tools/virtio/vringh_test.c

   1 /* Simple test of virtio code, entirely in userpsace. */
   2 #define _GNU_SOURCE
   3 #include <sched.h>
   4 #include <err.h>
   5 #include <linux/kernel.h>
   6 #include <linux/err.h>
   7 #include <linux/virtio.h>
   8 #include <linux/vringh.h>
   9 #include <linux/virtio_ring.h>
  10 #include <linux/virtio_config.h>
  11 #include <linux/uaccess.h>
  12 #include <sys/types.h>
  13 #include <sys/stat.h>
  14 #include <sys/mman.h>
  15 #include <sys/wait.h>
  16 #include <fcntl.h>
  17
  18 #define USER_MEM (1024*1024)
  19 void *__user_addr_min, *__user_addr_max;
  20 void *__kmalloc_fake, *__kfree_ignore_start, *__kfree_ignore_end;
  21 static u64 user_addr_offset;
  22
  23 #define RINGSIZE 256
  24 #define ALIGN 4096
  25
  26 static bool never_notify_host(struct virtqueue *vq)
  27 {
  28         abort();
  29 }
  30
  31 static void never_callback_guest(struct virtqueue *vq)
  32 {
  33         abort();
  34 }
  35
  36 static bool getrange_iov(struct vringh *vrh, u64 addr, struct vringh_range *r)
  37 {
  38         if (addr < (u64)(unsigned long)__user_addr_min - user_addr_offset)
  39                 return false;
  40         if (addr >= (u64)(unsigned long)__user_addr_max - user_addr_offset)
  41                 return false;
  42
  43         r->start = (u64)(unsigned long)__user_addr_min - user_addr_offset;
  44         r->end_incl = (u64)(unsigned long)__user_addr_max - 1 - user_addr_offset;
  45         r->offset = user_addr_offset;
  46         return true;
  47 }
  48
  49 /* We return single byte ranges. */
  50 static bool getrange_slow(struct vringh *vrh, u64 addr, struct vringh_range *r)
  51 {
  52         if (addr < (u64)(unsigned long)__user_addr_min - user_addr_offset)
  53                 return false;
  54         if (addr >= (u64)(unsigned long)__user_addr_max - user_addr_offset)
  55                 return false;
  56
  57         r->start = addr;
  58         r->end_incl = r->start;
  59         r->offset = user_addr_offset;
  60         return true;
  61 }
  62
  63 struct guest_virtio_device {
  64         struct virtio_device vdev;
  65         int to_host_fd;
  66         unsigned long notifies;
  67 };
  68
  69 static bool parallel_notify_host(struct virtqueue *vq)
  70 {
  71         int rc;
  72         struct guest_virtio_device *gvdev;
  73
  74         gvdev = container_of(vq->vdev, struct guest_virtio_device, vdev);
  75         rc = write(gvdev->to_host_fd, "", 1);
  76         if (rc < 0)
  77                 return false;
  78         gvdev->notifies++;
  79         return true;
  80 }
  81
  82 static bool no_notify_host(struct virtqueue *vq)
  83 {
  84         return true;
  85 }
  86
  87 #define NUM_XFERS (10000000)
  88
  89 /* We aim for two "distant" cpus. */
  90 static void find_cpus(unsigned int *first, unsigned int *last)
  91 {
  92         unsigned int i;
  93
  94         *first = -1U;
  95         *last = 0;
  96         for (i = 0; i < 4096; i++) {
  97                 cpu_set_t set;
  98                 CPU_ZERO(&set);
  99                 CPU_SET(i, &set);
 100                 if (sched_setaffinity(getpid(), sizeof(set), &set) == 0) {
 101                         if (i < *first)
 102                                 *first = i;
 103                         if (i > *last)
 104                                 *last = i;
 105                 }
 106         }
 107 }
 108
 109 /* Opencoded version for fast mode */
 110 static inline int vringh_get_head(struct vringh *vrh, u16 *head)
 111 {
 112         u16 avail_idx, i;
 113         int err;
 114
 115         err = get_user(avail_idx, &vrh->vring.avail->idx);
 116         if (err)
 117                 return err;
 118
 119         if (vrh->last_avail_idx == avail_idx)
 120                 return 0;
 121
 122         /* Only get avail ring entries after they have been exposed by guest. */
 123         virtio_rmb(vrh->weak_barriers);
 124
 125         i = vrh->last_avail_idx & (vrh->vring.num - 1);
 126
 127         err = get_user(*head, &vrh->vring.avail->ring[i]);
 128         if (err)
 129                 return err;
 130
