vhost: fix possible out of bound access in vector filling
[dpdk.git] / lib / librte_vhost / virtio_net.c
1 /* SPDX-License-Identifier: BSD-3-Clause
2  * Copyright(c) 2010-2016 Intel Corporation
3  */
4
5 #include <stdint.h>
6 #include <stdbool.h>
7 #include <linux/virtio_net.h>
8
9 #include <rte_mbuf.h>
10 #include <rte_memcpy.h>
11 #include <rte_ether.h>
12 #include <rte_ip.h>
13 #include <rte_vhost.h>
14 #include <rte_tcp.h>
15 #include <rte_udp.h>
16 #include <rte_sctp.h>
17 #include <rte_arp.h>
18 #include <rte_spinlock.h>
19 #include <rte_malloc.h>
20
21 #include "iotlb.h"
22 #include "vhost.h"
23
24 #define MAX_PKT_BURST 32
25
26 #define MAX_BATCH_LEN 256
27
28 static  __rte_always_inline bool
29 rxvq_is_mergeable(struct virtio_net *dev)
30 {
31         return dev->features & (1ULL << VIRTIO_NET_F_MRG_RXBUF);
32 }
33
34 static bool
35 is_valid_virt_queue_idx(uint32_t idx, int is_tx, uint32_t nr_vring)
36 {
37         return (is_tx ^ (idx & 1)) == 0 && idx < nr_vring;
38 }
39
40 static __rte_always_inline void
41 do_flush_shadow_used_ring_split(struct virtio_net *dev,
42                         struct vhost_virtqueue *vq,
43                         uint16_t to, uint16_t from, uint16_t size)
44 {
45         rte_memcpy(&vq->used->ring[to],
46                         &vq->shadow_used_split[from],
47                         size * sizeof(struct vring_used_elem));
48         vhost_log_cache_used_vring(dev, vq,
49                         offsetof(struct vring_used, ring[to]),
50                         size * sizeof(struct vring_used_elem));
51 }
52
53 static __rte_always_inline void
54 flush_shadow_used_ring_split(struct virtio_net *dev, struct vhost_virtqueue *vq)
55 {
56         uint16_t used_idx = vq->last_used_idx & (vq->size - 1);
57
58         if (used_idx + vq->shadow_used_idx <= vq->size) {
59                 do_flush_shadow_used_ring_split(dev, vq, used_idx, 0,
60                                           vq->shadow_used_idx);
61         } else {
62                 uint16_t size;
63
64                 /* update used ring interval [used_idx, vq->size] */
65                 size = vq->size - used_idx;
66                 do_flush_shadow_used_ring_split(dev, vq, used_idx, 0, size);
67
68                 /* update the left half used ring interval [0, left_size] */
69                 do_flush_shadow_used_ring_split(dev, vq, 0, size,
70                                           vq->shadow_used_idx - size);
71         }
72         vq->last_used_idx += vq->shadow_used_idx;
73
74         rte_smp_wmb();
75
76         vhost_log_cache_sync(dev, vq);
77
78         *(volatile uint16_t *)&vq->used->idx += vq->shadow_used_idx;
79         vq->shadow_used_idx = 0;
80         vhost_log_used_vring(dev, vq, offsetof(struct vring_used, idx),
81                 sizeof(vq->used->idx));
82 }
83
84 static __rte_always_inline void
85 update_shadow_used_ring_split(struct vhost_virtqueue *vq,
86                          uint16_t desc_idx, uint32_t len)
87 {
88         uint16_t i = vq->shadow_used_idx++;
89
90         vq->shadow_used_split[i].id  = desc_idx;
91         vq->shadow_used_split[i].len = len;
92 }
93
94 static __rte_always_inline void
95 flush_shadow_used_ring_packed(struct virtio_net *dev,
96                         struct vhost_virtqueue *vq)
97 {
98         int i;
99         uint16_t used_idx = vq->last_used_idx;
100         uint16_t head_idx = vq->last_used_idx;
101         uint16_t head_flags = 0;
102
103         /* Split loop in two to save memory barriers */
104         for (i = 0; i < vq->shadow_used_idx; i++) {
105                 vq->desc_packed[used_idx].id = vq->shadow_used_packed[i].id;
106                 vq->desc_packed[used_idx].len = vq->shadow_used_packed[i].len;
107
108                 used_idx += vq->shadow_used_packed[i].count;
109                 if (used_idx >= vq->size)
110                         used_idx -= vq->size;
111         }
112
113         rte_smp_wmb();
114
115         for (i = 0; i < vq->shadow_used_idx; i++) {
116                 uint16_t flags;
117
118                 if (vq->shadow_used_packed[i].len)
119                         flags = VRING_DESC_F_WRITE;
120                 else
121                         flags = 0;
122
123                 if (vq->used_wrap_counter) {
124                         flags |= VRING_DESC_F_USED;
125                         flags |= VRING_DESC_F_AVAIL;
126                 } else {
127                         flags &= ~VRING_DESC_F_USED;
128                         flags &= ~VRING_DESC_F_AVAIL;
129                 }
130
131                 if (i > 0) {
132                         vq->desc_packed[vq->last_used_idx].flags = flags;
133
134                         vhost_log_cache_used_vring(dev, vq,
135                                         vq->last_used_idx *
136                                         sizeof(struct vring_packed_desc),
137                                         sizeof(struct vring_packed_desc));
138                 } else {
139                         head_idx = vq->last_used_idx;
140                         head_flags = flags;
141                 }
142
143                 vq->last_used_idx += vq->shadow_used_packed[i].count;
144                 if (vq->last_used_idx >= vq->size) {
145                         vq->used_wrap_counter ^= 1;
146                         vq->last_used_idx -= vq->size;
147                 }
148         }
149
150         vq->desc_packed[head_idx].flags = head_flags;
151
152         vhost_log_cache_used_vring(dev, vq,
153                                 head_idx *
154                                 sizeof(struct vring_packed_desc),
155                                 sizeof(struct vring_packed_desc));
156
157         vq->shadow_used_idx = 0;
158         vhost_log_cache_sync(dev, vq);
159 }
160
161 static __rte_always_inline void
162 update_shadow_used_ring_packed(struct vhost_virtqueue *vq,
163                          uint16_t desc_idx, uint32_t len, uint16_t count)
164 {
165         uint16_t i = vq->shadow_used_idx++;
166
167         vq->shadow_used_packed[i].id  = desc_idx;
168         vq->shadow_used_packed[i].len = len;
169         vq->shadow_used_packed[i].count = count;
170 }
171
172 static inline void
173 do_data_copy_enqueue(struct virtio_net *dev, struct vhost_virtqueue *vq)
174 {
175         struct batch_copy_elem *elem = vq->batch_copy_elems;
176         uint16_t count = vq->batch_copy_nb_elems;
177         int i;
178
179         for (i = 0; i < count; i++) {
180                 rte_memcpy(elem[i].dst, elem[i].src, elem[i].len);
181                 vhost_log_cache_write(dev, vq, elem[i].log_addr, elem[i].len);
182                 PRINT_PACKET(dev, (uintptr_t)elem[i].dst, elem[i].len, 0);
183         }
184
185         vq->batch_copy_nb_elems = 0;
186 }
187
188 static inline void
189 do_data_copy_dequeue(struct vhost_virtqueue *vq)
190 {
191         struct batch_copy_elem *elem = vq->batch_copy_elems;
192         uint16_t count = vq->batch_copy_nb_elems;
193         int i;
194
195         for (i = 0; i < count; i++)
196                 rte_memcpy(elem[i].dst, elem[i].src, elem[i].len);
197
198         vq->batch_copy_nb_elems = 0;
199 }
200
201 /* avoid write operation when necessary, to lessen cache issues */
202 #define ASSIGN_UNLESS_EQUAL(var, val) do {      \
203         if ((var) != (val))                     \
204                 (var) = (val);                  \
205 } while (0)
206
207 static __rte_always_inline void
208 virtio_enqueue_offload(struct rte_mbuf *m_buf, struct virtio_net_hdr *net_hdr)
209 {
210         uint64_t csum_l4 = m_buf->ol_flags & PKT_TX_L4_MASK;
211
212         if (m_buf->ol_flags & PKT_TX_TCP_SEG)
213                 csum_l4 |= PKT_TX_TCP_CKSUM;
214
215         if (csum_l4) {
216                 net_hdr->flags = VIRTIO_NET_HDR_F_NEEDS_CSUM;
217                 net_hdr->csum_start = m_buf->l2_len + m_buf->l3_len;
218
219                 switch (csum_l4) {
220                 case PKT_TX_TCP_CKSUM:
221                         net_hdr->csum_offset = (offsetof(struct tcp_hdr,
222                                                 cksum));
223                         break;
224                 case PKT_TX_UDP_CKSUM:
225                         net_hdr->csum_offset = (offsetof(struct udp_hdr,
226                                                 dgram_cksum));
227                         break;
228                 case PKT_TX_SCTP_CKSUM:
229                         net_hdr->csum_offset = (offsetof(struct sctp_hdr,
