drivers/xen/pvcalls-back.c

   1 /*
   2  * (c) 2017 Stefano Stabellini <stefano@aporeto.com>
   3  *
   4  * This program is free software; you can redistribute it and/or modify
   5  * it under the terms of the GNU General Public License as published by
   6  * the Free Software Foundation; either version 2 of the License, or
   7  * (at your option) any later version.
   8  *
   9  * This program is distributed in the hope that it will be useful,
  10  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  11  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  12  * GNU General Public License for more details.
  13  */
  14
  15 #include <linux/inet.h>
  16 #include <linux/kthread.h>
  17 #include <linux/list.h>
  18 #include <linux/radix-tree.h>
  19 #include <linux/module.h>
  20 #include <linux/semaphore.h>
  21 #include <linux/wait.h>
  22 #include <net/sock.h>
  23 #include <net/inet_common.h>
  24 #include <net/inet_connection_sock.h>
  25 #include <net/request_sock.h>
  26
  27 #include <xen/events.h>
  28 #include <xen/grant_table.h>
  29 #include <xen/xen.h>
  30 #include <xen/xenbus.h>
  31 #include <xen/interface/io/pvcalls.h>
  32
  33 #define PVCALLS_VERSIONS "1"
  34 #define MAX_RING_ORDER XENBUS_MAX_RING_GRANT_ORDER
  35
  36 struct pvcalls_back_global {
  37         struct list_head frontends;
  38         struct semaphore frontends_lock;
  39 } pvcalls_back_global;
  40
  41 /*
  42  * Per-frontend data structure. It contains pointers to the command
  43  * ring, its event channel, a list of active sockets and a tree of
  44  * passive sockets.
  45  */
  46 struct pvcalls_fedata {
  47         struct list_head list;
  48         struct xenbus_device *dev;
  49         struct xen_pvcalls_sring *sring;
  50         struct xen_pvcalls_back_ring ring;
  51         int irq;
  52         struct list_head socket_mappings;
  53         struct radix_tree_root socketpass_mappings;
  54         struct semaphore socket_lock;
  55 };
  56
  57 struct pvcalls_ioworker {
  58         struct work_struct register_work;
  59         struct workqueue_struct *wq;
  60 };
  61
  62 struct sock_mapping {
  63         struct list_head list;
  64         struct pvcalls_fedata *fedata;
  65         struct sockpass_mapping *sockpass;
  66         struct socket *sock;
  67         uint64_t id;
  68         grant_ref_t ref;
  69         struct pvcalls_data_intf *ring;
  70         void *bytes;
  71         struct pvcalls_data data;
  72         uint32_t ring_order;
  73         int irq;
  74         atomic_t read;
  75         atomic_t write;
  76         atomic_t io;
  77         atomic_t release;
  78         atomic_t eoi;
  79         void (*saved_data_ready)(struct sock *sk);
  80         struct pvcalls_ioworker ioworker;
  81 };
  82
  83 struct sockpass_mapping {
  84         struct list_head list;
  85         struct pvcalls_fedata *fedata;
  86         struct socket *sock;
  87         uint64_t id;
  88         struct xen_pvcalls_request reqcopy;
  89         spinlock_t copy_lock;
  90         struct workqueue_struct *wq;
  91         struct work_struct register_work;
  92         void (*saved_data_ready)(struct sock *sk);
  93 };
  94
  95 static irqreturn_t pvcalls_back_conn_event(int irq, void *sock_map);
  96 static int pvcalls_back_release_active(struct xenbus_device *dev,
  97                                        struct pvcalls_fedata *fedata,
  98                                        struct sock_mapping *map);
  99
 100 static bool pvcalls_conn_back_read(void *opaque)
 101 {
 102         struct sock_mapping *map = (struct sock_mapping *)opaque;
 103         struct msghdr msg;
 104         struct kvec vec[2];
 105         RING_IDX cons, prod, size, wanted, array_size, masked_prod, masked_cons;
 106         int32_t error;
 107         struct pvcalls_data_intf *intf = map->ring;
 108         struct pvcalls_data *data = &map->data;
 109         unsigned long flags;
 110         int ret;
 111
 112         array_size = XEN_FLEX_RING_SIZE(map->ring_order);
 113         cons = intf->in_cons;
 114         prod = intf->in_prod;
 115         error = intf->in_error;
 116         /* read the indexes first, then deal with the data */
 117         virt_mb();
 118
 119         if (error)
 120                 return false;
 121
 122         size = pvcalls_queued(prod, cons, array_size);
 123         if (size >= array_size)
 124                 return false;
 125         spin_lock_irqsave(&map->sock->sk->sk_receive_queue.lock, flags);
 126         if (skb_queue_empty(&map->sock->sk->sk_receive_queue)) {
 127                 atomic_set(&map->read, 0);
 128                 spin_unlock_irqrestore(&map->sock->sk->sk_receive_queue.lock,
 129                                 flags);
 130                 return true;
 131         }
 132         spin_unlock_irqrestore(&map->sock->sk->sk_receive_queue.lock, flags);
 133         wanted = array_size - size;
 134         masked_prod = pvcalls_mask(prod, array_size);
 135         masked_cons = pvcalls_mask(cons, array_size);
 136
 137         memset(&msg, 0, sizeof(msg));
 138         msg.msg_iter.type = ITER_KVEC|WRITE;
 139         msg.msg_iter.count = wanted;
 140         if (masked_prod < masked_cons) {
 141                 vec[0].iov_base = data->in + masked_prod;
 142                 vec[0].iov_len = wanted;
 143                 msg.msg_iter.kvec = vec;
 144                 msg.msg_iter.nr_segs = 1;
 145         } else {
 146                 vec[0].iov_base = data->in + masked_prod;
 147                 vec[0].iov_len = array_size - masked_prod;
 148                 vec[1].iov_base = data->in;
 149                 vec[1].iov_len = wanted - vec[0].iov_len;
