xref: /linux/tools/virtio/vringh_test.c (revision d26270061ae66b915138af7cd73ca6f8b85e6b44)
1 // SPDX-License-Identifier: GPL-2.0
2 /* Simple test of virtio code, entirely in userpsace. */
3 #define _GNU_SOURCE
4 #include <sched.h>
5 #include <err.h>
6 #include <linux/kernel.h>
7 #include <linux/err.h>
8 #include <linux/virtio.h>
9 #include <linux/vringh.h>
10 #include <linux/virtio_ring.h>
11 #include <linux/virtio_config.h>
12 #include <linux/uaccess.h>
13 #include <sys/types.h>
14 #include <sys/stat.h>
15 #include <sys/mman.h>
16 #include <sys/wait.h>
17 #include <fcntl.h>
18 
19 #define USER_MEM (1024*1024)
20 void *__user_addr_min, *__user_addr_max;
21 void *__kmalloc_fake, *__kfree_ignore_start, *__kfree_ignore_end;
22 static u64 user_addr_offset;
23 
24 #define RINGSIZE 256
25 #define ALIGN 4096
26 
27 static bool never_notify_host(struct virtqueue *vq)
28 {
29 	abort();
30 }
31 
32 static void never_callback_guest(struct virtqueue *vq)
33 {
34 	abort();
35 }
36 
37 static bool getrange_iov(struct vringh *vrh, u64 addr, struct vringh_range *r)
38 {
39 	if (addr < (u64)(unsigned long)__user_addr_min - user_addr_offset)
40 		return false;
41 	if (addr >= (u64)(unsigned long)__user_addr_max - user_addr_offset)
42 		return false;
43 
44 	r->start = (u64)(unsigned long)__user_addr_min - user_addr_offset;
45 	r->end_incl = (u64)(unsigned long)__user_addr_max - 1 - user_addr_offset;
46 	r->offset = user_addr_offset;
47 	return true;
48 }
49 
50 /* We return single byte ranges. */
51 static bool getrange_slow(struct vringh *vrh, u64 addr, struct vringh_range *r)
52 {
53 	if (addr < (u64)(unsigned long)__user_addr_min - user_addr_offset)
54 		return false;
55 	if (addr >= (u64)(unsigned long)__user_addr_max - user_addr_offset)
56 		return false;
57 
58 	r->start = addr;
59 	r->end_incl = r->start;
60 	r->offset = user_addr_offset;
61 	return true;
62 }
63 
64 struct guest_virtio_device {
65 	struct virtio_device vdev;
66 	int to_host_fd;
67 	unsigned long notifies;
68 };
69 
70 static bool parallel_notify_host(struct virtqueue *vq)
71 {
72 	int rc;
73 	struct guest_virtio_device *gvdev;
74 
75 	gvdev = container_of(vq->vdev, struct guest_virtio_device, vdev);
76 	rc = write(gvdev->to_host_fd, "", 1);
77 	if (rc < 0)
78 		return false;
79 	gvdev->notifies++;
80 	return true;
81 }
82 
83 static bool no_notify_host(struct virtqueue *vq)
84 {
85 	return true;
86 }
87 
88 #define NUM_XFERS (10000000)
89 
90 /* We aim for two "distant" cpus. */
91 static void find_cpus(unsigned int *first, unsigned int *last)
92 {
93 	unsigned int i;
94 
95 	*first = -1U;
96 	*last = 0;
97 	for (i = 0; i < 4096; i++) {
98 		cpu_set_t set;
99 		CPU_ZERO(&set);
100 		CPU_SET(i, &set);
101 		if (sched_setaffinity(getpid(), sizeof(set), &set) == 0) {
102 			if (i < *first)
103 				*first = i;
104 			if (i > *last)
105 				*last = i;
106 		}
107 	}
108 }
109 
110 /* Opencoded version for fast mode */
111 static inline int vringh_get_head(struct vringh *vrh, u16 *head)
112 {
113 	u16 avail_idx, i;
114 	int err;
115 
116 	err = get_user(avail_idx, &vrh->vring.avail->idx);
117 	if (err)
118 		return err;
119 
120 	if (vrh->last_avail_idx == avail_idx)
121 		return 0;
122 
123 	/* Only get avail ring entries after they have been exposed by guest. */
124 	virtio_rmb(vrh->weak_barriers);
125 
126 	i = vrh->last_avail_idx & (vrh->vring.num - 1);
127 
128 	err = get_user(*head, &vrh->vring.avail->ring[i]);
129 	if (err)
130 		return err;
131 
132 	vrh->last_avail_idx++;
133 	return 1;
134 }
135 
136 static int parallel_test(u64 features,
137 			 bool (*getrange)(struct vringh *vrh,
138 					  u64 addr, struct vringh_range *r),
139 			 bool fast_vringh)
140 {
141 	void *host_map, *guest_map;
142 	int fd, mapsize, to_guest[2], to_host[2];
143 	unsigned long xfers = 0, notifies = 0, receives = 0;
144 	unsigned int first_cpu, last_cpu;
145 	cpu_set_t cpu_set;
146 	char buf[128];
147 
148 	/* Create real file to mmap. */
149 	fd = open("/tmp/vringh_test-file", O_RDWR|O_CREAT|O_TRUNC, 0600);
150 	if (fd < 0)
151 		err(1, "Opening /tmp/vringh_test-file");
152 
153 	/* Extra room at the end for some data, and indirects */
154 	mapsize = vring_size(RINGSIZE, ALIGN)
155 		+ RINGSIZE * 2 * sizeof(int)
156 		+ RINGSIZE * 6 * sizeof(struct vring_desc);
157 	mapsize = (mapsize + getpagesize() - 1) & ~(getpagesize() - 1);
158 	ftruncate(fd, mapsize);
159 
160 	/* Parent and child use separate addresses, to check our mapping logic! */
161 	host_map = mmap(NULL, mapsize, PROT_READ|PROT_WRITE, MAP_SHARED, fd, 0);
162 	guest_map = mmap(NULL, mapsize, PROT_READ|PROT_WRITE, MAP_SHARED, fd, 0);
163 
164 	pipe(to_guest);
165 	pipe(to_host);
166 
167 	CPU_ZERO(&cpu_set);
168 	find_cpus(&first_cpu, &last_cpu);
169 	printf("Using CPUS %u and %u\n", first_cpu, last_cpu);
170 	fflush(stdout);
171 
172 	if (fork() != 0) {
173 		struct vringh vrh;
174 		int status, err, rlen = 0;
175 		char rbuf[5];
176 
177 		/* We are the host: never access guest addresses! */
178 		munmap(guest_map, mapsize);
179 
180 		__user_addr_min = host_map;
181 		__user_addr_max = __user_addr_min + mapsize;
182 		user_addr_offset = host_map - guest_map;
183 		assert(user_addr_offset);
184 
185 		close(to_guest[0]);
186 		close(to_host[1]);
187 
188 		vring_init(&vrh.vring, RINGSIZE, host_map, ALIGN);
189 		vringh_init_user(&vrh, features, RINGSIZE, true,
190 				 vrh.vring.desc, vrh.vring.avail, vrh.vring.used);
191 		CPU_SET(first_cpu, &cpu_set);
192 		if (sched_setaffinity(getpid(), sizeof(cpu_set), &cpu_set))
193 			errx(1, "Could not set affinity to cpu %u", first_cpu);
194 
195 		while (xfers < NUM_XFERS) {
196 			struct iovec host_riov[2], host_wiov[2];
197 			struct vringh_iov riov, wiov;
198 			u16 head, written;
199 
200 			if (fast_vringh) {
201 				for (;;) {
202 					err = vringh_get_head(&vrh, &head);
203 					if (err != 0)
204 						break;
205 					err = vringh_need_notify_user(&vrh);
206 					if (err < 0)
207 						errx(1, "vringh_need_notify_user: %i",
208 						     err);
209 					if (err) {
210 						write(to_guest[1], "", 1);
211 						notifies++;
212 					}
213 				}
214 				if (err != 1)
215 					errx(1, "vringh_get_head");
216 				written = 0;
217 				goto complete;
218 			} else {
219 				vringh_iov_init(&riov,
220 						host_riov,
221 						ARRAY_SIZE(host_riov));
222 				vringh_iov_init(&wiov,
223 						host_wiov,
224 						ARRAY_SIZE(host_wiov));
225 
226 				err = vringh_getdesc_user(&vrh, &riov, &wiov,
227 							  getrange, &head);
228 			}
229 			if (err == 0) {
230 				err = vringh_need_notify_user(&vrh);
231 				if (err < 0)
232 					errx(1, "vringh_need_notify_user: %i",
233 					     err);
234 				if (err) {
235 					write(to_guest[1], "", 1);
236 					notifies++;
237 				}
238 
239 				if (!vringh_notify_enable_user(&vrh))
240 					continue;
241 
242 				/* Swallow all notifies at once. */
243 				if (read(to_host[0], buf, sizeof(buf)) < 1)
244 					break;
245 
246 				vringh_notify_disable_user(&vrh);
247 				receives++;
248 				continue;
249 			}
250 			if (err != 1)
251 				errx(1, "vringh_getdesc_user: %i", err);
252 
253 			/* We simply copy bytes. */
254 			if (riov.used) {
255 				rlen = vringh_iov_pull_user(&riov, rbuf,
256 							    sizeof(rbuf));
257 				if (rlen != 4)
258 					errx(1, "vringh_iov_pull_user: %i",
259 					     rlen);
260 				assert(riov.i == riov.used);
261 				written = 0;
262 			} else {
263 				err = vringh_iov_push_user(&wiov, rbuf, rlen);
264 				if (err != rlen)
265 					errx(1, "vringh_iov_push_user: %i",
266 					     err);
267 				assert(wiov.i == wiov.used);
268 				written = err;
269 			}
270 		complete:
271 			xfers++;
272 
273 			err = vringh_complete_user(&vrh, head, written);
274 			if (err != 0)
275 				errx(1, "vringh_complete_user: %i", err);
276 		}
277 
278 		err = vringh_need_notify_user(&vrh);
279 		if (err < 0)
280 			errx(1, "vringh_need_notify_user: %i", err);
281 		if (err) {
282 			write(to_guest[1], "", 1);
283 			notifies++;
284 		}
285 		wait(&status);
286 		if (!WIFEXITED(status))
287 			errx(1, "Child died with signal %i?", WTERMSIG(status));
288 		if (WEXITSTATUS(status) != 0)
289 			errx(1, "Child exited %i?", WEXITSTATUS(status));
290 		printf("Host: notified %lu, pinged %lu\n", notifies, receives);
291 		return 0;
292 	} else {
293 		struct guest_virtio_device gvdev;
294 		struct virtqueue *vq;
295 		unsigned int *data;
296 		struct vring_desc *indirects;
297 		unsigned int finished = 0;
298 
299 		/* We pass sg[]s pointing into here, but we need RINGSIZE+1 */
300 		data = guest_map + vring_size(RINGSIZE, ALIGN);
301 		indirects = (void *)data + (RINGSIZE + 1) * 2 * sizeof(int);
302 
303 		/* We are the guest. */
304 		munmap(host_map, mapsize);
305 
306 		close(to_guest[1]);
307 		close(to_host[0]);
308 
309 		gvdev.vdev.features = features;
310 		INIT_LIST_HEAD(&gvdev.vdev.vqs);
311 		spin_lock_init(&gvdev.vdev.vqs_list_lock);
312 		gvdev.to_host_fd = to_host[1];
313 		gvdev.notifies = 0;
314 
315 		CPU_SET(first_cpu, &cpu_set);
316 		if (sched_setaffinity(getpid(), sizeof(cpu_set), &cpu_set))
317 			err(1, "Could not set affinity to cpu %u", first_cpu);
318 
319 		vq = vring_new_virtqueue(0, RINGSIZE, ALIGN, &gvdev.vdev, true,
320 					 false, guest_map,
321 					 fast_vringh ? no_notify_host
322 					 : parallel_notify_host,
323 					 never_callback_guest, "guest vq");
324 
325 		/* Don't kfree indirects. */
326 		__kfree_ignore_start = indirects;
327 		__kfree_ignore_end = indirects + RINGSIZE * 6;
328 
329 		while (xfers < NUM_XFERS) {
330 			struct scatterlist sg[4];
331 			unsigned int num_sg, len;
332 			int *dbuf, err;
333 			bool output = !(xfers % 2);
334 
335 			/* Consume bufs. */
336 			while ((dbuf = virtqueue_get_buf(vq, &len)) != NULL) {
337 				if (len == 4)
338 					assert(*dbuf == finished - 1);
339 				else if (!fast_vringh)
340 					assert(*dbuf == finished);
341 				finished++;
342 			}
343 
344 			/* Produce a buffer. */
345 			dbuf = data + (xfers % (RINGSIZE + 1));
346 
347 			if (output)
348 				*dbuf = xfers;
349 			else
350 				*dbuf = -1;
351 
352 			switch ((xfers / sizeof(*dbuf)) % 4) {
353 			case 0:
354 				/* Nasty three-element sg list. */
355 				sg_init_table(sg, num_sg = 3);
356 				sg_set_buf(&sg[0], (void *)dbuf, 1);
357 				sg_set_buf(&sg[1], (void *)dbuf + 1, 2);
358 				sg_set_buf(&sg[2], (void *)dbuf + 3, 1);
359 				break;
360 			case 1:
361 				sg_init_table(sg, num_sg = 2);
362 				sg_set_buf(&sg[0], (void *)dbuf, 1);
363 				sg_set_buf(&sg[1], (void *)dbuf + 1, 3);
364 				break;
365 			case 2:
366 				sg_init_table(sg, num_sg = 1);
367 				sg_set_buf(&sg[0], (void *)dbuf, 4);
368 				break;
369 			case 3:
370 				sg_init_table(sg, num_sg = 4);
371 				sg_set_buf(&sg[0], (void *)dbuf, 1);
372 				sg_set_buf(&sg[1], (void *)dbuf + 1, 1);
373 				sg_set_buf(&sg[2], (void *)dbuf + 2, 1);
374 				sg_set_buf(&sg[3], (void *)dbuf + 3, 1);
375 				break;
376 			}
377 
378 			/* May allocate an indirect, so force it to allocate
379 			 * user addr */
380 			__kmalloc_fake = indirects + (xfers % RINGSIZE) * 4;
381 			if (output)
382 				err = virtqueue_add_outbuf(vq, sg, num_sg, dbuf,
383 							   GFP_KERNEL);
384 			else
385 				err = virtqueue_add_inbuf(vq, sg, num_sg,
386 							  dbuf, GFP_KERNEL);
387 
388 			if (err == -ENOSPC) {
389 				if (!virtqueue_enable_cb_delayed(vq))
390 					continue;
391 				/* Swallow all notifies at once. */
392 				if (read(to_guest[0], buf, sizeof(buf)) < 1)
393 					break;
394 
395 				receives++;
396 				virtqueue_disable_cb(vq);
397 				continue;
398 			}
399 
400 			if (err)
401 				errx(1, "virtqueue_add_in/outbuf: %i", err);
402 
403 			xfers++;
404 			virtqueue_kick(vq);
405 		}
406 
407 		/* Any extra? */
408 		while (finished != xfers) {
409 			int *dbuf;
410 			unsigned int len;
411 
412 			/* Consume bufs. */
413 			dbuf = virtqueue_get_buf(vq, &len);
414 			if (dbuf) {
415 				if (len == 4)
416 					assert(*dbuf == finished - 1);
417 				else
418 					assert(len == 0);
419 				finished++;
420 				continue;
421 			}
422 
423 			if (!virtqueue_enable_cb_delayed(vq))
424 				continue;
425 			if (read(to_guest[0], buf, sizeof(buf)) < 1)
426 				break;
427 
428 			receives++;
429 			virtqueue_disable_cb(vq);
430 		}
431 
432 		printf("Guest: notified %lu, pinged %lu\n",
433 		       gvdev.notifies, receives);
434 		vring_del_virtqueue(vq);
435 		return 0;
436 	}
437 }
438 
439 int main(int argc, char *argv[])
440 {
441 	struct virtio_device vdev;
442 	struct virtqueue *vq;
443 	struct vringh vrh;
444 	struct scatterlist guest_sg[RINGSIZE], *sgs[2];
445 	struct iovec host_riov[2], host_wiov[2];
446 	struct vringh_iov riov, wiov;
447 	struct vring_used_elem used[RINGSIZE];
448 	char buf[28];
449 	u16 head;
450 	int err;
451 	unsigned i;
452 	void *ret;
453 	bool (*getrange)(struct vringh *vrh, u64 addr, struct vringh_range *r);
454 	bool fast_vringh = false, parallel = false;
455 
456 	getrange = getrange_iov;
457 	vdev.features = 0;
458 	INIT_LIST_HEAD(&vdev.vqs);
459 	spin_lock_init(&vdev.vqs_list_lock);
460 
461 	while (argv[1]) {
462 		if (strcmp(argv[1], "--indirect") == 0)
463 			__virtio_set_bit(&vdev, VIRTIO_RING_F_INDIRECT_DESC);
464 		else if (strcmp(argv[1], "--eventidx") == 0)
465 			__virtio_set_bit(&vdev, VIRTIO_RING_F_EVENT_IDX);
466 		else if (strcmp(argv[1], "--virtio-1") == 0)
467 			__virtio_set_bit(&vdev, VIRTIO_F_VERSION_1);
468 		else if (strcmp(argv[1], "--slow-range") == 0)
469 			getrange = getrange_slow;
470 		else if (strcmp(argv[1], "--fast-vringh") == 0)
471 			fast_vringh = true;
472 		else if (strcmp(argv[1], "--parallel") == 0)
473 			parallel = true;
474 		else
475 			errx(1, "Unknown arg %s", argv[1]);
476 		argv++;
477 	}
478 
479 	if (parallel)
480 		return parallel_test(vdev.features, getrange, fast_vringh);
481 
482 	if (posix_memalign(&__user_addr_min, PAGE_SIZE, USER_MEM) != 0)
483 		abort();
484 	__user_addr_max = __user_addr_min + USER_MEM;
485 	memset(__user_addr_min, 0, vring_size(RINGSIZE, ALIGN));
486 
487 	/* Set up guest side. */
488 	vq = vring_new_virtqueue(0, RINGSIZE, ALIGN, &vdev, true, false,
489 				 __user_addr_min,
490 				 never_notify_host, never_callback_guest,
491 				 "guest vq");
492 
493 	/* Set up host side. */
494 	vring_init(&vrh.vring, RINGSIZE, __user_addr_min, ALIGN);
495 	vringh_init_user(&vrh, vdev.features, RINGSIZE, true,
496 			 vrh.vring.desc, vrh.vring.avail, vrh.vring.used);
497 
498 	/* No descriptor to get yet... */
499 	err = vringh_getdesc_user(&vrh, &riov, &wiov, getrange, &head);
500 	if (err != 0)
501 		errx(1, "vringh_getdesc_user: %i", err);
502 
503 	/* Guest puts in a descriptor. */
504 	memcpy(__user_addr_max - 1, "a", 1);
505 	sg_init_table(guest_sg, 1);
506 	sg_set_buf(&guest_sg[0], __user_addr_max - 1, 1);
507 	sg_init_table(guest_sg+1, 1);
508 	sg_set_buf(&guest_sg[1], __user_addr_max - 3, 2);
509 	sgs[0] = &guest_sg[0];
510 	sgs[1] = &guest_sg[1];
511 
512 	/* May allocate an indirect, so force it to allocate user addr */
513 	__kmalloc_fake = __user_addr_min + vring_size(RINGSIZE, ALIGN);
514 	err = virtqueue_add_sgs(vq, sgs, 1, 1, &err, GFP_KERNEL);
515 	if (err)
516 		errx(1, "virtqueue_add_sgs: %i", err);
517 	__kmalloc_fake = NULL;
518 
519 	/* Host retreives it. */
520 	vringh_iov_init(&riov, host_riov, ARRAY_SIZE(host_riov));
521 	vringh_iov_init(&wiov, host_wiov, ARRAY_SIZE(host_wiov));
522 
523 	err = vringh_getdesc_user(&vrh, &riov, &wiov, getrange, &head);
524 	if (err != 1)
525 		errx(1, "vringh_getdesc_user: %i", err);
526 
527 	assert(riov.used == 1);
528 	assert(riov.iov[0].iov_base == __user_addr_max - 1);
529 	assert(riov.iov[0].iov_len == 1);
530 	if (getrange != getrange_slow) {
531 		assert(wiov.used == 1);
532 		assert(wiov.iov[0].iov_base == __user_addr_max - 3);
533 		assert(wiov.iov[0].iov_len == 2);
534 	} else {
535 		assert(wiov.used == 2);
536 		assert(wiov.iov[0].iov_base == __user_addr_max - 3);
537 		assert(wiov.iov[0].iov_len == 1);
538 		assert(wiov.iov[1].iov_base == __user_addr_max - 2);
539 		assert(wiov.iov[1].iov_len == 1);
540 	}
541 
542 	err = vringh_iov_pull_user(&riov, buf, 5);
543 	if (err != 1)
544 		errx(1, "vringh_iov_pull_user: %i", err);
545 	assert(buf[0] == 'a');
546 	assert(riov.i == 1);
547 	assert(vringh_iov_pull_user(&riov, buf, 5) == 0);
548 
549 	memcpy(buf, "bcdef", 5);
550 	err = vringh_iov_push_user(&wiov, buf, 5);
551 	if (err != 2)
552 		errx(1, "vringh_iov_push_user: %i", err);
553 	assert(memcmp(__user_addr_max - 3, "bc", 2) == 0);
554 	assert(wiov.i == wiov.used);
555 	assert(vringh_iov_push_user(&wiov, buf, 5) == 0);
556 
557 	/* Host is done. */
558 	err = vringh_complete_user(&vrh, head, err);
559 	if (err != 0)
560 		errx(1, "vringh_complete_user: %i", err);
561 
562 	/* Guest should see used token now. */
563 	__kfree_ignore_start = __user_addr_min + vring_size(RINGSIZE, ALIGN);
564 	__kfree_ignore_end = __kfree_ignore_start + 1;
565 	ret = virtqueue_get_buf(vq, &i);
566 	if (ret != &err)
567 		errx(1, "virtqueue_get_buf: %p", ret);
568 	assert(i == 2);
569 
570 	/* Guest puts in a huge descriptor. */
571 	sg_init_table(guest_sg, RINGSIZE);
572 	for (i = 0; i < RINGSIZE; i++) {
573 		sg_set_buf(&guest_sg[i],
574 			   __user_addr_max - USER_MEM/4, USER_MEM/4);
575 	}
576 
577 	/* Fill contents with recognisable garbage. */
578 	for (i = 0; i < USER_MEM/4; i++)
579 		((char *)__user_addr_max - USER_MEM/4)[i] = i;
580 
581 	/* This will allocate an indirect, so force it to allocate user addr */
582 	__kmalloc_fake = __user_addr_min + vring_size(RINGSIZE, ALIGN);
583 	err = virtqueue_add_outbuf(vq, guest_sg, RINGSIZE, &err, GFP_KERNEL);
584 	if (err)
585 		errx(1, "virtqueue_add_outbuf (large): %i", err);
586 	__kmalloc_fake = NULL;
587 
588 	/* Host picks it up (allocates new iov). */
589 	vringh_iov_init(&riov, host_riov, ARRAY_SIZE(host_riov));
590 	vringh_iov_init(&wiov, host_wiov, ARRAY_SIZE(host_wiov));
591 
592 	err = vringh_getdesc_user(&vrh, &riov, &wiov, getrange, &head);
593 	if (err != 1)
594 		errx(1, "vringh_getdesc_user: %i", err);
595 
596 	assert(riov.max_num & VRINGH_IOV_ALLOCATED);
597 	assert(riov.iov != host_riov);
598 	if (getrange != getrange_slow)
599 		assert(riov.used == RINGSIZE);
600 	else
601 		assert(riov.used == RINGSIZE * USER_MEM/4);
602 
603 	assert(!(wiov.max_num & VRINGH_IOV_ALLOCATED));
604 	assert(wiov.used == 0);
605 
606 	/* Pull data back out (in odd chunks), should be as expected. */
607 	for (i = 0; i < RINGSIZE * USER_MEM/4; i += 3) {
608 		err = vringh_iov_pull_user(&riov, buf, 3);
609 		if (err != 3 && i + err != RINGSIZE * USER_MEM/4)
610 			errx(1, "vringh_iov_pull_user large: %i", err);
611 		assert(buf[0] == (char)i);
612 		assert(err < 2 || buf[1] == (char)(i + 1));
613 		assert(err < 3 || buf[2] == (char)(i + 2));
614 	}
615 	assert(riov.i == riov.used);
616 	vringh_iov_cleanup(&riov);
617 	vringh_iov_cleanup(&wiov);
618 
619 	/* Complete using multi interface, just because we can. */
620 	used[0].id = head;
621 	used[0].len = 0;
622 	err = vringh_complete_multi_user(&vrh, used, 1);
623 	if (err)
624 		errx(1, "vringh_complete_multi_user(1): %i", err);
625 
626 	/* Free up those descriptors. */
627 	ret = virtqueue_get_buf(vq, &i);
628 	if (ret != &err)
629 		errx(1, "virtqueue_get_buf: %p", ret);
630 
631 	/* Add lots of descriptors. */
632 	sg_init_table(guest_sg, 1);
633 	sg_set_buf(&guest_sg[0], __user_addr_max - 1, 1);
634 	for (i = 0; i < RINGSIZE; i++) {
635 		err = virtqueue_add_outbuf(vq, guest_sg, 1, &err, GFP_KERNEL);
636 		if (err)
637 			errx(1, "virtqueue_add_outbuf (multiple): %i", err);
638 	}
639 
640 	/* Now get many, and consume them all at once. */
641 	vringh_iov_init(&riov, host_riov, ARRAY_SIZE(host_riov));
642 	vringh_iov_init(&wiov, host_wiov, ARRAY_SIZE(host_wiov));
643 
644 	for (i = 0; i < RINGSIZE; i++) {
645 		err = vringh_getdesc_user(&vrh, &riov, &wiov, getrange, &head);
646 		if (err != 1)
647 			errx(1, "vringh_getdesc_user: %i", err);
648 		used[i].id = head;
649 		used[i].len = 0;
650 	}
651 	/* Make sure it wraps around ring, to test! */
652 	assert(vrh.vring.used->idx % RINGSIZE != 0);
653 	err = vringh_complete_multi_user(&vrh, used, RINGSIZE);
654 	if (err)
655 		errx(1, "vringh_complete_multi_user: %i", err);
656 
657 	/* Free those buffers. */
658 	for (i = 0; i < RINGSIZE; i++) {
659 		unsigned len;
660 		assert(virtqueue_get_buf(vq, &len) != NULL);
661 	}
662 
663 	/* Test weird (but legal!) indirect. */
664 	if (__virtio_test_bit(&vdev, VIRTIO_RING_F_INDIRECT_DESC)) {
665 		char *data = __user_addr_max - USER_MEM/4;
