drivers/xen/pvcalls-back.c

   1 /*
   2  * (c) 2017 Stefano Stabellini <stefano@aporeto.com>
   3  *
   4  * This program is free software; you can redistribute it and/or modify
   5  * it under the terms of the GNU General Public License as published by
   6  * the Free Software Foundation; either version 2 of the License, or
   7  * (at your option) any later version.
   8  *
   9  * This program is distributed in the hope that it will be useful,
  10  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  11  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  12  * GNU General Public License for more details.
  13  */
  14
  15 #include <linux/inet.h>
  16 #include <linux/kthread.h>
  17 #include <linux/list.h>
  18 #include <linux/radix-tree.h>
  19 #include <linux/module.h>
  20 #include <linux/semaphore.h>
  21 #include <linux/wait.h>
  22 #include <net/sock.h>
  23 #include <net/inet_common.h>
  24 #include <net/inet_connection_sock.h>
  25 #include <net/request_sock.h>
  26
  27 #include <xen/events.h>
  28 #include <xen/grant_table.h>
  29 #include <xen/xen.h>
  30 #include <xen/xenbus.h>
  31 #include <xen/interface/io/pvcalls.h>
  32
  33 #define PVCALLS_VERSIONS "1"
  34 #define MAX_RING_ORDER XENBUS_MAX_RING_GRANT_ORDER
  35
  36 struct pvcalls_back_global {
  37         struct list_head frontends;
  38         struct semaphore frontends_lock;
  39 } pvcalls_back_global;
  40
  41 /*
  42  * Per-frontend data structure. It contains pointers to the command
  43  * ring, its event channel, a list of active sockets and a tree of
  44  * passive sockets.
  45  */
  46 struct pvcalls_fedata {
  47         struct list_head list;
  48         struct xenbus_device *dev;
  49         struct xen_pvcalls_sring *sring;
  50         struct xen_pvcalls_back_ring ring;
  51         int irq;
  52         struct list_head socket_mappings;
  53         struct radix_tree_root socketpass_mappings;
  54         struct semaphore socket_lock;
  55 };
  56
  57 struct pvcalls_ioworker {
  58         struct work_struct register_work;
  59         struct workqueue_struct *wq;
  60 };
  61
  62 struct sock_mapping {
  63         struct list_head list;
  64         struct pvcalls_fedata *fedata;
  65         struct sockpass_mapping *sockpass;
  66         struct socket *sock;
  67         uint64_t id;
  68         grant_ref_t ref;
  69         struct pvcalls_data_intf *ring;
  70         void *bytes;
  71         struct pvcalls_data data;
  72         uint32_t ring_order;
  73         int irq;
  74         atomic_t read;
  75         atomic_t write;
  76         atomic_t io;
  77         atomic_t release;
  78         atomic_t eoi;
  79         void (*saved_data_ready)(struct sock *sk);
  80         struct pvcalls_ioworker ioworker;
  81 };
  82
  83 struct sockpass_mapping {
  84         struct list_head list;
  85         struct pvcalls_fedata *fedata;
  86         struct socket *sock;
  87         uint64_t id;
  88         struct xen_pvcalls_request reqcopy;
  89         spinlock_t copy_lock;
  90         struct workqueue_struct *wq;
  91         struct work_struct register_work;
  92         void (*saved_data_ready)(struct sock *sk);
  93 };
  94
  95 static irqreturn_t pvcalls_back_conn_event(int irq, void *sock_map);
  96 static int pvcalls_back_release_active(struct xenbus_device *dev,
  97                                        struct pvcalls_fedata *fedata,
  98                                        struct sock_mapping *map);
  99
 100 static bool pvcalls_conn_back_read(void *opaque)
 101 {
 102         struct sock_mapping *map = (struct sock_mapping *)opaque;
 103         struct msghdr msg;
 104         struct kvec vec[2];
 105         RING_IDX cons, prod, size, wanted, array_size, masked_prod, masked_cons;
 106         int32_t error;
 107         struct pvcalls_data_intf *intf = map->ring;
 108         struct pvcalls_data *data = &map->data;
 109         unsigned long flags;
 110         int ret;
 111
 112         array_size = XEN_FLEX_RING_SIZE(map->ring_order);
 113         cons = intf->in_cons;
 114         prod = intf->in_prod;
 115         error = intf->in_error;
 116         /* read the indexes first, then deal with the data */
 117         virt_mb();
 118
 119         if (error)
 120                 return false;
 121
 122         size = pvcalls_queued(prod, cons, array_size);
 123         if (size >= array_size)
 124                 return false;
 125         spin_lock_irqsave(&map->sock->sk->sk_receive_queue.lock, flags);
 126         if (skb_queue_empty(&map->sock->sk->sk_receive_queue)) {
 127                 atomic_set(&map->read, 0);
 128                 spin_unlock_irqrestore(&map->sock->sk->sk_receive_queue.lock,
 129                                 flags);
 130                 return true;
 131         }
 132         spin_unlock_irqrestore(&map->sock->sk->sk_receive_queue.lock, flags);
 133         wanted = array_size - size;
 134         masked_prod = pvcalls_mask(prod, array_size);
 135         masked_cons = pvcalls_mask(cons, array_size);
 136
 137         memset(&msg, 0, sizeof(msg));
 138         if (masked_prod < masked_cons) {
 139                 vec[0].iov_base = data->in + masked_prod;
 140                 vec[0].iov_len = wanted;
 141                 iov_iter_kvec(&msg.msg_iter, ITER_KVEC|WRITE, vec, 1, wanted);
 142         } else {
 143                 vec[0].iov_base = data->in + masked_prod;
 144                 vec[0].iov_len = array_size - masked_prod;
 145                 vec[1].iov_base = data->in;
 146                 vec[1].iov_len = wanted - vec[0].iov_len;
 147                 iov_iter_kvec(&msg.msg_iter, ITER_KVEC|WRITE, vec, 2, wanted);
