From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:49776) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1WKaUZ-0005dc-OT for Qemu-devel@nongnu.org; Mon, 03 Mar 2014 16:33:50 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1WKaUT-0005ry-0T for Qemu-devel@nongnu.org; Mon, 03 Mar 2014 16:33:43 -0500 Received: from omzsmtpe04.verizonbusiness.com ([199.249.25.207]:31241) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1WKaUS-0005qs-PP for Qemu-devel@nongnu.org; Mon, 03 Mar 2014 16:33:36 -0500 From: Don Slutz Message-ID: <5314F52B.4070101@terremark.com> Date: Mon, 03 Mar 2014 16:33:31 -0500 MIME-Version: 1.0 References: <6777CD901FD53644B082307CD745FB8326AC9348@SACEXCMBX02-PRD.hq.netapp.com> <530AC892.2080109@ozlabs.ru> <5311D2DD.4090904@ozlabs.ru> <531251CB.10102@redhat.com> <5313E1AD.5050409@ozlabs.ru> <53143E50.5060205@redhat.com> <53145DD4.4040101@ozlabs.ru> In-Reply-To: <53145DD4.4040101@ozlabs.ru> Content-Type: text/plain; charset=KOI8-R; format=flowed Content-Transfer-Encoding: 7bit Subject: Re: [Qemu-devel] e1000 memory corruption in guest OS List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Alexey Kardashevskiy , Paolo Bonzini , "Hoyer, David" , "Qemu-devel@nongnu.org" Cc: "Moyer, Keith" , "Best, Tish" On 03/03/14 05:47, Alexey Kardashevskiy wrote: > On 03/03/2014 07:33 PM, Paolo Bonzini wrote: >> Il 03/03/2014 02:58, Alexey Kardashevskiy ha scritto: >>> On 03/02/2014 08:31 AM, Paolo Bonzini wrote: >>>> Il 01/03/2014 13:30, Alexey Kardashevskiy ha scritto: >>>>>>> Corrupted DMA buffer is 0x e00000 -- 0x7f15c313f000. >>>>>>> The e1000 packet is at 0x12ffac2 -- 0x7f15c313eac2. >>>>>>> >>>>>>> (0x7f15c313f000 - 0x7f15c313eac2) = 0x53e which is less than 0x5aa and >>>>>>> (0x5aa - 0x53e) = 0x6c bytes get corrupted. >>>>>>> >>>>>>> I see here buffer overrun from e1000 and I suspect that your patch just >>>>>>> hides this problem. What did I miss? >>>>> Ping, anyone? >>>> You missed that this is a Xen-specific problem. Xen maps things a page at >>>> a time, so address_space_map/unmap/rw can operate only on a small part of >>>> the requested [address, address+length) range. >>> Sorry, I am not following you here. Does KVM map things not page-aligned? >> Look in exec.c for xen_enabled(). Xen's implementation of >> address_space_map/unmap is completely different. > Honestly cannot see much difference in the current QEMU... > >>>> So there is no overrun in e1000. The patch is incomplete, because it fixes >>>> only address_space_rw, but the problem is indeed in exec.c. >>> So you know what the problem is? We have a bunch of bugreports against >>> e1000 breaking things... >> This one had been reported and fixed already. > Any hint? :) Could not spot any related to overrun except: > a0ae17a 8 months ago Andrew Jones e1000: cleanup process_tx_desc > but commit message says "complaints are false positives"... > > Looks like you have also ignored: http://marc.info/?l=qemu-devel&m=139325054822857&w=2 http://marc.info/?l=qemu-devel&m=139325135123159&w=2 -Don Slutz