Re: [Qemu-devel] [PATCH] hw/core/qdev: Do not allow hot-plugging without hotplug controller

[Thomas Huth <thuth@redhat.com>]

On 26.09.2017 15:41, Eduardo Habkost wrote:
> On Tue, Sep 26, 2017 at 12:05:47PM +0200, Thomas Huth wrote:
>> On 21.09.2017 19:56, Eduardo Habkost wrote:
>>> On Thu, Sep 07, 2017 at 11:22:42AM +0200, Thomas Huth wrote:
>>>> qdev_unplug() bails out with an assertion if the user tries to device_del
>>>> a hot-plugged device that does not have a hotplug controller. Unfortunately,
>>>> our devices are all marked with hotpluggable = true by default (see the
>>>> device_class_init() function in qdev.c), so it currently can happen that
>>>> the user runs into this situation and QEMU gets terminated unexpectedly:
>>>>
>>>> $ qemu-system-aarch64 -M virt -nographic -nodefaults -monitor stdio -S
>>>> QEMU 2.10.50 monitor - type 'help' for more information
>>>> (qemu) device_add aux-to-i2c-bridge,id=x
>>>> (qemu) device_del x
>>>> **
>>>> ERROR:qdev-monitor.c:872:qdev_unplug: assertion failed: (hotplug_ctrl)
>>>> Aborted (core dumped)
>>>>
>>>> Hotplugging devices without a hotplug controller does not make much sense,
>>>> so we should disallow this during the device_add process already!
>>>>
>>>> Suggested-by: Paolo Bonzini <pbonzini@redhat.com>
>>>> Signed-off-by: Thomas Huth <thuth@redhat.com>
>>>
>>> I'm queueing this on machine-next.  We still want it even if we
>>> apply the patch that changes TYPE_DEVICE to hotpluggable=false by
>>> default, right?
>>
>> OK, just to be sure: Please de-queue it again. As you already mentioned
>> in another mail, there are situations where this does not work (e.g.
>> when one hot-pluggable device wants to instantiate another hot-pluggable
>> device internally).
> 
> I just dequeued it.
> 
>>
>> But maybe we could add the test for the availability of a hot-plug
>> controller to qmp_device_add() instead? (I haven't had a closer look at
>> that yet, though).
> 
> I'm unsure about this.  Now we know we have some devices that
> work without a hotplug controller, so what's the reason
> device_add must always require one?

The problem is that you can also "device_del" these devices again. And
qdev_unplug() currently has this piece of code in it:

    /* hotpluggable device MUST have HotplugHandler, if it doesn't
     * then something is very wrong with it */
    g_assert(hotplug_ctrl);

So if you do a device_add followed by a device_del with one of these
devices, QEMU aborts and kills your guest.

One solution is maybe to remove the assert here. OTOH, considering that
we have the assert in qdev_monitor.c->qdev_unplug(), adding a check for
the availability of a hotplug_ctrl in qdev_monitor.c->qmp_device_add()
currently sounds like the better solution to this problem to me. Anybody
got another opinion here? If not, I'll have a try and send a patch...

 Thomas