netback.c 53.4 KB
Newer Older
I
Ian Campbell 已提交
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39
/*
 * Back-end of the driver for virtual network devices. This portion of the
 * driver exports a 'unified' network-device interface that can be accessed
 * by any operating system that implements a compatible front end. A
 * reference front-end implementation can be found in:
 *  drivers/net/xen-netfront.c
 *
 * Copyright (c) 2002-2005, K A Fraser
 *
 * This program is free software; you can redistribute it and/or
 * modify it under the terms of the GNU General Public License version 2
 * as published by the Free Software Foundation; or, when distributed
 * separately from the Linux kernel or incorporated into other
 * software packages, subject to the following license:
 *
 * Permission is hereby granted, free of charge, to any person obtaining a copy
 * of this source file (the "Software"), to deal in the Software without
 * restriction, including without limitation the rights to use, copy, modify,
 * merge, publish, distribute, sublicense, and/or sell copies of the Software,
 * and to permit persons to whom the Software is furnished to do so, subject to
 * the following conditions:
 *
 * The above copyright notice and this permission notice shall be included in
 * all copies or substantial portions of the Software.
 *
 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
 * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
 * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS
 * IN THE SOFTWARE.
 */

#include "common.h"

#include <linux/kthread.h>
#include <linux/if_vlan.h>
#include <linux/udp.h>
40
#include <linux/highmem.h>
I
Ian Campbell 已提交
41 42 43

#include <net/tcp.h>

S
Stefano Stabellini 已提交
44
#include <xen/xen.h>
I
Ian Campbell 已提交
45 46 47 48 49 50
#include <xen/events.h>
#include <xen/interface/memory.h>

#include <asm/xen/hypercall.h>
#include <asm/xen/page.h>

51 52 53 54 55 56 57
/* Provide an option to disable split event channels at load time as
 * event channels are limited resource. Split event channels are
 * enabled by default.
 */
bool separate_tx_rx_irq = 1;
module_param(separate_tx_rx_irq, bool, 0644);

58 59
/* The time that packets can stay on the guest Rx internal queue
 * before they are dropped.
60 61 62 63
 */
unsigned int rx_drain_timeout_msecs = 10000;
module_param(rx_drain_timeout_msecs, uint, 0444);

64 65 66
/* The length of time before the frontend is considered unresponsive
 * because it isn't providing Rx slots.
 */
67
unsigned int rx_stall_timeout_msecs = 60000;
68 69
module_param(rx_stall_timeout_msecs, uint, 0444);

70 71 72 73 74
unsigned int xenvif_max_queues;
module_param_named(max_queues, xenvif_max_queues, uint, 0644);
MODULE_PARM_DESC(max_queues,
		 "Maximum number of queues per virtual interface");

75 76 77 78
/*
 * This is the maximum slots a skb can have. If a guest sends a skb
 * which exceeds this limit it is considered malicious.
 */
79 80 81 82
#define FATAL_SKB_SLOTS_DEFAULT 20
static unsigned int fatal_skb_slots = FATAL_SKB_SLOTS_DEFAULT;
module_param(fatal_skb_slots, uint, 0444);

83 84 85 86 87 88 89 90 91 92
/* The amount to copy out of the first guest Tx slot into the skb's
 * linear area.  If the first slot has more data, it will be mapped
 * and put into the first frag.
 *
 * This is sized to avoid pulling headers from the frags for most
 * TCP/IP packets.
 */
#define XEN_NETBACK_TX_COPY_LEN 128


93
static void xenvif_idx_release(struct xenvif_queue *queue, u16 pending_idx,
W
Wei Liu 已提交
94 95
			       u8 status);

96
static void make_tx_response(struct xenvif_queue *queue,
I
Ian Campbell 已提交
97 98
			     struct xen_netif_tx_request *txp,
			     s8       st);
99
static void push_tx_responses(struct xenvif_queue *queue);
100

101
static inline int tx_work_todo(struct xenvif_queue *queue);
102

103
static struct xen_netif_rx_response *make_rx_response(struct xenvif_queue *queue,
I
Ian Campbell 已提交
104 105 106 107 108 109
					     u16      id,
					     s8       st,
					     u16      offset,
					     u16      size,
					     u16      flags);

110
static inline unsigned long idx_to_pfn(struct xenvif_queue *queue,
111
				       u16 idx)
I
Ian Campbell 已提交
112
{
113
	return page_to_pfn(queue->mmap_pages[idx]);
I
Ian Campbell 已提交
114 115
}

116
static inline unsigned long idx_to_kaddr(struct xenvif_queue *queue,
117
					 u16 idx)
I
Ian Campbell 已提交
118
{
119
	return (unsigned long)pfn_to_kaddr(idx_to_pfn(queue, idx));
I
Ian Campbell 已提交
120 121
}

122 123 124
#define callback_param(vif, pending_idx) \
	(vif->pending_tx_info[pending_idx].callback_struct)

125 126
/* Find the containing VIF's structure from a pointer in pending_tx_info array
 */
127
static inline struct xenvif_queue *ubuf_to_queue(const struct ubuf_info *ubuf)
128
{
129 130 131 132
	u16 pending_idx = ubuf->desc;
	struct pending_tx_info *temp =
		container_of(ubuf, struct pending_tx_info, callback_struct);
	return container_of(temp - pending_idx,
133
			    struct xenvif_queue,
134
			    pending_tx_info[0]);
135
}
136

137 138 139 140 141 142 143 144 145 146
static u16 frag_get_pending_idx(skb_frag_t *frag)
{
	return (u16)frag->page_offset;
}

static void frag_set_pending_idx(skb_frag_t *frag, u16 pending_idx)
{
	frag->page_offset = pending_idx;
}

I
Ian Campbell 已提交
147 148 149 150 151
static inline pending_ring_idx_t pending_index(unsigned i)
{
	return i & (MAX_PENDING_REQS-1);
}

152
bool xenvif_rx_ring_slots_available(struct xenvif_queue *queue, int needed)
I
Ian Campbell 已提交
153
{
154
	RING_IDX prod, cons;
I
Ian Campbell 已提交
155

156
	do {
157 158
		prod = queue->rx.sring->req_prod;
		cons = queue->rx.req_cons;
I
Ian Campbell 已提交
159

160 161
		if (prod - cons >= needed)
			return true;
I
Ian Campbell 已提交
162

163
		queue->rx.sring->req_event = prod + 1;
I
Ian Campbell 已提交
164

165 166 167 168
		/* Make sure event is visible before we check prod
		 * again.
		 */
		mb();
169
	} while (queue->rx.sring->req_prod != prod);
I
Ian Campbell 已提交
170

171
	return false;
I
Ian Campbell 已提交
172 173
}

174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236
void xenvif_rx_queue_tail(struct xenvif_queue *queue, struct sk_buff *skb)
{
	unsigned long flags;

	spin_lock_irqsave(&queue->rx_queue.lock, flags);

	__skb_queue_tail(&queue->rx_queue, skb);

	queue->rx_queue_len += skb->len;
	if (queue->rx_queue_len > queue->rx_queue_max)
		netif_tx_stop_queue(netdev_get_tx_queue(queue->vif->dev, queue->id));

	spin_unlock_irqrestore(&queue->rx_queue.lock, flags);
}

static struct sk_buff *xenvif_rx_dequeue(struct xenvif_queue *queue)
{
	struct sk_buff *skb;

	spin_lock_irq(&queue->rx_queue.lock);

	skb = __skb_dequeue(&queue->rx_queue);
	if (skb)
		queue->rx_queue_len -= skb->len;

	spin_unlock_irq(&queue->rx_queue.lock);

	return skb;
}

static void xenvif_rx_queue_maybe_wake(struct xenvif_queue *queue)
{
	spin_lock_irq(&queue->rx_queue.lock);

	if (queue->rx_queue_len < queue->rx_queue_max)
		netif_tx_wake_queue(netdev_get_tx_queue(queue->vif->dev, queue->id));

	spin_unlock_irq(&queue->rx_queue.lock);
}


static void xenvif_rx_queue_purge(struct xenvif_queue *queue)
{
	struct sk_buff *skb;
	while ((skb = xenvif_rx_dequeue(queue)) != NULL)
		kfree_skb(skb);
}

static void xenvif_rx_queue_drop_expired(struct xenvif_queue *queue)
{
	struct sk_buff *skb;

	for(;;) {
		skb = skb_peek(&queue->rx_queue);
		if (!skb)
			break;
		if (time_before(jiffies, XENVIF_RX_CB(skb)->expires))
			break;
		xenvif_rx_dequeue(queue);
		kfree_skb(skb);
	}
}

I
Ian Campbell 已提交
237 238 239 240
struct netrx_pending_operations {
	unsigned copy_prod, copy_cons;
	unsigned meta_prod, meta_cons;
	struct gnttab_copy *copy;
241
	struct xenvif_rx_meta *meta;
I
Ian Campbell 已提交
242 243 244 245
	int copy_off;
	grant_ref_t copy_gref;
};

246
static struct xenvif_rx_meta *get_next_rx_buffer(struct xenvif_queue *queue,
247
						 struct netrx_pending_operations *npo)
I
Ian Campbell 已提交
248
{
249
	struct xenvif_rx_meta *meta;
I
Ian Campbell 已提交
250 251
	struct xen_netif_rx_request *req;

252
	req = RING_GET_REQUEST(&queue->rx, queue->rx.req_cons++);
I
Ian Campbell 已提交
253 254

	meta = npo->meta + npo->meta_prod++;
255
	meta->gso_type = XEN_NETIF_GSO_TYPE_NONE;
I
Ian Campbell 已提交
256 257 258 259 260 261 262 263 264 265
	meta->gso_size = 0;
	meta->size = 0;
	meta->id = req->id;

	npo->copy_off = 0;
	npo->copy_gref = req->gref;

	return meta;
}

266 267 268 269
/*
 * Set up the grant operations for this fragment. If it's a flipping
 * interface, we also set up the unmap request from here.
 */
270
static void xenvif_gop_frag_copy(struct xenvif_queue *queue, struct sk_buff *skb,
W
Wei Liu 已提交
271 272
				 struct netrx_pending_operations *npo,
				 struct page *page, unsigned long size,
273
				 unsigned long offset, int *head)
I
Ian Campbell 已提交
274 275
{
	struct gnttab_copy *copy_gop;
276
	struct xenvif_rx_meta *meta;
I
Ian Campbell 已提交
277
	unsigned long bytes;
278
	int gso_type = XEN_NETIF_GSO_TYPE_NONE;
I
Ian Campbell 已提交
279 280

	/* Data must not cross a page boundary. */
281
	BUG_ON(size + offset > PAGE_SIZE<<compound_order(page));
I
Ian Campbell 已提交
282 283 284

	meta = npo->meta + npo->meta_prod - 1;

285 286 287 288
	/* Skip unused frames from start of page */
	page += offset >> PAGE_SHIFT;
	offset &= ~PAGE_MASK;

I
Ian Campbell 已提交
289
	while (size > 0) {
290 291
		struct xen_page_foreign *foreign;

292
		BUG_ON(offset >= PAGE_SIZE);
I
Ian Campbell 已提交
293 294
		BUG_ON(npo->copy_off > MAX_BUFFER_OFFSET);

295 296
		if (npo->copy_off == MAX_BUFFER_OFFSET)
			meta = get_next_rx_buffer(queue, npo);
297

