Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wirel...
[platform/adaptation/renesas_rcar/renesas_kernel.git] / drivers / vhost / net.c
1 /* Copyright (C) 2009 Red Hat, Inc.
2  * Author: Michael S. Tsirkin <mst@redhat.com>
3  *
4  * This work is licensed under the terms of the GNU GPL, version 2.
5  *
6  * virtio-net server in host kernel.
7  */
8
9 #include <linux/compat.h>
10 #include <linux/eventfd.h>
11 #include <linux/vhost.h>
12 #include <linux/virtio_net.h>
13 #include <linux/miscdevice.h>
14 #include <linux/module.h>
15 #include <linux/moduleparam.h>
16 #include <linux/mutex.h>
17 #include <linux/workqueue.h>
18 #include <linux/file.h>
19 #include <linux/slab.h>
20
21 #include <linux/net.h>
22 #include <linux/if_packet.h>
23 #include <linux/if_arp.h>
24 #include <linux/if_tun.h>
25 #include <linux/if_macvlan.h>
26 #include <linux/if_vlan.h>
27
28 #include <net/sock.h>
29
30 #include "vhost.h"
31
32 static int experimental_zcopytx = 1;
33 module_param(experimental_zcopytx, int, 0444);
34 MODULE_PARM_DESC(experimental_zcopytx, "Enable Zero Copy TX;"
35                                        " 1 -Enable; 0 - Disable");
36
37 /* Max number of bytes transferred before requeueing the job.
38  * Using this limit prevents one virtqueue from starving others. */
39 #define VHOST_NET_WEIGHT 0x80000
40
41 /* MAX number of TX used buffers for outstanding zerocopy */
42 #define VHOST_MAX_PEND 128
43 #define VHOST_GOODCOPY_LEN 256
44
45 /*
46  * For transmit, used buffer len is unused; we override it to track buffer
47  * status internally; used for zerocopy tx only.
48  */
49 /* Lower device DMA failed */
50 #define VHOST_DMA_FAILED_LEN    3
51 /* Lower device DMA done */
52 #define VHOST_DMA_DONE_LEN      2
53 /* Lower device DMA in progress */
54 #define VHOST_DMA_IN_PROGRESS   1
55 /* Buffer unused */
56 #define VHOST_DMA_CLEAR_LEN     0
57
58 #define VHOST_DMA_IS_DONE(len) ((len) >= VHOST_DMA_DONE_LEN)
59
60 enum {
61         VHOST_NET_FEATURES = VHOST_FEATURES |
62                          (1ULL << VHOST_NET_F_VIRTIO_NET_HDR) |
63                          (1ULL << VIRTIO_NET_F_MRG_RXBUF),
64 };
65
66 enum {
67         VHOST_NET_VQ_RX = 0,
68         VHOST_NET_VQ_TX = 1,
69         VHOST_NET_VQ_MAX = 2,
70 };
71
72 struct vhost_net_ubuf_ref {
73         /* refcount follows semantics similar to kref:
74          *  0: object is released
75          *  1: no outstanding ubufs
76          * >1: outstanding ubufs
77          */
78         atomic_t refcount;
79         wait_queue_head_t wait;
80         struct vhost_virtqueue *vq;
81 };
82
83 struct vhost_net_virtqueue {
84         struct vhost_virtqueue vq;
85         /* hdr is used to store the virtio header.
86          * Since each iovec has >= 1 byte length, we never need more than
87          * header length entries to store the header. */
88         struct iovec hdr[sizeof(struct virtio_net_hdr_mrg_rxbuf)];
89         size_t vhost_hlen;
90         size_t sock_hlen;
91         /* vhost zerocopy support fields below: */
92         /* last used idx for outstanding DMA zerocopy buffers */
93         int upend_idx;
94         /* first used idx for DMA done zerocopy buffers */
95         int done_idx;
96         /* an array of userspace buffers info */
97         struct ubuf_info *ubuf_info;
98         /* Reference counting for outstanding ubufs.
99          * Protected by vq mutex. Writers must also take device mutex. */
100         struct vhost_net_ubuf_ref *ubufs;
101 };
102
103 struct vhost_net {
104         struct vhost_dev dev;
105         struct vhost_net_virtqueue vqs[VHOST_NET_VQ_MAX];
106         struct vhost_poll poll[VHOST_NET_VQ_MAX];
107         /* Number of TX recently submitted.
108          * Protected by tx vq lock. */
109         unsigned tx_packets;
110         /* Number of times zerocopy TX recently failed.
