1 /* 2 * Vhost User library 3 * 4 * Copyright IBM, Corp. 2007 5 * Copyright (c) 2016 Red Hat, Inc. 6 * 7 * Authors: 8 * Anthony Liguori <aliguori@us.ibm.com> 9 * Marc-André Lureau <mlureau@redhat.com> 10 * Victor Kaplansky <victork@redhat.com> 11 * 12 * This work is licensed under the terms of the GNU GPL, version 2 or 13 * later. See the COPYING file in the top-level directory. 14 */ 15 16 #ifndef _GNU_SOURCE 17 #define _GNU_SOURCE 18 #endif 19 20 /* this code avoids GLib dependency */ 21 #include <stdlib.h> 22 #include <stdio.h> 23 #include <unistd.h> 24 #include <stdarg.h> 25 #include <errno.h> 26 #include <string.h> 27 #include <assert.h> 28 #include <inttypes.h> 29 #include <sys/types.h> 30 #include <sys/socket.h> 31 #include <sys/eventfd.h> 32 #include <sys/mman.h> 33 #include <endian.h> 34 35 /* Necessary to provide VIRTIO_F_VERSION_1 on system 36 * with older linux headers. Must appear before 37 * <linux/vhost.h> below. 38 */ 39 #include "standard-headers/linux/virtio_config.h" 40 41 #if defined(__linux__) 42 #include <sys/syscall.h> 43 #include <fcntl.h> 44 #include <sys/ioctl.h> 45 #include <linux/vhost.h> 46 #include <sys/vfs.h> 47 #include <linux/magic.h> 48 49 #ifdef __NR_userfaultfd 50 #include <linux/userfaultfd.h> 51 #endif 52 53 #endif 54 55 #include "include/atomic.h" 56 57 #include "libvhost-user.h" 58 59 /* usually provided by GLib */ 60 #if __GNUC__ > 2 || (__GNUC__ == 2 && __GNUC_MINOR__ > 4) 61 #if !defined(__clang__) && (__GNUC__ == 4 && __GNUC_MINOR__ == 4) 62 #define G_GNUC_PRINTF(format_idx, arg_idx) \ 63 __attribute__((__format__(gnu_printf, format_idx, arg_idx))) 64 #else 65 #define G_GNUC_PRINTF(format_idx, arg_idx) \ 66 __attribute__((__format__(__printf__, format_idx, arg_idx))) 67 #endif 68 #else /* !__GNUC__ */ 69 #define G_GNUC_PRINTF(format_idx, arg_idx) 70 #endif /* !__GNUC__ */ 71 #ifndef MIN 72 #define MIN(x, y) ({ \ 73 __typeof__(x) _min1 = (x); \ 74 __typeof__(y) _min2 = (y); \ 75 (void) (&_min1 == &_min2); \ 76 _min1 < _min2 ? _min1 : _min2; }) 77 #endif 78 79 /* Round number down to multiple */ 80 #define ALIGN_DOWN(n, m) ((n) / (m) * (m)) 81 82 /* Round number up to multiple */ 83 #define ALIGN_UP(n, m) ALIGN_DOWN((n) + (m) - 1, (m)) 84 85 #ifndef unlikely 86 #define unlikely(x) __builtin_expect(!!(x), 0) 87 #endif 88 89 /* Align each region to cache line size in inflight buffer */ 90 #define INFLIGHT_ALIGNMENT 64 91 92 /* The version of inflight buffer */ 93 #define INFLIGHT_VERSION 1 94 95 /* The version of the protocol we support */ 96 #define VHOST_USER_VERSION 1 97 #define LIBVHOST_USER_DEBUG 0 98 99 #define DPRINT(...) \ 100 do { \ 101 if (LIBVHOST_USER_DEBUG) { \ 102 fprintf(stderr, __VA_ARGS__); \ 103 } \ 104 } while (0) 105 106 static inline 107 bool has_feature(uint64_t features, unsigned int fbit) 108 { 109 assert(fbit < 64); 110 return !!(features & (1ULL << fbit)); 111 } 112 113 static inline 114 bool vu_has_feature(VuDev *dev, 115 unsigned int fbit) 116 { 117 return has_feature(dev->features, fbit); 118 } 119 120 static inline bool vu_has_protocol_feature(VuDev *dev, unsigned int fbit) 121 { 122 return has_feature(dev->protocol_features, fbit); 123 } 124 125 const char * 126 vu_request_to_string(unsigned int req) 127 { 128 #define REQ(req) [req] = #req 129 static const char *vu_request_str[] = { 130 REQ(VHOST_USER_NONE), 131 REQ(VHOST_USER_GET_FEATURES), 132 REQ(VHOST_USER_SET_FEATURES), 133 REQ(VHOST_USER_SET_OWNER), 134 REQ(VHOST_USER_RESET_OWNER), 135 REQ(VHOST_USER_SET_MEM_TABLE), 136 REQ(VHOST_USER_SET_LOG_BASE), 137 REQ(VHOST_USER_SET_LOG_FD), 138 REQ(VHOST_USER_SET_VRING_NUM), 139 REQ(VHOST_USER_SET_VRING_ADDR), 140 REQ(VHOST_USER_SET_VRING_BASE), 141 REQ(VHOST_USER_GET_VRING_BASE), 142 REQ(VHOST_USER_SET_VRING_KICK), 143 REQ(VHOST_USER_SET_VRING_CALL), 144 REQ(VHOST_USER_SET_VRING_ERR), 145 REQ(VHOST_USER_GET_PROTOCOL_FEATURES), 146 REQ(VHOST_USER_SET_PROTOCOL_FEATURES), 147 REQ(VHOST_USER_GET_QUEUE_NUM), 148 REQ(VHOST_USER_SET_VRING_ENABLE), 149 REQ(VHOST_USER_SEND_RARP), 150 REQ(VHOST_USER_NET_SET_MTU), 151 REQ(VHOST_USER_SET_BACKEND_REQ_FD), 152 REQ(VHOST_USER_IOTLB_MSG), 153 REQ(VHOST_USER_SET_VRING_ENDIAN), 154 REQ(VHOST_USER_GET_CONFIG), 155 REQ(VHOST_USER_SET_CONFIG), 156 REQ(VHOST_USER_POSTCOPY_ADVISE), 157 REQ(VHOST_USER_POSTCOPY_LISTEN), 158 REQ(VHOST_USER_POSTCOPY_END), 159 REQ(VHOST_USER_GET_INFLIGHT_FD), 160 REQ(VHOST_USER_SET_INFLIGHT_FD), 161 REQ(VHOST_USER_GPU_SET_SOCKET), 162 REQ(VHOST_USER_VRING_KICK), 163 REQ(VHOST_USER_GET_MAX_MEM_SLOTS), 164 REQ(VHOST_USER_ADD_MEM_REG), 165 REQ(VHOST_USER_REM_MEM_REG), 166 REQ(VHOST_USER_GET_SHARED_OBJECT), 167 REQ(VHOST_USER_MAX), 168 }; 169 #undef REQ 170 171 if (req < VHOST_USER_MAX) { 172 return vu_request_str[req]; 173 } else { 174 return "unknown"; 175 } 176 } 177 178 static void G_GNUC_PRINTF(2, 3) 179 vu_panic(VuDev *dev, const char *msg, ...) 180 { 181 char *buf = NULL; 182 va_list ap; 183 184 va_start(ap, msg); 185 if (vasprintf(&buf, msg, ap) < 0) { 186 buf = NULL; 187 } 188 va_end(ap); 189 190 dev->broken = true; 191 dev->panic(dev, buf); 192 free(buf); 193 194 /* 195 * FIXME: 196 * find a way to call virtio_error, or perhaps close the connection? 197 */ 198 } 199 200 /* Search for a memory region that covers this guest physical address. */ 201 static VuDevRegion * 202 vu_gpa_to_mem_region(VuDev *dev, uint64_t guest_addr) 203 { 204 int low = 0; 205 int high = dev->nregions - 1; 206 207 /* 208 * Memory regions cannot overlap in guest physical address space. Each 209 * GPA belongs to exactly one memory region, so there can only be one 210 * match. 211 * 212 * We store our memory regions ordered by GPA and can simply perform a 213 * binary search. 214 */ 215 while (low <= high) { 216 unsigned int mid = low + (high - low) / 2; 217 VuDevRegion *cur = &dev->regions[mid]; 218 219 if (guest_addr >= cur->gpa && guest_addr < cur->gpa + cur->size) { 220 return cur; 221 } 222 if (guest_addr >= cur->gpa + cur->size) { 223 low = mid + 1; 224 } 225 if (guest_addr < cur->gpa) { 226 high = mid - 1; 227 } 228 } 229 return NULL; 230 } 231 232 /* Translate guest physical address to our virtual address. */ 233 void * 234 vu_gpa_to_va(VuDev *dev, uint64_t *plen, uint64_t guest_addr) 235 { 236 VuDevRegion *r; 237 238 if (*plen == 0) { 239 return NULL; 240 } 241 242 r = vu_gpa_to_mem_region(dev, guest_addr); 243 if (!r) { 244 return NULL; 245 } 246 247 if ((guest_addr + *plen) > (r->gpa + r->size)) { 248 *plen = r->gpa + r->size - guest_addr; 249 } 250 return (void *)(uintptr_t)guest_addr - r->gpa + r->mmap_addr + 251 r->mmap_offset; 252 } 253 254 /* Translate qemu virtual address to our virtual address. */ 255 static void * 256 qva_to_va(VuDev *dev, uint64_t qemu_addr) 257 { 258 unsigned int i; 259 260 /* Find matching memory region. */ 261 for (i = 0; i < dev->nregions; i++) { 262 VuDevRegion *r = &dev->regions[i]; 263 264 if ((qemu_addr >= r->qva) && (qemu_addr < (r->qva + r->size))) { 265 return (void *)(uintptr_t) 266 qemu_addr - r->qva + r->mmap_addr + r->mmap_offset; 267 } 268 } 269 270 return NULL; 271 } 272 273 static void 274 vu_remove_all_mem_regs(VuDev *dev) 275 { 276 unsigned int i; 277 278 for (i = 0; i < dev->nregions; i++) { 279 VuDevRegion *r = &dev->regions[i]; 280 281 munmap((void *)(uintptr_t)r->mmap_addr, r->size + r->mmap_offset); 282 } 283 dev->nregions = 0; 284 } 285 286 static bool 287 map_ring(VuDev *dev, VuVirtq *vq) 288 { 289 vq->vring.desc = qva_to_va(dev, vq->vra.desc_user_addr); 290 vq->vring.used = qva_to_va(dev, vq->vra.used_user_addr); 291 vq->vring.avail = qva_to_va(dev, vq->vra.avail_user_addr); 292 293 DPRINT("Setting virtq addresses:\n"); 294 DPRINT(" vring_desc at %p\n", vq->vring.desc); 295 DPRINT(" vring_used at %p\n", vq->vring.used); 296 DPRINT(" vring_avail at %p\n", vq->vring.avail); 297 298 return !(vq->vring.desc && vq->vring.used && vq->vring.avail); 299 } 300 301 static bool 302 vu_is_vq_usable(VuDev *dev, VuVirtq *vq) 303 { 304 if (unlikely(dev->broken)) { 305 return false; 306 } 307 308 if (likely(vq->vring.avail)) { 309 return true; 310 } 311 312 /* 313 * In corner cases, we might temporarily remove a memory region that 314 * mapped a ring. When removing a memory region we make sure to 315 * unmap any rings that would be impacted. Let's try to remap if we 316 * already succeeded mapping this ring once. 317 */ 318 if (!vq->vra.desc_user_addr || !vq->vra.used_user_addr || 319 !vq->vra.avail_user_addr) { 320 return false; 321 } 322 if (map_ring(dev, vq)) { 323 vu_panic(dev, "remapping queue on access"); 324 return false; 325 } 326 return true; 327 } 328 329 static void 330 unmap_rings(VuDev *dev, VuDevRegion *r) 331 { 332 int i; 333 334 for (i = 0; i < dev->max_queues; i++) { 335 VuVirtq *vq = &dev->vq[i]; 336 const uintptr_t desc = (uintptr_t)vq->vring.desc; 337 const uintptr_t used = (uintptr_t)vq->vring.used; 338 const uintptr_t avail = (uintptr_t)vq->vring.avail; 339 340 if (desc < r->mmap_addr || desc >= r->mmap_addr + r->size) { 341 continue; 342 } 343 if (used < r->mmap_addr || used >= r->mmap_addr + r->size) { 344 continue; 345 } 346 if (avail < r->mmap_addr || avail >= r->mmap_addr + r->size) { 347 continue; 348 } 349 350 DPRINT("Unmapping rings of queue %d\n", i); 351 vq->vring.desc = NULL; 352 vq->vring.used = NULL; 353 vq->vring.avail = NULL; 354 } 355 } 356 357 static size_t 358 get_fd_hugepagesize(int fd) 359 { 360 #if defined(__linux__) 361 struct statfs fs; 362 int ret; 363 364 do { 365 ret = fstatfs(fd, &fs); 366 } while (ret != 0 && errno == EINTR); 367 368 if (!ret && (unsigned int)fs.f_type == HUGETLBFS_MAGIC) { 369 return fs.f_bsize; 370 } 371 #endif 372 return 0; 373 } 374 375 static void 376 _vu_add_mem_reg(VuDev *dev, VhostUserMemoryRegion *msg_region, int fd) 377 { 378 const uint64_t start_gpa = msg_region->guest_phys_addr; 379 const uint64_t end_gpa = start_gpa + msg_region->memory_size; 380 int prot = PROT_READ | PROT_WRITE; 381 uint64_t mmap_offset, fd_offset; 382 size_t hugepagesize; 383 VuDevRegion *r; 384 void *mmap_addr; 385 int low = 0; 386 int high = dev->nregions - 1; 387 unsigned int idx; 388 389 DPRINT("Adding region %d\n", dev->nregions); 390 DPRINT(" guest_phys_addr: 0x%016"PRIx64"\n", 391 msg_region->guest_phys_addr); 392 DPRINT(" memory_size: 0x%016"PRIx64"\n", 393 msg_region->memory_size); 394 DPRINT(" userspace_addr: 0x%016"PRIx64"\n", 395 msg_region->userspace_addr); 396 DPRINT(" old mmap_offset: 0x%016"PRIx64"\n", 397 msg_region->mmap_offset); 398 399 if (dev->postcopy_listening) { 400 /* 401 * In postcopy we're using PROT_NONE here to catch anyone 402 * accessing it before we userfault 403 */ 404 prot = PROT_NONE; 405 } 406 407 /* 408 * We will add memory regions into the array sorted by GPA. Perform a 409 * binary search to locate the insertion point: it will be at the low 410 * index. 