hw/virtio-9p.c

   1 /*
   2  * Virtio 9p backend
   3  *
   4  * Copyright IBM, Corp. 2010
   5  *
   6  * Authors:
   7  *  Anthony Liguori   <aliguori@us.ibm.com>
   8  *
   9  * This work is licensed under the terms of the GNU GPL, version 2.  See
  10  * the COPYING file in the top-level directory.
  11  *
  12  */
  13
  14 #include "virtio.h"
  15 #include "pc.h"
  16 #include "qemu_socket.h"
  17 #include "virtio-9p.h"
  18 #include "fsdev/qemu-fsdev.h"
  19 #include "virtio-9p-debug.h"
  20
  21 int dotu = 1;
  22 int debug_9p_pdu;
  23
  24 static int v9fs_do_lstat(V9fsState *s, V9fsString *path, struct stat *stbuf)
  25 {
  26     return s->ops->lstat(&s->ctx, path->data, stbuf);
  27 }
  28
  29 static int v9fs_do_setuid(V9fsState *s, uid_t uid)
  30 {
  31     return s->ops->setuid(&s->ctx, uid);
  32 }
  33
  34 static ssize_t v9fs_do_readlink(V9fsState *s, V9fsString *path, V9fsString *buf)
  35 {
  36     ssize_t len;
  37
  38     buf->data = qemu_malloc(1024);
  39
  40     len = s->ops->readlink(&s->ctx, path->data, buf->data, 1024 - 1);
  41     if (len > -1) {
  42         buf->size = len;
  43         buf->data[len] = 0;
  44     }
  45
  46     return len;
  47 }
  48
  49 static int v9fs_do_close(V9fsState *s, int fd)
  50 {
  51     return s->ops->close(&s->ctx, fd);
  52 }
  53
  54 static int v9fs_do_closedir(V9fsState *s, DIR *dir)
  55 {
  56     return s->ops->closedir(&s->ctx, dir);
  57 }
  58
  59 static int v9fs_do_open(V9fsState *s, V9fsString *path, int flags)
  60 {
  61     return s->ops->open(&s->ctx, path->data, flags);
  62 }
  63
  64 static DIR *v9fs_do_opendir(V9fsState *s, V9fsString *path)
  65 {
  66     return s->ops->opendir(&s->ctx, path->data);
  67 }
  68
  69 static void v9fs_do_rewinddir(V9fsState *s, DIR *dir)
  70 {
  71     return s->ops->rewinddir(&s->ctx, dir);
  72 }
  73
  74 static off_t v9fs_do_telldir(V9fsState *s, DIR *dir)
  75 {
  76     return s->ops->telldir(&s->ctx, dir);
  77 }
  78
  79 static struct dirent *v9fs_do_readdir(V9fsState *s, DIR *dir)
  80 {
  81     return s->ops->readdir(&s->ctx, dir);
  82 }
  83
  84 static void v9fs_do_seekdir(V9fsState *s, DIR *dir, off_t off)
  85 {
  86     return s->ops->seekdir(&s->ctx, dir, off);
  87 }
  88
  89 static int v9fs_do_readv(V9fsState *s, int fd, const struct iovec *iov,
  90                             int iovcnt)
  91 {
  92     return s->ops->readv(&s->ctx, fd, iov, iovcnt);
  93 }
  94
  95 static off_t v9fs_do_lseek(V9fsState *s, int fd, off_t offset, int whence)
  96 {
  97     return s->ops->lseek(&s->ctx, fd, offset, whence);
  98 }
  99
 100 static void v9fs_string_init(V9fsString *str)
 101 {
 102     str->data = NULL;
 103     str->size = 0;
 104 }
 105
 106 static void v9fs_string_free(V9fsString *str)
 107 {
 108     qemu_free(str->data);
 109     str->data = NULL;
 110     str->size = 0;
 111 }
 112
 113 static void v9fs_string_null(V9fsString *str)
 114 {
 115     v9fs_string_free(str);
 116 }
 117
 118 static int number_to_string(void *arg, char type)
 119 {
 120     unsigned int ret = 0;
 121
 122     switch (type) {
 123     case 'u': {
 124         unsigned int num = *(unsigned int *)arg;
 125
 126         do {
 127             ret++;
 128             num = num/10;
 129         } while (num);
 130         break;
 131     }
 132     default:
 133         printf("Number_to_string: Unknown number format\n");
 134         return -1;
 135     }
 136
 137     return ret;
 138 }
 139
 140 static int v9fs_string_alloc_printf(char **strp, const char *fmt, va_list ap)
 141 {
 142     va_list ap2;
 143     char *iter = (char *)fmt;
 144     int len = 0;
 145     int nr_args = 0;
 146     char *arg_char_ptr;
 147     unsigned int arg_uint;
 148
 149     /* Find the number of %'s that denotes an argument */
 150     for (iter = strstr(iter, "%"); iter; iter = strstr(iter, "%")) {
 151         nr_args++;
 152         iter++;
 153     }
 154
 155     len = strlen(fmt) - 2*nr_args;
 156
 157     if (!nr_args) {
 158         goto alloc_print;
 159     }
 160
 161     va_copy(ap2, ap);
 162
 163     iter = (char *)fmt;
 164
 165     /* Now parse the format string */
 166     for (iter = strstr(iter, "%"); iter; iter = strstr(iter, "%")) {
 167         iter++;
 168         switch (*iter) {
 169         case 'u':
 170             arg_uint = va_arg(ap2, unsigned int);
 171             len += number_to_string((void *)&arg_uint, 'u');
 172             break;
 173         case 's':
 174             arg_char_ptr = va_arg(ap2, char *);
 175             len += strlen(arg_char_ptr);
 176             break;
 177         case 'c':
 178             len += 1;
 179             break;
 180         default:
 181             fprintf(stderr,
 182                     "v9fs_string_alloc_printf:Incorrect format %c", *iter);
 183             return -1;
 184         }
 185         iter++;
 186     }
 187
 188 alloc_print:
 189     *strp = qemu_malloc((len + 1) * sizeof(**strp));
 190
 191     return vsprintf(*strp, fmt, ap);
 192 }
 193
 194 static void v9fs_string_sprintf(V9fsString *str, const char *fmt, ...)
