]> git.proxmox.com Git - qemu.git/blob - hw/virtio-blk.c
virtio-blk: fix use-after-free while handling scsi commands
[qemu.git] / hw / virtio-blk.c
1 /*
2 * Virtio Block Device
3 *
4 * Copyright IBM, Corp. 2007
5 *
6 * Authors:
7 * Anthony Liguori <aliguori@us.ibm.com>
8 *
9 * This work is licensed under the terms of the GNU GPL, version 2. See
10 * the COPYING file in the top-level directory.
11 *
12 */
13
14 #include "qemu-common.h"
15 #include "qemu-error.h"
16 #include "trace.h"
17 #include "hw/block-common.h"
18 #include "blockdev.h"
19 #include "virtio-blk.h"
20 #include "scsi-defs.h"
21 #ifdef __linux__
22 # include <scsi/sg.h>
23 #endif
24
25 typedef struct VirtIOBlock
26 {
27 VirtIODevice vdev;
28 BlockDriverState *bs;
29 VirtQueue *vq;
30 void *rq;
31 QEMUBH *bh;
32 BlockConf *conf;
33 VirtIOBlkConf *blk;
34 unsigned short sector_mask;
35 DeviceState *qdev;
36 } VirtIOBlock;
37
38 static VirtIOBlock *to_virtio_blk(VirtIODevice *vdev)
39 {
40 return (VirtIOBlock *)vdev;
41 }
42
43 typedef struct VirtIOBlockReq
44 {
45 VirtIOBlock *dev;
46 VirtQueueElement elem;
47 struct virtio_blk_inhdr *in;
48 struct virtio_blk_outhdr *out;
49 struct virtio_scsi_inhdr *scsi;
50 QEMUIOVector qiov;
51 struct VirtIOBlockReq *next;
52 BlockAcctCookie acct;
53 } VirtIOBlockReq;
54
55 static void virtio_blk_req_complete(VirtIOBlockReq *req, int status)
56 {
57 VirtIOBlock *s = req->dev;
58
59 trace_virtio_blk_req_complete(req, status);
60
61 stb_p(&req->in->status, status);
62 virtqueue_push(s->vq, &req->elem, req->qiov.size + sizeof(*req->in));
63 virtio_notify(&s->vdev, s->vq);
64 }
65
66 static int virtio_blk_handle_rw_error(VirtIOBlockReq *req, int error,
67 int is_read)
68 {
69 BlockErrorAction action = bdrv_get_on_error(req->dev->bs, is_read);
70 VirtIOBlock *s = req->dev;
71
72 if (action == BLOCK_ERR_IGNORE) {
73 bdrv_emit_qmp_error_event(s->bs, BDRV_ACTION_IGNORE, is_read);
74 return 0;
75 }
76
77 if ((error == ENOSPC && action == BLOCK_ERR_STOP_ENOSPC)
78 || action == BLOCK_ERR_STOP_ANY) {
79 req->next = s->rq;
80 s->rq = req;
81 bdrv_emit_qmp_error_event(s->bs, BDRV_ACTION_STOP, is_read);
82 vm_stop(RUN_STATE_IO_ERROR);
83 bdrv_iostatus_set_err(s->bs, error);
84 } else {
85 virtio_blk_req_complete(req, VIRTIO_BLK_S_IOERR);
86 bdrv_acct_done(s->bs, &req->acct);
87 g_free(req);
88 bdrv_emit_qmp_error_event(s->bs, BDRV_ACTION_REPORT, is_read);
89 }
90
91 return 1;
92 }
93
94 static void virtio_blk_rw_complete(void *opaque, int ret)
95 {
96 VirtIOBlockReq *req = opaque;
97
98 trace_virtio_blk_rw_complete(req, ret);
99
100 if (ret) {
101 int is_read = !(ldl_p(&req->out->type) & VIRTIO_BLK_T_OUT);
102 if (virtio_blk_handle_rw_error(req, -ret, is_read))
103 return;
104 }
105
106 virtio_blk_req_complete(req, VIRTIO_BLK_S_OK);
107 bdrv_acct_done(req->dev->bs, &req->acct);
108 g_free(req);
109 }
110
111 static void virtio_blk_flush_complete(void *opaque, int ret)
