On 07/21/2015 06:37 AM, David Hildenbrand wrote:
So if I've got this code right, you send here a "header" that announces
a packet with all pages ...
+ while (handled_count < total_count) {
+ cur_count = MIN(total_count - handled_count, S390_SKEYS_BUFFER_SIZE);
+
+ ret = skeyclass->get_skeys(ss, cur_gfn, cur_count, buf);
+ if (ret < 0) {
+ error_report("S390_GET_KEYS error %d\n", ret);
+ break;
... but when an error occurs here, you suddenly stop in the middle of
that "packet" with all pages ...
Indeed, although that should never fail, we never know.
We don't want to overengineer the protocol but still abort migration at least
on the loading side in that (theoretical) case.
+ }
+
+ /* write keys to stream */
+ qemu_put_buffer(f, buf, cur_count);
+
+ cur_gfn += cur_count;
+ handled_count += cur_count;
+ }
+
+ g_free(buf);
+end_stream:
+ qemu_put_be64(f, S390_SKEYS_SAVE_FLAG_EOS);
... and send an EOS marker here instead ...
+}
+
+static int s390_storage_keys_load(QEMUFile *f, void *opaque, int version_id)
+{
+ S390SKeysState *ss = S390_SKEYS(opaque);
+ S390SKeysClass *skeyclass = S390_SKEYS_GET_CLASS(ss);
+ int ret = 0;
+
+ while (!ret) {
+ ram_addr_t addr;
+ int flags;
+
+ addr = qemu_get_be64(f);
+ flags = addr & ~TARGET_PAGE_MASK;
+ addr &= TARGET_PAGE_MASK;
+
+ switch (flags) {
+ case S390_SKEYS_SAVE_FLAG_SKEYS: {
+ const uint64_t total_count = qemu_get_be64(f);
+ uint64_t handled_count = 0, cur_count;
+ uint64_t cur_gfn = addr / TARGET_PAGE_SIZE;
+ uint8_t *buf = g_try_malloc(S390_SKEYS_BUFFER_SIZE);
+
+ if (!buf) {
+ error_report("storage key load could not allocate memory\n");
+ ret = -ENOMEM;
+ break;
+ }
+
+ while (handled_count < total_count) {
+ cur_count = MIN(total_count - handled_count,
+ S390_SKEYS_BUFFER_SIZE);
+ qemu_get_buffer(f, buf, cur_count);
... while the receiver can not handle the EOS marker here.
This looks fishy to me (or I might have just missed something), but
anyway please double check whether your error handling in the sender
really makes sense.
My shot would be, to send invalid storage keys if getting the keys from the
kernel fails. So we can detect it on the loading side and abort migration
gracefully.
What storage key value would you consider invalid? All combinations of
the upper four bits are valid. And of the lower four, we have the FP,
reference and change bits with the final bit marked as reserved. The
only possible answer would be to abuse the reserved bit and set it to 1
when there is an error. The major problem with that: This bit could be
used for something someday which would require us to stop using it for
an error indicator. Another problem is that we would then have to check
every single storage key for this error bit on the destination side.
This ioctl should not fail if we've made it this far. If it does we are
still covered because the sudden hole in the data will throw off
everything else. It could (in VERY rare cases, if at all) cause error
messages to surface that are unrelated to the problem but the correct
"S390_GET_KEYS error %d" message will still be displayed first.
Certainly it is not 100% perfect but since the sending side is not
allowed to fail there seems to be simple option here. We could
re-engineer the protocol to send packets of [Length][KeyData] and we
could decide on an error value for length (0xFFFFFFFF) that would
indicate an error, perhaps with 0x0 indicating end of data. I'm happy to
do the work if requested but is it really worth it?
+ ret = skeyclass->set_skeys(ss, cur_gfn, cur_count, buf);
+ if (ret < 0) {
+ error_report("S390_SET_KEYS error %d\n", ret);
+ break;
+ }
+ handled_count += cur_count;
+ cur_gfn += cur_count;
+ }
+ g_free(buf);
+ break;
+ }
+ case S390_SKEYS_SAVE_FLAG_EOS:
+ /* normal exit */
+ return 0;
+ default:
+ error_report("Unexpected storage key flag data: %#x", flags);
+ ret = -EINVAL;
+ }
+ }
+
+ return ret;
+}
Thomas
Thanks Thomas!
David
--
-- Jason J. Herne (jjhe...@linux.vnet.ibm.com)