 195 {
 196     va_list ap;
 197     int err;
 198
 199     v9fs_string_free(str);
 200
 201     va_start(ap, fmt);
 202     err = v9fs_string_alloc_printf(&str->data, fmt, ap);
 203     BUG_ON(err == -1);
 204     va_end(ap);
 205
 206     str->size = err;
 207 }
 208
 209 static void v9fs_string_copy(V9fsString *lhs, V9fsString *rhs)
 210 {
 211     v9fs_string_free(lhs);
 212     v9fs_string_sprintf(lhs, "%s", rhs->data);
 213 }
 214
 215 static size_t v9fs_string_size(V9fsString *str)
 216 {
 217     return str->size;
 218 }
 219
 220 static V9fsFidState *lookup_fid(V9fsState *s, int32_t fid)
 221 {
 222     V9fsFidState *f;
 223
 224     for (f = s->fid_list; f; f = f->next) {
 225         if (f->fid == fid) {
 226             v9fs_do_setuid(s, f->uid);
 227             return f;
 228         }
 229     }
 230
 231     return NULL;
 232 }
 233
 234 static V9fsFidState *alloc_fid(V9fsState *s, int32_t fid)
 235 {
 236     V9fsFidState *f;
 237
 238     f = lookup_fid(s, fid);
 239     if (f) {
 240         return NULL;
 241     }
 242
 243     f = qemu_mallocz(sizeof(V9fsFidState));
 244
 245     f->fid = fid;
 246     f->fd = -1;
 247     f->dir = NULL;
 248
 249     f->next = s->fid_list;
 250     s->fid_list = f;
 251
 252     return f;
 253 }
 254
 255 static int free_fid(V9fsState *s, int32_t fid)
 256 {
 257     V9fsFidState **fidpp, *fidp;
 258
 259     for (fidpp = &s->fid_list; *fidpp; fidpp = &(*fidpp)->next) {
 260         if ((*fidpp)->fid == fid) {
 261             break;
 262         }
 263     }
 264
 265     if (*fidpp == NULL) {
 266         return -ENOENT;
 267     }
 268
 269     fidp = *fidpp;
 270     *fidpp = fidp->next;
 271
 272     if (fidp->fd != -1) {
 273         v9fs_do_close(s, fidp->fd);
 274     }
 275     if (fidp->dir) {
 276         v9fs_do_closedir(s, fidp->dir);
 277     }
 278     v9fs_string_free(&fidp->path);
 279     qemu_free(fidp);
 280
 281     return 0;
 282 }
 283
 284 #define P9_QID_TYPE_DIR         0x80
 285 #define P9_QID_TYPE_SYMLINK     0x02
 286
 287 #define P9_STAT_MODE_DIR        0x80000000
 288 #define P9_STAT_MODE_APPEND     0x40000000
 289 #define P9_STAT_MODE_EXCL       0x20000000
 290 #define P9_STAT_MODE_MOUNT      0x10000000
 291 #define P9_STAT_MODE_AUTH       0x08000000
 292 #define P9_STAT_MODE_TMP        0x04000000
 293 #define P9_STAT_MODE_SYMLINK    0x02000000
 294 #define P9_STAT_MODE_LINK       0x01000000
 295 #define P9_STAT_MODE_DEVICE     0x00800000
 296 #define P9_STAT_MODE_NAMED_PIPE 0x00200000
 297 #define P9_STAT_MODE_SOCKET     0x00100000
 298 #define P9_STAT_MODE_SETUID     0x00080000
 299 #define P9_STAT_MODE_SETGID     0x00040000
 300 #define P9_STAT_MODE_SETVTX     0x00010000
 301
 302 #define P9_STAT_MODE_TYPE_BITS (P9_STAT_MODE_DIR |          \
 303                                 P9_STAT_MODE_SYMLINK |      \
 304                                 P9_STAT_MODE_LINK |         \
 305                                 P9_STAT_MODE_DEVICE |       \
 306                                 P9_STAT_MODE_NAMED_PIPE |   \
 307                                 P9_STAT_MODE_SOCKET)
 308
 309 /* This is the algorithm from ufs in spfs */
 310 static void stat_to_qid(const struct stat *stbuf, V9fsQID *qidp)
 311 {
 312     size_t size;
 313
 314     size = MIN(sizeof(stbuf->st_ino), sizeof(qidp->path));
 315     memcpy(&qidp->path, &stbuf->st_ino, size);
 316     qidp->version = stbuf->st_mtime ^ (stbuf->st_size << 8);
 317     qidp->type = 0;
 318     if (S_ISDIR(stbuf->st_mode)) {
 319         qidp->type |= P9_QID_TYPE_DIR;
 320     }
 321     if (S_ISLNK(stbuf->st_mode)) {
 322         qidp->type |= P9_QID_TYPE_SYMLINK;
 323     }
 324 }
 325
 326 static int fid_to_qid(V9fsState *s, V9fsFidState *fidp, V9fsQID *qidp)
 327 {
 328     struct stat stbuf;
 329     int err;
 330
 331     err = v9fs_do_lstat(s, &fidp->path, &stbuf);
 332     if (err) {
 333         return err;
 334     }
 335
 336     stat_to_qid(&stbuf, qidp);
 337     return 0;
 338 }
 339
 340 static V9fsPDU *alloc_pdu(V9fsState *s)
 341 {
 342     V9fsPDU *pdu = NULL;
 343
 344     if (!QLIST_EMPTY(&s->free_list)) {
 345         pdu = QLIST_FIRST(&s->free_list);
 346         QLIST_REMOVE(pdu, next);
 347     }
 348     return pdu;
 349 }
 350
 351 static void free_pdu(V9fsState *s, V9fsPDU *pdu)
 352 {
 353     if (pdu) {
 354         QLIST_INSERT_HEAD(&s->free_list, pdu, next);
 355     }
 356 }
 357
 358 size_t pdu_packunpack(void *addr, struct iovec *sg, int sg_count,
 359                         size_t offset, size_t size, int pack)
 360 {
 361     int i = 0;
 362     size_t copied = 0;
 363
 364     for (i = 0; size && i < sg_count; i++) {
 365         size_t len;
 366         if (offset >= sg[i].iov_len) {
 367             /* skip this sg */
 368             offset -= sg[i].iov_len;
 369             continue;
 370         } else {
 371             len = MIN(sg[i].iov_len - offset, size);
 372             if (pack) {
 373                 memcpy(sg[i].iov_base + offset, addr, len);
 374             } else {
 375                 memcpy(addr, sg[i].iov_base + offset, len);
 376             }
 377             size -= len;
 378             copied += len;
 379             addr += len;
 380             if (size) {
 381                 offset = 0;
 382                 continue;
 383             }
 384         }
 385     }
 386
 387     return copied;
 388 }
 389
 390 static size_t pdu_unpack(void *dst, V9fsPDU *pdu, size_t offset, size_t size)
 391 {
 392     return pdu_packunpack(dst, pdu->elem.out_sg, pdu->elem.out_num,
 393                          offset, size, 0);
 394 }
 395
 396 static size_t pdu_pack(V9fsPDU *pdu, size_t offset, const void *src,
 397                         size_t size)
 398 {
 399     return pdu_packunpack((void *)src, pdu->elem.in_sg, pdu->elem.in_num,
 400                              offset, size, 1);
 401 }
 402
 403 static int pdu_copy_sg(V9fsPDU *pdu, size_t offset, int rx, struct iovec *sg)
 404 {
 405     size_t pos = 0;
 406     int i, j;
 407     struct iovec *src_sg;
 408     unsigned int num;
 409
 410     if (rx) {
 411         src_sg = pdu->elem.in_sg;
 412         num = pdu->elem.in_num;
 413     } else {
 414         src_sg = pdu->elem.out_sg;
 415         num = pdu->elem.out_num;
 416     }
 417
 418     j = 0;
 419     for (i = 0; i < num; i++) {
 420         if (offset <= pos) {
 421             sg[j].iov_base = src_sg[i].iov_base;
 422             sg[j].iov_len = src_sg[i].iov_len;
 423             j++;
 424         } else if (offset < (src_sg[i].iov_len + pos)) {
 425             sg[j].iov_base = src_sg[i].iov_base;
 426             sg[j].iov_len = src_sg[i].iov_len;
 427             sg[j].iov_base += (offset - pos);
 428             sg[j].iov_len -= (offset - pos);
 429             j++;
 430         }
 431         pos += src_sg[i].iov_len;
 432     }
 433
 434     return j;
 435 }
 436
 437 static size_t pdu_unmarshal(V9fsPDU *pdu, size_t offset, const char *fmt, ...)
