1 /* 2 * Vhost User library 3 * 4 * Copyright IBM, Corp. 2007 5 * Copyright (c) 2016 Red Hat, Inc. 6 * 7 * Authors: 8 * Anthony Liguori <aliguori@us.ibm.com> 9 * Marc-André Lureau <mlureau@redhat.com> 10 * Victor Kaplansky <victork@redhat.com> 11 * 12 * This work is licensed under the terms of the GNU GPL, version 2 or 13 * later. See the COPYING file in the top-level directory. 14 */ 15 16 #ifndef _GNU_SOURCE 17 #define _GNU_SOURCE 18 #endif 19 20 /* this code avoids GLib dependency */ 21 #include <stdlib.h> 22 #include <stdio.h> 23 #include <unistd.h> 24 #include <stdarg.h> 25 #include <errno.h> 26 #include <string.h> 27 #include <assert.h> 28 #include <inttypes.h> 29 #include <sys/types.h> 30 #include <sys/socket.h> 31 #include <sys/eventfd.h> 32 #include <sys/mman.h> 33 #include <endian.h> 34 35 /* Necessary to provide VIRTIO_F_VERSION_1 on system 36 * with older linux headers. Must appear before 37 * <linux/vhost.h> below. 38 */ 39 #include "standard-headers/linux/virtio_config.h" 40 41 #if defined(__linux__) 42 #include <sys/syscall.h> 43 #include <fcntl.h> 44 #include <sys/ioctl.h> 45 #include <linux/vhost.h> 46 #include <sys/vfs.h> 47 #include <linux/magic.h> 48 49 #ifdef __NR_userfaultfd 50 #include <linux/userfaultfd.h> 51 #endif 52 53 #endif 54 55 #include "include/atomic.h" 56 57 #include "libvhost-user.h" 58 59 /* usually provided by GLib */ 60 #if __GNUC__ > 2 || (__GNUC__ == 2 && __GNUC_MINOR__ > 4) 61 #if !defined(__clang__) && (__GNUC__ == 4 && __GNUC_MINOR__ == 4) 62 #define G_GNUC_PRINTF(format_idx, arg_idx) \ 63 __attribute__((__format__(gnu_printf, format_idx, arg_idx))) 64 #else 65 #define G_GNUC_PRINTF(format_idx, arg_idx) \ 66 __attribute__((__format__(__printf__, format_idx, arg_idx))) 67 #endif 68 #else /* !__GNUC__ */ 69 #define G_GNUC_PRINTF(format_idx, arg_idx) 70 #endif /* !__GNUC__ */ 71 #ifndef MIN 72 #define MIN(x, y) ({ \ 73 __typeof__(x) _min1 = (x); \ 74 __typeof__(y) _min2 = (y); \ 75 (void) (&_min1 == &_min2); \ 76 _min1 < _min2 ? _min1 : _min2; }) 77 #endif 78 79 /* Round number down to multiple */ 80 #define ALIGN_DOWN(n, m) ((n) / (m) * (m)) 81 82 /* Round number up to multiple */ 83 #define ALIGN_UP(n, m) ALIGN_DOWN((n) + (m) - 1, (m)) 84 85 #ifndef unlikely 86 #define unlikely(x) __builtin_expect(!!(x), 0) 87 #endif 88 89 /* Align each region to cache line size in inflight buffer */ 90 #define INFLIGHT_ALIGNMENT 64 91 92 /* The version of inflight buffer */ 93 #define INFLIGHT_VERSION 1 94 95 /* The version of the protocol we support */ 96 #define VHOST_USER_VERSION 1 97 #define LIBVHOST_USER_DEBUG 0 98 99 #define DPRINT(...) \ 100 do { \ 101 if (LIBVHOST_USER_DEBUG) { \ 102 fprintf(stderr, __VA_ARGS__); \ 103 } \ 104 } while (0) 105 106 static inline 107 bool has_feature(uint64_t features, unsigned int fbit) 108 { 109 assert(fbit < 64); 110 return !!(features & (1ULL << fbit)); 111 } 112 113 static inline 114 bool vu_has_feature(VuDev *dev, 115 unsigned int fbit) 116 { 117 return has_feature(dev->features, fbit); 118 } 119 120 static inline bool vu_has_protocol_feature(VuDev *dev, unsigned int fbit) 121 { 122 return has_feature(dev->protocol_features, fbit); 123 } 124 125 const char * 126 vu_request_to_string(unsigned int req) 127 { 128 #define REQ(req) [req] = #req 129 static const char *vu_request_str[] = { 130 REQ(VHOST_USER_NONE), 131 REQ(VHOST_USER_GET_FEATURES), 132 REQ(VHOST_USER_SET_FEATURES), 133 REQ(VHOST_USER_SET_OWNER), 134 REQ(VHOST_USER_RESET_OWNER), 135 REQ(VHOST_USER_SET_MEM_TABLE), 136 REQ(VHOST_USER_SET_LOG_BASE), 137 REQ(VHOST_USER_SET_LOG_FD), 138 REQ(VHOST_USER_SET_VRING_NUM), 139 REQ(VHOST_USER_SET_VRING_ADDR), 140 REQ(VHOST_USER_SET_VRING_BASE), 141 REQ(VHOST_USER_GET_VRING_BASE), 142 REQ(VHOST_USER_SET_VRING_KICK), 143 REQ(VHOST_USER_SET_VRING_CALL), 144 REQ(VHOST_USER_SET_VRING_ERR), 145 REQ(VHOST_USER_GET_PROTOCOL_FEATURES), 146 REQ(VHOST_USER_SET_PROTOCOL_FEATURES), 147 REQ(VHOST_USER_GET_QUEUE_NUM), 148 REQ(VHOST_USER_SET_VRING_ENABLE), 149 REQ(VHOST_USER_SEND_RARP), 150 REQ(VHOST_USER_NET_SET_MTU), 151 REQ(VHOST_USER_SET_BACKEND_REQ_FD), 152 REQ(VHOST_USER_IOTLB_MSG), 153 REQ(VHOST_USER_SET_VRING_ENDIAN), 154 REQ(VHOST_USER_GET_CONFIG), 155 REQ(VHOST_USER_SET_CONFIG), 156 REQ(VHOST_USER_POSTCOPY_ADVISE), 157 REQ(VHOST_USER_POSTCOPY_LISTEN), 158 REQ(VHOST_USER_POSTCOPY_END), 159 REQ(VHOST_USER_GET_INFLIGHT_FD), 160 REQ(VHOST_USER_SET_INFLIGHT_FD), 161 REQ(VHOST_USER_GPU_SET_SOCKET), 162 REQ(VHOST_USER_VRING_KICK), 163 REQ(VHOST_USER_GET_MAX_MEM_SLOTS), 164 REQ(VHOST_USER_ADD_MEM_REG), 165 REQ(VHOST_USER_REM_MEM_REG), 166 REQ(VHOST_USER_GET_SHARED_OBJECT), 167 REQ(VHOST_USER_MAX), 168 }; 169 #undef REQ 170 171 if (req < VHOST_USER_MAX) { 172 return vu_request_str[req]; 173 } else { 174 return "unknown"; 175 } 176 } 177 178 static void G_GNUC_PRINTF(2, 3) 179 vu_panic(VuDev *dev, const char *msg, ...) 180 { 181 char *buf = NULL; 182 va_list ap; 183 184 va_start(ap, msg); 185 if (vasprintf(&buf, msg, ap) < 0) { 186 buf = NULL; 187 } 188 va_end(ap); 189 190 dev->broken = true; 191 dev->panic(dev, buf); 192 free(buf); 193 194 /* 195 * FIXME: 196 * find a way to call virtio_error, or perhaps close the connection? 197 */ 198 } 199 200 /* Search for a memory region that covers this guest physical address. */ 201 static VuDevRegion * 202 vu_gpa_to_mem_region(VuDev *dev, uint64_t guest_addr) 203 { 204 int low = 0; 205 int high = dev->nregions - 1; 206 207 /* 208 * Memory regions cannot overlap in guest physical address space. Each 209 * GPA belongs to exactly one memory region, so there can only be one 210 * match. 211 * 212 * We store our memory regions ordered by GPA and can simply perform a 213 * binary search. 214 */ 215 while (low <= high) { 216 unsigned int mid = low + (high - low) / 2; 217 VuDevRegion *cur = &dev->regions[mid]; 218 219 if (guest_addr >= cur->gpa && guest_addr < cur->gpa + cur->size) { 220 return cur; 221 } 222 if (guest_addr >= cur->gpa + cur->size) { 223 low = mid + 1; 224 } 225 if (guest_addr < cur->gpa) { 226 high = mid - 1; 227 } 228 } 229 return NULL; 230 } 231 232 /* Translate guest physical address to our virtual address. */ 233 void * 234 vu_gpa_to_va(VuDev *dev, uint64_t *plen, uint64_t guest_addr) 235 { 236 VuDevRegion *r; 237 238 if (*plen == 0) { 239 return NULL; 240 } 241 242 r = vu_gpa_to_mem_region(dev, guest_addr); 243 if (!r) { 244 return NULL; 245 } 246 247 if ((guest_addr + *plen) > (r->gpa + r->size)) { 248 *plen = r->gpa + r->size - guest_addr; 249 } 250 return (void *)(uintptr_t)guest_addr - r->gpa + r->mmap_addr + 251 r->mmap_offset; 252 } 253 254 /* Translate qemu virtual address to our virtual address. */ 255 static void * 256 qva_to_va(VuDev *dev, uint64_t qemu_addr) 257 { 258 unsigned int i; 259 260 /* Find matching memory region. */ 261 for (i = 0; i < dev->nregions; i++) { 262 VuDevRegion *r = &dev->regions[i]; 263 264 if ((qemu_addr >= r->qva) && (qemu_addr < (r->qva + r->size))) { 265 return (void *)(uintptr_t) 266 qemu_addr - r->qva + r->mmap_addr + r->mmap_offset; 267 } 268 } 269 270 return NULL; 271 } 272 273 static void 274 vu_remove_all_mem_regs(VuDev *dev) 275 { 276 unsigned int i; 277 278 for (i = 0; i < dev->nregions; i++) { 279 VuDevRegion *r = &dev->regions[i]; 280 281 munmap((void *)(uintptr_t)r->mmap_addr, r->size + r->mmap_offset); 282 } 283 dev->nregions = 0; 284 } 285 286 static bool 287 map_ring(VuDev *dev, VuVirtq *vq) 288 { 289 vq->vring.desc = qva_to_va(dev, vq->vra.desc_user_addr); 290 vq->vring.used = qva_to_va(dev, vq->vra.used_user_addr); 291 vq->vring.avail = qva_to_va(dev, vq->vra.avail_user_addr); 292 293 DPRINT("Setting virtq addresses:\n"); 294 DPRINT(" vring_desc at %p\n", vq->vring.desc); 295 DPRINT(" vring_used at %p\n", vq->vring.used); 296 DPRINT(" vring_avail at %p\n", vq->vring.avail); 297 298 return !(vq->vring.desc && vq->vring.used && vq->vring.avail); 299 } 300 301 static bool 302 vu_is_vq_usable(VuDev *dev, VuVirtq *vq) 303 { 304 if (unlikely(dev->broken)) { 305 return false; 306 } 307 308 if (likely(vq->vring.avail)) { 309 return true; 310 } 311 312 /* 313 * In corner cases, we might temporarily remove a memory region that 314 * mapped a ring. When removing a memory region we make sure to 315 * unmap any rings that would be impacted. Let's try to remap if we 316 * already succeeded mapping this ring once. 317 */ 318 if (!vq->vra.desc_user_addr || !vq->vra.used_user_addr || 319 !vq->vra.avail_user_addr) { 320 return false; 321 } 322 if (map_ring(dev, vq)) { 323 vu_panic(dev, "remapping queue on access"); 324 return false; 325 } 326 return true; 327 } 328 329 static void 330 unmap_rings(VuDev *dev, VuDevRegion *r) 331 { 332 int i; 333 334 for (i = 0; i < dev->max_queues; i++) { 335 VuVirtq *vq = &dev->vq[i]; 336 const uintptr_t desc = (uintptr_t)vq->vring.desc; 337 const uintptr_t used = (uintptr_t)vq->vring.used; 338 const uintptr_t avail = (uintptr_t)vq->vring.avail; 339 340 if (desc < r->mmap_addr || desc >= r->mmap_addr + r->size) { 341 continue; 342 } 343 if (used < r->mmap_addr || used >= r->mmap_addr + r->size) { 344 continue; 345 } 346 if (avail < r->mmap_addr || avail >= r->mmap_addr + r->size) { 347 continue; 348 } 349 350 DPRINT("Unmapping rings of queue %d\n", i); 351 vq->vring.desc = NULL; 352 vq->vring.used = NULL; 353 vq->vring.avail = NULL; 354 } 355 } 356 357 static size_t 358 get_fd_hugepagesize(int fd) 359 { 360 #if defined(__linux__) 361 struct statfs fs; 362 int ret; 363 364 do { 365 ret = fstatfs(fd, &fs); 366 } while (ret != 0 && errno == EINTR); 367 368 if (!ret && (unsigned int)fs.f_type == HUGETLBFS_MAGIC) { 369 return fs.f_bsize; 370 } 371 #endif 372 return 0; 373 } 374 375 static void 376 _vu_add_mem_reg(VuDev *dev, VhostUserMemoryRegion *msg_region, int fd) 377 { 378 const uint64_t start_gpa = msg_region->guest_phys_addr; 379 const uint64_t end_gpa = start_gpa + msg_region->memory_size; 380 int prot = PROT_READ | PROT_WRITE; 381 uint64_t mmap_offset, fd_offset; 382 size_t hugepagesize; 383 VuDevRegion *r; 384 void *mmap_addr; 385 int low = 0; 386 int high = dev->nregions - 1; 387 unsigned int idx; 388 389 DPRINT("Adding region %d\n", dev->nregions); 390 DPRINT(" guest_phys_addr: 0x%016"PRIx64"\n", 391 msg_region->guest_phys_addr); 392 DPRINT(" memory_size: 0x%016"PRIx64"\n", 393 msg_region->memory_size); 394 DPRINT(" userspace_addr: 0x%016"PRIx64"\n", 395 msg_region->userspace_addr); 396 DPRINT(" old mmap_offset: 0x%016"PRIx64"\n", 397 msg_region->mmap_offset); 398 399 if (dev->postcopy_listening) { 400 /* 401 * In postcopy we're using PROT_NONE here to catch anyone 402 * accessing it before we userfault 403 */ 404 prot = PROT_NONE; 405 } 406 407 /* 408 * We will add memory regions into the array sorted by GPA. Perform a 409 * binary search to locate the insertion point: it will be at the low 410 * index. 