111          * Protected by tx vq lock. */
112         unsigned tx_zcopy_err;
113         /* Flush in progress. Protected by tx vq lock. */
114         bool tx_flush;
115 };
116
117 static unsigned vhost_net_zcopy_mask __read_mostly;
118
119 static void vhost_net_enable_zcopy(int vq)
120 {
121         vhost_net_zcopy_mask |= 0x1 << vq;
122 }
123
124 static struct vhost_net_ubuf_ref *
125 vhost_net_ubuf_alloc(struct vhost_virtqueue *vq, bool zcopy)
126 {
127         struct vhost_net_ubuf_ref *ubufs;
128         /* No zero copy backend? Nothing to count. */
129         if (!zcopy)
130                 return NULL;
131         ubufs = kmalloc(sizeof(*ubufs), GFP_KERNEL);
132         if (!ubufs)
133                 return ERR_PTR(-ENOMEM);
134         atomic_set(&ubufs->refcount, 1);
135         init_waitqueue_head(&ubufs->wait);
136         ubufs->vq = vq;
137         return ubufs;
138 }
139
140 static int vhost_net_ubuf_put(struct vhost_net_ubuf_ref *ubufs)
141 {
142         int r = atomic_sub_return(1, &ubufs->refcount);
143         if (unlikely(!r))
144                 wake_up(&ubufs->wait);
145         return r;
146 }
147
148 static void vhost_net_ubuf_put_and_wait(struct vhost_net_ubuf_ref *ubufs)
149 {
150         vhost_net_ubuf_put(ubufs);
151         wait_event(ubufs->wait, !atomic_read(&ubufs->refcount));
152 }
153
154 static void vhost_net_ubuf_put_wait_and_free(struct vhost_net_ubuf_ref *ubufs)
155 {
156         vhost_net_ubuf_put_and_wait(ubufs);
157         kfree(ubufs);
158 }
159
160 static void vhost_net_clear_ubuf_info(struct vhost_net *n)
161 {
162         int i;
163
164         for (i = 0; i < VHOST_NET_VQ_MAX; ++i) {
165                 kfree(n->vqs[i].ubuf_info);
166                 n->vqs[i].ubuf_info = NULL;
167         }
168 }
169
170 static int vhost_net_set_ubuf_info(struct vhost_net *n)
171 {
172         bool zcopy;
173         int i;
174
175         for (i = 0; i < VHOST_NET_VQ_MAX; ++i) {
176                 zcopy = vhost_net_zcopy_mask & (0x1 << i);
177                 if (!zcopy)
178                         continue;
179                 n->vqs[i].ubuf_info = kmalloc(sizeof(*n->vqs[i].ubuf_info) *
180                                               UIO_MAXIOV, GFP_KERNEL);
181                 if  (!n->vqs[i].ubuf_info)
182                         goto err;
183         }
184         return 0;
185
186 err:
187         vhost_net_clear_ubuf_info(n);
188         return -ENOMEM;
189 }
190
191 static void vhost_net_vq_reset(struct vhost_net *n)
192 {
193         int i;
194
195         vhost_net_clear_ubuf_info(n);
196
197         for (i = 0; i < VHOST_NET_VQ_MAX; i++) {
198                 n->vqs[i].done_idx = 0;
199                 n->vqs[i].upend_idx = 0;
200                 n->vqs[i].ubufs = NULL;
201                 n->vqs[i].vhost_hlen = 0;
202                 n->vqs[i].sock_hlen = 0;
203         }
204
205 }
206
207 static void vhost_net_tx_packet(struct vhost_net *net)
208 {
209         ++net->tx_packets;
210         if (net->tx_packets < 1024)
211                 return;
212         net->tx_packets = 0;
213         net->tx_zcopy_err = 0;
214 }
215
216 static void vhost_net_tx_err(struct vhost_net *net)
217 {
218         ++net->tx_zcopy_err;
219 }
220
221 static bool vhost_net_tx_select_zcopy(struct vhost_net *net)
222 {
223         /* TX flush waits for outstanding DMAs to be done.
224          * Don't start new DMAs.
225          */
226         return !net->tx_flush &&
227                 net->tx_packets / 64 >= net->tx_zcopy_err;
228 }
229
230 static bool vhost_sock_zcopy(struct socket *sock)
231 {
232         return unlikely(experimental_zcopytx) &&
233                 sock_flag(sock->sk, SOCK_ZEROCOPY);
234 }
235
236 /* Pop first len bytes from iovec. Return number of segments used. */
237 static int move_iovec_hdr(struct iovec *from, struct iovec *to,
238                           size_t len, int iov_count)
239 {
240         int seg = 0;
241         size_t size;
242
243         while (len && seg < iov_count) {
244                 size = min(from->iov_len, len);
245                 to->iov_base = from->iov_base;
246                 to->iov_len = size;
247                 from->iov_len -= size;
248                 from->iov_base += size;
249                 len -= size;
250                 ++from;
251                 ++to;
252                 ++seg;
253         }
254         return seg;
255 }
256 /* Copy iovec entries for len bytes from iovec. */
257 static void copy_iovec_hdr(const struct iovec *from, struct iovec *to,
258                            size_t len, int iovcount)
259 {
260         int seg = 0;
261         size_t size;
262
263         while (len && seg < iovcount) {
264                 size = min(from->iov_len, len);
265                 to->iov_base = from->iov_base;
266                 to->iov_len = size;
267                 len -= size;
268                 ++from;
269                 ++to;
270                 ++seg;
271         }
272 }
273
274 /* In case of DMA done not in order in lower device driver for some reason.
275  * upend_idx is used to track end of used idx, done_idx is used to track head
276  * of used idx. Once lower device DMA done contiguously, we will signal KVM
277  * guest used idx.
278  */
279 static void vhost_zerocopy_signal_used(struct vhost_net *net,
280                                        struct vhost_virtqueue *vq)
281 {
282         struct vhost_net_virtqueue *nvq =
283                 container_of(vq, struct vhost_net_virtqueue, vq);
284         int i, add;
285         int j = 0;
286
287         for (i = nvq->done_idx; i != nvq->upend_idx; i = (i + 1) % UIO_MAXIOV) {
288                 if (vq->heads[i].len == VHOST_DMA_FAILED_LEN)
289                         vhost_net_tx_err(net);
290                 if (VHOST_DMA_IS_DONE(vq->heads[i].len)) {
291                         vq->heads[i].len = VHOST_DMA_CLEAR_LEN;
292                         ++j;
293                 } else
294                         break;
295         }
296         while (j) {
297                 add = min(UIO_MAXIOV - nvq->done_idx, j);
298                 vhost_add_used_and_signal_n(vq->dev, vq,
299                                             &vq->heads[nvq->done_idx], add);
300                 nvq->done_idx = (nvq->done_idx + add) % UIO_MAXIOV;
301                 j -= add;
302         }
303 }
304
305 static void vhost_zerocopy_callback(struct ubuf_info *ubuf, bool success)
306 {
307         struct vhost_net_ubuf_ref *ubufs = ubuf->ctx;
308         struct vhost_virtqueue *vq = ubufs->vq;
309         int cnt;
310
311         rcu_read_lock_bh();
312
313         /* set len to mark this desc buffers done DMA */
314         vq->heads[ubuf->desc].len = success ?
