xref: /linux/drivers/vhost/vhost.c (revision d39d0ed196aa1685bb24771e92f78633c66ac9cb)
1 /* Copyright (C) 2009 Red Hat, Inc.
2  * Copyright (C) 2006 Rusty Russell IBM Corporation
3  *
4  * Author: Michael S. Tsirkin <mst@redhat.com>
5  *
6  * Inspiration, some code, and most witty comments come from
7  * Documentation/lguest/lguest.c, by Rusty Russell
8  *
9  * This work is licensed under the terms of the GNU GPL, version 2.
10  *
11  * Generic code for virtio server in host kernel.
12  */
13 
14 #include <linux/eventfd.h>
15 #include <linux/vhost.h>
16 #include <linux/virtio_net.h>
17 #include <linux/mm.h>
18 #include <linux/miscdevice.h>
19 #include <linux/mutex.h>
20 #include <linux/rcupdate.h>
21 #include <linux/poll.h>
22 #include <linux/file.h>
23 #include <linux/highmem.h>
24 #include <linux/slab.h>
25 #include <linux/kthread.h>
26 #include <linux/cgroup.h>
27 
28 #include <linux/net.h>
29 #include <linux/if_packet.h>
30 #include <linux/if_arp.h>
31 
32 #include <net/sock.h>
33 
34 #include "vhost.h"
35 
36 enum {
37 	VHOST_MEMORY_MAX_NREGIONS = 64,
38 	VHOST_MEMORY_F_LOG = 0x1,
39 };
40 
41 static void vhost_poll_func(struct file *file, wait_queue_head_t *wqh,
42 			    poll_table *pt)
43 {
44 	struct vhost_poll *poll;
45 	poll = container_of(pt, struct vhost_poll, table);
46 
47 	poll->wqh = wqh;
48 	add_wait_queue(wqh, &poll->wait);
49 }
50 
51 static int vhost_poll_wakeup(wait_queue_t *wait, unsigned mode, int sync,
52 			     void *key)
53 {
54 	struct vhost_poll *poll = container_of(wait, struct vhost_poll, wait);
55 
56 	if (!((unsigned long)key & poll->mask))
57 		return 0;
58 
59 	vhost_poll_queue(poll);
60 	return 0;
61 }
62 
63 /* Init poll structure */
64 void vhost_poll_init(struct vhost_poll *poll, vhost_work_fn_t fn,
65 		     unsigned long mask, struct vhost_dev *dev)
66 {
67 	struct vhost_work *work = &poll->work;
68 
69 	init_waitqueue_func_entry(&poll->wait, vhost_poll_wakeup);
70 	init_poll_funcptr(&poll->table, vhost_poll_func);
71 	poll->mask = mask;
72 	poll->dev = dev;
73 
74 	INIT_LIST_HEAD(&work->node);
75 	work->fn = fn;
76 	init_waitqueue_head(&work->done);
77 	work->flushing = 0;
78 	work->queue_seq = work->done_seq = 0;
79 }
80 
81 /* Start polling a file. We add ourselves to file's wait queue. The caller must
82  * keep a reference to a file until after vhost_poll_stop is called. */
83 void vhost_poll_start(struct vhost_poll *poll, struct file *file)
84 {
85 	unsigned long mask;
86 	mask = file->f_op->poll(file, &poll->table);
87 	if (mask)
88 		vhost_poll_wakeup(&poll->wait, 0, 0, (void *)mask);
89 }
90 
91 /* Stop polling a file. After this function returns, it becomes safe to drop the
92  * file reference. You must also flush afterwards. */
93 void vhost_poll_stop(struct vhost_poll *poll)
94 {
95 	remove_wait_queue(poll->wqh, &poll->wait);
96 }
97 
98 /* Flush any work that has been scheduled. When calling this, don't hold any
99  * locks that are also used by the callback. */
100 void vhost_poll_flush(struct vhost_poll *poll)
101 {
102 	struct vhost_work *work = &poll->work;
103 	unsigned seq;
104 	int left;
105 	int flushing;
106 
107 	spin_lock_irq(&poll->dev->work_lock);
108 	seq = work->queue_seq;
109 	work->flushing++;
110 	spin_unlock_irq(&poll->dev->work_lock);
111 	wait_event(work->done, ({
112 		   spin_lock_irq(&poll->dev->work_lock);
113 		   left = seq - work->done_seq <= 0;
114 		   spin_unlock_irq(&poll->dev->work_lock);
115 		   left;
116 	}));
117 	spin_lock_irq(&poll->dev->work_lock);
118 	flushing = --work->flushing;
119 	spin_unlock_irq(&poll->dev->work_lock);
120 	BUG_ON(flushing < 0);
121 }
122 
123 void vhost_poll_queue(struct vhost_poll *poll)
124 {
125 	struct vhost_dev *dev = poll->dev;
126 	struct vhost_work *work = &poll->work;
127 	unsigned long flags;
128 
129 	spin_lock_irqsave(&dev->work_lock, flags);
130 	if (list_empty(&work->node)) {
131 		list_add_tail(&work->node, &dev->work_list);
132 		work->queue_seq++;
133 		wake_up_process(dev->worker);
134 	}
135 	spin_unlock_irqrestore(&dev->work_lock, flags);
136 }
137 
138 static void vhost_vq_reset(struct vhost_dev *dev,
139 			   struct vhost_virtqueue *vq)
140 {
141 	vq->num = 1;
142 	vq->desc = NULL;
143 	vq->avail = NULL;
144 	vq->used = NULL;
145 	vq->last_avail_idx = 0;
146 	vq->avail_idx = 0;
147 	vq->last_used_idx = 0;
148 	vq->used_flags = 0;
149 	vq->used_flags = 0;
150 	vq->log_used = false;
151 	vq->log_addr = -1ull;
152 	vq->vhost_hlen = 0;
153 	vq->sock_hlen = 0;
154 	vq->private_data = NULL;
155 	vq->log_base = NULL;
156 	vq->error_ctx = NULL;
157 	vq->error = NULL;
158 	vq->kick = NULL;
159 	vq->call_ctx = NULL;
160 	vq->call = NULL;