411 */ 412 while (low <= high) { 413 unsigned int mid = low + (high - low) / 2; 414 VuDevRegion *cur = &dev->regions[mid]; 415 416 /* Overlap of GPA addresses. */ 417 if (start_gpa < cur->gpa + cur->size && cur->gpa < end_gpa) { 418 vu_panic(dev, "regions with overlapping guest physical addresses"); 419 return; 420 } 421 if (start_gpa >= cur->gpa + cur->size) { 422 low = mid + 1; 423 } 424 if (start_gpa < cur->gpa) { 425 high = mid - 1; 426 } 427 } 428 idx = low; 429 430 /* 431 * Convert most of msg_region->mmap_offset to fd_offset. In almost all 432 * cases, this will leave us with mmap_offset == 0, mmap()'ing only 433 * what we really need. Only if a memory region would partially cover 434 * hugetlb pages, we'd get mmap_offset != 0, which usually doesn't happen 435 * anymore (i.e., modern QEMU). 436 * 437 * Note that mmap() with hugetlb would fail if the offset into the file 438 * is not aligned to the huge page size. 439 */ 440 hugepagesize = get_fd_hugepagesize(fd); 441 if (hugepagesize) { 442 fd_offset = ALIGN_DOWN(msg_region->mmap_offset, hugepagesize); 443 mmap_offset = msg_region->mmap_offset - fd_offset; 444 } else { 445 fd_offset = msg_region->mmap_offset; 446 mmap_offset = 0; 447 } 448 449 DPRINT(" fd_offset: 0x%016"PRIx64"\n", 450 fd_offset); 451 DPRINT(" new mmap_offset: 0x%016"PRIx64"\n", 452 mmap_offset); 453 454 mmap_addr = mmap(0, msg_region->memory_size + mmap_offset, 455 prot, MAP_SHARED | MAP_NORESERVE, fd, fd_offset); 456 if (mmap_addr == MAP_FAILED) { 457 vu_panic(dev, "region mmap error: %s", strerror(errno)); 458 return; 459 } 460 DPRINT(" mmap_addr: 0x%016"PRIx64"\n", 461 (uint64_t)(uintptr_t)mmap_addr); 462 463 #if defined(__linux__) 464 /* Don't include all guest memory in a coredump. */ 465 madvise(mmap_addr, msg_region->memory_size + mmap_offset, 466 MADV_DONTDUMP); 467 #endif 468 469 /* Shift all affected entries by 1 to open a hole at idx. */ 470 r = &dev->regions[idx]; 471 memmove(r + 1, r, sizeof(VuDevRegion) * (dev->nregions - idx)); 472 r->gpa = msg_region->guest_phys_addr; 473 r->size = msg_region->memory_size; 474 r->qva = msg_region->userspace_addr; 475 r->mmap_addr = (uint64_t)(uintptr_t)mmap_addr; 476 r->mmap_offset = mmap_offset; 477 dev->nregions++; 478 479 if (dev->postcopy_listening) { 480 /* 481 * Return the address to QEMU so that it can translate the ufd 482 * fault addresses back. 483 */ 484 msg_region->userspace_addr = r->mmap_addr + r->mmap_offset; 485 } 486 } 487 488 static void 489 vmsg_close_fds(VhostUserMsg *vmsg) 490 { 491 int i; 492 493 for (i = 0; i < vmsg->fd_num; i++) { 494 close(vmsg->fds[i]); 495 } 496 } 497 498 /* Set reply payload.u64 and clear request flags and fd_num */ 499 static void vmsg_set_reply_u64(VhostUserMsg *vmsg, uint64_t val) 500 { 501 vmsg->flags = 0; /* defaults will be set by vu_send_reply() */ 502 vmsg->size = sizeof(vmsg->payload.u64); 503 vmsg->payload.u64 = val; 504 vmsg->fd_num = 0; 505 } 506 507 /* A test to see if we have userfault available */ 508 static bool 509 have_userfault(void) 510 { 511 #if defined(__linux__) && defined(__NR_userfaultfd) &&\ 512 defined(UFFD_FEATURE_MISSING_SHMEM) &&\ 513 defined(UFFD_FEATURE_MISSING_HUGETLBFS) 514 /* Now test the kernel we're running on really has the features */ 515 int ufd = syscall(__NR_userfaultfd, O_CLOEXEC | O_NONBLOCK); 516 struct uffdio_api api_struct; 517 if (ufd < 0) { 518 return false; 519 } 520 521 api_struct.api = UFFD_API; 522 api_struct.features = UFFD_FEATURE_MISSING_SHMEM | 523 UFFD_FEATURE_MISSING_HUGETLBFS; 524 if (ioctl(ufd, UFFDIO_API, &api_struct)) { 525 close(ufd); 526 return false; 527 } 528 close(ufd); 529 return true; 530 531 #else 532 return false; 533 #endif 534 } 535 536 static bool 537 vu_message_read_default(VuDev *dev, int conn_fd, VhostUserMsg *vmsg) 538 { 539 char control[CMSG_SPACE(VHOST_MEMORY_BASELINE_NREGIONS * sizeof(int))] = {}; 540 struct iovec iov = { 541 .iov_base = (char *)vmsg, 542 .iov_len = VHOST_USER_HDR_SIZE, 543 }; 544 struct msghdr msg = { 545 .msg_iov = &iov, 546 .msg_iovlen = 1, 547 .msg_control = control, 548 .msg_controllen = sizeof(control), 549 }; 550 size_t fd_size; 551 struct cmsghdr *cmsg; 552 int rc; 553 554 do { 555 rc = recvmsg(conn_fd, &msg, 0); 556 } while (rc < 0 && (errno == EINTR || errno == EAGAIN)); 557 558 if (rc < 0) { 559 vu_panic(dev, "Error while recvmsg: %s", strerror(errno)); 560 return false; 561 } 562 563 vmsg->fd_num = 0; 564 for (cmsg = CMSG_FIRSTHDR(&msg); 565 cmsg != NULL; 566 cmsg = CMSG_NXTHDR(&msg, cmsg)) 567 { 568 if (cmsg->cmsg_level == SOL_SOCKET && cmsg->cmsg_type == SCM_RIGHTS) { 569 fd_size = cmsg->cmsg_len - CMSG_LEN(0); 570 vmsg->fd_num = fd_size / sizeof(int); 571 assert(vmsg->fd_num <= VHOST_MEMORY_BASELINE_NREGIONS); 572 memcpy(vmsg->fds, CMSG_DATA(cmsg), fd_size); 573 break; 574 } 575 } 576 577 if (vmsg->size > sizeof(vmsg->payload)) { 578 vu_panic(dev, 579 "Error: too big message request: %d, size: vmsg->size: %u, " 580 "while sizeof(vmsg->payload) = %zu\n", 581 vmsg->request, vmsg->size, sizeof(vmsg->payload)); 582 goto fail; 583 } 584 585 if (vmsg->size) { 586 do { 587 rc = read(conn_fd, &vmsg->payload, vmsg->size); 588 } while (rc < 0 && (errno == EINTR || errno == EAGAIN)); 589 590 if (rc <= 0) { 591 vu_panic(dev, "Error while reading: %s", strerror(errno)); 592 goto fail; 593 } 594 595 assert((uint32_t)rc == vmsg->size); 596 } 597 598 return true; 599 600 fail: 601 vmsg_close_fds(vmsg); 602 603 return false; 604 } 605 606 static bool 607 vu_message_write(VuDev *dev, int conn_fd, VhostUserMsg *vmsg) 608 { 609 int rc; 610 uint8_t *p = (uint8_t *)vmsg; 611 char control[CMSG_SPACE(VHOST_MEMORY_BASELINE_NREGIONS * sizeof(int))] = {}; 612 struct iovec iov = { 613 .iov_base = (char *)vmsg, 614 .iov_len = VHOST_USER_HDR_SIZE, 615 }; 616 struct msghdr msg = { 617 .msg_iov = &iov, 618 .msg_iovlen = 1, 619 .msg_control = control, 620 }; 621 struct cmsghdr *cmsg; 622 623 memset(control, 0, sizeof(control)); 624 assert(vmsg->fd_num <= VHOST_MEMORY_BASELINE_NREGIONS); 625 if (vmsg->fd_num > 0) { 626 size_t fdsize = vmsg->fd_num * sizeof(int); 627 msg.msg_controllen = CMSG_SPACE(fdsize); 628 cmsg = CMSG_FIRSTHDR(&msg); 629 cmsg->cmsg_len = CMSG_LEN(fdsize); 630 cmsg->cmsg_level = SOL_SOCKET; 631 cmsg->cmsg_type = SCM_RIGHTS; 632 memcpy(CMSG_DATA(cmsg), vmsg->fds, fdsize); 633 } else { 634 msg.msg_controllen = 0; 635 msg.msg_control = NULL; 636 } 637 638 do { 639 rc = sendmsg(conn_fd, &msg, 0); 640 } while (rc < 0 && (errno == EINTR || errno == EAGAIN)); 641 642 if (rc <= 0) { 643 vu_panic(dev, "Error while writing: %s", strerror(errno)); 644 return false; 645 } 646 647 if (vmsg->size) { 648 do { 649 if (vmsg->data) { 650 rc = write(conn_fd, vmsg->data, vmsg->size); 651 } else { 652 rc = write(conn_fd, p + VHOST_USER_HDR_SIZE, vmsg->size); 653 } 654 } while (rc < 0 && (errno == EINTR || errno == EAGAIN)); 655 } 656 657 if (rc <= 0) { 658 vu_panic(dev, "Error while writing: %s", strerror(errno)); 659 return false; 660 } 661 662 return true; 663 } 664 665 static bool 666 vu_send_reply(VuDev *dev, int conn_fd, VhostUserMsg *vmsg) 667 { 668 /* Set the version in the flags when sending the reply */ 669 vmsg->flags &= ~VHOST_USER_VERSION_MASK; 670 vmsg->flags |= VHOST_USER_VERSION; 671 vmsg->flags |= VHOST_USER_REPLY_MASK; 672 673 return vu_message_write(dev, conn_fd, vmsg); 674 } 675 676 /* 677 * Processes a reply on the backend channel. 678 * Entered with backend_mutex held and releases it before exit. 679 * Returns true on success. 680 */ 681 static bool 682 vu_process_message_reply(VuDev *dev, const VhostUserMsg *vmsg) 683 { 684 VhostUserMsg msg_reply; 685 bool result = false; 686 687 if ((vmsg->flags & VHOST_USER_NEED_REPLY_MASK) == 0) { 688 result = true; 689 goto out; 690 } 691 692 if (!vu_message_read_default(dev, dev->backend_fd, &msg_reply)) { 693 goto out; 694 } 695 696 if (msg_reply.request != vmsg->request) { 697 DPRINT("Received unexpected msg type. Expected %d received %d", 698 vmsg->request, msg_reply.request); 699 goto out; 700 } 701 702 result = msg_reply.payload.u64 == 0; 703 704 out: 705 pthread_mutex_unlock(&dev->backend_mutex); 706 return result; 707 } 708 709 /* Kick the log_call_fd if required. */ 710 static void 711 vu_log_kick(VuDev *dev) 712 { 713 if (dev->log_call_fd != -1) { 714 DPRINT("Kicking the QEMU's log...\n"); 715 if (eventfd_write(dev->log_call_fd, 1) < 0) { 716 vu_panic(dev, "Error writing eventfd: %s", strerror(errno)); 717 } 718 } 719 } 720 721 static void 722 vu_log_page(uint8_t *log_table, uint64_t page) 723 { 724 DPRINT("Logged dirty guest page: %"PRId64"\n", page); 725 qatomic_or(&log_table[page / 8], 1 << (page % 8)); 726 } 727 728 static void 729 vu_log_write(VuDev *dev, uint64_t address, uint64_t length) 730 { 731 uint64_t page; 732 733 if (!(dev->features & (1ULL << VHOST_F_LOG_ALL)) || 734 !dev->log_table || !length) { 735 return; 736 } 737 738 assert(dev->log_size > ((address + length - 1) / VHOST_LOG_PAGE / 8)); 739 740 page = address / VHOST_LOG_PAGE; 741 while (page * VHOST_LOG_PAGE < address + length) { 742 vu_log_page(dev->log_table, page); 743 page += 1; 744 } 745 746 vu_log_kick(dev); 747 } 748 749 static void 750 vu_kick_cb(VuDev *dev, int condition, void *data) 751 { 752 int index = (intptr_t)data; 753 VuVirtq *vq = &dev->vq[index]; 754 int sock = vq->kick_fd; 755 eventfd_t kick_data; 756 ssize_t rc; 757 758 rc = eventfd_read(sock, &kick_data); 759 if (rc == -1) { 760 vu_panic(dev, "kick eventfd_read(): %s", strerror(errno)); 761 dev->remove_watch(dev, dev->vq[index].kick_fd); 762 } else { 763 DPRINT("Got kick_data: %016"PRIx64" handler:%p idx:%d\n", 764 kick_data, vq->handler, index); 765 if (vq->handler) { 766 vq->handler(dev, index); 767 } 768 } 769 } 770 771 static bool 772 vu_get_features_exec(VuDev *dev, VhostUserMsg *vmsg) 773 { 774 vmsg->payload.u64 = 775 /* 776 * The following VIRTIO feature bits are supported by our virtqueue 777 * implementation: 778 */ 779 1ULL << VIRTIO_F_NOTIFY_ON_EMPTY | 780 1ULL << VIRTIO_RING_F_INDIRECT_DESC | 781 1ULL << VIRTIO_RING_F_EVENT_IDX | 782 1ULL << VIRTIO_F_VERSION_1 | 783 784 /* vhost-user feature bits */ 785 1ULL << VHOST_F_LOG_ALL | 786 1ULL << VHOST_USER_F_PROTOCOL_FEATURES; 787 788 if (dev->iface->get_features) { 789 vmsg->payload.u64 |= dev->iface->get_features(dev); 790 } 791 792 vmsg->size = sizeof(vmsg->payload.u64); 793 vmsg->fd_num = 0; 794 795 DPRINT("Sending back to guest u64: 0x%016"PRIx64"\n", vmsg->payload.u64); 796 797 return true; 798 } 799 800 static void 801 vu_set_enable_all_rings(VuDev *dev, bool enabled) 802 { 803 uint16_t i; 804 805 for (i = 0; i < dev->max_queues; i++) { 806 dev->vq[i].enable = enabled; 807 } 808 } 809 810 static bool 811 vu_set_features_exec(VuDev *dev, VhostUserMsg *vmsg) 812 { 813 DPRINT("u64: 0x%016"PRIx64"\n", vmsg->payload.u64); 814 815 dev->features = vmsg->payload.u64; 816 if (!vu_has_feature(dev, VIRTIO_F_VERSION_1)) { 817 /* 818 * We only support devices conforming to VIRTIO 1.0 or 819 * later 820 */ 821 vu_panic(dev, "virtio legacy devices aren't supported by libvhost-user"); 822 return false; 823 } 824 825 if (!