1 /* 2 * Vhost User library 3 * 4 * Copyright IBM, Corp. 2007 5 * Copyright (c) 2016 Red Hat, Inc. 6 * 7 * Authors: 8 * Anthony Liguori <aliguori@us.ibm.com> 9 * Marc-André Lureau <mlureau@redhat.com> 10 * Victor Kaplansky <victork@redhat.com> 11 * 12 * This work is licensed under the terms of the GNU GPL, version 2 or 13 * later. See the COPYING file in the top-level directory. 14 */ 15 16 #ifndef _GNU_SOURCE 17 #define _GNU_SOURCE 18 #endif 19 20 /* this code avoids GLib dependency */ 21 #include <stdlib.h> 22 #include <stdio.h> 23 #include <unistd.h> 24 #include <stdarg.h> 25 #include <errno.h> 26 #include <string.h> 27 #include <assert.h> 28 #include <inttypes.h> 29 #include <sys/types.h> 30 #include <sys/socket.h> 31 #include <sys/eventfd.h> 32 #include <sys/mman.h> 33 #include <endian.h> 34 35 /* Necessary to provide VIRTIO_F_VERSION_1 on system 36 * with older linux headers. Must appear before 37 * <linux/vhost.h> below. 38 */ 39 #include "standard-headers/linux/virtio_config.h" 40 41 #if defined(__linux__) 42 #include <sys/syscall.h> 43 #include <fcntl.h> 44 #include <sys/ioctl.h> 45 #include <linux/vhost.h> 46 47 #ifdef __NR_userfaultfd 48 #include <linux/userfaultfd.h> 49 #endif 50 51 #endif 52 53 #include "include/atomic.h" 54 55 #include "libvhost-user.h" 56 57 /* usually provided by GLib */ 58 #if __GNUC__ > 2 || (__GNUC__ == 2 && __GNUC_MINOR__ > 4) 59 #if !defined(__clang__) && (__GNUC__ == 4 && __GNUC_MINOR__ == 4) 60 #define G_GNUC_PRINTF(format_idx, arg_idx) \ 61 __attribute__((__format__(gnu_printf, format_idx, arg_idx))) 62 #else 63 #define G_GNUC_PRINTF(format_idx, arg_idx) \ 64 __attribute__((__format__(__printf__, format_idx, arg_idx))) 65 #endif 66 #else /* !__GNUC__ */ 67 #define G_GNUC_PRINTF(format_idx, arg_idx) 68 #endif /* !__GNUC__ */ 69 #ifndef MIN 70 #define MIN(x, y) ({ \ 71 __typeof__(x) _min1 = (x); \ 72 __typeof__(y) _min2 = (y); \ 73 (void) (&_min1 == &_min2); \ 74 _min1 < _min2 ? _min1 : _min2; }) 75 #endif 76 77 /* Round number down to multiple */ 78 #define ALIGN_DOWN(n, m) ((n) / (m) * (m)) 79 80 /* Round number up to multiple */ 81 #define ALIGN_UP(n, m) ALIGN_DOWN((n) + (m) - 1, (m)) 82 83 #ifndef unlikely 84 #define unlikely(x) __builtin_expect(!!(x), 0) 85 #endif 86 87 /* Align each region to cache line size in inflight buffer */ 88 #define INFLIGHT_ALIGNMENT 64 89 90 /* The version of inflight buffer */ 91 #define INFLIGHT_VERSION 1 92 93 /* The version of the protocol we support */ 94 #define VHOST_USER_VERSION 1 95 #define LIBVHOST_USER_DEBUG 0 96 97 #define DPRINT(...) \ 98 do { \ 99 if (LIBVHOST_USER_DEBUG) { \ 100 fprintf(stderr, __VA_ARGS__); \ 101 } \ 102 } while (0) 103 104 static inline 105 bool has_feature(uint64_t features, unsigned int fbit) 106 { 107 assert(fbit < 64); 108 return !!(features & (1ULL << fbit)); 109 } 110 111 static inline 112 bool vu_has_feature(VuDev *dev, 113 unsigned int fbit) 114 { 115 return has_feature(dev->features, fbit); 116 } 117 118 static inline bool vu_has_protocol_feature(VuDev *dev, unsigned int fbit) 119 { 120 return has_feature(dev->protocol_features, fbit); 121 } 122 123 const char * 124 vu_request_to_string(unsigned int req) 125 { 126 #define REQ(req) [req] = #req 127 static const char *vu_request_str[] = { 128 REQ(VHOST_USER_NONE), 129 REQ(VHOST_USER_GET_FEATURES), 130 REQ(VHOST_USER_SET_FEATURES), 131 REQ(VHOST_USER_SET_OWNER), 132 REQ(VHOST_USER_RESET_OWNER), 133 REQ(VHOST_USER_SET_MEM_TABLE), 134 REQ(VHOST_USER_SET_LOG_BASE), 135 REQ(VHOST_USER_SET_LOG_FD), 136 REQ(VHOST_USER_SET_VRING_NUM), 137 REQ(VHOST_USER_SET_VRING_ADDR), 138 REQ(VHOST_USER_SET_VRING_BASE), 139 REQ(VHOST_USER_GET_VRING_BASE), 140 REQ(VHOST_USER_SET_VRING_KICK), 141 REQ(VHOST_USER_SET_VRING_CALL), 142 REQ(VHOST_USER_SET_VRING_ERR), 143 REQ(VHOST_USER_GET_PROTOCOL_FEATURES), 144 REQ(VHOST_USER_SET_PROTOCOL_FEATURES), 145 REQ(VHOST_USER_GET_QUEUE_NUM), 146 REQ(VHOST_USER_SET_VRING_ENABLE), 147 REQ(VHOST_USER_SEND_RARP), 148 REQ(VHOST_USER_NET_SET_MTU), 149 REQ(VHOST_USER_SET_BACKEND_REQ_FD), 150 REQ(VHOST_USER_IOTLB_MSG), 151 REQ(VHOST_USER_SET_VRING_ENDIAN), 152 REQ(VHOST_USER_GET_CONFIG), 153 REQ(VHOST_USER_SET_CONFIG), 154 REQ(VHOST_USER_POSTCOPY_ADVISE), 155 REQ(VHOST_USER_POSTCOPY_LISTEN), 156 REQ(VHOST_USER_POSTCOPY_END), 157 REQ(VHOST_USER_GET_INFLIGHT_FD), 158 REQ(VHOST_USER_SET_INFLIGHT_FD), 159 REQ(VHOST_USER_GPU_SET_SOCKET), 160 REQ(VHOST_USER_VRING_KICK), 161 REQ(VHOST_USER_GET_MAX_MEM_SLOTS), 162 REQ(VHOST_USER_ADD_MEM_REG), 163 REQ(VHOST_USER_REM_MEM_REG), 164 REQ(VHOST_USER_GET_SHARED_OBJECT), 165 REQ(VHOST_USER_MAX), 166 }; 167 #undef REQ 168 169 if (req < VHOST_USER_MAX) { 170 return vu_request_str[req]; 171 } else { 172 return "unknown"; 173 } 174 } 175 176 static void G_GNUC_PRINTF(2, 3) 177 vu_panic(VuDev *dev, const char *msg, ...) 178 { 179 char *buf = NULL; 180 va_list ap; 181 182 va_start(ap, msg); 183 if (vasprintf(&buf, msg, ap) < 0) { 184 buf = NULL; 185 } 186 va_end(ap); 187 188 dev->broken = true; 189 dev->panic(dev, buf); 190 free(buf); 191 192 /* 193 * FIXME: 194 * find a way to call virtio_error, or perhaps close the connection? 195 */ 196 } 197 198 /* Translate guest physical address to our virtual address. */ 199 void * 200 vu_gpa_to_va(VuDev *dev, uint64_t *plen, uint64_t guest_addr) 201 { 202 unsigned int i; 203 204 if (*plen == 0) { 205 return NULL; 206 } 207 208 /* Find matching memory region. */ 209 for (i = 0; i < dev->nregions; i++) { 210 VuDevRegion *r = &dev->regions[i]; 211 212 if ((guest_addr >= r->gpa) && (guest_addr < (r->gpa + r->size))) { 213 if ((guest_addr + *plen) > (r->gpa + r->size)) { 214 *plen = r->gpa + r->size - guest_addr; 215 } 216 return (void *)(uintptr_t) 217 guest_addr - r->gpa + r->mmap_addr + r->mmap_offset; 218 } 219 } 220 221 return NULL; 222 } 223 224 /* Translate qemu virtual address to our virtual address. */ 225 static void * 226 qva_to_va(VuDev *dev, uint64_t qemu_addr) 227 { 228 unsigned int i; 229 230 /* Find matching memory region. */ 231 for (i = 0; i < dev->nregions; i++) { 232 VuDevRegion *r = &dev->regions[i]; 233 234 if ((qemu_addr >= r->qva) && (qemu_addr < (r->qva + r->size))) { 235 return (void *)(uintptr_t) 236 qemu_addr - r->qva + r->mmap_addr + r->mmap_offset; 237 } 238 } 239 240 return NULL; 241 } 242 243 static void 244 vu_remove_all_mem_regs(VuDev *dev) 245 { 246 unsigned int i; 247 248 for (i = 0; i < dev->nregions; i++) { 249 VuDevRegion *r = &dev->regions[i]; 250 void *ma = (void *)(uintptr_t)r->mmap_addr; 251 252 if (ma) { 253 munmap(ma, r->size + r->mmap_offset); 254 } 255 } 256 dev->nregions = 0; 257 } 258 259 static void 260 _vu_add_mem_reg(VuDev *dev, VhostUserMemoryRegion *msg_region, int fd) 261 { 262 int prot = PROT_READ | PROT_WRITE; 263 VuDevRegion *r; 264 void *mmap_addr; 265 266 DPRINT("Adding region %d\n", dev->nregions); 267 DPRINT(" guest_phys_addr: 0x%016"PRIx64"\n", 268 msg_region->guest_phys_addr); 269 DPRINT(" memory_size: 0x%016"PRIx64"\n", 270 msg_region->memory_size); 271 DPRINT(" userspace_addr: 0x%016"PRIx64"\n", 272 msg_region->userspace_addr); 273 DPRINT(" mmap_offset: 0x%016"PRIx64"\n", 274 msg_region->mmap_offset); 275 276 if (dev->postcopy_listening) { 277 /* 278 * In postcopy we're using PROT_NONE here to catch anyone 279 * accessing it before we userfault 280 */ 281 prot = PROT_NONE; 282 } 283 284 /* 285 * We don't use offset argument of mmap() since the mapped address has 286 * to be page aligned, and we use huge pages. 287 */ 288 mmap_addr = mmap(0, msg_region->memory_size + msg_region->mmap_offset, 289 prot, MAP_SHARED | MAP_NORESERVE, fd, 0); 290 if (mmap_addr == MAP_FAILED) { 291 vu_panic(dev, "region mmap error: %s", strerror(errno)); 292 return; 293 } 294 DPRINT(" mmap_addr: 0x%016"PRIx64"\n", 295 (uint64_t)(uintptr_t)mmap_addr); 296 297 r = &dev->regions[dev->nregions]; 298 r->gpa = msg_region->guest_phys_addr; 299 r->size = msg_region->memory_size; 300 r->qva = msg_region->userspace_addr; 301 r->mmap_addr = (uint64_t)(uintptr_t)mmap_addr; 302 r->mmap_offset = msg_region->mmap_offset; 303 dev->nregions++; 304 305 if (dev->postcopy_listening) { 306 /* 307 * Return the address to QEMU so that it can translate the ufd 308 * fault addresses back. 309 */ 310 msg_region->userspace_addr = r->mmap_addr + r->mmap_offset; 311 } 312 } 313 314 static void 315 vmsg_close_fds(VhostUserMsg *vmsg) 316 { 317 int i; 318 319 for (i = 0; i < vmsg->fd_num; i++) { 320 close(vmsg->fds[i]); 321 } 322 } 323 324 /* Set reply payload.u64 and clear request flags and fd_num */ 325 static void vmsg_set_reply_u64(VhostUserMsg *vmsg, uint64_t val) 326 { 327 vmsg->flags = 0; /* defaults will be set by vu_send_reply() */ 328 vmsg->size = sizeof(vmsg->payload.u64); 329 vmsg->payload.u64 = val; 330 vmsg->fd_num = 0; 331 } 332 333 /* A test to see if we have userfault available */ 334 static bool 335 have_userfault(void) 336 { 337 #if defined(__linux__) && defined(__NR_userfaultfd) &&\ 338 defined(UFFD_FEATURE_MISSING_SHMEM) &&\ 339 defined(UFFD_FEATURE_MISSING_HUGETLBFS) 340 /* Now test the kernel we're running on really has the features */ 341 int ufd = syscall(__NR_userfaultfd, O_CLOEXEC | O_NONBLOCK); 342 struct uffdio_api api_struct; 343 if (ufd < 0) { 344 return false; 345 } 346 347 api_struct.api = UFFD_API; 348 api_struct.features = UFFD_FEATURE_MISSING_SHMEM | 349 UFFD_FEATURE_MISSING_HUGETLBFS; 350 if (ioctl(ufd, UFFDIO_API, &api_struct)) { 351 close(ufd); 352 return false; 353 } 354 close(ufd); 355 return true; 356 357 #else 358 return false; 359 #endif 360 } 361 362 static bool 363 vu_message_read_default(VuDev *dev, int conn_fd, VhostUserMsg *vmsg) 364 { 365 char control[CMSG_SPACE(VHOST_MEMORY_BASELINE_NREGIONS * sizeof(int))] = {}; 366 struct iovec iov = { 367 .iov_base = (char *)vmsg, 368 .iov_len = VHOST_USER_HDR_SIZE, 369 }; 370 struct msghdr msg = { 371 .msg_iov = &iov, 372 .msg_iovlen = 1, 373 .msg_control = control, 374 .msg_controllen = sizeof(control), 375 }; 376 size_t fd_size; 377 struct cmsghdr *cmsg; 378 int rc; 379 380 do { 381 rc = recvmsg(conn_fd, &msg, 