411 */ 412 while (low <= high) { 413 unsigned int mid = low + (high - low) / 2; 414 VuDevRegion *cur = &dev->regions[mid]; 415 416 /* Overlap of GPA addresses. */ 417 if (start_gpa < cur->gpa + cur->size && cur->gpa < end_gpa) { 418 vu_panic(dev, "regions with overlapping guest physical addresses"); 419 return; 420 } 421 if (start_gpa >= cur->gpa + cur->size) { 422 low = mid + 1; 423 } 424 if (start_gpa < cur->gpa) { 425 high = mid - 1; 426 } 427 } 428 idx = low; 429 430 /* 431 * Convert most of msg_region->mmap_offset to fd_offset. In almost all 432 * cases, this will leave us with mmap_offset == 0, mmap()'ing only 433 * what we really need. Only if a memory region would partially cover 434 * hugetlb pages, we'd get mmap_offset != 0, which usually doesn't happen 435 * anymore (i.e., modern QEMU). 436 * 437 * Note that mmap() with hugetlb would fail if the offset into the file 438 * is not aligned to the huge page size. 439 */ 440 hugepagesize = get_fd_hugepagesize(fd); 441 if (hugepagesize) { 442 fd_offset = ALIGN_DOWN(msg_region->mmap_offset, hugepagesize); 443 mmap_offset = msg_region->mmap_offset - fd_offset; 444 } else { 445 fd_offset = msg_region->mmap_offset; 446 mmap_offset = 0; 447 } 448 449 DPRINT(" fd_offset: 0x%016"PRIx64"\n", 450 fd_offset); 451 DPRINT(" new mmap_offset: 0x%016"PRIx64"\n", 452 mmap_offset); 453 454 mmap_addr = mmap(0, msg_region->memory_size + mmap_offset, 455 prot, MAP_SHARED | MAP_NORESERVE, fd, fd_offset); 456 if (mmap_addr == MAP_FAILED) { 457 vu_panic(dev, "region mmap error: %s", strerror(errno)); 458 return; 459 } 460 DPRINT(" mmap_addr: 0x%016"PRIx64"\n", 461 (uint64_t)(uintptr_t)mmap_addr); 462 463 #if defined(__linux__) 464 /* Don't include all guest memory in a coredump. */ 465 madvise(mmap_addr, msg_region->memory_size + mmap_offset, 466 MADV_DONTDUMP); 467 #endif 468 469 /* Shift all affected entries by 1 to open a hole at idx. */ 470 r = &dev->regions[idx]; 471 memmove(r + 1, r, sizeof(VuDevRegion) * (dev->nregions - idx)); 472 r->gpa = msg_region->guest_phys_addr; 473 r->size = msg_region->memory_size; 474 r->qva = msg_region->userspace_addr; 475 r->mmap_addr = (uint64_t)(uintptr_t)mmap_addr; 476 r->mmap_offset = mmap_offset; 477 dev->nregions++; 478 479 if (dev->postcopy_listening) { 480 /* 481 * Return the address to QEMU so that it can translate the ufd 482 * fault addresses back. 483 */ 484 msg_region->userspace_addr = r->mmap_addr + r->mmap_offset; 485 } 486 } 487 488 static void 489 vmsg_close_fds(VhostUserMsg *vmsg) 490 { 491 int i; 492 493 for (i = 0; i < vmsg->fd_num; i++) { 494 close(vmsg->fds[i]); 495 } 496 } 497 498 /* Set reply payload.u64 and clear request flags and fd_num */ 499 static void vmsg_set_reply_u64(VhostUserMsg *vmsg, uint64_t val) 500 { 501 vmsg->flags = 0; /* defaults will be set by vu_send_reply() */ 502 vmsg->size = sizeof(vmsg->payload.u64); 503 vmsg->payload.u64 = val; 504 vmsg->fd_num = 0; 505 } 506 507 /* A test to see if we have userfault available */ 508 static bool 509 have_userfault(void) 510 { 511 #if defined(__linux__) && defined(__NR_userfaultfd) &&\ 512 defined(UFFD_FEATURE_MISSING_SHMEM) &&\ 513 defined(UFFD_FEATURE_MISSING_HUGETLBFS) 514 /* Now test the kernel we're running on really has the features */ 515 int ufd = syscall(__NR_userfaultfd, O_CLOEXEC | O_NONBLOCK); 516 struct uffdio_api api_struct; 517 if (ufd < 0) { 518 return false; 519 } 520 521 api_struct.api = UFFD_API; 522 api_struct.features = UFFD_FEATURE_MISSING_SHMEM | 523 UFFD_FEATURE_MISSING_HUGETLBFS; 524 if (ioctl(ufd, UFFDIO_API, &api_struct)) { 525 close(ufd); 526 return false; 527 } 528 close(ufd); 529 return true; 530 531 #else 532 return false; 533 #endif 534 } 535 536 static bool 537 vu_message_read_default(VuDev *dev, int conn_fd, VhostUserMsg *vmsg) 538 { 539 char control[CMSG_SPACE(VHOST_MEMORY_BASELINE_NREGIONS * sizeof(int))] = {}; 540 struct iovec iov = { 541 .iov_base = (char *)vmsg, 542 .iov_len = VHOST_USER_HDR_SIZE, 543 }; 544 struct msghdr msg = { 545 .msg_iov = &iov, 546 .msg_iovlen = 1, 547 .msg_control = control, 548 .msg_controllen = sizeof(control), 549 }; 550 size_t fd_size; 551 struct cmsghdr *cmsg; 552 int rc; 553 554 do { 555 rc = recvmsg(conn_fd, &msg, 0); 556 } while (rc < 0 && (errno == EINTR || errno == EAGAIN)); 557 558 if (rc < 0) { 559 vu_panic(dev, "Error while recvmsg: %s", strerror(errno)); 560 return false; 561 } 562 563 vmsg->fd_num = 0; 564 for (cmsg = CMSG_FIRSTHDR(&msg); 565 cmsg != NULL; 566 cmsg = CMSG_NXTHDR(&msg, cmsg)) 567 { 568 if (cmsg->cmsg_level == SOL_SOCKET && cmsg->cmsg_type == SCM_RIGHTS) { 569 fd_size = cmsg->cmsg_len - CMSG_LEN(0); 570 vmsg->fd_num = fd_size / sizeof(int); 571 assert(vmsg->fd_num <= VHOST_MEMORY_BASELINE_NREGIONS); 572 memcpy(vmsg->fds, CMSG_DATA(cmsg), fd_size); 573 break; 574 } 575 } 576 577 if (vmsg->size > sizeof(vmsg->payload)) { 578 vu_panic(dev, 579 "Error: too big message request: %d, size: vmsg->size: %u, " 580 "while sizeof(vmsg->payload) = %zu\n", 581 vmsg->request, vmsg->size, sizeof(vmsg->payload)); 582 goto fail; 583 } 584 585 if (vmsg->size) { 586 do { 587 rc = read(conn_fd, &vmsg->payload, vmsg->size); 588 } while (rc < 0 && (errno == EINTR || errno == EAGAIN)); 589 590 if (rc <= 0) { 591 vu_panic(dev, "Error while reading: %s", strerror(errno)); 592 goto fail; 593 } 594 595 assert((uint32_t)rc == vmsg->size); 596 } 597 598 return true; 599 600 fail: 601 vmsg_close_fds(vmsg); 602 603 return false; 604 } 605 606 static bool 607 vu_message_write(VuDev *dev, int conn_fd, VhostUserMsg *vmsg) 608 { 609 int rc; 610 uint8_t *p = (uint8_t *)vmsg; 611 char control[CMSG_SPACE(VHOST_MEMORY_BASELINE_NREGIONS * sizeof(int))] = {}; 612 struct iovec iov = { 613 .iov_base = (char *)vmsg, 614 .iov_len = VHOST_USER_HDR_SIZE, 615 }; 616 struct msghdr msg = { 617 .msg_iov = &iov, 618 .msg_iovlen = 1, 619 .msg_control = control, 620 }; 621 struct cmsghdr *cmsg; 622 623 memset(control, 0, sizeof(control)); 624 assert(vmsg->fd_num <= VHOST_MEMORY_BASELINE_NREGIONS); 625 if (vmsg->fd_num > 0) { 626 size_t fdsize = vmsg->fd_num * sizeof(int); 627 msg.msg_controllen = CMSG_SPACE(fdsize); 628 cmsg = CMSG_FIRSTHDR(&msg); 629 cmsg->cmsg_len = CMSG_LEN(fdsize); 630 cmsg->cmsg_level = SOL_SOCKET; 631 cmsg->cmsg_type = SCM_RIGHTS; 632 memcpy(CMSG_DATA(cmsg), vmsg->fds, fdsize); 633 } else { 634 msg.msg_controllen = 0; 635 msg.msg_control = NULL; 636 } 637 638 do { 639 rc = sendmsg(conn_fd, &msg, 0); 640 } while (rc < 0 && (errno == EINTR || errno == EAGAIN)); 641 642 if (vmsg->size) { 643 do { 644 if (vmsg->data) { 645 rc = write(conn_fd, vmsg->data, vmsg->size); 646 } else { 647 rc = write(conn_fd, p + VHOST_USER_HDR_SIZE, vmsg->size); 648 } 649 } while (rc < 0 && (errno == EINTR || errno == EAGAIN)); 650 } 651 652 if (rc <= 0) { 653 vu_panic(dev, "Error while writing: %s", strerror(errno)); 654 return false; 655 } 656 657 return true; 658 } 659 660 static bool 661 vu_send_reply(VuDev *dev, int conn_fd, VhostUserMsg *vmsg) 662 { 663 /* Set the version in the flags when sending the reply */ 664 vmsg->flags &= ~VHOST_USER_VERSION_MASK; 665 vmsg->flags |= VHOST_USER_VERSION; 666 vmsg->flags |= VHOST_USER_REPLY_MASK; 667 668 return vu_message_write(dev, conn_fd, vmsg); 669 } 670 671 /* 672 * Processes a reply on the backend channel. 673 * Entered with backend_mutex held and releases it before exit. 674 * Returns true on success. 675 */ 676 static bool 677 vu_process_message_reply(VuDev *dev, const VhostUserMsg *vmsg) 678 { 679 VhostUserMsg msg_reply; 680 bool result = false; 681 682 if ((vmsg->flags & VHOST_USER_NEED_REPLY_MASK) == 0) { 683 result = true; 684 goto out; 685 } 686 687 if (!vu_message_read_default(dev, dev->backend_fd, &msg_reply)) { 688 goto out; 689 } 690 691 if (msg_reply.request != vmsg->request) { 692 DPRINT("Received unexpected msg type. Expected %d received %d", 693 vmsg->request, msg_reply.request); 694 goto out; 695 } 696 697 result = msg_reply.payload.u64 == 0; 698 699 out: 700 pthread_mutex_unlock(&dev->backend_mutex); 701 return result; 702 } 703 704 /* Kick the log_call_fd if required. */ 705 static void 706 vu_log_kick(VuDev *dev) 707 { 708 if (dev->log_call_fd != -1) { 709 DPRINT("Kicking the QEMU's log...\n"); 710 if (eventfd_write(dev->log_call_fd, 1) < 0) { 711 vu_panic(dev, "Error writing eventfd: %s", strerror(errno)); 712 } 713 } 714 } 715 716 static void 717 vu_log_page(uint8_t *log_table, uint64_t page) 718 { 719 DPRINT("Logged dirty guest page: %"PRId64"\n", page); 720 qatomic_or(&log_table[page / 8], 1 << (page % 8)); 721 } 722 723 static void 724 vu_log_write(VuDev *dev, uint64_t address, uint64_t length) 725 { 726 uint64_t page; 727 728 if (!(dev->features & (1ULL << VHOST_F_LOG_ALL)) || 729 !dev->log_table || !length) { 730 return; 731 } 732 733 assert(dev->log_size > ((address + length - 1) / VHOST_LOG_PAGE / 8)); 734 735 page = address / VHOST_LOG_PAGE; 736 while (page * VHOST_LOG_PAGE < address + length) { 737 vu_log_page(dev->log_table, page); 738 page += 1; 739 } 740 741 vu_log_kick(dev); 742 } 743 744 static void 745 vu_kick_cb(VuDev *dev, int condition, void *data) 746 { 747 int index = (intptr_t)data; 748 VuVirtq *vq = &dev->vq[index]; 749 int sock = vq->kick_fd; 750 eventfd_t kick_data; 751 ssize_t rc; 752 753 rc = eventfd_read(sock, &kick_data); 754 if (rc == -1) { 755 vu_panic(dev, "kick eventfd_read(): %s", strerror(errno)); 756 dev->remove_watch(dev, dev->vq[index].kick_fd); 757 } else { 758 DPRINT("Got kick_data: %016"PRIx64" handler:%p idx:%d\n", 759 kick_data, vq->handler, index); 760 if (vq->handler) { 761 vq->handler(dev, index); 762 } 763 } 764 } 765 766 static bool 767 vu_get_features_exec(VuDev *dev, VhostUserMsg *vmsg) 768 { 769 vmsg->payload.u64 = 770 /* 771 * The following VIRTIO feature bits are supported by our virtqueue 772 * implementation: 773 */ 774 1ULL << VIRTIO_F_NOTIFY_ON_EMPTY | 775 1ULL << VIRTIO_RING_F_INDIRECT_DESC | 776 1ULL << VIRTIO_RING_F_EVENT_IDX | 777 1ULL << VIRTIO_F_VERSION_1 | 778 779 /* vhost-user feature bits */ 780 1ULL << VHOST_F_LOG_ALL | 781 1ULL << VHOST_USER_F_PROTOCOL_FEATURES; 782 783 if (dev->iface->get_features) { 784 vmsg->payload.u64 |= dev->iface->get_features(dev); 785 } 786 787 vmsg->size = sizeof(vmsg->payload.u64); 788 vmsg->fd_num = 0; 789 790 DPRINT("Sending back to guest u64: 0x%016"PRIx64"\n", vmsg->payload.u64); 791 792 return true; 793 } 794 795 static void 796 vu_set_enable_all_rings(VuDev *dev, bool enabled) 797 { 798 uint16_t i; 799 800 for (i = 0; i < dev->max_queues; i++) { 801 dev->vq[i].enable = enabled; 802 } 803 } 804 805 static bool 806 vu_set_features_exec(VuDev *dev, VhostUserMsg *vmsg) 807 { 808 DPRINT("u64: 0x%016"PRIx64"\n", vmsg->payload.u64); 809 810 dev->features = vmsg->payload.u64; 811 if (!vu_has_feature(dev, VIRTIO_F_VERSION_1)) { 812 /* 813 * We only support devices conforming to VIRTIO 1.0 or 814 * later 815 */ 816 vu_panic(dev, "virtio legacy devices aren't supported by libvhost-user"); 817 return false; 818 } 819 820 if (!