1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /*
3 * (c) 2017 Stefano Stabellini <stefano@aporeto.com>
4 */
5
6 #include <linux/inet.h>
7 #include <linux/kthread.h>
8 #include <linux/list.h>
9 #include <linux/radix-tree.h>
10 #include <linux/module.h>
11 #include <linux/semaphore.h>
12 #include <linux/wait.h>
13 #include <net/sock.h>
14 #include <net/inet_common.h>
15 #include <net/inet_connection_sock.h>
16 #include <net/request_sock.h>
17
18 #include <xen/events.h>
19 #include <xen/grant_table.h>
20 #include <xen/xen.h>
21 #include <xen/xenbus.h>
22 #include <xen/interface/io/pvcalls.h>
23
24 #define PVCALLS_VERSIONS "1"
25 #define MAX_RING_ORDER XENBUS_MAX_RING_GRANT_ORDER
26
27 static struct pvcalls_back_global {
28 struct list_head frontends;
29 struct semaphore frontends_lock;
30 } pvcalls_back_global;
31
32 /*
33 * Per-frontend data structure. It contains pointers to the command
34 * ring, its event channel, a list of active sockets and a tree of
35 * passive sockets.
36 */
37 struct pvcalls_fedata {
38 struct list_head list;
39 struct xenbus_device *dev;
40 struct xen_pvcalls_sring *sring;
41 struct xen_pvcalls_back_ring ring;
42 int irq;
43 struct list_head socket_mappings;
44 struct radix_tree_root socketpass_mappings;
45 struct semaphore socket_lock;
46 };
47
48 struct pvcalls_ioworker {
49 struct work_struct register_work;
50 struct workqueue_struct *wq;
51 };
52
53 struct sock_mapping {
54 struct list_head list;
55 struct pvcalls_fedata *fedata;
56 struct sockpass_mapping *sockpass;
57 struct socket *sock;
58 uint64_t id;
59 grant_ref_t ref;
60 struct pvcalls_data_intf *ring;
61 void *bytes;
62 struct pvcalls_data data;
63 uint32_t ring_order;
64 int irq;
65 atomic_t read;
66 atomic_t write;
67 atomic_t io;
68 atomic_t release;
69 atomic_t eoi;
70 void (*saved_data_ready)(struct sock *sk);
71 struct pvcalls_ioworker ioworker;
72 };
73
74 struct sockpass_mapping {
75 struct list_head list;
76 struct pvcalls_fedata *fedata;
77 struct socket *sock;
78 uint64_t id;
79 struct xen_pvcalls_request reqcopy;
80 spinlock_t copy_lock;
81 struct workqueue_struct *wq;
82 struct work_struct register_work;
83 void (*saved_data_ready)(struct sock *sk);
84 };
85
86 static irqreturn_t pvcalls_back_conn_event(int irq, void *sock_map);
87 static int pvcalls_back_release_active(struct xenbus_device *dev,
88 struct pvcalls_fedata *fedata,
89 struct sock_mapping *map);
90
pvcalls_conn_back_read(void * opaque)91 static bool pvcalls_conn_back_read(void *opaque)
92 {
93 struct sock_mapping *map = (struct sock_mapping *)opaque;
94 struct msghdr msg;
95 struct kvec vec[2];
96 RING_IDX cons, prod, size, wanted, array_size, masked_prod, masked_cons;
97 int32_t error;
98 struct pvcalls_data_intf *intf = map->ring;
99 struct pvcalls_data *data = &map->data;
100 unsigned long flags;
101 int ret;
102
103 array_size = XEN_FLEX_RING_SIZE(map->ring_order);
104 cons = intf->in_cons;
105 prod = intf->in_prod;
106 error = intf->in_error;
107 /* read the indexes first, then deal with the data */
108 virt_mb();
109
110 if (error)
111 return false;
112
113 size = pvcalls_queued(prod, cons, array_size);
114 if (size >= array_size)
115 return false;
116 spin_lock_irqsave(&map->sock->sk->sk_receive_queue.lock, flags);
117 if (skb_queue_empty(&map->sock->sk->sk_receive_queue)) {
118 atomic_set(&map->read, 0);
119 spin_unlock_irqrestore(&map->sock->sk->sk_receive_queue.lock,
120 flags);
121 return true;
122 }
123 spin_unlock_irqrestore(&map->sock->sk->sk_receive_queue.lock, flags);
124 wanted = array_size - size;
125 masked_prod = pvcalls_mask(prod, array_size);
126 masked_cons = pvcalls_mask(cons, array_size);
127
128 memset(&msg, 0, sizeof(msg));
129 if (masked_prod < masked_cons) {
130 vec[0].iov_base = data->in + masked_prod;
131 vec[0].iov_len = wanted;
132 iov_iter_kvec(&msg.msg_iter, ITER_DEST, vec, 1, wanted);
133 } else {
134 vec[0].iov_base = data->in + masked_prod;
135 vec[0].iov_len = array_size - masked_prod;
136 vec[1].iov_base = data->in;
137 vec[1].iov_len = wanted - vec[0].iov_len;
138 iov_iter_kvec(&msg.msg_iter, ITER_DEST, vec, 2, wanted);
139 }
140
141 atomic_set(&map->read, 0);
142 ret = inet_recvmsg(map->sock, &msg, wanted, MSG_DONTWAIT);
143 WARN_ON(ret > wanted);
144 if (ret == -EAGAIN) /* shouldn't happen */
145 return true;
146 if (!ret)
147 ret = -ENOTCONN;
148 spin_lock_irqsave(&map->sock->sk->sk_receive_queue.lock, flags);
149 if (ret > 0 && !skb_queue_empty(&map->sock->sk->sk_receive_queue))
150 atomic_inc(&map->read);
151 spin_unlock_irqrestore(&map->sock->sk->sk_receive_queue.lock, flags);
152
153 /* write the data, then modify the indexes */