 131         vrh->last_avail_idx++;
 132         return 1;
 133 }
 134
 135 static int parallel_test(u64 features,
 136                          bool (*getrange)(struct vringh *vrh,
 137                                           u64 addr, struct vringh_range *r),
 138                          bool fast_vringh)
 139 {
 140         void *host_map, *guest_map;
 141         int fd, mapsize, to_guest[2], to_host[2];
 142         unsigned long xfers = 0, notifies = 0, receives = 0;
 143         unsigned int first_cpu, last_cpu;
 144         cpu_set_t cpu_set;
 145         char buf[128];
 146
 147         /* Create real file to mmap. */
 148         fd = open("/tmp/vringh_test-file", O_RDWR|O_CREAT|O_TRUNC, 0600);
 149         if (fd < 0)
 150                 err(1, "Opening /tmp/vringh_test-file");
 151
 152         /* Extra room at the end for some data, and indirects */
 153         mapsize = vring_size(RINGSIZE, ALIGN)
 154                 + RINGSIZE * 2 * sizeof(int)
 155                 + RINGSIZE * 6 * sizeof(struct vring_desc);
 156         mapsize = (mapsize + getpagesize() - 1) & ~(getpagesize() - 1);
 157         ftruncate(fd, mapsize);
 158
 159         /* Parent and child use separate addresses, to check our mapping logic! */
 160         host_map = mmap(NULL, mapsize, PROT_READ|PROT_WRITE, MAP_SHARED, fd, 0);
 161         guest_map = mmap(NULL, mapsize, PROT_READ|PROT_WRITE, MAP_SHARED, fd, 0);
 162
 163         pipe(to_guest);
 164         pipe(to_host);
 165
 166         CPU_ZERO(&cpu_set);
 167         find_cpus(&first_cpu, &last_cpu);
 168         printf("Using CPUS %u and %u\n", first_cpu, last_cpu);
 169         fflush(stdout);
 170
 171         if (fork() != 0) {
 172                 struct vringh vrh;
 173                 int status, err, rlen = 0;
 174                 char rbuf[5];
 175
 176                 /* We are the host: never access guest addresses! */
 177                 munmap(guest_map, mapsize);
 178
 179                 __user_addr_min = host_map;
 180                 __user_addr_max = __user_addr_min + mapsize;
 181                 user_addr_offset = host_map - guest_map;
 182                 assert(user_addr_offset);
 183
 184                 close(to_guest[0]);
 185                 close(to_host[1]);
 186
 187                 vring_init(&vrh.vring, RINGSIZE, host_map, ALIGN);
 188                 vringh_init_user(&vrh, features, RINGSIZE, true,
 189                                  vrh.vring.desc, vrh.vring.avail, vrh.vring.used);
 190                 CPU_SET(first_cpu, &cpu_set);
 191                 if (sched_setaffinity(getpid(), sizeof(cpu_set), &cpu_set))
 192                         errx(1, "Could not set affinity to cpu %u", first_cpu);
 193
 194                 while (xfers < NUM_XFERS) {
 195                         struct iovec host_riov[2], host_wiov[2];
 196                         struct vringh_iov riov, wiov;
 197                         u16 head, written;
 198
 199                         if (fast_vringh) {
 200                                 for (;;) {
 201                                         err = vringh_get_head(&vrh, &head);
 202                                         if (err != 0)
 203                                                 break;
 204                                         err = vringh_need_notify_user(&vrh);
 205                                         if (err < 0)
 206                                                 errx(1, "vringh_need_notify_user: %i",
 207                                                      err);
 208                                         if (err) {
 209                                                 write(to_guest[1], "", 1);
 210                                                 notifies++;
 211                                         }
 212                                 }
 213                                 if (err != 1)
 214                                         errx(1, "vringh_get_head");
 215                                 written = 0;
 216                                 goto complete;
 217                         } else {
 218                                 vringh_iov_init(&riov,