161 	vq->log_ctx = NULL;
162 }
163 
164 static int vhost_worker(void *data)
165 {
166 	struct vhost_dev *dev = data;
167 	struct vhost_work *work = NULL;
168 	unsigned uninitialized_var(seq);
169 
170 	for (;;) {
171 		/* mb paired w/ kthread_stop */
172 		set_current_state(TASK_INTERRUPTIBLE);
173 
174 		spin_lock_irq(&dev->work_lock);
175 		if (work) {
176 			work->done_seq = seq;
177 			if (work->flushing)
178 				wake_up_all(&work->done);
179 		}
180 
181 		if (kthread_should_stop()) {
182 			spin_unlock_irq(&dev->work_lock);
183 			__set_current_state(TASK_RUNNING);
184 			return 0;
185 		}
186 		if (!list_empty(&dev->work_list)) {
187 			work = list_first_entry(&dev->work_list,
188 						struct vhost_work, node);
189 			list_del_init(&work->node);
190 			seq = work->queue_seq;
191 		} else
192 			work = NULL;
193 		spin_unlock_irq(&dev->work_lock);
194 
195 		if (work) {
196 			__set_current_state(TASK_RUNNING);
197 			work->fn(work);
198 		} else
199 			schedule();
200 
201 	}
202 }
203 
204 long vhost_dev_init(struct vhost_dev *dev,
205 		    struct vhost_virtqueue *vqs, int nvqs)
206 {
207 	int i;
208 
209 	dev->vqs = vqs;
210 	dev->nvqs = nvqs;
211 	mutex_init(&dev->mutex);
212 	dev->log_ctx = NULL;
213 	dev->log_file = NULL;
214 	dev->memory = NULL;
215 	dev->mm = NULL;
216 	spin_lock_init(&dev->work_lock);
217 	INIT_LIST_HEAD(&dev->work_list);
218 	dev->worker = NULL;
219 
220 	for (i = 0; i < dev->nvqs; ++i) {
221 		dev->vqs[i].dev = dev;
222 		mutex_init(&dev->vqs[i].mutex);
223 		vhost_vq_reset(dev, dev->vqs + i);
224 		if (dev->vqs[i].handle_kick)
225 			vhost_poll_init(&dev->vqs[i].poll,
226 					dev->vqs[i].handle_kick, POLLIN, dev);
227 	}
228 
229 	return 0;
230 }
231 
232 /* Caller should have device mutex */
233 long vhost_dev_check_owner(struct vhost_dev *dev)
234 {
235 	/* Are you the owner? If not, I don't think you mean to do that */
236 	return dev->mm == current->mm ? 0 : -EPERM;
237 }
238 
239 /* Caller should have device mutex */
240 static long vhost_dev_set_owner(struct vhost_dev *dev)
241 {
242 	struct task_struct *worker;
243 	int err;
244 	/* Is there an owner already? */
245 	if (dev->mm) {
246 		err = -EBUSY;
247 		goto err_mm;
248 	}
249 	/* No owner, become one */
250 	dev->mm = get_task_mm(current);
251 	worker = kthread_create(vhost_worker, dev, "vhost-%d", current->pid);
252 	if (IS_ERR(worker)) {
253 		err = PTR_ERR(worker);
254 		goto err_worker;
255 	}
256 
257 	dev->worker = worker;
258 	err = cgroup_attach_task_current_cg(worker);
259 	if (err)
260 		goto err_cgroup;
261 	wake_up_process(worker);	/* avoid contributing to loadavg */
262 
263 	return 0;
264 err_cgroup:
265 	kthread_stop(worker);
266 err_worker:
267 	if (dev->mm)
268 		mmput(dev->mm);
269 	dev->mm = NULL;
270 err_mm:
271 	return err;
272 }
273 
274 /* Caller should have device mutex */
275 long vhost_dev_reset_owner(struct vhost_dev *dev)
276 {
277 	struct vhost_memory *memory;
278 
279 	/* Restore memory to default empty mapping. */
280 	memory = kmalloc(offsetof(struct vhost_memory, regions), GFP_KERNEL);
281 	if (!memory)
282 		return -ENOMEM;
283 
284 	vhost_dev_cleanup(dev);
285 
286 	memory->nregions = 0;
287 	dev->memory = memory;
288 	return 0;
289 }
290 
291 /* Caller should have device mutex */
292 void vhost_dev_cleanup(struct vhost_dev *dev)
293 {
294 	int i;
295 	for (i = 0; i < dev->nvqs; ++i) {
296 		if (dev->vqs[i].kick && dev->vqs[i].handle_kick) {
297 			vhost_poll_stop(&dev->vqs[i].poll);
298 			vhost_poll_flush(&dev->vqs[i].poll);
299 		}
300 		if (dev->vqs[i].error_ctx)
301 			eventfd_ctx_put(dev->vqs[i].error_ctx);
302 		if (dev->vqs[i].error)
303 			fput(dev->vqs[i].error);
304 		if (dev->vqs[i].kick)
305 			fput(dev->vqs[i].kick);
306 		if (dev->vqs[i].call_ctx)
307 			eventfd_ctx_put(dev->vqs[i].call_ctx);
308 		if (dev->vqs[i].call)
309 			fput(dev->vqs[i].call);
310 		vhost_vq_reset(dev, dev->vqs + i);
311 	}
312 	if (dev->log_ctx)
313 		eventfd_ctx_put(dev->log_ctx);
314 	dev->log_ctx = NULL;
315 	if (dev->log_file)
316 		fput(dev->log_file);
317 	dev->log_file = NULL;
318 	/* No one will access memory at this point */
319 	kfree(dev->memory);
320 	dev->memory = NULL;
321 	if (dev->mm)
322 		mmput(dev->mm);
323 	dev->mm = NULL;
324 
325 	WARN_ON(!list_empty(&dev->work_list));
326 	kthread_stop(dev->worker);
327 }
328 
329 static int log_access_ok(void __user *log_base, u64 addr, unsigned long sz)
330 {
331 	u64 a = addr / VHOST_PAGE_SIZE / 8;
332 	/* Make sure 64 bit math will not overflow. */
333 	if (a > ULONG_MAX - (unsigned long)log_base ||
334 	    a + (unsigned long)log_base > ULONG_MAX)
335 		return -EFAULT;
336 
