netback.c 53.4 KB
Newer Older
I
Ian Campbell 已提交
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39
/*
 * Back-end of the driver for virtual network devices. This portion of the
 * driver exports a 'unified' network-device interface that can be accessed
 * by any operating system that implements a compatible front end. A
 * reference front-end implementation can be found in:
 *  drivers/net/xen-netfront.c
 *
 * Copyright (c) 2002-2005, K A Fraser
 *
 * This program is free software; you can redistribute it and/or
 * modify it under the terms of the GNU General Public License version 2
 * as published by the Free Software Foundation; or, when distributed
 * separately from the Linux kernel or incorporated into other
 * software packages, subject to the following license:
 *
 * Permission is hereby granted, free of charge, to any person obtaining a copy
 * of this source file (the "Software"), to deal in the Software without
 * restriction, including without limitation the rights to use, copy, modify,
 * merge, publish, distribute, sublicense, and/or sell copies of the Software,
 * and to permit persons to whom the Software is furnished to do so, subject to
 * the following conditions:
 *
 * The above copyright notice and this permission notice shall be included in
 * all copies or substantial portions of the Software.
 *
 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
 * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
 * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS
 * IN THE SOFTWARE.
 */

#include "common.h"

#include <linux/kthread.h>
#include <linux/if_vlan.h>
#include <linux/udp.h>
40
#include <linux/highmem.h>
I
Ian Campbell 已提交
41 42 43

#include <net/tcp.h>

S
Stefano Stabellini 已提交
44
#include <xen/xen.h>
I
Ian Campbell 已提交
45 46
#include <xen/events.h>
#include <xen/interface/memory.h>
47
#include <xen/page.h>
I
Ian Campbell 已提交
48 49 50

#include <asm/xen/hypercall.h>

51 52 53 54
/* Provide an option to disable split event channels at load time as
 * event channels are limited resource. Split event channels are
 * enabled by default.
 */
55
bool separate_tx_rx_irq = true;
56 57
module_param(separate_tx_rx_irq, bool, 0644);

58 59
/* The time that packets can stay on the guest Rx internal queue
 * before they are dropped.
60 61 62 63
 */
unsigned int rx_drain_timeout_msecs = 10000;
module_param(rx_drain_timeout_msecs, uint, 0444);

64 65 66
/* The length of time before the frontend is considered unresponsive
 * because it isn't providing Rx slots.
 */
67
unsigned int rx_stall_timeout_msecs = 60000;
68 69
module_param(rx_stall_timeout_msecs, uint, 0444);

70 71 72 73 74
unsigned int xenvif_max_queues;
module_param_named(max_queues, xenvif_max_queues, uint, 0644);
MODULE_PARM_DESC(max_queues,
		 "Maximum number of queues per virtual interface");

75 76 77 78
/*
 * This is the maximum slots a skb can have. If a guest sends a skb
 * which exceeds this limit it is considered malicious.
 */
79 80 81 82
#define FATAL_SKB_SLOTS_DEFAULT 20
static unsigned int fatal_skb_slots = FATAL_SKB_SLOTS_DEFAULT;
module_param(fatal_skb_slots, uint, 0444);

83 84 85 86 87 88 89 90 91 92
/* The amount to copy out of the first guest Tx slot into the skb's
 * linear area.  If the first slot has more data, it will be mapped
 * and put into the first frag.
 *
 * This is sized to avoid pulling headers from the frags for most
 * TCP/IP packets.
 */
#define XEN_NETBACK_TX_COPY_LEN 128


93
static void xenvif_idx_release(struct xenvif_queue *queue, u16 pending_idx,
W
Wei Liu 已提交
94 95
			       u8 status);

96
static void make_tx_response(struct xenvif_queue *queue,
I
Ian Campbell 已提交
97 98
			     struct xen_netif_tx_request *txp,
			     s8       st);
99
static void push_tx_responses(struct xenvif_queue *queue);
100

101
static inline int tx_work_todo(struct xenvif_queue *queue);
102

103
static struct xen_netif_rx_response *make_rx_response(struct xenvif_queue *queue,
I
Ian Campbell 已提交
104 105 106 107 108 109
					     u16      id,
					     s8       st,
					     u16      offset,
					     u16      size,
					     u16      flags);

110
static inline unsigned long idx_to_pfn(struct xenvif_queue *queue,
111
				       u16 idx)
I
Ian Campbell 已提交
112
{
113
	return page_to_pfn(queue->mmap_pages[idx]);
I
Ian Campbell 已提交
114 115
}

116
static inline unsigned long idx_to_kaddr(struct xenvif_queue *queue,
117
					 u16 idx)
I
Ian Campbell 已提交
118
{
119
	return (unsigned long)pfn_to_kaddr(idx_to_pfn(queue, idx));
I
Ian Campbell 已提交
120 121
}

122 123 124
#define callback_param(vif, pending_idx) \
	(vif->pending_tx_info[pending_idx].callback_struct)

125 126
/* Find the containing VIF's structure from a pointer in pending_tx_info array
 */
127
static inline struct xenvif_queue *ubuf_to_queue(const struct ubuf_info *ubuf)
128
{
129 130 131 132
	u16 pending_idx = ubuf->desc;
	struct pending_tx_info *temp =
		container_of(ubuf, struct pending_tx_info, callback_struct);
	return container_of(temp - pending_idx,
133
			    struct xenvif_queue,
134
			    pending_tx_info[0]);
135
}
136

137 138 139 140 141 142 143 144 145 146
static u16 frag_get_pending_idx(skb_frag_t *frag)
{
	return (u16)frag->page_offset;
}

static void frag_set_pending_idx(skb_frag_t *frag, u16 pending_idx)
{
	frag->page_offset = pending_idx;
}

I
Ian Campbell 已提交
147 148 149 150 151
static inline pending_ring_idx_t pending_index(unsigned i)
{
	return i & (MAX_PENDING_REQS-1);
}

152
bool xenvif_rx_ring_slots_available(struct xenvif_queue *queue, int needed)
I
Ian Campbell 已提交
153
{
154
	RING_IDX prod, cons;
I
Ian Campbell 已提交
155

156
	do {
157 158
		prod = queue->rx.sring->req_prod;
		cons = queue->rx.req_cons;
I
Ian Campbell 已提交
159

160 161
		if (prod - cons >= needed)
			return true;
I
Ian Campbell 已提交
162

163
		queue->rx.sring->req_event = prod + 1;
I
Ian Campbell 已提交
164

165 166 167 168
		/* Make sure event is visible before we check prod
		 * again.
		 */
		mb();
169
	} while (queue->rx.sring->req_prod != prod);
I
Ian Campbell 已提交
170

171
	return false;
I
Ian Campbell 已提交
172 173
}

174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236
void xenvif_rx_queue_tail(struct xenvif_queue *queue, struct sk_buff *skb)
{
	unsigned long flags;

	spin_lock_irqsave(&queue->rx_queue.lock, flags);

	__skb_queue_tail(&queue->rx_queue, skb);

	queue->rx_queue_len += skb->len;
	if (queue->rx_queue_len > queue->rx_queue_max)
		netif_tx_stop_queue(netdev_get_tx_queue(queue->vif->dev, queue->id));

	spin_unlock_irqrestore(&queue->rx_queue.lock, flags);
}

static struct sk_buff *xenvif_rx_dequeue(struct xenvif_queue *queue)
{
	struct sk_buff *skb;

	spin_lock_irq(&queue->rx_queue.lock);

	skb = __skb_dequeue(&queue->rx_queue);
	if (skb)
		queue->rx_queue_len -= skb->len;

	spin_unlock_irq(&queue->rx_queue.lock);

	return skb;
}

static void xenvif_rx_queue_maybe_wake(struct xenvif_queue *queue)
{
	spin_lock_irq(&queue->rx_queue.lock);

	if (queue->rx_queue_len < queue->rx_queue_max)
		netif_tx_wake_queue(netdev_get_tx_queue(queue->vif->dev, queue->id));

	spin_unlock_irq(&queue->rx_queue.lock);
}


static void xenvif_rx_queue_purge(struct xenvif_queue *queue)
{
	struct sk_buff *skb;
	while ((skb = xenvif_rx_dequeue(queue)) != NULL)
		kfree_skb(skb);
}

static void xenvif_rx_queue_drop_expired(struct xenvif_queue *queue)
{
	struct sk_buff *skb;

	for(;;) {
		skb = skb_peek(&queue->rx_queue);
		if (!skb)
			break;
		if (time_before(jiffies, XENVIF_RX_CB(skb)->expires))
			break;
		xenvif_rx_dequeue(queue);
		kfree_skb(skb);
	}
}

I
Ian Campbell 已提交
237 238 239 240
struct netrx_pending_operations {
	unsigned copy_prod, copy_cons;
	unsigned meta_prod, meta_cons;
	struct gnttab_copy *copy;
241
	struct xenvif_rx_meta *meta;
I
Ian Campbell 已提交
242 243 244 245
	int copy_off;
	grant_ref_t copy_gref;
};

246
static struct xenvif_rx_meta *get_next_rx_buffer(struct xenvif_queue *queue,
247
						 struct netrx_pending_operations *npo)
I
Ian Campbell 已提交
248
{
249
	struct xenvif_rx_meta *meta;
I
Ian Campbell 已提交
250 251
	struct xen_netif_rx_request *req;

252
	req = RING_GET_REQUEST(&queue->rx, queue->rx.req_cons++);
I
Ian Campbell 已提交
253 254

	meta = npo->meta + npo->meta_prod++;
255
	meta->gso_type = XEN_NETIF_GSO_TYPE_NONE;
I
Ian Campbell 已提交
256 257 258 259 260 261 262 263 264 265
	meta->gso_size = 0;
	meta->size = 0;
	meta->id = req->id;

	npo->copy_off = 0;
	npo->copy_gref = req->gref;

	return meta;
}

266 267 268 269
/*
 * Set up the grant operations for this fragment. If it's a flipping
 * interface, we also set up the unmap request from here.
 */
270
static void xenvif_gop_frag_copy(struct xenvif_queue *queue, struct sk_buff *skb,
W
Wei Liu 已提交
271 272
				 struct netrx_pending_operations *npo,
				 struct page *page, unsigned long size,
273
				 unsigned long offset, int *head)
I
Ian Campbell 已提交
274 275
{
	struct gnttab_copy *copy_gop;
276
	struct xenvif_rx_meta *meta;
I
Ian Campbell 已提交
277
	unsigned long bytes;
278
	int gso_type = XEN_NETIF_GSO_TYPE_NONE;
I
Ian Campbell 已提交
279 280

	/* Data must not cross a page boundary. */
281
	BUG_ON(size + offset > PAGE_SIZE<<compound_order(page));
I
Ian Campbell 已提交
282 283 284

	meta = npo->meta + npo->meta_prod - 1;

285 286 287 288
	/* Skip unused frames from start of page */
	page += offset >> PAGE_SHIFT;
	offset &= ~PAGE_MASK;

I
Ian Campbell 已提交
289
	while (size > 0) {
290 291
		struct xen_page_foreign *foreign;

292
		BUG_ON(offset >= PAGE_SIZE);
I
Ian Campbell 已提交
293 294
		BUG_ON(npo->copy_off > MAX_BUFFER_OFFSET);

295 296
		if (npo->copy_off == MAX_BUFFER_OFFSET)
			meta = get_next_rx_buffer(queue, npo);
297