298
		bytes = PAGE_SIZE - offset;
299 300 301
		if (bytes > size)
			bytes = size;

I
Ian Campbell 已提交
302 303 304 305 306
		if (npo->copy_off + bytes > MAX_BUFFER_OFFSET)
			bytes = MAX_BUFFER_OFFSET - npo->copy_off;

		copy_gop = npo->copy + npo->copy_prod++;
		copy_gop->flags = GNTCOPY_dest_gref;
307 308
		copy_gop->len = bytes;

309 310 311 312
		foreign = xen_page_foreign(page);
		if (foreign) {
			copy_gop->source.domid = foreign->domid;
			copy_gop->source.u.ref = foreign->gref;
313 314 315 316 317 318
			copy_gop->flags |= GNTCOPY_source_gref;
		} else {
			copy_gop->source.domid = DOMID_SELF;
			copy_gop->source.u.gmfn =
				virt_to_mfn(page_address(page));
		}
I
Ian Campbell 已提交
319 320
		copy_gop->source.offset = offset;

321
		copy_gop->dest.domid = queue->vif->domid;
I
Ian Campbell 已提交
322 323 324 325 326 327 328 329 330
		copy_gop->dest.offset = npo->copy_off;
		copy_gop->dest.u.ref = npo->copy_gref;

		npo->copy_off += bytes;
		meta->size += bytes;

		offset += bytes;
		size -= bytes;

331 332 333 334 335 336 337
		/* Next frame */
		if (offset == PAGE_SIZE && size) {
			BUG_ON(!PageCompound(page));
			page++;
			offset = 0;
		}

I
Ian Campbell 已提交
338
		/* Leave a gap for the GSO descriptor. */
339 340 341 342 343 344
		if (skb_is_gso(skb)) {
			if (skb_shinfo(skb)->gso_type & SKB_GSO_TCPV4)
				gso_type = XEN_NETIF_GSO_TYPE_TCPV4;
			else if (skb_shinfo(skb)->gso_type & SKB_GSO_TCPV6)
				gso_type = XEN_NETIF_GSO_TYPE_TCPV6;
		}
345

346 347
		if (*head && ((1 << gso_type) & queue->vif->gso_mask))
			queue->rx.req_cons++;
I
Ian Campbell 已提交
348

349
		*head = 0; /* There must be something in this buffer now. */
I
Ian Campbell 已提交
350 351 352 353 354 355 356 357 358 359 360 361 362 363 364 365

	}
}

/*
 * Prepare an SKB to be transmitted to the frontend.
 *
 * This function is responsible for allocating grant operations, meta
 * structures, etc.
 *
 * It returns the number of meta structures consumed. The number of
 * ring slots used is always equal to the number of meta slots used
 * plus the number of GSO descriptors used. Currently, we use either
 * zero GSO descriptors (for non-GSO packets) or one descriptor (for
 * frontend-side LRO).
 */
W
Wei Liu 已提交
366
static int xenvif_gop_skb(struct sk_buff *skb,
367 368
			  struct netrx_pending_operations *npo,
			  struct xenvif_queue *queue)
I
Ian Campbell 已提交
369 370 371 372 373
{
	struct xenvif *vif = netdev_priv(skb->dev);
	int nr_frags = skb_shinfo(skb)->nr_frags;
	int i;
	struct xen_netif_rx_request *req;
374
	struct xenvif_rx_meta *meta;
I
Ian Campbell 已提交
375
	unsigned char *data;
376
	int head = 1;
I
Ian Campbell 已提交
377
	int old_meta_prod;
378
	int gso_type;
I
Ian Campbell 已提交
379 380 381

	old_meta_prod = npo->meta_prod;

382 383 384 385 386 387
	gso_type = XEN_NETIF_GSO_TYPE_NONE;
	if (skb_is_gso(skb)) {
		if (skb_shinfo(skb)->gso_type & SKB_GSO_TCPV4)
			gso_type = XEN_NETIF_GSO_TYPE_TCPV4;
		else if (skb_shinfo(skb)->gso_type & SKB_GSO_TCPV6)
			gso_type = XEN_NETIF_GSO_TYPE_TCPV6;
388 389
	}

I
Ian Campbell 已提交
390
	/* Set up a GSO prefix descriptor, if necessary */
P
Paul Durrant 已提交
391
	if ((1 << gso_type) & vif->gso_prefix_mask) {
392
		req = RING_GET_REQUEST(&queue->rx, queue->rx.req_cons++);
I
Ian Campbell 已提交
393
		meta = npo->meta + npo->meta_prod++;
394
		meta->gso_type = gso_type;
395
		meta->gso_size = skb_shinfo(skb)->gso_size;
I
Ian Campbell 已提交
396 397 398 399
		meta->size = 0;
		meta->id = req->id;
	}

400
	req = RING_GET_REQUEST(&queue->rx, queue->rx.req_cons++);
I
Ian Campbell 已提交
401 402
	meta = npo->meta + npo->meta_prod++;

403 404
	if ((1 << gso_type) & vif->gso_mask) {
		meta->gso_type = gso_type;
405
		meta->gso_size = skb_shinfo(skb)->gso_size;
406 407
	} else {
		meta->gso_type = XEN_NETIF_GSO_TYPE_NONE;
I
Ian Campbell 已提交
408
		meta->gso_size = 0;
409
	}
I
Ian Campbell 已提交
410 411 412 413 414 415 416 417 418 419 420 421 422 423

	meta->size = 0;
	meta->id = req->id;
	npo->copy_off = 0;
	npo->copy_gref = req->gref;

	data = skb->data;
	while (data < skb_tail_pointer(skb)) {
		unsigned int offset = offset_in_page(data);
		unsigned int len = PAGE_SIZE - offset;

		if (data + len > skb_tail_pointer(skb))
			len = skb_tail_pointer(skb) - data;

424
		xenvif_gop_frag_copy(queue, skb, npo,
425
				     virt_to_page(data), len, offset, &head);
I
Ian Campbell 已提交
426 427 428 429
		data += len;
	}

	for (i = 0; i < nr_frags; i++) {
430
		xenvif_gop_frag_copy(queue, skb, npo,
W
Wei Liu 已提交
431 432 433
				     skb_frag_page(&skb_shinfo(skb)->frags[i]),
				     skb_frag_size(&skb_shinfo(skb)->frags[i]),
				     skb_shinfo(skb)->frags[i].page_offset,
434
				     &head);
I
Ian Campbell 已提交
435 436 437 438 439 440
	}

	return npo->meta_prod - old_meta_prod;
}

/*
W
Wei Liu 已提交
441
 * This is a twin to xenvif_gop_skb.  Assume that xenvif_gop_skb was
I
Ian Campbell 已提交
442 443 444 445
 * used to set up the operations on the top of
 * netrx_pending_operations, which have since been done.  Check that
 * they didn't give any errors and advance over them.
 */
W
Wei Liu 已提交
446 447
static int xenvif_check_gop(struct xenvif *vif, int nr_meta_slots,
			    struct netrx_pending_operations *npo)
I
Ian Campbell 已提交
448 449 450 451 452 453 454 455 456 457 458 459 460 461 462 463 464 465
{
	struct gnttab_copy     *copy_op;
	int status = XEN_NETIF_RSP_OKAY;
	int i;

	for (i = 0; i < nr_meta_slots; i++) {
		copy_op = npo->copy + npo->copy_cons++;
		if (copy_op->status != GNTST_okay) {
			netdev_dbg(vif->dev,
				   "Bad status %d from copy to DOM%d.\n",
				   copy_op->status, vif->domid);
			status = XEN_NETIF_RSP_ERROR;
		}
	}

	return status;
}

466
static void xenvif_add_frag_responses(struct xenvif_queue *queue, int status,
W
Wei Liu 已提交
467 468
				      struct xenvif_rx_meta *meta,
				      int nr_meta_slots)
I
Ian Campbell 已提交
469 470 471 472 473 474 475 476 477 478 479 480 481 482 483 484 485 486
{
	int i;
	unsigned long offset;

	/* No fragments used */
	if (nr_meta_slots <= 1)
		return;

	nr_meta_slots--;

	for (i = 0; i < nr_meta_slots; i++) {
		int flags;
		if (i == nr_meta_slots - 1)
			flags = 0;
		else
			flags = XEN_NETRXF_more_data;

		offset = 0;
487
		make_rx_response(queue, meta[i].id, status, offset,
I
Ian Campbell 已提交
488 489 490 491
				 meta[i].size, flags);
	}
}

492
void xenvif_kick_thread(struct xenvif_queue *queue)
493
{
494
	wake_up(&queue->wq);
495 496
}

497
static void xenvif_rx_action(struct xenvif_queue *queue)
I
Ian Campbell 已提交
498 499
{
	s8 status;
500
	u16 flags;
I
Ian Campbell 已提交
501 502 503 504 505 506
	struct xen_netif_rx_response *resp;
	struct sk_buff_head rxq;
	struct sk_buff *skb;
	LIST_HEAD(notify);
	int ret;
	unsigned long offset;
507
	bool need_to_notify = false;
I
Ian Campbell 已提交
508 509

	struct netrx_pending_operations npo = {
510 511
		.copy  = queue->grant_copy_op,
		.meta  = queue->meta,
I
Ian Campbell 已提交
512 513 514 515
	};

	skb_queue_head_init(&rxq);

516 517
	while (xenvif_rx_ring_slots_available(queue, XEN_NETBK_RX_SLOTS_MAX)
	       && (skb = xenvif_rx_dequeue(queue)) != NULL) {
518 519
		RING_IDX old_req_cons;
		RING_IDX ring_slots_used;
520

521 522
		queue->last_rx_time = jiffies;

523 524 525
		old_req_cons = queue->rx.req_cons;
		XENVIF_RX_CB(skb)->meta_slots_used = xenvif_gop_skb(skb, &npo, queue);
		ring_slots_used = queue->rx.req_cons - old_req_cons;
526

I
Ian Campbell 已提交
527 528 529
		__skb_queue_tail(&rxq, skb);
	}

530
	BUG_ON(npo.meta_prod > ARRAY_SIZE(queue->meta));
I
Ian Campbell 已提交
531 532

	if (!npo.copy_prod)
533
		goto done;
I
Ian Campbell 已提交
534

535
	BUG_ON(npo.copy_prod > MAX_GRANT_COPY_OPS);
536
	gnttab_batch_copy(queue->grant_copy_op, npo.copy_prod);
I
Ian Campbell 已提交
537 538 539

	while ((skb = __skb_dequeue(&rxq)) != NULL) {

540 541 542 543
		if ((1 << queue->meta[npo.meta_cons].gso_type) &
		    queue->vif->gso_prefix_mask) {
			resp = RING_GET_RESPONSE(&queue->rx,
						 queue->rx.rsp_prod_pvt++);
I
Ian Campbell 已提交
544 545 546

			resp->flags = XEN_NETRXF_gso_prefix | XEN_NETRXF_more_data;

