qemu-devel
[Top][All Lists]
Advanced

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [PATCH v4 2/2] hw/pci-host: save/restore pci host config register fo


From: Michael S. Tsirkin
Subject: Re: [PATCH v4 2/2] hw/pci-host: save/restore pci host config register for old ones
Date: Mon, 27 Jul 2020 10:08:24 -0400

On Mon, Jul 27, 2020 at 02:53:29PM +0100, Dr. David Alan Gilbert wrote:
> * Michael S. Tsirkin (mst@redhat.com) wrote:
> > On Mon, Jul 27, 2020 at 04:46:21PM +0800, Hogan Wang wrote:
> > > The i440fx and q35 machines integrate i440FX or MCH PCI device by default.
> > > Refer to i440FX and ICH9-LPC spcifications, there are some reserved
> > > configuration registers can used to save/restore PCIHostState.config_reg.
> > > It's nasty but friendly to old ones.
> > > 
> > > Reproducer steps:
> > > step 1. Make modifications to seabios and qemu for increase reproduction
> > > efficiency, write 0xf0 to 0x402 port notify qemu to stop vcpu after
> > > 0x0cf8 port wrote i440 configure register. qemu stop vcpu when catch
> > > 0x402 port wrote 0xf0.
> > > 
> > > seabios:/src/hw/pci.c
> > > @@ -52,6 +52,11 @@ void pci_config_writeb(u16 bdf, u32 addr, u8 val)
> > >          writeb(mmconfig_addr(bdf, addr), val);
> > >      } else {
> > >          outl(ioconfig_cmd(bdf, addr), PORT_PCI_CMD);
> > > +       if (bdf == 0 && addr == 0x72 && val == 0xa) {
> > > +            dprintf(1, "stop vcpu\n");
> > > +            outb(0xf0, 0x402); // notify qemu to stop vcpu
> > > +            dprintf(1, "resume vcpu\n");
> > > +        }
> > >          outb(val, PORT_PCI_DATA + (addr & 3));
> > >      }
> > >  }
> > > 
> > > qemu:hw/char/debugcon.c
> > > @@ -60,6 +61,9 @@ static void debugcon_ioport_write(void *opaque, hwaddr 
> > > addr, uint64_t val,
> > >      printf(" [debugcon: write addr=0x%04" HWADDR_PRIx " val=0x%02" 
> > > PRIx64 "]\n", addr, val);
> > >  #endif
> > > 
> > > +    if (ch == 0xf0) {
> > > +        vm_stop(RUN_STATE_PAUSED);
> > > +    }
> > >      /* XXX this blocks entire thread. Rewrite to use
> > >       * qemu_chr_fe_write and background I/O callbacks */
> > >      qemu_chr_fe_write_all(&s->chr, &ch, 1);
> > > 
> > > step 2. start vm1 by the following command line, and then vm stopped.
> > > $ qemu-system-x86_64 -machine pc-i440fx-5.0,accel=kvm\
> > >  -netdev tap,ifname=tap-test,id=hostnet0,vhost=on,downscript=no,script=no\
> > >  -device 
> > > virtio-net-pci,netdev=hostnet0,id=net0,bus=pci.0,addr=0x13,bootindex=3\
> > >  -device cirrus-vga,id=video0,vgamem_mb=16,bus=pci.0,addr=0x2\
> > >  -chardev file,id=seabios,path=/var/log/test.seabios,append=on\
> > >  -device isa-debugcon,iobase=0x402,chardev=seabios\
> > >  -monitor stdio
> > > 
> > > step 3. start vm2 to accept vm1 state.
> > > $ qemu-system-x86_64 -machine pc-i440fx-5.0,accel=kvm\
> > >  -netdev 
> > > tap,ifname=tap-test1,id=hostnet0,vhost=on,downscript=no,script=no\
> > >  -device 
> > > virtio-net-pci,netdev=hostnet0,id=net0,bus=pci.0,addr=0x13,bootindex=3\
> > >  -device cirrus-vga,id=video0,vgamem_mb=16,bus=pci.0,addr=0x2\
> > >  -chardev file,id=seabios,path=/var/log/test.seabios,append=on\
> > >  -device isa-debugcon,iobase=0x402,chardev=seabios\
> > >  -monitor stdio \
> > >  -incoming tcp:127.0.0.1:8000
> > > 
> > > step 4. execute the following qmp command in vm1 to migrate.
> > > (qemu) migrate tcp:127.0.0.1:8000
> > > 
> > > step 5. execute the following qmp command in vm2 to resume vcpu.
> > > (qemu) cont
> > > 
> > > Before this patch, we can get KVM "emulation failure" error on vm2.
> > > This patch can fix it.
> > > 
> > > Signed-off-by: Hogan Wang <hogan.wang@huawei.com>
> > 
> > Question - did you test that this migrates successfully to
> > old QEMU too? Thanks!
> 
> I'm not seeing how it will;

