drivers/xen/pvcalls-back.c

   1 // SPDX-License-Identifier: GPL-2.0-or-later
   2 /*
   3  * (c) 2017 Stefano Stabellini <stefano@aporeto.com>
   4  */
   5
   6 #include <linux/inet.h>
   7 #include <linux/kthread.h>
   8 #include <linux/list.h>
   9 #include <linux/radix-tree.h>
  10 #include <linux/module.h>
  11 #include <linux/semaphore.h>
  12 #include <linux/wait.h>
  13 #include <net/sock.h>
  14 #include <net/inet_common.h>
  15 #include <net/inet_connection_sock.h>
  16 #include <net/request_sock.h>
  17
  18 #include <xen/events.h>
  19 #include <xen/grant_table.h>
  20 #include <xen/xen.h>
  21 #include <xen/xenbus.h>
  22 #include <xen/interface/io/pvcalls.h>
  23
  24 #define PVCALLS_VERSIONS "1"
  25 #define MAX_RING_ORDER XENBUS_MAX_RING_GRANT_ORDER
  26
  27 static struct pvcalls_back_global {
  28         struct list_head frontends;
  29         struct semaphore frontends_lock;
  30 } pvcalls_back_global;
  31
  32 /*
  33  * Per-frontend data structure. It contains pointers to the command
  34  * ring, its event channel, a list of active sockets and a tree of
  35  * passive sockets.
  36  */
  37 struct pvcalls_fedata {
  38         struct list_head list;
  39         struct xenbus_device *dev;
  40         struct xen_pvcalls_sring *sring;
  41         struct xen_pvcalls_back_ring ring;
  42         int irq;
  43         struct list_head socket_mappings;
  44         struct radix_tree_root socketpass_mappings;
  45         struct semaphore socket_lock;
  46 };
  47
  48 struct pvcalls_ioworker {
  49         struct work_struct register_work;
  50         struct workqueue_struct *wq;
  51 };
  52
  53 struct sock_mapping {
  54         struct list_head list;
  55         struct pvcalls_fedata *fedata;
  56         struct sockpass_mapping *sockpass;
  57         struct socket *sock;
  58         uint64_t id;
  59         grant_ref_t ref;
  60         struct pvcalls_data_intf *ring;
  61         void *bytes;
  62         struct pvcalls_data data;
  63         uint32_t ring_order;
  64         int irq;
  65         atomic_t read;
  66         atomic_t write;
  67         atomic_t io;
  68         atomic_t release;
  69         atomic_t eoi;
  70         void (*saved_data_ready)(struct sock *sk);
  71         struct pvcalls_ioworker ioworker;
  72 };
  73
  74 struct sockpass_mapping {
  75         struct list_head list;
  76         struct pvcalls_fedata *fedata;
  77         struct socket *sock;
  78         uint64_t id;
  79         struct xen_pvcalls_request reqcopy;
  80         spinlock_t copy_lock;
  81         struct workqueue_struct *wq;
  82         struct work_struct register_work;
  83         void (*saved_data_ready)(struct sock *sk);
  84 };
  85
  86 static irqreturn_t pvcalls_back_conn_event(int irq, void *sock_map);
  87 static int pvcalls_back_release_active(struct xenbus_device *dev,
  88                                        struct pvcalls_fedata *fedata,
  89                                        struct sock_mapping *map);
  90
  91 static bool pvcalls_conn_back_read(void *opaque)
  92 {
  93         struct sock_mapping *map = (struct sock_mapping *)opaque;
  94         struct msghdr msg;
  95         struct kvec vec[2];
  96         RING_IDX cons, prod, size, wanted, array_size, masked_prod, masked_cons;
  97         int32_t error;
  98         struct pvcalls_data_intf *intf = map->ring;
  99         struct pvcalls_data *data = &map->data;
 100         unsigned long flags;
 101         int ret;
 102
 103         array_size = XEN_FLEX_RING_SIZE(map->ring_order);
 104         cons = intf->in_cons;
 105         prod = intf->in_prod;
 106         error = intf->in_error;
 107         /* read the indexes first, then deal with the data */
 108         virt_mb();
 109
 110         if (error)
 111                 return false;
 112
 113         size = pvcalls_queued(prod, cons, array_size);
 114         if (size >= array_size)
 115                 return false;
 116         spin_lock_irqsave(&map->sock->sk->sk_receive_queue.lock, flags);
 117         if (skb_queue_empty(&map->sock->sk->sk_receive_queue)) {
 118                 atomic_set(&map->read, 0);
 119                 spin_unlock_irqrestore(&map->sock->sk->sk_receive_queue.lock,
 120                                 flags);
 121                 return true;
 122         }
 123         spin_unlock_irqrestore(&map->sock->sk->sk_receive_queue.lock, flags);
 124         wanted = array_size - size;
 125         masked_prod = pvcalls_mask(prod, array_size);
 126         masked_cons = pvcalls_mask(cons, array_size);
 127
 128         memset(&msg, 0, sizeof(msg));
 129         if (masked_prod < masked_cons) {
 130                 vec[0].iov_base = data->in + masked_prod;
 131                 vec[0].iov_len = wanted;
 132                 iov_iter_kvec(&msg.msg_iter, ITER_DEST, vec, 1, wanted);
 133         } else {
 134                 vec[0].iov_base = data->in + masked_prod;
 135                 vec[0].iov_len = array_size - masked_prod;
 136                 vec[1].iov_base = data->in;
 137                 vec[1].iov_len = wanted - vec[0].iov_len;
 138                 iov_iter_kvec(&msg.msg_iter, ITER_DEST, vec, 2, wanted);
 139         }
 140
 141         atomic_set(&map->read, 0);
 142         ret = inet_recvmsg(map->sock, &msg, wanted, MSG_DONTWAIT);
 143         WARN_ON(ret > wanted);
 144         if (ret == -EAGAIN) /* shouldn't happen */
 145                 return true;
 146         if (!ret)
 147                 ret = -ENOTCONN;