 219                                                 host_riov,
 220                                                 ARRAY_SIZE(host_riov));
 221                                 vringh_iov_init(&wiov,
 222                                                 host_wiov,
 223                                                 ARRAY_SIZE(host_wiov));
 224
 225                                 err = vringh_getdesc_user(&vrh, &riov, &wiov,
 226                                                           getrange, &head);
 227                         }
 228                         if (err == 0) {
 229                                 err = vringh_need_notify_user(&vrh);
 230                                 if (err < 0)
 231                                         errx(1, "vringh_need_notify_user: %i",
 232                                              err);
 233                                 if (err) {
 234                                         write(to_guest[1], "", 1);
 235                                         notifies++;
 236                                 }
 237
 238                                 if (!vringh_notify_enable_user(&vrh))
 239                                         continue;
 240
 241                                 /* Swallow all notifies at once. */
 242                                 if (read(to_host[0], buf, sizeof(buf)) < 1)
 243                                         break;
 244
 245                                 vringh_notify_disable_user(&vrh);
 246                                 receives++;
 247                                 continue;
 248                         }
 249                         if (err != 1)
 250                                 errx(1, "vringh_getdesc_user: %i", err);
 251
 252                         /* We simply copy bytes. */
 253                         if (riov.used) {
 254                                 rlen = vringh_iov_pull_user(&riov, rbuf,
 255                                                             sizeof(rbuf));
 256                                 if (rlen != 4)
 257                                         errx(1, "vringh_iov_pull_user: %i",
 258                                              rlen);
 259                                 assert(riov.i == riov.used);
 260                                 written = 0;
 261                         } else {
 262                                 err = vringh_iov_push_user(&wiov, rbuf, rlen);
 263                                 if (err != rlen)
 264                                         errx(1, "vringh_iov_push_user: %i",
 265                                              err);
 266                                 assert(wiov.i == wiov.used);
 267                                 written = err;
 268                         }
 269                 complete:
 270                         xfers++;
 271
 272                         err = vringh_complete_user(&vrh, head, written);
 273                         if (err != 0)
 274                                 errx(1, "vringh_complete_user: %i", err);
 275                 }
 276
 277                 err = vringh_need_notify_user(&vrh);
 278                 if (err < 0)
 279                         errx(1, "vringh_need_notify_user: %i", err);
 280                 if (err) {
 281                         write(to_guest[1], "", 1);
 282                         notifies++;
 283                 }
 284                 wait(&status);
 285                 if (!WIFEXITED(status))
 286                         errx(1, "Child died with signal %i?", WTERMSIG(status));
 287                 if (WEXITSTATUS(status) != 0)
 288                         errx(1, "Child exited %i?", WEXITSTATUS(status));
 289                 printf("Host: notified %lu, pinged %lu\n", notifies, receives);
 290                 return 0;
 291         } else {
 292                 struct guest_virtio_device gvdev;
 293                 struct virtqueue *vq;
 294                 unsigned int *data;
 295                 struct vring_desc *indirects;
 296                 unsigned int finished = 0;
 297
 298                 /* We pass sg[]s pointing into here, but we need RINGSIZE+1 */