547 548
			resp->offset = queue->meta[npo.meta_cons].gso_size;
			resp->id = queue->meta[npo.meta_cons].id;
549
			resp->status = XENVIF_RX_CB(skb)->meta_slots_used;
I
Ian Campbell 已提交
550 551

			npo.meta_cons++;
552
			XENVIF_RX_CB(skb)->meta_slots_used--;
I
Ian Campbell 已提交
553 554 555
		}


556 557
		queue->stats.tx_bytes += skb->len;
		queue->stats.tx_packets++;
I
Ian Campbell 已提交
558

559
		status = xenvif_check_gop(queue->vif,
560 561
					  XENVIF_RX_CB(skb)->meta_slots_used,
					  &npo);
I
Ian Campbell 已提交
562

563
		if (XENVIF_RX_CB(skb)->meta_slots_used == 1)
I
Ian Campbell 已提交
564 565 566 567 568 569 570 571 572 573 574
			flags = 0;
		else
			flags = XEN_NETRXF_more_data;

		if (skb->ip_summed == CHECKSUM_PARTIAL) /* local packet? */
			flags |= XEN_NETRXF_csum_blank | XEN_NETRXF_data_validated;
		else if (skb->ip_summed == CHECKSUM_UNNECESSARY)
			/* remote but checksummed. */
			flags |= XEN_NETRXF_data_validated;

		offset = 0;
575
		resp = make_rx_response(queue, queue->meta[npo.meta_cons].id,
I
Ian Campbell 已提交
576
					status, offset,
577
					queue->meta[npo.meta_cons].size,
I
Ian Campbell 已提交
578 579
					flags);

580 581
		if ((1 << queue->meta[npo.meta_cons].gso_type) &
		    queue->vif->gso_mask) {
I
Ian Campbell 已提交
582 583
			struct xen_netif_extra_info *gso =
				(struct xen_netif_extra_info *)
584 585
				RING_GET_RESPONSE(&queue->rx,
						  queue->rx.rsp_prod_pvt++);
I
Ian Campbell 已提交
586 587 588

			resp->flags |= XEN_NETRXF_extra_info;

589 590
			gso->u.gso.type = queue->meta[npo.meta_cons].gso_type;
			gso->u.gso.size = queue->meta[npo.meta_cons].gso_size;
I
Ian Campbell 已提交
591 592 593 594 595 596 597
			gso->u.gso.pad = 0;
			gso->u.gso.features = 0;

			gso->type = XEN_NETIF_EXTRA_TYPE_GSO;
			gso->flags = 0;
		}

598 599
		xenvif_add_frag_responses(queue, status,
					  queue->meta + npo.meta_cons + 1,
600
					  XENVIF_RX_CB(skb)->meta_slots_used);
I
Ian Campbell 已提交
601

602
		RING_PUSH_RESPONSES_AND_CHECK_NOTIFY(&queue->rx, ret);
I
Ian Campbell 已提交
603

604
		need_to_notify |= !!ret;
605

606
		npo.meta_cons += XENVIF_RX_CB(skb)->meta_slots_used;
I
Ian Campbell 已提交
607 608 609
		dev_kfree_skb(skb);
	}

610
done:
611
	if (need_to_notify)
612
		notify_remote_via_irq(queue->rx_irq);
I
Ian Campbell 已提交
613 614
}

615
void xenvif_napi_schedule_or_enable_events(struct xenvif_queue *queue)
I
Ian Campbell 已提交
616 617 618
{
	int more_to_do;

619
	RING_FINAL_CHECK_FOR_REQUESTS(&queue->tx, more_to_do);
I
Ian Campbell 已提交
620 621

	if (more_to_do)
622
		napi_schedule(&queue->napi);
I
Ian Campbell 已提交
623 624
}

625
static void tx_add_credit(struct xenvif_queue *queue)
I
Ian Campbell 已提交
626 627 628 629 630 631 632
{
	unsigned long max_burst, max_credit;

	/*
	 * Allow a burst big enough to transmit a jumbo packet of up to 128kB.
	 * Otherwise the interface can seize up due to insufficient credit.
	 */
633
	max_burst = RING_GET_REQUEST(&queue->tx, queue->tx.req_cons)->size;
I
Ian Campbell 已提交
634
	max_burst = min(max_burst, 131072UL);
635
	max_burst = max(max_burst, queue->credit_bytes);
I
Ian Campbell 已提交
636 637

	/* Take care that adding a new chunk of credit doesn't wrap to zero. */
638 639
	max_credit = queue->remaining_credit + queue->credit_bytes;
	if (max_credit < queue->remaining_credit)
I
Ian Campbell 已提交
640 641
		max_credit = ULONG_MAX; /* wrapped: clamp to ULONG_MAX */

642
	queue->remaining_credit = min(max_credit, max_burst);
I
Ian Campbell 已提交
643 644
}

645
void xenvif_tx_credit_callback(unsigned long data)
I
Ian Campbell 已提交
646
{
647 648 649
	struct xenvif_queue *queue = (struct xenvif_queue *)data;
	tx_add_credit(queue);
	xenvif_napi_schedule_or_enable_events(queue);
I
Ian Campbell 已提交
650 651
}

652
static void xenvif_tx_err(struct xenvif_queue *queue,
W
Wei Liu 已提交
653
			  struct xen_netif_tx_request *txp, RING_IDX end)
I
Ian Campbell 已提交
654
{
655
	RING_IDX cons = queue->tx.req_cons;
656
	unsigned long flags;
I
Ian Campbell 已提交
657 658

	do {
659 660
		spin_lock_irqsave(&queue->response_lock, flags);
		make_tx_response(queue, txp, XEN_NETIF_RSP_ERROR);
661
		push_tx_responses(queue);
662
		spin_unlock_irqrestore(&queue->response_lock, flags);
663
		if (cons == end)
I
Ian Campbell 已提交
664
			break;
665
		txp = RING_GET_REQUEST(&queue->tx, cons++);
I
Ian Campbell 已提交
666
	} while (1);
667
	queue->tx.req_cons = cons;
I
Ian Campbell 已提交
668 669
}

W
Wei Liu 已提交
670
static void xenvif_fatal_tx_err(struct xenvif *vif)
671 672
{
	netdev_err(vif->dev, "fatal error; disabling device\n");
673
	vif->disabled = true;
674 675 676
	/* Disable the vif from queue 0's kthread */
	if (vif->queues)
		xenvif_kick_thread(&vif->queues[0]);
677 678
}

679
static int xenvif_count_requests(struct xenvif_queue *queue,
W
Wei Liu 已提交
680 681 682
				 struct xen_netif_tx_request *first,
				 struct xen_netif_tx_request *txp,
				 int work_to_do)
I
Ian Campbell 已提交
683
{
684
	RING_IDX cons = queue->tx.req_cons;
685 686
	int slots = 0;
	int drop_err = 0;
687
	int more_data;
I
Ian Campbell 已提交
688 689 690 691 692

	if (!(first->flags & XEN_NETTXF_more_data))
		return 0;

	do {
693 694
		struct xen_netif_tx_request dropped_tx = { 0 };

695
		if (slots >= work_to_do) {
696
			netdev_err(queue->vif->dev,
697 698
				   "Asked for %d slots but exceeds this limit\n",
				   work_to_do);
699
			xenvif_fatal_tx_err(queue->vif);
700
			return -ENODATA;
I
Ian Campbell 已提交
701 702
		}

703 704 705
		/* This guest is really using too many slots and
		 * considered malicious.
		 */
706
		if (unlikely(slots >= fatal_skb_slots)) {
707
			netdev_err(queue->vif->dev,
708
				   "Malicious frontend using %d slots, threshold %u\n",
709
				   slots, fatal_skb_slots);
710
			xenvif_fatal_tx_err(queue->vif);
711
			return -E2BIG;
I
Ian Campbell 已提交
712 713
		}

714
		/* Xen network protocol had implicit dependency on
715 716 717 718 719
		 * MAX_SKB_FRAGS. XEN_NETBK_LEGACY_SLOTS_MAX is set to
		 * the historical MAX_SKB_FRAGS value 18 to honor the
		 * same behavior as before. Any packet using more than
		 * 18 slots but less than fatal_skb_slots slots is
		 * dropped
720
		 */
721
		if (!drop_err && slots >= XEN_NETBK_LEGACY_SLOTS_MAX) {
722
			if (net_ratelimit())
723
				netdev_dbg(queue->vif->dev,
724
					   "Too many slots (%d) exceeding limit (%d), dropping packet\n",
725
					   slots, XEN_NETBK_LEGACY_SLOTS_MAX);
726 727 728
			drop_err = -E2BIG;
		}

729 730 731
		if (drop_err)
			txp = &dropped_tx;

732
		memcpy(txp, RING_GET_REQUEST(&queue->tx, cons + slots),
I
Ian Campbell 已提交
733
		       sizeof(*txp));
734 735 736 737 738 739 740 741 742 743 744 745

		/* If the guest submitted a frame >= 64 KiB then
		 * first->size overflowed and following slots will
		 * appear to be larger than the frame.
		 *
		 * This cannot be fatal error as there are buggy
		 * frontends that do this.
		 *
		 * Consume all slots and drop the packet.
		 */
		if (!drop_err && txp->size > first->size) {
			if (net_ratelimit())
746
				netdev_dbg(queue->vif->dev,
747 748 749
					   "Invalid tx request, slot size %u > remaining size %u\n",
					   txp->size, first->size);
			drop_err = -EIO;
I
Ian Campbell 已提交
750 751 752
		}

		first->size -= txp->size;
753
		slots++;
I
Ian Campbell 已提交
754 755

		if (unlikely((txp->offset + txp->size) > PAGE_SIZE)) {
756
			netdev_err(queue->vif->dev, "Cross page boundary, txp->offset: %x, size: %u\n",
I
Ian Campbell 已提交
757
				 txp->offset, txp->size);
758
			xenvif_fatal_tx_err(queue->vif);
759
			return -EINVAL;
I
Ian Campbell 已提交
760
		}
761 762 763 764 765 766 767

		more_data = txp->flags & XEN_NETTXF_more_data;

		if (!drop_err)
			txp++;

	} while (more_data);
768 769

	if (drop_err) {
770
		xenvif_tx_err(queue, first, cons + slots);
771 772 773 774
		return drop_err;
	}

	return slots;
I
Ian Campbell 已提交
775 776
}

777 778 779 780 781 782 783

struct xenvif_tx_cb {
	u16 pending_idx;
};

#define XENVIF_TX_CB(skb) ((struct xenvif_tx_cb *)(skb)->cb)

784
static inline void xenvif_tx_create_map_op(struct xenvif_queue *queue,
Z
Zoltan Kiss 已提交
785 786 787
					  u16 pending_idx,
					  struct xen_netif_tx_request *txp,
					  struct gnttab_map_grant_ref *mop)
788
{
789 790
	queue->pages_to_map[mop-queue->tx_map_ops] = queue->mmap_pages[pending_idx];
	gnttab_set_map_op(mop, idx_to_kaddr(queue, pending_idx),
791
			  GNTMAP_host_map | GNTMAP_readonly,
792
			  txp->gref, queue->vif->domid);
793

794
	memcpy(&queue->pending_tx_info[pending_idx].req, txp,
795 796 797
	       sizeof(*txp));
}