 148         spin_lock_irqsave(&map->sock->sk->sk_receive_queue.lock, flags);
 149         if (ret > 0 && !skb_queue_empty(&map->sock->sk->sk_receive_queue))
 150                 atomic_inc(&map->read);
 151         spin_unlock_irqrestore(&map->sock->sk->sk_receive_queue.lock, flags);
 152
 153         /* write the data, then modify the indexes */
 154         virt_wmb();
 155         if (ret < 0) {
 156                 atomic_set(&map->read, 0);
 157                 intf->in_error = ret;
 158         } else
 159                 intf->in_prod = prod + ret;
 160         /* update the indexes, then notify the other end */
 161         virt_wmb();
 162         notify_remote_via_irq(map->irq);
 163
 164         return true;
 165 }
 166
 167 static bool pvcalls_conn_back_write(struct sock_mapping *map)
 168 {
 169         struct pvcalls_data_intf *intf = map->ring;
 170         struct pvcalls_data *data = &map->data;
 171         struct msghdr msg;
 172         struct kvec vec[2];
 173         RING_IDX cons, prod, size, array_size;
 174         int ret;
 175
 176         cons = intf->out_cons;
 177         prod = intf->out_prod;
 178         /* read the indexes before dealing with the data */
 179         virt_mb();
 180
 181         array_size = XEN_FLEX_RING_SIZE(map->ring_order);
 182         size = pvcalls_queued(prod, cons, array_size);
 183         if (size == 0)
 184                 return false;
 185
 186         memset(&msg, 0, sizeof(msg));
 187         msg.msg_flags |= MSG_DONTWAIT;
 188         if (pvcalls_mask(prod, array_size) > pvcalls_mask(cons, array_size)) {
 189                 vec[0].iov_base = data->out + pvcalls_mask(cons, array_size);
 190                 vec[0].iov_len = size;
 191                 iov_iter_kvec(&msg.msg_iter, ITER_SOURCE, vec, 1, size);
 192         } else {
 193                 vec[0].iov_base = data->out + pvcalls_mask(cons, array_size);
 194                 vec[0].iov_len = array_size - pvcalls_mask(cons, array_size);
 195                 vec[1].iov_base = data->out;
 196                 vec[1].iov_len = size - vec[0].iov_len;
 197                 iov_iter_kvec(&msg.msg_iter, ITER_SOURCE, vec, 2, size);
 198         }
 199
 200         atomic_set(&map->write, 0);
 201         ret = inet_sendmsg(map->sock, &msg, size);
 202         if (ret == -EAGAIN) {
 203                 atomic_inc(&map->write);
 204                 atomic_inc(&map->io);
 205                 return true;
 206         }
 207
 208         /* write the data, then update the indexes */
 209         virt_wmb();
 210         if (ret < 0) {
 211                 intf->out_error = ret;
 212         } else {
 213                 intf->out_error = 0;
 214                 intf->out_cons = cons + ret;
 215                 prod = intf->out_prod;
 216         }
 217         /* update the indexes, then notify the other end */
 218         virt_wmb();
 219         if (prod != cons + ret) {
 220                 atomic_inc(&map->write);
 221                 atomic_inc(&map->io);
 222         }
 223         notify_remote_via_irq(map->irq);
 224
 225         return true;
 226 }
 227
 228 static void pvcalls_back_ioworker(struct work_struct *work)
 229 {
 230         struct pvcalls_ioworker *ioworker = container_of(work,
 231                 struct pvcalls_ioworker, register_work);
 232         struct sock_mapping *map = container_of(ioworker, struct sock_mapping,
 233                 ioworker);
 234         unsigned int eoi_flags = XEN_EOI_FLAG_SPURIOUS;
 235
 236         while (atomic_read(&map->io) > 0) {
 237                 if (atomic_read(&map->release) > 0) {
 238                         atomic_set(&map->release, 0);
 239                         return;
 240                 }
 241
 242                 if (atomic_read(&map->read) > 0 &&
 243                     pvcalls_conn_back_read(map))
 244                         eoi_flags = 0;
 245                 if (atomic_read(&map->write) > 0 &&
 246                     pvcalls_conn_back_write(map))
 247                         eoi_flags = 0;
 248
 249                 if (atomic_read(&map->eoi) > 0 && !atomic_read(&map->write)) {
 250                         atomic_set(&map->eoi, 0);
 251                         xen_irq_lateeoi(map->irq, eoi_flags);
 252                         eoi_flags = XEN_EOI_FLAG_SPURIOUS;
 253                 }
 254
 255                 atomic_dec(&map->io);
 256         }
 257 }
 258
 259 static int pvcalls_back_socket(struct xenbus_device *dev,
 260                 struct xen_pvcalls_request *req)
 261 {
 262         struct pvcalls_fedata *fedata;
 263         int ret;
 264         struct xen_pvcalls_response *rsp;
 265
 266         fedata = dev_get_drvdata(&dev->dev);
 267
 268         if (req->u.socket.domain != AF_INET ||
 269             req->u.socket.type != SOCK_STREAM ||
 270             (req->u.socket.protocol != IPPROTO_IP &&
 271              req->u.socket.protocol != AF_INET))
 272                 ret = -EAFNOSUPPORT;
 273         else
 274                 ret = 0;
 275
 276         /* leave the actual socket allocation for later */
 277
 278         rsp = RING_GET_RESPONSE(&fedata->ring, fedata->ring.rsp_prod_pvt++);
 279         rsp->req_id = req->req_id;
 280         rsp->cmd = req->cmd;
 281         rsp->u.socket.id = req->u.socket.id;
 282         rsp->ret = ret;
 283
 284         return 0;
 285 }
 286
 287 static void pvcalls_sk_state_change(struct sock *sock)
 288 {
 289         struct sock_mapping *map = sock->sk_user_data;
 290
 291         if (map == NULL)
 292                 return;