154 virt_wmb();
155 if (ret < 0) {
156 atomic_set(&map->read, 0);
157 intf->in_error = ret;
158 } else
159 intf->in_prod = prod + ret;
160 /* update the indexes, then notify the other end */
161 virt_wmb();
162 notify_remote_via_irq(map->irq);
163
164 return true;
165 }
166
pvcalls_conn_back_write(struct sock_mapping * map)167 static bool pvcalls_conn_back_write(struct sock_mapping *map)
168 {
169 struct pvcalls_data_intf *intf = map->ring;
170 struct pvcalls_data *data = &map->data;
171 struct msghdr msg;
172 struct kvec vec[2];
173 RING_IDX cons, prod, size, array_size;
174 int ret;
175
176 cons = intf->out_cons;
177 prod = intf->out_prod;
178 /* read the indexes before dealing with the data */
179 virt_mb();
180
181 array_size = XEN_FLEX_RING_SIZE(map->ring_order);
182 size = pvcalls_queued(prod, cons, array_size);
183 if (size == 0)
184 return false;
185
186 memset(&msg, 0, sizeof(msg));
187 msg.msg_flags |= MSG_DONTWAIT;
188 if (pvcalls_mask(prod, array_size) > pvcalls_mask(cons, array_size)) {
189 vec[0].iov_base = data->out + pvcalls_mask(cons, array_size);
190 vec[0].iov_len = size;
191 iov_iter_kvec(&msg.msg_iter, ITER_SOURCE, vec, 1, size);
192 } else {
193 vec[0].iov_base = data->out + pvcalls_mask(cons, array_size);
194 vec[0].iov_len = array_size - pvcalls_mask(cons, array_size);
195 vec[1].iov_base = data->out;
196 vec[1].iov_len = size - vec[0].iov_len;
197 iov_iter_kvec(&msg.msg_iter, ITER_SOURCE, vec, 2, size);
198 }
199
200 atomic_set(&map->write, 0);
201 ret = inet_sendmsg(map->sock, &msg, size);
202 if (ret == -EAGAIN) {
203 atomic_inc(&map->write);
204 atomic_inc(&map->io);
205 return true;
206 }
207
208 /* write the data, then update the indexes */
209 virt_wmb();
210 if (ret < 0) {
211 intf->out_error = ret;
212 } else {
213 intf->out_error = 0;
214 intf->out_cons = cons + ret;
215 prod = intf->out_prod;
216 }
217 /* update the indexes, then notify the other end */
218 virt_wmb();
219 if (prod != cons + ret) {
220 atomic_inc(&map->write);
221 atomic_inc(&map->io);
222 }
223 notify_remote_via_irq(map->irq);
224
225 return true;
226 }
227
pvcalls_back_ioworker(struct work_struct * work)228 static void pvcalls_back_ioworker(struct work_struct *work)
229 {
230 struct pvcalls_ioworker *ioworker = container_of(work,
231 struct pvcalls_ioworker, register_work);
232 struct sock_mapping *map = container_of(ioworker, struct sock_mapping,
233 ioworker);
234 unsigned int eoi_flags = XEN_EOI_FLAG_SPURIOUS;
235
236 while (atomic_read(&map->io) > 0) {
237 if (atomic_read(&map->release) > 0) {
238 atomic_set(&map->release, 0);
239 return;
240 }
241
242 if (atomic_read(&map->read) > 0 &&
243 pvcalls_conn_back_read(map))
244 eoi_flags = 0;
245 if (atomic_read(&map->write) > 0 &&
246 pvcalls_conn_back_write(map))
247 eoi_flags = 0;
248
249 if (atomic_read(&map->eoi) > 0 && !atomic_read(&map->write)) {
250 atomic_set(&map->eoi, 0);
251 xen_irq_lateeoi(map->irq, eoi_flags);
252 eoi_flags = XEN_EOI_FLAG_SPURIOUS;
253 }
254
255 atomic_dec(&map->io);
256 }
257 }
258
pvcalls_back_socket(struct xenbus_device * dev,struct xen_pvcalls_request * req)259 static int pvcalls_back_socket(struct xenbus_device *dev,
260 struct xen_pvcalls_request *req)
261 {
262 struct pvcalls_fedata *fedata;
263 int ret;
264 struct xen_pvcalls_response *rsp;
265
266 fedata = dev_get_drvdata(&dev->dev);
267
268 if (req->u.socket.domain != AF_INET ||
269 req->u.socket.type != SOCK_STREAM ||
270 (req->u.socket.protocol != IPPROTO_IP &&
271 req->u.socket.protocol != AF_INET))
272 ret = -EAFNOSUPPORT;
273 else
274 ret = 0;
275
276 /* leave the actual socket allocation for later */
277
278 rsp = RING_GET_RESPONSE(&fedata->ring, fedata->ring.rsp_prod_pvt++);
279 rsp->req_id = req->req_id;
280 rsp->cmd = req->cmd;
281 rsp->u.socket.id = req->u.socket.id;
282 rsp->ret = ret;
283
284 return 0;
285 }
286
pvcalls_sk_state_change(struct sock * sock)287 static void pvcalls_sk_state_change(struct sock *sock)
288 {
289 struct sock_mapping *map = sock->sk_user_data;
290
291 if (map == NULL)
292 return;
293
294 atomic_inc(&map->read);
295 notify_remote_via_irq(map->irq);
296 }
297
pvcalls_sk_data_ready(struct sock * sock)298 static void pvcalls_sk_data_ready(struct sock *sock)
299 {
300 struct sock_mapping *map = sock->sk_user_data;
301 struct pvcalls_ioworker *iow;
302
303 if (map == NULL)
304 return;
305
306 iow = &map->ioworker;
307 atomic_inc(&map->read);
308 atomic_inc(&map->io);
309 queue_work(iow->wq, &iow->register_work);
310 }
311
pvcalls_new_active_socket(struct pvcalls_fedata * fedata,uint64_t id,grant_ref_t ref,evtchn_port_t evtchn,struct socket * sock)312 static struct sock_mapping *pvcalls_new_active_socket(
