On 07/15/2015 05:04 PM, Wen Congyang wrote:
> On 07/15/2015 04:42 PM, Jason Wang wrote:
>> >
>> >
>> > On 07/15/2015 04:20 PM, Wen Congyang wrote:
>>> >> commit da51a335 adds all queues in .realize(). But if the
>>> >> guest doesn't support multiqueue, we forget to remove them. And
>>> >> we cannot handle the ctrl vq corretly. The guest will hang.
>>> >>
>>> >> Signed-off-by: Wen Congyang <we...@cn.fujitsu.com>
>>> >> ---
>>> >> hw/net/virtio-net.c | 93
>>> >> ++++++++++++++++++++++++++++++++++++++++++++---------
>>> >> 1 file changed, 78 insertions(+), 15 deletions(-)
>>> >>
>>> >> diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
>>> >> index e3c2db3..48c7705 100644
>>> >> --- a/hw/net/virtio-net.c
>>> >> +++ b/hw/net/virtio-net.c
>>> >> @@ -1306,9 +1306,86 @@ static void virtio_net_tx_bh(void *opaque)
>>> >> }
>>> >> }
>>> >>
>>> >> +static void virtio_net_add_queue(VirtIONet *n, int index)
>>> >> +{
>>> >> + VirtIODevice *vdev = VIRTIO_DEVICE(n);
>>> >> +
>>> >> + n->vqs[index].rx_vq = virtio_add_queue(vdev, 256,
>>> >> virtio_net_handle_rx);
>>> >> + if (n->net_conf.tx && !strcmp(n->net_conf.tx, "timer")) {
>>> >> + n->vqs[index].tx_vq =
>>> >> + virtio_add_queue(vdev, 256, virtio_net_handle_tx_timer);
>>> >> + n->vqs[index].tx_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL,
>>> >> + virtio_net_tx_timer,
>>> >> + &n->vqs[index]);
>>> >> + } else {
>>> >> + n->vqs[index].tx_vq =
>>> >> + virtio_add_queue(vdev, 256, virtio_net_handle_tx_bh);
>>> >> + n->vqs[index].tx_bh = qemu_bh_new(virtio_net_tx_bh,
>>> >> &n->vqs[index]);
>>> >> + }
>>> >> +
>>> >> + n->vqs[index].tx_waiting = 0;
>>> >> + n->vqs[index].n = n;
>>> >> +}
>>> >> +
>>> >> +static void virtio_net_del_queue(VirtIONet *n, int index)
>>> >> +{
>>> >> + VirtIODevice *vdev = VIRTIO_DEVICE(n);
>>> >> + VirtIONetQueue *q = &n->vqs[index];
>>> >> + NetClientState *nc = qemu_get_subqueue(n->nic, index);
>>> >> +
>>> >> + qemu_purge_queued_packets(nc);
>>> >> +
>>> >> + virtio_del_queue(vdev, index * 2);
>>> >> + if (q->tx_timer) {
>>> >> + timer_del(q->tx_timer);
>>> >> + timer_free(q->tx_timer);
>>> >> + } else {
>>> >> + qemu_bh_delete(q->tx_bh);
>>> >> + }
>>> >> + virtio_del_queue(vdev, index * 2 + 1);
>>> >> +}
>> >
>> > Ok, then in unrealize() you may just want to delete bhs/timers up to
>> > curr_queues. Otherwise it may cause a use after free?
> One question: If the max_queues in qemu is 3, and the guest set queues to 2.
> which vq is ctrl vq? vq[4] or vq[6]?
Spec (5.1.2) said
"
0
receiveq1
1
transmitq1
…
2N
receiveqN
2N+1
transmitqN
2N+2
controlq
N=1 if VIRTIO_NET_F_MQ is not negotiated, otherwise N is set by
max_virtqueue_pairs.
"
So should be 6.
> Thanks
> Wen Congyang
>