 299                 data = guest_map + vring_size(RINGSIZE, ALIGN);
 300                 indirects = (void *)data + (RINGSIZE + 1) * 2 * sizeof(int);
 301
 302                 /* We are the guest. */
 303                 munmap(host_map, mapsize);
 304
 305                 close(to_guest[1]);
 306                 close(to_host[0]);
 307
 308                 gvdev.vdev.features = features;
 309                 gvdev.to_host_fd = to_host[1];
 310                 gvdev.notifies = 0;
 311
 312                 CPU_SET(first_cpu, &cpu_set);
 313                 if (sched_setaffinity(getpid(), sizeof(cpu_set), &cpu_set))
 314                         err(1, "Could not set affinity to cpu %u", first_cpu);
 315
 316                 vq = vring_new_virtqueue(0, RINGSIZE, ALIGN, &gvdev.vdev, true,
 317                                          guest_map, fast_vringh ? no_notify_host
 318                                          : parallel_notify_host,
 319                                          never_callback_guest, "guest vq");
 320
 321                 /* Don't kfree indirects. */
 322                 __kfree_ignore_start = indirects;
 323                 __kfree_ignore_end = indirects + RINGSIZE * 6;
 324
 325                 while (xfers < NUM_XFERS) {
 326                         struct scatterlist sg[4];
 327                         unsigned int num_sg, len;
 328                         int *dbuf, err;
 329                         bool output = !(xfers % 2);
 330
 331                         /* Consume bufs. */
 332                         while ((dbuf = virtqueue_get_buf(vq, &len)) != NULL) {
 333                                 if (len == 4)
 334                                         assert(*dbuf == finished - 1);
 335                                 else if (!fast_vringh)
 336                                         assert(*dbuf == finished);
 337                                 finished++;
 338                         }
 339
 340                         /* Produce a buffer. */
 341                         dbuf = data + (xfers % (RINGSIZE + 1));
 342
 343                         if (output)
 344                                 *dbuf = xfers;
 345                         else
 346                                 *dbuf = -1;
 347
 348                         switch ((xfers / sizeof(*dbuf)) % 4) {
 349                         case 0:
 350                                 /* Nasty three-element sg list. */
 351                                 sg_init_table(sg, num_sg = 3);
 352                                 sg_set_buf(&sg[0], (void *)dbuf, 1);
 353                                 sg_set_buf(&sg[1], (void *)dbuf + 1, 2);
 354                                 sg_set_buf(&sg[2], (void *)dbuf + 3, 1);
 355                                 break;
 356                         case 1:
 357                                 sg_init_table(sg, num_sg = 2);
 358                                 sg_set_buf(&sg[0], (void *)dbuf, 1);
 359                                 sg_set_buf(&sg[1], (void *)dbuf + 1, 3);
 360                                 break;
 361                         case 2:
 362                                 sg_init_table(sg, num_sg = 1);
 363                                 sg_set_buf(&sg[0], (void *)dbuf, 4);
 364                                 break;
 365                         case 3:
 366                                 sg_init_table(sg, num_sg = 4);
 367                                 sg_set_buf(&sg[0], (void *)dbuf, 1);
 368                                 sg_set_buf(&sg[1], (void *)dbuf + 1, 1);
 369                                 sg_set_buf(&sg[2], (void *)dbuf + 2, 1);
 370                                 sg_set_buf(&sg[3], (void *)dbuf + 3, 1);
 371                                 break;
 372                         }
 373
 374                         /* May allocate an indirect, so force it to allocate
 375                          * user addr */
 376                         __kmalloc_fake = indirects + (xfers % RINGSIZE) * 4;
 377                         if (output)
 378                                 err = virtqueue_add_outbuf(vq, sg, num_sg, dbuf,
