Loading...
1// SPDX-License-Identifier: GPL-2.0-or-later
2/*
3 * (c) 2017 Stefano Stabellini <stefano@aporeto.com>
4 */
5
6#include <linux/module.h>
7#include <linux/net.h>
8#include <linux/socket.h>
9
10#include <net/sock.h>
11
12#include <xen/events.h>
13#include <xen/grant_table.h>
14#include <xen/xen.h>
15#include <xen/xenbus.h>
16#include <xen/interface/io/pvcalls.h>
17
18#include "pvcalls-front.h"
19
20#define PVCALLS_INVALID_ID UINT_MAX
21#define PVCALLS_RING_ORDER XENBUS_MAX_RING_GRANT_ORDER
22#define PVCALLS_NR_RSP_PER_RING __CONST_RING_SIZE(xen_pvcalls, XEN_PAGE_SIZE)
23#define PVCALLS_FRONT_MAX_SPIN 5000
24
25static struct proto pvcalls_proto = {
26 .name = "PVCalls",
27 .owner = THIS_MODULE,
28 .obj_size = sizeof(struct sock),
29};
30
31struct pvcalls_bedata {
32 struct xen_pvcalls_front_ring ring;
33 grant_ref_t ref;
34 int irq;
35
36 struct list_head socket_mappings;
37 spinlock_t socket_lock;
38
39 wait_queue_head_t inflight_req;
40 struct xen_pvcalls_response rsp[PVCALLS_NR_RSP_PER_RING];
41};
42/* Only one front/back connection supported. */
43static struct xenbus_device *pvcalls_front_dev;
44static atomic_t pvcalls_refcount;
45
46/* first increment refcount, then proceed */
47#define pvcalls_enter() { \
48 atomic_inc(&pvcalls_refcount); \
49}
50
51/* first complete other operations, then decrement refcount */
52#define pvcalls_exit() { \
53 atomic_dec(&pvcalls_refcount); \
54}
55
56struct sock_mapping {
57 bool active_socket;
58 struct list_head list;
59 struct socket *sock;
60 atomic_t refcount;
61 union {
62 struct {
63 int irq;
64 grant_ref_t ref;
65 struct pvcalls_data_intf *ring;
66 struct pvcalls_data data;
67 struct mutex in_mutex;
68 struct mutex out_mutex;
69
70 wait_queue_head_t inflight_conn_req;
71 } active;
72 struct {
73 /*
74 * Socket status, needs to be 64-bit aligned due to the
75 * test_and_* functions which have this requirement on arm64.
76 */
77#define PVCALLS_STATUS_UNINITALIZED 0
78#define PVCALLS_STATUS_BIND 1
79#define PVCALLS_STATUS_LISTEN 2
80 uint8_t status __attribute__((aligned(8)));
81 /*
82 * Internal state-machine flags.
83 * Only one accept operation can be inflight for a socket.
84 * Only one poll operation can be inflight for a given socket.
85 * flags needs to be 64-bit aligned due to the test_and_*
86 * functions which have this requirement on arm64.
87 */
88#define PVCALLS_FLAG_ACCEPT_INFLIGHT 0
89#define PVCALLS_FLAG_POLL_INFLIGHT 1
90#define PVCALLS_FLAG_POLL_RET 2
91 uint8_t flags __attribute__((aligned(8)));
92 uint32_t inflight_req_id;
93 struct sock_mapping *accept_map;
94 wait_queue_head_t inflight_accept_req;
95 } passive;
96 };
97};
98
99static inline struct sock_mapping *pvcalls_enter_sock(struct socket *sock)
100{
101 struct sock_mapping *map;
102
103 if (!pvcalls_front_dev ||
104 dev_get_drvdata(&pvcalls_front_dev->dev) == NULL)
105 return ERR_PTR(-ENOTCONN);
106
107 map = (struct sock_mapping *)sock->sk->sk_send_head;
108 if (map == NULL)
109 return ERR_PTR(-ENOTSOCK);
110
111 pvcalls_enter();
112 atomic_inc(&map->refcount);
113 return map;
114}
115
116static inline void pvcalls_exit_sock(struct socket *sock)
117{
118 struct sock_mapping *map;
119
120 map = (struct sock_mapping *)sock->sk->sk_send_head;
121 atomic_dec(&map->refcount);
122 pvcalls_exit();
123}
124
125static inline int get_request(struct pvcalls_bedata *bedata, int *req_id)
126{
127 *req_id = bedata->ring.req_prod_pvt & (RING_SIZE(&bedata->ring) - 1);
128 if (RING_FULL(&bedata->ring) ||
129 bedata->rsp[*req_id].req_id != PVCALLS_INVALID_ID)
130 return -EAGAIN;
131 return 0;
132}
133
134static bool pvcalls_front_write_todo(struct sock_mapping *map)
135{
136 struct pvcalls_data_intf *intf = map->active.ring;
137 RING_IDX cons, prod, size = XEN_FLEX_RING_SIZE(PVCALLS_RING_ORDER);
138 int32_t error;
139
140 error = intf->out_error;
141 if (error == -ENOTCONN)
142 return false;
143 if (error != 0)
144 return true;
145
146 cons = intf->out_cons;
147 prod = intf->out_prod;
148 return !!(size - pvcalls_queued(prod, cons, size));
149}
150
151static bool pvcalls_front_read_todo(struct sock_mapping *map)
152{
153 struct pvcalls_data_intf *intf = map->active.ring;
154 RING_IDX cons, prod;
155 int32_t error;
156
157 cons = intf->in_cons;
158 prod = intf->in_prod;
159 error = intf->in_error;
160 return (error != 0 ||
161 pvcalls_queued(prod, cons,
162 XEN_FLEX_RING_SIZE(PVCALLS_RING_ORDER)) != 0);
163}
164
165static irqreturn_t pvcalls_front_event_handler(int irq, void *dev_id)
166{
167 struct xenbus_device *dev = dev_id;
168 struct pvcalls_bedata *bedata;
169 struct xen_pvcalls_response *rsp;
170 uint8_t *src, *dst;
171 int req_id = 0, more = 0, done = 0;
172
173 if (dev == NULL)
174 return IRQ_HANDLED;
175
176 pvcalls_enter();
177 bedata = dev_get_drvdata(&dev->dev);
178 if (bedata == NULL) {
179 pvcalls_exit();
180 return IRQ_HANDLED;
181 }
182
183again:
184 while (RING_HAS_UNCONSUMED_RESPONSES(&bedata->ring)) {
185 rsp = RING_GET_RESPONSE(&bedata->ring, bedata->ring.rsp_cons);
186
187 req_id = rsp->req_id;
188 if (rsp->cmd == PVCALLS_POLL) {
189 struct sock_mapping *map = (struct sock_mapping *)(uintptr_t)
190 rsp->u.poll.id;
191
192 clear_bit(PVCALLS_FLAG_POLL_INFLIGHT,
193 (void *)&map->passive.flags);
194 /*
195 * clear INFLIGHT, then set RET. It pairs with
196 * the checks at the beginning of
197 * pvcalls_front_poll_passive.
198 */
199 smp_wmb();
200 set_bit(PVCALLS_FLAG_POLL_RET,
201 (void *)&map->passive.flags);
202 } else {
203 dst = (uint8_t *)&bedata->rsp[req_id] +
204 sizeof(rsp->req_id);
205 src = (uint8_t *)rsp + sizeof(rsp->req_id);
206 memcpy(dst, src, sizeof(*rsp) - sizeof(rsp->req_id));
207 /*
208 * First copy the rest of the data, then req_id. It is
209 * paired with the barrier when accessing bedata->rsp.