230                                                 cksum));
231                         break;
232                 }
233         } else {
234                 ASSIGN_UNLESS_EQUAL(net_hdr->csum_start, 0);
235                 ASSIGN_UNLESS_EQUAL(net_hdr->csum_offset, 0);
236                 ASSIGN_UNLESS_EQUAL(net_hdr->flags, 0);
237         }
238
239         /* IP cksum verification cannot be bypassed, then calculate here */
240         if (m_buf->ol_flags & PKT_TX_IP_CKSUM) {
241                 struct ipv4_hdr *ipv4_hdr;
242
243                 ipv4_hdr = rte_pktmbuf_mtod_offset(m_buf, struct ipv4_hdr *,
244                                                    m_buf->l2_len);
245                 ipv4_hdr->hdr_checksum = rte_ipv4_cksum(ipv4_hdr);
246         }
247
248         if (m_buf->ol_flags & PKT_TX_TCP_SEG) {
249                 if (m_buf->ol_flags & PKT_TX_IPV4)
250                         net_hdr->gso_type = VIRTIO_NET_HDR_GSO_TCPV4;
251                 else
252                         net_hdr->gso_type = VIRTIO_NET_HDR_GSO_TCPV6;
253                 net_hdr->gso_size = m_buf->tso_segsz;
254                 net_hdr->hdr_len = m_buf->l2_len + m_buf->l3_len
255                                         + m_buf->l4_len;
256         } else if (m_buf->ol_flags & PKT_TX_UDP_SEG) {
257                 net_hdr->gso_type = VIRTIO_NET_HDR_GSO_UDP;
258                 net_hdr->gso_size = m_buf->tso_segsz;
259                 net_hdr->hdr_len = m_buf->l2_len + m_buf->l3_len +
260                         m_buf->l4_len;
261         } else {
262                 ASSIGN_UNLESS_EQUAL(net_hdr->gso_type, 0);
263                 ASSIGN_UNLESS_EQUAL(net_hdr->gso_size, 0);
264                 ASSIGN_UNLESS_EQUAL(net_hdr->hdr_len, 0);
265         }
266 }
267
268 static __rte_always_inline int
269 map_one_desc(struct virtio_net *dev, struct vhost_virtqueue *vq,
270                 struct buf_vector *buf_vec, uint16_t *vec_idx,
271                 uint64_t desc_iova, uint64_t desc_len, uint8_t perm)
272 {
273         uint16_t vec_id = *vec_idx;
274
275         while (desc_len) {
276                 uint64_t desc_addr;
277                 uint64_t desc_chunck_len = desc_len;
278
279                 if (unlikely(vec_id >= BUF_VECTOR_MAX))
280                         return -1;
281
282                 desc_addr = vhost_iova_to_vva(dev, vq,
283                                 desc_iova,
284                                 &desc_chunck_len,
285                                 perm);
286                 if (unlikely(!desc_addr))
287                         return -1;
288
289                 buf_vec[vec_id].buf_iova = desc_iova;
290                 buf_vec[vec_id].buf_addr = desc_addr;
291                 buf_vec[vec_id].buf_len  = desc_chunck_len;
292
293                 desc_len -= desc_chunck_len;
294                 desc_iova += desc_chunck_len;
295                 vec_id++;
296         }
297         *vec_idx = vec_id;
298
299         return 0;
300 }
301
302 static __rte_always_inline int
303 fill_vec_buf_split(struct virtio_net *dev, struct vhost_virtqueue *vq,
304                          uint32_t avail_idx, uint16_t *vec_idx,
305                          struct buf_vector *buf_vec, uint16_t *desc_chain_head,
306                          uint32_t *desc_chain_len, uint8_t perm)
307 {
308         uint16_t idx = vq->avail->ring[avail_idx & (vq->size - 1)];
309         uint16_t vec_id = *vec_idx;
310         uint32_t len    = 0;
311         uint64_t dlen;
312         struct vring_desc *descs = vq->desc;
313         struct vring_desc *idesc = NULL;
314
315         if (unlikely(idx >= vq->size))
316                 return -1;
317
318         *desc_chain_head = idx;
319
320         if (vq->desc[idx].flags & VRING_DESC_F_INDIRECT) {
321                 dlen = vq->desc[idx].len;
322                 descs = (struct vring_desc *)(uintptr_t)
323                         vhost_iova_to_vva(dev, vq, vq->desc[idx].addr,
324                                                 &dlen,
325                                                 VHOST_ACCESS_RO);
326                 if (unlikely(!descs))
327                         return -1;
328
329                 if (unlikely(dlen < vq->desc[idx].len)) {
330                         /*
331                          * The indirect desc table is not contiguous
332                          * in process VA space, we have to copy it.
333                          */
334                         idesc = alloc_copy_ind_table(dev, vq,
335                                         vq->desc[idx].addr, vq->desc[idx].len);
336                         if (unlikely(!idesc))
337                                 return -1;
338
339                         descs = idesc;
340                 }
341
342                 idx = 0;
343         }
344
345         while (1) {
346                 if (unlikely(idx >= vq->size)) {
347                         free_ind_table(idesc);
348                         return -1;
349                 }
350
351                 len += descs[idx].len;
352
353                 if (unlikely(map_one_desc(dev, vq, buf_vec, &vec_id,
354                                                 descs[idx].addr, descs[idx].len,
355                                                 perm))) {
356                         free_ind_table(idesc);
357                         return -1;
358                 }
359
360                 if ((descs[idx].flags & VRING_DESC_F_NEXT) == 0)
361                         break;
362
363                 idx = descs[idx].next;
364         }
365
366         *desc_chain_len = len;
367         *vec_idx = vec_id;
368
369         if (unlikely(!!idesc))
370                 free_ind_table(idesc);
371
372         return 0;
373 }
374
375 /*
376  * Returns -1 on fail, 0 on success
377  */
378 static inline int
379 reserve_avail_buf_split(struct virtio_net *dev, struct vhost_virtqueue *vq,
380                                 uint32_t size, struct buf_vector *buf_vec,
381                                 uint16_t *num_buffers, uint16_t avail_head,
382                                 uint16_t *nr_vec)
383 {
384         uint16_t cur_idx;
385         uint16_t vec_idx = 0;
386         uint16_t max_tries, tries = 0;
387
388         uint16_t head_idx = 0;
389         uint32_t len = 0;
390
391         *num_buffers = 0;
392         cur_idx  = vq->last_avail_idx;
393
394         if (rxvq_is_mergeable(dev))
395                 max_tries = vq->size - 1;
396         else
397                 max_tries = 1;
398
399         while (size > 0) {
400                 if (unlikely(cur_idx == avail_head))
401                         return -1;
402                 /*
403                  * if we tried all available ring items, and still
404                  * can't get enough buf, it means something abnormal
405                  * happened.
406                  */
407                 if (unlikely(++tries > max_tries))
408                         return -1;
409
410                 if (unlikely(fill_vec_buf_split(dev, vq, cur_idx,
411                                                 &vec_idx, buf_vec,
412                                                 &head_idx, &len,
413                                                 VHOST_ACCESS_RW) < 0))
414                         return -1;
415                 len = RTE_MIN(len, size);
416                 update_shadow_used_ring_split(vq, head_idx, len);
417                 size -= len;
418
419                 cur_idx++;
420                 *num_buffers += 1;
421         }
422
423         *nr_vec = vec_idx;
424
425         return 0;
426 }
427
428 static __rte_always_inline int
429 fill_vec_buf_packed_indirect(struct virtio_net *dev,
430                         struct vhost_virtqueue *vq,
431                         struct vring_packed_desc *desc, uint16_t *vec_idx,
432                         struct buf_vector *buf_vec, uint32_t *len, uint8_t perm)
433 {
434         uint16_t i;
435         uint32_t nr_descs;
436         uint16_t vec_id = *vec_idx;
437         uint64_t dlen;
438         struct vring_packed_desc *descs, *idescs = NULL;
439
440         dlen = desc->len;
441         descs = (struct vring_packed_desc *)(uintptr_t)
442                 vhost_iova_to_vva(dev, vq, desc->addr, &dlen, VHOST_ACCESS_RO);
443         if (unlikely(!descs))
444                 return -1;
445
446         if (unlikely(dlen < desc->len)) {
447                 /*
448                  * The indirect desc table is not contiguous
449                  * in process VA space, we have to copy it.