 148         }
 149
 150         atomic_set(&map->read, 0);
 151         ret = inet_recvmsg(map->sock, &msg, wanted, MSG_DONTWAIT);
 152         WARN_ON(ret > wanted);
 153         if (ret == -EAGAIN) /* shouldn't happen */
 154                 return true;
 155         if (!ret)
 156                 ret = -ENOTCONN;
 157         spin_lock_irqsave(&map->sock->sk->sk_receive_queue.lock, flags);
 158         if (ret > 0 && !skb_queue_empty(&map->sock->sk->sk_receive_queue))
 159                 atomic_inc(&map->read);
 160         spin_unlock_irqrestore(&map->sock->sk->sk_receive_queue.lock, flags);
 161
 162         /* write the data, then modify the indexes */
 163         virt_wmb();
 164         if (ret < 0) {
 165                 atomic_set(&map->read, 0);
 166                 intf->in_error = ret;
 167         } else
 168                 intf->in_prod = prod + ret;
 169         /* update the indexes, then notify the other end */
 170         virt_wmb();
 171         notify_remote_via_irq(map->irq);
 172
 173         return true;
 174 }
 175
 176 static bool pvcalls_conn_back_write(struct sock_mapping *map)
 177 {
 178         struct pvcalls_data_intf *intf = map->ring;
 179         struct pvcalls_data *data = &map->data;
 180         struct msghdr msg;
 181         struct kvec vec[2];
 182         RING_IDX cons, prod, size, array_size;
 183         int ret;
 184
 185         cons = intf->out_cons;
 186         prod = intf->out_prod;
 187         /* read the indexes before dealing with the data */
 188         virt_mb();
 189
 190         array_size = XEN_FLEX_RING_SIZE(map->ring_order);
 191         size = pvcalls_queued(prod, cons, array_size);
 192         if (size == 0)
 193                 return false;
 194
 195         memset(&msg, 0, sizeof(msg));
 196         msg.msg_flags |= MSG_DONTWAIT;
 197         if (pvcalls_mask(prod, array_size) > pvcalls_mask(cons, array_size)) {
 198                 vec[0].iov_base = data->out + pvcalls_mask(cons, array_size);
 199                 vec[0].iov_len = size;
 200                 iov_iter_kvec(&msg.msg_iter, ITER_KVEC|READ, vec, 1, size);
 201         } else {
 202                 vec[0].iov_base = data->out + pvcalls_mask(cons, array_size);
 203                 vec[0].iov_len = array_size - pvcalls_mask(cons, array_size);
 204                 vec[1].iov_base = data->out;
 205                 vec[1].iov_len = size - vec[0].iov_len;
 206                 iov_iter_kvec(&msg.msg_iter, ITER_KVEC|READ, vec, 2, size);
 207         }
 208
 209         atomic_set(&map->write, 0);
 210         ret = inet_sendmsg(map->sock, &msg, size);
 211         if (ret == -EAGAIN) {
 212                 atomic_inc(&map->write);
 213                 atomic_inc(&map->io);
 214                 return true;
 215         }
 216
 217         /* write the data, then update the indexes */
 218         virt_wmb();
 219         if (ret < 0) {
 220                 intf->out_error = ret;
 221         } else {
 222                 intf->out_error = 0;
 223                 intf->out_cons = cons + ret;
 224                 prod = intf->out_prod;
 225         }
 226         /* update the indexes, then notify the other end */
 227         virt_wmb();
 228         if (prod != cons + ret) {
 229                 atomic_inc(&map->write);
 230                 atomic_inc(&map->io);
 231         }
 232         notify_remote_via_irq(map->irq);
 233
 234         return true;
 235 }
 236
 237 static void pvcalls_back_ioworker(struct work_struct *work)
 238 {
 239         struct pvcalls_ioworker *ioworker = container_of(work,
 240                 struct pvcalls_ioworker, register_work);
 241         struct sock_mapping *map = container_of(ioworker, struct sock_mapping,
 242                 ioworker);
 243         unsigned int eoi_flags = XEN_EOI_FLAG_SPURIOUS;
 244
 245         while (atomic_read(&map->io) > 0) {
 246                 if (atomic_read(&map->release) > 0) {
 247                         atomic_set(&map->release, 0);
 248                         return;
 249                 }
 250
 251                 if (atomic_read(&map->read) > 0 &&
 252                     pvcalls_conn_back_read(map))
 253                         eoi_flags = 0;
 254                 if (atomic_read(&map->write) > 0 &&
 255                     pvcalls_conn_back_write(map))
 256                         eoi_flags = 0;
 257
 258                 if (atomic_read(&map->eoi) > 0 && !atomic_read(&map->write)) {
 259                         atomic_set(&map->eoi, 0);
 260                         xen_irq_lateeoi(map->irq, eoi_flags);
 261                         eoi_flags = XEN_EOI_FLAG_SPURIOUS;
 262                 }
 263
 264                 atomic_dec(&map->io);
 265         }
 266 }
 267
 268 static int pvcalls_back_socket(struct xenbus_device *dev,
 269                 struct xen_pvcalls_request *req)
 270 {
 271         struct pvcalls_fedata *fedata;
 272         int ret;
 273         struct xen_pvcalls_response *rsp;
 274
 275         fedata = dev_get_drvdata(&dev->dev);
 276
 277         if (req->u.socket.domain != AF_INET ||
 278             req->u.socket.type != SOCK_STREAM ||
 279             (req->u.socket.protocol != IPPROTO_IP &&
 280              req->u.socket.protocol != AF_INET))
 281                 ret = -EAFNOSUPPORT;
 282         else
 283                 ret = 0;
 284
 285         /* leave the actual socket allocation for later */
 286
 287         rsp = RING_GET_RESPONSE(&fedata->ring, fedata->ring.rsp_prod_pvt++);
 288         rsp->req_id = req->req_id;
 289         rsp->cmd = req->cmd;
 290         rsp->u.socket.id = req->u.socket.id;
