1 // SPDX-License-Identifier: GPL-2.0
2 /* Copyright (c) 2017 - 2018 Covalent IO, Inc. http://covalent.io */
4 #include <linux/skmsg.h>
5 #include <linux/skbuff.h>
6 #include <linux/scatterlist.h>
11 static bool sk_msg_try_coalesce_ok(struct sk_msg *msg, int elem_first_coalesce)
13 if (msg->sg.end > msg->sg.start &&
14 elem_first_coalesce < msg->sg.end)
17 if (msg->sg.end < msg->sg.start &&
18 (elem_first_coalesce > msg->sg.start ||
19 elem_first_coalesce < msg->sg.end))
25 int sk_msg_alloc(struct sock *sk, struct sk_msg *msg, int len,
26 int elem_first_coalesce)
28 struct page_frag *pfrag = sk_page_frag(sk);
33 struct scatterlist *sge;
37 if (!sk_page_frag_refill(sk, pfrag))
40 orig_offset = pfrag->offset;
41 use = min_t(int, len, pfrag->size - orig_offset);
42 if (!sk_wmem_schedule(sk, use))
46 sk_msg_iter_var_prev(i);
47 sge = &msg->sg.data[i];
49 if (sk_msg_try_coalesce_ok(msg, elem_first_coalesce) &&
50 sg_page(sge) == pfrag->page &&
51 sge->offset + sge->length == orig_offset) {
54 if (sk_msg_full(msg)) {
59 sge = &msg->sg.data[msg->sg.end];
61 sg_set_page(sge, pfrag->page, use, orig_offset);
62 get_page(pfrag->page);
63 sk_msg_iter_next(msg, end);
66 sk_mem_charge(sk, use);
74 EXPORT_SYMBOL_GPL(sk_msg_alloc);
76 int sk_msg_clone(struct sock *sk, struct sk_msg *dst, struct sk_msg *src,
79 int i = src->sg.start;
80 struct scatterlist *sge = sk_msg_elem(src, i);
81 struct scatterlist *sgd = NULL;
85 if (sge->length > off)
88 sk_msg_iter_var_next(i);
89 if (i == src->sg.end && off)
91 sge = sk_msg_elem(src, i);
95 sge_len = sge->length - off;
100 sgd = sk_msg_elem(dst, dst->sg.end - 1);
103 (sg_page(sge) == sg_page(sgd)) &&
104 (sg_virt(sge) + off == sg_virt(sgd) + sgd->length)) {
105 sgd->length += sge_len;
106 dst->sg.size += sge_len;
107 } else if (!sk_msg_full(dst)) {
108 sge_off = sge->offset + off;
109 sk_msg_page_add(dst, sg_page(sge), sge_len, sge_off);
116 sk_mem_charge(sk, sge_len);
117 sk_msg_iter_var_next(i);
118 if (i == src->sg.end && len)
120 sge = sk_msg_elem(src, i);
125 EXPORT_SYMBOL_GPL(sk_msg_clone);
127 void sk_msg_return_zero(struct sock *sk, struct sk_msg *msg, int bytes)
129 int i = msg->sg.start;
132 struct scatterlist *sge = sk_msg_elem(msg, i);
134 if (bytes < sge->length) {
135 sge->length -= bytes;
136 sge->offset += bytes;
137 sk_mem_uncharge(sk, bytes);
141 sk_mem_uncharge(sk, sge->length);
142 bytes -= sge->length;
145 sk_msg_iter_var_next(i);
146 } while (bytes && i != msg->sg.end);
149 EXPORT_SYMBOL_GPL(sk_msg_return_zero);
151 void sk_msg_return(struct sock *sk, struct sk_msg *msg, int bytes)
153 int i = msg->sg.start;
156 struct scatterlist *sge = &msg->sg.data[i];
157 int uncharge = (bytes < sge->length) ? bytes : sge->length;
159 sk_mem_uncharge(sk, uncharge);
161 sk_msg_iter_var_next(i);
162 } while (i != msg->sg.end);
164 EXPORT_SYMBOL_GPL(sk_msg_return);
166 static int sk_msg_free_elem(struct sock *sk, struct sk_msg *msg, u32 i,
169 struct scatterlist *sge = sk_msg_elem(msg, i);
170 u32 len = sge->length;
173 sk_mem_uncharge(sk, len);
175 put_page(sg_page(sge));
176 memset(sge, 0, sizeof(*sge));
180 static int __sk_msg_free(struct sock *sk, struct sk_msg *msg, u32 i,