450                  */
451                 idescs = alloc_copy_ind_table(dev, vq, desc->addr, desc->len);
452                 if (unlikely(!idescs))
453                         return -1;
454
455                 descs = idescs;
456         }
457
458         nr_descs =  desc->len / sizeof(struct vring_packed_desc);
459         if (unlikely(nr_descs >= vq->size)) {
460                 free_ind_table(idescs);
461                 return -1;
462         }
463
464         for (i = 0; i < nr_descs; i++) {
465                 if (unlikely(vec_id >= BUF_VECTOR_MAX)) {
466                         free_ind_table(idescs);
467                         return -1;
468                 }
469
470                 *len += descs[i].len;
471                 if (unlikely(map_one_desc(dev, vq, buf_vec, &vec_id,
472                                                 descs[i].addr, descs[i].len,
473                                                 perm)))
474                         return -1;
475         }
476         *vec_idx = vec_id;
477
478         if (unlikely(!!idescs))
479                 free_ind_table(idescs);
480
481         return 0;
482 }
483
484 static __rte_always_inline int
485 fill_vec_buf_packed(struct virtio_net *dev, struct vhost_virtqueue *vq,
486                                 uint16_t avail_idx, uint16_t *desc_count,
487                                 struct buf_vector *buf_vec, uint16_t *vec_idx,
488                                 uint16_t *buf_id, uint32_t *len, uint8_t perm)
489 {
490         bool wrap_counter = vq->avail_wrap_counter;
491         struct vring_packed_desc *descs = vq->desc_packed;
492         uint16_t vec_id = *vec_idx;
493
494         if (avail_idx < vq->last_avail_idx)
495                 wrap_counter ^= 1;
496
497         if (unlikely(!desc_is_avail(&descs[avail_idx], wrap_counter)))
498                 return -1;
499
500         /*
501          * The ordering between desc flags and desc
502          * content reads need to be enforced.
503          */
504         rte_smp_rmb();
505
506         *desc_count = 0;
507         *len = 0;
508
509         while (1) {
510                 if (unlikely(vec_id >= BUF_VECTOR_MAX))
511                         return -1;
512
513                 *desc_count += 1;
514                 *buf_id = descs[avail_idx].id;
515
516                 if (descs[avail_idx].flags & VRING_DESC_F_INDIRECT) {
517                         if (unlikely(fill_vec_buf_packed_indirect(dev, vq,
518                                                         &descs[avail_idx],
519                                                         &vec_id, buf_vec,
520                                                         len, perm) < 0))
521                                 return -1;
522                 } else {
523                         *len += descs[avail_idx].len;
524
525                         if (unlikely(map_one_desc(dev, vq, buf_vec, &vec_id,
526                                                         descs[avail_idx].addr,
527                                                         descs[avail_idx].len,
528                                                         perm)))
529                                 return -1;
530                 }
531
532                 if ((descs[avail_idx].flags & VRING_DESC_F_NEXT) == 0)
533                         break;
534
535                 if (++avail_idx >= vq->size) {
536                         avail_idx -= vq->size;
537                         wrap_counter ^= 1;
538                 }
539         }
540
541         *vec_idx = vec_id;
542
543         return 0;
544 }
545
546 /*
547  * Returns -1 on fail, 0 on success
548  */
549 static inline int
550 reserve_avail_buf_packed(struct virtio_net *dev, struct vhost_virtqueue *vq,
551                                 uint32_t size, struct buf_vector *buf_vec,
552                                 uint16_t *nr_vec, uint16_t *num_buffers,
553                                 uint16_t *nr_descs)
554 {
555         uint16_t avail_idx;
556         uint16_t vec_idx = 0;
557         uint16_t max_tries, tries = 0;
558
559         uint16_t buf_id = 0;
560         uint32_t len = 0;
561         uint16_t desc_count;
562
563         *num_buffers = 0;
564         avail_idx = vq->last_avail_idx;
565
566         if (rxvq_is_mergeable(dev))
567                 max_tries = vq->size - 1;
568         else
569                 max_tries = 1;
570
571         while (size > 0) {
572                 /*
573                  * if we tried all available ring items, and still
574                  * can't get enough buf, it means something abnormal
575                  * happened.
576                  */
577                 if (unlikely(++tries > max_tries))
578                         return -1;
579
580                 if (unlikely(fill_vec_buf_packed(dev, vq,
581                                                 avail_idx, &desc_count,
582                                                 buf_vec, &vec_idx,
583                                                 &buf_id, &len,
584                                                 VHOST_ACCESS_RW) < 0))
585                         return -1;
586
587                 len = RTE_MIN(len, size);
588                 update_shadow_used_ring_packed(vq, buf_id, len, desc_count);
589                 size -= len;
590
591                 avail_idx += desc_count;
592                 if (avail_idx >= vq->size)
593                         avail_idx -= vq->size;
594
595                 *nr_descs += desc_count;
596                 *num_buffers += 1;
597         }
598
599         *nr_vec = vec_idx;
600
601         return 0;
602 }
603
604 static __rte_always_inline int
605 copy_mbuf_to_desc(struct virtio_net *dev, struct vhost_virtqueue *vq,
606                             struct rte_mbuf *m, struct buf_vector *buf_vec,
607                             uint16_t nr_vec, uint16_t num_buffers)
608 {
609         uint32_t vec_idx = 0;
610         uint32_t mbuf_offset, mbuf_avail;
611         uint32_t buf_offset, buf_avail;
612         uint64_t buf_addr, buf_iova, buf_len;
613         uint32_t cpy_len;
614         uint64_t hdr_addr;
615         struct rte_mbuf *hdr_mbuf;
616         struct batch_copy_elem *batch_copy = vq->batch_copy_elems;
617         struct virtio_net_hdr_mrg_rxbuf tmp_hdr, *hdr = NULL;
618         int error = 0;
619
620         if (unlikely(m == NULL)) {
621                 error = -1;
622                 goto out;
623         }
624
625         buf_addr = buf_vec[vec_idx].buf_addr;
626         buf_iova = buf_vec[vec_idx].buf_iova;
627         buf_len = buf_vec[vec_idx].buf_len;
628
629         if (nr_vec > 1)
630                 rte_prefetch0((void *)(uintptr_t)buf_vec[1].buf_addr);
631
632         if (unlikely(buf_len < dev->vhost_hlen && nr_vec <= 1)) {
633                 error = -1;
634                 goto out;
635         }
636
637         hdr_mbuf = m;
638         hdr_addr = buf_addr;
639         if (unlikely(buf_len < dev->vhost_hlen))
640                 hdr = &tmp_hdr;
641         else
642                 hdr = (struct virtio_net_hdr_mrg_rxbuf *)(uintptr_t)hdr_addr;
643
644         VHOST_LOG_DEBUG(VHOST_DATA, "(%d) RX: num merge buffers %d\n",
645                 dev->vid, num_buffers);
646
647         if (unlikely(buf_len < dev->vhost_hlen)) {
648                 buf_offset = dev->vhost_hlen - buf_len;
649                 vec_idx++;
650                 buf_addr = buf_vec[vec_idx].buf_addr;
651                 buf_iova = buf_vec[vec_idx].buf_iova;
652                 buf_len = buf_vec[vec_idx].buf_len;
653                 buf_avail = buf_len - buf_offset;
654         } else {
655                 buf_offset = dev->vhost_hlen;
656                 buf_avail = buf_len - dev->vhost_hlen;
657         }
658
659         mbuf_avail  = rte_pktmbuf_data_len(m);
660         mbuf_offset = 0;
661         while (mbuf_avail != 0 || m->next != NULL) {
662                 /* done with current buf, get the next one */
663                 if (buf_avail == 0) {
664                         vec_idx++;
665                         if (unlikely(vec_idx >= nr_vec)) {
666                                 error = -1;
667                                 goto out;
668                         }
669
670                         buf_addr = buf_vec[vec_idx].buf_addr;
671                         buf_iova = buf_vec[vec_idx].buf_iova;
672                         buf_len = buf_vec[vec_idx].buf_len;
673
674                         /* Prefetch next buffer address. */
675                         if (vec_idx + 1 < nr_vec)
676                                 rte_prefetch0((void *)(uintptr_t)
677                                                 buf_vec[vec_idx + 1].buf_addr);
678                         buf_offset = 0;
679                         buf_avail  = buf_len;
680                 }