 438 {
 439     size_t old_offset = offset;
 440     va_list ap;
 441     int i;
 442
 443     va_start(ap, fmt);
 444     for (i = 0; fmt[i]; i++) {
 445         switch (fmt[i]) {
 446         case 'b': {
 447             uint8_t *valp = va_arg(ap, uint8_t *);
 448             offset += pdu_unpack(valp, pdu, offset, sizeof(*valp));
 449             break;
 450         }
 451         case 'w': {
 452             uint16_t val, *valp;
 453             valp = va_arg(ap, uint16_t *);
 454             val = le16_to_cpupu(valp);
 455             offset += pdu_unpack(&val, pdu, offset, sizeof(val));
 456             *valp = val;
 457             break;
 458         }
 459         case 'd': {
 460             uint32_t val, *valp;
 461             valp = va_arg(ap, uint32_t *);
 462             val = le32_to_cpupu(valp);
 463             offset += pdu_unpack(&val, pdu, offset, sizeof(val));
 464             *valp = val;
 465             break;
 466         }
 467         case 'q': {
 468             uint64_t val, *valp;
 469             valp = va_arg(ap, uint64_t *);
 470             val = le64_to_cpup(valp);
 471             offset += pdu_unpack(&val, pdu, offset, sizeof(val));
 472             *valp = val;
 473             break;
 474         }
 475         case 'v': {
 476             struct iovec *iov = va_arg(ap, struct iovec *);
 477             int *iovcnt = va_arg(ap, int *);
 478             *iovcnt = pdu_copy_sg(pdu, offset, 0, iov);
 479             break;
 480         }
 481         case 's': {
 482             V9fsString *str = va_arg(ap, V9fsString *);
 483             offset += pdu_unmarshal(pdu, offset, "w", &str->size);
 484             /* FIXME: sanity check str->size */
 485             str->data = qemu_malloc(str->size + 1);
 486             offset += pdu_unpack(str->data, pdu, offset, str->size);
 487             str->data[str->size] = 0;
 488             break;
 489         }
 490         case 'Q': {
 491             V9fsQID *qidp = va_arg(ap, V9fsQID *);
 492             offset += pdu_unmarshal(pdu, offset, "bdq",
 493                         &qidp->type, &qidp->version, &qidp->path);
 494             break;
 495         }
 496         case 'S': {
 497             V9fsStat *statp = va_arg(ap, V9fsStat *);
 498             offset += pdu_unmarshal(pdu, offset, "wwdQdddqsssssddd",
 499                         &statp->size, &statp->type, &statp->dev,
 500                         &statp->qid, &statp->mode, &statp->atime,
 501                         &statp->mtime, &statp->length,
 502                         &statp->name, &statp->uid, &statp->gid,
 503                         &statp->muid, &statp->extension,
 504                         &statp->n_uid, &statp->n_gid,
 505                         &statp->n_muid);
 506             break;
 507         }
 508         default:
 509             break;
 510         }
 511     }
 512
 513     va_end(ap);
 514
 515     return offset - old_offset;
 516 }
 517
 518 static size_t pdu_marshal(V9fsPDU *pdu, size_t offset, const char *fmt, ...)
 519 {
 520     size_t old_offset = offset;
 521     va_list ap;
 522     int i;
 523
 524     va_start(ap, fmt);
 525     for (i = 0; fmt[i]; i++) {
 526         switch (fmt[i]) {
 527         case 'b': {
 528             uint8_t val = va_arg(ap, int);
 529             offset += pdu_pack(pdu, offset, &val, sizeof(val));
 530             break;
 531         }
 532         case 'w': {
 533             uint16_t val;
 534             cpu_to_le16w(&val, va_arg(ap, int));
 535             offset += pdu_pack(pdu, offset, &val, sizeof(val));
 536             break;
 537         }
 538         case 'd': {
 539             uint32_t val;
 540             cpu_to_le32w(&val, va_arg(ap, uint32_t));
 541             offset += pdu_pack(pdu, offset, &val, sizeof(val));
 542             break;
 543         }
 544         case 'q': {
 545             uint64_t val;
 546             cpu_to_le64w(&val, va_arg(ap, uint64_t));
 547             offset += pdu_pack(pdu, offset, &val, sizeof(val));
 548             break;
 549         }
 550         case 'v': {
 551             struct iovec *iov = va_arg(ap, struct iovec *);
 552             int *iovcnt = va_arg(ap, int *);
 553             *iovcnt = pdu_copy_sg(pdu, offset, 1, iov);
 554             break;
 555         }
 556         case 's': {
 557             V9fsString *str = va_arg(ap, V9fsString *);
 558             offset += pdu_marshal(pdu, offset, "w", str->size);
 559             offset += pdu_pack(pdu, offset, str->data, str->size);
 560             break;
 561         }
 562         case 'Q': {
 563             V9fsQID *qidp = va_arg(ap, V9fsQID *);
 564             offset += pdu_marshal(pdu, offset, "bdq",
 565                         qidp->type, qidp->version, qidp->path);
 566             break;
 567         }
 568         case 'S': {
 569             V9fsStat *statp = va_arg(ap, V9fsStat *);
 570             offset += pdu_marshal(pdu, offset, "wwdQdddqsssssddd",
 571                         statp->size, statp->type, statp->dev,
 572                         &statp->qid, statp->mode, statp->atime,
 573                         statp->mtime, statp->length, &statp->name,
 574                         &statp->uid, &statp->gid, &statp->muid,
 575                         &statp->extension, statp->n_uid,
 576                         statp->n_gid, statp->n_muid);
 577             break;
 578         }
 579         default:
 580             break;
 581         }
 582     }
 583     va_end(ap);
 584
 585     return offset - old_offset;
 586 }
 587
 588 static void complete_pdu(V9fsState *s, V9fsPDU *pdu, ssize_t len)
 589 {
 590     int8_t id = pdu->id + 1; /* Response */
 591
 592     if (len < 0) {
 593         V9fsString str;
 594         int err = -len;
 595
 596         str.data = strerror(err);
 597         str.size = strlen(str.data);
 598
 599         len = 7;
 600         len += pdu_marshal(pdu, len, "s", &str);
 601         if (dotu) {
 602             len += pdu_marshal(pdu, len, "d", err);
 603         }
 604
 605         id = P9_RERROR;
 606     }
 607
 608     /* fill out the header */
 609     pdu_marshal(pdu, 0, "dbw", (int32_t)len, id, pdu->tag);
 610
 611     /* keep these in sync */
 612     pdu->size = len;
 613     pdu->id = id;
 614