337 	return access_ok(VERIFY_WRITE, log_base + a,
338 			 (sz + VHOST_PAGE_SIZE * 8 - 1) / VHOST_PAGE_SIZE / 8);
339 }
340 
341 /* Caller should have vq mutex and device mutex. */
342 static int vq_memory_access_ok(void __user *log_base, struct vhost_memory *mem,
343 			       int log_all)
344 {
345 	int i;
346 
347 	if (!mem)
348 		return 0;
349 
350 	for (i = 0; i < mem->nregions; ++i) {
351 		struct vhost_memory_region *m = mem->regions + i;
352 		unsigned long a = m->userspace_addr;
353 		if (m->memory_size > ULONG_MAX)
354 			return 0;
355 		else if (!access_ok(VERIFY_WRITE, (void __user *)a,
356 				    m->memory_size))
357 			return 0;
358 		else if (log_all && !log_access_ok(log_base,
359 						   m->guest_phys_addr,
360 						   m->memory_size))
361 			return 0;
362 	}
363 	return 1;
364 }
365 
366 /* Can we switch to this memory table? */
367 /* Caller should have device mutex but not vq mutex */
368 static int memory_access_ok(struct vhost_dev *d, struct vhost_memory *mem,
369 			    int log_all)
370 {
371 	int i;
372 	for (i = 0; i < d->nvqs; ++i) {
373 		int ok;
374 		mutex_lock(&d->vqs[i].mutex);
375 		/* If ring is inactive, will check when it's enabled. */
376 		if (d->vqs[i].private_data)
377 			ok = vq_memory_access_ok(d->vqs[i].log_base, mem,
378 						 log_all);
379 		else
380 			ok = 1;
381 		mutex_unlock(&d->vqs[i].mutex);
382 		if (!ok)
383 			return 0;
384 	}
385 	return 1;
386 }
387 
388 static int vq_access_ok(unsigned int num,
389 			struct vring_desc __user *desc,
390 			struct vring_avail __user *avail,
391 			struct vring_used __user *used)
392 {
393 	return access_ok(VERIFY_READ, desc, num * sizeof *desc) &&
394 	       access_ok(VERIFY_READ, avail,
395 			 sizeof *avail + num * sizeof *avail->ring) &&
396 	       access_ok(VERIFY_WRITE, used,
397 			sizeof *used + num * sizeof *used->ring);
398 }
399 
400 /* Can we log writes? */
401 /* Caller should have device mutex but not vq mutex */
402 int vhost_log_access_ok(struct vhost_dev *dev)
403 {
404 	return memory_access_ok(dev, dev->memory, 1);
405 }
406 
407 /* Verify access for write logging. */
408 /* Caller should have vq mutex and device mutex */
409 static int vq_log_access_ok(struct vhost_virtqueue *vq, void __user *log_base)
410 {
411 	return vq_memory_access_ok(log_base, vq->dev->memory,
412 			    vhost_has_feature(vq->dev, VHOST_F_LOG_ALL)) &&
413 		(!vq->log_used || log_access_ok(log_base, vq->log_addr,
414 					sizeof *vq->used +
415 					vq->num * sizeof *vq->used->ring));
416 }
417 
418 /* Can we start vq? */
419 /* Caller should have vq mutex and device mutex */
420 int vhost_vq_access_ok(struct vhost_virtqueue *vq)
421 {
422 	return vq_access_ok(vq->num, vq->desc, vq->avail, vq->used) &&
423 		vq_log_access_ok(vq, vq->log_base);
424 }
425 
426 static long vhost_set_memory(struct vhost_dev *d, struct vhost_memory __user *m)
427 {
428 	struct vhost_memory mem, *newmem, *oldmem;
429 	unsigned long size = offsetof(struct vhost_memory, regions);
430 	if (copy_from_user(&mem, m, size))
431 		return -EFAULT;
432 	if (mem.padding)
433 		return -EOPNOTSUPP;
434 	if (mem.nregions > VHOST_MEMORY_MAX_NREGIONS)
435 		return -E2BIG;
436 	newmem = kmalloc(size + mem.nregions * sizeof *m->regions, GFP_KERNEL);
437 	if (!newmem)
438 		return -ENOMEM;
439 
440 	memcpy(newmem, &mem, size);
441 	if (copy_from_user(newmem->regions, m->regions,
442 			   mem.nregions * sizeof *m->regions)) {
443 		kfree(newmem);
444 		return -EFAULT;
445 	}
446 
447 	if (!memory_access_ok(d, newmem, vhost_has_feature(d, VHOST_F_LOG_ALL))) {
448 		kfree(newmem);
449 		return -EFAULT;
450 	}
451 	oldmem = d->memory;
452 	rcu_assign_pointer(d->memory, newmem);
453 	synchronize_rcu();
454 	kfree(oldmem);
455 	return 0;
456 }
457 
458 static int init_used(struct vhost_virtqueue *vq,
459 		     struct vring_used __user *used)
460 {
461 	int r = put_user(vq->used_flags, &used->flags);
462 	if (r)
463 		return r;
464 	return get_user(vq->last_used_idx, &used->idx);
465 }
466 
467 static long vhost_set_vring(struct vhost_dev *d, int ioctl, void __user *argp)
468 {
469 	struct file *eventfp, *filep = NULL,
470 		    *pollstart = NULL, *pollstop = NULL;
471 	struct eventfd_ctx *ctx = NULL;
472 	u32 __user *idxp = argp;
473 	struct vhost_virtqueue *vq;
474 	struct vhost_vring_state s;
475 	struct vhost_vring_file f;
476 	struct vhost_vring_addr a;
477 	u32 idx;
478 	long r;
479 
480 	r = get_user(idx, idxp);
481 	if (r < 0)
482 		return r;
483 	if (idx >= d->nvqs)
484 		return -ENOBUFS;
485 
486 	vq = d->vqs + idx;
487 
488 	mutex_lock(&vq->mutex);
489 
490 	switch (ioctl) {
491 	case VHOST_SET_VRING_NUM:
492 		/* Resizing ring with an active backend?