(dev->features & VHOST_USER_F_PROTOCOL_FEATURES)) { 821 vu_set_enable_all_rings(dev, true); 822 } 823 824 if (dev->iface->set_features) { 825 dev->iface->set_features(dev, dev->features); 826 } 827 828 return false; 829 } 830 831 static bool 832 vu_set_owner_exec(VuDev *dev, VhostUserMsg *vmsg) 833 { 834 return false; 835 } 836 837 static void 838 vu_close_log(VuDev *dev) 839 { 840 if (dev->log_table) { 841 if (munmap(dev->log_table, dev->log_size) != 0) { 842 perror("close log munmap() error"); 843 } 844 845 dev->log_table = NULL; 846 } 847 if (dev->log_call_fd != -1) { 848 close(dev->log_call_fd); 849 dev->log_call_fd = -1; 850 } 851 } 852 853 static bool 854 vu_reset_device_exec(VuDev *dev, VhostUserMsg *vmsg) 855 { 856 vu_set_enable_all_rings(dev, false); 857 858 return false; 859 } 860 861 static bool 862 generate_faults(VuDev *dev) { 863 unsigned int i; 864 for (i = 0; i < dev->nregions; i++) { 865 #ifdef UFFDIO_REGISTER 866 VuDevRegion *dev_region = &dev->regions[i]; 867 int ret; 868 struct uffdio_register reg_struct; 869 870 /* 871 * We should already have an open ufd. Mark each memory 872 * range as ufd. 873 * Discard any mapping we have here; note I can't use MADV_REMOVE 874 * or fallocate to make the hole since I don't want to lose 875 * data that's already arrived in the shared process. 876 * TODO: How to do hugepage 877 */ 878 ret = madvise((void *)(uintptr_t)dev_region->mmap_addr, 879 dev_region->size + dev_region->mmap_offset, 880 MADV_DONTNEED); 881 if (ret) { 882 fprintf(stderr, 883 "%s: Failed to madvise(DONTNEED) region %d: %s\n", 884 __func__, i, strerror(errno)); 885 } 886 /* 887 * Turn off transparent hugepages so we dont get lose wakeups 888 * in neighbouring pages. 889 * TODO: Turn this backon later. 890 */ 891 ret = madvise((void *)(uintptr_t)dev_region->mmap_addr, 892 dev_region->size + dev_region->mmap_offset, 893 MADV_NOHUGEPAGE); 894 if (ret) { 895 /* 896 * Note: This can happen legally on kernels that are configured 897 * without madvise'able hugepages 898 */ 899 fprintf(stderr, 900 "%s: Failed to madvise(NOHUGEPAGE) region %d: %s\n", 901 __func__, i, strerror(errno)); 902 } 903 904 reg_struct.range.start = (uintptr_t)dev_region->mmap_addr; 905 reg_struct.range.len = dev_region->size + dev_region->mmap_offset; 906 reg_struct.mode = UFFDIO_REGISTER_MODE_MISSING; 907 908 if (ioctl(dev->postcopy_ufd, UFFDIO_REGISTER, ®_struct)) { 909 vu_panic(dev, "%s: Failed to userfault region %d " 910 "@%" PRIx64 " + size:%" PRIx64 " offset: %" PRIx64 911 ": (ufd=%d)%s\n", 912 __func__, i, 913 dev_region->mmap_addr, 914 dev_region->size, dev_region->mmap_offset, 915 dev->postcopy_ufd, strerror(errno)); 916 return false; 917 } 918 if (!(reg_struct.ioctls & (1ULL << _UFFDIO_COPY))) { 919 vu_panic(dev, "%s Region (%d) doesn't support COPY", 920 __func__, i); 921 return false; 922 } 923 DPRINT("%s: region %d: Registered userfault for %" 924 PRIx64 " + %" PRIx64 "\n", __func__, i, 925 (uint64_t)reg_struct.range.start, 926 (uint64_t)reg_struct.range.len); 927 /* Now it's registered we can let the client at it */ 928 if (mprotect((void *)(uintptr_t)dev_region->mmap_addr, 929 dev_region->size + dev_region->mmap_offset, 930 PROT_READ | PROT_WRITE)) { 931 vu_panic(dev, "failed to mprotect region %d for postcopy (%s)", 932 i, strerror(errno)); 933 return false; 934 } 935 /* TODO: Stash 'zero' support flags somewhere */ 936 #endif 937 } 938 939 return true; 940 } 941 942 static bool 943 vu_add_mem_reg(VuDev *dev, VhostUserMsg *vmsg) { 944 VhostUserMemoryRegion m = vmsg->payload.memreg.region, *msg_region = &m; 945 946 if (vmsg->fd_num != 1) { 947 vmsg_close_fds(vmsg); 948 vu_panic(dev, "VHOST_USER_ADD_MEM_REG received %d fds - only 1 fd " 949 "should be sent for this message type", vmsg->fd_num); 950 return false; 951 } 952 953 if (vmsg->size < VHOST_USER_MEM_REG_SIZE) { 954 close(vmsg->fds[0]); 955 vu_panic(dev, "VHOST_USER_ADD_MEM_REG requires a message size of at " 956 "least %zu bytes and only %d bytes were received", 957 VHOST_USER_MEM_REG_SIZE, vmsg->size); 958 return false; 959 } 960 961 if (dev->nregions == VHOST_USER_MAX_RAM_SLOTS) { 962 close(vmsg->fds[0]); 963 vu_panic(dev, "failing attempt to hot add memory via " 964 "VHOST_USER_ADD_MEM_REG message because the backend has " 965 "no free ram slots available"); 966 return false; 967 } 968 969 /* 970 * If we are in postcopy mode and we receive a u64 payload with a 0 value 971 * we know all the postcopy client bases have been received, and we 972 * should start generating faults. 973 */ 974 if (dev->postcopy_listening && 975 vmsg->size == sizeof(vmsg->payload.u64) && 976 vmsg->payload.u64 == 0) { 977 (void)generate_faults(dev); 978 return false; 979 } 980 981 _vu_add_mem_reg(dev, msg_region, vmsg->fds[0]); 982 close(vmsg->fds[0]); 983 984 if (dev->postcopy_listening) { 985 /* Send the message back to qemu with the addresses filled in. */ 986 vmsg->fd_num = 0; 987 DPRINT("Successfully added new region in postcopy\n"); 988 return true; 989 } 990 DPRINT("Successfully added new region\n"); 991 return false; 992 } 993 994 static inline bool reg_equal(VuDevRegion *vudev_reg, 995 VhostUserMemoryRegion *msg_reg) 996 { 997 if (vudev_reg->gpa == msg_reg->guest_phys_addr && 998 vudev_reg->qva == msg_reg->userspace_addr && 999 vudev_reg->size == msg_reg->memory_size) { 1000 return true; 1001 } 1002 1003 return false; 1004 } 1005 1006 static bool 1007 vu_rem_mem_reg(VuDev *dev, VhostUserMsg *vmsg) { 1008 VhostUserMemoryRegion m = vmsg->payload.memreg.region, *msg_region = &m; 1009 unsigned int idx; 1010 VuDevRegion *r; 1011 1012 if (vmsg->fd_num > 1) { 1013 vmsg_close_fds(vmsg); 1014 vu_panic(dev, "VHOST_USER_REM_MEM_REG received %d fds - at most 1 fd " 1015 "should be sent for this message type", vmsg->fd_num); 1016 return false; 1017 } 1018 1019 if (vmsg->size < VHOST_USER_MEM_REG_SIZE) { 1020 vmsg_close_fds(vmsg); 1021 vu_panic(dev, "VHOST_USER_REM_MEM_REG requires a message size of at " 1022 "least %zu bytes and only %d bytes were received", 1023 VHOST_USER_MEM_REG_SIZE, vmsg->size); 1024 return false; 1025 } 1026 1027 DPRINT("Removing region:\n"); 1028 DPRINT(" guest_phys_addr: 0x%016"PRIx64"\n", 1029 msg_region->guest_phys_addr); 1030 DPRINT(" memory_size: 0x%016"PRIx64"\n", 1031 msg_region->memory_size); 1032 DPRINT(" userspace_addr 0x%016"PRIx64"\n", 1033 msg_region->userspace_addr); 1034 DPRINT(" mmap_offset 0x%016"PRIx64"\n", 1035 msg_region->mmap_offset); 1036 1037 r = vu_gpa_to_mem_region(dev, msg_region->guest_phys_addr); 1038 if (!r || !reg_equal(r, msg_region)) { 1039 vmsg_close_fds(vmsg); 1040 vu_panic(dev, "Specified region not found\n"); 1041 return false; 1042 } 1043 1044 /* 1045 * There might be valid cases where we temporarily remove memory regions 1046 * to readd them again, or remove memory regions and don't use the rings 1047 * anymore before we set the ring addresses and restart the device. 1048 * 1049 * Unmap all affected rings, remapping them on demand later. This should 1050 * be a corner case. 1051 */ 1052 unmap_rings(dev, r); 1053 1054 munmap((void *)(uintptr_t)r->mmap_addr, r->size + r->mmap_offset); 1055 1056 idx = r - dev->regions; 1057 assert(idx < dev->nregions); 1058 /* Shift all affected entries by 1 to close the hole. */ 1059 memmove(r, r + 1, sizeof(VuDevRegion) * (dev->nregions - idx - 1)); 1060 DPRINT("Successfully removed a region\n"); 1061 dev->nregions--; 1062 1063 vmsg_close_fds(vmsg); 1064 1065 return false; 1066 } 1067 1068 static bool 1069 vu_get_shared_object(VuDev *dev, VhostUserMsg *vmsg) 1070 { 1071 int fd_num = 0; 1072 int dmabuf_fd = -1; 1073 if (dev->iface->get_shared_object) { 1074 dmabuf_fd = dev->iface->get_shared_object( 1075 dev, &vmsg->payload.object.uuid[0]); 1076 } 1077 if (dmabuf_fd != -1) { 1078 DPRINT("dmabuf_fd found for requested UUID\n"); 1079 vmsg->fds[fd_num++] = dmabuf_fd; 1080 } 1081 vmsg->fd_num = fd_num; 1082 1083 return true; 1084 } 1085 1086 static bool 1087 vu_set_mem_table_exec(VuDev *dev, VhostUserMsg *vmsg) 1088 { 1089 VhostUserMemory m = vmsg->payload.memory, *memory = &m; 1090 unsigned int i; 1091 1092 vu_remove_all_mem_regs(dev); 1093 1094 DPRINT("Nregions: %u\n", memory->nregions); 1095 for (i = 0; i < memory->nregions; i++) { 1096 _vu_add_mem_reg(dev, &memory->regions[i], vmsg->fds[i]); 1097 close(vmsg->fds[i]); 1098 } 1099 1100 if (dev->postcopy_listening) { 1101 /* Send the message back to qemu with the addresses filled in */ 1102 vmsg->fd_num = 0; 1103 if (!vu_send_reply(dev, dev->sock, vmsg)) { 1104 vu_panic(dev, "failed to respond to set-mem-table for postcopy"); 1105 return false; 1106 } 1107 1108 /* 1109 * Wait for QEMU to confirm that it's registered the handler for the 1110 * faults. 