210 */
211 smp_wmb();
212 bedata->rsp[req_id].req_id = req_id;
213 }
214
215 done = 1;
216 bedata->ring.rsp_cons++;
217 }
218
219 RING_FINAL_CHECK_FOR_RESPONSES(&bedata->ring, more);
220 if (more)
221 goto again;
222 if (done)
223 wake_up(&bedata->inflight_req);
224 pvcalls_exit();
225 return IRQ_HANDLED;
226}
227
228static void free_active_ring(struct sock_mapping *map);
229
230static void pvcalls_front_free_map(struct pvcalls_bedata *bedata,
231 struct sock_mapping *map)
232{
233 int i;
234
235 unbind_from_irqhandler(map->active.irq, map);
236
237 spin_lock(&bedata->socket_lock);
238 if (!list_empty(&map->list))
239 list_del_init(&map->list);
240 spin_unlock(&bedata->socket_lock);
241
242 for (i = 0; i < (1 << PVCALLS_RING_ORDER); i++)
243 gnttab_end_foreign_access(map->active.ring->ref[i], NULL);
244 gnttab_end_foreign_access(map->active.ref, NULL);
245 free_active_ring(map);
246
247 kfree(map);
248}
249
250static irqreturn_t pvcalls_front_conn_handler(int irq, void *sock_map)
251{
252 struct sock_mapping *map = sock_map;
253
254 if (map == NULL)
255 return IRQ_HANDLED;
256
257 wake_up_interruptible(&map->active.inflight_conn_req);
258
259 return IRQ_HANDLED;
260}
261
262int pvcalls_front_socket(struct socket *sock)
263{
264 struct pvcalls_bedata *bedata;
265 struct sock_mapping *map = NULL;
266 struct xen_pvcalls_request *req;
267 int notify, req_id, ret;
268
269 /*
270 * PVCalls only supports domain AF_INET,
271 * type SOCK_STREAM and protocol 0 sockets for now.
272 *
273 * Check socket type here, AF_INET and protocol checks are done
274 * by the caller.
275 */
276 if (sock->type != SOCK_STREAM)
277 return -EOPNOTSUPP;
278
279 pvcalls_enter();
280 if (!pvcalls_front_dev) {
281 pvcalls_exit();
282 return -EACCES;
283 }
284 bedata = dev_get_drvdata(&pvcalls_front_dev->dev);
285
286 map = kzalloc(sizeof(*map), GFP_KERNEL);
287 if (map == NULL) {
288 pvcalls_exit();
289 return -ENOMEM;
290 }
291
292 spin_lock(&bedata->socket_lock);
293
294 ret = get_request(bedata, &req_id);
295 if (ret < 0) {
296 kfree(map);
297 spin_unlock(&bedata->socket_lock);
298 pvcalls_exit();
299 return ret;
300 }
301
302 /*
303 * sock->sk->sk_send_head is not used for ip sockets: reuse the
304 * field to store a pointer to the struct sock_mapping
305 * corresponding to the socket. This way, we can easily get the
306 * struct sock_mapping from the struct socket.
307 */
308 sock->sk->sk_send_head = (void *)map;
309 list_add_tail(&map->list, &bedata->socket_mappings);
310
311 req = RING_GET_REQUEST(&bedata->ring, req_id);
312 req->req_id = req_id;
313 req->cmd = PVCALLS_SOCKET;
314 req->u.socket.id = (uintptr_t) map;
315 req->u.socket.domain = AF_INET;
316 req->u.socket.type = SOCK_STREAM;
317 req->u.socket.protocol = IPPROTO_IP;
318
319 bedata->ring.req_prod_pvt++;
320 RING_PUSH_REQUESTS_AND_CHECK_NOTIFY(&bedata->ring, notify);
321 spin_unlock(&bedata->socket_lock);
322 if (notify)
323 notify_remote_via_irq(bedata->irq);
324
325 wait_event(bedata->inflight_req,
326 READ_ONCE(bedata->rsp[req_id].req_id) == req_id);
327
328 /* read req_id, then the content */
329 smp_rmb();
330 ret = bedata->rsp[req_id].ret;
331 bedata->rsp[req_id].req_id = PVCALLS_INVALID_ID;
332
333 pvcalls_exit();
334 return ret;
335}
336
337static void free_active_ring(struct sock_mapping *map)
338{
339 if (!map->active.ring)
340 return;
341
342 free_pages_exact(map->active.data.in,
343 PAGE_SIZE << map->active.ring->ring_order);
344 free_page((unsigned long)map->active.ring);
345}
346
347static int alloc_active_ring(struct sock_mapping *map)
348{
349 void *bytes;
350
351 map->active.ring = (struct pvcalls_data_intf *)
352 get_zeroed_page(GFP_KERNEL);
353 if (!map->active.ring)
354 goto out;
355
356 map->active.ring->ring_order = PVCALLS_RING_ORDER;
357 bytes = alloc_pages_exact(PAGE_SIZE << PVCALLS_RING_ORDER,
358 GFP_KERNEL | __GFP_ZERO);
359 if (!bytes)
360 goto out;
361
362 map->active.data.in = bytes;
363 map->active.data.out = bytes +
364 XEN_FLEX_RING_SIZE(PVCALLS_RING_ORDER);
365
366 return 0;
367
368out:
369 free_active_ring(map);
370 return -ENOMEM;
371}
372
373static int create_active(struct sock_mapping *map, evtchn_port_t *evtchn)
374{
375 void *bytes;
376 int ret, irq = -1, i;
377
378 *evtchn = 0;
379 init_waitqueue_head(&map->active.inflight_conn_req);
380
381 bytes = map->active.data.in;
382 for (i = 0; i < (1 << PVCALLS_RING_ORDER); i++)
383 map->active.ring->ref[i] = gnttab_grant_foreign_access(
384 pvcalls_front_dev->otherend_id,
385 pfn_to_gfn(virt_to_pfn(bytes) + i), 0);
386
387 map->active.ref = gnttab_grant_foreign_access(
388 pvcalls_front_dev->otherend_id,
389 pfn_to_gfn(virt_to_pfn((void *)map->active.ring)), 0);
390
391 ret = xenbus_alloc_evtchn(pvcalls_front_dev, evtchn);
392 if (ret)
393 goto out_error;
394 irq = bind_evtchn_to_irqhandler(*evtchn, pvcalls_front_conn_handler,
395 0, "pvcalls-frontend", map);
396 if (irq < 0) {
397 ret = irq;
398 goto out_error;
399 }
400
401 map->active.irq = irq;
402 map->active_socket = true;
403 mutex_init(&map->active.in_mutex);
404 mutex_init(&map->active.out_mutex);
405
406 return 0;
407
408out_error:
409 if (*evtchn > 0)
410 xenbus_free_evtchn(pvcalls_front_dev, *evtchn);
411 return ret;
412}
413
414int pvcalls_front_connect(struct socket *sock, struct sockaddr *addr,
415 int addr_len, int flags)
416{
417 struct pvcalls_bedata *bedata;
418 struct sock_mapping *map = NULL;
419 struct xen_pvcalls_request *req;
420 int notify, req_id, ret;
421 evtchn_port_t evtchn;
422
423 if (addr->sa_family != AF_INET || sock->type != SOCK_STREAM)
424 return -EOPNOTSUPP;
425
426 map = pvcalls_enter_sock(sock);
427 if (IS_ERR(map))
428 return PTR_ERR(map);
429
430 bedata = dev_get_drvdata(&pvcalls_front_dev->dev);
431 ret = alloc_active_ring(map);