 615     /* push onto queue and notify */
 616     virtqueue_push(s->vq, &pdu->elem, len);
 617
 618     /* FIXME: we should batch these completions */
 619     virtio_notify(&s->vdev, s->vq);
 620
 621     free_pdu(s, pdu);
 622 }
 623
 624 static mode_t v9mode_to_mode(uint32_t mode, V9fsString *extension)
 625 {
 626     mode_t ret;
 627
 628     ret = mode & 0777;
 629     if (mode & P9_STAT_MODE_DIR) {
 630         ret |= S_IFDIR;
 631     }
 632
 633     if (dotu) {
 634         if (mode & P9_STAT_MODE_SYMLINK) {
 635             ret |= S_IFLNK;
 636         }
 637         if (mode & P9_STAT_MODE_SOCKET) {
 638             ret |= S_IFSOCK;
 639         }
 640         if (mode & P9_STAT_MODE_NAMED_PIPE) {
 641             ret |= S_IFIFO;
 642         }
 643         if (mode & P9_STAT_MODE_DEVICE) {
 644             if (extension && extension->data[0] == 'c') {
 645                 ret |= S_IFCHR;
 646             } else {
 647                 ret |= S_IFBLK;
 648             }
 649         }
 650     }
 651
 652     if (!(ret&~0777)) {
 653         ret |= S_IFREG;
 654     }
 655
 656     if (mode & P9_STAT_MODE_SETUID) {
 657         ret |= S_ISUID;
 658     }
 659     if (mode & P9_STAT_MODE_SETGID) {
 660         ret |= S_ISGID;
 661     }
 662     if (mode & P9_STAT_MODE_SETVTX) {
 663         ret |= S_ISVTX;
 664     }
 665
 666     return ret;
 667 }
 668
 669 static int donttouch_stat(V9fsStat *stat)
 670 {
 671     if (stat->type == -1 &&
 672         stat->dev == -1 &&
 673         stat->qid.type == -1 &&
 674         stat->qid.version == -1 &&
 675         stat->qid.path == -1 &&
 676         stat->mode == -1 &&
 677         stat->atime == -1 &&
 678         stat->mtime == -1 &&
 679         stat->length == -1 &&
 680         !stat->name.size &&
 681         !stat->uid.size &&
 682         !stat->gid.size &&
 683         !stat->muid.size &&
 684         stat->n_uid == -1 &&
 685         stat->n_gid == -1 &&
 686         stat->n_muid == -1) {
 687         return 1;
 688     }
 689
 690     return 0;
 691 }
 692
 693 static void v9fs_stat_free(V9fsStat *stat)
 694 {
 695     v9fs_string_free(&stat->name);
 696     v9fs_string_free(&stat->uid);
 697     v9fs_string_free(&stat->gid);
 698     v9fs_string_free(&stat->muid);
 699     v9fs_string_free(&stat->extension);
 700 }
 701
 702 static uint32_t stat_to_v9mode(const struct stat *stbuf)
 703 {
 704     uint32_t mode;
 705
 706     mode = stbuf->st_mode & 0777;
 707     if (S_ISDIR(stbuf->st_mode)) {
 708         mode |= P9_STAT_MODE_DIR;
 709     }
 710
 711     if (dotu) {
 712         if (S_ISLNK(stbuf->st_mode)) {
 713             mode |= P9_STAT_MODE_SYMLINK;
 714         }
 715
 716         if (S_ISSOCK(stbuf->st_mode)) {
 717             mode |= P9_STAT_MODE_SOCKET;
 718         }
 719
 720         if (S_ISFIFO(stbuf->st_mode)) {
 721             mode |= P9_STAT_MODE_NAMED_PIPE;
 722         }
 723
 724         if (S_ISBLK(stbuf->st_mode) || S_ISCHR(stbuf->st_mode)) {
 725             mode |= P9_STAT_MODE_DEVICE;
 726         }
 727
 728         if (stbuf->st_mode & S_ISUID) {
 729             mode |= P9_STAT_MODE_SETUID;
 730         }
 731
 732         if (stbuf->st_mode & S_ISGID) {
 733             mode |= P9_STAT_MODE_SETGID;
 734         }
 735
 736         if (stbuf->st_mode & S_ISVTX) {
 737             mode |= P9_STAT_MODE_SETVTX;
 738         }
 739     }
 740
 741     return mode;
 742 }
 743
 744 static int stat_to_v9stat(V9fsState *s, V9fsString *name,
 745                             const struct stat *stbuf,
 746                             V9fsStat *v9stat)
 747 {
 748     int err;
 749     const char *str;
 750
 751     memset(v9stat, 0, sizeof(*v9stat));
 752
 753     stat_to_qid(stbuf, &v9stat->qid);
 754     v9stat->mode = stat_to_v9mode(stbuf);
 755     v9stat->atime = stbuf->st_atime;
 756     v9stat->mtime = stbuf->st_mtime;
 757     v9stat->length = stbuf->st_size;
 758
 759     v9fs_string_null(&v9stat->uid);
 760     v9fs_string_null(&v9stat->gid);
 761     v9fs_string_null(&v9stat->muid);
 762
 763     if (dotu) {
 764         v9stat->n_uid = stbuf->st_uid;
 765         v9stat->n_gid = stbuf->st_gid;
 766         v9stat->n_muid = 0;
 767
 768         v9fs_string_null(&v9stat->extension);
 769
 770         if (v9stat->mode & P9_STAT_MODE_SYMLINK) {
 771             err = v9fs_do_readlink(s, name, &v9stat->extension);
 772             if (err == -1) {
 773                 err = -errno;
 774                 return err;
 775             }
 776             v9stat->extension.data[err] = 0;
 777             v9stat->extension.size = err;
 778         } else if (v9stat->mode & P9_STAT_MODE_DEVICE) {
 779             v9fs_string_sprintf(&v9stat->extension, "%c %u %u",
 780                     S_ISCHR(stbuf->st_mode) ? 'c' : 'b',
 781                     major(stbuf->st_rdev), minor(stbuf->st_rdev));
 782         } else if (S_ISDIR(stbuf->st_mode) || S_ISREG(stbuf->st_mode)) {
 783             v9fs_string_sprintf(&v9stat->extension, "%s %u",
 784                     "HARDLINKCOUNT", stbuf->st_nlink);
 785         }
 786     }
 787
 788     str = strrchr(name->data, '/');
 789     if (str) {
 790         str += 1;
 791     } else {
 792         str = name->data;
 793     }
 794
 795     v9fs_string_sprintf(&v9stat->name, "%s", str);
 796
 797     v9stat->size = 61 +
 798         v9fs_string_size(&v9stat->name) +
 799         v9fs_string_size(&v9stat->uid) +
 800         v9fs_string_size(&v9stat->gid) +
 801         v9fs_string_size(&v9stat->muid) +
 802         v9fs_string_size(&v9stat->extension);
 803     return 0;
 804 }
 805
 806 static struct iovec *adjust_sg(struct iovec *sg, int len, int *iovcnt)
 807 {
 808     while (len && *iovcnt) {
 809         if (len < sg->iov_len) {
 810             sg->iov_len -= len;
 811             sg->iov_base += len;
 812             len = 0;
 813         } else {
 814             len -= sg->iov_len;
 815             sg++;
 816             *iovcnt -= 1;
 817         }
 818     }
 819
 820     return sg;
 821 }
 822
 823 static struct iovec *cap_sg(struct iovec *sg, int cap, int *cnt)
 824 {
 825     int i;
 826     int total = 0;
 827
 828     for (i = 0; i < *cnt; i++) {
 829         if ((total + sg[i].iov_len) > cap) {
 830             sg[i].iov_len -= ((total + sg[i].iov_len) - cap);