1111 */ 1112 if (!dev->read_msg(dev, dev->sock, vmsg) || 1113 vmsg->size != sizeof(vmsg->payload.u64) || 1114 vmsg->payload.u64 != 0) { 1115 vu_panic(dev, "failed to receive valid ack for postcopy set-mem-table"); 1116 return false; 1117 } 1118 1119 /* OK, now we can go and register the memory and generate faults */ 1120 (void)generate_faults(dev); 1121 return false; 1122 } 1123 1124 for (i = 0; i < dev->max_queues; i++) { 1125 if (dev->vq[i].vring.desc) { 1126 if (map_ring(dev, &dev->vq[i])) { 1127 vu_panic(dev, "remapping queue %d during setmemtable", i); 1128 } 1129 } 1130 } 1131 1132 return false; 1133 } 1134 1135 static bool 1136 vu_set_log_base_exec(VuDev *dev, VhostUserMsg *vmsg) 1137 { 1138 int fd; 1139 uint64_t log_mmap_size, log_mmap_offset; 1140 void *rc; 1141 1142 if (vmsg->fd_num != 1 || 1143 vmsg->size != sizeof(vmsg->payload.log)) { 1144 vu_panic(dev, "Invalid log_base message"); 1145 return true; 1146 } 1147 1148 fd = vmsg->fds[0]; 1149 log_mmap_offset = vmsg->payload.log.mmap_offset; 1150 log_mmap_size = vmsg->payload.log.mmap_size; 1151 DPRINT("Log mmap_offset: %"PRId64"\n", log_mmap_offset); 1152 DPRINT("Log mmap_size: %"PRId64"\n", log_mmap_size); 1153 1154 rc = mmap(0, log_mmap_size, PROT_READ | PROT_WRITE, MAP_SHARED, fd, 1155 log_mmap_offset); 1156 close(fd); 1157 if (rc == MAP_FAILED) { 1158 perror("log mmap error"); 1159 } 1160 1161 if (dev->log_table) { 1162 munmap(dev->log_table, dev->log_size); 1163 } 1164 dev->log_table = rc; 1165 dev->log_size = log_mmap_size; 1166 1167 vmsg->size = sizeof(vmsg->payload.u64); 1168 vmsg->fd_num = 0; 1169 1170 return true; 1171 } 1172 1173 static bool 1174 vu_set_log_fd_exec(VuDev *dev, VhostUserMsg *vmsg) 1175 { 1176 if (vmsg->fd_num != 1) { 1177 vu_panic(dev, "Invalid log_fd message"); 1178 return false; 1179 } 1180 1181 if (dev->log_call_fd != -1) { 1182 close(dev->log_call_fd); 1183 } 1184 dev->log_call_fd = vmsg->fds[0]; 1185 DPRINT("Got log_call_fd: %d\n", vmsg->fds[0]); 1186 1187 return false; 1188 } 1189 1190 static bool 1191 vu_set_vring_num_exec(VuDev *dev, VhostUserMsg *vmsg) 1192 { 1193 unsigned int index = vmsg->payload.state.index; 1194 unsigned int num = vmsg->payload.state.num; 1195 1196 DPRINT("State.index: %u\n", index); 1197 DPRINT("State.num: %u\n", num); 1198 dev->vq[index].vring.num = num; 1199 1200 return false; 1201 } 1202 1203 static bool 1204 vu_set_vring_addr_exec(VuDev *dev, VhostUserMsg *vmsg) 1205 { 1206 struct vhost_vring_addr addr = vmsg->payload.addr, *vra = &addr; 1207 unsigned int index = vra->index; 1208 VuVirtq *vq = &dev->vq[index]; 1209 1210 DPRINT("vhost_vring_addr:\n"); 1211 DPRINT(" index: %d\n", vra->index); 1212 DPRINT(" flags: %d\n", vra->flags); 1213 DPRINT(" desc_user_addr: 0x%016" PRIx64 "\n", (uint64_t)vra->desc_user_addr); 1214 DPRINT(" used_user_addr: 0x%016" PRIx64 "\n", (uint64_t)vra->used_user_addr); 1215 DPRINT(" avail_user_addr: 0x%016" PRIx64 "\n", (uint64_t)vra->avail_user_addr); 1216 DPRINT(" log_guest_addr: 0x%016" PRIx64 "\n", (uint64_t)vra->log_guest_addr); 1217 1218 vq->vra = *vra; 1219 vq->vring.flags = vra->flags; 1220 vq->vring.log_guest_addr = vra->log_guest_addr; 1221 1222 1223 if (map_ring(dev, vq)) { 1224 vu_panic(dev, "Invalid vring_addr message"); 1225 return false; 1226 } 1227 1228 vq->used_idx = le16toh(vq->vring.used->idx); 1229 1230 if (vq->last_avail_idx != vq->used_idx) { 1231 bool resume = dev->iface->queue_is_processed_in_order && 1232 dev->iface->queue_is_processed_in_order(dev, index); 1233 1234 DPRINT("Last avail index != used index: %u != %u%s\n", 1235 vq->last_avail_idx, vq->used_idx, 1236 resume ? ", resuming" : ""); 1237 1238 if (resume) { 1239 vq->shadow_avail_idx = vq->last_avail_idx = vq->used_idx; 1240 } 1241 } 1242 1243 return false; 1244 } 1245 1246 static bool 1247 vu_set_vring_base_exec(VuDev *dev, VhostUserMsg *vmsg) 1248 { 1249 unsigned int index = vmsg->payload.state.index; 1250 unsigned int num = vmsg->payload.state.num; 1251 1252 DPRINT("State.index: %u\n", index); 1253 DPRINT("State.num: %u\n", num); 1254 dev->vq[index].shadow_avail_idx = dev->vq[index].last_avail_idx = num; 1255 1256 return false; 1257 } 1258 1259 static bool 1260 vu_get_vring_base_exec(VuDev *dev, VhostUserMsg *vmsg) 1261 { 1262 unsigned int index = vmsg->payload.state.index; 1263 1264 DPRINT("State.index: %u\n", index); 1265 vmsg->payload.state.num = dev->vq[index].last_avail_idx; 1266 vmsg->size = sizeof(vmsg->payload.state); 1267 1268 dev->vq[index].started = false; 1269 if (dev->iface->queue_set_started) { 1270 dev->iface->queue_set_started(dev, index, false); 1271 } 1272 1273 if (dev->vq[index].call_fd != -1) { 1274 close(dev->vq[index].call_fd); 1275 dev->vq[index].call_fd = -1; 1276 } 1277 if (dev->vq[index].kick_fd != -1) { 1278 dev->remove_watch(dev, dev->vq[index].kick_fd); 1279 close(dev->vq[index].kick_fd); 1280 dev->vq[index].kick_fd = -1; 1281 } 1282 1283 return true; 1284 } 1285 1286 static bool 1287 vu_check_queue_msg_file(VuDev *dev, VhostUserMsg *vmsg) 1288 { 1289 int index = vmsg->payload.u64 & VHOST_USER_VRING_IDX_MASK; 1290 bool nofd = vmsg->payload.u64 & VHOST_USER_VRING_NOFD_MASK; 1291 1292 if (index >= dev->max_queues) { 1293 vmsg_close_fds(vmsg); 1294 vu_panic(dev, "Invalid queue index: %u", index); 1295 return false; 1296 } 1297 1298 if (nofd) { 1299 vmsg_close_fds(vmsg); 1300 return true; 1301 } 1302 1303 if (vmsg->fd_num != 1) { 1304 vmsg_close_fds(vmsg); 1305 vu_panic(dev, "Invalid fds in request: %d", vmsg->request); 1306 return false; 1307 } 1308 1309 return true; 1310 } 1311 1312 static int 1313 inflight_desc_compare(const void *a, const void *b) 1314 { 1315 VuVirtqInflightDesc *desc0 = (VuVirtqInflightDesc *)a, 1316 *desc1 = (VuVirtqInflightDesc *)b; 1317 1318 if (desc1->counter > desc0->counter && 1319 (desc1->counter - desc0->counter) < VIRTQUEUE_MAX_SIZE * 2) { 1320 return 1; 1321 } 1322 1323 return -1; 1324 } 1325 1326 static int 1327 vu_check_queue_inflights(VuDev *dev, VuVirtq *vq) 1328 { 1329 int i = 0; 1330 1331 if (!vu_has_protocol_feature(dev, VHOST_USER_PROTOCOL_F_INFLIGHT_SHMFD)) { 1332 return 0; 1333 } 1334 1335 if (unlikely(!vq->inflight)) { 1336 return -1; 1337 } 1338 1339 if (unlikely(!vq->inflight->version)) { 1340 /* initialize the buffer */ 1341 vq->inflight->version = INFLIGHT_VERSION; 1342 return 0; 1343 } 1344 1345 vq->used_idx = le16toh(vq->vring.used->idx); 1346 vq->resubmit_num = 0; 1347 vq->resubmit_list = NULL; 1348 vq->counter = 0; 1349 1350 if (unlikely(vq->inflight->used_idx != vq->used_idx)) { 1351 vq->inflight->desc[vq->inflight->last_batch_head].inflight = 0; 1352 1353 barrier(); 1354 1355 vq->inflight->used_idx = vq->used_idx; 1356 } 1357 1358 for (i = 0; i < vq->inflight->desc_num; i++) { 1359 if (vq->inflight->desc[i].inflight == 1) { 1360 vq->inuse++; 1361 } 1362 } 1363 1364 vq->shadow_avail_idx = vq->last_avail_idx = vq->inuse + vq->used_idx; 1365 1366 if (vq->inuse) { 1367 vq->resubmit_list = calloc(vq->inuse, sizeof(VuVirtqInflightDesc)); 1368 if (!vq->resubmit_list) { 1369 return -1; 1370 } 1371 1372 for (i = 0; i < vq->inflight->desc_num; i++) { 1373 if (vq->inflight->desc[i].inflight) { 1374 vq->resubmit_list[vq->resubmit_num].index = i; 1375 vq->resubmit_list[vq->resubmit_num].counter = 1376 vq->inflight->desc[i].counter; 1377 vq->resubmit_num++; 1378 } 1379 } 1380 1381 if (vq->resubmit_num > 1) { 1382 qsort(vq->resubmit_list, vq->resubmit_num, 1383 sizeof(VuVirtqInflightDesc), inflight_desc_compare); 1384 } 1385 vq->counter = vq->resubmit_list[0].counter + 1; 1386 } 1387 1388 /* in case of I/O hang after reconnecting */ 1389 if (eventfd_write(vq->kick_fd, 1)) { 1390 return -1; 1391 } 1392 1393 return 0; 1394 } 1395 1396 static bool 1397 vu_set_vring_kick_exec(VuDev *dev, VhostUserMsg *vmsg) 1398 { 1399 int index = vmsg->payload.u64 & VHOST_USER_VRING_IDX_MASK; 1400 bool nofd = vmsg->payload.u64 & VHOST_USER_VRING_NOFD_MASK; 1401 1402 DPRINT("u64: 0x%016"PRIx64"\n", vmsg->payload.u64); 1403 1404 if (!vu_check_queue_msg_file(dev, vmsg)) { 1405 return false; 1406 } 1407 1408 if (dev->vq[index].kick_fd != -1) { 1409 dev->remove_watch(dev, dev->vq[index].kick_fd); 1410 close(dev->vq[index].kick_fd); 1411 dev->vq[index].kick_fd = -1; 1412 } 1413 1414 dev->vq[index].kick_fd = nofd ? -1 : vmsg->fds[0]; 1415 DPRINT("Got kick_fd: %d for vq: %d\n", dev->vq[index].kick_fd, index); 1416 1417 dev->vq[index].started = true; 1418 if (dev->iface->queue_set_started) { 1419 dev->iface->queue_set_started(dev, index, true); 1420 } 1421 1422 if (dev->vq[index].kick_fd != -1 && dev->vq[index].handler) { 1423 dev->set_watch(dev, dev->vq[index].kick_fd, VU_WATCH_IN, 1424 vu_kick_cb, (void *)(long)index); 1425 1426 DPRINT("Waiting for kicks on fd: %d for vq: %d\n", 1427 dev->vq[index].kick_fd, index); 1428 } 1429 1430 if (vu_check_queue_inflights(dev, &dev->vq[index])) { 1431 vu_panic(dev, "Failed to check inflights for vq: %d\n", index); 1432 } 1433 1434 return false; 1435 } 1436 1437 void vu_set_queue_handler(VuDev *dev, VuVirtq *vq, 1438 vu_queue_handler_cb handler) 1439 { 1440 int qidx = vq - dev->vq; 1441 1442 vq->handler = handler; 1443 if (vq->kick_fd >= 0) { 1444 if (handler) { 1445 dev->set_watch(dev, vq->kick_fd, VU_WATCH_IN, 1446 vu_kick_cb, (void *)(long)qidx); 1447 } else { 1448 dev->remove_watch(dev, vq->kick_fd); 1449 } 1450 } 1451 } 1452 1453 bool vu_set_queue_host_notifier(VuDev *dev, VuVirtq *vq, int fd, 1454 int size, int offset) 1455 { 1456 int qidx = vq - dev->vq; 1457 int fd_num = 0; 1458 VhostUserMsg vmsg = { 1459 .request = VHOST_USER_BACKEND_VRING_HOST_NOTIFIER_MSG, 1460 .flags = VHOST_USER_VERSION | VHOST_USER_NEED_REPLY_MASK, 1461 .size = sizeof(vmsg.payload.area), 1462 .payload.area = { 1463 .u64 = qidx & VHOST_USER_VRING_IDX_MASK, 1464 .size = size, 1465 .offset = offset, 1466 }, 1467 }; 1468 1469 if (fd == -1) { 1470 vmsg.payload.area.u64 |= VHOST_USER_VRING_NOFD_MASK; 1471 } else { 1472 vmsg.fds[fd_num++] = fd; 1473 } 1474 1475 vmsg.fd_num = fd_num; 1476 1477 if (!vu_has_protocol_feature(dev, VHOST_USER_PROTOCOL_F_BACKEND_SEND_FD)) { 1478 return false; 1479 } 1480 1481 pthread_mutex_lock(&dev->backend_mutex); 1482 if (!vu_message_write(dev, dev->backend_fd, &vmsg)) { 1483 pthread_mutex_unlock(&dev->backend_mutex); 1484 return false; 1485 } 1486 1487 /* Also unlocks the backend_mutex */ 1488 return vu_process_message_reply(dev, &vmsg); 1489 } 1490 1491 bool 1492 vu_lookup_shared_object(VuDev *dev, unsigned char uuid[UUID_LEN], 1493 int *dmabuf_fd) 1494 { 1495 bool result = false; 1496 VhostUserMsg msg_reply; 1497 VhostUserMsg msg = { 1498 .request = VHOST_USER_BACKEND_SHARED_OBJECT_LOOKUP, 1499 .size = sizeof(msg.payload.object), 1500 .flags = VHOST_USER_VERSION | VHOST_USER_NEED_REPLY_MASK, 1501 }; 1502 1503 memcpy(msg.payload.object.uuid, uuid, sizeof(uuid[0]) * UUID_LEN); 1504 1505 if (!vu_has_protocol_feature(dev, VHOST_USER_PROTOCOL_F_SHARED_OBJECT)) { 1506 return false; 1507 } 1508 1509 pthread_mutex_lock(&dev->backend_mutex); 1510 if (!vu_message_write(dev, dev->backend_fd, &msg)) { 1511 goto out; 1512 } 1513 1514 if (!vu_message_read_default(dev, dev->backend_fd, &msg_reply)) { 1515 goto out; 1516 } 1517 1518 if (msg_reply.request != msg.request) { 1519 DPRINT("Received unexpected msg type. Expected %d, received %d", 1520 msg.request, msg_reply.request); 1521 goto out; 1522 } 1523 1524 if (msg_reply.fd_num != 1) { 1525 DPRINT("Received unexpected number of fds. Expected 1, received %d", 1526 msg_reply.fd_num); 1527 goto out; 1528 } 1529 1530 *dmabuf_fd = msg_reply.fds[0]; 1531 result = *dmabuf_fd > 0 && msg_reply.payload.u64 == 0; 1532 out: 1533 pthread_mutex_unlock(&dev->backend_mutex); 1534 1535 return result; 1536 } 1537 1538 static bool 1539 vu_send_message(VuDev *dev, VhostUserMsg *vmsg) 1540 { 1541 bool result = false; 1542 pthread_mutex_lock(&dev->backend_mutex); 1543 if (!vu_message_write(dev, dev->backend_fd, vmsg)) { 1544 goto out; 1545 } 1546 1547 result = true; 1548 out: 1549 pthread_mutex_unlock(&dev->backend_mutex); 1550 1551 return result; 1552 } 1553 1554 bool 1555 vu_add_shared_object(VuDev *dev, unsigned char uuid[UUID_LEN]) 1556 { 1557 VhostUserMsg msg = { 1558 .request = VHOST_USER_BACKEND_SHARED_OBJECT_ADD, 1559 .size = sizeof(msg.payload.object), 1560 .flags = VHOST_USER_VERSION, 1561 }; 1562 1563 memcpy(msg.payload.object.uuid, uuid, sizeof(uuid[0]) * UUID_LEN); 1564 1565 if (!vu_has_protocol_feature(dev, VHOST_USER_PROTOCOL_F_SHARED_OBJECT)) { 1566 return false; 1567 } 1568 1569 return vu_send_message(dev, &msg); 1570 } 1571 1572 bool 1573 vu_rm_shared_object(VuDev *dev, unsigned char uuid[UUID_LEN]) 1574 { 1575 VhostUserMsg msg = { 1576 .request = VHOST_USER_BACKEND_SHARED_OBJECT_REMOVE, 1577 .size = sizeof(msg.payload.object), 1578 .flags = VHOST_USER_VERSION, 1579 }; 1580 1581 memcpy(msg.payload.object.uuid, uuid, sizeof(uuid[0]) * UUID_LEN); 1582 1583 if (!vu_has_protocol_feature(dev, VHOST_USER_PROTOCOL_F_SHARED_OBJECT)) { 1584 return false; 1585 } 1586 1587 return vu_send_message(dev, &msg); 1588 } 1589 1590 static bool 1591 vu_set_vring_call_exec(VuDev *dev, VhostUserMsg *vmsg) 1592 { 1593 int index = vmsg->payload.u64 & VHOST_USER_VRING_IDX_MASK; 1594 bool nofd = vmsg->payload.u64 & VHOST_USER_VRING_NOFD_MASK; 1595 1596 DPRINT("u64: 0x%016"PRIx64"\n", vmsg->payload.u64); 1597 1598 if (!vu_check_queue_msg_file(dev, vmsg)) { 1599 return false; 1600 } 1601 1602 if (dev->vq[index].call_fd != -1) { 1603 close(dev->vq[index].call_fd); 1604 dev->vq[index].call_fd = -1; 1605 } 1606 1607 dev->vq[index].call_fd = nofd ? -1 : vmsg->fds[0]; 1608 1609 /* in case of I/O hang after reconnecting */ 1610 if (dev->vq[index].call_fd != -1 && eventfd_write(vmsg->fds[0], 1)) { 1611 return -1; 1612 } 1613 1614 DPRINT("Got call_fd: %d for vq: %d\n", dev->vq[index].call_fd, index); 1615 1616 return false; 1617 } 1618 1619 static bool 1620 vu_set_vring_err_exec(VuDev *dev, VhostUserMsg *vmsg) 1621 { 1622 int index = vmsg->payload.u64 & VHOST_USER_VRING_IDX_MASK; 1623 bool nofd = vmsg->payload.u64 & VHOST_USER_VRING_NOFD_MASK; 1624 1625 DPRINT("u64: 0x%016"PRIx64"\n", vmsg->payload.u64); 1626 1627 if (!vu_check_queue_msg_file(dev, vmsg)) { 1628 return false; 1629 } 1630 1631 if (dev->vq[index].err_fd != -1) { 1632 close(dev->vq[index].err_fd); 1633 dev->vq[index].err_fd = -1; 1634 } 1635 1636 dev->vq[index].err_fd = nofd ? -1 : vmsg->fds[0]; 1637 1638 return false; 1639 } 1640 1641 static bool 1642 vu_get_protocol_features_exec(VuDev *dev, VhostUserMsg *vmsg) 1643 { 1644 /* 1645 * Note that we support, but intentionally do not set, 1646 * VHOST_USER_PROTOCOL_F_INBAND_NOTIFICATIONS. This means that 1647 * a device implementation can return it in its callback 1648 * (get_protocol_features) if it wants to use this for 1649 * simulation, but it is otherwise not desirable (if even 1650 * implemented by the frontend.) 1651 */ 1652 uint64_t features = 1ULL << VHOST_USER_PROTOCOL_F_MQ | 1653 1ULL << VHOST_USER_PROTOCOL_F_LOG_SHMFD | 1654 1ULL << VHOST_USER_PROTOCOL_F_BACKEND_REQ | 1655 1ULL << VHOST_USER_PROTOCOL_F_HOST_NOTIFIER | 1656 1ULL << VHOST_USER_PROTOCOL_F_BACKEND_SEND_FD | 1657 1ULL << VHOST_USER_PROTOCOL_F_REPLY_ACK | 1658 1ULL << VHOST_USER_PROTOCOL_F_CONFIGURE_MEM_SLOTS; 1659 1660 if (have_userfault()) { 1661 features |= 1ULL << VHOST_USER_PROTOCOL_F_PAGEFAULT; 1662 } 1663 1664 if (dev->iface->get_config && dev->iface->set_config) { 1665 features |= 1ULL << VHOST_USER_PROTOCOL_F_CONFIG; 1666 } 1667 1668 if (dev->iface->get_protocol_features) { 1669 features |= dev->iface->get_protocol_features(dev); 1670 } 1671 1672 vmsg_set_reply_u64(vmsg, features); 1673 return true; 1674 } 1675 1676 static bool 1677 vu_set_protocol_features_exec(VuDev *dev, VhostUserMsg *vmsg) 1678 { 1679 uint64_t features = vmsg->payload.u64; 1680 1681 DPRINT("u64: 0x%016"PRIx64"\n", features); 1682 1683 dev->protocol_features = vmsg->payload.u64; 1684 1685 if (vu_has_protocol_feature(dev, 1686 VHOST_USER_PROTOCOL_F_INBAND_NOTIFICATIONS) && 1687 (!vu_has_protocol_feature(dev, VHOST_USER_PROTOCOL_F_BACKEND_REQ) || 1688 !vu_has_protocol_feature(dev, VHOST_USER_PROTOCOL_F_REPLY_ACK))) { 1689 /* 1690 * The use case for using messages for kick/call is simulation, to make 1691 * the kick and call synchronous. To actually get that behaviour, both 1692 * of the other features are required. 1693 * Theoretically, one could use only kick messages, or do them without 1694 * having F_REPLY_ACK, but too many (possibly pending) messages on the 1695 * socket will eventually cause the frontend to hang, to avoid this in 1696 * scenarios where not desired enforce that the settings are in a way 1697 * that actually enables the simulation case. 1698 */ 1699 vu_panic(dev, 1700 "F_IN_BAND_NOTIFICATIONS requires F_BACKEND_REQ && F_REPLY_ACK"); 1701 return false; 1702 } 1703 1704 if (dev->iface->set_protocol_features) { 1705 dev->iface->set_protocol_features(dev, features); 1706 } 1707 1708 return false; 1709 } 1710 1711 static bool 1712 vu_get_queue_num_exec(VuDev *dev, VhostUserMsg *vmsg) 1713 { 1714 vmsg_set_reply_u64(vmsg, dev->max_queues); 1715 return true; 1716 } 1717 1718 static bool 1719 vu_set_vring_enable_exec(VuDev *dev, VhostUserMsg *vmsg) 1720 { 1721 unsigned int index = vmsg->payload.state.index; 1722 unsigned int enable = vmsg->payload.state.num; 1723 1724 DPRINT("State.index: %u\n", index); 1725 DPRINT("State.enable: %u\n", enable); 1726 1727 if (index >= dev->max_queues) { 1728 vu_panic(dev, "Invalid vring_enable index: %u", index); 1729 return false; 1730 } 1731 1732 dev->vq[index].enable = enable; 1733 return false; 1734 } 1735 1736 static bool 1737 vu_set_backend_req_fd(VuDev *dev, VhostUserMsg *vmsg) 1738 { 1739 if (vmsg->fd_num != 1) { 1740 vu_panic(dev, "Invalid backend_req_fd message (%d fd's)", vmsg->fd_num); 1741 return false; 1742 } 1743 1744 if (dev->backend_fd != -1) { 1745 close(dev->backend_fd); 1746 } 1747 dev->backend_fd = vmsg->fds[0]; 1748 DPRINT("Got backend_fd: %d\n", vmsg->fds[0]); 1749 1750 return false; 1751 } 1752 1753 static bool 1754 vu_get_config(VuDev *dev, VhostUserMsg *vmsg) 1755 { 1756 int ret = -1; 1757 1758 if (dev->iface->get_config) { 1759 ret = dev->iface->get_config(dev, vmsg->payload.config.region, 1760 vmsg->payload.config.size); 1761 } 1762 1763 if (ret) { 1764 /* resize to zero to indicate an error to frontend */ 1765 vmsg->size = 0; 1766 } 1767 1768 return true; 1769 } 1770 1771 static bool 1772 vu_set_config(VuDev *dev, VhostUserMsg *vmsg) 1773 { 1774 int ret = -1; 1775 1776 if (dev->iface->set_config) { 1777 ret = dev->iface->set_config(dev, vmsg->payload.config.region, 1778 vmsg->payload.config.offset, 1779 vmsg->payload.config.size, 1780 vmsg->payload.config.flags); 1781 if (ret) { 1782 vu_panic(dev, "Set virtio configuration space failed"); 1783 } 1784 } 1785 1786 return false; 1787 } 1788 1789 static bool 1790 vu_set_postcopy_advise(VuDev *dev, VhostUserMsg *vmsg) 1791 { 1792 #ifdef UFFDIO_API 1793 struct uffdio_api api_struct; 1794 1795 dev->postcopy_ufd = syscall(__NR_userfaultfd, O_CLOEXEC | O_NONBLOCK); 1796 vmsg->size = 0; 1797 #else 1798 dev->postcopy_ufd = -1; 1799 #endif 1800 1801 if (dev->postcopy_ufd == -1) { 1802 vu_panic(dev, "Userfaultfd not available: %s", strerror(errno)); 1803 goto out; 1804 } 1805 1806 #ifdef UFFDIO_API 1807 api_struct.api = UFFD_API; 1808 api_struct.features = 0; 1809 if (ioctl(dev->postcopy_ufd, UFFDIO_API, &api_struct)) { 1810 vu_panic(dev, "Failed UFFDIO_API: %s", strerror(errno)); 1811 close(dev->postcopy_ufd); 1812 dev->postcopy_ufd = -1; 1813 goto out; 1814 } 1815 /* TODO: Stash feature flags somewhere */ 1816 #endif 1817 1818 out: 1819 /* Return a ufd to the QEMU */ 1820 vmsg->fd_num = 1; 1821 vmsg->fds[0] = dev->postcopy_ufd; 1822 return true; /* = send a reply */ 1823 } 1824 1825 static bool 1826 vu_set_postcopy_listen(VuDev *dev, VhostUserMsg *vmsg) 1827 { 1828 if (dev->nregions) { 1829 vu_panic(dev, "Regions already registered at postcopy-listen"); 1830 vmsg_set_reply_u64(vmsg, -1); 1831 return true; 1832 } 1833 dev->postcopy_listening = true; 1834 1835 vmsg_set_reply_u64(vmsg, 0); 1836 return true; 1837 } 1838 1839 static bool 1840 vu_set_postcopy_end(VuDev *dev, VhostUserMsg *vmsg) 1841 { 1842 DPRINT("%s: Entry\n", __func__); 1843 dev->postcopy_listening = false; 1844 if (dev->postcopy_ufd > 0) { 1845 close(dev->postcopy_ufd); 1846 dev->postcopy_ufd = -1; 1847 DPRINT("%s: Done close\n", __func__); 1848 } 1849 1850 vmsg_set_reply_u64(vmsg, 0); 1851 DPRINT("%s: exit\n", __func__); 1852 return true; 1853 } 1854 1855 static inline uint64_t 1856 vu_inflight_queue_size(uint16_t queue_size) 1857 { 1858 return ALIGN_UP(sizeof(VuDescStateSplit) * queue_size + 1859 sizeof(uint16_t), INFLIGHT_ALIGNMENT); 1860 } 1861 1862 #ifdef MFD_ALLOW_SEALING 1863 static void * 1864 memfd_alloc(const char *name, size_t size, unsigned int flags, int *fd) 1865 { 1866 void *ptr; 1867 int ret; 1868 1869 *fd = memfd_create(name, MFD_ALLOW_SEALING); 1870 if (*fd < 0) { 1871 return NULL; 1872 } 1873 1874 ret = ftruncate(*fd, size); 1875 if (ret < 0) { 1876 close(*fd); 1877 return NULL; 1878 } 1879 1880 ret = fcntl(*fd, F_ADD_SEALS, flags); 1881 if (ret < 0) { 1882 close(*fd); 1883 return NULL; 1884 } 1885 1886 ptr = mmap(0, size, PROT_READ | PROT_WRITE, MAP_SHARED, *fd, 0); 1887 if (ptr == MAP_FAILED) { 1888 close(*fd); 1889 return NULL; 1890 } 1891 1892 return ptr; 1893 } 1894 #endif 1895 1896 static bool 1897 vu_get_inflight_fd(VuDev *dev, VhostUserMsg *vmsg) 1898 { 1899 int fd = -1; 1900 void *addr = NULL; 1901 uint64_t mmap_size; 1902 uint16_t num_queues, queue_size; 1903 1904 if (vmsg->size != sizeof(vmsg->payload.inflight)) { 1905 vu_panic(dev, "Invalid get_inflight_fd message:%d", vmsg->size); 1906 vmsg->payload.inflight.mmap_size = 0; 1907 return true; 1908 } 1909 1910 num_queues = vmsg->payload.inflight.num_queues; 1911 queue_size = vmsg->payload.inflight.queue_size; 1912 1913 DPRINT("set_inflight_fd num_queues: %"PRId16"\n", num_queues); 1914 DPRINT("set_inflight_fd queue_size: %"PRId16"\n", queue_size); 1915 1916 mmap_size = vu_inflight_queue_size(queue_size) * num_queues; 1917 1918 #ifdef MFD_ALLOW_SEALING 1919 addr = memfd_alloc("vhost-inflight", mmap_size, 1920 F_SEAL_GROW | F_SEAL_SHRINK | F_SEAL_SEAL, 1921 &fd); 1922 #else 1923 vu_panic(dev, "Not implemented: memfd support is missing"); 1924 #endif 1925 1926 if (!addr) { 