From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from eggs.gnu.org ([2001:4830:134:3::10]:43603)
	by lists.gnu.org with esmtp (Exim 4.71)
	(envelope-from <aik@ozlabs.ru>) id 1WKI98-0002Mx-KB
	for Qemu-devel@nongnu.org; Sun, 02 Mar 2014 20:58:29 -0500
Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)
	(envelope-from <aik@ozlabs.ru>) id 1WKI91-00006j-AX
	for Qemu-devel@nongnu.org; Sun, 02 Mar 2014 20:58:22 -0500
Received: from mail-pd0-f177.google.com ([209.85.192.177]:33509)
	by eggs.gnu.org with esmtp (Exim 4.71)
	(envelope-from <aik@ozlabs.ru>) id 1WKI91-00006X-40
	for Qemu-devel@nongnu.org; Sun, 02 Mar 2014 20:58:15 -0500
Received: by mail-pd0-f177.google.com with SMTP id g10so3046143pdj.22
	for <Qemu-devel@nongnu.org>; Sun, 02 Mar 2014 17:58:13 -0800 (PST)
Message-ID: <5313E1AD.5050409@ozlabs.ru>
Date: Mon, 03 Mar 2014 12:58:05 +1100
From: Alexey Kardashevskiy <aik@ozlabs.ru>
MIME-Version: 1.0
References: <6777CD901FD53644B082307CD745FB8326AC9348@SACEXCMBX02-PRD.hq.netapp.com>	<530AC892.2080109@ozlabs.ru>
	<5311D2DD.4090904@ozlabs.ru> <531251CB.10102@redhat.com>
In-Reply-To: <531251CB.10102@redhat.com>
Content-Type: text/plain; charset=KOI8-R
Content-Transfer-Encoding: 7bit
Subject: Re: [Qemu-devel] e1000 memory corruption in guest OS
List-Id: <qemu-devel.nongnu.org>
List-Unsubscribe: <https://lists.nongnu.org/mailman/options/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=unsubscribe>
List-Archive: <http://lists.nongnu.org/archive/html/qemu-devel>
List-Post: <mailto:qemu-devel@nongnu.org>
List-Help: <mailto:qemu-devel-request@nongnu.org?subject=help>
List-Subscribe: <https://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=subscribe>
To: Paolo Bonzini <pbonzini@redhat.com>, "Hoyer, David" <David.Hoyer@netapp.com>, "Qemu-devel@nongnu.org" <Qemu-devel@nongnu.org>
Cc: "Moyer, Keith" <Keith.Moyer@netapp.com>, "Best,
	Tish" <Tish.Best@netapp.com>

On 03/02/2014 08:31 AM, Paolo Bonzini wrote:
> Il 01/03/2014 13:30, Alexey Kardashevskiy ha scritto:
>>> >
>>> > Corrupted DMA buffer is 0x e00000 -- 0x7f15c313f000.
>>> > The e1000 packet is at  0x12ffac2 -- 0x7f15c313eac2.
>>> >
>>> > (0x7f15c313f000 - 0x7f15c313eac2) = 0x53e which is less than 0x5aa and
>>> > (0x5aa - 0x53e) = 0x6c bytes get corrupted.
>>> >
>>> > I see here buffer overrun from e1000 and I suspect that your patch just
>>> > hides this problem. What did I miss?
>>
>> Ping, anyone?
> 
> You missed that this is a Xen-specific problem.  Xen maps things a page at
> a time, so address_space_map/unmap/rw can operate only on a small part of
> the requested [address, address+length) range.

Sorry, I am not following you here. Does KVM map things not page-aligned?


> So there is no overrun in e1000.  The patch is incomplete, because it fixes
> only address_space_rw, but the problem is indeed in exec.c.

So you know what the problem is? We have a bunch of bugreports against
e1000 breaking things...


-- 
Alexey