The attached patch corrects a bug in qemu/slirp/tcp_var.h that defines the seg_next field in struct tcpcb to be 32 bits wide regardless of 32/64-bitness. seg_next is assigned a pointer value in qemu/slirp/tcp_subr.c, then cast back to a pointer in qemu/slirp/tcp_input.c and dereferenced. That produces a SIGSEGV on my system.
For more information, see the thread "[ 1881532 ] Network access seg faults KVM on large-memory machine" on the KVM Bugs page on SourceForge (http://tinyurl.com/2fxfbx). Regards, -- Scott P.S. Note: This message was sent to both qemu-devel and kvm-devel.
--- qemu/slirp/tcp_var.h.ORIG 2008-01-28 17:27:09.000000000 -0700 +++ qemu/slirp/tcp_var.h 2008-01-28 17:27:20.000000000 -0700 @@ -40,11 +40,7 @@ #include "tcpip.h" #include "tcp_timer.h" -#if SIZEOF_CHAR_P == 4 - typedef struct tcpiphdr *tcpiphdrp_32; -#else - typedef u_int32_t tcpiphdrp_32; -#endif +typedef struct tcpiphdr *tcpiphdrp_32; /* * Tcp control block, one per tcp; fields:
