| 1 | /* |
| 2 | * Virtio 9p backend |
| 3 | * |
| 4 | * Copyright IBM, Corp. 2010 |
| 5 | * |
| 6 | * Authors: |
| 7 | * Anthony Liguori <aliguori@us.ibm.com> |
| 8 | * |
| 9 | * This work is licensed under the terms of the GNU GPL, version 2. See |
| 10 | * the COPYING file in the top-level directory. |
| 11 | * |
| 12 | */ |
| 13 | |
| 14 | /* |
| 15 | * Not so fast! You might want to read the 9p developer docs first: |
| 16 | * https://wiki.qemu.org/Documentation/9p |
| 17 | */ |
| 18 | |
| 19 | #include "qemu/osdep.h" |
| 20 | #include "hw/virtio/virtio.h" |
| 21 | #include "qemu/sockets.h" |
| 22 | #include "virtio-9p.h" |
| 23 | #include "fsdev/qemu-fsdev.h" |
| 24 | #include "coth.h" |
| 25 | #include "hw/core/qdev-properties.h" |
| 26 | #include "hw/virtio/virtio-access.h" |
| 27 | #include "qemu/iov.h" |
| 28 | #include "qemu/module.h" |
| 29 | #include "system/qtest.h" |
| 30 | |
| 31 | static void coroutine_fn virtio_9p_push_and_notify(V9fsPDU *pdu) |
| 32 | { |
| 33 | V9fsState *s = pdu->s; |
| 34 | V9fsVirtioState *v = container_of(s, V9fsVirtioState, state); |
| 35 | VirtQueueElement *elem = v->elems[pdu->idx]; |
| 36 | |
| 37 | /* push onto queue and notify */ |
| 38 | virtqueue_push(v->vq, elem, pdu->size); |
| 39 | g_free(elem); |
| 40 | v->elems[pdu->idx] = NULL; |
| 41 | |
| 42 | /* FIXME: we should batch these completions */ |
| 43 | virtio_notify(VIRTIO_DEVICE(v), v->vq); |
| 44 | } |
| 45 | |
| 46 | static void handle_9p_output(VirtIODevice *vdev, VirtQueue *vq) |
| 47 | { |
| 48 | V9fsVirtioState *v = (V9fsVirtioState *)vdev; |
| 49 | V9fsState *s = &v->state; |
| 50 | V9fsPDU *pdu; |
| 51 | ssize_t len; |
| 52 | VirtQueueElement *elem; |
| 53 | |
| 54 | while ((pdu = pdu_alloc(s))) { |
| 55 | P9MsgHeader out; |
| 56 | |
| 57 | elem = virtqueue_pop(vq, sizeof(VirtQueueElement)); |
| 58 | if (!elem) { |
| 59 | goto out_free_pdu; |
| 60 | } |
| 61 | |
| 62 | if (iov_size(elem->in_sg, elem->in_num) < 7) { |
| 63 | virtio_error(vdev, |
| 64 | "The guest sent a VirtFS request without space for " |
| 65 | "the reply"); |
| 66 | goto out_free_req; |
| 67 | } |
| 68 | |
| 69 | len = iov_to_buf(elem->out_sg, elem->out_num, 0, &out, 7); |
| 70 | if (len != 7) { |
| 71 | virtio_error(vdev, "The guest sent a malformed VirtFS request: " |
| 72 | "header size is %zd, should be 7", len); |
| 73 | goto out_free_req; |
| 74 | } |
| 75 | |
| 76 | v->elems[pdu->idx] = elem; |
| 77 | |
| 78 | pdu_submit(pdu, &out); |
| 79 | } |
| 80 | |
| 81 | return; |
| 82 | |
| 83 | out_free_req: |
| 84 | virtqueue_detach_element(vq, elem, 0); |
| 85 | g_free(elem); |
| 86 | out_free_pdu: |
| 87 | pdu_free(pdu); |
| 88 | } |
| 89 | |
| 90 | static uint64_t virtio_9p_get_features(VirtIODevice *vdev, uint64_t features, |
| 91 | Error **errp) |
| 92 | { |
| 93 | virtio_add_feature(&features, VIRTIO_9P_MOUNT_TAG); |
| 94 | return features; |
| 95 | } |
| 96 | |
| 97 | static void virtio_9p_get_config(VirtIODevice *vdev, uint8_t *config) |
| 98 | { |
| 99 | int len; |
| 100 | struct virtio_9p_config *cfg; |
| 101 | V9fsVirtioState *v = VIRTIO_9P(vdev); |
| 102 | V9fsState *s = &v->state; |
| 103 | |
| 104 | len = strlen(s->tag); |
| 105 | cfg = g_malloc0(sizeof(struct virtio_9p_config) + len); |
| 106 | virtio_stw_p(vdev, &cfg->tag_len, len); |
| 107 | /* We don't copy the terminating null to config space */ |
| 108 | memcpy(cfg->tag, s->tag, len); |
| 109 | memcpy(config, cfg, v->config_size); |
| 110 | g_free(cfg); |
| 111 | } |
| 112 | |
| 113 | static void virtio_9p_reset(VirtIODevice *vdev) |
| 114 | { |
| 115 | V9fsVirtioState *v = (V9fsVirtioState *)vdev; |
| 116 | |
| 117 | v9fs_reset(&v->state); |
| 118 | } |
| 119 | |
| 120 | static ssize_t coroutine_fn |
| 121 | virtio_pdu_vmarshal(V9fsPDU *pdu, size_t offset, const char *fmt, va_list ap) |
| 122 | { |
| 123 | V9fsState *s = pdu->s; |
| 124 | V9fsVirtioState *v = container_of(s, V9fsVirtioState, state); |
| 125 | VirtQueueElement *elem = v->elems[pdu->idx]; |
| 126 | ssize_t ret; |
| 127 | |
| 128 | ret = v9fs_iov_vmarshal(elem->in_sg, elem->in_num, offset, 1, fmt, ap); |
| 129 | if (ret < 0) { |
| 130 | VirtIODevice *vdev = VIRTIO_DEVICE(v); |
| 131 | |
| 132 | virtio_error(vdev, "Failed to encode VirtFS reply type %d", |
| 133 | pdu->id + 1); |
| 134 | } |
| 135 | return ret; |
| 136 | } |
| 137 | |
| 138 | static ssize_t coroutine_fn |
| 139 | virtio_pdu_vunmarshal(V9fsPDU *pdu, size_t offset, const char *fmt, va_list ap) |
| 140 | { |
| 141 | V9fsState *s = pdu->s; |
| 142 | V9fsVirtioState *v = container_of(s, V9fsVirtioState, state); |
| 143 | VirtQueueElement *elem = v->elems[pdu->idx]; |
| 144 | ssize_t ret; |
| 145 | |
| 146 | ret = v9fs_iov_vunmarshal(elem->out_sg, elem->out_num, offset, 1, fmt, ap); |
| 147 | if (ret < 0) { |
| 148 | VirtIODevice *vdev = VIRTIO_DEVICE(v); |
| 149 | |
| 150 | virtio_error(vdev, "Failed to decode VirtFS request type %d", pdu->id); |
| 151 | } |
| 152 | return ret; |
| 153 | } |
| 154 | |
| 155 | static void coroutine_fn |
| 156 | virtio_init_in_iov_from_pdu(V9fsPDU *pdu, struct iovec **piov, |
| 157 | unsigned int *pniov, size_t size) |
| 158 | { |
| 159 | V9fsState *s = pdu->s; |
| 160 | V9fsVirtioState *v = container_of(s, V9fsVirtioState, state); |
| 161 | VirtQueueElement *elem = v->elems[pdu->idx]; |
| 162 | size_t buf_size = iov_size(elem->in_sg, elem->in_num); |
| 163 | |
| 164 | if (buf_size < size) { |
| 165 | VirtIODevice *vdev = VIRTIO_DEVICE(v); |
| 166 | |
| 167 | virtio_error(vdev, |
| 168 | "VirtFS reply type %d needs %zu bytes, buffer has %zu", |
| 169 | pdu->id + 1, size, buf_size); |
| 170 | } |
| 171 | |
| 172 | *piov = elem->in_sg; |
| 173 | *pniov = elem->in_num; |
| 174 | } |
| 175 | |
| 176 | static void coroutine_fn |
| 177 | virtio_init_out_iov_from_pdu(V9fsPDU *pdu, struct iovec **piov, |
| 178 | unsigned int *pniov, size_t size) |
| 179 | { |
| 180 | V9fsState *s = pdu->s; |
| 181 | V9fsVirtioState *v = container_of(s, V9fsVirtioState, state); |
| 182 | VirtQueueElement *elem = v->elems[pdu->idx]; |
| 183 | size_t buf_size = iov_size(elem->out_sg, elem->out_num); |
| 184 | |
| 185 | if (buf_size < size) { |
| 186 | VirtIODevice *vdev = VIRTIO_DEVICE(v); |
| 187 | |
| 188 | virtio_error(vdev, |
| 189 | "VirtFS request type %d needs %zu bytes, buffer has %zu", |
| 190 | pdu->id, size, buf_size); |
| 191 | } |
| 192 | |
| 193 | *piov = elem->out_sg; |
| 194 | *pniov = elem->out_num; |
| 195 | } |
| 196 | |
| 197 | static size_t coroutine_fn virtio_9p_msize_limit(V9fsState *s) |
| 198 | { |
| 199 | const size_t guestPageSize = 4096; |
| 200 | return (VIRTQUEUE_MAX_SIZE - 2) * guestPageSize; |
| 201 | } |
| 202 | |
| 203 | static size_t coroutine_fn virtio_9p_response_buffer_size(V9fsPDU *pdu) |
| 204 | { |
| 205 | V9fsState *s = pdu->s; |
| 206 | V9fsVirtioState *v = container_of(s, V9fsVirtioState, state); |
| 207 | VirtQueueElement *elem = v->elems[pdu->idx]; |
| 208 | |
| 209 | return iov_size(elem->in_sg, elem->in_num); |
| 210 | } |
| 211 | |
| 212 | static const V9fsTransport virtio_9p_transport = { |
| 213 | .pdu_vmarshal = virtio_pdu_vmarshal, |
| 214 | .pdu_vunmarshal = virtio_pdu_vunmarshal, |
| 215 | .init_in_iov_from_pdu = virtio_init_in_iov_from_pdu, |
| 216 | .init_out_iov_from_pdu = virtio_init_out_iov_from_pdu, |
| 217 | .push_and_notify = virtio_9p_push_and_notify, |
| 218 | .msize_limit = virtio_9p_msize_limit, |
| 219 | .response_buffer_size = virtio_9p_response_buffer_size, |
| 220 | }; |
| 221 | |
| 222 | static void virtio_9p_device_realize(DeviceState *dev, Error **errp) |
| 223 | { |
| 224 | VirtIODevice *vdev = VIRTIO_DEVICE(dev); |
| 225 | V9fsVirtioState *v = VIRTIO_9P(dev); |
| 226 | V9fsState *s = &v->state; |
| 227 | FsDriverEntry *fse = get_fsdev_fsentry(s->fsconf.fsdev_id); |
| 228 | |
| 229 | if (qtest_enabled() && fse) { |
| 230 | fse->export_flags |= V9FS_NO_PERF_WARN; |
| 231 | } |
| 232 | |
| 233 | if (v9fs_device_realize_common(s, &virtio_9p_transport, errp)) { |
| 234 | return; |
| 235 | } |
| 236 | |
| 237 | v->config_size = sizeof(struct virtio_9p_config) + strlen(s->fsconf.tag); |
| 238 | virtio_init(vdev, VIRTIO_ID_9P, v->config_size); |
| 239 | v->vq = virtio_add_queue(vdev, MAX_REQ, handle_9p_output); |
| 240 | } |
| 241 | |
| 242 | static void virtio_9p_device_unrealize(DeviceState *dev) |
| 243 | { |
| 244 | VirtIODevice *vdev = VIRTIO_DEVICE(dev); |
| 245 | V9fsVirtioState *v = VIRTIO_9P(dev); |
| 246 | V9fsState *s = &v->state; |
| 247 | |
| 248 | v9fs_reset(s); /* cancel all in-flight PDUs to prevent UAF */ |
| 249 | virtio_delete_queue(v->vq); |
| 250 | virtio_cleanup(vdev); |
| 251 | v9fs_device_unrealize_common(s); |
| 252 | } |
| 253 | |
| 254 | /* virtio-9p device */ |
| 255 | |
| 256 | static const VMStateDescription vmstate_virtio_9p = { |
| 257 | .name = "virtio-9p", |
| 258 | .minimum_version_id = 1, |
| 259 | .version_id = 1, |
| 260 | .fields = (const VMStateField[]) { |
| 261 | VMSTATE_VIRTIO_DEVICE, |
| 262 | VMSTATE_END_OF_LIST() |
| 263 | }, |
| 264 | }; |
| 265 | |
| 266 | static const Property virtio_9p_properties[] = { |
| 267 | DEFINE_PROP_STRING("mount_tag", V9fsVirtioState, state.fsconf.tag), |
| 268 | DEFINE_PROP_STRING("fsdev", V9fsVirtioState, state.fsconf.fsdev_id), |
| 269 | }; |
| 270 | |
| 271 | static void virtio_9p_class_init(ObjectClass *klass, const void *data) |
| 272 | { |
| 273 | DeviceClass *dc = DEVICE_CLASS(klass); |
| 274 | VirtioDeviceClass *vdc = VIRTIO_DEVICE_CLASS(klass); |
| 275 | |
| 276 | device_class_set_props(dc, virtio_9p_properties); |
| 277 | dc->vmsd = &vmstate_virtio_9p; |
| 278 | set_bit(DEVICE_CATEGORY_STORAGE, dc->categories); |
| 279 | vdc->realize = virtio_9p_device_realize; |
| 280 | vdc->unrealize = virtio_9p_device_unrealize; |
| 281 | vdc->get_features = virtio_9p_get_features; |
| 282 | vdc->get_config = virtio_9p_get_config; |
| 283 | vdc->reset = virtio_9p_reset; |
| 284 | } |
| 285 | |
| 286 | static const TypeInfo virtio_device_info = { |
| 287 | .name = TYPE_VIRTIO_9P, |
| 288 | .parent = TYPE_VIRTIO_DEVICE, |
| 289 | .instance_size = sizeof(V9fsVirtioState), |
| 290 | .class_init = virtio_9p_class_init, |
| 291 | }; |
| 292 | |
| 293 | static void virtio_9p_register_types(void) |
| 294 | { |
| 295 | type_register_static(&virtio_device_info); |
| 296 | } |
| 297 | |
| 298 | type_init(virtio_9p_register_types) |