[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PULL 08/19] virtio: stop virtqueue processing if device is
From: |
Michael S. Tsirkin |
Subject: |
[Qemu-devel] [PULL 08/19] virtio: stop virtqueue processing if device is broken |
Date: |
Fri, 23 Sep 2016 22:57:25 +0300 |
From: Stefan Hajnoczi <address@hidden>
QEMU prints an error message and exits when the device enters an invalid
state. Terminating the process is heavy-handed. The guest may still be
able to function even if there is a bug in a virtio guest driver.
Moreover, exiting is a bug in nested virtualization where a nested guest
could DoS other nested guests by killing a pass-through virtio device.
I don't think this configuration is possible today but it is likely in
the future.
If the broken flag is set, do not process virtqueues or write back used
descriptors. The broken flag can be cleared again by resetting the
device.
Signed-off-by: Stefan Hajnoczi <address@hidden>
Reviewed-by: Cornelia Huck <address@hidden>
Reviewed-by: Michael S. Tsirkin <address@hidden>
Signed-off-by: Michael S. Tsirkin <address@hidden>
Reviewed-by: Cornelia Huck <address@hidden>
---
include/hw/virtio/virtio.h | 3 +++
hw/virtio/virtio.c | 39 +++++++++++++++++++++++++++++++++++++++
2 files changed, 42 insertions(+)
diff --git a/include/hw/virtio/virtio.h b/include/hw/virtio/virtio.h
index f05559d..888c8de 100644
--- a/include/hw/virtio/virtio.h
+++ b/include/hw/virtio/virtio.h
@@ -87,6 +87,7 @@ struct VirtIODevice
VirtQueue *vq;
uint16_t device_id;
bool vm_running;
+ bool broken; /* device in invalid state, needs reset */
VMChangeStateEntry *vmstate;
char *bus_name;
uint8_t device_endian;
@@ -135,6 +136,8 @@ void virtio_init(VirtIODevice *vdev, const char *name,
uint16_t device_id, size_t config_size);
void virtio_cleanup(VirtIODevice *vdev);
+void virtio_error(VirtIODevice *vdev, const char *fmt, ...) GCC_FMT_ATTR(2, 3);
+
/* Set the child bus name. */
void virtio_device_set_child_bus_name(VirtIODevice *vdev, char *bus_name);
diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c
index 1199149..1671ea8 100644
--- a/hw/virtio/virtio.c
+++ b/hw/virtio/virtio.c
@@ -303,6 +303,10 @@ void virtqueue_fill(VirtQueue *vq, const VirtQueueElement
*elem,
virtqueue_unmap_sg(vq, elem, len);
+ if (unlikely(vq->vdev->broken)) {
+ return;
+ }
+
idx = (idx + vq->used_idx) % vq->vring.num;
uelem.id = elem->index;
@@ -313,6 +317,12 @@ void virtqueue_fill(VirtQueue *vq, const VirtQueueElement
*elem,
void virtqueue_flush(VirtQueue *vq, unsigned int count)
{
uint16_t old, new;
+
+ if (unlikely(vq->vdev->broken)) {
+ vq->inuse -= count;
+ return;
+ }
+
/* Make sure buffer is written before we update index. */
smp_wmb();
trace_virtqueue_flush(vq, count);
@@ -583,6 +593,9 @@ void *virtqueue_pop(VirtQueue *vq, size_t sz)
struct iovec iov[VIRTQUEUE_MAX_SIZE];
VRingDesc desc;
+ if (unlikely(vdev->broken)) {
+ return NULL;
+ }
if (virtio_queue_empty(vq)) {
return NULL;
}
@@ -747,6 +760,10 @@ static void virtio_notify_vector(VirtIODevice *vdev,
uint16_t vector)
BusState *qbus = qdev_get_parent_bus(DEVICE(vdev));
VirtioBusClass *k = VIRTIO_BUS_GET_CLASS(qbus);
+ if (unlikely(vdev->broken)) {
+ return;
+ }
+
if (k->notify) {
k->notify(qbus->parent, vector);
}
@@ -830,6 +847,7 @@ void virtio_reset(void *opaque)
k->reset(vdev);
}
+ vdev->broken = false;
vdev->guest_features = 0;
vdev->queue_sel = 0;
vdev->status = 0;
@@ -1137,6 +1155,10 @@ static void virtio_queue_notify_vq(VirtQueue *vq)
if (vq->vring.desc && vq->handle_output) {
VirtIODevice *vdev = vq->vdev;
+ if (unlikely(vdev->broken)) {
+ return;
+ }
+
trace_virtio_queue_notify(vdev, vq - vdev->vq, vq);
vq->handle_output(vdev, vq);
}
@@ -1758,6 +1780,7 @@ void virtio_init(VirtIODevice *vdev, const char *name,
vdev->config_vector = VIRTIO_NO_VECTOR;
vdev->vq = g_malloc0(sizeof(VirtQueue) * VIRTIO_QUEUE_MAX);
vdev->vm_running = runstate_is_running();
+ vdev->broken = false;
for (i = 0; i < VIRTIO_QUEUE_MAX; i++) {
vdev->vq[i].vector = VIRTIO_NO_VECTOR;
vdev->vq[i].vdev = vdev;
@@ -1944,6 +1967,22 @@ void virtio_device_set_child_bus_name(VirtIODevice
*vdev, char *bus_name)
vdev->bus_name = g_strdup(bus_name);
}
+void GCC_FMT_ATTR(2, 3) virtio_error(VirtIODevice *vdev, const char *fmt, ...)