0); 382 } while (rc < 0 && (errno == EINTR || errno == EAGAIN)); 383 384 if (rc < 0) { 385 vu_panic(dev, "Error while recvmsg: %s", strerror(errno)); 386 return false; 387 } 388 389 vmsg->fd_num = 0; 390 for (cmsg = CMSG_FIRSTHDR(&msg); 391 cmsg != NULL; 392 cmsg = CMSG_NXTHDR(&msg, cmsg)) 393 { 394 if (cmsg->cmsg_level == SOL_SOCKET && cmsg->cmsg_type == SCM_RIGHTS) { 395 fd_size = cmsg->cmsg_len - CMSG_LEN(0); 396 vmsg->fd_num = fd_size / sizeof(int); 397 assert(fd_size < VHOST_MEMORY_BASELINE_NREGIONS); 398 memcpy(vmsg->fds, CMSG_DATA(cmsg), fd_size); 399 break; 400 } 401 } 402 403 if (vmsg->size > sizeof(vmsg->payload)) { 404 vu_panic(dev, 405 "Error: too big message request: %d, size: vmsg->size: %u, " 406 "while sizeof(vmsg->payload) = %zu\n", 407 vmsg->request, vmsg->size, sizeof(vmsg->payload)); 408 goto fail; 409 } 410 411 if (vmsg->size) { 412 do { 413 rc = read(conn_fd, &vmsg->payload, vmsg->size); 414 } while (rc < 0 && (errno == EINTR || errno == EAGAIN)); 415 416 if (rc <= 0) { 417 vu_panic(dev, "Error while reading: %s", strerror(errno)); 418 goto fail; 419 } 420 421 assert((uint32_t)rc == vmsg->size); 422 } 423 424 return true; 425 426 fail: 427 vmsg_close_fds(vmsg); 428 429 return false; 430 } 431 432 static bool 433 vu_message_write(VuDev *dev, int conn_fd, VhostUserMsg *vmsg) 434 { 435 int rc; 436 uint8_t *p = (uint8_t *)vmsg; 437 char control[CMSG_SPACE(VHOST_MEMORY_BASELINE_NREGIONS * sizeof(int))] = {}; 438 struct iovec iov = { 439 .iov_base = (char *)vmsg, 440 .iov_len = VHOST_USER_HDR_SIZE, 441 }; 442 struct msghdr msg = { 443 .msg_iov = &iov, 444 .msg_iovlen = 1, 445 .msg_control = control, 446 }; 447 struct cmsghdr *cmsg; 448 449 memset(control, 0, sizeof(control)); 450 assert(vmsg->fd_num <= VHOST_MEMORY_BASELINE_NREGIONS); 451 if (vmsg->fd_num > 0) { 452 size_t fdsize = vmsg->fd_num * sizeof(int); 453 msg.msg_controllen = CMSG_SPACE(fdsize); 454 cmsg = CMSG_FIRSTHDR(&msg); 455 cmsg->cmsg_len = CMSG_LEN(fdsize); 456 cmsg->cmsg_level = SOL_SOCKET; 457 cmsg->cmsg_type = SCM_RIGHTS; 458 memcpy(CMSG_DATA(cmsg), vmsg->fds, fdsize); 459 } else { 460 msg.msg_controllen = 0; 461 } 462 463 do { 464 rc = sendmsg(conn_fd, &msg, 0); 465 } while (rc < 0 && (errno == EINTR || errno == EAGAIN)); 466 467 if (vmsg->size) { 468 do { 469 if (vmsg->data) { 470 rc = write(conn_fd, vmsg->data, vmsg->size); 471 } else { 472 rc = write(conn_fd, p + VHOST_USER_HDR_SIZE, vmsg->size); 473 } 474 } while (rc < 0 && (errno == EINTR || errno == EAGAIN)); 475 } 476 477 if (rc <= 0) { 478 vu_panic(dev, "Error while writing: %s", strerror(errno)); 479 return false; 480 } 481 482 return true; 483 } 484 485 static bool 486 vu_send_reply(VuDev *dev, int conn_fd, VhostUserMsg *vmsg) 487 { 488 /* Set the version in the flags when sending the reply */ 489 vmsg->flags &= ~VHOST_USER_VERSION_MASK; 490 vmsg->flags |= VHOST_USER_VERSION; 491 vmsg->flags |= VHOST_USER_REPLY_MASK; 492 493 return vu_message_write(dev, conn_fd, vmsg); 494 } 495 496 /* 497 * Processes a reply on the backend channel. 498 * Entered with backend_mutex held and releases it before exit. 499 * Returns true on success. 500 */ 501 static bool 502 vu_process_message_reply(VuDev *dev, const VhostUserMsg *vmsg) 503 { 504 VhostUserMsg msg_reply; 505 bool result = false; 506 507 if ((vmsg->flags & VHOST_USER_NEED_REPLY_MASK) == 0) { 508 result = true; 509 goto out; 510 } 511 512 if (!vu_message_read_default(dev, dev->backend_fd, &msg_reply)) { 513 goto out; 514 } 515 516 if (msg_reply.request != vmsg->request) { 517 DPRINT("Received unexpected msg type. Expected %d received %d", 518 vmsg->request, msg_reply.request); 519 goto out; 520 } 521 522 result = msg_reply.payload.u64 == 0; 523 524 out: 525 pthread_mutex_unlock(&dev->backend_mutex); 526 return result; 527 } 528 529 /* Kick the log_call_fd if required. */ 530 static void 531 vu_log_kick(VuDev *dev) 532 { 533 if (dev->log_call_fd != -1) { 534 DPRINT("Kicking the QEMU's log...\n"); 535 if (eventfd_write(dev->log_call_fd, 1) < 0) { 536 vu_panic(dev, "Error writing eventfd: %s", strerror(errno)); 537 } 538 } 539 } 540 541 static void 542 vu_log_page(uint8_t *log_table, uint64_t page) 543 { 544 DPRINT("Logged dirty guest page: %"PRId64"\n", page); 545 qatomic_or(&log_table[page / 8], 1 << (page % 8)); 546 } 547 548 static void 549 vu_log_write(VuDev *dev, uint64_t address, uint64_t length) 550 { 551 uint64_t page; 552 553 if (!(dev->features & (1ULL << VHOST_F_LOG_ALL)) || 554 !dev->log_table || !length) { 555 return; 556 } 557 558 assert(dev->log_size > ((address + length - 1) / VHOST_LOG_PAGE / 8)); 559 560 page = address / VHOST_LOG_PAGE; 561 while (page * VHOST_LOG_PAGE < address + length) { 562 vu_log_page(dev->log_table, page); 563 page += 1; 564 } 565 566 vu_log_kick(dev); 567 } 568 569 static void 570 vu_kick_cb(VuDev *dev, int condition, void *data) 571 { 572 int index = (intptr_t)data; 573 VuVirtq *vq = &dev->vq[index]; 574 int sock = vq->kick_fd; 575 eventfd_t kick_data; 576 ssize_t rc; 577 578 rc = eventfd_read(sock, &kick_data); 579 if (rc == -1) { 580 vu_panic(dev, "kick eventfd_read(): %s", strerror(errno)); 581 dev->remove_watch(dev, dev->vq[index].kick_fd); 582 } else { 583 DPRINT("Got kick_data: %016"PRIx64" handler:%p idx:%d\n", 584 kick_data, vq->handler, index); 585 if (vq->handler) { 586 vq->handler(dev, index); 587 } 588 } 589 } 590 591 static bool 592 vu_get_features_exec(VuDev *dev, VhostUserMsg *vmsg) 593 { 594 vmsg->payload.u64 = 595 /* 596 * The following VIRTIO feature bits are supported by our virtqueue 597 * implementation: 598 */ 599 1ULL << VIRTIO_F_NOTIFY_ON_EMPTY | 600 1ULL << VIRTIO_RING_F_INDIRECT_DESC | 601 1ULL << VIRTIO_RING_F_EVENT_IDX | 602 1ULL << VIRTIO_F_VERSION_1 | 603 604 /* vhost-user feature bits */ 605 1ULL << VHOST_F_LOG_ALL | 606 1ULL << VHOST_USER_F_PROTOCOL_FEATURES; 607 608 if (dev->iface->get_features) { 609 vmsg->payload.u64 |= dev->iface->get_features(dev); 610 } 611 612 vmsg->size = sizeof(vmsg->payload.u64); 613 vmsg->fd_num = 0; 614 615 DPRINT("Sending back to guest u64: 0x%016"PRIx64"\n", vmsg->payload.u64); 616 617 return true; 618 } 619 620 static void 621 vu_set_enable_all_rings(VuDev *dev, bool enabled) 622 { 623 uint16_t i; 624 625 for (i = 0; i < dev->max_queues; i++) { 626 dev->vq[i].enable = enabled; 627 } 628 } 629 630 static bool 631 vu_set_features_exec(VuDev *dev, VhostUserMsg *vmsg) 632 { 633 DPRINT("u64: 0x%016"PRIx64"\n", vmsg->payload.u64); 634 635 dev->features = vmsg->payload.u64; 636 if (!vu_has_feature(dev, VIRTIO_F_VERSION_1)) { 637 /* 638 * We only support devices conforming to VIRTIO 1.0 or 639 * later 640 */ 641 vu_panic(dev, "virtio legacy devices aren't supported by libvhost-user"); 642 return false; 643 } 644 645 if (!(dev->features & VHOST_USER_F_PROTOCOL_FEATURES)) { 646 vu_set_enable_all_rings(dev, true); 647 } 648 649 if (dev->iface->set_features) { 650 dev->iface->set_features(dev, dev->features); 651 } 652 653 return false; 654 } 655 656 static bool 657 vu_set_owner_exec(VuDev *dev, VhostUserMsg *vmsg) 658 { 659 return false; 660 } 661 662 static void 663 vu_close_log(VuDev *dev) 664 { 665 if (dev->log_table) { 666 if (munmap(dev->log_table, dev->log_size) != 0) { 667 perror("close log munmap() error"); 668 } 669 670 dev->log_table = NULL; 671 } 672 if (dev->log_call_fd != -1) { 673 close(dev->log_call_fd); 674 dev->log_call_fd = -1; 675 } 676 } 677 678 static bool 679 vu_reset_device_exec(VuDev *dev, VhostUserMsg *vmsg) 680 { 681 vu_set_enable_all_rings(dev, false); 682 683 return false; 684 } 685 686 static bool 687 map_ring(VuDev *dev, VuVirtq *vq) 688 { 689 vq->vring.desc = qva_to_va(dev, vq->vra.desc_user_addr); 690 vq->vring.used = qva_to_va(dev, vq->vra.used_user_addr); 691 vq->vring.avail = qva_to_va(dev, vq->vra.avail_user_addr); 692 693 DPRINT("Setting virtq addresses:\n"); 694 DPRINT(" vring_desc at %p\n", vq->vring.desc); 695 DPRINT(" vring_used at %p\n", vq->vring.used); 696 DPRINT(" vring_avail at %p\n", vq->vring.avail); 697 698 return !(vq->vring.desc && vq->vring.used && vq->vring.avail); 699 } 700 701 static bool 702 generate_faults(VuDev *dev) { 703 unsigned int i; 704 for (i = 0; i < dev->nregions; i++) { 705 #ifdef UFFDIO_REGISTER 706 VuDevRegion *dev_region = &dev->regions[i]; 707 int ret; 708 struct uffdio_register reg_struct; 709 710 /* 711 * We should already have an open ufd. Mark each memory 712 * range as ufd. 713 * Discard any mapping we have here; note I can't use MADV_REMOVE 714 * or fallocate to make the hole since I don't want to lose 715 * data that's already arrived in the shared process. 716 * TODO: How to do hugepage 717 */ 718 ret = madvise((void *)(uintptr_t)dev_region->mmap_addr, 719 dev_region->size + dev_region->mmap_offset, 720 MADV_DONTNEED); 721 if (ret) { 722 fprintf(stderr, 723 "%s: Failed to madvise(DONTNEED) region %d: %s\n", 724 __func__, i, strerror(errno)); 725 } 726 /* 727 * Turn off transparent hugepages so we dont get lose wakeups 728 * in neighbouring pages. 729 * TODO: Turn this backon later. 730 */ 731 ret = madvise((void *)(uintptr_t)dev_region->mmap_addr, 732 dev_region->size + dev_region->mmap_offset, 733 MADV_NOHUGEPAGE); 734 if (ret) { 735 /* 736 * Note: This can happen legally on kernels that are configured 737 * without madvise'able hugepages 738 */ 739 fprintf(stderr, 740 "%s: Failed to madvise(NOHUGEPAGE) region %d: %s\n", 741 __func__, i, strerror(errno)); 742 } 743 744 reg_struct.range.start = (uintptr_t)dev_region->mmap_addr; 745 reg_struct.range.len = dev_region->size + dev_region->mmap_offset; 746 reg_struct.mode = UFFDIO_REGISTER_MODE_MISSING; 747 748 if (ioctl(dev->postcopy_ufd, UFFDIO_REGISTER, ®_struct)) { 749 vu_panic(dev, "%s: Failed to userfault region %d " 750 "@%" PRIx64 " + size:%" PRIx64 " offset: %" PRIx64 751 ": (ufd=%d)%s\n", 752 __func__, i, 753 dev_region->mmap_addr, 754 dev_region->size, dev_region->mmap_offset, 755 dev->postcopy_ufd, strerror(errno)); 756 return false; 757 } 758 if (!