[Qemu-devel] [PATCH] Fix regression introduced by 6398

[Qemu-devel] [PATCH] Fix regression introduced by 6398

[Eduardo Felipe]

Hi,

After commit 6398 some of my guests started to SEGFAULT at boot time.
Reverting these two lines fixes the problem for me:

signed-off-by: Eduardo Felipe <edusaper@gmail.com>

--- a/hw/ide.c    Fri Jan 30 21:15:15 2009
+++ b/hw/ide.c    Fri Jan 30 21:13:49 2009
@@ -1084,7 +1084,7 @@
 #ifdef DEBUG_AIO
     printf("aio_read: sector_num=%" PRId64 " n=%d\n", sector_num, n);
 #endif
-    bm->aiocb = bdrv_aio_readv(s->bs, sector_num, &s->iovec, n,
+    bm->aiocb = bdrv_aio_read(s->bs, sector_num, s->io_buffer, n,
                                ide_read_dma_cb, bm);
     ide_dma_submit_check(s, ide_read_dma_cb, bm);
 }
@@ -1212,7 +1212,7 @@
 #ifdef DEBUG_AIO
     printf("aio_write: sector_num=%" PRId64 " n=%d\n", sector_num, n);
 #endif
-    bm->aiocb = bdrv_aio_writev(s->bs, sector_num, &s->iovec, n,
+    bm->aiocb = bdrv_aio_write(s->bs, sector_num, s->io_buffer, n,
                                 ide_write_dma_cb, bm);
     ide_dma_submit_check(s, ide_write_dma_cb, bm);
 }


Can anybody take a look at it?

Thanks,
Edu

[Qemu-devel] Re: [PATCH] Fix regression introduced by 6398

[Eduardo Felipe]

2009/1/30 Eduardo Felipe <edusaper@gmail.com>:
> Hi,
>
> After commit 6398 some of my guests started to SEGFAULT at boot time.
> Reverting these two lines fixes the problem for me:
>
> signed-off-by: Eduardo Felipe <edusaper@gmail.com>
>
> --- a/hw/ide.c    Fri Jan 30 21:15:15 2009
> +++ b/hw/ide.c    Fri Jan 30 21:13:49 2009
> @@ -1084,7 +1084,7 @@
>  #ifdef DEBUG_AIO
>     printf("aio_read: sector_num=%" PRId64 " n=%d\n", sector_num, n);
>  #endif
> -    bm->aiocb = bdrv_aio_readv(s->bs, sector_num, &s->iovec, n,
> +    bm->aiocb = bdrv_aio_read(s->bs, sector_num, s->io_buffer, n,
>                                ide_read_dma_cb, bm);
>     ide_dma_submit_check(s, ide_read_dma_cb, bm);
>  }
> @@ -1212,7 +1212,7 @@
>  #ifdef DEBUG_AIO
>     printf("aio_write: sector_num=%" PRId64 " n=%d\n", sector_num, n);
>  #endif
> -    bm->aiocb = bdrv_aio_writev(s->bs, sector_num, &s->iovec, n,
> +    bm->aiocb = bdrv_aio_write(s->bs, sector_num, s->io_buffer, n,
>                                 ide_write_dma_cb, bm);
>     ide_dma_submit_check(s, ide_write_dma_cb, bm);
>  }
>
>
> Can anybody take a look at it?
>
> Thanks,
> Edu
>

Please, ignore my previous mail.

I traced the problem to the qemu_free call in bdrv_aio_rw_vector_cb.
It fails when s->bounce is exactly 65536 bytes long  (128 sectors).
This change seems to do the trick:

--- a/block.c	Sun Feb 01 22:25:18 2009
+++ b/block.c	Sun Feb 01 22:24:00 2009
@@ -1286,7 +1286,7 @@

     s->this_aiocb = aiocb;
     s->iov = iov;
-    s->bounce = qemu_memalign(512, nb_sectors * 512);
+    s->bounce = qemu_memalign(512, nb_sectors * 512 + 4);
     s->is_write = is_write;
     if (is_write) {
         qemu_iovec_to_buffer(s->iov, s->bounce);


I've seen a similar hack in ide_init2 when calling qemu_memalign. Are
these four bytes used in any way or it's just a way to avoid
allocating exactly a 64k multiple buffer?

My host is Win32. Can anybody confirm if this happens in any other platform?

Regards,
Edu