681
682                 /* done with current mbuf, get the next one */
683                 if (mbuf_avail == 0) {
684                         m = m->next;
685
686                         mbuf_offset = 0;
687                         mbuf_avail  = rte_pktmbuf_data_len(m);
688                 }
689
690                 if (hdr_addr) {
691                         virtio_enqueue_offload(hdr_mbuf, &hdr->hdr);
692                         if (rxvq_is_mergeable(dev))
693                                 ASSIGN_UNLESS_EQUAL(hdr->num_buffers,
694                                                 num_buffers);
695
696                         if (unlikely(hdr == &tmp_hdr)) {
697                                 uint64_t len;
698                                 uint64_t remain = dev->vhost_hlen;
699                                 uint64_t src = (uint64_t)(uintptr_t)hdr, dst;
700                                 uint64_t iova = buf_vec[0].buf_iova;
701                                 uint16_t hdr_vec_idx = 0;
702
703                                 while (remain) {
704                                         len = RTE_MIN(remain,
705                                                 buf_vec[hdr_vec_idx].buf_len);
706                                         dst = buf_vec[hdr_vec_idx].buf_addr;
707                                         rte_memcpy((void *)(uintptr_t)dst,
708                                                         (void *)(uintptr_t)src,
709                                                         len);
710
711                                         PRINT_PACKET(dev, (uintptr_t)dst,
712                                                         (uint32_t)len, 0);
713                                         vhost_log_cache_write(dev, vq,
714                                                         iova, len);
715
716                                         remain -= len;
717                                         iova += len;
718                                         src += len;
719                                         hdr_vec_idx++;
720                                 }
721                         } else {
722                                 PRINT_PACKET(dev, (uintptr_t)hdr_addr,
723                                                 dev->vhost_hlen, 0);
724                                 vhost_log_cache_write(dev, vq,
725                                                 buf_vec[0].buf_iova,
726                                                 dev->vhost_hlen);
727                         }
728
729                         hdr_addr = 0;
730                 }
731
732                 cpy_len = RTE_MIN(buf_avail, mbuf_avail);
733
734                 if (likely(cpy_len > MAX_BATCH_LEN ||
735                                         vq->batch_copy_nb_elems >= vq->size)) {
736                         rte_memcpy((void *)((uintptr_t)(buf_addr + buf_offset)),
737                                 rte_pktmbuf_mtod_offset(m, void *, mbuf_offset),
738                                 cpy_len);
739                         vhost_log_cache_write(dev, vq, buf_iova + buf_offset,
740                                         cpy_len);
741                         PRINT_PACKET(dev, (uintptr_t)(buf_addr + buf_offset),
742                                 cpy_len, 0);
743                 } else {
744                         batch_copy[vq->batch_copy_nb_elems].dst =
745                                 (void *)((uintptr_t)(buf_addr + buf_offset));
746                         batch_copy[vq->batch_copy_nb_elems].src =
747                                 rte_pktmbuf_mtod_offset(m, void *, mbuf_offset);
748                         batch_copy[vq->batch_copy_nb_elems].log_addr =
749                                 buf_iova + buf_offset;
750                         batch_copy[vq->batch_copy_nb_elems].len = cpy_len;
751                         vq->batch_copy_nb_elems++;
752                 }
753
754                 mbuf_avail  -= cpy_len;
755                 mbuf_offset += cpy_len;
756                 buf_avail  -= cpy_len;
757                 buf_offset += cpy_len;
758         }
759
760 out:
761
762         return error;
763 }
764
765 static __rte_always_inline uint32_t
766 virtio_dev_rx_split(struct virtio_net *dev, struct vhost_virtqueue *vq,
767         struct rte_mbuf **pkts, uint32_t count)
768 {
769         uint32_t pkt_idx = 0;
770         uint16_t num_buffers;
771         struct buf_vector buf_vec[BUF_VECTOR_MAX];
772         uint16_t avail_head;
773
774         avail_head = *((volatile uint16_t *)&vq->avail->idx);
775
776         /*
777          * The ordering between avail index and
778          * desc reads needs to be enforced.
779          */
780         rte_smp_rmb();
781
782         rte_prefetch0(&vq->avail->ring[vq->last_avail_idx & (vq->size - 1)]);
783
784         for (pkt_idx = 0; pkt_idx < count; pkt_idx++) {
785                 uint32_t pkt_len = pkts[pkt_idx]->pkt_len + dev->vhost_hlen;
786                 uint16_t nr_vec = 0;
787
788                 if (unlikely(reserve_avail_buf_split(dev, vq,
789                                                 pkt_len, buf_vec, &num_buffers,
790                                                 avail_head, &nr_vec) < 0)) {
791                         VHOST_LOG_DEBUG(VHOST_DATA,
792                                 "(%d) failed to get enough desc from vring\n",
793                                 dev->vid);
794                         vq->shadow_used_idx -= num_buffers;
795                         break;
796                 }
797
798                 rte_prefetch0((void *)(uintptr_t)buf_vec[0].buf_addr);
799
800                 VHOST_LOG_DEBUG(VHOST_DATA, "(%d) current index %d | end index %d\n",
801                         dev->vid, vq->last_avail_idx,
802                         vq->last_avail_idx + num_buffers);
803
804                 if (copy_mbuf_to_desc(dev, vq, pkts[pkt_idx],
805                                                 buf_vec, nr_vec,
806                                                 num_buffers) < 0) {
807                         vq->shadow_used_idx -= num_buffers;
808                         break;
809                 }
810
811                 vq->last_avail_idx += num_buffers;
812         }
813
814         do_data_copy_enqueue(dev, vq);
815
816         if (likely(vq->shadow_used_idx)) {
817                 flush_shadow_used_ring_split(dev, vq);
818                 vhost_vring_call_split(dev, vq);
819         }
820
821         return pkt_idx;
822 }
823
824 static __rte_always_inline uint32_t
825 virtio_dev_rx_packed(struct virtio_net *dev, struct vhost_virtqueue *vq,
826         struct rte_mbuf **pkts, uint32_t count)
827 {
828         uint32_t pkt_idx = 0;
829         uint16_t num_buffers;
830         struct buf_vector buf_vec[BUF_VECTOR_MAX];
831
832         for (pkt_idx = 0; pkt_idx < count; pkt_idx++) {
833                 uint32_t pkt_len = pkts[pkt_idx]->pkt_len + dev->vhost_hlen;
834                 uint16_t nr_vec = 0;
835                 uint16_t nr_descs = 0;
836
837                 if (unlikely(reserve_avail_buf_packed(dev, vq,
838                                                 pkt_len, buf_vec, &nr_vec,
839                                                 &num_buffers, &nr_descs) < 0)) {
840                         VHOST_LOG_DEBUG(VHOST_DATA,
841                                 "(%d) failed to get enough desc from vring\n",
842                                 dev->vid);
843                         vq->shadow_used_idx -= num_buffers;
844                         break;
845                 }
846
847                 rte_prefetch0((void *)(uintptr_t)buf_vec[0].buf_addr);
848
849                 VHOST_LOG_DEBUG(VHOST_DATA, "(%d) current index %d | end index %d\n",
850                         dev->vid, vq->last_avail_idx,
851                         vq->last_avail_idx + num_buffers);
852
853                 if (copy_mbuf_to_desc(dev, vq, pkts[pkt_idx],
854                                                 buf_vec, nr_vec,
855                                                 num_buffers) < 0) {
856                         vq->shadow_used_idx -= num_buffers;
857                         break;
858                 }
859
860                 vq->last_avail_idx += nr_descs;
861                 if (vq->last_avail_idx >= vq->size) {
862                         vq->last_avail_idx -= vq->size;
863                         vq->avail_wrap_counter ^= 1;
864                 }
865         }
866
867         do_data_copy_enqueue(dev, vq);
868
869         if (likely(vq->shadow_used_idx)) {
870                 flush_shadow_used_ring_packed(dev, vq);
871                 vhost_vring_call_packed(dev, vq);
872         }
873
874         return pkt_idx;
875 }
876
877 static __rte_always_inline uint32_t
878 virtio_dev_rx(struct virtio_net *dev, uint16_t queue_id,