Well the way this is supposed to work is, it's a reserved register.
So if you migrate to an old qemu it will ignore it, the bug is
not fixed but if you got lucky and did not run into the bug,
the guest will keep going.

Migrating back has a small chance to mess up the guest in a way that is
different from how it was messed up previously, because old qemu will
send a stale config value if you run into the race.
The scariest thing  is it can convert a buggy write into register 0
into a write into another register - potentially more dangerous.
OTOH not writing at all which is what write to register 0 does
it also unlikely to work as expected ...

I really think we need a way to add migrated data without breaking
compat with old machine types, and have old types just ignore it. If we
had such a way we could now use it and at least we would not be making
the problem bigger for anyway.


> and isn't pci_host used in lots of
> architectures?

It doesn't affect these others. They can add a work around
too if there's a migrated register.

> 
> Dave
> 
> > And I guess this needs a CC stable?
> > 
> > > ---
> > >  hw/pci-host/i440fx.c | 31 +++++++++++++++++++++++++++++++
> > >  hw/pci-host/q35.c    | 30 ++++++++++++++++++++++++++++++
> > >  2 files changed, 61 insertions(+)
> > > 
> > > diff --git a/hw/pci-host/i440fx.c b/hw/pci-host/i440fx.c
> > > index 8ed2417f0c..b78c8bc5f9 100644
> > > --- a/hw/pci-host/i440fx.c
> > > +++ b/hw/pci-host/i440fx.c
> > > @@ -64,6 +64,14 @@ typedef struct I440FXState {
> > >   */
> > >  #define I440FX_COREBOOT_RAM_SIZE 0x57
> > >  
> > > +/* Older I440FX machines (5.0 and older) not support i440FX-pcihost state
> > > + * migration, use some reserved INTEL 82441 configuration registers to
> > > + * save/restore i440FX-pcihost config register. Refer to [INTEL 440FX 
> > > PCISET
> > > + * 82441FX PCI AND MEMORY CONTROLLER (PMC) AND 82442FX DATA BUS 
> > > ACCELERATOR
> > > + * (DBX) Table 1. PMC Configuration Space]
> > > + */
> > > +#define I440FX_PCI_HOST_CONFIG_REG 0x94
> > > +
> > >  static void i440fx_update_memory_mappings(PCII440FXState *d)
> > >  {
> > >      int i;
> > > @@ -98,8 +106,30 @@ static void i440fx_write_config(PCIDevice *dev,
> > >  static int i440fx_post_load(void *opaque, int version_id)
> > >  {
> > >      PCII440FXState *d = opaque;
> > > +    PCIDevice *dev;
> > > +    PCIHostState *s = OBJECT_CHECK(PCIHostState,
> > > +                                   
> > > object_resolve_path("/machine/i440fx", NULL),
> > > +                                   TYPE_PCI_HOST_BRIDGE);
> > >  
> > >      i440fx_update_memory_mappings(d);
> > > +
> > > +    if (!s->mig_enabled) {
> > > +        dev = PCI_DEVICE(d);
> > > +        s->config_reg = 
> > > pci_get_long(&dev->config[I440FX_PCI_HOST_CONFIG_REG]);
> > > +    }
> > > +    return 0;
> > > +}
> > > +
> > > +static int i440fx_pre_save(void *opaque)
> > > +{
> > > +    PCIDevice *dev = opaque;
> > > +    PCIHostState *s = OBJECT_CHECK(PCIHostState,
> > > +                                   
> > > object_resolve_path("/machine/i440fx", NULL),