 150                 msg.msg_iter.kvec = vec;
 151                 msg.msg_iter.nr_segs = 2;
 152         }
 153
 154         atomic_set(&map->read, 0);
 155         ret = inet_recvmsg(map->sock, &msg, wanted, MSG_DONTWAIT);
 156         WARN_ON(ret > wanted);
 157         if (ret == -EAGAIN) /* shouldn't happen */
 158                 return true;
 159         if (!ret)
 160                 ret = -ENOTCONN;
 161         spin_lock_irqsave(&map->sock->sk->sk_receive_queue.lock, flags);
 162         if (ret > 0 && !skb_queue_empty(&map->sock->sk->sk_receive_queue))
 163                 atomic_inc(&map->read);
 164         spin_unlock_irqrestore(&map->sock->sk->sk_receive_queue.lock, flags);
 165
 166         /* write the data, then modify the indexes */
 167         virt_wmb();
 168         if (ret < 0) {
 169                 atomic_set(&map->read, 0);
 170                 intf->in_error = ret;
 171         } else
 172                 intf->in_prod = prod + ret;
 173         /* update the indexes, then notify the other end */
 174         virt_wmb();
 175         notify_remote_via_irq(map->irq);
 176
 177         return true;
 178 }
 179
 180 static bool pvcalls_conn_back_write(struct sock_mapping *map)
 181 {
 182         struct pvcalls_data_intf *intf = map->ring;
 183         struct pvcalls_data *data = &map->data;
 184         struct msghdr msg;
 185         struct kvec vec[2];
 186         RING_IDX cons, prod, size, array_size;
 187         int ret;
 188
 189         cons = intf->out_cons;
 190         prod = intf->out_prod;
 191         /* read the indexes before dealing with the data */
 192         virt_mb();
 193
 194         array_size = XEN_FLEX_RING_SIZE(map->ring_order);
 195         size = pvcalls_queued(prod, cons, array_size);
 196         if (size == 0)
 197                 return false;
 198
 199         memset(&msg, 0, sizeof(msg));
 200         msg.msg_flags |= MSG_DONTWAIT;
 201         msg.msg_iter.type = ITER_KVEC|READ;
 202         msg.msg_iter.count = size;
 203         if (pvcalls_mask(prod, array_size) > pvcalls_mask(cons, array_size)) {
 204                 vec[0].iov_base = data->out + pvcalls_mask(cons, array_size);
 205                 vec[0].iov_len = size;
 206                 msg.msg_iter.kvec = vec;
 207                 msg.msg_iter.nr_segs = 1;
 208         } else {
 209                 vec[0].iov_base = data->out + pvcalls_mask(cons, array_size);
 210                 vec[0].iov_len = array_size - pvcalls_mask(cons, array_size);
 211                 vec[1].iov_base = data->out;
 212                 vec[1].iov_len = size - vec[0].iov_len;
 213                 msg.msg_iter.kvec = vec;
 214                 msg.msg_iter.nr_segs = 2;
 215         }
 216
 217         atomic_set(&map->write, 0);
 218         ret = inet_sendmsg(map->sock, &msg, size);
 219         if (ret == -EAGAIN) {
 220                 atomic_inc(&map->write);
 221                 atomic_inc(&map->io);
 222                 return true;
 223         }
 224
 225         /* write the data, then update the indexes */
 226         virt_wmb();
 227         if (ret < 0) {
 228                 intf->out_error = ret;
 229         } else {
 230                 intf->out_error = 0;
 231                 intf->out_cons = cons + ret;
 232                 prod = intf->out_prod;
 233         }
 234         /* update the indexes, then notify the other end */
 235         virt_wmb();
 236         if (prod != cons + ret) {
 237                 atomic_inc(&map->write);
 238                 atomic_inc(&map->io);
 239         }
 240         notify_remote_via_irq(map->irq);
 241
 242         return true;
 243 }
 244
 245 static void pvcalls_back_ioworker(struct work_struct *work)
 246 {
 247         struct pvcalls_ioworker *ioworker = container_of(work,
 248                 struct pvcalls_ioworker, register_work);
 249         struct sock_mapping *map = container_of(ioworker, struct sock_mapping,
 250                 ioworker);
 251         unsigned int eoi_flags = XEN_EOI_FLAG_SPURIOUS;
 252
 253         while (atomic_read(&map->io) > 0) {
 254                 if (atomic_read(&map->release) > 0) {
 255                         atomic_set(&map->release, 0);
 256                         return;
 257                 }
 258
 259                 if (atomic_read(&map->read) > 0 &&
 260                     pvcalls_conn_back_read(map))
 261                         eoi_flags = 0;
 262                 if (atomic_read(&map->write) > 0 &&
 263                     pvcalls_conn_back_write(map))
 264                         eoi_flags = 0;
 265
 266                 if (atomic_read(&map->eoi) > 0 && !atomic_read(&map->write)) {
 267                         atomic_set(&map->eoi, 0);
 268                         xen_irq_lateeoi(map->irq, eoi_flags);
 269                         eoi_flags = XEN_EOI_FLAG_SPURIOUS;
 270                 }
 271
 272                 atomic_dec(&map->io);
 273         }
 274 }
 275
 276 static int pvcalls_back_socket(struct xenbus_device *dev,
 277                 struct xen_pvcalls_request *req)
 278 {
 279         struct pvcalls_fedata *fedata;
 280         int ret;
 281         struct xen_pvcalls_response *rsp;
 282
 283         fedata = dev_get_drvdata(&dev->dev);
 284
 285         if (req->u.socket.domain != AF_INET ||
 286             req->u.socket.type != SOCK_STREAM ||
 287             (req->u.socket.protocol != IPPROTO_IP &&
 288              req->u.socket.protocol != AF_INET))
 289                 ret = -EAFNOSUPPORT;
 290         else
 291                 ret = 0;
 292
 293         /* leave the actual socket allocation for later */
 294
 295         rsp = RING_GET_RESPONSE(&fedata->ring, fedata->ring.rsp_prod_pvt++);