315                 VHOST_DMA_DONE_LEN : VHOST_DMA_FAILED_LEN;
316         cnt = vhost_net_ubuf_put(ubufs);
317
318         /*
319          * Trigger polling thread if guest stopped submitting new buffers:
320          * in this case, the refcount after decrement will eventually reach 1.
321          * We also trigger polling periodically after each 16 packets
322          * (the value 16 here is more or less arbitrary, it's tuned to trigger
323          * less than 10% of times).
324          */
325         if (cnt <= 1 || !(cnt % 16))
326                 vhost_poll_queue(&vq->poll);
327
328         rcu_read_unlock_bh();
329 }
330
331 /* Expects to be always run from workqueue - which acts as
332  * read-size critical section for our kind of RCU. */
333 static void handle_tx(struct vhost_net *net)
334 {
335         struct vhost_net_virtqueue *nvq = &net->vqs[VHOST_NET_VQ_TX];
336         struct vhost_virtqueue *vq = &nvq->vq;
337         unsigned out, in, s;
338         int head;
339         struct msghdr msg = {
340                 .msg_name = NULL,
341                 .msg_namelen = 0,
342                 .msg_control = NULL,
343                 .msg_controllen = 0,
344                 .msg_iov = vq->iov,
345                 .msg_flags = MSG_DONTWAIT,
346         };
347         size_t len, total_len = 0;
348         int err;
349         size_t hdr_size;
350         struct socket *sock;
351         struct vhost_net_ubuf_ref *uninitialized_var(ubufs);
352         bool zcopy, zcopy_used;
353
354         mutex_lock(&vq->mutex);
355         sock = vq->private_data;
356         if (!sock)
357                 goto out;
358
359         vhost_disable_notify(&net->dev, vq);
360
361         hdr_size = nvq->vhost_hlen;
362         zcopy = nvq->ubufs;
363
364         for (;;) {
365                 /* Release DMAs done buffers first */
366                 if (zcopy)
367                         vhost_zerocopy_signal_used(net, vq);
368
369                 /* If more outstanding DMAs, queue the work.
370                  * Handle upend_idx wrap around
371                  */
372                 if (unlikely((nvq->upend_idx + vq->num - VHOST_MAX_PEND)
373                               % UIO_MAXIOV == nvq->done_idx))
374                         break;
375
376                 head = vhost_get_vq_desc(&net->dev, vq, vq->iov,
377                                          ARRAY_SIZE(vq->iov),
378                                          &out, &in,
379                                          NULL, NULL);
380                 /* On error, stop handling until the next kick. */
381                 if (unlikely(head < 0))
382                         break;
383                 /* Nothing new?  Wait for eventfd to tell us they refilled. */
384                 if (head == vq->num) {
385                         if (unlikely(vhost_enable_notify(&net->dev, vq))) {
386                                 vhost_disable_notify(&net->dev, vq);
387                                 continue;
388                         }
389                         break;
390                 }
391                 if (in) {
392                         vq_err(vq, "Unexpected descriptor format for TX: "
393                                "out %d, int %d\n", out, in);
394                         break;
395                 }
396                 /* Skip header. TODO: support TSO. */
397                 s = move_iovec_hdr(vq->iov, nvq->hdr, hdr_size, out);
398                 msg.msg_iovlen = out;
399                 len = iov_length(vq->iov, out);
400                 /* Sanity check */
401                 if (!len) {
402                         vq_err(vq, "Unexpected header len for TX: "
403                                "%zd expected %zd\n",
404                                iov_length(nvq->hdr, s), hdr_size);
405                         break;
406                 }
407
408                 zcopy_used = zcopy && len >= VHOST_GOODCOPY_LEN
409                                    && (nvq->upend_idx + 1) % UIO_MAXIOV !=
410                                       nvq->done_idx
411                                    && vhost_net_tx_select_zcopy(net);
412
413                 /* use msg_control to pass vhost zerocopy ubuf info to skb */
414                 if (zcopy_used) {
415                         struct ubuf_info *ubuf;
416                         ubuf = nvq->ubuf_info + nvq->upend_idx;
417
418                         vq->heads[nvq->upend_idx].id = head;
419                         vq->heads[nvq->upend_idx].len = VHOST_DMA_IN_PROGRESS;
420                         ubuf->callback = vhost_zerocopy_callback;
421                         ubuf->ctx = nvq->ubufs;
422                         ubuf->desc = nvq->upend_idx;
423                         msg.msg_control = ubuf;
424                         msg.msg_controllen = sizeof(ubuf);
425                         ubufs = nvq->ubufs;
426                         atomic_inc(&ubufs->refcount);
427                         nvq->upend_idx = (nvq->upend_idx + 1) % UIO_MAXIOV;
428                 } else {
429                         msg.msg_control = NULL;
430                         ubufs = NULL;
431                 }
432                 /* TODO: Check specific error and bomb out unless ENOBUFS? */
433                 err = sock->ops->sendmsg(NULL, sock, &msg, len);
434                 if (unlikely(err < 0)) {
435                         if (zcopy_used) {
436                                 vhost_net_ubuf_put(ubufs);