313 struct pvcalls_fedata *fedata,
314 uint64_t id,
315 grant_ref_t ref,
316 evtchn_port_t evtchn,
317 struct socket *sock)
318 {
319 int ret;
320 struct sock_mapping *map;
321 void *page;
322
323 map = kzalloc(sizeof(*map), GFP_KERNEL);
324 if (map == NULL) {
325 sock_release(sock);
326 return NULL;
327 }
328
329 map->fedata = fedata;
330 map->sock = sock;
331 map->id = id;
332 map->ref = ref;
333
334 ret = xenbus_map_ring_valloc(fedata->dev, &ref, 1, &page);
335 if (ret < 0)
336 goto out;
337 map->ring = page;
338 map->ring_order = map->ring->ring_order;
339 /* first read the order, then map the data ring */
340 virt_rmb();
341 if (map->ring_order > MAX_RING_ORDER) {
342 pr_warn("%s frontend requested ring_order %u, which is > MAX (%u)\n",
343 __func__, map->ring_order, MAX_RING_ORDER);
344 goto out;
345 }
346 ret = xenbus_map_ring_valloc(fedata->dev, map->ring->ref,
347 (1 << map->ring_order), &page);
348 if (ret < 0)
349 goto out;
350 map->bytes = page;
351
352 ret = bind_interdomain_evtchn_to_irqhandler_lateeoi(
353 fedata->dev, evtchn,
354 pvcalls_back_conn_event, 0, "pvcalls-backend", map);
355 if (ret < 0)
356 goto out;
357 map->irq = ret;
358
359 map->data.in = map->bytes;
360 map->data.out = map->bytes + XEN_FLEX_RING_SIZE(map->ring_order);
361
362 map->ioworker.wq = alloc_workqueue("pvcalls_io", WQ_UNBOUND, 1);
363 if (!map->ioworker.wq)
364 goto out;
365 atomic_set(&map->io, 1);
366 INIT_WORK(&map->ioworker.register_work, pvcalls_back_ioworker);
367
368 down(&fedata->socket_lock);
369 list_add_tail(&map->list, &fedata->socket_mappings);
370 up(&fedata->socket_lock);
371
372 write_lock_bh(&map->sock->sk->sk_callback_lock);
373 map->saved_data_ready = map->sock->sk->sk_data_ready;
374 map->sock->sk->sk_user_data = map;
375 map->sock->sk->sk_data_ready = pvcalls_sk_data_ready;
376 map->sock->sk->sk_state_change = pvcalls_sk_state_change;
377 write_unlock_bh(&map->sock->sk->sk_callback_lock);
378
379 return map;
380 out:
381 down(&fedata->socket_lock);
382 list_del(&map->list);
383 pvcalls_back_release_active(fedata->dev, fedata, map);
384 up(&fedata->socket_lock);
385 return NULL;
386 }
387
pvcalls_back_connect(struct xenbus_device * dev,struct xen_pvcalls_request * req)388 static int pvcalls_back_connect(struct xenbus_device *dev,
389 struct xen_pvcalls_request *req)
390 {
391 struct pvcalls_fedata *fedata;
392 int ret = -EINVAL;
393 struct socket *sock;
394 struct sock_mapping *map;
395 struct xen_pvcalls_response *rsp;
396 struct sockaddr *sa = (struct sockaddr *)&req->u.connect.addr;
397
398 fedata = dev_get_drvdata(&dev->dev);
399
400 if (req->u.connect.len < sizeof(sa->sa_family) ||
401 req->u.connect.len > sizeof(req->u.connect.addr) ||
402 sa->sa_family != AF_INET)
403 goto out;
404
405 ret = sock_create(AF_INET, SOCK_STREAM, 0, &sock);
406 if (ret < 0)
407 goto out;
408 ret = inet_stream_connect(sock, sa, req->u.connect.len, 0);
409 if (ret < 0) {
410 sock_release(sock);
411 goto out;
412 }
413
414 map = pvcalls_new_active_socket(fedata,
415 req->u.connect.id,
416 req->u.connect.ref,
417 req->u.connect.evtchn,
418 sock);
419 if (!map)
420 ret = -EFAULT;
421
422 out:
423 rsp = RING_GET_RESPONSE(&fedata->ring, fedata->ring.rsp_prod_pvt++);
424 rsp->req_id = req->req_id;
425 rsp->cmd = req->cmd;
426 rsp->u.connect.id = req->u.connect.id;
427 rsp->ret = ret;
428
429 return 0;
430 }
431
pvcalls_back_release_active(struct xenbus_device * dev,struct pvcalls_fedata * fedata,struct sock_mapping * map)432 static int pvcalls_back_release_active(struct xenbus_device *dev,
433 struct pvcalls_fedata *fedata,
434 struct sock_mapping *map)
435 {
436 disable_irq(map->irq);
437 if (map->sock->sk != NULL) {
438 write_lock_bh(&map->sock->sk->sk_callback_lock);
439 map->sock->sk->sk_user_data = NULL;
440 map->sock->sk->sk_data_ready = map->saved_data_ready;
441 write_unlock_bh(&map->sock->sk->sk_callback_lock);
442 }
443
444 atomic_set(&map->release, 1);
445 flush_work(&map->ioworker.register_work);
446
447 xenbus_unmap_ring_vfree(dev, map->bytes);
448 xenbus_unmap_ring_vfree(dev, (void *)map->ring);
449 unbind_from_irqhandler(map->irq, map);
450
451 sock_release(map->sock);
452 kfree(map);
453
454 return 0;
455 }
456
pvcalls_back_release_passive(struct xenbus_device * dev,struct pvcalls_fedata * fedata,struct sockpass_mapping * mappass)457 static int pvcalls_back_release_passive(struct xenbus_device *dev,
458 struct pvcalls_fedata *fedata,
459 struct sockpass_mapping *mappass)
460 {
461 if (mappass->sock->sk != NULL) {
462 write_lock_bh(&mappass->sock->sk->sk_callback_lock);
463 mappass->sock->sk->sk_user_data = NULL;