 296         rsp->req_id = req->req_id;
 297         rsp->cmd = req->cmd;
 298         rsp->u.socket.id = req->u.socket.id;
 299         rsp->ret = ret;
 300
 301         return 0;
 302 }
 303
 304 static void pvcalls_sk_state_change(struct sock *sock)
 305 {
 306         struct sock_mapping *map = sock->sk_user_data;
 307
 308         if (map == NULL)
 309                 return;
 310
 311         atomic_inc(&map->read);
 312         notify_remote_via_irq(map->irq);
 313 }
 314
 315 static void pvcalls_sk_data_ready(struct sock *sock)
 316 {
 317         struct sock_mapping *map = sock->sk_user_data;
 318         struct pvcalls_ioworker *iow;
 319
 320         if (map == NULL)
 321                 return;
 322
 323         iow = &map->ioworker;
 324         atomic_inc(&map->read);
 325         atomic_inc(&map->io);
 326         queue_work(iow->wq, &iow->register_work);
 327 }
 328
 329 static struct sock_mapping *pvcalls_new_active_socket(
 330                 struct pvcalls_fedata *fedata,
 331                 uint64_t id,
 332                 grant_ref_t ref,
 333                 uint32_t evtchn,
 334                 struct socket *sock)
 335 {
 336         int ret;
 337         struct sock_mapping *map;
 338         void *page;
 339
 340         map = kzalloc(sizeof(*map), GFP_KERNEL);
 341         if (map == NULL)
 342                 return NULL;
 343
 344         map->fedata = fedata;
 345         map->sock = sock;
 346         map->id = id;
 347         map->ref = ref;
 348
 349         ret = xenbus_map_ring_valloc(fedata->dev, &ref, 1, &page);
 350         if (ret < 0)
 351                 goto out;
 352         map->ring = page;
 353         map->ring_order = map->ring->ring_order;
 354         /* first read the order, then map the data ring */
 355         virt_rmb();
 356         if (map->ring_order > MAX_RING_ORDER) {
 357                 pr_warn("%s frontend requested ring_order %u, which is > MAX (%u)\n",
 358                                 __func__, map->ring_order, MAX_RING_ORDER);
 359                 goto out;
 360         }
 361         ret = xenbus_map_ring_valloc(fedata->dev, map->ring->ref,
 362                                      (1 << map->ring_order), &page);
 363         if (ret < 0)
 364                 goto out;
 365         map->bytes = page;
 366
 367         ret = bind_interdomain_evtchn_to_irqhandler_lateeoi(
 368                         fedata->dev->otherend_id, evtchn,
 369                         pvcalls_back_conn_event, 0, "pvcalls-backend", map);
 370         if (ret < 0)
 371                 goto out;
 372         map->irq = ret;
 373
 374         map->data.in = map->bytes;
 375         map->data.out = map->bytes + XEN_FLEX_RING_SIZE(map->ring_order);
 376
 377         map->ioworker.wq = alloc_workqueue("pvcalls_io", WQ_UNBOUND, 1);
 378         if (!map->ioworker.wq)
 379                 goto out;
 380         atomic_set(&map->io, 1);
 381         INIT_WORK(&map->ioworker.register_work, pvcalls_back_ioworker);
 382
 383         down(&fedata->socket_lock);
 384         list_add_tail(&map->list, &fedata->socket_mappings);
 385         up(&fedata->socket_lock);
 386
 387         write_lock_bh(&map->sock->sk->sk_callback_lock);
 388         map->saved_data_ready = map->sock->sk->sk_data_ready;
 389         map->sock->sk->sk_user_data = map;
 390         map->sock->sk->sk_data_ready = pvcalls_sk_data_ready;
 391         map->sock->sk->sk_state_change = pvcalls_sk_state_change;
 392         write_unlock_bh(&map->sock->sk->sk_callback_lock);
 393
 394         return map;
 395 out:
 396         down(&fedata->socket_lock);
 397         list_del(&map->list);
 398         pvcalls_back_release_active(fedata->dev, fedata, map);
 399         up(&fedata->socket_lock);
 400         return NULL;
 401 }
 402
 403 static int pvcalls_back_connect(struct xenbus_device *dev,
 404                                 struct xen_pvcalls_request *req)
 405 {
 406         struct pvcalls_fedata *fedata;
 407         int ret = -EINVAL;
 408         struct socket *sock;
 409         struct sock_mapping *map;
 410         struct xen_pvcalls_response *rsp;
 411         struct sockaddr *sa = (struct sockaddr *)&req->u.connect.addr;
 412
 413         fedata = dev_get_drvdata(&dev->dev);
 414
 415         if (req->u.connect.len < sizeof(sa->sa_family) ||
 416             req->u.connect.len > sizeof(req->u.connect.addr) ||
 417             sa->sa_family != AF_INET)
 418                 goto out;
 419
 420         ret = sock_create(AF_INET, SOCK_STREAM, 0, &sock);
 421         if (ret < 0)
 422                 goto out;
 423         ret = inet_stream_connect(sock, sa, req->u.connect.len, 0);
 424         if (ret < 0) {
 425                 sock_release(sock);
 426                 goto out;
 427         }
 428
 429         map = pvcalls_new_active_socket(fedata,
 430                                         req->u.connect.id,
 431                                         req->u.connect.ref,
 432                                         req->u.connect.evtchn,
 433                                         sock);
 434         if (!map) {
 435                 ret = -EFAULT;
 436                 sock_release(sock);
 437         }
 438
 439 out:
 440         rsp = RING_GET_RESPONSE(&fedata->ring, fedata->ring.rsp_prod_pvt++);
 441         rsp->req_id = req->req_id;
 442         rsp->cmd = req->cmd;
 443         rsp->u.connect.id = req->u.connect.id;
 444         rsp->ret = ret;
 445
 446         return 0;
 447 }
 448
 449 static int pvcalls_back_release_active(struct xenbus_device *dev,
 450                                        struct pvcalls_fedata *fedata,