437                                 nvq->upend_idx = ((unsigned)nvq->upend_idx - 1)
438                                         % UIO_MAXIOV;
439                         }
440                         vhost_discard_vq_desc(vq, 1);
441                         break;
442                 }
443                 if (err != len)
444                         pr_debug("Truncated TX packet: "
445                                  " len %d != %zd\n", err, len);
446                 if (!zcopy_used)
447                         vhost_add_used_and_signal(&net->dev, vq, head, 0);
448                 else
449                         vhost_zerocopy_signal_used(net, vq);
450                 total_len += len;
451                 vhost_net_tx_packet(net);
452                 if (unlikely(total_len >= VHOST_NET_WEIGHT)) {
453                         vhost_poll_queue(&vq->poll);
454                         break;
455                 }
456         }
457 out:
458         mutex_unlock(&vq->mutex);
459 }
460
461 static int peek_head_len(struct sock *sk)
462 {
463         struct sk_buff *head;
464         int len = 0;
465         unsigned long flags;
466
467         spin_lock_irqsave(&sk->sk_receive_queue.lock, flags);
468         head = skb_peek(&sk->sk_receive_queue);
469         if (likely(head)) {
470                 len = head->len;
471                 if (vlan_tx_tag_present(head))
472                         len += VLAN_HLEN;
473         }
474
475         spin_unlock_irqrestore(&sk->sk_receive_queue.lock, flags);
476         return len;
477 }
478
479 /* This is a multi-buffer version of vhost_get_desc, that works if
480  *      vq has read descriptors only.
481  * @vq          - the relevant virtqueue
482  * @datalen     - data length we'll be reading
483  * @iovcount    - returned count of io vectors we fill
484  * @log         - vhost log
485  * @log_num     - log offset
486  * @quota       - headcount quota, 1 for big buffer
487  *      returns number of buffer heads allocated, negative on error
488  */
489 static int get_rx_bufs(struct vhost_virtqueue *vq,
490                        struct vring_used_elem *heads,
491                        int datalen,
492                        unsigned *iovcount,
493                        struct vhost_log *log,
494                        unsigned *log_num,
495                        unsigned int quota)
496 {
497         unsigned int out, in;
498         int seg = 0;
499         int headcount = 0;
500         unsigned d;
501         int r, nlogs = 0;
502
503         while (datalen > 0 && headcount < quota) {
504                 if (unlikely(seg >= UIO_MAXIOV)) {
505                         r = -ENOBUFS;
506                         goto err;
507                 }
508                 d = vhost_get_vq_desc(vq->dev, vq, vq->iov + seg,
509                                       ARRAY_SIZE(vq->iov) - seg, &out,
510                                       &in, log, log_num);
511                 if (d == vq->num) {
512                         r = 0;
513                         goto err;
514                 }
515                 if (unlikely(out || in <= 0)) {
516                         vq_err(vq, "unexpected descriptor format for RX: "
517                                 "out %d, in %d\n", out, in);
518                         r = -EINVAL;
519                         goto err;
520                 }
521                 if (unlikely(log)) {
522                         nlogs += *log_num;
523                         log += *log_num;
524                 }
525                 heads[headcount].id = d;
526                 heads[headcount].len = iov_length(vq->iov + seg, in);
527                 datalen -= heads[headcount].len;
528                 ++headcount;
529                 seg += in;
530         }
531         heads[headcount - 1].len += datalen;
532         *iovcount = seg;
533         if (unlikely(log))
534                 *log_num = nlogs;
535         return headcount;
536 err:
537         vhost_discard_vq_desc(vq, headcount);
538         return r;
539 }
540
541 /* Expects to be always run from workqueue - which acts as
542  * read-size critical section for our kind of RCU. */
543 static void handle_rx(struct vhost_net *net)
544 {
545         struct vhost_net_virtqueue *nvq = &net->vqs[VHOST_NET_VQ_RX];
546         struct vhost_virtqueue *vq = &nvq->vq;
547         unsigned uninitialized_var(in), log;
548         struct vhost_log *vq_log;
549         struct msghdr msg = {
550                 .msg_name = NULL,
551                 .msg_namelen = 0,
552                 .msg_control = NULL, /* FIXME: get and handle RX aux data. */
553                 .msg_controllen = 0,
554                 .msg_iov = vq->iov,
555                 .msg_flags = MSG_DONTWAIT,
556         };
557         struct virtio_net_hdr_mrg_rxbuf hdr = {
558                 .hdr.flags = 0,
559                 .hdr.gso_type = VIRTIO_NET_HDR_GSO_NONE
560         };
561         size_t total_len = 0;
562         int err, mergeable;
563         s16 headcount;
564         size_t vhost_hlen, sock_hlen;
565         size_t vhost_len, sock_len;
566         struct socket *sock;
567
568         mutex_lock(&vq->mutex);
569         sock = vq->private_data;
570         if (!sock)
571                 goto out;
572         vhost_disable_notify(&net->dev, vq);
573
574         vhost_hlen = nvq->vhost_hlen;
575         sock_hlen = nvq->sock_hlen;
576
577         vq_log = unlikely(vhost_has_feature(&net->dev, VHOST_F_LOG_ALL)) ?