 291         rsp->ret = ret;
 292
 293         return 0;
 294 }
 295
 296 static void pvcalls_sk_state_change(struct sock *sock)
 297 {
 298         struct sock_mapping *map = sock->sk_user_data;
 299
 300         if (map == NULL)
 301                 return;
 302
 303         atomic_inc(&map->read);
 304         notify_remote_via_irq(map->irq);
 305 }
 306
 307 static void pvcalls_sk_data_ready(struct sock *sock)
 308 {
 309         struct sock_mapping *map = sock->sk_user_data;
 310         struct pvcalls_ioworker *iow;
 311
 312         if (map == NULL)
 313                 return;
 314
 315         iow = &map->ioworker;
 316         atomic_inc(&map->read);
 317         atomic_inc(&map->io);
 318         queue_work(iow->wq, &iow->register_work);
 319 }
 320
 321 static struct sock_mapping *pvcalls_new_active_socket(
 322                 struct pvcalls_fedata *fedata,
 323                 uint64_t id,
 324                 grant_ref_t ref,
 325                 uint32_t evtchn,
 326                 struct socket *sock)
 327 {
 328         int ret;
 329         struct sock_mapping *map;
 330         void *page;
 331
 332         map = kzalloc(sizeof(*map), GFP_KERNEL);
 333         if (map == NULL)
 334                 return NULL;
 335
 336         map->fedata = fedata;
 337         map->sock = sock;
 338         map->id = id;
 339         map->ref = ref;
 340
 341         ret = xenbus_map_ring_valloc(fedata->dev, &ref, 1, &page);
 342         if (ret < 0)
 343                 goto out;
 344         map->ring = page;
 345         map->ring_order = map->ring->ring_order;
 346         /* first read the order, then map the data ring */
 347         virt_rmb();
 348         if (map->ring_order > MAX_RING_ORDER) {
 349                 pr_warn("%s frontend requested ring_order %u, which is > MAX (%u)\n",
 350                                 __func__, map->ring_order, MAX_RING_ORDER);
 351                 goto out;
 352         }
 353         ret = xenbus_map_ring_valloc(fedata->dev, map->ring->ref,
 354                                      (1 << map->ring_order), &page);
 355         if (ret < 0)
 356                 goto out;
 357         map->bytes = page;
 358
 359         ret = bind_interdomain_evtchn_to_irqhandler_lateeoi(
 360                         fedata->dev->otherend_id, evtchn,
 361                         pvcalls_back_conn_event, 0, "pvcalls-backend", map);
 362         if (ret < 0)
 363                 goto out;
 364         map->irq = ret;
 365
 366         map->data.in = map->bytes;
 367         map->data.out = map->bytes + XEN_FLEX_RING_SIZE(map->ring_order);
 368
 369         map->ioworker.wq = alloc_workqueue("pvcalls_io", WQ_UNBOUND, 1);
 370         if (!map->ioworker.wq)
 371                 goto out;
 372         atomic_set(&map->io, 1);
 373         INIT_WORK(&map->ioworker.register_work, pvcalls_back_ioworker);
 374
 375         down(&fedata->socket_lock);
 376         list_add_tail(&map->list, &fedata->socket_mappings);
 377         up(&fedata->socket_lock);
 378
 379         write_lock_bh(&map->sock->sk->sk_callback_lock);
 380         map->saved_data_ready = map->sock->sk->sk_data_ready;
 381         map->sock->sk->sk_user_data = map;
 382         map->sock->sk->sk_data_ready = pvcalls_sk_data_ready;
 383         map->sock->sk->sk_state_change = pvcalls_sk_state_change;
 384         write_unlock_bh(&map->sock->sk->sk_callback_lock);
 385
 386         return map;
 387 out:
 388         down(&fedata->socket_lock);
 389         list_del(&map->list);
 390         pvcalls_back_release_active(fedata->dev, fedata, map);
 391         up(&fedata->socket_lock);
 392         return NULL;
 393 }
 394
 395 static int pvcalls_back_connect(struct xenbus_device *dev,
 396                                 struct xen_pvcalls_request *req)
 397 {
 398         struct pvcalls_fedata *fedata;
 399         int ret = -EINVAL;
 400         struct socket *sock;
 401         struct sock_mapping *map;
 402         struct xen_pvcalls_response *rsp;
 403         struct sockaddr *sa = (struct sockaddr *)&req->u.connect.addr;
 404
 405         fedata = dev_get_drvdata(&dev->dev);
 406
 407         if (req->u.connect.len < sizeof(sa->sa_family) ||
 408             req->u.connect.len > sizeof(req->u.connect.addr) ||
 409             sa->sa_family != AF_INET)
 410                 goto out;
 411
 412         ret = sock_create(AF_INET, SOCK_STREAM, 0, &sock);
 413         if (ret < 0)
 414                 goto out;
 415         ret = inet_stream_connect(sock, sa, req->u.connect.len, 0);
 416         if (ret < 0) {
 417                 sock_release(sock);
 418                 goto out;
 419         }
 420
 421         map = pvcalls_new_active_socket(fedata,
 422                                         req->u.connect.id,
 423                                         req->u.connect.ref,
 424                                         req->u.connect.evtchn,
 425                                         sock);
 426         if (!map) {
 427                 ret = -EFAULT;
 428                 sock_release(sock);
 429         }
 430
 431 out:
 432         rsp = RING_GET_RESPONSE(&fedata->ring, fedata->ring.rsp_prod_pvt++);
 433         rsp->req_id = req->req_id;
 434         rsp->cmd = req->cmd;
 435         rsp->u.connect.id = req->u.connect.id;
 436         rsp->ret = ret;
 437
 438         return 0;
 439 }
 440
 441 static int pvcalls_back_release_active(struct xenbus_device *dev,
 442                                        struct pvcalls_fedata *fedata,
 443                                        struct sock_mapping *map)
 444 {
 445         disable_irq(map->irq);