493 		 * You don't want to do that. */
494 		if (vq->private_data) {
495 			r = -EBUSY;
496 			break;
497 		}
498 		if (copy_from_user(&s, argp, sizeof s)) {
499 			r = -EFAULT;
500 			break;
501 		}
502 		if (!s.num || s.num > 0xffff || (s.num & (s.num - 1))) {
503 			r = -EINVAL;
504 			break;
505 		}
506 		vq->num = s.num;
507 		break;
508 	case VHOST_SET_VRING_BASE:
509 		/* Moving base with an active backend?
510 		 * You don't want to do that. */
511 		if (vq->private_data) {
512 			r = -EBUSY;
513 			break;
514 		}
515 		if (copy_from_user(&s, argp, sizeof s)) {
516 			r = -EFAULT;
517 			break;
518 		}
519 		if (s.num > 0xffff) {
520 			r = -EINVAL;
521 			break;
522 		}
523 		vq->last_avail_idx = s.num;
524 		/* Forget the cached index value. */
525 		vq->avail_idx = vq->last_avail_idx;
526 		break;
527 	case VHOST_GET_VRING_BASE:
528 		s.index = idx;
529 		s.num = vq->last_avail_idx;
530 		if (copy_to_user(argp, &s, sizeof s))
531 			r = -EFAULT;
532 		break;
533 	case VHOST_SET_VRING_ADDR:
534 		if (copy_from_user(&a, argp, sizeof a)) {
535 			r = -EFAULT;
536 			break;
537 		}
538 		if (a.flags & ~(0x1 << VHOST_VRING_F_LOG)) {
539 			r = -EOPNOTSUPP;
540 			break;
541 		}
542 		/* For 32bit, verify that the top 32bits of the user
543 		   data are set to zero. */
544 		if ((u64)(unsigned long)a.desc_user_addr != a.desc_user_addr ||
545 		    (u64)(unsigned long)a.used_user_addr != a.used_user_addr ||
546 		    (u64)(unsigned long)a.avail_user_addr != a.avail_user_addr) {
547 			r = -EFAULT;
548 			break;
549 		}
550 		if ((a.avail_user_addr & (sizeof *vq->avail->ring - 1)) ||
551 		    (a.used_user_addr & (sizeof *vq->used->ring - 1)) ||
552 		    (a.log_guest_addr & (sizeof *vq->used->ring - 1))) {
553 			r = -EINVAL;
554 			break;
555 		}
556 
557 		/* We only verify access here if backend is configured.
558 		 * If it is not, we don't as size might not have been setup.
559 		 * We will verify when backend is configured. */
560 		if (vq->private_data) {
561 			if (!vq_access_ok(vq->num,
562 				(void __user *)(unsigned long)a.desc_user_addr,
563 				(void __user *)(unsigned long)a.avail_user_addr,
564 				(void __user *)(unsigned long)a.used_user_addr)) {
565 				r = -EINVAL;
566 				break;
567 			}
568 
569 			/* Also validate log access for used ring if enabled. */
570 			if ((a.flags & (0x1 << VHOST_VRING_F_LOG)) &&
571 			    !log_access_ok(vq->log_base, a.log_guest_addr,
572 					   sizeof *vq->used +
573 					   vq->num * sizeof *vq->used->ring)) {
574 				r = -EINVAL;
575 				break;
576 			}
577 		}
578 
579 		r = init_used(vq, (struct vring_used __user *)(unsigned long)
580 			      a.used_user_addr);
581 		if (r)
582 			break;
583 		vq->log_used = !!(a.flags & (0x1 << VHOST_VRING_F_LOG));
584 		vq->desc = (void __user *)(unsigned long)a.desc_user_addr;
585 		vq->avail = (void __user *)(unsigned long)a.avail_user_addr;
586 		vq->log_addr = a.log_guest_addr;
587 		vq->used = (void __user *)(unsigned long)a.used_user_addr;
588 		break;
589 	case VHOST_SET_VRING_KICK:
590 		if (copy_from_user(&f, argp, sizeof f)) {
591 			r = -EFAULT;
592 			break;
593 		}
594 		eventfp = f.fd == -1 ? NULL : eventfd_fget(f.fd);
595 		if (IS_ERR(eventfp)) {
596 			r = PTR_ERR(eventfp);
597 			break;
598 		}
599 		if (eventfp != vq->kick) {
600 			pollstop = filep = vq->kick;
601 			pollstart = vq->kick = eventfp;
602 		} else
603 			filep = eventfp;
604 		break;
605 	case VHOST_SET_VRING_CALL:
606 		if (copy_from_user(&f, argp, sizeof f)) {
607 			r = -EFAULT;
608 			break;
609 		}
610 		eventfp = f.fd == -1 ? NULL : eventfd_fget(f.fd);
611 		if (IS_ERR(eventfp)) {
612 			r = PTR_ERR(eventfp);
613 			break;
614 		}
615 		if (eventfp != vq->call) {
616 			filep = vq->call;
617 			ctx = vq->call_ctx;
618 			vq->call = eventfp;
619 			vq->call_ctx = eventfp ?
620 				eventfd_ctx_fileget(eventfp) : NULL;
621 		} else
622 			filep = eventfp;
623 		break;
624 	case VHOST_SET_VRING_ERR:
625 		if (copy_from_user(&f, argp, sizeof f)) {
626 			r = -EFAULT;
627 			break;
628 		}
629 		eventfp = f.fd == -1 ? NULL : eventfd_fget(f.fd);
630 		if (IS_ERR(eventfp)) {
631 			r = PTR_ERR(eventfp);
632 			break;
633 		}
634 		if (eventfp != vq->error) {
635 			filep = vq->error;
636 			vq->error = eventfp;
637 			ctx = vq->error_ctx;
638 			vq->error_ctx = eventfp ?