464 mappass->sock->sk->sk_data_ready = mappass->saved_data_ready;
465 write_unlock_bh(&mappass->sock->sk->sk_callback_lock);
466 }
467 sock_release(mappass->sock);
468 destroy_workqueue(mappass->wq);
469 kfree(mappass);
470
471 return 0;
472 }
473
pvcalls_back_release(struct xenbus_device * dev,struct xen_pvcalls_request * req)474 static int pvcalls_back_release(struct xenbus_device *dev,
475 struct xen_pvcalls_request *req)
476 {
477 struct pvcalls_fedata *fedata;
478 struct sock_mapping *map, *n;
479 struct sockpass_mapping *mappass;
480 int ret = 0;
481 struct xen_pvcalls_response *rsp;
482
483 fedata = dev_get_drvdata(&dev->dev);
484
485 down(&fedata->socket_lock);
486 list_for_each_entry_safe(map, n, &fedata->socket_mappings, list) {
487 if (map->id == req->u.release.id) {
488 list_del(&map->list);
489 up(&fedata->socket_lock);
490 ret = pvcalls_back_release_active(dev, fedata, map);
491 goto out;
492 }
493 }
494 mappass = radix_tree_lookup(&fedata->socketpass_mappings,
495 req->u.release.id);
496 if (mappass != NULL) {
497 radix_tree_delete(&fedata->socketpass_mappings, mappass->id);
498 up(&fedata->socket_lock);
499 ret = pvcalls_back_release_passive(dev, fedata, mappass);
500 } else
501 up(&fedata->socket_lock);
502
503 out:
504 rsp = RING_GET_RESPONSE(&fedata->ring, fedata->ring.rsp_prod_pvt++);
505 rsp->req_id = req->req_id;
506 rsp->u.release.id = req->u.release.id;
507 rsp->cmd = req->cmd;
508 rsp->ret = ret;
509 return 0;
510 }
511
__pvcalls_back_accept(struct work_struct * work)512 static void __pvcalls_back_accept(struct work_struct *work)
513 {
514 struct sockpass_mapping *mappass = container_of(
515 work, struct sockpass_mapping, register_work);
516 struct sock_mapping *map;
517 struct pvcalls_ioworker *iow;
518 struct pvcalls_fedata *fedata;
519 struct socket *sock;
520 struct xen_pvcalls_response *rsp;
521 struct xen_pvcalls_request *req;
522 int notify;
523 int ret = -EINVAL;
524 unsigned long flags;
525
526 fedata = mappass->fedata;
527 /*
528 * __pvcalls_back_accept can race against pvcalls_back_accept.
529 * We only need to check the value of "cmd" on read. It could be
530 * done atomically, but to simplify the code on the write side, we
531 * use a spinlock.
532 */
533 spin_lock_irqsave(&mappass->copy_lock, flags);
534 req = &mappass->reqcopy;
535 if (req->cmd != PVCALLS_ACCEPT) {
536 spin_unlock_irqrestore(&mappass->copy_lock, flags);
537 return;
538 }
539 spin_unlock_irqrestore(&mappass->copy_lock, flags);
540
541 sock = sock_alloc();
542 if (sock == NULL)
543 goto out_error;
544 sock->type = mappass->sock->type;
545 sock->ops = mappass->sock->ops;
546
547 ret = inet_accept(mappass->sock, sock, O_NONBLOCK, true);
548 if (ret == -EAGAIN) {
549 sock_release(sock);
550 return;
551 }
552
553 map = pvcalls_new_active_socket(fedata,
554 req->u.accept.id_new,
555 req->u.accept.ref,
556 req->u.accept.evtchn,
557 sock);
558 if (!map) {
559 ret = -EFAULT;
560 goto out_error;
561 }
562
563 map->sockpass = mappass;
564 iow = &map->ioworker;
565 atomic_inc(&map->read);
566 atomic_inc(&map->io);
567 queue_work(iow->wq, &iow->register_work);
568
569 out_error:
570 rsp = RING_GET_RESPONSE(&fedata->ring, fedata->ring.rsp_prod_pvt++);
571 rsp->req_id = req->req_id;
572 rsp->cmd = req->cmd;
573 rsp->u.accept.id = req->u.accept.id;
574 rsp->ret = ret;
575 RING_PUSH_RESPONSES_AND_CHECK_NOTIFY(&fedata->ring, notify);
576 if (notify)
577 notify_remote_via_irq(fedata->irq);
578
579 mappass->reqcopy.cmd = 0;
580 }
581
pvcalls_pass_sk_data_ready(struct sock * sock)582 static void pvcalls_pass_sk_data_ready(struct sock *sock)
583 {
584 struct sockpass_mapping *mappass = sock->sk_user_data;
585 struct pvcalls_fedata *fedata;
586 struct xen_pvcalls_response *rsp;
587 unsigned long flags;
588 int notify;
589
590 if (mappass == NULL)
591 return;
592
593 fedata = mappass->fedata;
594 spin_lock_irqsave(&mappass->copy_lock, flags);
595 if (mappass->reqcopy.cmd == PVCALLS_POLL) {
596 rsp = RING_GET_RESPONSE(&fedata->ring,
597 fedata->ring.rsp_prod_pvt++);
598 rsp->req_id = mappass->reqcopy.req_id;
599 rsp->u.poll.id = mappass->reqcopy.u.poll.id;
600 rsp->cmd = mappass->reqcopy.cmd;
601 rsp->ret = 0;
602
603 mappass->reqcopy.cmd = 0;
604 spin_unlock_irqrestore(&mappass->copy_lock, flags);
605
606 RING_PUSH_RESPONSES_AND_CHECK_NOTIFY(&fedata->ring, notify);
607 if (notify)
608 notify_remote_via_irq(mappass->fedata->irq);
609 } else {
610 spin_unlock_irqrestore(&mappass->copy_lock, flags);
611 queue_work(mappass->wq, &mappass->register_work);
612 }
613 }
614
pvcalls_back_bind(struct xenbus_device * dev,struct xen_pvcalls_request * req)615 static int pvcalls_back_bind(struct xenbus_device *dev,