1927 vu_panic(dev, "Failed to alloc vhost inflight area"); 1928 vmsg->payload.inflight.mmap_size = 0; 1929 return true; 1930 } 1931 1932 memset(addr, 0, mmap_size); 1933 1934 dev->inflight_info.addr = addr; 1935 dev->inflight_info.size = vmsg->payload.inflight.mmap_size = mmap_size; 1936 dev->inflight_info.fd = vmsg->fds[0] = fd; 1937 vmsg->fd_num = 1; 1938 vmsg->payload.inflight.mmap_offset = 0; 1939 1940 DPRINT("send inflight mmap_size: %"PRId64"\n", 1941 vmsg->payload.inflight.mmap_size); 1942 DPRINT("send inflight mmap offset: %"PRId64"\n", 1943 vmsg->payload.inflight.mmap_offset); 1944 1945 return true; 1946 } 1947 1948 static bool 1949 vu_set_inflight_fd(VuDev *dev, VhostUserMsg *vmsg) 1950 { 1951 int fd, i; 1952 uint64_t mmap_size, mmap_offset; 1953 uint16_t num_queues, queue_size; 1954 void *rc; 1955 1956 if (vmsg->fd_num != 1 || 1957 vmsg->size != sizeof(vmsg->payload.inflight)) { 1958 vu_panic(dev, "Invalid set_inflight_fd message size:%d fds:%d", 1959 vmsg->size, vmsg->fd_num); 1960 return false; 1961 } 1962 1963 fd = vmsg->fds[0]; 1964 mmap_size = vmsg->payload.inflight.mmap_size; 1965 mmap_offset = vmsg->payload.inflight.mmap_offset; 1966 num_queues = vmsg->payload.inflight.num_queues; 1967 queue_size = vmsg->payload.inflight.queue_size; 1968 1969 DPRINT("set_inflight_fd mmap_size: %"PRId64"\n", mmap_size); 1970 DPRINT("set_inflight_fd mmap_offset: %"PRId64"\n", mmap_offset); 1971 DPRINT("set_inflight_fd num_queues: %"PRId16"\n", num_queues); 1972 DPRINT("set_inflight_fd queue_size: %"PRId16"\n", queue_size); 1973 1974 rc = mmap(0, mmap_size, PROT_READ | PROT_WRITE, MAP_SHARED, 1975 fd, mmap_offset); 1976 1977 if (rc == MAP_FAILED) { 1978 vu_panic(dev, "set_inflight_fd mmap error: %s", strerror(errno)); 1979 return false; 1980 } 1981 1982 if (dev->inflight_info.fd) { 1983 close(dev->inflight_info.fd); 1984 } 1985 1986 if (dev->inflight_info.addr) { 1987 munmap(dev->inflight_info.addr, dev->inflight_info.size); 1988 } 1989 1990 dev->inflight_info.fd = fd; 1991 dev->inflight_info.addr = rc; 1992 dev->inflight_info.size = mmap_size; 1993 1994 for (i = 0; i < num_queues; i++) { 1995 dev->vq[i].inflight = (VuVirtqInflight *)rc; 1996 dev->vq[i].inflight->desc_num = queue_size; 1997 rc = (void *)((char *)rc + vu_inflight_queue_size(queue_size)); 1998 } 1999 2000 return false; 2001 } 2002 2003 static bool 2004 vu_handle_vring_kick(VuDev *dev, VhostUserMsg *vmsg) 2005 { 2006 unsigned int index = vmsg->payload.state.index; 2007 2008 if (index >= dev->max_queues) { 2009 vu_panic(dev, "Invalid queue index: %u", index); 2010 return false; 2011 } 2012 2013 DPRINT("Got kick message: handler:%p idx:%u\n", 2014 dev->vq[index].handler, index); 2015 2016 if (!dev->vq[index].started) { 2017 dev->vq[index].started = true; 2018 2019 if (dev->iface->queue_set_started) { 2020 dev->iface->queue_set_started(dev, index, true); 2021 } 2022 } 2023 2024 if (dev->vq[index].handler) { 2025 dev->vq[index].handler(dev, index); 2026 } 2027 2028 return false; 2029 } 2030 2031 static bool vu_handle_get_max_memslots(VuDev *dev, VhostUserMsg *vmsg) 2032 { 2033 vmsg_set_reply_u64(vmsg, VHOST_USER_MAX_RAM_SLOTS); 2034 2035 DPRINT("u64: 0x%016"PRIx64"\n", (uint64_t) VHOST_USER_MAX_RAM_SLOTS); 2036 2037 return true; 2038 } 2039 2040 static bool 2041 vu_process_message(VuDev *dev, VhostUserMsg *vmsg) 2042 { 2043 int do_reply = 0; 2044 2045 /* Print out generic part of the request. */ 2046 DPRINT("================ Vhost user message ================\n"); 2047 DPRINT("Request: %s (%d)\n", vu_request_to_string(vmsg->request), 2048 vmsg->request); 2049 DPRINT("Flags: 0x%x\n", vmsg->flags); 2050 DPRINT("Size: %u\n", vmsg->size); 2051 2052 if (vmsg->fd_num) { 2053 int i; 2054 DPRINT("Fds:"); 2055 for (i = 0; i < vmsg->fd_num; i++) { 2056 DPRINT(" %d", vmsg->fds[i]); 2057 } 2058 DPRINT("\n"); 2059 } 2060 2061 if (dev->iface->process_msg && 2062 dev->iface->process_msg(dev, vmsg, &do_reply)) { 2063 return do_reply; 2064 } 2065 2066 switch (vmsg->request) { 2067 case VHOST_USER_GET_FEATURES: 2068 return vu_get_features_exec(dev, vmsg); 2069 case VHOST_USER_SET_FEATURES: 2070 return vu_set_features_exec(dev, vmsg); 2071 case VHOST_USER_GET_PROTOCOL_FEATURES: 2072 return vu_get_protocol_features_exec(dev, vmsg); 2073 case VHOST_USER_SET_PROTOCOL_FEATURES: 2074 return vu_set_protocol_features_exec(dev, vmsg); 2075 case VHOST_USER_SET_OWNER: 2076 return vu_set_owner_exec(dev, vmsg); 2077 case VHOST_USER_RESET_OWNER: 2078 return vu_reset_device_exec(dev, vmsg); 2079 case VHOST_USER_SET_MEM_TABLE: 2080 return vu_set_mem_table_exec(dev, vmsg); 2081 case VHOST_USER_SET_LOG_BASE: 2082 return vu_set_log_base_exec(dev, vmsg); 2083 case VHOST_USER_SET_LOG_FD: 2084 return vu_set_log_fd_exec(dev, vmsg); 2085 case VHOST_USER_SET_VRING_NUM: 2086 return vu_set_vring_num_exec(dev, vmsg); 2087 case VHOST_USER_SET_VRING_ADDR: 2088 return vu_set_vring_addr_exec(dev, vmsg); 2089 case VHOST_USER_SET_VRING_BASE: 2090 return vu_set_vring_base_exec(dev, vmsg); 2091 case VHOST_USER_GET_VRING_BASE: 2092 return vu_get_vring_base_exec(dev, vmsg); 2093 case VHOST_USER_SET_VRING_KICK: 2094 return vu_set_vring_kick_exec(dev, vmsg); 2095 case VHOST_USER_SET_VRING_CALL: 2096 return vu_set_vring_call_exec(dev, vmsg); 2097 case VHOST_USER_SET_VRING_ERR: 2098 return vu_set_vring_err_exec(dev, vmsg); 2099 case VHOST_USER_GET_QUEUE_NUM: 2100 return vu_get_queue_num_exec(dev, vmsg); 2101 case VHOST_USER_SET_VRING_ENABLE: 2102 return vu_set_vring_enable_exec(dev, vmsg); 2103 case VHOST_USER_SET_BACKEND_REQ_FD: 2104 return vu_set_backend_req_fd(dev, vmsg); 2105 case VHOST_USER_GET_CONFIG: 2106 return vu_get_config(dev, vmsg); 2107 case VHOST_USER_SET_CONFIG: 2108 return vu_set_config(dev, vmsg); 2109 case VHOST_USER_NONE: 2110 /* if you need processing before exit, override iface->process_msg */ 2111 exit(0); 2112 case VHOST_USER_POSTCOPY_ADVISE: 2113 return vu_set_postcopy_advise(dev, vmsg); 2114 case VHOST_USER_POSTCOPY_LISTEN: 2115 return vu_set_postcopy_listen(dev, vmsg); 2116 case VHOST_USER_POSTCOPY_END: 2117 return vu_set_postcopy_end(dev, vmsg); 2118 case VHOST_USER_GET_INFLIGHT_FD: 2119 return vu_get_inflight_fd(dev, vmsg); 2120 case VHOST_USER_SET_INFLIGHT_FD: 2121 return vu_set_inflight_fd(dev, vmsg); 2122 case VHOST_USER_VRING_KICK: 2123 return vu_handle_vring_kick(dev, vmsg); 2124 case VHOST_USER_GET_MAX_MEM_SLOTS: 2125 return vu_handle_get_max_memslots(dev, vmsg); 2126 case VHOST_USER_ADD_MEM_REG: 2127 return vu_add_mem_reg(dev, vmsg); 2128 case VHOST_USER_REM_MEM_REG: 2129 return vu_rem_mem_reg(dev, vmsg); 2130 case VHOST_USER_GET_SHARED_OBJECT: 2131 return vu_get_shared_object(dev, vmsg); 2132 default: 2133 vmsg_close_fds(vmsg); 2134 vu_panic(dev, "Unhandled request: %d", vmsg->request); 2135 } 2136 2137 return false; 2138 } 2139 2140 bool 2141 vu_dispatch(VuDev *dev) 2142 { 2143 VhostUserMsg vmsg = { 0, }; 2144 int reply_requested; 2145 bool need_reply, success = false; 2146 2147 if (!dev->read_msg(dev, dev->sock, &vmsg)) { 2148 goto end; 2149 } 2150 2151 need_reply = vmsg.flags & VHOST_USER_NEED_REPLY_MASK; 2152 2153 reply_requested = vu_process_message(dev, &vmsg); 2154 if (!reply_requested && need_reply) { 2155 vmsg_set_reply_u64(&vmsg, 0); 2156 reply_requested = 1; 2157 } 2158 2159 if (!reply_requested) { 2160 success = true; 2161 goto end; 2162 } 2163 2164 if (!vu_send_reply(dev, dev->sock, &vmsg)) { 2165 goto end; 2166 } 2167 2168 success = true; 2169 2170 end: 2171 free(vmsg.data); 2172 return success; 2173 } 2174 2175 void 2176 vu_deinit(VuDev *dev) 2177 { 2178 unsigned int i; 2179 2180 vu_remove_all_mem_regs(dev); 2181 2182 for (i = 0; i < dev->max_queues; i++) { 2183 VuVirtq *vq = &dev->vq[i]; 2184 2185 if (vq->call_fd != -1) { 2186 close(vq->call_fd); 2187 vq->call_fd = -1; 2188 } 2189 2190 if (vq->kick_fd != -1) { 2191 dev->remove_watch(dev, vq->kick_fd); 2192 close(vq->kick_fd); 2193 vq->kick_fd = -1; 2194 } 2195 2196 if (vq->err_fd != -1) { 2197 close(vq->err_fd); 2198 vq->err_fd = -1; 2199 } 2200 2201 if (vq->resubmit_list) { 2202 free(vq->resubmit_list); 2203 vq->resubmit_list = NULL; 2204 } 2205 2206 vq->inflight = NULL; 2207 } 2208 2209 if (dev->inflight_info.addr) { 2210 munmap(dev->inflight_info.addr, dev->inflight_info.size); 2211 dev->inflight_info.addr = NULL; 2212 } 2213 2214 if (dev->inflight_info.fd > 0) { 2215 close(dev->inflight_info.fd); 2216 dev->inflight_info.fd = -1; 2217 } 2218 2219 vu_close_log(dev); 2220 if (dev->backend_fd != -1) { 2221 close(dev->backend_fd); 2222 dev->backend_fd = -1; 2223 } 2224 pthread_mutex_destroy(&dev->backend_mutex); 2225 2226 if (dev->sock != -1) { 2227 close(dev->sock); 2228 } 2229 2230 free(dev->vq); 2231 dev->vq = NULL; 2232 free(dev->regions); 2233 dev->regions = NULL; 2234 } 2235 2236 bool 2237 vu_init(VuDev *dev, 2238 uint16_t max_queues, 2239 int socket, 2240 vu_panic_cb panic, 2241 vu_read_msg_cb read_msg, 2242 vu_set_watch_cb set_watch, 2243 vu_remove_watch_cb remove_watch, 2244 const VuDevIface *iface) 2245 { 2246 uint16_t i; 2247 2248 assert(max_queues > 0); 2249 assert(socket >= 0); 2250 assert(set_watch); 2251 assert(remove_watch); 2252 assert(iface); 2253 assert(panic); 2254 2255 memset(dev, 0, sizeof(*dev)); 2256 2257 dev->sock = socket; 2258 dev->panic = panic; 2259 dev->read_msg = read_msg ? read_msg : vu_message_read_default; 2260 dev->set_watch = set_watch; 2261 dev->remove_watch = remove_watch; 2262 dev->iface = iface; 2263 dev->log_call_fd = -1; 2264 pthread_mutex_init(&dev->backend_mutex, NULL); 2265 dev->backend_fd = -1; 2266 dev->max_queues = max_queues; 2267 2268 dev->regions = malloc(VHOST_USER_MAX_RAM_SLOTS * sizeof(dev->regions[0])); 2269 if (!dev->regions) { 2270 DPRINT("%s: failed to malloc mem regions\n", __func__); 2271 return false; 2272 } 2273 2274 dev->vq = malloc(max_queues * sizeof(dev->vq[0])); 2275 if (!dev->vq) { 2276 DPRINT("%s: failed to malloc virtqueues\n", __func__); 2277 free(dev->regions); 2278 dev->regions = NULL; 2279 return false; 2280 } 2281 2282 for (i = 0; i < max_queues; i++) { 2283 dev->vq[i] = (VuVirtq) { 2284 .call_fd = -1, .kick_fd = -1, .err_fd = -1, 2285 .notification = true, 2286 }; 2287 } 2288 2289 return true; 2290 } 2291 2292 VuVirtq * 2293 vu_get_queue(VuDev *dev, int qidx) 2294 { 2295 assert(qidx < dev->max_queues); 2296 return &dev->vq[qidx]; 2297 } 2298 2299 bool 2300 vu_queue_enabled(VuDev *dev, VuVirtq *vq) 2301 { 2302 return vq->enable; 2303 } 2304 2305 bool 2306 vu_queue_started(const VuDev *dev, const VuVirtq *vq) 2307 { 2308 return vq->started; 2309 } 2310 2311 static inline uint16_t 