298
		bytes = PAGE_SIZE - offset;
299 300 301
		if (bytes > size)
			bytes = size;

I
Ian Campbell 已提交
302 303 304 305 306
		if (npo->copy_off + bytes > MAX_BUFFER_OFFSET)
			bytes = MAX_BUFFER_OFFSET - npo->copy_off;

		copy_gop = npo->copy + npo->copy_prod++;
		copy_gop->flags = GNTCOPY_dest_gref;
307 308
		copy_gop->len = bytes;

309 310 311 312
		foreign = xen_page_foreign(page);
		if (foreign) {
			copy_gop->source.domid = foreign->domid;
			copy_gop->source.u.ref = foreign->gref;
313 314 315 316 317 318
			copy_gop->flags |= GNTCOPY_source_gref;
		} else {
			copy_gop->source.domid = DOMID_SELF;
			copy_gop->source.u.gmfn =
				virt_to_mfn(page_address(page));
		}
I
Ian Campbell 已提交
319 320
		copy_gop->source.offset = offset;

321
		copy_gop->dest.domid = queue->vif->domid;
I
Ian Campbell 已提交
322 323 324 325 326 327 328 329 330
		copy_gop->dest.offset = npo->copy_off;
		copy_gop->dest.u.ref = npo->copy_gref;

		npo->copy_off += bytes;
		meta->size += bytes;

		offset += bytes;
		size -= bytes;

331 332 333 334 335 336 337
		/* Next frame */
		if (offset == PAGE_SIZE && size) {
			BUG_ON(!PageCompound(page));
			page++;
			offset = 0;
		}

I
Ian Campbell 已提交
338
		/* Leave a gap for the GSO descriptor. */
339 340 341 342 343 344
		if (skb_is_gso(skb)) {
			if (skb_shinfo(skb)->gso_type & SKB_GSO_TCPV4)
				gso_type = XEN_NETIF_GSO_TYPE_TCPV4;
			else if (skb_shinfo(skb)->gso_type & SKB_GSO_TCPV6)
				gso_type = XEN_NETIF_GSO_TYPE_TCPV6;
		}
345

346 347
		if (*head && ((1 << gso_type) & queue->vif->gso_mask))
			queue->rx.req_cons++;
I
Ian Campbell 已提交
348

349
		*head = 0; /* There must be something in this buffer now. */
I
Ian Campbell 已提交
350 351 352 353 354 355 356 357 358 359 360 361 362 363 364 365

	}
}

/*
 * Prepare an SKB to be transmitted to the frontend.
 *
 * This function is responsible for allocating grant operations, meta
 * structures, etc.
 *
 * It returns the number of meta structures consumed. The number of
 * ring slots used is always equal to the number of meta slots used
 * plus the number of GSO descriptors used. Currently, we use either
 * zero GSO descriptors (for non-GSO packets) or one descriptor (for
 * frontend-side LRO).
 */
W
Wei Liu 已提交
366
static int xenvif_gop_skb(struct sk_buff *skb,
367 368
			  struct netrx_pending_operations *npo,
			  struct xenvif_queue *queue)
I
Ian Campbell 已提交
369 370 371 372 373
{
	struct xenvif *vif = netdev_priv(skb->dev);
	int nr_frags = skb_shinfo(skb)->nr_frags;
	int i;
	struct xen_netif_rx_request *req;
374
	struct xenvif_rx_meta *meta;
I
Ian Campbell 已提交
375
	unsigned char *data;
376
	int head = 1;
I
Ian Campbell 已提交
377
	int old_meta_prod;
378
	int gso_type;
I
Ian Campbell 已提交
379 380 381

	old_meta_prod = npo->meta_prod;

382 383 384 385 386 387
	gso_type = XEN_NETIF_GSO_TYPE_NONE;
	if (skb_is_gso(skb)) {
		if (skb_shinfo(skb)->gso_type & SKB_GSO_TCPV4)
			gso_type = XEN_NETIF_GSO_TYPE_TCPV4;
		else if (skb_shinfo(skb)->gso_type & SKB_GSO_TCPV6)
			gso_type = XEN_NETIF_GSO_TYPE_TCPV6;
388 389
	}

I
Ian Campbell 已提交
390
	/* Set up a GSO prefix descriptor, if necessary */
P
Paul Durrant 已提交
391
	if ((1 << gso_type) & vif->gso_prefix_mask) {
392
		req = RING_GET_REQUEST(&queue->rx, queue->rx.req_cons++);
I
Ian Campbell 已提交
393
		meta = npo->meta + npo->meta_prod++;
394
		meta->gso_type = gso_type;
395
		meta->gso_size = skb_shinfo(skb)->gso_size;
I
Ian Campbell 已提交
396 397 398 399
		meta->size = 0;
		meta->id = req->id;
	}

400
	req = RING_GET_REQUEST(&queue->rx, queue->rx.req_cons++);
I
Ian Campbell 已提交
401 402
	meta = npo->meta + npo->meta_prod++;

403 404
	if ((1 << gso_type) & vif->gso_mask) {
		meta->gso_type = gso_type;
405
		meta->gso_size = skb_shinfo(skb)->gso_size;
406 407
	} else {
		meta->gso_type = XEN_NETIF_GSO_TYPE_NONE;
I
Ian Campbell 已提交
408
		meta->gso_size = 0;
409
	}
I
Ian Campbell 已提交
410 411 412 413 414 415 416 417 418 419 420 421 422 423

	meta->size = 0;
	meta->id = req->id;
	npo->copy_off = 0;
	npo->copy_gref = req->gref;

	data = skb->data;
	while (data < skb_tail_pointer(skb)) {
		unsigned int offset = offset_in_page(data);
		unsigned int len = PAGE_SIZE - offset;

		if (data + len > skb_tail_pointer(skb))
			len = skb_tail_pointer(skb) - data;

424
		xenvif_gop_frag_copy(queue, skb, npo,
425
				     virt_to_page(data), len, offset, &head);
I
Ian Campbell 已提交
426 427 428 429
		data += len;
	}

	for (i = 0; i < nr_frags; i++) {
430
		xenvif_gop_frag_copy(queue, skb, npo,
W
Wei Liu 已提交
431 432 433
				     skb_frag_page(&skb_shinfo(skb)->frags[i]),
				     skb_frag_size(&skb_shinfo(skb)->frags[i]),
				     skb_shinfo(skb)->frags[i].page_offset,
434
				     &head);
I
Ian Campbell 已提交
435 436 437 438 439 440
	}

	return npo->meta_prod - old_meta_prod;
}

/*
W
Wei Liu 已提交
441
 * This is a twin to xenvif_gop_skb.  Assume that xenvif_gop_skb was
I
Ian Campbell 已提交
442 443 444 445
 * used to set up the operations on the top of
 * netrx_pending_operations, which have since been done.  Check that
 * they didn't give any errors and advance over them.
 */
W
Wei Liu 已提交
446 447
static int xenvif_check_gop(struct xenvif *vif, int nr_meta_slots,
			    struct netrx_pending_operations *npo)
I
Ian Campbell 已提交
448 449 450 451 452 453 454 455 456 457 458 459 460 461 462 463 464 465
{
	struct gnttab_copy     *copy_op;
	int status = XEN_NETIF_RSP_OKAY;
	int i;

	for (i = 0; i < nr_meta_slots; i++) {
		copy_op = npo->copy + npo->copy_cons++;
		if (copy_op->status != GNTST_okay) {
			netdev_dbg(vif->dev,
				   "Bad status %d from copy to DOM%d.\n",
				   copy_op->status, vif->domid);
			status = XEN_NETIF_RSP_ERROR;
		}
	}

	return status;
}

466
static void xenvif_add_frag_responses(struct xenvif_queue *queue, int status,
W
Wei Liu 已提交
467 468
				      struct xenvif_rx_meta *meta,
				      int nr_meta_slots)
I
Ian Campbell 已提交
469 470 471 472 473 474 475 476 477 478 479 480 481 482 483 484 485 486
{
	int i;
	unsigned long offset;

	/* No fragments used */
	if (nr_meta_slots <= 1)
		return;

	nr_meta_slots--;

	for (i = 0; i < nr_meta_slots; i++) {
		int flags;
		if (i == nr_meta_slots - 1)
			flags = 0;
		else
			flags = XEN_NETRXF_more_data;

		offset = 0;
487
		make_rx_response(queue, meta[i].id, status, offset,
I
Ian Campbell 已提交
488 489 490 491
				 meta[i].size, flags);
	}
}

492
void xenvif_kick_thread(struct xenvif_queue *queue)
493
{
494
	wake_up(&queue->wq);
495 496
}

497
static void xenvif_rx_action(struct xenvif_queue *queue)
I
Ian Campbell 已提交
498 499
{
	s8 status;
500
	u16 flags;
I
Ian Campbell 已提交
501 502 503 504 505 506
	struct xen_netif_rx_response *resp;
	struct sk_buff_head rxq;
	struct sk_buff *skb;
	LIST_HEAD(notify);
	int ret;
	unsigned long offset;
507
	bool need_to_notify = false;
I
Ian Campbell 已提交
508 509

	struct netrx_pending_operations npo = {
510 511
		.copy  = queue->grant_copy_op,
		.meta  = queue->meta,
I
Ian Campbell 已提交
512 513 514 515
	};

	skb_queue_head_init(&rxq);

516 517
	while (xenvif_rx_ring_slots_available(queue, XEN_NETBK_RX_SLOTS_MAX)
	       && (skb = xenvif_rx_dequeue(queue)) != NULL) {
518 519
		queue->last_rx_time = jiffies;

520
		XENVIF_RX_CB(skb)->meta_slots_used = xenvif_gop_skb(skb, &npo, queue);
521

I
Ian Campbell 已提交
522 523 524
		__skb_queue_tail(&rxq, skb);
	}

525
	BUG_ON(npo.meta_prod > ARRAY_SIZE(queue->meta));
I
Ian Campbell 已提交
526 527

	if (!npo.copy_prod)
528
		goto done;
I
Ian Campbell 已提交
529

530
	BUG_ON(npo.copy_prod > MAX_GRANT_COPY_OPS);
531
	gnttab_batch_copy(queue->grant_copy_op, npo.copy_prod);
I
Ian Campbell 已提交
532 533 534

	while ((skb = __skb_dequeue(&rxq)) != NULL) {

535 536 537 538
		if ((1 << queue->meta[npo.meta_cons].gso_type) &
		    queue->vif->gso_prefix_mask) {
			resp = RING_GET_RESPONSE(&queue->rx,
						 queue->rx.rsp_prod_pvt++);
I
Ian Campbell 已提交
539 540 541

			resp->flags = XEN_NETRXF_gso_prefix | XEN_NETRXF_more_data;

542 543
			resp->offset = queue->meta[npo.meta_cons].gso_size;
			resp->id = queue->meta[npo.meta_cons].id;
544
			resp->status = XENVIF_RX_CB(skb)->meta_slots_used;
I
Ian Campbell 已提交
545 546

			npo.meta_cons++;
547
			XENVIF_RX_CB(skb)->meta_slots_used--;
I
Ian Campbell 已提交
548 549 550
		}