432 if (ret < 0) {
433 pvcalls_exit_sock(sock);
434 return ret;
435 }
436
437 spin_lock(&bedata->socket_lock);
438 ret = get_request(bedata, &req_id);
439 if (ret < 0) {
440 spin_unlock(&bedata->socket_lock);
441 free_active_ring(map);
442 pvcalls_exit_sock(sock);
443 return ret;
444 }
445 ret = create_active(map, &evtchn);
446 if (ret < 0) {
447 spin_unlock(&bedata->socket_lock);
448 free_active_ring(map);
449 pvcalls_exit_sock(sock);
450 return ret;
451 }
452
453 req = RING_GET_REQUEST(&bedata->ring, req_id);
454 req->req_id = req_id;
455 req->cmd = PVCALLS_CONNECT;
456 req->u.connect.id = (uintptr_t)map;
457 req->u.connect.len = addr_len;
458 req->u.connect.flags = flags;
459 req->u.connect.ref = map->active.ref;
460 req->u.connect.evtchn = evtchn;
461 memcpy(req->u.connect.addr, addr, sizeof(*addr));
462
463 map->sock = sock;
464
465 bedata->ring.req_prod_pvt++;
466 RING_PUSH_REQUESTS_AND_CHECK_NOTIFY(&bedata->ring, notify);
467 spin_unlock(&bedata->socket_lock);
468
469 if (notify)
470 notify_remote_via_irq(bedata->irq);
471
472 wait_event(bedata->inflight_req,
473 READ_ONCE(bedata->rsp[req_id].req_id) == req_id);
474
475 /* read req_id, then the content */
476 smp_rmb();
477 ret = bedata->rsp[req_id].ret;
478 bedata->rsp[req_id].req_id = PVCALLS_INVALID_ID;
479 pvcalls_exit_sock(sock);
480 return ret;
481}
482
483static int __write_ring(struct pvcalls_data_intf *intf,
484 struct pvcalls_data *data,
485 struct iov_iter *msg_iter,
486 int len)
487{
488 RING_IDX cons, prod, size, masked_prod, masked_cons;
489 RING_IDX array_size = XEN_FLEX_RING_SIZE(PVCALLS_RING_ORDER);
490 int32_t error;
491
492 error = intf->out_error;
493 if (error < 0)
494 return error;
495 cons = intf->out_cons;
496 prod = intf->out_prod;
497 /* read indexes before continuing */
498 virt_mb();
499
500 size = pvcalls_queued(prod, cons, array_size);
501 if (size > array_size)
502 return -EINVAL;
503 if (size == array_size)
504 return 0;
505 if (len > array_size - size)
506 len = array_size - size;
507
508 masked_prod = pvcalls_mask(prod, array_size);
509 masked_cons = pvcalls_mask(cons, array_size);
510
511 if (masked_prod < masked_cons) {
512 len = copy_from_iter(data->out + masked_prod, len, msg_iter);
513 } else {
514 if (len > array_size - masked_prod) {
515 int ret = copy_from_iter(data->out + masked_prod,
516 array_size - masked_prod, msg_iter);
517 if (ret != array_size - masked_prod) {
518 len = ret;
519 goto out;
520 }
521 len = ret + copy_from_iter(data->out, len - ret, msg_iter);
522 } else {
523 len = copy_from_iter(data->out + masked_prod, len, msg_iter);
524 }
525 }
526out:
527 /* write to ring before updating pointer */
528 virt_wmb();
529 intf->out_prod += len;
530
531 return len;
532}
533
534int pvcalls_front_sendmsg(struct socket *sock, struct msghdr *msg,
535 size_t len)
536{
537 struct sock_mapping *map;
538 int sent, tot_sent = 0;
539 int count = 0, flags;
540
541 flags = msg->msg_flags;
542 if (flags & (MSG_CONFIRM|MSG_DONTROUTE|MSG_EOR|MSG_OOB))
543 return -EOPNOTSUPP;
544
545 map = pvcalls_enter_sock(sock);
546 if (IS_ERR(map))
547 return PTR_ERR(map);
548
549 mutex_lock(&map->active.out_mutex);
550 if ((flags & MSG_DONTWAIT) && !pvcalls_front_write_todo(map)) {
551 mutex_unlock(&map->active.out_mutex);
552 pvcalls_exit_sock(sock);
553 return -EAGAIN;
554 }
555 if (len > INT_MAX)
556 len = INT_MAX;
557
558again:
559 count++;
560 sent = __write_ring(map->active.ring,
561 &map->active.data, &msg->msg_iter,
562 len);
563 if (sent > 0) {
564 len -= sent;
565 tot_sent += sent;
566 notify_remote_via_irq(map->active.irq);
567 }
568 if (sent >= 0 && len > 0 && count < PVCALLS_FRONT_MAX_SPIN)
569 goto again;
570 if (sent < 0)
571 tot_sent = sent;
572
573 mutex_unlock(&map->active.out_mutex);
574 pvcalls_exit_sock(sock);
575 return tot_sent;
576}
577
578static int __read_ring(struct pvcalls_data_intf *intf,
579 struct pvcalls_data *data,
580 struct iov_iter *msg_iter,
581 size_t len, int flags)
582{
583 RING_IDX cons, prod, size, masked_prod, masked_cons;
584 RING_IDX array_size = XEN_FLEX_RING_SIZE(PVCALLS_RING_ORDER);
585 int32_t error;
586
587 cons = intf->in_cons;
588 prod = intf->in_prod;
589 error = intf->in_error;
590 /* get pointers before reading from the ring */
591 virt_rmb();
592
593 size = pvcalls_queued(prod, cons, array_size);
594 masked_prod = pvcalls_mask(prod, array_size);
595 masked_cons = pvcalls_mask(cons, array_size);
596
597 if (size == 0)
598 return error ?: size;
599
600 if (len > size)
601 len = size;
602
603 if (masked_prod > masked_cons) {
604 len = copy_to_iter(data->in + masked_cons, len, msg_iter);
605 } else {
606 if (len > (array_size - masked_cons)) {
607 int ret = copy_to_iter(data->in + masked_cons,
608 array_size - masked_cons, msg_iter);
609 if (ret != array_size - masked_cons) {
610 len = ret;
611 goto out;
612 }
613 len = ret + copy_to_iter(data->in, len - ret, msg_iter);
614 } else {
615 len = copy_to_iter(data->in + masked_cons, len, msg_iter);
616 }
617 }
618out:
619 /* read data from the ring before increasing the index */
620 virt_mb();
621 if (!(flags & MSG_PEEK))
622 intf->in_cons += len;
623
624 return len;
625}
626
627int pvcalls_front_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,
628 int flags)
629{
630 int ret;
631 struct sock_mapping *map;
632
633 if (flags & (MSG_CMSG_CLOEXEC|MSG_ERRQUEUE|MSG_OOB|MSG_TRUNC))
634 return -EOPNOTSUPP;
635
636 map = pvcalls_enter_sock(sock);
637 if (IS_ERR(map))
638 return PTR_ERR(map);
639
640 mutex_lock(&map->active.in_mutex);
641 if (len > XEN_FLEX_RING_SIZE(PVCALLS_RING_ORDER))
642 len = XEN_FLEX_RING_SIZE(PVCALLS_RING_ORDER);
643
644 while (!(flags & MSG_DONTWAIT) && !pvcalls_front_read_todo(map)) {
645 wait_event_interruptible(map->active.inflight_conn_req,