 379                                                            GFP_KERNEL);
 380                         else
 381                                 err = virtqueue_add_inbuf(vq, sg, num_sg,
 382                                                           dbuf, GFP_KERNEL);
 383
 384                         if (err == -ENOSPC) {
 385                                 if (!virtqueue_enable_cb_delayed(vq))
 386                                         continue;
 387                                 /* Swallow all notifies at once. */
 388                                 if (read(to_guest[0], buf, sizeof(buf)) < 1)
 389                                         break;
 390
 391                                 receives++;
 392                                 virtqueue_disable_cb(vq);
 393                                 continue;
 394                         }
 395
 396                         if (err)
 397                                 errx(1, "virtqueue_add_in/outbuf: %i", err);
 398
 399                         xfers++;
 400                         virtqueue_kick(vq);
 401                 }
 402
 403                 /* Any extra? */
 404                 while (finished != xfers) {
 405                         int *dbuf;
 406                         unsigned int len;
 407
 408                         /* Consume bufs. */
 409                         dbuf = virtqueue_get_buf(vq, &len);
 410                         if (dbuf) {
 411                                 if (len == 4)
 412                                         assert(*dbuf == finished - 1);
 413                                 else
 414                                         assert(len == 0);
 415                                 finished++;
 416                                 continue;
 417                         }
 418
 419                         if (!virtqueue_enable_cb_delayed(vq))
 420                                 continue;
 421                         if (read(to_guest[0], buf, sizeof(buf)) < 1)
 422                                 break;
 423
 424                         receives++;
 425                         virtqueue_disable_cb(vq);
 426                 }
 427
 428                 printf("Guest: notified %lu, pinged %lu\n",
 429                        gvdev.notifies, receives);
 430                 vring_del_virtqueue(vq);
 431                 return 0;
 432         }
 433 }
 434
 435 int main(int argc, char *argv[])
 436 {
 437         struct virtio_device vdev;
 438         struct virtqueue *vq;
 439         struct vringh vrh;
 440         struct scatterlist guest_sg[RINGSIZE], *sgs[2];
 441         struct iovec host_riov[2], host_wiov[2];
 442         struct vringh_iov riov, wiov;
 443         struct vring_used_elem used[RINGSIZE];
 444         char buf[28];
 445         u16 head;
 446         int err;
 447         unsigned i;
 448         void *ret;
 449         bool (*getrange)(struct vringh *vrh, u64 addr, struct vringh_range *r);
 450         bool fast_vringh = false, parallel = false;
 451
 452         getrange = getrange_iov;
 453         vdev.features = 0;
 454
 455         while (argv[1]) {
 456                 if (strcmp(argv[1], "--indirect") == 0)
 457                         __virtio_set_bit(&vdev, VIRTIO_RING_F_INDIRECT_DESC);
 458                 else if (strcmp(argv[1], "--eventidx") == 0)
 459                         __virtio_set_bit(&vdev, VIRTIO_RING_F_EVENT_IDX);
 460                 else if (strcmp(argv[1], "--slow-range") == 0)
 461                         getrange = getrange_slow;
 462                 else if (strcmp(argv[1], "--fast-vringh") == 0)
 463                         fast_vringh = true;
 464                 else if (strcmp(argv[1], "--parallel") == 0)
 465                         parallel = true;
 466                 else
 467                         errx(1, "Unknown arg %s", argv[1]);
 468                 argv++;
 469         }
 470
 471         if (parallel)
 472                 return parallel_test(vdev.features, getrange, fast_vringh);
 473
 474         if (posix_memalign(&__user_addr_min, PAGE_SIZE, USER_MEM) != 0)
 475                 abort();