551 552
		queue->stats.tx_bytes += skb->len;
		queue->stats.tx_packets++;
I
Ian Campbell 已提交
553

554
		status = xenvif_check_gop(queue->vif,
555 556
					  XENVIF_RX_CB(skb)->meta_slots_used,
					  &npo);
I
Ian Campbell 已提交
557

558
		if (XENVIF_RX_CB(skb)->meta_slots_used == 1)
I
Ian Campbell 已提交
559 560 561 562 563 564 565 566 567 568 569
			flags = 0;
		else
			flags = XEN_NETRXF_more_data;

		if (skb->ip_summed == CHECKSUM_PARTIAL) /* local packet? */
			flags |= XEN_NETRXF_csum_blank | XEN_NETRXF_data_validated;
		else if (skb->ip_summed == CHECKSUM_UNNECESSARY)
			/* remote but checksummed. */
			flags |= XEN_NETRXF_data_validated;

		offset = 0;
570
		resp = make_rx_response(queue, queue->meta[npo.meta_cons].id,
I
Ian Campbell 已提交
571
					status, offset,
572
					queue->meta[npo.meta_cons].size,
I
Ian Campbell 已提交
573 574
					flags);

575 576
		if ((1 << queue->meta[npo.meta_cons].gso_type) &
		    queue->vif->gso_mask) {
I
Ian Campbell 已提交
577 578
			struct xen_netif_extra_info *gso =
				(struct xen_netif_extra_info *)
579 580
				RING_GET_RESPONSE(&queue->rx,
						  queue->rx.rsp_prod_pvt++);
I
Ian Campbell 已提交
581 582 583

			resp->flags |= XEN_NETRXF_extra_info;

584 585
			gso->u.gso.type = queue->meta[npo.meta_cons].gso_type;
			gso->u.gso.size = queue->meta[npo.meta_cons].gso_size;
I
Ian Campbell 已提交
586 587 588 589 590 591 592
			gso->u.gso.pad = 0;
			gso->u.gso.features = 0;

			gso->type = XEN_NETIF_EXTRA_TYPE_GSO;
			gso->flags = 0;
		}

593 594
		xenvif_add_frag_responses(queue, status,
					  queue->meta + npo.meta_cons + 1,
595
					  XENVIF_RX_CB(skb)->meta_slots_used);
I
Ian Campbell 已提交
596

597
		RING_PUSH_RESPONSES_AND_CHECK_NOTIFY(&queue->rx, ret);
I
Ian Campbell 已提交
598

599
		need_to_notify |= !!ret;
600

601
		npo.meta_cons += XENVIF_RX_CB(skb)->meta_slots_used;
I
Ian Campbell 已提交
602 603 604
		dev_kfree_skb(skb);
	}

605
done:
606
	if (need_to_notify)
607
		notify_remote_via_irq(queue->rx_irq);
I
Ian Campbell 已提交
608 609
}

610
void xenvif_napi_schedule_or_enable_events(struct xenvif_queue *queue)
I
Ian Campbell 已提交
611 612 613
{
	int more_to_do;

614
	RING_FINAL_CHECK_FOR_REQUESTS(&queue->tx, more_to_do);
I
Ian Campbell 已提交
615 616

	if (more_to_do)
617
		napi_schedule(&queue->napi);
I
Ian Campbell 已提交
618 619
}

620
static void tx_add_credit(struct xenvif_queue *queue)
I
Ian Campbell 已提交
621 622 623 624 625 626 627
{
	unsigned long max_burst, max_credit;

	/*
	 * Allow a burst big enough to transmit a jumbo packet of up to 128kB.
	 * Otherwise the interface can seize up due to insufficient credit.
	 */
628
	max_burst = RING_GET_REQUEST(&queue->tx, queue->tx.req_cons)->size;
I
Ian Campbell 已提交
629
	max_burst = min(max_burst, 131072UL);
630
	max_burst = max(max_burst, queue->credit_bytes);
I
Ian Campbell 已提交
631 632

	/* Take care that adding a new chunk of credit doesn't wrap to zero. */
633 634
	max_credit = queue->remaining_credit + queue->credit_bytes;
	if (max_credit < queue->remaining_credit)
I
Ian Campbell 已提交
635 636
		max_credit = ULONG_MAX; /* wrapped: clamp to ULONG_MAX */

637
	queue->remaining_credit = min(max_credit, max_burst);
I
Ian Campbell 已提交
638 639
}

640
void xenvif_tx_credit_callback(unsigned long data)
I
Ian Campbell 已提交
641
{
642 643 644
	struct xenvif_queue *queue = (struct xenvif_queue *)data;
	tx_add_credit(queue);
	xenvif_napi_schedule_or_enable_events(queue);
I
Ian Campbell 已提交
645 646
}

647
static void xenvif_tx_err(struct xenvif_queue *queue,
W
Wei Liu 已提交
648
			  struct xen_netif_tx_request *txp, RING_IDX end)
I
Ian Campbell 已提交
649
{
650
	RING_IDX cons = queue->tx.req_cons;
651
	unsigned long flags;
I
Ian Campbell 已提交
652 653

	do {
654 655
		spin_lock_irqsave(&queue->response_lock, flags);
		make_tx_response(queue, txp, XEN_NETIF_RSP_ERROR);
656
		push_tx_responses(queue);
657
		spin_unlock_irqrestore(&queue->response_lock, flags);
658
		if (cons == end)
I
Ian Campbell 已提交
659
			break;
660
		txp = RING_GET_REQUEST(&queue->tx, cons++);
I
Ian Campbell 已提交
661
	} while (1);
662
	queue->tx.req_cons = cons;
I
Ian Campbell 已提交
663 664
}

W
Wei Liu 已提交
665
static void xenvif_fatal_tx_err(struct xenvif *vif)
666 667
{
	netdev_err(vif->dev, "fatal error; disabling device\n");
668
	vif->disabled = true;
669 670 671
	/* Disable the vif from queue 0's kthread */
	if (vif->queues)
		xenvif_kick_thread(&vif->queues[0]);
672 673
}

674
static int xenvif_count_requests(struct xenvif_queue *queue,
W
Wei Liu 已提交
675 676 677
				 struct xen_netif_tx_request *first,
				 struct xen_netif_tx_request *txp,
				 int work_to_do)
I
Ian Campbell 已提交
678
{
679
	RING_IDX cons = queue->tx.req_cons;
680 681
	int slots = 0;
	int drop_err = 0;
682
	int more_data;
I
Ian Campbell 已提交
683 684 685 686 687

	if (!(first->flags & XEN_NETTXF_more_data))
		return 0;

	do {
688 689
		struct xen_netif_tx_request dropped_tx = { 0 };

690
		if (slots >= work_to_do) {
691
			netdev_err(queue->vif->dev,
692 693
				   "Asked for %d slots but exceeds this limit\n",
				   work_to_do);
694
			xenvif_fatal_tx_err(queue->vif);
695
			return -ENODATA;
I
Ian Campbell 已提交
696 697
		}

698 699 700
		/* This guest is really using too many slots and
		 * considered malicious.
		 */
701
		if (unlikely(slots >= fatal_skb_slots)) {
702
			netdev_err(queue->vif->dev,
703
				   "Malicious frontend using %d slots, threshold %u\n",
704
				   slots, fatal_skb_slots);
705
			xenvif_fatal_tx_err(queue->vif);
706
			return -E2BIG;
I
Ian Campbell 已提交
707 708
		}

709
		/* Xen network protocol had implicit dependency on
710 711 712 713 714
		 * MAX_SKB_FRAGS. XEN_NETBK_LEGACY_SLOTS_MAX is set to
		 * the historical MAX_SKB_FRAGS value 18 to honor the
		 * same behavior as before. Any packet using more than
		 * 18 slots but less than fatal_skb_slots slots is
		 * dropped
715
		 */
716
		if (!drop_err && slots >= XEN_NETBK_LEGACY_SLOTS_MAX) {
717
			if (net_ratelimit())
718
				netdev_dbg(queue->vif->dev,
719
					   "Too many slots (%d) exceeding limit (%d), dropping packet\n",
720
					   slots, XEN_NETBK_LEGACY_SLOTS_MAX);
721 722 723
			drop_err = -E2BIG;
		}

724 725 726
		if (drop_err)
			txp = &dropped_tx;

727
		memcpy(txp, RING_GET_REQUEST(&queue->tx, cons + slots),
I
Ian Campbell 已提交
728
		       sizeof(*txp));
729 730 731 732 733 734 735 736 737 738 739 740

		/* If the guest submitted a frame >= 64 KiB then
		 * first->size overflowed and following slots will
		 * appear to be larger than the frame.
		 *
		 * This cannot be fatal error as there are buggy
		 * frontends that do this.
		 *
		 * Consume all slots and drop the packet.
		 */
		if (!drop_err && txp->size > first->size) {
			if (net_ratelimit())
741
				netdev_dbg(queue->vif->dev,
742 743 744
					   "Invalid tx request, slot size %u > remaining size %u\n",
					   txp->size, first->size);
			drop_err = -EIO;
I
Ian Campbell 已提交
745 746 747
		}

		first->size -= txp->size;
748
		slots++;
I
Ian Campbell 已提交
749 750

		if (unlikely((txp->offset + txp->size) > PAGE_SIZE)) {
751
			netdev_err(queue->vif->dev, "Cross page boundary, txp->offset: %u, size: %u\n",
I
Ian Campbell 已提交
752
				 txp->offset, txp->size);
753
			xenvif_fatal_tx_err(queue->vif);
754
			return -EINVAL;
I
Ian Campbell 已提交
755
		}
756 757 758 759 760 761 762

		more_data = txp->flags & XEN_NETTXF_more_data;

		if (!drop_err)
			txp++;

	} while (more_data);
763 764

	if (drop_err) {
765
		xenvif_tx_err(queue, first, cons + slots);
766 767 768 769
		return drop_err;
	}

	return slots;
I
Ian Campbell 已提交
770 771
}

772 773 774 775 776 777 778

struct xenvif_tx_cb {
	u16 pending_idx;
};

#define XENVIF_TX_CB(skb) ((struct xenvif_tx_cb *)(skb)->cb)

779
static inline void xenvif_tx_create_map_op(struct xenvif_queue *queue,
Z
Zoltan Kiss 已提交
780 781 782
					  u16 pending_idx,
					  struct xen_netif_tx_request *txp,
					  struct gnttab_map_grant_ref *mop)
783
{
784 785
	queue->pages_to_map[mop-queue->tx_map_ops] = queue->mmap_pages[pending_idx];
	gnttab_set_map_op(mop, idx_to_kaddr(queue, pending_idx),
786
			  GNTMAP_host_map | GNTMAP_readonly,
787
			  txp->gref, queue->vif->domid);
788

789
	memcpy(&queue->pending_tx_info[pending_idx].req, txp,
790 791 792
	       sizeof(*txp));
}

793 794 795 796 797 798 799 800 801 802 803 804 805 806 807 808 809
static inline struct sk_buff *xenvif_alloc_skb(unsigned int size)
{
	struct sk_buff *skb =
		alloc_skb(size + NET_SKB_PAD + NET_IP_ALIGN,
			  GFP_ATOMIC | __GFP_NOWARN);
	if (unlikely(skb == NULL))
		return NULL;

	/* Packets passed to netif_rx() must have some headroom. */
	skb_reserve(skb, NET_SKB_PAD + NET_IP_ALIGN);

	/* Initialize it here to avoid later surprises */
	skb_shinfo(skb)->destructor_arg = NULL;

	return skb;
}

810
static struct gnttab_map_grant_ref *xenvif_get_requests(struct xenvif_queue *queue,
811 812
							struct sk_buff *skb,
							struct xen_netif_tx_request *txp,
813 814 815
							struct gnttab_map_grant_ref *gop,
							unsigned int frag_overflow,
							struct sk_buff *nskb)
I
Ian Campbell 已提交
816 817 818
{
	struct skb_shared_info *shinfo = skb_shinfo(skb);
	skb_frag_t *frags = shinfo->frags;
819
	u16 pending_idx = XENVIF_TX_CB(skb)->pending_idx;
820 821
	int start;
	pending_ring_idx_t index;
822
	unsigned int nr_slots;
823 824

	nr_slots = shinfo->nr_frags;
I
Ian Campbell 已提交
825 826

	/* Skip first skb fragment if it is on same page as header fragment. */
827
	start = (frag_get_pending_idx(&shinfo->frags[0]) == pending_idx);
I
Ian Campbell 已提交
828

829 830
	for (shinfo->nr_frags = start; shinfo->nr_frags < nr_slots;
	     shinfo->nr_frags++, txp++, gop++) {
831 832 833
		index = pending_index(queue->pending_cons++);
		pending_idx = queue->pending_ring[index];
		xenvif_tx_create_map_op(queue, pending_idx, txp, gop);
834
		frag_set_pending_idx(&frags[shinfo->nr_frags], pending_idx);
I
Ian Campbell 已提交
835 836
	}

837 838 839 840 841 842 843
	if (frag_overflow) {

		shinfo = skb_shinfo(nskb);
		frags = shinfo->frags;

		for (shinfo->nr_frags = 0; shinfo->nr_frags < frag_overflow;
		     shinfo->nr_frags++, txp++, gop++) {
844 845 846
			index = pending_index(queue->pending_cons++);
			pending_idx = queue->pending_ring[index];
			xenvif_tx_create_map_op(queue, pending_idx, txp, gop);
847 848 849 850 851 852
			frag_set_pending_idx(&frags[shinfo->nr_frags],
					     pending_idx);
		}

		skb_shinfo(skb)->frag_list = nskb;
	}
853

I
Ian Campbell 已提交
854 855 856
	return gop;
}

857
static inline void xenvif_grant_handle_set(struct xenvif_queue *queue,
858 859 860
					   u16 pending_idx,
					   grant_handle_t handle)
{
861
	if (unlikely(queue->grant_tx_handle[pending_idx] !=
862
		     NETBACK_INVALID_HANDLE)) {
863
		netdev_err(queue->vif->dev,
864
			   "Trying to overwrite active handle! pending_idx: 0x%x\n",
865 866 867
			   pending_idx);
		BUG();
	}
868
	queue->grant_tx_handle[pending_idx] = handle;
869 870
}

871
static inline void xenvif_grant_handle_reset(struct xenvif_queue *queue,
872 873
					     u16 pending_idx)
{
874
	if (unlikely(queue->grant_tx_handle[pending_idx] ==
875
		     NETBACK_INVALID_HANDLE)) {
876
		netdev_err(queue->vif->dev,
877
			   "Trying to unmap invalid handle! pending_idx: 0x%x\n",
878 879 880
			   pending_idx);
		BUG();
	}
881
	queue->grant_tx_handle[pending_idx] = NETBACK_INVALID_HANDLE;
882 883
}

884
static int xenvif_tx_check_gop(struct xenvif_queue *queue,
W
Wei Liu 已提交
885
			       struct sk_buff *skb,
886 887
			       struct gnttab_map_grant_ref **gopp_map,
			       struct gnttab_copy **gopp_copy)
I
Ian Campbell 已提交
888
{
Z
Zoltan Kiss 已提交
889
	struct gnttab_map_grant_ref *gop_map = *gopp_map;
890
	u16 pending_idx = XENVIF_TX_CB(skb)->pending_idx;
891 892 893
	/* This always points to the shinfo of the skb being checked, which
	 * could be either the first or the one on the frag_list
	 */
I
Ian Campbell 已提交
894
	struct skb_shared_info *shinfo = skb_shinfo(skb);
895 896 897 898
	/* If this is non-NULL, we are currently checking the frag_list skb, and
	 * this points to the shinfo of the first one
	 */
	struct skb_shared_info *first_shinfo = NULL;
I
Ian Campbell 已提交
899
	int nr_frags = shinfo->nr_frags;
900 901
	const bool sharedslot = nr_frags &&
				frag_get_pending_idx(&shinfo->frags[0]) == pending_idx;
902
	int i, err;
I
Ian Campbell 已提交
903 904

	/* Check status of header. */
905 906 907
	err = (*gopp_copy)->status;
	if (unlikely(err)) {
		if (net_ratelimit())
908
			netdev_dbg(queue->vif->dev,
909
				   "Grant copy of header failed! status: %d pending_idx: %u ref: %u\n",
910 911 912
				   (*gopp_copy)->status,
				   pending_idx,
				   (*gopp_copy)->source.u.ref);
913 914 915 916
		/* The first frag might still have this slot mapped */
		if (!sharedslot)
			xenvif_idx_release(queue, pending_idx,
					   XEN_NETIF_RSP_ERROR);
917
	}
918
	(*gopp_copy)++;
I
Ian Campbell 已提交
919

920
check_frags:
921
	for (i = 0; i < nr_frags; i++, gop_map++) {
I
Ian Campbell 已提交
922 923
		int j, newerr;

924
		pending_idx = frag_get_pending_idx(&shinfo->frags[i]);
I
Ian Campbell 已提交
925 926

		/* Check error status: if okay then remember grant handle. */
927
		newerr = gop_map->status;
928

I
Ian Campbell 已提交
929
		if (likely(!newerr)) {
930
			xenvif_grant_handle_set(queue,
Z
Zoltan Kiss 已提交
931 932
						pending_idx,
						gop_map->handle);
I
Ian Campbell 已提交
933
			/* Had a previous error? Invalidate this fragment. */
934
			if (unlikely(err)) {
935
				xenvif_idx_unmap(queue, pending_idx);
936 937 938 939 940 941 942 943 944 945 946
				/* If the mapping of the first frag was OK, but
				 * the header's copy failed, and they are
				 * sharing a slot, send an error
				 */
				if (i == 0 && sharedslot)
					xenvif_idx_release(queue, pending_idx,
							   XEN_NETIF_RSP_ERROR);
				else
					xenvif_idx_release(queue, pending_idx,
							   XEN_NETIF_RSP_OKAY);
			}
I
Ian Campbell 已提交
947 948 949 950
			continue;
		}

		/* Error on this fragment: respond to client with an error. */
951
		if (net_ratelimit())
952
			netdev_dbg(queue->vif->dev,
953
				   "Grant map of %d. frag failed! status: %d pending_idx: %u ref: %u\n",
954 955 956 957
				   i,
				   gop_map->status,
				   pending_idx,
				   gop_map->ref);
958

959
		xenvif_idx_release(queue, pending_idx, XEN_NETIF_RSP_ERROR);
I
Ian Campbell 已提交
960 961 962 963

		/* Not the first error? Preceding frags already invalidated. */
		if (err)
			continue;
964 965 966 967 968 969 970 971 972 973

		/* First error: if the header haven't shared a slot with the
		 * first frag, release it as well.
		 */
		if (!sharedslot)
			xenvif_idx_release(queue,
					   XENVIF_TX_CB(skb)->pending_idx,
					   XEN_NETIF_RSP_OKAY);

		/* Invalidate preceding fragments of this skb. */
974
		for (j = 0; j < i; j++) {
975
			pending_idx = frag_get_pending_idx(&shinfo->frags[j]);
976
			xenvif_idx_unmap(queue, pending_idx);
977 978
			xenvif_idx_release(queue, pending_idx,
					   XEN_NETIF_RSP_OKAY);
I
Ian Campbell 已提交
979 980
		}

981 982 983 984 985 986 987
		/* And if we found the error while checking the frag_list, unmap
		 * the first skb's frags
		 */
		if (first_shinfo) {
			for (j = 0; j < first_shinfo->nr_frags; j++) {
				pending_idx = frag_get_pending_idx(&first_shinfo->frags[j]);
				xenvif_idx_unmap(queue, pending_idx);
988 989
				xenvif_idx_release(queue, pending_idx,
						   XEN_NETIF_RSP_OKAY);
990
			}
I
Ian Campbell 已提交
991 992 993 994 995 996
		}

		/* Remember the error: invalidate all subsequent fragments. */
		err = newerr;
	}

997 998 999
	if (skb_has_frag_list(skb) && !first_shinfo) {
		first_shinfo = skb_shinfo(skb);
		shinfo = skb_shinfo(skb_shinfo(skb)->frag_list);
1000 1001 1002 1003 1004
		nr_frags = shinfo->nr_frags;

		goto check_frags;
	}

1005
	*gopp_map = gop_map;
I
Ian Campbell 已提交
1006 1007 1008
	return err;
}

1009
static void xenvif_fill_frags(struct xenvif_queue *queue, struct sk_buff *skb)
I
Ian Campbell 已提交
1010 1011 1012 1013
{
	struct skb_shared_info *shinfo = skb_shinfo(skb);
	int nr_frags = shinfo->nr_frags;
	int i;
1014 1015
	u16 prev_pending_idx = INVALID_PENDING_IDX;

I
Ian Campbell 已提交
1016 1017 1018
	for (i = 0; i < nr_frags; i++) {
		skb_frag_t *frag = shinfo->frags + i;
		struct xen_netif_tx_request *txp;
1019 1020
		struct page *page;
		u16 pending_idx;
I
Ian Campbell 已提交
1021

1022
		pending_idx = frag_get_pending_idx(frag);
I
Ian Campbell 已提交
1023

1024
		/* If this is not the first frag, chain it to the previous*/
1025
		if (prev_pending_idx == INVALID_PENDING_IDX)
1026
			skb_shinfo(skb)->destructor_arg =
1027
				&callback_param(queue, pending_idx);
1028
		else
1029 1030
			callback_param(queue, prev_pending_idx).ctx =
				&callback_param(queue, pending_idx);
1031

1032
		callback_param(queue, pending_idx).ctx = NULL;
1033 1034
		prev_pending_idx = pending_idx;

1035 1036
		txp = &queue->pending_tx_info[pending_idx].req;
		page = virt_to_page(idx_to_kaddr(queue, pending_idx));
1037
		__skb_fill_page_desc(skb, i, page, txp->offset, txp->size);
I
Ian Campbell 已提交
1038 1039 1040 1041
		skb->len += txp->size;
		skb->data_len += txp->size;
		skb->truesize += txp->size;

1042
		/* Take an extra reference to offset network stack's put_page */
1043
		get_page(queue->mmap_pages[pending_idx]);
I
Ian Campbell 已提交
1044 1045 1046
	}
}

1047
static int xenvif_get_extras(struct xenvif_queue *queue,
I
Ian Campbell 已提交
1048 1049 1050 1051
				struct xen_netif_extra_info *extras,
				int work_to_do)
{
	struct xen_netif_extra_info extra;
1052
	RING_IDX cons = queue->tx.req_cons;
I
Ian Campbell 已提交
1053 1054 1055

	do {
		if (unlikely(work_to_do-- <= 0)) {
1056 1057
			netdev_err(queue->vif->dev, "Missing extra info\n");
			xenvif_fatal_tx_err(queue->vif);
I
Ian Campbell 已提交
1058 1059 1060
			return -EBADR;
		}

1061
		memcpy(&extra, RING_GET_REQUEST(&queue->tx, cons),
I
Ian Campbell 已提交
1062 1063 1064
		       sizeof(extra));
		if (unlikely(!extra.type ||
			     extra.type >= XEN_NETIF_EXTRA_TYPE_MAX)) {
1065 1066
			queue->tx.req_cons = ++cons;
			netdev_err(queue->vif->dev,
I
Ian Campbell 已提交
1067
				   "Invalid extra type: %d\n", extra.type);
1068
			xenvif_fatal_tx_err(queue->vif);
I
Ian Campbell 已提交
1069 1070 1071 1072
			return -EINVAL;
		}

		memcpy(&extras[extra.type - 1], &extra, sizeof(extra));
1073
		queue->tx.req_cons = ++cons;
I
Ian Campbell 已提交
1074 1075 1076 1077 1078
	} while (extra.flags & XEN_NETIF_EXTRA_FLAG_MORE);

	return work_to_do;
}

W
Wei Liu 已提交
1079 1080 1081
static int xenvif_set_skb_gso(struct xenvif *vif,
			      struct sk_buff *skb,
			      struct xen_netif_extra_info *gso)
I
Ian Campbell 已提交
1082 1083
{
	if (!gso->u.gso.size) {
1084
		netdev_err(vif->dev, "GSO size must not be zero.\n");
W
Wei Liu 已提交
1085
		xenvif_fatal_tx_err(vif);
I
Ian Campbell 已提交
1086 1087 1088
		return -EINVAL;
	}

1089 1090 1091 1092 1093 1094 1095 1096
	switch (gso->u.gso.type) {
	case XEN_NETIF_GSO_TYPE_TCPV4:
		skb_shinfo(skb)->gso_type = SKB_GSO_TCPV4;
		break;
	case XEN_NETIF_GSO_TYPE_TCPV6:
		skb_shinfo(skb)->gso_type = SKB_GSO_TCPV6;
		break;
	default:
1097
		netdev_err(vif->dev, "Bad GSO type %d.\n", gso->u.gso.type);
W
Wei Liu 已提交
1098
		xenvif_fatal_tx_err(vif);
I
Ian Campbell 已提交
1099 1100 1101 1102
		return -EINVAL;
	}

	skb_shinfo(skb)->gso_size = gso->u.gso.size;
1103
	/* gso_segs will be calculated later */
I
Ian Campbell 已提交
1104 1105 1106 1107

	return 0;
}

1108
static int checksum_setup(struct xenvif_queue *queue, struct sk_buff *skb)
1109
{
1110
	bool recalculate_partial_csum = false;
1111 1112 1113 1114 1115 1116 1117

	/* A GSO SKB must be CHECKSUM_PARTIAL. However some buggy
	 * peers can fail to set NETRXF_csum_blank when sending a GSO
	 * frame. In this case force the SKB to CHECKSUM_PARTIAL and
	 * recalculate the partial checksum.
	 */
	if (skb->ip_summed != CHECKSUM_PARTIAL && skb_is_gso(skb)) {
1118
		queue->stats.rx_gso_checksum_fixup++;
1119
		skb->ip_summed = CHECKSUM_PARTIAL;
1120
		recalculate_partial_csum = true;
1121 1122 1123 1124 1125 1126
	}

	/* A non-CHECKSUM_PARTIAL SKB does not require setup. */
	if (skb->ip_summed != CHECKSUM_PARTIAL)
		return 0;

1127
	return skb_checksum_setup(skb, recalculate_partial_csum);
1128 1129
}

1130
static bool tx_credit_exceeded(struct xenvif_queue *queue, unsigned size)
I
Ian Campbell 已提交
1131
{
1132
	u64 now = get_jiffies_64();
1133 1134
	u64 next_credit = queue->credit_window_start +
		msecs_to_jiffies(queue->credit_usec / 1000);
I
Ian Campbell 已提交
1135 1136

	/* Timer could already be pending in rare cases. */
1137
	if (timer_pending(&queue->credit_timeout))
I
Ian Campbell 已提交
1138 1139 1140
		return true;

	/* Passed the point where we can replenish credit? */
1141
	if (time_after_eq64(now, next_credit)) {
1142 1143
		queue->credit_window_start = now;
		tx_add_credit(queue);
I
Ian Campbell 已提交
1144 1145 1146
	}

	/* Still too big to send right now? Set a callback. */
1147 1148 1149 1150
	if (size > queue->remaining_credit) {
		queue->credit_timeout.data     =
			(unsigned long)queue;
		mod_timer(&queue->credit_timeout,
I
Ian Campbell 已提交
1151
			  next_credit);
1152
		queue->credit_window_start = next_credit;
I
Ian Campbell 已提交
1153 1154 1155 1156 1157 1158 1159

		return true;
	}

	return false;
}

1160
static void xenvif_tx_build_gops(struct xenvif_queue *queue,
1161 1162 1163
				     int budget,
				     unsigned *copy_ops,
				     unsigned *map_ops)
I
Ian Campbell 已提交
1164
{
1165 1166
	struct gnttab_map_grant_ref *gop = queue->tx_map_ops;
	struct sk_buff *skb, *nskb;
I
Ian Campbell 已提交
1167
	int ret;
1168
	unsigned int frag_overflow;
I
Ian Campbell 已提交
1169

1170
	while (skb_queue_len(&queue->tx_queue) < budget) {
I
Ian Campbell 已提交
1171
		struct xen_netif_tx_request txreq;
1172
		struct xen_netif_tx_request txfrags[XEN_NETBK_LEGACY_SLOTS_MAX];
I
Ian Campbell 已提交
1173 1174 1175 1176 1177 1178 1179
		struct xen_netif_extra_info extras[XEN_NETIF_EXTRA_TYPE_MAX-1];
		u16 pending_idx;
		RING_IDX idx;
		int work_to_do;
		unsigned int data_len;
		pending_ring_idx_t index;

1180
		if (queue->tx.sring->req_prod - queue->tx.req_cons >
1181
		    XEN_NETIF_TX_RING_SIZE) {
1182
			netdev_err(queue->vif->dev,
1183 1184
				   "Impossible number of requests. "
				   "req_prod %d, req_cons %d, size %ld\n",
1185
				   queue->tx.sring->req_prod, queue->tx.req_cons,
1186
				   XEN_NETIF_TX_RING_SIZE);
1187
			xenvif_fatal_tx_err(queue->vif);
1188
			break;
1189 1190
		}

1191
		work_to_do = RING_HAS_UNCONSUMED_REQUESTS(&queue->tx);
1192 1193
		if (!work_to_do)
			break;
I
Ian Campbell 已提交
1194

1195
		idx = queue->tx.req_cons;
I
Ian Campbell 已提交
1196
		rmb(); /* Ensure that we see the request before we copy it. */
1197
		memcpy(&txreq, RING_GET_REQUEST(&queue->tx, idx), sizeof(txreq));
I
Ian Campbell 已提交
1198 1199

		/* Credit-based scheduling. */
1200 1201
		if (txreq.size > queue->remaining_credit &&
		    tx_credit_exceeded(queue, txreq.size))
1202
			break;
I
Ian Campbell 已提交
1203

1204
		queue->remaining_credit -= txreq.size;
I
Ian Campbell 已提交
1205 1206

		work_to_do--;
1207
		queue->tx.req_cons = ++idx;
I
Ian Campbell 已提交
1208 1209 1210

		memset(extras, 0, sizeof(extras));
		if (txreq.flags & XEN_NETTXF_extra_info) {
1211
			work_to_do = xenvif_get_extras(queue, extras,
W
Wei Liu 已提交
1212
						       work_to_do);
1213
			idx = queue->tx.req_cons;
1214
			if (unlikely(work_to_do < 0))
1215
				break;
I
Ian Campbell 已提交
1216 1217
		}

1218
		ret = xenvif_count_requests(queue, &txreq, txfrags, work_to_do);
1219
		if (unlikely(ret < 0))
1220
			break;
1221

I
Ian Campbell 已提交
1222 1223 1224
		idx += ret;

		if (unlikely(txreq.size < ETH_HLEN)) {
1225
			netdev_dbg(queue->vif->dev,
I
Ian Campbell 已提交
1226
				   "Bad packet size: %d\n", txreq.size);
1227
			xenvif_tx_err(queue, &txreq, idx);
1228
			break;
I
Ian Campbell 已提交
1229 1230 1231 1232
		}

		/* No crossing a page as the payload mustn't fragment. */
		if (unlikely((txreq.offset + txreq.size) > PAGE_SIZE)) {
1233
			netdev_err(queue->vif->dev,
1234
				   "txreq.offset: %u, size: %u, end: %lu\n",
I
Ian Campbell 已提交
1235
				   txreq.offset, txreq.size,
1236
				   (unsigned long)(txreq.offset&~PAGE_MASK) + txreq.size);
1237
			xenvif_fatal_tx_err(queue->vif);
1238
			break;
I
Ian Campbell 已提交
1239 1240
		}

1241 1242
		index = pending_index(queue->pending_cons);
		pending_idx = queue->pending_ring[index];
I
Ian Campbell 已提交
1243

1244
		data_len = (txreq.size > XEN_NETBACK_TX_COPY_LEN &&
1245
			    ret < XEN_NETBK_LEGACY_SLOTS_MAX) ?
1246
			XEN_NETBACK_TX_COPY_LEN : txreq.size;
I
Ian Campbell 已提交
1247

1248
		skb = xenvif_alloc_skb(data_len);
I
Ian Campbell 已提交
1249
		if (unlikely(skb == NULL)) {
1250
			netdev_dbg(queue->vif->dev,
I
Ian Campbell 已提交
1251
				   "Can't allocate a skb in start_xmit.\n");
1252
			xenvif_tx_err(queue, &txreq, idx);
I
Ian Campbell 已提交
1253 1254 1255
			break;
		}

1256 1257 1258 1259 1260 1261 1262 1263 1264 1265 1266 1267 1268 1269 1270 1271 1272 1273 1274 1275 1276 1277 1278
		skb_shinfo(skb)->nr_frags = ret;
		if (data_len < txreq.size)
			skb_shinfo(skb)->nr_frags++;
		/* At this point shinfo->nr_frags is in fact the number of
		 * slots, which can be as large as XEN_NETBK_LEGACY_SLOTS_MAX.
		 */
		frag_overflow = 0;
		nskb = NULL;
		if (skb_shinfo(skb)->nr_frags > MAX_SKB_FRAGS) {
			frag_overflow = skb_shinfo(skb)->nr_frags - MAX_SKB_FRAGS;
			BUG_ON(frag_overflow > MAX_SKB_FRAGS);
			skb_shinfo(skb)->nr_frags = MAX_SKB_FRAGS;
			nskb = xenvif_alloc_skb(0);
			if (unlikely(nskb == NULL)) {
				kfree_skb(skb);
				xenvif_tx_err(queue, &txreq, idx);
				if (net_ratelimit())
					netdev_err(queue->vif->dev,
						   "Can't allocate the frag_list skb.\n");
				break;
			}
		}