183 struct scatterlist *sge = sk_msg_elem(msg, i);
186 while (msg->sg.size) {
187 msg->sg.size -= sge->length;
188 freed += sk_msg_free_elem(sk, msg, i, charge);
189 sk_msg_iter_var_next(i);
190 sk_msg_check_to_free(msg, i, msg->sg.size);
191 sge = sk_msg_elem(msg, i);
193 consume_skb(msg->skb);
198 int sk_msg_free_nocharge(struct sock *sk, struct sk_msg *msg)
200 return __sk_msg_free(sk, msg, msg->sg.start, false);
202 EXPORT_SYMBOL_GPL(sk_msg_free_nocharge);
204 int sk_msg_free(struct sock *sk, struct sk_msg *msg)
206 return __sk_msg_free(sk, msg, msg->sg.start, true);
208 EXPORT_SYMBOL_GPL(sk_msg_free);
210 static void __sk_msg_free_partial(struct sock *sk, struct sk_msg *msg,
211 u32 bytes, bool charge)
213 struct scatterlist *sge;
214 u32 i = msg->sg.start;
217 sge = sk_msg_elem(msg, i);
220 if (bytes < sge->length) {
222 sk_mem_uncharge(sk, bytes);
223 sge->length -= bytes;
224 sge->offset += bytes;
225 msg->sg.size -= bytes;
229 msg->sg.size -= sge->length;
230 bytes -= sge->length;
231 sk_msg_free_elem(sk, msg, i, charge);
232 sk_msg_iter_var_next(i);
233 sk_msg_check_to_free(msg, i, bytes);
238 void sk_msg_free_partial(struct sock *sk, struct sk_msg *msg, u32 bytes)
240 __sk_msg_free_partial(sk, msg, bytes, true);
242 EXPORT_SYMBOL_GPL(sk_msg_free_partial);
244 void sk_msg_free_partial_nocharge(struct sock *sk, struct sk_msg *msg,
247 __sk_msg_free_partial(sk, msg, bytes, false);
250 void sk_msg_trim(struct sock *sk, struct sk_msg *msg, int len)
252 int trim = msg->sg.size - len;
260 sk_msg_iter_var_prev(i);
262 while (msg->sg.data[i].length &&
263 trim >= msg->sg.data[i].length) {
264 trim -= msg->sg.data[i].length;
265 sk_msg_free_elem(sk, msg, i, true);
266 sk_msg_iter_var_prev(i);
271 msg->sg.data[i].length -= trim;
272 sk_mem_uncharge(sk, trim);
274 /* If we trim data before curr pointer update copybreak and current
275 * so that any future copy operations start at new copy location.
276 * However trimed data that has not yet been used in a copy op
277 * does not require an update.
279 if (msg->sg.curr >= i) {
281 msg->sg.copybreak = msg->sg.data[i].length;
283 sk_msg_iter_var_next(i);
286 EXPORT_SYMBOL_GPL(sk_msg_trim);
288 int sk_msg_zerocopy_from_iter(struct sock *sk, struct iov_iter *from,
289 struct sk_msg *msg, u32 bytes)
291 int i, maxpages, ret = 0, num_elems = sk_msg_elem_used(msg);
292 const int to_max_pages = MAX_MSG_FRAGS;
293 struct page *pages[MAX_MSG_FRAGS];
294 ssize_t orig, copied, use, offset;
299 maxpages = to_max_pages - num_elems;
305 copied = iov_iter_get_pages(from, pages, bytes, maxpages,
312 iov_iter_advance(from, copied);
314 msg->sg.size += copied;
317 use = min_t(int, copied, PAGE_SIZE - offset);
318 sg_set_page(&msg->sg.data[msg->sg.end],
319 pages[i], use, offset);
320 sg_unmark_end(&msg->sg.data[msg->sg.end]);
321 sk_mem_charge(sk, use);
325 sk_msg_iter_next(msg, end);
329 /* When zerocopy is mixed with sk_msg_*copy* operations we
330 * may have a copybreak set in this case clear and prefer
331 * zerocopy remainder when possible.
333 msg->sg.copybreak = 0;
334 msg->sg.curr = msg->sg.end;
337 /* Revert iov_iter updates, msg will need to use 'trim' later if it
338 * also needs to be cleared.