+{
+ va_list ap;
+
+ va_start(ap, fmt);
+ error_vreport(fmt, ap);
+ va_end(ap);
+
+ vdev->broken = true;
+
+ if (virtio_vdev_has_feature(vdev, VIRTIO_F_VERSION_1)) {
+ virtio_set_status(vdev, vdev->status | VIRTIO_CONFIG_S_NEEDS_RESET);
+ virtio_notify_config(vdev);
+ }
+}
+
static void virtio_device_realize(DeviceState *dev, Error **errp)
{
VirtIODevice *vdev = VIRTIO_DEVICE(dev);
--
MST
- [Qemu-devel] [PULL 00/19] virtio, pc: fixes and features, Michael S. Tsirkin, 2016/09/23
- [Qemu-devel] [PULL 01/19] tests: add /vhost-user/connect-fail test, Michael S. Tsirkin, 2016/09/23
- [Qemu-devel] [PULL 02/19] tests: add a simple /vhost-user/multiqueue test, Michael S. Tsirkin, 2016/09/23
- [Qemu-devel] [PULL 03/19] tests: add /vhost-user/flags-mismatch test, Michael S. Tsirkin, 2016/09/23
- [Qemu-devel] [PULL 04/19] virtio: add check for descriptor's mapped address, Michael S. Tsirkin, 2016/09/23
- [Qemu-devel] [PULL 05/19] pc: clean up COMPAT macro chaining, Michael S. Tsirkin, 2016/09/23
- [Qemu-devel] [PULL 06/19] target-i386: turn off CPU.l3-cache only for 2.7 and older machine types, Michael S. Tsirkin, 2016/09/23
- [Qemu-devel] [PULL 09/19] virtio: migrate vdev->broken flag, Michael S. Tsirkin, 2016/09/23
- [Qemu-devel] [PULL 07/19] virtio: fix stray tab character, Michael S. Tsirkin, 2016/09/23
- [Qemu-devel] [PULL 08/19] virtio: stop virtqueue processing if device is broken,
Michael S. Tsirkin <=
- [Qemu-devel] [PULL 10/19] virtio: handle virtqueue_map_desc() errors, Michael S. Tsirkin, 2016/09/23
- [Qemu-devel] [PULL 12/19] virtio: use unsigned int for virtqueue_get_avail_bytes() index, Michael S. Tsirkin, 2016/09/23
- [Qemu-devel] [PULL 11/19] virtio: handle virtqueue_get_avail_bytes() errors, Michael S. Tsirkin, 2016/09/23
- [Qemu-devel] [PULL 14/19] virtio: handle virtqueue_num_heads() errors, Michael S. Tsirkin, 2016/09/23
- [Qemu-devel] [PULL 15/19] virtio: handle virtqueue_get_head() errors, Michael S. Tsirkin, 2016/09/23
- [Qemu-devel] [PULL 13/19] virtio: handle virtqueue_read_next_desc() errors, Michael S. Tsirkin, 2016/09/23
- [Qemu-devel] [PULL 16/19] hw/pci: Prepare for AMD IOMMU, Michael S. Tsirkin, 2016/09/23
- [Qemu-devel] [PULL 17/19] hw/i386/trace-events: Add AMD IOMMU trace events, Michael S. Tsirkin, 2016/09/23
- [Qemu-devel] [PULL 19/19] hw/i386: AMD IOMMU IVRS table, Michael S. Tsirkin, 2016/09/23
- [Qemu-devel] [PULL 18/19] hw/i386: Introduce AMD IOMMU, Michael S. Tsirkin, 2016/09/23