I
Ian Campbell 已提交
1279 1280 1281 1282
		if (extras[XEN_NETIF_EXTRA_TYPE_GSO - 1].type) {
			struct xen_netif_extra_info *gso;
			gso = &extras[XEN_NETIF_EXTRA_TYPE_GSO - 1];

1283
			if (xenvif_set_skb_gso(queue->vif, skb, gso)) {
W
Wei Liu 已提交
1284
				/* Failure in xenvif_set_skb_gso is fatal. */
I
Ian Campbell 已提交
1285
				kfree_skb(skb);
1286
				kfree_skb(nskb);
1287
				break;
I
Ian Campbell 已提交
1288 1289 1290
			}
		}

1291
		XENVIF_TX_CB(skb)->pending_idx = pending_idx;
I
Ian Campbell 已提交
1292 1293

		__skb_put(skb, data_len);
1294 1295 1296
		queue->tx_copy_ops[*copy_ops].source.u.ref = txreq.gref;
		queue->tx_copy_ops[*copy_ops].source.domid = queue->vif->domid;
		queue->tx_copy_ops[*copy_ops].source.offset = txreq.offset;
1297

1298
		queue->tx_copy_ops[*copy_ops].dest.u.gmfn =
1299
			virt_to_mfn(skb->data);
1300 1301
		queue->tx_copy_ops[*copy_ops].dest.domid = DOMID_SELF;
		queue->tx_copy_ops[*copy_ops].dest.offset =
1302 1303
			offset_in_page(skb->data);

1304 1305
		queue->tx_copy_ops[*copy_ops].len = data_len;
		queue->tx_copy_ops[*copy_ops].flags = GNTCOPY_source_gref;
1306 1307

		(*copy_ops)++;
I
Ian Campbell 已提交
1308 1309

		if (data_len < txreq.size) {
1310 1311
			frag_set_pending_idx(&skb_shinfo(skb)->frags[0],
					     pending_idx);
1312
			xenvif_tx_create_map_op(queue, pending_idx, &txreq, gop);
1313
			gop++;
I
Ian Campbell 已提交
1314
		} else {
1315 1316
			frag_set_pending_idx(&skb_shinfo(skb)->frags[0],
					     INVALID_PENDING_IDX);
1317
			memcpy(&queue->pending_tx_info[pending_idx].req, &txreq,
1318
			       sizeof(txreq));
I
Ian Campbell 已提交
1319 1320
		}

1321
		queue->pending_cons++;
I
Ian Campbell 已提交
1322

1323 1324
		gop = xenvif_get_requests(queue, skb, txfrags, gop,
				          frag_overflow, nskb);
I
Ian Campbell 已提交
1325

1326
		__skb_queue_tail(&queue->tx_queue, skb);
1327

1328
		queue->tx.req_cons = idx;
I
Ian Campbell 已提交
1329

1330 1331
		if (((gop-queue->tx_map_ops) >= ARRAY_SIZE(queue->tx_map_ops)) ||
		    (*copy_ops >= ARRAY_SIZE(queue->tx_copy_ops)))
I
Ian Campbell 已提交
1332 1333 1334
			break;
	}

1335
	(*map_ops) = gop - queue->tx_map_ops;
1336
	return;
I
Ian Campbell 已提交
1337 1338
}

1339 1340 1341
/* Consolidate skb with a frag_list into a brand new one with local pages on
 * frags. Returns 0 or -ENOMEM if can't allocate new pages.
 */
1342
static int xenvif_handle_frag_list(struct xenvif_queue *queue, struct sk_buff *skb)
1343 1344 1345
{
	unsigned int offset = skb_headlen(skb);
	skb_frag_t frags[MAX_SKB_FRAGS];
1346
	int i, f;
1347 1348 1349
	struct ubuf_info *uarg;
	struct sk_buff *nskb = skb_shinfo(skb)->frag_list;

1350 1351
	queue->stats.tx_zerocopy_sent += 2;
	queue->stats.tx_frag_overflow++;
1352

1353
	xenvif_fill_frags(queue, nskb);
1354 1355 1356 1357 1358 1359 1360 1361 1362 1363 1364
	/* Subtract frags size, we will correct it later */
	skb->truesize -= skb->data_len;
	skb->len += nskb->len;
	skb->data_len += nskb->len;

	/* create a brand new frags array and coalesce there */
	for (i = 0; offset < skb->len; i++) {
		struct page *page;
		unsigned int len;

		BUG_ON(i >= MAX_SKB_FRAGS);
Z
Zoltan Kiss 已提交
1365
		page = alloc_page(GFP_ATOMIC);
1366 1367 1368 1369 1370 1371 1372 1373 1374 1375 1376 1377 1378 1379 1380 1381 1382 1383 1384 1385
		if (!page) {
			int j;
			skb->truesize += skb->data_len;
			for (j = 0; j < i; j++)
				put_page(frags[j].page.p);
			return -ENOMEM;
		}

		if (offset + PAGE_SIZE < skb->len)
			len = PAGE_SIZE;
		else
			len = skb->len - offset;
		if (skb_copy_bits(skb, offset, page_address(page), len))
			BUG();

		offset += len;
		frags[i].page.p = page;
		frags[i].page_offset = 0;
		skb_frag_size_set(&frags[i], len);
	}
1386

1387 1388 1389 1390 1391
	/* Copied all the bits from the frag list -- free it. */
	skb_frag_list_init(skb);
	xenvif_skb_zerocopy_prepare(queue, nskb);
	kfree_skb(nskb);

1392 1393 1394
	/* Release all the original (foreign) frags. */
	for (f = 0; f < skb_shinfo(skb)->nr_frags; f++)
		skb_frag_unref(skb, f);
1395
	uarg = skb_shinfo(skb)->destructor_arg;
1396 1397
	/* increase inflight counter to offset decrement in callback */
	atomic_inc(&queue->inflight_packets);
1398 1399 1400
	uarg->callback(uarg, true);
	skb_shinfo(skb)->destructor_arg = NULL;

1401 1402 1403 1404
	/* Fill the skb with the new (local) frags. */
	memcpy(skb_shinfo(skb)->frags, frags, i * sizeof(skb_frag_t));
	skb_shinfo(skb)->nr_frags = i;
	skb->truesize += i * PAGE_SIZE;
1405 1406 1407

	return 0;
}
1408

1409
static int xenvif_tx_submit(struct xenvif_queue *queue)
I
Ian Campbell 已提交
1410
{
1411 1412
	struct gnttab_map_grant_ref *gop_map = queue->tx_map_ops;
	struct gnttab_copy *gop_copy = queue->tx_copy_ops;
I
Ian Campbell 已提交
1413
	struct sk_buff *skb;
1414
	int work_done = 0;
I
Ian Campbell 已提交
1415

1416
	while ((skb = __skb_dequeue(&queue->tx_queue)) != NULL) {
I
Ian Campbell 已提交
1417 1418 1419 1420
		struct xen_netif_tx_request *txp;
		u16 pending_idx;
		unsigned data_len;

1421
		pending_idx = XENVIF_TX_CB(skb)->pending_idx;
1422
		txp = &queue->pending_tx_info[pending_idx].req;
I
Ian Campbell 已提交
1423 1424

		/* Check the remap error code. */
1425
		if (unlikely(xenvif_tx_check_gop(queue, skb, &gop_map, &gop_copy))) {
1426 1427 1428 1429
			/* If there was an error, xenvif_tx_check_gop is
			 * expected to release all the frags which were mapped,
			 * so kfree_skb shouldn't do it again
			 */
I
Ian Campbell 已提交
1430
			skb_shinfo(skb)->nr_frags = 0;
1431 1432 1433 1434 1435
			if (skb_has_frag_list(skb)) {
				struct sk_buff *nskb =
						skb_shinfo(skb)->frag_list;
				skb_shinfo(nskb)->nr_frags = 0;
			}
I
Ian Campbell 已提交
1436 1437 1438 1439 1440
			kfree_skb(skb);
			continue;
		}

		data_len = skb->len;
1441
		callback_param(queue, pending_idx).ctx = NULL;
I
Ian Campbell 已提交
1442 1443 1444 1445 1446 1447
		if (data_len < txp->size) {
			/* Append the packet payload as a fragment. */
			txp->offset += data_len;
			txp->size -= data_len;
		} else {
			/* Schedule a response immediately. */
1448
			xenvif_idx_release(queue, pending_idx,
1449
					   XEN_NETIF_RSP_OKAY);
I
Ian Campbell 已提交
1450 1451 1452 1453 1454 1455 1456
		}

		if (txp->flags & XEN_NETTXF_csum_blank)
			skb->ip_summed = CHECKSUM_PARTIAL;
		else if (txp->flags & XEN_NETTXF_data_validated)
			skb->ip_summed = CHECKSUM_UNNECESSARY;

1457
		xenvif_fill_frags(queue, skb);
I
Ian Campbell 已提交
1458

1459
		if (unlikely(skb_has_frag_list(skb))) {
1460
			if (xenvif_handle_frag_list(queue, skb)) {
1461
				if (net_ratelimit())
1462
					netdev_err(queue->vif->dev,
1463
						   "Not enough memory to consolidate frag_list!\n");
1464
				xenvif_skb_zerocopy_prepare(queue, skb);
1465 1466 1467 1468 1469
				kfree_skb(skb);
				continue;
			}
		}

1470
		skb->dev      = queue->vif->dev;
I
Ian Campbell 已提交
1471
		skb->protocol = eth_type_trans(skb, skb->dev);
1472
		skb_reset_network_header(skb);
I
Ian Campbell 已提交
1473

1474 1475
		if (checksum_setup(queue, skb)) {
			netdev_dbg(queue->vif->dev,
I
Ian Campbell 已提交
1476
				   "Can't setup checksum in net_tx_action\n");
1477 1478
			/* We have to set this flag to trigger the callback */
			if (skb_shinfo(skb)->destructor_arg)
1479
				xenvif_skb_zerocopy_prepare(queue, skb);
I
Ian Campbell 已提交
1480 1481 1482 1483
			kfree_skb(skb);
			continue;
		}

1484
		skb_probe_transport_header(skb, 0);
1485

1486 1487 1488 1489 1490 1491 1492 1493 1494 1495 1496 1497 1498 1499
		/* If the packet is GSO then we will have just set up the
		 * transport header offset in checksum_setup so it's now
		 * straightforward to calculate gso_segs.
		 */
		if (skb_is_gso(skb)) {
			int mss = skb_shinfo(skb)->gso_size;
			int hdrlen = skb_transport_header(skb) -
				skb_mac_header(skb) +
				tcp_hdrlen(skb);

			skb_shinfo(skb)->gso_segs =
				DIV_ROUND_UP(skb->len - hdrlen, mss);
		}

1500 1501
		queue->stats.rx_bytes += skb->len;
		queue->stats.rx_packets++;
I
Ian Campbell 已提交
1502

1503 1504
		work_done++;

