1 /* 2 * Vhost User library 3 * 4 * Copyright IBM, Corp. 2007 5 * Copyright (c) 2016 Red Hat, Inc. 6 * 7 * Authors: 8 * Anthony Liguori <aliguori@us.ibm.com> 9 * Marc-André Lureau <mlureau@redhat.com> 10 * Victor Kaplansky <victork@redhat.com> 11 * 12 * This work is licensed under the terms of the GNU GPL, version 2 or 13 * later. See the COPYING file in the top-level directory. 14 */ 15 16 #ifndef _GNU_SOURCE 17 #define _GNU_SOURCE 18 #endif 19 20 /* this code avoids GLib dependency */ 21 #include <stdlib.h> 22 #include <stdio.h> 23 #include <unistd.h> 24 #include <stdarg.h> 25 #include <errno.h> 26 #include <string.h> 27 #include <assert.h> 28 #include <inttypes.h> 29 #include <sys/types.h> 30 #include <sys/socket.h> 31 #include <sys/eventfd.h> 32 #include <sys/mman.h> 33 #include <endian.h> 34 35 #if defined(__linux__) 36 #include <sys/syscall.h> 37 #include <fcntl.h> 38 #include <sys/ioctl.h> 39 #include <linux/vhost.h> 40 41 #ifdef __NR_userfaultfd 42 #include <linux/userfaultfd.h> 43 #endif 44 45 #endif 46 47 #include "include/atomic.h" 48 49 #include "libvhost-user.h" 50 51 /* usually provided by GLib */ 52 #if __GNUC__ > 2 || (__GNUC__ == 2 && __GNUC_MINOR__ > 4) 53 #if !defined(__clang__) && (__GNUC__ == 4 && __GNUC_MINOR__ == 4) 54 #define G_GNUC_PRINTF(format_idx, arg_idx) \ 55 __attribute__((__format__(gnu_printf, format_idx, arg_idx))) 56 #else 57 #define G_GNUC_PRINTF(format_idx, arg_idx) \ 58 __attribute__((__format__(__printf__, format_idx, arg_idx))) 59 #endif 60 #else /* !__GNUC__ */ 61 #define G_GNUC_PRINTF(format_idx, arg_idx) 62 #endif /* !__GNUC__ */ 63 #ifndef MIN 64 #define MIN(x, y) ({ \ 65 __typeof__(x) _min1 = (x); \ 66 __typeof__(y) _min2 = (y); \ 67 (void) (&_min1 == &_min2); \ 68 _min1 < _min2 ? _min1 : _min2; }) 69 #endif 70 71 /* Round number down to multiple */ 72 #define ALIGN_DOWN(n, m) ((n) / (m) * (m)) 73 74 /* Round number up to multiple */ 75 #define ALIGN_UP(n, m) ALIGN_DOWN((n) + (m) - 1, (m)) 76 77 #ifndef unlikely 78 #define unlikely(x) __builtin_expect(!!(x), 0) 79 #endif 80 81 /* Align each region to cache line size in inflight buffer */ 82 #define INFLIGHT_ALIGNMENT 64 83 84 /* The version of inflight buffer */ 85 #define INFLIGHT_VERSION 1 86 87 /* The version of the protocol we support */ 88 #define VHOST_USER_VERSION 1 89 #define LIBVHOST_USER_DEBUG 0 90 91 #define DPRINT(...) \ 92 do { \ 93 if (LIBVHOST_USER_DEBUG) { \ 94 fprintf(stderr, __VA_ARGS__); \ 95 } \ 96 } while (0) 97 98 static inline 99 bool has_feature(uint64_t features, unsigned int fbit) 100 { 101 assert(fbit < 64); 102 return !!(features & (1ULL << fbit)); 103 } 104 105 static inline 106 bool vu_has_feature(VuDev *dev, 107 unsigned int fbit) 108 { 109 return has_feature(dev->features, fbit); 110 } 111 112 static inline bool vu_has_protocol_feature(VuDev *dev, unsigned int fbit) 113 { 114 return has_feature(dev->protocol_features, fbit); 115 } 116 117 const char * 118 vu_request_to_string(unsigned int req) 119 { 120 #define REQ(req) [req] = #req 121 static const char *vu_request_str[] = { 122 REQ(VHOST_USER_NONE), 123 REQ(VHOST_USER_GET_FEATURES), 124 REQ(VHOST_USER_SET_FEATURES), 125 REQ(VHOST_USER_SET_OWNER), 126 REQ(VHOST_USER_RESET_OWNER), 127 REQ(VHOST_USER_SET_MEM_TABLE), 128 REQ(VHOST_USER_SET_LOG_BASE), 129 REQ(VHOST_USER_SET_LOG_FD), 130 REQ(VHOST_USER_SET_VRING_NUM), 131 REQ(VHOST_USER_SET_VRING_ADDR), 132 REQ(VHOST_USER_SET_VRING_BASE), 133 REQ(VHOST_USER_GET_VRING_BASE), 134 REQ(VHOST_USER_SET_VRING_KICK), 135 REQ(VHOST_USER_SET_VRING_CALL), 136 REQ(VHOST_USER_SET_VRING_ERR), 137 REQ(VHOST_USER_GET_PROTOCOL_FEATURES), 138 REQ(VHOST_USER_SET_PROTOCOL_FEATURES), 139 REQ(VHOST_USER_GET_QUEUE_NUM), 140 REQ(VHOST_USER_SET_VRING_ENABLE), 141 REQ(VHOST_USER_SEND_RARP), 142 REQ(VHOST_USER_NET_SET_MTU), 143 REQ(VHOST_USER_SET_SLAVE_REQ_FD), 144 REQ(VHOST_USER_IOTLB_MSG), 145 REQ(VHOST_USER_SET_VRING_ENDIAN), 146 REQ(VHOST_USER_GET_CONFIG), 147 REQ(VHOST_USER_SET_CONFIG), 148 REQ(VHOST_USER_POSTCOPY_ADVISE), 149 REQ(VHOST_USER_POSTCOPY_LISTEN), 150 REQ(VHOST_USER_POSTCOPY_END), 151 REQ(VHOST_USER_GET_INFLIGHT_FD), 152 REQ(VHOST_USER_SET_INFLIGHT_FD), 153 REQ(VHOST_USER_GPU_SET_SOCKET), 154 REQ(VHOST_USER_VRING_KICK), 155 REQ(VHOST_USER_GET_MAX_MEM_SLOTS), 156 REQ(VHOST_USER_ADD_MEM_REG), 157 REQ(VHOST_USER_REM_MEM_REG), 158 REQ(VHOST_USER_MAX), 159 }; 160 #undef REQ 161 162 if (req < VHOST_USER_MAX) { 163 return vu_request_str[req]; 164 } else { 165 return "unknown"; 166 } 167 } 168 169 static void G_GNUC_PRINTF(2, 3) 170 vu_panic(VuDev *dev, const char *msg, ...) 171 { 172 char *buf = NULL; 173 va_list ap; 174 175 va_start(ap, msg); 176 if (vasprintf(&buf, msg, ap) < 0) { 177 buf = NULL; 178 } 179 va_end(ap); 180 181 dev->broken = true; 182 dev->panic(dev, buf); 183 free(buf); 184 185 /* 186 * FIXME: 187 * find a way to call virtio_error, or perhaps close the connection? 188 */ 189 } 190 191 /* Translate guest physical address to our virtual address. */ 192 void * 193 vu_gpa_to_va(VuDev *dev, uint64_t *plen, uint64_t guest_addr) 194 { 195 int i; 196 197 if (*plen == 0) { 198 return NULL; 199 } 200 201 /* Find matching memory region. */ 202 for (i = 0; i < dev->nregions; i++) { 203 VuDevRegion *r = &dev->regions[i]; 204 205 if ((guest_addr >= r->gpa) && (guest_addr < (r->gpa + r->size))) { 206 if ((guest_addr + *plen) > (r->gpa + r->size)) { 207 *plen = r->gpa + r->size - guest_addr; 208 } 209 return (void *)(uintptr_t) 210 guest_addr - r->gpa + r->mmap_addr + r->mmap_offset; 211 } 212 } 213 214 return NULL; 215 } 216 217 /* Translate qemu virtual address to our virtual address. */ 218 static void * 219 qva_to_va(VuDev *dev, uint64_t qemu_addr) 220 { 221 int i; 222 223 /* Find matching memory region. */ 224 for (i = 0; i < dev->nregions; i++) { 225 VuDevRegion *r = &dev->regions[i]; 226 227 if ((qemu_addr >= r->qva) && (qemu_addr < (r->qva + r->size))) { 228 return (void *)(uintptr_t) 229 qemu_addr - r->qva + r->mmap_addr + r->mmap_offset; 230 } 231 } 232 233 return NULL; 234 } 235 236 static void 237 vmsg_close_fds(VhostUserMsg *vmsg) 238 { 239 int i; 240 241 for (i = 0; i < vmsg->fd_num; i++) { 242 close(vmsg->fds[i]); 243 } 244 } 245 246 /* Set reply payload.u64 and clear request flags and fd_num */ 247 static void vmsg_set_reply_u64(VhostUserMsg *vmsg, uint64_t val) 248 { 249 vmsg->flags = 0; /* defaults will be set by vu_send_reply() */ 250 vmsg->size = sizeof(vmsg->payload.u64); 251 vmsg->payload.u64 = val; 252 vmsg->fd_num = 0; 253 } 254 255 /* A test to see if we have userfault available */ 256 static bool 257 have_userfault(void) 258 { 259 #if defined(__linux__) && defined(__NR_userfaultfd) &&\ 260 defined(UFFD_FEATURE_MISSING_SHMEM) &&\ 261 defined(UFFD_FEATURE_MISSING_HUGETLBFS) 262 /* Now test the kernel we're running on really has the features */ 263 int ufd = syscall(__NR_userfaultfd, O_CLOEXEC | O_NONBLOCK); 264 struct uffdio_api api_struct; 265 if (ufd < 0) { 266 return false; 267 } 268 269 api_struct.api = UFFD_API; 270 api_struct.features = UFFD_FEATURE_MISSING_SHMEM | 271 UFFD_FEATURE_MISSING_HUGETLBFS; 272 if (ioctl(ufd, UFFDIO_API, &api_struct)) { 273 close(ufd); 274 return false; 275 } 276 close(ufd); 277 return true; 278 279 #else 280 return false; 281 #endif 282 } 283 284 static bool 285 vu_message_read_default(VuDev *dev, int conn_fd, VhostUserMsg *vmsg) 286 { 287 char control[CMSG_SPACE(VHOST_MEMORY_BASELINE_NREGIONS * sizeof(int))] = {}; 288 struct iovec iov = { 289 .iov_base = (char *)vmsg, 290 .iov_len = VHOST_USER_HDR_SIZE, 291 }; 292 struct msghdr msg = { 293 .msg_iov = &iov, 294 .msg_iovlen = 1, 295 .msg_control = control, 296 .msg_controllen = sizeof(control), 297 }; 298 size_t fd_size; 299 struct cmsghdr *cmsg; 300 int rc; 301 302 do { 303 rc = recvmsg(conn_fd, &msg, 0); 304 } while (rc < 0 && (errno == EINTR || errno == EAGAIN)); 305 306 if (rc < 0) { 307 vu_panic(dev, "Error while recvmsg: %s", strerror(errno)); 308 return false; 309 } 310 311 vmsg->fd_num = 0; 312 for (cmsg = CMSG_FIRSTHDR(&msg); 313 cmsg != NULL; 314 cmsg = CMSG_NXTHDR(&msg, cmsg)) 315 { 316 if (cmsg->cmsg_level == SOL_SOCKET && cmsg->cmsg_type == SCM_RIGHTS) { 317 fd_size = cmsg->cmsg_len - CMSG_LEN(0); 318 vmsg->fd_num = fd_size / sizeof(int); 319 memcpy(vmsg->fds, CMSG_DATA(cmsg), fd_size); 320 break; 321 } 322 } 323 324 if (vmsg->size > sizeof(vmsg->payload)) { 325 vu_panic(dev, 326 "Error: too big message request: %d, size: vmsg->size: %u, " 327 "while sizeof(vmsg->payload) = %zu\n", 328 vmsg->request, vmsg->size, sizeof(vmsg->payload)); 329 goto fail; 330 } 331 332 if (vmsg->size) { 333 do { 334 rc = read(conn_fd, &vmsg->payload, vmsg->size); 335 } while (rc < 0 && (errno == EINTR || errno == EAGAIN)); 336 337 if (rc <= 0) { 338 vu_panic(dev, "Error while reading: %s", strerror(errno)); 339 goto fail; 340 } 341 342 assert((uint32_t)rc == vmsg->size); 343 } 344 345 return true; 346 347 fail: 348 vmsg_close_fds(vmsg); 349 350 return false; 351 } 352 353 static bool 354 vu_message_write(VuDev *dev, int conn_fd, VhostUserMsg *vmsg) 355 { 356 int rc; 357 uint8_t *p = (uint8_t *)vmsg; 358 char control[CMSG_SPACE(VHOST_MEMORY_BASELINE_NREGIONS * sizeof(int))] = {}; 359 struct iovec iov = { 360 .iov_base = (char *)vmsg, 361 .iov_len = VHOST_USER_HDR_SIZE, 362 }; 363 struct msghdr msg = { 364 .msg_iov = &iov, 365 .msg_iovlen = 1, 366 .msg_control = control, 367 }; 368 struct cmsghdr *cmsg; 369 370 memset(control, 0, sizeof(control)); 371 assert(vmsg->fd_num <= VHOST_MEMORY_BASELINE_NREGIONS); 372 if (vmsg->fd_num > 0) { 373 size_t fdsize = vmsg->fd_num * sizeof(int); 374 msg.msg_controllen = CMSG_SPACE(fdsize); 375 cmsg = CMSG_FIRSTHDR(&msg); 376 cmsg->cmsg_len = CMSG_LEN(fdsize); 377 cmsg->cmsg_level = SOL_SOCKET; 378 cmsg->cmsg_type = SCM_RIGHTS; 379 memcpy(CMSG_DATA(cmsg), vmsg->fds, fdsize); 380 } else { 381 msg.msg_controllen = 0; 382 } 383 384 do { 385 rc = sendmsg(conn_fd, &msg, 0); 386 } while (rc < 0 && (errno == EINTR || errno == EAGAIN)); 387 388 if (vmsg->size) { 389 do { 390 if (vmsg->data) { 391 rc = write(conn_fd, vmsg->data, vmsg->size); 392 } else { 393 rc = write(conn_fd, p + VHOST_USER_HDR_SIZE, vmsg->size); 394 } 395 } while (rc < 0 && (errno == EINTR || errno == EAGAIN)); 396 } 397 398 if (rc <= 0) { 399 vu_panic(dev, "Error while writing: %s", strerror(errno)); 400 return false; 401 } 402 403 return true; 404 } 405 406 static bool 407 vu_send_reply(VuDev *dev, int conn_fd, VhostUserMsg *vmsg) 408 { 409 /* Set the version in the flags when sending the reply */ 410 vmsg->flags &= ~VHOST_USER_VERSION_MASK; 411 vmsg->flags |= VHOST_USER_VERSION; 412 vmsg->flags |= VHOST_USER_REPLY_MASK; 413 414 return vu_message_write(dev, conn_fd, vmsg); 415 } 416 417 /* 418 * Processes a reply on the slave channel. 