1 // SPDX-License-Identifier: GPL-2.0
2 /* Copyright (c) 2017 - 2018 Covalent IO, Inc. http://covalent.io */
4 #include <linux/skmsg.h>
5 #include <linux/skbuff.h>
6 #include <linux/scatterlist.h>
12 static bool sk_msg_try_coalesce_ok(struct sk_msg *msg, int elem_first_coalesce)
14 if (msg->sg.end > msg->sg.start &&
15 elem_first_coalesce < msg->sg.end)
18 if (msg->sg.end < msg->sg.start &&
19 (elem_first_coalesce > msg->sg.start ||
20 elem_first_coalesce < msg->sg.end))
26 int sk_msg_alloc(struct sock *sk, struct sk_msg *msg, int len,
27 int elem_first_coalesce)
29 struct page_frag *pfrag = sk_page_frag(sk);
34 struct scatterlist *sge;
38 if (!sk_page_frag_refill(sk, pfrag))
41 orig_offset = pfrag->offset;
42 use = min_t(int, len, pfrag->size - orig_offset);
43 if (!sk_wmem_schedule(sk, use))
47 sk_msg_iter_var_prev(i);
48 sge = &msg->sg.data[i];
50 if (sk_msg_try_coalesce_ok(msg, elem_first_coalesce) &&
51 sg_page(sge) == pfrag->page &&
52 sge->offset + sge->length == orig_offset) {
55 if (sk_msg_full(msg)) {
60 sge = &msg->sg.data[msg->sg.end];
62 sg_set_page(sge, pfrag->page, use, orig_offset);
63 get_page(pfrag->page);
64 sk_msg_iter_next(msg, end);
67 sk_mem_charge(sk, use);
75 EXPORT_SYMBOL_GPL(sk_msg_alloc);
77 int sk_msg_clone(struct sock *sk, struct sk_msg *dst, struct sk_msg *src,
80 int i = src->sg.start;
81 struct scatterlist *sge = sk_msg_elem(src, i);
82 struct scatterlist *sgd = NULL;
86 if (sge->length > off)
89 sk_msg_iter_var_next(i);
90 if (i == src->sg.end && off)
92 sge = sk_msg_elem(src, i);
96 sge_len = sge->length - off;
101 sgd = sk_msg_elem(dst, dst->sg.end - 1);
104 (sg_page(sge) == sg_page(sgd)) &&
105 (sg_virt(sge) + off == sg_virt(sgd) + sgd->length)) {
106 sgd->length += sge_len;
107 dst->sg.size += sge_len;
108 } else if (!sk_msg_full(dst)) {
109 sge_off = sge->offset + off;
110 sk_msg_page_add(dst, sg_page(sge), sge_len, sge_off);
117 sk_mem_charge(sk, sge_len);
118 sk_msg_iter_var_next(i);
119 if (i == src->sg.end && len)
121 sge = sk_msg_elem(src, i);
126 EXPORT_SYMBOL_GPL(sk_msg_clone);
128 void sk_msg_return_zero(struct sock *sk, struct sk_msg *msg, int bytes)
130 int i = msg->sg.start;
133 struct scatterlist *sge = sk_msg_elem(msg, i);
135 if (bytes < sge->length) {
136 sge->length -= bytes;
137 sge->offset += bytes;
138 sk_mem_uncharge(sk, bytes);
142 sk_mem_uncharge(sk, sge->length);
143 bytes -= sge->length;
146 sk_msg_iter_var_next(i);
147 } while (bytes && i != msg->sg.end);
150 EXPORT_SYMBOL_GPL(sk_msg_return_zero);
152 void sk_msg_return(struct sock *sk, struct sk_msg *msg, int bytes)
154 int i = msg->sg.start;
157 struct scatterlist *sge = &msg->sg.data[i];
158 int uncharge = (bytes < sge->length) ? bytes : sge->length;