1505 1506 1507 1508 1509
		/* Set this flag right before netif_receive_skb, otherwise
		 * someone might think this packet already left netback, and
		 * do a skb_copy_ubufs while we are still in control of the
		 * skb. E.g. the __pskb_pull_tail earlier can do such thing.
		 */
1510
		if (skb_shinfo(skb)->destructor_arg) {
1511
			xenvif_skb_zerocopy_prepare(queue, skb);
1512
			queue->stats.tx_zerocopy_sent++;
1513
		}
1514

1515
		netif_receive_skb(skb);
I
Ian Campbell 已提交
1516
	}
1517 1518

	return work_done;
I
Ian Campbell 已提交
1519 1520
}

1521 1522
void xenvif_zerocopy_callback(struct ubuf_info *ubuf, bool zerocopy_success)
{
1523 1524
	unsigned long flags;
	pending_ring_idx_t index;
1525
	struct xenvif_queue *queue = ubuf_to_queue(ubuf);
1526 1527 1528 1529

	/* This is the only place where we grab this lock, to protect callbacks
	 * from each other.
	 */
1530
	spin_lock_irqsave(&queue->callback_lock, flags);
1531 1532 1533
	do {
		u16 pending_idx = ubuf->desc;
		ubuf = (struct ubuf_info *) ubuf->ctx;
1534
		BUG_ON(queue->dealloc_prod - queue->dealloc_cons >=
1535
			MAX_PENDING_REQS);
1536 1537
		index = pending_index(queue->dealloc_prod);
		queue->dealloc_ring[index] = pending_idx;
1538 1539 1540 1541
		/* Sync with xenvif_tx_dealloc_action:
		 * insert idx then incr producer.
		 */
		smp_wmb();
1542
		queue->dealloc_prod++;
1543
	} while (ubuf);
1544
	spin_unlock_irqrestore(&queue->callback_lock, flags);
1545

1546
	if (likely(zerocopy_success))
1547
		queue->stats.tx_zerocopy_success++;
1548
	else
1549
		queue->stats.tx_zerocopy_fail++;
1550
	xenvif_skb_zerocopy_complete(queue);
1551 1552
}

1553
static inline void xenvif_tx_dealloc_action(struct xenvif_queue *queue)
1554 1555 1556 1557 1558 1559
{
	struct gnttab_unmap_grant_ref *gop;
	pending_ring_idx_t dc, dp;
	u16 pending_idx, pending_idx_release[MAX_PENDING_REQS];
	unsigned int i = 0;

1560 1561
	dc = queue->dealloc_cons;
	gop = queue->tx_unmap_ops;
1562 1563 1564

	/* Free up any grants we have finished using */
	do {
1565
		dp = queue->dealloc_prod;
1566 1567 1568 1569 1570 1571 1572

		/* Ensure we see all indices enqueued by all
		 * xenvif_zerocopy_callback().
		 */
		smp_rmb();

		while (dc != dp) {
1573
			BUG_ON(gop - queue->tx_unmap_ops >= MAX_PENDING_REQS);
1574
			pending_idx =
1575
				queue->dealloc_ring[pending_index(dc++)];
1576

1577
			pending_idx_release[gop - queue->tx_unmap_ops] =
1578
				pending_idx;
1579
			queue->pages_to_unmap[gop - queue->tx_unmap_ops] =
1580
				queue->mmap_pages[pending_idx];
1581
			gnttab_set_unmap_op(gop,
1582
					    idx_to_kaddr(queue, pending_idx),
1583
					    GNTMAP_host_map,
1584 1585
					    queue->grant_tx_handle[pending_idx]);
			xenvif_grant_handle_reset(queue, pending_idx);
1586 1587 1588
			++gop;
		}

1589
	} while (dp != queue->dealloc_prod);
1590

1591
	queue->dealloc_cons = dc;
1592

1593
	if (gop - queue->tx_unmap_ops > 0) {
1594
		int ret;
1595
		ret = gnttab_unmap_refs(queue->tx_unmap_ops,
1596
					NULL,
1597 1598
					queue->pages_to_unmap,
					gop - queue->tx_unmap_ops);
1599
		if (ret) {
1600
			netdev_err(queue->vif->dev, "Unmap fail: nr_ops %tu ret %d\n",
1601 1602
				   gop - queue->tx_unmap_ops, ret);
			for (i = 0; i < gop - queue->tx_unmap_ops; ++i) {
1603
				if (gop[i].status != GNTST_okay)
1604
					netdev_err(queue->vif->dev,
1605
						   " host_addr: 0x%llx handle: 0x%x status: %d\n",
1606 1607 1608 1609 1610 1611 1612 1613
						   gop[i].host_addr,
						   gop[i].handle,
						   gop[i].status);
			}
			BUG();
		}
	}

1614 1615
	for (i = 0; i < gop - queue->tx_unmap_ops; ++i)
		xenvif_idx_release(queue, pending_idx_release[i],
1616
				   XEN_NETIF_RSP_OKAY);
1617 1618
}

1619

I
Ian Campbell 已提交
1620
/* Called after netfront has transmitted */
1621
int xenvif_tx_action(struct xenvif_queue *queue, int budget)
I
Ian Campbell 已提交
1622
{
1623
	unsigned nr_mops, nr_cops = 0;
1624
	int work_done, ret;
I
Ian Campbell 已提交
1625

1626
	if (unlikely(!tx_work_todo(queue)))
1627 1628
		return 0;

1629
	xenvif_tx_build_gops(queue, budget, &nr_cops, &nr_mops);
I
Ian Campbell 已提交
1630

1631
	if (nr_cops == 0)
1632 1633
		return 0;

1634
	gnttab_batch_copy(queue->tx_copy_ops, nr_cops);
1635
	if (nr_mops != 0) {
1636
		ret = gnttab_map_refs(queue->tx_map_ops,
1637
				      NULL,
1638
				      queue->pages_to_map,
1639 1640 1641
				      nr_mops);
		BUG_ON(ret);
	}
I
Ian Campbell 已提交
1642

1643
	work_done = xenvif_tx_submit(queue);
I
Ian Campbell 已提交
1644

1645
	return work_done;
I
Ian Campbell 已提交
1646 1647
}

1648
static void xenvif_idx_release(struct xenvif_queue *queue, u16 pending_idx,
W
Wei Liu 已提交
1649
			       u8 status)
I
Ian Campbell 已提交
1650 1651
{
	struct pending_tx_info *pending_tx_info;
1652 1653
	pending_ring_idx_t index;
	unsigned long flags;
1654

1655
	pending_tx_info = &queue->pending_tx_info[pending_idx];
1656

1657
	spin_lock_irqsave(&queue->response_lock, flags);
1658

1659
	make_tx_response(queue, &pending_tx_info->req, status);
1660 1661 1662 1663 1664 1665

	/* Release the pending index before pusing the Tx response so
	 * its available before a new Tx request is pushed by the
	 * frontend.
	 */
	index = pending_index(queue->pending_prod++);
1666
	queue->pending_ring[index] = pending_idx;
1667

1668
	push_tx_responses(queue);
1669

1670
	spin_unlock_irqrestore(&queue->response_lock, flags);
I
Ian Campbell 已提交
1671 1672
}

1673

1674
static void make_tx_response(struct xenvif_queue *queue,
I
Ian Campbell 已提交
1675 1676 1677
			     struct xen_netif_tx_request *txp,
			     s8       st)
{
1678
	RING_IDX i = queue->tx.rsp_prod_pvt;
I
Ian Campbell 已提交
1679 1680
	struct xen_netif_tx_response *resp;

1681
	resp = RING_GET_RESPONSE(&queue->tx, i);
I
Ian Campbell 已提交
1682 1683 1684 1685
	resp->id     = txp->id;
	resp->status = st;

	if (txp->flags & XEN_NETTXF_extra_info)
1686
		RING_GET_RESPONSE(&queue->tx, ++i)->status = XEN_NETIF_RSP_NULL;
I
Ian Campbell 已提交
1687

1688
	queue->tx.rsp_prod_pvt = ++i;
I
Ian Campbell 已提交
1689 1690
}

1691 1692 1693 1694 1695 1696 1697 1698 1699
static void push_tx_responses(struct xenvif_queue *queue)
{
	int notify;

	RING_PUSH_RESPONSES_AND_CHECK_NOTIFY(&queue->tx, notify);
	if (notify)
		notify_remote_via_irq(queue->tx_irq);
}

1700
static struct xen_netif_rx_response *make_rx_response(struct xenvif_queue *queue,
I
Ian Campbell 已提交
1701 1702 1703 1704 1705 1706
					     u16      id,
					     s8       st,
					     u16      offset,
					     u16      size,
					     u16      flags)
{
1707
	RING_IDX i = queue->rx.rsp_prod_pvt;
I
Ian Campbell 已提交
1708 1709
	struct xen_netif_rx_response *resp;

1710
	resp = RING_GET_RESPONSE(&queue->rx, i);
I
Ian Campbell 已提交
1711 1712 1713 1714 1715 1716 1717
	resp->offset     = offset;
	resp->flags      = flags;
	resp->id         = id;
	resp->status     = (s16)size;
	if (st < 0)
		resp->status = (s16)st;

1718
	queue->rx.rsp_prod_pvt = ++i;
I
Ian Campbell 已提交
1719 1720 1721 1722

	return resp;
}

1723
void xenvif_idx_unmap(struct xenvif_queue *queue, u16 pending_idx)
1724 1725 1726 1727 1728
{
	int ret;
	struct gnttab_unmap_grant_ref tx_unmap_op;

	gnttab_set_unmap_op(&tx_unmap_op,
1729
			    idx_to_kaddr(queue, pending_idx),
1730
			    GNTMAP_host_map,
1731 1732
			    queue->grant_tx_handle[pending_idx]);
	xenvif_grant_handle_reset(queue, pending_idx);
1733 1734

	ret = gnttab_unmap_refs(&tx_unmap_op, NULL,
1735
				&queue->mmap_pages[pending_idx], 1);
1736
	if (ret) {
1737
		netdev_err(queue->vif->dev,
1738
			   "Unmap fail: ret: %d pending_idx: %d host_addr: %llx handle: 0x%x status: %d\n",
1739 1740 1741 1742 1743 1744 1745
			   ret,
			   pending_idx,
			   tx_unmap_op.host_addr,
			   tx_unmap_op.handle,
			   tx_unmap_op.status);
		BUG();
	}
1746 1747
}

1748
static inline int tx_work_todo(struct xenvif_queue *queue)
I
Ian Campbell 已提交
1749
{
1750
	if (likely(RING_HAS_UNCONSUMED_REQUESTS(&queue->tx)))
I
Ian Campbell 已提交
1751 1752 1753 1754 1755
		return 1;

	return 0;
}

1756
static inline bool tx_dealloc_work_todo(struct xenvif_queue *queue)
1757
{
1758
	return queue->dealloc_cons != queue->dealloc_prod;
1759 1760
}

1761
void xenvif_unmap_frontend_rings(struct xenvif_queue *queue)
I
Ian Campbell 已提交
1762
{
1763 1764 1765 1766 1767 1768
	if (queue->tx.sring)
		xenbus_unmap_ring_vfree(xenvif_to_xenbus_device(queue->vif),
					queue->tx.sring);
	if (queue->rx.sring)
		xenbus_unmap_ring_vfree(xenvif_to_xenbus_device(queue->vif),
					queue->rx.sring);
I
Ian Campbell 已提交
1769 1770
}