(reg_struct.ioctls & (1ULL << _UFFDIO_COPY))) { 759 vu_panic(dev, "%s Region (%d) doesn't support COPY", 760 __func__, i); 761 return false; 762 } 763 DPRINT("%s: region %d: Registered userfault for %" 764 PRIx64 " + %" PRIx64 "\n", __func__, i, 765 (uint64_t)reg_struct.range.start, 766 (uint64_t)reg_struct.range.len); 767 /* Now it's registered we can let the client at it */ 768 if (mprotect((void *)(uintptr_t)dev_region->mmap_addr, 769 dev_region->size + dev_region->mmap_offset, 770 PROT_READ | PROT_WRITE)) { 771 vu_panic(dev, "failed to mprotect region %d for postcopy (%s)", 772 i, strerror(errno)); 773 return false; 774 } 775 /* TODO: Stash 'zero' support flags somewhere */ 776 #endif 777 } 778 779 return true; 780 } 781 782 static bool 783 vu_add_mem_reg(VuDev *dev, VhostUserMsg *vmsg) { 784 int i; 785 VhostUserMemoryRegion m = vmsg->payload.memreg.region, *msg_region = &m; 786 787 if (vmsg->fd_num != 1) { 788 vmsg_close_fds(vmsg); 789 vu_panic(dev, "VHOST_USER_ADD_MEM_REG received %d fds - only 1 fd " 790 "should be sent for this message type", vmsg->fd_num); 791 return false; 792 } 793 794 if (vmsg->size < VHOST_USER_MEM_REG_SIZE) { 795 close(vmsg->fds[0]); 796 vu_panic(dev, "VHOST_USER_ADD_MEM_REG requires a message size of at " 797 "least %zu bytes and only %d bytes were received", 798 VHOST_USER_MEM_REG_SIZE, vmsg->size); 799 return false; 800 } 801 802 if (dev->nregions == VHOST_USER_MAX_RAM_SLOTS) { 803 close(vmsg->fds[0]); 804 vu_panic(dev, "failing attempt to hot add memory via " 805 "VHOST_USER_ADD_MEM_REG message because the backend has " 806 "no free ram slots available"); 807 return false; 808 } 809 810 /* 811 * If we are in postcopy mode and we receive a u64 payload with a 0 value 812 * we know all the postcopy client bases have been received, and we 813 * should start generating faults. 814 */ 815 if (dev->postcopy_listening && 816 vmsg->size == sizeof(vmsg->payload.u64) && 817 vmsg->payload.u64 == 0) { 818 (void)generate_faults(dev); 819 return false; 820 } 821 822 _vu_add_mem_reg(dev, msg_region, vmsg->fds[0]); 823 close(vmsg->fds[0]); 824 825 if (dev->postcopy_listening) { 826 /* Send the message back to qemu with the addresses filled in. */ 827 vmsg->fd_num = 0; 828 DPRINT("Successfully added new region in postcopy\n"); 829 return true; 830 } else { 831 for (i = 0; i < dev->max_queues; i++) { 832 if (dev->vq[i].vring.desc) { 833 if (map_ring(dev, &dev->vq[i])) { 834 vu_panic(dev, "remapping queue %d for new memory region", 835 i); 836 } 837 } 838 } 839 840 DPRINT("Successfully added new region\n"); 841 return false; 842 } 843 } 844 845 static inline bool reg_equal(VuDevRegion *vudev_reg, 846 VhostUserMemoryRegion *msg_reg) 847 { 848 if (vudev_reg->gpa == msg_reg->guest_phys_addr && 849 vudev_reg->qva == msg_reg->userspace_addr && 850 vudev_reg->size == msg_reg->memory_size) { 851 return true; 852 } 853 854 return false; 855 } 856 857 static bool 858 vu_rem_mem_reg(VuDev *dev, VhostUserMsg *vmsg) { 859 VhostUserMemoryRegion m = vmsg->payload.memreg.region, *msg_region = &m; 860 unsigned int i; 861 bool found = false; 862 863 if (vmsg->fd_num > 1) { 864 vmsg_close_fds(vmsg); 865 vu_panic(dev, "VHOST_USER_REM_MEM_REG received %d fds - at most 1 fd " 866 "should be sent for this message type", vmsg->fd_num); 867 return false; 868 } 869 870 if (vmsg->size < VHOST_USER_MEM_REG_SIZE) { 871 vmsg_close_fds(vmsg); 872 vu_panic(dev, "VHOST_USER_REM_MEM_REG requires a message size of at " 873 "least %zu bytes and only %d bytes were received", 874 VHOST_USER_MEM_REG_SIZE, vmsg->size); 875 return false; 876 } 877 878 DPRINT("Removing region:\n"); 879 DPRINT(" guest_phys_addr: 0x%016"PRIx64"\n", 880 msg_region->guest_phys_addr); 881 DPRINT(" memory_size: 0x%016"PRIx64"\n", 882 msg_region->memory_size); 883 DPRINT(" userspace_addr 0x%016"PRIx64"\n", 884 msg_region->userspace_addr); 885 DPRINT(" mmap_offset 0x%016"PRIx64"\n", 886 msg_region->mmap_offset); 887 888 for (i = 0; i < dev->nregions; i++) { 889 if (reg_equal(&dev->regions[i], msg_region)) { 890 VuDevRegion *r = &dev->regions[i]; 891 void *ma = (void *) (uintptr_t) r->mmap_addr; 892 893 if (ma) { 894 munmap(ma, r->size + r->mmap_offset); 895 } 896 897 /* 898 * Shift all affected entries by 1 to close the hole at index i and 899 * zero out the last entry. 900 */ 901 memmove(dev->regions + i, dev->regions + i + 1, 902 sizeof(VuDevRegion) * (dev->nregions - i - 1)); 903 memset(dev->regions + dev->nregions - 1, 0, sizeof(VuDevRegion)); 904 DPRINT("Successfully removed a region\n"); 905 dev->nregions--; 906 i--; 907 908 found = true; 909 910 /* Continue the search for eventual duplicates. */ 911 } 912 } 913 914 if (!found) { 915 vu_panic(dev, "Specified region not found\n"); 916 } 917 918 vmsg_close_fds(vmsg); 919 920 return false; 921 } 922 923 static bool 924 vu_get_shared_object(VuDev *dev, VhostUserMsg *vmsg) 925 { 926 int fd_num = 0; 927 int dmabuf_fd = -1; 928 if (dev->iface->get_shared_object) { 929 dmabuf_fd = dev->iface->get_shared_object( 930 dev, &vmsg->payload.object.uuid[0]); 931 } 932 if (dmabuf_fd != -1) { 933 DPRINT("dmabuf_fd found for requested UUID\n"); 934 vmsg->fds[fd_num++] = dmabuf_fd; 935 } 936 vmsg->fd_num = fd_num; 937 938 return true; 939 } 940 941 static bool 942 vu_set_mem_table_exec(VuDev *dev, VhostUserMsg *vmsg) 943 { 944 VhostUserMemory m = vmsg->payload.memory, *memory = &m; 945 unsigned int i; 946 947 vu_remove_all_mem_regs(dev); 948 949 DPRINT("Nregions: %u\n", memory->nregions); 950 for (i = 0; i < memory->nregions; i++) { 951 _vu_add_mem_reg(dev, &memory->regions[i], vmsg->fds[i]); 952 close(vmsg->fds[i]); 953 } 954 955 if (dev->postcopy_listening) { 956 /* Send the message back to qemu with the addresses filled in */ 957 vmsg->fd_num = 0; 958 if (!vu_send_reply(dev, dev->sock, vmsg)) { 959 vu_panic(dev, "failed to respond to set-mem-table for postcopy"); 960 return false; 961 } 962 963 /* 964 * Wait for QEMU to confirm that it's registered the handler for the 965 * faults. 966 */ 967 if (!dev->read_msg(dev, dev->sock, vmsg) || 968 vmsg->size != sizeof(vmsg->payload.u64) || 969 vmsg->payload.u64 != 0) { 970 vu_panic(dev, "failed to receive valid ack for postcopy set-mem-table"); 971 return false; 972 } 973 974 /* OK, now we can go and register the memory and generate faults */ 975 (void)generate_faults(dev); 976 return false; 977 } 978 979 for (i = 0; i < dev->max_queues; i++) { 980 if (dev->vq[i].vring.desc) { 981 if (map_ring(dev, &dev->vq[i])) { 982 vu_panic(dev, "remapping queue %d during setmemtable", i); 983 } 984 } 985 } 986 987 return false; 988 } 989 990 static bool 991 vu_set_log_base_exec(VuDev *dev, VhostUserMsg *vmsg) 992 { 993 int fd; 994 uint64_t log_mmap_size, log_mmap_offset; 995 void *rc; 996 997 if (vmsg->fd_num != 1 || 998 vmsg->size != sizeof(vmsg->payload.log)) { 999 vu_panic(dev, "Invalid log_base message"); 1000 return true; 1001 } 1002 1003 fd = vmsg->fds[0]; 1004 log_mmap_offset = vmsg->payload.log.mmap_offset; 1005 log_mmap_size = vmsg->payload.log.mmap_size; 1006 DPRINT("Log mmap_offset: %"PRId64"\n", log_mmap_offset); 1007 DPRINT("Log mmap_size: %"PRId64"\n", log_mmap_size); 1008 1009 rc = mmap(0, log_mmap_size, PROT_READ | PROT_WRITE, MAP_SHARED, fd, 1010 log_mmap_offset); 1011 close(fd); 1012 if (rc == MAP_FAILED) { 1013 perror("log mmap error"); 1014 } 1015 1016 if (dev->log_table) { 1017 munmap(dev->log_table, dev->log_size); 1018 } 1019 dev->log_table = rc; 1020 dev->log_size = log_mmap_size; 1021 1022 vmsg->size = sizeof(vmsg->payload.u64); 1023 vmsg->fd_num = 0; 1024 1025 return true; 1026 } 1027 1028 static bool 1029 vu_set_log_fd_exec(VuDev *dev, VhostUserMsg *vmsg) 1030 { 1031 if (vmsg->fd_num != 1) { 1032 vu_panic(dev, "Invalid log_fd message"); 1033 return false; 1034 } 1035 1036 if (dev->log_call_fd != -1) { 1037 close(dev->log_call_fd); 1038 } 1039 dev->log_call_fd = vmsg->fds[0]; 1040 DPRINT("Got log_call_fd: %d\n", vmsg->fds[0]); 1041 1042 return false; 1043 } 1044 1045 static bool 1046 vu_set_vring_num_exec(VuDev *dev, VhostUserMsg *vmsg) 1047 { 1048 unsigned int index = vmsg->payload.state.index; 1049 unsigned int num = vmsg->payload.state.num; 1050 1051 DPRINT("State.index: %u\n", index); 1052 DPRINT("State.num: %u\n", num); 1053 dev->vq[index].vring.num = num; 1054 1055 return false; 1056 } 1057 1058 static bool 1059 vu_set_vring_addr_exec(VuDev *dev, VhostUserMsg *vmsg) 1060 { 1061 struct vhost_vring_addr addr = vmsg->payload.addr, *vra = &addr; 1062 unsigned int index = vra->index; 1063 VuVirtq *vq = &dev->vq[index]; 1064 1065 DPRINT("vhost_vring_addr:\n"); 1066 DPRINT(" index: %d\n", vra->index); 1067 DPRINT(" flags: %d\n", vra->flags); 1068 DPRINT(" desc_user_addr: 0x%016" PRIx64 "\n", (uint64_t)vra->desc_user_addr); 1069 DPRINT(" used_user_addr: 0x%016" PRIx64 "\n", (uint64_t)vra->used_user_addr); 1070 DPRINT(" avail_user_addr: 0x%016" PRIx64 "\n", (uint64_t)vra->avail_user_addr); 1071 DPRINT(" log_guest_addr: 0x%016" PRIx64 "\n", (uint64_t)vra->log_guest_addr); 1072 1073 vq->vra = *vra; 1074 vq->vring.flags = vra->flags; 1075 vq->vring.log_guest_addr = vra->log_guest_addr; 1076 1077 1078 if (map_ring(dev, vq)) { 1079 vu_panic(dev, "Invalid vring_addr message"); 1080 return false; 1081 } 1082 1083 vq->used_idx = le16toh(vq->vring.used->idx); 1084 1085 if (vq->last_avail_idx != vq->used_idx) { 1086 bool resume = dev->iface->queue_is_processed_in_order && 1087 dev->iface->queue_is_processed_in_order(dev, index); 1088 1089 DPRINT("Last avail index != used index: %u != %u%s\n", 1090 vq->last_avail_idx, vq->used_idx, 1091 resume ? ", resuming" : ""); 1092 1093 if (resume) { 1094 vq->shadow_avail_idx = vq->last_avail_idx = vq->used_idx; 1095 } 1096 } 1097 1098 return false; 1099 } 1100 1101 static bool 1102 vu_set_vring_base_exec(VuDev *dev, VhostUserMsg *vmsg) 1103 { 1104 unsigned int index = vmsg->payload.state.index; 1105 unsigned int num = vmsg->payload.state.num; 1106 1107 DPRINT("State.index: %u\n", index); 1108 DPRINT("State.num: %u\n", num); 1109 dev->vq[index].shadow_avail_idx = dev->vq[index].last_avail_idx = num; 1110 1111 return false; 