From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from eggs.gnu.org ([2001:4830:134:3::10]:58400)
	by lists.gnu.org with esmtp (Exim 4.71)
	(envelope-from <pbonzini@redhat.com>) id 1V3l5E-00019I-RZ
	for qemu-devel@nongnu.org; Mon, 29 Jul 2013 06:53:50 -0400
Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)
	(envelope-from <pbonzini@redhat.com>) id 1V3l58-0001Ep-TK
	for qemu-devel@nongnu.org; Mon, 29 Jul 2013 06:53:44 -0400
Received: from mx1.redhat.com ([209.132.183.28]:63112)
	by eggs.gnu.org with esmtp (Exim 4.71)
	(envelope-from <pbonzini@redhat.com>) id 1V3l58-0001Ej-Ll
	for qemu-devel@nongnu.org; Mon, 29 Jul 2013 06:53:38 -0400
Message-ID: <51F6499E.3090306@redhat.com>
Date: Mon, 29 Jul 2013 12:53:18 +0200
From: Paolo Bonzini <pbonzini@redhat.com>
MIME-Version: 1.0
References: <87zjtcw9c6.fsf@iit.kharkov.ua>
	<20130729085008.GE26410@stefanha-thinkpad.redhat.com>
In-Reply-To: <20130729085008.GE26410@stefanha-thinkpad.redhat.com>
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Subject: Re: [Qemu-devel] qemu git (f03d07d46) / e100 / sending large
 packets causes SIGABRT
List-Id: <qemu-devel.nongnu.org>
List-Unsubscribe: <https://lists.nongnu.org/mailman/options/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=unsubscribe>
List-Archive: <http://lists.nongnu.org/archive/html/qemu-devel>
List-Post: <mailto:qemu-devel@nongnu.org>
List-Help: <mailto:qemu-devel-request@nongnu.org?subject=help>
List-Subscribe: <https://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=subscribe>
To: Stefan Hajnoczi <stefanha@gmail.com>
Cc: Oleksii Shevchuk <alxchk@gmail.com>, qemu-devel Developers <qemu-devel@nongnu.org>

Il 29/07/2013 10:50, Stefan Hajnoczi ha scritto:
> There are only a few bytes remaining: len=0x3.  The abort(3) comes from address_space_rw():
> 
> if (!memory_access_is_direct(mr, is_write)) {
>     /* I/O case */
>     l = memory_access_size(mr, l, addr1);
>     switch (l) {
>     case 8:
>         ...
>     case 4:
>         ...
>     case 2:
>         ...
>     case 1:
>         ...
>     default:
>         abort();  <-- we abort here
> }
> 
> Paolo: Do you know how the memory API is supposed to work here?

The problem is introduced by commit 2332616 (exec: Support 64-bit
operations in address_space_rw, 2013-07-08).  Before that commit,
memory_access_size would only return 1/2/4.  The following should help:

diff --git a/exec.c b/exec.c
index 7997002..7686c15 100644
--- a/exec.c
+++ b/exec.c
@@ -1922,6 +1922,9 @@ static int memory_access_size(MemoryRegion *mr,
unsigned l, hwaddr addr)
     if (l > access_size_max) {
         l = access_size_max;
     }
+    if (l & (l - 1)) {
+        l = 1 << (qemu_fls(l) - 1);
+    }

     return l;
 }


Paolo