 293
 294         atomic_inc(&map->read);
 295         notify_remote_via_irq(map->irq);
 296 }
 297
 298 static void pvcalls_sk_data_ready(struct sock *sock)
 299 {
 300         struct sock_mapping *map = sock->sk_user_data;
 301         struct pvcalls_ioworker *iow;
 302
 303         if (map == NULL)
 304                 return;
 305
 306         iow = &map->ioworker;
 307         atomic_inc(&map->read);
 308         atomic_inc(&map->io);
 309         queue_work(iow->wq, &iow->register_work);
 310 }
 311
 312 static struct sock_mapping *pvcalls_new_active_socket(
 313                 struct pvcalls_fedata *fedata,
 314                 uint64_t id,
 315                 grant_ref_t ref,
 316                 evtchn_port_t evtchn,
 317                 struct socket *sock)
 318 {
 319         int ret;
 320         struct sock_mapping *map;
 321         void *page;
 322
 323         map = kzalloc(sizeof(*map), GFP_KERNEL);
 324         if (map == NULL) {
 325                 sock_release(sock);
 326                 return NULL;
 327         }
 328
 329         map->fedata = fedata;
 330         map->sock = sock;
 331         map->id = id;
 332         map->ref = ref;
 333
 334         ret = xenbus_map_ring_valloc(fedata->dev, &ref, 1, &page);
 335         if (ret < 0)
 336                 goto out;
 337         map->ring = page;
 338         map->ring_order = map->ring->ring_order;
 339         /* first read the order, then map the data ring */
 340         virt_rmb();
 341         if (map->ring_order > MAX_RING_ORDER) {
 342                 pr_warn("%s frontend requested ring_order %u, which is > MAX (%u)\n",
 343                                 __func__, map->ring_order, MAX_RING_ORDER);
 344                 goto out;
 345         }
 346         ret = xenbus_map_ring_valloc(fedata->dev, map->ring->ref,
 347                                      (1 << map->ring_order), &page);
 348         if (ret < 0)
 349                 goto out;
 350         map->bytes = page;
 351
 352         ret = bind_interdomain_evtchn_to_irqhandler_lateeoi(
 353                         fedata->dev, evtchn,
 354                         pvcalls_back_conn_event, 0, "pvcalls-backend", map);
 355         if (ret < 0)
 356                 goto out;
 357         map->irq = ret;
 358
 359         map->data.in = map->bytes;
 360         map->data.out = map->bytes + XEN_FLEX_RING_SIZE(map->ring_order);
 361
 362         map->ioworker.wq = alloc_workqueue("pvcalls_io", WQ_UNBOUND, 1);
 363         if (!map->ioworker.wq)
 364                 goto out;
 365         atomic_set(&map->io, 1);
 366         INIT_WORK(&map->ioworker.register_work, pvcalls_back_ioworker);
 367
 368         down(&fedata->socket_lock);
 369         list_add_tail(&map->list, &fedata->socket_mappings);
 370         up(&fedata->socket_lock);
 371
 372         write_lock_bh(&map->sock->sk->sk_callback_lock);
 373         map->saved_data_ready = map->sock->sk->sk_data_ready;
 374         map->sock->sk->sk_user_data = map;
 375         map->sock->sk->sk_data_ready = pvcalls_sk_data_ready;
 376         map->sock->sk->sk_state_change = pvcalls_sk_state_change;
 377         write_unlock_bh(&map->sock->sk->sk_callback_lock);
 378
 379         return map;
 380 out:
 381         down(&fedata->socket_lock);
 382         list_del(&map->list);
 383         pvcalls_back_release_active(fedata->dev, fedata, map);
 384         up(&fedata->socket_lock);
 385         return NULL;
 386 }
 387
 388 static int pvcalls_back_connect(struct xenbus_device *dev,
 389                                 struct xen_pvcalls_request *req)
 390 {
 391         struct pvcalls_fedata *fedata;
 392         int ret = -EINVAL;
 393         struct socket *sock;
 394         struct sock_mapping *map;
 395         struct xen_pvcalls_response *rsp;
 396         struct sockaddr *sa = (struct sockaddr *)&req->u.connect.addr;
 397
 398         fedata = dev_get_drvdata(&dev->dev);
 399
 400         if (req->u.connect.len < sizeof(sa->sa_family) ||
 401             req->u.connect.len > sizeof(req->u.connect.addr) ||
 402             sa->sa_family != AF_INET)
 403                 goto out;
 404
 405         ret = sock_create(AF_INET, SOCK_STREAM, 0, &sock);
 406         if (ret < 0)
 407                 goto out;
 408         ret = inet_stream_connect(sock, sa, req->u.connect.len, 0);
 409         if (ret < 0) {
 410                 sock_release(sock);
 411                 goto out;
 412         }
 413
 414         map = pvcalls_new_active_socket(fedata,
 415                                         req->u.connect.id,
 416                                         req->u.connect.ref,
 417                                         req->u.connect.evtchn,
 418                                         sock);
 419         if (!map)
 420                 ret = -EFAULT;
 421
 422 out:
 423         rsp = RING_GET_RESPONSE(&fedata->ring, fedata->ring.rsp_prod_pvt++);
 424         rsp->req_id = req->req_id;
 425         rsp->cmd = req->cmd;
 426         rsp->u.connect.id = req->u.connect.id;
 427         rsp->ret = ret;
 428
 429         return 0;
 430 }
 431
 432 static int pvcalls_back_release_active(struct xenbus_device *dev,
 433                                        struct pvcalls_fedata *fedata,
 434                                        struct sock_mapping *map)
 435 {
 436         disable_irq(map->irq);
 437         if (map->sock->sk != NULL) {
 438                 write_lock_bh(&map->sock->sk->sk_callback_lock);
 439                 map->sock->sk->sk_user_data = NULL;