112 {
113 VirtIOBlockReq *req = opaque;
114
115 if (ret) {
116 if (virtio_blk_handle_rw_error(req, -ret, 0)) {
117 return;
118 }
119 }
120
121 virtio_blk_req_complete(req, VIRTIO_BLK_S_OK);
122 bdrv_acct_done(req->dev->bs, &req->acct);
123 g_free(req);
124 }
125
126 static VirtIOBlockReq *virtio_blk_alloc_request(VirtIOBlock *s)
127 {
128 VirtIOBlockReq *req = g_malloc(sizeof(*req));
129 req->dev = s;
130 req->qiov.size = 0;
131 req->next = NULL;
132 return req;
133 }
134
135 static VirtIOBlockReq *virtio_blk_get_request(VirtIOBlock *s)
136 {
137 VirtIOBlockReq *req = virtio_blk_alloc_request(s);
138
139 if (req != NULL) {
140 if (!virtqueue_pop(s->vq, &req->elem)) {
141 g_free(req);
142 return NULL;
143 }
144 }
145
146 return req;
147 }
148
149 static void virtio_blk_handle_scsi(VirtIOBlockReq *req)
150 {
151 #ifdef __linux__
152 int ret;
153 int i;
154 #endif
155 int status = VIRTIO_BLK_S_OK;
156
157 /*
158 * We require at least one output segment each for the virtio_blk_outhdr
159 * and the SCSI command block.
160 *
161 * We also at least require the virtio_blk_inhdr, the virtio_scsi_inhdr
162 * and the sense buffer pointer in the input segments.
163 */
164 if (req->elem.out_num < 2 || req->elem.in_num < 3) {
165 virtio_blk_req_complete(req, VIRTIO_BLK_S_IOERR);
166 g_free(req);
167 return;
168 }
169
170 /*
171 * The scsi inhdr is placed in the second-to-last input segment, just
172 * before the regular inhdr.
173 */
174 req->scsi = (void *)req->elem.in_sg[req->elem.in_num - 2].iov_base;
175
176 if (!req->dev->blk->scsi) {
177 status = VIRTIO_BLK_S_UNSUPP;
178 goto fail;
179 }
180
181 /*
182 * No support for bidirection commands yet.
183 */
184 if (req->elem.out_num > 2 && req->elem.in_num > 3) {
185 status = VIRTIO_BLK_S_UNSUPP;
186 goto fail;
187 }
188
189 #ifdef __linux__
190 struct sg_io_hdr hdr;
191 memset(&hdr, 0, sizeof(struct sg_io_hdr));
192 hdr.interface_id = 'S';
193 hdr.cmd_len = req->elem.out_sg[1].iov_len;
194 hdr.cmdp = req->elem.out_sg[1].iov_base;
195 hdr.dxfer_len = 0;
196
197 if (req->elem.out_num > 2) {
198 /*
199 * If there are more than the minimally required 2 output segments
200 * there is write payload starting from the third iovec.
201 */
202 hdr.dxfer_direction = SG_DXFER_TO_DEV;
203 hdr.iovec_count = req->elem.out_num - 2;
204
205 for (i = 0; i < hdr.iovec_count; i++)
206 hdr.dxfer_len += req->elem.out_sg[i + 2].iov_len;
207
208 hdr.dxferp = req->elem.out_sg + 2;
209
210 } else if (req->elem.in_num > 3) {
211 /*
212 * If we have more than 3 input segments the guest wants to actually
213 * read data.
214 */
215 hdr.dxfer_direction = SG_DXFER_FROM_DEV;
216 hdr.iovec_count = req->elem.in_num - 3;
217 for (i = 0; i < hdr.iovec_count; i++)
218 hdr.dxfer_len += req->elem.in_sg[i].iov_len;
219
220 hdr.dxferp = req->elem.in_sg;
221 } else {
222 /*
223 * Some SCSI commands don't actually transfer any data.