419 * Entered with slave_mutex held and releases it before exit. 420 * Returns true on success. 421 */ 422 static bool 423 vu_process_message_reply(VuDev *dev, const VhostUserMsg *vmsg) 424 { 425 VhostUserMsg msg_reply; 426 bool result = false; 427 428 if ((vmsg->flags & VHOST_USER_NEED_REPLY_MASK) == 0) { 429 result = true; 430 goto out; 431 } 432 433 if (!vu_message_read_default(dev, dev->slave_fd, &msg_reply)) { 434 goto out; 435 } 436 437 if (msg_reply.request != vmsg->request) { 438 DPRINT("Received unexpected msg type. Expected %d received %d", 439 vmsg->request, msg_reply.request); 440 goto out; 441 } 442 443 result = msg_reply.payload.u64 == 0; 444 445 out: 446 pthread_mutex_unlock(&dev->slave_mutex); 447 return result; 448 } 449 450 /* Kick the log_call_fd if required. */ 451 static void 452 vu_log_kick(VuDev *dev) 453 { 454 if (dev->log_call_fd != -1) { 455 DPRINT("Kicking the QEMU's log...\n"); 456 if (eventfd_write(dev->log_call_fd, 1) < 0) { 457 vu_panic(dev, "Error writing eventfd: %s", strerror(errno)); 458 } 459 } 460 } 461 462 static void 463 vu_log_page(uint8_t *log_table, uint64_t page) 464 { 465 DPRINT("Logged dirty guest page: %"PRId64"\n", page); 466 qatomic_or(&log_table[page / 8], 1 << (page % 8)); 467 } 468 469 static void 470 vu_log_write(VuDev *dev, uint64_t address, uint64_t length) 471 { 472 uint64_t page; 473 474 if (!(dev->features & (1ULL << VHOST_F_LOG_ALL)) || 475 !dev->log_table || !length) { 476 return; 477 } 478 479 assert(dev->log_size > ((address + length - 1) / VHOST_LOG_PAGE / 8)); 480 481 page = address / VHOST_LOG_PAGE; 482 while (page * VHOST_LOG_PAGE < address + length) { 483 vu_log_page(dev->log_table, page); 484 page += 1; 485 } 486 487 vu_log_kick(dev); 488 } 489 490 static void 491 vu_kick_cb(VuDev *dev, int condition, void *data) 492 { 493 int index = (intptr_t)data; 494 VuVirtq *vq = &dev->vq[index]; 495 int sock = vq->kick_fd; 496 eventfd_t kick_data; 497 ssize_t rc; 498 499 rc = eventfd_read(sock, &kick_data); 500 if (rc == -1) { 501 vu_panic(dev, "kick eventfd_read(): %s", strerror(errno)); 502 dev->remove_watch(dev, dev->vq[index].kick_fd); 503 } else { 504 DPRINT("Got kick_data: %016"PRIx64" handler:%p idx:%d\n", 505 kick_data, vq->handler, index); 506 if (vq->handler) { 507 vq->handler(dev, index); 508 } 509 } 510 } 511 512 static bool 513 vu_get_features_exec(VuDev *dev, VhostUserMsg *vmsg) 514 { 515 vmsg->payload.u64 = 516 /* 517 * The following VIRTIO feature bits are supported by our virtqueue 518 * implementation: 519 */ 520 1ULL << VIRTIO_F_NOTIFY_ON_EMPTY | 521 1ULL << VIRTIO_RING_F_INDIRECT_DESC | 522 1ULL << VIRTIO_RING_F_EVENT_IDX | 523 1ULL << VIRTIO_F_VERSION_1 | 524 525 /* vhost-user feature bits */ 526 1ULL << VHOST_F_LOG_ALL | 527 1ULL << VHOST_USER_F_PROTOCOL_FEATURES; 528 529 if (dev->iface->get_features) { 530 vmsg->payload.u64 |= dev->iface->get_features(dev); 531 } 532 533 vmsg->size = sizeof(vmsg->payload.u64); 534 vmsg->fd_num = 0; 535 536 DPRINT("Sending back to guest u64: 0x%016"PRIx64"\n", vmsg->payload.u64); 537 538 return true; 539 } 540 541 static void 542 vu_set_enable_all_rings(VuDev *dev, bool enabled) 543 { 544 uint16_t i; 545 546 for (i = 0; i < dev->max_queues; i++) { 547 dev->vq[i].enable = enabled; 548 } 549 } 550 551 static bool 552 vu_set_features_exec(VuDev *dev, VhostUserMsg *vmsg) 553 { 554 DPRINT("u64: 0x%016"PRIx64"\n", vmsg->payload.u64); 555 556 dev->features = vmsg->payload.u64; 557 if (!vu_has_feature(dev, VIRTIO_F_VERSION_1)) { 558 /* 559 * We only support devices conforming to VIRTIO 1.0 or 560 * later 561 */ 562 vu_panic(dev, "virtio legacy devices aren't supported by libvhost-user"); 563 return false; 564 } 565 566 if (!(dev->features & VHOST_USER_F_PROTOCOL_FEATURES)) { 567 vu_set_enable_all_rings(dev, true); 568 } 569 570 if (dev->iface->set_features) { 571 dev->iface->set_features(dev, dev->features); 572 } 573 574 return false; 575 } 576 577 static bool 578 vu_set_owner_exec(VuDev *dev, VhostUserMsg *vmsg) 579 { 580 return false; 581 } 582 583 static void 584 vu_close_log(VuDev *dev) 585 { 586 if (dev->log_table) { 587 if (munmap(dev->log_table, dev->log_size) != 0) { 588 perror("close log munmap() error"); 589 } 590 591 dev->log_table = NULL; 592 } 593 if (dev->log_call_fd != -1) { 594 close(dev->log_call_fd); 595 dev->log_call_fd = -1; 596 } 597 } 598 599 static bool 600 vu_reset_device_exec(VuDev *dev, VhostUserMsg *vmsg) 601 { 602 vu_set_enable_all_rings(dev, false); 603 604 return false; 605 } 606 607 static bool 608 map_ring(VuDev *dev, VuVirtq *vq) 609 { 610 vq->vring.desc = qva_to_va(dev, vq->vra.desc_user_addr); 611 vq->vring.used = qva_to_va(dev, vq->vra.used_user_addr); 612 vq->vring.avail = qva_to_va(dev, vq->vra.avail_user_addr); 613 614 DPRINT("Setting virtq addresses:\n"); 615 DPRINT(" vring_desc at %p\n", vq->vring.desc); 616 DPRINT(" vring_used at %p\n", vq->vring.used); 617 DPRINT(" vring_avail at %p\n", vq->vring.avail); 618 619 return !(vq->vring.desc && vq->vring.used && vq->vring.avail); 620 } 621 622 static bool 623 generate_faults(VuDev *dev) { 624 int i; 625 for (i = 0; i < dev->nregions; i++) { 626 VuDevRegion *dev_region = &dev->regions[i]; 627 int ret; 628 #ifdef UFFDIO_REGISTER 629 /* 630 * We should already have an open ufd. Mark each memory 631 * range as ufd. 632 * Discard any mapping we have here; note I can't use MADV_REMOVE 633 * or fallocate to make the hole since I don't want to lose 634 * data that's already arrived in the shared process. 635 * TODO: How to do hugepage 636 */ 637 ret = madvise((void *)(uintptr_t)dev_region->mmap_addr, 638 dev_region->size + dev_region->mmap_offset, 639 MADV_DONTNEED); 640 if (ret) { 641 fprintf(stderr, 642 "%s: Failed to madvise(DONTNEED) region %d: %s\n", 643 __func__, i, strerror(errno)); 644 } 645 /* 646 * Turn off transparent hugepages so we dont get lose wakeups 647 * in neighbouring pages. 648 * TODO: Turn this backon later. 649 */ 650 ret = madvise((void *)(uintptr_t)dev_region->mmap_addr, 651 dev_region->size + dev_region->mmap_offset, 652 MADV_NOHUGEPAGE); 653 if (ret) { 654 /* 655 * Note: This can happen legally on kernels that are configured 656 * without madvise'able hugepages 657 */ 658 fprintf(stderr, 659 "%s: Failed to madvise(NOHUGEPAGE) region %d: %s\n", 660 __func__, i, strerror(errno)); 661 } 662 struct uffdio_register reg_struct; 663 reg_struct.range.start = (uintptr_t)dev_region->mmap_addr; 664 reg_struct.range.len = dev_region->size + dev_region->mmap_offset; 665 reg_struct.mode = UFFDIO_REGISTER_MODE_MISSING; 666 667 if (ioctl(dev->postcopy_ufd, UFFDIO_REGISTER, ®_struct)) { 668 vu_panic(dev, "%s: Failed to userfault region %d " 669 "@%" PRIx64 " + size:%" PRIx64 " offset: %" PRIx64 670 ": (ufd=%d)%s\n", 671 __func__, i, 672 dev_region->mmap_addr, 673 dev_region->size, dev_region->mmap_offset, 674 dev->postcopy_ufd, strerror(errno)); 675 return false; 676 } 677 if (!(reg_struct.ioctls & ((__u64)1 << _UFFDIO_COPY))) { 678 vu_panic(dev, "%s Region (%d) doesn't support COPY", 679 __func__, i); 680 return false; 681 } 682 DPRINT("%s: region %d: Registered userfault for %" 683 PRIx64 " + %" PRIx64 "\n", __func__, i, 684 (uint64_t)reg_struct.range.start, 685 (uint64_t)reg_struct.range.len); 686 /* Now it's registered we can let the client at it */ 687 if (mprotect((void *)(uintptr_t)dev_region->mmap_addr, 688 dev_region->size + dev_region->mmap_offset, 689 PROT_READ | PROT_WRITE)) { 690 vu_panic(dev, "failed to mprotect region %d for postcopy (%s)", 691 i, strerror(errno)); 692 return false; 693 } 694 /* TODO: Stash 'zero' support flags somewhere */ 695 #endif 696 } 697 698 return true; 699 } 700 701 static bool 702 vu_add_mem_reg(VuDev *dev, VhostUserMsg *vmsg) { 703 int i; 704 bool track_ramblocks = dev->postcopy_listening; 705 VhostUserMemoryRegion m = vmsg->payload.memreg.region, *msg_region = &m; 706 VuDevRegion *dev_region = &dev->regions[dev->nregions]; 707 void *mmap_addr; 708 709 if (vmsg->fd_num != 1) { 710 vmsg_close_fds(vmsg); 711 vu_panic(dev, "VHOST_USER_ADD_MEM_REG received %d fds - only 1 fd " 712 "should be sent for this message type", vmsg->fd_num); 713 return false; 714 } 715 716 if (vmsg->size < VHOST_USER_MEM_REG_SIZE) { 717 close(vmsg->fds[0]); 718 vu_panic(dev, "VHOST_USER_ADD_MEM_REG requires a message size of at " 719 "least %zu bytes and only %d bytes were received", 720 VHOST_USER_MEM_REG_SIZE, vmsg->size); 721 return false; 722 } 723 724 if (dev->nregions == VHOST_USER_MAX_RAM_SLOTS) { 725 close(vmsg->fds[0]); 726 vu_panic(dev, "failing attempt to hot add memory via " 727 "VHOST_USER_ADD_MEM_REG message because the backend has " 728 "no free ram slots available"); 729 return false; 730 } 731 732 /* 733 * If we are in postcopy mode and we receive a u64 payload with a 0 value 734 * we know all the postcopy client bases have been received, and we 735 * should start generating faults. 