 440                 map->sock->sk->sk_data_ready = map->saved_data_ready;
 441                 write_unlock_bh(&map->sock->sk->sk_callback_lock);
 442         }
 443
 444         atomic_set(&map->release, 1);
 445         flush_work(&map->ioworker.register_work);
 446
 447         xenbus_unmap_ring_vfree(dev, map->bytes);
 448         xenbus_unmap_ring_vfree(dev, (void *)map->ring);
 449         unbind_from_irqhandler(map->irq, map);
 450
 451         sock_release(map->sock);
 452         kfree(map);
 453
 454         return 0;
 455 }
 456
 457 static int pvcalls_back_release_passive(struct xenbus_device *dev,
 458                                         struct pvcalls_fedata *fedata,
 459                                         struct sockpass_mapping *mappass)
 460 {
 461         if (mappass->sock->sk != NULL) {
 462                 write_lock_bh(&mappass->sock->sk->sk_callback_lock);
 463                 mappass->sock->sk->sk_user_data = NULL;
 464                 mappass->sock->sk->sk_data_ready = mappass->saved_data_ready;
 465                 write_unlock_bh(&mappass->sock->sk->sk_callback_lock);
 466         }
 467         sock_release(mappass->sock);
 468         destroy_workqueue(mappass->wq);
 469         kfree(mappass);
 470
 471         return 0;
 472 }
 473
 474 static int pvcalls_back_release(struct xenbus_device *dev,
 475                                 struct xen_pvcalls_request *req)
 476 {
 477         struct pvcalls_fedata *fedata;
 478         struct sock_mapping *map, *n;
 479         struct sockpass_mapping *mappass;
 480         int ret = 0;
 481         struct xen_pvcalls_response *rsp;
 482
 483         fedata = dev_get_drvdata(&dev->dev);
 484
 485         down(&fedata->socket_lock);
 486         list_for_each_entry_safe(map, n, &fedata->socket_mappings, list) {
 487                 if (map->id == req->u.release.id) {
 488                         list_del(&map->list);
 489                         up(&fedata->socket_lock);
 490                         ret = pvcalls_back_release_active(dev, fedata, map);
 491                         goto out;
 492                 }
 493         }
 494         mappass = radix_tree_lookup(&fedata->socketpass_mappings,
 495                                     req->u.release.id);
 496         if (mappass != NULL) {
 497                 radix_tree_delete(&fedata->socketpass_mappings, mappass->id);
 498                 up(&fedata->socket_lock);
 499                 ret = pvcalls_back_release_passive(dev, fedata, mappass);
 500         } else
 501                 up(&fedata->socket_lock);
 502
 503 out:
 504         rsp = RING_GET_RESPONSE(&fedata->ring, fedata->ring.rsp_prod_pvt++);
 505         rsp->req_id = req->req_id;
 506         rsp->u.release.id = req->u.release.id;
 507         rsp->cmd = req->cmd;
 508         rsp->ret = ret;
 509         return 0;
 510 }
 511
 512 static void __pvcalls_back_accept(struct work_struct *work)
 513 {
 514         struct sockpass_mapping *mappass = container_of(
 515                 work, struct sockpass_mapping, register_work);
 516         struct sock_mapping *map;
 517         struct pvcalls_ioworker *iow;
 518         struct pvcalls_fedata *fedata;
 519         struct socket *sock;
 520         struct xen_pvcalls_response *rsp;
 521         struct xen_pvcalls_request *req;
 522         int notify;
 523         int ret = -EINVAL;
 524         unsigned long flags;
 525
 526         fedata = mappass->fedata;
 527         /*
 528          * __pvcalls_back_accept can race against pvcalls_back_accept.
 529          * We only need to check the value of "cmd" on read. It could be
 530          * done atomically, but to simplify the code on the write side, we
 531          * use a spinlock.
 532          */
 533         spin_lock_irqsave(&mappass->copy_lock, flags);
 534         req = &mappass->reqcopy;
 535         if (req->cmd != PVCALLS_ACCEPT) {
 536                 spin_unlock_irqrestore(&mappass->copy_lock, flags);
 537                 return;
 538         }
 539         spin_unlock_irqrestore(&mappass->copy_lock, flags);
 540
 541         sock = sock_alloc();
 542         if (sock == NULL)
 543                 goto out_error;
 544         sock->type = mappass->sock->type;
 545         sock->ops = mappass->sock->ops;
 546
 547         ret = inet_accept(mappass->sock, sock, O_NONBLOCK, true);
 548         if (ret == -EAGAIN) {
 549                 sock_release(sock);
 550                 return;
 551         }
 552
 553         map = pvcalls_new_active_socket(fedata,
 554                                         req->u.accept.id_new,
 555                                         req->u.accept.ref,
 556                                         req->u.accept.evtchn,
 557                                         sock);
 558         if (!map) {
 559                 ret = -EFAULT;
 560                 goto out_error;
 561         }
 562
 563         map->sockpass = mappass;
 564         iow = &map->ioworker;
 565         atomic_inc(&map->read);
 566         atomic_inc(&map->io);
 567         queue_work(iow->wq, &iow->register_work);
 568
 569 out_error:
 570         rsp = RING_GET_RESPONSE(&fedata->ring, fedata->ring.rsp_prod_pvt++);
 571         rsp->req_id = req->req_id;
 572         rsp->cmd = req->cmd;
 573         rsp->u.accept.id = req->u.accept.id;
 574         rsp->ret = ret;
 575         RING_PUSH_RESPONSES_AND_CHECK_NOTIFY(&fedata->ring, notify);
 576         if (notify)
 577                 notify_remote_via_irq(fedata->irq);
 578