2312 vring_avail_flags(VuVirtq *vq) 2313 { 2314 return le16toh(vq->vring.avail->flags); 2315 } 2316 2317 static inline uint16_t 2318 vring_avail_idx(VuVirtq *vq) 2319 { 2320 vq->shadow_avail_idx = le16toh(vq->vring.avail->idx); 2321 2322 return vq->shadow_avail_idx; 2323 } 2324 2325 static inline uint16_t 2326 vring_avail_ring(VuVirtq *vq, int i) 2327 { 2328 return le16toh(vq->vring.avail->ring[i]); 2329 } 2330 2331 static inline uint16_t 2332 vring_get_used_event(VuVirtq *vq) 2333 { 2334 return vring_avail_ring(vq, vq->vring.num); 2335 } 2336 2337 static int 2338 virtqueue_num_heads(VuDev *dev, VuVirtq *vq, unsigned int idx) 2339 { 2340 uint16_t num_heads = vring_avail_idx(vq) - idx; 2341 2342 /* Check it isn't doing very strange things with descriptor numbers. */ 2343 if (num_heads > vq->vring.num) { 2344 vu_panic(dev, "Guest moved used index from %u to %u", 2345 idx, vq->shadow_avail_idx); 2346 return -1; 2347 } 2348 if (num_heads) { 2349 /* On success, callers read a descriptor at vq->last_avail_idx. 2350 * Make sure descriptor read does not bypass avail index read. */ 2351 smp_rmb(); 2352 } 2353 2354 return num_heads; 2355 } 2356 2357 static bool 2358 virtqueue_get_head(VuDev *dev, VuVirtq *vq, 2359 unsigned int idx, unsigned int *head) 2360 { 2361 /* Grab the next descriptor number they're advertising, and increment 2362 * the index we've seen. */ 2363 *head = vring_avail_ring(vq, idx % vq->vring.num); 2364 2365 /* If their number is silly, that's a fatal mistake. */ 2366 if (*head >= vq->vring.num) { 2367 vu_panic(dev, "Guest says index %u is available", *head); 2368 return false; 2369 } 2370 2371 return true; 2372 } 2373 2374 static int 2375 virtqueue_read_indirect_desc(VuDev *dev, struct vring_desc *desc, 2376 uint64_t addr, size_t len) 2377 { 2378 struct vring_desc *ori_desc; 2379 uint64_t read_len; 2380 2381 if (len > (VIRTQUEUE_MAX_SIZE * sizeof(struct vring_desc))) { 2382 return -1; 2383 } 2384 2385 if (len == 0) { 2386 return -1; 2387 } 2388 2389 while (len) { 2390 read_len = len; 2391 ori_desc = vu_gpa_to_va(dev, &read_len, addr); 2392 if (!ori_desc) { 2393 return -1; 2394 } 2395 2396 memcpy(desc, ori_desc, read_len); 2397 len -= read_len; 2398 addr += read_len; 2399 desc += read_len; 2400 } 2401 2402 return 0; 2403 } 2404 2405 enum { 2406 VIRTQUEUE_READ_DESC_ERROR = -1, 2407 VIRTQUEUE_READ_DESC_DONE = 0, /* end of chain */ 2408 VIRTQUEUE_READ_DESC_MORE = 1, /* more buffers in chain */ 2409 }; 2410 2411 static int 2412 virtqueue_read_next_desc(VuDev *dev, struct vring_desc *desc, 2413 int i, unsigned int max, unsigned int *next) 2414 { 2415 /* If this descriptor says it doesn't chain, we're done. */ 2416 if (!(le16toh(desc[i].flags) & VRING_DESC_F_NEXT)) { 2417 return VIRTQUEUE_READ_DESC_DONE; 2418 } 2419 2420 /* Check they're not leading us off end of descriptors. */ 2421 *next = le16toh(desc[i].next); 2422 /* Make sure compiler knows to grab that: we don't want it changing! */ 2423 smp_wmb(); 2424 2425 if (*next >= max) { 2426 vu_panic(dev, "Desc next is %u", *next); 2427 return VIRTQUEUE_READ_DESC_ERROR; 2428 } 2429 2430 return VIRTQUEUE_READ_DESC_MORE; 2431 } 2432 2433 void 2434 vu_queue_get_avail_bytes(VuDev *dev, VuVirtq *vq, unsigned int *in_bytes, 2435 unsigned int *out_bytes, 2436 unsigned max_in_bytes, unsigned max_out_bytes) 2437 { 2438 unsigned int idx; 2439 unsigned int total_bufs, in_total, out_total; 2440 int rc; 2441 2442 idx = vq->last_avail_idx; 2443 2444 total_bufs = in_total = out_total = 0; 2445 if (!vu_is_vq_usable(dev, vq)) { 2446 goto done; 2447 } 2448 2449 while ((rc = virtqueue_num_heads(dev, vq, idx)) > 0) { 2450 unsigned int max, desc_len, num_bufs, indirect = 0; 2451 uint64_t desc_addr, read_len; 2452 struct vring_desc *desc; 2453 struct vring_desc desc_buf[VIRTQUEUE_MAX_SIZE]; 2454 unsigned int i; 2455 2456 max = vq->vring.num; 2457 num_bufs = total_bufs; 2458 if (!virtqueue_get_head(dev, vq, idx++, &i)) { 2459 goto err; 2460 } 2461 desc = vq->vring.desc; 2462 2463 if (le16toh(desc[i].flags) & VRING_DESC_F_INDIRECT) { 2464 if (le32toh(desc[i].len) % sizeof(struct vring_desc)) { 2465 vu_panic(dev, "Invalid size for indirect buffer table"); 2466 goto err; 2467 } 2468 2469 /* If we've got too many, that implies a descriptor loop. */ 2470 if (num_bufs >= max) { 2471 vu_panic(dev, "Looped descriptor"); 2472 goto err; 2473 } 2474 2475 /* loop over the indirect descriptor table */ 2476 indirect = 1; 2477 desc_addr = le64toh(desc[i].addr); 2478 desc_len = le32toh(desc[i].len); 2479 max = desc_len / sizeof(struct vring_desc); 2480 read_len = desc_len; 2481 desc = vu_gpa_to_va(dev, &read_len, desc_addr); 2482 if (unlikely(desc && read_len != desc_len)) { 2483 /* Failed to use zero copy */ 2484 desc = NULL; 2485 if (!virtqueue_read_indirect_desc(dev, desc_buf, 2486 desc_addr, 2487 desc_len)) { 2488 desc = desc_buf; 2489 } 2490 } 2491 if (!desc) { 2492 vu_panic(dev, "Invalid indirect buffer table"); 2493 goto err; 2494 } 2495 num_bufs = i = 0; 2496 } 2497 2498 do { 2499 /* If we've got too many, that implies a descriptor loop. */ 2500 if (++num_bufs > max) { 2501 vu_panic(dev, "Looped descriptor"); 2502 goto err; 2503 } 2504 2505 if (le16toh(desc[i].flags) & VRING_DESC_F_WRITE) { 2506 in_total += le32toh(desc[i].len); 2507 } else { 2508 out_total += le32toh(desc[i].len); 2509 } 2510 if (in_total >= max_in_bytes && out_total >= max_out_bytes) { 2511 goto done; 2512 } 2513 rc = virtqueue_read_next_desc(dev, desc, i, max, &i); 2514 } while (rc == VIRTQUEUE_READ_DESC_MORE); 2515 2516 if (rc == VIRTQUEUE_READ_DESC_ERROR) { 2517 goto err; 2518 } 2519 2520 if (!indirect) { 2521 total_bufs = num_bufs; 2522 } else { 2523 total_bufs++; 2524 } 2525 } 2526 if (rc < 0) { 2527 goto err; 2528 } 2529 done: 2530 if (in_bytes) { 2531 *in_bytes = in_total; 2532 } 2533 if (out_bytes) { 2534 *out_bytes = out_total; 2535 } 2536 return; 2537 2538 err: 2539 in_total = out_total = 0; 2540 goto done; 2541 } 2542 2543 bool 2544 vu_queue_avail_bytes(VuDev *dev, VuVirtq *vq, unsigned int in_bytes, 2545 unsigned int out_bytes) 2546 { 2547 unsigned int in_total, out_total; 2548 2549 vu_queue_get_avail_bytes(dev, vq, &in_total, &out_total, 2550 in_bytes, out_bytes); 2551 2552 return in_bytes <= in_total && out_bytes <= out_total; 2553 } 2554 2555 /* Fetch avail_idx from VQ memory only when we really need to know if 2556 * guest has added some buffers. */ 2557 bool 2558 vu_queue_empty(VuDev *dev, VuVirtq *vq) 2559 { 2560 if (!vu_is_vq_usable(dev, vq)) { 2561 return true; 2562 } 2563 2564 if (vq->shadow_avail_idx != vq->last_avail_idx) { 2565 return false; 2566 } 2567 2568 return vring_avail_idx(vq) == vq->last_avail_idx; 2569 } 2570 2571 static bool 2572 vring_notify(VuDev *dev, VuVirtq *vq) 2573 { 2574 uint16_t old, new; 2575 bool v; 2576 2577 /* We need to expose used array entries before checking used event. */ 2578 smp_mb(); 2579 2580 /* Always notify when queue is empty (when feature acknowledge) */ 2581 if (vu_has_feature(dev, VIRTIO_F_NOTIFY_ON_EMPTY) && 2582 !vq->inuse && vu_queue_empty(dev, vq)) { 2583 return true; 2584 } 2585 2586 if (!vu_has_feature(dev, VIRTIO_RING_F_EVENT_IDX)) { 2587 return !(vring_avail_flags(vq) & VRING_AVAIL_F_NO_INTERRUPT); 2588 } 2589 2590 v = vq->signalled_used_valid; 2591 vq->signalled_used_valid = true; 2592 old = vq->signalled_used; 2593 new = vq->signalled_used = vq->used_idx; 2594 return !v || vring_need_event(vring_get_used_event(vq), new, old); 2595 } 2596 2597 static void _vu_queue_notify(VuDev *dev, VuVirtq *vq, bool sync) 2598 { 2599 if (!vu_is_vq_usable(dev, vq)) { 2600 return; 2601 } 2602 2603 if (!vring_notify(dev, vq)) { 2604 DPRINT("skipped notify...\n"); 2605 return; 2606 } 2607 2608 if (vq->call_fd < 0 && 2609 vu_has_protocol_feature(dev, 2610 VHOST_USER_PROTOCOL_F_INBAND_NOTIFICATIONS) && 2611 vu_has_protocol_feature(dev, VHOST_USER_PROTOCOL_F_BACKEND_REQ)) { 2612 VhostUserMsg vmsg = { 2613 .request = VHOST_USER_BACKEND_VRING_CALL, 2614 .flags = VHOST_USER_VERSION, 2615 .size = sizeof(vmsg.payload.state), 2616 .payload.state = { 2617 .index = vq - dev->vq, 2618 }, 2619 }; 2620 bool ack = sync && 2621 vu_has_protocol_feature(dev, 2622 VHOST_USER_PROTOCOL_F_REPLY_ACK); 2623 2624 if (ack) { 2625 vmsg.flags |= VHOST_USER_NEED_REPLY_MASK; 2626 } 2627 2628 vu_message_write(dev, dev->backend_fd, &vmsg); 2629 if (ack) { 2630 vu_message_read_default(dev, dev->backend_fd, &vmsg); 2631 } 2632 return; 2633 } 2634 2635 if (eventfd_write(vq->call_fd, 1) < 0) { 2636 vu_panic(dev, "Error writing eventfd: %s", strerror(errno)); 2637 } 2638 } 2639 2640 void vu_queue_notify(VuDev *dev, VuVirtq *vq) 2641 { 2642 _vu_queue_notify(dev, vq, false); 2643 } 2644 2645 void vu_queue_notify_sync(VuDev *dev, VuVirtq *vq) 2646 { 2647 _vu_queue_notify(dev, vq, true); 2648 } 2649 2650 void vu_config_change_msg(VuDev *dev) 2651 { 2652 VhostUserMsg vmsg = { 2653 .request = VHOST_USER_BACKEND_CONFIG_CHANGE_MSG, 2654 .flags = VHOST_USER_VERSION, 2655 }; 2656 2657 vu_message_write(dev, dev->backend_fd, &vmsg); 2658 } 2659 2660 static inline void 2661 vring_used_flags_set_bit(VuVirtq *vq, int mask) 2662 { 2663 uint16_t *flags; 2664 2665 flags = (uint16_t *)((char*)vq->vring.used + 2666 offsetof(struct vring_used, flags)); 2667 *flags = htole16(le16toh(*flags) | mask); 2668 } 2669 2670 static inline void 2671 vring_used_flags_unset_bit(VuVirtq *vq, int mask) 2672 { 2673 uint16_t *flags; 2674 2675 flags = (uint16_t *)((char*)vq->vring.used + 2676 offsetof(struct vring_used, flags)); 2677 *flags = htole16(le16toh(*flags) & ~mask); 2678 } 2679 2680 static inline void 2681 vring_set_avail_event(VuVirtq *vq, uint16_t val) 2682 { 2683 uint16_t val_le = htole16(val); 2684 2685 if (!vq->notification) { 2686 return; 2687 } 2688 2689 memcpy(&vq->vring.used->ring[vq->vring.num], &val_le, sizeof(uint16_t)); 2690 } 2691 2692 void 2693 vu_queue_set_notification(VuDev *dev, VuVirtq *vq, int enable) 2694 { 2695 vq->notification = enable; 2696 if (vu_has_feature(dev, VIRTIO_RING_F_EVENT_IDX)) { 2697 vring_set_avail_event(vq, vring_avail_idx(vq)); 2698 } else if (enable) { 2699 vring_used_flags_unset_bit(vq, VRING_USED_F_NO_NOTIFY); 2700 } else { 2701 vring_used_flags_set_bit(vq, VRING_USED_F_NO_NOTIFY); 2702 } 2703 if (enable) { 2704 /* Expose avail event/used flags before caller checks the avail idx. */ 2705 smp_mb(); 2706 } 2707 } 2708 2709 static bool 2710 virtqueue_map_desc(VuDev *dev, 2711 unsigned int *p_num_sg, struct iovec *iov, 2712 unsigned int max_num_sg, bool is_write, 2713 uint64_t pa, size_t sz) 2714 { 2715 unsigned num_sg = *p_num_sg; 2716 