341 iov_iter_revert(from, msg->sg.size - orig);
344 EXPORT_SYMBOL_GPL(sk_msg_zerocopy_from_iter);
346 int sk_msg_memcopy_from_iter(struct sock *sk, struct iov_iter *from,
347 struct sk_msg *msg, u32 bytes)
349 int ret = -ENOSPC, i = msg->sg.curr;
350 struct scatterlist *sge;
355 sge = sk_msg_elem(msg, i);
356 /* This is possible if a trim operation shrunk the buffer */
357 if (msg->sg.copybreak >= sge->length) {
358 msg->sg.copybreak = 0;
359 sk_msg_iter_var_next(i);
360 if (i == msg->sg.end)
362 sge = sk_msg_elem(msg, i);
365 buf_size = sge->length - msg->sg.copybreak;
366 copy = (buf_size > bytes) ? bytes : buf_size;
367 to = sg_virt(sge) + msg->sg.copybreak;
368 msg->sg.copybreak += copy;
369 if (sk->sk_route_caps & NETIF_F_NOCACHE_COPY)
370 ret = copy_from_iter_nocache(to, copy, from);
372 ret = copy_from_iter(to, copy, from);
380 msg->sg.copybreak = 0;
381 sk_msg_iter_var_next(i);
382 } while (i != msg->sg.end);
387 EXPORT_SYMBOL_GPL(sk_msg_memcopy_from_iter);
389 static int sk_psock_skb_ingress(struct sk_psock *psock, struct sk_buff *skb)
391 struct sock *sk = psock->sk;
392 int copied = 0, num_sge;
395 msg = kzalloc(sizeof(*msg), __GFP_NOWARN | GFP_ATOMIC);
398 if (!sk_rmem_schedule(sk, skb, skb->len)) {
404 num_sge = skb_to_sgvec(skb, msg->sg.data, 0, skb->len);
405 if (unlikely(num_sge < 0)) {
410 sk_mem_charge(sk, skb->len);
413 msg->sg.size = copied;
414 msg->sg.end = num_sge == MAX_MSG_FRAGS ? 0 : num_sge;
417 sk_psock_queue_msg(psock, msg);
418 sk_psock_data_ready(sk, psock);
422 static int sk_psock_handle_skb(struct sk_psock *psock, struct sk_buff *skb,
423 u32 off, u32 len, bool ingress)
426 return sk_psock_skb_ingress(psock, skb);
428 return skb_send_sock_locked(psock->sk, skb, off, len);
431 static void sk_psock_backlog(struct work_struct *work)
433 struct sk_psock *psock = container_of(work, struct sk_psock, work);
434 struct sk_psock_work_state *state = &psock->work_state;
440 /* Lock sock to avoid losing sk_socket during loop. */
441 lock_sock(psock->sk);
450 while ((skb = skb_dequeue(&psock->ingress_skb))) {
454 ingress = tcp_skb_bpf_ingress(skb);
457 if (likely(psock->sk->sk_socket))
458 ret = sk_psock_handle_skb(psock, skb, off,
461 if (ret == -EAGAIN) {
467 /* Hard errors break pipe and stop xmit. */
468 sk_psock_report_error(psock, ret ? -ret : EPIPE);
469 sk_psock_clear_state(psock, SK_PSOCK_TX_ENABLED);
481 release_sock(psock->sk);
484 struct sk_psock *sk_psock_init(struct sock *sk, int node)
486 struct sk_psock *psock = kzalloc_node(sizeof(*psock),
487 GFP_ATOMIC | __GFP_NOWARN,
493 psock->eval = __SK_NONE;
495 INIT_LIST_HEAD(&psock->link);
496 spin_lock_init(&psock->link_lock);
498 INIT_WORK(&psock->work, sk_psock_backlog);
499 INIT_LIST_HEAD(&psock->ingress_msg);
500 skb_queue_head_init(&psock->ingress_skb);
502 sk_psock_set_state(psock, SK_PSOCK_TX_ENABLED);
503 refcount_set(&psock->refcnt, 1);
505 rcu_assign_sk_user_data(sk, psock);
510 EXPORT_SYMBOL_GPL(sk_psock_init);
512 struct sk_psock_link *sk_psock_link_pop(struct sk_psock *psock)
514 struct sk_psock_link *link;
516 spin_lock_bh(&psock->link_lock);
517 link = list_first_entry_or_null(&psock->link, struct sk_psock_link,
520 list_del(&link->list);