(dev->features & VHOST_USER_F_PROTOCOL_FEATURES)) { 826 vu_set_enable_all_rings(dev, true); 827 } 828 829 if (dev->iface->set_features) { 830 dev->iface->set_features(dev, dev->features); 831 } 832 833 return false; 834 } 835 836 static bool 837 vu_set_owner_exec(VuDev *dev, VhostUserMsg *vmsg) 838 { 839 return false; 840 } 841 842 static void 843 vu_close_log(VuDev *dev) 844 { 845 if (dev->log_table) { 846 if (munmap(dev->log_table, dev->log_size) != 0) { 847 perror("close log munmap() error"); 848 } 849 850 dev->log_table = NULL; 851 } 852 if (dev->log_call_fd != -1) { 853 close(dev->log_call_fd); 854 dev->log_call_fd = -1; 855 } 856 } 857 858 static bool 859 vu_reset_device_exec(VuDev *dev, VhostUserMsg *vmsg) 860 { 861 vu_set_enable_all_rings(dev, false); 862 863 return false; 864 } 865 866 static bool 867 generate_faults(VuDev *dev) { 868 unsigned int i; 869 for (i = 0; i < dev->nregions; i++) { 870 #ifdef UFFDIO_REGISTER 871 VuDevRegion *dev_region = &dev->regions[i]; 872 int ret; 873 struct uffdio_register reg_struct; 874 875 /* 876 * We should already have an open ufd. Mark each memory 877 * range as ufd. 878 * Discard any mapping we have here; note I can't use MADV_REMOVE 879 * or fallocate to make the hole since I don't want to lose 880 * data that's already arrived in the shared process. 881 * TODO: How to do hugepage 882 */ 883 ret = madvise((void *)(uintptr_t)dev_region->mmap_addr, 884 dev_region->size + dev_region->mmap_offset, 885 MADV_DONTNEED); 886 if (ret) { 887 fprintf(stderr, 888 "%s: Failed to madvise(DONTNEED) region %d: %s\n", 889 __func__, i, strerror(errno)); 890 } 891 /* 892 * Turn off transparent hugepages so we dont get lose wakeups 893 * in neighbouring pages. 894 * TODO: Turn this backon later. 895 */ 896 ret = madvise((void *)(uintptr_t)dev_region->mmap_addr, 897 dev_region->size + dev_region->mmap_offset, 898 MADV_NOHUGEPAGE); 899 if (ret) { 900 /* 901 * Note: This can happen legally on kernels that are configured 902 * without madvise'able hugepages 903 */ 904 fprintf(stderr, 905 "%s: Failed to madvise(NOHUGEPAGE) region %d: %s\n", 906 __func__, i, strerror(errno)); 907 } 908 909 reg_struct.range.start = (uintptr_t)dev_region->mmap_addr; 910 reg_struct.range.len = dev_region->size + dev_region->mmap_offset; 911 reg_struct.mode = UFFDIO_REGISTER_MODE_MISSING; 912 913 if (ioctl(dev->postcopy_ufd, UFFDIO_REGISTER, ®_struct)) { 914 vu_panic(dev, "%s: Failed to userfault region %d " 915 "@%" PRIx64 " + size:%" PRIx64 " offset: %" PRIx64 916 ": (ufd=%d)%s\n", 917 __func__, i, 918 dev_region->mmap_addr, 919 dev_region->size, dev_region->mmap_offset, 920 dev->postcopy_ufd, strerror(errno)); 921 return false; 922 } 923 if (!(reg_struct.ioctls & (1ULL << _UFFDIO_COPY))) { 924 vu_panic(dev, "%s Region (%d) doesn't support COPY", 925 __func__, i); 926 return false; 927 } 928 DPRINT("%s: region %d: Registered userfault for %" 929 PRIx64 " + %" PRIx64 "\n", __func__, i, 930 (uint64_t)reg_struct.range.start, 931 (uint64_t)reg_struct.range.len); 932 /* Now it's registered we can let the client at it */ 933 if (mprotect((void *)(uintptr_t)dev_region->mmap_addr, 934 dev_region->size + dev_region->mmap_offset, 935 PROT_READ | PROT_WRITE)) { 936 vu_panic(dev, "failed to mprotect region %d for postcopy (%s)", 937 i, strerror(errno)); 938 return false; 939 } 940 /* TODO: Stash 'zero' support flags somewhere */ 941 #endif 942 } 943 944 return true; 945 } 946 947 static bool 948 vu_add_mem_reg(VuDev *dev, VhostUserMsg *vmsg) { 949 VhostUserMemoryRegion m = vmsg->payload.memreg.region, *msg_region = &m; 950 951 if (vmsg->fd_num != 1) { 952 vmsg_close_fds(vmsg); 953 vu_panic(dev, "VHOST_USER_ADD_MEM_REG received %d fds - only 1 fd " 954 "should be sent for this message type", vmsg->fd_num); 955 return false; 956 } 957 958 if (vmsg->size < VHOST_USER_MEM_REG_SIZE) { 959 close(vmsg->fds[0]); 960 vu_panic(dev, "VHOST_USER_ADD_MEM_REG requires a message size of at " 961 "least %zu bytes and only %d bytes were received", 962 VHOST_USER_MEM_REG_SIZE, vmsg->size); 963 return false; 964 } 965 966 if (dev->nregions == VHOST_USER_MAX_RAM_SLOTS) { 967 close(vmsg->fds[0]); 968 vu_panic(dev, "failing attempt to hot add memory via " 969 "VHOST_USER_ADD_MEM_REG message because the backend has " 970 "no free ram slots available"); 971 return false; 972 } 973 974 /* 975 * If we are in postcopy mode and we receive a u64 payload with a 0 value 976 * we know all the postcopy client bases have been received, and we 977 * should start generating faults. 978 */ 979 if (dev->postcopy_listening && 980 vmsg->size == sizeof(vmsg->payload.u64) && 981 vmsg->payload.u64 == 0) { 982 (void)generate_faults(dev); 983 return false; 984 } 985 986 _vu_add_mem_reg(dev, msg_region, vmsg->fds[0]); 987 close(vmsg->fds[0]); 988 989 if (dev->postcopy_listening) { 990 /* Send the message back to qemu with the addresses filled in. */ 991 vmsg->fd_num = 0; 992 DPRINT("Successfully added new region in postcopy\n"); 993 return true; 994 } 995 DPRINT("Successfully added new region\n"); 996 return false; 997 } 998 999 static inline bool reg_equal(VuDevRegion *vudev_reg, 1000 VhostUserMemoryRegion *msg_reg) 1001 { 1002 if (vudev_reg->gpa == msg_reg->guest_phys_addr && 1003 vudev_reg->qva == msg_reg->userspace_addr && 1004 vudev_reg->size == msg_reg->memory_size) { 1005 return true; 1006 } 1007 1008 return false; 1009 } 1010 1011 static bool 1012 vu_rem_mem_reg(VuDev *dev, VhostUserMsg *vmsg) { 1013 VhostUserMemoryRegion m = vmsg->payload.memreg.region, *msg_region = &m; 1014 unsigned int idx; 1015 VuDevRegion *r; 1016 1017 if (vmsg->fd_num > 1) { 1018 vmsg_close_fds(vmsg); 1019 vu_panic(dev, "VHOST_USER_REM_MEM_REG received %d fds - at most 1 fd " 1020 "should be sent for this message type", vmsg->fd_num); 1021 return false; 1022 } 1023 1024 if (vmsg->size < VHOST_USER_MEM_REG_SIZE) { 1025 vmsg_close_fds(vmsg); 1026 vu_panic(dev, "VHOST_USER_REM_MEM_REG requires a message size of at " 1027 "least %zu bytes and only %d bytes were received", 1028 VHOST_USER_MEM_REG_SIZE, vmsg->size); 1029 return false; 1030 } 1031 1032 DPRINT("Removing region:\n"); 1033 DPRINT(" guest_phys_addr: 0x%016"PRIx64"\n", 1034 msg_region->guest_phys_addr); 1035 DPRINT(" memory_size: 0x%016"PRIx64"\n", 1036 msg_region->memory_size); 1037 DPRINT(" userspace_addr 0x%016"PRIx64"\n", 1038 msg_region->userspace_addr); 1039 DPRINT(" mmap_offset 0x%016"PRIx64"\n", 1040 msg_region->mmap_offset); 1041 1042 r = vu_gpa_to_mem_region(dev, msg_region->guest_phys_addr); 1043 if (!r || !reg_equal(r, msg_region)) { 1044 vmsg_close_fds(vmsg); 1045 vu_panic(dev, "Specified region not found\n"); 1046 return false; 1047 } 1048 1049 /* 1050 * There might be valid cases where we temporarily remove memory regions 1051 * to readd them again, or remove memory regions and don't use the rings 1052 * anymore before we set the ring addresses and restart the device. 1053 * 1054 * Unmap all affected rings, remapping them on demand later. This should 1055 * be a corner case. 1056 */ 1057 unmap_rings(dev, r); 1058 1059 munmap((void *)(uintptr_t)r->mmap_addr, r->size + r->mmap_offset); 1060 1061 idx = r - dev->regions; 1062 assert(idx < dev->nregions); 1063 /* Shift all affected entries by 1 to close the hole. */ 1064 memmove(r, r + 1, sizeof(VuDevRegion) * (dev->nregions - idx - 1)); 1065 DPRINT("Successfully removed a region\n"); 1066 dev->nregions--; 1067 1068 vmsg_close_fds(vmsg); 1069 1070 return false; 1071 } 1072 1073 static bool 1074 vu_get_shared_object(VuDev *dev, VhostUserMsg *vmsg) 1075 { 1076 int fd_num = 0; 1077 int dmabuf_fd = -1; 1078 if (dev->iface->get_shared_object) { 1079 dmabuf_fd = dev->iface->get_shared_object( 1080 dev, &vmsg->payload.object.uuid[0]); 1081 } 1082 if (dmabuf_fd != -1) { 1083 DPRINT("dmabuf_fd found for requested UUID\n"); 1084 vmsg->fds[fd_num++] = dmabuf_fd; 1085 } 1086 vmsg->fd_num = fd_num; 1087 1088 return true; 1089 } 1090 1091 static bool 1092 vu_set_mem_table_exec(VuDev *dev, VhostUserMsg *vmsg) 1093 { 1094 VhostUserMemory m = vmsg->payload.memory, *memory = &m; 1095 unsigned int i; 1096 1097 vu_remove_all_mem_regs(dev); 1098 1099 DPRINT("Nregions: %u\n", memory->nregions); 1100 for (i = 0; i < memory->nregions; i++) { 1101 _vu_add_mem_reg(dev, &memory->regions[i], vmsg->fds[i]); 1102 close(vmsg->fds[i]); 1103 } 1104 1105 if (dev->postcopy_listening) { 1106 /* Send the message back to qemu with the addresses filled in */ 1107 vmsg->fd_num = 0; 1108 if (!vu_send_reply(dev, dev->sock, vmsg)) { 1109 vu_panic(dev, "failed to respond to set-mem-table for postcopy"); 1110 return false; 1111 } 1112 1113 /* 1114 * Wait for QEMU to confirm that it's registered the handler for the 1115 * faults. 