virtio-net: fix buffer overflow on invalid state load
[qemu/cris-port.git] / include / hw / virtio / virtio-net.h
blob4b32440837cfc5aac05023142ccf7db063cd76e6
1 /*
2 * Virtio Network Device
4 * Copyright IBM, Corp. 2007
6 * Authors:
7 * Anthony Liguori <aliguori@us.ibm.com>
9 * This work is licensed under the terms of the GNU GPL, version 2. See
10 * the COPYING file in the top-level directory.
14 #ifndef _QEMU_VIRTIO_NET_H
15 #define _QEMU_VIRTIO_NET_H
17 #include "hw/virtio/virtio.h"
18 #include "hw/pci/pci.h"
20 #define TYPE_VIRTIO_NET "virtio-net-device"
21 #define VIRTIO_NET(obj) \
22 OBJECT_CHECK(VirtIONet, (obj), TYPE_VIRTIO_NET)
24 #define ETH_ALEN 6
26 /* from Linux's virtio_net.h */
28 /* The ID for virtio_net */
29 #define VIRTIO_ID_NET 1
31 /* The feature bitmap for virtio net */
32 #define VIRTIO_NET_F_CSUM 0 /* Host handles pkts w/ partial csum */
33 #define VIRTIO_NET_F_GUEST_CSUM 1 /* Guest handles pkts w/ partial csum */
34 #define VIRTIO_NET_F_CTRL_GUEST_OFFLOADS 2 /* Control channel offload
35 * configuration support */
36 #define VIRTIO_NET_F_MAC 5 /* Host has given MAC address. */
37 #define VIRTIO_NET_F_GSO 6 /* Host handles pkts w/ any GSO type */
38 #define VIRTIO_NET_F_GUEST_TSO4 7 /* Guest can handle TSOv4 in. */
39 #define VIRTIO_NET_F_GUEST_TSO6 8 /* Guest can handle TSOv6 in. */
40 #define VIRTIO_NET_F_GUEST_ECN 9 /* Guest can handle TSO[6] w/ ECN in. */
41 #define VIRTIO_NET_F_GUEST_UFO 10 /* Guest can handle UFO in. */
42 #define VIRTIO_NET_F_HOST_TSO4 11 /* Host can handle TSOv4 in. */
43 #define VIRTIO_NET_F_HOST_TSO6 12 /* Host can handle TSOv6 in. */
44 #define VIRTIO_NET_F_HOST_ECN 13 /* Host can handle TSO[6] w/ ECN in. */
45 #define VIRTIO_NET_F_HOST_UFO 14 /* Host can handle UFO in. */
46 #define VIRTIO_NET_F_MRG_RXBUF 15 /* Host can merge receive buffers. */
47 #define VIRTIO_NET_F_STATUS 16 /* virtio_net_config.status available */
48 #define VIRTIO_NET_F_CTRL_VQ 17 /* Control channel available */
49 #define VIRTIO_NET_F_CTRL_RX 18 /* Control channel RX mode support */
50 #define VIRTIO_NET_F_CTRL_VLAN 19 /* Control channel VLAN filtering */
51 #define VIRTIO_NET_F_CTRL_RX_EXTRA 20 /* Extra RX mode control support */
52 #define VIRTIO_NET_F_MQ 22 /* Device supports Receive Flow
53 * Steering */
55 #define VIRTIO_NET_F_CTRL_MAC_ADDR 23 /* Set MAC address */
57 #define VIRTIO_NET_S_LINK_UP 1 /* Link is up */
59 #define TX_TIMER_INTERVAL 150000 /* 150 us */
61 /* Limit the number of packets that can be sent via a single flush
62 * of the TX queue. This gives us a guaranteed exit condition and
63 * ensures fairness in the io path. 256 conveniently matches the
64 * length of the TX queue and shows a good balance of performance
65 * and latency. */
66 #define TX_BURST 256
68 typedef struct virtio_net_conf
70 uint32_t txtimer;
71 int32_t txburst;
72 char *tx;
73 } virtio_net_conf;
75 /* Maximum packet size we can receive from tap device: header + 64k */
76 #define VIRTIO_NET_MAX_BUFSIZE (sizeof(struct virtio_net_hdr) + (64 << 10))
78 struct virtio_net_config
80 /* The config defining mac address ($ETH_ALEN bytes) */
81 uint8_t mac[ETH_ALEN];
82 /* See VIRTIO_NET_F_STATUS and VIRTIO_NET_S_* above */
83 uint16_t status;
84 /* Max virtqueue pairs supported by the device */
85 uint16_t max_virtqueue_pairs;
86 } QEMU_PACKED;
89 * Control virtqueue data structures
91 * The control virtqueue expects a header in the first sg entry
92 * and an ack/status response in the last entry. Data for the
93 * command goes in between.
