Re: [PATCH 2/3] hw/9pfs/virtio: disable hotpluggable property of virtio-9p device

[Igor Mammedov <imammedo@redhat.com>]

On Fri, 10 Jul 2026 10:06:29 +0200
Christian Schoenebeck <qemu_oss@crudebyte.com> wrote:

> On Friday, 10 July 2026 09:37:37 CEST Igor Mammedov wrote:
> > On Thu, 9 Jul 2026 15:50:36 +0200
> > 
> > Christian Schoenebeck <qemu_oss@crudebyte.com> wrote:  
> > > Harden security by disabling hotpluggable property, to prevent
> > > issues like fixed in the previous commit.
> > > 
> > > Virtio-9p is a pass-through file-sharing device that provides a
> > > guest mount of a host filesystem tree. Unlike block or network
> > > devices, guest-triggered hotplug of the 9p device has no practical
> > > use case: the guest cannot recover from the device removal, and there
> > > is no protocol-level device-loss scenario as with block or ethernet
> > > devices.  
> > 
> > hmh, I'm no maintainer of 9pfs, but to me it looks like any other
> > storage device.
> > One should be able to unmount/stop using it and unplug
> > (it doesn't really matter if unplug is triggered by guest or host side).  
> 
> Guest could still unmount and stop using the 9pfs device. But why should guest 
> be able to unrealize the 9pfs device at any time? What should be the purpose 
> for this particular device?

unrealize is part of unplug process, at the end of unplug no device should be left attached.
You might not need/use it but others might be using it actively.

--- 

In QEMU impl. it's cooperative process (we don't do surprise removal of PCI devices),
where host triggers plug/unplug process and guest side completes it, by:
  1. freeing resources on its side 1st (hopefully)
  2. issuing eject/poweroff (either via ACPI or native PCIE-HP/SHPC interface)

If guest fails to do #1 it is able to abort process, or it might continue and
do #2 with a risk of loosing data but it's guest's business/policy.

If you need to disable hotplug for a specific PCI device instance,
use 'hotplug' CLI option on pcie bridge. If you use other than PCI variant
of virtio device, then unplug as you describe it isn't reachable, and if it
should be disabled in code, it's up to actual frontend device that exposes
underlying virtio one.

> /Christian
> 
>