1116 */ 1117 if (!dev->read_msg(dev, dev->sock, vmsg) || 1118 vmsg->size != sizeof(vmsg->payload.u64) || 1119 vmsg->payload.u64 != 0) { 1120 vu_panic(dev, "failed to receive valid ack for postcopy set-mem-table"); 1121 return false; 1122 } 1123 1124 /* OK, now we can go and register the memory and generate faults */ 1125 (void)generate_faults(dev); 1126 return false; 1127 } 1128 1129 for (i = 0; i < dev->max_queues; i++) { 1130 if (dev->vq[i].vring.desc) { 1131 if (map_ring(dev, &dev->vq[i])) { 1132 vu_panic(dev, "remapping queue %d during setmemtable", i); 1133 } 1134 } 1135 } 1136 1137 return false; 1138 } 1139 1140 static bool 1141 vu_set_log_base_exec(VuDev *dev, VhostUserMsg *vmsg) 1142 { 1143 int fd; 1144 uint64_t log_mmap_size, log_mmap_offset; 1145 void *rc; 1146 1147 if (vmsg->fd_num != 1 || 1148 vmsg->size != sizeof(vmsg->payload.log)) { 1149 vu_panic(dev, "Invalid log_base message"); 1150 return true; 1151 } 1152 1153 fd = vmsg->fds[0]; 1154 log_mmap_offset = vmsg->payload.log.mmap_offset; 1155 log_mmap_size = vmsg->payload.log.mmap_size; 1156 DPRINT("Log mmap_offset: %"PRId64"\n", log_mmap_offset); 1157 DPRINT("Log mmap_size: %"PRId64"\n", log_mmap_size); 1158 1159 rc = mmap(0, log_mmap_size, PROT_READ | PROT_WRITE, MAP_SHARED, fd, 1160 log_mmap_offset); 1161 close(fd); 1162 if (rc == MAP_FAILED) { 1163 perror("log mmap error"); 1164 } 1165 1166 if (dev->log_table) { 1167 munmap(dev->log_table, dev->log_size); 1168 } 1169 dev->log_table = rc; 1170 dev->log_size = log_mmap_size; 1171 1172 vmsg->size = sizeof(vmsg->payload.u64); 1173 vmsg->fd_num = 0; 1174 1175 return true; 1176 } 1177 1178 static bool 1179 vu_set_log_fd_exec(VuDev *dev, VhostUserMsg *vmsg) 1180 { 1181 if (vmsg->fd_num != 1) { 1182 vu_panic(dev, "Invalid log_fd message"); 1183 return false; 1184 } 1185 1186 if (dev->log_call_fd != -1) { 1187 close(dev->log_call_fd); 1188 } 1189 dev->log_call_fd = vmsg->fds[0]; 1190 DPRINT("Got log_call_fd: %d\n", vmsg->fds[0]); 1191 1192 return false; 1193 } 1194 1195 static bool 1196 vu_set_vring_num_exec(VuDev *dev, VhostUserMsg *vmsg) 1197 { 1198 unsigned int index = vmsg->payload.state.index; 1199 unsigned int num = vmsg->payload.state.num; 1200 1201 DPRINT("State.index: %u\n", index); 1202 DPRINT("State.num: %u\n", num); 1203 dev->vq[index].vring.num = num; 1204 1205 return false; 1206 } 1207 1208 static bool 1209 vu_set_vring_addr_exec(VuDev *dev, VhostUserMsg *vmsg) 1210 { 1211 struct vhost_vring_addr addr = vmsg->payload.addr, *vra = &addr; 1212 unsigned int index = vra->index; 1213 VuVirtq *vq = &dev->vq[index]; 1214 1215 DPRINT("vhost_vring_addr:\n"); 1216 DPRINT(" index: %d\n", vra->index); 1217 DPRINT(" flags: %d\n", vra->flags); 1218 DPRINT(" desc_user_addr: 0x%016" PRIx64 "\n", (uint64_t)vra->desc_user_addr); 1219 DPRINT(" used_user_addr: 0x%016" PRIx64 "\n", (uint64_t)vra->used_user_addr); 1220 DPRINT(" avail_user_addr: 0x%016" PRIx64 "\n", (uint64_t)vra->avail_user_addr); 1221 DPRINT(" log_guest_addr: 0x%016" PRIx64 "\n", (uint64_t)vra->log_guest_addr); 1222 1223 vq->vra = *vra; 1224 vq->vring.flags = vra->flags; 1225 vq->vring.log_guest_addr = vra->log_guest_addr; 1226 1227 1228 if (map_ring(dev, vq)) { 1229 vu_panic(dev, "Invalid vring_addr message"); 1230 return false; 1231 } 1232 1233 vq->used_idx = le16toh(vq->vring.used->idx); 1234 1235 if (vq->last_avail_idx != vq->used_idx) { 1236 bool resume = dev->iface->queue_is_processed_in_order && 1237 dev->iface->queue_is_processed_in_order(dev, index); 1238 1239 DPRINT("Last avail index != used index: %u != %u%s\n", 1240 vq->last_avail_idx, vq->used_idx, 1241 resume ? ", resuming" : ""); 1242 1243 if (resume) { 1244 vq->shadow_avail_idx = vq->last_avail_idx = vq->used_idx; 1245 } 1246 } 1247 1248 return false; 1249 } 1250 1251 static bool 1252 vu_set_vring_base_exec(VuDev *dev, VhostUserMsg *vmsg) 1253 { 1254 unsigned int index = vmsg->payload.state.index; 1255 unsigned int num = vmsg->payload.state.num; 1256 1257 DPRINT("State.index: %u\n", index); 1258 DPRINT("State.num: %u\n", num); 1259 dev->vq[index].shadow_avail_idx = dev->vq[index].last_avail_idx = num; 1260 1261 return false; 1262 } 1263 1264 static bool 1265 vu_get_vring_base_exec(VuDev *dev, VhostUserMsg *vmsg) 1266 { 1267 unsigned int index = vmsg->payload.state.index; 1268 1269 DPRINT("State.index: %u\n", index); 1270 vmsg->payload.state.num = dev->vq[index].last_avail_idx; 1271 vmsg->size = sizeof(vmsg->payload.state); 1272 1273 dev->vq[index].started = false; 1274 if (dev->iface->queue_set_started) { 1275 dev->iface->queue_set_started(dev, index, false); 1276 } 1277 1278 if (dev->vq[index].call_fd != -1) { 1279 close(dev->vq[index].call_fd); 1280 dev->vq[index].call_fd = -1; 1281 } 1282 if (dev->vq[index].kick_fd != -1) { 1283 dev->remove_watch(dev, dev->vq[index].kick_fd); 1284 close(dev->vq[index].kick_fd); 1285 dev->vq[index].kick_fd = -1; 1286 } 1287 1288 return true; 1289 } 1290 1291 static bool 1292 vu_check_queue_msg_file(VuDev *dev, VhostUserMsg *vmsg) 1293 { 1294 int index = vmsg->payload.u64 & VHOST_USER_VRING_IDX_MASK; 1295 bool nofd = vmsg->payload.u64 & VHOST_USER_VRING_NOFD_MASK; 1296 1297 if (index >= dev->max_queues) { 1298 vmsg_close_fds(vmsg); 1299 vu_panic(dev, "Invalid queue index: %u", index); 1300 return false; 1301 } 1302 1303 if (nofd) { 1304 vmsg_close_fds(vmsg); 1305 return true; 1306 } 1307 1308 if (vmsg->fd_num != 1) { 1309 vmsg_close_fds(vmsg); 1310 vu_panic(dev, "Invalid fds in request: %d", vmsg->request); 1311 return false; 1312 } 1313 1314 return true; 1315 } 1316 1317 static int 1318 inflight_desc_compare(const void *a, const void *b) 1319 { 1320 VuVirtqInflightDesc *desc0 = (VuVirtqInflightDesc *)a, 1321 *desc1 = (VuVirtqInflightDesc *)b; 1322 1323 if (desc1->counter > desc0->counter && 1324 (desc1->counter - desc0->counter) < VIRTQUEUE_MAX_SIZE * 2) { 1325 return 1; 1326 } 1327 1328 return -1; 1329 } 1330 1331 static int 1332 vu_check_queue_inflights(VuDev *dev, VuVirtq *vq) 1333 { 1334 int i = 0; 1335 1336 if (!vu_has_protocol_feature(dev, VHOST_USER_PROTOCOL_F_INFLIGHT_SHMFD)) { 1337 return 0; 1338 } 1339 1340 if (unlikely(!vq->inflight)) { 1341 return -1; 1342 } 1343 1344 if (unlikely(!vq->inflight->version)) { 1345 /* initialize the buffer */ 1346 vq->inflight->version = INFLIGHT_VERSION; 1347 return 0; 1348 } 1349 1350 vq->used_idx = le16toh(vq->vring.used->idx); 1351 vq->resubmit_num = 0; 1352 vq->resubmit_list = NULL; 1353 vq->counter = 0; 1354 1355 if (unlikely(vq->inflight->used_idx != vq->used_idx)) { 1356 vq->inflight->desc[vq->inflight->last_batch_head].inflight = 0; 1357 1358 barrier(); 1359 1360 vq->inflight->used_idx = vq->used_idx; 1361 } 1362 1363 for (i = 0; i < vq->inflight->desc_num; i++) { 1364 if (vq->inflight->desc[i].inflight == 1) { 1365 vq->inuse++; 1366 } 1367 } 1368 1369 vq->shadow_avail_idx = vq->last_avail_idx = vq->inuse + vq->used_idx; 1370 1371 if (vq->inuse) { 1372 vq->resubmit_list = calloc(vq->inuse, sizeof(VuVirtqInflightDesc)); 1373 if (!vq->resubmit_list) { 1374 return -1; 1375 } 1376 1377 for (i = 0; i < vq->inflight->desc_num; i++) { 1378 if (vq->inflight->desc[i].inflight) { 1379 vq->resubmit_list[vq->resubmit_num].index = i; 1380 vq->resubmit_list[vq->resubmit_num].counter = 1381 vq->inflight->desc[i].counter; 1382 vq->resubmit_num++; 1383 } 1384 } 1385 1386 if (vq->resubmit_num > 1) { 1387 qsort(vq->resubmit_list, vq->resubmit_num, 1388 sizeof(VuVirtqInflightDesc), inflight_desc_compare); 1389 } 1390 vq->counter = vq->resubmit_list[0].counter + 1; 1391 } 1392 1393 /* in case of I/O hang after reconnecting */ 1394 if (eventfd_write(vq->kick_fd, 1)) { 1395 return -1; 1396 } 1397 1398 return 0; 1399 } 1400 1401 static bool 1402 vu_set_vring_kick_exec(VuDev *dev, VhostUserMsg *vmsg) 1403 { 1404 int index = vmsg->payload.u64 & VHOST_USER_VRING_IDX_MASK; 1405 bool nofd = vmsg->payload.u64 & VHOST_USER_VRING_NOFD_MASK; 1406 1407 DPRINT("u64: 0x%016"PRIx64"\n", vmsg->payload.u64); 1408 1409 if (!vu_check_queue_msg_file(dev, vmsg)) { 1410 return false; 1411 } 1412 1413 if (dev->vq[index].kick_fd != -1) { 1414 dev->remove_watch(dev, dev->vq[index].kick_fd); 1415 close(dev->vq[index].kick_fd); 1416 dev->vq[index].kick_fd = -1; 1417 } 1418 1419 dev->vq[index].kick_fd = nofd ? -1 : vmsg->fds[0]; 1420 DPRINT("Got kick_fd: %d for vq: %d\n", dev->vq[index].kick_fd, index); 1421 1422 dev->vq[index].started = true; 1423 if (dev->iface->queue_set_started) { 1424 dev->iface->queue_set_started(dev, index, true); 1425 } 1426 1427 if (dev->vq[index].kick_fd != -1 && dev->vq[index].handler) { 1428 dev->set_watch(dev, dev->vq[index].kick_fd, VU_WATCH_IN, 1429 vu_kick_cb, (void *)(long)index); 1430 1431 DPRINT("Waiting for kicks on fd: %d for vq: %d\n", 1432 dev->vq[index].kick_fd, index); 1433 } 1434 1435 if (vu_check_queue_inflights(dev, &dev->vq[index])) { 1436 vu_panic(dev, "Failed to check inflights for vq: %d\n", index); 1437 } 1438 1439 return false; 1440 } 1441 1442 void vu_set_queue_handler(VuDev *dev, VuVirtq *vq, 1443 vu_queue_handler_cb handler) 1444 { 1445 int qidx = vq - dev->vq; 1446 1447 vq->handler = handler; 1448 if (vq->kick_fd >= 0) { 1449 if (handler) { 1450 dev->set_watch(dev, vq->kick_fd, VU_WATCH_IN, 1451 vu_kick_cb, (void *)(long)qidx); 1452 } else { 1453 dev->remove_watch(dev, vq->kick_fd); 1454 } 1455 } 1456 } 1457 1458 bool vu_set_queue_host_notifier(VuDev *dev, VuVirtq *vq, int fd, 1459 int size, int offset) 1460 { 1461 int qidx = vq - dev->vq; 1462 int fd_num = 0; 1463 VhostUserMsg vmsg = { 1464 .request = VHOST_USER_BACKEND_VRING_HOST_NOTIFIER_MSG, 1465 .flags = VHOST_USER_VERSION | VHOST_USER_NEED_REPLY_MASK, 1466 .size = sizeof(vmsg.payload.area), 1467 .payload.area = { 1468 .u64 = qidx & VHOST_USER_VRING_IDX_MASK, 1469 .size = size, 1470 .offset = offset, 1471 }, 1472 }; 1473 1474 if (fd == -1) { 1475 vmsg.payload.area.u64 |= VHOST_USER_VRING_NOFD_MASK; 1476 } else { 1477 vmsg.fds[fd_num++] = fd; 1478 } 1479 1480 vmsg.fd_num = fd_num; 1481 1482 if (!vu_has_protocol_feature(dev, VHOST_USER_PROTOCOL_F_BACKEND_SEND_FD)) { 1483 return false; 1484 } 1485 1486 pthread_mutex_lock(&dev->backend_mutex); 1487 if (!vu_message_write(dev, dev->backend_fd, &vmsg)) { 1488 pthread_mutex_unlock(&dev->backend_mutex); 1489 return false; 1490 } 1491 1492 /* Also unlocks the backend_mutex */ 1493 return vu_process_message_reply(dev, &vmsg); 1494 } 1495 1496 bool 1497 vu_lookup_shared_object(VuDev *dev, unsigned char uuid[UUID_LEN], 1498 int *dmabuf_fd) 1499 { 1500 bool result = false; 1501 VhostUserMsg msg_reply; 1502 VhostUserMsg msg = { 1503 .request = VHOST_USER_BACKEND_SHARED_OBJECT_LOOKUP, 1504 .size = sizeof(msg.payload.object), 1505 .flags = VHOST_USER_VERSION | VHOST_USER_NEED_REPLY_MASK, 1506 }; 1507 1508 memcpy(msg.payload.object.uuid, uuid, sizeof(uuid[0]) * UUID_LEN); 1509 1510 if (!vu_has_protocol_feature(dev, VHOST_USER_PROTOCOL_F_SHARED_OBJECT)) { 1511 return false; 1512 } 1513 1514 pthread_mutex_lock(&dev->backend_mutex); 1515 if (!vu_message_write(dev, dev->backend_fd, &msg)) { 1516 goto out; 1517 } 1518 1519 if (!vu_message_read_default(dev, dev->backend_fd, &msg_reply)) { 1520 goto out; 1521 } 1522 1523 if (msg_reply.request != msg.request) { 1524 DPRINT("Received unexpected msg type. Expected %d, received %d", 1525 msg.request, msg_reply.request); 1526 goto out; 1527 } 1528 1529 if (msg_reply.fd_num != 1) { 1530 DPRINT("Received unexpected number of fds. Expected 1, received %d", 1531 msg_reply.fd_num); 1532 goto out; 1533 } 1534 1535 *dmabuf_fd = msg_reply.fds[0]; 1536 result = *dmabuf_fd > 0 && msg_reply.payload.u64 == 0; 1537 out: 1538 pthread_mutex_unlock(&dev->backend_mutex); 1539 1540 return result; 1541 } 1542 1543 static bool 1544 vu_send_message(VuDev *dev, VhostUserMsg *vmsg) 1545 { 1546 bool result = false; 1547 pthread_mutex_lock(&dev->backend_mutex); 1548 if (!vu_message_write(dev, dev->backend_fd, vmsg)) { 1549 goto out; 1550 } 1551 1552 result = true; 1553 out: 1554 pthread_mutex_unlock(&dev->backend_mutex); 1555 1556 return result; 1557 } 1558 1559 bool 1560 vu_add_shared_object(VuDev *dev, unsigned char uuid[UUID_LEN]) 1561 { 1562 VhostUserMsg msg = { 1563 .request = VHOST_USER_BACKEND_SHARED_OBJECT_ADD, 1564 .size = sizeof(msg.payload.object), 1565 .flags = VHOST_USER_VERSION, 1566 }; 1567 1568 memcpy(msg.payload.object.uuid, uuid, sizeof(uuid[0]) * UUID_LEN); 1569 1570 if (!vu_has_protocol_feature(dev, VHOST_USER_PROTOCOL_F_SHARED_OBJECT)) { 1571 return false; 1572 } 1573 1574 return vu_send_message(dev, &msg); 1575 } 1576 1577 bool 1578 vu_rm_shared_object(VuDev *dev, unsigned char uuid[UUID_LEN]) 1579 { 1580 VhostUserMsg msg = { 1581 .request = VHOST_USER_BACKEND_SHARED_OBJECT_REMOVE, 1582 .size = sizeof(msg.payload.object), 1583 .flags = VHOST_USER_VERSION, 1584 }; 1585 1586 memcpy(msg.payload.object.uuid, uuid, sizeof(uuid[0]) * UUID_LEN); 1587 1588 if (!vu_has_protocol_feature(dev, VHOST_USER_PROTOCOL_F_SHARED_OBJECT)) { 1589 return false; 1590 } 1591 1592 return vu_send_message(dev, &msg); 1593 } 1594 1595 static bool 1596 vu_set_vring_call_exec(VuDev *dev, VhostUserMsg *vmsg) 1597 { 1598 int index = vmsg->payload.u64 & VHOST_USER_VRING_IDX_MASK; 1599 bool nofd = vmsg->payload.u64 & VHOST_USER_VRING_NOFD_MASK; 1600 1601 DPRINT("u64: 0x%016"PRIx64"\n", vmsg->payload.u64); 1602 1603 if (!vu_check_queue_msg_file(dev, vmsg)) { 1604 return false; 1605 } 1606 1607 if (dev->vq[index].call_fd != -1) { 1608 close(dev->vq[index].call_fd); 1609 dev->vq[index].call_fd = -1; 1610 } 1611 1612 dev->vq[index].call_fd = nofd ? -1 : vmsg->fds[0]; 1613 1614 /* in case of I/O hang after reconnecting */ 1615 if (dev->vq[index].call_fd != -1 && eventfd_write(vmsg->fds[0], 1)) { 1616 return -1; 1617 } 1618 1619 DPRINT("Got call_fd: %d for vq: %d\n", dev->vq[index].call_fd, index); 1620 1621 return false; 1622 } 1623 1624 static bool 1625 vu_set_vring_err_exec(VuDev *dev, VhostUserMsg *vmsg) 1626 { 1627 int index = vmsg->payload.u64 & VHOST_USER_VRING_IDX_MASK; 1628 bool nofd = vmsg->payload.u64 & VHOST_USER_VRING_NOFD_MASK; 1629 1630 DPRINT("u64: 0x%016"PRIx64"\n", vmsg->payload.u64); 1631 1632 if (!vu_check_queue_msg_file(dev, vmsg)) { 1633 return false; 1634 } 1635 1636 if (dev->vq[index].err_fd != -1) { 1637 close(dev->vq[index].err_fd); 1638 dev->vq[index].err_fd = -1; 1639 } 1640 1641 dev->vq[index].err_fd = nofd ? -1 : vmsg->fds[0]; 1642 1643 return false; 1644 } 1645 1646 static bool 1647 vu_get_protocol_features_exec(VuDev *dev, VhostUserMsg *vmsg) 1648 { 1649 /* 1650 * Note that we support, but intentionally do not set, 1651 * VHOST_USER_PROTOCOL_F_INBAND_NOTIFICATIONS. This means that 1652 * a device implementation can return it in its callback 1653 * (get_protocol_features) if it wants to use this for 1654 * simulation, but it is otherwise not desirable (if even 1655 * implemented by the frontend.) 1656 */ 1657 uint64_t features = 1ULL << VHOST_USER_PROTOCOL_F_MQ | 1658 1ULL << VHOST_USER_PROTOCOL_F_LOG_SHMFD | 1659 1ULL << VHOST_USER_PROTOCOL_F_BACKEND_REQ | 1660 1ULL << VHOST_USER_PROTOCOL_F_HOST_NOTIFIER | 1661 1ULL << VHOST_USER_PROTOCOL_F_BACKEND_SEND_FD | 1662 1ULL << VHOST_USER_PROTOCOL_F_REPLY_ACK | 1663 1ULL << VHOST_USER_PROTOCOL_F_CONFIGURE_MEM_SLOTS; 1664 1665 if (have_userfault()) { 1666 features |= 1ULL << VHOST_USER_PROTOCOL_F_PAGEFAULT; 1667 } 1668 1669 if (dev->iface->get_config && dev->iface->set_config) { 1670 features |= 1ULL << VHOST_USER_PROTOCOL_F_CONFIG; 1671 } 1672 1673 if (dev->iface->get_protocol_features) { 1674 features |= dev->iface->get_protocol_features(dev); 1675 } 1676 1677 vmsg_set_reply_u64(vmsg, features); 1678 return true; 1679 } 1680 1681 static bool 1682 vu_set_protocol_features_exec(VuDev *dev, VhostUserMsg *vmsg) 1683 { 1684 uint64_t features = vmsg->payload.u64; 1685 1686 DPRINT("u64: 0x%016"PRIx64"\n", features); 1687 1688 dev->protocol_features = vmsg->payload.u64; 1689 1690 if (vu_has_protocol_feature(dev, 1691 VHOST_USER_PROTOCOL_F_INBAND_NOTIFICATIONS) && 1692 (!vu_has_protocol_feature(dev, VHOST_USER_PROTOCOL_F_BACKEND_REQ) || 1693 !vu_has_protocol_feature(dev, VHOST_USER_PROTOCOL_F_REPLY_ACK))) { 1694 /* 1695 * The use case for using messages for kick/call is simulation, to make 1696 * the kick and call synchronous. To actually get that behaviour, both 1697 * of the other features are required. 1698 * Theoretically, one could use only kick messages, or do them without 1699 * having F_REPLY_ACK, but too many (possibly pending) messages on the 1700 * socket will eventually cause the frontend to hang, to avoid this in 1701 * scenarios where not desired enforce that the settings are in a way 1702 * that actually enables the simulation case. 1703 */ 1704 vu_panic(dev, 1705 "F_IN_BAND_NOTIFICATIONS requires F_BACKEND_REQ && F_REPLY_ACK"); 1706 return false; 1707 } 1708 1709 if (dev->iface->set_protocol_features) { 1710 dev->iface->set_protocol_features(dev, features); 1711 } 1712 1713 return false; 1714 } 1715 1716 static bool 1717 vu_get_queue_num_exec(VuDev *dev, VhostUserMsg *vmsg) 1718 { 1719 vmsg_set_reply_u64(vmsg, dev->max_queues); 1720 return true; 1721 } 1722 1723 static bool 1724 vu_set_vring_enable_exec(VuDev *dev, VhostUserMsg *vmsg) 1725 { 1726 unsigned int index = vmsg->payload.state.index; 1727 unsigned int enable = vmsg->payload.state.num; 1728 1729 DPRINT("State.index: %u\n", index); 1730 DPRINT("State.enable: %u\n", enable); 1731 1732 if (index >= dev->max_queues) { 1733 vu_panic(dev, "Invalid vring_enable index: %u", index); 1734 return false; 1735 } 1736 1737 dev->vq[index].enable = enable; 1738 return false; 1739 } 1740 1741 static bool 1742 vu_set_backend_req_fd(VuDev *dev, VhostUserMsg *vmsg) 1743 { 1744 if (vmsg->fd_num != 1) { 1745 vu_panic(dev, "Invalid backend_req_fd message (%d fd's)", vmsg->fd_num); 1746 return false; 1747 } 1748 1749 if (dev->backend_fd != -1) { 1750 close(dev->backend_fd); 1751 } 1752 dev->backend_fd = vmsg->fds[0]; 1753 DPRINT("Got backend_fd: %d\n", vmsg->fds[0]); 1754 1755 return false; 1756 } 1757 1758 static bool 1759 vu_get_config(VuDev *dev, VhostUserMsg *vmsg) 1760 { 1761 int ret = -1; 1762 1763 if (dev->iface->get_config) { 1764 ret = dev->iface->get_config(dev, vmsg->payload.config.region, 1765 vmsg->payload.config.size); 1766 } 1767 1768 if (ret) { 1769 /* resize to zero to indicate an error to frontend */ 1770 vmsg->size = 0; 1771 } 1772 1773 return true; 1774 } 1775 1776 static bool 1777 vu_set_config(VuDev *dev, VhostUserMsg *vmsg) 1778 { 1779 int ret = -1; 1780 1781 if (dev->iface->set_config) { 1782 ret = dev->iface->set_config(dev, vmsg->payload.config.region, 1783 vmsg->payload.config.offset, 1784 vmsg->payload.config.size, 1785 vmsg->payload.config.flags); 1786 if (ret) { 1787 vu_panic(dev, "Set virtio configuration space failed"); 1788 } 1789 } 1790 1791 return false; 1792 } 1793 1794 static bool 1795 vu_set_postcopy_advise(VuDev *dev, VhostUserMsg *vmsg) 1796 { 1797 #ifdef UFFDIO_API 1798 struct uffdio_api api_struct; 1799 1800 dev->postcopy_ufd = syscall(__NR_userfaultfd, O_CLOEXEC | O_NONBLOCK); 1801 vmsg->size = 0; 1802 #else 1803 dev->postcopy_ufd = -1; 1804 #endif 1805 1806 if (dev->postcopy_ufd == -1) { 1807 vu_panic(dev, "Userfaultfd not available: %s", strerror(errno)); 1808 goto out; 1809 } 1810 1811 #ifdef UFFDIO_API 1812 api_struct.api = UFFD_API; 1813 api_struct.features = 0; 1814 if (ioctl(dev->postcopy_ufd, UFFDIO_API, &api_struct)) { 1815 vu_panic(dev, "Failed UFFDIO_API: %s", strerror(errno)); 1816 close(dev->postcopy_ufd); 1817 dev->postcopy_ufd = -1; 1818 goto out; 1819 } 1820 /* TODO: Stash feature flags somewhere */ 1821 #endif 1822 1823 out: 1824 /* Return a ufd to the QEMU */ 1825 vmsg->fd_num = 1; 1826 vmsg->fds[0] = dev->postcopy_ufd; 1827 return true; /* = send a reply */ 1828 } 1829 1830 static bool 1831 vu_set_postcopy_listen(VuDev *dev, VhostUserMsg *vmsg) 1832 { 1833 if (dev->nregions) { 1834 vu_panic(dev, "Regions already registered at postcopy-listen"); 1835 vmsg_set_reply_u64(vmsg, -1); 1836 return true; 1837 } 1838 dev->postcopy_listening = true; 1839 1840 vmsg_set_reply_u64(vmsg, 0); 1841 return true; 1842 } 1843 1844 static bool 1845 vu_set_postcopy_end(VuDev *dev, VhostUserMsg *vmsg) 1846 { 1847 DPRINT("%s: Entry\n", __func__); 1848 dev->postcopy_listening = false; 1849 if (dev->postcopy_ufd > 0) { 1850 close(dev->postcopy_ufd); 1851 dev->postcopy_ufd = -1; 1852 DPRINT("%s: Done close\n", __func__); 1853 } 1854 1855 vmsg_set_reply_u64(vmsg, 0); 1856 DPRINT("%s: exit\n", __func__); 1857 return true; 1858 } 1859 1860 static inline uint64_t 1861 vu_inflight_queue_size(uint16_t queue_size) 1862 { 1863 return ALIGN_UP(sizeof(VuDescStateSplit) * queue_size + 1864 sizeof(uint16_t), INFLIGHT_ALIGNMENT); 1865 } 1866 1867 #ifdef MFD_ALLOW_SEALING 1868 static void * 1869 memfd_alloc(const char *name, size_t size, unsigned int flags, int *fd) 1870 { 1871 void *ptr; 1872 int ret; 1873 1874 *fd = memfd_create(name, MFD_ALLOW_SEALING); 1875 if (*fd < 0) { 1876 return NULL; 1877 } 1878 1879 ret = ftruncate(*fd, size); 1880 if (ret < 0) { 1881 close(*fd); 1882 return NULL; 1883 } 1884 1885 ret = fcntl(*fd, F_ADD_SEALS, flags); 1886 if (ret < 0) { 1887 close(*fd); 1888 return NULL; 1889 } 1890 1891 ptr = mmap(0, size, PROT_READ | PROT_WRITE, MAP_SHARED, *fd, 0); 1892 if (ptr == MAP_FAILED) { 1893 close(*fd); 1894 return NULL; 1895 } 1896 1897 return ptr; 1898 } 1899 #endif 1900 1901 static bool 1902 vu_get_inflight_fd(VuDev *dev, VhostUserMsg *vmsg) 1903 { 1904 int fd = -1; 1905 void *addr = NULL; 1906 uint64_t mmap_size; 1907 uint16_t num_queues, queue_size; 1908 1909 if (vmsg->size != sizeof(vmsg->payload.inflight)) { 1910 vu_panic(dev, "Invalid get_inflight_fd message:%d", vmsg->size); 1911 vmsg->payload.inflight.mmap_size = 0; 1912 return true; 1913 } 1914 1915 num_queues = vmsg->payload.inflight.num_queues; 1916 queue_size = vmsg->payload.inflight.queue_size; 1917 1918 DPRINT("set_inflight_fd num_queues: %"PRId16"\n", num_queues); 1919 DPRINT("set_inflight_fd queue_size: %"PRId16"\n", queue_size); 1920 1921 mmap_size = vu_inflight_queue_size(queue_size) * num_queues; 1922 1923 #ifdef MFD_ALLOW_SEALING 1924 addr = memfd_alloc("vhost-inflight", mmap_size, 1925 F_SEAL_GROW | F_SEAL_SHRINK | F_SEAL_SEAL, 1926 &fd); 1927 #else 1928 vu_panic(dev, "Not implemented: memfd support is