 451                                        struct sock_mapping *map)
 452 {
 453         disable_irq(map->irq);
 454         if (map->sock->sk != NULL) {
 455                 write_lock_bh(&map->sock->sk->sk_callback_lock);
 456                 map->sock->sk->sk_user_data = NULL;
 457                 map->sock->sk->sk_data_ready = map->saved_data_ready;
 458                 write_unlock_bh(&map->sock->sk->sk_callback_lock);
 459         }
 460
 461         atomic_set(&map->release, 1);
 462         flush_work(&map->ioworker.register_work);
 463
 464         xenbus_unmap_ring_vfree(dev, map->bytes);
 465         xenbus_unmap_ring_vfree(dev, (void *)map->ring);
 466         unbind_from_irqhandler(map->irq, map);
 467
 468         sock_release(map->sock);
 469         kfree(map);
 470
 471         return 0;
 472 }
 473
 474 static int pvcalls_back_release_passive(struct xenbus_device *dev,
 475                                         struct pvcalls_fedata *fedata,
 476                                         struct sockpass_mapping *mappass)
 477 {
 478         if (mappass->sock->sk != NULL) {
 479                 write_lock_bh(&mappass->sock->sk->sk_callback_lock);
 480                 mappass->sock->sk->sk_user_data = NULL;
 481                 mappass->sock->sk->sk_data_ready = mappass->saved_data_ready;
 482                 write_unlock_bh(&mappass->sock->sk->sk_callback_lock);
 483         }
 484         sock_release(mappass->sock);
 485         flush_workqueue(mappass->wq);
 486         destroy_workqueue(mappass->wq);
 487         kfree(mappass);
 488
 489         return 0;
 490 }
 491
 492 static int pvcalls_back_release(struct xenbus_device *dev,
 493                                 struct xen_pvcalls_request *req)
 494 {
 495         struct pvcalls_fedata *fedata;
 496         struct sock_mapping *map, *n;
 497         struct sockpass_mapping *mappass;
 498         int ret = 0;
 499         struct xen_pvcalls_response *rsp;
 500
 501         fedata = dev_get_drvdata(&dev->dev);
 502
 503         down(&fedata->socket_lock);
 504         list_for_each_entry_safe(map, n, &fedata->socket_mappings, list) {
 505                 if (map->id == req->u.release.id) {
 506                         list_del(&map->list);
 507                         up(&fedata->socket_lock);
 508                         ret = pvcalls_back_release_active(dev, fedata, map);
 509                         goto out;
 510                 }
 511         }
 512         mappass = radix_tree_lookup(&fedata->socketpass_mappings,
 513                                     req->u.release.id);
 514         if (mappass != NULL) {
 515                 radix_tree_delete(&fedata->socketpass_mappings, mappass->id);
 516                 up(&fedata->socket_lock);
 517                 ret = pvcalls_back_release_passive(dev, fedata, mappass);
 518         } else
 519                 up(&fedata->socket_lock);
 520
 521 out:
 522         rsp = RING_GET_RESPONSE(&fedata->ring, fedata->ring.rsp_prod_pvt++);
 523         rsp->req_id = req->req_id;
 524         rsp->u.release.id = req->u.release.id;
 525         rsp->cmd = req->cmd;
 526         rsp->ret = ret;
 527         return 0;
 528 }
 529
 530 static void __pvcalls_back_accept(struct work_struct *work)
 531 {
 532         struct sockpass_mapping *mappass = container_of(
 533                 work, struct sockpass_mapping, register_work);
 534         struct sock_mapping *map;
 535         struct pvcalls_ioworker *iow;
 536         struct pvcalls_fedata *fedata;
 537         struct socket *sock;
 538         struct xen_pvcalls_response *rsp;
 539         struct xen_pvcalls_request *req;
 540         int notify;
 541         int ret = -EINVAL;
 542         unsigned long flags;
 543
 544         fedata = mappass->fedata;
 545         /*
 546          * __pvcalls_back_accept can race against pvcalls_back_accept.
 547          * We only need to check the value of "cmd" on read. It could be
 548          * done atomically, but to simplify the code on the write side, we
 549          * use a spinlock.
 550          */
 551         spin_lock_irqsave(&mappass->copy_lock, flags);
 552         req = &mappass->reqcopy;
 553         if (req->cmd != PVCALLS_ACCEPT) {
 554                 spin_unlock_irqrestore(&mappass->copy_lock, flags);
 555                 return;
 556         }
 557         spin_unlock_irqrestore(&mappass->copy_lock, flags);
 558
 559         sock = sock_alloc();
 560         if (sock == NULL)
 561                 goto out_error;
 562         sock->type = mappass->sock->type;
 563         sock->ops = mappass->sock->ops;
 564
 565         ret = inet_accept(mappass->sock, sock, O_NONBLOCK, true);
 566         if (ret == -EAGAIN) {
 567                 sock_release(sock);
 568                 goto out_error;
 569         }
 570
 571         map = pvcalls_new_active_socket(fedata,
 572                                         req->u.accept.id_new,
 573                                         req->u.accept.ref,
 574                                         req->u.accept.evtchn,
 575                                         sock);
 576         if (!map) {
 577                 ret = -EFAULT;
 578                 sock_release(sock);
 579                 goto out_error;
 580         }
 581
 582         map->sockpass = mappass;
 583         iow = &map->ioworker;
 584         atomic_inc(&map->read);
 585         atomic_inc(&map->io);
 586         queue_work(iow->wq, &iow->register_work);
 587
 588 out_error:
 589         rsp = RING_GET_RESPONSE(&fedata->ring, fedata->ring.rsp_prod_pvt++);
 590         rsp->req_id = req->req_id;
 591         rsp->cmd = req->cmd;
 592         rsp->u.accept.id = req->u.accept.id;
 593         rsp->ret = ret;
