addr, is_write); addr = ((iotlb.translated_addr & ~iotlb.addr_mask) | (addr & iotlb.addr_mask)); - len = MIN(len, (addr | iotlb.addr_mask) - addr + 1); + *plen = MIN(*plen, (addr | iotlb.addr_mask) - addr + 1); if (!(iotlb.perm & (1 << is_write))) { mr = &as->uc->io_mem_unassigned; break; @@ -365,7 +364,6 @@ MemoryRegion *address_space_translate(AddressSpace *as, hwaddr addr, as = iotlb.target_as; } - *plen = len; *xlat = addr; return mr; }