Re: [Qemu-devel] [PATCH 04/11] exec: introduce MemoryRegionCache

[Stefan Hajnoczi <stefanha@redhat.com>]

[-- Attachment #1: Type: text/plain, Size: 1562 bytes --]

On Mon, Dec 12, 2016 at 12:18:50PM +0100, Paolo Bonzini wrote:
> diff --git a/exec.c b/exec.c
> index d4b3656..8d4bb0e 100644
> --- a/exec.c
> +++ b/exec.c
> @@ -3077,6 +3077,82 @@ void cpu_physical_memory_unmap(void *buffer, hwaddr len,
>  #define RCU_READ_UNLOCK(...)     rcu_read_unlock()
>  #include "memory_ldst.inc.c"
>  
> +int64_t address_space_cache_init(MemoryRegionCache *cache,
> +                                 AddressSpace *as,
> +                                 hwaddr addr,
> +                                 hwaddr len,
> +                                 bool is_write)
> +{
> +    hwaddr l, xlat;
> +    MemoryRegion *mr;
> +    void *ptr;
> +
> +    assert(len > 0);
> +
> +    l = len;
> +    mr = address_space_translate(as, addr, &xlat, &l, is_write);
> +    if (!memory_access_is_direct(mr, is_write)) {
> +        return -EINVAL;
> +    }
> +
> +    l = address_space_extend_translation(as, addr, len, mr, xlat, l, is_write);
> +    ptr = qemu_ram_ptr_length(mr->ram_block, xlat, &l);
> +
> +    cache->xlat = xlat;
> +    cache->is_write = is_write;
> +    cache->mr = mr;
> +    cache->ptr = ptr;
> +    cache->len = l;
> +    memory_region_ref(cache->mr);
> +
> +    return l;
> +}

What happens when [addr, addr + len) overlaps a MemoryRegion boundary?
It looks like this function silently truncates the MemoryRegionCache,
leading to an assertion failure in address_space_translate_cached().

Perhaps it would be better to fail address_space_cache_init() if the
length is truncated.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 455 bytes --]