Re: [Qemu-devel] e1000 memory corruption in guest OS

[Paolo Bonzini]

Il 01/03/2014 13:30, Alexey Kardashevskiy ha scritto:
> > >
> > > Corrupted DMA buffer is 0x e00000 -- 0x7f15c313f000.
> > > The e1000 packet is at  0x12ffac2 -- 0x7f15c313eac2.
> > >
> > > (0x7f15c313f000 - 0x7f15c313eac2) = 0x53e which is less than 0x5aa and
> > > (0x5aa - 0x53e) = 0x6c bytes get corrupted.
> > >
> > > I see here buffer overrun from e1000 and I suspect that your patch just
> > > hides this problem. What did I miss?
>
> Ping, anyone?

You missed that this is a Xen-specific problem.  Xen maps things a page 
at a time, so address_space_map/unmap/rw can operate only on a small 
part of the requested [address, address+length) range.

So there is no overrun in e1000.  The patch is incomplete, because it 
fixes only address_space_rw, but the problem is indeed in exec.c.

Paolo