Paolo Bonzini <pbonz...@redhat.com> writes: > Il 17/07/2013 11:50, Markus Armbruster ha scritto: >> Richard Henderson <r...@twiddle.net> writes: >> >>> Honor the implementation maximum access size, and at least check >>> the minimum access size. >>> >>> Reviewed-by: Paolo Bonzini <pbonz...@redhat.com> >>> Signed-off-by: Richard Henderson <r...@twiddle.net> >> >> Fails for me: >> >> qemu-system-x86_64: /work/armbru/qemu/exec.c:1927: memory_access_size: >> Assertion `l >= access_size_min' failed. > > This: > > unsigned access_size_min = mr->ops->impl.min_access_size; > unsigned access_size_max = mr->ops->impl.max_access_size; > > must be respectively: > > unsigned access_size_min = 1; > unsigned access_size_max = mr->ops->valid.max_access_size; > > access_size_min can be 1 because erroneous accesses must not crash > QEMU, they should trigger exceptions in the guest or just return > garbage (depending on the CPU). I'm not sure I understand the comment, > placing a 4-byte field at the last byte of a region makes no sense > (unless impl.unaligned is true). > > access_size_max can be mr->ops->valid.max_access_size because memory.c > can and will still break accesses bigger than > mr->ops->impl.max_access_size. > > Markus, can you try the minimal patch above? Or this one that also > does the consequent simplifications.
FYI, the reproducer is very simple: qemu-system-x86_64 -usb Regards, Anthony Liguori > > diff --git a/exec.c b/exec.c > index c99a883..0904283 100644 > --- a/exec.c > +++ b/exec.c > @@ -1898,14 +1898,8 @@ static inline bool > memory_access_is_direct(MemoryRegion *mr, bool is_write) > > static int memory_access_size(MemoryRegion *mr, unsigned l, hwaddr addr) > { > - unsigned access_size_min = mr->ops->impl.min_access_size; > - unsigned access_size_max = mr->ops->impl.max_access_size; > + unsigned access_size_max = mr->ops->valid.max_access_size; > > - /* Regions are assumed to support 1-4 byte accesses unless > - otherwise specified. */ > - if (access_size_min == 0) { > - access_size_min = 1; > - } > if (access_size_max == 0) { > access_size_max = 4; > } > @@ -1922,9 +1916,6 @@ static int memory_access_size(MemoryRegion *mr, > unsigned l, hwaddr addr) > if (l > access_size_max) { > l = access_size_max; > } > - /* ??? The users of this function are wrong, not supporting minimums > larger > - than the remaining length. C.f. memory.c:access_with_adjusted_size. > */ > - assert(l >= access_size_min); > > return l; > } > > Paolo