95 struct virtio_net_ctrl_hdr {
96 uint8_t class;
97 uint8_t cmd;
100 typedef uint8_t virtio_net_ctrl_ack;
102 #define VIRTIO_NET_OK 0
103 #define VIRTIO_NET_ERR 1
106 * Control the RX mode, ie. promisucous, allmulti, etc...
107 * All commands require an "out" sg entry containing a 1 byte
108 * state value, zero = disable, non-zero = enable. Commands
109 * 0 and 1 are supported with the VIRTIO_NET_F_CTRL_RX feature.
110 * Commands 2-5 are added with VIRTIO_NET_F_CTRL_RX_EXTRA.
112 #define VIRTIO_NET_CTRL_RX 0
113 #define VIRTIO_NET_CTRL_RX_PROMISC 0
114 #define VIRTIO_NET_CTRL_RX_ALLMULTI 1
115 #define VIRTIO_NET_CTRL_RX_ALLUNI 2
116 #define VIRTIO_NET_CTRL_RX_NOMULTI 3
117 #define VIRTIO_NET_CTRL_RX_NOUNI 4
118 #define VIRTIO_NET_CTRL_RX_NOBCAST 5
121 * Control the MAC
123 * The MAC filter table is managed by the hypervisor, the guest should
124 * assume the size is infinite. Filtering should be considered
125 * non-perfect, ie. based on hypervisor resources, the guest may
126 * received packets from sources not specified in the filter list.
128 * In addition to the class/cmd header, the TABLE_SET command requires
129 * two out scatterlists. Each contains a 4 byte count of entries followed
130 * by a concatenated byte stream of the ETH_ALEN MAC addresses. The
131 * first sg list contains unicast addresses, the second is for multicast.
132 * This functionality is present if the VIRTIO_NET_F_CTRL_RX feature
133 * is available.
135 * The ADDR_SET command requests one out scatterlist, it contains a
136 * 6 bytes MAC address. This functionality is present if the
137 * VIRTIO_NET_F_CTRL_MAC_ADDR feature is available.
139 struct virtio_net_ctrl_mac {
140 uint32_t entries;
141 uint8_t macs[][ETH_ALEN];
144 typedef struct VirtIONetQueue {
145 VirtQueue *rx_vq;
146 VirtQueue *tx_vq;
147 QEMUTimer *tx_timer;
148 QEMUBH *tx_bh;
149 int tx_waiting;
150 struct {
151 VirtQueueElement elem;
152 ssize_t len;
153 } async_tx;
154 struct VirtIONet *n;
155 } VirtIONetQueue;
157 typedef struct VirtIONet {
158 VirtIODevice parent_obj;
159 uint8_t mac[ETH_ALEN];
160 uint16_t status;
161 VirtIONetQueue *vqs;
162 VirtQueue *ctrl_vq;
163 NICState *nic;
164 uint32_t tx_timeout;
165 int32_t tx_burst;
166 uint32_t has_vnet_hdr;
167 size_t host_hdr_len;
168 size_t guest_hdr_len;
169 uint8_t has_ufo;
170 int mergeable_rx_bufs;
171 uint8_t promisc;
172 uint8_t allmulti;
173 uint8_t alluni;
174 uint8_t nomulti;
175 uint8_t nouni;
176 uint8_t nobcast;
177 uint8_t vhost_started;
178 struct {
179 uint32_t in_use;
180 uint32_t first_multi;
181 uint8_t multi_overflow;
182 uint8_t uni_overflow;
183 uint8_t *macs;
184 } mac_table;
185 uint32_t *vlans;
186 virtio_net_conf net_conf;
187 NICConf nic_conf;
188 DeviceState *qdev;
189 int multiqueue;
190 uint16_t max_queues;
191 uint16_t curr_queues;
192 size_t config_size;
193 char *netclient_name;
194 char *netclient_type;
195 uint64_t curr_guest_offloads;
196 } VirtIONet;
198 #define VIRTIO_NET_CTRL_MAC 1
199 #define VIRTIO_NET_CTRL_MAC_TABLE_SET 0
200 #define VIRTIO_NET_CTRL_MAC_ADDR_SET 1
203 * Control VLAN filtering
205 * The VLAN filter table is controlled via a simple ADD/DEL interface.
206 * VLAN IDs not added may be filterd by the hypervisor. Del is the
207 * opposite of add. Both commands expect an out entry containing a 2
208 * byte VLAN ID. VLAN filterting is available with the
209 * VIRTIO_NET_F_CTRL_VLAN feature bit.