 594         RING_PUSH_RESPONSES_AND_CHECK_NOTIFY(&fedata->ring, notify);
 595         if (notify)
 596                 notify_remote_via_irq(fedata->irq);
 597
 598         mappass->reqcopy.cmd = 0;
 599 }
 600
 601 static void pvcalls_pass_sk_data_ready(struct sock *sock)
 602 {
 603         struct sockpass_mapping *mappass = sock->sk_user_data;
 604         struct pvcalls_fedata *fedata;
 605         struct xen_pvcalls_response *rsp;
 606         unsigned long flags;
 607         int notify;
 608
 609         if (mappass == NULL)
 610                 return;
 611
 612         fedata = mappass->fedata;
 613         spin_lock_irqsave(&mappass->copy_lock, flags);
 614         if (mappass->reqcopy.cmd == PVCALLS_POLL) {
 615                 rsp = RING_GET_RESPONSE(&fedata->ring,
 616                                         fedata->ring.rsp_prod_pvt++);
 617                 rsp->req_id = mappass->reqcopy.req_id;
 618                 rsp->u.poll.id = mappass->reqcopy.u.poll.id;
 619                 rsp->cmd = mappass->reqcopy.cmd;
 620                 rsp->ret = 0;
 621
 622                 mappass->reqcopy.cmd = 0;
 623                 spin_unlock_irqrestore(&mappass->copy_lock, flags);
 624
 625                 RING_PUSH_RESPONSES_AND_CHECK_NOTIFY(&fedata->ring, notify);
 626                 if (notify)
 627                         notify_remote_via_irq(mappass->fedata->irq);
 628         } else {
 629                 spin_unlock_irqrestore(&mappass->copy_lock, flags);
 630                 queue_work(mappass->wq, &mappass->register_work);
 631         }
 632 }
 633
 634 static int pvcalls_back_bind(struct xenbus_device *dev,
 635                              struct xen_pvcalls_request *req)
 636 {
 637         struct pvcalls_fedata *fedata;
 638         int ret;
 639         struct sockpass_mapping *map;
 640         struct xen_pvcalls_response *rsp;
 641
 642         fedata = dev_get_drvdata(&dev->dev);
 643
 644         map = kzalloc(sizeof(*map), GFP_KERNEL);
 645         if (map == NULL) {
 646                 ret = -ENOMEM;
 647                 goto out;
 648         }
 649
 650         INIT_WORK(&map->register_work, __pvcalls_back_accept);
 651         spin_lock_init(&map->copy_lock);
 652         map->wq = alloc_workqueue("pvcalls_wq", WQ_UNBOUND, 1);
 653         if (!map->wq) {
 654                 ret = -ENOMEM;
 655                 goto out;
 656         }
 657
 658         ret = sock_create(AF_INET, SOCK_STREAM, 0, &map->sock);
 659         if (ret < 0)
 660                 goto out;
 661
 662         ret = inet_bind(map->sock, (struct sockaddr *)&req->u.bind.addr,
 663                         req->u.bind.len);
 664         if (ret < 0)
 665                 goto out;
 666
 667         map->fedata = fedata;
 668         map->id = req->u.bind.id;
 669
 670         down(&fedata->socket_lock);
 671         ret = radix_tree_insert(&fedata->socketpass_mappings, map->id,
 672                                 map);
 673         up(&fedata->socket_lock);
 674         if (ret)
 675                 goto out;
 676
 677         write_lock_bh(&map->sock->sk->sk_callback_lock);
 678         map->saved_data_ready = map->sock->sk->sk_data_ready;
 679         map->sock->sk->sk_user_data = map;
 680         map->sock->sk->sk_data_ready = pvcalls_pass_sk_data_ready;
 681         write_unlock_bh(&map->sock->sk->sk_callback_lock);
 682
 683 out:
 684         if (ret) {
 685                 if (map && map->sock)
 686                         sock_release(map->sock);
 687                 if (map && map->wq)
 688                         destroy_workqueue(map->wq);
 689                 kfree(map);
 690         }
 691         rsp = RING_GET_RESPONSE(&fedata->ring, fedata->ring.rsp_prod_pvt++);
 692         rsp->req_id = req->req_id;
 693         rsp->cmd = req->cmd;
 694         rsp->u.bind.id = req->u.bind.id;
 695         rsp->ret = ret;
 696         return 0;
 697 }
 698
 699 static int pvcalls_back_listen(struct xenbus_device *dev,
 700                                struct xen_pvcalls_request *req)
 701 {
 702         struct pvcalls_fedata *fedata;
 703         int ret = -EINVAL;
 704         struct sockpass_mapping *map;
 705         struct xen_pvcalls_response *rsp;
 706
 707         fedata = dev_get_drvdata(&dev->dev);
 708
 709         down(&fedata->socket_lock);
 710         map = radix_tree_lookup(&fedata->socketpass_mappings, req->u.listen.id);
 711         up(&fedata->socket_lock);
 712         if (map == NULL)
 713                 goto out;
 714
 715         ret = inet_listen(map->sock, req->u.listen.backlog);
 716
 717 out:
 718         rsp = RING_GET_RESPONSE(&fedata->ring, fedata->ring.rsp_prod_pvt++);
 719         rsp->req_id = req->req_id;
 720         rsp->cmd = req->cmd;
 721         rsp->u.listen.id = req->u.listen.id;
 722         rsp->ret = ret;
 723         return 0;
 724 }
 725
 726 static int pvcalls_back_accept(struct xenbus_device *dev,
 727                                struct xen_pvcalls_request *req)
 728 {
 729         struct pvcalls_fedata *fedata;
 730         struct sockpass_mapping *mappass;
 731         int ret = -EINVAL;
 732         struct xen_pvcalls_response *rsp;
 733         unsigned long flags;
 734
 735         fedata = dev_get_drvdata(&dev->dev);
 736
 737         down(&fedata->socket_lock);
 738         mappass = radix_tree_lookup(&fedata->socketpass_mappings,
 739                 req->u.accept.id);
 740         up(&fedata->socket_lock);
 741         if (mappass == NULL)
 742                 goto out_error;
 743
 744         /*
 745          * Limitation of the current implementation: only support one
 746          * concurrent accept or poll call on one socket.