 476         __user_addr_max = __user_addr_min + USER_MEM;
 477         memset(__user_addr_min, 0, vring_size(RINGSIZE, ALIGN));
 478
 479         /* Set up guest side. */
 480         vq = vring_new_virtqueue(0, RINGSIZE, ALIGN, &vdev, true,
 481                                  __user_addr_min,
 482                                  never_notify_host, never_callback_guest,
 483                                  "guest vq");
 484
 485         /* Set up host side. */
 486         vring_init(&vrh.vring, RINGSIZE, __user_addr_min, ALIGN);
 487         vringh_init_user(&vrh, vdev.features, RINGSIZE, true,
 488                          vrh.vring.desc, vrh.vring.avail, vrh.vring.used);
 489
 490         /* No descriptor to get yet... */
 491         err = vringh_getdesc_user(&vrh, &riov, &wiov, getrange, &head);
 492         if (err != 0)
 493                 errx(1, "vringh_getdesc_user: %i", err);
 494
 495         /* Guest puts in a descriptor. */
 496         memcpy(__user_addr_max - 1, "a", 1);
 497         sg_init_table(guest_sg, 1);
 498         sg_set_buf(&guest_sg[0], __user_addr_max - 1, 1);
 499         sg_init_table(guest_sg+1, 1);
 500         sg_set_buf(&guest_sg[1], __user_addr_max - 3, 2);
 501         sgs[0] = &guest_sg[0];
 502         sgs[1] = &guest_sg[1];
 503
 504         /* May allocate an indirect, so force it to allocate user addr */
 505         __kmalloc_fake = __user_addr_min + vring_size(RINGSIZE, ALIGN);
 506         err = virtqueue_add_sgs(vq, sgs, 1, 1, &err, GFP_KERNEL);
 507         if (err)
 508                 errx(1, "virtqueue_add_sgs: %i", err);
 509         __kmalloc_fake = NULL;
 510
 511         /* Host retreives it. */
 512         vringh_iov_init(&riov, host_riov, ARRAY_SIZE(host_riov));
 513         vringh_iov_init(&wiov, host_wiov, ARRAY_SIZE(host_wiov));
 514
 515         err = vringh_getdesc_user(&vrh, &riov, &wiov, getrange, &head);
 516         if (err != 1)
 517                 errx(1, "vringh_getdesc_user: %i", err);
 518
 519         assert(riov.used == 1);
 520         assert(riov.iov[0].iov_base == __user_addr_max - 1);
 521         assert(riov.iov[0].iov_len == 1);
 522         if (getrange != getrange_slow) {
 523                 assert(wiov.used == 1);
 524                 assert(wiov.iov[0].iov_base == __user_addr_max - 3);
 525                 assert(wiov.iov[0].iov_len == 2);
 526         } else {
 527                 assert(wiov.used == 2);
 528                 assert(wiov.iov[0].iov_base == __user_addr_max - 3);
 529                 assert(wiov.iov[0].iov_len == 1);
 530                 assert(wiov.iov[1].iov_base == __user_addr_max - 2);
 531                 assert(wiov.iov[1].iov_len == 1);
 532         }
 533
 534         err = vringh_iov_pull_user(&riov, buf, 5);
 535         if (err != 1)
 536                 errx(1, "vringh_iov_pull_user: %i", err);
 537         assert(buf[0] == 'a');
 538         assert(riov.i == 1);
 539         assert(vringh_iov_pull_user(&riov, buf, 5) == 0);
 540
 541         memcpy(buf, "bcdef", 5);
 542         err = vringh_iov_push_user(&wiov, buf, 5);
 543         if (err != 2)
 544                 errx(1, "vringh_iov_push_user: %i", err);
 545         assert(memcmp(__user_addr_max - 3, "bc", 2) == 0);
 546         assert(wiov.i == wiov.used);
 547         assert(vringh_iov_push_user(&wiov, buf, 5) == 0);
 548
 549         /* Host is done. */
 550         err = vringh_complete_user(&vrh, head, err);
 551         if (err != 0)
 552                 errx(1, "vringh_complete_user: %i", err);
 553
 554         /* Guest should see used token now. */
 555         __kfree_ignore_start = __user_addr_min + vring_size(RINGSIZE, ALIGN);
 556         __kfree_ignore_end = __kfree_ignore_start + 1;
 557         ret = virtqueue_get_buf(vq, &i);
 558         if (ret != &err)
 559                 errx(1, "virtqueue_get_buf: %p", ret);
 560         assert(i == 2);
 561
 562         /* Guest puts in a huge descriptor. */
 563         sg_init_table(guest_sg, RINGSIZE);
 564         for (i = 0; i < RINGSIZE; i++) {
 565                 sg_set_buf(&guest_sg[i],