 831             i++;
 832             break;
 833         }
 834         total += sg[i].iov_len;
 835     }
 836
 837     *cnt = i;
 838
 839     return sg;
 840 }
 841
 842 static void print_sg(struct iovec *sg, int cnt)
 843 {
 844     int i;
 845
 846     printf("sg[%d]: {", cnt);
 847     for (i = 0; i < cnt; i++) {
 848         if (i) {
 849             printf(", ");
 850         }
 851         printf("(%p, %zd)", sg[i].iov_base, sg[i].iov_len);
 852     }
 853     printf("}\n");
 854 }
 855
 856 static void v9fs_dummy(V9fsState *s, V9fsPDU *pdu)
 857 {
 858     /* Note: The following have been added to prevent GCC from complaining
 859      * They will be removed in the subsequent patches */
 860     (void)pdu_unmarshal;
 861     (void) complete_pdu;
 862     (void) v9fs_string_init;
 863     (void) v9fs_string_free;
 864     (void) v9fs_string_null;
 865     (void) v9fs_string_sprintf;
 866     (void) v9fs_string_copy;
 867     (void) v9fs_string_size;
 868     (void) v9fs_do_lstat;
 869     (void) v9fs_do_setuid;
 870     (void) v9fs_do_readlink;
 871     (void) v9fs_do_close;
 872     (void) v9fs_do_closedir;
 873     (void) alloc_fid;
 874     (void) free_fid;
 875     (void) fid_to_qid;
 876     (void) v9mode_to_mode;
 877     (void) donttouch_stat;
 878     (void) v9fs_stat_free;
 879     (void) stat_to_v9stat;
 880     (void) adjust_sg;
 881     (void) cap_sg;
 882     (void) print_sg;
 883 }
 884
 885 static void v9fs_version(V9fsState *s, V9fsPDU *pdu)
 886 {
 887     int32_t msize;
 888     V9fsString version;
 889     size_t offset = 7;
 890
 891     pdu_unmarshal(pdu, offset, "ds", &msize, &version);
 892
 893     if (strcmp(version.data, "9P2000.u")) {
 894         v9fs_string_sprintf(&version, "unknown");
 895     }
 896
 897     offset += pdu_marshal(pdu, offset, "ds", msize, &version);
 898     complete_pdu(s, pdu, offset);
 899
 900     v9fs_string_free(&version);
 901 }
 902
 903 static void v9fs_attach(V9fsState *s, V9fsPDU *pdu)
 904 {
 905     int32_t fid, afid, n_uname;
 906     V9fsString uname, aname;
 907     V9fsFidState *fidp;
 908     V9fsQID qid;
 909     size_t offset = 7;
 910     ssize_t err;
 911
 912     pdu_unmarshal(pdu, offset, "ddssd", &fid, &afid, &uname, &aname, &n_uname);
 913
 914     fidp = alloc_fid(s, fid);
 915     if (fidp == NULL) {
 916         err = -EINVAL;
 917         goto out;
 918     }
 919
 920     fidp->uid = n_uname;
 921
 922     v9fs_string_sprintf(&fidp->path, "%s", "/");
 923     err = fid_to_qid(s, fidp, &qid);
 924     if (err) {
 925         err = -EINVAL;
 926         free_fid(s, fid);
 927         goto out;
 928     }
 929
 930     offset += pdu_marshal(pdu, offset, "Q", &qid);
 931
 932     err = offset;
 933 out:
 934     complete_pdu(s, pdu, err);
 935     v9fs_string_free(&uname);
 936     v9fs_string_free(&aname);
 937 }
 938
 939 typedef struct V9fsStatState {
 940     V9fsPDU *pdu;
 941     size_t offset;
 942     V9fsStat v9stat;
 943     V9fsFidState *fidp;
 944     struct stat stbuf;
 945 } V9fsStatState;
 946
 947 static void v9fs_stat_post_lstat(V9fsState *s, V9fsStatState *vs, int err)
 948 {
 949     if (err == -1) {
 950         err = -errno;
 951         goto out;
 952     }
 953
 954     err = stat_to_v9stat(s, &vs->fidp->path, &vs->stbuf, &vs->v9stat);
 955     if (err) {
 956         goto out;
 957     }
 958     vs->offset += pdu_marshal(vs->pdu, vs->offset, "wS", 0, &vs->v9stat);
 959     err = vs->offset;
 960
 961 out:
 962     complete_pdu(s, vs->pdu, err);
 963     v9fs_stat_free(&vs->v9stat);
 964     qemu_free(vs);
 965 }
 966
 967 static void v9fs_stat(V9fsState *s, V9fsPDU *pdu)
 968 {
 969     int32_t fid;
 970     V9fsStatState *vs;
 971     ssize_t err = 0;
 972
 973     vs = qemu_malloc(sizeof(*vs));
 974     vs->pdu = pdu;
 975     vs->offset = 7;
 976
 977     memset(&vs->v9stat, 0, sizeof(vs->v9stat));
 978
 979     pdu_unmarshal(vs->pdu, vs->offset, "d", &fid);
 980
 981     vs->fidp = lookup_fid(s, fid);
 982     if (vs->fidp == NULL) {
 983         err = -ENOENT;
 984         goto out;
 985     }
 986
 987     err = v9fs_do_lstat(s, &vs->fidp->path, &vs->stbuf);
 988     v9fs_stat_post_lstat(s, vs, err);
 989     return;
 990
 991 out:
 992     complete_pdu(s, vs->pdu, err);
 993     v9fs_stat_free(&vs->v9stat);
 994     qemu_free(vs);
 995 }
 996
 997 typedef struct V9fsWalkState {
 998     V9fsPDU *pdu;
 999     size_t offset;
1000     int16_t nwnames;
1001     int name_idx;
1002     V9fsQID *qids;
1003     V9fsFidState *fidp;
1004     V9fsFidState *newfidp;
1005     V9fsString path;
1006     V9fsString *wnames;
1007     struct stat stbuf;
1008 } V9fsWalkState;
1009
1010 static void v9fs_walk_complete(V9fsState *s, V9fsWalkState *vs, int err)
1011 {
1012     complete_pdu(s, vs->pdu, err);
1013
1014     if (vs->nwnames) {
1015         for (vs->name_idx = 0; vs->name_idx < vs->nwnames; vs->name_idx++) {
1016             v9fs_string_free(&vs->wnames[vs->name_idx]);
1017         }
1018
1019         qemu_free(vs->wnames);
1020         qemu_free(vs->qids);
1021     }
1022 }
1023
1024 static void v9fs_walk_marshal(V9fsWalkState *vs)
1025 {
1026     int i;
1027     vs->offset = 7;
1028     vs->offset += pdu_marshal(vs->pdu, vs->offset, "w", vs->nwnames);
1029
1030     for (i = 0; i < vs->nwnames; i++) {
1031         vs->offset += pdu_marshal(vs->pdu, vs->offset, "Q", &vs->qids[i]);
1032     }
1033 }
1034
1035 static void v9fs_walk_post_newfid_lstat(V9fsState *s, V9fsWalkState *vs,
1036                                                                 int err)
1037 {
1038     if (err == -1) {
1039         free_fid(s, vs->newfidp->fid);
1040         v9fs_string_free(&vs->path);
1041         err = -ENOENT;
1042         goto out;
1043     }
1044
1045     stat_to_qid(&vs->stbuf, &vs->qids[vs->name_idx]);
1046
1047     vs->name_idx++;
1048     if (vs->name_idx < vs->nwnames) {
1049         v9fs_string_sprintf(&vs->path, "%s/%s", vs->newfidp->path.data,
1050                                             vs->wnames[vs->name_idx].data);
1051         v9fs_string_copy(&vs->newfidp->path, &vs->path);
1052
1053         err = v9fs_do_lstat(s, &vs->newfidp->path, &vs->stbuf);
1054         v9fs_walk_post_newfid_lstat(s, vs, err);
1055         return;
1056     }
1057
1058     v9fs_string_free(&vs->path);
