Re: [PATCH v4 6/9] KVM: Save/restore state of assigned PCI device

[Jan Kiszka <jan.kiszka@siemens.com>]

Am 09.11.2010 13:35, Avi Kivity wrote:
> On 11/08/2010 01:21 PM, Jan Kiszka wrote:
>> The guest may change states that pci_reset_function does not touch. So
>> we better save/restore the assigned device across guest usage.
> 
> Why do we care?  Shouldn't the next user reset the state to its taste?  

Maybe he should, but are we sure this actually happens? E.g.
pci_reset_function preserves the config state, thus does not remove the
traces of guest.

> Or are you worried about information leakage?

Anyone who's worried about security should not assign the same device to
different users (host or guest) that should be isolated from each other.
You never know in what state the firmware and/or internal memory of the
device are.

Probably, anyone concerned about security should not give a device in
untrusted hands at all...

>> @@ -514,6 +515,7 @@ static int kvm_vm_ioctl_assign_device(struct kvm *kvm,
>>   	}
>>
>>   	pci_reset_function(dev);
>> +	pci_save_state(dev);
>>
>>   	match->assigned_dev_id = assigned_dev->assigned_dev_id;
>>   	match->host_segnr = assigned_dev->segnr;
>> @@ -544,6 +546,7 @@ out:
>>   	mutex_unlock(&kvm->lock);
>>   	return r;
>>   out_list_del:
>> +	pci_restore_state(dev);
>>   	list_del(&match->list);
>>   	pci_release_regions(dev);
>>   out_disable:
> 
> This assumes no one else calls pci_save_state()/pci_restore_state() 

Correct.

> while the guest is running.  Is this true?  What about suspend/resume? 
> (can this even work without guest assistance?)

Well, so far suspend/resume does not work at all once assigned devices
are in use. IIUC, the guest is not informed about the fact that power
will be cut off, trashing the states of its assigned devices. We would
have to signal this event to the guest and give it a chance to save the
states.

Maybe we could generate an ACPI event that corresponds to pressing a
standby button. Or we would have to signal PCI unplug events for all
assigned devices. In any case, suspend/resume of the host then becomes
dependent on guest proper reaction.

Jan

-- 
Siemens AG, Corporate Technology, CT T DE IT 1
Corporate Competence Center Embedded Linux