879         struct rte_mbuf **pkts, uint32_t count)
880 {
881         struct vhost_virtqueue *vq;
882         uint32_t nb_tx = 0;
883
884         VHOST_LOG_DEBUG(VHOST_DATA, "(%d) %s\n", dev->vid, __func__);
885         if (unlikely(!is_valid_virt_queue_idx(queue_id, 0, dev->nr_vring))) {
886                 RTE_LOG(ERR, VHOST_DATA, "(%d) %s: invalid virtqueue idx %d.\n",
887                         dev->vid, __func__, queue_id);
888                 return 0;
889         }
890
891         vq = dev->virtqueue[queue_id];
892
893         rte_spinlock_lock(&vq->access_lock);
894
895         if (unlikely(vq->enabled == 0))
896                 goto out_access_unlock;
897
898         if (dev->features & (1ULL << VIRTIO_F_IOMMU_PLATFORM))
899                 vhost_user_iotlb_rd_lock(vq);
900
901         if (unlikely(vq->access_ok == 0))
902                 if (unlikely(vring_translate(dev, vq) < 0))
903                         goto out;
904
905         count = RTE_MIN((uint32_t)MAX_PKT_BURST, count);
906         if (count == 0)
907                 goto out;
908
909         if (vq_is_packed(dev))
910                 nb_tx = virtio_dev_rx_packed(dev, vq, pkts, count);
911         else
912                 nb_tx = virtio_dev_rx_split(dev, vq, pkts, count);
913
914 out:
915         if (dev->features & (1ULL << VIRTIO_F_IOMMU_PLATFORM))
916                 vhost_user_iotlb_rd_unlock(vq);
917
918 out_access_unlock:
919         rte_spinlock_unlock(&vq->access_lock);
920
921         return nb_tx;
922 }
923
924 uint16_t
925 rte_vhost_enqueue_burst(int vid, uint16_t queue_id,
926         struct rte_mbuf **pkts, uint16_t count)
927 {
928         struct virtio_net *dev = get_device(vid);
929
930         if (!dev)
931                 return 0;
932
933         if (unlikely(!(dev->flags & VIRTIO_DEV_BUILTIN_VIRTIO_NET))) {
934                 RTE_LOG(ERR, VHOST_DATA,
935                         "(%d) %s: built-in vhost net backend is disabled.\n",
936                         dev->vid, __func__);
937                 return 0;
938         }
939
940         return virtio_dev_rx(dev, queue_id, pkts, count);
941 }
942
943 static inline bool
944 virtio_net_with_host_offload(struct virtio_net *dev)
945 {
946         if (dev->features &
947                         ((1ULL << VIRTIO_NET_F_CSUM) |
948                          (1ULL << VIRTIO_NET_F_HOST_ECN) |
949                          (1ULL << VIRTIO_NET_F_HOST_TSO4) |
950                          (1ULL << VIRTIO_NET_F_HOST_TSO6) |
951                          (1ULL << VIRTIO_NET_F_HOST_UFO)))
952                 return true;
953
954         return false;
955 }
956
957 static void
958 parse_ethernet(struct rte_mbuf *m, uint16_t *l4_proto, void **l4_hdr)
959 {
960         struct ipv4_hdr *ipv4_hdr;
961         struct ipv6_hdr *ipv6_hdr;
962         void *l3_hdr = NULL;
963         struct ether_hdr *eth_hdr;
964         uint16_t ethertype;
965
966         eth_hdr = rte_pktmbuf_mtod(m, struct ether_hdr *);
967
968         m->l2_len = sizeof(struct ether_hdr);
969         ethertype = rte_be_to_cpu_16(eth_hdr->ether_type);
970
971         if (ethertype == ETHER_TYPE_VLAN) {
972                 struct vlan_hdr *vlan_hdr = (struct vlan_hdr *)(eth_hdr + 1);
973
974                 m->l2_len += sizeof(struct vlan_hdr);
975                 ethertype = rte_be_to_cpu_16(vlan_hdr->eth_proto);
976         }
977
978         l3_hdr = (char *)eth_hdr + m->l2_len;
979
980         switch (ethertype) {
981         case ETHER_TYPE_IPv4:
982                 ipv4_hdr = l3_hdr;
983                 *l4_proto = ipv4_hdr->next_proto_id;
984                 m->l3_len = (ipv4_hdr->version_ihl & 0x0f) * 4;
985                 *l4_hdr = (char *)l3_hdr + m->l3_len;
986                 m->ol_flags |= PKT_TX_IPV4;
987                 break;
988         case ETHER_TYPE_IPv6:
989                 ipv6_hdr = l3_hdr;
990                 *l4_proto = ipv6_hdr->proto;
991                 m->l3_len = sizeof(struct ipv6_hdr);
992                 *l4_hdr = (char *)l3_hdr + m->l3_len;
993                 m->ol_flags |= PKT_TX_IPV6;
994                 break;
995         default:
996                 m->l3_len = 0;
997                 *l4_proto = 0;
998                 *l4_hdr = NULL;
999                 break;
1000         }
1001 }
1002
1003 static __rte_always_inline void
1004 vhost_dequeue_offload(struct virtio_net_hdr *hdr, struct rte_mbuf *m)
1005 {
1006         uint16_t l4_proto = 0;
1007         void *l4_hdr = NULL;
1008         struct tcp_hdr *tcp_hdr = NULL;
1009
1010         if (hdr->flags == 0 && hdr->gso_type == VIRTIO_NET_HDR_GSO_NONE)
1011                 return;
1012
1013         parse_ethernet(m, &l4_proto, &l4_hdr);
1014         if (hdr->flags == VIRTIO_NET_HDR_F_NEEDS_CSUM) {
1015                 if (hdr->csum_start == (m->l2_len + m->l3_len)) {
1016                         switch (hdr->csum_offset) {
1017                         case (offsetof(struct tcp_hdr, cksum)):
1018                                 if (l4_proto == IPPROTO_TCP)
1019                                         m->ol_flags |= PKT_TX_TCP_CKSUM;
1020                                 break;
1021                         case (offsetof(struct udp_hdr, dgram_cksum)):
1022                                 if (l4_proto == IPPROTO_UDP)
1023                                         m->ol_flags |= PKT_TX_UDP_CKSUM;
1024                                 break;
1025                         case (offsetof(struct sctp_hdr, cksum)):
1026                                 if (l4_proto == IPPROTO_SCTP)
1027                                         m->ol_flags |= PKT_TX_SCTP_CKSUM;
1028                                 break;
1029                         default:
1030                                 break;
1031                         }
1032                 }
1033         }
1034
1035         if (l4_hdr && hdr->gso_type != VIRTIO_NET_HDR_GSO_NONE) {
1036                 switch (hdr->gso_type & ~VIRTIO_NET_HDR_GSO_ECN) {
1037                 case VIRTIO_NET_HDR_GSO_TCPV4:
1038                 case VIRTIO_NET_HDR_GSO_TCPV6:
1039                         tcp_hdr = l4_hdr;
1040                         m->ol_flags |= PKT_TX_TCP_SEG;
1041                         m->tso_segsz = hdr->gso_size;
1042                         m->l4_len = (tcp_hdr->data_off & 0xf0) >> 2;
1043                         break;
1044                 case VIRTIO_NET_HDR_GSO_UDP:
1045                         m->ol_flags |= PKT_TX_UDP_SEG;
1046                         m->tso_segsz = hdr->gso_size;
1047                         m->l4_len = sizeof(struct udp_hdr);
1048                         break;
1049                 default:
1050                         RTE_LOG(WARNING, VHOST_DATA,
1051                                 "unsupported gso type %u.\n", hdr->gso_type);
1052                         break;
1053                 }
1054         }
1055 }
1056
1057 static __rte_always_inline void
1058 put_zmbuf(struct zcopy_mbuf *zmbuf)
1059 {
1060         zmbuf->in_use = 0;
1061 }
1062
1063 static __rte_always_inline int
1064 copy_desc_to_mbuf(struct virtio_net *dev, struct vhost_virtqueue *vq,
1065                   struct buf_vector *buf_vec, uint16_t nr_vec,
1066                   struct rte_mbuf *m, struct rte_mempool *mbuf_pool)
1067 {
1068         uint32_t buf_avail, buf_offset;
1069         uint64_t buf_addr, buf_iova, buf_len;
1070         uint32_t mbuf_avail, mbuf_offset;
1071         uint32_t cpy_len;
1072         struct rte_mbuf *cur = m, *prev = m;
1073         struct virtio_net_hdr tmp_hdr;
1074         struct virtio_net_hdr *hdr = NULL;
1075         /* A counter to avoid desc dead loop chain */
1076         uint16_t vec_idx = 0;
1077         struct batch_copy_elem *batch_copy = vq->batch_copy_elems;
1078         int error = 0;
1079
1080         buf_addr = buf_vec[vec_idx].buf_addr;
1081         buf_iova = buf_vec[vec_idx].buf_iova;
1082         buf_len = buf_vec[vec_idx].buf_len;
1083
1084         if (unlikely(buf_len < dev->vhost_hlen && nr_vec <= 1)) {
1085                 error = -1;
1086                 goto out;
1087         }
1088
1089         if (likely(nr_vec > 1))
1090                 rte_prefetch0((void *)(uintptr_t)buf_vec[1].buf_addr);
1091
1092         if (virtio_net_with_host_offload(dev)) {
1093                 if (unlikely(buf_len < sizeof(struct virtio_net_hdr))) {
1094                         uint64_t len;
1095                         uint64_t remain = sizeof(struct virtio_net_hdr);
1096                         uint64_t src;
1097                         uint64_t dst = (uint64_t)(uintptr_t)&tmp_hdr;
1098                         uint16_t hdr_vec_idx = 0;
1099
1100                         /*
1101                          * No luck, the virtio-net header doesn't fit
1102                          * in a contiguous virtual area.