1112 } 1113 1114 static bool 1115 vu_get_vring_base_exec(VuDev *dev, VhostUserMsg *vmsg) 1116 { 1117 unsigned int index = vmsg->payload.state.index; 1118 1119 DPRINT("State.index: %u\n", index); 1120 vmsg->payload.state.num = dev->vq[index].last_avail_idx; 1121 vmsg->size = sizeof(vmsg->payload.state); 1122 1123 dev->vq[index].started = false; 1124 if (dev->iface->queue_set_started) { 1125 dev->iface->queue_set_started(dev, index, false); 1126 } 1127 1128 if (dev->vq[index].call_fd != -1) { 1129 close(dev->vq[index].call_fd); 1130 dev->vq[index].call_fd = -1; 1131 } 1132 if (dev->vq[index].kick_fd != -1) { 1133 dev->remove_watch(dev, dev->vq[index].kick_fd); 1134 close(dev->vq[index].kick_fd); 1135 dev->vq[index].kick_fd = -1; 1136 } 1137 1138 return true; 1139 } 1140 1141 static bool 1142 vu_check_queue_msg_file(VuDev *dev, VhostUserMsg *vmsg) 1143 { 1144 int index = vmsg->payload.u64 & VHOST_USER_VRING_IDX_MASK; 1145 bool nofd = vmsg->payload.u64 & VHOST_USER_VRING_NOFD_MASK; 1146 1147 if (index >= dev->max_queues) { 1148 vmsg_close_fds(vmsg); 1149 vu_panic(dev, "Invalid queue index: %u", index); 1150 return false; 1151 } 1152 1153 if (nofd) { 1154 vmsg_close_fds(vmsg); 1155 return true; 1156 } 1157 1158 if (vmsg->fd_num != 1) { 1159 vmsg_close_fds(vmsg); 1160 vu_panic(dev, "Invalid fds in request: %d", vmsg->request); 1161 return false; 1162 } 1163 1164 return true; 1165 } 1166 1167 static int 1168 inflight_desc_compare(const void *a, const void *b) 1169 { 1170 VuVirtqInflightDesc *desc0 = (VuVirtqInflightDesc *)a, 1171 *desc1 = (VuVirtqInflightDesc *)b; 1172 1173 if (desc1->counter > desc0->counter && 1174 (desc1->counter - desc0->counter) < VIRTQUEUE_MAX_SIZE * 2) { 1175 return 1; 1176 } 1177 1178 return -1; 1179 } 1180 1181 static int 1182 vu_check_queue_inflights(VuDev *dev, VuVirtq *vq) 1183 { 1184 int i = 0; 1185 1186 if (!vu_has_protocol_feature(dev, VHOST_USER_PROTOCOL_F_INFLIGHT_SHMFD)) { 1187 return 0; 1188 } 1189 1190 if (unlikely(!vq->inflight)) { 1191 return -1; 1192 } 1193 1194 if (unlikely(!vq->inflight->version)) { 1195 /* initialize the buffer */ 1196 vq->inflight->version = INFLIGHT_VERSION; 1197 return 0; 1198 } 1199 1200 vq->used_idx = le16toh(vq->vring.used->idx); 1201 vq->resubmit_num = 0; 1202 vq->resubmit_list = NULL; 1203 vq->counter = 0; 1204 1205 if (unlikely(vq->inflight->used_idx != vq->used_idx)) { 1206 vq->inflight->desc[vq->inflight->last_batch_head].inflight = 0; 1207 1208 barrier(); 1209 1210 vq->inflight->used_idx = vq->used_idx; 1211 } 1212 1213 for (i = 0; i < vq->inflight->desc_num; i++) { 1214 if (vq->inflight->desc[i].inflight == 1) { 1215 vq->inuse++; 1216 } 1217 } 1218 1219 vq->shadow_avail_idx = vq->last_avail_idx = vq->inuse + vq->used_idx; 1220 1221 if (vq->inuse) { 1222 vq->resubmit_list = calloc(vq->inuse, sizeof(VuVirtqInflightDesc)); 1223 if (!vq->resubmit_list) { 1224 return -1; 1225 } 1226 1227 for (i = 0; i < vq->inflight->desc_num; i++) { 1228 if (vq->inflight->desc[i].inflight) { 1229 vq->resubmit_list[vq->resubmit_num].index = i; 1230 vq->resubmit_list[vq->resubmit_num].counter = 1231 vq->inflight->desc[i].counter; 1232 vq->resubmit_num++; 1233 } 1234 } 1235 1236 if (vq->resubmit_num > 1) { 1237 qsort(vq->resubmit_list, vq->resubmit_num, 1238 sizeof(VuVirtqInflightDesc), inflight_desc_compare); 1239 } 1240 vq->counter = vq->resubmit_list[0].counter + 1; 1241 } 1242 1243 /* in case of I/O hang after reconnecting */ 1244 if (eventfd_write(vq->kick_fd, 1)) { 1245 return -1; 1246 } 1247 1248 return 0; 1249 } 1250 1251 static bool 1252 vu_set_vring_kick_exec(VuDev *dev, VhostUserMsg *vmsg) 1253 { 1254 int index = vmsg->payload.u64 & VHOST_USER_VRING_IDX_MASK; 1255 bool nofd = vmsg->payload.u64 & VHOST_USER_VRING_NOFD_MASK; 1256 1257 DPRINT("u64: 0x%016"PRIx64"\n", vmsg->payload.u64); 1258 1259 if (!vu_check_queue_msg_file(dev, vmsg)) { 1260 return false; 1261 } 1262 1263 if (dev->vq[index].kick_fd != -1) { 1264 dev->remove_watch(dev, dev->vq[index].kick_fd); 1265 close(dev->vq[index].kick_fd); 1266 dev->vq[index].kick_fd = -1; 1267 } 1268 1269 dev->vq[index].kick_fd = nofd ? -1 : vmsg->fds[0]; 1270 DPRINT("Got kick_fd: %d for vq: %d\n", dev->vq[index].kick_fd, index); 1271 1272 dev->vq[index].started = true; 1273 if (dev->iface->queue_set_started) { 1274 dev->iface->queue_set_started(dev, index, true); 1275 } 1276 1277 if (dev->vq[index].kick_fd != -1 && dev->vq[index].handler) { 1278 dev->set_watch(dev, dev->vq[index].kick_fd, VU_WATCH_IN, 1279 vu_kick_cb, (void *)(long)index); 1280 1281 DPRINT("Waiting for kicks on fd: %d for vq: %d\n", 1282 dev->vq[index].kick_fd, index); 1283 } 1284 1285 if (vu_check_queue_inflights(dev, &dev->vq[index])) { 1286 vu_panic(dev, "Failed to check inflights for vq: %d\n", index); 1287 } 1288 1289 return false; 1290 } 1291 1292 void vu_set_queue_handler(VuDev *dev, VuVirtq *vq, 1293 vu_queue_handler_cb handler) 1294 { 1295 int qidx = vq - dev->vq; 1296 1297 vq->handler = handler; 1298 if (vq->kick_fd >= 0) { 1299 if (handler) { 1300 dev->set_watch(dev, vq->kick_fd, VU_WATCH_IN, 1301 vu_kick_cb, (void *)(long)qidx); 1302 } else { 1303 dev->remove_watch(dev, vq->kick_fd); 1304 } 1305 } 1306 } 1307 1308 bool vu_set_queue_host_notifier(VuDev *dev, VuVirtq *vq, int fd, 1309 int size, int offset) 1310 { 1311 int qidx = vq - dev->vq; 1312 int fd_num = 0; 1313 VhostUserMsg vmsg = { 1314 .request = VHOST_USER_BACKEND_VRING_HOST_NOTIFIER_MSG, 1315 .flags = VHOST_USER_VERSION | VHOST_USER_NEED_REPLY_MASK, 1316 .size = sizeof(vmsg.payload.area), 1317 .payload.area = { 1318 .u64 = qidx & VHOST_USER_VRING_IDX_MASK, 1319 .size = size, 1320 .offset = offset, 1321 }, 1322 }; 1323 1324 if (fd == -1) { 1325 vmsg.payload.area.u64 |= VHOST_USER_VRING_NOFD_MASK; 1326 } else { 1327 vmsg.fds[fd_num++] = fd; 1328 } 1329 1330 vmsg.fd_num = fd_num; 1331 1332 if (!vu_has_protocol_feature(dev, VHOST_USER_PROTOCOL_F_BACKEND_SEND_FD)) { 1333 return false; 1334 } 1335 1336 pthread_mutex_lock(&dev->backend_mutex); 1337 if (!vu_message_write(dev, dev->backend_fd, &vmsg)) { 1338 pthread_mutex_unlock(&dev->backend_mutex); 1339 return false; 1340 } 1341 1342 /* Also unlocks the backend_mutex */ 1343 return vu_process_message_reply(dev, &vmsg); 1344 } 1345 1346 bool 1347 vu_lookup_shared_object(VuDev *dev, unsigned char uuid[UUID_LEN], 1348 int *dmabuf_fd) 1349 { 1350 bool result = false; 1351 VhostUserMsg msg_reply; 1352 VhostUserMsg msg = { 1353 .request = VHOST_USER_BACKEND_SHARED_OBJECT_LOOKUP, 1354 .size = sizeof(msg.payload.object), 1355 .flags = VHOST_USER_VERSION | VHOST_USER_NEED_REPLY_MASK, 1356 }; 1357 1358 memcpy(msg.payload.object.uuid, uuid, sizeof(uuid[0]) * UUID_LEN); 1359 1360 if (!vu_has_protocol_feature(dev, VHOST_USER_PROTOCOL_F_SHARED_OBJECT)) { 1361 return false; 1362 } 1363 1364 pthread_mutex_lock(&dev->backend_mutex); 1365 if (!vu_message_write(dev, dev->backend_fd, &msg)) { 1366 goto out; 1367 } 1368 1369 if (!vu_message_read_default(dev, dev->backend_fd, &msg_reply)) { 1370 goto out; 1371 } 1372 1373 if (msg_reply.request != msg.request) { 1374 DPRINT("Received unexpected msg type. Expected %d, received %d", 1375 msg.request, msg_reply.request); 1376 goto out; 1377 } 1378 1379 if (msg_reply.fd_num != 1) { 1380 DPRINT("Received unexpected number of fds. Expected 1, received %d", 1381 msg_reply.fd_num); 1382 goto out; 1383 } 1384 1385 *dmabuf_fd = msg_reply.fds[0]; 1386 result = *dmabuf_fd > 0 && msg_reply.payload.u64 == 0; 1387 out: 1388 pthread_mutex_unlock(&dev->backend_mutex); 1389 1390 return result; 1391 } 1392 1393 static bool 1394 vu_send_message(VuDev *dev, VhostUserMsg *vmsg) 1395 { 1396 bool result = false; 1397 pthread_mutex_lock(&dev->backend_mutex); 1398 if (!vu_message_write(dev, dev->backend_fd, vmsg)) { 1399 goto out; 1400 } 1401 1402 result = true; 1403 out: 1404 pthread_mutex_unlock(&dev->backend_mutex); 1405 1406 return result; 1407 } 1408 1409 bool 1410 vu_add_shared_object(VuDev *dev, unsigned char uuid[UUID_LEN]) 1411 { 1412 VhostUserMsg msg = { 1413 .request = VHOST_USER_BACKEND_SHARED_OBJECT_ADD, 1414 .size = sizeof(msg.payload.object), 1415 .flags = VHOST_USER_VERSION, 1416 }; 1417 1418 memcpy(msg.payload.object.uuid, uuid, sizeof(uuid[0]) * UUID_LEN); 1419 1420 if (!vu_has_protocol_feature(dev, VHOST_USER_PROTOCOL_F_SHARED_OBJECT)) { 1421 return false; 1422 } 1423 1424 return vu_send_message(dev, &msg); 1425 } 1426 1427 bool 1428 vu_rm_shared_object(VuDev *dev, unsigned char uuid[UUID_LEN]) 1429 { 1430 VhostUserMsg msg = { 1431 .request = VHOST_USER_BACKEND_SHARED_OBJECT_REMOVE, 1432 .size = sizeof(msg.payload.object), 1433 .flags = VHOST_USER_VERSION, 1434 }; 1435 1436 memcpy(msg.payload.object.uuid, uuid, sizeof(uuid[0]) * UUID_LEN); 1437 1438 if (!vu_has_protocol_feature(dev, VHOST_USER_PROTOCOL_F_SHARED_OBJECT)) { 1439 return false; 1440 } 1441 1442 return vu_send_message(dev, &msg); 1443 } 1444 1445 static bool 1446 vu_set_vring_call_exec(VuDev *dev, VhostUserMsg *vmsg) 1447 { 1448 int index = vmsg->payload.u64 & VHOST_USER_VRING_IDX_MASK; 1449 bool nofd = vmsg->payload.u64 & VHOST_USER_VRING_NOFD_MASK; 1450 1451 DPRINT("u64: 0x%016"PRIx64"\n", vmsg->payload.u64); 1452 1453 if (!vu_check_queue_msg_file(dev, vmsg)) { 1454 return false; 1455 } 1456 1457 if (dev->vq[index].call_fd != -1) { 1458 close(dev->vq[index].call_fd); 1459 dev->vq[index].call_fd = -1; 1460 } 1461 1462 dev->vq[index].call_fd = nofd ? -1 : vmsg->fds[0]; 1463 1464 /* in case of I/O hang after reconnecting */ 1465 if (dev->vq[index].call_fd != -1 && eventfd_write(vmsg->fds[0], 1)) { 1466 return -1; 1467 } 1468 1469 DPRINT("Got call_fd: %d for vq: %d\n", dev->vq[index].call_fd, index); 1470 1471 return false; 1472 } 1473 1474 static bool 1475 vu_set_vring_err_exec(VuDev *dev, VhostUserMsg *vmsg) 1476 { 1477 int index = vmsg->payload.u64 & VHOST_USER_VRING_IDX_MASK; 1478 bool nofd = vmsg->payload.u64 & VHOST_USER_VRING_NOFD_MASK; 1479 1480 DPRINT("u64: 0x%016"PRIx64"\n", vmsg->payload.u64); 1481 1482 if (!vu_check_queue_msg_file(dev, vmsg)) { 1483 return false; 1484 } 1485 1486 if (dev->vq[index].err_fd != -1) { 1487 close(dev->vq[index].err_fd); 1488 dev->vq[index].err_fd = -1; 1489 } 1490 1491 dev->vq[index].err_fd = nofd ? -1 : vmsg->fds[0]; 1492 1493 return false; 1494 } 1495 1496 static bool 1497 vu_get_protocol_features_exec(VuDev *dev, VhostUserMsg *vmsg) 1498 { 1499 /* 1500 * Note that we support, but intentionally do not set, 1501 * VHOST_USER_PROTOCOL_F_INBAND_NOTIFICATIONS. This means that 1502 * a device implementation can return it in its callback 1503 * (get_protocol_features) if it wants to use this for 1504 * simulation, but it is otherwise not desirable (if even 1505 * implemented by the frontend.) 