616 struct xen_pvcalls_request *req)
617 {
618 struct pvcalls_fedata *fedata;
619 int ret;
620 struct sockpass_mapping *map;
621 struct xen_pvcalls_response *rsp;
622
623 fedata = dev_get_drvdata(&dev->dev);
624
625 map = kzalloc(sizeof(*map), GFP_KERNEL);
626 if (map == NULL) {
627 ret = -ENOMEM;
628 goto out;
629 }
630
631 INIT_WORK(&map->register_work, __pvcalls_back_accept);
632 spin_lock_init(&map->copy_lock);
633 map->wq = alloc_workqueue("pvcalls_wq", WQ_UNBOUND, 1);
634 if (!map->wq) {
635 ret = -ENOMEM;
636 goto out;
637 }
638
639 ret = sock_create(AF_INET, SOCK_STREAM, 0, &map->sock);
640 if (ret < 0)
641 goto out;
642
643 ret = inet_bind(map->sock, (struct sockaddr *)&req->u.bind.addr,
644 req->u.bind.len);
645 if (ret < 0)
646 goto out;
647
648 map->fedata = fedata;
649 map->id = req->u.bind.id;
650
651 down(&fedata->socket_lock);
652 ret = radix_tree_insert(&fedata->socketpass_mappings, map->id,
653 map);
654 up(&fedata->socket_lock);
655 if (ret)
656 goto out;
657
658 write_lock_bh(&map->sock->sk->sk_callback_lock);
659 map->saved_data_ready = map->sock->sk->sk_data_ready;
660 map->sock->sk->sk_user_data = map;
661 map->sock->sk->sk_data_ready = pvcalls_pass_sk_data_ready;
662 write_unlock_bh(&map->sock->sk->sk_callback_lock);
663
664 out:
665 if (ret) {
666 if (map && map->sock)
667 sock_release(map->sock);
668 if (map && map->wq)
669 destroy_workqueue(map->wq);
670 kfree(map);
671 }
672 rsp = RING_GET_RESPONSE(&fedata->ring, fedata->ring.rsp_prod_pvt++);
673 rsp->req_id = req->req_id;
674 rsp->cmd = req->cmd;
675 rsp->u.bind.id = req->u.bind.id;
676 rsp->ret = ret;
677 return 0;
678 }
679
pvcalls_back_listen(struct xenbus_device * dev,struct xen_pvcalls_request * req)680 static int pvcalls_back_listen(struct xenbus_device *dev,
681 struct xen_pvcalls_request *req)
682 {
683 struct pvcalls_fedata *fedata;
684 int ret = -EINVAL;
685 struct sockpass_mapping *map;
686 struct xen_pvcalls_response *rsp;
687
688 fedata = dev_get_drvdata(&dev->dev);
689
690 down(&fedata->socket_lock);
691 map = radix_tree_lookup(&fedata->socketpass_mappings, req->u.listen.id);
692 up(&fedata->socket_lock);
693 if (map == NULL)
694 goto out;
695
696 ret = inet_listen(map->sock, req->u.listen.backlog);
697
698 out:
699 rsp = RING_GET_RESPONSE(&fedata->ring, fedata->ring.rsp_prod_pvt++);
700 rsp->req_id = req->req_id;
701 rsp->cmd = req->cmd;
702 rsp->u.listen.id = req->u.listen.id;
703 rsp->ret = ret;
704 return 0;
705 }
706
pvcalls_back_accept(struct xenbus_device * dev,struct xen_pvcalls_request * req)707 static int pvcalls_back_accept(struct xenbus_device *dev,
708 struct xen_pvcalls_request *req)
709 {
710 struct pvcalls_fedata *fedata;
711 struct sockpass_mapping *mappass;
712 int ret = -EINVAL;
713 struct xen_pvcalls_response *rsp;
714 unsigned long flags;
715
716 fedata = dev_get_drvdata(&dev->dev);
717
718 down(&fedata->socket_lock);
719 mappass = radix_tree_lookup(&fedata->socketpass_mappings,
720 req->u.accept.id);
721 up(&fedata->socket_lock);
722 if (mappass == NULL)
723 goto out_error;
724
725 /*
726 * Limitation of the current implementation: only support one
727 * concurrent accept or poll call on one socket.
728 */
729 spin_lock_irqsave(&mappass->copy_lock, flags);
730 if (mappass->reqcopy.cmd != 0) {
731 spin_unlock_irqrestore(&mappass->copy_lock, flags);
732 ret = -EINTR;
733 goto out_error;
734 }
735
736 mappass->reqcopy = *req;
737 spin_unlock_irqrestore(&mappass->copy_lock, flags);
738 queue_work(mappass->wq, &mappass->register_work);
739
740 /* Tell the caller we don't need to send back a notification yet */
741 return -1;
742
743 out_error:
744 rsp = RING_GET_RESPONSE(&fedata->ring, fedata->ring.rsp_prod_pvt++);
745 rsp->req_id = req->req_id;
746 rsp->cmd = req->cmd;
747 rsp->u.accept.id = req->u.accept.id;
748 rsp->ret = ret;
749 return 0;
750 }
751
pvcalls_back_poll(struct xenbus_device * dev,struct xen_pvcalls_request * req)752 static int pvcalls_back_poll(struct xenbus_device *dev,
753 struct xen_pvcalls_request *req)
754 {
755 struct pvcalls_fedata *fedata;
756 struct sockpass_mapping *mappass;
757 struct xen_pvcalls_response *rsp;
758 struct inet_connection_sock *icsk;
759 struct request_sock_queue *queue;
760 unsigned long flags;
761 int ret;
762 bool data;
763
764 fedata = dev_get_drvdata(&dev->dev);
765
766 down(&fedata->socket_lock);
767 mappass = radix_tree_lookup(&fedata->socketpass_mappings,
768 req->u.poll.id);
769 up(&fedata->socket_lock);
770 if (mappass == NULL)
771 return -EINVAL;
772
773 /*
774 * Limitation of the current implementation: only support one
775 * concurrent accept or poll call on one socket.