224 */
225 hdr.dxfer_direction = SG_DXFER_NONE;
226 }
227
228 hdr.sbp = req->elem.in_sg[req->elem.in_num - 3].iov_base;
229 hdr.mx_sb_len = req->elem.in_sg[req->elem.in_num - 3].iov_len;
230
231 ret = bdrv_ioctl(req->dev->bs, SG_IO, &hdr);
232 if (ret) {
233 status = VIRTIO_BLK_S_UNSUPP;
234 goto fail;
235 }
236
237 /*
238 * From SCSI-Generic-HOWTO: "Some lower level drivers (e.g. ide-scsi)
239 * clear the masked_status field [hence status gets cleared too, see
240 * block/scsi_ioctl.c] even when a CHECK_CONDITION or COMMAND_TERMINATED
241 * status has occurred. However they do set DRIVER_SENSE in driver_status
242 * field. Also a (sb_len_wr > 0) indicates there is a sense buffer.
243 */
244 if (hdr.status == 0 && hdr.sb_len_wr > 0) {
245 hdr.status = CHECK_CONDITION;
246 }
247
248 stl_p(&req->scsi->errors,
249 hdr.status | (hdr.msg_status << 8) |
250 (hdr.host_status << 16) | (hdr.driver_status << 24));
251 stl_p(&req->scsi->residual, hdr.resid);
252 stl_p(&req->scsi->sense_len, hdr.sb_len_wr);
253 stl_p(&req->scsi->data_len, hdr.dxfer_len);
254
255 virtio_blk_req_complete(req, status);
256 g_free(req);
257 return;
258 #else
259 abort();
260 #endif
261
262 fail:
263 /* Just put anything nonzero so that the ioctl fails in the guest. */
264 stl_p(&req->scsi->errors, 255);
265 virtio_blk_req_complete(req, status);
266 g_free(req);
267 }
268
269 typedef struct MultiReqBuffer {
270 BlockRequest blkreq[32];
271 unsigned int num_writes;
272 } MultiReqBuffer;
273
274 static void virtio_submit_multiwrite(BlockDriverState *bs, MultiReqBuffer *mrb)
275 {
276 int i, ret;
277
278 if (!mrb->num_writes) {
279 return;
280 }
281
282 ret = bdrv_aio_multiwrite(bs, mrb->blkreq, mrb->num_writes);
283 if (ret != 0) {
284 for (i = 0; i < mrb->num_writes; i++) {
285 if (mrb->blkreq[i].error) {
286 virtio_blk_rw_complete(mrb->blkreq[i].opaque, -EIO);
287 }
288 }
289 }
290
291 mrb->num_writes = 0;
292 }
293
294 static void virtio_blk_handle_flush(VirtIOBlockReq *req, MultiReqBuffer *mrb)
295 {
296 bdrv_acct_start(req->dev->bs, &req->acct, 0, BDRV_ACCT_FLUSH);
297
298 /*
299 * Make sure all outstanding writes are posted to the backing device.