578                 vq->log : NULL;
579         mergeable = vhost_has_feature(&net->dev, VIRTIO_NET_F_MRG_RXBUF);
580
581         while ((sock_len = peek_head_len(sock->sk))) {
582                 sock_len += sock_hlen;
583                 vhost_len = sock_len + vhost_hlen;
584                 headcount = get_rx_bufs(vq, vq->heads, vhost_len,
585                                         &in, vq_log, &log,
586                                         likely(mergeable) ? UIO_MAXIOV : 1);
587                 /* On error, stop handling until the next kick. */
588                 if (unlikely(headcount < 0))
589                         break;
590                 /* OK, now we need to know about added descriptors. */
591                 if (!headcount) {
592                         if (unlikely(vhost_enable_notify(&net->dev, vq))) {
593                                 /* They have slipped one in as we were
594                                  * doing that: check again. */
595                                 vhost_disable_notify(&net->dev, vq);
596                                 continue;
597                         }
598                         /* Nothing new?  Wait for eventfd to tell us
599                          * they refilled. */
600                         break;
601                 }
602                 /* We don't need to be notified again. */
603                 if (unlikely((vhost_hlen)))
604                         /* Skip header. TODO: support TSO. */
605                         move_iovec_hdr(vq->iov, nvq->hdr, vhost_hlen, in);
606                 else
607                         /* Copy the header for use in VIRTIO_NET_F_MRG_RXBUF:
608                          * needed because recvmsg can modify msg_iov. */
609                         copy_iovec_hdr(vq->iov, nvq->hdr, sock_hlen, in);
610                 msg.msg_iovlen = in;
611                 err = sock->ops->recvmsg(NULL, sock, &msg,
612                                          sock_len, MSG_DONTWAIT | MSG_TRUNC);
613                 /* Userspace might have consumed the packet meanwhile:
614                  * it's not supposed to do this usually, but might be hard
615                  * to prevent. Discard data we got (if any) and keep going. */
616                 if (unlikely(err != sock_len)) {
617                         pr_debug("Discarded rx packet: "
618                                  " len %d, expected %zd\n", err, sock_len);
619                         vhost_discard_vq_desc(vq, headcount);
620                         continue;
621                 }
622                 if (unlikely(vhost_hlen) &&
623                     memcpy_toiovecend(nvq->hdr, (unsigned char *)&hdr, 0,
624                                       vhost_hlen)) {
625                         vq_err(vq, "Unable to write vnet_hdr at addr %p\n",
626                                vq->iov->iov_base);
627                         break;
628                 }
629                 /* TODO: Should check and handle checksum. */
630                 if (likely(mergeable) &&
631                     memcpy_toiovecend(nvq->hdr, (unsigned char *)&headcount,
632                                       offsetof(typeof(hdr), num_buffers),
633                                       sizeof hdr.num_buffers)) {
634                         vq_err(vq, "Failed num_buffers write");
635                         vhost_discard_vq_desc(vq, headcount);
636                         break;
637                 }
638                 vhost_add_used_and_signal_n(&net->dev, vq, vq->heads,
639                                             headcount);
640                 if (unlikely(vq_log))
641                         vhost_log_write(vq, vq_log, log, vhost_len);
642                 total_len += vhost_len;
643                 if (unlikely(total_len >= VHOST_NET_WEIGHT)) {
644                         vhost_poll_queue(&vq->poll);
645                         break;
646                 }
647         }
648 out:
649         mutex_unlock(&vq->mutex);
650 }
651
652 static void handle_tx_kick(struct vhost_work *work)
653 {
654         struct vhost_virtqueue *vq = container_of(work, struct vhost_virtqueue,
655                                                   poll.work);
656         struct vhost_net *net = container_of(vq->dev, struct vhost_net, dev);
657
658         handle_tx(net);
659 }
660
661 static void handle_rx_kick(struct vhost_work *work)
662 {
663         struct vhost_virtqueue *vq = container_of(work, struct vhost_virtqueue,
664                                                   poll.work);
665         struct vhost_net *net = container_of(vq->dev, struct vhost_net, dev);
666
667         handle_rx(net);
668 }
669
670 static void handle_tx_net(struct vhost_work *work)
671 {
672         struct vhost_net *net = container_of(work, struct vhost_net,
673                                              poll[VHOST_NET_VQ_TX].work);
674         handle_tx(net);
675 }
676
677 static void handle_rx_net(struct vhost_work *work)
678 {
679         struct vhost_net *net = container_of(work, struct vhost_net,
680                                              poll[VHOST_NET_VQ_RX].work);
681         handle_rx(net);
682 }
683
684 static int vhost_net_open(struct inode *inode, struct file *f)
685 {
686         struct vhost_net *n = kmalloc(sizeof *n, GFP_KERNEL);