1506 */ 1507 uint64_t features = 1ULL << VHOST_USER_PROTOCOL_F_MQ | 1508 1ULL << VHOST_USER_PROTOCOL_F_LOG_SHMFD | 1509 1ULL << VHOST_USER_PROTOCOL_F_BACKEND_REQ | 1510 1ULL << VHOST_USER_PROTOCOL_F_HOST_NOTIFIER | 1511 1ULL << VHOST_USER_PROTOCOL_F_BACKEND_SEND_FD | 1512 1ULL << VHOST_USER_PROTOCOL_F_REPLY_ACK | 1513 1ULL << VHOST_USER_PROTOCOL_F_CONFIGURE_MEM_SLOTS; 1514 1515 if (have_userfault()) { 1516 features |= 1ULL << VHOST_USER_PROTOCOL_F_PAGEFAULT; 1517 } 1518 1519 if (dev->iface->get_config && dev->iface->set_config) { 1520 features |= 1ULL << VHOST_USER_PROTOCOL_F_CONFIG; 1521 } 1522 1523 if (dev->iface->get_protocol_features) { 1524 features |= dev->iface->get_protocol_features(dev); 1525 } 1526 1527 vmsg_set_reply_u64(vmsg, features); 1528 return true; 1529 } 1530 1531 static bool 1532 vu_set_protocol_features_exec(VuDev *dev, VhostUserMsg *vmsg) 1533 { 1534 uint64_t features = vmsg->payload.u64; 1535 1536 DPRINT("u64: 0x%016"PRIx64"\n", features); 1537 1538 dev->protocol_features = vmsg->payload.u64; 1539 1540 if (vu_has_protocol_feature(dev, 1541 VHOST_USER_PROTOCOL_F_INBAND_NOTIFICATIONS) && 1542 (!vu_has_protocol_feature(dev, VHOST_USER_PROTOCOL_F_BACKEND_REQ) || 1543 !vu_has_protocol_feature(dev, VHOST_USER_PROTOCOL_F_REPLY_ACK))) { 1544 /* 1545 * The use case for using messages for kick/call is simulation, to make 1546 * the kick and call synchronous. To actually get that behaviour, both 1547 * of the other features are required. 1548 * Theoretically, one could use only kick messages, or do them without 1549 * having F_REPLY_ACK, but too many (possibly pending) messages on the 1550 * socket will eventually cause the frontend to hang, to avoid this in 1551 * scenarios where not desired enforce that the settings are in a way 1552 * that actually enables the simulation case. 1553 */ 1554 vu_panic(dev, 1555 "F_IN_BAND_NOTIFICATIONS requires F_BACKEND_REQ && F_REPLY_ACK"); 1556 return false; 1557 } 1558 1559 if (dev->iface->set_protocol_features) { 1560 dev->iface->set_protocol_features(dev, features); 1561 } 1562 1563 return false; 1564 } 1565 1566 static bool 1567 vu_get_queue_num_exec(VuDev *dev, VhostUserMsg *vmsg) 1568 { 1569 vmsg_set_reply_u64(vmsg, dev->max_queues); 1570 return true; 1571 } 1572 1573 static bool 1574 vu_set_vring_enable_exec(VuDev *dev, VhostUserMsg *vmsg) 1575 { 1576 unsigned int index = vmsg->payload.state.index; 1577 unsigned int enable = vmsg->payload.state.num; 1578 1579 DPRINT("State.index: %u\n", index); 1580 DPRINT("State.enable: %u\n", enable); 1581 1582 if (index >= dev->max_queues) { 1583 vu_panic(dev, "Invalid vring_enable index: %u", index); 1584 return false; 1585 } 1586 1587 dev->vq[index].enable = enable; 1588 return false; 1589 } 1590 1591 static bool 1592 vu_set_backend_req_fd(VuDev *dev, VhostUserMsg *vmsg) 1593 { 1594 if (vmsg->fd_num != 1) { 1595 vu_panic(dev, "Invalid backend_req_fd message (%d fd's)", vmsg->fd_num); 1596 return false; 1597 } 1598 1599 if (dev->backend_fd != -1) { 1600 close(dev->backend_fd); 1601 } 1602 dev->backend_fd = vmsg->fds[0]; 1603 DPRINT("Got backend_fd: %d\n", vmsg->fds[0]); 1604 1605 return false; 1606 } 1607 1608 static bool 1609 vu_get_config(VuDev *dev, VhostUserMsg *vmsg) 1610 { 1611 int ret = -1; 1612 1613 if (dev->iface->get_config) { 1614 ret = dev->iface->get_config(dev, vmsg->payload.config.region, 1615 vmsg->payload.config.size); 1616 } 1617 1618 if (ret) { 1619 /* resize to zero to indicate an error to frontend */ 1620 vmsg->size = 0; 1621 } 1622 1623 return true; 1624 } 1625 1626 static bool 1627 vu_set_config(VuDev *dev, VhostUserMsg *vmsg) 1628 { 1629 int ret = -1; 1630 1631 if (dev->iface->set_config) { 1632 ret = dev->iface->set_config(dev, vmsg->payload.config.region, 1633 vmsg->payload.config.offset, 1634 vmsg->payload.config.size, 1635 vmsg->payload.config.flags); 1636 if (ret) { 1637 vu_panic(dev, "Set virtio configuration space failed"); 1638 } 1639 } 1640 1641 return false; 1642 } 1643 1644 static bool 1645 vu_set_postcopy_advise(VuDev *dev, VhostUserMsg *vmsg) 1646 { 1647 #ifdef UFFDIO_API 1648 struct uffdio_api api_struct; 1649 1650 dev->postcopy_ufd = syscall(__NR_userfaultfd, O_CLOEXEC | O_NONBLOCK); 1651 vmsg->size = 0; 1652 #else 1653 dev->postcopy_ufd = -1; 1654 #endif 1655 1656 if (dev->postcopy_ufd == -1) { 1657 vu_panic(dev, "Userfaultfd not available: %s", strerror(errno)); 1658 goto out; 1659 } 1660 1661 #ifdef UFFDIO_API 1662 api_struct.api = UFFD_API; 1663 api_struct.features = 0; 1664 if (ioctl(dev->postcopy_ufd, UFFDIO_API, &api_struct)) { 1665 vu_panic(dev, "Failed UFFDIO_API: %s", strerror(errno)); 1666 close(dev->postcopy_ufd); 1667 dev->postcopy_ufd = -1; 1668 goto out; 1669 } 1670 /* TODO: Stash feature flags somewhere */ 1671 #endif 1672 1673 out: 1674 /* Return a ufd to the QEMU */ 1675 vmsg->fd_num = 1; 1676 vmsg->fds[0] = dev->postcopy_ufd; 1677 return true; /* = send a reply */ 1678 } 1679 1680 static bool 1681 vu_set_postcopy_listen(VuDev *dev, VhostUserMsg *vmsg) 1682 { 1683 if (dev->nregions) { 1684 vu_panic(dev, "Regions already registered at postcopy-listen"); 1685 vmsg_set_reply_u64(vmsg, -1); 1686 return true; 1687 } 1688 dev->postcopy_listening = true; 1689 1690 vmsg_set_reply_u64(vmsg, 0); 1691 return true; 1692 } 1693 1694 static bool 1695 vu_set_postcopy_end(VuDev *dev, VhostUserMsg *vmsg) 1696 { 1697 DPRINT("%s: Entry\n", __func__); 1698 dev->postcopy_listening = false; 1699 if (dev->postcopy_ufd > 0) { 1700 close(dev->postcopy_ufd); 1701 dev->postcopy_ufd = -1; 1702 DPRINT("%s: Done close\n", __func__); 1703 } 1704 1705 vmsg_set_reply_u64(vmsg, 0); 1706 DPRINT("%s: exit\n", __func__); 1707 return true; 1708 } 1709 1710 static inline uint64_t 1711 vu_inflight_queue_size(uint16_t queue_size) 1712 { 1713 return ALIGN_UP(sizeof(VuDescStateSplit) * queue_size + 1714 sizeof(uint16_t), INFLIGHT_ALIGNMENT); 1715 } 1716 1717 #ifdef MFD_ALLOW_SEALING 1718 static void * 1719 memfd_alloc(const char *name, size_t size, unsigned int flags, int *fd) 1720 { 1721 void *ptr; 1722 int ret; 1723 1724 *fd = memfd_create(name, MFD_ALLOW_SEALING); 1725 if (*fd < 0) { 1726 return NULL; 1727 } 1728 1729 ret = ftruncate(*fd, size); 1730 if (ret < 0) { 1731 close(*fd); 1732 return NULL; 1733 } 1734 1735 ret = fcntl(*fd, F_ADD_SEALS, flags); 1736 if (ret < 0) { 1737 close(*fd); 1738 return NULL; 1739 } 1740 1741 ptr = mmap(0, size, PROT_READ | PROT_WRITE, MAP_SHARED, *fd, 0); 1742 if (ptr == MAP_FAILED) { 1743 close(*fd); 1744 return NULL; 1745 } 1746 1747 return ptr; 1748 } 1749 #endif 1750 1751 static bool 1752 vu_get_inflight_fd(VuDev *dev, VhostUserMsg *vmsg) 1753 { 1754 int fd = -1; 1755 void *addr = NULL; 1756 uint64_t mmap_size; 1757 uint16_t num_queues, queue_size; 1758 1759 if (vmsg->size != sizeof(vmsg->payload.inflight)) { 1760 vu_panic(dev, "Invalid get_inflight_fd message:%d", vmsg->size); 1761 vmsg->payload.inflight.mmap_size = 0; 1762 return true; 1763 } 1764 1765 num_queues = vmsg->payload.inflight.num_queues; 1766 queue_size = vmsg->payload.inflight.queue_size; 1767 1768 DPRINT("set_inflight_fd num_queues: %"PRId16"\n", num_queues); 1769 DPRINT("set_inflight_fd queue_size: %"PRId16"\n", queue_size); 1770 1771 mmap_size = vu_inflight_queue_size(queue_size) * num_queues; 1772 1773 #ifdef MFD_ALLOW_SEALING 1774 addr = memfd_alloc("vhost-inflight", mmap_size, 1775 F_SEAL_GROW | F_SEAL_SHRINK | F_SEAL_SEAL, 1776 &fd); 1777 #else 1778 vu_panic(dev, "Not implemented: memfd support is missing"); 1779 #endif 1780 1781 if (!addr) { 1782 vu_panic(dev, "Failed to alloc vhost inflight area"); 1783 vmsg->payload.inflight.mmap_size = 0; 1784 return true; 1785 } 1786 1787 memset(addr, 0, mmap_size); 1788 1789 dev->inflight_info.addr = addr; 1790 dev->inflight_info.size = vmsg->payload.inflight.mmap_size = mmap_size; 1791 dev->inflight_info.fd = vmsg->fds[0] = fd; 1792 vmsg->fd_num = 1; 1793 vmsg->payload.inflight.mmap_offset = 0; 1794 1795 DPRINT("send inflight mmap_size: %"PRId64"\n", 1796 vmsg->payload.inflight.mmap_size); 1797 DPRINT("send inflight mmap offset: %"PRId64"\n", 1798 vmsg->payload.inflight.mmap_offset); 1799 1800 return true; 1801 } 1802 1803 static bool 1804 vu_set_inflight_fd(VuDev *dev, VhostUserMsg *vmsg) 1805 { 1806 int fd, i; 1807 uint64_t mmap_size, mmap_offset; 1808 uint16_t num_queues, queue_size; 1809 void *rc; 1810 1811 if (vmsg->fd_num != 1 || 1812 vmsg->size != sizeof(vmsg->payload.inflight)) { 1813 vu_panic(dev, "Invalid set_inflight_fd message size:%d fds:%d", 1814 vmsg->size, vmsg->fd_num); 1815 return false; 1816 } 1817 1818 fd = vmsg->fds[0]; 1819 mmap_size = vmsg->payload.inflight.mmap_size; 1820 mmap_offset = vmsg->payload.inflight.mmap_offset; 1821 num_queues = vmsg->payload.inflight.num_queues; 1822 queue_size = vmsg->payload.inflight.queue_size; 1823 1824 DPRINT("set_inflight_fd mmap_size: %"PRId64"\n", mmap_size); 1825 DPRINT("set_inflight_fd mmap_offset: %"PRId64"\n", mmap_offset); 1826 DPRINT("set_inflight_fd num_queues: %"PRId16"\n", num_queues); 1827 DPRINT("set_inflight_fd queue_size: %"PRId16"\n", queue_size); 1828 1829 rc = mmap(0, mmap_size, PROT_READ | PROT_WRITE, MAP_SHARED, 1830 fd, mmap_offset); 1831 1832 if (rc == MAP_FAILED) { 1833 vu_panic(dev, "set_inflight_fd mmap error: %s", strerror(errno)); 1834 return false; 1835 } 1836 1837 if (dev->inflight_info.fd) { 1838 close(dev->inflight_info.fd); 1839 } 1840 1841 