[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Qemu-devel] [RFC v2 3/9] virtio: stop virtqueue processing if devic
From: |
Cornelia Huck |
Subject: |
Re: [Qemu-devel] [RFC v2 3/9] virtio: stop virtqueue processing if device is broken |
Date: |
Tue, 29 Mar 2016 18:58:03 +0200 |
On Tue, 29 Mar 2016 17:12:55 +0100
Stefan Hajnoczi <address@hidden> wrote:
> QEMU prints an error message and exits when the device enters an invalid
> state. Terminating the process is heavy-handed. The guest may still be
> able to function even if there is a bug in a virtio guest driver.
>
> Moreover, exiting is a bug in nested virtualization where a nested guest
> could DoS other nested guests by killing a pass-through virtio device.
> I don't think this configuration is possible today but it is likely in
> the future.
>
> If the broken flag is set, do not process virtqueues or write back used
> descriptors. The broken flag can be cleared again by resetting the
> device.
>
> Signed-off-by: Stefan Hajnoczi <address@hidden>
> ---
> hw/virtio/virtio.c | 39 +++++++++++++++++++++++++++++++++++++++
> include/hw/virtio/virtio.h | 3 +++
> 2 files changed, 42 insertions(+)
> +void GCC_FMT_ATTR(2, 3) virtio_error(VirtIODevice *vdev, const char *fmt,
> ...)
> +{
> + va_list ap;
> +
> + va_start(ap, fmt);
> + error_vreport(fmt, ap);
> + va_end(ap);
> +
> + vdev->broken = true;
> +
> + if (virtio_vdev_has_feature(vdev, VIRTIO_F_VERSION_1)) {
> + vdev->status |= VIRTIO_CONFIG_S_NEEDS_RESET;
virtio_set_status()?
> + virtio_notify_config(vdev);
> + }
> +}
> +
> static void virtio_device_realize(DeviceState *dev, Error **errp)
> {
> VirtIODevice *vdev = VIRTIO_DEVICE(dev);
> diff --git a/include/hw/virtio/virtio.h b/include/hw/virtio/virtio.h
> index 2b5b248..1565e53 100644
> --- a/include/hw/virtio/virtio.h
> +++ b/include/hw/virtio/virtio.h
> @@ -87,6 +87,7 @@ struct VirtIODevice
> VirtQueue *vq;
> uint16_t device_id;
> bool vm_running;
> + bool broken; /* device in invalid state, needs reset */
I'm wondering whether there's a sane way to track the broken state via
the NEEDS_RESET status bit instead. We'd probably want to filter out
this bit and not expose it to legacy drivers; but as the status field
is migrated anyway, we might be able to avoid a subsection for
migration.
- [Qemu-devel] [RFC v2 0/9] virtio: avoid exit() when device enters invalid states, Stefan Hajnoczi, 2016/03/29
- [Qemu-devel] [RFC v2 1/9] virtio: fix stray tab character, Stefan Hajnoczi, 2016/03/29
- [Qemu-devel] [RFC v2 2/9] include: update virtio_config.h Linux header, Stefan Hajnoczi, 2016/03/29
- [Qemu-devel] [RFC v2 3/9] virtio: stop virtqueue processing if device is broken, Stefan Hajnoczi, 2016/03/29
- Re: [Qemu-devel] [RFC v2 3/9] virtio: stop virtqueue processing if device is broken,
Cornelia Huck <=
- [Qemu-devel] [RFC v2 6/9] virtio: use unsigned int for virtqueue_get_avail_bytes() index, Stefan Hajnoczi, 2016/03/29
- [Qemu-devel] [RFC v2 4/9] virtio: handle virtqueue_map_desc() errors, Stefan Hajnoczi, 2016/03/29
- [Qemu-devel] [RFC v2 5/9] virtio: handle virtqueue_get_avail_bytes() errors, Stefan Hajnoczi, 2016/03/29
- [Qemu-devel] [RFC v2 9/9] virtio: handle virtqueue_get_head() errors, Stefan Hajnoczi, 2016/03/29
- [Qemu-devel] [RFC v2 7/9] virtio: handle virtqueue_read_next_desc() errors, Stefan Hajnoczi, 2016/03/29
- [Qemu-devel] [RFC v2 8/9] virtio: handle virtqueue_num_heads() errors, Stefan Hajnoczi, 2016/03/29