646 pvcalls_front_read_todo(map));
647 }
648 ret = __read_ring(map->active.ring, &map->active.data,
649 &msg->msg_iter, len, flags);
650
651 if (ret > 0)
652 notify_remote_via_irq(map->active.irq);
653 if (ret == 0)
654 ret = (flags & MSG_DONTWAIT) ? -EAGAIN : 0;
655 if (ret == -ENOTCONN)
656 ret = 0;
657
658 mutex_unlock(&map->active.in_mutex);
659 pvcalls_exit_sock(sock);
660 return ret;
661}
662
663int pvcalls_front_bind(struct socket *sock, struct sockaddr *addr, int addr_len)
664{
665 struct pvcalls_bedata *bedata;
666 struct sock_mapping *map = NULL;
667 struct xen_pvcalls_request *req;
668 int notify, req_id, ret;
669
670 if (addr->sa_family != AF_INET || sock->type != SOCK_STREAM)
671 return -EOPNOTSUPP;
672
673 map = pvcalls_enter_sock(sock);
674 if (IS_ERR(map))
675 return PTR_ERR(map);
676 bedata = dev_get_drvdata(&pvcalls_front_dev->dev);
677
678 spin_lock(&bedata->socket_lock);
679 ret = get_request(bedata, &req_id);
680 if (ret < 0) {
681 spin_unlock(&bedata->socket_lock);
682 pvcalls_exit_sock(sock);
683 return ret;
684 }
685 req = RING_GET_REQUEST(&bedata->ring, req_id);
686 req->req_id = req_id;
687 map->sock = sock;
688 req->cmd = PVCALLS_BIND;
689 req->u.bind.id = (uintptr_t)map;
690 memcpy(req->u.bind.addr, addr, sizeof(*addr));
691 req->u.bind.len = addr_len;
692
693 init_waitqueue_head(&map->passive.inflight_accept_req);
694
695 map->active_socket = false;
696
697 bedata->ring.req_prod_pvt++;
698 RING_PUSH_REQUESTS_AND_CHECK_NOTIFY(&bedata->ring, notify);
699 spin_unlock(&bedata->socket_lock);
700 if (notify)
701 notify_remote_via_irq(bedata->irq);
702
703 wait_event(bedata->inflight_req,
704 READ_ONCE(bedata->rsp[req_id].req_id) == req_id);
705
706 /* read req_id, then the content */
707 smp_rmb();
708 ret = bedata->rsp[req_id].ret;
709 bedata->rsp[req_id].req_id = PVCALLS_INVALID_ID;
710
711 map->passive.status = PVCALLS_STATUS_BIND;
712 pvcalls_exit_sock(sock);
713 return 0;
714}
715
716int pvcalls_front_listen(struct socket *sock, int backlog)
717{
718 struct pvcalls_bedata *bedata;
719 struct sock_mapping *map;
720 struct xen_pvcalls_request *req;
721 int notify, req_id, ret;
722
723 map = pvcalls_enter_sock(sock);
724 if (IS_ERR(map))
725 return PTR_ERR(map);
726 bedata = dev_get_drvdata(&pvcalls_front_dev->dev);
727
728 if (map->passive.status != PVCALLS_STATUS_BIND) {
729 pvcalls_exit_sock(sock);
730 return -EOPNOTSUPP;
731 }
732
733 spin_lock(&bedata->socket_lock);
734 ret = get_request(bedata, &req_id);
735 if (ret < 0) {
736 spin_unlock(&bedata->socket_lock);
737 pvcalls_exit_sock(sock);
738 return ret;
739 }
740 req = RING_GET_REQUEST(&bedata->ring, req_id);
741 req->req_id = req_id;
742 req->cmd = PVCALLS_LISTEN;
743 req->u.listen.id = (uintptr_t) map;
744 req->u.listen.backlog = backlog;
745
746 bedata->ring.req_prod_pvt++;
747 RING_PUSH_REQUESTS_AND_CHECK_NOTIFY(&bedata->ring, notify);
748 spin_unlock(&bedata->socket_lock);
749 if (notify)
750 notify_remote_via_irq(bedata->irq);
751
752 wait_event(bedata->inflight_req,
753 READ_ONCE(bedata->rsp[req_id].req_id) == req_id);
754
755 /* read req_id, then the content */
756 smp_rmb();
757 ret = bedata->rsp[req_id].ret;
758 bedata->rsp[req_id].req_id = PVCALLS_INVALID_ID;
759
760 map->passive.status = PVCALLS_STATUS_LISTEN;
761 pvcalls_exit_sock(sock);
762 return ret;
763}
764
765int pvcalls_front_accept(struct socket *sock, struct socket *newsock, int flags)
766{
767 struct pvcalls_bedata *bedata;
768 struct sock_mapping *map;
769 struct sock_mapping *map2 = NULL;
770 struct xen_pvcalls_request *req;
771 int notify, req_id, ret, nonblock;
772 evtchn_port_t evtchn;
773
774 map = pvcalls_enter_sock(sock);
775 if (IS_ERR(map))
776 return PTR_ERR(map);
777 bedata = dev_get_drvdata(&pvcalls_front_dev->dev);
778
779 if (map->passive.status != PVCALLS_STATUS_LISTEN) {
780 pvcalls_exit_sock(sock);
781 return -EINVAL;
782 }
783
784 nonblock = flags & SOCK_NONBLOCK;
785 /*
786 * Backend only supports 1 inflight accept request, will return
787 * errors for the others
788 */
789 if (test_and_set_bit(PVCALLS_FLAG_ACCEPT_INFLIGHT,
790 (void *)&map->passive.flags)) {
791 req_id = READ_ONCE(map->passive.inflight_req_id);
792 if (req_id != PVCALLS_INVALID_ID &&
793 READ_ONCE(bedata->rsp[req_id].req_id) == req_id) {
794 map2 = map->passive.accept_map;
795 goto received;
796 }
797 if (nonblock) {
798 pvcalls_exit_sock(sock);
799 return -EAGAIN;
800 }
801 if (wait_event_interruptible(map->passive.inflight_accept_req,
802 !test_and_set_bit(PVCALLS_FLAG_ACCEPT_INFLIGHT,
803 (void *)&map->passive.flags))) {
804 pvcalls_exit_sock(sock);
805 return -EINTR;
806 }
807 }
808
809 map2 = kzalloc(sizeof(*map2), GFP_KERNEL);
810 if (map2 == NULL) {
811 clear_bit(PVCALLS_FLAG_ACCEPT_INFLIGHT,
812 (void *)&map->passive.flags);
813 pvcalls_exit_sock(sock);
814 return -ENOMEM;
815 }
816 ret = alloc_active_ring(map2);
817 if (ret < 0) {
818 clear_bit(PVCALLS_FLAG_ACCEPT_INFLIGHT,
819 (void *)&map->passive.flags);
820 kfree(map2);
821 pvcalls_exit_sock(sock);
822 return ret;
823 }
824 spin_lock(&bedata->socket_lock);
825 ret = get_request(bedata, &req_id);
826 if (ret < 0) {
827 clear_bit(PVCALLS_FLAG_ACCEPT_INFLIGHT,
828 (void *)&map->passive.flags);
829 spin_unlock(&bedata->socket_lock);
830 free_active_ring(map2);
831 kfree(map2);
832 pvcalls_exit_sock(sock);
833 return ret;
834 }
835
836 ret = create_active(map2, &evtchn);
837 if (ret < 0) {
838 free_active_ring(map2);
839 kfree(map2);
840 clear_bit(PVCALLS_FLAG_ACCEPT_INFLIGHT,
841 (void *)&map->passive.flags);
842 spin_unlock(&bedata->socket_lock);
843 pvcalls_exit_sock(sock);
844 return ret;
845 }
846 list_add_tail(&map2->list, &bedata->socket_mappings);
847
848 req = RING_GET_REQUEST(&bedata->ring, req_id);
849 req->req_id = req_id;
850 req->cmd = PVCALLS_ACCEPT;