798 799 800 801 802 803 804 805 806 807 808 809 810 811 812 813 814
static inline struct sk_buff *xenvif_alloc_skb(unsigned int size)
{
	struct sk_buff *skb =
		alloc_skb(size + NET_SKB_PAD + NET_IP_ALIGN,
			  GFP_ATOMIC | __GFP_NOWARN);
	if (unlikely(skb == NULL))
		return NULL;

	/* Packets passed to netif_rx() must have some headroom. */
	skb_reserve(skb, NET_SKB_PAD + NET_IP_ALIGN);

	/* Initialize it here to avoid later surprises */
	skb_shinfo(skb)->destructor_arg = NULL;

	return skb;
}

815
static struct gnttab_map_grant_ref *xenvif_get_requests(struct xenvif_queue *queue,
816 817 818
							struct sk_buff *skb,
							struct xen_netif_tx_request *txp,
							struct gnttab_map_grant_ref *gop)
I
Ian Campbell 已提交
819 820 821
{
	struct skb_shared_info *shinfo = skb_shinfo(skb);
	skb_frag_t *frags = shinfo->frags;
822
	u16 pending_idx = XENVIF_TX_CB(skb)->pending_idx;
823 824
	int start;
	pending_ring_idx_t index;
825
	unsigned int nr_slots, frag_overflow = 0;
826 827

	/* At this point shinfo->nr_frags is in fact the number of
828
	 * slots, which can be as large as XEN_NETBK_LEGACY_SLOTS_MAX.
829
	 */
830 831 832 833 834
	if (shinfo->nr_frags > MAX_SKB_FRAGS) {
		frag_overflow = shinfo->nr_frags - MAX_SKB_FRAGS;
		BUG_ON(frag_overflow > MAX_SKB_FRAGS);
		shinfo->nr_frags = MAX_SKB_FRAGS;
	}
835
	nr_slots = shinfo->nr_frags;
I
Ian Campbell 已提交
836 837

	/* Skip first skb fragment if it is on same page as header fragment. */
838
	start = (frag_get_pending_idx(&shinfo->frags[0]) == pending_idx);
I
Ian Campbell 已提交
839

840 841
	for (shinfo->nr_frags = start; shinfo->nr_frags < nr_slots;
	     shinfo->nr_frags++, txp++, gop++) {
842 843 844
		index = pending_index(queue->pending_cons++);
		pending_idx = queue->pending_ring[index];
		xenvif_tx_create_map_op(queue, pending_idx, txp, gop);
845
		frag_set_pending_idx(&frags[shinfo->nr_frags], pending_idx);
I
Ian Campbell 已提交
846 847
	}

848 849 850 851
	if (frag_overflow) {
		struct sk_buff *nskb = xenvif_alloc_skb(0);
		if (unlikely(nskb == NULL)) {
			if (net_ratelimit())
852
				netdev_err(queue->vif->dev,
853 854 855 856 857 858 859 860 861
					   "Can't allocate the frag_list skb.\n");
			return NULL;
		}

		shinfo = skb_shinfo(nskb);
		frags = shinfo->frags;

		for (shinfo->nr_frags = 0; shinfo->nr_frags < frag_overflow;
		     shinfo->nr_frags++, txp++, gop++) {
862 863 864
			index = pending_index(queue->pending_cons++);
			pending_idx = queue->pending_ring[index];
			xenvif_tx_create_map_op(queue, pending_idx, txp, gop);
865 866 867 868 869 870
			frag_set_pending_idx(&frags[shinfo->nr_frags],
					     pending_idx);
		}

		skb_shinfo(skb)->frag_list = nskb;
	}
871

I
Ian Campbell 已提交
872 873 874
	return gop;
}

875
static inline void xenvif_grant_handle_set(struct xenvif_queue *queue,
876 877 878
					   u16 pending_idx,
					   grant_handle_t handle)
{
879
	if (unlikely(queue->grant_tx_handle[pending_idx] !=
880
		     NETBACK_INVALID_HANDLE)) {
881
		netdev_err(queue->vif->dev,
882 883 884 885
			   "Trying to overwrite active handle! pending_idx: %x\n",
			   pending_idx);
		BUG();
	}
886
	queue->grant_tx_handle[pending_idx] = handle;
887 888
}

889
static inline void xenvif_grant_handle_reset(struct xenvif_queue *queue,
890 891
					     u16 pending_idx)
{
892
	if (unlikely(queue->grant_tx_handle[pending_idx] ==
893
		     NETBACK_INVALID_HANDLE)) {
894
		netdev_err(queue->vif->dev,
895 896 897 898
			   "Trying to unmap invalid handle! pending_idx: %x\n",
			   pending_idx);
		BUG();
	}
899
	queue->grant_tx_handle[pending_idx] = NETBACK_INVALID_HANDLE;
900 901
}

902
static int xenvif_tx_check_gop(struct xenvif_queue *queue,
W
Wei Liu 已提交
903
			       struct sk_buff *skb,
904 905
			       struct gnttab_map_grant_ref **gopp_map,
			       struct gnttab_copy **gopp_copy)
I
Ian Campbell 已提交
906
{
Z
Zoltan Kiss 已提交
907
	struct gnttab_map_grant_ref *gop_map = *gopp_map;
908
	u16 pending_idx = XENVIF_TX_CB(skb)->pending_idx;
909 910 911
	/* This always points to the shinfo of the skb being checked, which
	 * could be either the first or the one on the frag_list
	 */
I
Ian Campbell 已提交
912
	struct skb_shared_info *shinfo = skb_shinfo(skb);
913 914 915 916
	/* If this is non-NULL, we are currently checking the frag_list skb, and
	 * this points to the shinfo of the first one
	 */
	struct skb_shared_info *first_shinfo = NULL;
I
Ian Campbell 已提交
917
	int nr_frags = shinfo->nr_frags;
918 919
	const bool sharedslot = nr_frags &&
				frag_get_pending_idx(&shinfo->frags[0]) == pending_idx;
920
	int i, err;
I
Ian Campbell 已提交
921 922

	/* Check status of header. */
923 924 925
	err = (*gopp_copy)->status;
	if (unlikely(err)) {
		if (net_ratelimit())
926
			netdev_dbg(queue->vif->dev,
927
				   "Grant copy of header failed! status: %d pending_idx: %u ref: %u\n",
928 929 930
				   (*gopp_copy)->status,
				   pending_idx,
				   (*gopp_copy)->source.u.ref);
931 932 933 934
		/* The first frag might still have this slot mapped */
		if (!sharedslot)
			xenvif_idx_release(queue, pending_idx,
					   XEN_NETIF_RSP_ERROR);
935
	}
936
	(*gopp_copy)++;
I
Ian Campbell 已提交
937

938
check_frags:
939
	for (i = 0; i < nr_frags; i++, gop_map++) {
I
Ian Campbell 已提交
940 941
		int j, newerr;

942
		pending_idx = frag_get_pending_idx(&shinfo->frags[i]);
I
Ian Campbell 已提交
943 944

		/* Check error status: if okay then remember grant handle. */
945
		newerr = gop_map->status;
946

I
Ian Campbell 已提交
947
		if (likely(!newerr)) {
948
			xenvif_grant_handle_set(queue,
Z
Zoltan Kiss 已提交
949 950
						pending_idx,
						gop_map->handle);
I
Ian Campbell 已提交
951
			/* Had a previous error? Invalidate this fragment. */
952
			if (unlikely(err)) {
953
				xenvif_idx_unmap(queue, pending_idx);
954 955 956 957 958 959 960 961 962 963 964
				/* If the mapping of the first frag was OK, but
				 * the header's copy failed, and they are
				 * sharing a slot, send an error
				 */
				if (i == 0 && sharedslot)
					xenvif_idx_release(queue, pending_idx,
							   XEN_NETIF_RSP_ERROR);
				else
					xenvif_idx_release(queue, pending_idx,
							   XEN_NETIF_RSP_OKAY);
			}
I
Ian Campbell 已提交
965 966 967 968
			continue;
		}

		/* Error on this fragment: respond to client with an error. */
969
		if (net_ratelimit())
970
			netdev_dbg(queue->vif->dev,
971
				   "Grant map of %d. frag failed! status: %d pending_idx: %u ref: %u\n",
972 973 974 975
				   i,
				   gop_map->status,
				   pending_idx,
				   gop_map->ref);
976

977
		xenvif_idx_release(queue, pending_idx, XEN_NETIF_RSP_ERROR);
I
Ian Campbell 已提交
978 979 980 981

		/* Not the first error? Preceding frags already invalidated. */
		if (err)
			continue;
982 983 984 985 986 987 988 989 990 991

		/* First error: if the header haven't shared a slot with the
		 * first frag, release it as well.
		 */
		if (!sharedslot)
			xenvif_idx_release(queue,
					   XENVIF_TX_CB(skb)->pending_idx,
					   XEN_NETIF_RSP_OKAY);

		/* Invalidate preceding fragments of this skb. */
992
		for (j = 0; j < i; j++) {
993
			pending_idx = frag_get_pending_idx(&shinfo->frags[j]);
994
			xenvif_idx_unmap(queue, pending_idx);
995 996
			xenvif_idx_release(queue, pending_idx,
					   XEN_NETIF_RSP_OKAY);
I
Ian Campbell 已提交
997 998
		}

999 1000 1001 1002 1003 1004 1005
		/* And if we found the error while checking the frag_list, unmap
		 * the first skb's frags
		 */
		if (first_shinfo) {
			for (j = 0; j < first_shinfo->nr_frags; j++) {
				pending_idx = frag_get_pending_idx(&first_shinfo->frags[j]);
				xenvif_idx_unmap(queue, pending_idx);
1006 1007
				xenvif_idx_release(queue, pending_idx,
						   XEN_NETIF_RSP_OKAY);
1008
			}
I
Ian Campbell 已提交
1009 1010 1011 1012 1013 1014
		}

		/* Remember the error: invalidate all subsequent fragments. */
		err = newerr;
	}

1015 1016 1017
	if (skb_has_frag_list(skb) && !first_shinfo) {
		first_shinfo = skb_shinfo(skb);
		shinfo = skb_shinfo(skb_shinfo(skb)->frag_list);
1018 1019 1020 1021 1022
		nr_frags = shinfo->nr_frags;

		goto check_frags;
	}

1023
	*gopp_map = gop_map;
I
Ian Campbell 已提交
1024 1025 1026
	return err;
}

1027
static void xenvif_fill_frags(struct xenvif_queue *queue, struct sk_buff *skb)
I
Ian Campbell 已提交
1028 1029 1030 1031
{
	struct skb_shared_info *shinfo = skb_shinfo(skb);
	int nr_frags = shinfo->nr_frags;
	int i;
1032 1033
	u16 prev_pending_idx = INVALID_PENDING_IDX;

I
Ian Campbell 已提交
1034 1035 1036
	for (i = 0; i < nr_frags; i++) {
		skb_frag_t *frag = shinfo->frags + i;
		struct xen_netif_tx_request *txp;
1037 1038
		struct page *page;
		u16 pending_idx;
I
Ian Campbell 已提交
1039

1040
		pending_idx = frag_get_pending_idx(frag);
I
Ian Campbell 已提交
1041

1042
		/* If this is not the first frag, chain it to the previous*/
1043
		if (prev_pending_idx == INVALID_PENDING_IDX)
1044
			skb_shinfo(skb)->destructor_arg =
1045
				&callback_param(queue, pending_idx);
1046
		else
1047 1048
			callback_param(queue, prev_pending_idx).ctx =
				&callback_param(queue, pending_idx);
1049