639 				eventfd_ctx_fileget(eventfp) : NULL;
640 		} else
641 			filep = eventfp;
642 		break;
643 	default:
644 		r = -ENOIOCTLCMD;
645 	}
646 
647 	if (pollstop && vq->handle_kick)
648 		vhost_poll_stop(&vq->poll);
649 
650 	if (ctx)
651 		eventfd_ctx_put(ctx);
652 	if (filep)
653 		fput(filep);
654 
655 	if (pollstart && vq->handle_kick)
656 		vhost_poll_start(&vq->poll, vq->kick);
657 
658 	mutex_unlock(&vq->mutex);
659 
660 	if (pollstop && vq->handle_kick)
661 		vhost_poll_flush(&vq->poll);
662 	return r;
663 }
664 
665 /* Caller must have device mutex */
666 long vhost_dev_ioctl(struct vhost_dev *d, unsigned int ioctl, unsigned long arg)
667 {
668 	void __user *argp = (void __user *)arg;
669 	struct file *eventfp, *filep = NULL;
670 	struct eventfd_ctx *ctx = NULL;
671 	u64 p;
672 	long r;
673 	int i, fd;
674 
675 	/* If you are not the owner, you can become one */
676 	if (ioctl == VHOST_SET_OWNER) {
677 		r = vhost_dev_set_owner(d);
678 		goto done;
679 	}
680 
681 	/* You must be the owner to do anything else */
682 	r = vhost_dev_check_owner(d);
683 	if (r)
684 		goto done;
685 
686 	switch (ioctl) {
687 	case VHOST_SET_MEM_TABLE:
688 		r = vhost_set_memory(d, argp);
689 		break;
690 	case VHOST_SET_LOG_BASE:
691 		if (copy_from_user(&p, argp, sizeof p)) {
692 			r = -EFAULT;
693 			break;
694 		}
695 		if ((u64)(unsigned long)p != p) {
696 			r = -EFAULT;
697 			break;
698 		}
699 		for (i = 0; i < d->nvqs; ++i) {
700 			struct vhost_virtqueue *vq;
701 			void __user *base = (void __user *)(unsigned long)p;
702 			vq = d->vqs + i;
703 			mutex_lock(&vq->mutex);
704 			/* If ring is inactive, will check when it's enabled. */
705 			if (vq->private_data && !vq_log_access_ok(vq, base))
706 				r = -EFAULT;
707 			else
708 				vq->log_base = base;
709 			mutex_unlock(&vq->mutex);
710 		}
711 		break;
712 	case VHOST_SET_LOG_FD:
713 		r = get_user(fd, (int __user *)argp);
714 		if (r < 0)
715 			break;
716 		eventfp = fd == -1 ? NULL : eventfd_fget(fd);
717 		if (IS_ERR(eventfp)) {
718 			r = PTR_ERR(eventfp);
719 			break;
720 		}
721 		if (eventfp != d->log_file) {
722 			filep = d->log_file;
723 			ctx = d->log_ctx;
724 			d->log_ctx = eventfp ?
725 				eventfd_ctx_fileget(eventfp) : NULL;
726 		} else
727 			filep = eventfp;
728 		for (i = 0; i < d->nvqs; ++i) {
729 			mutex_lock(&d->vqs[i].mutex);
730 			d->vqs[i].log_ctx = d->log_ctx;
731 			mutex_unlock(&d->vqs[i].mutex);
732 		}
733 		if (ctx)
734 			eventfd_ctx_put(ctx);
735 		if (filep)
736 			fput(filep);
737 		break;
738 	default:
739 		r = vhost_set_vring(d, ioctl, argp);
740 		break;
741 	}
742 done:
743 	return r;
744 }
745 
746 static const struct vhost_memory_region *find_region(struct vhost_memory *mem,
747 						     __u64 addr, __u32 len)
748 {
749 	struct vhost_memory_region *reg;
750 	int i;
751 	/* linear search is not brilliant, but we really have on the order of 6
752 	 * regions in practice */
753 	for (i = 0; i < mem->nregions; ++i) {
754 		reg = mem->regions + i;
755 		if (reg->guest_phys_addr <= addr &&
756 		    reg->guest_phys_addr + reg->memory_size - 1 >= addr)
757 			return reg;
758 	}
759 	return NULL;
760 }
761 
762 /* TODO: This is really inefficient.  We need something like get_user()
763  * (instruction directly accesses the data, with an exception table entry
764  * returning -EFAULT). See Documentation/x86/exception-tables.txt.
765  */
766 static int set_bit_to_user(int nr, void __user *addr)
767 {
768 	unsigned long log = (unsigned long)addr;
769 	struct page *page;
770 	void *base;
771 	int bit = nr + (log % PAGE_SIZE) * 8;
772 	int r;
773 	r = get_user_pages_fast(log, 1, 1, &page);
774 	if (r < 0)
775 		return r;
776 	BUG_ON(r != 1);
777 	base = kmap_atomic(page, KM_USER0);
778 	set_bit(bit, base);
779 	kunmap_atomic(base, KM_USER0);
780 	set_page_dirty_lock(page);
781 	put_page(page);
782 	return 0;
783 }
784 
785 static int log_write(void __user *log_base,
786 		     u64 write_address, u64 write_length)
787 {
788 	int r;
789 	if (!write_length)
790 		return 0;
791 	write_address /= VHOST_PAGE_SIZE;
792 	for (;;) {
793 		u64 base = (u64)(unsigned long)log_base;
794 		u64 log = base + write_address / 8;
795 		int bit = write_address % 8;
796 		if ((u64)(unsigned long)log != log)
797 			return -EFAULT;
798 		r = set_bit_to_user(bit, (void __user *)(unsigned long)log);
799 		if (r < 0)
800 			return r;
801 		if (write_length <= VHOST_PAGE_SIZE)
802 			break;
803 		write_length -= VHOST_PAGE_SIZE;
804 		write_address += VHOST_PAGE_SIZE;
805 	}
806 	return r;
807 }
808 
809 int vhost_log_write(struct vhost_virtqueue *vq, struct vhost_log *log,
810 		    unsigned int log_num, u64 len)
811 {
812 	int i, r;
813 
814 	/* Make sure data written is seen before log. */
815 	smp_wmb();
816 	for (i = 0; i < log_num; ++i) {
817 		u64 l = min(log[i].len, len);
818 		r = log_write(vq->log_base, log[i].addr, l);
819 		if (r < 0)
820 			return r;
821 		len -= l;
822 		if (!len)
823 			return 0;
824 	}
825 	if (vq->log_ctx)
826 		eventfd_signal(vq->log_ctx, 1);