1771
int xenvif_map_frontend_rings(struct xenvif_queue *queue,
W
Wei Liu 已提交
1772 1773
			      grant_ref_t tx_ring_ref,
			      grant_ref_t rx_ring_ref)
I
Ian Campbell 已提交
1774
{
1775
	void *addr;
I
Ian Campbell 已提交
1776 1777 1778 1779 1780
	struct xen_netif_tx_sring *txs;
	struct xen_netif_rx_sring *rxs;

	int err = -ENOMEM;

1781
	err = xenbus_map_ring_valloc(xenvif_to_xenbus_device(queue->vif),
1782
				     &tx_ring_ref, 1, &addr);
1783
	if (err)
I
Ian Campbell 已提交
1784 1785
		goto err;

1786
	txs = (struct xen_netif_tx_sring *)addr;
1787
	BACK_RING_INIT(&queue->tx, txs, PAGE_SIZE);
I
Ian Campbell 已提交
1788

1789
	err = xenbus_map_ring_valloc(xenvif_to_xenbus_device(queue->vif),
1790
				     &rx_ring_ref, 1, &addr);
1791
	if (err)
I
Ian Campbell 已提交
1792 1793
		goto err;

1794
	rxs = (struct xen_netif_rx_sring *)addr;
1795
	BACK_RING_INIT(&queue->rx, rxs, PAGE_SIZE);
I
Ian Campbell 已提交
1796 1797 1798 1799

	return 0;

err:
1800
	xenvif_unmap_frontend_rings(queue);
I
Ian Campbell 已提交
1801 1802 1803
	return err;
}

1804
static void xenvif_queue_carrier_off(struct xenvif_queue *queue)
1805
{
1806 1807 1808 1809 1810 1811 1812 1813 1814 1815 1816
	struct xenvif *vif = queue->vif;

	queue->stalled = true;

	/* At least one queue has stalled? Disable the carrier. */
	spin_lock(&vif->lock);
	if (vif->stalled_queues++ == 0) {
		netdev_info(vif->dev, "Guest Rx stalled");
		netif_carrier_off(vif->dev);
	}
	spin_unlock(&vif->lock);
1817 1818
}

1819
static void xenvif_queue_carrier_on(struct xenvif_queue *queue)
1820
{
1821
	struct xenvif *vif = queue->vif;
1822

1823 1824
	queue->last_rx_time = jiffies; /* Reset Rx stall detection. */
	queue->stalled = false;
1825

1826 1827 1828 1829 1830 1831 1832 1833
	/* All queues are ready? Enable the carrier. */
	spin_lock(&vif->lock);
	if (--vif->stalled_queues == 0) {
		netdev_info(vif->dev, "Guest Rx ready");
		netif_carrier_on(vif->dev);
	}
	spin_unlock(&vif->lock);
}
1834

1835 1836 1837 1838 1839 1840 1841 1842 1843 1844
static bool xenvif_rx_queue_stalled(struct xenvif_queue *queue)
{
	RING_IDX prod, cons;

	prod = queue->rx.sring->req_prod;
	cons = queue->rx.req_cons;

	return !queue->stalled
		&& prod - cons < XEN_NETBK_RX_SLOTS_MAX
		&& time_after(jiffies,
1845
			      queue->last_rx_time + queue->vif->stall_timeout);
1846 1847 1848 1849 1850 1851 1852 1853 1854 1855 1856 1857 1858
}

static bool xenvif_rx_queue_ready(struct xenvif_queue *queue)
{
	RING_IDX prod, cons;

	prod = queue->rx.sring->req_prod;
	cons = queue->rx.req_cons;

	return queue->stalled
		&& prod - cons >= XEN_NETBK_RX_SLOTS_MAX;
}

1859
static bool xenvif_have_rx_work(struct xenvif_queue *queue)
1860
{
1861 1862
	return (!skb_queue_empty(&queue->rx_queue)
		&& xenvif_rx_ring_slots_available(queue, XEN_NETBK_RX_SLOTS_MAX))
1863 1864 1865
		|| (queue->vif->stall_timeout &&
		    (xenvif_rx_queue_stalled(queue)
		     || xenvif_rx_queue_ready(queue)))
1866 1867
		|| kthread_should_stop()
		|| queue->vif->disabled;
1868 1869
}

1870
static long xenvif_rx_queue_timeout(struct xenvif_queue *queue)
1871
{
1872 1873
	struct sk_buff *skb;
	long timeout;
1874

1875 1876 1877
	skb = skb_peek(&queue->rx_queue);
	if (!skb)
		return MAX_SCHEDULE_TIMEOUT;
1878

1879 1880 1881
	timeout = XENVIF_RX_CB(skb)->expires - jiffies;
	return timeout < 0 ? 0 : timeout;
}
1882

1883 1884 1885 1886 1887 1888 1889 1890 1891 1892 1893 1894 1895 1896 1897 1898 1899 1900 1901 1902 1903 1904 1905 1906 1907 1908
/* Wait until the guest Rx thread has work.
 *
 * The timeout needs to be adjusted based on the current head of the
 * queue (and not just the head at the beginning).  In particular, if
 * the queue is initially empty an infinite timeout is used and this
 * needs to be reduced when a skb is queued.
 *
 * This cannot be done with wait_event_timeout() because it only
 * calculates the timeout once.
 */
static void xenvif_wait_for_rx_work(struct xenvif_queue *queue)
{
	DEFINE_WAIT(wait);

	if (xenvif_have_rx_work(queue))
		return;

	for (;;) {
		long ret;

		prepare_to_wait(&queue->wq, &wait, TASK_INTERRUPTIBLE);
		if (xenvif_have_rx_work(queue))
			break;
		ret = schedule_timeout(xenvif_rx_queue_timeout(queue));
		if (!ret)
			break;
1909
	}
1910
	finish_wait(&queue->wq, &wait);
1911 1912
}

1913
int xenvif_kthread_guest_rx(void *data)
1914
{
1915
	struct xenvif_queue *queue = data;
1916
	struct xenvif *vif = queue->vif;
1917

1918 1919 1920
	if (!vif->stall_timeout)
		xenvif_queue_carrier_on(queue);

1921 1922
	for (;;) {
		xenvif_wait_for_rx_work(queue);
1923

1924 1925 1926
		if (kthread_should_stop())
			break;

1927 1928 1929 1930
		/* This frontend is found to be rogue, disable it in
		 * kthread context. Currently this is only set when
		 * netback finds out frontend sends malformed packet,
		 * but we cannot disable the interface in softirq
1931 1932
		 * context so we defer it here, if this thread is
		 * associated with queue 0.
1933
		 */
1934 1935
		if (unlikely(vif->disabled && queue->id == 0)) {
			xenvif_carrier_off(vif);
1936
			break;
1937 1938
		}

1939 1940
		if (!skb_queue_empty(&queue->rx_queue))
			xenvif_rx_action(queue);
1941

1942 1943 1944 1945
		/* If the guest hasn't provided any Rx slots for a
		 * while it's probably not responsive, drop the
		 * carrier so packets are dropped earlier.
		 */
1946 1947 1948 1949 1950 1951
		if (vif->stall_timeout) {
			if (xenvif_rx_queue_stalled(queue))
				xenvif_queue_carrier_off(queue);
			else if (xenvif_rx_queue_ready(queue))
				xenvif_queue_carrier_on(queue);
		}
1952

1953 1954 1955 1956 1957 1958 1959 1960 1961
		/* Queued packets may have foreign pages from other
		 * domains.  These cannot be queued indefinitely as
		 * this would starve guests of grant refs and transmit
		 * slots.
		 */
		xenvif_rx_queue_drop_expired(queue);

		xenvif_rx_queue_maybe_wake(queue);

1962 1963 1964
		cond_resched();
	}

1965
	/* Bin any remaining skbs */
1966
	xenvif_rx_queue_purge(queue);
1967

1968 1969 1970
	return 0;
}

1971 1972 1973 1974 1975 1976 1977 1978 1979
static bool xenvif_dealloc_kthread_should_stop(struct xenvif_queue *queue)
{
	/* Dealloc thread must remain running until all inflight
	 * packets complete.
	 */
	return kthread_should_stop() &&
		!atomic_read(&queue->inflight_packets);
}

1980 1981
int xenvif_dealloc_kthread(void *data)
{
1982
	struct xenvif_queue *queue = data;
1983

1984
	for (;;) {
1985 1986
		wait_event_interruptible(queue->dealloc_wq,
					 tx_dealloc_work_todo(queue) ||
1987 1988
					 xenvif_dealloc_kthread_should_stop(queue));
		if (xenvif_dealloc_kthread_should_stop(queue))
1989 1990
			break;

1991
		xenvif_tx_dealloc_action(queue);
1992 1993 1994 1995
		cond_resched();
	}

	/* Unmap anything remaining*/
1996 1997
	if (tx_dealloc_work_todo(queue))
		xenvif_tx_dealloc_action(queue);
1998 1999 2000 2001

	return 0;
}

I
Ian Campbell 已提交
2002 2003 2004 2005
static int __init netback_init(void)
{
	int rc = 0;

2006
	if (!xen_domain())
I
Ian Campbell 已提交
2007 2008
		return -ENODEV;

2009 2010 2011
	/* Allow as many queues as there are CPUs, by default */
	xenvif_max_queues = num_online_cpus();

2012
	if (fatal_skb_slots < XEN_NETBK_LEGACY_SLOTS_MAX) {
2013 2014
		pr_info("fatal_skb_slots too small (%d), bump it to XEN_NETBK_LEGACY_SLOTS_MAX (%d)\n",
			fatal_skb_slots, XEN_NETBK_LEGACY_SLOTS_MAX);
2015
		fatal_skb_slots = XEN_NETBK_LEGACY_SLOTS_MAX;
2016 2017
	}

I
Ian Campbell 已提交
2018 2019 2020 2021
	rc = xenvif_xenbus_init();
	if (rc)
		goto failed_init;

2022 2023 2024 2025 2026 2027 2028
#ifdef CONFIG_DEBUG_FS
	xen_netback_dbg_root = debugfs_create_dir("xen-netback", NULL);
	if (IS_ERR_OR_NULL(xen_netback_dbg_root))
		pr_warn("Init of debugfs returned %ld!\n",
			PTR_ERR(xen_netback_dbg_root));
#endif /* CONFIG_DEBUG_FS */

I
Ian Campbell 已提交
2029 2030 2031 2032 2033 2034 2035 2036
	return 0;

failed_init:
	return rc;
}

module_init(netback_init);

2037 2038
static void __exit netback_fini(void)
{
2039 2040 2041 2042
#ifdef CONFIG_DEBUG_FS
	if (!IS_ERR_OR_NULL(xen_netback_dbg_root))
		debugfs_remove_recursive(xen_netback_dbg_root);
#endif /* CONFIG_DEBUG_FS */
2043 2044 2045 2046
	xenvif_xenbus_fini();
}
module_exit(netback_fini);

I
Ian Campbell 已提交
2047
MODULE_LICENSE("Dual BSD/GPL");
2048
MODULE_ALIAS("xen-backend:vif");