687         struct vhost_dev *dev;
688         struct vhost_virtqueue **vqs;
689         int i;
690
691         if (!n)
692                 return -ENOMEM;
693         vqs = kmalloc(VHOST_NET_VQ_MAX * sizeof(*vqs), GFP_KERNEL);
694         if (!vqs) {
695                 kfree(n);
696                 return -ENOMEM;
697         }
698
699         dev = &n->dev;
700         vqs[VHOST_NET_VQ_TX] = &n->vqs[VHOST_NET_VQ_TX].vq;
701         vqs[VHOST_NET_VQ_RX] = &n->vqs[VHOST_NET_VQ_RX].vq;
702         n->vqs[VHOST_NET_VQ_TX].vq.handle_kick = handle_tx_kick;
703         n->vqs[VHOST_NET_VQ_RX].vq.handle_kick = handle_rx_kick;
704         for (i = 0; i < VHOST_NET_VQ_MAX; i++) {
705                 n->vqs[i].ubufs = NULL;
706                 n->vqs[i].ubuf_info = NULL;
707                 n->vqs[i].upend_idx = 0;
708                 n->vqs[i].done_idx = 0;
709                 n->vqs[i].vhost_hlen = 0;
710                 n->vqs[i].sock_hlen = 0;
711         }
712         vhost_dev_init(dev, vqs, VHOST_NET_VQ_MAX);
713
714         vhost_poll_init(n->poll + VHOST_NET_VQ_TX, handle_tx_net, POLLOUT, dev);
715         vhost_poll_init(n->poll + VHOST_NET_VQ_RX, handle_rx_net, POLLIN, dev);
716
717         f->private_data = n;
718
719         return 0;
720 }
721
722 static void vhost_net_disable_vq(struct vhost_net *n,
723                                  struct vhost_virtqueue *vq)
724 {
725         struct vhost_net_virtqueue *nvq =
726                 container_of(vq, struct vhost_net_virtqueue, vq);
727         struct vhost_poll *poll = n->poll + (nvq - n->vqs);
728         if (!vq->private_data)
729                 return;
730         vhost_poll_stop(poll);
731 }
732
733 static int vhost_net_enable_vq(struct vhost_net *n,
734                                 struct vhost_virtqueue *vq)
735 {
736         struct vhost_net_virtqueue *nvq =
737                 container_of(vq, struct vhost_net_virtqueue, vq);
738         struct vhost_poll *poll = n->poll + (nvq - n->vqs);
739         struct socket *sock;
740
741         sock = vq->private_data;
742         if (!sock)
743                 return 0;
744
745         return vhost_poll_start(poll, sock->file);
746 }
747
748 static struct socket *vhost_net_stop_vq(struct vhost_net *n,
749                                         struct vhost_virtqueue *vq)
750 {
751         struct socket *sock;
752
753         mutex_lock(&vq->mutex);
754         sock = vq->private_data;
755         vhost_net_disable_vq(n, vq);
756         vq->private_data = NULL;
757         mutex_unlock(&vq->mutex);
758         return sock;
759 }
760
761 static void vhost_net_stop(struct vhost_net *n, struct socket **tx_sock,
762                            struct socket **rx_sock)
763 {
764         *tx_sock = vhost_net_stop_vq(n, &n->vqs[VHOST_NET_VQ_TX].vq);
765         *rx_sock = vhost_net_stop_vq(n, &n->vqs[VHOST_NET_VQ_RX].vq);
766 }
767
768 static void vhost_net_flush_vq(struct vhost_net *n, int index)
769 {
770         vhost_poll_flush(n->poll + index);
771         vhost_poll_flush(&n->vqs[index].vq.poll);
772 }
773
774 static void vhost_net_flush(struct vhost_net *n)
775 {
776         vhost_net_flush_vq(n, VHOST_NET_VQ_TX);
777         vhost_net_flush_vq(n, VHOST_NET_VQ_RX);
778         if (n->vqs[VHOST_NET_VQ_TX].ubufs) {
779                 mutex_lock(&n->vqs[VHOST_NET_VQ_TX].vq.mutex);
780                 n->tx_flush = true;
781                 mutex_unlock(&n->vqs[VHOST_NET_VQ_TX].vq.mutex);
782                 /* Wait for all lower device DMAs done. */
783                 vhost_net_ubuf_put_and_wait(n->vqs[VHOST_NET_VQ_TX].ubufs);
784                 mutex_lock(&n->vqs[VHOST_NET_VQ_TX].vq.mutex);
785                 n->tx_flush = false;
786                 atomic_set(&n->vqs[VHOST_NET_VQ_TX].ubufs->refcount, 1);
787                 mutex_unlock(&n->vqs[VHOST_NET_VQ_TX].vq.mutex);
788         }
789 }
790
791 static int vhost_net_release(struct inode *inode, struct file *f)
792 {
793         struct vhost_net *n = f->private_data;
794         struct socket *tx_sock;
795         struct socket *rx_sock;
796
797         vhost_net_stop(n, &tx_sock, &rx_sock);
798         vhost_net_flush(n);
799         vhost_dev_stop(&n->dev);
800         vhost_dev_cleanup(&n->dev, false);
801         vhost_net_vq_reset(n);
802         if (tx_sock)
803                 fput(tx_sock->file);
804         if (rx_sock)
805                 fput(rx_sock->file);
806         /* Make sure no callbacks are outstanding */
807         synchronize_rcu_bh();
808         /* We do an extra flush before freeing memory,
809          * since jobs can re-queue themselves. */
810         vhost_net_flush(n);
811         kfree(n->dev.vqs);
812         kfree(n);
813         return 0;
814 }
815
816 static struct socket *get_raw_socket(int fd)
817 {
818         struct {
819                 struct sockaddr_ll sa;
820                 char  buf[MAX_ADDR_LEN];
821         } uaddr;
822         int uaddr_len = sizeof uaddr, r;
823         struct socket *sock = sockfd_lookup(fd, &r);
824
825         if (!sock)
826                 return ERR_PTR(-ENOTSOCK);
827
828         /* Parameter checking */
829         if (sock->sk->sk_type != SOCK_RAW) {
830                 r = -ESOCKTNOSUPPORT;
831                 goto err;
832         }
