[Qemu-devel] [PATCH 1/2] Fix off-by-1 error in RAM migration code

[Qemu-devel] [PATCH 1/2] Fix off-by-1 error in RAM migration code

[David Gibson]

The code for migrating (or savevm-ing) memory pages starts off by creating
a dirty bitmap and filling it with 1s.  Except, actually, because bit
addresses are 0-based it fills every bit except bit 0 with 1s and puts an
extra 1 beyond the end of the bitmap, potentially corrupting unrelated
memory.  Oops.  This patch fixes it.

Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
---
 arch_init.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch_init.c b/arch_init.c
index e6effe8..b75a4c5 100644
--- a/arch_init.c
+++ b/arch_init.c
@@ -568,7 +568,7 @@ static int ram_save_setup(QEMUFile *f, void *opaque)
     int64_t ram_pages = last_ram_offset() >> TARGET_PAGE_BITS;
 
     migration_bitmap = bitmap_new(ram_pages);
-    bitmap_set(migration_bitmap, 1, ram_pages);
+    bitmap_set(migration_bitmap, 0, ram_pages);
     migration_dirty_pages = ram_pages;
 
     bytes_transferred = 0;
-- 
1.7.10.4

[Qemu-devel] [PULL 0/2] migration queue

[Juan Quintela]

Hi

Anthony, this fixes two errors on the migration code, could you pull?

Thanks, Juan.

The following changes since commit 1c97e303d4ea80a2691334b0febe87a50660f99d:

  Merge remote-tracking branch 'afaerber/qom-cpu' into staging (2012-12-10 08:35:15 -0600)

are available in the git repository at:


  git://repo.or.cz/qemu/quintela.git migration.next

for you to fetch changes up to 77db8657048f233edf21e1a9ebdc30a367fbdc36:

  migration: Fix madvise breakage if host and guest have different page sizes (2012-12-11 12:45:56 +0100)

----------------------------------------------------------------
David Gibson (2):
      Fix off-by-1 error in RAM migration code
      migration: Fix madvise breakage if host and guest have different page sizes

 arch_init.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

[Qemu-devel] [PATCH 1/2] Fix off-by-1 error in RAM migration code

[Juan Quintela]

From: David Gibson <david@gibson.dropbear.id.au>

The code for migrating (or savevm-ing) memory pages starts off by creating
a dirty bitmap and filling it with 1s.  Except, actually, because bit
addresses are 0-based it fills every bit except bit 0 with 1s and puts an
extra 1 beyond the end of the bitmap, potentially corrupting unrelated
memory.  Oops.  This patch fixes it.

Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Juan Quintela <quintela@redhat.com>
---
 arch_init.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch_init.c b/arch_init.c
index e6effe8..b75a4c5 100644
--- a/arch_init.c
+++ b/arch_init.c
@@ -568,7 +568,7 @@ static int ram_save_setup(QEMUFile *f, void *opaque)
     int64_t ram_pages = last_ram_offset() >> TARGET_PAGE_BITS;

     migration_bitmap = bitmap_new(ram_pages);
-    bitmap_set(migration_bitmap, 1, ram_pages);
+    bitmap_set(migration_bitmap, 0, ram_pages);
     migration_dirty_pages = ram_pages;

     bytes_transferred = 0;
-- 
1.7.11.7

[Qemu-devel] [PATCH 2/2] migration: Fix madvise breakage if host and guest have different page sizes

[Juan Quintela]

From: David Gibson <david@gibson.dropbear.id.au>

madvise(DONTNEED) will throw away the contents of the whole page at the
given address, even if the given length is less than the page size.  One
can argue about whether that's the correct behaviour, but that's what it's
done for a long time in Linux at least.

That means that the madvise() in ram_load(), on a setup where
TARGET_PAGE_SIZE is smaller than the host page size, can throw away data
in guest pages adjacent to the one it's actually processing right now,
leading to guest memory corruption on an incoming migration.

This patch therefore, disables the madvise() if the host page size is
larger than TARGET_PAGE_SIZE.  This means we don't get the benefits of that
madvise() in this case, but a more complete fix is more difficult to
accomplish.  This at least fixes the guest memory corruption.

Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
Reported-by: Alexey Kardashevskiy <aik@ozlabs.ru>
Signed-off-by: Juan Quintela <quintela@redhat.com>
---
 arch_init.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/arch_init.c b/arch_init.c
index b75a4c5..83dcc53 100644
--- a/arch_init.c
+++ b/arch_init.c
@@ -840,7 +840,8 @@ static int ram_load(QEMUFile *f, void *opaque, int version_id)
             memset(host, ch, TARGET_PAGE_SIZE);
 #ifndef _WIN32
             if (ch == 0 &&
-                (!kvm_enabled() || kvm_has_sync_mmu())) {
+                (!kvm_enabled() || kvm_has_sync_mmu()) &&
+                getpagesize() <= TARGET_PAGE_SIZE) {
                 qemu_madvise(host, TARGET_PAGE_SIZE, QEMU_MADV_DONTNEED);
             }
 #endif
-- 
1.7.11.7

Re: [Qemu-devel] [PULL 0/2] migration queue

[Anthony Liguori]

Thanks, applied.

Regards,

Anthony Liguori

Re: [Qemu-devel] [PULL 0/2] migration queue

[Anthony Liguori]

Anthony Liguori <aliguori@us.ibm.com> writes:

> Thanks, applied.

Please disregard.  That's a bug in my script.  Sorry for the noise.

Regards,

Anthony Liguori

>
> Regards,
>
> Anthony Liguori