 747          */
 748         spin_lock_irqsave(&mappass->copy_lock, flags);
 749         if (mappass->reqcopy.cmd != 0) {
 750                 spin_unlock_irqrestore(&mappass->copy_lock, flags);
 751                 ret = -EINTR;
 752                 goto out_error;
 753         }
 754
 755         mappass->reqcopy = *req;
 756         spin_unlock_irqrestore(&mappass->copy_lock, flags);
 757         queue_work(mappass->wq, &mappass->register_work);
 758
 759         /* Tell the caller we don't need to send back a notification yet */
 760         return -1;
 761
 762 out_error:
 763         rsp = RING_GET_RESPONSE(&fedata->ring, fedata->ring.rsp_prod_pvt++);
 764         rsp->req_id = req->req_id;
 765         rsp->cmd = req->cmd;
 766         rsp->u.accept.id = req->u.accept.id;
 767         rsp->ret = ret;
 768         return 0;
 769 }
 770
 771 static int pvcalls_back_poll(struct xenbus_device *dev,
 772                              struct xen_pvcalls_request *req)
 773 {
 774         struct pvcalls_fedata *fedata;
 775         struct sockpass_mapping *mappass;
 776         struct xen_pvcalls_response *rsp;
 777         struct inet_connection_sock *icsk;
 778         struct request_sock_queue *queue;
 779         unsigned long flags;
 780         int ret;
 781         bool data;
 782
 783         fedata = dev_get_drvdata(&dev->dev);
 784
 785         down(&fedata->socket_lock);
 786         mappass = radix_tree_lookup(&fedata->socketpass_mappings,
 787                                     req->u.poll.id);
 788         up(&fedata->socket_lock);
 789         if (mappass == NULL)
 790                 return -EINVAL;
 791
 792         /*
 793          * Limitation of the current implementation: only support one
 794          * concurrent accept or poll call on one socket.
 795          */
 796         spin_lock_irqsave(&mappass->copy_lock, flags);
 797         if (mappass->reqcopy.cmd != 0) {
 798                 ret = -EINTR;
 799                 goto out;
 800         }
 801
 802         mappass->reqcopy = *req;
 803         icsk = inet_csk(mappass->sock->sk);
 804         queue = &icsk->icsk_accept_queue;
 805         data = READ_ONCE(queue->rskq_accept_head) != NULL;
 806         if (data) {
 807                 mappass->reqcopy.cmd = 0;
 808                 ret = 0;
 809                 goto out;
 810         }
 811         spin_unlock_irqrestore(&mappass->copy_lock, flags);
 812
 813         /* Tell the caller we don't need to send back a notification yet */
 814         return -1;
 815
 816 out:
 817         spin_unlock_irqrestore(&mappass->copy_lock, flags);
 818
 819         rsp = RING_GET_RESPONSE(&fedata->ring, fedata->ring.rsp_prod_pvt++);
 820         rsp->req_id = req->req_id;
 821         rsp->cmd = req->cmd;
 822         rsp->u.poll.id = req->u.poll.id;
 823         rsp->ret = ret;
 824         return 0;
 825 }
 826
 827 static int pvcalls_back_handle_cmd(struct xenbus_device *dev,
 828                                    struct xen_pvcalls_request *req)
 829 {
 830         int ret = 0;
 831
 832         switch (req->cmd) {
 833         case PVCALLS_SOCKET:
 834                 ret = pvcalls_back_socket(dev, req);
 835                 break;
 836         case PVCALLS_CONNECT:
 837                 ret = pvcalls_back_connect(dev, req);
 838                 break;
 839         case PVCALLS_RELEASE:
 840                 ret = pvcalls_back_release(dev, req);
 841                 break;
 842         case PVCALLS_BIND:
 843                 ret = pvcalls_back_bind(dev, req);
 844                 break;
 845         case PVCALLS_LISTEN:
 846                 ret = pvcalls_back_listen(dev, req);
 847                 break;
 848         case PVCALLS_ACCEPT:
 849                 ret = pvcalls_back_accept(dev, req);
 850                 break;
 851         case PVCALLS_POLL:
 852                 ret = pvcalls_back_poll(dev, req);
 853                 break;
 854         default:
 855         {
 856                 struct pvcalls_fedata *fedata;
 857                 struct xen_pvcalls_response *rsp;
 858
 859                 fedata = dev_get_drvdata(&dev->dev);
 860                 rsp = RING_GET_RESPONSE(
 861                                 &fedata->ring, fedata->ring.rsp_prod_pvt++);
 862                 rsp->req_id = req->req_id;
 863                 rsp->cmd = req->cmd;
 864                 rsp->ret = -ENOTSUPP;
 865                 break;
 866         }
 867         }
 868         return ret;
 869 }
 870
 871 static void pvcalls_back_work(struct pvcalls_fedata *fedata)
 872 {
 873         int notify, notify_all = 0, more = 1;
 874         struct xen_pvcalls_request req;
 875         struct xenbus_device *dev = fedata->dev;
 876
 877         while (more) {
 878                 while (RING_HAS_UNCONSUMED_REQUESTS(&fedata->ring)) {
 879                         RING_COPY_REQUEST(&fedata->ring,
 880                                           fedata->ring.req_cons++,
 881                                           &req);
 882
 883                         if (!pvcalls_back_handle_cmd(dev, &req)) {
 884                                 RING_PUSH_RESPONSES_AND_CHECK_NOTIFY(
 885                                         &fedata->ring, notify);
 886                                 notify_all += notify;
 887                         }
 888                 }
 889
 890                 if (notify_all) {
 891                         notify_remote_via_irq(fedata->irq);
 892                         notify_all = 0;
 893                 }
 894
 895                 RING_FINAL_CHECK_FOR_REQUESTS(&fedata->ring, more);
 896         }
 897 }
 898
 899 static irqreturn_t pvcalls_back_event(int irq, void *dev_id)
 900 {
 901         struct xenbus_device *dev = dev_id;
 902         struct pvcalls_fedata *fedata = NULL;
 903         unsigned int eoi_flags = XEN_EOI_FLAG_SPURIOUS;
 904
 905         if (dev) {
 906                 fedata = dev_get_drvdata(&dev->dev);
 907                 if (fedata) {
 908                         pvcalls_back_work(fedata);
 909                         eoi_flags = 0;
 910                 }
 911         }
 912
 913         xen_irq_lateeoi(irq, eoi_flags);
 914
 915         return IRQ_HANDLED;
 916 }
 917
 918 static irqreturn_t pvcalls_back_conn_event(int irq, void *sock_map)
 919 {