827 	/* Length written exceeds what we have stored. This is a bug. */
828 	BUG();
829 	return 0;
830 }
831 
832 static int translate_desc(struct vhost_dev *dev, u64 addr, u32 len,
833 			  struct iovec iov[], int iov_size)
834 {
835 	const struct vhost_memory_region *reg;
836 	struct vhost_memory *mem;
837 	struct iovec *_iov;
838 	u64 s = 0;
839 	int ret = 0;
840 
841 	rcu_read_lock();
842 
843 	mem = rcu_dereference(dev->memory);
844 	while ((u64)len > s) {
845 		u64 size;
846 		if (unlikely(ret >= iov_size)) {
847 			ret = -ENOBUFS;
848 			break;
849 		}
850 		reg = find_region(mem, addr, len);
851 		if (unlikely(!reg)) {
852 			ret = -EFAULT;
853 			break;
854 		}
855 		_iov = iov + ret;
856 		size = reg->memory_size - addr + reg->guest_phys_addr;
857 		_iov->iov_len = min((u64)len, size);
858 		_iov->iov_base = (void __user *)(unsigned long)
859 			(reg->userspace_addr + addr - reg->guest_phys_addr);
860 		s += size;
861 		addr += size;
862 		++ret;
863 	}
864 
865 	rcu_read_unlock();
866 	return ret;
867 }
868 
869 /* Each buffer in the virtqueues is actually a chain of descriptors.  This
870  * function returns the next descriptor in the chain,
871  * or -1U if we're at the end. */
872 static unsigned next_desc(struct vring_desc *desc)
873 {
874 	unsigned int next;
875 
876 	/* If this descriptor says it doesn't chain, we're done. */
877 	if (!(desc->flags & VRING_DESC_F_NEXT))
878 		return -1U;
879 
880 	/* Check they're not leading us off end of descriptors. */
881 	next = desc->next;
882 	/* Make sure compiler knows to grab that: we don't want it changing! */
883 	/* We will use the result as an index in an array, so most
884 	 * architectures only need a compiler barrier here. */
885 	read_barrier_depends();
886 
887 	return next;
888 }
889 
890 static int get_indirect(struct vhost_dev *dev, struct vhost_virtqueue *vq,
891 			struct iovec iov[], unsigned int iov_size,
892 			unsigned int *out_num, unsigned int *in_num,
893 			struct vhost_log *log, unsigned int *log_num,
894 			struct vring_desc *indirect)
895 {
896 	struct vring_desc desc;
897 	unsigned int i = 0, count, found = 0;
898 	int ret;
899 
900 	/* Sanity check */
901 	if (unlikely(indirect->len % sizeof desc)) {
902 		vq_err(vq, "Invalid length in indirect descriptor: "
903 		       "len 0x%llx not multiple of 0x%zx\n",
904 		       (unsigned long long)indirect->len,
905 		       sizeof desc);
906 		return -EINVAL;
907 	}
908 
909 	ret = translate_desc(dev, indirect->addr, indirect->len, vq->indirect,
910 			     ARRAY_SIZE(vq->indirect));
911 	if (unlikely(ret < 0)) {
912 		vq_err(vq, "Translation failure %d in indirect.\n", ret);
913 		return ret;
914 	}
915 
916 	/* We will use the result as an address to read from, so most
917 	 * architectures only need a compiler barrier here. */
918 	read_barrier_depends();
919 
920 	count = indirect->len / sizeof desc;
921 	/* Buffers are chained via a 16 bit next field, so
922 	 * we can have at most 2^16 of these. */
923 	if (unlikely(count > USHRT_MAX + 1)) {
924 		vq_err(vq, "Indirect buffer length too big: %d\n",
925 		       indirect->len);
926 		return -E2BIG;
927 	}
928 
929 	do {
930 		unsigned iov_count = *in_num + *out_num;
931 		if (unlikely(++found > count)) {
932 			vq_err(vq, "Loop detected: last one at %u "
933 			       "indirect size %u\n",
934 			       i, count);
935 			return -EINVAL;
936 		}
937 		if (unlikely(memcpy_fromiovec((unsigned char *)&desc, vq->indirect,
938 					      sizeof desc))) {
939 			vq_err(vq, "Failed indirect descriptor: idx %d, %zx\n",
940 			       i, (size_t)indirect->addr + i * sizeof desc);
941 			return -EINVAL;
942 		}
943 		if (unlikely(desc.flags & VRING_DESC_F_INDIRECT)) {
944 			vq_err(vq, "Nested indirect descriptor: idx %d, %zx\n",
945 			       i, (size_t)indirect->addr + i * sizeof desc);
946 			return -EINVAL;
947 		}
948 
949 		ret = translate_desc(dev, desc.addr, desc.len, iov + iov_count,
950 				     iov_size - iov_count);
951 		if (unlikely(ret < 0)) {
952 			vq_err(vq, "Translation failure %d indirect idx %d\n",
953 			       ret, i);
954 			return ret;
955 		}
956 		/* If this is an input descriptor, increment that count. */
957 		if (desc.flags & VRING_DESC_F_WRITE) {
958 			*in_num += ret;
959 			if (unlikely(log)) {
960 				log[*log_num].addr = desc.addr;
961 				log[*log_num].len = desc.len;
962 				++*log_num;
963 			}
964 		} else {
965 			/* If it's an output descriptor, they're all supposed
966 			 * to come before any input descriptors. */
967 			if (unlikely(*in_num)) {
968 				vq_err(vq, "Indirect descriptor "
969 				       "has out after in: idx %d\n", i);
970 				return -EINVAL;
971 			}
972 			*out_num += ret;
973 		}
974 	} while ((i = next_desc(&desc)) != -1);
975 	return 0;
976 }
977 
978 /* This looks in the virtqueue and for the first available buffer, and converts
979  * it to an iovec for convenient access.  Since descriptors consist of some
980  * number of output then some number of input descriptors, it's actually two
981  * iovecs, but we pack them into one and note how many of each there were.