160 sk_mem_uncharge(sk, uncharge);
162 sk_msg_iter_var_next(i);
163 } while (i != msg->sg.end);
165 EXPORT_SYMBOL_GPL(sk_msg_return);
167 static int sk_msg_free_elem(struct sock *sk, struct sk_msg *msg, u32 i,
170 struct scatterlist *sge = sk_msg_elem(msg, i);
171 u32 len = sge->length;
174 sk_mem_uncharge(sk, len);
176 put_page(sg_page(sge));
177 memset(sge, 0, sizeof(*sge));
181 static int __sk_msg_free(struct sock *sk, struct sk_msg *msg, u32 i,
184 struct scatterlist *sge = sk_msg_elem(msg, i);
187 while (msg->sg.size) {
188 msg->sg.size -= sge->length;
189 freed += sk_msg_free_elem(sk, msg, i, charge);
190 sk_msg_iter_var_next(i);
191 sk_msg_check_to_free(msg, i, msg->sg.size);
192 sge = sk_msg_elem(msg, i);
194 consume_skb(msg->skb);
199 int sk_msg_free_nocharge(struct sock *sk, struct sk_msg *msg)
201 return __sk_msg_free(sk, msg, msg->sg.start, false);
203 EXPORT_SYMBOL_GPL(sk_msg_free_nocharge);
205 int sk_msg_free(struct sock *sk, struct sk_msg *msg)
207 return __sk_msg_free(sk, msg, msg->sg.start, true);
209 EXPORT_SYMBOL_GPL(sk_msg_free);
211 static void __sk_msg_free_partial(struct sock *sk, struct sk_msg *msg,
212 u32 bytes, bool charge)
214 struct scatterlist *sge;
215 u32 i = msg->sg.start;
218 sge = sk_msg_elem(msg, i);
221 if (bytes < sge->length) {
223 sk_mem_uncharge(sk, bytes);
224 sge->length -= bytes;
225 sge->offset += bytes;
226 msg->sg.size -= bytes;
230 msg->sg.size -= sge->length;
231 bytes -= sge->length;
232 sk_msg_free_elem(sk, msg, i, charge);
233 sk_msg_iter_var_next(i);
234 sk_msg_check_to_free(msg, i, bytes);
239 void sk_msg_free_partial(struct sock *sk, struct sk_msg *msg, u32 bytes)
241 __sk_msg_free_partial(sk, msg, bytes, true);
243 EXPORT_SYMBOL_GPL(sk_msg_free_partial);
245 void sk_msg_free_partial_nocharge(struct sock *sk, struct sk_msg *msg,
248 __sk_msg_free_partial(sk, msg, bytes, false);
251 void sk_msg_trim(struct sock *sk, struct sk_msg *msg, int len)
253 int trim = msg->sg.size - len;
261 sk_msg_iter_var_prev(i);
263 while (msg->sg.data[i].length &&
264 trim >= msg->sg.data[i].length) {
265 trim -= msg->sg.data[i].length;
266 sk_msg_free_elem(sk, msg, i, true);
267 sk_msg_iter_var_prev(i);
272 msg->sg.data[i].length -= trim;
273 sk_mem_uncharge(sk, trim);
274 /* Adjust copybreak if it falls into the trimmed part of last buf */
275 if (msg->sg.curr == i && msg->sg.copybreak > msg->sg.data[i].length)
276 msg->sg.copybreak = msg->sg.data[i].length;
278 sk_msg_iter_var_next(i);
281 /* If we trim data a full sg elem before curr pointer update
282 * copybreak and current so that any future copy operations
283 * start at new copy location.
284 * However trimed data that has not yet been used in a copy op
285 * does not require an update.