 920         struct sock_mapping *map = sock_map;
 921         struct pvcalls_ioworker *iow;
 922
 923         if (map == NULL || map->sock == NULL || map->sock->sk == NULL ||
 924                 map->sock->sk->sk_user_data != map) {
 925                 xen_irq_lateeoi(irq, 0);
 926                 return IRQ_HANDLED;
 927         }
 928
 929         iow = &map->ioworker;
 930
 931         atomic_inc(&map->write);
 932         atomic_inc(&map->eoi);
 933         atomic_inc(&map->io);
 934         queue_work(iow->wq, &iow->register_work);
 935
 936         return IRQ_HANDLED;
 937 }
 938
 939 static int backend_connect(struct xenbus_device *dev)
 940 {
 941         int err, evtchn;
 942         grant_ref_t ring_ref;
 943         struct pvcalls_fedata *fedata = NULL;
 944
 945         fedata = kzalloc(sizeof(struct pvcalls_fedata), GFP_KERNEL);
 946         if (!fedata)
 947                 return -ENOMEM;
 948
 949         fedata->irq = -1;
 950         err = xenbus_scanf(XBT_NIL, dev->otherend, "port", "%u",
 951                            &evtchn);
 952         if (err != 1) {
 953                 err = -EINVAL;
 954                 xenbus_dev_fatal(dev, err, "reading %s/event-channel",
 955                                  dev->otherend);
 956                 goto error;
 957         }
 958
 959         err = xenbus_scanf(XBT_NIL, dev->otherend, "ring-ref", "%u", &ring_ref);
 960         if (err != 1) {
 961                 err = -EINVAL;
 962                 xenbus_dev_fatal(dev, err, "reading %s/ring-ref",
 963                                  dev->otherend);
 964                 goto error;
 965         }
 966
 967         err = bind_interdomain_evtchn_to_irq_lateeoi(dev->otherend_id, evtchn);
 968         if (err < 0)
 969                 goto error;
 970         fedata->irq = err;
 971
 972         err = request_threaded_irq(fedata->irq, NULL, pvcalls_back_event,
 973                                    IRQF_ONESHOT, "pvcalls-back", dev);
 974         if (err < 0)
 975                 goto error;
 976
 977         err = xenbus_map_ring_valloc(dev, &ring_ref, 1,
 978                                      (void **)&fedata->sring);
 979         if (err < 0)
 980                 goto error;
 981
 982         BACK_RING_INIT(&fedata->ring, fedata->sring, XEN_PAGE_SIZE * 1);
 983         fedata->dev = dev;
 984
 985         INIT_LIST_HEAD(&fedata->socket_mappings);
 986         INIT_RADIX_TREE(&fedata->socketpass_mappings, GFP_KERNEL);
 987         sema_init(&fedata->socket_lock, 1);
 988         dev_set_drvdata(&dev->dev, fedata);
 989
 990         down(&pvcalls_back_global.frontends_lock);
 991         list_add_tail(&fedata->list, &pvcalls_back_global.frontends);
 992         up(&pvcalls_back_global.frontends_lock);
 993
 994         return 0;
 995
 996  error:
 997         if (fedata->irq >= 0)
 998                 unbind_from_irqhandler(fedata->irq, dev);
 999         if (fedata->sring != NULL)
1000                 xenbus_unmap_ring_vfree(dev, fedata->sring);
1001         kfree(fedata);
1002         return err;
1003 }
1004
1005 static int backend_disconnect(struct xenbus_device *dev)
1006 {
1007         struct pvcalls_fedata *fedata;
1008         struct sock_mapping *map, *n;
1009         struct sockpass_mapping *mappass;
1010         struct radix_tree_iter iter;
1011         void **slot;
1012
1013
1014         fedata = dev_get_drvdata(&dev->dev);
1015
1016         down(&fedata->socket_lock);
1017         list_for_each_entry_safe(map, n, &fedata->socket_mappings, list) {
1018                 list_del(&map->list);
1019                 pvcalls_back_release_active(dev, fedata, map);
1020         }
1021
1022         radix_tree_for_each_slot(slot, &fedata->socketpass_mappings, &iter, 0) {
1023                 mappass = radix_tree_deref_slot(slot);
1024                 if (!mappass)
1025                         continue;
1026                 if (radix_tree_exception(mappass)) {
1027                         if (radix_tree_deref_retry(mappass))
1028                                 slot = radix_tree_iter_retry(&iter);
1029                 } else {
1030                         radix_tree_delete(&fedata->socketpass_mappings,
1031                                           mappass->id);
1032                         pvcalls_back_release_passive(dev, fedata, mappass);
1033                 }
1034         }
1035         up(&fedata->socket_lock);
1036
1037         unbind_from_irqhandler(fedata->irq, dev);
1038         xenbus_unmap_ring_vfree(dev, fedata->sring);
1039
1040         list_del(&fedata->list);
1041         kfree(fedata);
1042         dev_set_drvdata(&dev->dev, NULL);
1043
1044         return 0;
1045 }
1046
1047 static int pvcalls_back_probe(struct xenbus_device *dev,
1048                               const struct xenbus_device_id *id)
1049 {
1050         int err, abort;
1051         struct xenbus_transaction xbt;
1052
1053 again:
1054         abort = 1;
1055
1056         err = xenbus_transaction_start(&xbt);
1057         if (err) {
1058                 pr_warn("%s cannot create xenstore transaction\n", __func__);
1059                 return err;
1060         }
1061
1062         err = xenbus_printf(xbt, dev->nodename, "versions", "%s",
1063                             PVCALLS_VERSIONS);
1064         if (err) {
1065                 pr_warn("%s write out 'versions' failed\n", __func__);
1066                 goto abort;
1067         }
1068
1069         err = xenbus_printf(xbt, dev->nodename, "max-page-order", "%u",
1070                             MAX_RING_ORDER);
1071         if (err) {
1072                 pr_warn("%s write out 'max-page-order' failed\n", __func__);
1073                 goto abort;
1074         }
1075
1076         err = xenbus_printf(xbt, dev->nodename, "function-calls",
1077                             XENBUS_FUNCTIONS_CALLS);
1078         if (err) {
1079                 pr_warn("%s write out 'function-calls' failed\n", __func__);
1080                 goto abort;
1081         }
1082
1083         abort = 0;
1084 abort:
1085         err = xenbus_transaction_end(xbt, abort);
1086         if (err) {
1087                 if (err == -EAGAIN && !abort)
1088                         goto again;
1089                 pr_warn("%s cannot complete xenstore transaction\n", __func__);
1090                 return err;
1091         }