833
834         r = sock->ops->getname(sock, (struct sockaddr *)&uaddr.sa,
835                                &uaddr_len, 0);
836         if (r)
837                 goto err;
838
839         if (uaddr.sa.sll_family != AF_PACKET) {
840                 r = -EPFNOSUPPORT;
841                 goto err;
842         }
843         return sock;
844 err:
845         fput(sock->file);
846         return ERR_PTR(r);
847 }
848
849 static struct socket *get_tap_socket(int fd)
850 {
851         struct file *file = fget(fd);
852         struct socket *sock;
853
854         if (!file)
855                 return ERR_PTR(-EBADF);
856         sock = tun_get_socket(file);
857         if (!IS_ERR(sock))
858                 return sock;
859         sock = macvtap_get_socket(file);
860         if (IS_ERR(sock))
861                 fput(file);
862         return sock;
863 }
864
865 static struct socket *get_socket(int fd)
866 {
867         struct socket *sock;
868
869         /* special case to disable backend */
870         if (fd == -1)
871                 return NULL;
872         sock = get_raw_socket(fd);
873         if (!IS_ERR(sock))
874                 return sock;
875         sock = get_tap_socket(fd);
876         if (!IS_ERR(sock))
877                 return sock;
878         return ERR_PTR(-ENOTSOCK);
879 }
880
881 static long vhost_net_set_backend(struct vhost_net *n, unsigned index, int fd)
882 {
883         struct socket *sock, *oldsock;
884         struct vhost_virtqueue *vq;
885         struct vhost_net_virtqueue *nvq;
886         struct vhost_net_ubuf_ref *ubufs, *oldubufs = NULL;
887         int r;
888
889         mutex_lock(&n->dev.mutex);
890         r = vhost_dev_check_owner(&n->dev);
891         if (r)
892                 goto err;
893
894         if (index >= VHOST_NET_VQ_MAX) {
895                 r = -ENOBUFS;
896                 goto err;
897         }
898         vq = &n->vqs[index].vq;
899         nvq = &n->vqs[index];
900         mutex_lock(&vq->mutex);
901
902         /* Verify that ring has been setup correctly. */
903         if (!vhost_vq_access_ok(vq)) {
904                 r = -EFAULT;
905                 goto err_vq;
906         }
907         sock = get_socket(fd);
908         if (IS_ERR(sock)) {
909                 r = PTR_ERR(sock);
910                 goto err_vq;
911         }
912
913         /* start polling new socket */
914         oldsock = vq->private_data;
915         if (sock != oldsock) {
916                 ubufs = vhost_net_ubuf_alloc(vq,
917                                              sock && vhost_sock_zcopy(sock));
918                 if (IS_ERR(ubufs)) {
919                         r = PTR_ERR(ubufs);
920                         goto err_ubufs;
921                 }
922
923                 vhost_net_disable_vq(n, vq);
924                 vq->private_data = sock;
925                 r = vhost_init_used(vq);
926                 if (r)
927                         goto err_used;
928                 r = vhost_net_enable_vq(n, vq);
929                 if (r)
930                         goto err_used;
931
932                 oldubufs = nvq->ubufs;
933                 nvq->ubufs = ubufs;
934
935                 n->tx_packets = 0;
936                 n->tx_zcopy_err = 0;
937                 n->tx_flush = false;
938         }
939
940         mutex_unlock(&vq->mutex);
941
942         if (oldubufs) {
943                 vhost_net_ubuf_put_wait_and_free(oldubufs);
944                 mutex_lock(&vq->mutex);
945                 vhost_zerocopy_signal_used(n, vq);
946                 mutex_unlock(&vq->mutex);
947         }
948
949         if (oldsock) {
950                 vhost_net_flush_vq(n, index);
951                 fput(oldsock->file);
952         }
953
954         mutex_unlock(&n->dev.mutex);
955         return 0;
956
957 err_used:
958         vq->private_data = oldsock;
959         vhost_net_enable_vq(n, vq);
960         if (ubufs)
961                 vhost_net_ubuf_put_wait_and_free(ubufs);
962 err_ubufs:
963         fput(sock->file);
964 err_vq:
965         mutex_unlock(&vq->mutex);
966 err:
967         mutex_unlock(&n->dev.mutex);
968         return r;
969 }
970
971 static long vhost_net_reset_owner(struct vhost_net *n)
972 {
973         struct socket *tx_sock = NULL;
974         struct socket *rx_sock = NULL;
975         long err;
976         struct vhost_memory *memory;
977
978         mutex_lock(&n->dev.mutex);
979         err = vhost_dev_check_owner(&n->dev);
980         if (err)
981                 goto done;
982         memory = vhost_dev_reset_owner_prepare();
983         if (!memory) {
984                 err = -ENOMEM;
985                 goto done;
986         }
987         vhost_net_stop(n, &tx_sock, &rx_sock);
988         vhost_net_flush(n);
989         vhost_dev_reset_owner(&n->dev, memory);
990         vhost_net_vq_reset(n);
991 done:
992         mutex_unlock(&n->dev.mutex);
993         if (tx_sock)
994                 fput(tx_sock->file);
995         if (rx_sock)
996                 fput(rx_sock->file);
997         return err;
998 }
999
1000 static int vhost_net_set_features(struct vhost_net *n, u64 features)
1001 {
1002         size_t vhost_hlen, sock_hlen, hdr_len;
1003         int i;
1004
1005         hdr_len = (features & (1 << VIRTIO_NET_F_MRG_RXBUF)) ?