missing"); 1929 #endif 1930 1931 if (!addr) { 1932 vu_panic(dev, "Failed to alloc vhost inflight area"); 1933 vmsg->payload.inflight.mmap_size = 0; 1934 return true; 1935 } 1936 1937 memset(addr, 0, mmap_size); 1938 1939 dev->inflight_info.addr = addr; 1940 dev->inflight_info.size = vmsg->payload.inflight.mmap_size = mmap_size; 1941 dev->inflight_info.fd = vmsg->fds[0] = fd; 1942 vmsg->fd_num = 1; 1943 vmsg->payload.inflight.mmap_offset = 0; 1944 1945 DPRINT("send inflight mmap_size: %"PRId64"\n", 1946 vmsg->payload.inflight.mmap_size); 1947 DPRINT("send inflight mmap offset: %"PRId64"\n", 1948 vmsg->payload.inflight.mmap_offset); 1949 1950 return true; 1951 } 1952 1953 static bool 1954 vu_set_inflight_fd(VuDev *dev, VhostUserMsg *vmsg) 1955 { 1956 int fd, i; 1957 uint64_t mmap_size, mmap_offset; 1958 uint16_t num_queues, queue_size; 1959 void *rc; 1960 1961 if (vmsg->fd_num != 1 || 1962 vmsg->size != sizeof(vmsg->payload.inflight)) { 1963 vu_panic(dev, "Invalid set_inflight_fd message size:%d fds:%d", 1964 vmsg->size, vmsg->fd_num); 1965 return false; 1966 } 1967 1968 fd = vmsg->fds[0]; 1969 mmap_size = vmsg->payload.inflight.mmap_size; 1970 mmap_offset = vmsg->payload.inflight.mmap_offset; 1971 num_queues = vmsg->payload.inflight.num_queues; 1972 queue_size = vmsg->payload.inflight.queue_size; 1973 1974 DPRINT("set_inflight_fd mmap_size: %"PRId64"\n", mmap_size); 1975 DPRINT("set_inflight_fd mmap_offset: %"PRId64"\n", mmap_offset); 1976 DPRINT("set_inflight_fd num_queues: %"PRId16"\n", num_queues); 1977 DPRINT("set_inflight_fd queue_size: %"PRId16"\n", queue_size); 1978 1979 rc = mmap(0, mmap_size, PROT_READ | PROT_WRITE, MAP_SHARED, 1980 fd, mmap_offset); 1981 1982 if (rc == MAP_FAILED) { 1983 vu_panic(dev, "set_inflight_fd mmap error: %s", strerror(errno)); 1984 return false; 1985 } 1986 1987 if (dev->inflight_info.fd) { 1988 close(dev->inflight_info.fd); 1989 } 1990 1991 if (dev->inflight_info.addr) { 1992 munmap(dev->inflight_info.addr, dev->inflight_info.size); 1993 } 1994 1995 dev->inflight_info.fd = fd; 1996 dev->inflight_info.addr = rc; 1997 dev->inflight_info.size = mmap_size; 1998 1999 for (i = 0; i < num_queues; i++) { 2000 dev->vq[i].inflight = (VuVirtqInflight *)rc; 2001 dev->vq[i].inflight->desc_num = queue_size; 2002 rc = (void *)((char *)rc + vu_inflight_queue_size(queue_size)); 2003 } 2004 2005 return false; 2006 } 2007 2008 static bool 2009 vu_handle_vring_kick(VuDev *dev, VhostUserMsg *vmsg) 2010 { 2011 unsigned int index = vmsg->payload.state.index; 2012 2013 if (index >= dev->max_queues) { 2014 vu_panic(dev, "Invalid queue index: %u", index); 2015 return false; 2016 } 2017 2018 DPRINT("Got kick message: handler:%p idx:%u\n", 2019 dev->vq[index].handler, index); 2020 2021 if (!dev->vq[index].started) { 2022 dev->vq[index].started = true; 2023 2024 if (dev->iface->queue_set_started) { 2025 dev->iface->queue_set_started(dev, index, true); 2026 } 2027 } 2028 2029 if (dev->vq[index].handler) { 2030 dev->vq[index].handler(dev, index); 2031 } 2032 2033 return false; 2034 } 2035 2036 static bool vu_handle_get_max_memslots(VuDev *dev, VhostUserMsg *vmsg) 2037 { 2038 vmsg_set_reply_u64(vmsg, VHOST_USER_MAX_RAM_SLOTS); 2039 2040 DPRINT("u64: 0x%016"PRIx64"\n", (uint64_t) VHOST_USER_MAX_RAM_SLOTS); 2041 2042 return true; 2043 } 2044 2045 static bool 2046 vu_process_message(VuDev *dev, VhostUserMsg *vmsg) 2047 { 2048 int do_reply = 0; 2049 2050 /* Print out generic part of the request. */ 2051 DPRINT("================ Vhost user message ================\n"); 2052 DPRINT("Request: %s (%d)\n", vu_request_to_string(vmsg->request), 2053 vmsg->request); 2054 DPRINT("Flags: 0x%x\n", vmsg->flags); 2055 DPRINT("Size: %u\n", vmsg->size); 2056 2057 if (vmsg->fd_num) { 2058 int i; 2059 DPRINT("Fds:"); 2060 for (i = 0; i < vmsg->fd_num; i++) { 2061 DPRINT(" %d", vmsg->fds[i]); 2062 } 2063 DPRINT("\n"); 2064 } 2065 2066 if (dev->iface->process_msg && 2067 dev->iface->process_msg(dev, vmsg, &do_reply)) { 2068 return do_reply; 2069 } 2070 2071 switch (vmsg->request) { 2072 case VHOST_USER_GET_FEATURES: 2073 return vu_get_features_exec(dev, vmsg); 2074 case VHOST_USER_SET_FEATURES: 2075 return vu_set_features_exec(dev, vmsg); 2076 case VHOST_USER_GET_PROTOCOL_FEATURES: 2077 return vu_get_protocol_features_exec(dev, vmsg); 2078 case VHOST_USER_SET_PROTOCOL_FEATURES: 2079 return vu_set_protocol_features_exec(dev, vmsg); 2080 case VHOST_USER_SET_OWNER: 2081 return vu_set_owner_exec(dev, vmsg); 2082 case VHOST_USER_RESET_OWNER: 2083 return vu_reset_device_exec(dev, vmsg); 2084 case VHOST_USER_SET_MEM_TABLE: 2085 return vu_set_mem_table_exec(dev, vmsg); 2086 case VHOST_USER_SET_LOG_BASE: 2087 return vu_set_log_base_exec(dev, vmsg); 2088 case VHOST_USER_SET_LOG_FD: 2089 return vu_set_log_fd_exec(dev, vmsg); 2090 case VHOST_USER_SET_VRING_NUM: 2091 return vu_set_vring_num_exec(dev, vmsg); 2092 case VHOST_USER_SET_VRING_ADDR: 2093 return vu_set_vring_addr_exec(dev, vmsg); 2094 case VHOST_USER_SET_VRING_BASE: 2095 return vu_set_vring_base_exec(dev, vmsg); 2096 case VHOST_USER_GET_VRING_BASE: 2097 return vu_get_vring_base_exec(dev, vmsg); 2098 case VHOST_USER_SET_VRING_KICK: 2099 return vu_set_vring_kick_exec(dev, vmsg); 2100 case VHOST_USER_SET_VRING_CALL: 2101 return vu_set_vring_call_exec(dev, vmsg); 2102 case VHOST_USER_SET_VRING_ERR: 2103 return vu_set_vring_err_exec(dev, vmsg); 2104 case VHOST_USER_GET_QUEUE_NUM: 2105 return vu_get_queue_num_exec(dev, vmsg); 2106 case VHOST_USER_SET_VRING_ENABLE: 2107 return vu_set_vring_enable_exec(dev, vmsg); 2108 case VHOST_USER_SET_BACKEND_REQ_FD: 2109 return vu_set_backend_req_fd(dev, vmsg); 2110 case VHOST_USER_GET_CONFIG: 2111 return vu_get_config(dev, vmsg); 2112 case VHOST_USER_SET_CONFIG: 2113 return vu_set_config(dev, vmsg); 2114 case VHOST_USER_NONE: 2115 /* if you need processing before exit, override iface->process_msg */ 2116 exit(0); 2117 case VHOST_USER_POSTCOPY_ADVISE: 2118 return vu_set_postcopy_advise(dev, vmsg); 2119 case VHOST_USER_POSTCOPY_LISTEN: 2120 return vu_set_postcopy_listen(dev, vmsg); 2121 case VHOST_USER_POSTCOPY_END: 2122 return vu_set_postcopy_end(dev, vmsg); 2123 case VHOST_USER_GET_INFLIGHT_FD: 2124 return vu_get_inflight_fd(dev, vmsg); 2125 case VHOST_USER_SET_INFLIGHT_FD: 2126 return vu_set_inflight_fd(dev, vmsg); 2127 case VHOST_USER_VRING_KICK: 2128 return vu_handle_vring_kick(dev, vmsg); 2129 case VHOST_USER_GET_MAX_MEM_SLOTS: 2130 return vu_handle_get_max_memslots(dev, vmsg); 2131 case VHOST_USER_ADD_MEM_REG: 2132 return vu_add_mem_reg(dev, vmsg); 2133 case VHOST_USER_REM_MEM_REG: 2134 return vu_rem_mem_reg(dev, vmsg); 2135 case VHOST_USER_GET_SHARED_OBJECT: 2136 return vu_get_shared_object(dev, vmsg); 2137 default: 2138 vmsg_close_fds(vmsg); 2139 vu_panic(dev, "Unhandled request: %d", vmsg->request); 2140 } 2141 2142 return false; 2143 } 2144 2145 bool 2146 vu_dispatch(VuDev *dev) 2147 { 2148 VhostUserMsg vmsg = { 0, }; 2149 int reply_requested; 2150 bool need_reply, success = false; 2151 2152 if (!dev->read_msg(dev, dev->sock, &vmsg)) { 2153 goto end; 2154 } 2155 2156 need_reply = vmsg.flags & VHOST_USER_NEED_REPLY_MASK; 2157 2158 reply_requested = vu_process_message(dev, &vmsg); 2159 if (!reply_requested && need_reply) { 2160 vmsg_set_reply_u64(&vmsg, 0); 2161 reply_requested = 1; 2162 } 2163 2164 if (!reply_requested) { 2165 success = true; 2166 goto end; 2167 } 2168 2169 if (!vu_send_reply(dev, dev->sock, &vmsg)) { 2170 goto end; 2171 } 2172 2173 success = true; 2174 2175 end: 2176 free(vmsg.data); 2177 return success; 2178 } 2179 2180 void 2181 vu_deinit(VuDev *dev) 2182 { 2183 unsigned int i; 2184 2185 vu_remove_all_mem_regs(dev); 2186 2187 for (i = 0; i < dev->max_queues; i++) { 2188 VuVirtq *vq = &dev->vq[i]; 2189 2190 if (vq->call_fd != -1) { 2191 close(vq->call_fd); 2192 vq->call_fd = -1; 2193 } 2194 2195 if (vq->kick_fd != -1) { 2196 dev->remove_watch(dev, vq->kick_fd); 2197 close(vq->kick_fd); 2198 vq->kick_fd = -1; 2199 } 2200 2201 if (vq->err_fd != -1) { 2202 close(vq->err_fd); 2203 vq->err_fd = -1; 2204 } 2205 2206 if (vq->resubmit_list) { 2207 free(vq->resubmit_list); 2208 vq->resubmit_list = NULL; 2209 } 2210 2211 vq->inflight = NULL; 2212 } 2213 2214 if (dev->inflight_info.addr) { 2215 munmap(dev->inflight_info.addr, dev->inflight_info.size); 2216 dev->inflight_info.addr = NULL; 2217 } 2218 2219 if (dev->inflight_info.fd > 0) { 2220 close(dev->inflight_info.fd); 2221 dev->inflight_info.fd = -1; 2222 } 2223 2224 vu_close_log(dev); 2225 if (dev->backend_fd != -1) { 2226 close(dev->backend_fd); 2227 dev->backend_fd = -1; 2228 } 2229 pthread_mutex_destroy(&dev->backend_mutex); 2230 2231 if (dev->sock != -1) { 2232 close(dev->sock); 2233 } 2234 2235 free(dev->vq); 2236 dev->vq = NULL; 2237 free(dev->regions); 2238 dev->regions = NULL; 2239 } 2240 2241 bool 2242 vu_init(VuDev *dev, 2243 uint16_t max_queues, 2244 int socket, 2245 vu_panic_cb panic, 2246 vu_read_msg_cb read_msg, 2247 vu_set_watch_cb set_watch, 2248 vu_remove_watch_cb remove_watch, 2249 const VuDevIface *iface) 2250 { 2251 uint16_t i; 2252 2253 assert(max_queues > 0); 2254 assert(socket >= 0); 2255 assert(set_watch); 2256 assert(remove_watch); 2257 assert(iface); 2258 assert(panic); 2259 2260 memset(dev, 0, sizeof(*dev)); 2261 2262 dev->sock = socket; 2263 dev->panic = panic; 2264 dev->read_msg = read_msg ? read_msg : vu_message_read_default; 2265 dev->set_watch = set_watch; 2266 dev->remove_watch = remove_watch; 2267 dev->iface = iface; 2268 dev->log_call_fd = -1; 2269 pthread_mutex_init(&dev->backend_mutex, NULL); 2270 dev->backend_fd = -1; 2271 dev->max_queues = max_queues; 2272 2273 dev->regions = malloc(VHOST_USER_MAX_RAM_SLOTS * sizeof(dev->regions[0])); 2274 if (!dev->regions) { 2275 DPRINT("%s: failed to malloc mem regions\n", __func__); 2276 return false; 2277 } 2278 2279 dev->vq = malloc(max_queues * sizeof(dev->vq[0])); 2280 if (!dev->vq) { 2281 DPRINT("%s: failed to malloc virtqueues\n", __func__); 2282 free(dev->regions); 2283 dev->regions = NULL; 2284 return false; 2285 } 2286 2287 for (i = 0; i < max_queues; i++) { 2288 dev->vq[i] = (VuVirtq) { 2289 .call_fd = -1, .kick_fd = -1, .err_fd = -1, 2290 .notification = true, 2291 }; 2292 } 2293 2294 return true; 2295 } 2296 2297 VuVirtq * 2298 vu_get_queue(VuDev *dev, int qidx) 2299 { 2300 assert(qidx < dev->max_queues); 2301 return &dev->vq[qidx]; 2302 } 2303 2304 bool 2305 vu_queue_enabled(VuDev *dev, VuVirtq *vq) 2306 { 2307 return vq->enable; 2308 } 2309 2310 bool 2311 vu_queue_started(const VuDev *dev, const VuVirtq *vq) 2312 { 2313 return vq->started; 2314 } 2315 