736 */ 737 if (track_ramblocks && 738 vmsg->size == sizeof(vmsg->payload.u64) && 739 vmsg->payload.u64 == 0) { 740 (void)generate_faults(dev); 741 return false; 742 } 743 744 DPRINT("Adding region: %u\n", dev->nregions); 745 DPRINT(" guest_phys_addr: 0x%016"PRIx64"\n", 746 msg_region->guest_phys_addr); 747 DPRINT(" memory_size: 0x%016"PRIx64"\n", 748 msg_region->memory_size); 749 DPRINT(" userspace_addr 0x%016"PRIx64"\n", 750 msg_region->userspace_addr); 751 DPRINT(" mmap_offset 0x%016"PRIx64"\n", 752 msg_region->mmap_offset); 753 754 dev_region->gpa = msg_region->guest_phys_addr; 755 dev_region->size = msg_region->memory_size; 756 dev_region->qva = msg_region->userspace_addr; 757 dev_region->mmap_offset = msg_region->mmap_offset; 758 759 /* 760 * We don't use offset argument of mmap() since the 761 * mapped address has to be page aligned, and we use huge 762 * pages. 763 */ 764 if (track_ramblocks) { 765 /* 766 * In postcopy we're using PROT_NONE here to catch anyone 767 * accessing it before we userfault. 768 */ 769 mmap_addr = mmap(0, dev_region->size + dev_region->mmap_offset, 770 PROT_NONE, MAP_SHARED | MAP_NORESERVE, 771 vmsg->fds[0], 0); 772 } else { 773 mmap_addr = mmap(0, dev_region->size + dev_region->mmap_offset, 774 PROT_READ | PROT_WRITE, MAP_SHARED | MAP_NORESERVE, 775 vmsg->fds[0], 0); 776 } 777 778 if (mmap_addr == MAP_FAILED) { 779 vu_panic(dev, "region mmap error: %s", strerror(errno)); 780 } else { 781 dev_region->mmap_addr = (uint64_t)(uintptr_t)mmap_addr; 782 DPRINT(" mmap_addr: 0x%016"PRIx64"\n", 783 dev_region->mmap_addr); 784 } 785 786 close(vmsg->fds[0]); 787 788 if (track_ramblocks) { 789 /* 790 * Return the address to QEMU so that it can translate the ufd 791 * fault addresses back. 792 */ 793 msg_region->userspace_addr = (uintptr_t)(mmap_addr + 794 dev_region->mmap_offset); 795 796 /* Send the message back to qemu with the addresses filled in. */ 797 vmsg->fd_num = 0; 798 DPRINT("Successfully added new region in postcopy\n"); 799 dev->nregions++; 800 return true; 801 } else { 802 for (i = 0; i < dev->max_queues; i++) { 803 if (dev->vq[i].vring.desc) { 804 if (map_ring(dev, &dev->vq[i])) { 805 vu_panic(dev, "remapping queue %d for new memory region", 806 i); 807 } 808 } 809 } 810 811 DPRINT("Successfully added new region\n"); 812 dev->nregions++; 813 return false; 814 } 815 } 816 817 static inline bool reg_equal(VuDevRegion *vudev_reg, 818 VhostUserMemoryRegion *msg_reg) 819 { 820 if (vudev_reg->gpa == msg_reg->guest_phys_addr && 821 vudev_reg->qva == msg_reg->userspace_addr && 822 vudev_reg->size == msg_reg->memory_size) { 823 return true; 824 } 825 826 return false; 827 } 828 829 static bool 830 vu_rem_mem_reg(VuDev *dev, VhostUserMsg *vmsg) { 831 VhostUserMemoryRegion m = vmsg->payload.memreg.region, *msg_region = &m; 832 int i; 833 bool found = false; 834 835 if (vmsg->fd_num > 1) { 836 vmsg_close_fds(vmsg); 837 vu_panic(dev, "VHOST_USER_REM_MEM_REG received %d fds - at most 1 fd " 838 "should be sent for this message type", vmsg->fd_num); 839 return false; 840 } 841 842 if (vmsg->size < VHOST_USER_MEM_REG_SIZE) { 843 vmsg_close_fds(vmsg); 844 vu_panic(dev, "VHOST_USER_REM_MEM_REG requires a message size of at " 845 "least %zu bytes and only %d bytes were received", 846 VHOST_USER_MEM_REG_SIZE, vmsg->size); 847 return false; 848 } 849 850 DPRINT("Removing region:\n"); 851 DPRINT(" guest_phys_addr: 0x%016"PRIx64"\n", 852 msg_region->guest_phys_addr); 853 DPRINT(" memory_size: 0x%016"PRIx64"\n", 854 msg_region->memory_size); 855 DPRINT(" userspace_addr 0x%016"PRIx64"\n", 856 msg_region->userspace_addr); 857 DPRINT(" mmap_offset 0x%016"PRIx64"\n", 858 msg_region->mmap_offset); 859 860 for (i = 0; i < dev->nregions; i++) { 861 if (reg_equal(&dev->regions[i], msg_region)) { 862 VuDevRegion *r = &dev->regions[i]; 863 void *m = (void *) (uintptr_t) r->mmap_addr; 864 865 if (m) { 866 munmap(m, r->size + r->mmap_offset); 867 } 868 869 /* 870 * Shift all affected entries by 1 to close the hole at index i and 871 * zero out the last entry. 872 */ 873 memmove(dev->regions + i, dev->regions + i + 1, 874 sizeof(VuDevRegion) * (dev->nregions - i - 1)); 875 memset(dev->regions + dev->nregions - 1, 0, sizeof(VuDevRegion)); 876 DPRINT("Successfully removed a region\n"); 877 dev->nregions--; 878 i--; 879 880 found = true; 881 882 /* Continue the search for eventual duplicates. */ 883 } 884 } 885 886 if (!found) { 887 vu_panic(dev, "Specified region not found\n"); 888 } 889 890 vmsg_close_fds(vmsg); 891 892 return false; 893 } 894 895 static bool 896 vu_set_mem_table_exec_postcopy(VuDev *dev, VhostUserMsg *vmsg) 897 { 898 int i; 899 VhostUserMemory m = vmsg->payload.memory, *memory = &m; 900 dev->nregions = memory->nregions; 901 902 DPRINT("Nregions: %u\n", memory->nregions); 903 for (i = 0; i < dev->nregions; i++) { 904 void *mmap_addr; 905 VhostUserMemoryRegion *msg_region = &memory->regions[i]; 906 VuDevRegion *dev_region = &dev->regions[i]; 907 908 DPRINT("Region %d\n", i); 909 DPRINT(" guest_phys_addr: 0x%016"PRIx64"\n", 910 msg_region->guest_phys_addr); 911 DPRINT(" memory_size: 0x%016"PRIx64"\n", 912 msg_region->memory_size); 913 DPRINT(" userspace_addr 0x%016"PRIx64"\n", 914 msg_region->userspace_addr); 915 DPRINT(" mmap_offset 0x%016"PRIx64"\n", 916 msg_region->mmap_offset); 917 918 dev_region->gpa = msg_region->guest_phys_addr; 919 dev_region->size = msg_region->memory_size; 920 dev_region->qva = msg_region->userspace_addr; 921 dev_region->mmap_offset = msg_region->mmap_offset; 922 923 /* We don't use offset argument of mmap() since the 924 * mapped address has to be page aligned, and we use huge 925 * pages. 926 * In postcopy we're using PROT_NONE here to catch anyone 927 * accessing it before we userfault 928 */ 929 mmap_addr = mmap(0, dev_region->size + dev_region->mmap_offset, 930 PROT_NONE, MAP_SHARED | MAP_NORESERVE, 931 vmsg->fds[i], 0); 932 933 if (mmap_addr == MAP_FAILED) { 934 vu_panic(dev, "region mmap error: %s", strerror(errno)); 935 } else { 936 dev_region->mmap_addr = (uint64_t)(uintptr_t)mmap_addr; 937 DPRINT(" mmap_addr: 0x%016"PRIx64"\n", 938 dev_region->mmap_addr); 939 } 940 941 /* Return the address to QEMU so that it can translate the ufd 942 * fault addresses back. 943 */ 944 msg_region->userspace_addr = (uintptr_t)(mmap_addr + 945 dev_region->mmap_offset); 946 close(vmsg->fds[i]); 947 } 948 949 /* Send the message back to qemu with the addresses filled in */ 950 vmsg->fd_num = 0; 951 if (!vu_send_reply(dev, dev->sock, vmsg)) { 952 vu_panic(dev, "failed to respond to set-mem-table for postcopy"); 953 return false; 954 } 955 956 /* Wait for QEMU to confirm that it's registered the handler for the 957 * faults. 958 */ 959 if (!dev->read_msg(dev, dev->sock, vmsg) || 960 vmsg->size != sizeof(vmsg->payload.u64) || 961 vmsg->payload.u64 != 0) { 962 vu_panic(dev, "failed to receive valid ack for postcopy set-mem-table"); 963 return false; 964 } 965 966 /* OK, now we can go and register the memory and generate faults */ 967 (void)generate_faults(dev); 968 969 return false; 970 } 971 972 static bool 973 vu_set_mem_table_exec(VuDev *dev, VhostUserMsg *vmsg) 974 { 975 int i; 976 VhostUserMemory m = vmsg->payload.memory, *memory = &m; 977 978 for (i = 0; i < dev->nregions; i++) { 979 VuDevRegion *r = &dev->regions[i]; 980 void *m = (void *) (uintptr_t) r->mmap_addr; 981 982 if (m) { 983 munmap(m, r->size + r->mmap_offset); 984 } 985 } 986 dev->nregions = memory->nregions; 987 988 if (dev->postcopy_listening) { 989 return vu_set_mem_table_exec_postcopy(dev, vmsg); 990 } 991 992 DPRINT("Nregions: %u\n", memory->nregions); 993 for (i = 0; i < dev->nregions; i++) { 994 void *mmap_addr; 995 VhostUserMemoryRegion *msg_region = &memory->regions[i]; 996 VuDevRegion *dev_region = &dev->regions[i]; 997 998 DPRINT("Region %d\n", i); 999 DPRINT(" guest_phys_addr: 0x%016"PRIx64"\n", 1000 msg_region->guest_phys_addr); 1001 DPRINT(" memory_size: 0x%016"PRIx64"\n", 1002 msg_region->memory_size); 1003 DPRINT(" userspace_addr 0x%016"PRIx64"\n", 1004 msg_region->userspace_addr); 1005 DPRINT(" mmap_offset 0x%016"PRIx64"\n", 1006 msg_region->mmap_offset); 1007 1008 dev_region->gpa = msg_region->guest_phys_addr; 1009 dev_region->size = msg_region->memory_size; 1010 dev_region->qva = msg_region->userspace_addr; 1011 dev_region->mmap_offset = msg_region->mmap_offset; 1012 1013 /* We don't use offset argument of mmap() since the 1014 * mapped address has to be page aligned, and we use huge 1015 * pages. */ 1016 mmap_addr = mmap(0, dev_region->size + dev_region->mmap_offset, 1017 PROT_READ | PROT_WRITE, MAP_SHARED | MAP_NORESERVE, 1018 vmsg->fds[i], 0); 1019 1020 if (mmap_addr == MAP_FAILED) { 1021 vu_panic(dev, "region mmap error: %s", strerror(errno)); 1022 } else { 1023 dev_region->mmap_addr = (uint64_t)(uintptr_t)mmap_addr; 1024 DPRINT(" mmap_addr: 0x%016"PRIx64"\n", 1025 dev_region->mmap_addr); 1026 } 1027 1028 close(vmsg->fds[i]); 1029 } 1030 1031 for (i = 0; i < dev->max_queues; i++) { 1032 if (dev->vq[i].vring.desc) { 1033 if (map_ring(dev, &dev->vq[i])) { 1034 vu_panic(dev, "remapping queue %d during setmemtable", i); 1035 } 1036 } 1037 } 1038 1039 return false; 1040 } 1041 1042 static bool 1043 vu_set_log_base_exec(VuDev *dev, VhostUserMsg *vmsg) 1044 { 1045 int fd; 1046 uint64_t log_mmap_size, log_mmap_offset; 1047 void *rc; 1048 1049 if (vmsg->fd_num != 1 || 1050 vmsg->size != sizeof(vmsg->payload.log)) { 1051 vu_panic(dev, "Invalid log_base message"); 1052 return true; 1053 } 1054 1055 fd = vmsg->fds[0]; 1056 log_mmap_offset = vmsg->payload.log.mmap_offset; 1057 log_mmap_size = vmsg->payload.log.mmap_size; 1058 DPRINT("Log mmap_offset: %"PRId64"\n", log_mmap_offset); 1059 DPRINT("Log mmap_size: %"PRId64"\n", log_mmap_size); 1060 1061 rc = mmap(0, log_mmap_size, PROT_READ | PROT_WRITE, MAP_SHARED, fd, 1062 log_mmap_offset); 1063 close(fd); 1064 if (rc == MAP_FAILED) { 1065 perror("log mmap error"); 1066 } 1067 1068 if (dev->log_table) { 1069 munmap(dev->log_table, dev->log_size); 1070 } 1071 dev->log_table = rc; 