288 msg->sg.curr = msg->sg.start;
289 msg->sg.copybreak = 0;
290 } else if (sk_msg_iter_dist(msg->sg.start, msg->sg.curr) >=
291 sk_msg_iter_dist(msg->sg.start, msg->sg.end)) {
292 sk_msg_iter_var_prev(i);
294 msg->sg.copybreak = msg->sg.data[i].length;
297 EXPORT_SYMBOL_GPL(sk_msg_trim);
299 int sk_msg_zerocopy_from_iter(struct sock *sk, struct iov_iter *from,
300 struct sk_msg *msg, u32 bytes)
302 int i, maxpages, ret = 0, num_elems = sk_msg_elem_used(msg);
303 const int to_max_pages = MAX_MSG_FRAGS;
304 struct page *pages[MAX_MSG_FRAGS];
305 ssize_t orig, copied, use, offset;
310 maxpages = to_max_pages - num_elems;
316 copied = iov_iter_get_pages(from, pages, bytes, maxpages,
323 iov_iter_advance(from, copied);
325 msg->sg.size += copied;
328 use = min_t(int, copied, PAGE_SIZE - offset);
329 sg_set_page(&msg->sg.data[msg->sg.end],
330 pages[i], use, offset);
331 sg_unmark_end(&msg->sg.data[msg->sg.end]);
332 sk_mem_charge(sk, use);
336 sk_msg_iter_next(msg, end);
340 /* When zerocopy is mixed with sk_msg_*copy* operations we
341 * may have a copybreak set in this case clear and prefer
342 * zerocopy remainder when possible.
344 msg->sg.copybreak = 0;
345 msg->sg.curr = msg->sg.end;
348 /* Revert iov_iter updates, msg will need to use 'trim' later if it
349 * also needs to be cleared.
352 iov_iter_revert(from, msg->sg.size - orig);
355 EXPORT_SYMBOL_GPL(sk_msg_zerocopy_from_iter);
357 int sk_msg_memcopy_from_iter(struct sock *sk, struct iov_iter *from,
358 struct sk_msg *msg, u32 bytes)
360 int ret = -ENOSPC, i = msg->sg.curr;
361 struct scatterlist *sge;
366 sge = sk_msg_elem(msg, i);
367 /* This is possible if a trim operation shrunk the buffer */
368 if (msg->sg.copybreak >= sge->length) {
369 msg->sg.copybreak = 0;
370 sk_msg_iter_var_next(i);
371 if (i == msg->sg.end)
373 sge = sk_msg_elem(msg, i);
376 buf_size = sge->length - msg->sg.copybreak;
377 copy = (buf_size > bytes) ? bytes : buf_size;
378 to = sg_virt(sge) + msg->sg.copybreak;
379 msg->sg.copybreak += copy;
380 if (sk->sk_route_caps & NETIF_F_NOCACHE_COPY)
381 ret = copy_from_iter_nocache(to, copy, from);
383 ret = copy_from_iter(to, copy, from);
391 msg->sg.copybreak = 0;
392 sk_msg_iter_var_next(i);
393 } while (i != msg->sg.end);
398 EXPORT_SYMBOL_GPL(sk_msg_memcopy_from_iter);
400 static int sk_psock_skb_ingress(struct sk_psock *psock, struct sk_buff *skb)
402 struct sock *sk = psock->sk;
403 int copied = 0, num_sge;
406 msg = kzalloc(sizeof(*msg), __GFP_NOWARN | GFP_ATOMIC);
409 if (!sk_rmem_schedule(sk, skb, skb->len)) {
415 num_sge = skb_to_sgvec(skb, msg->sg.data, 0, skb->len);
416 if (unlikely(num_sge < 0)) {
421 sk_mem_charge(sk, skb->len);
424 msg->sg.size = copied;
425 msg->sg.end = num_sge;
428 sk_psock_queue_msg(psock, msg);
429 sk_psock_data_ready(sk, psock);
433 static int sk_psock_handle_skb(struct sk_psock *psock, struct sk_buff *skb,
434 u32 off, u32 len, bool ingress)
437 if (!sock_writeable(psock->sk))
439 return skb_send_sock_locked(psock->sk, skb, off, len);
441 return sk_psock_skb_ingress(psock, skb);
444 static void sk_psock_backlog(struct work_struct *work)
446 struct sk_psock *psock = container_of(work, struct sk_psock, work);
447 struct sk_psock_work_state *state = &psock->work_state;
453 /* Lock sock to avoid losing sk_socket during loop. */
