--- a/exec.c
+++ b/exec.c
@@ -380,7 +380,6 @@?MemoryRegion?*address_space_translate(AddressSpace?*as,?hwaddr?addr,
?????IOMMUTLBEntry?iotlb;
?????MemoryRegionSection?*section;
?????MemoryRegion?*mr;
-????hwaddr?len?=?*plen;
?
?????rcu_read_lock();
?????for?(;;)?{
@@ -395,7 +394,7 @@?MemoryRegion?*address_space_translate(AddressSpace?*as,?hwaddr?addr,
?????????iotlb?=?mr->iommu_ops->translate(mr,?addr,?is_write);
?????????addr?=?((iotlb.translated_addr?&?~iotlb.addr_mask)
?????????????????|?(addr?&?iotlb.addr_mask));
-????????len?=?MIN(len,?(addr?|?iotlb.addr_mask)?-?addr?+?1);
+????????*plen?=?MIN(*plen,?(addr?|?iotlb.addr_mask)?-?addr?+?1);
?????????if?(!(iotlb.perm?&?(1?<<?is_write)))?{
?????????????mr?=?&io_mem_unassigned;
?????????????break;
@@ -406,10 +405,9 @@?MemoryRegion?*address_space_translate(AddressSpace?*as,?hwaddr?addr,
?
?????if?(xen_enabled()?&&?memory_access_is_direct(mr,?is_write))?{
?????????hwaddr?page?=?((addr?&?TARGET_PAGE_MASK)?+?TARGET_PAGE_SIZE)?-?addr;
-????????len?=?MIN(page,?len);
+????????*plen?=?MIN(page,?*plen);
?????}
?
-????*plen?=?len;
?????*xlat?=?addr;
?????rcu_read_unlock();
?????return?mr;