1050
		callback_param(queue, pending_idx).ctx = NULL;
1051 1052
		prev_pending_idx = pending_idx;

1053 1054
		txp = &queue->pending_tx_info[pending_idx].req;
		page = virt_to_page(idx_to_kaddr(queue, pending_idx));
1055
		__skb_fill_page_desc(skb, i, page, txp->offset, txp->size);
I
Ian Campbell 已提交
1056 1057 1058 1059
		skb->len += txp->size;
		skb->data_len += txp->size;
		skb->truesize += txp->size;

1060
		/* Take an extra reference to offset network stack's put_page */
1061
		get_page(queue->mmap_pages[pending_idx]);
I
Ian Campbell 已提交
1062 1063 1064
	}
}

1065
static int xenvif_get_extras(struct xenvif_queue *queue,
I
Ian Campbell 已提交
1066 1067 1068 1069
				struct xen_netif_extra_info *extras,
				int work_to_do)
{
	struct xen_netif_extra_info extra;
1070
	RING_IDX cons = queue->tx.req_cons;
I
Ian Campbell 已提交
1071 1072 1073

	do {
		if (unlikely(work_to_do-- <= 0)) {
1074 1075
			netdev_err(queue->vif->dev, "Missing extra info\n");
			xenvif_fatal_tx_err(queue->vif);
I
Ian Campbell 已提交
1076 1077 1078
			return -EBADR;
		}

1079
		memcpy(&extra, RING_GET_REQUEST(&queue->tx, cons),
I
Ian Campbell 已提交
1080 1081 1082
		       sizeof(extra));
		if (unlikely(!extra.type ||
			     extra.type >= XEN_NETIF_EXTRA_TYPE_MAX)) {
1083 1084
			queue->tx.req_cons = ++cons;
			netdev_err(queue->vif->dev,
I
Ian Campbell 已提交
1085
				   "Invalid extra type: %d\n", extra.type);
1086
			xenvif_fatal_tx_err(queue->vif);
I
Ian Campbell 已提交
1087 1088 1089 1090
			return -EINVAL;
		}

		memcpy(&extras[extra.type - 1], &extra, sizeof(extra));
1091
		queue->tx.req_cons = ++cons;
I
Ian Campbell 已提交
1092 1093 1094 1095 1096
	} while (extra.flags & XEN_NETIF_EXTRA_FLAG_MORE);

	return work_to_do;
}

W
Wei Liu 已提交
1097 1098 1099
static int xenvif_set_skb_gso(struct xenvif *vif,
			      struct sk_buff *skb,
			      struct xen_netif_extra_info *gso)
I
Ian Campbell 已提交
1100 1101
{
	if (!gso->u.gso.size) {
1102
		netdev_err(vif->dev, "GSO size must not be zero.\n");
W
Wei Liu 已提交
1103
		xenvif_fatal_tx_err(vif);
I
Ian Campbell 已提交
1104 1105 1106
		return -EINVAL;
	}

1107 1108 1109 1110 1111 1112 1113 1114
	switch (gso->u.gso.type) {
	case XEN_NETIF_GSO_TYPE_TCPV4:
		skb_shinfo(skb)->gso_type = SKB_GSO_TCPV4;
		break;
	case XEN_NETIF_GSO_TYPE_TCPV6:
		skb_shinfo(skb)->gso_type = SKB_GSO_TCPV6;
		break;
	default:
1115
		netdev_err(vif->dev, "Bad GSO type %d.\n", gso->u.gso.type);
W
Wei Liu 已提交
1116
		xenvif_fatal_tx_err(vif);
I
Ian Campbell 已提交
1117 1118 1119 1120
		return -EINVAL;
	}

	skb_shinfo(skb)->gso_size = gso->u.gso.size;
1121
	/* gso_segs will be calculated later */
I
Ian Campbell 已提交
1122 1123 1124 1125

	return 0;
}

1126
static int checksum_setup(struct xenvif_queue *queue, struct sk_buff *skb)
1127
{
1128
	bool recalculate_partial_csum = false;
1129 1130 1131 1132 1133 1134 1135

	/* A GSO SKB must be CHECKSUM_PARTIAL. However some buggy
	 * peers can fail to set NETRXF_csum_blank when sending a GSO
	 * frame. In this case force the SKB to CHECKSUM_PARTIAL and
	 * recalculate the partial checksum.
	 */
	if (skb->ip_summed != CHECKSUM_PARTIAL && skb_is_gso(skb)) {
1136
		queue->stats.rx_gso_checksum_fixup++;
1137
		skb->ip_summed = CHECKSUM_PARTIAL;
1138
		recalculate_partial_csum = true;
1139 1140 1141 1142 1143 1144
	}

	/* A non-CHECKSUM_PARTIAL SKB does not require setup. */
	if (skb->ip_summed != CHECKSUM_PARTIAL)
		return 0;

1145
	return skb_checksum_setup(skb, recalculate_partial_csum);
1146 1147
}

1148
static bool tx_credit_exceeded(struct xenvif_queue *queue, unsigned size)
I
Ian Campbell 已提交
1149
{
1150
	u64 now = get_jiffies_64();
1151 1152
	u64 next_credit = queue->credit_window_start +
		msecs_to_jiffies(queue->credit_usec / 1000);
I
Ian Campbell 已提交
1153 1154

	/* Timer could already be pending in rare cases. */
1155
	if (timer_pending(&queue->credit_timeout))
I
Ian Campbell 已提交
1156 1157 1158
		return true;

	/* Passed the point where we can replenish credit? */
1159
	if (time_after_eq64(now, next_credit)) {
1160 1161
		queue->credit_window_start = now;
		tx_add_credit(queue);
I
Ian Campbell 已提交
1162 1163 1164
	}

	/* Still too big to send right now? Set a callback. */
1165 1166 1167 1168
	if (size > queue->remaining_credit) {
		queue->credit_timeout.data     =
			(unsigned long)queue;
		mod_timer(&queue->credit_timeout,
I
Ian Campbell 已提交
1169
			  next_credit);
1170
		queue->credit_window_start = next_credit;
I
Ian Campbell 已提交
1171 1172 1173 1174 1175 1176 1177

		return true;
	}

	return false;
}

1178
static void xenvif_tx_build_gops(struct xenvif_queue *queue,
1179 1180 1181
				     int budget,
				     unsigned *copy_ops,
				     unsigned *map_ops)
I
Ian Campbell 已提交
1182
{
1183
	struct gnttab_map_grant_ref *gop = queue->tx_map_ops, *request_gop;
I
Ian Campbell 已提交
1184 1185 1186
	struct sk_buff *skb;
	int ret;

1187
	while (skb_queue_len(&queue->tx_queue) < budget) {
I
Ian Campbell 已提交
1188
		struct xen_netif_tx_request txreq;
1189
		struct xen_netif_tx_request txfrags[XEN_NETBK_LEGACY_SLOTS_MAX];
I
Ian Campbell 已提交
1190 1191 1192 1193 1194 1195 1196
		struct xen_netif_extra_info extras[XEN_NETIF_EXTRA_TYPE_MAX-1];
		u16 pending_idx;
		RING_IDX idx;
		int work_to_do;
		unsigned int data_len;
		pending_ring_idx_t index;

1197
		if (queue->tx.sring->req_prod - queue->tx.req_cons >
1198
		    XEN_NETIF_TX_RING_SIZE) {
1199
			netdev_err(queue->vif->dev,
1200 1201
				   "Impossible number of requests. "
				   "req_prod %d, req_cons %d, size %ld\n",
1202
				   queue->tx.sring->req_prod, queue->tx.req_cons,
1203
				   XEN_NETIF_TX_RING_SIZE);
1204
			xenvif_fatal_tx_err(queue->vif);
1205
			break;
1206 1207
		}

1208
		work_to_do = RING_HAS_UNCONSUMED_REQUESTS(&queue->tx);
1209 1210
		if (!work_to_do)
			break;
I
Ian Campbell 已提交
1211

1212
		idx = queue->tx.req_cons;
I
Ian Campbell 已提交
1213
		rmb(); /* Ensure that we see the request before we copy it. */
1214
		memcpy(&txreq, RING_GET_REQUEST(&queue->tx, idx), sizeof(txreq));
I
Ian Campbell 已提交
1215 1216

		/* Credit-based scheduling. */
1217 1218
		if (txreq.size > queue->remaining_credit &&
		    tx_credit_exceeded(queue, txreq.size))
1219
			break;
I
Ian Campbell 已提交
1220

1221
		queue->remaining_credit -= txreq.size;
I
Ian Campbell 已提交
1222 1223

		work_to_do--;
1224
		queue->tx.req_cons = ++idx;
I
Ian Campbell 已提交
1225 1226 1227

		memset(extras, 0, sizeof(extras));
		if (txreq.flags & XEN_NETTXF_extra_info) {
1228
			work_to_do = xenvif_get_extras(queue, extras,
W
Wei Liu 已提交
1229
						       work_to_do);
1230
			idx = queue->tx.req_cons;
1231
			if (unlikely(work_to_do < 0))
1232
				break;
I
Ian Campbell 已提交
1233 1234
		}

1235
		ret = xenvif_count_requests(queue, &txreq, txfrags, work_to_do);
1236
		if (unlikely(ret < 0))
1237
			break;
1238

I
Ian Campbell 已提交
1239 1240 1241
		idx += ret;

		if (unlikely(txreq.size < ETH_HLEN)) {
1242
			netdev_dbg(queue->vif->dev,
I
Ian Campbell 已提交
1243
				   "Bad packet size: %d\n", txreq.size);
1244
			xenvif_tx_err(queue, &txreq, idx);
1245
			break;
I
Ian Campbell 已提交
1246 1247 1248 1249
		}

		/* No crossing a page as the payload mustn't fragment. */
		if (unlikely((txreq.offset + txreq.size) > PAGE_SIZE)) {
1250
			netdev_err(queue->vif->dev,
I
Ian Campbell 已提交
1251 1252 1253
				   "txreq.offset: %x, size: %u, end: %lu\n",
				   txreq.offset, txreq.size,
				   (txreq.offset&~PAGE_MASK) + txreq.size);
1254
			xenvif_fatal_tx_err(queue->vif);
1255
			break;
I
Ian Campbell 已提交
1256 1257
		}

1258 1259
		index = pending_index(queue->pending_cons);
		pending_idx = queue->pending_ring[index];
I
Ian Campbell 已提交
1260

1261
		data_len = (txreq.size > XEN_NETBACK_TX_COPY_LEN &&
1262
			    ret < XEN_NETBK_LEGACY_SLOTS_MAX) ?
1263
			XEN_NETBACK_TX_COPY_LEN : txreq.size;
I
Ian Campbell 已提交
1264

1265
		skb = xenvif_alloc_skb(data_len);
I
Ian Campbell 已提交
1266
		if (unlikely(skb == NULL)) {
1267
			netdev_dbg(queue->vif->dev,
I
Ian Campbell 已提交
1268
				   "Can't allocate a skb in start_xmit.\n");
1269
			xenvif_tx_err(queue, &txreq, idx);
I
Ian Campbell 已提交
1270 1271 1272 1273 1274 1275 1276
			break;
		}

		if (extras[XEN_NETIF_EXTRA_TYPE_GSO - 1].type) {
			struct xen_netif_extra_info *gso;
			gso = &extras[XEN_NETIF_EXTRA_TYPE_GSO - 1];