454 lock_sock(psock->sk);
463 while ((skb = skb_dequeue(&psock->ingress_skb))) {
467 ingress = tcp_skb_bpf_ingress(skb);
470 if (likely(psock->sk->sk_socket))
471 ret = sk_psock_handle_skb(psock, skb, off,
474 if (ret == -EAGAIN) {
480 /* Hard errors break pipe and stop xmit. */
481 sk_psock_report_error(psock, ret ? -ret : EPIPE);
482 sk_psock_clear_state(psock, SK_PSOCK_TX_ENABLED);
494 release_sock(psock->sk);
497 struct sk_psock *sk_psock_init(struct sock *sk, int node)
499 struct sk_psock *psock;
502 write_lock_bh(&sk->sk_callback_lock);
504 if (inet_csk_has_ulp(sk)) {
505 psock = ERR_PTR(-EINVAL);
509 if (sk->sk_user_data) {
510 psock = ERR_PTR(-EBUSY);
514 psock = kzalloc_node(sizeof(*psock), GFP_ATOMIC | __GFP_NOWARN, node);
516 psock = ERR_PTR(-ENOMEM);
520 prot = READ_ONCE(sk->sk_prot);
522 psock->eval = __SK_NONE;
523 psock->sk_proto = prot;
524 psock->saved_unhash = prot->unhash;
525 psock->saved_close = prot->close;
526 psock->saved_write_space = sk->sk_write_space;
528 INIT_LIST_HEAD(&psock->link);
529 spin_lock_init(&psock->link_lock);
531 INIT_WORK(&psock->work, sk_psock_backlog);
532 INIT_LIST_HEAD(&psock->ingress_msg);
533 skb_queue_head_init(&psock->ingress_skb);
535 sk_psock_set_state(psock, SK_PSOCK_TX_ENABLED);
536 refcount_set(&psock->refcnt, 1);
538 rcu_assign_sk_user_data_nocopy(sk, psock);
542 write_unlock_bh(&sk->sk_callback_lock);
545 EXPORT_SYMBOL_GPL(sk_psock_init);
547 struct sk_psock_link *sk_psock_link_pop(struct sk_psock *psock)
549 struct sk_psock_link *link;
551 spin_lock_bh(&psock->link_lock);
552 link = list_first_entry_or_null(&psock->link, struct sk_psock_link,
555 list_del(&link->list);
556 spin_unlock_bh(&psock->link_lock);
560 void __sk_psock_purge_ingress_msg(struct sk_psock *psock)
562 struct sk_msg *msg, *tmp;
564 list_for_each_entry_safe(msg, tmp, &psock->ingress_msg, list) {
565 list_del(&msg->list);
566 sk_msg_free(psock->sk, msg);
571 static void sk_psock_zap_ingress(struct sk_psock *psock)
573 __skb_queue_purge(&psock->ingress_skb);
574 __sk_psock_purge_ingress_msg(psock);
577 static void sk_psock_link_destroy(struct sk_psock *psock)
579 struct sk_psock_link *link, *tmp;
581 list_for_each_entry_safe(link, tmp, &psock->link, list) {
582 list_del(&link->list);
583 sk_psock_free_link(link);
587 static void sk_psock_destroy_deferred(struct work_struct *gc)
589 struct sk_psock *psock = container_of(gc, struct sk_psock, gc);
591 /* No sk_callback_lock since already detached. */
593 /* Parser has been stopped */
594 if (psock->progs.skb_parser)
595 strp_done(&psock->parser.strp);
597 cancel_work_sync(&psock->work);
599 psock_progs_drop(&psock->progs);
601 sk_psock_link_destroy(psock);
602 sk_psock_cork_free(psock);
603 sk_psock_zap_ingress(psock);
606 sock_put(psock->sk_redir);
611 void sk_psock_destroy(struct rcu_head *rcu)
613 struct sk_psock *psock = container_of(rcu, struct sk_psock, rcu);
615 INIT_WORK(&psock->gc, sk_psock_destroy_deferred);
616 schedule_work(&psock->gc);
618 EXPORT_SYMBOL_GPL(sk_psock_destroy);
620 void sk_psock_drop(struct sock *sk, struct sk_psock *psock)
622 sk_psock_cork_free(psock);
623 sk_psock_zap_ingress(psock);
625 write_lock_bh(&sk->sk_callback_lock);
626 sk_psock_restore_proto(sk, psock);
627 rcu_assign_sk_user_data(sk, NULL);
628 if (psock->progs.skb_parser)
629 sk_psock_stop_strp(sk, psock);
