From 39e85ce4d59eb5747cdc466209e2649926125649 Mon Sep 17 00:00:00 2001 From: aurel32 <aurel32> Date: Wed, 18 Feb 2009 21:37:17 +0000 Subject: [PATCH 1/8] Fix cpu_physical_memory_rw() for 64-bit I/O accesses KVM uses cpu_physical_memory_rw() to access the I/O devices. When a read or write with a length of 8-byte is requested, it is split into 2 4-byte accesses. This has been broken in revision 5849. After this revision, only the first 4 bytes are actually read/write to the device, as the target address is changed, so on the next iteration of the loop the next 4 bytes are actually read/written elsewhere (in the RAM for the graphic card). This patch fixes screen corruption (and most probably data corruption) with FreeBSD/amd64. Bug #2556746 in KVM bugzilla. Signed-off-by: Aurelien Jarno <aurelien@aurel32.net> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com> RH-Upstream-status: applied(kvm/master), applied(qemu) Bugzilla: 488135 Acked-by: Glauber Costa <glommer@redhat.com> Acked-by: Gleb Natapov <gleb@redhat.com> --- qemu/exec.c | 26 ++++++++++++++------------ 1 files changed, 14 insertions(+), 12 deletions(-) diff --git a/qemu/exec.c b/qemu/exec.c index 545e864..4f83643 100644 --- a/qemu/exec.c +++ b/qemu/exec.c @@ -2970,25 +2970,26 @@ void cpu_physical_memory_rw(target_phys_addr_t addr, uint8_t *buf, if (is_write) { if ((pd & ~TARGET_PAGE_MASK) != IO_MEM_RAM) { + target_phys_addr_t addr1 = addr; io_index = (pd >> IO_MEM_SHIFT) & (IO_MEM_NB_ENTRIES - 1); if (p) - addr = (addr & ~TARGET_PAGE_MASK) + p->region_offset; + addr1 = (addr & ~TARGET_PAGE_MASK) + p->region_offset; /* XXX: could force cpu_single_env to NULL to avoid potential bugs */ - if (l >= 4 && ((addr & 3) == 0)) { + if (l >= 4 && ((addr1 & 3) == 0)) { /* 32 bit write access */ val = ldl_p(buf); - io_mem_write[io_index][2](io_mem_opaque[io_index], addr, val); + io_mem_write[io_index][2](io_mem_opaque[io_index], addr1, val); l = 4; - } else if (l >= 2 && ((addr & 1) == 0)) { + } else if (l >= 2 && ((addr1 & 1) == 0)) { /* 16 bit write access */ val = lduw_p(buf); - io_mem_write[io_index][1](io_mem_opaque[io_index], addr, val); + io_mem_write[io_index][1](io_mem_opaque[io_index], addr1, val); l = 2; } else { /* 8 bit write access */ val = ldub_p(buf); - io_mem_write[io_index][0](io_mem_opaque[io_index], addr, val); + io_mem_write[io_index][0](io_mem_opaque[io_index], addr1, val); l = 1; } } else { @@ -3013,23 +3014,24 @@ void cpu_physical_memory_rw(target_phys_addr_t addr, uint8_t *buf, } else { if ((pd & ~TARGET_PAGE_MASK) > IO_MEM_ROM && !(pd & IO_MEM_ROMD)) { + target_phys_addr_t addr1 = addr; /* I/O case */ io_index = (pd >> IO_MEM_SHIFT) & (IO_MEM_NB_ENTRIES - 1); if (p) - addr = (addr & ~TARGET_PAGE_MASK) + p->region_offset; - if (l >= 4 && ((addr & 3) == 0)) { + addr1 = (addr & ~TARGET_PAGE_MASK) + p->region_offset; + if (l >= 4 && ((addr1 & 3) == 0)) { /* 32 bit read access */ - val = io_mem_read[io_index][2](io_mem_opaque[io_index], addr); + val = io_mem_read[io_index][2](io_mem_opaque[io_index], addr1); stl_p(buf, val); l = 4; - } else if (l >= 2 && ((addr & 1) == 0)) { + } else if (l >= 2 && ((addr1 & 1) == 0)) { /* 16 bit read access */ - val = io_mem_read[io_index][1](io_mem_opaque[io_index], addr); + val = io_mem_read[io_index][1](io_mem_opaque[io_index], addr1); stw_p(buf, val); l = 2; } else { /* 8 bit read access */ - val = io_mem_read[io_index][0](io_mem_opaque[io_index], addr); + val = io_mem_read[io_index][0](io_mem_opaque[io_index], addr1); stb_p(buf, val); l = 1; } -- 1.6.1