2316 static inline uint16_t 2317 vring_avail_flags(VuVirtq *vq) 2318 { 2319 return le16toh(vq->vring.avail->flags); 2320 } 2321 2322 static inline uint16_t 2323 vring_avail_idx(VuVirtq *vq) 2324 { 2325 vq->shadow_avail_idx = le16toh(vq->vring.avail->idx); 2326 2327 return vq->shadow_avail_idx; 2328 } 2329 2330 static inline uint16_t 2331 vring_avail_ring(VuVirtq *vq, int i) 2332 { 2333 return le16toh(vq->vring.avail->ring[i]); 2334 } 2335 2336 static inline uint16_t 2337 vring_get_used_event(VuVirtq *vq) 2338 { 2339 return vring_avail_ring(vq, vq->vring.num); 2340 } 2341 2342 static int 2343 virtqueue_num_heads(VuDev *dev, VuVirtq *vq, unsigned int idx) 2344 { 2345 uint16_t num_heads = vring_avail_idx(vq) - idx; 2346 2347 /* Check it isn't doing very strange things with descriptor numbers. */ 2348 if (num_heads > vq->vring.num) { 2349 vu_panic(dev, "Guest moved used index from %u to %u", 2350 idx, vq->shadow_avail_idx); 2351 return -1; 2352 } 2353 if (num_heads) { 2354 /* On success, callers read a descriptor at vq->last_avail_idx. 2355 * Make sure descriptor read does not bypass avail index read. */ 2356 smp_rmb(); 2357 } 2358 2359 return num_heads; 2360 } 2361 2362 static bool 2363 virtqueue_get_head(VuDev *dev, VuVirtq *vq, 2364 unsigned int idx, unsigned int *head) 2365 { 2366 /* Grab the next descriptor number they're advertising, and increment 2367 * the index we've seen. */ 2368 *head = vring_avail_ring(vq, idx % vq->vring.num); 2369 2370 /* If their number is silly, that's a fatal mistake. */ 2371 if (*head >= vq->vring.num) { 2372 vu_panic(dev, "Guest says index %u is available", *head); 2373 return false; 2374 } 2375 2376 return true; 2377 } 2378 2379 static int 2380 virtqueue_read_indirect_desc(VuDev *dev, struct vring_desc *desc, 2381 uint64_t addr, size_t len) 2382 { 2383 struct vring_desc *ori_desc; 2384 uint64_t read_len; 2385 2386 if (len > (VIRTQUEUE_MAX_SIZE * sizeof(struct vring_desc))) { 2387 return -1; 2388 } 2389 2390 if (len == 0) { 2391 return -1; 2392 } 2393 2394 while (len) { 2395 read_len = len; 2396 ori_desc = vu_gpa_to_va(dev, &read_len, addr); 2397 if (!ori_desc) { 2398 return -1; 2399 } 2400 2401 memcpy(desc, ori_desc, read_len); 2402 len -= read_len; 2403 addr += read_len; 2404 desc += read_len; 2405 } 2406 2407 return 0; 2408 } 2409 2410 enum { 2411 VIRTQUEUE_READ_DESC_ERROR = -1, 2412 VIRTQUEUE_READ_DESC_DONE = 0, /* end of chain */ 2413 VIRTQUEUE_READ_DESC_MORE = 1, /* more buffers in chain */ 2414 }; 2415 2416 static int 2417 virtqueue_read_next_desc(VuDev *dev, struct vring_desc *desc, 2418 int i, unsigned int max, unsigned int *next) 2419 { 2420 /* If this descriptor says it doesn't chain, we're done. */ 2421 if (!(le16toh(desc[i].flags) & VRING_DESC_F_NEXT)) { 2422 return VIRTQUEUE_READ_DESC_DONE; 2423 } 2424 2425 /* Check they're not leading us off end of descriptors. */ 2426 *next = le16toh(desc[i].next); 2427 /* Make sure compiler knows to grab that: we don't want it changing! */ 2428 smp_wmb(); 2429 2430 if (*next >= max) { 2431 vu_panic(dev, "Desc next is %u", *next); 2432 return VIRTQUEUE_READ_DESC_ERROR; 2433 } 2434 2435 return VIRTQUEUE_READ_DESC_MORE; 2436 } 2437 2438 void 2439 vu_queue_get_avail_bytes(VuDev *dev, VuVirtq *vq, unsigned int *in_bytes, 2440 unsigned int *out_bytes, 2441 unsigned max_in_bytes, unsigned max_out_bytes) 2442 { 2443 unsigned int idx; 2444 unsigned int total_bufs, in_total, out_total; 2445 int rc; 2446 2447 idx = vq->last_avail_idx; 2448 2449 total_bufs = in_total = out_total = 0; 2450 if (!vu_is_vq_usable(dev, vq)) { 2451 goto done; 2452 } 2453 2454 while ((rc = virtqueue_num_heads(dev, vq, idx)) > 0) { 2455 unsigned int max, desc_len, num_bufs, indirect = 0; 2456 uint64_t desc_addr, read_len; 2457 struct vring_desc *desc; 2458 struct vring_desc desc_buf[VIRTQUEUE_MAX_SIZE]; 2459 unsigned int i; 2460 2461 max = vq->vring.num; 2462 num_bufs = total_bufs; 2463 if (!virtqueue_get_head(dev, vq, idx++, &i)) { 2464 goto err; 2465 } 2466 desc = vq->vring.desc; 2467 2468 if (le16toh(desc[i].flags) & VRING_DESC_F_INDIRECT) { 2469 if (le32toh(desc[i].len) % sizeof(struct vring_desc)) { 2470 vu_panic(dev, "Invalid size for indirect buffer table"); 2471 goto err; 2472 } 2473 2474 /* If we've got too many, that implies a descriptor loop. */ 2475 if (num_bufs >= max) { 2476 vu_panic(dev, "Looped descriptor"); 2477 goto err; 2478 } 2479 2480 /* loop over the indirect descriptor table */ 2481 indirect = 1; 2482 desc_addr = le64toh(desc[i].addr); 2483 desc_len = le32toh(desc[i].len); 2484 max = desc_len / sizeof(struct vring_desc); 2485 read_len = desc_len; 2486 desc = vu_gpa_to_va(dev, &read_len, desc_addr); 2487 if (unlikely(desc && read_len != desc_len)) { 2488 /* Failed to use zero copy */ 2489 desc = NULL; 2490 if (!virtqueue_read_indirect_desc(dev, desc_buf, 2491 desc_addr, 2492 desc_len)) { 2493 desc = desc_buf; 2494 } 2495 } 2496 if (!desc) { 2497 vu_panic(dev, "Invalid indirect buffer table"); 2498 goto err; 2499 } 2500 num_bufs = i = 0; 2501 } 2502 2503 do { 2504 /* If we've got too many, that implies a descriptor loop. */ 2505 if (++num_bufs > max) { 2506 vu_panic(dev, "Looped descriptor"); 2507 goto err; 2508 } 2509 2510 if (le16toh(desc[i].flags) & VRING_DESC_F_WRITE) { 2511 in_total += le32toh(desc[i].len); 2512 } else { 2513 out_total += le32toh(desc[i].len); 2514 } 2515 if (in_total >= max_in_bytes && out_total >= max_out_bytes) { 2516 goto done; 2517 } 2518 rc = virtqueue_read_next_desc(dev, desc, i, max, &i); 2519 } while (rc == VIRTQUEUE_READ_DESC_MORE); 2520 2521 if (rc == VIRTQUEUE_READ_DESC_ERROR) { 2522 goto err; 2523 } 2524 2525 if (!indirect) { 2526 total_bufs = num_bufs; 2527 } else { 2528 total_bufs++; 2529 } 2530 } 2531 if (rc < 0) { 2532 goto err; 2533 } 2534 done: 2535 if (in_bytes) { 2536 *in_bytes = in_total; 2537 } 2538 if (out_bytes) { 2539 *out_bytes = out_total; 2540 } 2541 return; 2542 2543 err: 2544 in_total = out_total = 0; 2545 goto done; 2546 } 2547 2548 bool 2549 vu_queue_avail_bytes(VuDev *dev, VuVirtq *vq, unsigned int in_bytes, 2550 unsigned int out_bytes) 2551 { 2552 unsigned int in_total, out_total; 2553 2554 vu_queue_get_avail_bytes(dev, vq, &in_total, &out_total, 2555 in_bytes, out_bytes); 2556 2557 return in_bytes <= in_total && out_bytes <= out_total; 2558 } 2559 2560 /* Fetch avail_idx from VQ memory only when we really need to know if 2561 * guest has added some buffers. */ 2562 bool 2563 vu_queue_empty(VuDev *dev, VuVirtq *vq) 2564 { 2565 if (!vu_is_vq_usable(dev, vq)) { 2566 return true; 2567 } 2568 2569 if (vq->shadow_avail_idx != vq->last_avail_idx) { 2570 return false; 2571 } 2572 2573 return vring_avail_idx(vq) == vq->last_avail_idx; 2574 } 2575 2576 static bool 2577 vring_notify(VuDev *dev, VuVirtq *vq) 2578 { 2579 uint16_t old, new; 2580 bool v; 2581 2582 /* We need to expose used array entries before checking used event. */ 2583 smp_mb(); 2584 2585 /* Always notify when queue is empty (when feature acknowledge) */ 2586 if (vu_has_feature(dev, VIRTIO_F_NOTIFY_ON_EMPTY) && 2587 !vq->inuse && vu_queue_empty(dev, vq)) { 2588 return true; 2589 } 2590 2591 if (!vu_has_feature(dev, VIRTIO_RING_F_EVENT_IDX)) { 2592 return !(vring_avail_flags(vq) & VRING_AVAIL_F_NO_INTERRUPT); 2593 } 2594 2595 v = vq->signalled_used_valid; 2596 vq->signalled_used_valid = true; 2597 old = vq->signalled_used; 2598 new = vq->signalled_used = vq->used_idx; 2599 return !v || vring_need_event(vring_get_used_event(vq), new, old); 2600 } 2601 2602 static void _vu_queue_notify(VuDev *dev, VuVirtq *vq, bool sync) 2603 { 2604 if (!vu_is_vq_usable(dev, vq)) { 2605 return; 2606 } 2607 2608 if (!vring_notify(dev, vq)) { 2609 DPRINT("skipped notify...\n"); 2610 return; 2611 } 2612 2613 if (vq->call_fd < 0 && 2614 vu_has_protocol_feature(dev, 2615 VHOST_USER_PROTOCOL_F_INBAND_NOTIFICATIONS) && 2616 vu_has_protocol_feature(dev, VHOST_USER_PROTOCOL_F_BACKEND_REQ)) { 2617 VhostUserMsg vmsg = { 2618 .request = VHOST_USER_BACKEND_VRING_CALL, 2619 .flags = VHOST_USER_VERSION, 2620 .size = sizeof(vmsg.payload.state), 2621 .payload.state = { 2622 .index = vq - dev->vq, 2623 }, 2624 }; 2625 bool ack = sync && 2626 vu_has_protocol_feature(dev, 2627 VHOST_USER_PROTOCOL_F_REPLY_ACK); 2628 2629 if (ack) { 2630 vmsg.flags |= VHOST_USER_NEED_REPLY_MASK; 2631 } 2632 2633 vu_message_write(dev, dev->backend_fd, &vmsg); 2634 if (ack) { 2635 vu_message_read_default(dev, dev->backend_fd, &vmsg); 2636 } 2637 return; 2638 } 2639 2640 if (eventfd_write(vq->call_fd, 1) < 0) { 2641 vu_panic(dev, "Error writing eventfd: %s", strerror(errno)); 2642 } 2643 } 2644 2645 void vu_queue_notify(VuDev *dev, VuVirtq *vq) 2646 { 2647 _vu_queue_notify(dev, vq, false); 2648 } 2649 2650 void vu_queue_notify_sync(VuDev *dev, VuVirtq *vq) 2651 { 2652 _vu_queue_notify(dev, vq, true); 2653 } 2654 2655 void vu_config_change_msg(VuDev *dev) 2656 { 2657 VhostUserMsg vmsg = { 2658 .request = VHOST_USER_BACKEND_CONFIG_CHANGE_MSG, 2659 .flags = VHOST_USER_VERSION, 2660 }; 2661 2662 vu_message_write(dev, dev->backend_fd, &vmsg); 2663 } 2664 2665 static inline void 2666 vring_used_flags_set_bit(VuVirtq *vq, int mask) 2667 { 2668 uint16_t *flags; 2669 2670 flags = (uint16_t *)((char*)vq->vring.used + 2671 offsetof(struct vring_used, flags)); 2672 *flags = htole16(le16toh(*flags) | mask); 2673 } 2674 2675 static inline void 2676 vring_used_flags_unset_bit(VuVirtq *vq, int mask) 2677 { 2678 uint16_t *flags; 2679 2680 flags = (uint16_t *)((char*)vq->vring.used + 2681 offsetof(struct vring_used, flags)); 2682 *flags = htole16(le16toh(*flags) & ~mask); 2683 } 2684 2685 static inline void 2686 vring_set_avail_event(VuVirtq *vq, uint16_t val) 2687 { 2688 uint16_t val_le = htole16(val); 2689 2690 if (!vq->notification) { 2691 return; 2692 } 2693 2694 memcpy(&vq->vring.used->ring[vq->vring.num], &val_le, sizeof(uint16_t)); 2695 } 2696 2697 void 2698 vu_queue_set_notification(VuDev *dev, VuVirtq *vq, int enable) 2699 { 2700 vq->notification = enable; 2701 if (vu_has_feature(dev, VIRTIO_RING_F_EVENT_IDX)) { 2702 vring_set_avail_event(vq, vring_avail_idx(vq)); 2703 } else if (enable) { 2704 vring_used_flags_unset_bit(vq, VRING_USED_F_NO_NOTIFY); 2705 } else { 2706 vring_used_flags_set_bit(vq, VRING_USED_F_NO_NOTIFY); 2707 } 2708 if (enable) { 2709 /* Expose avail event/used flags before caller checks the avail idx. */ 2710 smp_mb(); 2711 } 2712 } 2713 2714 static bool 2715 virtqueue_map_desc(VuDev *dev, 2716 unsigned int *p_num_sg, struct iovec *iov, 2717 unsigned int max_num_sg, bool is_write, 2718 uint64_t pa, size_t sz) 2719 { 2720 unsigned num_sg = *p_num_sg; 2721 2722 assert(num_sg <= max_num_sg); 2723 2724 if (!sz) { 2725 vu_panic(dev, "virtio: zero sized buffers are not allowed"); 2726 return false; 2727 } 2728 2729 while (sz) { 2730 uint64_t len = sz; 2731 2732 if (num_sg == max_num_sg) { 2733 vu_panic(dev, "virtio: too many descriptors in indirect table"); 2734 return false; 2735 } 2736 2737 iov[num_sg].iov_base = vu_gpa_to_va(dev, &len, pa); 2738 if (iov[num_sg].iov_base == NULL) { 2739 vu_panic(dev, "virtio: invalid address for buffers"); 2740 return false; 2741 } 2742 iov[num_sg].iov_len = len; 2743 num_sg++; 2744 sz -= len; 2745 pa += len; 2746 } 2747 2748 *p_num_sg = num_sg; 2749 return true; 2750 } 2751 2752 static void * 2753 virtqueue_alloc_element(size_t sz, 2754 unsigned out_num, unsigned in_num) 2755 { 2756 VuVirtqElement *elem; 2757 size_t in_sg_ofs = ALIGN_UP(sz, __alignof__(elem->in_sg[0])); 2758 size_t out_sg_ofs = in_sg_ofs + in_num * sizeof(elem->in_sg[0]); 2759 size_t out_sg_end = out_sg_ofs + out_num * sizeof(elem->out_sg[0]); 2760 2761 assert(sz >= sizeof(VuVirtqElement)); 2762 elem = malloc(out_sg_end); 2763 if (!elem) { 2764 DPRINT("%s: failed to malloc virtqueue element\n", __func__); 2765 return NULL; 2766 } 2767 elem->out_num = out_num; 2768 elem->in_num = in_num; 2769 elem->in_sg = (void *)elem + in_sg_ofs; 2770 elem->out_sg = (void *)elem + out_sg_ofs; 2771 return elem; 2772 } 2773 2774 static void * 2775 vu_queue_map_desc(VuDev *dev, VuVirtq *vq, unsigned int idx, size_t sz) 2776 { 2777 struct vring_desc *desc = vq->vring.desc; 2778 uint64_t desc_addr, read_len; 2779 unsigned int desc_len; 2780 unsigned int max = vq->vring.num; 2781 unsigned int i = idx; 2782 VuVirtqElement *elem; 2783 unsigned int out_num = 0, in_num = 0; 2784 struct iovec iov[VIRTQUEUE_MAX_SIZE]; 2785 struct vring_desc desc_buf[VIRTQUEUE_MAX_SIZE]; 2786 int rc; 2787 2788 if (le16toh(desc[i].flags) & VRING_DESC_F_INDIRECT) { 2789 if (le32toh(desc[i].len) % sizeof(struct vring_desc)) { 2790 vu_panic(dev, "Invalid size for indirect buffer table"); 2791 return NULL; 2792 } 2793 2794 /* loop over the indirect descriptor table */ 2795 desc_addr = le64toh(desc[i].addr); 2796 desc_len = le32toh(desc[i].len); 2797 max = desc_len / sizeof(struct vring_desc); 2798 read_len = desc_len; 2799 desc = vu_gpa_to_va(dev, &read_len, desc_addr); 2800 if (unlikely(desc && read_len != desc_len)) { 2801 /* Failed to use zero copy */ 2802 desc = NULL; 2803 if (!virtqueue_read_indirect_desc(dev, desc_buf, 2804 desc_addr, 2805 desc_len)) { 2806 desc = desc_buf; 2807 } 2808 } 2809 if (!desc) { 2810 vu_panic(dev, "Invalid indirect buffer table"); 2811 return NULL; 2812 } 2813 i = 0; 2814 } 2815 2816 /* Collect all the descriptors */ 2817 do { 2818 if (le16toh(desc[i].flags) & VRING_DESC_F_WRITE) { 2819 if (!virtqueue_map_desc(dev, &in_num, iov + out_num, 2820 VIRTQUEUE_MAX_SIZE - out_num, true, 2821 le64toh(desc[i].addr), 2822 le32toh(desc[i].len))) { 2823 return NULL; 2824 } 2825 } else { 2826 if (in_num) { 2827 vu_panic(dev, "Incorrect order for descriptors"); 2828 return NULL; 2829 } 2830 if (!virtqueue_map_desc(dev, &out_num, iov, 2831 VIRTQUEUE_MAX_SIZE, false, 2832 le64toh(desc[i].addr), 2833 le32toh(desc[i].len))) { 2834 return NULL; 2835 } 2836 } 2837 2838 /* If we've got too many, that implies a descriptor loop. */ 2839 if ((in_num + out_num) > max) { 2840 vu_panic(dev, "Looped descriptor"); 2841 return NULL; 2842 } 2843 rc = virtqueue_read_next_desc(dev, desc, i, max, &i); 2844 } while (rc == VIRTQUEUE_READ_DESC_MORE); 2845 2846 if (rc == VIRTQUEUE_READ_DESC_ERROR) { 2847 vu_panic(dev, "read descriptor error"); 2848 return NULL; 2849 } 2850 2851 /* Now copy what we have collected and mapped */ 2852 elem = virtqueue_alloc_element(sz, out_num, in_num); 2853 if (!elem) { 2854 return NULL; 2855 } 2856 elem->index = idx; 2857 for (i = 0; i < out_num; i++) { 2858 elem->out_sg[i] = iov[i]; 2859 } 2860 for (i = 0; i < in_num; i++) { 2861 elem->in_sg[i] = iov[out_num + i]; 2862 } 2863 2864 return elem; 2865 } 2866 2867 static int 2868 vu_queue_inflight_get(VuDev *dev, VuVirtq *vq, int desc_idx) 2869 { 2870 if (!vu_has_protocol_feature(dev, VHOST_USER_PROTOCOL_F_INFLIGHT_SHMFD)) { 2871 return 0; 2872 } 2873 2874 if (unlikely(!vq->inflight)) { 2875 return -1; 2876 } 2877 2878 vq->inflight->desc[desc_idx].counter = vq->counter++; 2879 vq->inflight->desc[desc_idx].inflight = 1; 2880 2881 return 0; 2882 } 2883 2884 static int 2885 vu_queue_inflight_pre_put(VuDev *dev, VuVirtq *vq, int desc_idx) 2886 { 2887 if (!vu_has_protocol_feature(dev, VHOST_USER_PROTOCOL_F_INFLIGHT_SHMFD)) { 2888 return 0; 2889 } 2890 2891 if (unlikely(!vq->inflight)) { 2892 return -1; 2893 } 2894 2895 vq->inflight->last_batch_head = desc_idx; 2896 2897 return 0; 2898 } 2899 2900 static int 2901 vu_queue_inflight_post_put(VuDev *dev, VuVirtq *vq, int desc_idx) 2902 { 2903 if (!vu_has_protocol_feature(dev, VHOST_USER_PROTOCOL_F_INFLIGHT_SHMFD)) { 2904 return 0; 2905 } 2906 2907 if (unlikely(!vq->inflight)) { 2908 return -1; 2909 } 2910 2911 barrier(); 2912 2913 vq->inflight->desc[desc_idx].inflight = 0; 2914 2915 barrier(); 2916 2917 vq->inflight->used_idx = vq->used_idx; 2918 2919 return 0; 2920 } 2921 2922 void * 2923 vu_queue_pop(VuDev *dev, VuVirtq *vq, size_t sz) 2924 { 2925 int i; 2926 unsigned int head; 2927 VuVirtqElement *elem; 2928 2929 if (!vu_is_vq_usable(dev, vq)) { 2930 return NULL; 2931 } 2932 2933 if (unlikely(vq->resubmit_list && vq->resubmit_num > 0)) { 2934 i = (--vq->resubmit_num); 2935 elem = vu_queue_map_desc(dev, vq, vq->resubmit_list[i].index, sz); 2936 2937 if (!vq->resubmit_num) { 2938 free(vq->resubmit_list); 2939 vq->resubmit_list = NULL; 2940 } 2941 2942 return elem; 2943 } 2944 2945 if (vu_queue_empty(dev, vq)) { 2946 return NULL; 2947 } 2948 /* 2949 * Needed after virtio_queue_empty(), see comment in 2950 * virtqueue_num_heads(). 2951 */ 2952 smp_rmb(); 2953 2954 if (vq->inuse >= vq->vring.num) { 2955 vu_panic(dev, "Virtqueue size exceeded"); 2956 return NULL; 2957 } 2958 2959 if (!virtqueue_get_head(dev, vq, vq->last_avail_idx++, &head)) { 2960 return NULL; 2961 } 2962 2963 if (vu_has_feature(dev, VIRTIO_RING_F_EVENT_IDX)) { 2964 vring_set_avail_event(vq, vq->last_avail_idx); 2965 } 2966 2967 elem = vu_queue_map_desc(dev, vq, head, sz); 2968 2969 if (!elem) { 2970 return NULL; 2971 } 2972 2973 vq->inuse++; 2974 2975 vu_queue_inflight_get(dev, vq, head); 2976 2977 return elem; 2978 } 2979 2980 static void 2981 vu_queue_detach_element(VuDev *dev, VuVirtq *vq, VuVirtqElement *elem, 2982 size_t len) 2983 { 2984 vq->inuse--; 2985 /* unmap, when DMA support is added */ 2986 } 2987 2988 void 2989 vu_queue_unpop(VuDev *dev, VuVirtq *vq, VuVirtqElement *elem, 2990 size_t len) 2991 { 2992 vq->last_avail_idx--; 2993 vu_queue_detach_element(dev, vq, elem, len); 2994 } 2995 2996 bool 2997 vu_queue_rewind(VuDev *dev, VuVirtq *vq, unsigned int num) 2998 { 2999 if (num > vq->inuse) { 3000 return false; 3001 } 3002 vq->last_avail_idx -= num; 3003 vq->inuse -= num; 3004 return true; 3005 } 3006 3007 static inline 3008 void vring_used_write(VuDev *dev, VuVirtq *vq, 3009 struct vring_used_elem *uelem, int i) 3010 { 3011 struct vring_used *used = vq->vring.used; 3012 3013 used->ring[i] = *uelem; 3014 vu_log_write(dev, vq->vring.log_guest_addr + 3015 offsetof(struct vring_used, ring[i]), 3016 sizeof(used->ring[i])); 3017 } 3018 3019 3020 static void 3021 vu_log_queue_fill(VuDev *dev, VuVirtq *vq, 3022 const VuVirtqElement *elem, 3023 unsigned int len) 3024 { 3025 struct vring_desc *desc = vq->vring.desc; 3026 unsigned int i, max, min, desc_len; 3027 uint64_t desc_addr, read_len; 3028 struct vring_desc desc_buf[VIRTQUEUE_MAX_SIZE]; 3029 unsigned num_bufs = 0; 3030 3031 max = vq->vring.num; 3032 i = elem->index; 3033 3034 if (le16toh(desc[i].flags) & VRING_DESC_F_INDIRECT) { 3035 if (le32toh(desc[i].len) % sizeof(struct vring_desc)) { 3036 vu_panic(dev, "Invalid size for indirect buffer table"); 3037 return; 3038 } 3039 3040 /* loop over the indirect descriptor table */ 3041 desc_addr = le64toh(desc[i].addr); 3042 desc_len = le32toh(desc[i].len); 3043 max = desc_len / sizeof(struct vring_desc); 3044 read_len = desc_len; 3045 desc = vu_gpa_to_va(dev, &read_len, desc_addr); 3046 if (unlikely(desc && read_len != desc_len)) { 3047 /* Failed to use zero copy */ 3048 desc = NULL; 3049 if (!virtqueue_read_indirect_desc(dev, desc_buf, 3050 desc_addr, 3051 desc_len)) { 3052 desc = desc_buf; 3053 } 3054 } 3055 if (!desc) { 3056 vu_panic(dev, "Invalid indirect buffer table"); 3057 return; 3058 } 3059 i = 0; 3060 } 3061 3062 do { 3063 if (++num_bufs > max) { 3064 vu_panic(dev, "Looped descriptor"); 3065 return; 3066 } 3067 3068 if (le16toh(desc[i].flags) & VRING_DESC_F_WRITE) { 3069 min = MIN(le32toh(desc[i].len), len); 3070 vu_log_write(dev, le64toh(desc[i].addr), min); 3071 len -= min; 3072 } 3073 3074 } while (len > 0 && 3075 (virtqueue_read_next_desc(dev, desc, i, max, &i) 3076 == VIRTQUEUE_READ_DESC_MORE)); 3077 } 3078 3079 void 3080 vu_queue_fill(VuDev *dev, VuVirtq *vq, 3081 const VuVirtqElement *elem, 3082 unsigned int len, unsigned int idx) 3083 { 3084 struct vring_used_elem uelem; 3085 3086 if (!vu_is_vq_usable(dev, vq)) { 3087 return; 3088 } 3089 3090 vu_log_queue_fill(dev, vq, elem, len); 3091 3092 idx = (idx + vq->used_idx) % vq->vring.num; 3093 3094 uelem.id = htole32(elem->index); 3095 uelem.len = htole32(len); 3096 vring_used_write(dev, vq, &uelem, idx); 3097 } 3098 3099 static inline 3100 void vring_used_idx_set(VuDev *dev, VuVirtq *vq, uint16_t val) 3101 { 3102 vq->vring.used->idx = htole16(val); 3103 vu_log_write(dev, 3104 vq->vring.log_guest_addr + offsetof(struct vring_used, idx), 3105 sizeof(vq->vring.used->idx)); 3106 3107 vq->used_idx = val; 3108 } 3109 3110 void 3111 vu_queue_flush(VuDev *dev, VuVirtq *vq, unsigned int count) 3112 { 3113 uint16_t old, new; 3114 3115 if (!vu_is_vq_usable(dev, vq)) { 3116 return; 3117 } 3118 3119 /* Make sure buffer is written before we update index. */ 3120 smp_wmb(); 3121 3122 old = vq->used_idx; 3123 new = old + count; 3124 vring_used_idx_set(dev, vq, new); 3125 vq->inuse -= count; 3126 if (unlikely((int16_t)(new - vq->signalled_used) < (uint16_t)(new - old))) { 3127 vq->signalled_used_valid = false; 3128 } 3129 } 3130 3131 void 3132 vu_queue_push(VuDev *dev, VuVirtq *vq, 3133 const VuVirtqElement *elem, unsigned int len) 3134 { 3135 vu_queue_fill(dev, vq, elem, len, 0); 3136 vu_queue_inflight_pre_put(dev, vq, elem->index); 3137 vu_queue_flush(dev, vq, 1); 3138 vu_queue_inflight_post_put(dev, vq, elem->index); 3139 } 3140