IssueTracker

The problems described here were found during code review for the virtio-iommu specification update, which is discussed at: https://lore.kernel.org/virtio-dev/20230803153238.541803-5-jean-philippe@linaro.org/

The Linux driver of virtio-iommu DETACHes an endpoint for unplugged devices since 6.5: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit?id=809d0810e3520da669d231303608cdf5fe5c1a70

This interacts badly with crosvm:

1. crosvm does not support DETACH request for domains with several endpoints.

This limitation is stated in: https://chromium.googlesource.com/crosvm/crosvm/+/fef85d48c85ea6a50b12bcab0ad61d6be17469fd%5E%21/

2. crosvm automatically DETACHes such an endpoint (in a wrong way)

Such a detach operation is inherently prone to a race condition that can result in use-after-free in a scenario like following:

    VMM                        GUEST
 Remove ep 1
   detach domain 1
   destroy domain 1
                            ATTACH ep 2 to domain 1
 Handle ATTACH
   create domain 1

 Notify that ep 1 is gone
                            Handle notification, DETACH ep 1

The guest tries to attach ep 2 to domain 1, which succeeds. So the guest expects that ep 2 is now able to access the mappings that were on domain 1. But instead it's a new empty domain.

https://lore.kernel.org/virtio-dev/20230811142039.GA2189828@myrica/

As such, crosvm must not automatically DETACH an endpoint.

Moreover, the automatic DETACH is implemented wrongly. crosvm destroys the domain even if there are other endpoints attached to the domain. You can see the relevant code at: https://chromium.googlesource.com/crosvm/crosvm/+/7cd94642e79a39f740b3a49373e9cdef77e9150d/devices/src/virtio/iommu/sys/unix.rs#69

Recommended fixes:

• Implement DETACH request for domains with several endpoints.
• Remove the code that automatically DETACHes endpoints for unplugged devices.

It is proposed to clarify what the guest and host should do with hot-unplug on the virtio-dev thread mentioned above. Please reply to it if you have any questions.