From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:51412) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1VHdBm-0001VP-QW for qemu-devel@nongnu.org; Thu, 05 Sep 2013 13:17:56 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1VHdBg-0000r9-Hx for qemu-devel@nongnu.org; Thu, 05 Sep 2013 13:17:50 -0400 Sender: Paolo Bonzini From: Paolo Bonzini Date: Thu, 5 Sep 2013 19:17:31 +0200 Message-Id: <1378401455-583-2-git-send-email-pbonzini@redhat.com> In-Reply-To: <1378401455-583-1-git-send-email-pbonzini@redhat.com> References: <1378401455-583-1-git-send-email-pbonzini@redhat.com> Subject: [Qemu-devel] [PULL 1/5] exec: fix writing to MMIO area with non-power-of-two length List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, anthony@codemonkey.ws The problem is introduced by commit 2332616 (exec: Support 64-bit operations in address_space_rw, 2013-07-08). Before that commit, memory_access_size would only return 1/2/4. Since alignment is already handled above, reduce l to the largest power of two that is smaller than l. Cc: qemu-stable@nongnu.org Reported-by: Oleksii Shevchuk Tested-by: Oleksii Shevchuk Signed-off-by: Paolo Bonzini --- exec.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/exec.c b/exec.c index 87b0b39..b52ec80 100644 --- a/exec.c +++ b/exec.c @@ -1913,6 +1913,9 @@ static int memory_access_size(MemoryRegion *mr, unsigned l, hwaddr addr) if (l > access_size_max) { l = access_size_max; } + if (l & (l - 1)) { + l = 1 << (qemu_fls(l) - 1); + } return l; } -- 1.8.3.1