{"id":2221549,"url":"http://patchwork.ozlabs.org/api/1.2/patches/2221549/?format=json","web_url":"http://patchwork.ozlabs.org/project/qemu-devel/patch/20260409175334.181249-2-dblanzeanu@linux.microsoft.com/","project":{"id":14,"url":"http://patchwork.ozlabs.org/api/1.2/projects/14/?format=json","name":"QEMU Development","link_name":"qemu-devel","list_id":"qemu-devel.nongnu.org","list_email":"qemu-devel@nongnu.org","web_url":"","scm_url":"","webscm_url":"","list_archive_url":"","list_archive_url_format":"","commit_url_format":""},"msgid":"<20260409175334.181249-2-dblanzeanu@linux.microsoft.com>","list_archive_url":null,"date":"2026-04-09T17:53:34","name":"[1/1] target/i386/mshv: fix read/write memory across the page boundary","commit_ref":null,"pull_url":null,"state":"new","archived":false,"hash":"ec28c3c4dfa61e5f82c69057bedfe2d12766c892","submitter":{"id":93106,"url":"http://patchwork.ozlabs.org/api/1.2/people/93106/?format=json","name":"Doru Blânzeanu","email":"dblanzeanu@linux.microsoft.com"},"delegate":null,"mbox":"http://patchwork.ozlabs.org/project/qemu-devel/patch/20260409175334.181249-2-dblanzeanu@linux.microsoft.com/mbox/","series":[{"id":499339,"url":"http://patchwork.ozlabs.org/api/1.2/series/499339/?format=json","web_url":"http://patchwork.ozlabs.org/project/qemu-devel/list/?series=499339","date":"2026-04-09T17:53:34","name":"target/i386/mshv: fix read and write memory across the page boundary","version":1,"mbox":"http://patchwork.ozlabs.org/series/499339/mbox/"}],"comments":"http://patchwork.ozlabs.org/api/patches/2221549/comments/","check":"pending","checks":"http://patchwork.ozlabs.org/api/patches/2221549/checks/","tags":{},"related":[],"headers":{"Return-Path":"","X-Original-To":"incoming@patchwork.ozlabs.org","Delivered-To":"patchwork-incoming@legolas.ozlabs.org","Authentication-Results":["legolas.ozlabs.org;\n\tdkim=pass (1024-bit key;\n unprotected) header.d=linux.microsoft.com header.i=@linux.microsoft.com\n header.a=rsa-sha256 header.s=default header.b=G+Q6XP1W;\n\tdkim-atps=neutral","legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=nongnu.org\n (client-ip=209.51.188.17; helo=lists.gnu.org;\n envelope-from=qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org;\n receiver=patchwork.ozlabs.org)"],"Received":["from lists.gnu.org (lists1p.gnu.org [209.51.188.17])\n\t(using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits))\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4fs6xv14NTz1yHG\n\tfor ; Fri, 10 Apr 2026 03:54:11 +1000 (AEST)","from localhost ([::1] helo=lists1p.gnu.org)\n\tby lists.gnu.org with esmtp (Exim 4.90_1)\n\t(envelope-from )\n\tid 1wAtZv-0000mq-GC; Thu, 09 Apr 2026 13:54:07 -0400","from eggs.gnu.org ([2001:470:142:3::10])\n by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256)\n (Exim 4.90_1) (envelope-from )\n id 1wAtZk-0000RX-7r\n for qemu-devel@nongnu.org; Thu, 09 Apr 2026 13:53:58 -0400","from linux.microsoft.com ([13.77.154.182])\n by eggs.gnu.org with esmtp (Exim 4.90_1)\n (envelope-from ) id 1wAtZg-0006dU-O6\n for qemu-devel@nongnu.org; Thu, 09 Apr 2026 13:53:55 -0400","from laptop.localdomain (unknown [86.121.140.85])\n by linux.microsoft.com (Postfix) with ESMTPSA id A893E20B7128;\n Thu, 9 Apr 2026 10:53:49 -0700 (PDT)"],"DKIM-Filter":"OpenDKIM Filter v2.11.0 linux.microsoft.com A893E20B7128","DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.microsoft.com;\n s=default; t=1775757230;\n bh=GKviAFDCqOn49FheT3Dqs15l4v2G6x26IOu2bK6XmaI=;\n h=From:To:Cc:Subject:Date:In-Reply-To:References:From;\n b=G+Q6XP1W6jGsKW42jIz9KiEp65n/Hheq0Pk//90ykU/Y7IoB53Yz3yySXmDPrZqZG\n PIBT3RhmPuMYATBBMjx+Pt2+/NLwpti2KC4To0mgR3gGIcmyVIt+A524Ijba5NvkYB\n LDp8jHdtmHC6zcpLYj8b8jOb1J7qs+NNpXRSF/3A=","From":"=?utf-8?q?Doru_Bl=C3=A2nzeanu?= ","To":"qemu-devel@nongnu.org","Cc":"Wei Liu ,\n Magnus Kulke ","Subject":"[PATCH 1/1] target/i386/mshv: fix read/write memory across the page\n boundary","Date":"Thu, 9 Apr 2026 20:53:34 +0300","Message-ID":"<20260409175334.181249-2-dblanzeanu@linux.microsoft.com>","X-Mailer":"git-send-email 2.53.0","In-Reply-To":"<20260409175334.181249-1-dblanzeanu@linux.microsoft.com>","References":"<20260409175334.181249-1-dblanzeanu@linux.microsoft.com>","MIME-Version":"1.0","Content-Type":"text/plain; charset=UTF-8","Content-Transfer-Encoding":"8bit","Received-SPF":"pass client-ip=13.77.154.182;\n envelope-from=dblanzeanu@linux.microsoft.com; helo=linux.microsoft.com","X-Spam_score_int":"-42","X-Spam_score":"-4.3","X-Spam_bar":"----","X-Spam_report":"(-4.3 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1,\n DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3,\n RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.001,\n SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no","X-Spam_action":"no action","X-BeenThere":"qemu-devel@nongnu.org","X-Mailman-Version":"2.1.29","Precedence":"list","List-Id":"qemu development ","List-Unsubscribe":",\n ","List-Archive":"","List-Post":"","List-Help":"","List-Subscribe":",\n ","Errors-To":"qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org","Sender":"qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org"},"content":"Previously, read_memory and write_memory performed a single GVA-to-GPA\ntranslation for the entire buffer. If the buffer spanned a page\nboundary, the translated GPA was only valid for the first page, causing\nincorrect reads/writes for the remainder.\n\nFix both functions to loop over pages, translating and accessing each\npage-aligned chunk separately.\n\nSigned-off-by: Doru Blânzeanu \n---\n target/i386/mshv/mshv-cpu.c | 71 +++++++++++++++++++++++++++----------\n 1 file changed, 52 insertions(+), 19 deletions(-)","diff":"diff --git a/target/i386/mshv/mshv-cpu.c b/target/i386/mshv/mshv-cpu.c\nindex 2bc978deb2..afdb6b6e29 100644\n--- a/target/i386/mshv/mshv-cpu.c\n+++ b/target/i386/mshv/mshv-cpu.c\n@@ -1316,21 +1316,38 @@ static int read_memory(const CPUState *cpu, uint64_t initial_gva,\n {\n int ret;\n uint64_t gpa, flags;\n-\n- if (gva == initial_gva) {\n- gpa = initial_gpa;\n- } else {\n- flags = HV_TRANSLATE_GVA_VALIDATE_READ;\n- ret = translate_gva(cpu, gva, &gpa, flags);\n- if (ret < 0) {\n- return -1;\n+ uint64_t cur_gva = gva;\n+ size_t page_left, chunk;\n+ uint8_t *cur_data = data;\n+\n+ /*\n+ * If the read spans multiple pages,\n+ * we need to translate and read each page separately\n+ */\n+ while (len > 0) {\n+ page_left = HV_HYP_PAGE_SIZE - (cur_gva & (HV_HYP_PAGE_SIZE - 1));\n+ chunk = MIN(len, page_left);\n+\n+ if (cur_gva == initial_gva) {\n+ gpa = initial_gpa;\n+ } else {\n+ flags = HV_TRANSLATE_GVA_VALIDATE_READ;\n+ ret = translate_gva(cpu, cur_gva, &gpa, flags);\n+ if (ret < 0) {\n+ return -1;\n+ }\n }\n \n- ret = mshv_guest_mem_read(gpa, data, len, false, false);\n+ ret = mshv_guest_mem_read(gpa, cur_data, chunk,\n+ false, false);\n if (ret < 0) {\n error_report(\"failed to read guest mem\");\n return -1;\n }\n+\n+ cur_gva += chunk;\n+ cur_data += chunk;\n+ len -= chunk;\n }\n \n return 0;\n@@ -1341,18 +1358,34 @@ static int write_memory(const CPUState *cpu, uint64_t gva, const uint8_t *data,\n {\n int ret;\n uint64_t gpa, flags;\n+ uint64_t cur_gva = gva;\n+ size_t page_left, chunk;\n+ const uint8_t *cur_data = data;\n+\n+ /*\n+ * If the write spans multiple pages,\n+ * we need to translate and write each page separately\n+ */\n+ while (len > 0) {\n+ page_left = HV_HYP_PAGE_SIZE - (cur_gva & (HV_HYP_PAGE_SIZE - 1));\n+ chunk = MIN(len, page_left);\n+\n+ flags = HV_TRANSLATE_GVA_VALIDATE_WRITE;\n+ ret = translate_gva(cpu, cur_gva, &gpa, flags);\n+ if (ret < 0) {\n+ error_report(\"failed to translate gva to gpa\");\n+ return -1;\n+ }\n \n- flags = HV_TRANSLATE_GVA_VALIDATE_WRITE;\n- ret = translate_gva(cpu, gva, &gpa, flags);\n- if (ret < 0) {\n- error_report(\"failed to translate gva to gpa\");\n- return -1;\n- }\n+ ret = mshv_guest_mem_write(gpa, cur_data, chunk, false);\n+ if (ret != MEMTX_OK) {\n+ error_report(\"failed to write to mmio\");\n+ return -1;\n+ }\n \n- ret = mshv_guest_mem_write(gpa, data, len, false);\n- if (ret != MEMTX_OK) {\n- error_report(\"failed to write to mmio\");\n- return -1;\n+ cur_gva += chunk;\n+ cur_data += chunk;\n+ len -= chunk;\n }\n \n return 0;\n","prefixes":["1/1"]}