1072 dev->log_size = log_mmap_size; 1073 1074 vmsg->size = sizeof(vmsg->payload.u64); 1075 vmsg->fd_num = 0; 1076 1077 return true; 1078 } 1079 1080 static bool 1081 vu_set_log_fd_exec(VuDev *dev, VhostUserMsg *vmsg) 1082 { 1083 if (vmsg->fd_num != 1) { 1084 vu_panic(dev, "Invalid log_fd message"); 1085 return false; 1086 } 1087 1088 if (dev->log_call_fd != -1) { 1089 close(dev->log_call_fd); 1090 } 1091 dev->log_call_fd = vmsg->fds[0]; 1092 DPRINT("Got log_call_fd: %d\n", vmsg->fds[0]); 1093 1094 return false; 1095 } 1096 1097 static bool 1098 vu_set_vring_num_exec(VuDev *dev, VhostUserMsg *vmsg) 1099 { 1100 unsigned int index = vmsg->payload.state.index; 1101 unsigned int num = vmsg->payload.state.num; 1102 1103 DPRINT("State.index: %u\n", index); 1104 DPRINT("State.num: %u\n", num); 1105 dev->vq[index].vring.num = num; 1106 1107 return false; 1108 } 1109 1110 static bool 1111 vu_set_vring_addr_exec(VuDev *dev, VhostUserMsg *vmsg) 1112 { 1113 struct vhost_vring_addr addr = vmsg->payload.addr, *vra = &addr; 1114 unsigned int index = vra->index; 1115 VuVirtq *vq = &dev->vq[index]; 1116 1117 DPRINT("vhost_vring_addr:\n"); 1118 DPRINT(" index: %d\n", vra->index); 1119 DPRINT(" flags: %d\n", vra->flags); 1120 DPRINT(" desc_user_addr: 0x%016" PRIx64 "\n", (uint64_t)vra->desc_user_addr); 1121 DPRINT(" used_user_addr: 0x%016" PRIx64 "\n", (uint64_t)vra->used_user_addr); 1122 DPRINT(" avail_user_addr: 0x%016" PRIx64 "\n", (uint64_t)vra->avail_user_addr); 1123 DPRINT(" log_guest_addr: 0x%016" PRIx64 "\n", (uint64_t)vra->log_guest_addr); 1124 1125 vq->vra = *vra; 1126 vq->vring.flags = vra->flags; 1127 vq->vring.log_guest_addr = vra->log_guest_addr; 1128 1129 1130 if (map_ring(dev, vq)) { 1131 vu_panic(dev, "Invalid vring_addr message"); 1132 return false; 1133 } 1134 1135 vq->used_idx = le16toh(vq->vring.used->idx); 1136 1137 if (vq->last_avail_idx != vq->used_idx) { 1138 bool resume = dev->iface->queue_is_processed_in_order && 1139 dev->iface->queue_is_processed_in_order(dev, index); 1140 1141 DPRINT("Last avail index != used index: %u != %u%s\n", 1142 vq->last_avail_idx, vq->used_idx, 1143 resume ? ", resuming" : ""); 1144 1145 if (resume) { 1146 vq->shadow_avail_idx = vq->last_avail_idx = vq->used_idx; 1147 } 1148 } 1149 1150 return false; 1151 } 1152 1153 static bool 1154 vu_set_vring_base_exec(VuDev *dev, VhostUserMsg *vmsg) 1155 { 1156 unsigned int index = vmsg->payload.state.index; 1157 unsigned int num = vmsg->payload.state.num; 1158 1159 DPRINT("State.index: %u\n", index); 1160 DPRINT("State.num: %u\n", num); 1161 dev->vq[index].shadow_avail_idx = dev->vq[index].last_avail_idx = num; 1162 1163 return false; 1164 } 1165 1166 static bool 1167 vu_get_vring_base_exec(VuDev *dev, VhostUserMsg *vmsg) 1168 { 1169 unsigned int index = vmsg->payload.state.index; 1170 1171 DPRINT("State.index: %u\n", index); 1172 vmsg->payload.state.num = dev->vq[index].last_avail_idx; 1173 vmsg->size = sizeof(vmsg->payload.state); 1174 1175 dev->vq[index].started = false; 1176 if (dev->iface->queue_set_started) { 1177 dev->iface->queue_set_started(dev, index, false); 1178 } 1179 1180 if (dev->vq[index].call_fd != -1) { 1181 close(dev->vq[index].call_fd); 1182 dev->vq[index].call_fd = -1; 1183 } 1184 if (dev->vq[index].kick_fd != -1) { 1185 dev->remove_watch(dev, dev->vq[index].kick_fd); 1186 close(dev->vq[index].kick_fd); 1187 dev->vq[index].kick_fd = -1; 1188 } 1189 1190 return true; 1191 } 1192 1193 static bool 1194 vu_check_queue_msg_file(VuDev *dev, VhostUserMsg *vmsg) 1195 { 1196 int index = vmsg->payload.u64 & VHOST_USER_VRING_IDX_MASK; 1197 bool nofd = vmsg->payload.u64 & VHOST_USER_VRING_NOFD_MASK; 1198 1199 if (index >= dev->max_queues) { 1200 vmsg_close_fds(vmsg); 1201 vu_panic(dev, "Invalid queue index: %u", index); 1202 return false; 1203 } 1204 1205 if (nofd) { 1206 vmsg_close_fds(vmsg); 1207 return true; 1208 } 1209 1210 if (vmsg->fd_num != 1) { 1211 vmsg_close_fds(vmsg); 1212 vu_panic(dev, "Invalid fds in request: %d", vmsg->request); 1213 return false; 1214 } 1215 1216 return true; 1217 } 1218 1219 static int 1220 inflight_desc_compare(const void *a, const void *b) 1221 { 1222 VuVirtqInflightDesc *desc0 = (VuVirtqInflightDesc *)a, 1223 *desc1 = (VuVirtqInflightDesc *)b; 1224 1225 if (desc1->counter > desc0->counter && 1226 (desc1->counter - desc0->counter) < VIRTQUEUE_MAX_SIZE * 2) { 1227 return 1; 1228 } 1229 1230 return -1; 1231 } 1232 1233 static int 1234 vu_check_queue_inflights(VuDev *dev, VuVirtq *vq) 1235 { 1236 int i = 0; 1237 1238 if (!vu_has_protocol_feature(dev, VHOST_USER_PROTOCOL_F_INFLIGHT_SHMFD)) { 1239 return 0; 1240 } 1241 1242 if (unlikely(!vq->inflight)) { 1243 return -1; 1244 } 1245 1246 if (unlikely(!vq->inflight->version)) { 1247 /* initialize the buffer */ 1248 vq->inflight->version = INFLIGHT_VERSION; 1249 return 0; 1250 } 1251 1252 vq->used_idx = le16toh(vq->vring.used->idx); 1253 vq->resubmit_num = 0; 1254 vq->resubmit_list = NULL; 1255 vq->counter = 0; 1256 1257 if (unlikely(vq->inflight->used_idx != vq->used_idx)) { 1258 vq->inflight->desc[vq->inflight->last_batch_head].inflight = 0; 1259 1260 barrier(); 1261 1262 vq->inflight->used_idx = vq->used_idx; 1263 } 1264 1265 for (i = 0; i < vq->inflight->desc_num; i++) { 1266 if (vq->inflight->desc[i].inflight == 1) { 1267 vq->inuse++; 1268 } 1269 } 1270 1271 vq->shadow_avail_idx = vq->last_avail_idx = vq->inuse + vq->used_idx; 1272 1273 if (vq->inuse) { 1274 vq->resubmit_list = calloc(vq->inuse, sizeof(VuVirtqInflightDesc)); 1275 if (!vq->resubmit_list) { 1276 return -1; 1277 } 1278 1279 for (i = 0; i < vq->inflight->desc_num; i++) { 1280 if (vq->inflight->desc[i].inflight) { 1281 vq->resubmit_list[vq->resubmit_num].index = i; 1282 vq->resubmit_list[vq->resubmit_num].counter = 1283 vq->inflight->desc[i].counter; 1284 vq->resubmit_num++; 1285 } 1286 } 1287 1288 if (vq->resubmit_num > 1) { 1289 qsort(vq->resubmit_list, vq->resubmit_num, 1290 sizeof(VuVirtqInflightDesc), inflight_desc_compare); 1291 } 1292 vq->counter = vq->resubmit_list[0].counter + 1; 1293 } 1294 1295 /* in case of I/O hang after reconnecting */ 1296 if (eventfd_write(vq->kick_fd, 1)) { 1297 return -1; 1298 } 1299 1300 return 0; 1301 } 1302 1303 static bool 1304 vu_set_vring_kick_exec(VuDev *dev, VhostUserMsg *vmsg) 1305 { 1306 int index = vmsg->payload.u64 & VHOST_USER_VRING_IDX_MASK; 1307 bool nofd = vmsg->payload.u64 & VHOST_USER_VRING_NOFD_MASK; 1308 1309 DPRINT("u64: 0x%016"PRIx64"\n", vmsg->payload.u64); 1310 1311 if (!vu_check_queue_msg_file(dev, vmsg)) { 1312 return false; 1313 } 1314 1315 if (dev->vq[index].kick_fd != -1) { 1316 dev->remove_watch(dev, dev->vq[index].kick_fd); 1317 close(dev->vq[index].kick_fd); 1318 dev->vq[index].kick_fd = -1; 1319 } 1320 1321 dev->vq[index].kick_fd = nofd ? -1 : vmsg->fds[0]; 1322 DPRINT("Got kick_fd: %d for vq: %d\n", dev->vq[index].kick_fd, index); 1323 1324 dev->vq[index].started = true; 1325 if (dev->iface->queue_set_started) { 1326 dev->iface->queue_set_started(dev, index, true); 1327 } 1328 1329 if (dev->vq[index].kick_fd != -1 && dev->vq[index].handler) { 1330 dev->set_watch(dev, dev->vq[index].kick_fd, VU_WATCH_IN, 1331 vu_kick_cb, (void *)(long)index); 1332 1333 DPRINT("Waiting for kicks on fd: %d for vq: %d\n", 1334 dev->vq[index].kick_fd, index); 1335 } 1336 1337 if (vu_check_queue_inflights(dev, &dev->vq[index])) { 1338 vu_panic(dev, "Failed to check inflights for vq: %d\n", index); 1339 } 1340 1341 return false; 1342 } 1343 1344 void vu_set_queue_handler(VuDev *dev, VuVirtq *vq, 1345 vu_queue_handler_cb handler) 1346 { 1347 int qidx = vq - dev->vq; 1348 1349 vq->handler = handler; 1350 if (vq->kick_fd >= 0) { 1351 if (handler) { 1352 dev->set_watch(dev, vq->kick_fd, VU_WATCH_IN, 1353 vu_kick_cb, (void *)(long)qidx); 1354 } else { 1355 dev->remove_watch(dev, vq->kick_fd); 1356 } 1357 } 1358 } 1359 1360 bool vu_set_queue_host_notifier(VuDev *dev, VuVirtq *vq, int fd, 1361 int size, int offset) 1362 { 1363 int qidx = vq - dev->vq; 1364 int fd_num = 0; 1365 VhostUserMsg vmsg = { 1366 .request = VHOST_USER_SLAVE_VRING_HOST_NOTIFIER_MSG, 1367 .flags = VHOST_USER_VERSION | VHOST_USER_NEED_REPLY_MASK, 1368 .size = sizeof(vmsg.payload.area), 1369 .payload.area = { 1370 .u64 = qidx & VHOST_USER_VRING_IDX_MASK, 1371 .size = size, 1372 .offset = offset, 1373 }, 1374 }; 1375 1376 if (fd == -1) { 1377 vmsg.payload.area.u64 |= VHOST_USER_VRING_NOFD_MASK; 1378 } else { 1379 vmsg.fds[fd_num++] = fd; 1380 } 1381 1382 vmsg.fd_num = fd_num; 1383 1384 if (!vu_has_protocol_feature(dev, VHOST_USER_PROTOCOL_F_SLAVE_SEND_FD)) { 1385 return false; 1386 } 1387 1388 pthread_mutex_lock(&dev->slave_mutex); 1389 if (!vu_message_write(dev, dev->slave_fd, &vmsg)) { 1390 pthread_mutex_unlock(&dev->slave_mutex); 1391 return false; 1392 } 1393 1394 /* Also unlocks the slave_mutex */ 1395 return vu_process_message_reply(dev, &vmsg); 1396 } 1397 1398 static bool 1399 vu_set_vring_call_exec(VuDev *dev, VhostUserMsg *vmsg) 1400 { 1401 int index = vmsg->payload.u64 & VHOST_USER_VRING_IDX_MASK; 1402 bool nofd = vmsg->payload.u64 & VHOST_USER_VRING_NOFD_MASK; 1403 1404 DPRINT("u64: 0x%016"PRIx64"\n", vmsg->payload.u64); 1405 1406 if (!vu_check_queue_msg_file(dev, vmsg)) { 1407 return false; 1408 } 1409 1410 if (dev->vq[index].call_fd != -1) { 1411 close(dev->vq[index].call_fd); 1412 dev->vq[index].call_fd = -1; 1413 } 1414 1415 dev->vq[index].call_fd = nofd ? -1 : vmsg->fds[0]; 1416 1417 /* in case of I/O hang after reconnecting */ 1418 if (dev->vq[index].call_fd != -1 && eventfd_write(vmsg->fds[0], 1)) { 1419 return -1; 1420 } 1421 1422 DPRINT("Got call_fd: %d for vq: %d\n", dev->vq[index].call_fd, index); 1423 1424 return false; 1425 } 1426 1427 static bool 1428 vu_set_vring_err_exec(VuDev *dev, VhostUserMsg *vmsg) 1429 { 1430 int index = vmsg->payload.u64 & VHOST_USER_VRING_IDX_MASK; 1431 bool nofd = vmsg->payload.u64 & VHOST_USER_VRING_NOFD_MASK; 1432 1433 DPRINT("u64: 0x%016"PRIx64"\n", vmsg->payload.u64); 1434 1435 if (!vu_check_queue_msg_file(dev, vmsg)) { 1436 return false; 1437 } 1438 1439 if (dev->vq[index].err_fd != -1) { 1440 close(dev->vq[index].err_fd); 1441 dev->vq[index].err_fd = -1; 1442 } 1443 1444 dev->vq[index].err_fd = nofd ? -1 : vmsg->fds[0]; 1445 1446 return false; 1447 } 1448 1449 static bool 1450 vu_get_protocol_features_exec(VuDev *dev, VhostUserMsg *vmsg) 1451 { 1452 /* 1453 * Note that we support, but intentionally do not set, 1454 * VHOST_USER_PROTOCOL_F_INBAND_NOTIFICATIONS. This means that 1455 * a device implementation can return it in its callback 1456 * (get_protocol_features) if it wants to use this for 1457 * simulation, but it is otherwise not desirable (if even 1458 * implemented by the master.) 