 579         mappass->reqcopy.cmd = 0;
 580 }
 581
 582 static void pvcalls_pass_sk_data_ready(struct sock *sock)
 583 {
 584         struct sockpass_mapping *mappass = sock->sk_user_data;
 585         struct pvcalls_fedata *fedata;
 586         struct xen_pvcalls_response *rsp;
 587         unsigned long flags;
 588         int notify;
 589
 590         if (mappass == NULL)
 591                 return;
 592
 593         fedata = mappass->fedata;
 594         spin_lock_irqsave(&mappass->copy_lock, flags);
 595         if (mappass->reqcopy.cmd == PVCALLS_POLL) {
 596                 rsp = RING_GET_RESPONSE(&fedata->ring,
 597                                         fedata->ring.rsp_prod_pvt++);
 598                 rsp->req_id = mappass->reqcopy.req_id;
 599                 rsp->u.poll.id = mappass->reqcopy.u.poll.id;
 600                 rsp->cmd = mappass->reqcopy.cmd;
 601                 rsp->ret = 0;
 602
 603                 mappass->reqcopy.cmd = 0;
 604                 spin_unlock_irqrestore(&mappass->copy_lock, flags);
 605
 606                 RING_PUSH_RESPONSES_AND_CHECK_NOTIFY(&fedata->ring, notify);
 607                 if (notify)
 608                         notify_remote_via_irq(mappass->fedata->irq);
 609         } else {
 610                 spin_unlock_irqrestore(&mappass->copy_lock, flags);
 611                 queue_work(mappass->wq, &mappass->register_work);
 612         }
 613 }
 614
 615 static int pvcalls_back_bind(struct xenbus_device *dev,
 616                              struct xen_pvcalls_request *req)
 617 {
 618         struct pvcalls_fedata *fedata;
 619         int ret;
 620         struct sockpass_mapping *map;
 621         struct xen_pvcalls_response *rsp;
 622
 623         fedata = dev_get_drvdata(&dev->dev);
 624
 625         map = kzalloc(sizeof(*map), GFP_KERNEL);
 626         if (map == NULL) {
 627                 ret = -ENOMEM;
 628                 goto out;
 629         }
 630
 631         INIT_WORK(&map->register_work, __pvcalls_back_accept);
 632         spin_lock_init(&map->copy_lock);
 633         map->wq = alloc_workqueue("pvcalls_wq", WQ_UNBOUND, 1);
 634         if (!map->wq) {
 635                 ret = -ENOMEM;
 636                 goto out;
 637         }
 638
 639         ret = sock_create(AF_INET, SOCK_STREAM, 0, &map->sock);
 640         if (ret < 0)
 641                 goto out;
 642
 643         ret = inet_bind(map->sock, (struct sockaddr *)&req->u.bind.addr,
 644                         req->u.bind.len);
 645         if (ret < 0)
 646                 goto out;
 647
 648         map->fedata = fedata;
 649         map->id = req->u.bind.id;
 650
 651         down(&fedata->socket_lock);
 652         ret = radix_tree_insert(&fedata->socketpass_mappings, map->id,
 653                                 map);
 654         up(&fedata->socket_lock);
 655         if (ret)
 656                 goto out;
 657
 658         write_lock_bh(&map->sock->sk->sk_callback_lock);
 659         map->saved_data_ready = map->sock->sk->sk_data_ready;
 660         map->sock->sk->sk_user_data = map;
 661         map->sock->sk->sk_data_ready = pvcalls_pass_sk_data_ready;
 662         write_unlock_bh(&map->sock->sk->sk_callback_lock);
 663
 664 out:
 665         if (ret) {
 666                 if (map && map->sock)
 667                         sock_release(map->sock);
 668                 if (map && map->wq)
 669                         destroy_workqueue(map->wq);
 670                 kfree(map);
 671         }
 672         rsp = RING_GET_RESPONSE(&fedata->ring, fedata->ring.rsp_prod_pvt++);
 673         rsp->req_id = req->req_id;
 674         rsp->cmd = req->cmd;
 675         rsp->u.bind.id = req->u.bind.id;
 676         rsp->ret = ret;
 677         return 0;
 678 }
 679
 680 static int pvcalls_back_listen(struct xenbus_device *dev,
 681                                struct xen_pvcalls_request *req)
 682 {
 683         struct pvcalls_fedata *fedata;
 684         int ret = -EINVAL;
 685         struct sockpass_mapping *map;
 686         struct xen_pvcalls_response *rsp;
 687
 688         fedata = dev_get_drvdata(&dev->dev);
 689
 690         down(&fedata->socket_lock);
 691         map = radix_tree_lookup(&fedata->socketpass_mappings, req->u.listen.id);
 692         up(&fedata->socket_lock);
 693         if (map == NULL)
 694                 goto out;
 695
 696         ret = inet_listen(map->sock, req->u.listen.backlog);
 697
 698 out:
 699         rsp = RING_GET_RESPONSE(&fedata->ring, fedata->ring.rsp_prod_pvt++);
 700         rsp->req_id = req->req_id;
 701         rsp->cmd = req->cmd;
 702         rsp->u.listen.id = req->u.listen.id;
 703         rsp->ret = ret;
 704         return 0;
 705 }
 706
 707 static int pvcalls_back_accept(struct xenbus_device *dev,
 708                                struct xen_pvcalls_request *req)
 709 {
 710         struct pvcalls_fedata *fedata;
 711         struct sockpass_mapping *mappass;
 712         int ret = -EINVAL;
 713         struct xen_pvcalls_response *rsp;
 714         unsigned long flags;
 715
 716         fedata = dev_get_drvdata(&dev->dev);
 717
 718         down(&fedata->socket_lock);
 719         mappass = radix_tree_lookup(&fedata->socketpass_mappings,
 720                 req->u.accept.id);
 721         up(&fedata->socket_lock);
 722         if (mappass == NULL)
 723                 goto out_error;
 724
 725         /*
 726          * Limitation of the current implementation: only support one
 727          * concurrent accept or poll call on one socket.
