Re: [virtio-dev] Timing out virtio-pci config space access

["Michael S. Tsirkin" <mst@redhat.com>]

On Thu, Nov 04, 2021 at 10:37:40PM +0530, Srivatsa Vaddagiri wrote:
> We are working on a virtio-pci implementation on a Type-1 hypervisor where
> backend drivers are hosted in another VM and are considered untrusted. PCI is
> the virtio transport used in this case.
> 
> One issue that crops up is a read/write of config space can potentially block
> forever, as the backend is untrusted and could be causing a denial-of-service of
> sorts. This causes the vcpu to stall forever. I was wondering if we can timeout
> in such case and have the hypervisor break the stall by letting read return
> "error" (-1) along with setting DEVICE_NEEDS_RESET in status register. Will that
> allow Linux guest driver to gracefully fail its probe? I don't see where Linux
> handles DEVICE_NEEDS_RESET currently and also am not sure if returning -1 will
> lead to graceful failure of the driver alone (we don't want VM to come down or
> panic because of a mis-behaving device). 

DEVICE_NEEDS_RESET isn't handled ATM. the point of it in any case
is a recoverable error, with a malicious backend this is
not the case.


Once thing you can do that will work a bit better is implementing
surprise-removal in this case. So hypervisor detects a timeout
(presumably it knows what to expect of the device) and then pretends to
guest device is gone, unmapping it completely from guest.  Note you will
have to find a way to block device from poking at guest memory,
implementing it in the hypervisor.  We likely have some bugs around
surprise-removal but generally are interested in fixing them.

> I saw some discussions in this regard for vDPA where similar solution seem to
> have been discussed.
> 
> https://lkml.org/lkml/2021/7/6/219
> 
> Would that work for PCI transport also?
> 
> Thanks
> vatsa
> 
> 
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: virtio-dev-unsubscribe@lists.oasis-open.org
> For additional commands, e-mail: virtio-dev-help@lists.oasis-open.org


---------------------------------------------------------------------
To unsubscribe, e-mail: virtio-dev-unsubscribe@lists.oasis-open.org
For additional commands, e-mail: virtio-dev-help@lists.oasis-open.org