776 */
777 spin_lock_irqsave(&mappass->copy_lock, flags);
778 if (mappass->reqcopy.cmd != 0) {
779 ret = -EINTR;
780 goto out;
781 }
782
783 mappass->reqcopy = *req;
784 icsk = inet_csk(mappass->sock->sk);
785 queue = &icsk->icsk_accept_queue;
786 data = READ_ONCE(queue->rskq_accept_head) != NULL;
787 if (data) {
788 mappass->reqcopy.cmd = 0;
789 ret = 0;
790 goto out;
791 }
792 spin_unlock_irqrestore(&mappass->copy_lock, flags);
793
794 /* Tell the caller we don't need to send back a notification yet */
795 return -1;
796
797 out:
798 spin_unlock_irqrestore(&mappass->copy_lock, flags);
799
800 rsp = RING_GET_RESPONSE(&fedata->ring, fedata->ring.rsp_prod_pvt++);
801 rsp->req_id = req->req_id;
802 rsp->cmd = req->cmd;
803 rsp->u.poll.id = req->u.poll.id;
804 rsp->ret = ret;
805 return 0;
806 }
807
pvcalls_back_handle_cmd(struct xenbus_device * dev,struct xen_pvcalls_request * req)808 static int pvcalls_back_handle_cmd(struct xenbus_device *dev,
809 struct xen_pvcalls_request *req)
810 {
811 int ret = 0;
812
813 switch (req->cmd) {
814 case PVCALLS_SOCKET:
815 ret = pvcalls_back_socket(dev, req);
816 break;
817 case PVCALLS_CONNECT:
818 ret = pvcalls_back_connect(dev, req);
819 break;
820 case PVCALLS_RELEASE:
821 ret = pvcalls_back_release(dev, req);
822 break;
823 case PVCALLS_BIND:
824 ret = pvcalls_back_bind(dev, req);
825 break;
826 case PVCALLS_LISTEN:
827 ret = pvcalls_back_listen(dev, req);
828 break;
829 case PVCALLS_ACCEPT:
830 ret = pvcalls_back_accept(dev, req);
831 break;
832 case PVCALLS_POLL:
833 ret = pvcalls_back_poll(dev, req);
834 break;
835 default:
836 {
837 struct pvcalls_fedata *fedata;
838 struct xen_pvcalls_response *rsp;
839
840 fedata = dev_get_drvdata(&dev->dev);
841 rsp = RING_GET_RESPONSE(
842 &fedata->ring, fedata->ring.rsp_prod_pvt++);
843 rsp->req_id = req->req_id;
844 rsp->cmd = req->cmd;
845 rsp->ret = -ENOTSUPP;
846 break;
847 }
848 }
849 return ret;
850 }
851
pvcalls_back_work(struct pvcalls_fedata * fedata)852 static void pvcalls_back_work(struct pvcalls_fedata *fedata)
853 {
854 int notify, notify_all = 0, more = 1;
855 struct xen_pvcalls_request req;
856 struct xenbus_device *dev = fedata->dev;
857
858 while (more) {
859 while (RING_HAS_UNCONSUMED_REQUESTS(&fedata->ring)) {
860 RING_COPY_REQUEST(&fedata->ring,
861 fedata->ring.req_cons++,
862 &req);
863
864 if (!pvcalls_back_handle_cmd(dev, &req)) {
865 RING_PUSH_RESPONSES_AND_CHECK_NOTIFY(
866 &fedata->ring, notify);
867 notify_all += notify;
868 }
869 }
870
871 if (notify_all) {
872 notify_remote_via_irq(fedata->irq);
873 notify_all = 0;
874 }
875
876 RING_FINAL_CHECK_FOR_REQUESTS(&fedata->ring, more);
877 }
878 }
879
pvcalls_back_event(int irq,void * dev_id)880 static irqreturn_t pvcalls_back_event(int irq, void *dev_id)
881 {
882 struct xenbus_device *dev = dev_id;
883 struct pvcalls_fedata *fedata = NULL;
884 unsigned int eoi_flags = XEN_EOI_FLAG_SPURIOUS;
885
886 if (dev) {
887 fedata = dev_get_drvdata(&dev->dev);
888 if (fedata) {
889 pvcalls_back_work(fedata);
890 eoi_flags = 0;
891 }
892 }
893
894 xen_irq_lateeoi(irq, eoi_flags);
895
896 return IRQ_HANDLED;
897 }
898
pvcalls_back_conn_event(int irq,void * sock_map)899 static irqreturn_t pvcalls_back_conn_event(int irq, void *sock_map)
900 {
901 struct sock_mapping *map = sock_map;
902 struct pvcalls_ioworker *iow;
903
904 if (map == NULL || map->sock == NULL || map->sock->sk == NULL ||
905 map->sock->sk->sk_user_data != map) {
906 xen_irq_lateeoi(irq, 0);
907 return IRQ_HANDLED;
908 }
909
910 iow = &map->ioworker;
911
912 atomic_inc(&map->write);
913 atomic_inc(&map->eoi);
914 atomic_inc(&map->io);
915 queue_work(iow->wq, &iow->register_work);
916
917 return IRQ_HANDLED;
918 }
919
backend_connect(struct xenbus_device * dev)920 static int backend_connect(struct xenbus_device *dev)
921 {
922 int err;
923 evtchn_port_t evtchn;
924 grant_ref_t ring_ref;
925 struct pvcalls_fedata *fedata = NULL;
926
927 fedata = kzalloc(sizeof(struct pvcalls_fedata), GFP_KERNEL);
928 if (!fedata)
929 return -ENOMEM;
930
931 fedata->irq = -1;
932 err = xenbus_scanf(XBT_NIL, dev->otherend, "port", "%u",
933 &evtchn);
934 if (err != 1) {
935 err = -EINVAL;