1459 */ 1460 uint64_t features = 1ULL << VHOST_USER_PROTOCOL_F_MQ | 1461 1ULL << VHOST_USER_PROTOCOL_F_LOG_SHMFD | 1462 1ULL << VHOST_USER_PROTOCOL_F_SLAVE_REQ | 1463 1ULL << VHOST_USER_PROTOCOL_F_HOST_NOTIFIER | 1464 1ULL << VHOST_USER_PROTOCOL_F_SLAVE_SEND_FD | 1465 1ULL << VHOST_USER_PROTOCOL_F_REPLY_ACK | 1466 1ULL << VHOST_USER_PROTOCOL_F_CONFIGURE_MEM_SLOTS; 1467 1468 if (have_userfault()) { 1469 features |= 1ULL << VHOST_USER_PROTOCOL_F_PAGEFAULT; 1470 } 1471 1472 if (dev->iface->get_config && dev->iface->set_config) { 1473 features |= 1ULL << VHOST_USER_PROTOCOL_F_CONFIG; 1474 } 1475 1476 if (dev->iface->get_protocol_features) { 1477 features |= dev->iface->get_protocol_features(dev); 1478 } 1479 1480 vmsg_set_reply_u64(vmsg, features); 1481 return true; 1482 } 1483 1484 static bool 1485 vu_set_protocol_features_exec(VuDev *dev, VhostUserMsg *vmsg) 1486 { 1487 uint64_t features = vmsg->payload.u64; 1488 1489 DPRINT("u64: 0x%016"PRIx64"\n", features); 1490 1491 dev->protocol_features = vmsg->payload.u64; 1492 1493 if (vu_has_protocol_feature(dev, 1494 VHOST_USER_PROTOCOL_F_INBAND_NOTIFICATIONS) && 1495 (!vu_has_protocol_feature(dev, VHOST_USER_PROTOCOL_F_SLAVE_REQ) || 1496 !vu_has_protocol_feature(dev, VHOST_USER_PROTOCOL_F_REPLY_ACK))) { 1497 /* 1498 * The use case for using messages for kick/call is simulation, to make 1499 * the kick and call synchronous. To actually get that behaviour, both 1500 * of the other features are required. 1501 * Theoretically, one could use only kick messages, or do them without 1502 * having F_REPLY_ACK, but too many (possibly pending) messages on the 1503 * socket will eventually cause the master to hang, to avoid this in 1504 * scenarios where not desired enforce that the settings are in a way 1505 * that actually enables the simulation case. 1506 */ 1507 vu_panic(dev, 1508 "F_IN_BAND_NOTIFICATIONS requires F_SLAVE_REQ && F_REPLY_ACK"); 1509 return false; 1510 } 1511 1512 if (dev->iface->set_protocol_features) { 1513 dev->iface->set_protocol_features(dev, features); 1514 } 1515 1516 return false; 1517 } 1518 1519 static bool 1520 vu_get_queue_num_exec(VuDev *dev, VhostUserMsg *vmsg) 1521 { 1522 vmsg_set_reply_u64(vmsg, dev->max_queues); 1523 return true; 1524 } 1525 1526 static bool 1527 vu_set_vring_enable_exec(VuDev *dev, VhostUserMsg *vmsg) 1528 { 1529 unsigned int index = vmsg->payload.state.index; 1530 unsigned int enable = vmsg->payload.state.num; 1531 1532 DPRINT("State.index: %u\n", index); 1533 DPRINT("State.enable: %u\n", enable); 1534 1535 if (index >= dev->max_queues) { 1536 vu_panic(dev, "Invalid vring_enable index: %u", index); 1537 return false; 1538 } 1539 1540 dev->vq[index].enable = enable; 1541 return false; 1542 } 1543 1544 static bool 1545 vu_set_slave_req_fd(VuDev *dev, VhostUserMsg *vmsg) 1546 { 1547 if (vmsg->fd_num != 1) { 1548 vu_panic(dev, "Invalid slave_req_fd message (%d fd's)", vmsg->fd_num); 1549 return false; 1550 } 1551 1552 if (dev->slave_fd != -1) { 1553 close(dev->slave_fd); 1554 } 1555 dev->slave_fd = vmsg->fds[0]; 1556 DPRINT("Got slave_fd: %d\n", vmsg->fds[0]); 1557 1558 return false; 1559 } 1560 1561 static bool 1562 vu_get_config(VuDev *dev, VhostUserMsg *vmsg) 1563 { 1564 int ret = -1; 1565 1566 if (dev->iface->get_config) { 1567 ret = dev->iface->get_config(dev, vmsg->payload.config.region, 1568 vmsg->payload.config.size); 1569 } 1570 1571 if (ret) { 1572 /* resize to zero to indicate an error to master */ 1573 vmsg->size = 0; 1574 } 1575 1576 return true; 1577 } 1578 1579 static bool 1580 vu_set_config(VuDev *dev, VhostUserMsg *vmsg) 1581 { 1582 int ret = -1; 1583 1584 if (dev->iface->set_config) { 1585 ret = dev->iface->set_config(dev, vmsg->payload.config.region, 1586 vmsg->payload.config.offset, 1587 vmsg->payload.config.size, 1588 vmsg->payload.config.flags); 1589 if (ret) { 1590 vu_panic(dev, "Set virtio configuration space failed"); 1591 } 1592 } 1593 1594 return false; 1595 } 1596 1597 static bool 1598 vu_set_postcopy_advise(VuDev *dev, VhostUserMsg *vmsg) 1599 { 1600 dev->postcopy_ufd = -1; 1601 #ifdef UFFDIO_API 1602 struct uffdio_api api_struct; 1603 1604 dev->postcopy_ufd = syscall(__NR_userfaultfd, O_CLOEXEC | O_NONBLOCK); 1605 vmsg->size = 0; 1606 #endif 1607 1608 if (dev->postcopy_ufd == -1) { 1609 vu_panic(dev, "Userfaultfd not available: %s", strerror(errno)); 1610 goto out; 1611 } 1612 1613 #ifdef UFFDIO_API 1614 api_struct.api = UFFD_API; 1615 api_struct.features = 0; 1616 if (ioctl(dev->postcopy_ufd, UFFDIO_API, &api_struct)) { 1617 vu_panic(dev, "Failed UFFDIO_API: %s", strerror(errno)); 1618 close(dev->postcopy_ufd); 1619 dev->postcopy_ufd = -1; 1620 goto out; 1621 } 1622 /* TODO: Stash feature flags somewhere */ 1623 #endif 1624 1625 out: 1626 /* Return a ufd to the QEMU */ 1627 vmsg->fd_num = 1; 1628 vmsg->fds[0] = dev->postcopy_ufd; 1629 return true; /* = send a reply */ 1630 } 1631 1632 static bool 1633 vu_set_postcopy_listen(VuDev *dev, VhostUserMsg *vmsg) 1634 { 1635 if (dev->nregions) { 1636 vu_panic(dev, "Regions already registered at postcopy-listen"); 1637 vmsg_set_reply_u64(vmsg, -1); 1638 return true; 1639 } 1640 dev->postcopy_listening = true; 1641 1642 vmsg_set_reply_u64(vmsg, 0); 1643 return true; 1644 } 1645 1646 static bool 1647 vu_set_postcopy_end(VuDev *dev, VhostUserMsg *vmsg) 1648 { 1649 DPRINT("%s: Entry\n", __func__); 1650 dev->postcopy_listening = false; 1651 if (dev->postcopy_ufd > 0) { 1652 close(dev->postcopy_ufd); 1653 dev->postcopy_ufd = -1; 1654 DPRINT("%s: Done close\n", __func__); 1655 } 1656 1657 vmsg_set_reply_u64(vmsg, 0); 1658 DPRINT("%s: exit\n", __func__); 1659 return true; 1660 } 1661 1662 static inline uint64_t 1663 vu_inflight_queue_size(uint16_t queue_size) 1664 { 1665 return ALIGN_UP(sizeof(VuDescStateSplit) * queue_size + 1666 sizeof(uint16_t), INFLIGHT_ALIGNMENT); 1667 } 1668 1669 #ifdef MFD_ALLOW_SEALING 1670 static void * 1671 memfd_alloc(const char *name, size_t size, unsigned int flags, int *fd) 1672 { 1673 void *ptr; 1674 int ret; 1675 1676 *fd = memfd_create(name, MFD_ALLOW_SEALING); 1677 if (*fd < 0) { 1678 return NULL; 1679 } 1680 1681 ret = ftruncate(*fd, size); 1682 if (ret < 0) { 1683 close(*fd); 1684 return NULL; 1685 } 1686 1687 ret = fcntl(*fd, F_ADD_SEALS, flags); 1688 if (ret < 0) { 1689 close(*fd); 1690 return NULL; 1691 } 1692 1693 ptr = mmap(0, size, PROT_READ | PROT_WRITE, MAP_SHARED, *fd, 0); 1694 if (ptr == MAP_FAILED) { 1695 close(*fd); 1696 return NULL; 1697 } 1698 1699 return ptr; 1700 } 1701 #endif 1702 1703 static bool 1704 vu_get_inflight_fd(VuDev *dev, VhostUserMsg *vmsg) 1705 { 1706 int fd = -1; 1707 void *addr = NULL; 1708 uint64_t mmap_size; 1709 uint16_t num_queues, queue_size; 1710 1711 if (vmsg->size != sizeof(vmsg->payload.inflight)) { 1712 vu_panic(dev, "Invalid get_inflight_fd message:%d", vmsg->size); 1713 vmsg->payload.inflight.mmap_size = 0; 1714 return true; 1715 } 1716 1717 num_queues = vmsg->payload.inflight.num_queues; 1718 queue_size = vmsg->payload.inflight.queue_size; 1719 1720 DPRINT("set_inflight_fd num_queues: %"PRId16"\n", num_queues); 1721 DPRINT("set_inflight_fd queue_size: %"PRId16"\n", queue_size); 1722 1723 mmap_size = vu_inflight_queue_size(queue_size) * num_queues; 1724 1725 #ifdef MFD_ALLOW_SEALING 1726 addr = memfd_alloc("vhost-inflight", mmap_size, 1727 F_SEAL_GROW | F_SEAL_SHRINK | F_SEAL_SEAL, 1728 &fd); 1729 #else 1730 vu_panic(dev, "Not implemented: memfd support is missing"); 1731 #endif 1732 1733 if (!addr) { 1734 vu_panic(dev, "Failed to alloc vhost inflight area"); 1735 vmsg->payload.inflight.mmap_size = 0; 1736 return true; 1737 } 1738 1739 memset(addr, 0, mmap_size); 1740 1741 dev->inflight_info.addr = addr; 1742 dev->inflight_info.size = vmsg->payload.inflight.mmap_size = mmap_size; 1743 dev->inflight_info.fd = vmsg->fds[0] = fd; 1744 vmsg->fd_num = 1; 1745 vmsg->payload.inflight.mmap_offset = 0; 1746 1747 DPRINT("send inflight mmap_size: %"PRId64"\n", 1748 vmsg->payload.inflight.mmap_size); 1749 DPRINT("send inflight mmap offset: %"PRId64"\n", 1750 vmsg->payload.inflight.mmap_offset); 1751 1752 return true; 1753 } 1754 1755 static bool 1756 vu_set_inflight_fd(VuDev *dev, VhostUserMsg *vmsg) 1757 { 1758 int fd, i; 1759 uint64_t mmap_size, mmap_offset; 1760 uint16_t num_queues, queue_size; 1761 void *rc; 1762 1763 if (vmsg->fd_num != 1 || 1764 vmsg->size != sizeof(vmsg->payload.inflight)) { 1765 vu_panic(dev, "Invalid set_inflight_fd message size:%d fds:%d", 1766 vmsg->size, vmsg->fd_num); 1767 return false; 1768 } 1769 1770 fd = vmsg->fds[0]; 1771 mmap_size = vmsg->payload.inflight.mmap_size; 1772 mmap_offset = vmsg->payload.inflight.mmap_offset; 1773 num_queues = vmsg->payload.inflight.num_queues; 1774 queue_size = vmsg->payload.inflight.queue_size; 1775 1776 DPRINT("set_inflight_fd mmap_size: %"PRId64"\n", mmap_size); 1777 DPRINT("set_inflight_fd mmap_offset: %"PRId64"\n", mmap_offset); 1778 DPRINT("set_inflight_fd num_queues: %"PRId16"\n", num_queues); 1779 DPRINT("set_inflight_fd queue_size: %"PRId16"\n", queue_size); 1780 1781 rc = mmap(0, mmap_size, PROT_READ | PROT_WRITE, MAP_SHARED, 