From nobody Tue Nov 4 15:46:43 2025 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) client-ip=208.118.235.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Authentication-Results: mx.zohomail.com; spf=pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) by mx.zohomail.com with SMTPS id 1503967922959608.629827613233; Mon, 28 Aug 2017 17:52:02 -0700 (PDT) Received: from localhost ([::1]:42088 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1dmUl6-00089W-PI for importer@patchew.org; Mon, 28 Aug 2017 20:52:00 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:47983) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1dmUCR-0001F9-A3 for qemu-devel@nongnu.org; Mon, 28 Aug 2017 20:16:14 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1dmUCO-0005Qa-26 for qemu-devel@nongnu.org; Mon, 28 Aug 2017 20:16:11 -0400 Received: from mx0a-001b2d01.pphosted.com ([148.163.156.1]:44213) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1dmUCN-0005PX-Pm for qemu-devel@nongnu.org; Mon, 28 Aug 2017 20:16:07 -0400 Received: from pps.filterd (m0098399.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.16.0.21/8.16.0.21) with SMTP id v7T0FlUN045002 for ; Mon, 28 Aug 2017 20:16:07 -0400 Received: from e33.co.us.ibm.com (e33.co.us.ibm.com [32.97.110.151]) by mx0a-001b2d01.pphosted.com with ESMTP id 2cmur4vpmu-1 (version=TLSv1.2 cipher=AES256-SHA bits=256 verify=NOT) for ; Mon, 28 Aug 2017 20:16:06 -0400 Received: from localhost by e33.co.us.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Mon, 28 Aug 2017 18:16:06 -0600 Received: from b03cxnp07028.gho.boulder.ibm.com (9.17.130.15) by e33.co.us.ibm.com (192.168.1.133) with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted; Mon, 28 Aug 2017 18:16:03 -0600 Received: from b03ledav003.gho.boulder.ibm.com (b03ledav003.gho.boulder.ibm.com [9.17.130.234]) by b03cxnp07028.gho.boulder.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id v7T0G3oU2687396; Mon, 28 Aug 2017 17:16:03 -0700 Received: from b03ledav003.gho.boulder.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 2454D6A03C; Mon, 28 Aug 2017 18:16:03 -0600 (MDT) Received: from localhost (unknown [9.80.85.217]) by b03ledav003.gho.boulder.ibm.com (Postfix) with ESMTP id EF6E46A03D; Mon, 28 Aug 2017 18:16:02 -0600 (MDT) From: Michael Roth To: qemu-devel@nongnu.org Date: Mon, 28 Aug 2017 19:14:11 -0500 X-Mailer: git-send-email 2.7.4 In-Reply-To: <1503965694-10794-1-git-send-email-mdroth@linux.vnet.ibm.com> References: <1503965694-10794-1-git-send-email-mdroth@linux.vnet.ibm.com> X-TM-AS-GCONF: 00 x-cbid: 17082900-0008-0000-0000-0000087D385D X-IBM-SpamModules-Scores: X-IBM-SpamModules-Versions: BY=3.00007630; HX=3.00000241; KW=3.00000007; PH=3.00000004; SC=3.00000226; SDB=6.00909028; UDB=6.00455849; IPR=6.00689279; BA=6.00005557; NDR=6.00000001; ZLA=6.00000005; ZF=6.00000009; ZB=6.00000000; ZP=6.00000000; ZH=6.00000000; ZU=6.00000002; MB=3.00016909; XFM=3.00000015; UTC=2017-08-29 00:16:05 X-IBM-AV-DETECTION: SAVI=unused REMOTE=unused XFE=unused x-cbparentid: 17082900-0009-0000-0000-000043C046CF Message-Id: <1503965694-10794-37-git-send-email-mdroth@linux.vnet.ibm.com> X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:, , definitions=2017-08-28_13:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 suspectscore=1 malwarescore=0 phishscore=0 adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1707230000 definitions=main-1708290001 X-detected-operating-system: by eggs.gnu.org: GNU/Linux 3.x [generic] [fuzzy] X-Received-From: 148.163.156.1 Subject: [Qemu-devel] [PATCH 36/79] s390x/css: catch section mismatch on load X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Christian Borntraeger , Halil Pasic , qemu-stable@nongnu.org Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" X-ZohoMail: RSF_0 Z_629925259 SPT_0 Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" From: Halil Pasic Prior to the virtio-ccw-2.7 machine (and commit 2a79eb1a), our virtio devices residing under the virtual-css bus do not have qdev_path based migration stream identifiers (because their qdev_path is NULL). The ids are instead generated when the device is registered as a composition of the so called idstr, which takes the vmsd name as its value, and an instance_id, which is which is calculated as a maximal instance_id registered with the same idstr plus one, or zero (if none was registered previously). That means, under certain circumstances, one device might try, and even succeed, to load the state of a different device. This can lead to trouble. Let us fail the migration if the above problem is detected during load. How to reproduce the problem: 1) start qemu-system-s390x making sure you have the following devices defined on your command line: -device virtio-rng-ccw,id=3Drng1,devno=3Dfe.0.0001 -device virtio-rng-ccw,id=3Drng2,devno=3Dfe.0.0002 2) detach the devices and reattach in reverse order using the monitor: (qemu) device_del rng1 (qemu) device_del rng2 (qemu) device_add virtio-rng-ccw,id=3Drng2,devno=3Dfe.0.0002 (qemu) device_add virtio-rng-ccw,id=3Drng1,devno=3Dfe.0.0001 3) save the state of the vm into a temporary file and quit QEMU: (qemu) migrate "exec:gzip -c > /tmp/tmp_vmstate.gz" (qemu) q 4) use your command line from step 1 with -incoming "exec:gzip -c -d /tmp/tmp_vmstate.gz" appended to reproduce the problem (while trying to to load the saved vm) CC: qemu-stable@nongnu.org Signed-off-by: Halil Pasic Reviewed-by: Dong Jia Shi Reviewed-by: Cornelia Huck Message-Id: <20170518111405.56947-1-pasic@linux.vnet.ibm.com> Signed-off-by: Christian Borntraeger (cherry picked from commit 8ed179c937830143dc0e03daac30a55272ed89e3) * removed context dep on d8d98db5 Signed-off-by: Michael Roth --- hw/s390x/css.c | 14 ++++++++++++++ hw/s390x/virtio-ccw.c | 6 +++++- 2 files changed, 19 insertions(+), 1 deletion(-) diff --git a/hw/s390x/css.c b/hw/s390x/css.c index 37caa98..b24e8b7 100644 --- a/hw/s390x/css.c +++ b/hw/s390x/css.c @@ -14,6 +14,7 @@ #include "qapi/visitor.h" #include "hw/qdev.h" #include "qemu/bitops.h" +#include "qemu/error-report.h" #include "exec/address-spaces.h" #include "cpu.h" #include "hw/s390x/ioinst.h" @@ -1676,13 +1677,26 @@ void subch_device_save(SubchDev *s, QEMUFile *f) int subch_device_load(SubchDev *s, QEMUFile *f) { SubchDev *old_s; + Error *err =3D NULL; uint16_t old_schid =3D s->schid; + uint16_t old_devno =3D s->devno; int i; =20 s->cssid =3D qemu_get_byte(f); s->ssid =3D qemu_get_byte(f); s->schid =3D qemu_get_be16(f); s->devno =3D qemu_get_be16(f); + if (s->devno !=3D old_devno) { + /* Only possible if machine < 2.7 (no css_dev_path) */ + + error_setg(&err, "%x !=3D %x", old_devno, s->devno); + error_append_hint(&err, "Devno mismatch, tried to load wrong secti= on!" + " Likely reason: some sequences of plug and unpl= ug" + " can break migration for machine versions prior= to" + " 2.7 (known design flaw).\n"); + error_report_err(err); + return -EINVAL; + } /* Re-assign subch. */ if (old_schid !=3D s->schid) { old_s =3D channel_subsys.css[s->cssid]->sch_set[s->ssid]->sch[old_= schid]; diff --git a/hw/s390x/virtio-ccw.c b/hw/s390x/virtio-ccw.c index 00b3bde..c0c1db8 100644 --- a/hw/s390x/virtio-ccw.c +++ b/hw/s390x/virtio-ccw.c @@ -1264,9 +1264,13 @@ static int virtio_ccw_load_config(DeviceState *d, QE= MUFile *f) SubchDev *s =3D ccw_dev->sch; VirtIODevice *vdev =3D virtio_ccw_get_vdev(s); int len; + int ret; =20 s->driver_data =3D dev; - subch_device_load(s, f); + ret =3D subch_device_load(s, f); + if (ret) { + return ret; + } len =3D qemu_get_be32(f); if (len !=3D 0) { dev->indicators =3D get_indicator(qemu_get_be64(f), len); --=20 2.7.4