521 spin_unlock_bh(&psock->link_lock);
525 void __sk_psock_purge_ingress_msg(struct sk_psock *psock)
527 struct sk_msg *msg, *tmp;
529 list_for_each_entry_safe(msg, tmp, &psock->ingress_msg, list) {
530 list_del(&msg->list);
531 sk_msg_free(psock->sk, msg);
536 static void sk_psock_zap_ingress(struct sk_psock *psock)
538 __skb_queue_purge(&psock->ingress_skb);
539 __sk_psock_purge_ingress_msg(psock);
542 static void sk_psock_link_destroy(struct sk_psock *psock)
544 struct sk_psock_link *link, *tmp;
546 list_for_each_entry_safe(link, tmp, &psock->link, list) {
547 list_del(&link->list);
548 sk_psock_free_link(link);
552 static void sk_psock_destroy_deferred(struct work_struct *gc)
554 struct sk_psock *psock = container_of(gc, struct sk_psock, gc);
556 /* No sk_callback_lock since already detached. */
558 /* Parser has been stopped */
559 if (psock->progs.skb_parser)
560 strp_done(&psock->parser.strp);
562 cancel_work_sync(&psock->work);
564 psock_progs_drop(&psock->progs);
566 sk_psock_link_destroy(psock);
567 sk_psock_cork_free(psock);
568 sk_psock_zap_ingress(psock);
571 sock_put(psock->sk_redir);
576 void sk_psock_destroy(struct rcu_head *rcu)
578 struct sk_psock *psock = container_of(rcu, struct sk_psock, rcu);
580 INIT_WORK(&psock->gc, sk_psock_destroy_deferred);
581 schedule_work(&psock->gc);
583 EXPORT_SYMBOL_GPL(sk_psock_destroy);
585 void sk_psock_drop(struct sock *sk, struct sk_psock *psock)
587 sk_psock_cork_free(psock);
588 sk_psock_zap_ingress(psock);
590 write_lock_bh(&sk->sk_callback_lock);
591 sk_psock_restore_proto(sk, psock);
592 rcu_assign_sk_user_data(sk, NULL);
593 if (psock->progs.skb_parser)
594 sk_psock_stop_strp(sk, psock);
595 write_unlock_bh(&sk->sk_callback_lock);
596 sk_psock_clear_state(psock, SK_PSOCK_TX_ENABLED);
598 call_rcu(&psock->rcu, sk_psock_destroy);
600 EXPORT_SYMBOL_GPL(sk_psock_drop);
602 static int sk_psock_map_verd(int verdict, bool redir)
606 return redir ? __SK_REDIRECT : __SK_PASS;
615 int sk_psock_msg_verdict(struct sock *sk, struct sk_psock *psock,
618 struct bpf_prog *prog;
623 prog = READ_ONCE(psock->progs.msg_parser);
624 if (unlikely(!prog)) {
629 sk_msg_compute_data_pointers(msg);
631 ret = BPF_PROG_RUN(prog, msg);
632 ret = sk_psock_map_verd(ret, msg->sk_redir);
633 psock->apply_bytes = msg->apply_bytes;
634 if (ret == __SK_REDIRECT) {
636 sock_put(psock->sk_redir);
637 psock->sk_redir = msg->sk_redir;
638 if (!psock->sk_redir) {
642 sock_hold(psock->sk_redir);
649 EXPORT_SYMBOL_GPL(sk_psock_msg_verdict);
651 static int sk_psock_bpf_run(struct sk_psock *psock, struct bpf_prog *prog,
657 bpf_compute_data_end_sk_skb(skb);
659 ret = BPF_PROG_RUN(prog, skb);
661 /* strparser clones the skb before handing it to a upper layer,
662 * meaning skb_orphan has been called. We NULL sk on the way out
663 * to ensure we don't trigger a BUG_ON() in skb/sk operations
664 * later and because we are not charging the memory of this skb
671 static struct sk_psock *sk_psock_from_strp(struct strparser *strp)
673 struct sk_psock_parser *parser;
675 parser = container_of(strp, struct sk_psock_parser, strp);
676 return container_of(parser, struct sk_psock, parser);
679 static void sk_psock_verdict_apply(struct sk_psock *psock,