300 */
301 virtio_submit_multiwrite(req->dev->bs, mrb);
302 bdrv_aio_flush(req->dev->bs, virtio_blk_flush_complete, req);
303 }
304
305 static void virtio_blk_handle_write(VirtIOBlockReq *req, MultiReqBuffer *mrb)
306 {
307 BlockRequest *blkreq;
308 uint64_t sector;
309
310 sector = ldq_p(&req->out->sector);
311
312 bdrv_acct_start(req->dev->bs, &req->acct, req->qiov.size, BDRV_ACCT_WRITE);
313
314 trace_virtio_blk_handle_write(req, sector, req->qiov.size / 512);
315
316 if (sector & req->dev->sector_mask) {
317 virtio_blk_rw_complete(req, -EIO);
318 return;
319 }
320 if (req->qiov.size % req->dev->conf->logical_block_size) {
321 virtio_blk_rw_complete(req, -EIO);
322 return;
323 }
324
325 if (mrb->num_writes == 32) {
326 virtio_submit_multiwrite(req->dev->bs, mrb);
327 }
328
329 blkreq = &mrb->blkreq[mrb->num_writes];
330 blkreq->sector = sector;
331 blkreq->nb_sectors = req->qiov.size / BDRV_SECTOR_SIZE;
332 blkreq->qiov = &req->qiov;
333 blkreq->cb = virtio_blk_rw_complete;
334 blkreq->opaque = req;
335 blkreq->error = 0;
336
337 mrb->num_writes++;
338 }
339
340 static void virtio_blk_handle_read(VirtIOBlockReq *req)
341 {
342 uint64_t sector;
343
344 sector = ldq_p(&req->out->sector);
345
346 bdrv_acct_start(req->dev->bs, &req->acct, req->qiov.size, BDRV_ACCT_READ);
347
348 trace_virtio_blk_handle_read(req, sector, req->qiov.size / 512);
349
350 if (sector & req->dev->sector_mask) {
351 virtio_blk_rw_complete(req, -EIO);
352 return;
353 }
354 if (req->qiov.size % req->dev->conf->logical_block_size) {
355 virtio_blk_rw_complete(req, -EIO);
356 return;
357 }
358 bdrv_aio_readv(req->dev->bs, sector, &req->qiov,
359 req->qiov.size / BDRV_SECTOR_SIZE,
360 virtio_blk_rw_complete, req);
361 }
362
363 static void virtio_blk_handle_request(VirtIOBlockReq *req,
364 MultiReqBuffer *mrb)
365 {
366 uint32_t type;
367
368 if (req->elem.out_num < 1 || req->elem.in_num < 1) {
369 error_report("virtio-blk missing headers");
370 exit(1);
371 }
372
373 if (req->elem.out_sg[0].iov_len < sizeof(*req->out) ||
374 req->elem.in_sg[req->elem.in_num - 1].iov_len < sizeof(*req->in)) {
375 error_report("virtio-blk header not in correct element");
376 exit(1);
377 }
378
379 req->out = (void *)req->elem.out_sg[0].iov_base;
380 req->in = (void *)req->elem.in_sg[req->elem.in_num - 1].iov_base;
381
382 type = ldl_p(&req->out->type);
383
384 if (type & VIRTIO_BLK_T_FLUSH) {
385 virtio_blk_handle_flush(req, mrb);
386 } else if (type & VIRTIO_BLK_T_SCSI_CMD) {
387 virtio_blk_handle_scsi(req);
388 } else if (type & VIRTIO_BLK_T_GET_ID) {
389 VirtIOBlock *s = req->dev;
390
391 /*
392 * NB: per existing s/n string convention the string is
393 * terminated by '\0' only when shorter than buffer.
394 */
395 strncpy(req->elem.in_sg[0].iov_base,
396 s->blk->serial ? s->blk->serial : "",
397 MIN(req->elem.in_sg[0].iov_len, VIRTIO_BLK_ID_BYTES));
398 virtio_blk_req_complete(req, VIRTIO_BLK_S_OK);
399 g_free(req);
400 } else if (type & VIRTIO_BLK_T_OUT) {
401 qemu_iovec_init_external(&req->qiov, &req->elem.out_sg[1],
402 req->elem.out_num - 1);
403 virtio_blk_handle_write(req, mrb);
404 } else {
405 qemu_iovec_init_external(&req->qiov, &req->elem.in_sg[0],
406 req->elem.in_num - 1);
407 virtio_blk_handle_read(req);
408 }
409 }
410
411 static void virtio_blk_handle_output(VirtIODevice *vdev, VirtQueue *vq)
412 {
413 VirtIOBlock *s = to_virtio_blk(vdev);
414 VirtIOBlockReq *req;
415 MultiReqBuffer mrb = {
416 .num_writes = 0,
417 };
418
419 while ((req = virtio_blk_get_request(s))) {
420 virtio_blk_handle_request(req, &mrb);
421 }
422
423 virtio_submit_multiwrite(s->bs, &mrb);
424
425 /*
426 * FIXME: Want to check for completions before returning to guest mode,
427 * so cached reads and writes are reported as quickly as possible. But
428 * that should be done in the generic block layer.