1103                          */
1104                         while (remain) {
1105                                 len = RTE_MIN(remain,
1106                                         buf_vec[hdr_vec_idx].buf_len);
1107                                 src = buf_vec[hdr_vec_idx].buf_addr;
1108                                 rte_memcpy((void *)(uintptr_t)dst,
1109                                                    (void *)(uintptr_t)src, len);
1110
1111                                 remain -= len;
1112                                 dst += len;
1113                                 hdr_vec_idx++;
1114                         }
1115
1116                         hdr = &tmp_hdr;
1117                 } else {
1118                         hdr = (struct virtio_net_hdr *)((uintptr_t)buf_addr);
1119                         rte_prefetch0(hdr);
1120                 }
1121         }
1122
1123         /*
1124          * A virtio driver normally uses at least 2 desc buffers
1125          * for Tx: the first for storing the header, and others
1126          * for storing the data.
1127          */
1128         if (unlikely(buf_len < dev->vhost_hlen)) {
1129                 buf_offset = dev->vhost_hlen - buf_len;
1130                 vec_idx++;
1131                 buf_addr = buf_vec[vec_idx].buf_addr;
1132                 buf_iova = buf_vec[vec_idx].buf_iova;
1133                 buf_len = buf_vec[vec_idx].buf_len;
1134                 buf_avail  = buf_len - buf_offset;
1135         } else if (buf_len == dev->vhost_hlen) {
1136                 if (unlikely(++vec_idx >= nr_vec))
1137                         goto out;
1138                 buf_addr = buf_vec[vec_idx].buf_addr;
1139                 buf_iova = buf_vec[vec_idx].buf_iova;
1140                 buf_len = buf_vec[vec_idx].buf_len;
1141
1142                 buf_offset = 0;
1143                 buf_avail = buf_len;
1144         } else {
1145                 buf_offset = dev->vhost_hlen;
1146                 buf_avail = buf_vec[vec_idx].buf_len - dev->vhost_hlen;
1147         }
1148
1149         rte_prefetch0((void *)(uintptr_t)
1150                         (buf_addr + buf_offset));
1151
1152         PRINT_PACKET(dev,
1153                         (uintptr_t)(buf_addr + buf_offset),
1154                         (uint32_t)buf_avail, 0);
1155
1156         mbuf_offset = 0;
1157         mbuf_avail  = m->buf_len - RTE_PKTMBUF_HEADROOM;
1158         while (1) {
1159                 uint64_t hpa;
1160
1161                 cpy_len = RTE_MIN(buf_avail, mbuf_avail);
1162
1163                 /*
1164                  * A desc buf might across two host physical pages that are
1165                  * not continuous. In such case (gpa_to_hpa returns 0), data
1166                  * will be copied even though zero copy is enabled.
1167                  */
1168                 if (unlikely(dev->dequeue_zero_copy && (hpa = gpa_to_hpa(dev,
1169                                         buf_iova + buf_offset, cpy_len)))) {
1170                         cur->data_len = cpy_len;
1171                         cur->data_off = 0;
1172                         cur->buf_addr =
1173                                 (void *)(uintptr_t)(buf_addr + buf_offset);
1174                         cur->buf_iova = hpa;
1175
1176                         /*
1177                          * In zero copy mode, one mbuf can only reference data
1178                          * for one or partial of one desc buff.
1179                          */
1180                         mbuf_avail = cpy_len;
1181                 } else {
1182                         if (likely(cpy_len > MAX_BATCH_LEN ||
1183                                    vq->batch_copy_nb_elems >= vq->size ||
1184                                    (hdr && cur == m))) {
1185                                 rte_memcpy(rte_pktmbuf_mtod_offset(cur, void *,
1186                                                                    mbuf_offset),
1187                                            (void *)((uintptr_t)(buf_addr +
1188                                                            buf_offset)),
1189                                            cpy_len);
1190                         } else {
1191                                 batch_copy[vq->batch_copy_nb_elems].dst =
1192                                         rte_pktmbuf_mtod_offset(cur, void *,
1193                                                                 mbuf_offset);
1194                                 batch_copy[vq->batch_copy_nb_elems].src =
1195                                         (void *)((uintptr_t)(buf_addr +
1196                                                                 buf_offset));
1197                                 batch_copy[vq->batch_copy_nb_elems].len =
1198                                         cpy_len;
1199                                 vq->batch_copy_nb_elems++;
1200                         }
1201                 }
1202
1203                 mbuf_avail  -= cpy_len;
1204                 mbuf_offset += cpy_len;
1205                 buf_avail -= cpy_len;
1206                 buf_offset += cpy_len;
1207
1208                 /* This buf reaches to its end, get the next one */
1209                 if (buf_avail == 0) {
1210                         if (++vec_idx >= nr_vec)
1211                                 break;
1212
1213                         buf_addr = buf_vec[vec_idx].buf_addr;
1214                         buf_iova = buf_vec[vec_idx].buf_iova;
1215                         buf_len = buf_vec[vec_idx].buf_len;
1216
1217                         /*
1218                          * Prefecth desc n + 1 buffer while
1219                          * desc n buffer is processed.
1220                          */
1221                         if (vec_idx + 1 < nr_vec)
1222                                 rte_prefetch0((void *)(uintptr_t)
1223                                                 buf_vec[vec_idx + 1].buf_addr);
1224
1225                         buf_offset = 0;
1226                         buf_avail  = buf_len;
1227
1228                         PRINT_PACKET(dev, (uintptr_t)buf_addr,
1229                                         (uint32_t)buf_avail, 0);
1230                 }
1231
1232                 /*
1233                  * This mbuf reaches to its end, get a new one
1234                  * to hold more data.