 728          */
 729         spin_lock_irqsave(&mappass->copy_lock, flags);
 730         if (mappass->reqcopy.cmd != 0) {
 731                 spin_unlock_irqrestore(&mappass->copy_lock, flags);
 732                 ret = -EINTR;
 733                 goto out_error;
 734         }
 735
 736         mappass->reqcopy = *req;
 737         spin_unlock_irqrestore(&mappass->copy_lock, flags);
 738         queue_work(mappass->wq, &mappass->register_work);
 739
 740         /* Tell the caller we don't need to send back a notification yet */
 741         return -1;
 742
 743 out_error:
 744         rsp = RING_GET_RESPONSE(&fedata->ring, fedata->ring.rsp_prod_pvt++);
 745         rsp->req_id = req->req_id;
 746         rsp->cmd = req->cmd;
 747         rsp->u.accept.id = req->u.accept.id;
 748         rsp->ret = ret;
 749         return 0;
 750 }
 751
 752 static int pvcalls_back_poll(struct xenbus_device *dev,
 753                              struct xen_pvcalls_request *req)
 754 {
 755         struct pvcalls_fedata *fedata;
 756         struct sockpass_mapping *mappass;
 757         struct xen_pvcalls_response *rsp;
 758         struct inet_connection_sock *icsk;
 759         struct request_sock_queue *queue;
 760         unsigned long flags;
 761         int ret;
 762         bool data;
 763
 764         fedata = dev_get_drvdata(&dev->dev);
 765
 766         down(&fedata->socket_lock);
 767         mappass = radix_tree_lookup(&fedata->socketpass_mappings,
 768                                     req->u.poll.id);
 769         up(&fedata->socket_lock);
 770         if (mappass == NULL)
 771                 return -EINVAL;
 772
 773         /*
 774          * Limitation of the current implementation: only support one
 775          * concurrent accept or poll call on one socket.
 776          */
 777         spin_lock_irqsave(&mappass->copy_lock, flags);
 778         if (mappass->reqcopy.cmd != 0) {
 779                 ret = -EINTR;
 780                 goto out;
 781         }
 782
 783         mappass->reqcopy = *req;
 784         icsk = inet_csk(mappass->sock->sk);
 785         queue = &icsk->icsk_accept_queue;
 786         data = READ_ONCE(queue->rskq_accept_head) != NULL;
 787         if (data) {
 788                 mappass->reqcopy.cmd = 0;
 789                 ret = 0;
 790                 goto out;
 791         }
 792         spin_unlock_irqrestore(&mappass->copy_lock, flags);
 793
 794         /* Tell the caller we don't need to send back a notification yet */
 795         return -1;
 796
 797 out:
 798         spin_unlock_irqrestore(&mappass->copy_lock, flags);
 799
 800         rsp = RING_GET_RESPONSE(&fedata->ring, fedata->ring.rsp_prod_pvt++);
 801         rsp->req_id = req->req_id;
 802         rsp->cmd = req->cmd;
 803         rsp->u.poll.id = req->u.poll.id;
 804         rsp->ret = ret;
 805         return 0;
 806 }
 807
 808 static int pvcalls_back_handle_cmd(struct xenbus_device *dev,
 809                                    struct xen_pvcalls_request *req)
 810 {
 811         int ret = 0;
 812
 813         switch (req->cmd) {
 814         case PVCALLS_SOCKET:
 815                 ret = pvcalls_back_socket(dev, req);
 816                 break;
 817         case PVCALLS_CONNECT:
 818                 ret = pvcalls_back_connect(dev, req);
 819                 break;
 820         case PVCALLS_RELEASE:
 821                 ret = pvcalls_back_release(dev, req);
 822                 break;
 823         case PVCALLS_BIND:
 824                 ret = pvcalls_back_bind(dev, req);
 825                 break;
 826         case PVCALLS_LISTEN:
 827                 ret = pvcalls_back_listen(dev, req);
 828                 break;
 829         case PVCALLS_ACCEPT:
 830                 ret = pvcalls_back_accept(dev, req);
 831                 break;
 832         case PVCALLS_POLL:
 833                 ret = pvcalls_back_poll(dev, req);
 834                 break;
 835         default:
 836         {
 837                 struct pvcalls_fedata *fedata;
 838                 struct xen_pvcalls_response *rsp;
 839
 840                 fedata = dev_get_drvdata(&dev->dev);
 841                 rsp = RING_GET_RESPONSE(
 842                                 &fedata->ring, fedata->ring.rsp_prod_pvt++);
 843                 rsp->req_id = req->req_id;
 844                 rsp->cmd = req->cmd;
 845                 rsp->ret = -ENOTSUPP;
 846                 break;
 847         }
 848         }
 849         return ret;
 850 }
 851
 852 static void pvcalls_back_work(struct pvcalls_fedata *fedata)
 853 {
 854         int notify, notify_all = 0, more = 1;
 855         struct xen_pvcalls_request req;
 856         struct xenbus_device *dev = fedata->dev;
 857
 858         while (more) {
 859                 while (RING_HAS_UNCONSUMED_REQUESTS(&fedata->ring)) {
 860                         RING_COPY_REQUEST(&fedata->ring,
 861                                           fedata->ring.req_cons++,
 862                                           &req);
 863
 864                         if (!pvcalls_back_handle_cmd(dev, &req)) {
 865                                 RING_PUSH_RESPONSES_AND_CHECK_NOTIFY(
 866                                         &fedata->ring, notify);
 867                                 notify_all += notify;
 868                         }
 869                 }
 870
 871                 if (notify_all) {
 872                         notify_remote_via_irq(fedata->irq);
 873                         notify_all = 0;
 874                 }
 875
 876                 RING_FINAL_CHECK_FOR_REQUESTS(&fedata->ring, more);
 877         }
 878 }
 879
 880 static irqreturn_t pvcalls_back_event(int irq, void *dev_id)
 881 {
 882         struct xenbus_device *dev = dev_id;
 883         struct pvcalls_fedata *fedata = NULL;
 884         unsigned int eoi_flags = XEN_EOI_FLAG_SPURIOUS;
 885
 886         if (dev) {
 887                 fedata = dev_get_drvdata(&dev->dev);
 888                 if (fedata) {
 889                         pvcalls_back_work(fedata);
 890                         eoi_flags = 0;
 891                 }
 892         }
 893
 894         xen_irq_lateeoi(irq, eoi_flags);
 895
 896         return IRQ_HANDLED;
 897 }
 898
 899 static irqreturn_t pvcalls_back_conn_event(int irq, void *sock_map)
 900 {
 901         struct sock_mapping *map = sock_map;
 902         struct pvcalls_ioworker *iow;
