Re: [Qemu-devel] e1000 memory corruption in guest OS

[Alexey Kardashevskiy]

On 03/02/2014 08:31 AM, Paolo Bonzini wrote:
> Il 01/03/2014 13:30, Alexey Kardashevskiy ha scritto:
>>> >
>>> > Corrupted DMA buffer is 0x e00000 -- 0x7f15c313f000.
>>> > The e1000 packet is at  0x12ffac2 -- 0x7f15c313eac2.
>>> >
>>> > (0x7f15c313f000 - 0x7f15c313eac2) = 0x53e which is less than 0x5aa and
>>> > (0x5aa - 0x53e) = 0x6c bytes get corrupted.
>>> >
>>> > I see here buffer overrun from e1000 and I suspect that your patch just
>>> > hides this problem. What did I miss?
>>
>> Ping, anyone?
> 
> You missed that this is a Xen-specific problem.  Xen maps things a page at
> a time, so address_space_map/unmap/rw can operate only on a small part of
> the requested [address, address+length) range.

Sorry, I am not following you here. Does KVM map things not page-aligned?


> So there is no overrun in e1000.  The patch is incomplete, because it fixes
> only address_space_rw, but the problem is indeed in exec.c.

So you know what the problem is? We have a bunch of bugreports against
e1000 breaking things...


-- 
Alexey