if (dev->inflight_info.addr) { 1842 munmap(dev->inflight_info.addr, dev->inflight_info.size); 1843 } 1844 1845 dev->inflight_info.fd = fd; 1846 dev->inflight_info.addr = rc; 1847 dev->inflight_info.size = mmap_size; 1848 1849 for (i = 0; i < num_queues; i++) { 1850 dev->vq[i].inflight = (VuVirtqInflight *)rc; 1851 dev->vq[i].inflight->desc_num = queue_size; 1852 rc = (void *)((char *)rc + vu_inflight_queue_size(queue_size)); 1853 } 1854 1855 return false; 1856 } 1857 1858 static bool 1859 vu_handle_vring_kick(VuDev *dev, VhostUserMsg *vmsg) 1860 { 1861 unsigned int index = vmsg->payload.state.index; 1862 1863 if (index >= dev->max_queues) { 1864 vu_panic(dev, "Invalid queue index: %u", index); 1865 return false; 1866 } 1867 1868 DPRINT("Got kick message: handler:%p idx:%u\n", 1869 dev->vq[index].handler, index); 1870 1871 if (!dev->vq[index].started) { 1872 dev->vq[index].started = true; 1873 1874 if (dev->iface->queue_set_started) { 1875 dev->iface->queue_set_started(dev, index, true); 1876 } 1877 } 1878 1879 if (dev->vq[index].handler) { 1880 dev->vq[index].handler(dev, index); 1881 } 1882 1883 return false; 1884 } 1885 1886 static bool vu_handle_get_max_memslots(VuDev *dev, VhostUserMsg *vmsg) 1887 { 1888 vmsg_set_reply_u64(vmsg, VHOST_USER_MAX_RAM_SLOTS); 1889 1890 DPRINT("u64: 0x%016"PRIx64"\n", (uint64_t) VHOST_USER_MAX_RAM_SLOTS); 1891 1892 return true; 1893 } 1894 1895 static bool 1896 vu_process_message(VuDev *dev, VhostUserMsg *vmsg) 1897 { 1898 int do_reply = 0; 1899 1900 /* Print out generic part of the request. */ 1901 DPRINT("================ Vhost user message ================\n"); 1902 DPRINT("Request: %s (%d)\n", vu_request_to_string(vmsg->request), 1903 vmsg->request); 1904 DPRINT("Flags: 0x%x\n", vmsg->flags); 1905 DPRINT("Size: %u\n", vmsg->size); 1906 1907 if (vmsg->fd_num) { 1908 int i; 1909 DPRINT("Fds:"); 1910 for (i = 0; i < vmsg->fd_num; i++) { 1911 DPRINT(" %d", vmsg->fds[i]); 1912 } 1913 DPRINT("\n"); 1914 } 1915 1916 if (dev->iface->process_msg && 1917 dev->iface->process_msg(dev, vmsg, &do_reply)) { 1918 return do_reply; 1919 } 1920 1921 switch (vmsg->request) { 1922 case VHOST_USER_GET_FEATURES: 1923 return vu_get_features_exec(dev, vmsg); 1924 case VHOST_USER_SET_FEATURES: 1925 return vu_set_features_exec(dev, vmsg); 1926 case VHOST_USER_GET_PROTOCOL_FEATURES: 1927 return vu_get_protocol_features_exec(dev, vmsg); 1928 case VHOST_USER_SET_PROTOCOL_FEATURES: 1929 return vu_set_protocol_features_exec(dev, vmsg); 1930 case VHOST_USER_SET_OWNER: 1931 return vu_set_owner_exec(dev, vmsg); 1932 case VHOST_USER_RESET_OWNER: 1933 return vu_reset_device_exec(dev, vmsg); 1934 case VHOST_USER_SET_MEM_TABLE: 1935 return vu_set_mem_table_exec(dev, vmsg); 1936 case VHOST_USER_SET_LOG_BASE: 1937 return vu_set_log_base_exec(dev, vmsg); 1938 case VHOST_USER_SET_LOG_FD: 1939 return vu_set_log_fd_exec(dev, vmsg); 1940 case VHOST_USER_SET_VRING_NUM: 1941 return vu_set_vring_num_exec(dev, vmsg); 1942 case VHOST_USER_SET_VRING_ADDR: 1943 return vu_set_vring_addr_exec(dev, vmsg); 1944 case VHOST_USER_SET_VRING_BASE: 1945 return vu_set_vring_base_exec(dev, vmsg); 1946 case VHOST_USER_GET_VRING_BASE: 1947 return vu_get_vring_base_exec(dev, vmsg); 1948 case VHOST_USER_SET_VRING_KICK: 1949 return vu_set_vring_kick_exec(dev, vmsg); 1950 case VHOST_USER_SET_VRING_CALL: 1951 return vu_set_vring_call_exec(dev, vmsg); 1952 case VHOST_USER_SET_VRING_ERR: 1953 return vu_set_vring_err_exec(dev, vmsg); 1954 case VHOST_USER_GET_QUEUE_NUM: 1955 return vu_get_queue_num_exec(dev, vmsg); 1956 case VHOST_USER_SET_VRING_ENABLE: 1957 return vu_set_vring_enable_exec(dev, vmsg); 1958 case VHOST_USER_SET_BACKEND_REQ_FD: 1959 return vu_set_backend_req_fd(dev, vmsg); 1960 case VHOST_USER_GET_CONFIG: 1961 return vu_get_config(dev, vmsg); 1962 case VHOST_USER_SET_CONFIG: 1963 return vu_set_config(dev, vmsg); 1964 case VHOST_USER_NONE: 1965 /* if you need processing before exit, override iface->process_msg */ 1966 exit(0); 1967 case VHOST_USER_POSTCOPY_ADVISE: 1968 return vu_set_postcopy_advise(dev, vmsg); 1969 case VHOST_USER_POSTCOPY_LISTEN: 1970 return vu_set_postcopy_listen(dev, vmsg); 1971 case VHOST_USER_POSTCOPY_END: 1972 return vu_set_postcopy_end(dev, vmsg); 1973 case VHOST_USER_GET_INFLIGHT_FD: 1974 return vu_get_inflight_fd(dev, vmsg); 1975 case VHOST_USER_SET_INFLIGHT_FD: 1976 return vu_set_inflight_fd(dev, vmsg); 1977 case VHOST_USER_VRING_KICK: 1978 return vu_handle_vring_kick(dev, vmsg); 1979 case VHOST_USER_GET_MAX_MEM_SLOTS: 1980 return vu_handle_get_max_memslots(dev, vmsg); 1981 case VHOST_USER_ADD_MEM_REG: 1982 return vu_add_mem_reg(dev, vmsg); 1983 case VHOST_USER_REM_MEM_REG: 1984 return vu_rem_mem_reg(dev, vmsg); 1985 case VHOST_USER_GET_SHARED_OBJECT: 1986 return vu_get_shared_object(dev, vmsg); 1987 default: 1988 vmsg_close_fds(vmsg); 1989 vu_panic(dev, "Unhandled request: %d", vmsg->request); 1990 } 1991 1992 return false; 1993 } 1994 1995 bool 1996 vu_dispatch(VuDev *dev) 1997 { 1998 VhostUserMsg vmsg = { 0, }; 1999 int reply_requested; 2000 bool need_reply, success = false; 2001 2002 if (!dev->read_msg(dev, dev->sock, &vmsg)) { 2003 goto end; 2004 } 2005 2006 need_reply = vmsg.flags & VHOST_USER_NEED_REPLY_MASK; 2007 2008 reply_requested = vu_process_message(dev, &vmsg); 2009 if (!reply_requested && need_reply) { 2010 vmsg_set_reply_u64(&vmsg, 0); 2011 reply_requested = 1; 2012 } 2013 2014 if (!reply_requested) { 2015 success = true; 2016 goto end; 2017 } 2018 2019 if (!vu_send_reply(dev, dev->sock, &vmsg)) { 2020 goto end; 2021 } 2022 2023 success = true; 2024 2025 end: 2026 free(vmsg.data); 2027 return success; 2028 } 2029 2030 void 2031 vu_deinit(VuDev *dev) 2032 { 2033 unsigned int i; 2034 2035 vu_remove_all_mem_regs(dev); 2036 2037 for (i = 0; i < dev->max_queues; i++) { 2038 VuVirtq *vq = &dev->vq[i]; 2039 2040 if (vq->call_fd != -1) { 2041 close(vq->call_fd); 2042 vq->call_fd = -1; 2043 } 2044 2045 if (vq->kick_fd != -1) { 2046 dev->remove_watch(dev, vq->kick_fd); 2047 close(vq->kick_fd); 2048 vq->kick_fd = -1; 2049 } 2050 2051 if (vq->err_fd != -1) { 2052 close(vq->err_fd); 2053 vq->err_fd = -1; 2054 } 2055 2056 if (vq->resubmit_list) { 2057 free(vq->resubmit_list); 2058 vq->resubmit_list = NULL; 2059 } 2060 2061 vq->inflight = NULL; 2062 } 2063 2064 if (dev->inflight_info.addr) { 2065 munmap(dev->inflight_info.addr, dev->inflight_info.size); 2066 dev->inflight_info.addr = NULL; 2067 } 2068 2069 if (dev->inflight_info.fd > 0) { 2070 close(dev->inflight_info.fd); 2071 dev->inflight_info.fd = -1; 2072 } 2073 2074 vu_close_log(dev); 2075 if (dev->backend_fd != -1) { 2076 close(dev->backend_fd); 2077 dev->backend_fd = -1; 2078 } 2079 pthread_mutex_destroy(&dev->backend_mutex); 2080 2081 if (dev->sock != -1) { 2082 close(dev->sock); 2083 } 2084 2085 free(dev->vq); 2086 dev->vq = NULL; 2087 free(dev->regions); 2088 dev->regions = NULL; 2089 } 2090 2091 bool 2092 vu_init(VuDev *dev, 2093 uint16_t max_queues, 2094 int socket, 2095 vu_panic_cb panic, 2096 vu_read_msg_cb read_msg, 2097 vu_set_watch_cb set_watch, 2098 vu_remove_watch_cb remove_watch, 2099 const VuDevIface *iface) 2100 { 2101 uint16_t i; 2102 2103 assert(max_queues > 0); 2104 assert(socket >= 0); 2105 assert(set_watch); 2106 assert(remove_watch); 2107 assert(iface); 2108 assert(panic); 2109 2110 memset(dev, 0, sizeof(*dev)); 2111 2112 dev->sock = socket; 2113 dev->panic = panic; 2114 dev->read_msg = read_msg ? read_msg : vu_message_read_default; 2115 dev->set_watch = set_watch; 2116 dev->remove_watch = remove_watch; 2117 dev->iface = iface; 2118 dev->log_call_fd = -1; 2119 pthread_mutex_init(&dev->backend_mutex, NULL); 2120 dev->backend_fd = -1; 2121 dev->max_queues = max_queues; 2122 2123 dev->regions = malloc(VHOST_USER_MAX_RAM_SLOTS * sizeof(dev->regions[0])); 2124 if (!dev->regions) { 2125 DPRINT("%s: failed to malloc mem regions\n", __func__); 2126 return false; 2127 } 2128 memset(dev->regions, 0, VHOST_USER_MAX_RAM_SLOTS * sizeof(dev->regions[0])); 2129 2130 dev->vq = malloc(max_queues * sizeof(dev->vq[0])); 2131 if (!dev->vq) { 2132 DPRINT("%s: failed to malloc virtqueues\n", __func__); 2133 free(dev->regions); 2134 dev->regions = NULL; 2135 return false; 2136 } 2137 2138 for (i = 0; i < max_queues; i++) { 2139 dev->vq[i] = (VuVirtq) { 2140 .call_fd = -1, .kick_fd = -1, .err_fd = -1, 2141 .notification = true, 2142 }; 2143 } 2144 2145 return true; 2146 } 2147 2148 VuVirtq * 2149 vu_get_queue(VuDev *dev, int qidx) 2150 { 2151 assert(qidx < dev->max_queues); 2152 return &dev->vq[qidx]; 2153 } 2154 2155 bool 2156 vu_queue_enabled(VuDev *dev, VuVirtq *vq) 2157 { 2158 return vq->enable; 2159 } 2160 2161 bool 2162 vu_queue_started(const VuDev *dev, const VuVirtq *vq) 2163 { 2164 return vq->started; 2165 } 2166 2167 static inline uint16_t 2168 vring_avail_flags(VuVirtq *vq) 2169 { 2170 return le16toh(vq->vring.avail->flags); 2171 } 2172 2173 static inline uint16_t 2174 vring_avail_idx(VuVirtq *vq) 2175 { 2176 vq->shadow_avail_idx = le16toh(vq->vring.avail->idx); 2177 2178 return vq->shadow_avail_idx; 2179 } 2180 2181 static inline uint16_t 2182 vring_avail_ring(VuVirtq *vq, int i) 2183 { 2184 return le16toh(vq->vring.avail->ring[i]); 2185 } 2186 2187 static inline uint16_t 2188 vring_get_used_event(VuVirtq *vq) 2189 { 2190 return vring_avail_ring(vq, vq->vring.num); 2191 } 2192 2193 static int 2194 virtqueue_num_heads(VuDev *dev, VuVirtq *vq, unsigned int idx) 2195 { 2196 uint16_t num_heads = vring_avail_idx(vq) - idx; 2197 2198 /* Check it isn't doing very strange things with descriptor numbers. */ 2199 if (num_heads > vq->vring.num) { 2200 vu_panic(dev, "Guest moved used index from %u to %u", 2201 idx, vq->shadow_avail_idx); 2202 return -1; 2203 } 2204 if (num_heads) { 2205 /* On success, callers read a descriptor at vq->last_avail_idx. 2206 * Make sure descriptor read does not bypass avail index read. */ 2207 smp_rmb(); 2208 } 2209 2210 return num_heads; 2211 } 2212 2213 static bool 2214 virtqueue_get_head(VuDev *dev, VuVirtq *vq, 2215 unsigned int idx, unsigned int *head) 2216 { 2217 /* Grab the next descriptor number they're advertising, and increment 2218 * the index we've seen. */ 2219 *head = vring_avail_ring(vq, idx % vq->vring.num); 2220 2221 /* If their number is silly, that's a fatal mistake. */ 2222 if (*head >= vq->vring.num) { 2223 vu_panic(dev, "Guest says index %u is available", *head); 2224 return false; 2225 } 2226 2227 return true; 2228 } 2229 2230 static int 2231 virtqueue_read_indirect_desc(VuDev *dev, struct vring_desc *desc, 2232 uint64_t addr, size_t len) 2233 { 2234 struct vring_desc *ori_desc; 2235 uint64_t read_len; 2236 2237 if (len > (VIRTQUEUE_MAX_SIZE * sizeof(struct vring_desc))) { 2238 return -1; 2239 } 2240 2241 if (len == 0) { 2242 return -1; 2243 } 2244 2245 while (len) { 2246 read_len = len; 2247 ori_desc = vu_gpa_to_va(dev, &read_len, addr); 2248 if (!ori_desc) { 2249 return -1; 2250 } 2251 2252 memcpy(desc, ori_desc, read_len); 2253 len -= read_len; 2254 addr += read_len; 2255 desc += read_len; 2256 } 2257 2258 return 0; 2259 } 2260 2261 enum { 2262 VIRTQUEUE_READ_DESC_ERROR = -1, 2263 VIRTQUEUE_READ_DESC_DONE = 0, /* end of chain */ 2264 VIRTQUEUE_READ_DESC_MORE = 1, /* more buffers in chain */ 2265 }; 2266 2267 static int 2268 virtqueue_read_next_desc(VuDev *dev, struct vring_desc *desc, 2269 int i, unsigned int max, unsigned int *next) 2270 { 2271 /* If this descriptor says it doesn't chain, we're done. */ 2272 if (!