1235                  */
1236                 if (mbuf_avail == 0) {
1237                         cur = rte_pktmbuf_alloc(mbuf_pool);
1238                         if (unlikely(cur == NULL)) {
1239                                 RTE_LOG(ERR, VHOST_DATA, "Failed to "
1240                                         "allocate memory for mbuf.\n");
1241                                 error = -1;
1242                                 goto out;
1243                         }
1244                         if (unlikely(dev->dequeue_zero_copy))
1245                                 rte_mbuf_refcnt_update(cur, 1);
1246
1247                         prev->next = cur;
1248                         prev->data_len = mbuf_offset;
1249                         m->nb_segs += 1;
1250                         m->pkt_len += mbuf_offset;
1251                         prev = cur;
1252
1253                         mbuf_offset = 0;
1254                         mbuf_avail  = cur->buf_len - RTE_PKTMBUF_HEADROOM;
1255                 }
1256         }
1257
1258         prev->data_len = mbuf_offset;
1259         m->pkt_len    += mbuf_offset;
1260
1261         if (hdr)
1262                 vhost_dequeue_offload(hdr, m);
1263
1264 out:
1265
1266         return error;
1267 }
1268
1269 static __rte_always_inline struct zcopy_mbuf *
1270 get_zmbuf(struct vhost_virtqueue *vq)
1271 {
1272         uint16_t i;
1273         uint16_t last;
1274         int tries = 0;
1275
1276         /* search [last_zmbuf_idx, zmbuf_size) */
1277         i = vq->last_zmbuf_idx;
1278         last = vq->zmbuf_size;
1279
1280 again:
1281         for (; i < last; i++) {
1282                 if (vq->zmbufs[i].in_use == 0) {
1283                         vq->last_zmbuf_idx = i + 1;
1284                         vq->zmbufs[i].in_use = 1;
1285                         return &vq->zmbufs[i];
1286                 }
1287         }
1288
1289         tries++;
1290         if (tries == 1) {
1291                 /* search [0, last_zmbuf_idx) */
1292                 i = 0;
1293                 last = vq->last_zmbuf_idx;
1294                 goto again;
1295         }
1296
1297         return NULL;
1298 }
1299
1300 static __rte_always_inline bool
1301 mbuf_is_consumed(struct rte_mbuf *m)
1302 {
1303         while (m) {
1304                 if (rte_mbuf_refcnt_read(m) > 1)
1305                         return false;
1306                 m = m->next;
1307         }
1308
1309         return true;
1310 }
1311
1312 static __rte_always_inline void
1313 restore_mbuf(struct rte_mbuf *m)
1314 {
1315         uint32_t mbuf_size, priv_size;
1316
1317         while (m) {
1318                 priv_size = rte_pktmbuf_priv_size(m->pool);
1319                 mbuf_size = sizeof(struct rte_mbuf) + priv_size;
1320                 /* start of buffer is after mbuf structure and priv data */
1321
1322                 m->buf_addr = (char *)m + mbuf_size;
1323                 m->buf_iova = rte_mempool_virt2iova(m) + mbuf_size;
1324                 m = m->next;
1325         }
1326 }
1327
1328 static __rte_always_inline uint16_t
1329 virtio_dev_tx_split(struct virtio_net *dev, struct vhost_virtqueue *vq,
1330         struct rte_mempool *mbuf_pool, struct rte_mbuf **pkts, uint16_t count)
1331 {
1332         uint16_t i;
1333         uint16_t free_entries;
1334
1335         if (unlikely(dev->dequeue_zero_copy)) {
1336                 struct zcopy_mbuf *zmbuf, *next;
1337
1338                 for (zmbuf = TAILQ_FIRST(&vq->zmbuf_list);
1339                      zmbuf != NULL; zmbuf = next) {
1340                         next = TAILQ_NEXT(zmbuf, next);
1341
1342                         if (mbuf_is_consumed(zmbuf->mbuf)) {
1343                                 update_shadow_used_ring_split(vq,
1344                                                 zmbuf->desc_idx, 0);
1345                                 TAILQ_REMOVE(&vq->zmbuf_list, zmbuf, next);
1346                                 restore_mbuf(zmbuf->mbuf);
1347                                 rte_pktmbuf_free(zmbuf->mbuf);
1348                                 put_zmbuf(zmbuf);
1349                                 vq->nr_zmbuf -= 1;
1350                         }
1351                 }
1352
1353                 if (likely(vq->shadow_used_idx)) {
1354                         flush_shadow_used_ring_split(dev, vq);
1355                         vhost_vring_call_split(dev, vq);
1356                 }
1357         }
1358
1359         free_entries = *((volatile uint16_t *)&vq->avail->idx) -
1360                         vq->last_avail_idx;
1361         if (free_entries == 0)
1362                 return 0;
1363
1364         /*
1365          * The ordering between avail index and
1366          * desc reads needs to be enforced.
1367          */
1368         rte_smp_rmb();
1369
1370         rte_prefetch0(&vq->avail->ring[vq->last_avail_idx & (vq->size - 1)]);
1371
1372         VHOST_LOG_DEBUG(VHOST_DATA, "(%d) %s\n", dev->vid, __func__);
1373
1374         count = RTE_MIN(count, MAX_PKT_BURST);
1375         count = RTE_MIN(count, free_entries);
1376         VHOST_LOG_DEBUG(VHOST_DATA, "(%d) about to dequeue %u buffers\n",
1377                         dev->vid, count);
1378
1379         for (i = 0; i < count; i++) {
1380                 struct buf_vector buf_vec[BUF_VECTOR_MAX];
1381                 uint16_t head_idx;
1382                 uint32_t dummy_len;
1383                 uint16_t nr_vec = 0;
1384                 int err;
1385
1386                 if (unlikely(fill_vec_buf_split(dev, vq,
1387                                                 vq->last_avail_idx + i,
1388                                                 &nr_vec, buf_vec,
1389                                                 &head_idx, &dummy_len,
1390                                                 VHOST_ACCESS_RO) < 0))
1391                         break;
1392
1393                 if (likely(dev->dequeue_zero_copy == 0))
1394                         update_shadow_used_ring_split(vq, head_idx, 0);
1395
1396                 rte_prefetch0((void *)(uintptr_t)buf_vec[0].buf_addr);
1397
1398                 pkts[i] = rte_pktmbuf_alloc(mbuf_pool);
1399                 if (unlikely(pkts[i] == NULL)) {
1400                         RTE_LOG(ERR, VHOST_DATA,
1401                                 "Failed to allocate memory for mbuf.\n");
1402                         break;
1403                 }
1404
1405                 err = copy_desc_to_mbuf(dev, vq, buf_vec, nr_vec, pkts[i],
1406                                 mbuf_pool);
1407                 if (unlikely(err)) {
1408                         rte_pktmbuf_free(pkts[i]);
1409                         break;
1410                 }
1411
1412                 if (unlikely(dev->dequeue_zero_copy)) {
1413                         struct zcopy_mbuf *zmbuf;
1414
1415                         zmbuf = get_zmbuf(vq);
1416                         if (!zmbuf) {
1417                                 rte_pktmbuf_free(pkts[i]);
1418                                 break;
1419                         }
1420                         zmbuf->mbuf = pkts[i];
1421                         zmbuf->desc_idx = head_idx;
1422
1423                         /*
1424                          * Pin lock the mbuf; we will check later to see
1425                          * whether the mbuf is freed (when we are the last
1426                          * user) or not. If that's the case, we then could
1427                          * update the used ring safely.