1059     v9fs_walk_marshal(vs);
1060     err = vs->offset;
1061 out:
1062     v9fs_walk_complete(s, vs, err);
1063 }
1064
1065 static void v9fs_walk_post_oldfid_lstat(V9fsState *s, V9fsWalkState *vs,
1066         int err)
1067 {
1068     if (err == -1) {
1069         v9fs_string_free(&vs->path);
1070         err = -ENOENT;
1071         goto out;
1072     }
1073
1074     stat_to_qid(&vs->stbuf, &vs->qids[vs->name_idx]);
1075     vs->name_idx++;
1076     if (vs->name_idx < vs->nwnames) {
1077
1078         v9fs_string_sprintf(&vs->path, "%s/%s",
1079                 vs->fidp->path.data, vs->wnames[vs->name_idx].data);
1080         v9fs_string_copy(&vs->fidp->path, &vs->path);
1081
1082         err = v9fs_do_lstat(s, &vs->fidp->path, &vs->stbuf);
1083         v9fs_walk_post_oldfid_lstat(s, vs, err);
1084         return;
1085     }
1086
1087     v9fs_string_free(&vs->path);
1088     v9fs_walk_marshal(vs);
1089     err = vs->offset;
1090 out:
1091     v9fs_walk_complete(s, vs, err);
1092 }
1093
1094 static void v9fs_walk(V9fsState *s, V9fsPDU *pdu)
1095 {
1096     int32_t fid, newfid;
1097     V9fsWalkState *vs;
1098     int err = 0;
1099     int i;
1100
1101     vs = qemu_malloc(sizeof(*vs));
1102     vs->pdu = pdu;
1103     vs->wnames = NULL;
1104     vs->qids = NULL;
1105     vs->offset = 7;
1106
1107     vs->offset += pdu_unmarshal(vs->pdu, vs->offset, "ddw", &fid,
1108                                             &newfid, &vs->nwnames);
1109
1110     if (vs->nwnames) {
1111         vs->wnames = qemu_mallocz(sizeof(vs->wnames[0]) * vs->nwnames);
1112
1113         vs->qids = qemu_mallocz(sizeof(vs->qids[0]) * vs->nwnames);
1114
1115         for (i = 0; i < vs->nwnames; i++) {
1116             vs->offset += pdu_unmarshal(vs->pdu, vs->offset, "s",
1117                                             &vs->wnames[i]);
1118         }
1119     }
1120
1121     vs->fidp = lookup_fid(s, fid);
1122     if (vs->fidp == NULL) {
1123         err = -ENOENT;
1124         goto out;
1125     }
1126
1127     /* FIXME: is this really valid? */
1128     if (fid == newfid) {
1129
1130         BUG_ON(vs->fidp->fd != -1);
1131         BUG_ON(vs->fidp->dir);
1132         v9fs_string_init(&vs->path);
1133         vs->name_idx = 0;
1134
1135         if (vs->name_idx < vs->nwnames) {
1136             v9fs_string_sprintf(&vs->path, "%s/%s",
1137                 vs->fidp->path.data, vs->wnames[vs->name_idx].data);
1138             v9fs_string_copy(&vs->fidp->path, &vs->path);
1139
1140             err = v9fs_do_lstat(s, &vs->fidp->path, &vs->stbuf);
1141             v9fs_walk_post_oldfid_lstat(s, vs, err);
1142             return;
1143         }
1144     } else {
1145         vs->newfidp = alloc_fid(s, newfid);
1146         if (vs->newfidp == NULL) {
1147             err = -EINVAL;
1148             goto out;
1149         }
1150
1151         vs->newfidp->uid = vs->fidp->uid;
1152         v9fs_string_init(&vs->path);
1153         vs->name_idx = 0;
1154         v9fs_string_copy(&vs->newfidp->path, &vs->fidp->path);
1155
1156         if (vs->name_idx < vs->nwnames) {
1157             v9fs_string_sprintf(&vs->path, "%s/%s", vs->newfidp->path.data,
1158                                 vs->wnames[vs->name_idx].data);
1159             v9fs_string_copy(&vs->newfidp->path, &vs->path);
1160
1161             err = v9fs_do_lstat(s, &vs->newfidp->path, &vs->stbuf);
1162             v9fs_walk_post_newfid_lstat(s, vs, err);
1163             return;
1164         }
1165     }
1166
1167     v9fs_walk_marshal(vs);
1168     err = vs->offset;
1169 out:
1170     v9fs_walk_complete(s, vs, err);
1171 }
1172
1173 typedef struct V9fsOpenState {
1174     V9fsPDU *pdu;
1175     size_t offset;
1176     int8_t mode;
1177     V9fsFidState *fidp;
1178     V9fsQID qid;
1179     struct stat stbuf;
1180
1181 } V9fsOpenState;
1182
1183 enum {
1184     Oread   = 0x00,
1185     Owrite  = 0x01,
1186     Ordwr   = 0x02,
1187     Oexec   = 0x03,
1188     Oexcl   = 0x04,
1189     Otrunc  = 0x10,
1190     Orexec  = 0x20,
1191     Orclose = 0x40,
1192     Oappend = 0x80,
1193 };
1194
1195 static int omode_to_uflags(int8_t mode)
1196 {
1197     int ret = 0;
1198
1199     switch (mode & 3) {
1200     case Oread:
1201         ret = O_RDONLY;
1202         break;
1203     case Ordwr:
1204         ret = O_RDWR;
1205         break;
1206     case Owrite:
1207         ret = O_WRONLY;
1208         break;
1209     case Oexec:
1210         ret = O_RDONLY;
1211         break;
1212     }
1213
1214     if (mode & Otrunc) {
1215         ret |= O_TRUNC;
1216     }
1217
1218     if (mode & Oappend) {
1219         ret |= O_APPEND;
1220     }
1221
1222     if (mode & Oexcl) {
1223         ret |= O_EXCL;
1224     }
1225
1226     return ret;
1227 }
1228
1229 static void v9fs_open_post_opendir(V9fsState *s, V9fsOpenState *vs, int err)
1230 {
1231     if (vs->fidp->dir == NULL) {
1232         err = -errno;
1233         goto out;
1234     }
1235
1236     vs->offset += pdu_marshal(vs->pdu, vs->offset, "Qd", &vs->qid, 0);
1237     err = vs->offset;
1238 out:
1239     complete_pdu(s, vs->pdu, err);
1240     qemu_free(vs);
1241
1242 }
1243
1244 static void v9fs_open_post_open(V9fsState *s, V9fsOpenState *vs, int err)
1245 {
1246     if (vs->fidp->fd == -1) {
1247         err = -errno;
1248         goto out;
1249     }
1250
1251     vs->offset += pdu_marshal(vs->pdu, vs->offset, "Qd", &vs->qid, 0);
1252     err = vs->offset;
1253 out:
1254     complete_pdu(s, vs->pdu, err);
1255     qemu_free(vs);
1256 }
1257
1258 static void v9fs_open_post_lstat(V9fsState *s, V9fsOpenState *vs, int err)
1259 {
1260     if (err) {
1261         err = -errno;
1262         goto out;
1263     }
1264
1265     stat_to_qid(&vs->stbuf, &vs->qid);
1266
1267     if (S_ISDIR(vs->stbuf.st_mode)) {
1268         vs->fidp->dir = v9fs_do_opendir(s, &vs->fidp->path);
1269         v9fs_open_post_opendir(s, vs, err);
1270     } else {
1271         vs->fidp->fd = v9fs_do_open(s, &vs->fidp->path,
1272                                     omode_to_uflags(vs->mode));
1273         v9fs_open_post_open(s, vs, err);
1274     }
1275     return;
1276 out:
1277     complete_pdu(s, vs->pdu, err);
1278     qemu_free(vs);
1279 }
1280
1281 static void v9fs_open(V9fsState *s, V9fsPDU *pdu)
1282 {
1283     int32_t fid;
1284     V9fsOpenState *vs;