851 req->u.accept.id = (uintptr_t) map;
852 req->u.accept.ref = map2->active.ref;
853 req->u.accept.id_new = (uintptr_t) map2;
854 req->u.accept.evtchn = evtchn;
855 map->passive.accept_map = map2;
856
857 bedata->ring.req_prod_pvt++;
858 RING_PUSH_REQUESTS_AND_CHECK_NOTIFY(&bedata->ring, notify);
859 spin_unlock(&bedata->socket_lock);
860 if (notify)
861 notify_remote_via_irq(bedata->irq);
862 /* We could check if we have received a response before returning. */
863 if (nonblock) {
864 WRITE_ONCE(map->passive.inflight_req_id, req_id);
865 pvcalls_exit_sock(sock);
866 return -EAGAIN;
867 }
868
869 if (wait_event_interruptible(bedata->inflight_req,
870 READ_ONCE(bedata->rsp[req_id].req_id) == req_id)) {
871 pvcalls_exit_sock(sock);
872 return -EINTR;
873 }
874 /* read req_id, then the content */
875 smp_rmb();
876
877received:
878 map2->sock = newsock;
879 newsock->sk = sk_alloc(sock_net(sock->sk), PF_INET, GFP_KERNEL, &pvcalls_proto, false);
880 if (!newsock->sk) {
881 bedata->rsp[req_id].req_id = PVCALLS_INVALID_ID;
882 map->passive.inflight_req_id = PVCALLS_INVALID_ID;
883 clear_bit(PVCALLS_FLAG_ACCEPT_INFLIGHT,
884 (void *)&map->passive.flags);
885 pvcalls_front_free_map(bedata, map2);
886 pvcalls_exit_sock(sock);
887 return -ENOMEM;
888 }
889 newsock->sk->sk_send_head = (void *)map2;
890
891 ret = bedata->rsp[req_id].ret;
892 bedata->rsp[req_id].req_id = PVCALLS_INVALID_ID;
893 map->passive.inflight_req_id = PVCALLS_INVALID_ID;
894
895 clear_bit(PVCALLS_FLAG_ACCEPT_INFLIGHT, (void *)&map->passive.flags);
896 wake_up(&map->passive.inflight_accept_req);
897
898 pvcalls_exit_sock(sock);
899 return ret;
900}
901
902static __poll_t pvcalls_front_poll_passive(struct file *file,
903 struct pvcalls_bedata *bedata,
904 struct sock_mapping *map,
905 poll_table *wait)
906{
907 int notify, req_id, ret;
908 struct xen_pvcalls_request *req;
909
910 if (test_bit(PVCALLS_FLAG_ACCEPT_INFLIGHT,
911 (void *)&map->passive.flags)) {
912 uint32_t req_id = READ_ONCE(map->passive.inflight_req_id);
913
914 if (req_id != PVCALLS_INVALID_ID &&
915 READ_ONCE(bedata->rsp[req_id].req_id) == req_id)
916 return EPOLLIN | EPOLLRDNORM;
917
918 poll_wait(file, &map->passive.inflight_accept_req, wait);
919 return 0;
920 }
921
922 if (test_and_clear_bit(PVCALLS_FLAG_POLL_RET,
923 (void *)&map->passive.flags))
924 return EPOLLIN | EPOLLRDNORM;
925
926 /*
927 * First check RET, then INFLIGHT. No barriers necessary to
928 * ensure execution ordering because of the conditional
929 * instructions creating control dependencies.
930 */
931
932 if (test_and_set_bit(PVCALLS_FLAG_POLL_INFLIGHT,
933 (void *)&map->passive.flags)) {
934 poll_wait(file, &bedata->inflight_req, wait);
935 return 0;
936 }
937
938 spin_lock(&bedata->socket_lock);
939 ret = get_request(bedata, &req_id);
940 if (ret < 0) {
941 spin_unlock(&bedata->socket_lock);
942 return ret;
943 }
944 req = RING_GET_REQUEST(&bedata->ring, req_id);
945 req->req_id = req_id;
946 req->cmd = PVCALLS_POLL;
947 req->u.poll.id = (uintptr_t) map;
948
949 bedata->ring.req_prod_pvt++;
950 RING_PUSH_REQUESTS_AND_CHECK_NOTIFY(&bedata->ring, notify);
951 spin_unlock(&bedata->socket_lock);
952 if (notify)
953 notify_remote_via_irq(bedata->irq);
954
955 poll_wait(file, &bedata->inflight_req, wait);
956 return 0;
957}
958
959static __poll_t pvcalls_front_poll_active(struct file *file,
960 struct pvcalls_bedata *bedata,
961 struct sock_mapping *map,
962 poll_table *wait)
963{
964 __poll_t mask = 0;
965 int32_t in_error, out_error;
966 struct pvcalls_data_intf *intf = map->active.ring;
967
968 out_error = intf->out_error;
969 in_error = intf->in_error;
970
971 poll_wait(file, &map->active.inflight_conn_req, wait);
972 if (pvcalls_front_write_todo(map))
973 mask |= EPOLLOUT | EPOLLWRNORM;
974 if (pvcalls_front_read_todo(map))
975 mask |= EPOLLIN | EPOLLRDNORM;
976 if (in_error != 0 || out_error != 0)
977 mask |= EPOLLERR;
978
979 return mask;
980}
981
982__poll_t pvcalls_front_poll(struct file *file, struct socket *sock,
983 poll_table *wait)
984{
985 struct pvcalls_bedata *bedata;
986 struct sock_mapping *map;
987 __poll_t ret;
988
989 map = pvcalls_enter_sock(sock);
990 if (IS_ERR(map))
991 return EPOLLNVAL;
992 bedata = dev_get_drvdata(&pvcalls_front_dev->dev);
993
994 if (map->active_socket)
995 ret = pvcalls_front_poll_active(file, bedata, map, wait);
996 else
997 ret = pvcalls_front_poll_passive(file, bedata, map, wait);
998 pvcalls_exit_sock(sock);
999 return ret;
1000}
1001
1002int pvcalls_front_release(struct socket *sock)
1003{
1004 struct pvcalls_bedata *bedata;
1005 struct sock_mapping *map;
1006 int req_id, notify, ret;
1007 struct xen_pvcalls_request *req;
1008
1009 if (sock->sk == NULL)
1010 return 0;
1011
1012 map = pvcalls_enter_sock(sock);
1013 if (IS_ERR(map)) {
1014 if (PTR_ERR(map) == -ENOTCONN)
1015 return -EIO;
1016 else
1017 return 0;
1018 }
1019 bedata = dev_get_drvdata(&pvcalls_front_dev->dev);
1020
1021 spin_lock(&bedata->socket_lock);
1022 ret = get_request(bedata, &req_id);
1023 if (ret < 0) {
1024 spin_unlock(&bedata->socket_lock);
1025 pvcalls_exit_sock(sock);
1026 return ret;
1027 }
1028 sock->sk->sk_send_head = NULL;
1029
1030 req = RING_GET_REQUEST(&bedata->ring, req_id);
1031 req->req_id = req_id;
1032 req->cmd = PVCALLS_RELEASE;
1033 req->u.release.id = (uintptr_t)map;
1034
1035 bedata->ring.req_prod_pvt++;
1036 RING_PUSH_REQUESTS_AND_CHECK_NOTIFY(&bedata->ring, notify);
1037 spin_unlock(&bedata->socket_lock);
1038 if (notify)
1039 notify_remote_via_irq(bedata->irq);
1040
1041 wait_event(bedata->inflight_req,
1042 READ_ONCE(bedata->rsp[req_id].req_id) == req_id);
1043
1044 if (map->active_socket) {
1045 /*
1046 * Set in_error and wake up inflight_conn_req to force
1047 * recvmsg waiters to exit.