 903
 904         if (map == NULL || map->sock == NULL || map->sock->sk == NULL ||
 905                 map->sock->sk->sk_user_data != map) {
 906                 xen_irq_lateeoi(irq, 0);
 907                 return IRQ_HANDLED;
 908         }
 909
 910         iow = &map->ioworker;
 911
 912         atomic_inc(&map->write);
 913         atomic_inc(&map->eoi);
 914         atomic_inc(&map->io);
 915         queue_work(iow->wq, &iow->register_work);
 916
 917         return IRQ_HANDLED;
 918 }
 919
 920 static int backend_connect(struct xenbus_device *dev)
 921 {
 922         int err;
 923         evtchn_port_t evtchn;
 924         grant_ref_t ring_ref;
 925         struct pvcalls_fedata *fedata = NULL;
 926
 927         fedata = kzalloc(sizeof(struct pvcalls_fedata), GFP_KERNEL);
 928         if (!fedata)
 929                 return -ENOMEM;
 930
 931         fedata->irq = -1;
 932         err = xenbus_scanf(XBT_NIL, dev->otherend, "port", "%u",
 933                            &evtchn);
 934         if (err != 1) {
 935                 err = -EINVAL;
 936                 xenbus_dev_fatal(dev, err, "reading %s/event-channel",
 937                                  dev->otherend);
 938                 goto error;
 939         }
 940
 941         err = xenbus_scanf(XBT_NIL, dev->otherend, "ring-ref", "%u", &ring_ref);
 942         if (err != 1) {
 943                 err = -EINVAL;
 944                 xenbus_dev_fatal(dev, err, "reading %s/ring-ref",
 945                                  dev->otherend);
 946                 goto error;
 947         }
 948
 949         err = bind_interdomain_evtchn_to_irq_lateeoi(dev, evtchn);
 950         if (err < 0)
 951                 goto error;
 952         fedata->irq = err;
 953
 954         err = request_threaded_irq(fedata->irq, NULL, pvcalls_back_event,
 955                                    IRQF_ONESHOT, "pvcalls-back", dev);
 956         if (err < 0)
 957                 goto error;
 958
 959         err = xenbus_map_ring_valloc(dev, &ring_ref, 1,
 960                                      (void **)&fedata->sring);
 961         if (err < 0)
 962                 goto error;
 963
 964         BACK_RING_INIT(&fedata->ring, fedata->sring, XEN_PAGE_SIZE * 1);
 965         fedata->dev = dev;
 966
 967         INIT_LIST_HEAD(&fedata->socket_mappings);
 968         INIT_RADIX_TREE(&fedata->socketpass_mappings, GFP_KERNEL);
 969         sema_init(&fedata->socket_lock, 1);
 970         dev_set_drvdata(&dev->dev, fedata);
 971
 972         down(&pvcalls_back_global.frontends_lock);
 973         list_add_tail(&fedata->list, &pvcalls_back_global.frontends);
 974         up(&pvcalls_back_global.frontends_lock);
 975
 976         return 0;
 977
 978  error:
 979         if (fedata->irq >= 0)
 980                 unbind_from_irqhandler(fedata->irq, dev);
 981         if (fedata->sring != NULL)
 982                 xenbus_unmap_ring_vfree(dev, fedata->sring);
 983         kfree(fedata);
 984         return err;
 985 }
 986
 987 static int backend_disconnect(struct xenbus_device *dev)
 988 {
 989         struct pvcalls_fedata *fedata;
 990         struct sock_mapping *map, *n;
 991         struct sockpass_mapping *mappass;
 992         struct radix_tree_iter iter;
 993         void **slot;
 994
 995
 996         fedata = dev_get_drvdata(&dev->dev);
 997
 998         down(&fedata->socket_lock);
 999         list_for_each_entry_safe(map, n, &fedata->socket_mappings, list) {
1000                 list_del(&map->list);
1001                 pvcalls_back_release_active(dev, fedata, map);
1002         }
1003
1004         radix_tree_for_each_slot(slot, &fedata->socketpass_mappings, &iter, 0) {
1005                 mappass = radix_tree_deref_slot(slot);
1006                 if (!mappass)
1007                         continue;
1008                 if (radix_tree_exception(mappass)) {
1009                         if (radix_tree_deref_retry(mappass))
1010                                 slot = radix_tree_iter_retry(&iter);
1011                 } else {
1012                         radix_tree_delete(&fedata->socketpass_mappings,
1013                                           mappass->id);
1014                         pvcalls_back_release_passive(dev, fedata, mappass);
1015                 }
1016         }
1017         up(&fedata->socket_lock);
1018
1019         unbind_from_irqhandler(fedata->irq, dev);
1020         xenbus_unmap_ring_vfree(dev, fedata->sring);
1021
1022         list_del(&fedata->list);
1023         kfree(fedata);
1024         dev_set_drvdata(&dev->dev, NULL);
1025
1026         return 0;
1027 }
1028
1029 static int pvcalls_back_probe(struct xenbus_device *dev,
1030                               const struct xenbus_device_id *id)
1031 {
1032         int err, abort;
1033         struct xenbus_transaction xbt;
1034
1035 again:
1036         abort = 1;
1037
1038         err = xenbus_transaction_start(&xbt);
1039         if (err) {
1040                 pr_warn("%s cannot create xenstore transaction\n", __func__);
1041                 return err;
1042         }
1043
1044         err = xenbus_printf(xbt, dev->nodename, "versions", "%s",
1045                             PVCALLS_VERSIONS);
1046         if (err) {
1047                 pr_warn("%s write out 'versions' failed\n", __func__);
1048                 goto abort;
1049         }
1050
1051         err = xenbus_printf(xbt, dev->nodename, "max-page-order", "%u",
1052                             MAX_RING_ORDER);
1053         if (err) {
1054                 pr_warn("%s write out 'max-page-order' failed\n", __func__);
1055                 goto abort;
1056         }
1057
1058         err = xenbus_printf(xbt, dev->nodename, "function-calls",
1059                             XENBUS_FUNCTIONS_CALLS);
1060         if (err) {
1061                 pr_warn("%s write out 'function-calls' failed\n", __func__);
1062                 goto abort;
1063         }
1064
1065         abort = 0;
1066 abort:
1067         err = xenbus_transaction_end(xbt, abort);
1068         if (err) {
1069                 if (err == -EAGAIN && !abort)
1070                         goto again;
1071                 pr_warn("%s cannot complete xenstore transaction\n", __func__);
1072                 return err;
1073         }
1074
1075         if (abort)
1076                 return -EFAULT;
1077