429 */
430 }
431
432 static void virtio_blk_dma_restart_bh(void *opaque)
433 {
434 VirtIOBlock *s = opaque;
435 VirtIOBlockReq *req = s->rq;
436 MultiReqBuffer mrb = {
437 .num_writes = 0,
438 };
439
440 qemu_bh_delete(s->bh);
441 s->bh = NULL;
442
443 s->rq = NULL;
444
445 while (req) {
446 virtio_blk_handle_request(req, &mrb);
447 req = req->next;
448 }
449
450 virtio_submit_multiwrite(s->bs, &mrb);
451 }
452
453 static void virtio_blk_dma_restart_cb(void *opaque, int running,
454 RunState state)
455 {
456 VirtIOBlock *s = opaque;
457
458 if (!running)
459 return;
460
461 if (!s->bh) {
462 s->bh = qemu_bh_new(virtio_blk_dma_restart_bh, s);
463 qemu_bh_schedule(s->bh);
464 }
465 }
466
467 static void virtio_blk_reset(VirtIODevice *vdev)
468 {
469 /*
470 * This should cancel pending requests, but can't do nicely until there
471 * are per-device request lists.
472 */
473 bdrv_drain_all();
474 }
475
476 /* coalesce internal state, copy to pci i/o region 0
477 */
478 static void virtio_blk_update_config(VirtIODevice *vdev, uint8_t *config)
479 {
480 VirtIOBlock *s = to_virtio_blk(vdev);
481 struct virtio_blk_config blkcfg;
482 uint64_t capacity;
483 int blk_size = s->conf->logical_block_size;
484
485 bdrv_get_geometry(s->bs, &capacity);
486 memset(&blkcfg, 0, sizeof(blkcfg));
487 stq_raw(&blkcfg.capacity, capacity);
488 stl_raw(&blkcfg.seg_max, 128 - 2);
489 stw_raw(&blkcfg.cylinders, s->conf->cyls);
490 stl_raw(&blkcfg.blk_size, blk_size);
491 stw_raw(&blkcfg.min_io_size, s->conf->min_io_size / blk_size);
492 stw_raw(&blkcfg.opt_io_size, s->conf->opt_io_size / blk_size);
493 blkcfg.heads = s->conf->heads;
494 /*
495 * We must ensure that the block device capacity is a multiple of
496 * the logical block size. If that is not the case, lets use
497 * sector_mask to adopt the geometry to have a correct picture.
498 * For those devices where the capacity is ok for the given geometry
499 * we dont touch the sector value of the geometry, since some devices
500 * (like s390 dasd) need a specific value. Here the capacity is already
501 * cyls*heads*secs*blk_size and the sector value is not block size
502 * divided by 512 - instead it is the amount of blk_size blocks
503 * per track (cylinder).
504 */
505 if (bdrv_getlength(s->bs) / s->conf->heads / s->conf->secs % blk_size) {
506 blkcfg.sectors = s->conf->secs & ~s->sector_mask;
507 } else {
508 blkcfg.sectors = s->conf->secs;
509 }
510 blkcfg.size_max = 0;
511 blkcfg.physical_block_exp = get_physical_block_exp(s->conf);
512 blkcfg.alignment_offset = 0;
513 memcpy(config, &blkcfg, sizeof(struct virtio_blk_config));
514 }
515
516 static uint32_t virtio_blk_get_features(VirtIODevice *vdev, uint32_t features)
517 {
518 VirtIOBlock *s = to_virtio_blk(vdev);
519
520 features |= (1 << VIRTIO_BLK_F_SEG_MAX);
521 features |= (1 << VIRTIO_BLK_F_GEOMETRY);
522 features |= (1 << VIRTIO_BLK_F_TOPOLOGY);
523 features |= (1 << VIRTIO_BLK_F_BLK_SIZE);
524 features |= (1 << VIRTIO_BLK_F_SCSI);
525
526 if (bdrv_enable_write_cache(s->bs))