982  *
983  * This function returns the descriptor number found, or vq->num (which is
984  * never a valid descriptor number) if none was found.  A negative code is
985  * returned on error. */
986 int vhost_get_vq_desc(struct vhost_dev *dev, struct vhost_virtqueue *vq,
987 		      struct iovec iov[], unsigned int iov_size,
988 		      unsigned int *out_num, unsigned int *in_num,
989 		      struct vhost_log *log, unsigned int *log_num)
990 {
991 	struct vring_desc desc;
992 	unsigned int i, head, found = 0;
993 	u16 last_avail_idx;
994 	int ret;
995 
996 	/* Check it isn't doing very strange things with descriptor numbers. */
997 	last_avail_idx = vq->last_avail_idx;
998 	if (unlikely(get_user(vq->avail_idx, &vq->avail->idx))) {
999 		vq_err(vq, "Failed to access avail idx at %p\n",
1000 		       &vq->avail->idx);
1001 		return -EFAULT;
1002 	}
1003 
1004 	if (unlikely((u16)(vq->avail_idx - last_avail_idx) > vq->num)) {
1005 		vq_err(vq, "Guest moved used index from %u to %u",
1006 		       last_avail_idx, vq->avail_idx);
1007 		return -EFAULT;
1008 	}
1009 
1010 	/* If there's nothing new since last we looked, return invalid. */
1011 	if (vq->avail_idx == last_avail_idx)
1012 		return vq->num;
1013 
1014 	/* Only get avail ring entries after they have been exposed by guest. */
1015 	smp_rmb();
1016 
1017 	/* Grab the next descriptor number they're advertising, and increment
1018 	 * the index we've seen. */
1019 	if (unlikely(get_user(head,
1020 			      &vq->avail->ring[last_avail_idx % vq->num]))) {
1021 		vq_err(vq, "Failed to read head: idx %d address %p\n",
1022 		       last_avail_idx,
1023 		       &vq->avail->ring[last_avail_idx % vq->num]);
1024 		return -EFAULT;
1025 	}
1026 
1027 	/* If their number is silly, that's an error. */
1028 	if (unlikely(head >= vq->num)) {
1029 		vq_err(vq, "Guest says index %u > %u is available",
1030 		       head, vq->num);
1031 		return -EINVAL;
1032 	}
1033 
1034 	/* When we start there are none of either input nor output. */
1035 	*out_num = *in_num = 0;
1036 	if (unlikely(log))
1037 		*log_num = 0;
1038 
1039 	i = head;
1040 	do {
1041 		unsigned iov_count = *in_num + *out_num;
1042 		if (unlikely(i >= vq->num)) {
1043 			vq_err(vq, "Desc index is %u > %u, head = %u",
1044 			       i, vq->num, head);
1045 			return -EINVAL;
1046 		}
1047 		if (unlikely(++found > vq->num)) {
1048 			vq_err(vq, "Loop detected: last one at %u "
1049 			       "vq size %u head %u\n",
1050 			       i, vq->num, head);
1051 			return -EINVAL;
1052 		}
1053 		ret = copy_from_user(&desc, vq->desc + i, sizeof desc);
1054 		if (unlikely(ret)) {
1055 			vq_err(vq, "Failed to get descriptor: idx %d addr %p\n",
1056 			       i, vq->desc + i);
1057 			return -EFAULT;
1058 		}
1059 		if (desc.flags & VRING_DESC_F_INDIRECT) {
1060 			ret = get_indirect(dev, vq, iov, iov_size,
1061 					   out_num, in_num,
1062 					   log, log_num, &desc);
1063 			if (unlikely(ret < 0)) {
1064 				vq_err(vq, "Failure detected "
1065 				       "in indirect descriptor at idx %d\n", i);
1066 				return ret;
1067 			}
1068 			continue;
1069 		}
1070 
1071 		ret = translate_desc(dev, desc.addr, desc.len, iov + iov_count,
1072 				     iov_size - iov_count);
1073 		if (unlikely(ret < 0)) {
1074 			vq_err(vq, "Translation failure %d descriptor idx %d\n",
1075 			       ret, i);
1076 			return ret;
1077 		}
1078 		if (desc.flags & VRING_DESC_F_WRITE) {
1079 			/* If this is an input descriptor,
1080 			 * increment that count. */
1081 			*in_num += ret;
1082 			if (unlikely(log)) {
1083 				log[*log_num].addr = desc.addr;
1084 				log[*log_num].len = desc.len;
1085 				++*log_num;
1086 			}
1087 		} else {
1088 			/* If it's an output descriptor, they're all supposed
1089 			 * to come before any input descriptors. */
1090 			if (unlikely(*in_num)) {
1091 				vq_err(vq, "Descriptor has out after in: "
1092 				       "idx %d\n", i);
1093 				return -EINVAL;
1094 			}
1095 			*out_num += ret;
1096 		}
1097 	} while ((i = next_desc(&desc)) != -1);
1098 
1099 	/* On success, increment avail index. */
1100 	vq->last_avail_idx++;
1101 	return head;
1102 }
1103 
1104 /* Reverse the effect of vhost_get_vq_desc. Useful for error handling. */
1105 void vhost_discard_vq_desc(struct vhost_virtqueue *vq, int n)
1106 {
1107 	vq->last_avail_idx -= n;
1108 }
1109 
1110 /* After we've used one of their buffers, we tell them about it.  We'll then
1111  * want to notify the guest, using eventfd. */
1112 int vhost_add_used(struct vhost_virtqueue *vq, unsigned int head, int len)
1113 {
1114 	struct vring_used_elem __user *used;
1115 
1116 	/* The virtqueue contains a ring of used buffers.  Get a pointer to the
1117 	 * next entry in that used ring. */
1118 	used = &vq->used->ring[vq->last_used_idx % vq->num];
1119 	if (put_user(head, &used->id)) {
1120 		vq_err(vq, "Failed to write used id");
1121 		return -EFAULT;
1122 	}
1123 	if (put_user(len, &used->len)) {
1124 		vq_err(vq, "Failed to write used len");
1125 		return -EFAULT;
1126 	}
1127 	/* Make sure buffer is written before we update index. */
1128 	smp_wmb();
1129 	if (put_user(vq->last_used_idx + 1, &vq->used->idx)) {
1130 		vq_err(vq, "Failed to increment used idx");