> > > +                                   TYPE_PCI_HOST_BRIDGE);
> > > +    if (!s->mig_enabled) {
> > > +        pci_set_long(&dev->config[I440FX_PCI_HOST_CONFIG_REG],
> > > +                     s->config_reg);
> > > +    }
> > >      return 0;
> > >  }
> > >  
> > > @@ -107,6 +137,7 @@ static const VMStateDescription vmstate_i440fx = {
> > >      .name = "I440FX",
> > >      .version_id = 3,
> > >      .minimum_version_id = 3,
> > > +    .pre_save = i440fx_pre_save,
> > >      .post_load = i440fx_post_load,
> > >      .fields = (VMStateField[]) {
> > >          VMSTATE_PCI_DEVICE(parent_obj, PCII440FXState),
> > > diff --git a/hw/pci-host/q35.c b/hw/pci-host/q35.c
> > > index b67cb9c29f..bed66be181 100644
> > > --- a/hw/pci-host/q35.c
> > > +++ b/hw/pci-host/q35.c
> > > @@ -43,6 +43,15 @@
> > >  
> > >  #define Q35_PCI_HOST_HOLE64_SIZE_DEFAULT (1ULL << 35)
> > >  
> > > +/* Older Q35 machines (5.0 and older) not support q35-pcihost state
> > > + * migration, use some reserved INTEL MCH configuration registers to
> > > + * save/restore q35-pcihost config register. Refer to [Intel 3 Series
> > > + * Chipset Family Datasheet Table 5-1. DRAM Controller Register Address
> > > + * Map (D0:F0)]
> > > + */
> > > +#define Q35_PCI_HOST_CONFIG_REG 0x70
> > > +
> > > +
> > >  static void q35_host_realize(DeviceState *dev, Error **errp)
> > >  {
> > >      PCIHostState *pci = PCI_HOST_BRIDGE(dev);
> > > @@ -513,7 +522,27 @@ static void mch_update(MCHPCIState *mch)
> > >  static int mch_post_load(void *opaque, int version_id)
> > >  {
> > >      MCHPCIState *mch = opaque;
> > > +    PCIDevice *dev;
> > > +    PCIHostState *s = OBJECT_CHECK(PCIHostState,
> > > +                                   object_resolve_path("/machine/q35", 
> > > NULL),
> > > +                                   TYPE_PCI_HOST_BRIDGE);
> > >      mch_update(mch);
> > > +    if (!s->mig_enabled) {
> > > +        dev = PCI_DEVICE(mch);
> > > +        s->config_reg = 
> > > pci_get_long(&dev->config[Q35_PCI_HOST_CONFIG_REG]);
> > > +    }
> > > +    return 0;
> > > +}
> > > +
> > > +static int mch_pre_save(void *opaque)
> > > +{
> > > +    PCIDevice *dev = opaque;
> > > +    PCIHostState *s = OBJECT_CHECK(PCIHostState,
> > > +                                   object_resolve_path("/machine/q35", 
> > > NULL),
> > > +                                   TYPE_PCI_HOST_BRIDGE);
> > > +    if (!s->mig_enabled) {
> > > +        pci_set_long(&dev->config[Q35_PCI_HOST_CONFIG_REG], 
> > > s->config_reg);
> > > +    }
> > >      return 0;
> > >  }
> > >  
> > > @@ -521,6 +550,7 @@ static const VMStateDescription vmstate_mch = {
> > >      .name = "mch",
> > >      .version_id = 1,
> > >      .minimum_version_id = 1,
> > > +    .pre_save = mch_pre_save,
> > >      .post_load = mch_post_load,
> > >      .fields = (VMStateField[]) {
> > >          VMSTATE_PCI_DEVICE(parent_obj, MCHPCIState),
> > > -- 
> > > 2.27.0
> > > 
> > 
> --
> Dr. David Alan Gilbert / dgilbert@redhat.com / Manchester, UK




reply via email to

[Prev in Thread] Current Thread [Next in Thread]