1428                          */
1429                         rte_mbuf_refcnt_update(pkts[i], 1);
1430
1431                         vq->nr_zmbuf += 1;
1432                         TAILQ_INSERT_TAIL(&vq->zmbuf_list, zmbuf, next);
1433                 }
1434         }
1435         vq->last_avail_idx += i;
1436
1437         if (likely(dev->dequeue_zero_copy == 0)) {
1438                 do_data_copy_dequeue(vq);
1439                 if (unlikely(i < count))
1440                         vq->shadow_used_idx = i;
1441                 if (likely(vq->shadow_used_idx)) {
1442                         flush_shadow_used_ring_split(dev, vq);
1443                         vhost_vring_call_split(dev, vq);
1444                 }
1445         }
1446
1447         return i;
1448 }
1449
1450 static __rte_always_inline uint16_t
1451 virtio_dev_tx_packed(struct virtio_net *dev, struct vhost_virtqueue *vq,
1452         struct rte_mempool *mbuf_pool, struct rte_mbuf **pkts, uint16_t count)
1453 {
1454         uint16_t i;
1455
1456         if (unlikely(dev->dequeue_zero_copy)) {
1457                 struct zcopy_mbuf *zmbuf, *next;
1458
1459                 for (zmbuf = TAILQ_FIRST(&vq->zmbuf_list);
1460                      zmbuf != NULL; zmbuf = next) {
1461                         next = TAILQ_NEXT(zmbuf, next);
1462
1463                         if (mbuf_is_consumed(zmbuf->mbuf)) {
1464                                 update_shadow_used_ring_packed(vq,
1465                                                 zmbuf->desc_idx,
1466                                                 0,
1467                                                 zmbuf->desc_count);
1468
1469                                 TAILQ_REMOVE(&vq->zmbuf_list, zmbuf, next);
1470                                 restore_mbuf(zmbuf->mbuf);
1471                                 rte_pktmbuf_free(zmbuf->mbuf);
1472                                 put_zmbuf(zmbuf);
1473                                 vq->nr_zmbuf -= 1;
1474                         }
1475                 }
1476
1477                 if (likely(vq->shadow_used_idx)) {
1478                         flush_shadow_used_ring_packed(dev, vq);
1479                         vhost_vring_call_packed(dev, vq);
1480                 }
1481         }
1482
1483         VHOST_LOG_DEBUG(VHOST_DATA, "(%d) %s\n", dev->vid, __func__);
1484
1485         count = RTE_MIN(count, MAX_PKT_BURST);
1486         VHOST_LOG_DEBUG(VHOST_DATA, "(%d) about to dequeue %u buffers\n",
1487                         dev->vid, count);
1488
1489         for (i = 0; i < count; i++) {
1490                 struct buf_vector buf_vec[BUF_VECTOR_MAX];
1491                 uint16_t buf_id;
1492                 uint32_t dummy_len;
1493                 uint16_t desc_count, nr_vec = 0;
1494                 int err;
1495
1496                 if (unlikely(fill_vec_buf_packed(dev, vq,
1497                                                 vq->last_avail_idx, &desc_count,
1498                                                 buf_vec, &nr_vec,
1499                                                 &buf_id, &dummy_len,
1500                                                 VHOST_ACCESS_RO) < 0))
1501                         break;
1502
1503                 if (likely(dev->dequeue_zero_copy == 0))
1504                         update_shadow_used_ring_packed(vq, buf_id, 0,
1505                                         desc_count);
1506
1507                 rte_prefetch0((void *)(uintptr_t)buf_vec[0].buf_addr);
1508
1509                 pkts[i] = rte_pktmbuf_alloc(mbuf_pool);
1510                 if (unlikely(pkts[i] == NULL)) {
1511                         RTE_LOG(ERR, VHOST_DATA,
1512                                 "Failed to allocate memory for mbuf.\n");
1513                         break;
1514                 }
1515
1516                 err = copy_desc_to_mbuf(dev, vq, buf_vec, nr_vec, pkts[i],
1517                                 mbuf_pool);
1518                 if (unlikely(err)) {
1519                         rte_pktmbuf_free(pkts[i]);
1520                         break;
1521                 }
1522
1523                 if (unlikely(dev->dequeue_zero_copy)) {
1524                         struct zcopy_mbuf *zmbuf;
1525
1526                         zmbuf = get_zmbuf(vq);
1527                         if (!zmbuf) {
1528                                 rte_pktmbuf_free(pkts[i]);
1529                                 break;
1530                         }
1531                         zmbuf->mbuf = pkts[i];
1532                         zmbuf->desc_idx = buf_id;
1533                         zmbuf->desc_count = desc_count;
1534
1535                         /*
1536                          * Pin lock the mbuf; we will check later to see
1537                          * whether the mbuf is freed (when we are the last
1538                          * user) or not. If that's the case, we then could
1539                          * update the used ring safely.
1540                          */
1541                         rte_mbuf_refcnt_update(pkts[i], 1);
1542
1543                         vq->nr_zmbuf += 1;
1544                         TAILQ_INSERT_TAIL(&vq->zmbuf_list, zmbuf, next);
1545                 }
1546
1547                 vq->last_avail_idx += desc_count;
1548                 if (vq->last_avail_idx >= vq->size) {
1549                         vq->last_avail_idx -= vq->size;
1550                         vq->avail_wrap_counter ^= 1;
1551                 }
1552         }
1553
1554         if (likely(dev->dequeue_zero_copy == 0)) {
1555                 do_data_copy_dequeue(vq);
1556                 if (unlikely(i < count))
1557                         vq->shadow_used_idx = i;
1558                 if (likely(vq->shadow_used_idx)) {
1559                         flush_shadow_used_ring_packed(dev, vq);
1560                         vhost_vring_call_packed(dev, vq);
1561                 }
1562         }
1563
1564         return i;
1565 }
1566
1567 uint16_t
1568 rte_vhost_dequeue_burst(int vid, uint16_t queue_id,
1569         struct rte_mempool *mbuf_pool, struct rte_mbuf **pkts, uint16_t count)
1570 {
1571         struct virtio_net *dev;
1572         struct rte_mbuf *rarp_mbuf = NULL;
1573         struct vhost_virtqueue *vq;
1574
1575         dev = get_device(vid);
1576         if (!dev)
1577                 return 0;
1578
1579         if (unlikely(!(dev->flags & VIRTIO_DEV_BUILTIN_VIRTIO_NET))) {
1580                 RTE_LOG(ERR, VHOST_DATA,
1581                         "(%d) %s: built-in vhost net backend is disabled.\n",
1582                         dev->vid, __func__);
1583                 return 0;
1584         }
1585
1586         if (unlikely(!is_valid_virt_queue_idx(queue_id, 1, dev->nr_vring))) {
1587                 RTE_LOG(ERR, VHOST_DATA, "(%d) %s: invalid virtqueue idx %d.\n",
1588                         dev->vid, __func__, queue_id);
1589                 return 0;
1590         }
1591
1592         vq = dev->virtqueue[queue_id];
1593
1594         if (unlikely(rte_spinlock_trylock(&vq->access_lock) == 0))
1595                 return 0;
1596
1597         if (unlikely(vq->enabled == 0)) {
1598                 count = 0;
1599                 goto out_access_unlock;
1600         }
1601
1602         if (dev->features & (1ULL << VIRTIO_F_IOMMU_PLATFORM))
1603                 vhost_user_iotlb_rd_lock(vq);
1604
1605         if (unlikely(vq->access_ok == 0))
1606                 if (unlikely(vring_translate(dev, vq) < 0)) {
1607                         count = 0;
1608                         goto out;
1609                 }
1610
1611         /*
1612          * Construct a RARP broadcast packet, and inject it to the "pkts"
1613          * array, to looks like that guest actually send such packet.
1614          *
1615          * Check user_send_rarp() for more information.
1616          *
1617          * broadcast_rarp shares a cacheline in the virtio_net structure
1618          * with some fields that are accessed during enqueue and
1619          * rte_atomic16_cmpset() causes a write if using cmpxchg. This could
1620          * result in false sharing between enqueue and dequeue.
1621          *
1622          * Prevent unnecessary false sharing by reading broadcast_rarp first
1623          * and only performing cmpset if the read indicates it is likely to
1624          * be set.
1625          */
1626         if (unlikely(rte_atomic16_read(&dev->broadcast_rarp) &&
1627                         rte_atomic16_cmpset((volatile uint16_t *)
1628                                 &dev->broadcast_rarp.cnt, 1, 0))) {
1629
1630                 rarp_mbuf = rte_net_make_rarp_packet(mbuf_pool, &dev->mac);
1631                 if (rarp_mbuf == NULL) {
1632                         RTE_LOG(ERR, VHOST_DATA,
1633                                 "Failed to make RARP packet.\n");
1634                         count = 0;
1635                         goto out;
1636                 }
1637                 count -= 1;
1638         }
1639
1640         if (vq_is_packed(dev))
1641                 count = virtio_dev_tx_packed(dev, vq, mbuf_pool, pkts, count);
1642         else
1643                 count = virtio_dev_tx_split(dev, vq, mbuf_pool, pkts, count);
1644
1645 out:
1646         if (dev->features & (1ULL << VIRTIO_F_IOMMU_PLATFORM))
1647                 vhost_user_iotlb_rd_unlock(vq);
1648
1649 out_access_unlock:
1650         rte_spinlock_unlock(&vq->access_lock);
1651
1652         if (unlikely(rarp_mbuf != NULL)) {
1653                 /*
1654                  * Inject it to the head of "pkts" array, so that switch's mac
1655                  * learning table will get updated first.
1656                  */
1657                 memmove(&pkts[1], pkts, count * sizeof(struct rte_mbuf *));
1658                 pkts[0] = rarp_mbuf;
1659                 count += 1;
1660         }
1661
1662         return count;
1663 }