Skip to content

fix(vu): packed vring base init, feature filtering, and queue error handling - #541

Open
Lencerf wants to merge 2 commits into
google:mainfrom
Lencerf:fix/vu-vhost-critical
Open

Lencerf wants to merge 2 commits into
google:mainfrom
Lencerf:fix/vu-vhost-critical

Conversation

@Lencerf

@Lencerf Lencerf commented Nov 11, 2026

Copy link
Copy Markdown
Collaborator

Summary

Fixes two critical issues in Alioth's vhost and vhost-user frontend implementations:

  1. Packed virtqueue SET_VRING_BASE wrap counter initialization:

    • Per VirtIO 1.4 Sec 2.8.1, both the driver and device ring wrap counters in packed virtqueues are initialized to 1.
    • When VIRTIO_F_RING_PACKED is negotiated, vhost and vhost-user SET_VRING_BASE encode avail_wrap_counter in bit 15 and used_wrap_counter in bit 31.
    • Update VuFrontend::activate and VhostVsock::activate to set initial base to (1 << 15) | (1 << 31) for packed rings (0 for split rings).
  2. VuFrontend feature filtering and VMM crash prevention:

    • Filter VuFrontend::feature() to expose only supported VirtIO transport features (INDIRECT_DESC, EVENT_IDX, VERSION_1, ACCESS_PLATFORM, RING_PACKED) alongside device-specific feature bits (0..24 and 50..64), stripping VHOST_PROTOCOL (bit 30) and unsupported transport/reserved bits (24..50). Also strip VHOST_PROTOCOL in VhostVsock::new and only include VHOST_PROTOCOL in VuFrontend::activate SET_FEATURES when advertised by the backend.
    • Replace unreachable!() in VuFrontend::handle_event with vu_error::QueueErr (draining the error eventfd on error and reset so re-activation does not loop), and replace unreachable!() in VuFrontend::handle_queue and VhostVsock::handle_queue with kick notification forwarding or error logging so unexpected notifications never crash the VMM.

Testing

  • Added unit tests in alioth/src/virtio/vu/frontend_test.rs and alioth/src/virtio/dev/vsock/vhost_vsock_test.rs covering split vs. packed SET_VRING_BASE, conditional VHOST_PROTOCOL in SET_FEATURES, feature bit filtering, queue error event handling, and unexpected queue notification handling.
  • Verified both commits individually with cargo +nightly fmt --check, cargo test --workspace, cargo clippy --all-targets -- -D warnings, and cargo clippy --all-targets --target x86_64-unknown-linux-gnu -- -D warnings.

Per VirtIO 1.4 Sec 2.8.1, both driver and device ring wrap counters in
packed virtqueues are initialized to 1. For packed rings, vhost and
vhost-user SET_VRING_BASE encode the avail wrap counter in bit 15 and
the used wrap counter in bit 31.

Set the initial vring base to (1 << 15) | (1 << 31) when RING_PACKED is
negotiated in VuFrontend::activate and VhostVsock::activate instead of
hardcoding 0.

Signed-off-by: Changyuan Lyu <changyuanl@google.com>
Filter VuFrontend::feature() so only supported VirtIO transport features
(INDIRECT_DESC, EVENT_IDX, VERSION_1, ACCESS_PLATFORM, RING_PACKED) and
device-specific feature bits (0..24 and 50..64) are exposed to the
guest, stripping VHOST_PROTOCOL (bit 30) and unsupported transport or
reserved bits (24..50). Also only include VHOST_PROTOCOL in
VuFrontend::activate SET_FEATURES when advertised by the backend, and
strip VHOST_PROTOCOL in VhostVsock::new.

Replace unreachable!() in VuFrontend::handle_event with
vu_error::QueueErr (draining the error eventfd on error and reset so
re-activation does not loop), and replace unreachable!() in
VuFrontend::handle_queue and VhostVsock::handle_queue with kick
forwarding or error logging so unexpected notifications never crash the
VMM.

Signed-off-by: Changyuan Lyu <changyuanl@google.com>
@coveralls

Copy link
Copy Markdown

Coverage Report for CI Build 42955106147

Coverage increased (+0.9%) to 44.521%

Details

  • Coverage increased (+0.9%) from the base build.
  • Patch coverage: 8 uncovered changes across 2 files (46 of 54 lines covered, 85.19%).
  • No coverage regressions found.

Uncovered Changes

File Changed Covered %
alioth/src/virtio/dev/vsock/vhost_vsock.rs 19 15 78.95%
alioth/src/virtio/vu/frontend.rs 35 31 88.57%

Coverage Regressions

No coverage regressions found.


Coverage Stats

Coverage Status
Relevant Lines: 16477
Covered Lines: 7133
Line Coverage: 43.29%
Relevant Branches: 1764
Covered Branches: 988
Branch Coverage: 56.01%
Branches in Coverage %: Yes
Coverage Strength: 906.94 hits per line

💛 - Coveralls

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants