vhost: fix out-of-bounds read
[dpdk.git] / lib / librte_vhost / vhost_user / vhost-net-user.c
1 /*-
2  *   BSD LICENSE
3  *
4  *   Copyright(c) 2010-2014 Intel Corporation. All rights reserved.
5  *   All rights reserved.
6  *
7  *   Redistribution and use in source and binary forms, with or without
8  *   modification, are permitted provided that the following conditions
9  *   are met:
10  *
11  *     * Redistributions of source code must retain the above copyright
12  *       notice, this list of conditions and the following disclaimer.
13  *     * Redistributions in binary form must reproduce the above copyright
14  *       notice, this list of conditions and the following disclaimer in
15  *       the documentation and/or other materials provided with the
16  *       distribution.
17  *     * Neither the name of Intel Corporation nor the names of its
18  *       contributors may be used to endorse or promote products derived
19  *       from this software without specific prior written permission.
20  *
21  *   THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
22  *   "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
23  *   LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
24  *   A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
25  *   OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
26  *   SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
27  *   LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
28  *   DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
29  *   THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
30  *   (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
31  *   OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
32  */
33
34 #include <stdint.h>
35 #include <stdio.h>
36 #include <limits.h>
37 #include <stdlib.h>
38 #include <unistd.h>
39 #include <string.h>
40 #include <sys/types.h>
41 #include <sys/socket.h>
42 #include <sys/un.h>
43 #include <errno.h>
44 #include <pthread.h>
45
46 #include <rte_log.h>
47 #include <rte_virtio_net.h>
48
49 #include "fd_man.h"
50 #include "vhost-net-user.h"
51 #include "vhost-net.h"
52 #include "virtio-net-user.h"
53
54 #define MAX_VIRTIO_BACKLOG 128
55
56 static void vserver_new_vq_conn(int fd, void *data, int *remove);
57 static void vserver_message_handler(int fd, void *dat, int *remove);
58 struct vhost_net_device_ops const *ops;
59
60 struct connfd_ctx {
61         struct vhost_server *vserver;
62         uint32_t fh;
63 };
64
65 #define MAX_VHOST_SERVER 1024
66 struct _vhost_server {
67         struct vhost_server *server[MAX_VHOST_SERVER];
68         struct fdset fdset;
69         int vserver_cnt;
70         pthread_mutex_t server_mutex;
71 };
72
73 static struct _vhost_server g_vhost_server = {
74         .fdset = {
75                 .fd = { [0 ... MAX_FDS - 1] = {-1, NULL, NULL, NULL, 0} },
76                 .fd_mutex = PTHREAD_MUTEX_INITIALIZER,
77                 .num = 0
78         },
79         .vserver_cnt = 0,
80         .server_mutex = PTHREAD_MUTEX_INITIALIZER,
81 };
82
83 static const char *vhost_message_str[VHOST_USER_MAX] = {
84         [VHOST_USER_NONE] = "VHOST_USER_NONE",
85         [VHOST_USER_GET_FEATURES] = "VHOST_USER_GET_FEATURES",
86         [VHOST_USER_SET_FEATURES] = "VHOST_USER_SET_FEATURES",
87         [VHOST_USER_SET_OWNER] = "VHOST_USER_SET_OWNER",
88         [VHOST_USER_RESET_OWNER] = "VHOST_USER_RESET_OWNER",
89         [VHOST_USER_SET_MEM_TABLE] = "VHOST_USER_SET_MEM_TABLE",
90         [VHOST_USER_SET_LOG_BASE] = "VHOST_USER_SET_LOG_BASE",
91         [VHOST_USER_SET_LOG_FD] = "VHOST_USER_SET_LOG_FD",
92         [VHOST_USER_SET_VRING_NUM] = "VHOST_USER_SET_VRING_NUM",
93         [VHOST_USER_SET_VRING_ADDR] = "VHOST_USER_SET_VRING_ADDR",
94         [VHOST_USER_SET_VRING_BASE] = "VHOST_USER_SET_VRING_BASE",
95         [VHOST_USER_GET_VRING_BASE] = "VHOST_USER_GET_VRING_BASE",
96         [VHOST_USER_SET_VRING_KICK] = "VHOST_USER_SET_VRING_KICK",
97         [VHOST_USER_SET_VRING_CALL] = "VHOST_USER_SET_VRING_CALL",
98         [VHOST_USER_SET_VRING_ERR]  = "VHOST_USER_SET_VRING_ERR",
99         [VHOST_USER_GET_PROTOCOL_FEATURES]  = "VHOST_USER_GET_PROTOCOL_FEATURES",
100         [VHOST_USER_SET_PROTOCOL_FEATURES]  = "VHOST_USER_SET_PROTOCOL_FEATURES",
101         [VHOST_USER_GET_QUEUE_NUM]  = "VHOST_USER_GET_QUEUE_NUM",
102         [VHOST_USER_SET_VRING_ENABLE]  = "VHOST_USER_SET_VRING_ENABLE",
103 };
104
105 /**
106  * Create a unix domain socket, bind to path and listen for connection.
107  * @return
108  *  socket fd or -1 on failure
109  */
110 static int
111 uds_socket(const char *path)
112 {
113         struct sockaddr_un un;
114         int sockfd;
115         int ret;
116
117         if (path == NULL)
118                 return -1;
119
120         sockfd = socket(AF_UNIX, SOCK_STREAM, 0);
121         if (sockfd < 0)
122                 return -1;
123         RTE_LOG(INFO, VHOST_CONFIG, "socket created, fd:%d\n", sockfd);
124
125         memset(&un, 0, sizeof(un));
126         un.sun_family = AF_UNIX;
127         snprintf(un.sun_path, sizeof(un.sun_path), "%s", path);
128         ret = bind(sockfd, (struct sockaddr *)&un, sizeof(un));
129         if (ret == -1) {
130                 RTE_LOG(ERR, VHOST_CONFIG, "fail to bind fd:%d, remove file:%s and try again.\n",
131                         sockfd, path);
132                 goto err;
133         }
134         RTE_LOG(INFO, VHOST_CONFIG, "bind to %s\n", path);
135
136         ret = listen(sockfd, MAX_VIRTIO_BACKLOG);
137         if (ret == -1)
138                 goto err;
139
140         return sockfd;
141
142 err:
143         close(sockfd);
144         return -1;
145 }
146
147 /* return bytes# of read on success or negative val on failure. */
148 static int
149 read_fd_message(int sockfd, char *buf, int buflen, int *fds, int fd_num)
150 {
151         struct iovec iov;
152         struct msghdr msgh;
153         size_t fdsize = fd_num * sizeof(int);
154         char control[CMSG_SPACE(fdsize)];
155         struct cmsghdr *cmsg;
156         int ret;
157
158         memset(&msgh, 0, sizeof(msgh));
159         iov.iov_base = buf;
160         iov.iov_len  = buflen;
161
162         msgh.msg_iov = &iov;
163         msgh.msg_iovlen = 1;
164         msgh.msg_control = control;
165         msgh.msg_controllen = sizeof(control);
166
167         ret = recvmsg(sockfd, &msgh, 0);
168         if (ret <= 0) {
169                 RTE_LOG(ERR, VHOST_CONFIG, "recvmsg failed\n");
170                 return ret;
171         }
172
173         if (msgh.msg_flags & (MSG_TRUNC | MSG_CTRUNC)) {
174                 RTE_LOG(ERR, VHOST_CONFIG, "truncted msg\n");
175                 return -1;
176         }
177
178         for (cmsg = CMSG_FIRSTHDR(&msgh); cmsg != NULL;
179                 cmsg = CMSG_NXTHDR(&msgh, cmsg)) {
180                 if ((cmsg->cmsg_level == SOL_SOCKET) &&
181                         (cmsg->cmsg_type == SCM_RIGHTS)) {
182                         memcpy(fds, CMSG_DATA(cmsg), fdsize);
183                         break;
184                 }
185         }
186
187         return ret;
188 }
189
190 /* return bytes# of read on success or negative val on failure. */
191 static int
192 read_vhost_message(int sockfd, struct VhostUserMsg *msg)
193 {
194         int ret;
195
196         ret = read_fd_message(sockfd, (char *)msg, VHOST_USER_HDR_SIZE,
197                 msg->fds, VHOST_MEMORY_MAX_NREGIONS);
198         if (ret <= 0)
199                 return ret;
200
201         if (msg && msg->size) {
202                 if (msg->size > sizeof(msg->payload)) {
203                         RTE_LOG(ERR, VHOST_CONFIG,
204                                 "invalid msg size: %d\n", msg->size);
205                         return -1;
206                 }
207                 ret = read(sockfd, &msg->payload, msg->size);
208                 if (ret <= 0)
209                         return ret;
210                 if (ret != (int)msg->size) {
211                         RTE_LOG(ERR, VHOST_CONFIG,
212                                 "read control message failed\n");
213                         return -1;
214                 }
215         }
216
217         return ret;
218 }
219
220 static int
221 send_fd_message(int sockfd, char *buf, int buflen, int *fds, int fd_num)
222 {
223
224         struct iovec iov;
225         struct msghdr msgh;
226         size_t fdsize = fd_num * sizeof(int);
227         char control[CMSG_SPACE(fdsize)];
228         struct cmsghdr *cmsg;
229         int ret;
230
231         memset(&msgh, 0, sizeof(msgh));
232         iov.iov_base = buf;
233         iov.iov_len = buflen;
234
235         msgh.msg_iov = &iov;
236         msgh.msg_iovlen = 1;
237
238         if (fds && fd_num > 0) {
239                 msgh.msg_control = control;
240                 msgh.msg_controllen = sizeof(control);
241                 cmsg = CMSG_FIRSTHDR(&msgh);
242                 cmsg->cmsg_len = CMSG_LEN(fdsize);
243                 cmsg->cmsg_level = SOL_SOCKET;
244                 cmsg->cmsg_type = SCM_RIGHTS;
245                 memcpy(CMSG_DATA(cmsg), fds, fdsize);
246         } else {
247                 msgh.msg_control = NULL;
248                 msgh.msg_controllen = 0;
249         }
250
251         do {
252                 ret = sendmsg(sockfd, &msgh, 0);
253         } while (ret < 0 && errno == EINTR);
254
255         if (ret < 0) {
256                 RTE_LOG(ERR, VHOST_CONFIG,  "sendmsg error\n");
257                 return ret;
258         }
259
260         return ret;
261 }
262
263 static int
264 send_vhost_message(int sockfd, struct VhostUserMsg *msg)
265 {
266         int ret;
267
268         if (!msg)
269                 return 0;
270
271         msg->flags &= ~VHOST_USER_VERSION_MASK;
272         msg->flags |= VHOST_USER_VERSION;
273         msg->flags |= VHOST_USER_REPLY_MASK;
274
275         ret = send_fd_message(sockfd, (char *)msg,
276                 VHOST_USER_HDR_SIZE + msg->size, NULL, 0);
277
278         return ret;
279 }
280
281 /* call back when there is new virtio connection.  */
282 static void
283 vserver_new_vq_conn(int fd, void *dat, __rte_unused int *remove)
284 {
285         struct vhost_server *vserver = (struct vhost_server *)dat;
286         int conn_fd;
287         struct connfd_ctx *ctx;
288         int fh;
289         struct vhost_device_ctx vdev_ctx = { (pid_t)0, 0 };
290         unsigned int size;
291
292         conn_fd = accept(fd, NULL, NULL);
293         RTE_LOG(INFO, VHOST_CONFIG,
294                 "new virtio connection is %d\n", conn_fd);
295         if (conn_fd < 0)
296                 return;
297
298         ctx = calloc(1, sizeof(*ctx));
299         if (ctx == NULL) {
300                 close(conn_fd);
301                 return;
302         }
303
304         fh = ops->new_device(vdev_ctx);
305         if (fh == -1) {
306                 free(ctx);
307                 close(conn_fd);
308                 return;
309         }
310
311         vdev_ctx.fh = fh;
312         size = strnlen(vserver->path, PATH_MAX);
313         ops->set_ifname(vdev_ctx, vserver->path,
314                 size);
315
316         RTE_LOG(INFO, VHOST_CONFIG, "new device, handle is %d\n", fh);
317
318         ctx->vserver = vserver;
319         ctx->fh = fh;
320         fdset_add(&g_vhost_server.fdset,
321                 conn_fd, vserver_message_handler, NULL, ctx);
322 }
323
324 /* callback when there is message on the connfd */
325 static void
326 vserver_message_handler(int connfd, void *dat, int *remove)
327 {
328         struct vhost_device_ctx ctx;
329         struct connfd_ctx *cfd_ctx = (struct connfd_ctx *)dat;
330         struct VhostUserMsg msg;
331         uint64_t features;
332         int ret;
333
334         ctx.fh = cfd_ctx->fh;
335         ret = read_vhost_message(connfd, &msg);
336         if (ret <= 0 || msg.request >= VHOST_USER_MAX) {
337                 if (ret < 0)
338                         RTE_LOG(ERR, VHOST_CONFIG,
339                                 "vhost read message failed\n");
340                 else if (ret == 0)
341                         RTE_LOG(INFO, VHOST_CONFIG,
342                                 "vhost peer closed\n");
343                 else
344                         RTE_LOG(ERR, VHOST_CONFIG,
345                                 "vhost read incorrect message\n");
346
347                 close(connfd);
348                 *remove = 1;
349                 free(cfd_ctx);
350                 user_destroy_device(ctx);
351                 ops->destroy_device(ctx);
352
353                 return;
354         }
355
356         RTE_LOG(INFO, VHOST_CONFIG, "read message %s\n",
357                 vhost_message_str[msg.request]);
358         switch (msg.request) {
359         case VHOST_USER_GET_FEATURES:
360                 ret = ops->get_features(ctx, &features);
361                 msg.payload.u64 = features;
362                 msg.size = sizeof(msg.payload.u64);
363                 send_vhost_message(connfd, &msg);
364                 break;
365         case VHOST_USER_SET_FEATURES:
366                 features = msg.payload.u64;
367                 ops->set_features(ctx, &features);
368                 break;
369
370         case VHOST_USER_GET_PROTOCOL_FEATURES:
371                 msg.payload.u64 = VHOST_USER_PROTOCOL_FEATURES;
372                 msg.size = sizeof(msg.payload.u64);
373                 send_vhost_message(connfd, &msg);
374                 break;
375         case VHOST_USER_SET_PROTOCOL_FEATURES:
376                 user_set_protocol_features(ctx, msg.payload.u64);
377                 break;
378
379         case VHOST_USER_SET_OWNER:
380                 ops->set_owner(ctx);
381                 break;
382         case VHOST_USER_RESET_OWNER:
383                 ops->reset_owner(ctx);
384                 break;
385
386         case VHOST_USER_SET_MEM_TABLE:
387                 user_set_mem_table(ctx, &msg);
388                 break;
389
390         case VHOST_USER_SET_LOG_BASE:
391                 RTE_LOG(INFO, VHOST_CONFIG, "not implemented.\n");
392         case VHOST_USER_SET_LOG_FD:
393                 close(msg.fds[0]);
394                 RTE_LOG(INFO, VHOST_CONFIG, "not implemented.\n");
395                 break;
396
397         case VHOST_USER_SET_VRING_NUM:
398                 ops->set_vring_num(ctx, &msg.payload.state);
399                 break;
400         case VHOST_USER_SET_VRING_ADDR:
401                 ops->set_vring_addr(ctx, &msg.payload.addr);
402                 break;
403         case VHOST_USER_SET_VRING_BASE:
404                 ops->set_vring_base(ctx, &msg.payload.state);
405                 break;
406
407         case VHOST_USER_GET_VRING_BASE:
408                 ret = user_get_vring_base(ctx, &msg.payload.state);
409                 msg.size = sizeof(msg.payload.state);
410                 send_vhost_message(connfd, &msg);
411                 break;
412
413         case VHOST_USER_SET_VRING_KICK:
414                 user_set_vring_kick(ctx, &msg);
415                 break;
416         case VHOST_USER_SET_VRING_CALL:
417                 user_set_vring_call(ctx, &msg);
418                 break;
419
420         case VHOST_USER_SET_VRING_ERR:
421                 if (!(msg.payload.u64 & VHOST_USER_VRING_NOFD_MASK))
422                         close(msg.fds[0]);
423                 RTE_LOG(INFO, VHOST_CONFIG, "not implemented\n");
424                 break;
425
426         case VHOST_USER_GET_QUEUE_NUM:
427                 msg.payload.u64 = VHOST_MAX_QUEUE_PAIRS;
428                 msg.size = sizeof(msg.payload.u64);
429                 send_vhost_message(connfd, &msg);
430                 break;
431
432         case VHOST_USER_SET_VRING_ENABLE:
433                 user_set_vring_enable(ctx, &msg.payload.state);
434                 break;
435
436         default:
437                 break;
438
439         }
440 }
441
442 /**
443  * Creates and initialise the vhost server.
444  */
445 int
446 rte_vhost_driver_register(const char *path)
447 {
448         struct vhost_server *vserver;
449
450         pthread_mutex_lock(&g_vhost_server.server_mutex);
451         if (ops == NULL)
452                 ops = get_virtio_net_callbacks();
453
454         if (g_vhost_server.vserver_cnt == MAX_VHOST_SERVER) {
455                 RTE_LOG(ERR, VHOST_CONFIG,
456                         "error: the number of servers reaches maximum\n");
457                 pthread_mutex_unlock(&g_vhost_server.server_mutex);
458                 return -1;
459         }
460
461         vserver = calloc(sizeof(struct vhost_server), 1);
462         if (vserver == NULL) {
463                 pthread_mutex_unlock(&g_vhost_server.server_mutex);
464                 return -1;
465         }
466
467         vserver->listenfd = uds_socket(path);
468         if (vserver->listenfd < 0) {
469                 free(vserver);
470                 pthread_mutex_unlock(&g_vhost_server.server_mutex);
471                 return -1;
472         }
473
474         vserver->path = strdup(path);
475
476         fdset_add(&g_vhost_server.fdset, vserver->listenfd,
477                 vserver_new_vq_conn, NULL, vserver);
478
479         g_vhost_server.server[g_vhost_server.vserver_cnt++] = vserver;
480         pthread_mutex_unlock(&g_vhost_server.server_mutex);
481
482         return 0;
483 }
484
485
486 /**
487  * Unregister the specified vhost server
488  */
489 int
490 rte_vhost_driver_unregister(const char *path)
491 {
492         int i;
493         int count;
494
495         pthread_mutex_lock(&g_vhost_server.server_mutex);
496
497         for (i = 0; i < g_vhost_server.vserver_cnt; i++) {
498                 if (!strcmp(g_vhost_server.server[i]->path, path)) {
499                         fdset_del(&g_vhost_server.fdset,
500                                 g_vhost_server.server[i]->listenfd);
501
502                         close(g_vhost_server.server[i]->listenfd);
503                         free(g_vhost_server.server[i]->path);
504                         free(g_vhost_server.server[i]);
505
506                         unlink(path);
507
508                         count = --g_vhost_server.vserver_cnt;
509                         g_vhost_server.server[i] = g_vhost_server.server[count];
510                         g_vhost_server.server[count] = NULL;
511                         pthread_mutex_unlock(&g_vhost_server.server_mutex);
512
513                         return 0;
514                 }
515         }
516         pthread_mutex_unlock(&g_vhost_server.server_mutex);
517
518         return -1;
519 }
520
521 int
522 rte_vhost_driver_session_start(void)
523 {
524         fdset_event_dispatch(&g_vhost_server.fdset);
525         return 0;
526 }