 446         if (map->sock->sk != NULL) {
 447                 write_lock_bh(&map->sock->sk->sk_callback_lock);
 448                 map->sock->sk->sk_user_data = NULL;
 449                 map->sock->sk->sk_data_ready = map->saved_data_ready;
 450                 write_unlock_bh(&map->sock->sk->sk_callback_lock);
 451         }
 452
 453         atomic_set(&map->release, 1);
 454         flush_work(&map->ioworker.register_work);
 455
 456         xenbus_unmap_ring_vfree(dev, map->bytes);
 457         xenbus_unmap_ring_vfree(dev, (void *)map->ring);
 458         unbind_from_irqhandler(map->irq, map);
 459
 460         sock_release(map->sock);
 461         kfree(map);
 462
 463         return 0;
 464 }
 465
 466 static int pvcalls_back_release_passive(struct xenbus_device *dev,
 467                                         struct pvcalls_fedata *fedata,
 468                                         struct sockpass_mapping *mappass)
 469 {
 470         if (mappass->sock->sk != NULL) {
 471                 write_lock_bh(&mappass->sock->sk->sk_callback_lock);
 472                 mappass->sock->sk->sk_user_data = NULL;
 473                 mappass->sock->sk->sk_data_ready = mappass->saved_data_ready;
 474                 write_unlock_bh(&mappass->sock->sk->sk_callback_lock);
 475         }
 476         sock_release(mappass->sock);
 477         flush_workqueue(mappass->wq);
 478         destroy_workqueue(mappass->wq);
 479         kfree(mappass);
 480
 481         return 0;
 482 }
 483
 484 static int pvcalls_back_release(struct xenbus_device *dev,
 485                                 struct xen_pvcalls_request *req)
 486 {
 487         struct pvcalls_fedata *fedata;
 488         struct sock_mapping *map, *n;
 489         struct sockpass_mapping *mappass;
 490         int ret = 0;
 491         struct xen_pvcalls_response *rsp;
 492
 493         fedata = dev_get_drvdata(&dev->dev);
 494
 495         down(&fedata->socket_lock);
 496         list_for_each_entry_safe(map, n, &fedata->socket_mappings, list) {
 497                 if (map->id == req->u.release.id) {
 498                         list_del(&map->list);
 499                         up(&fedata->socket_lock);
 500                         ret = pvcalls_back_release_active(dev, fedata, map);
 501                         goto out;
 502                 }
 503         }
 504         mappass = radix_tree_lookup(&fedata->socketpass_mappings,
 505                                     req->u.release.id);
 506         if (mappass != NULL) {
 507                 radix_tree_delete(&fedata->socketpass_mappings, mappass->id);
 508                 up(&fedata->socket_lock);
 509                 ret = pvcalls_back_release_passive(dev, fedata, mappass);
 510         } else
 511                 up(&fedata->socket_lock);
 512
 513 out:
 514         rsp = RING_GET_RESPONSE(&fedata->ring, fedata->ring.rsp_prod_pvt++);
 515         rsp->req_id = req->req_id;
 516         rsp->u.release.id = req->u.release.id;
 517         rsp->cmd = req->cmd;
 518         rsp->ret = ret;
 519         return 0;
 520 }
 521
 522 static void __pvcalls_back_accept(struct work_struct *work)
 523 {
 524         struct sockpass_mapping *mappass = container_of(
 525                 work, struct sockpass_mapping, register_work);
 526         struct sock_mapping *map;
 527         struct pvcalls_ioworker *iow;
 528         struct pvcalls_fedata *fedata;
 529         struct socket *sock;
 530         struct xen_pvcalls_response *rsp;
 531         struct xen_pvcalls_request *req;
 532         int notify;
 533         int ret = -EINVAL;
 534         unsigned long flags;
 535
 536         fedata = mappass->fedata;
 537         /*
 538          * __pvcalls_back_accept can race against pvcalls_back_accept.
 539          * We only need to check the value of "cmd" on read. It could be
 540          * done atomically, but to simplify the code on the write side, we
 541          * use a spinlock.
 542          */
 543         spin_lock_irqsave(&mappass->copy_lock, flags);
 544         req = &mappass->reqcopy;
 545         if (req->cmd != PVCALLS_ACCEPT) {
 546                 spin_unlock_irqrestore(&mappass->copy_lock, flags);
 547                 return;
 548         }
 549         spin_unlock_irqrestore(&mappass->copy_lock, flags);
 550
 551         sock = sock_alloc();
 552         if (sock == NULL)
 553                 goto out_error;
 554         sock->type = mappass->sock->type;
 555         sock->ops = mappass->sock->ops;
 556
 557         ret = inet_accept(mappass->sock, sock, O_NONBLOCK, true);
 558         if (ret == -EAGAIN) {
 559                 sock_release(sock);
 560                 return;
 561         }
 562
 563         map = pvcalls_new_active_socket(fedata,
 564                                         req->u.accept.id_new,
 565                                         req->u.accept.ref,
 566                                         req->u.accept.evtchn,
 567                                         sock);
 568         if (!map) {
 569                 ret = -EFAULT;
 570                 sock_release(sock);
 571                 goto out_error;
 572         }
 573
 574         map->sockpass = mappass;
 575         iow = &map->ioworker;
 576         atomic_inc(&map->read);
 577         atomic_inc(&map->io);
 578         queue_work(iow->wq, &iow->register_work);
 579
 580 out_error:
 581         rsp = RING_GET_RESPONSE(&fedata->ring, fedata->ring.rsp_prod_pvt++);
 582         rsp->req_id = req->req_id;
 583         rsp->cmd = req->cmd;
 584         rsp->u.accept.id = req->u.accept.id;
 585         rsp->ret = ret;
 586         RING_PUSH_RESPONSES_AND_CHECK_NOTIFY(&fedata->ring, notify);