1048 */
1049 map->active.ring->in_error = -EBADF;
1050 wake_up_interruptible(&map->active.inflight_conn_req);
1051
1052 /*
1053 * We need to make sure that sendmsg/recvmsg on this socket have
1054 * not started before we've cleared sk_send_head here. The
1055 * easiest way to guarantee this is to see that no pvcalls
1056 * (other than us) is in progress on this socket.
1057 */
1058 while (atomic_read(&map->refcount) > 1)
1059 cpu_relax();
1060
1061 pvcalls_front_free_map(bedata, map);
1062 } else {
1063 wake_up(&bedata->inflight_req);
1064 wake_up(&map->passive.inflight_accept_req);
1065
1066 while (atomic_read(&map->refcount) > 1)
1067 cpu_relax();
1068
1069 spin_lock(&bedata->socket_lock);
1070 list_del(&map->list);
1071 spin_unlock(&bedata->socket_lock);
1072 if (READ_ONCE(map->passive.inflight_req_id) != PVCALLS_INVALID_ID &&
1073 READ_ONCE(map->passive.inflight_req_id) != 0) {
1074 pvcalls_front_free_map(bedata,
1075 map->passive.accept_map);
1076 }
1077 kfree(map);
1078 }
1079 WRITE_ONCE(bedata->rsp[req_id].req_id, PVCALLS_INVALID_ID);
1080
1081 pvcalls_exit();
1082 return 0;
1083}
1084
1085static const struct xenbus_device_id pvcalls_front_ids[] = {
1086 { "pvcalls" },
1087 { "" }
1088};
1089
1090static void pvcalls_front_remove(struct xenbus_device *dev)
1091{
1092 struct pvcalls_bedata *bedata;
1093 struct sock_mapping *map = NULL, *n;
1094
1095 bedata = dev_get_drvdata(&pvcalls_front_dev->dev);
1096 dev_set_drvdata(&dev->dev, NULL);
1097 pvcalls_front_dev = NULL;
1098 if (bedata->irq >= 0)
1099 unbind_from_irqhandler(bedata->irq, dev);
1100
1101 list_for_each_entry_safe(map, n, &bedata->socket_mappings, list) {
1102 map->sock->sk->sk_send_head = NULL;
1103 if (map->active_socket) {
1104 map->active.ring->in_error = -EBADF;
1105 wake_up_interruptible(&map->active.inflight_conn_req);
1106 }
1107 }
1108
1109 smp_mb();
1110 while (atomic_read(&pvcalls_refcount) > 0)
1111 cpu_relax();
1112 list_for_each_entry_safe(map, n, &bedata->socket_mappings, list) {
1113 if (map->active_socket) {
1114 /* No need to lock, refcount is 0 */
1115 pvcalls_front_free_map(bedata, map);
1116 } else {
1117 list_del(&map->list);
1118 kfree(map);
1119 }
1120 }
1121 if (bedata->ref != -1)
1122 gnttab_end_foreign_access(bedata->ref, NULL);
1123 kfree(bedata->ring.sring);
1124 kfree(bedata);
1125 xenbus_switch_state(dev, XenbusStateClosed);
1126}
1127
1128static int pvcalls_front_probe(struct xenbus_device *dev,
1129 const struct xenbus_device_id *id)
1130{
1131 int ret = -ENOMEM, i;
1132 evtchn_port_t evtchn;
1133 unsigned int max_page_order, function_calls, len;
1134 char *versions;
1135 grant_ref_t gref_head = 0;
1136 struct xenbus_transaction xbt;
1137 struct pvcalls_bedata *bedata = NULL;
1138 struct xen_pvcalls_sring *sring;
1139
1140 if (pvcalls_front_dev != NULL) {
1141 dev_err(&dev->dev, "only one PV Calls connection supported\n");
1142 return -EINVAL;
1143 }
1144
1145 versions = xenbus_read(XBT_NIL, dev->otherend, "versions", &len);
1146 if (IS_ERR(versions))
1147 return PTR_ERR(versions);
1148 if (!len)
1149 return -EINVAL;
1150 if (strcmp(versions, "1")) {
1151 kfree(versions);
1152 return -EINVAL;
1153 }
1154 kfree(versions);
1155 max_page_order = xenbus_read_unsigned(dev->otherend,
1156 "max-page-order", 0);
1157 if (max_page_order < PVCALLS_RING_ORDER)
1158 return -ENODEV;
1159 function_calls = xenbus_read_unsigned(dev->otherend,
1160 "function-calls", 0);
1161 /* See XENBUS_FUNCTIONS_CALLS in pvcalls.h */
1162 if (function_calls != 1)
1163 return -ENODEV;
1164 pr_info("%s max-page-order is %u\n", __func__, max_page_order);
1165
1166 bedata = kzalloc(sizeof(struct pvcalls_bedata), GFP_KERNEL);
1167 if (!bedata)
1168 return -ENOMEM;
1169
1170 dev_set_drvdata(&dev->dev, bedata);
1171 pvcalls_front_dev = dev;
1172 init_waitqueue_head(&bedata->inflight_req);
1173 INIT_LIST_HEAD(&bedata->socket_mappings);
1174 spin_lock_init(&bedata->socket_lock);
1175 bedata->irq = -1;
1176 bedata->ref = -1;
1177
1178 for (i = 0; i < PVCALLS_NR_RSP_PER_RING; i++)
1179 bedata->rsp[i].req_id = PVCALLS_INVALID_ID;
1180
1181 sring = (struct xen_pvcalls_sring *) __get_free_page(GFP_KERNEL |
1182 __GFP_ZERO);
1183 if (!sring)
1184 goto error;
1185 SHARED_RING_INIT(sring);
1186 FRONT_RING_INIT(&bedata->ring, sring, XEN_PAGE_SIZE);
1187
1188 ret = xenbus_alloc_evtchn(dev, &evtchn);
1189 if (ret)
1190 goto error;
1191
1192 bedata->irq = bind_evtchn_to_irqhandler(evtchn,
1193 pvcalls_front_event_handler,
1194 0, "pvcalls-frontend", dev);
1195 if (bedata->irq < 0) {
1196 ret = bedata->irq;
1197 goto error;
1198 }
1199
1200 ret = gnttab_alloc_grant_references(1, &gref_head);
1201 if (ret < 0)
1202 goto error;
1203 ret = gnttab_claim_grant_reference(&gref_head);
1204 if (ret < 0)
1205 goto error;
1206 bedata->ref = ret;
1207 gnttab_grant_foreign_access_ref(bedata->ref, dev->otherend_id,
1208 virt_to_gfn((void *)sring), 0);
1209
1210 again:
1211 ret = xenbus_transaction_start(&xbt);
1212 if (ret) {
1213 xenbus_dev_fatal(dev, ret, "starting transaction");
1214 goto error;
1215 }
1216 ret = xenbus_printf(xbt, dev->nodename, "version", "%u", 1);
1217 if (ret)
1218 goto error_xenbus;
1219 ret = xenbus_printf(xbt, dev->nodename, "ring-ref", "%d", bedata->ref);
1220 if (ret)
1221 goto error_xenbus;
1222 ret = xenbus_printf(xbt, dev->nodename, "port", "%u",
1223 evtchn);
1224 if (ret)
1225 goto error_xenbus;
1226 ret = xenbus_transaction_end(xbt, 0);
1227 if (ret) {
1228 if (ret == -EAGAIN)
1229 goto again;
1230 xenbus_dev_fatal(dev, ret, "completing transaction");
1231 goto error;
1232 }
1233 xenbus_switch_state(dev, XenbusStateInitialised);
1234
1235 return 0;
1236
1237 error_xenbus:
1238 xenbus_transaction_end(xbt, 1);
1239 xenbus_dev_fatal(dev, ret, "writing xenstore");
1240 error:
1241 pvcalls_front_remove(dev);
1242 return ret;
1243}
1244
1245static void pvcalls_front_changed(struct xenbus_device *dev,
1246 enum xenbus_state backend_state)
1247{
1248 switch (backend_state) {
1249 case XenbusStateReconfiguring:
1250 case XenbusStateReconfigured:
1251 case XenbusStateInitialising:
1252 case XenbusStateInitialised:
1253 case XenbusStateUnknown:
1254 break;
1255
1256 case XenbusStateInitWait:
1257 break;
1258
1259 case XenbusStateConnected:
1260 xenbus_switch_state(dev, XenbusStateConnected);
1261 break;
1262
1263 case XenbusStateClosed:
1264 if (dev->state == XenbusStateClosed)
1265 break;
1266 /* Missed the backend's CLOSING state */
1267 fallthrough;