1006                         sizeof(struct virtio_net_hdr_mrg_rxbuf) :
1007                         sizeof(struct virtio_net_hdr);
1008         if (features & (1 << VHOST_NET_F_VIRTIO_NET_HDR)) {
1009                 /* vhost provides vnet_hdr */
1010                 vhost_hlen = hdr_len;
1011                 sock_hlen = 0;
1012         } else {
1013                 /* socket provides vnet_hdr */
1014                 vhost_hlen = 0;
1015                 sock_hlen = hdr_len;
1016         }
1017         mutex_lock(&n->dev.mutex);
1018         if ((features & (1 << VHOST_F_LOG_ALL)) &&
1019             !vhost_log_access_ok(&n->dev)) {
1020                 mutex_unlock(&n->dev.mutex);
1021                 return -EFAULT;
1022         }
1023         n->dev.acked_features = features;
1024         smp_wmb();
1025         for (i = 0; i < VHOST_NET_VQ_MAX; ++i) {
1026                 mutex_lock(&n->vqs[i].vq.mutex);
1027                 n->vqs[i].vhost_hlen = vhost_hlen;
1028                 n->vqs[i].sock_hlen = sock_hlen;
1029                 mutex_unlock(&n->vqs[i].vq.mutex);
1030         }
1031         vhost_net_flush(n);
1032         mutex_unlock(&n->dev.mutex);
1033         return 0;
1034 }
1035
1036 static long vhost_net_set_owner(struct vhost_net *n)
1037 {
1038         int r;
1039
1040         mutex_lock(&n->dev.mutex);
1041         if (vhost_dev_has_owner(&n->dev)) {
1042                 r = -EBUSY;
1043                 goto out;
1044         }
1045         r = vhost_net_set_ubuf_info(n);
1046         if (r)
1047                 goto out;
1048         r = vhost_dev_set_owner(&n->dev);
1049         if (r)
1050                 vhost_net_clear_ubuf_info(n);
1051         vhost_net_flush(n);
1052 out:
1053         mutex_unlock(&n->dev.mutex);
1054         return r;
1055 }
1056
1057 static long vhost_net_ioctl(struct file *f, unsigned int ioctl,
1058                             unsigned long arg)
1059 {
1060         struct vhost_net *n = f->private_data;
1061         void __user *argp = (void __user *)arg;
1062         u64 __user *featurep = argp;
1063         struct vhost_vring_file backend;
1064         u64 features;
1065         int r;
1066
1067         switch (ioctl) {
1068         case VHOST_NET_SET_BACKEND:
1069                 if (copy_from_user(&backend, argp, sizeof backend))
1070                         return -EFAULT;
1071                 return vhost_net_set_backend(n, backend.index, backend.fd);
1072         case VHOST_GET_FEATURES:
1073                 features = VHOST_NET_FEATURES;
1074                 if (copy_to_user(featurep, &features, sizeof features))
1075                         return -EFAULT;
1076                 return 0;
1077         case VHOST_SET_FEATURES:
1078                 if (copy_from_user(&features, featurep, sizeof features))
1079                         return -EFAULT;
1080                 if (features & ~VHOST_NET_FEATURES)
1081                         return -EOPNOTSUPP;
1082                 return vhost_net_set_features(n, features);
1083         case VHOST_RESET_OWNER:
1084                 return vhost_net_reset_owner(n);
1085         case VHOST_SET_OWNER:
1086                 return vhost_net_set_owner(n);
1087         default:
1088                 mutex_lock(&n->dev.mutex);
1089                 r = vhost_dev_ioctl(&n->dev, ioctl, argp);
1090                 if (r == -ENOIOCTLCMD)
1091                         r = vhost_vring_ioctl(&n->dev, ioctl, argp);
1092                 else
1093                         vhost_net_flush(n);
1094                 mutex_unlock(&n->dev.mutex);
1095                 return r;
1096         }
1097 }
1098
1099 #ifdef CONFIG_COMPAT
1100 static long vhost_net_compat_ioctl(struct file *f, unsigned int ioctl,
1101                                    unsigned long arg)
1102 {
1103         return vhost_net_ioctl(f, ioctl, (unsigned long)compat_ptr(arg));
1104 }
1105 #endif
1106
1107 static const struct file_operations vhost_net_fops = {
1108         .owner          = THIS_MODULE,
1109         .release        = vhost_net_release,
1110         .unlocked_ioctl = vhost_net_ioctl,
1111 #ifdef CONFIG_COMPAT
1112         .compat_ioctl   = vhost_net_compat_ioctl,
1113 #endif
1114         .open           = vhost_net_open,
1115         .llseek         = noop_llseek,
1116 };
1117
1118 static struct miscdevice vhost_net_misc = {
1119         .minor = VHOST_NET_MINOR,
1120         .name = "vhost-net",
1121         .fops = &vhost_net_fops,
1122 };
1123
1124 static int vhost_net_init(void)
1125 {
1126         if (experimental_zcopytx)
1127                 vhost_net_enable_zcopy(VHOST_NET_VQ_TX);
1128         return misc_register(&vhost_net_misc);
1129 }
1130 module_init(vhost_net_init);
1131
1132 static void vhost_net_exit(void)
1133 {
1134         misc_deregister(&vhost_net_misc);
1135 }
1136 module_exit(vhost_net_exit);
1137
1138 MODULE_VERSION("0.0.1");
1139 MODULE_LICENSE("GPL v2");
1140 MODULE_AUTHOR("Michael S. Tsirkin");
1141 MODULE_DESCRIPTION("Host kernel accelerator for virtio net");
1142 MODULE_ALIAS_MISCDEV(VHOST_NET_MINOR);
1143 MODULE_ALIAS("devname:vhost-net");