 587         if (notify)
 588                 notify_remote_via_irq(fedata->irq);
 589
 590         mappass->reqcopy.cmd = 0;
 591 }
 592
 593 static void pvcalls_pass_sk_data_ready(struct sock *sock)
 594 {
 595         struct sockpass_mapping *mappass = sock->sk_user_data;
 596         struct pvcalls_fedata *fedata;
 597         struct xen_pvcalls_response *rsp;
 598         unsigned long flags;
 599         int notify;
 600
 601         if (mappass == NULL)
 602                 return;
 603
 604         fedata = mappass->fedata;
 605         spin_lock_irqsave(&mappass->copy_lock, flags);
 606         if (mappass->reqcopy.cmd == PVCALLS_POLL) {
 607                 rsp = RING_GET_RESPONSE(&fedata->ring,
 608                                         fedata->ring.rsp_prod_pvt++);
 609                 rsp->req_id = mappass->reqcopy.req_id;
 610                 rsp->u.poll.id = mappass->reqcopy.u.poll.id;
 611                 rsp->cmd = mappass->reqcopy.cmd;
 612                 rsp->ret = 0;
 613
 614                 mappass->reqcopy.cmd = 0;
 615                 spin_unlock_irqrestore(&mappass->copy_lock, flags);
 616
 617                 RING_PUSH_RESPONSES_AND_CHECK_NOTIFY(&fedata->ring, notify);
 618                 if (notify)
 619                         notify_remote_via_irq(mappass->fedata->irq);
 620         } else {
 621                 spin_unlock_irqrestore(&mappass->copy_lock, flags);
 622                 queue_work(mappass->wq, &mappass->register_work);
 623         }
 624 }
 625
 626 static int pvcalls_back_bind(struct xenbus_device *dev,
 627                              struct xen_pvcalls_request *req)
 628 {
 629         struct pvcalls_fedata *fedata;
 630         int ret;
 631         struct sockpass_mapping *map;
 632         struct xen_pvcalls_response *rsp;
 633
 634         fedata = dev_get_drvdata(&dev->dev);
 635
 636         map = kzalloc(sizeof(*map), GFP_KERNEL);
 637         if (map == NULL) {
 638                 ret = -ENOMEM;
 639                 goto out;
 640         }
 641
 642         INIT_WORK(&map->register_work, __pvcalls_back_accept);
 643         spin_lock_init(&map->copy_lock);
 644         map->wq = alloc_workqueue("pvcalls_wq", WQ_UNBOUND, 1);
 645         if (!map->wq) {
 646                 ret = -ENOMEM;
 647                 goto out;
 648         }
 649
 650         ret = sock_create(AF_INET, SOCK_STREAM, 0, &map->sock);
 651         if (ret < 0)
 652                 goto out;
 653
 654         ret = inet_bind(map->sock, (struct sockaddr *)&req->u.bind.addr,
 655                         req->u.bind.len);
 656         if (ret < 0)
 657                 goto out;
 658
 659         map->fedata = fedata;
 660         map->id = req->u.bind.id;
 661
 662         down(&fedata->socket_lock);
 663         ret = radix_tree_insert(&fedata->socketpass_mappings, map->id,
 664                                 map);
 665         up(&fedata->socket_lock);
 666         if (ret)
 667                 goto out;
 668
 669         write_lock_bh(&map->sock->sk->sk_callback_lock);
 670         map->saved_data_ready = map->sock->sk->sk_data_ready;
 671         map->sock->sk->sk_user_data = map;
 672         map->sock->sk->sk_data_ready = pvcalls_pass_sk_data_ready;
 673         write_unlock_bh(&map->sock->sk->sk_callback_lock);
 674
 675 out:
 676         if (ret) {
 677                 if (map && map->sock)
 678                         sock_release(map->sock);
 679                 if (map && map->wq)
 680                         destroy_workqueue(map->wq);
 681                 kfree(map);
 682         }
 683         rsp = RING_GET_RESPONSE(&fedata->ring, fedata->ring.rsp_prod_pvt++);
 684         rsp->req_id = req->req_id;
 685         rsp->cmd = req->cmd;
 686         rsp->u.bind.id = req->u.bind.id;
 687         rsp->ret = ret;
 688         return 0;
 689 }
 690
 691 static int pvcalls_back_listen(struct xenbus_device *dev,
 692                                struct xen_pvcalls_request *req)
 693 {
 694         struct pvcalls_fedata *fedata;
 695         int ret = -EINVAL;
 696         struct sockpass_mapping *map;
 697         struct xen_pvcalls_response *rsp;
 698
 699         fedata = dev_get_drvdata(&dev->dev);
 700
 701         down(&fedata->socket_lock);
 702         map = radix_tree_lookup(&fedata->socketpass_mappings, req->u.listen.id);
 703         up(&fedata->socket_lock);
 704         if (map == NULL)
 705                 goto out;
 706
 707         ret = inet_listen(map->sock, req->u.listen.backlog);
 708
 709 out:
 710         rsp = RING_GET_RESPONSE(&fedata->ring, fedata->ring.rsp_prod_pvt++);
 711         rsp->req_id = req->req_id;
 712         rsp->cmd = req->cmd;
 713         rsp->u.listen.id = req->u.listen.id;
 714         rsp->ret = ret;
 715         return 0;
 716 }
 717
 718 static int pvcalls_back_accept(struct xenbus_device *dev,
 719                                struct xen_pvcalls_request *req)
 720 {
 721         struct pvcalls_fedata *fedata;
 722         struct sockpass_mapping *mappass;
 723         int ret = -EINVAL;
 724         struct xen_pvcalls_response *rsp;
 725         unsigned long flags;
 726
 727         fedata = dev_get_drvdata(&dev->dev);
 728
 729         down(&fedata->socket_lock);
 730         mappass = radix_tree_lookup(&fedata->socketpass_mappings,
 731                 req->u.accept.id);
 732         up(&fedata->socket_lock);
 733         if (mappass == NULL)
 734                 goto out_error;
 735
 736         /*
 737          * Limitation of the current implementation: only support one
 738          * concurrent accept or poll call on one socket.