 566                            __user_addr_max - USER_MEM/4, USER_MEM/4);
 567         }
 568
 569         /* Fill contents with recognisable garbage. */
 570         for (i = 0; i < USER_MEM/4; i++)
 571                 ((char *)__user_addr_max - USER_MEM/4)[i] = i;
 572
 573         /* This will allocate an indirect, so force it to allocate user addr */
 574         __kmalloc_fake = __user_addr_min + vring_size(RINGSIZE, ALIGN);
 575         err = virtqueue_add_outbuf(vq, guest_sg, RINGSIZE, &err, GFP_KERNEL);
 576         if (err)
 577                 errx(1, "virtqueue_add_outbuf (large): %i", err);
 578         __kmalloc_fake = NULL;
 579
 580         /* Host picks it up (allocates new iov). */
 581         vringh_iov_init(&riov, host_riov, ARRAY_SIZE(host_riov));
 582         vringh_iov_init(&wiov, host_wiov, ARRAY_SIZE(host_wiov));
 583
 584         err = vringh_getdesc_user(&vrh, &riov, &wiov, getrange, &head);
 585         if (err != 1)
 586                 errx(1, "vringh_getdesc_user: %i", err);
 587
 588         assert(riov.max_num & VRINGH_IOV_ALLOCATED);
 589         assert(riov.iov != host_riov);
 590         if (getrange != getrange_slow)
 591                 assert(riov.used == RINGSIZE);
 592         else
 593                 assert(riov.used == RINGSIZE * USER_MEM/4);
 594
 595         assert(!(wiov.max_num & VRINGH_IOV_ALLOCATED));
 596         assert(wiov.used == 0);
 597
 598         /* Pull data back out (in odd chunks), should be as expected. */
 599         for (i = 0; i < RINGSIZE * USER_MEM/4; i += 3) {
 600                 err = vringh_iov_pull_user(&riov, buf, 3);
 601                 if (err != 3 && i + err != RINGSIZE * USER_MEM/4)
 602                         errx(1, "vringh_iov_pull_user large: %i", err);
 603                 assert(buf[0] == (char)i);
 604                 assert(err < 2 || buf[1] == (char)(i + 1));
 605                 assert(err < 3 || buf[2] == (char)(i + 2));
 606         }
 607         assert(riov.i == riov.used);
 608         vringh_iov_cleanup(&riov);
 609         vringh_iov_cleanup(&wiov);
 610
 611         /* Complete using multi interface, just because we can. */
 612         used[0].id = head;
 613         used[0].len = 0;
 614         err = vringh_complete_multi_user(&vrh, used, 1);
 615         if (err)
 616                 errx(1, "vringh_complete_multi_user(1): %i", err);
 617
 618         /* Free up those descriptors. */
 619         ret = virtqueue_get_buf(vq, &i);
 620         if (ret != &err)
 621                 errx(1, "virtqueue_get_buf: %p", ret);
 622
 623         /* Add lots of descriptors. */
 624         sg_init_table(guest_sg, 1);
 625         sg_set_buf(&guest_sg[0], __user_addr_max - 1, 1);
 626         for (i = 0; i < RINGSIZE; i++) {
 627                 err = virtqueue_add_outbuf(vq, guest_sg, 1, &err, GFP_KERNEL);
 628                 if (err)
 629                         errx(1, "virtqueue_add_outbuf (multiple): %i", err);
 630         }
 631
 632         /* Now get many, and consume them all at once. */
 633         vringh_iov_init(&riov, host_riov, ARRAY_SIZE(host_riov));
 634         vringh_iov_init(&wiov, host_wiov, ARRAY_SIZE(host_wiov));
 635
 636         for (i = 0; i < RINGSIZE; i++) {
 637                 err = vringh_getdesc_user(&vrh, &riov, &wiov, getrange, &head);
 638                 if (err != 1)
 639                         errx(1, "vringh_getdesc_user: %i", err);
 640                 used[i].id = head;
 641                 used[i].len = 0;
 642         }
 643         /* Make sure it wraps around ring, to test! */
 644         assert(vrh.vring.used->idx % RINGSIZE != 0);
 645         err = vringh_complete_multi_user(&vrh, used, RINGSIZE);
 646         if (err)
 647                 errx(1, "vringh_complete_multi_user: %i", err);
 648
 649         /* Free those buffers. */
 650         for (i = 0; i < RINGSIZE; i++) {
 651                 unsigned len;
 652                 assert(virtqueue_get_buf(vq, &len) != NULL);
 653         }
 654
 655         /* Test weird (but legal!) indirect. */
 656         if (__virtio_test_bit(&vdev, VIRTIO_RING_F_INDIRECT_DESC)) {
 657                 char *data = __user_addr_max - USER_MEM/4;