527 features |= (1 << VIRTIO_BLK_F_WCACHE);
528
529 if (bdrv_is_read_only(s->bs))
530 features |= 1 << VIRTIO_BLK_F_RO;
531
532 return features;
533 }
534
535 static void virtio_blk_save(QEMUFile *f, void *opaque)
536 {
537 VirtIOBlock *s = opaque;
538 VirtIOBlockReq *req = s->rq;
539
540 virtio_save(&s->vdev, f);
541
542 while (req) {
543 qemu_put_sbyte(f, 1);
544 qemu_put_buffer(f, (unsigned char*)&req->elem, sizeof(req->elem));
545 req = req->next;
546 }
547 qemu_put_sbyte(f, 0);
548 }
549
550 static int virtio_blk_load(QEMUFile *f, void *opaque, int version_id)
551 {
552 VirtIOBlock *s = opaque;
553 int ret;
554
555 if (version_id != 2)
556 return -EINVAL;
557
558 ret = virtio_load(&s->vdev, f);
559 if (ret) {
560 return ret;
561 }
562
563 while (qemu_get_sbyte(f)) {
564 VirtIOBlockReq *req = virtio_blk_alloc_request(s);
565 qemu_get_buffer(f, (unsigned char*)&req->elem, sizeof(req->elem));
566 req->next = s->rq;
567 s->rq = req;
568
569 virtqueue_map_sg(req->elem.in_sg, req->elem.in_addr,
570 req->elem.in_num, 1);
571 virtqueue_map_sg(req->elem.out_sg, req->elem.out_addr,
572 req->elem.out_num, 0);
573 }
574
575 return 0;
576 }
577
578 static void virtio_blk_resize(void *opaque)
579 {
580 VirtIOBlock *s = opaque;
581
582 virtio_notify_config(&s->vdev);
583 }
584
585 static const BlockDevOps virtio_block_ops = {
586 .resize_cb = virtio_blk_resize,
587 };
588
589 VirtIODevice *virtio_blk_init(DeviceState *dev, VirtIOBlkConf *blk)
590 {
591 VirtIOBlock *s;
592 static int virtio_blk_id;
593
594 if (!blk->conf.bs) {
595 error_report("drive property not set");
596 return NULL;
597 }
598 if (!bdrv_is_inserted(blk->conf.bs)) {
599 error_report("Device needs media, but drive is empty");
600 return NULL;
601 }
602
603 blkconf_serial(&blk->conf, &blk->serial);
604 if (blkconf_geometry(&blk->conf, NULL, 65535, 255, 255) < 0) {
605 return NULL;
606 }
607
608 s = (VirtIOBlock *)virtio_common_init("virtio-blk", VIRTIO_ID_BLOCK,
609 sizeof(struct virtio_blk_config),
610 sizeof(VirtIOBlock));
611
612 s->vdev.get_config = virtio_blk_update_config;
613 s->vdev.get_features = virtio_blk_get_features;
614 s->vdev.reset = virtio_blk_reset;
615 s->bs = blk->conf.bs;
616 s->conf = &blk->conf;
617 s->blk = blk;
618 s->rq = NULL;
619 s->sector_mask = (s->conf->logical_block_size / BDRV_SECTOR_SIZE) - 1;
620
621 s->vq = virtio_add_queue(&s->vdev, 128, virtio_blk_handle_output);
622
623 qemu_add_vm_change_state_handler(virtio_blk_dma_restart_cb, s);
624 s->qdev = dev;
625 register_savevm(dev, "virtio-blk", virtio_blk_id++, 2,
626 virtio_blk_save, virtio_blk_load, s);
627 bdrv_set_dev_ops(s->bs, &virtio_block_ops, s);
628 bdrv_set_buffer_alignment(s->bs, s->conf->logical_block_size);
629
630 bdrv_iostatus_enable(s->bs);
631 add_boot_device_path(s->conf->bootindex, dev, "/disk@0,0");
632
633 return &s->vdev;
634 }
635
636 void virtio_blk_exit(VirtIODevice *vdev)
637 {
638 VirtIOBlock *s = to_virtio_blk(vdev);
639 unregister_savevm(s->qdev, "virtio-blk", s);
640 blockdev_mark_auto_del(s->bs);
641 virtio_cleanup(vdev);
642 }