(le16toh(desc[i].flags) & VRING_DESC_F_NEXT)) { 2273 return VIRTQUEUE_READ_DESC_DONE; 2274 } 2275 2276 /* Check they're not leading us off end of descriptors. */ 2277 *next = le16toh(desc[i].next); 2278 /* Make sure compiler knows to grab that: we don't want it changing! */ 2279 smp_wmb(); 2280 2281 if (*next >= max) { 2282 vu_panic(dev, "Desc next is %u", *next); 2283 return VIRTQUEUE_READ_DESC_ERROR; 2284 } 2285 2286 return VIRTQUEUE_READ_DESC_MORE; 2287 } 2288 2289 void 2290 vu_queue_get_avail_bytes(VuDev *dev, VuVirtq *vq, unsigned int *in_bytes, 2291 unsigned int *out_bytes, 2292 unsigned max_in_bytes, unsigned max_out_bytes) 2293 { 2294 unsigned int idx; 2295 unsigned int total_bufs, in_total, out_total; 2296 int rc; 2297 2298 idx = vq->last_avail_idx; 2299 2300 total_bufs = in_total = out_total = 0; 2301 if (unlikely(dev->broken) || 2302 unlikely(!vq->vring.avail)) { 2303 goto done; 2304 } 2305 2306 while ((rc = virtqueue_num_heads(dev, vq, idx)) > 0) { 2307 unsigned int max, desc_len, num_bufs, indirect = 0; 2308 uint64_t desc_addr, read_len; 2309 struct vring_desc *desc; 2310 struct vring_desc desc_buf[VIRTQUEUE_MAX_SIZE]; 2311 unsigned int i; 2312 2313 max = vq->vring.num; 2314 num_bufs = total_bufs; 2315 if (!virtqueue_get_head(dev, vq, idx++, &i)) { 2316 goto err; 2317 } 2318 desc = vq->vring.desc; 2319 2320 if (le16toh(desc[i].flags) & VRING_DESC_F_INDIRECT) { 2321 if (le32toh(desc[i].len) % sizeof(struct vring_desc)) { 2322 vu_panic(dev, "Invalid size for indirect buffer table"); 2323 goto err; 2324 } 2325 2326 /* If we've got too many, that implies a descriptor loop. */ 2327 if (num_bufs >= max) { 2328 vu_panic(dev, "Looped descriptor"); 2329 goto err; 2330 } 2331 2332 /* loop over the indirect descriptor table */ 2333 indirect = 1; 2334 desc_addr = le64toh(desc[i].addr); 2335 desc_len = le32toh(desc[i].len); 2336 max = desc_len / sizeof(struct vring_desc); 2337 read_len = desc_len; 2338 desc = vu_gpa_to_va(dev, &read_len, desc_addr); 2339 if (unlikely(desc && read_len != desc_len)) { 2340 /* Failed to use zero copy */ 2341 desc = NULL; 2342 if (!virtqueue_read_indirect_desc(dev, desc_buf, 2343 desc_addr, 2344 desc_len)) { 2345 desc = desc_buf; 2346 } 2347 } 2348 if (!desc) { 2349 vu_panic(dev, "Invalid indirect buffer table"); 2350 goto err; 2351 } 2352 num_bufs = i = 0; 2353 } 2354 2355 do { 2356 /* If we've got too many, that implies a descriptor loop. */ 2357 if (++num_bufs > max) { 2358 vu_panic(dev, "Looped descriptor"); 2359 goto err; 2360 } 2361 2362 if (le16toh(desc[i].flags) & VRING_DESC_F_WRITE) { 2363 in_total += le32toh(desc[i].len); 2364 } else { 2365 out_total += le32toh(desc[i].len); 2366 } 2367 if (in_total >= max_in_bytes && out_total >= max_out_bytes) { 2368 goto done; 2369 } 2370 rc = virtqueue_read_next_desc(dev, desc, i, max, &i); 2371 } while (rc == VIRTQUEUE_READ_DESC_MORE); 2372 2373 if (rc == VIRTQUEUE_READ_DESC_ERROR) { 2374 goto err; 2375 } 2376 2377 if (!indirect) { 2378 total_bufs = num_bufs; 2379 } else { 2380 total_bufs++; 2381 } 2382 } 2383 if (rc < 0) { 2384 goto err; 2385 } 2386 done: 2387 if (in_bytes) { 2388 *in_bytes = in_total; 2389 } 2390 if (out_bytes) { 2391 *out_bytes = out_total; 2392 } 2393 return; 2394 2395 err: 2396 in_total = out_total = 0; 2397 goto done; 2398 } 2399 2400 bool 2401 vu_queue_avail_bytes(VuDev *dev, VuVirtq *vq, unsigned int in_bytes, 2402 unsigned int out_bytes) 2403 { 2404 unsigned int in_total, out_total; 2405 2406 vu_queue_get_avail_bytes(dev, vq, &in_total, &out_total, 2407 in_bytes, out_bytes); 2408 2409 return in_bytes <= in_total && out_bytes <= out_total; 2410 } 2411 2412 /* Fetch avail_idx from VQ memory only when we really need to know if 2413 * guest has added some buffers. */ 2414 bool 2415 vu_queue_empty(VuDev *dev, VuVirtq *vq) 2416 { 2417 if (unlikely(dev->broken) || 2418 unlikely(!vq->vring.avail)) { 2419 return true; 2420 } 2421 2422 if (vq->shadow_avail_idx != vq->last_avail_idx) { 2423 return false; 2424 } 2425 2426 return vring_avail_idx(vq) == vq->last_avail_idx; 2427 } 2428 2429 static bool 2430 vring_notify(VuDev *dev, VuVirtq *vq) 2431 { 2432 uint16_t old, new; 2433 bool v; 2434 2435 /* We need to expose used array entries before checking used event. */ 2436 smp_mb(); 2437 2438 /* Always notify when queue is empty (when feature acknowledge) */ 2439 if (vu_has_feature(dev, VIRTIO_F_NOTIFY_ON_EMPTY) && 2440 !vq->inuse && vu_queue_empty(dev, vq)) { 2441 return true; 2442 } 2443 2444 if (!vu_has_feature(dev, VIRTIO_RING_F_EVENT_IDX)) { 2445 return !(vring_avail_flags(vq) & VRING_AVAIL_F_NO_INTERRUPT); 2446 } 2447 2448 v = vq->signalled_used_valid; 2449 vq->signalled_used_valid = true; 2450 old = vq->signalled_used; 2451 new = vq->signalled_used = vq->used_idx; 2452 return !v || vring_need_event(vring_get_used_event(vq), new, old); 2453 } 2454 2455 static void _vu_queue_notify(VuDev *dev, VuVirtq *vq, bool sync) 2456 { 2457 if (unlikely(dev->broken) || 2458 unlikely(!vq->vring.avail)) { 2459 return; 2460 } 2461 2462 if (!vring_notify(dev, vq)) { 2463 DPRINT("skipped notify...\n"); 2464 return; 2465 } 2466 2467 if (vq->call_fd < 0 && 2468 vu_has_protocol_feature(dev, 2469 VHOST_USER_PROTOCOL_F_INBAND_NOTIFICATIONS) && 2470 vu_has_protocol_feature(dev, VHOST_USER_PROTOCOL_F_BACKEND_REQ)) { 2471 VhostUserMsg vmsg = { 2472 .request = VHOST_USER_BACKEND_VRING_CALL, 2473 .flags = VHOST_USER_VERSION, 2474 .size = sizeof(vmsg.payload.state), 2475 .payload.state = { 2476 .index = vq - dev->vq, 2477 }, 2478 }; 2479 bool ack = sync && 2480 vu_has_protocol_feature(dev, 2481 VHOST_USER_PROTOCOL_F_REPLY_ACK); 2482 2483 if (ack) { 2484 vmsg.flags |= VHOST_USER_NEED_REPLY_MASK; 2485 } 2486 2487 vu_message_write(dev, dev->backend_fd, &vmsg); 2488 if (ack) { 2489 vu_message_read_default(dev, dev->backend_fd, &vmsg); 2490 } 2491 return; 2492 } 2493 2494 if (eventfd_write(vq->call_fd, 1) < 0) { 2495 vu_panic(dev, "Error writing eventfd: %s", strerror(errno)); 2496 } 2497 } 2498 2499 void vu_queue_notify(VuDev *dev, VuVirtq *vq) 2500 { 2501 _vu_queue_notify(dev, vq, false); 2502 } 2503 2504 void vu_queue_notify_sync(VuDev *dev, VuVirtq *vq) 2505 { 2506 _vu_queue_notify(dev, vq, true); 2507 } 2508 2509 void vu_config_change_msg(VuDev *dev) 2510 { 2511 VhostUserMsg vmsg = { 2512 .request = VHOST_USER_BACKEND_CONFIG_CHANGE_MSG, 2513 .flags = VHOST_USER_VERSION, 2514 }; 2515 2516 vu_message_write(dev, dev->backend_fd, &vmsg); 2517 } 2518 2519 static inline void 2520 vring_used_flags_set_bit(VuVirtq *vq, int mask) 2521 { 2522 uint16_t *flags; 2523 2524 flags = (uint16_t *)((char*)vq->vring.used + 2525 offsetof(struct vring_used, flags)); 2526 *flags = htole16(le16toh(*flags) | mask); 2527 } 2528 2529 static inline void 2530 vring_used_flags_unset_bit(VuVirtq *vq, int mask) 2531 { 2532 uint16_t *flags; 2533 2534 flags = (uint16_t *)((char*)vq->vring.used + 2535 offsetof(struct vring_used, flags)); 2536 *flags = htole16(le16toh(*flags) & ~mask); 2537 } 2538 2539 static inline void 2540 vring_set_avail_event(VuVirtq *vq, uint16_t val) 2541 { 2542 uint16_t val_le = htole16(val); 2543 2544 if (!vq->notification) { 2545 return; 2546 } 2547 2548 memcpy(&vq->vring.used->ring[vq->vring.num], &val_le, sizeof(uint16_t)); 2549 } 2550 2551 void 2552 vu_queue_set_notification(VuDev *dev, VuVirtq *vq, int enable) 2553 { 2554 vq->notification = enable; 2555 if (vu_has_feature(dev, VIRTIO_RING_F_EVENT_IDX)) { 2556 vring_set_avail_event(vq, vring_avail_idx(vq)); 2557 } else if (enable) { 2558 vring_used_flags_unset_bit(vq, VRING_USED_F_NO_NOTIFY); 2559 } else { 2560 vring_used_flags_set_bit(vq, VRING_USED_F_NO_NOTIFY); 2561 } 2562 if (enable) { 2563 /* Expose avail event/used flags before caller checks the avail idx. */ 2564 smp_mb(); 2565 } 2566 } 2567 2568 static bool 2569 virtqueue_map_desc(VuDev *dev, 2570 unsigned int *p_num_sg, struct iovec *iov, 2571 unsigned int max_num_sg, bool is_write, 2572 uint64_t pa, size_t sz) 2573 { 2574 unsigned num_sg = *p_num_sg; 2575 2576 assert(num_sg <= max_num_sg); 2577 2578 if (!sz) { 2579 vu_panic(dev, "virtio: zero sized buffers are not allowed"); 2580 return false; 2581 } 2582 2583 while (sz) { 2584 uint64_t len = sz; 2585 2586 if (num_sg == max_num_sg) { 2587 vu_panic(dev, "virtio: too many descriptors in indirect table"); 2588 return false; 2589 } 2590 2591 iov[num_sg].iov_base = vu_gpa_to_va(dev, &len, pa); 2592 if (iov[num_sg].iov_base == NULL) { 2593 vu_panic(dev, "virtio: invalid address for buffers"); 2594 return false; 2595 } 2596 iov[num_sg].iov_len = len; 2597 num_sg++; 2598 sz -= len; 2599 pa += len; 2600 } 2601 2602 *p_num_sg = num_sg; 2603 return true; 2604 } 2605 2606 static void * 2607 virtqueue_alloc_element(size_t sz, 2608 unsigned out_num, unsigned in_num) 2609 { 2610 VuVirtqElement *elem; 2611 size_t in_sg_ofs = ALIGN_UP(sz, __alignof__(elem->in_sg[0])); 2612 size_t out_sg_ofs = in_sg_ofs + in_num * sizeof(elem->in_sg[0]); 2613 size_t out_sg_end = out_sg_ofs + out_num * sizeof(elem->out_sg[0]); 2614 2615 assert(sz >= sizeof(VuVirtqElement)); 2616 elem = malloc(out_sg_end); 2617 if (!elem) { 2618 DPRINT("%s: failed to malloc virtqueue element\n", __func__); 2619 return NULL; 2620 } 2621 elem->out_num = out_num; 2622 elem->in_num = in_num; 2623 elem->in_sg = (void *)elem + in_sg_ofs; 2624 elem->out_sg = (void *)elem + out_sg_ofs; 2625 return elem; 2626 } 2627 2628 static void * 2629 vu_queue_map_desc(VuDev *dev, VuVirtq *vq, unsigned int idx, size_t sz) 2630 { 2631 struct vring_desc *desc = vq->vring.desc; 2632 uint64_t desc_addr, read_len; 2633 unsigned int desc_len; 2634 unsigned int max = vq->vring.num; 2635 unsigned int i = idx; 2636 VuVirtqElement *elem; 2637 unsigned int out_num = 0, in_num = 0; 2638 struct iovec iov[VIRTQUEUE_MAX_SIZE]; 2639 struct vring_desc desc_buf[VIRTQUEUE_MAX_SIZE]; 2640 int rc; 2641 2642 if (le16toh(desc[i].flags) & VRING_DESC_F_INDIRECT) { 2643 if (le32toh(desc[i].len) % sizeof(struct vring_desc)) { 2644 vu_panic(dev, "Invalid size for indirect buffer table"); 2645 return NULL; 2646 } 2647 2648 /* loop over the indirect descriptor table */ 2649 desc_addr = le64toh(desc[i].addr); 2650 desc_len = le32toh(desc[i].len); 2651 max = desc_len / sizeof(struct vring_desc); 2652 read_len = desc_len; 2653 desc = vu_gpa_to_va(dev, &read_len, desc_addr); 2654 if (unlikely(desc && read_len != desc_len)) { 2655 /* Failed to use zero copy */ 2656 desc = NULL; 2657 if (!virtqueue_read_indirect_desc(dev, desc_buf, 2658 desc_addr, 2659 desc_len)) { 2660 desc = desc_buf; 2661 } 2662 } 2663 if (!desc) { 2664 vu_panic(dev, "Invalid indirect buffer table"); 2665 return NULL; 2666 } 2667 i = 0; 2668 } 2669 2670 /* Collect all the descriptors */ 2671 do { 2672 if (le16toh(desc[i].flags) & VRING_DESC_F_WRITE) { 2673 if (!virtqueue_map_desc(dev, &in_num, iov + out_num, 2674 VIRTQUEUE_MAX_SIZE - out_num, true, 2675 le64toh(desc[i].addr), 2676 le32toh(desc[i].len))) { 2677 return NULL; 2678 } 2679 } else { 2680 if (in_num) { 2681 vu_panic(dev, "Incorrect order for descriptors"); 2682 return NULL; 2683 } 2684 if (!virtqueue_map_desc(dev, &out_num, iov, 2685 VIRTQUEUE_MAX_SIZE, false, 2686 le64toh(desc[i].addr), 2687 le32toh(desc[i].len))) { 2688 return NULL; 2689 } 2690 } 2691 2692 /* If we've got too many, that implies a descriptor loop. */ 2693 if ((in_num + out_num) > max) { 2694 vu_panic(dev, "Looped descriptor"); 2695 return NULL; 2696 } 2697 rc = virtqueue_read_next_desc(dev, desc, i, max, &i); 2698 } while (rc == VIRTQUEUE_READ_DESC_MORE); 2699 2700 if (rc == VIRTQUEUE_READ_DESC_ERROR) { 2701 vu_panic(dev, "read descriptor error"); 2702 return NULL; 2703 } 2704 2705 /* Now copy what we have collected and mapped */ 2706 elem = virtqueue_alloc_element(sz, out_num, in_num); 2707 if (!elem) { 2708 return NULL; 2709 } 2710 elem->index = idx; 2711 for (i = 0; i < out_num; i++) { 2712 elem->out_sg[i] = iov[i]; 2713 } 2714 for (i = 0; i < in_num; i++) { 2715 elem->in_sg[i] = iov[out_num + i]; 2716 } 2717 2718 return elem; 2719 } 2720 2721 static int 2722 vu_queue_inflight_get(VuDev *dev, VuVirtq *vq, int desc_idx) 2723 { 2724 if (!vu_has_protocol_feature(dev, VHOST_USER_PROTOCOL_F_INFLIGHT_SHMFD)) { 2725 return 0; 2726 } 2727 2728 if (unlikely(!vq->inflight)) { 2729 return -1; 2730 } 2731 2732 vq->inflight->desc[desc_idx].counter = vq->counter++; 2733 vq->inflight->desc[desc_idx].inflight = 1; 2734 2735 return 0; 2736 } 2737 2738 static int 2739 vu_queue_inflight_pre_put(VuDev *dev, VuVirtq *vq, int desc_idx) 2740 { 2741 if (!vu_has_protocol_feature(dev, VHOST_USER_PROTOCOL_F_INFLIGHT_SHMFD)) { 2742 return 0; 2743 } 2744 2745 if (unlikely(!vq->inflight)) { 2746 return -1; 2747 } 2748 2749 vq->inflight->last_batch_head = desc_idx; 2750 2751 return 0; 2752 } 2753 2754 static int 2755 vu_queue_inflight_post_put(VuDev *dev, VuVirtq *vq, int desc_idx) 2756 { 2757 if (!vu_has_protocol_feature(dev, VHOST_USER_PROTOCOL_F_INFLIGHT_SHMFD)) { 2758 return 0; 2759 } 2760 2761 if (unlikely(!vq->inflight)) { 2762 return -1; 2763 } 2764 2765 barrier(); 2766 2767 vq->inflight->desc[desc_idx].inflight = 0; 2768 2769 barrier(); 2770 2771 vq->inflight->used_idx = vq->used_idx; 2772 2773 return 0; 2774 } 2775 2776 void * 2777 vu_queue_pop(VuDev *dev, VuVirtq *vq, size_t sz) 2778 { 2779 int i; 2780 unsigned int head; 2781 VuVirtqElement *elem; 2782 2783 if (unlikely(dev->broken) || 2784 unlikely(!vq->vring.avail)) { 2785 return NULL; 2786 } 2787 2788 if (unlikely(vq->resubmit_list && vq->resubmit_num > 0)) { 2789 i = (--vq->resubmit_num); 2790 elem = vu_queue_map_desc(dev, vq, vq->resubmit_list[i].index, sz); 2791 2792 if (!vq->resubmit_num) { 2793 free(vq->resubmit_list); 2794 vq->resubmit_list = NULL; 2795 } 2796 2797 return elem; 2798 } 2799 2800 if (vu_queue_empty(dev, vq)) { 2801 return NULL; 2802 } 2803 /* 2804 * Needed after virtio_queue_empty(), see comment in 2805 * virtqueue_num_heads(). 2806 */ 2807 smp_rmb(); 2808 2809 if (vq->inuse >= vq->vring.num) { 2810 vu_panic(dev, "Virtqueue size exceeded"); 2811 return NULL; 2812 } 2813 2814 if (!virtqueue_get_head(dev, vq, vq->last_avail_idx++, &head)) { 2815 return NULL; 2816 } 2817 2818 if (vu_has_feature(dev, VIRTIO_RING_F_EVENT_IDX)) { 2819 vring_set_avail_event(vq, vq->last_avail_idx); 2820 } 2821 2822 elem = vu_queue_map_desc(dev, vq, head, sz); 2823 2824 if (!elem) { 2825 return NULL; 2826 } 2827 2828 vq->inuse++; 2829 2830 vu_queue_inflight_get(dev, vq, head); 2831 2832 return elem; 2833 } 2834 2835 static void 2836 vu_queue_detach_element(VuDev *dev, VuVirtq *vq, VuVirtqElement *elem, 2837 size_t len) 2838 { 2839 vq->inuse--; 2840 /* unmap, when DMA support is added */ 2841 } 2842 2843 void 2844 vu_queue_unpop(VuDev *dev, VuVirtq *vq, VuVirtqElement *elem, 2845 size_t len) 2846 { 2847 vq->last_avail_idx--; 2848 vu_queue_detach_element(dev, vq, elem, len); 2849 } 2850 2851 bool 2852 vu_queue_rewind(VuDev *dev, VuVirtq *vq, unsigned int num) 2853 { 2854 if (num > vq->inuse) { 2855 return false; 2856 } 2857 vq->last_avail_idx -= num; 2858 vq->inuse -= num; 2859 return true; 2860 } 2861 2862 static inline 2863 void vring_used_write(VuDev *dev, VuVirtq *vq, 2864 struct vring_used_elem *uelem, int i) 2865 { 2866 struct vring_used *used = vq->vring.used; 2867 2868 used->ring[i] = *uelem; 2869 vu_log_write(dev, vq->vring.log_guest_addr + 2870 offsetof(struct vring_used, ring[i]), 2871 sizeof(used->ring[i])); 2872 } 2873 2874 2875 static void 2876 vu_log_queue_fill(VuDev *dev, VuVirtq *vq, 2877 const VuVirtqElement *elem, 2878 unsigned int len) 2879 { 2880 struct vring_desc *desc = vq->vring.desc; 2881 unsigned int i, max, min, desc_len; 2882 uint64_t desc_addr, read_len; 2883 struct vring_desc desc_buf[VIRTQUEUE_MAX_SIZE]; 2884 unsigned num_bufs = 0; 2885 2886 max = vq->vring.num; 2887 i = elem->index; 2888 2889 if (le16toh(desc[i].flags) & VRING_DESC_F_INDIRECT) { 2890 if (le32toh(desc[i].len) % sizeof(struct vring_desc)) { 2891 vu_panic(dev, "Invalid size for indirect buffer table"); 2892 return; 2893 } 2894 2895 /* loop over the indirect descriptor table */ 2896 desc_addr = le64toh(desc[i].addr); 2897 desc_len = le32toh(desc[i].len); 2898 max = desc_len / sizeof(struct vring_desc); 2899 read_len = desc_len; 2900 desc = vu_gpa_to_va(dev, &read_len, desc_addr); 2901 if (unlikely(desc && read_len != desc_len)) { 2902 /* Failed to use zero copy */ 2903 desc = NULL; 2904 if (!virtqueue_read_indirect_desc(dev, desc_buf, 2905 desc_addr, 2906 desc_len)) { 2907 desc = desc_buf; 2908 } 2909 } 2910 if (!desc) { 2911 vu_panic(dev, "Invalid indirect buffer table"); 2912 return; 2913 } 2914 i = 0; 2915 } 2916 2917 do { 2918 if (++num_bufs > max) { 2919 vu_panic(dev, "Looped descriptor"); 2920 return; 2921 } 2922 2923 if (le16toh(desc[i].flags) & VRING_DESC_F_WRITE) { 2924 min = MIN(le32toh(desc[i].len), len); 2925 vu_log_write(dev, le64toh(desc[i].addr), min); 2926 len -= min; 2927 } 2928 2929 } while (len > 0 && 2930 (virtqueue_read_next_desc(dev, desc, i, max, &i) 2931 == VIRTQUEUE_READ_DESC_MORE)); 2932 } 2933 2934 void 2935 vu_queue_fill(VuDev *dev, VuVirtq *vq, 2936 const VuVirtqElement *elem, 2937 unsigned int len, unsigned int idx) 2938 { 2939 struct vring_used_elem uelem; 2940 2941 if (unlikely(dev->broken) || 2942 unlikely(!vq->vring.avail)) { 2943 return; 2944 } 2945 2946 vu_log_queue_fill(dev, vq, elem, len); 2947 2948 idx = (idx + vq->used_idx) % vq->vring.num; 2949 2950 uelem.id = htole32(elem->index); 2951 uelem.len = htole32(len); 2952 vring_used_write(dev, vq, &uelem, idx); 2953 } 2954 2955 static inline 2956 void vring_used_idx_set(VuDev *dev, VuVirtq *vq, uint16_t val) 2957 { 2958 vq->vring.used->idx = htole16(val); 2959 vu_log_write(dev, 2960 vq->vring.log_guest_addr + offsetof(struct vring_used, idx), 2961 sizeof(vq->vring.used->idx)); 2962 2963 vq->used_idx = val; 2964 } 2965 2966 void 2967 vu_queue_flush(VuDev *dev, VuVirtq *vq, unsigned int count) 2968 { 2969 uint16_t old, new; 2970 2971 if (unlikely(dev->broken) || 2972 unlikely(!vq->vring.avail)) { 2973 return; 2974 } 2975 2976 /* Make sure buffer is written before we update index. */ 2977 smp_wmb(); 2978 2979 old = vq->used_idx; 2980 new = old + count; 2981 vring_used_idx_set(dev, vq, new); 2982 vq->inuse -= count; 2983 if (unlikely((int16_t)(new - vq->signalled_used) < (uint16_t)(new - old))) { 2984 vq->signalled_used_valid = false; 2985 } 2986 } 2987 2988 void 2989 vu_queue_push(VuDev *dev, VuVirtq *vq, 2990 const VuVirtqElement *elem, unsigned int len) 2991 { 2992 vu_queue_fill(dev, vq, elem, len, 0); 2993 vu_queue_inflight_pre_put(dev, vq, elem->index); 2994 vu_queue_flush(dev, vq, 1); 2995 vu_queue_inflight_post_put(dev, vq, elem->index); 2996 } 2997