 739          */
 740         spin_lock_irqsave(&mappass->copy_lock, flags);
 741         if (mappass->reqcopy.cmd != 0) {
 742                 spin_unlock_irqrestore(&mappass->copy_lock, flags);
 743                 ret = -EINTR;
 744                 goto out_error;
 745         }
 746
 747         mappass->reqcopy = *req;
 748         spin_unlock_irqrestore(&mappass->copy_lock, flags);
 749         queue_work(mappass->wq, &mappass->register_work);
 750
 751         /* Tell the caller we don't need to send back a notification yet */
 752         return -1;
 753
 754 out_error:
 755         rsp = RING_GET_RESPONSE(&fedata->ring, fedata->ring.rsp_prod_pvt++);
 756         rsp->req_id = req->req_id;
 757         rsp->cmd = req->cmd;
 758         rsp->u.accept.id = req->u.accept.id;
 759         rsp->ret = ret;
 760         return 0;
 761 }
 762
 763 static int pvcalls_back_poll(struct xenbus_device *dev,
 764                              struct xen_pvcalls_request *req)
 765 {
 766         struct pvcalls_fedata *fedata;
 767         struct sockpass_mapping *mappass;
 768         struct xen_pvcalls_response *rsp;
 769         struct inet_connection_sock *icsk;
 770         struct request_sock_queue *queue;
 771         unsigned long flags;
 772         int ret;
 773         bool data;
 774
 775         fedata = dev_get_drvdata(&dev->dev);
 776
 777         down(&fedata->socket_lock);
 778         mappass = radix_tree_lookup(&fedata->socketpass_mappings,
 779                                     req->u.poll.id);
 780         up(&fedata->socket_lock);
 781         if (mappass == NULL)
 782                 return -EINVAL;
 783
 784         /*
 785          * Limitation of the current implementation: only support one
 786          * concurrent accept or poll call on one socket.
 787          */
 788         spin_lock_irqsave(&mappass->copy_lock, flags);
 789         if (mappass->reqcopy.cmd != 0) {
 790                 ret = -EINTR;
 791                 goto out;
 792         }
 793
 794         mappass->reqcopy = *req;
 795         icsk = inet_csk(mappass->sock->sk);
 796         queue = &icsk->icsk_accept_queue;
 797         data = READ_ONCE(queue->rskq_accept_head) != NULL;
 798         if (data) {
 799                 mappass->reqcopy.cmd = 0;
 800                 ret = 0;
 801                 goto out;
 802         }
 803         spin_unlock_irqrestore(&mappass->copy_lock, flags);
 804
 805         /* Tell the caller we don't need to send back a notification yet */
 806         return -1;
 807
 808 out:
 809         spin_unlock_irqrestore(&mappass->copy_lock, flags);
 810
 811         rsp = RING_GET_RESPONSE(&fedata->ring, fedata->ring.rsp_prod_pvt++);
 812         rsp->req_id = req->req_id;
 813         rsp->cmd = req->cmd;
 814         rsp->u.poll.id = req->u.poll.id;
 815         rsp->ret = ret;
 816         return 0;
 817 }
 818
 819 static int pvcalls_back_handle_cmd(struct xenbus_device *dev,
 820                                    struct xen_pvcalls_request *req)
 821 {
 822         int ret = 0;
 823
 824         switch (req->cmd) {
 825         case PVCALLS_SOCKET:
 826                 ret = pvcalls_back_socket(dev, req);
 827                 break;
 828         case PVCALLS_CONNECT:
 829                 ret = pvcalls_back_connect(dev, req);
 830                 break;
 831         case PVCALLS_RELEASE:
 832                 ret = pvcalls_back_release(dev, req);
 833                 break;
 834         case PVCALLS_BIND:
 835                 ret = pvcalls_back_bind(dev, req);
 836                 break;
 837         case PVCALLS_LISTEN:
 838                 ret = pvcalls_back_listen(dev, req);
 839                 break;
 840         case PVCALLS_ACCEPT:
 841                 ret = pvcalls_back_accept(dev, req);
 842                 break;
 843         case PVCALLS_POLL:
 844                 ret = pvcalls_back_poll(dev, req);
 845                 break;
 846         default:
 847         {
 848                 struct pvcalls_fedata *fedata;
 849                 struct xen_pvcalls_response *rsp;
 850
 851                 fedata = dev_get_drvdata(&dev->dev);
 852                 rsp = RING_GET_RESPONSE(
 853                                 &fedata->ring, fedata->ring.rsp_prod_pvt++);
 854                 rsp->req_id = req->req_id;
 855                 rsp->cmd = req->cmd;
 856                 rsp->ret = -ENOTSUPP;
 857                 break;
 858         }
 859         }
 860         return ret;
 861 }
 862
 863 static void pvcalls_back_work(struct pvcalls_fedata *fedata)
 864 {
 865         int notify, notify_all = 0, more = 1;
 866         struct xen_pvcalls_request req;
 867         struct xenbus_device *dev = fedata->dev;
 868
 869         while (more) {
 870                 while (RING_HAS_UNCONSUMED_REQUESTS(&fedata->ring)) {
 871                         RING_COPY_REQUEST(&fedata->ring,
 872                                           fedata->ring.req_cons++,
 873                                           &req);
 874
 875                         if (!pvcalls_back_handle_cmd(dev, &req)) {
 876                                 RING_PUSH_RESPONSES_AND_CHECK_NOTIFY(
 877                                         &fedata->ring, notify);
 878                                 notify_all += notify;
 879                         }
 880                 }
 881
 882                 if (notify_all) {
 883                         notify_remote_via_irq(fedata->irq);
 884                         notify_all = 0;
 885                 }
 886
 887                 RING_FINAL_CHECK_FOR_REQUESTS(&fedata->ring, more);
 888         }
 889 }
 890
 891 static irqreturn_t pvcalls_back_event(int irq, void *dev_id)
 892 {
 893         struct xenbus_device *dev = dev_id;
 894         struct pvcalls_fedata *fedata = NULL;
 895         unsigned int eoi_flags = XEN_EOI_FLAG_SPURIOUS;
 896
 897         if (dev) {
 898                 fedata = dev_get_drvdata(&dev->dev);
 899                 if (fedata) {
 900                         pvcalls_back_work(fedata);
 901                         eoi_flags = 0;
 902                 }
 903         }
 904
 905         xen_irq_lateeoi(irq, eoi_flags);
 906
 907         return IRQ_HANDLED;
 908 }
 909
 910 static irqreturn_t pvcalls_back_conn_event(int irq, void *sock_map)
 911 {
 912         struct sock_mapping *map = sock_map;
 913         struct pvcalls_ioworker *iow;