211 #define VIRTIO_NET_CTRL_VLAN 2
212 #define VIRTIO_NET_CTRL_VLAN_ADD 0
213 #define VIRTIO_NET_CTRL_VLAN_DEL 1
216 * Control Multiqueue
218 * The command VIRTIO_NET_CTRL_MQ_VQ_PAIRS_SET
219 * enables multiqueue, specifying the number of the transmit and
220 * receive queues that will be used. After the command is consumed and acked by
221 * the device, the device will not steer new packets on receive virtqueues
222 * other than specified nor read from transmit virtqueues other than specified.
223 * Accordingly, driver should not transmit new packets on virtqueues other than
224 * specified.
226 struct virtio_net_ctrl_mq {
227 uint16_t virtqueue_pairs;
230 #define VIRTIO_NET_CTRL_MQ 4
231 #define VIRTIO_NET_CTRL_MQ_VQ_PAIRS_SET 0
232 #define VIRTIO_NET_CTRL_MQ_VQ_PAIRS_MIN 1
233 #define VIRTIO_NET_CTRL_MQ_VQ_PAIRS_MAX 0x8000
236 * Control network offloads
238 * Dynamic offloads are available with the
239 * VIRTIO_NET_F_CTRL_GUEST_OFFLOADS feature bit.
241 #define VIRTIO_NET_CTRL_GUEST_OFFLOADS 5
242 #define VIRTIO_NET_CTRL_GUEST_OFFLOADS_SET 0
244 #define DEFINE_VIRTIO_NET_FEATURES(_state, _field) \
245 DEFINE_VIRTIO_COMMON_FEATURES(_state, _field), \
246 DEFINE_PROP_BIT("any_layout", _state, _field, VIRTIO_F_ANY_LAYOUT, true), \
247 DEFINE_PROP_BIT("csum", _state, _field, VIRTIO_NET_F_CSUM, true), \
248 DEFINE_PROP_BIT("guest_csum", _state, _field, VIRTIO_NET_F_GUEST_CSUM, true), \
249 DEFINE_PROP_BIT("gso", _state, _field, VIRTIO_NET_F_GSO, true), \
250 DEFINE_PROP_BIT("guest_tso4", _state, _field, VIRTIO_NET_F_GUEST_TSO4, true), \
251 DEFINE_PROP_BIT("guest_tso6", _state, _field, VIRTIO_NET_F_GUEST_TSO6, true), \
252 DEFINE_PROP_BIT("guest_ecn", _state, _field, VIRTIO_NET_F_GUEST_ECN, true), \
253 DEFINE_PROP_BIT("guest_ufo", _state, _field, VIRTIO_NET_F_GUEST_UFO, true), \
254 DEFINE_PROP_BIT("host_tso4", _state, _field, VIRTIO_NET_F_HOST_TSO4, true), \
255 DEFINE_PROP_BIT("host_tso6", _state, _field, VIRTIO_NET_F_HOST_TSO6, true), \
256 DEFINE_PROP_BIT("host_ecn", _state, _field, VIRTIO_NET_F_HOST_ECN, true), \
257 DEFINE_PROP_BIT("host_ufo", _state, _field, VIRTIO_NET_F_HOST_UFO, true), \
258 DEFINE_PROP_BIT("mrg_rxbuf", _state, _field, VIRTIO_NET_F_MRG_RXBUF, true), \
259 DEFINE_PROP_BIT("status", _state, _field, VIRTIO_NET_F_STATUS, true), \
260 DEFINE_PROP_BIT("ctrl_vq", _state, _field, VIRTIO_NET_F_CTRL_VQ, true), \
261 DEFINE_PROP_BIT("ctrl_rx", _state, _field, VIRTIO_NET_F_CTRL_RX, true), \
262 DEFINE_PROP_BIT("ctrl_vlan", _state, _field, VIRTIO_NET_F_CTRL_VLAN, true), \
263 DEFINE_PROP_BIT("ctrl_rx_extra", _state, _field, VIRTIO_NET_F_CTRL_RX_EXTRA, true), \
264 DEFINE_PROP_BIT("ctrl_mac_addr", _state, _field, VIRTIO_NET_F_CTRL_MAC_ADDR, true), \
265 DEFINE_PROP_BIT("ctrl_guest_offloads", _state, _field, VIRTIO_NET_F_CTRL_GUEST_OFFLOADS, true), \
266 DEFINE_PROP_BIT("mq", _state, _field, VIRTIO_NET_F_MQ, false)
268 #define DEFINE_VIRTIO_NET_PROPERTIES(_state, _field) \
269 DEFINE_PROP_UINT32("x-txtimer", _state, _field.txtimer, TX_TIMER_INTERVAL),\
270 DEFINE_PROP_INT32("x-txburst", _state, _field.txburst, TX_BURST), \
271 DEFINE_PROP_STRING("tx", _state, _field.tx)
273 void virtio_net_set_config_size(VirtIONet *n, uint32_t host_features);
274 void virtio_net_set_netclient_name(VirtIONet *n, const char *name,
275 const char *type);
277 #endif