680 struct sk_buff *skb, int verdict)
682 struct sk_psock *psock_other;
683 struct sock *sk_other;
688 sk_other = psock->sk;
689 if (sock_flag(sk_other, SOCK_DEAD) ||
690 !sk_psock_test_state(psock, SK_PSOCK_TX_ENABLED)) {
693 if (atomic_read(&sk_other->sk_rmem_alloc) <=
694 sk_other->sk_rcvbuf) {
695 struct tcp_skb_cb *tcp = TCP_SKB_CB(skb);
697 tcp->bpf.flags |= BPF_F_INGRESS;
698 skb_queue_tail(&psock->ingress_skb, skb);
699 schedule_work(&psock->work);
704 sk_other = tcp_skb_bpf_redirect_fetch(skb);
705 if (unlikely(!sk_other))
707 psock_other = sk_psock(sk_other);
708 if (!psock_other || sock_flag(sk_other, SOCK_DEAD) ||
709 !sk_psock_test_state(psock_other, SK_PSOCK_TX_ENABLED))
711 ingress = tcp_skb_bpf_ingress(skb);
712 if ((!ingress && sock_writeable(sk_other)) ||
714 atomic_read(&sk_other->sk_rmem_alloc) <=
715 sk_other->sk_rcvbuf)) {
717 skb_set_owner_w(skb, sk_other);
718 skb_queue_tail(&psock_other->ingress_skb, skb);
719 schedule_work(&psock_other->work);
731 static void sk_psock_strp_read(struct strparser *strp, struct sk_buff *skb)
733 struct sk_psock *psock = sk_psock_from_strp(strp);
734 struct bpf_prog *prog;
738 prog = READ_ONCE(psock->progs.skb_verdict);
741 tcp_skb_bpf_redirect_clear(skb);
742 ret = sk_psock_bpf_run(psock, prog, skb);
743 ret = sk_psock_map_verd(ret, tcp_skb_bpf_redirect_fetch(skb));
746 sk_psock_verdict_apply(psock, skb, ret);
749 static int sk_psock_strp_read_done(struct strparser *strp, int err)
754 static int sk_psock_strp_parse(struct strparser *strp, struct sk_buff *skb)
756 struct sk_psock *psock = sk_psock_from_strp(strp);
757 struct bpf_prog *prog;
761 prog = READ_ONCE(psock->progs.skb_parser);
763 ret = sk_psock_bpf_run(psock, prog, skb);
768 /* Called with socket lock held. */
769 static void sk_psock_strp_data_ready(struct sock *sk)
771 struct sk_psock *psock;
774 psock = sk_psock(sk);
776 write_lock_bh(&sk->sk_callback_lock);
777 strp_data_ready(&psock->parser.strp);
778 write_unlock_bh(&sk->sk_callback_lock);
783 static void sk_psock_write_space(struct sock *sk)
785 struct sk_psock *psock;
786 void (*write_space)(struct sock *sk);
789 psock = sk_psock(sk);
790 if (likely(psock && sk_psock_test_state(psock, SK_PSOCK_TX_ENABLED)))
791 schedule_work(&psock->work);
792 write_space = psock->saved_write_space;
797 int sk_psock_init_strp(struct sock *sk, struct sk_psock *psock)
799 static const struct strp_callbacks cb = {
800 .rcv_msg = sk_psock_strp_read,
801 .read_sock_done = sk_psock_strp_read_done,
802 .parse_msg = sk_psock_strp_parse,
805 psock->parser.enabled = false;
806 return strp_init(&psock->parser.strp, sk, &cb);
809 void sk_psock_start_strp(struct sock *sk, struct sk_psock *psock)
811 struct sk_psock_parser *parser = &psock->parser;
816 parser->saved_data_ready = sk->sk_data_ready;
817 sk->sk_data_ready = sk_psock_strp_data_ready;
818 sk->sk_write_space = sk_psock_write_space;
819 parser->enabled = true;
822 void sk_psock_stop_strp(struct sock *sk, struct sk_psock *psock)
824 struct sk_psock_parser *parser = &psock->parser;
826 if (!parser->enabled)
829 sk->sk_data_ready = parser->saved_data_ready;
830 parser->saved_data_ready = NULL;
831 strp_stop(&parser->strp);
832 parser->enabled = false;