1782 fd, mmap_offset); 1783 1784 if (rc == MAP_FAILED) { 1785 vu_panic(dev, "set_inflight_fd mmap error: %s", strerror(errno)); 1786 return false; 1787 } 1788 1789 if (dev->inflight_info.fd) { 1790 close(dev->inflight_info.fd); 1791 } 1792 1793 if (dev->inflight_info.addr) { 1794 munmap(dev->inflight_info.addr, dev->inflight_info.size); 1795 } 1796 1797 dev->inflight_info.fd = fd; 1798 dev->inflight_info.addr = rc; 1799 dev->inflight_info.size = mmap_size; 1800 1801 for (i = 0; i < num_queues; i++) { 1802 dev->vq[i].inflight = (VuVirtqInflight *)rc; 1803 dev->vq[i].inflight->desc_num = queue_size; 1804 rc = (void *)((char *)rc + vu_inflight_queue_size(queue_size)); 1805 } 1806 1807 return false; 1808 } 1809 1810 static bool 1811 vu_handle_vring_kick(VuDev *dev, VhostUserMsg *vmsg) 1812 { 1813 unsigned int index = vmsg->payload.state.index; 1814 1815 if (index >= dev->max_queues) { 1816 vu_panic(dev, "Invalid queue index: %u", index); 1817 return false; 1818 } 1819 1820 DPRINT("Got kick message: handler:%p idx:%u\n", 1821 dev->vq[index].handler, index); 1822 1823 if (!dev->vq[index].started) { 1824 dev->vq[index].started = true; 1825 1826 if (dev->iface->queue_set_started) { 1827 dev->iface->queue_set_started(dev, index, true); 1828 } 1829 } 1830 1831 if (dev->vq[index].handler) { 1832 dev->vq[index].handler(dev, index); 1833 } 1834 1835 return false; 1836 } 1837 1838 static bool vu_handle_get_max_memslots(VuDev *dev, VhostUserMsg *vmsg) 1839 { 1840 vmsg_set_reply_u64(vmsg, VHOST_USER_MAX_RAM_SLOTS); 1841 1842 DPRINT("u64: 0x%016"PRIx64"\n", (uint64_t) VHOST_USER_MAX_RAM_SLOTS); 1843 1844 return true; 1845 } 1846 1847 static bool 1848 vu_process_message(VuDev *dev, VhostUserMsg *vmsg) 1849 { 1850 int do_reply = 0; 1851 1852 /* Print out generic part of the request. */ 1853 DPRINT("================ Vhost user message ================\n"); 1854 DPRINT("Request: %s (%d)\n", vu_request_to_string(vmsg->request), 1855 vmsg->request); 1856 DPRINT("Flags: 0x%x\n", vmsg->flags); 1857 DPRINT("Size: %u\n", vmsg->size); 1858 1859 if (vmsg->fd_num) { 1860 int i; 1861 DPRINT("Fds:"); 1862 for (i = 0; i < vmsg->fd_num; i++) { 1863 DPRINT(" %d", vmsg->fds[i]); 1864 } 1865 DPRINT("\n"); 1866 } 1867 1868 if (dev->iface->process_msg && 1869 dev->iface->process_msg(dev, vmsg, &do_reply)) { 1870 return do_reply; 1871 } 1872 1873 switch (vmsg->request) { 1874 case VHOST_USER_GET_FEATURES: 1875 return vu_get_features_exec(dev, vmsg); 1876 case VHOST_USER_SET_FEATURES: 1877 return vu_set_features_exec(dev, vmsg); 1878 case VHOST_USER_GET_PROTOCOL_FEATURES: 1879 return vu_get_protocol_features_exec(dev, vmsg); 1880 case VHOST_USER_SET_PROTOCOL_FEATURES: 1881 return vu_set_protocol_features_exec(dev, vmsg); 1882 case VHOST_USER_SET_OWNER: 1883 return vu_set_owner_exec(dev, vmsg); 1884 case VHOST_USER_RESET_OWNER: 1885 return vu_reset_device_exec(dev, vmsg); 1886 case VHOST_USER_SET_MEM_TABLE: 1887 return vu_set_mem_table_exec(dev, vmsg); 1888 case VHOST_USER_SET_LOG_BASE: 1889 return vu_set_log_base_exec(dev, vmsg); 1890 case VHOST_USER_SET_LOG_FD: 1891 return vu_set_log_fd_exec(dev, vmsg); 1892 case VHOST_USER_SET_VRING_NUM: 1893 return vu_set_vring_num_exec(dev, vmsg); 1894 case VHOST_USER_SET_VRING_ADDR: 1895 return vu_set_vring_addr_exec(dev, vmsg); 1896 case VHOST_USER_SET_VRING_BASE: 1897 return vu_set_vring_base_exec(dev, vmsg); 1898 case VHOST_USER_GET_VRING_BASE: 1899 return vu_get_vring_base_exec(dev, vmsg); 1900 case VHOST_USER_SET_VRING_KICK: 1901 return vu_set_vring_kick_exec(dev, vmsg); 1902 case VHOST_USER_SET_VRING_CALL: 1903 return vu_set_vring_call_exec(dev, vmsg); 1904 case VHOST_USER_SET_VRING_ERR: 1905 return vu_set_vring_err_exec(dev, vmsg); 1906 case VHOST_USER_GET_QUEUE_NUM: 1907 return vu_get_queue_num_exec(dev, vmsg); 1908 case VHOST_USER_SET_VRING_ENABLE: 1909 return vu_set_vring_enable_exec(dev, vmsg); 1910 case VHOST_USER_SET_SLAVE_REQ_FD: 1911 return vu_set_slave_req_fd(dev, vmsg); 1912 case VHOST_USER_GET_CONFIG: 1913 return vu_get_config(dev, vmsg); 1914 case VHOST_USER_SET_CONFIG: 1915 return vu_set_config(dev, vmsg); 1916 case VHOST_USER_NONE: 1917 /* if you need processing before exit, override iface->process_msg */ 1918 exit(0); 1919 case VHOST_USER_POSTCOPY_ADVISE: 1920 return vu_set_postcopy_advise(dev, vmsg); 1921 case VHOST_USER_POSTCOPY_LISTEN: 1922 return vu_set_postcopy_listen(dev, vmsg); 1923 case VHOST_USER_POSTCOPY_END: 1924 return vu_set_postcopy_end(dev, vmsg); 1925 case VHOST_USER_GET_INFLIGHT_FD: 1926 return vu_get_inflight_fd(dev, vmsg); 1927 case VHOST_USER_SET_INFLIGHT_FD: 1928 return vu_set_inflight_fd(dev, vmsg); 1929 case VHOST_USER_VRING_KICK: 1930 return vu_handle_vring_kick(dev, vmsg); 1931 case VHOST_USER_GET_MAX_MEM_SLOTS: 1932 return vu_handle_get_max_memslots(dev, vmsg); 1933 case VHOST_USER_ADD_MEM_REG: 1934 return vu_add_mem_reg(dev, vmsg); 1935 case VHOST_USER_REM_MEM_REG: 1936 return vu_rem_mem_reg(dev, vmsg); 1937 default: 1938 vmsg_close_fds(vmsg); 1939 vu_panic(dev, "Unhandled request: %d", vmsg->request); 1940 } 1941 1942 return false; 1943 } 1944 1945 bool 1946 vu_dispatch(VuDev *dev) 1947 { 1948 VhostUserMsg vmsg = { 0, }; 1949 int reply_requested; 1950 bool need_reply, success = false; 1951 1952 if (!dev->read_msg(dev, dev->sock, &vmsg)) { 1953 goto end; 1954 } 1955 1956 need_reply = vmsg.flags & VHOST_USER_NEED_REPLY_MASK; 1957 1958 reply_requested = vu_process_message(dev, &vmsg); 1959 if (!reply_requested && need_reply) { 1960 vmsg_set_reply_u64(&vmsg, 0); 1961 reply_requested = 1; 1962 } 1963 1964 if (!reply_requested) { 1965 success = true; 1966 goto end; 1967 } 1968 1969 if (!vu_send_reply(dev, dev->sock, &vmsg)) { 1970 goto end; 1971 } 1972 1973 success = true; 1974 1975 end: 1976 free(vmsg.data); 1977 return success; 1978 } 1979 1980 void 1981 vu_deinit(VuDev *dev) 1982 { 1983 int i; 1984 1985 for (i = 0; i < dev->nregions; i++) { 1986 VuDevRegion *r = &dev->regions[i]; 1987 void *m = (void *) (uintptr_t) r->mmap_addr; 1988 if (m != MAP_FAILED) { 1989 munmap(m, r->size + r->mmap_offset); 1990 } 1991 } 1992 dev->nregions = 0; 1993 1994 for (i = 0; i < dev->max_queues; i++) { 1995 VuVirtq *vq = &dev->vq[i]; 1996 1997 if (vq->call_fd != -1) { 1998 close(vq->call_fd); 1999 vq->call_fd = -1; 2000 } 2001 2002 if (vq->kick_fd != -1) { 2003 dev->remove_watch(dev, vq->kick_fd); 2004 close(vq->kick_fd); 2005 vq->kick_fd = -1; 2006 } 2007 2008 if (vq->err_fd != -1) { 2009 close(vq->err_fd); 2010 vq->err_fd = -1; 2011 } 2012 2013 if (vq->resubmit_list) { 2014 free(vq->resubmit_list); 2015 vq->resubmit_list = NULL; 2016 } 2017 2018 vq->inflight = NULL; 2019 } 2020 2021 if (dev->inflight_info.addr) { 2022 munmap(dev->inflight_info.addr, dev->inflight_info.size); 2023 dev->inflight_info.addr = NULL; 2024 } 2025 2026 if (dev->inflight_info.fd > 0) { 2027 close(dev->inflight_info.fd); 2028 dev->inflight_info.fd = -1; 2029 } 2030 2031 vu_close_log(dev); 2032 if (dev->slave_fd != -1) { 2033 close(dev->slave_fd); 2034 dev->slave_fd = -1; 2035 } 2036 pthread_mutex_destroy(&dev->slave_mutex); 2037 2038 if (dev->sock != -1) { 2039 close(dev->sock); 2040 } 2041 2042 free(dev->vq); 2043 dev->vq = NULL; 2044 } 2045 2046 bool 2047 vu_init(VuDev *dev, 2048 uint16_t max_queues, 2049 int socket, 2050 vu_panic_cb panic, 2051 vu_read_msg_cb read_msg, 2052 vu_set_watch_cb set_watch, 2053 vu_remove_watch_cb remove_watch, 2054 const VuDevIface *iface) 2055 { 2056 uint16_t i; 2057 2058 assert(max_queues > 0); 2059 assert(socket >= 0); 2060 assert(set_watch); 2061 assert(remove_watch); 2062 assert(iface); 2063 assert(panic); 2064 2065 memset(dev, 0, sizeof(*dev)); 2066 2067 dev->sock = socket; 2068 dev->panic = panic; 2069 dev->read_msg = read_msg ? read_msg : vu_message_read_default; 2070 dev->set_watch = set_watch; 2071 dev->remove_watch = remove_watch; 2072 dev->iface = iface; 2073 dev->log_call_fd = -1; 2074 pthread_mutex_init(&dev->slave_mutex, NULL); 2075 dev->slave_fd = -1; 2076 dev->max_queues = max_queues; 2077 2078 dev->vq = malloc(max_queues * sizeof(dev->vq[0])); 2079 if (!dev->vq) { 2080 DPRINT("%s: failed to malloc virtqueues\n", __func__); 2081 return false; 2082 } 2083 2084 for (i = 0; i < max_queues; i++) { 2085 dev->vq[i] = (VuVirtq) { 2086 .call_fd = -1, .kick_fd = -1, .err_fd = -1, 2087 .notification = true, 2088 }; 2089 } 2090 2091 return true; 2092 } 2093 2094 VuVirtq * 2095 vu_get_queue(VuDev *dev, int qidx) 2096 { 2097 assert(qidx < dev->max_queues); 2098 return &dev->vq[qidx]; 2099 } 2100 2101 bool 2102 vu_queue_enabled(VuDev *dev, VuVirtq *vq) 2103 { 2104 return vq->enable; 2105 } 2106 2107 bool 2108 vu_queue_started(const VuDev *dev, const VuVirtq *vq) 2109 { 2110 return vq->started; 2111 } 2112 2113 static inline uint16_t 2114 vring_avail_flags(VuVirtq *vq) 2115 { 2116 return le16toh(vq->vring.avail->flags); 2117 } 2118 2119 static inline uint16_t 2120 vring_avail_idx(VuVirtq *vq) 2121 { 2122 vq->shadow_avail_idx = le16toh(vq->vring.avail->idx); 2123 2124 return vq->shadow_avail_idx; 2125 } 2126 2127 static inline uint16_t 2128 vring_avail_ring(VuVirtq *vq, int i) 2129 { 2130 return le16toh(vq->vring.avail->ring[i]); 2131 } 2132 2133 static inline uint16_t 2134 vring_get_used_event(VuVirtq *vq) 2135 { 2136 return vring_avail_ring(vq, vq->vring.num); 2137 } 2138 2139 static int 2140 virtqueue_num_heads(VuDev *dev, VuVirtq *vq, unsigned int idx) 2141 { 2142 uint16_t num_heads = vring_avail_idx(vq) - idx; 2143 2144 /* Check it isn't doing very strange things with descriptor numbers. */ 2145 if (num_heads > vq->vring.num) { 2146 vu_panic(dev, "Guest moved used index from %u to %u", 2147 idx, vq->shadow_avail_idx); 2148 return -1; 2149 } 2150 if (num_heads) { 2151 /* On success, callers read a descriptor at vq->last_avail_idx. 2152 * Make sure descriptor read does not bypass avail index read. */ 2153 smp_rmb(); 2154 } 2155 2156 return num_heads; 