Re: [Qemu-devel] [PATCH v1 1/1] s390x: fix storage attributes migration for non-small guests

[Cornelia Huck]

On Mon, 15 Jan 2018 17:52:02 +0100
Claudio Imbrenda <address@hidden> wrote:

> Fix storage attribute migration so that it does not fail for guests
> with more than a few GB of RAM. Migration itself was successful, but
> storage attributes were not migrated completely.
> 
> This patch fixes the migration of all storage attributes, even when the
> guest have large amounts of memory.
> 
> Signed-off-by: Claudio Imbrenda <address@hidden>
> Fixes: 903fd80b03243476 ("s390x/migration: Storage attributes device")
> ---
>  hw/s390x/s390-stattrib-kvm.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/hw/s390x/s390-stattrib-kvm.c b/hw/s390x/s390-stattrib-kvm.c
> index 41770a7..480551c 100644
> --- a/hw/s390x/s390-stattrib-kvm.c
> +++ b/hw/s390x/s390-stattrib-kvm.c
> @@ -116,7 +116,7 @@ static void 
> kvm_s390_stattrib_synchronize(S390StAttribState *sa)
>          for (cx = 0; cx + len <= max; cx += len) {
>              clog.start_gfn = cx;
>              clog.count = len;
> -            clog.values = (uint64_t)(sas->incoming_buffer + cx * len);

Hm, doesn't that even imply that you reference an area beyond the
buffer, as the <= max check does not catch this?

> +            clog.values = (uint64_t)(sas->incoming_buffer + cx);
>              r = kvm_vm_ioctl(kvm_state, KVM_S390_SET_CMMA_BITS, &clog);
>              if (r) {
>                  error_report("KVM_S390_SET_CMMA_BITS failed: %s", 
> strerror(-r));
> @@ -126,7 +126,7 @@ static void 
> kvm_s390_stattrib_synchronize(S390StAttribState *sa)
>          if (cx < max) {
>              clog.start_gfn = cx;
>              clog.count = max - cx;
> -            clog.values = (uint64_t)(sas->incoming_buffer + cx * len);
> +            clog.values = (uint64_t)(sas->incoming_buffer + cx);
>              r = kvm_vm_ioctl(kvm_state, KVM_S390_SET_CMMA_BITS, &clog);
>              if (r) {
>                  error_report("KVM_S390_SET_CMMA_BITS failed: %s", 
> strerror(-r));