Re: [qemu-s390x] [PATCH v1 1/1] s390x: fix storage attributes migration for non-small guests

[Claudio Imbrenda]

On Thu, 18 Jan 2018 17:20:34 +0100
Cornelia Huck <address@hidden> wrote:

> On Mon, 15 Jan 2018 17:52:02 +0100
> Claudio Imbrenda <address@hidden> wrote:
> 
> > Fix storage attribute migration so that it does not fail for guests
> > with more than a few GB of RAM. Migration itself was successful, but
> > storage attributes were not migrated completely.
> > 
> > This patch fixes the migration of all storage attributes, even when
> > the guest have large amounts of memory.
> > 
> > Signed-off-by: Claudio Imbrenda <address@hidden>
> > Fixes: 903fd80b03243476 ("s390x/migration: Storage attributes
> > device") ---
> >  hw/s390x/s390-stattrib-kvm.c | 4 ++--
> >  1 file changed, 2 insertions(+), 2 deletions(-)
> > 
> > diff --git a/hw/s390x/s390-stattrib-kvm.c
> > b/hw/s390x/s390-stattrib-kvm.c index 41770a7..480551c 100644
> > --- a/hw/s390x/s390-stattrib-kvm.c
> > +++ b/hw/s390x/s390-stattrib-kvm.c
> > @@ -116,7 +116,7 @@ static void
> > kvm_s390_stattrib_synchronize(S390StAttribState *sa) for (cx = 0;
> > cx + len <= max; cx += len) { clog.start_gfn = cx;
> >              clog.count = len;
> > -            clog.values = (uint64_t)(sas->incoming_buffer + cx *
> > len);  
> 
> Hm, doesn't that even imply that you reference an area beyond the
> buffer, as the <= max check does not catch this?

what do you mean?

cx + len <= max catches the cases where you would write beyond the end
of the buffer. if cx + len == max then we are filling the buffer to the
last byte. and we will get out at the next iteration.

> > +            clog.values = (uint64_t)(sas->incoming_buffer + cx);
> >              r = kvm_vm_ioctl(kvm_state, KVM_S390_SET_CMMA_BITS,
> > &clog); if (r) {
> >                  error_report("KVM_S390_SET_CMMA_BITS failed: %s",
> > strerror(-r)); @@ -126,7 +126,7 @@ static void
> > kvm_s390_stattrib_synchronize(S390StAttribState *sa) if (cx < max) {
> >              clog.start_gfn = cx;
> >              clog.count = max - cx;
> > -            clog.values = (uint64_t)(sas->incoming_buffer + cx *
> > len);

and here we fill in the last pieces if there are any leftovers, which
at this point are guaranteed to be smaller than len.

> > +            clog.values = (uint64_t)(sas->incoming_buffer + cx);
> >              r = kvm_vm_ioctl(kvm_state, KVM_S390_SET_CMMA_BITS,
> > &clog); if (r) {
> >                  error_report("KVM_S390_SET_CMMA_BITS failed: %s",
> > strerror(-r));  
>