From nobody Sat Apr 11 17:03:02 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=none dis=none) header.from=linux.microsoft.com ARC-Seal: i=1; a=rsa-sha256; t=1775757249; cv=none; d=zohomail.com; s=zohoarc; b=nDZukJoPWPZelgPNHI/oRG5VuFnW46mRDrM43t4Ea9AkUDR94IWwB0p6AozfGAN5PamhYbmt80NC9rCt066LlceTkU7E/VRCXmS14zEx3E/N0xKUbgHCH1wRkpcFSc91I5yT7CSCqBY7nm8f3HfBoj+RhmMK+ESRkQ2dRKTcoQY= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1775757249; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=GKviAFDCqOn49FheT3Dqs15l4v2G6x26IOu2bK6XmaI=; b=doy7xiD2BE1cIkVMILoFsrN4sVMFYWAdiyP/2EcIUDfj6q3eVwSARc+J15JnTkCfitxRV0zOX86ipVoIeVwZUwzGgO/Ok41crVqzrHhzhGbZ+m/A13TapWtDu8Gfn8meRXIw1oCVNF/y8EAz6KjvnPUgZmnNMj6Q5eNpI5BmYNI= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=none dis=none) Return-Path: Received: from lists.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1775757249909507.49047157864186; Thu, 9 Apr 2026 10:54:09 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wAtZv-0000mq-GC; Thu, 09 Apr 2026 13:54:07 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wAtZk-0000RX-7r for qemu-devel@nongnu.org; Thu, 09 Apr 2026 13:53:58 -0400 Received: from linux.microsoft.com ([13.77.154.182]) by eggs.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wAtZg-0006dU-O6 for qemu-devel@nongnu.org; Thu, 09 Apr 2026 13:53:55 -0400 Received: from laptop.localdomain (unknown [86.121.140.85]) by linux.microsoft.com (Postfix) with ESMTPSA id A893E20B7128; Thu, 9 Apr 2026 10:53:49 -0700 (PDT) DKIM-Filter: OpenDKIM Filter v2.11.0 linux.microsoft.com A893E20B7128 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.microsoft.com; s=default; t=1775757230; bh=GKviAFDCqOn49FheT3Dqs15l4v2G6x26IOu2bK6XmaI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=G+Q6XP1W6jGsKW42jIz9KiEp65n/Hheq0Pk//90ykU/Y7IoB53Yz3yySXmDPrZqZG PIBT3RhmPuMYATBBMjx+Pt2+/NLwpti2KC4To0mgR3gGIcmyVIt+A524Ijba5NvkYB LDp8jHdtmHC6zcpLYj8b8jOb1J7qs+NNpXRSF/3A= From: =?UTF-8?q?Doru=20Bl=C3=A2nzeanu?= To: qemu-devel@nongnu.org Cc: Wei Liu , Magnus Kulke Subject: [PATCH 1/1] target/i386/mshv: fix read/write memory across the page boundary Date: Thu, 9 Apr 2026 20:53:34 +0300 Message-ID: <20260409175334.181249-2-dblanzeanu@linux.microsoft.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260409175334.181249-1-dblanzeanu@linux.microsoft.com> References: <20260409175334.181249-1-dblanzeanu@linux.microsoft.com> MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=13.77.154.182; envelope-from=dblanzeanu@linux.microsoft.com; helo=linux.microsoft.com X-Spam_score_int: -42 X-Spam_score: -4.3 X-Spam_bar: ---- X-Spam_report: (-4.3 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @linux.microsoft.com) X-ZM-MESSAGEID: 1775757251073158500 Previously, read_memory and write_memory performed a single GVA-to-GPA translation for the entire buffer. If the buffer spanned a page boundary, the translated GPA was only valid for the first page, causing incorrect reads/writes for the remainder. Fix both functions to loop over pages, translating and accessing each page-aligned chunk separately. Signed-off-by: Doru Bl=C3=A2nzeanu Reviewed-by: Magnus Kulke Reviewed-by: Mohamed Mediouni --- target/i386/mshv/mshv-cpu.c | 71 +++++++++++++++++++++++++++---------- 1 file changed, 52 insertions(+), 19 deletions(-) diff --git a/target/i386/mshv/mshv-cpu.c b/target/i386/mshv/mshv-cpu.c index 2bc978deb2..afdb6b6e29 100644 --- a/target/i386/mshv/mshv-cpu.c +++ b/target/i386/mshv/mshv-cpu.c @@ -1316,21 +1316,38 @@ static int read_memory(const CPUState *cpu, uint64_= t initial_gva, { int ret; uint64_t gpa, flags; - - if (gva =3D=3D initial_gva) { - gpa =3D initial_gpa; - } else { - flags =3D HV_TRANSLATE_GVA_VALIDATE_READ; - ret =3D translate_gva(cpu, gva, &gpa, flags); - if (ret < 0) { - return -1; + uint64_t cur_gva =3D gva; + size_t page_left, chunk; + uint8_t *cur_data =3D data; + + /* + * If the read spans multiple pages, + * we need to translate and read each page separately + */ + while (len > 0) { + page_left =3D HV_HYP_PAGE_SIZE - (cur_gva & (HV_HYP_PAGE_SIZE - 1)= ); + chunk =3D MIN(len, page_left); + + if (cur_gva =3D=3D initial_gva) { + gpa =3D initial_gpa; + } else { + flags =3D HV_TRANSLATE_GVA_VALIDATE_READ; + ret =3D translate_gva(cpu, cur_gva, &gpa, flags); + if (ret < 0) { + return -1; + } } =20 - ret =3D mshv_guest_mem_read(gpa, data, len, false, false); + ret =3D mshv_guest_mem_read(gpa, cur_data, chunk, + false, false); if (ret < 0) { error_report("failed to read guest mem"); return -1; } + + cur_gva +=3D chunk; + cur_data +=3D chunk; + len -=3D chunk; } =20 return 0; @@ -1341,18 +1358,34 @@ static int write_memory(const CPUState *cpu, uint64= _t gva, const uint8_t *data, { int ret; uint64_t gpa, flags; + uint64_t cur_gva =3D gva; + size_t page_left, chunk; + const uint8_t *cur_data =3D data; + + /* + * If the write spans multiple pages, + * we need to translate and write each page separately + */ + while (len > 0) { + page_left =3D HV_HYP_PAGE_SIZE - (cur_gva & (HV_HYP_PAGE_SIZE - 1)= ); + chunk =3D MIN(len, page_left); + + flags =3D HV_TRANSLATE_GVA_VALIDATE_WRITE; + ret =3D translate_gva(cpu, cur_gva, &gpa, flags); + if (ret < 0) { + error_report("failed to translate gva to gpa"); + return -1; + } =20 - flags =3D HV_TRANSLATE_GVA_VALIDATE_WRITE; - ret =3D translate_gva(cpu, gva, &gpa, flags); - if (ret < 0) { - error_report("failed to translate gva to gpa"); - return -1; - } + ret =3D mshv_guest_mem_write(gpa, cur_data, chunk, false); + if (ret !=3D MEMTX_OK) { + error_report("failed to write to mmio"); + return -1; + } =20 - ret =3D mshv_guest_mem_write(gpa, data, len, false); - if (ret !=3D MEMTX_OK) { - error_report("failed to write to mmio"); - return -1; + cur_gva +=3D chunk; + cur_data +=3D chunk; + len -=3D chunk; } =20 return 0; --=20 2.53.0