936 xenbus_dev_fatal(dev, err, "reading %s/event-channel",
937 dev->otherend);
938 goto error;
939 }
940
941 err = xenbus_scanf(XBT_NIL, dev->otherend, "ring-ref", "%u", &ring_ref);
942 if (err != 1) {
943 err = -EINVAL;
944 xenbus_dev_fatal(dev, err, "reading %s/ring-ref",
945 dev->otherend);
946 goto error;
947 }
948
949 err = bind_interdomain_evtchn_to_irq_lateeoi(dev, evtchn);
950 if (err < 0)
951 goto error;
952 fedata->irq = err;
953
954 err = request_threaded_irq(fedata->irq, NULL, pvcalls_back_event,
955 IRQF_ONESHOT, "pvcalls-back", dev);
956 if (err < 0)
957 goto error;
958
959 err = xenbus_map_ring_valloc(dev, &ring_ref, 1,
960 (void **)&fedata->sring);
961 if (err < 0)
962 goto error;
963
964 BACK_RING_INIT(&fedata->ring, fedata->sring, XEN_PAGE_SIZE * 1);
965 fedata->dev = dev;
966
967 INIT_LIST_HEAD(&fedata->socket_mappings);
968 INIT_RADIX_TREE(&fedata->socketpass_mappings, GFP_KERNEL);
969 sema_init(&fedata->socket_lock, 1);
970 dev_set_drvdata(&dev->dev, fedata);
971
972 down(&pvcalls_back_global.frontends_lock);
973 list_add_tail(&fedata->list, &pvcalls_back_global.frontends);
974 up(&pvcalls_back_global.frontends_lock);
975
976 return 0;
977
978 error:
979 if (fedata->irq >= 0)
980 unbind_from_irqhandler(fedata->irq, dev);
981 if (fedata->sring != NULL)
982 xenbus_unmap_ring_vfree(dev, fedata->sring);
983 kfree(fedata);
984 return err;
985 }
986
backend_disconnect(struct xenbus_device * dev)987 static int backend_disconnect(struct xenbus_device *dev)
988 {
989 struct pvcalls_fedata *fedata;
990 struct sock_mapping *map, *n;
991 struct sockpass_mapping *mappass;
992 struct radix_tree_iter iter;
993 void **slot;
994
995
996 fedata = dev_get_drvdata(&dev->dev);
997
998 down(&fedata->socket_lock);
999 list_for_each_entry_safe(map, n, &fedata->socket_mappings, list) {
1000 list_del(&map->list);
1001 pvcalls_back_release_active(dev, fedata, map);
1002 }
1003
1004 radix_tree_for_each_slot(slot, &fedata->socketpass_mappings, &iter, 0) {
1005 mappass = radix_tree_deref_slot(slot);
1006 if (!mappass)
1007 continue;
1008 if (radix_tree_exception(mappass)) {
1009 if (radix_tree_deref_retry(mappass))
1010 slot = radix_tree_iter_retry(&iter);
1011 } else {
1012 radix_tree_delete(&fedata->socketpass_mappings,
1013 mappass->id);
1014 pvcalls_back_release_passive(dev, fedata, mappass);
1015 }
1016 }
1017 up(&fedata->socket_lock);
1018
1019 unbind_from_irqhandler(fedata->irq, dev);
1020 xenbus_unmap_ring_vfree(dev, fedata->sring);
1021
1022 list_del(&fedata->list);
1023 kfree(fedata);
1024 dev_set_drvdata(&dev->dev, NULL);
1025
1026 return 0;
1027 }
1028
pvcalls_back_probe(struct xenbus_device * dev,const struct xenbus_device_id * id)1029 static int pvcalls_back_probe(struct xenbus_device *dev,
1030 const struct xenbus_device_id *id)
1031 {
1032 int err, abort;
1033 struct xenbus_transaction xbt;
1034
1035 again:
1036 abort = 1;
1037
1038 err = xenbus_transaction_start(&xbt);
1039 if (err) {
1040 pr_warn("%s cannot create xenstore transaction\n", __func__);
1041 return err;
1042 }
1043
1044 err = xenbus_printf(xbt, dev->nodename, "versions", "%s",
1045 PVCALLS_VERSIONS);
1046 if (err) {
1047 pr_warn("%s write out 'versions' failed\n", __func__);
1048 goto abort;
1049 }
1050
1051 err = xenbus_printf(xbt, dev->nodename, "max-page-order", "%u",
1052 MAX_RING_ORDER);
1053 if (err) {
1054 pr_warn("%s write out 'max-page-order' failed\n", __func__);
1055 goto abort;
1056 }
1057
1058 err = xenbus_printf(xbt, dev->nodename, "function-calls",
1059 XENBUS_FUNCTIONS_CALLS);
1060 if (err) {
1061 pr_warn("%s write out 'function-calls' failed\n", __func__);
1062 goto abort;
1063 }
1064
1065 abort = 0;
1066 abort:
1067 err = xenbus_transaction_end(xbt, abort);
1068 if (err) {
1069 if (err == -EAGAIN && !abort)
1070 goto again;
1071 pr_warn("%s cannot complete xenstore transaction\n", __func__);
1072 return err;
1073 }
1074
1075 if (abort)
1076 return -EFAULT;
1077
1078 xenbus_switch_state(dev, XenbusStateInitWait);
1079
1080 return 0;
1081 }
1082
set_backend_state(struct xenbus_device * dev,enum xenbus_state state)1083 static void set_backend_state(struct xenbus_device *dev,
1084 enum xenbus_state state)
1085 {
1086 while (dev->state != state) {
