Re: [PATCH] exec/rom_reset: Free rom data during inmigrate skip

[Dr. David Alan Gilbert]

* Peter Maydell (address@hidden) wrote:
> On Fri, 13 Mar 2020 at 13:21, Peter Maydell <address@hidden> wrote:
> >
> > On Fri, 13 Mar 2020 at 12:31, Dr. David Alan Gilbert (git)
> > <address@hidden> wrote:
> > >
> > > From: "Dr. David Alan Gilbert" <address@hidden>
> > >
> > > Commit 355477f8c73e9 skips rom reset when we're an incoming migration
> > > so as not to overwrite shared ram in the ignore-shared migration
> > > optimisation.
> > > However, it's got an unexpected side effect that because it skips
> > > freeing the ROM data, when rom_reset gets called later on, after
> > > migration (e.g. during a reboot), the ROM does get reset to the original
> > > file contents.  Because of seabios/x86's weird reboot process
> > > this confuses a reboot into hanging after a migration.
> > >
> > > Fixes: 355477f8c73e9 ("migration: do not rom_reset() during incoming 
> > > migration")
> > > https://bugzilla.redhat.com/show_bug.cgi?id=1809380
> > >
> > > Signed-off-by: Dr. David Alan Gilbert <address@hidden>
> > > ---
> > >  hw/core/loader.c | 23 ++++++++++++++---------
> > >  1 file changed, 14 insertions(+), 9 deletions(-)
> > >
> >
> > >      QTAILQ_FOREACH(rom, &roms, next) {
> > >          if (rom->fw_file) {
> > >              continue;
> > >          }
> > > +        /*
> > > +         * We don't need to fill in the RAM with ROM data because we'll 
> > > fill
> > > +         * the data in during the next incoming migration in all cases.  
> > > Note
> > > +         * that some of those RAMs can actually be modified by the guest 
> > > on ARM
> > > +         * so this is probably the only right thing to do here.
> > > +         */
> > > +        if (runstate_check(RUN_STATE_INMIGRATE) && rom->data) {
> > > +            /*
> > > +             * Free it so that a rom_reset after migration doesn't 
> > > overwrite a
> > > +             * potentially modified 'rom'.
> > > +             */
> > > +            rom_free_data(rom);
> >
> > Shouldn't this condition match the condition in rom_reset()
> > for when we call rom_free_data()? You want the behaviour
> > on a subsequent reset to match the behaviour you'd get
> > if you did a reset on the source end without the migration.
> 
> Wait, this *is* rom_reset(). Now I'm really confused.

The exsiting rom_reset gets called multiple times:
  a) During init
      This actually copies the ROMs and then calls rom_free_data

  b) During a subsequent reboot
      This is mostly skipped because rom->data is now free because
      of the prior call to rom_free_data during (a)

During an inbound migrate, (a) happens before the migration, and
(b) happens during a reboot after the migration.

The problem is that 355477f8c73e9 caused (a) to be skipped
then when (b) happens it actually overwrites the ROM because
the rom_free_data had been skipped.  What I'm doing here is 
doing the rom_free_data(..) which causes it to then skip this
iteration during (a) AND causes it to skip it during (b).

Dave

> thanks
> -- PMM
> 
--
Dr. David Alan Gilbert / address@hidden / Manchester, UK