 658                 struct vring_desc *d = __user_addr_max - USER_MEM/2;
 659                 struct vring vring;
 660
 661                 /* Force creation of direct, which we modify. */
 662                 __virtio_clear_bit(&vdev, VIRTIO_RING_F_INDIRECT_DESC);
 663                 vq = vring_new_virtqueue(0, RINGSIZE, ALIGN, &vdev, true,
 664                                          __user_addr_min,
 665                                          never_notify_host,
 666                                          never_callback_guest,
 667                                          "guest vq");
 668
 669                 sg_init_table(guest_sg, 4);
 670                 sg_set_buf(&guest_sg[0], d, sizeof(*d)*2);
 671                 sg_set_buf(&guest_sg[1], d + 2, sizeof(*d)*1);
 672                 sg_set_buf(&guest_sg[2], data + 6, 4);
 673                 sg_set_buf(&guest_sg[3], d + 3, sizeof(*d)*3);
 674
 675                 err = virtqueue_add_outbuf(vq, guest_sg, 4, &err, GFP_KERNEL);
 676                 if (err)
 677                         errx(1, "virtqueue_add_outbuf (indirect): %i", err);
 678
 679                 vring_init(&vring, RINGSIZE, __user_addr_min, ALIGN);
 680
 681                 /* They're used in order, but double-check... */
 682                 assert(vring.desc[0].addr == (unsigned long)d);
 683                 assert(vring.desc[1].addr == (unsigned long)(d+2));
 684                 assert(vring.desc[2].addr == (unsigned long)data + 6);
 685                 assert(vring.desc[3].addr == (unsigned long)(d+3));
 686                 vring.desc[0].flags |= VRING_DESC_F_INDIRECT;
 687                 vring.desc[1].flags |= VRING_DESC_F_INDIRECT;
 688                 vring.desc[3].flags |= VRING_DESC_F_INDIRECT;
 689
 690                 /* First indirect */
 691                 d[0].addr = (unsigned long)data;
 692                 d[0].len = 1;
 693                 d[0].flags = VRING_DESC_F_NEXT;
 694                 d[0].next = 1;
 695                 d[1].addr = (unsigned long)data + 1;
 696                 d[1].len = 2;
 697                 d[1].flags = 0;
 698
 699                 /* Second indirect */
 700                 d[2].addr = (unsigned long)data + 3;
 701                 d[2].len = 3;
 702                 d[2].flags = 0;
 703
 704                 /* Third indirect */
 705                 d[3].addr = (unsigned long)data + 10;
 706                 d[3].len = 5;
 707                 d[3].flags = VRING_DESC_F_NEXT;
 708                 d[3].next = 1;
 709                 d[4].addr = (unsigned long)data + 15;
 710                 d[4].len = 6;
 711                 d[4].flags = VRING_DESC_F_NEXT;
 712                 d[4].next = 2;
 713                 d[5].addr = (unsigned long)data + 21;
 714                 d[5].len = 7;
 715                 d[5].flags = 0;
 716
 717                 /* Host picks it up (allocates new iov). */
 718                 vringh_iov_init(&riov, host_riov, ARRAY_SIZE(host_riov));
 719                 vringh_iov_init(&wiov, host_wiov, ARRAY_SIZE(host_wiov));
 720
 721                 err = vringh_getdesc_user(&vrh, &riov, &wiov, getrange, &head);
 722                 if (err != 1)
 723                         errx(1, "vringh_getdesc_user: %i", err);
 724
 725                 if (head != 0)
 726                         errx(1, "vringh_getdesc_user: head %i not 0", head);
 727
 728                 assert(riov.max_num & VRINGH_IOV_ALLOCATED);
 729                 if (getrange != getrange_slow)
 730                         assert(riov.used == 7);
 731                 else
 732                         assert(riov.used == 28);
 733                 err = vringh_iov_pull_user(&riov, buf, 29);
 734                 assert(err == 28);
 735
 736                 /* Data should be linear. */
 737                 for (i = 0; i < err; i++)
 738                         assert(buf[i] == i);
 739                 vringh_iov_cleanup(&riov);
 740         }
 741
 742         /* Don't leak memory... */
 743         vring_del_virtqueue(vq);
 744         free(__user_addr_min);
 745
 746         return 0;
 747 }