630 write_unlock_bh(&sk->sk_callback_lock);
631 sk_psock_clear_state(psock, SK_PSOCK_TX_ENABLED);
633 call_rcu(&psock->rcu, sk_psock_destroy);
635 EXPORT_SYMBOL_GPL(sk_psock_drop);
637 static int sk_psock_map_verd(int verdict, bool redir)
641 return redir ? __SK_REDIRECT : __SK_PASS;
650 int sk_psock_msg_verdict(struct sock *sk, struct sk_psock *psock,
653 struct bpf_prog *prog;
657 prog = READ_ONCE(psock->progs.msg_parser);
658 if (unlikely(!prog)) {
663 sk_msg_compute_data_pointers(msg);
665 ret = bpf_prog_run_pin_on_cpu(prog, msg);
666 ret = sk_psock_map_verd(ret, msg->sk_redir);
667 psock->apply_bytes = msg->apply_bytes;
668 if (ret == __SK_REDIRECT) {
670 sock_put(psock->sk_redir);
671 psock->sk_redir = msg->sk_redir;
672 if (!psock->sk_redir) {
676 sock_hold(psock->sk_redir);
682 EXPORT_SYMBOL_GPL(sk_psock_msg_verdict);
684 static int sk_psock_bpf_run(struct sk_psock *psock, struct bpf_prog *prog,
687 bpf_compute_data_end_sk_skb(skb);
688 return bpf_prog_run_pin_on_cpu(prog, skb);
691 static struct sk_psock *sk_psock_from_strp(struct strparser *strp)
693 struct sk_psock_parser *parser;
695 parser = container_of(strp, struct sk_psock_parser, strp);
696 return container_of(parser, struct sk_psock, parser);
699 static void sk_psock_skb_redirect(struct sk_buff *skb)
701 struct sk_psock *psock_other;
702 struct sock *sk_other;
704 sk_other = tcp_skb_bpf_redirect_fetch(skb);
705 /* This error is a buggy BPF program, it returned a redirect
706 * return code, but then didn't set a redirect interface.
708 if (unlikely(!sk_other)) {
712 psock_other = sk_psock(sk_other);
713 /* This error indicates the socket is being torn down or had another
714 * error that caused the pipe to break. We can't send a packet on
715 * a socket that is in this state so we drop the skb.
717 if (!psock_other || sock_flag(sk_other, SOCK_DEAD) ||
718 !sk_psock_test_state(psock_other, SK_PSOCK_TX_ENABLED)) {
723 skb_queue_tail(&psock_other->ingress_skb, skb);
724 schedule_work(&psock_other->work);
727 static void sk_psock_tls_verdict_apply(struct sk_buff *skb, struct sock *sk, int verdict)
731 skb_set_owner_r(skb, sk);
732 sk_psock_skb_redirect(skb);
741 int sk_psock_tls_strp_read(struct sk_psock *psock, struct sk_buff *skb)
743 struct bpf_prog *prog;
747 prog = READ_ONCE(psock->progs.skb_verdict);
749 /* We skip full set_owner_r here because if we do a SK_PASS
750 * or SK_DROP we can skip skb memory accounting and use the
754 tcp_skb_bpf_redirect_clear(skb);
755 ret = sk_psock_bpf_run(psock, prog, skb);
756 ret = sk_psock_map_verd(ret, tcp_skb_bpf_redirect_fetch(skb));
759 sk_psock_tls_verdict_apply(skb, psock->sk, ret);
763 EXPORT_SYMBOL_GPL(sk_psock_tls_strp_read);
765 static void sk_psock_verdict_apply(struct sk_psock *psock,
766 struct sk_buff *skb, int verdict)
768 struct tcp_skb_cb *tcp;
769 struct sock *sk_other;
774 sk_other = psock->sk;
775 if (sock_flag(sk_other, SOCK_DEAD) ||
776 !sk_psock_test_state(psock, SK_PSOCK_TX_ENABLED)) {
780 tcp = TCP_SKB_CB(skb);
781 tcp->bpf.flags |= BPF_F_INGRESS;
783 /* If the queue is empty then we can submit directly
784 * into the msg queue. If its not empty we have to
785 * queue work otherwise we may get OOO data. Otherwise,
786 * if sk_psock_skb_ingress errors will be handled by
787 * retrying later from workqueue.