1268 case XenbusStateClosing:
1269 xenbus_frontend_closed(dev);
1270 break;
1271 }
1272}
1273
1274static struct xenbus_driver pvcalls_front_driver = {
1275 .ids = pvcalls_front_ids,
1276 .probe = pvcalls_front_probe,
1277 .remove = pvcalls_front_remove,
1278 .otherend_changed = pvcalls_front_changed,
1279 .not_essential = true,
1280};
1281
1282static int __init pvcalls_frontend_init(void)
1283{
1284 if (!xen_domain())
1285 return -ENODEV;
1286
1287 pr_info("Initialising Xen pvcalls frontend driver\n");
1288
1289 return xenbus_register_frontend(&pvcalls_front_driver);
1290}
1291
1292module_init(pvcalls_frontend_init);
1293
1294MODULE_DESCRIPTION("Xen PV Calls frontend driver");
1295MODULE_AUTHOR("Stefano Stabellini <sstabellini@kernel.org>");
1296MODULE_LICENSE("GPL");
1/*
2 * (c) 2017 Stefano Stabellini <stefano@aporeto.com>
3 *
4 * This program is free software; you can redistribute it and/or modify
5 * it under the terms of the GNU General Public License as published by
6 * the Free Software Foundation; either version 2 of the License, or
7 * (at your option) any later version.
8 *
9 * This program is distributed in the hope that it will be useful,
10 * but WITHOUT ANY WARRANTY; without even the implied warranty of
11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 * GNU General Public License for more details.
13 */
14
15#include <linux/module.h>
16#include <linux/net.h>
17#include <linux/socket.h>
18
19#include <net/sock.h>
20
21#include <xen/events.h>
22#include <xen/grant_table.h>
23#include <xen/xen.h>
24#include <xen/xenbus.h>
25#include <xen/interface/io/pvcalls.h>
26
27#include "pvcalls-front.h"
28
29#define PVCALLS_INVALID_ID UINT_MAX
30#define PVCALLS_RING_ORDER XENBUS_MAX_RING_GRANT_ORDER
31#define PVCALLS_NR_RSP_PER_RING __CONST_RING_SIZE(xen_pvcalls, XEN_PAGE_SIZE)
32#define PVCALLS_FRONT_MAX_SPIN 5000
33
34struct pvcalls_bedata {
35 struct xen_pvcalls_front_ring ring;
36 grant_ref_t ref;
37 int irq;
38
39 struct list_head socket_mappings;
40 spinlock_t socket_lock;
41
42 wait_queue_head_t inflight_req;
43 struct xen_pvcalls_response rsp[PVCALLS_NR_RSP_PER_RING];
44};
45/* Only one front/back connection supported. */
46static struct xenbus_device *pvcalls_front_dev;
47static atomic_t pvcalls_refcount;
48
49/* first increment refcount, then proceed */
50#define pvcalls_enter() { \
51 atomic_inc(&pvcalls_refcount); \
52}
53
54/* first complete other operations, then decrement refcount */
55#define pvcalls_exit() { \
56 atomic_dec(&pvcalls_refcount); \
57}
58
59struct sock_mapping {
60 bool active_socket;
61 struct list_head list;
62 struct socket *sock;
63 atomic_t refcount;
64 union {
65 struct {
66 int irq;
67 grant_ref_t ref;
68 struct pvcalls_data_intf *ring;
69 struct pvcalls_data data;
70 struct mutex in_mutex;
71 struct mutex out_mutex;
72
73 wait_queue_head_t inflight_conn_req;
74 } active;
75 struct {
76 /*
77 * Socket status, needs to be 64-bit aligned due to the
78 * test_and_* functions which have this requirement on arm64.
79 */
80#define PVCALLS_STATUS_UNINITALIZED 0
81#define PVCALLS_STATUS_BIND 1
82#define PVCALLS_STATUS_LISTEN 2
83 uint8_t status __attribute__((aligned(8)));
84 /*
85 * Internal state-machine flags.
86 * Only one accept operation can be inflight for a socket.
87 * Only one poll operation can be inflight for a given socket.
88 * flags needs to be 64-bit aligned due to the test_and_*
89 * functions which have this requirement on arm64.
90 */
91#define PVCALLS_FLAG_ACCEPT_INFLIGHT 0
92#define PVCALLS_FLAG_POLL_INFLIGHT 1
93#define PVCALLS_FLAG_POLL_RET 2
94 uint8_t flags __attribute__((aligned(8)));
95 uint32_t inflight_req_id;
96 struct sock_mapping *accept_map;
97 wait_queue_head_t inflight_accept_req;
98 } passive;
99 };
100};
101
102static inline struct sock_mapping *pvcalls_enter_sock(struct socket *sock)
103{
104 struct sock_mapping *map;
105
106 if (!pvcalls_front_dev ||
107 dev_get_drvdata(&pvcalls_front_dev->dev) == NULL)
108 return ERR_PTR(-ENOTCONN);
109
110 map = (struct sock_mapping *)sock->sk->sk_send_head;
111 if (map == NULL)
112 return ERR_PTR(-ENOTSOCK);
113
114 pvcalls_enter();
115 atomic_inc(&map->refcount);
116 return map;
117}
118
119static inline void pvcalls_exit_sock(struct socket *sock)
120{
121 struct sock_mapping *map;
122
123 map = (struct sock_mapping *)sock->sk->sk_send_head;
124 atomic_dec(&map->refcount);
125 pvcalls_exit();
126}
127
128static inline int get_request(struct pvcalls_bedata *bedata, int *req_id)
129{
130 *req_id = bedata->ring.req_prod_pvt & (RING_SIZE(&bedata->ring) - 1);
131 if (RING_FULL(&bedata->ring) ||
132 bedata->rsp[*req_id].req_id != PVCALLS_INVALID_ID)
133 return -EAGAIN;
134 return 0;
135}
136
137static bool pvcalls_front_write_todo(struct sock_mapping *map)
138{
139 struct pvcalls_data_intf *intf = map->active.ring;
140 RING_IDX cons, prod, size = XEN_FLEX_RING_SIZE(PVCALLS_RING_ORDER);
141 int32_t error;
142
143 error = intf->out_error;
144 if (error == -ENOTCONN)
145 return false;
146 if (error != 0)
147 return true;
148
149 cons = intf->out_cons;
150 prod = intf->out_prod;
151 return !!(size - pvcalls_queued(prod, cons, size));
152}
153
154static bool pvcalls_front_read_todo(struct sock_mapping *map)
155{
156 struct pvcalls_data_intf *intf = map->active.ring;
157 RING_IDX cons, prod;
158 int32_t error;
159
160 cons = intf->in_cons;
161 prod = intf->in_prod;
162 error = intf->in_error;
163 return (error != 0 ||
164 pvcalls_queued(prod, cons,
165 XEN_FLEX_RING_SIZE(PVCALLS_RING_ORDER)) != 0);
166}
167
168static irqreturn_t pvcalls_front_event_handler(int irq, void *dev_id)
169{
170 struct xenbus_device *dev = dev_id;
171 struct pvcalls_bedata *bedata;
172 struct xen_pvcalls_response *rsp;
173 uint8_t *src, *dst;
174 int req_id = 0, more = 0, done = 0;
175
176 if (dev == NULL)
177 return IRQ_HANDLED;
178
179 pvcalls_enter();
180 bedata = dev_get_drvdata(&dev->dev);
181 if (bedata == NULL) {
182 pvcalls_exit();
183 return IRQ_HANDLED;
184 }
185
186again:
187 while (RING_HAS_UNCONSUMED_RESPONSES(&bedata->ring)) {
188 rsp = RING_GET_RESPONSE(&bedata->ring, bedata->ring.rsp_cons);
189
190 req_id = rsp->req_id;
191 if (rsp->cmd == PVCALLS_POLL) {
192 struct sock_mapping *map = (struct sock_mapping *)(uintptr_t)
193 rsp->u.poll.id;
194
195 clear_bit(PVCALLS_FLAG_POLL_INFLIGHT,
196 (void *)&map->passive.flags);
197 /*
198 * clear INFLIGHT, then set RET. It pairs with
199 * the checks at the beginning of
200 * pvcalls_front_poll_passive.