1131 		return -EFAULT;
1132 	}
1133 	if (unlikely(vq->log_used)) {
1134 		/* Make sure data is seen before log. */
1135 		smp_wmb();
1136 		/* Log used ring entry write. */
1137 		log_write(vq->log_base,
1138 			  vq->log_addr +
1139 			   ((void __user *)used - (void __user *)vq->used),
1140 			  sizeof *used);
1141 		/* Log used index update. */
1142 		log_write(vq->log_base,
1143 			  vq->log_addr + offsetof(struct vring_used, idx),
1144 			  sizeof vq->used->idx);
1145 		if (vq->log_ctx)
1146 			eventfd_signal(vq->log_ctx, 1);
1147 	}
1148 	vq->last_used_idx++;
1149 	return 0;
1150 }
1151 
1152 static int __vhost_add_used_n(struct vhost_virtqueue *vq,
1153 			    struct vring_used_elem *heads,
1154 			    unsigned count)
1155 {
1156 	struct vring_used_elem __user *used;
1157 	int start;
1158 
1159 	start = vq->last_used_idx % vq->num;
1160 	used = vq->used->ring + start;
1161 	if (copy_to_user(used, heads, count * sizeof *used)) {
1162 		vq_err(vq, "Failed to write used");
1163 		return -EFAULT;
1164 	}
1165 	if (unlikely(vq->log_used)) {
1166 		/* Make sure data is seen before log. */
1167 		smp_wmb();
1168 		/* Log used ring entry write. */
1169 		log_write(vq->log_base,
1170 			  vq->log_addr +
1171 			   ((void __user *)used - (void __user *)vq->used),
1172 			  count * sizeof *used);
1173 	}
1174 	vq->last_used_idx += count;
1175 	return 0;
1176 }
1177 
1178 /* After we've used one of their buffers, we tell them about it.  We'll then
1179  * want to notify the guest, using eventfd. */
1180 int vhost_add_used_n(struct vhost_virtqueue *vq, struct vring_used_elem *heads,
1181 		     unsigned count)
1182 {
1183 	int start, n, r;
1184 
1185 	start = vq->last_used_idx % vq->num;
1186 	n = vq->num - start;
1187 	if (n < count) {
1188 		r = __vhost_add_used_n(vq, heads, n);
1189 		if (r < 0)
1190 			return r;
1191 		heads += n;
1192 		count -= n;
1193 	}
1194 	r = __vhost_add_used_n(vq, heads, count);
1195 
1196 	/* Make sure buffer is written before we update index. */
1197 	smp_wmb();
1198 	if (put_user(vq->last_used_idx, &vq->used->idx)) {
1199 		vq_err(vq, "Failed to increment used idx");
1200 		return -EFAULT;
1201 	}
1202 	if (unlikely(vq->log_used)) {
1203 		/* Log used index update. */
1204 		log_write(vq->log_base,
1205 			  vq->log_addr + offsetof(struct vring_used, idx),
1206 			  sizeof vq->used->idx);
1207 		if (vq->log_ctx)
1208 			eventfd_signal(vq->log_ctx, 1);
1209 	}
1210 	return r;
1211 }
1212 
1213 /* This actually signals the guest, using eventfd. */
1214 void vhost_signal(struct vhost_dev *dev, struct vhost_virtqueue *vq)
1215 {
1216 	__u16 flags;
1217 	/* Flush out used index updates. This is paired
1218 	 * with the barrier that the Guest executes when enabling
1219 	 * interrupts. */
1220 	smp_mb();
1221 
1222 	if (get_user(flags, &vq->avail->flags)) {
1223 		vq_err(vq, "Failed to get flags");
1224 		return;
1225 	}
1226 
1227 	/* If they don't want an interrupt, don't signal, unless empty. */
1228 	if ((flags & VRING_AVAIL_F_NO_INTERRUPT) &&
1229 	    (vq->avail_idx != vq->last_avail_idx ||
1230 	     !vhost_has_feature(dev, VIRTIO_F_NOTIFY_ON_EMPTY)))
1231 		return;
1232 
1233 	/* Signal the Guest tell them we used something up. */
1234 	if (vq->call_ctx)
1235 		eventfd_signal(vq->call_ctx, 1);
1236 }
1237 
1238 /* And here's the combo meal deal.  Supersize me! */
1239 void vhost_add_used_and_signal(struct vhost_dev *dev,
1240 			       struct vhost_virtqueue *vq,
1241 			       unsigned int head, int len)
1242 {
1243 	vhost_add_used(vq, head, len);
1244 	vhost_signal(dev, vq);
1245 }
1246 
1247 /* multi-buffer version of vhost_add_used_and_signal */
1248 void vhost_add_used_and_signal_n(struct vhost_dev *dev,
1249 				 struct vhost_virtqueue *vq,
1250 				 struct vring_used_elem *heads, unsigned count)
1251 {
1252 	vhost_add_used_n(vq, heads, count);
1253 	vhost_signal(dev, vq);
1254 }
1255 
1256 /* OK, now we need to know about added descriptors. */
1257 bool vhost_enable_notify(struct vhost_virtqueue *vq)
1258 {
1259 	u16 avail_idx;
1260 	int r;
1261 	if (!(vq->used_flags & VRING_USED_F_NO_NOTIFY))
1262 		return false;
1263 	vq->used_flags &= ~VRING_USED_F_NO_NOTIFY;
1264 	r = put_user(vq->used_flags, &vq->used->flags);
1265 	if (r) {
1266 		vq_err(vq, "Failed to enable notification at %p: %d\n",
1267 		       &vq->used->flags, r);
1268 		return false;
1269 	}
1270 	/* They could have slipped one in as we were doing that: make
1271 	 * sure it's written, then check again. */
1272 	smp_mb();
1273 	r = get_user(avail_idx, &vq->avail->idx);
1274 	if (r) {
1275 		vq_err(vq, "Failed to check avail idx at %p: %d\n",
1276 		       &vq->avail->idx, r);
1277 		return false;
1278 	}
1279 
1280 	return avail_idx != vq->avail_idx;
1281 }
1282 
1283 /* We don't need to be notified again. */
1284 void vhost_disable_notify(struct vhost_virtqueue *vq)
1285 {
1286 	int r;
1287 	if (vq->used_flags & VRING_USED_F_NO_NOTIFY)
1288 		return;
1289 	vq->used_flags |= VRING_USED_F_NO_NOTIFY;
1290 	r = put_user(vq->used_flags, &vq->used->flags);
1291 	if (r)
1292 		vq_err(vq, "Failed to enable notification at %p: %d\n",
1293 		       &vq->used->flags, r);
1294 }
1295