1277
			if (xenvif_set_skb_gso(queue->vif, skb, gso)) {
W
Wei Liu 已提交
1278
				/* Failure in xenvif_set_skb_gso is fatal. */
I
Ian Campbell 已提交
1279
				kfree_skb(skb);
1280
				break;
I
Ian Campbell 已提交
1281 1282 1283
			}
		}

1284
		XENVIF_TX_CB(skb)->pending_idx = pending_idx;
I
Ian Campbell 已提交
1285 1286

		__skb_put(skb, data_len);
1287 1288 1289
		queue->tx_copy_ops[*copy_ops].source.u.ref = txreq.gref;
		queue->tx_copy_ops[*copy_ops].source.domid = queue->vif->domid;
		queue->tx_copy_ops[*copy_ops].source.offset = txreq.offset;
1290

1291
		queue->tx_copy_ops[*copy_ops].dest.u.gmfn =
1292
			virt_to_mfn(skb->data);
1293 1294
		queue->tx_copy_ops[*copy_ops].dest.domid = DOMID_SELF;
		queue->tx_copy_ops[*copy_ops].dest.offset =
1295 1296
			offset_in_page(skb->data);

1297 1298
		queue->tx_copy_ops[*copy_ops].len = data_len;
		queue->tx_copy_ops[*copy_ops].flags = GNTCOPY_source_gref;
1299 1300

		(*copy_ops)++;
I
Ian Campbell 已提交
1301 1302 1303 1304

		skb_shinfo(skb)->nr_frags = ret;
		if (data_len < txreq.size) {
			skb_shinfo(skb)->nr_frags++;
1305 1306
			frag_set_pending_idx(&skb_shinfo(skb)->frags[0],
					     pending_idx);
1307
			xenvif_tx_create_map_op(queue, pending_idx, &txreq, gop);
1308
			gop++;
I
Ian Campbell 已提交
1309
		} else {
1310 1311
			frag_set_pending_idx(&skb_shinfo(skb)->frags[0],
					     INVALID_PENDING_IDX);
1312
			memcpy(&queue->pending_tx_info[pending_idx].req, &txreq,
1313
			       sizeof(txreq));
I
Ian Campbell 已提交
1314 1315
		}

1316
		queue->pending_cons++;
I
Ian Campbell 已提交
1317

1318
		request_gop = xenvif_get_requests(queue, skb, txfrags, gop);
I
Ian Campbell 已提交
1319 1320
		if (request_gop == NULL) {
			kfree_skb(skb);
1321
			xenvif_tx_err(queue, &txreq, idx);
1322
			break;
I
Ian Campbell 已提交
1323 1324 1325
		}
		gop = request_gop;

1326
		__skb_queue_tail(&queue->tx_queue, skb);
1327

1328
		queue->tx.req_cons = idx;
I
Ian Campbell 已提交
1329

1330 1331
		if (((gop-queue->tx_map_ops) >= ARRAY_SIZE(queue->tx_map_ops)) ||
		    (*copy_ops >= ARRAY_SIZE(queue->tx_copy_ops)))
I
Ian Campbell 已提交
1332 1333 1334
			break;
	}

1335
	(*map_ops) = gop - queue->tx_map_ops;
1336
	return;
I
Ian Campbell 已提交
1337 1338
}

1339 1340 1341
/* Consolidate skb with a frag_list into a brand new one with local pages on
 * frags. Returns 0 or -ENOMEM if can't allocate new pages.
 */
1342
static int xenvif_handle_frag_list(struct xenvif_queue *queue, struct sk_buff *skb)
1343 1344 1345
{
	unsigned int offset = skb_headlen(skb);
	skb_frag_t frags[MAX_SKB_FRAGS];
1346
	int i, f;
1347 1348 1349
	struct ubuf_info *uarg;
	struct sk_buff *nskb = skb_shinfo(skb)->frag_list;

1350 1351
	queue->stats.tx_zerocopy_sent += 2;
	queue->stats.tx_frag_overflow++;
1352

1353
	xenvif_fill_frags(queue, nskb);
1354 1355 1356 1357 1358 1359 1360 1361 1362 1363 1364
	/* Subtract frags size, we will correct it later */
	skb->truesize -= skb->data_len;
	skb->len += nskb->len;
	skb->data_len += nskb->len;

	/* create a brand new frags array and coalesce there */
	for (i = 0; offset < skb->len; i++) {
		struct page *page;
		unsigned int len;

		BUG_ON(i >= MAX_SKB_FRAGS);
Z
Zoltan Kiss 已提交
1365
		page = alloc_page(GFP_ATOMIC);
1366 1367 1368 1369 1370 1371 1372 1373 1374 1375 1376 1377 1378 1379 1380 1381 1382 1383 1384 1385
		if (!page) {
			int j;
			skb->truesize += skb->data_len;
			for (j = 0; j < i; j++)
				put_page(frags[j].page.p);
			return -ENOMEM;
		}

		if (offset + PAGE_SIZE < skb->len)
			len = PAGE_SIZE;
		else
			len = skb->len - offset;
		if (skb_copy_bits(skb, offset, page_address(page), len))
			BUG();

		offset += len;
		frags[i].page.p = page;
		frags[i].page_offset = 0;
		skb_frag_size_set(&frags[i], len);
	}
1386

1387 1388 1389 1390 1391
	/* Copied all the bits from the frag list -- free it. */
	skb_frag_list_init(skb);
	xenvif_skb_zerocopy_prepare(queue, nskb);
	kfree_skb(nskb);

1392 1393 1394
	/* Release all the original (foreign) frags. */
	for (f = 0; f < skb_shinfo(skb)->nr_frags; f++)
		skb_frag_unref(skb, f);
1395
	uarg = skb_shinfo(skb)->destructor_arg;
1396 1397
	/* increase inflight counter to offset decrement in callback */
	atomic_inc(&queue->inflight_packets);
1398 1399 1400
	uarg->callback(uarg, true);
	skb_shinfo(skb)->destructor_arg = NULL;

1401 1402 1403 1404
	/* Fill the skb with the new (local) frags. */
	memcpy(skb_shinfo(skb)->frags, frags, i * sizeof(skb_frag_t));
	skb_shinfo(skb)->nr_frags = i;
	skb->truesize += i * PAGE_SIZE;
1405 1406 1407

	return 0;
}
1408

1409
static int xenvif_tx_submit(struct xenvif_queue *queue)
I
Ian Campbell 已提交
1410
{
1411 1412
	struct gnttab_map_grant_ref *gop_map = queue->tx_map_ops;
	struct gnttab_copy *gop_copy = queue->tx_copy_ops;
I
Ian Campbell 已提交
1413
	struct sk_buff *skb;
1414
	int work_done = 0;
I
Ian Campbell 已提交
1415

1416
	while ((skb = __skb_dequeue(&queue->tx_queue)) != NULL) {
I
Ian Campbell 已提交
1417 1418 1419 1420
		struct xen_netif_tx_request *txp;
		u16 pending_idx;
		unsigned data_len;

1421
		pending_idx = XENVIF_TX_CB(skb)->pending_idx;
1422
		txp = &queue->pending_tx_info[pending_idx].req;
I
Ian Campbell 已提交
1423 1424

		/* Check the remap error code. */
1425
		if (unlikely(xenvif_tx_check_gop(queue, skb, &gop_map, &gop_copy))) {
1426 1427 1428 1429
			/* If there was an error, xenvif_tx_check_gop is
			 * expected to release all the frags which were mapped,
			 * so kfree_skb shouldn't do it again
			 */
I
Ian Campbell 已提交
1430
			skb_shinfo(skb)->nr_frags = 0;
1431 1432 1433 1434 1435
			if (skb_has_frag_list(skb)) {
				struct sk_buff *nskb =
						skb_shinfo(skb)->frag_list;
				skb_shinfo(nskb)->nr_frags = 0;
			}
I
Ian Campbell 已提交
1436 1437 1438 1439 1440
			kfree_skb(skb);
			continue;
		}

		data_len = skb->len;
1441
		callback_param(queue, pending_idx).ctx = NULL;
I
Ian Campbell 已提交
1442 1443 1444 1445 1446 1447
		if (data_len < txp->size) {
			/* Append the packet payload as a fragment. */
			txp->offset += data_len;
			txp->size -= data_len;
		} else {
			/* Schedule a response immediately. */
1448
			xenvif_idx_release(queue, pending_idx,
1449
					   XEN_NETIF_RSP_OKAY);
I
Ian Campbell 已提交
1450 1451 1452 1453 1454 1455 1456
		}

		if (txp->flags & XEN_NETTXF_csum_blank)
			skb->ip_summed = CHECKSUM_PARTIAL;
		else if (txp->flags & XEN_NETTXF_data_validated)
			skb->ip_summed = CHECKSUM_UNNECESSARY;

1457
		xenvif_fill_frags(queue, skb);
I
Ian Campbell 已提交
1458

1459
		if (unlikely(skb_has_frag_list(skb))) {
1460
			if (xenvif_handle_frag_list(queue, skb)) {
1461
				if (net_ratelimit())
1462
					netdev_err(queue->vif->dev,
1463
						   "Not enough memory to consolidate frag_list!\n");
1464
				xenvif_skb_zerocopy_prepare(queue, skb);
1465 1466 1467 1468 1469
				kfree_skb(skb);
				continue;
			}
		}

1470
		skb->dev      = queue->vif->dev;
I
Ian Campbell 已提交
1471
		skb->protocol = eth_type_trans(skb, skb->dev);
1472
		skb_reset_network_header(skb);
I
Ian Campbell 已提交
1473

1474 1475
		if (checksum_setup(queue, skb)) {
			netdev_dbg(queue->vif->dev,
I
Ian Campbell 已提交
1476
				   "Can't setup checksum in net_tx_action\n");
1477 1478
			/* We have to set this flag to trigger the callback */
			if (skb_shinfo(skb)->destructor_arg)
1479
				xenvif_skb_zerocopy_prepare(queue, skb);
I
Ian Campbell 已提交
1480 1481 1482 1483
			kfree_skb(skb);
			continue;
		}

1484
		skb_probe_transport_header(skb, 0);
1485

1486 1487 1488 1489 1490 1491 1492 1493 1494 1495 1496 1497 1498 1499
		/* If the packet is GSO then we will have just set up the
		 * transport header offset in checksum_setup so it's now
		 * straightforward to calculate gso_segs.
		 */
		if (skb_is_gso(skb)) {
			int mss = skb_shinfo(skb)->gso_size;
			int hdrlen = skb_transport_header(skb) -
				skb_mac_header(skb) +
				tcp_hdrlen(skb);

			skb_shinfo(skb)->gso_segs =
				DIV_ROUND_UP(skb->len - hdrlen, mss);
		}

1500 1501
		queue->stats.rx_bytes += skb->len;
		queue->stats.rx_packets++;
I
Ian Campbell 已提交
1502

1503 1504
		work_done++;