666 		struct vring_desc *d = __user_addr_max - USER_MEM/2;
667 		struct vring vring;
668 
669 		/* Force creation of direct, which we modify. */
670 		__virtio_clear_bit(&vdev, VIRTIO_RING_F_INDIRECT_DESC);
671 		vq = vring_new_virtqueue(0, RINGSIZE, ALIGN, &vdev, true,
672 					 false, __user_addr_min,
673 					 never_notify_host,
674 					 never_callback_guest,
675 					 "guest vq");
676 
677 		sg_init_table(guest_sg, 4);
678 		sg_set_buf(&guest_sg[0], d, sizeof(*d)*2);
679 		sg_set_buf(&guest_sg[1], d + 2, sizeof(*d)*1);
680 		sg_set_buf(&guest_sg[2], data + 6, 4);
681 		sg_set_buf(&guest_sg[3], d + 3, sizeof(*d)*3);
682 
683 		err = virtqueue_add_outbuf(vq, guest_sg, 4, &err, GFP_KERNEL);
684 		if (err)
685 			errx(1, "virtqueue_add_outbuf (indirect): %i", err);
686 
687 		vring_init(&vring, RINGSIZE, __user_addr_min, ALIGN);
688 
689 		/* They're used in order, but double-check... */
690 		assert(vring.desc[0].addr == (unsigned long)d);
691 		assert(vring.desc[1].addr == (unsigned long)(d+2));
692 		assert(vring.desc[2].addr == (unsigned long)data + 6);
693 		assert(vring.desc[3].addr == (unsigned long)(d+3));
694 		vring.desc[0].flags |= VRING_DESC_F_INDIRECT;
695 		vring.desc[1].flags |= VRING_DESC_F_INDIRECT;
696 		vring.desc[3].flags |= VRING_DESC_F_INDIRECT;
697 
698 		/* First indirect */
699 		d[0].addr = (unsigned long)data;
700 		d[0].len = 1;
701 		d[0].flags = VRING_DESC_F_NEXT;
702 		d[0].next = 1;
703 		d[1].addr = (unsigned long)data + 1;
704 		d[1].len = 2;
705 		d[1].flags = 0;
706 
707 		/* Second indirect */
708 		d[2].addr = (unsigned long)data + 3;
709 		d[2].len = 3;
710 		d[2].flags = 0;
711 
712 		/* Third indirect */
713 		d[3].addr = (unsigned long)data + 10;
714 		d[3].len = 5;
715 		d[3].flags = VRING_DESC_F_NEXT;
716 		d[3].next = 1;
717 		d[4].addr = (unsigned long)data + 15;
718 		d[4].len = 6;
719 		d[4].flags = VRING_DESC_F_NEXT;
720 		d[4].next = 2;
721 		d[5].addr = (unsigned long)data + 21;
722 		d[5].len = 7;
723 		d[5].flags = 0;
724 
725 		/* Host picks it up (allocates new iov). */
726 		vringh_iov_init(&riov, host_riov, ARRAY_SIZE(host_riov));
727 		vringh_iov_init(&wiov, host_wiov, ARRAY_SIZE(host_wiov));
728 
729 		err = vringh_getdesc_user(&vrh, &riov, &wiov, getrange, &head);
730 		if (err != 1)
731 			errx(1, "vringh_getdesc_user: %i", err);
732 
733 		if (head != 0)
734 			errx(1, "vringh_getdesc_user: head %i not 0", head);
735 
736 		assert(riov.max_num & VRINGH_IOV_ALLOCATED);
737 		if (getrange != getrange_slow)
738 			assert(riov.used == 7);
739 		else
740 			assert(riov.used == 28);
741 		err = vringh_iov_pull_user(&riov, buf, 29);
742 		assert(err == 28);
743 
744 		/* Data should be linear. */
745 		for (i = 0; i < err; i++)
746 			assert(buf[i] == i);
747 		vringh_iov_cleanup(&riov);
748 	}
749 
750 	/* Don't leak memory... */
751 	vring_del_virtqueue(vq);
752 	free(__user_addr_min);
753 
754 	return 0;
755 }
756