diff mbox

[1/2] Restore atapi_dma flag across migration

Message ID 1418148909-19870-2-git-send-email-dgilbert@redhat.com
State New
Headers show

Commit Message

Dr. David Alan Gilbert Dec. 9, 2014, 6:15 p.m. UTC
From: "Dr. David Alan Gilbert" <dgilbert@redhat.com>

If a migration happens just after the guest has kicked
off an ATAPI command and kicked off DMA, we lose the atapi_dma
flag, and the destination tries to complete the command as PIO
rather than DMA.  This upsets Linux; modern libata based kernels
stumble and recover OK, older kernels end up passing bad data
to userspace.

Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
---
 hw/ide/core.c | 1 +
 1 file changed, 1 insertion(+)

Comments

John Snow Dec. 10, 2014, 5:04 a.m. UTC | #1
On 12/09/2014 01:15 PM, Dr. David Alan Gilbert (git) wrote:
> From: "Dr. David Alan Gilbert" <dgilbert@redhat.com>
>
> If a migration happens just after the guest has kicked
> off an ATAPI command and kicked off DMA, we lose the atapi_dma
> flag, and the destination tries to complete the command as PIO
> rather than DMA.  This upsets Linux; modern libata based kernels
> stumble and recover OK, older kernels end up passing bad data
> to userspace.
>
> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
> ---
>   hw/ide/core.c | 1 +
>   1 file changed, 1 insertion(+)
>
> diff --git a/hw/ide/core.c b/hw/ide/core.c
> index d4af5e2..ac3f015 100644
> --- a/hw/ide/core.c
> +++ b/hw/ide/core.c
> @@ -2417,6 +2417,7 @@ static int ide_drive_pio_post_load(void *opaque, int version_id)
>       s->end_transfer_func = transfer_end_table[s->end_transfer_fn_idx];
>       s->data_ptr = s->io_buffer + s->cur_io_buffer_offset;
>       s->data_end = s->data_ptr + s->cur_io_buffer_len;
> +    s->atapi_dma = s->feature & 1; /* as per cmd_packet */
>
>       return 0;
>   }
>

This looks fine to me; though perhaps a more comprehensive fix might 
prevent us needing this at all. As the code exists today, it's 
definitely an error to lose this value, as you've noticed.

Reviewed-by: John Snow <jsnow@redhat.com>
diff mbox

Patch

diff --git a/hw/ide/core.c b/hw/ide/core.c
index d4af5e2..ac3f015 100644
--- a/hw/ide/core.c
+++ b/hw/ide/core.c
@@ -2417,6 +2417,7 @@  static int ide_drive_pio_post_load(void *opaque, int version_id)
     s->end_transfer_func = transfer_end_table[s->end_transfer_fn_idx];
     s->data_ptr = s->io_buffer + s->cur_io_buffer_offset;
     s->data_end = s->data_ptr + s->cur_io_buffer_len;
+    s->atapi_dma = s->feature & 1; /* as per cmd_packet */
 
     return 0;
 }