 914
 915         if (map == NULL || map->sock == NULL || map->sock->sk == NULL ||
 916                 map->sock->sk->sk_user_data != map) {
 917                 xen_irq_lateeoi(irq, 0);
 918                 return IRQ_HANDLED;
 919         }
 920
 921         iow = &map->ioworker;
 922
 923         atomic_inc(&map->write);
 924         atomic_inc(&map->eoi);
 925         atomic_inc(&map->io);
 926         queue_work(iow->wq, &iow->register_work);
 927
 928         return IRQ_HANDLED;
 929 }
 930
 931 static int backend_connect(struct xenbus_device *dev)
 932 {
 933         int err, evtchn;
 934         grant_ref_t ring_ref;
 935         struct pvcalls_fedata *fedata = NULL;
 936
 937         fedata = kzalloc(sizeof(struct pvcalls_fedata), GFP_KERNEL);
 938         if (!fedata)
 939                 return -ENOMEM;
 940
 941         fedata->irq = -1;
 942         err = xenbus_scanf(XBT_NIL, dev->otherend, "port", "%u",
 943                            &evtchn);
 944         if (err != 1) {
 945                 err = -EINVAL;
 946                 xenbus_dev_fatal(dev, err, "reading %s/event-channel",
 947                                  dev->otherend);
 948                 goto error;
 949         }
 950
 951         err = xenbus_scanf(XBT_NIL, dev->otherend, "ring-ref", "%u", &ring_ref);
 952         if (err != 1) {
 953                 err = -EINVAL;
 954                 xenbus_dev_fatal(dev, err, "reading %s/ring-ref",
 955                                  dev->otherend);
 956                 goto error;
 957         }
 958
 959         err = bind_interdomain_evtchn_to_irq_lateeoi(dev->otherend_id, evtchn);
 960         if (err < 0)
 961                 goto error;
 962         fedata->irq = err;
 963
 964         err = request_threaded_irq(fedata->irq, NULL, pvcalls_back_event,
 965                                    IRQF_ONESHOT, "pvcalls-back", dev);
 966         if (err < 0)
 967                 goto error;
 968
 969         err = xenbus_map_ring_valloc(dev, &ring_ref, 1,
 970                                      (void **)&fedata->sring);
 971         if (err < 0)
 972                 goto error;
 973
 974         BACK_RING_INIT(&fedata->ring, fedata->sring, XEN_PAGE_SIZE * 1);
 975         fedata->dev = dev;
 976
 977         INIT_LIST_HEAD(&fedata->socket_mappings);
 978         INIT_RADIX_TREE(&fedata->socketpass_mappings, GFP_KERNEL);
 979         sema_init(&fedata->socket_lock, 1);
 980         dev_set_drvdata(&dev->dev, fedata);
 981
 982         down(&pvcalls_back_global.frontends_lock);
 983         list_add_tail(&fedata->list, &pvcalls_back_global.frontends);
 984         up(&pvcalls_back_global.frontends_lock);
 985
 986         return 0;
 987
 988  error:
 989         if (fedata->irq >= 0)
 990                 unbind_from_irqhandler(fedata->irq, dev);
 991         if (fedata->sring != NULL)
 992                 xenbus_unmap_ring_vfree(dev, fedata->sring);
 993         kfree(fedata);
 994         return err;
 995 }
 996
 997 static int backend_disconnect(struct xenbus_device *dev)
 998 {
 999         struct pvcalls_fedata *fedata;
1000         struct sock_mapping *map, *n;
1001         struct sockpass_mapping *mappass;
1002         struct radix_tree_iter iter;
1003         void **slot;
1004
1005
1006         fedata = dev_get_drvdata(&dev->dev);
1007
1008         down(&fedata->socket_lock);
1009         list_for_each_entry_safe(map, n, &fedata->socket_mappings, list) {
1010                 list_del(&map->list);
1011                 pvcalls_back_release_active(dev, fedata, map);
1012         }
1013
1014         radix_tree_for_each_slot(slot, &fedata->socketpass_mappings, &iter, 0) {
1015                 mappass = radix_tree_deref_slot(slot);
1016                 if (!mappass)
1017                         continue;
1018                 if (radix_tree_exception(mappass)) {
1019                         if (radix_tree_deref_retry(mappass))
1020                                 slot = radix_tree_iter_retry(&iter);
1021                 } else {
1022                         radix_tree_delete(&fedata->socketpass_mappings,
1023                                           mappass->id);
1024                         pvcalls_back_release_passive(dev, fedata, mappass);
1025                 }
1026         }
1027         up(&fedata->socket_lock);
1028
1029         unbind_from_irqhandler(fedata->irq, dev);
1030         xenbus_unmap_ring_vfree(dev, fedata->sring);
1031
1032         list_del(&fedata->list);
1033         kfree(fedata);
1034         dev_set_drvdata(&dev->dev, NULL);
1035
1036         return 0;
1037 }
1038
1039 static int pvcalls_back_probe(struct xenbus_device *dev,
1040                               const struct xenbus_device_id *id)
1041 {
1042         int err, abort;
1043         struct xenbus_transaction xbt;
1044
1045 again:
1046         abort = 1;
1047
1048         err = xenbus_transaction_start(&xbt);
1049         if (err) {
1050                 pr_warn("%s cannot create xenstore transaction\n", __func__);
1051                 return err;
1052         }
1053
1054         err = xenbus_printf(xbt, dev->nodename, "versions", "%s",
1055                             PVCALLS_VERSIONS);
1056         if (err) {
1057                 pr_warn("%s write out 'versions' failed\n", __func__);
1058                 goto abort;
1059         }
1060
1061         err = xenbus_printf(xbt, dev->nodename, "max-page-order", "%u",
1062                             MAX_RING_ORDER);
1063         if (err) {
1064                 pr_warn("%s write out 'max-page-order' failed\n", __func__);
1065                 goto abort;
1066         }
1067
1068         err = xenbus_printf(xbt, dev->nodename, "function-calls",
1069                             XENBUS_FUNCTIONS_CALLS);
1070         if (err) {
1071                 pr_warn("%s write out 'function-calls' failed\n", __func__);
1072                 goto abort;
1073         }
1074
1075         abort = 0;
1076 abort:
1077         err = xenbus_transaction_end(xbt, abort);
1078         if (err) {
1079                 if (err == -EAGAIN && !abort)
1080                         goto again;
1081                 pr_warn("%s cannot complete xenstore transaction\n", __func__);
1082                 return err;
1083         }
1084
1085         if (abort)
1086                 return -EFAULT;
1087
