diff options
| author | John Levon <john.levon@nutanix.com> | 2020-11-20 18:51:07 +0000 |
|---|---|---|
| committer | Michael S. Tsirkin <mst@redhat.com> | 2020-12-08 13:48:57 -0500 |
| commit | 4aedda25e883c7c2e7cae911e39b84ad96ef4766 (patch) | |
| tree | 0b3bb57ec003d8db04487ee269287c6a845ebba5 /hw/virtio | |
| parent | 1804857f19f612f6907832e35599cdb51d4ec764 (diff) | |
virtio: reset device on bad guest index in virtio_load()
If we find a queue with an inconsistent guest index value, explicitly mark the
device as needing a reset - and broken - via virtio_error().
There's at least one driver implementation - the virtio-win NetKVM driver - that
is able to handle a VIRTIO_CONFIG_S_NEEDS_RESET notification and successfully
restore the device to a working state. Other implementations do not correctly
handle this, but as the VQ is not in a functional state anyway, this is still
worth doing.
Signed-off-by: John Levon <john.levon@nutanix.com>
Message-Id: <20201120185103.GA442386@sent>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Diffstat (limited to 'hw/virtio')
| -rw-r--r-- | hw/virtio/virtio.c | 15 |
1 files changed, 9 insertions, 6 deletions
diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c index ceb58fda6c..eff35fab7c 100644 --- a/hw/virtio/virtio.c +++ b/hw/virtio/virtio.c @@ -3161,12 +3161,15 @@ int virtio_load(VirtIODevice *vdev, QEMUFile *f, int version_id) nheads = vring_avail_idx(&vdev->vq[i]) - vdev->vq[i].last_avail_idx; /* Check it isn't doing strange things with descriptor numbers. */ if (nheads > vdev->vq[i].vring.num) { - qemu_log_mask(LOG_GUEST_ERROR, - "VQ %d size 0x%x Guest index 0x%x " - "inconsistent with Host index 0x%x: delta 0x%x", - i, vdev->vq[i].vring.num, - vring_avail_idx(&vdev->vq[i]), - vdev->vq[i].last_avail_idx, nheads); + virtio_error(vdev, "VQ %d size 0x%x Guest index 0x%x " + "inconsistent with Host index 0x%x: delta 0x%x", + i, vdev->vq[i].vring.num, + vring_avail_idx(&vdev->vq[i]), + vdev->vq[i].last_avail_idx, nheads); + vdev->vq[i].used_idx = 0; + vdev->vq[i].shadow_avail_idx = 0; + vdev->vq[i].inuse = 0; + continue; } vdev->vq[i].used_idx = vring_used_idx(&vdev->vq[i]); vdev->vq[i].shadow_avail_idx = vring_avail_idx(&vdev->vq[i]); |