1505 1506 1507 1508 1509
		/* Set this flag right before netif_receive_skb, otherwise
		 * someone might think this packet already left netback, and
		 * do a skb_copy_ubufs while we are still in control of the
		 * skb. E.g. the __pskb_pull_tail earlier can do such thing.
		 */
1510
		if (skb_shinfo(skb)->destructor_arg) {
1511
			xenvif_skb_zerocopy_prepare(queue, skb);
1512
			queue->stats.tx_zerocopy_sent++;
1513
		}
1514

1515
		netif_receive_skb(skb);
I
Ian Campbell 已提交
1516
	}
1517 1518

	return work_done;
I
Ian Campbell 已提交
1519 1520
}

1521 1522
void xenvif_zerocopy_callback(struct ubuf_info *ubuf, bool zerocopy_success)
{
1523 1524
	unsigned long flags;
	pending_ring_idx_t index;
1525
	struct xenvif_queue *queue = ubuf_to_queue(ubuf);
1526 1527 1528 1529

	/* This is the only place where we grab this lock, to protect callbacks
	 * from each other.
	 */
1530
	spin_lock_irqsave(&queue->callback_lock, flags);
1531 1532 1533
	do {
		u16 pending_idx = ubuf->desc;
		ubuf = (struct ubuf_info *) ubuf->ctx;
1534
		BUG_ON(queue->dealloc_prod - queue->dealloc_cons >=
1535
			MAX_PENDING_REQS);
1536 1537
		index = pending_index(queue->dealloc_prod);
		queue->dealloc_ring[index] = pending_idx;
1538 1539 1540 1541
		/* Sync with xenvif_tx_dealloc_action:
		 * insert idx then incr producer.
		 */
		smp_wmb();
1542
		queue->dealloc_prod++;
1543
	} while (ubuf);
1544 1545
	wake_up(&queue->dealloc_wq);
	spin_unlock_irqrestore(&queue->callback_lock, flags);
1546

1547
	if (likely(zerocopy_success))
1548
		queue->stats.tx_zerocopy_success++;
1549
	else
1550
		queue->stats.tx_zerocopy_fail++;
1551
	xenvif_skb_zerocopy_complete(queue);
1552 1553
}

1554
static inline void xenvif_tx_dealloc_action(struct xenvif_queue *queue)
1555 1556 1557 1558 1559 1560
{
	struct gnttab_unmap_grant_ref *gop;
	pending_ring_idx_t dc, dp;
	u16 pending_idx, pending_idx_release[MAX_PENDING_REQS];
	unsigned int i = 0;

1561 1562
	dc = queue->dealloc_cons;
	gop = queue->tx_unmap_ops;
1563 1564 1565

	/* Free up any grants we have finished using */
	do {
1566
		dp = queue->dealloc_prod;
1567 1568 1569 1570 1571 1572 1573

		/* Ensure we see all indices enqueued by all
		 * xenvif_zerocopy_callback().
		 */
		smp_rmb();

		while (dc != dp) {
1574
			BUG_ON(gop - queue->tx_unmap_ops > MAX_PENDING_REQS);
1575
			pending_idx =
1576
				queue->dealloc_ring[pending_index(dc++)];
1577

1578
			pending_idx_release[gop-queue->tx_unmap_ops] =
1579
				pending_idx;
1580 1581
			queue->pages_to_unmap[gop-queue->tx_unmap_ops] =
				queue->mmap_pages[pending_idx];
1582
			gnttab_set_unmap_op(gop,
1583
					    idx_to_kaddr(queue, pending_idx),
1584
					    GNTMAP_host_map,
1585 1586
					    queue->grant_tx_handle[pending_idx]);
			xenvif_grant_handle_reset(queue, pending_idx);
1587 1588 1589
			++gop;
		}

1590
	} while (dp != queue->dealloc_prod);
1591

1592
	queue->dealloc_cons = dc;
1593

1594
	if (gop - queue->tx_unmap_ops > 0) {
1595
		int ret;
1596
		ret = gnttab_unmap_refs(queue->tx_unmap_ops,
1597
					NULL,
1598 1599
					queue->pages_to_unmap,
					gop - queue->tx_unmap_ops);
1600
		if (ret) {
1601 1602 1603
			netdev_err(queue->vif->dev, "Unmap fail: nr_ops %tx ret %d\n",
				   gop - queue->tx_unmap_ops, ret);
			for (i = 0; i < gop - queue->tx_unmap_ops; ++i) {
1604
				if (gop[i].status != GNTST_okay)
1605
					netdev_err(queue->vif->dev,
1606 1607 1608 1609 1610 1611 1612 1613 1614
						   " host_addr: %llx handle: %x status: %d\n",
						   gop[i].host_addr,
						   gop[i].handle,
						   gop[i].status);
			}
			BUG();
		}
	}

1615 1616
	for (i = 0; i < gop - queue->tx_unmap_ops; ++i)
		xenvif_idx_release(queue, pending_idx_release[i],
1617
				   XEN_NETIF_RSP_OKAY);
1618 1619
}

1620

I
Ian Campbell 已提交
1621
/* Called after netfront has transmitted */
1622
int xenvif_tx_action(struct xenvif_queue *queue, int budget)
I
Ian Campbell 已提交
1623
{
1624
	unsigned nr_mops, nr_cops = 0;
1625
	int work_done, ret;
I
Ian Campbell 已提交
1626

1627
	if (unlikely(!tx_work_todo(queue)))
1628 1629
		return 0;

1630
	xenvif_tx_build_gops(queue, budget, &nr_cops, &nr_mops);
I
Ian Campbell 已提交
1631

1632
	if (nr_cops == 0)
1633 1634
		return 0;

1635
	gnttab_batch_copy(queue->tx_copy_ops, nr_cops);
1636
	if (nr_mops != 0) {
1637
		ret = gnttab_map_refs(queue->tx_map_ops,
1638
				      NULL,
1639
				      queue->pages_to_map,
1640 1641 1642
				      nr_mops);
		BUG_ON(ret);
	}
I
Ian Campbell 已提交
1643

1644
	work_done = xenvif_tx_submit(queue);
I
Ian Campbell 已提交
1645

1646
	return work_done;
I
Ian Campbell 已提交
1647 1648
}

1649
static void xenvif_idx_release(struct xenvif_queue *queue, u16 pending_idx,
W
Wei Liu 已提交
1650
			       u8 status)
I
Ian Campbell 已提交
1651 1652
{
	struct pending_tx_info *pending_tx_info;
1653 1654
	pending_ring_idx_t index;
	unsigned long flags;
1655

1656
	pending_tx_info = &queue->pending_tx_info[pending_idx];
1657

1658
	spin_lock_irqsave(&queue->response_lock, flags);
1659

1660
	make_tx_response(queue, &pending_tx_info->req, status);
1661 1662 1663 1664 1665 1666

	/* Release the pending index before pusing the Tx response so
	 * its available before a new Tx request is pushed by the
	 * frontend.
	 */
	index = pending_index(queue->pending_prod++);
1667
	queue->pending_ring[index] = pending_idx;
1668

1669
	push_tx_responses(queue);
1670

1671
	spin_unlock_irqrestore(&queue->response_lock, flags);
I
Ian Campbell 已提交
1672 1673
}

1674

1675
static void make_tx_response(struct xenvif_queue *queue,
I
Ian Campbell 已提交
1676 1677 1678
			     struct xen_netif_tx_request *txp,
			     s8       st)
{
1679
	RING_IDX i = queue->tx.rsp_prod_pvt;
I
Ian Campbell 已提交
1680 1681
	struct xen_netif_tx_response *resp;

1682
	resp = RING_GET_RESPONSE(&queue->tx, i);
I
Ian Campbell 已提交
1683 1684 1685 1686
	resp->id     = txp->id;
	resp->status = st;

	if (txp->flags & XEN_NETTXF_extra_info)
1687
		RING_GET_RESPONSE(&queue->tx, ++i)->status = XEN_NETIF_RSP_NULL;
I
Ian Campbell 已提交
1688

1689
	queue->tx.rsp_prod_pvt = ++i;
I
Ian Campbell 已提交
1690 1691
}

1692 1693 1694 1695 1696 1697 1698 1699 1700
static void push_tx_responses(struct xenvif_queue *queue)
{
	int notify;

	RING_PUSH_RESPONSES_AND_CHECK_NOTIFY(&queue->tx, notify);
	if (notify)
		notify_remote_via_irq(queue->tx_irq);
}

1701
static struct xen_netif_rx_response *make_rx_response(struct xenvif_queue *queue,
I
Ian Campbell 已提交
1702 1703 1704 1705 1706 1707
					     u16      id,
					     s8       st,
					     u16      offset,
					     u16      size,
					     u16      flags)
{
1708
	RING_IDX i = queue->rx.rsp_prod_pvt;
I
Ian Campbell 已提交
1709 1710
	struct xen_netif_rx_response *resp;

1711
	resp = RING_GET_RESPONSE(&queue->rx, i);
I
Ian Campbell 已提交
1712 1713 1714 1715 1716 1717 1718
	resp->offset     = offset;
	resp->flags      = flags;
	resp->id         = id;
	resp->status     = (s16)size;
	if (st < 0)
		resp->status = (s16)st;

1719
	queue->rx.rsp_prod_pvt = ++i;
I
Ian Campbell 已提交
1720 1721 1722 1723

	return resp;
}

1724
void xenvif_idx_unmap(struct xenvif_queue *queue, u16 pending_idx)
1725 1726 1727 1728 1729
{
	int ret;
	struct gnttab_unmap_grant_ref tx_unmap_op;

	gnttab_set_unmap_op(&tx_unmap_op,
1730
			    idx_to_kaddr(queue, pending_idx),
1731
			    GNTMAP_host_map,
1732 1733
			    queue->grant_tx_handle[pending_idx]);
	xenvif_grant_handle_reset(queue, pending_idx);
1734 1735

	ret = gnttab_unmap_refs(&tx_unmap_op, NULL,
1736
				&queue->mmap_pages[pending_idx], 1);
1737
	if (ret) {
1738
		netdev_err(queue->vif->dev,
1739 1740 1741 1742 1743 1744 1745 1746
			   "Unmap fail: ret: %d pending_idx: %d host_addr: %llx handle: %x status: %d\n",
			   ret,
			   pending_idx,
			   tx_unmap_op.host_addr,
			   tx_unmap_op.handle,
			   tx_unmap_op.status);
		BUG();
	}
1747 1748
}

1749
static inline int tx_work_todo(struct xenvif_queue *queue)
I
Ian Campbell 已提交
1750
{
1751
	if (likely(RING_HAS_UNCONSUMED_REQUESTS(&queue->tx)))
I
Ian Campbell 已提交
1752 1753 1754 1755 1756
		return 1;

	return 0;
}

1757
static inline bool tx_dealloc_work_todo(struct xenvif_queue *queue)
1758
{
1759
	return queue->dealloc_cons != queue->dealloc_prod;
1760 1761
}

1762
void xenvif_unmap_frontend_rings(struct xenvif_queue *queue)
I
Ian Campbell 已提交
1763
{
1764 1765 1766 1767 1768 1769
	if (queue->tx.sring)
		xenbus_unmap_ring_vfree(xenvif_to_xenbus_device(queue->vif),
					queue->tx.sring);
	if (queue->rx.sring)
		xenbus_unmap_ring_vfree(xenvif_to_xenbus_device(queue->vif),
					queue->rx.sring);
I
Ian Campbell 已提交
1770 1771
}