1092
1093         if (abort)
1094                 return -EFAULT;
1095
1096         xenbus_switch_state(dev, XenbusStateInitWait);
1097
1098         return 0;
1099 }
1100
1101 static void set_backend_state(struct xenbus_device *dev,
1102                               enum xenbus_state state)
1103 {
1104         while (dev->state != state) {
1105                 switch (dev->state) {
1106                 case XenbusStateClosed:
1107                         switch (state) {
1108                         case XenbusStateInitWait:
1109                         case XenbusStateConnected:
1110                                 xenbus_switch_state(dev, XenbusStateInitWait);
1111                                 break;
1112                         case XenbusStateClosing:
1113                                 xenbus_switch_state(dev, XenbusStateClosing);
1114                                 break;
1115                         default:
1116                                 WARN_ON(1);
1117                         }
1118                         break;
1119                 case XenbusStateInitWait:
1120                 case XenbusStateInitialised:
1121                         switch (state) {
1122                         case XenbusStateConnected:
1123                                 if (backend_connect(dev))
1124                                         return;
1125                                 xenbus_switch_state(dev, XenbusStateConnected);
1126                                 break;
1127                         case XenbusStateClosing:
1128                         case XenbusStateClosed:
1129                                 xenbus_switch_state(dev, XenbusStateClosing);
1130                                 break;
1131                         default:
1132                                 WARN_ON(1);
1133                         }
1134                         break;
1135                 case XenbusStateConnected:
1136                         switch (state) {
1137                         case XenbusStateInitWait:
1138                         case XenbusStateClosing:
1139                         case XenbusStateClosed:
1140                                 down(&pvcalls_back_global.frontends_lock);
1141                                 backend_disconnect(dev);
1142                                 up(&pvcalls_back_global.frontends_lock);
1143                                 xenbus_switch_state(dev, XenbusStateClosing);
1144                                 break;
1145                         default:
1146                                 WARN_ON(1);
1147                         }
1148                         break;
1149                 case XenbusStateClosing:
1150                         switch (state) {
1151                         case XenbusStateInitWait:
1152                         case XenbusStateConnected:
1153                         case XenbusStateClosed:
1154                                 xenbus_switch_state(dev, XenbusStateClosed);
1155                                 break;
1156                         default:
1157                                 WARN_ON(1);
1158                         }
1159                         break;
1160                 default:
1161                         WARN_ON(1);
1162                 }
1163         }
1164 }
1165
1166 static void pvcalls_back_changed(struct xenbus_device *dev,
1167                                  enum xenbus_state frontend_state)
1168 {
1169         switch (frontend_state) {
1170         case XenbusStateInitialising:
1171                 set_backend_state(dev, XenbusStateInitWait);
1172                 break;
1173
1174         case XenbusStateInitialised:
1175         case XenbusStateConnected:
1176                 set_backend_state(dev, XenbusStateConnected);
1177                 break;
1178
1179         case XenbusStateClosing:
1180                 set_backend_state(dev, XenbusStateClosing);
1181                 break;
1182
1183         case XenbusStateClosed:
1184                 set_backend_state(dev, XenbusStateClosed);
1185                 if (xenbus_dev_is_online(dev))
1186                         break;
1187                 device_unregister(&dev->dev);
1188                 break;
1189         case XenbusStateUnknown:
1190                 set_backend_state(dev, XenbusStateClosed);
1191                 device_unregister(&dev->dev);
1192                 break;
1193
1194         default:
1195                 xenbus_dev_fatal(dev, -EINVAL, "saw state %d at frontend",
1196                                  frontend_state);
1197                 break;
1198         }
1199 }
1200
1201 static int pvcalls_back_remove(struct xenbus_device *dev)
1202 {
1203         return 0;
1204 }
1205
1206 static int pvcalls_back_uevent(struct xenbus_device *xdev,
1207                                struct kobj_uevent_env *env)
1208 {
1209         return 0;
1210 }
1211
1212 static const struct xenbus_device_id pvcalls_back_ids[] = {
1213         { "pvcalls" },
1214         { "" }
1215 };
1216
1217 static struct xenbus_driver pvcalls_back_driver = {
1218         .ids = pvcalls_back_ids,
1219         .probe = pvcalls_back_probe,
1220         .remove = pvcalls_back_remove,
1221         .uevent = pvcalls_back_uevent,
1222         .otherend_changed = pvcalls_back_changed,
1223 };
1224
1225 static int __init pvcalls_back_init(void)
1226 {
1227         int ret;
1228
1229         if (!xen_domain())
1230                 return -ENODEV;
1231
1232         ret = xenbus_register_backend(&pvcalls_back_driver);
1233         if (ret < 0)
1234                 return ret;
1235
1236         sema_init(&pvcalls_back_global.frontends_lock, 1);
1237         INIT_LIST_HEAD(&pvcalls_back_global.frontends);
1238         return 0;
1239 }
1240 module_init(pvcalls_back_init);
1241
1242 static void __exit pvcalls_back_fin(void)
1243 {
1244         struct pvcalls_fedata *fedata, *nfedata;
1245
1246         down(&pvcalls_back_global.frontends_lock);
1247         list_for_each_entry_safe(fedata, nfedata,
1248                                  &pvcalls_back_global.frontends, list) {
1249                 backend_disconnect(fedata->dev);
1250         }
1251         up(&pvcalls_back_global.frontends_lock);
1252
1253         xenbus_unregister_driver(&pvcalls_back_driver);
1254 }
1255
1256 module_exit(pvcalls_back_fin);