2717 assert(num_sg <= max_num_sg); 2718 2719 if (!sz) { 2720 vu_panic(dev, "virtio: zero sized buffers are not allowed"); 2721 return false; 2722 } 2723 2724 while (sz) { 2725 uint64_t len = sz; 2726 2727 if (num_sg == max_num_sg) { 2728 vu_panic(dev, "virtio: too many descriptors in indirect table"); 2729 return false; 2730 } 2731 2732 iov[num_sg].iov_base = vu_gpa_to_va(dev, &len, pa); 2733 if (iov[num_sg].iov_base == NULL) { 2734 vu_panic(dev, "virtio: invalid address for buffers"); 2735 return false; 2736 } 2737 iov[num_sg].iov_len = len; 2738 num_sg++; 2739 sz -= len; 2740 pa += len; 2741 } 2742 2743 *p_num_sg = num_sg; 2744 return true; 2745 } 2746 2747 static void * 2748 virtqueue_alloc_element(size_t sz, 2749 unsigned out_num, unsigned in_num) 2750 { 2751 VuVirtqElement *elem; 2752 size_t in_sg_ofs = ALIGN_UP(sz, __alignof__(elem->in_sg[0])); 2753 size_t out_sg_ofs = in_sg_ofs + in_num * sizeof(elem->in_sg[0]); 2754 size_t out_sg_end = out_sg_ofs + out_num * sizeof(elem->out_sg[0]); 2755 2756 assert(sz >= sizeof(VuVirtqElement)); 2757 elem = malloc(out_sg_end); 2758 if (!elem) { 2759 DPRINT("%s: failed to malloc virtqueue element\n", __func__); 2760 return NULL; 2761 } 2762 elem->out_num = out_num; 2763 elem->in_num = in_num; 2764 elem->in_sg = (void *)elem + in_sg_ofs; 2765 elem->out_sg = (void *)elem + out_sg_ofs; 2766 return elem; 2767 } 2768 2769 static void * 2770 vu_queue_map_desc(VuDev *dev, VuVirtq *vq, unsigned int idx, size_t sz) 2771 { 2772 struct vring_desc *desc = vq->vring.desc; 2773 uint64_t desc_addr, read_len; 2774 unsigned int desc_len; 2775 unsigned int max = vq->vring.num; 2776 unsigned int i = idx; 2777 VuVirtqElement *elem; 2778 unsigned int out_num = 0, in_num = 0; 2779 struct iovec iov[VIRTQUEUE_MAX_SIZE]; 2780 struct vring_desc desc_buf[VIRTQUEUE_MAX_SIZE]; 2781 int rc; 2782 2783 if (le16toh(desc[i].flags) & VRING_DESC_F_INDIRECT) { 2784 if (le32toh(desc[i].len) % sizeof(struct vring_desc)) { 2785 vu_panic(dev, "Invalid size for indirect buffer table"); 2786 return NULL; 2787 } 2788 2789 /* loop over the indirect descriptor table */ 2790 desc_addr = le64toh(desc[i].addr); 2791 desc_len = le32toh(desc[i].len); 2792 max = desc_len / sizeof(struct vring_desc); 2793 read_len = desc_len; 2794 desc = vu_gpa_to_va(dev, &read_len, desc_addr); 2795 if (unlikely(desc && read_len != desc_len)) { 2796 /* Failed to use zero copy */ 2797 desc = NULL; 2798 if (!virtqueue_read_indirect_desc(dev, desc_buf, 2799 desc_addr, 2800 desc_len)) { 2801 desc = desc_buf; 2802 } 2803 } 2804 if (!desc) { 2805 vu_panic(dev, "Invalid indirect buffer table"); 2806 return NULL; 2807 } 2808 i = 0; 2809 } 2810 2811 /* Collect all the descriptors */ 2812 do { 2813 if (le16toh(desc[i].flags) & VRING_DESC_F_WRITE) { 2814 if (!virtqueue_map_desc(dev, &in_num, iov + out_num, 2815 VIRTQUEUE_MAX_SIZE - out_num, true, 2816 le64toh(desc[i].addr), 2817 le32toh(desc[i].len))) { 2818 return NULL; 2819 } 2820 } else { 2821 if (in_num) { 2822 vu_panic(dev, "Incorrect order for descriptors"); 2823 return NULL; 2824 } 2825 if (!virtqueue_map_desc(dev, &out_num, iov, 2826 VIRTQUEUE_MAX_SIZE, false, 2827 le64toh(desc[i].addr), 2828 le32toh(desc[i].len))) { 2829 return NULL; 2830 } 2831 } 2832 2833 /* If we've got too many, that implies a descriptor loop. */ 2834 if ((in_num + out_num) > max) { 2835 vu_panic(dev, "Looped descriptor"); 2836 return NULL; 2837 } 2838 rc = virtqueue_read_next_desc(dev, desc, i, max, &i); 2839 } while (rc == VIRTQUEUE_READ_DESC_MORE); 2840 2841 if (rc == VIRTQUEUE_READ_DESC_ERROR) { 2842 vu_panic(dev, "read descriptor error"); 2843 return NULL; 2844 } 2845 2846 /* Now copy what we have collected and mapped */ 2847 elem = virtqueue_alloc_element(sz, out_num, in_num); 2848 if (!elem) { 2849 return NULL; 2850 } 2851 elem->index = idx; 2852 for (i = 0; i < out_num; i++) { 2853 elem->out_sg[i] = iov[i]; 2854 } 2855 for (i = 0; i < in_num; i++) { 2856 elem->in_sg[i] = iov[out_num + i]; 2857 } 2858 2859 return elem; 2860 } 2861 2862 static int 2863 vu_queue_inflight_get(VuDev *dev, VuVirtq *vq, int desc_idx) 2864 { 2865 if (!vu_has_protocol_feature(dev, VHOST_USER_PROTOCOL_F_INFLIGHT_SHMFD)) { 2866 return 0; 2867 } 2868 2869 if (unlikely(!vq->inflight)) { 2870 return -1; 2871 } 2872 2873 vq->inflight->desc[desc_idx].counter = vq->counter++; 2874 vq->inflight->desc[desc_idx].inflight = 1; 2875 2876 return 0; 2877 } 2878 2879 static int 2880 vu_queue_inflight_pre_put(VuDev *dev, VuVirtq *vq, int desc_idx) 2881 { 2882 if (!vu_has_protocol_feature(dev, VHOST_USER_PROTOCOL_F_INFLIGHT_SHMFD)) { 2883 return 0; 2884 } 2885 2886 if (unlikely(!vq->inflight)) { 2887 return -1; 2888 } 2889 2890 vq->inflight->last_batch_head = desc_idx; 2891 2892 return 0; 2893 } 2894 2895 static int 2896 vu_queue_inflight_post_put(VuDev *dev, VuVirtq *vq, int desc_idx) 2897 { 2898 if (!vu_has_protocol_feature(dev, VHOST_USER_PROTOCOL_F_INFLIGHT_SHMFD)) { 2899 return 0; 2900 } 2901 2902 if (unlikely(!vq->inflight)) { 2903 return -1; 2904 } 2905 2906 barrier(); 2907 2908 vq->inflight->desc[desc_idx].inflight = 0; 2909 2910 barrier(); 2911 2912 vq->inflight->used_idx = vq->used_idx; 2913 2914 return 0; 2915 } 2916 2917 void * 2918 vu_queue_pop(VuDev *dev, VuVirtq *vq, size_t sz) 2919 { 2920 int i; 2921 unsigned int head; 2922 VuVirtqElement *elem; 2923 2924 if (!vu_is_vq_usable(dev, vq)) { 2925 return NULL; 2926 } 2927 2928 if (unlikely(vq->resubmit_list && vq->resubmit_num > 0)) { 2929 i = (--vq->resubmit_num); 2930 elem = vu_queue_map_desc(dev, vq, vq->resubmit_list[i].index, sz); 2931 2932 if (!vq->resubmit_num) { 2933 free(vq->resubmit_list); 2934 vq->resubmit_list = NULL; 2935 } 2936 2937 return elem; 2938 } 2939 2940 if (vu_queue_empty(dev, vq)) { 2941 return NULL; 2942 } 2943 /* 2944 * Needed after virtio_queue_empty(), see comment in 2945 * virtqueue_num_heads(). 2946 */ 2947 smp_rmb(); 2948 2949 if (vq->inuse >= vq->vring.num) { 2950 vu_panic(dev, "Virtqueue size exceeded"); 2951 return NULL; 2952 } 2953 2954 if (!virtqueue_get_head(dev, vq, vq->last_avail_idx++, &head)) { 2955 return NULL; 2956 } 2957 2958 if (vu_has_feature(dev, VIRTIO_RING_F_EVENT_IDX)) { 2959 vring_set_avail_event(vq, vq->last_avail_idx); 2960 } 2961 2962 elem = vu_queue_map_desc(dev, vq, head, sz); 2963 2964 if (!elem) { 2965 return NULL; 2966 } 2967 2968 vq->inuse++; 2969 2970 vu_queue_inflight_get(dev, vq, head); 2971 2972 return elem; 2973 } 2974 2975 static void 2976 vu_queue_detach_element(VuDev *dev, VuVirtq *vq, VuVirtqElement *elem, 2977 size_t len) 2978 { 2979 vq->inuse--; 2980 /* unmap, when DMA support is added */ 2981 } 2982 2983 void 2984 vu_queue_unpop(VuDev *dev, VuVirtq *vq, VuVirtqElement *elem, 2985 size_t len) 2986 { 2987 vq->last_avail_idx--; 2988 vu_queue_detach_element(dev, vq, elem, len); 2989 } 2990 2991 bool 2992 vu_queue_rewind(VuDev *dev, VuVirtq *vq, unsigned int num) 2993 { 2994 if (num > vq->inuse) { 2995 return false; 2996 } 2997 vq->last_avail_idx -= num; 2998 vq->inuse -= num; 2999 return true; 3000 } 3001 3002 static inline 3003 void vring_used_write(VuDev *dev, VuVirtq *vq, 3004 struct vring_used_elem *uelem, int i) 3005 { 3006 struct vring_used *used = vq->vring.used; 3007 3008 used->ring[i] = *uelem; 3009 vu_log_write(dev, vq->vring.log_guest_addr + 3010 offsetof(struct vring_used, ring[i]), 3011 sizeof(used->ring[i])); 3012 } 3013 3014 3015 static void 3016 vu_log_queue_fill(VuDev *dev, VuVirtq *vq, 3017 const VuVirtqElement *elem, 3018 unsigned int len) 3019 { 3020 struct vring_desc *desc = vq->vring.desc; 3021 unsigned int i, max, min, desc_len; 3022 uint64_t desc_addr, read_len; 3023 struct vring_desc desc_buf[VIRTQUEUE_MAX_SIZE]; 3024 unsigned num_bufs = 0; 3025 3026 max = vq->vring.num; 3027 i = elem->index; 3028 3029 if (le16toh(desc[i].flags) & VRING_DESC_F_INDIRECT) { 3030 if (le32toh(desc[i].len) % sizeof(struct vring_desc)) { 3031 vu_panic(dev, "Invalid size for indirect buffer table"); 3032 return; 3033 } 3034 3035 /* loop over the indirect descriptor table */ 3036 desc_addr = le64toh(desc[i].addr); 3037 desc_len = le32toh(desc[i].len); 3038 max = desc_len / sizeof(struct vring_desc); 3039 read_len = desc_len; 3040 desc = vu_gpa_to_va(dev, &read_len, desc_addr); 3041 if (unlikely(desc && read_len != desc_len)) { 3042 /* Failed to use zero copy */ 3043 desc = NULL; 3044 if (!virtqueue_read_indirect_desc(dev, desc_buf, 3045 desc_addr, 3046 desc_len)) { 3047 desc = desc_buf; 3048 } 3049 } 3050 if (!desc) { 3051 vu_panic(dev, "Invalid indirect buffer table"); 3052 return; 3053 } 3054 i = 0; 3055 } 3056 3057 do { 3058 if (++num_bufs > max) { 3059 vu_panic(dev, "Looped descriptor"); 3060 return; 3061 } 3062 3063 if (le16toh(desc[i].flags) & VRING_DESC_F_WRITE) { 3064 min = MIN(le32toh(desc[i].len), len); 3065 vu_log_write(dev, le64toh(desc[i].addr), min); 3066 len -= min; 3067 } 3068 3069 } while (len > 0 && 3070 (virtqueue_read_next_desc(dev, desc, i, max, &i) 3071 == VIRTQUEUE_READ_DESC_MORE)); 3072 } 3073 3074 void 3075 vu_queue_fill(VuDev *dev, VuVirtq *vq, 3076 const VuVirtqElement *elem, 3077 unsigned int len, unsigned int idx) 3078 { 3079 struct vring_used_elem uelem; 3080 3081 if (!vu_is_vq_usable(dev, vq)) { 3082 return; 3083 } 3084 3085 vu_log_queue_fill(dev, vq, elem, len); 3086 3087 idx = (idx + vq->used_idx) % vq->vring.num; 3088 3089 uelem.id = htole32(elem->index); 3090 uelem.len = htole32(len); 3091 vring_used_write(dev, vq, &uelem, idx); 3092 } 3093 3094 static inline 3095 void vring_used_idx_set(VuDev *dev, VuVirtq *vq, uint16_t val) 3096 { 3097 vq->vring.used->idx = htole16(val); 3098 vu_log_write(dev, 3099 vq->vring.log_guest_addr + offsetof(struct vring_used, idx), 3100 sizeof(vq->vring.used->idx)); 3101 3102 vq->used_idx = val; 3103 } 3104 3105 void 3106 vu_queue_flush(VuDev *dev, VuVirtq *vq, unsigned int count) 3107 { 3108 uint16_t old, new; 3109 3110 if (!vu_is_vq_usable(dev, vq)) { 3111 return; 3112 } 3113 3114 /* Make sure buffer is written before we update index. */ 3115 smp_wmb(); 3116 3117 old = vq->used_idx; 3118 new = old + count; 3119 vring_used_idx_set(dev, vq, new); 3120 vq->inuse -= count; 3121 if (unlikely((int16_t)(new - vq->signalled_used) < (uint16_t)(new - old))) { 3122 vq->signalled_used_valid = false; 3123 } 3124 } 3125 3126 void 3127 vu_queue_push(VuDev *dev, VuVirtq *vq, 3128 const VuVirtqElement *elem, unsigned int len) 3129 { 3130 vu_queue_fill(dev, vq, elem, len, 0); 3131 vu_queue_inflight_pre_put(dev, vq, elem->index); 3132 vu_queue_flush(dev, vq, 1); 3133 vu_queue_inflight_post_put(dev, vq, elem->index); 3134 } 3135