1285     ssize_t err = 0;
1286
1287
1288     vs = qemu_malloc(sizeof(*vs));
1289     vs->pdu = pdu;
1290     vs->offset = 7;
1291
1292     pdu_unmarshal(vs->pdu, vs->offset, "db", &fid, &vs->mode);
1293
1294     vs->fidp = lookup_fid(s, fid);
1295     if (vs->fidp == NULL) {
1296         err = -ENOENT;
1297         goto out;
1298     }
1299
1300     BUG_ON(vs->fidp->fd != -1);
1301     BUG_ON(vs->fidp->dir);
1302
1303     err = v9fs_do_lstat(s, &vs->fidp->path, &vs->stbuf);
1304
1305     v9fs_open_post_lstat(s, vs, err);
1306     return;
1307 out:
1308     complete_pdu(s, pdu, err);
1309     qemu_free(vs);
1310 }
1311
1312 static void v9fs_clunk(V9fsState *s, V9fsPDU *pdu)
1313 {
1314     if (debug_9p_pdu) {
1315         pprint_pdu(pdu);
1316     }
1317 }
1318
1319 typedef struct V9fsReadState {
1320     V9fsPDU *pdu;
1321     size_t offset;
1322     int32_t count;
1323     int32_t total;
1324     int64_t off;
1325     V9fsFidState *fidp;
1326     struct iovec iov[128]; /* FIXME: bad, bad, bad */
1327     struct iovec *sg;
1328     off_t dir_pos;
1329     struct dirent *dent;
1330     struct stat stbuf;
1331     V9fsString name;
1332     V9fsStat v9stat;
1333     int32_t len;
1334     int32_t cnt;
1335     int32_t max_count;
1336 } V9fsReadState;
1337
1338 static void v9fs_read_post_readdir(V9fsState *, V9fsReadState *, ssize_t);
1339
1340 static void v9fs_read_post_seekdir(V9fsState *s, V9fsReadState *vs, ssize_t err)
1341 {
1342     if (err) {
1343         goto out;
1344     }
1345     v9fs_stat_free(&vs->v9stat);
1346     v9fs_string_free(&vs->name);
1347     vs->offset += pdu_marshal(vs->pdu, vs->offset, "d", vs->count);
1348     vs->offset += vs->count;
1349     err = vs->offset;
1350 out:
1351     complete_pdu(s, vs->pdu, err);
1352     qemu_free(vs);
1353     return;
1354 }
1355
1356 static void v9fs_read_post_dir_lstat(V9fsState *s, V9fsReadState *vs,
1357                                     ssize_t err)
1358 {
1359     if (err) {
1360         err = -errno;
1361         goto out;
1362     }
1363     err = stat_to_v9stat(s, &vs->name, &vs->stbuf, &vs->v9stat);
1364     if (err) {
1365         goto out;
1366     }
1367
1368     vs->len = pdu_marshal(vs->pdu, vs->offset + 4 + vs->count, "S",
1369                             &vs->v9stat);
1370     if ((vs->len != (vs->v9stat.size + 2)) ||
1371             ((vs->count + vs->len) > vs->max_count)) {
1372         v9fs_do_seekdir(s, vs->fidp->dir, vs->dir_pos);
1373         v9fs_read_post_seekdir(s, vs, err);
1374         return;
1375     }
1376     vs->count += vs->len;
1377     v9fs_stat_free(&vs->v9stat);
1378     v9fs_string_free(&vs->name);
1379     vs->dir_pos = vs->dent->d_off;
1380     vs->dent = v9fs_do_readdir(s, vs->fidp->dir);
1381     v9fs_read_post_readdir(s, vs, err);
1382     return;
1383 out:
1384     v9fs_do_seekdir(s, vs->fidp->dir, vs->dir_pos);
1385     v9fs_read_post_seekdir(s, vs, err);
1386     return;
1387
1388 }
1389
1390 static void v9fs_read_post_readdir(V9fsState *s, V9fsReadState *vs, ssize_t err)
1391 {
1392     if (vs->dent) {
1393         memset(&vs->v9stat, 0, sizeof(vs->v9stat));
1394         v9fs_string_init(&vs->name);
1395         v9fs_string_sprintf(&vs->name, "%s/%s", vs->fidp->path.data,
1396                             vs->dent->d_name);
1397         err = v9fs_do_lstat(s, &vs->name, &vs->stbuf);
1398         v9fs_read_post_dir_lstat(s, vs, err);
1399         return;
1400     }
1401
1402     vs->offset += pdu_marshal(vs->pdu, vs->offset, "d", vs->count);
1403     vs->offset += vs->count;
1404     err = vs->offset;
1405     complete_pdu(s, vs->pdu, err);
1406     qemu_free(vs);
1407     return;
1408 }
1409
1410 static void v9fs_read_post_telldir(V9fsState *s, V9fsReadState *vs, ssize_t err)
1411 {
1412     vs->dent = v9fs_do_readdir(s, vs->fidp->dir);
1413     v9fs_read_post_readdir(s, vs, err);
1414     return;
1415 }
1416
1417 static void v9fs_read_post_rewinddir(V9fsState *s, V9fsReadState *vs,
1418                                        ssize_t err)
1419 {
1420     vs->dir_pos = v9fs_do_telldir(s, vs->fidp->dir);
1421     v9fs_read_post_telldir(s, vs, err);
1422     return;
1423 }
1424
1425 static void v9fs_read_post_readv(V9fsState *s, V9fsReadState *vs, ssize_t err)
1426 {
1427     if (err  < 0) {
1428         /* IO error return the error */
1429         err = -errno;
1430         goto out;
1431     }
1432     vs->total += vs->len;
1433     vs->sg = adjust_sg(vs->sg, vs->len, &vs->cnt);
1434     if (vs->total < vs->count && vs->len > 0) {
1435         do {
1436             if (0) {
1437                 print_sg(vs->sg, vs->cnt);
1438             }
1439             vs->len = v9fs_do_readv(s, vs->fidp->fd, vs->sg, vs->cnt);
1440         } while (vs->len == -1 && errno == EINTR);
1441         if (vs->len == -1) {
1442             err  = -errno;
1443         }
1444         v9fs_read_post_readv(s, vs, err);
1445         return;
1446     }
1447     vs->offset += pdu_marshal(vs->pdu, vs->offset, "d", vs->total);
1448     vs->offset += vs->count;
1449     err = vs->offset;
1450
1451 out:
1452     complete_pdu(s, vs->pdu, err);
1453     qemu_free(vs);
1454 }
1455
1456 static void v9fs_read_post_lseek(V9fsState *s, V9fsReadState *vs, ssize_t err)
1457 {
1458     if (err == -1) {
1459         err = -errno;
1460         goto out;
1461     }
1462     vs->sg = cap_sg(vs->sg, vs->count, &vs->cnt);
1463
1464     if (vs->total < vs->count) {
1465         do {
1466             if (0) {
1467                 print_sg(vs->sg, vs->cnt);
1468             }
1469             vs->len = v9fs_do_readv(s, vs->fidp->fd, vs->sg, vs->cnt);
1470         } while (vs->len == -1 && errno == EINTR);
1471         if (vs->len == -1) {
1472             err  = -errno;
1473         }
1474         v9fs_read_post_readv(s, vs, err);
1475         return;
1476     }
1477 out:
1478     complete_pdu(s, vs->pdu, err);
1479     qemu_free(vs);
1480 }
1481
1482 static void v9fs_read(V9fsState *s, V9fsPDU *pdu)
1483 {
1484     int32_t fid;
1485     V9fsReadState *vs;
1486     ssize_t err = 0;
1487
1488     vs = qemu_malloc(sizeof(*vs));
1489     vs->pdu = pdu;
1490     vs->offset = 7;
1491     vs->total = 0;
1492     vs->len = 0;
1493     vs->count = 0;
1494
1495     pdu_unmarshal(vs->pdu, vs->offset, "dqd", &fid, &vs->off, &vs->count);