1772
int xenvif_map_frontend_rings(struct xenvif_queue *queue,
W
Wei Liu 已提交
1773 1774
			      grant_ref_t tx_ring_ref,
			      grant_ref_t rx_ring_ref)
I
Ian Campbell 已提交
1775
{
1776
	void *addr;
I
Ian Campbell 已提交
1777 1778 1779 1780 1781
	struct xen_netif_tx_sring *txs;
	struct xen_netif_rx_sring *rxs;

	int err = -ENOMEM;

1782
	err = xenbus_map_ring_valloc(xenvif_to_xenbus_device(queue->vif),
1783
				     &tx_ring_ref, 1, &addr);
1784
	if (err)
I
Ian Campbell 已提交
1785 1786
		goto err;

1787
	txs = (struct xen_netif_tx_sring *)addr;
1788
	BACK_RING_INIT(&queue->tx, txs, PAGE_SIZE);
I
Ian Campbell 已提交
1789

1790
	err = xenbus_map_ring_valloc(xenvif_to_xenbus_device(queue->vif),
1791
				     &rx_ring_ref, 1, &addr);
1792
	if (err)
I
Ian Campbell 已提交
1793 1794
		goto err;

1795
	rxs = (struct xen_netif_rx_sring *)addr;
1796
	BACK_RING_INIT(&queue->rx, rxs, PAGE_SIZE);
I
Ian Campbell 已提交
1797 1798 1799 1800

	return 0;

err:
1801
	xenvif_unmap_frontend_rings(queue);
I
Ian Campbell 已提交
1802 1803 1804
	return err;
}

1805
static void xenvif_queue_carrier_off(struct xenvif_queue *queue)
1806
{
1807 1808 1809 1810 1811 1812 1813 1814 1815 1816 1817
	struct xenvif *vif = queue->vif;

	queue->stalled = true;

	/* At least one queue has stalled? Disable the carrier. */
	spin_lock(&vif->lock);
	if (vif->stalled_queues++ == 0) {
		netdev_info(vif->dev, "Guest Rx stalled");
		netif_carrier_off(vif->dev);
	}
	spin_unlock(&vif->lock);
1818 1819
}

1820
static void xenvif_queue_carrier_on(struct xenvif_queue *queue)
1821
{
1822
	struct xenvif *vif = queue->vif;
1823

1824 1825
	queue->last_rx_time = jiffies; /* Reset Rx stall detection. */
	queue->stalled = false;
1826

1827 1828 1829 1830 1831 1832 1833 1834
	/* All queues are ready? Enable the carrier. */
	spin_lock(&vif->lock);
	if (--vif->stalled_queues == 0) {
		netdev_info(vif->dev, "Guest Rx ready");
		netif_carrier_on(vif->dev);
	}
	spin_unlock(&vif->lock);
}
1835

1836 1837 1838 1839 1840 1841 1842 1843 1844 1845
static bool xenvif_rx_queue_stalled(struct xenvif_queue *queue)
{
	RING_IDX prod, cons;

	prod = queue->rx.sring->req_prod;
	cons = queue->rx.req_cons;

	return !queue->stalled
		&& prod - cons < XEN_NETBK_RX_SLOTS_MAX
		&& time_after(jiffies,
1846
			      queue->last_rx_time + queue->vif->stall_timeout);
1847 1848 1849 1850 1851 1852 1853 1854 1855 1856 1857 1858 1859
}

static bool xenvif_rx_queue_ready(struct xenvif_queue *queue)
{
	RING_IDX prod, cons;

	prod = queue->rx.sring->req_prod;
	cons = queue->rx.req_cons;

	return queue->stalled
		&& prod - cons >= XEN_NETBK_RX_SLOTS_MAX;
}

1860
static bool xenvif_have_rx_work(struct xenvif_queue *queue)
1861
{
1862 1863
	return (!skb_queue_empty(&queue->rx_queue)
		&& xenvif_rx_ring_slots_available(queue, XEN_NETBK_RX_SLOTS_MAX))
1864 1865 1866
		|| (queue->vif->stall_timeout &&
		    (xenvif_rx_queue_stalled(queue)
		     || xenvif_rx_queue_ready(queue)))
1867 1868
		|| kthread_should_stop()
		|| queue->vif->disabled;
1869 1870
}

1871
static long xenvif_rx_queue_timeout(struct xenvif_queue *queue)
1872
{
1873 1874
	struct sk_buff *skb;
	long timeout;
1875

1876 1877 1878
	skb = skb_peek(&queue->rx_queue);
	if (!skb)
		return MAX_SCHEDULE_TIMEOUT;
1879

1880 1881 1882
	timeout = XENVIF_RX_CB(skb)->expires - jiffies;
	return timeout < 0 ? 0 : timeout;
}
1883

1884 1885 1886 1887 1888 1889 1890 1891 1892 1893 1894 1895 1896 1897 1898 1899 1900 1901 1902 1903 1904 1905 1906 1907 1908 1909
/* Wait until the guest Rx thread has work.
 *
 * The timeout needs to be adjusted based on the current head of the
 * queue (and not just the head at the beginning).  In particular, if
 * the queue is initially empty an infinite timeout is used and this
 * needs to be reduced when a skb is queued.
 *
 * This cannot be done with wait_event_timeout() because it only
 * calculates the timeout once.
 */
static void xenvif_wait_for_rx_work(struct xenvif_queue *queue)
{
	DEFINE_WAIT(wait);

	if (xenvif_have_rx_work(queue))
		return;

	for (;;) {
		long ret;

		prepare_to_wait(&queue->wq, &wait, TASK_INTERRUPTIBLE);
		if (xenvif_have_rx_work(queue))
			break;
		ret = schedule_timeout(xenvif_rx_queue_timeout(queue));
		if (!ret)
			break;
1910
	}
1911
	finish_wait(&queue->wq, &wait);
1912 1913
}

1914
int xenvif_kthread_guest_rx(void *data)
1915
{
1916
	struct xenvif_queue *queue = data;
1917
	struct xenvif *vif = queue->vif;
1918

1919 1920 1921
	if (!vif->stall_timeout)
		xenvif_queue_carrier_on(queue);

1922 1923
	for (;;) {
		xenvif_wait_for_rx_work(queue);
1924

1925 1926 1927
		if (kthread_should_stop())
			break;

1928 1929 1930 1931
		/* This frontend is found to be rogue, disable it in
		 * kthread context. Currently this is only set when
		 * netback finds out frontend sends malformed packet,
		 * but we cannot disable the interface in softirq
1932 1933
		 * context so we defer it here, if this thread is
		 * associated with queue 0.
1934
		 */
1935 1936
		if (unlikely(vif->disabled && queue->id == 0)) {
			xenvif_carrier_off(vif);
1937
			break;
1938 1939
		}

1940 1941
		if (!skb_queue_empty(&queue->rx_queue))
			xenvif_rx_action(queue);
1942

1943 1944 1945 1946
		/* If the guest hasn't provided any Rx slots for a
		 * while it's probably not responsive, drop the
		 * carrier so packets are dropped earlier.
		 */
1947 1948 1949 1950 1951 1952
		if (vif->stall_timeout) {
			if (xenvif_rx_queue_stalled(queue))
				xenvif_queue_carrier_off(queue);
			else if (xenvif_rx_queue_ready(queue))
				xenvif_queue_carrier_on(queue);
		}
1953

1954 1955 1956 1957 1958 1959 1960 1961 1962
		/* Queued packets may have foreign pages from other
		 * domains.  These cannot be queued indefinitely as
		 * this would starve guests of grant refs and transmit
		 * slots.
		 */
		xenvif_rx_queue_drop_expired(queue);

		xenvif_rx_queue_maybe_wake(queue);

1963 1964 1965
		cond_resched();
	}

1966
	/* Bin any remaining skbs */
1967
	xenvif_rx_queue_purge(queue);
1968

1969 1970 1971
	return 0;
}

1972 1973 1974 1975 1976 1977 1978 1979 1980
static bool xenvif_dealloc_kthread_should_stop(struct xenvif_queue *queue)
{
	/* Dealloc thread must remain running until all inflight
	 * packets complete.
	 */
	return kthread_should_stop() &&
		!atomic_read(&queue->inflight_packets);
}

1981 1982
int xenvif_dealloc_kthread(void *data)
{
1983
	struct xenvif_queue *queue = data;
1984

1985
	for (;;) {
1986 1987
		wait_event_interruptible(queue->dealloc_wq,
					 tx_dealloc_work_todo(queue) ||
1988 1989
					 xenvif_dealloc_kthread_should_stop(queue));
		if (xenvif_dealloc_kthread_should_stop(queue))
1990 1991
			break;

1992
		xenvif_tx_dealloc_action(queue);
1993 1994 1995 1996
		cond_resched();
	}

	/* Unmap anything remaining*/
1997 1998
	if (tx_dealloc_work_todo(queue))
		xenvif_tx_dealloc_action(queue);
1999 2000 2001 2002

	return 0;
}

I
Ian Campbell 已提交
2003 2004 2005 2006
static int __init netback_init(void)
{
	int rc = 0;

2007
	if (!xen_domain())
I
Ian Campbell 已提交
2008 2009
		return -ENODEV;

2010 2011 2012
	/* Allow as many queues as there are CPUs, by default */
	xenvif_max_queues = num_online_cpus();

2013
	if (fatal_skb_slots < XEN_NETBK_LEGACY_SLOTS_MAX) {
2014 2015
		pr_info("fatal_skb_slots too small (%d), bump it to XEN_NETBK_LEGACY_SLOTS_MAX (%d)\n",
			fatal_skb_slots, XEN_NETBK_LEGACY_SLOTS_MAX);
2016
		fatal_skb_slots = XEN_NETBK_LEGACY_SLOTS_MAX;
2017 2018
	}

I
Ian Campbell 已提交
2019 2020 2021 2022
	rc = xenvif_xenbus_init();
	if (rc)
		goto failed_init;

2023 2024 2025 2026 2027 2028 2029
#ifdef CONFIG_DEBUG_FS
	xen_netback_dbg_root = debugfs_create_dir("xen-netback", NULL);
	if (IS_ERR_OR_NULL(xen_netback_dbg_root))
		pr_warn("Init of debugfs returned %ld!\n",
			PTR_ERR(xen_netback_dbg_root));
#endif /* CONFIG_DEBUG_FS */

I
Ian Campbell 已提交
2030 2031 2032 2033 2034 2035 2036 2037
	return 0;

failed_init:
	return rc;
}

module_init(netback_init);

2038 2039
static void __exit netback_fini(void)
{
2040 2041 2042 2043
#ifdef CONFIG_DEBUG_FS
	if (!IS_ERR_OR_NULL(xen_netback_dbg_root))
		debugfs_remove_recursive(xen_netback_dbg_root);
#endif /* CONFIG_DEBUG_FS */
2044 2045 2046 2047
	xenvif_xenbus_fini();
}
module_exit(netback_fini);

I
Ian Campbell 已提交
2048
MODULE_LICENSE("Dual BSD/GPL");
2049
MODULE_ALIAS("xen-backend:vif");