1078         xenbus_switch_state(dev, XenbusStateInitWait);
1079
1080         return 0;
1081 }
1082
1083 static void set_backend_state(struct xenbus_device *dev,
1084                               enum xenbus_state state)
1085 {
1086         while (dev->state != state) {
1087                 switch (dev->state) {
1088                 case XenbusStateClosed:
1089                         switch (state) {
1090                         case XenbusStateInitWait:
1091                         case XenbusStateConnected:
1092                                 xenbus_switch_state(dev, XenbusStateInitWait);
1093                                 break;
1094                         case XenbusStateClosing:
1095                                 xenbus_switch_state(dev, XenbusStateClosing);
1096                                 break;
1097                         default:
1098                                 WARN_ON(1);
1099                         }
1100                         break;
1101                 case XenbusStateInitWait:
1102                 case XenbusStateInitialised:
1103                         switch (state) {
1104                         case XenbusStateConnected:
1105                                 if (backend_connect(dev))
1106                                         return;
1107                                 xenbus_switch_state(dev, XenbusStateConnected);
1108                                 break;
1109                         case XenbusStateClosing:
1110                         case XenbusStateClosed:
1111                                 xenbus_switch_state(dev, XenbusStateClosing);
1112                                 break;
1113                         default:
1114                                 WARN_ON(1);
1115                         }
1116                         break;
1117                 case XenbusStateConnected:
1118                         switch (state) {
1119                         case XenbusStateInitWait:
1120                         case XenbusStateClosing:
1121                         case XenbusStateClosed:
1122                                 down(&pvcalls_back_global.frontends_lock);
1123                                 backend_disconnect(dev);
1124                                 up(&pvcalls_back_global.frontends_lock);
1125                                 xenbus_switch_state(dev, XenbusStateClosing);
1126                                 break;
1127                         default:
1128                                 WARN_ON(1);
1129                         }
1130                         break;
1131                 case XenbusStateClosing:
1132                         switch (state) {
1133                         case XenbusStateInitWait:
1134                         case XenbusStateConnected:
1135                         case XenbusStateClosed:
1136                                 xenbus_switch_state(dev, XenbusStateClosed);
1137                                 break;
1138                         default:
1139                                 WARN_ON(1);
1140                         }
1141                         break;
1142                 default:
1143                         WARN_ON(1);
1144                 }
1145         }
1146 }
1147
1148 static void pvcalls_back_changed(struct xenbus_device *dev,
1149                                  enum xenbus_state frontend_state)
1150 {
1151         switch (frontend_state) {
1152         case XenbusStateInitialising:
1153                 set_backend_state(dev, XenbusStateInitWait);
1154                 break;
1155
1156         case XenbusStateInitialised:
1157         case XenbusStateConnected:
1158                 set_backend_state(dev, XenbusStateConnected);
1159                 break;
1160
1161         case XenbusStateClosing:
1162                 set_backend_state(dev, XenbusStateClosing);
1163                 break;
1164
1165         case XenbusStateClosed:
1166                 set_backend_state(dev, XenbusStateClosed);
1167                 if (xenbus_dev_is_online(dev))
1168                         break;
1169                 device_unregister(&dev->dev);
1170                 break;
1171         case XenbusStateUnknown:
1172                 set_backend_state(dev, XenbusStateClosed);
1173                 device_unregister(&dev->dev);
1174                 break;
1175
1176         default:
1177                 xenbus_dev_fatal(dev, -EINVAL, "saw state %d at frontend",
1178                                  frontend_state);
1179                 break;
1180         }
1181 }
1182
1183 static int pvcalls_back_remove(struct xenbus_device *dev)
1184 {
1185         return 0;
1186 }
1187
1188 static int pvcalls_back_uevent(struct xenbus_device *xdev,
1189                                struct kobj_uevent_env *env)
1190 {
1191         return 0;
1192 }
1193
1194 static const struct xenbus_device_id pvcalls_back_ids[] = {
1195         { "pvcalls" },
1196         { "" }
1197 };
1198
1199 static struct xenbus_driver pvcalls_back_driver = {
1200         .ids = pvcalls_back_ids,
1201         .probe = pvcalls_back_probe,
1202         .remove = pvcalls_back_remove,
1203         .uevent = pvcalls_back_uevent,
1204         .otherend_changed = pvcalls_back_changed,
1205 };
1206
1207 static int __init pvcalls_back_init(void)
1208 {
1209         int ret;
1210
1211         if (!xen_domain())
1212                 return -ENODEV;
1213
1214         ret = xenbus_register_backend(&pvcalls_back_driver);
1215         if (ret < 0)
1216                 return ret;
1217
1218         sema_init(&pvcalls_back_global.frontends_lock, 1);
1219         INIT_LIST_HEAD(&pvcalls_back_global.frontends);
1220         return 0;
1221 }
1222 module_init(pvcalls_back_init);
1223
1224 static void __exit pvcalls_back_fin(void)
1225 {
1226         struct pvcalls_fedata *fedata, *nfedata;
1227
1228         down(&pvcalls_back_global.frontends_lock);
1229         list_for_each_entry_safe(fedata, nfedata,
1230                                  &pvcalls_back_global.frontends, list) {
1231                 backend_disconnect(fedata->dev);
1232         }
1233         up(&pvcalls_back_global.frontends_lock);
1234
1235         xenbus_unregister_driver(&pvcalls_back_driver);
1236 }
1237
1238 module_exit(pvcalls_back_fin);
1239
1240 MODULE_DESCRIPTION("Xen PV Calls backend driver");
1241 MODULE_AUTHOR("Stefano Stabellini <sstabellini@kernel.org>");
1242 MODULE_LICENSE("GPL");