1087 switch (dev->state) {
1088 case XenbusStateClosed:
1089 switch (state) {
1090 case XenbusStateInitWait:
1091 case XenbusStateConnected:
1092 xenbus_switch_state(dev, XenbusStateInitWait);
1093 break;
1094 case XenbusStateClosing:
1095 xenbus_switch_state(dev, XenbusStateClosing);
1096 break;
1097 default:
1098 WARN_ON(1);
1099 }
1100 break;
1101 case XenbusStateInitWait:
1102 case XenbusStateInitialised:
1103 switch (state) {
1104 case XenbusStateConnected:
1105 if (backend_connect(dev))
1106 return;
1107 xenbus_switch_state(dev, XenbusStateConnected);
1108 break;
1109 case XenbusStateClosing:
1110 case XenbusStateClosed:
1111 xenbus_switch_state(dev, XenbusStateClosing);
1112 break;
1113 default:
1114 WARN_ON(1);
1115 }
1116 break;
1117 case XenbusStateConnected:
1118 switch (state) {
1119 case XenbusStateInitWait:
1120 case XenbusStateClosing:
1121 case XenbusStateClosed:
1122 down(&pvcalls_back_global.frontends_lock);
1123 backend_disconnect(dev);
1124 up(&pvcalls_back_global.frontends_lock);
1125 xenbus_switch_state(dev, XenbusStateClosing);
1126 break;
1127 default:
1128 WARN_ON(1);
1129 }
1130 break;
1131 case XenbusStateClosing:
1132 switch (state) {
1133 case XenbusStateInitWait:
1134 case XenbusStateConnected:
1135 case XenbusStateClosed:
1136 xenbus_switch_state(dev, XenbusStateClosed);
1137 break;
1138 default:
1139 WARN_ON(1);
1140 }
1141 break;
1142 default:
1143 WARN_ON(1);
1144 }
1145 }
1146 }
1147
pvcalls_back_changed(struct xenbus_device * dev,enum xenbus_state frontend_state)1148 static void pvcalls_back_changed(struct xenbus_device *dev,
1149 enum xenbus_state frontend_state)
1150 {
1151 switch (frontend_state) {
1152 case XenbusStateInitialising:
1153 set_backend_state(dev, XenbusStateInitWait);
1154 break;
1155
1156 case XenbusStateInitialised:
1157 case XenbusStateConnected:
1158 set_backend_state(dev, XenbusStateConnected);
1159 break;
1160
1161 case XenbusStateClosing:
1162 set_backend_state(dev, XenbusStateClosing);
1163 break;
1164
1165 case XenbusStateClosed:
1166 set_backend_state(dev, XenbusStateClosed);
1167 if (xenbus_dev_is_online(dev))
1168 break;
1169 device_unregister(&dev->dev);
1170 break;
1171 case XenbusStateUnknown:
1172 set_backend_state(dev, XenbusStateClosed);
1173 device_unregister(&dev->dev);
1174 break;
1175
1176 default:
1177 xenbus_dev_fatal(dev, -EINVAL, "saw state %d at frontend",
1178 frontend_state);
1179 break;
1180 }
1181 }
1182
pvcalls_back_remove(struct xenbus_device * dev)1183 static int pvcalls_back_remove(struct xenbus_device *dev)
1184 {
1185 return 0;
1186 }
1187
pvcalls_back_uevent(struct xenbus_device * xdev,struct kobj_uevent_env * env)1188 static int pvcalls_back_uevent(struct xenbus_device *xdev,
1189 struct kobj_uevent_env *env)
1190 {
1191 return 0;
1192 }
1193
1194 static const struct xenbus_device_id pvcalls_back_ids[] = {
1195 { "pvcalls" },
1196 { "" }
1197 };
1198
1199 static struct xenbus_driver pvcalls_back_driver = {
1200 .ids = pvcalls_back_ids,
1201 .probe = pvcalls_back_probe,
1202 .remove = pvcalls_back_remove,
1203 .uevent = pvcalls_back_uevent,
1204 .otherend_changed = pvcalls_back_changed,
1205 };
1206
pvcalls_back_init(void)1207 static int __init pvcalls_back_init(void)
1208 {
1209 int ret;
1210
1211 if (!xen_domain())
1212 return -ENODEV;
1213
1214 ret = xenbus_register_backend(&pvcalls_back_driver);
1215 if (ret < 0)
1216 return ret;
1217
1218 sema_init(&pvcalls_back_global.frontends_lock, 1);
1219 INIT_LIST_HEAD(&pvcalls_back_global.frontends);
1220 return 0;
1221 }
1222 module_init(pvcalls_back_init);
1223
pvcalls_back_fin(void)1224 static void __exit pvcalls_back_fin(void)
1225 {
1226 struct pvcalls_fedata *fedata, *nfedata;
1227
1228 down(&pvcalls_back_global.frontends_lock);
1229 list_for_each_entry_safe(fedata, nfedata,
1230 &pvcalls_back_global.frontends, list) {
1231 backend_disconnect(fedata->dev);
1232 }
1233 up(&pvcalls_back_global.frontends_lock);
1234
1235 xenbus_unregister_driver(&pvcalls_back_driver);
1236 }
1237
1238 module_exit(pvcalls_back_fin);
1239
1240 MODULE_DESCRIPTION("Xen PV Calls backend driver");
1241 MODULE_AUTHOR("Stefano Stabellini <sstabellini@kernel.org>");
1242 MODULE_LICENSE("GPL");
1243