1088         xenbus_switch_state(dev, XenbusStateInitWait);
1089
1090         return 0;
1091 }
1092
1093 static void set_backend_state(struct xenbus_device *dev,
1094                               enum xenbus_state state)
1095 {
1096         while (dev->state != state) {
1097                 switch (dev->state) {
1098                 case XenbusStateClosed:
1099                         switch (state) {
1100                         case XenbusStateInitWait:
1101                         case XenbusStateConnected:
1102                                 xenbus_switch_state(dev, XenbusStateInitWait);
1103                                 break;
1104                         case XenbusStateClosing:
1105                                 xenbus_switch_state(dev, XenbusStateClosing);
1106                                 break;
1107                         default:
1108                                 WARN_ON(1);
1109                         }
1110                         break;
1111                 case XenbusStateInitWait:
1112                 case XenbusStateInitialised:
1113                         switch (state) {
1114                         case XenbusStateConnected:
1115                                 if (backend_connect(dev))
1116                                         return;
1117                                 xenbus_switch_state(dev, XenbusStateConnected);
1118                                 break;
1119                         case XenbusStateClosing:
1120                         case XenbusStateClosed:
1121                                 xenbus_switch_state(dev, XenbusStateClosing);
1122                                 break;
1123                         default:
1124                                 WARN_ON(1);
1125                         }
1126                         break;
1127                 case XenbusStateConnected:
1128                         switch (state) {
1129                         case XenbusStateInitWait:
1130                         case XenbusStateClosing:
1131                         case XenbusStateClosed:
1132                                 down(&pvcalls_back_global.frontends_lock);
1133                                 backend_disconnect(dev);
1134                                 up(&pvcalls_back_global.frontends_lock);
1135                                 xenbus_switch_state(dev, XenbusStateClosing);
1136                                 break;
1137                         default:
1138                                 WARN_ON(1);
1139                         }
1140                         break;
1141                 case XenbusStateClosing:
1142                         switch (state) {
1143                         case XenbusStateInitWait:
1144                         case XenbusStateConnected:
1145                         case XenbusStateClosed:
1146                                 xenbus_switch_state(dev, XenbusStateClosed);
1147                                 break;
1148                         default:
1149                                 WARN_ON(1);
1150                         }
1151                         break;
1152                 default:
1153                         WARN_ON(1);
1154                 }
1155         }
1156 }
1157
1158 static void pvcalls_back_changed(struct xenbus_device *dev,
1159                                  enum xenbus_state frontend_state)
1160 {
1161         switch (frontend_state) {
1162         case XenbusStateInitialising:
1163                 set_backend_state(dev, XenbusStateInitWait);
1164                 break;
1165
1166         case XenbusStateInitialised:
1167         case XenbusStateConnected:
1168                 set_backend_state(dev, XenbusStateConnected);
1169                 break;
1170
1171         case XenbusStateClosing:
1172                 set_backend_state(dev, XenbusStateClosing);
1173                 break;
1174
1175         case XenbusStateClosed:
1176                 set_backend_state(dev, XenbusStateClosed);
1177                 if (xenbus_dev_is_online(dev))
1178                         break;
1179                 device_unregister(&dev->dev);
1180                 break;
1181         case XenbusStateUnknown:
1182                 set_backend_state(dev, XenbusStateClosed);
1183                 device_unregister(&dev->dev);
1184                 break;
1185
1186         default:
1187                 xenbus_dev_fatal(dev, -EINVAL, "saw state %d at frontend",
1188                                  frontend_state);
1189                 break;
1190         }
1191 }
1192
1193 static int pvcalls_back_remove(struct xenbus_device *dev)
1194 {
1195         return 0;
1196 }
1197
1198 static int pvcalls_back_uevent(struct xenbus_device *xdev,
1199                                struct kobj_uevent_env *env)
1200 {
1201         return 0;
1202 }
1203
1204 static const struct xenbus_device_id pvcalls_back_ids[] = {
1205         { "pvcalls" },
1206         { "" }
1207 };
1208
1209 static struct xenbus_driver pvcalls_back_driver = {
1210         .ids = pvcalls_back_ids,
1211         .probe = pvcalls_back_probe,
1212         .remove = pvcalls_back_remove,
1213         .uevent = pvcalls_back_uevent,
1214         .otherend_changed = pvcalls_back_changed,
1215 };
1216
1217 static int __init pvcalls_back_init(void)
1218 {
1219         int ret;
1220
1221         if (!xen_domain())
1222                 return -ENODEV;
1223
1224         ret = xenbus_register_backend(&pvcalls_back_driver);
1225         if (ret < 0)
1226                 return ret;
1227
1228         sema_init(&pvcalls_back_global.frontends_lock, 1);
1229         INIT_LIST_HEAD(&pvcalls_back_global.frontends);
1230         return 0;
1231 }
1232 module_init(pvcalls_back_init);
1233
1234 static void __exit pvcalls_back_fin(void)
1235 {
1236         struct pvcalls_fedata *fedata, *nfedata;
1237
1238         down(&pvcalls_back_global.frontends_lock);
1239         list_for_each_entry_safe(fedata, nfedata,
1240                                  &pvcalls_back_global.frontends, list) {
1241                 backend_disconnect(fedata->dev);
1242         }
1243         up(&pvcalls_back_global.frontends_lock);
1244
1245         xenbus_unregister_driver(&pvcalls_back_driver);
1246 }
1247
1248 module_exit(pvcalls_back_fin);
1249
1250 MODULE_DESCRIPTION("Xen PV Calls backend driver");
1251 MODULE_AUTHOR("Stefano Stabellini <sstabellini@kernel.org>");
1252 MODULE_LICENSE("GPL");