789 if (skb_queue_empty(&psock->ingress_skb)) {
790 err = sk_psock_skb_ingress(psock, skb);
793 skb_queue_tail(&psock->ingress_skb, skb);
794 schedule_work(&psock->work);
798 sk_psock_skb_redirect(skb);
807 static void sk_psock_strp_read(struct strparser *strp, struct sk_buff *skb)
809 struct sk_psock *psock;
810 struct bpf_prog *prog;
816 psock = sk_psock(sk);
817 if (unlikely(!psock)) {
821 skb_set_owner_r(skb, sk);
822 prog = READ_ONCE(psock->progs.skb_verdict);
824 tcp_skb_bpf_redirect_clear(skb);
825 ret = sk_psock_bpf_run(psock, prog, skb);
826 ret = sk_psock_map_verd(ret, tcp_skb_bpf_redirect_fetch(skb));
828 sk_psock_verdict_apply(psock, skb, ret);
833 static int sk_psock_strp_read_done(struct strparser *strp, int err)
838 static int sk_psock_strp_parse(struct strparser *strp, struct sk_buff *skb)
840 struct sk_psock *psock = sk_psock_from_strp(strp);
841 struct bpf_prog *prog;
845 prog = READ_ONCE(psock->progs.skb_parser);
848 ret = sk_psock_bpf_run(psock, prog, skb);
855 /* Called with socket lock held. */
856 static void sk_psock_strp_data_ready(struct sock *sk)
858 struct sk_psock *psock;
861 psock = sk_psock(sk);
863 if (tls_sw_has_ctx_rx(sk)) {
864 psock->parser.saved_data_ready(sk);
866 write_lock_bh(&sk->sk_callback_lock);
867 strp_data_ready(&psock->parser.strp);
868 write_unlock_bh(&sk->sk_callback_lock);
874 static void sk_psock_write_space(struct sock *sk)
876 struct sk_psock *psock;
877 void (*write_space)(struct sock *sk) = NULL;
880 psock = sk_psock(sk);
882 if (sk_psock_test_state(psock, SK_PSOCK_TX_ENABLED))
883 schedule_work(&psock->work);
884 write_space = psock->saved_write_space;
891 int sk_psock_init_strp(struct sock *sk, struct sk_psock *psock)
893 static const struct strp_callbacks cb = {
894 .rcv_msg = sk_psock_strp_read,
895 .read_sock_done = sk_psock_strp_read_done,
896 .parse_msg = sk_psock_strp_parse,
899 psock->parser.enabled = false;
900 return strp_init(&psock->parser.strp, sk, &cb);
903 void sk_psock_start_strp(struct sock *sk, struct sk_psock *psock)
905 struct sk_psock_parser *parser = &psock->parser;
910 parser->saved_data_ready = sk->sk_data_ready;
911 sk->sk_data_ready = sk_psock_strp_data_ready;
912 sk->sk_write_space = sk_psock_write_space;
913 parser->enabled = true;
916 void sk_psock_stop_strp(struct sock *sk, struct sk_psock *psock)
918 struct sk_psock_parser *parser = &psock->parser;
920 if (!parser->enabled)
923 sk->sk_data_ready = parser->saved_data_ready;
924 parser->saved_data_ready = NULL;
925 strp_stop(&parser->strp);
926 parser->enabled = false;