1496
1497     vs->fidp = lookup_fid(s, fid);
1498     if (vs->fidp == NULL) {
1499         err = -EINVAL;
1500         goto out;
1501     }
1502
1503     if (vs->fidp->dir) {
1504         vs->max_count = vs->count;
1505         vs->count = 0;
1506         if (vs->off == 0) {
1507             v9fs_do_rewinddir(s, vs->fidp->dir);
1508         }
1509         v9fs_read_post_rewinddir(s, vs, err);
1510         return;
1511     } else if (vs->fidp->fd != -1) {
1512         vs->sg = vs->iov;
1513         pdu_marshal(vs->pdu, vs->offset + 4, "v", vs->sg, &vs->cnt);
1514         err = v9fs_do_lseek(s, vs->fidp->fd, vs->off, SEEK_SET);
1515         v9fs_read_post_lseek(s, vs, err);
1516         return;
1517     } else {
1518         err = -EINVAL;
1519     }
1520 out:
1521     complete_pdu(s, pdu, err);
1522     qemu_free(vs);
1523 }
1524
1525 static void v9fs_write(V9fsState *s, V9fsPDU *pdu)
1526 {
1527     if (debug_9p_pdu) {
1528         pprint_pdu(pdu);
1529     }
1530 }
1531
1532 static void v9fs_create(V9fsState *s, V9fsPDU *pdu)
1533 {
1534     if (debug_9p_pdu) {
1535         pprint_pdu(pdu);
1536     }
1537 }
1538
1539 static void v9fs_flush(V9fsState *s, V9fsPDU *pdu)
1540 {
1541     v9fs_dummy(s, pdu);
1542     if (debug_9p_pdu) {
1543         pprint_pdu(pdu);
1544     }
1545 }
1546
1547 static void v9fs_remove(V9fsState *s, V9fsPDU *pdu)
1548 {
1549     if (debug_9p_pdu) {
1550         pprint_pdu(pdu);
1551     }
1552 }
1553
1554 static void v9fs_wstat(V9fsState *s, V9fsPDU *pdu)
1555 {
1556     if (debug_9p_pdu) {
1557         pprint_pdu(pdu);
1558     }
1559 }
1560
1561 typedef void (pdu_handler_t)(V9fsState *s, V9fsPDU *pdu);
1562
1563 static pdu_handler_t *pdu_handlers[] = {
1564     [P9_TVERSION] = v9fs_version,
1565     [P9_TATTACH] = v9fs_attach,
1566     [P9_TSTAT] = v9fs_stat,
1567     [P9_TWALK] = v9fs_walk,
1568     [P9_TCLUNK] = v9fs_clunk,
1569     [P9_TOPEN] = v9fs_open,
1570     [P9_TREAD] = v9fs_read,
1571 #if 0
1572     [P9_TAUTH] = v9fs_auth,
1573 #endif
1574     [P9_TFLUSH] = v9fs_flush,
1575     [P9_TCREATE] = v9fs_create,
1576     [P9_TWRITE] = v9fs_write,
1577     [P9_TWSTAT] = v9fs_wstat,
1578     [P9_TREMOVE] = v9fs_remove,
1579 };
1580
1581 static void submit_pdu(V9fsState *s, V9fsPDU *pdu)
1582 {
1583     pdu_handler_t *handler;
1584
1585     if (debug_9p_pdu) {
1586         pprint_pdu(pdu);
1587     }
1588
1589     BUG_ON(pdu->id >= ARRAY_SIZE(pdu_handlers));
1590
1591     handler = pdu_handlers[pdu->id];
1592     BUG_ON(handler == NULL);
1593
1594     handler(s, pdu);
1595 }
1596
1597 static void handle_9p_output(VirtIODevice *vdev, VirtQueue *vq)
1598 {
1599     V9fsState *s = (V9fsState *)vdev;
1600     V9fsPDU *pdu;
1601     ssize_t len;
1602
1603     while ((pdu = alloc_pdu(s)) &&
1604             (len = virtqueue_pop(vq, &pdu->elem)) != 0) {
1605         uint8_t *ptr;
1606
1607         BUG_ON(pdu->elem.out_num == 0 || pdu->elem.in_num == 0);
1608         BUG_ON(pdu->elem.out_sg[0].iov_len < 7);
1609
1610         ptr = pdu->elem.out_sg[0].iov_base;
1611
1612         memcpy(&pdu->size, ptr, 4);
1613         pdu->id = ptr[4];
1614         memcpy(&pdu->tag, ptr + 5, 2);
1615
1616         submit_pdu(s, pdu);
1617     }
1618
1619     free_pdu(s, pdu);
1620 }
1621
1622 static uint32_t virtio_9p_get_features(VirtIODevice *vdev, uint32_t features)
1623 {
1624     features |= 1 << VIRTIO_9P_MOUNT_TAG;
1625     return features;
1626 }
1627
1628 static V9fsState *to_virtio_9p(VirtIODevice *vdev)
1629 {
1630     return (V9fsState *)vdev;
1631 }
1632
1633 static void virtio_9p_get_config(VirtIODevice *vdev, uint8_t *config)
1634 {
1635     struct virtio_9p_config *cfg;
1636     V9fsState *s = to_virtio_9p(vdev);
1637
1638     cfg = qemu_mallocz(sizeof(struct virtio_9p_config) +
1639                         s->tag_len);
1640     stw_raw(&cfg->tag_len, s->tag_len);
1641     memcpy(cfg->tag, s->tag, s->tag_len);
1642     memcpy(config, cfg, s->config_size);
1643     qemu_free(cfg);
1644 }
1645
1646 VirtIODevice *virtio_9p_init(DeviceState *dev, V9fsConf *conf)
1647  {
1648     V9fsState *s;
1649     int i, len;
1650     struct stat stat;
1651     FsTypeEntry *fse;
1652
1653
1654     s = (V9fsState *)virtio_common_init("virtio-9p",
1655                                     VIRTIO_ID_9P,
1656                                     sizeof(struct virtio_9p_config)+
1657                                     MAX_TAG_LEN,
1658                                     sizeof(V9fsState));
1659
1660     /* initialize pdu allocator */
1661     QLIST_INIT(&s->free_list);
1662     for (i = 0; i < (MAX_REQ - 1); i++) {
1663         QLIST_INSERT_HEAD(&s->free_list, &s->pdus[i], next);
1664     }
1665
1666     s->vq = virtio_add_queue(&s->vdev, MAX_REQ, handle_9p_output);
1667
1668     fse = get_fsdev_fsentry(conf->fsdev_id);
1669
1670     if (!fse) {
1671         /* We don't have a fsdev identified by fsdev_id */
1672         fprintf(stderr, "Virtio-9p device couldn't find fsdev "
1673                     "with the id %s\n", conf->fsdev_id);
1674         exit(1);
1675     }
1676
1677     if (!fse->path || !conf->tag) {
1678         /* we haven't specified a mount_tag or the path */
1679         fprintf(stderr, "fsdev with id %s needs path "
1680                 "and Virtio-9p device needs mount_tag arguments\n",
1681                 conf->fsdev_id);
1682         exit(1);
1683     }
1684
1685     if (lstat(fse->path, &stat)) {
1686         fprintf(stderr, "share path %s does not exist\n", fse->path);
1687         exit(1);
1688     } else if (!S_ISDIR(stat.st_mode)) {
1689         fprintf(stderr, "share path %s is not a directory \n", fse->path);
1690         exit(1);
1691     }
1692
1693     s->ctx.fs_root = qemu_strdup(fse->path);
1694     len = strlen(conf->tag);
1695     if (len > MAX_TAG_LEN) {
1696         len = MAX_TAG_LEN;
1697     }
1698     /* s->tag is non-NULL terminated string */
1699     s->tag = qemu_malloc(len);
1700     memcpy(s->tag, conf->tag, len);
1701     s->tag_len = len;
1702     s->ctx.uid = -1;
1703
1704     s->ops = fse->ops;
1705     s->vdev.get_features = virtio_9p_get_features;
1706     s->config_size = sizeof(struct virtio_9p_config) +
1707                         s->tag_len;
1708     s->vdev.get_config = virtio_9p_get_config;
1709
1710     return &s->vdev;
1711 }