Re: Data corruption in guest using KVM

[Aurelien Jarno <aurelien-rXXEIb44qovR7s880joybQ@public.gmane.org>]

On Sun, Jul 22, 2007 at 08:34:37PM +0300, Avi Kivity wrote:
> Aurelien Jarno wrote:
> > On Sun, Jul 22, 2007 at 04:46:19PM +0300, Avi Kivity wrote:
> >   
> >> If you do happen to get a same-size corruption, that may tell us more.
> >>
> >>     
> >
> > I have just got one same-size corruption building glibc 2.6 on 
> > GNU/kFreeBSD i386 (32-bit nonpae).
> >
> > One byte at address 0x9000 has been replaced by 0x00. Please find the
> > good and the bad file attached.
> >
> >   
> 
> Good.  We have one or two cross-page-boundary bugs.  The
> corruption-chase branch already fixes one (which is much more likely to
> be triggered by FreeBSD than Linux, if I understand the FreeBSD VM
> correctly).
> 

I have tried this branch, and the data get corrupted another way. This
is due to the fact that the source address is not incremented for the
second write. The patch below fixes that.

With this patch, I haven't be able to make any corruption. I have added
a printk in the code to see that I have been able to trigger 21 
cross-boundary writes without any problem in the various guests.

So I think this bug is now fixed. Thanks for your help.

Aurelien


Signed-off-by: Aurelien Jarno <aurelien-rXXEIb44qovR7s880joybQ@public.gmane.org>

diff --git a/drivers/kvm/kvm_main.c b/drivers/kvm/kvm_main.c
index 5b317c1..e7c9ca7 100644
--- a/drivers/kvm/kvm_main.c
+++ b/drivers/kvm/kvm_main.c
@@ -1141,6 +1141,7 @@ static int emulator_write_emulated(unsigned long addr,
 		if (rc != X86EMUL_CONTINUE)
 			return rc;
 		addr += now;
+		val += now;
 		bytes -= now;
 	}
 	return emulator_write_emulated_onepage(addr, val, bytes, ctxt);


-- 
  .''`.  Aurelien Jarno	            | GPG: 1024D/F1BCDB73
 : :' :  Debian developer           | Electrical Engineer
 `. `'   aurel32-8fiUuRrzOP0dnm+yROfE0A@public.gmane.org         | aurelien-rXXEIb44qovR7s880joybQ@public.gmane.org
   `-    people.debian.org/~aurel32 | www.aurel32.net

-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems?  Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >>  http://get.splunk.com/