virtio: stop virtqueue processing if device is broken
authorStefan Hajnoczi <stefanha@redhat.com>
Wed, 21 Sep 2016 15:52:19 +0000 (16:52 +0100)
committerMichael S. Tsirkin <mst@redhat.com>
Fri, 23 Sep 2016 16:03:55 +0000 (19:03 +0300)
commitf5ed36635d8fa73feb66fe12b3b9c2ed90a1adbe
treea9086bb7f609570c31bf5503c89e81c947adc890
parent8275e2f6be8b10c2b3da0fe6927d0ce7ad438c80
virtio: stop virtqueue processing if device is broken

QEMU prints an error message and exits when the device enters an invalid
state.  Terminating the process is heavy-handed.  The guest may still be
able to function even if there is a bug in a virtio guest driver.

Moreover, exiting is a bug in nested virtualization where a nested guest
could DoS other nested guests by killing a pass-through virtio device.
I don't think this configuration is possible today but it is likely in
the future.

If the broken flag is set, do not process virtqueues or write back used
descriptors.  The broken flag can be cleared again by resetting the
device.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com>
hw/virtio/virtio.c
include/hw/virtio/virtio.h