2157 } 2158 2159 static bool 2160 virtqueue_get_head(VuDev *dev, VuVirtq *vq, 2161 unsigned int idx, unsigned int *head) 2162 { 2163 /* Grab the next descriptor number they're advertising, and increment 2164 * the index we've seen. */ 2165 *head = vring_avail_ring(vq, idx % vq->vring.num); 2166 2167 /* If their number is silly, that's a fatal mistake. */ 2168 if (*head >= vq->vring.num) { 2169 vu_panic(dev, "Guest says index %u is available", *head); 2170 return false; 2171 } 2172 2173 return true; 2174 } 2175 2176 static int 2177 virtqueue_read_indirect_desc(VuDev *dev, struct vring_desc *desc, 2178 uint64_t addr, size_t len) 2179 { 2180 struct vring_desc *ori_desc; 2181 uint64_t read_len; 2182 2183 if (len > (VIRTQUEUE_MAX_SIZE * sizeof(struct vring_desc))) { 2184 return -1; 2185 } 2186 2187 if (len == 0) { 2188 return -1; 2189 } 2190 2191 while (len) { 2192 read_len = len; 2193 ori_desc = vu_gpa_to_va(dev, &read_len, addr); 2194 if (!ori_desc) { 2195 return -1; 2196 } 2197 2198 memcpy(desc, ori_desc, read_len); 2199 len -= read_len; 2200 addr += read_len; 2201 desc += read_len; 2202 } 2203 2204 return 0; 2205 } 2206 2207 enum { 2208 VIRTQUEUE_READ_DESC_ERROR = -1, 2209 VIRTQUEUE_READ_DESC_DONE = 0, /* end of chain */ 2210 VIRTQUEUE_READ_DESC_MORE = 1, /* more buffers in chain */ 2211 }; 2212 2213 static int 2214 virtqueue_read_next_desc(VuDev *dev, struct vring_desc *desc, 2215 int i, unsigned int max, unsigned int *next) 2216 { 2217 /* If this descriptor says it doesn't chain, we're done. */ 2218 if (!(le16toh(desc[i].flags) & VRING_DESC_F_NEXT)) { 2219 return VIRTQUEUE_READ_DESC_DONE; 2220 } 2221 2222 /* Check they're not leading us off end of descriptors. */ 2223 *next = le16toh(desc[i].next); 2224 /* Make sure compiler knows to grab that: we don't want it changing! */ 2225 smp_wmb(); 2226 2227 if (*next >= max) { 2228 vu_panic(dev, "Desc next is %u", *next); 2229 return VIRTQUEUE_READ_DESC_ERROR; 2230 } 2231 2232 return VIRTQUEUE_READ_DESC_MORE; 2233 } 2234 2235 void 2236 vu_queue_get_avail_bytes(VuDev *dev, VuVirtq *vq, unsigned int *in_bytes, 2237 unsigned int *out_bytes, 2238 unsigned max_in_bytes, unsigned max_out_bytes) 2239 { 2240 unsigned int idx; 2241 unsigned int total_bufs, in_total, out_total; 2242 int rc; 2243 2244 idx = vq->last_avail_idx; 2245 2246 total_bufs = in_total = out_total = 0; 2247 if (unlikely(dev->broken) || 2248 unlikely(!vq->vring.avail)) { 2249 goto done; 2250 } 2251 2252 while ((rc = virtqueue_num_heads(dev, vq, idx)) > 0) { 2253 unsigned int max, desc_len, num_bufs, indirect = 0; 2254 uint64_t desc_addr, read_len; 2255 struct vring_desc *desc; 2256 struct vring_desc desc_buf[VIRTQUEUE_MAX_SIZE]; 2257 unsigned int i; 2258 2259 max = vq->vring.num; 2260 num_bufs = total_bufs; 2261 if (!virtqueue_get_head(dev, vq, idx++, &i)) { 2262 goto err; 2263 } 2264 desc = vq->vring.desc; 2265 2266 if (le16toh(desc[i].flags) & VRING_DESC_F_INDIRECT) { 2267 if (le32toh(desc[i].len) % sizeof(struct vring_desc)) { 2268 vu_panic(dev, "Invalid size for indirect buffer table"); 2269 goto err; 2270 } 2271 2272 /* If we've got too many, that implies a descriptor loop. */ 2273 if (num_bufs >= max) { 2274 vu_panic(dev, "Looped descriptor"); 2275 goto err; 2276 } 2277 2278 /* loop over the indirect descriptor table */ 2279 indirect = 1; 2280 desc_addr = le64toh(desc[i].addr); 2281 desc_len = le32toh(desc[i].len); 2282 max = desc_len / sizeof(struct vring_desc); 2283 read_len = desc_len; 2284 desc = vu_gpa_to_va(dev, &read_len, desc_addr); 2285 if (unlikely(desc && read_len != desc_len)) { 2286 /* Failed to use zero copy */ 2287 desc = NULL; 2288 if (!virtqueue_read_indirect_desc(dev, desc_buf, 2289 desc_addr, 2290 desc_len)) { 2291 desc = desc_buf; 2292 } 2293 } 2294 if (!desc) { 2295 vu_panic(dev, "Invalid indirect buffer table"); 2296 goto err; 2297 } 2298 num_bufs = i = 0; 2299 } 2300 2301 do { 2302 /* If we've got too many, that implies a descriptor loop. */ 2303 if (++num_bufs > max) { 2304 vu_panic(dev, "Looped descriptor"); 2305 goto err; 2306 } 2307 2308 if (le16toh(desc[i].flags) & VRING_DESC_F_WRITE) { 2309 in_total += le32toh(desc[i].len); 2310 } else { 2311 out_total += le32toh(desc[i].len); 2312 } 2313 if (in_total >= max_in_bytes && out_total >= max_out_bytes) { 2314 goto done; 2315 } 2316 rc = virtqueue_read_next_desc(dev, desc, i, max, &i); 2317 } while (rc == VIRTQUEUE_READ_DESC_MORE); 2318 2319 if (rc == VIRTQUEUE_READ_DESC_ERROR) { 2320 goto err; 2321 } 2322 2323 if (!indirect) { 2324 total_bufs = num_bufs; 2325 } else { 2326 total_bufs++; 2327 } 2328 } 2329 if (rc < 0) { 2330 goto err; 2331 } 2332 done: 2333 if (in_bytes) { 2334 *in_bytes = in_total; 2335 } 2336 if (out_bytes) { 2337 *out_bytes = out_total; 2338 } 2339 return; 2340 2341 err: 2342 in_total = out_total = 0; 2343 goto done; 2344 } 2345 2346 bool 2347 vu_queue_avail_bytes(VuDev *dev, VuVirtq *vq, unsigned int in_bytes, 2348 unsigned int out_bytes) 2349 { 2350 unsigned int in_total, out_total; 2351 2352 vu_queue_get_avail_bytes(dev, vq, &in_total, &out_total, 2353 in_bytes, out_bytes); 2354 2355 return in_bytes <= in_total && out_bytes <= out_total; 2356 } 2357 2358 /* Fetch avail_idx from VQ memory only when we really need to know if 2359 * guest has added some buffers. */ 2360 bool 2361 vu_queue_empty(VuDev *dev, VuVirtq *vq) 2362 { 2363 if (unlikely(dev->broken) || 2364 unlikely(!vq->vring.avail)) { 2365 return true; 2366 } 2367 2368 if (vq->shadow_avail_idx != vq->last_avail_idx) { 2369 return false; 2370 } 2371 2372 return vring_avail_idx(vq) == vq->last_avail_idx; 2373 } 2374 2375 static bool 2376 vring_notify(VuDev *dev, VuVirtq *vq) 2377 { 2378 uint16_t old, new; 2379 bool v; 2380 2381 /* We need to expose used array entries before checking used event. */ 2382 smp_mb(); 2383 2384 /* Always notify when queue is empty (when feature acknowledge) */ 2385 if (vu_has_feature(dev, VIRTIO_F_NOTIFY_ON_EMPTY) && 2386 !vq->inuse && vu_queue_empty(dev, vq)) { 2387 return true; 2388 } 2389 2390 if (!vu_has_feature(dev, VIRTIO_RING_F_EVENT_IDX)) { 2391 return !(vring_avail_flags(vq) & VRING_AVAIL_F_NO_INTERRUPT); 2392 } 2393 2394 v = vq->signalled_used_valid; 2395 vq->signalled_used_valid = true; 2396 old = vq->signalled_used; 2397 new = vq->signalled_used = vq->used_idx; 2398 return !v || vring_need_event(vring_get_used_event(vq), new, old); 2399 } 2400 2401 static void _vu_queue_notify(VuDev *dev, VuVirtq *vq, bool sync) 2402 { 2403 if (unlikely(dev->broken) || 2404 unlikely(!vq->vring.avail)) { 2405 return; 2406 } 2407 2408 if (!vring_notify(dev, vq)) { 2409 DPRINT("skipped notify...\n"); 2410 return; 2411 } 2412 2413 if (vq->call_fd < 0 && 2414 vu_has_protocol_feature(dev, 2415 VHOST_USER_PROTOCOL_F_INBAND_NOTIFICATIONS) && 2416 vu_has_protocol_feature(dev, VHOST_USER_PROTOCOL_F_SLAVE_REQ)) { 2417 VhostUserMsg vmsg = { 2418 .request = VHOST_USER_SLAVE_VRING_CALL, 2419 .flags = VHOST_USER_VERSION, 2420 .size = sizeof(vmsg.payload.state), 2421 .payload.state = { 2422 .index = vq - dev->vq, 2423 }, 2424 }; 2425 bool ack = sync && 2426 vu_has_protocol_feature(dev, 2427 VHOST_USER_PROTOCOL_F_REPLY_ACK); 2428 2429 if (ack) { 2430 vmsg.flags |= VHOST_USER_NEED_REPLY_MASK; 2431 } 2432 2433 vu_message_write(dev, dev->slave_fd, &vmsg); 2434 if (ack) { 2435 vu_message_read_default(dev, dev->slave_fd, &vmsg); 2436 } 2437 return; 2438 } 2439 2440 if (eventfd_write(vq->call_fd, 1) < 0) { 2441 vu_panic(dev, "Error writing eventfd: %s", strerror(errno)); 2442 } 2443 } 2444 2445 void vu_queue_notify(VuDev *dev, VuVirtq *vq) 2446 { 2447 _vu_queue_notify(dev, vq, false); 2448 } 2449 2450 void vu_queue_notify_sync(VuDev *dev, VuVirtq *vq) 2451 { 2452 _vu_queue_notify(dev, vq, true); 2453 } 2454 2455 static inline void 2456 vring_used_flags_set_bit(VuVirtq *vq, int mask) 2457 { 2458 uint16_t *flags; 2459 2460 flags = (uint16_t *)((char*)vq->vring.used + 2461 offsetof(struct vring_used, flags)); 2462 *flags = htole16(le16toh(*flags) | mask); 2463 } 2464 2465 static inline void 2466 vring_used_flags_unset_bit(VuVirtq *vq, int mask) 2467 { 2468 uint16_t *flags; 2469 2470 flags = (uint16_t *)((char*)vq->vring.used + 2471 offsetof(struct vring_used, flags)); 2472 *flags = htole16(le16toh(*flags) & ~mask); 2473 } 2474 2475 static inline void 2476 vring_set_avail_event(VuVirtq *vq, uint16_t val) 2477 { 2478 uint16_t *avail; 2479 2480 if (!vq->notification) { 2481 return; 2482 } 2483 2484 avail = (uint16_t *)&vq->vring.used->ring[vq->vring.num]; 2485 *avail = htole16(val); 2486 } 2487 2488 void 2489 vu_queue_set_notification(VuDev *dev, VuVirtq *vq, int enable) 2490 { 2491 vq->notification = enable; 2492 if (vu_has_feature(dev, VIRTIO_RING_F_EVENT_IDX)) { 2493 vring_set_avail_event(vq, vring_avail_idx(vq)); 2494 } else if (enable) { 2495 vring_used_flags_unset_bit(vq, VRING_USED_F_NO_NOTIFY); 2496 } else { 2497 vring_used_flags_set_bit(vq, VRING_USED_F_NO_NOTIFY); 2498 } 2499 if (enable) { 2500 /* Expose avail event/used flags before caller checks the avail idx. */ 2501 smp_mb(); 2502 } 2503 } 2504 2505 static bool 2506 virtqueue_map_desc(VuDev *dev, 2507 unsigned int *p_num_sg, struct iovec *iov, 2508 unsigned int max_num_sg, bool is_write, 2509 uint64_t pa, size_t sz) 2510 { 2511 unsigned num_sg = *p_num_sg; 2512 2513 assert(num_sg <= max_num_sg); 2514 2515 if (!sz) { 2516 vu_panic(dev, "virtio: zero sized buffers are not allowed"); 2517 return false; 2518 } 2519 2520 while (sz) { 2521 uint64_t len = sz; 2522 2523 if (num_sg == max_num_sg) { 2524 vu_panic(dev, "virtio: too many descriptors in indirect table"); 2525 return false; 2526 } 2527 2528 iov[num_sg].iov_base = vu_gpa_to_va(dev, &len, pa); 2529 if (iov[num_sg].iov_base == NULL) { 2530 vu_panic(dev, "virtio: invalid address for buffers"); 2531 return false; 2532 } 2533 iov[num_sg].iov_len = len; 2534 num_sg++; 2535 sz -= len; 2536 pa += len; 2537 } 2538 2539 *p_num_sg = num_sg; 2540 return true; 2541 } 2542 2543 static void * 2544 virtqueue_alloc_element(size_t sz, 2545 unsigned out_num, unsigned in_num) 2546 { 2547 VuVirtqElement *elem; 2548 size_t in_sg_ofs = ALIGN_UP(sz, __alignof__(elem->in_sg[0])); 2549 size_t out_sg_ofs = in_sg_ofs + in_num * sizeof(elem->in_sg[0]); 2550 size_t out_sg_end = out_sg_ofs + out_num * sizeof(elem->out_sg[0]); 2551 2552 assert(sz >= sizeof(VuVirtqElement)); 2553 elem = malloc(out_sg_end); 2554 elem->out_num = out_num; 2555 elem->in_num = in_num; 2556 elem->in_sg = (void *)elem + in_sg_ofs; 2557 elem->out_sg = (void *)elem + out_sg_ofs; 2558 return elem; 2559 } 2560 2561 static void * 2562 vu_queue_map_desc(VuDev *dev, VuVirtq *vq, unsigned int idx, size_t sz) 2563 { 2564 struct vring_desc *desc = vq->vring.desc; 2565 uint64_t desc_addr, read_len; 2566 unsigned int desc_len; 2567 unsigned int max = vq->vring.num; 2568 unsigned int i = idx; 2569 VuVirtqElement *elem; 2570 unsigned int out_num = 0, in_num = 0; 2571 struct iovec iov[VIRTQUEUE_MAX_SIZE]; 2572 struct vring_desc desc_buf[VIRTQUEUE_MAX_SIZE]; 2573 int rc; 2574 2575 if (le16toh(desc[i].flags) & VRING_DESC_F_INDIRECT) { 2576 if (le32toh(desc[i].len) % sizeof(struct vring_desc)) { 2577 vu_panic(dev, "Invalid size for indirect buffer table"); 2578 return NULL; 2579 } 2580 2581 /* loop over the indirect descriptor table */ 2582 desc_addr = le64toh(desc[i].addr); 2583 desc_len = le32toh(desc[i].len); 2584 max = desc_len / sizeof(struct vring_desc); 2585 read_len = desc_len; 2586 desc = vu_gpa_to_va(dev, &read_len, desc_addr); 2587 if (unlikely(desc && read_len != desc_len)) { 2588 /* Failed to use zero copy */ 2589 desc = NULL; 2590 if (!virtqueue_read_indirect_desc(dev, desc_buf, 2591 desc_addr, 2592 desc_len)) { 2593 desc = desc_buf; 2594 } 2595 } 2596 if (!desc) { 2597 vu_panic(dev, "Invalid indirect buffer table"); 2598 return NULL; 2599 } 2600 i = 0; 2601 } 2602 2603 /* Collect all the descriptors */ 2604 do { 2605 if (le16toh(desc[i].flags) & VRING_DESC_F_WRITE) { 2606 if (!virtqueue_map_desc(dev, &in_num, iov + out_num, 2607 VIRTQUEUE_MAX_SIZE - out_num, true, 2608 le64toh(desc[i].addr), 2609 le32toh(desc[i].len))) { 2610 return NULL; 2611 } 2612 } else { 2613 if (in_num) { 2614 vu_panic(dev, "Incorrect order for descriptors"); 2615 return NULL; 2616 } 2617 if (!virtqueue_map_desc(dev, &out_num, iov, 2618 VIRTQUEUE_MAX_SIZE, false, 2619 le64toh(desc[i].addr), 2620 le32toh(desc[i].len))) { 2621 return NULL; 2622 } 2623 } 2624 2625 /* If we've got too many, that implies a descriptor loop. */ 2626 if ((in_num + out_num) > max) { 2627 vu_panic(dev, "Looped descriptor"); 2628 return NULL; 2629 } 2630 rc = virtqueue_read_next_desc(dev, desc, i, max, &i); 2631 } while (rc == VIRTQUEUE_READ_DESC_MORE); 2632 2633 if (rc == VIRTQUEUE_READ_DESC_ERROR) { 2634 vu_panic(dev, "read descriptor error"); 2635 return NULL; 2636 } 2637 2638 /* Now copy what we have collected and mapped */ 2639 elem = virtqueue_alloc_element(sz, out_num, in_num); 2640 elem->index = idx; 2641 for (i = 0; i < out_num; i++) { 2642 elem->out_sg[i] = iov[i]; 2643 } 2644 for (i = 0; i < in_num; i++) { 2645 elem->in_sg[i] = iov[out_num + i]; 2646 } 2647 2648 return elem; 2649 } 2650 2651 static int 2652 vu_queue_inflight_get(VuDev *dev, VuVirtq *vq, int desc_idx) 2653 { 2654 if (!vu_has_protocol_feature(dev, VHOST_USER_PROTOCOL_F_INFLIGHT_SHMFD)) { 2655 return 0; 2656 } 2657 2658 if (unlikely(!vq->inflight)) { 2659 return -1; 2660 } 2661 2662 vq->inflight->desc[desc_idx].counter = vq->counter++; 2663 vq->inflight->desc[desc_idx].inflight = 1; 2664 2665 return 0; 2666 } 2667 2668 static int 2669 vu_queue_inflight_pre_put(VuDev *dev, VuVirtq *vq, int desc_idx) 2670 { 2671 if (!vu_has_protocol_feature(dev, VHOST_USER_PROTOCOL_F_INFLIGHT_SHMFD)) { 2672 return 0; 2673 } 2674 2675 if (unlikely(!vq->inflight)) { 2676 return -1; 2677 } 2678 2679 vq->inflight->last_batch_head = desc_idx; 2680 2681 return 0; 2682 } 2683 2684 static int 2685 vu_queue_inflight_post_put(VuDev *dev, VuVirtq *vq, int desc_idx) 2686 { 2687 if (!vu_has_protocol_feature(dev, VHOST_USER_PROTOCOL_F_INFLIGHT_SHMFD)) { 2688 return 0; 2689 } 2690 2691 if (unlikely(!vq->inflight)) { 2692 return -1; 2693 } 2694 2695 barrier(); 2696 2697 vq->inflight->desc[desc_idx].inflight = 0; 2698 2699 barrier(); 2700 2701 vq->inflight->used_idx = vq->used_idx; 2702 2703 return 0; 2704 } 2705 2706 void * 2707 vu_queue_pop(VuDev *dev, VuVirtq *vq, size_t sz) 2708 { 2709 int i; 2710 unsigned int head; 2711 VuVirtqElement *elem; 2712 2713 if (unlikely(dev->broken) || 2714 unlikely(!vq->vring.avail)) { 2715 return NULL; 2716 } 2717 2718 if (unlikely(vq->resubmit_list && vq->resubmit_num > 0)) { 2719 i = (--vq->resubmit_num); 2720 elem = vu_queue_map_desc(dev, vq, vq->resubmit_list[i].index, sz); 2721 2722 if (!vq->resubmit_num) { 2723 free(vq->resubmit_list); 2724 vq->resubmit_list = NULL; 2725 } 2726 2727 return elem; 2728 } 2729 2730 if (vu_queue_empty(dev, vq)) { 2731 return NULL; 2732 } 2733 /* 2734 * Needed after virtio_queue_empty(), see comment in 2735 * virtqueue_num_heads(). 2736 */ 2737 smp_rmb(); 2738 2739 if (vq->inuse >= vq->vring.num) { 2740 vu_panic(dev, "Virtqueue size exceeded"); 2741 return NULL; 2742 } 2743 2744 if (!virtqueue_get_head(dev, vq, vq->last_avail_idx++, &head)) { 2745 return NULL; 2746 } 2747 2748 if (vu_has_feature(dev, VIRTIO_RING_F_EVENT_IDX)) { 2749 vring_set_avail_event(vq, vq->last_avail_idx); 2750 } 2751 2752 elem = vu_queue_map_desc(dev, vq, head, sz); 2753 2754 if (!elem) { 2755 return NULL; 2756 } 2757 2758 vq->inuse++; 2759 2760 vu_queue_inflight_get(dev, vq, head); 2761 2762 return elem; 2763 } 2764 2765 static void 2766 vu_queue_detach_element(VuDev *dev, VuVirtq *vq, VuVirtqElement *elem, 2767 size_t len) 2768 { 2769 vq->inuse--; 2770 /* unmap, when DMA support is added */ 2771 } 2772 2773 void 2774 vu_queue_unpop(VuDev *dev, VuVirtq *vq, VuVirtqElement *elem, 2775 size_t len) 2776 { 2777 vq->last_avail_idx--; 2778 vu_queue_detach_element(dev, vq, elem, len); 2779 } 2780 2781 bool 2782 vu_queue_rewind(VuDev *dev, VuVirtq *vq, unsigned int num) 2783 { 2784 if (num > vq->inuse) { 2785 return false; 2786 } 2787 vq->last_avail_idx -= num; 2788 vq->inuse -= num; 2789 return true; 2790 } 2791 2792 static inline 2793 void vring_used_write(VuDev *dev, VuVirtq *vq, 2794 struct vring_used_elem *uelem, int i) 2795 { 2796 struct vring_used *used = vq->vring.used; 2797 2798 used->ring[i] = *uelem; 2799 vu_log_write(dev, vq->vring.log_guest_addr + 2800 offsetof(struct vring_used, ring[i]), 2801 sizeof(used->ring[i])); 2802 } 2803 2804 2805 static void 2806 vu_log_queue_fill(VuDev *dev, VuVirtq *vq, 2807 const VuVirtqElement *elem, 2808 unsigned int len) 2809 { 2810 struct vring_desc *desc = vq->vring.desc; 2811 unsigned int i, max, min, desc_len; 2812 uint64_t desc_addr, read_len; 2813 struct vring_desc desc_buf[VIRTQUEUE_MAX_SIZE]; 2814 unsigned num_bufs = 0; 2815 2816 max = vq->vring.num; 2817 i = elem->index; 2818 2819 if (le16toh(desc[i].flags) & VRING_DESC_F_INDIRECT) { 2820 if (le32toh(desc[i].len) % sizeof(struct vring_desc)) { 2821 vu_panic(dev, "Invalid size for indirect buffer table"); 2822 return; 2823 } 2824 2825 /* loop over the indirect descriptor table */ 2826 desc_addr = le64toh(desc[i].addr); 2827 desc_len = le32toh(desc[i].len); 2828 max = desc_len / sizeof(struct vring_desc); 2829 read_len = desc_len; 2830 desc = vu_gpa_to_va(dev, &read_len, desc_addr); 2831 if (unlikely(desc && read_len != desc_len)) { 2832 /* Failed to use zero copy */ 2833 desc = NULL; 2834 if (!virtqueue_read_indirect_desc(dev, desc_buf, 2835 desc_addr, 2836 desc_len)) { 2837 desc = desc_buf; 2838 } 2839 } 2840 if (!desc) { 2841 vu_panic(dev, "Invalid indirect buffer table"); 2842 return; 2843 } 2844 i = 0; 2845 } 2846 2847 do { 2848 if (++num_bufs > max) { 2849 vu_panic(dev, "Looped descriptor"); 2850 return; 2851 } 2852 2853 if (le16toh(desc[i].flags) & VRING_DESC_F_WRITE) { 2854 min = MIN(le32toh(desc[i].len), len); 2855 vu_log_write(dev, le64toh(desc[i].addr), min); 2856 len -= min; 2857 } 2858 2859 } while (len > 0 && 2860 (virtqueue_read_next_desc(dev, desc, i, max, &i) 2861 == VIRTQUEUE_READ_DESC_MORE)); 2862 } 2863 2864 void 2865 vu_queue_fill(VuDev *dev, VuVirtq *vq, 2866 const VuVirtqElement *elem, 2867 unsigned int len, unsigned int idx) 2868 { 2869 struct vring_used_elem uelem; 2870 2871 if (unlikely(dev->broken) || 2872 unlikely(!vq->vring.avail)) { 2873 return; 2874 } 2875 2876 vu_log_queue_fill(dev, vq, elem, len); 2877 2878 idx = (idx + vq->used_idx) % vq->vring.num; 2879 2880 uelem.id = htole32(elem->index); 2881 uelem.len = htole32(len); 2882 vring_used_write(dev, vq, &uelem, idx); 2883 } 2884 2885 static inline 2886 void vring_used_idx_set(VuDev *dev, VuVirtq *vq, uint16_t val) 2887 { 2888 vq->vring.used->idx = htole16(val); 2889 vu_log_write(dev, 2890 vq->vring.log_guest_addr + offsetof(struct vring_used, idx), 2891 sizeof(vq->vring.used->idx)); 2892 2893 vq->used_idx = val; 2894 } 2895 2896 void 2897 vu_queue_flush(VuDev *dev, VuVirtq *vq, unsigned int count) 2898 { 2899 uint16_t old, new; 2900 2901 if (unlikely(dev->broken) || 2902 unlikely(!vq->vring.avail)) { 2903 return; 2904 } 2905 2906 /* Make sure buffer is written before we update index. */ 2907 smp_wmb(); 2908 2909 old = vq->used_idx; 2910 new = old + count; 2911 vring_used_idx_set(dev, vq, new); 2912 vq->inuse -= count; 2913 if (unlikely((int16_t)(new - vq->signalled_used) < (uint16_t)(new - old))) { 2914 vq->signalled_used_valid = false; 2915 } 2916 } 2917 2918 void 2919 vu_queue_push(VuDev *dev, VuVirtq *vq, 2920 const VuVirtqElement *elem, unsigned int len) 2921 { 2922 vu_queue_fill(dev, vq, elem, len, 0); 2923 vu_queue_inflight_pre_put(dev, vq, elem->index); 2924 vu_queue_flush(dev, vq, 1); 2925 vu_queue_inflight_post_put(dev, vq, elem->index); 2926 } 2927