201 */
202 smp_wmb();
203 set_bit(PVCALLS_FLAG_POLL_RET,
204 (void *)&map->passive.flags);
205 } else {
206 dst = (uint8_t *)&bedata->rsp[req_id] +
207 sizeof(rsp->req_id);
208 src = (uint8_t *)rsp + sizeof(rsp->req_id);
209 memcpy(dst, src, sizeof(*rsp) - sizeof(rsp->req_id));
210 /*
211 * First copy the rest of the data, then req_id. It is
212 * paired with the barrier when accessing bedata->rsp.
213 */
214 smp_wmb();
215 bedata->rsp[req_id].req_id = req_id;
216 }
217
218 done = 1;
219 bedata->ring.rsp_cons++;
220 }
221
222 RING_FINAL_CHECK_FOR_RESPONSES(&bedata->ring, more);
223 if (more)
224 goto again;
225 if (done)
226 wake_up(&bedata->inflight_req);
227 pvcalls_exit();
228 return IRQ_HANDLED;
229}
230
231static void pvcalls_front_free_map(struct pvcalls_bedata *bedata,
232 struct sock_mapping *map)
233{
234 int i;
235
236 unbind_from_irqhandler(map->active.irq, map);
237
238 spin_lock(&bedata->socket_lock);
239 if (!list_empty(&map->list))
240 list_del_init(&map->list);
241 spin_unlock(&bedata->socket_lock);
242
243 for (i = 0; i < (1 << PVCALLS_RING_ORDER); i++)
244 gnttab_end_foreign_access(map->active.ring->ref[i], 0, 0);
245 gnttab_end_foreign_access(map->active.ref, 0, 0);
246 free_page((unsigned long)map->active.ring);
247
248 kfree(map);
249}
250
251static irqreturn_t pvcalls_front_conn_handler(int irq, void *sock_map)
252{
253 struct sock_mapping *map = sock_map;
254
255 if (map == NULL)
256 return IRQ_HANDLED;
257
258 wake_up_interruptible(&map->active.inflight_conn_req);
259
260 return IRQ_HANDLED;
261}
262
263int pvcalls_front_socket(struct socket *sock)
264{
265 struct pvcalls_bedata *bedata;
266 struct sock_mapping *map = NULL;
267 struct xen_pvcalls_request *req;
268 int notify, req_id, ret;
269
270 /*
271 * PVCalls only supports domain AF_INET,
272 * type SOCK_STREAM and protocol 0 sockets for now.
273 *
274 * Check socket type here, AF_INET and protocol checks are done
275 * by the caller.
276 */
277 if (sock->type != SOCK_STREAM)
278 return -EOPNOTSUPP;
279
280 pvcalls_enter();
281 if (!pvcalls_front_dev) {
282 pvcalls_exit();
283 return -EACCES;
284 }
285 bedata = dev_get_drvdata(&pvcalls_front_dev->dev);
286
287 map = kzalloc(sizeof(*map), GFP_KERNEL);
288 if (map == NULL) {
289 pvcalls_exit();
290 return -ENOMEM;
291 }
292
293 spin_lock(&bedata->socket_lock);
294
295 ret = get_request(bedata, &req_id);
296 if (ret < 0) {
297 kfree(map);
298 spin_unlock(&bedata->socket_lock);
299 pvcalls_exit();
300 return ret;
301 }
302
303 /*
304 * sock->sk->sk_send_head is not used for ip sockets: reuse the
305 * field to store a pointer to the struct sock_mapping
306 * corresponding to the socket. This way, we can easily get the
307 * struct sock_mapping from the struct socket.
308 */
309 sock->sk->sk_send_head = (void *)map;
310 list_add_tail(&map->list, &bedata->socket_mappings);
311
312 req = RING_GET_REQUEST(&bedata->ring, req_id);
313 req->req_id = req_id;
314 req->cmd = PVCALLS_SOCKET;
315 req->u.socket.id = (uintptr_t) map;
316 req->u.socket.domain = AF_INET;
317 req->u.socket.type = SOCK_STREAM;
318 req->u.socket.protocol = IPPROTO_IP;
319
320 bedata->ring.req_prod_pvt++;
321 RING_PUSH_REQUESTS_AND_CHECK_NOTIFY(&bedata->ring, notify);
322 spin_unlock(&bedata->socket_lock);
323 if (notify)
324 notify_remote_via_irq(bedata->irq);
325
326 wait_event(bedata->inflight_req,
327 READ_ONCE(bedata->rsp[req_id].req_id) == req_id);
328
329 /* read req_id, then the content */
330 smp_rmb();
331 ret = bedata->rsp[req_id].ret;
332 bedata->rsp[req_id].req_id = PVCALLS_INVALID_ID;
333
334 pvcalls_exit();
335 return ret;
336}
337
338static int create_active(struct sock_mapping *map, int *evtchn)
339{
340 void *bytes;
341 int ret = -ENOMEM, irq = -1, i;
342
343 *evtchn = -1;
344 init_waitqueue_head(&map->active.inflight_conn_req);
345
346 map->active.ring = (struct pvcalls_data_intf *)
347 __get_free_page(GFP_KERNEL | __GFP_ZERO);
348 if (map->active.ring == NULL)
349 goto out_error;
350 map->active.ring->ring_order = PVCALLS_RING_ORDER;
351 bytes = (void *)__get_free_pages(GFP_KERNEL | __GFP_ZERO,
352 PVCALLS_RING_ORDER);
353 if (bytes == NULL)
354 goto out_error;
355 for (i = 0; i < (1 << PVCALLS_RING_ORDER); i++)
356 map->active.ring->ref[i] = gnttab_grant_foreign_access(
357 pvcalls_front_dev->otherend_id,
358 pfn_to_gfn(virt_to_pfn(bytes) + i), 0);
359
360 map->active.ref = gnttab_grant_foreign_access(
361 pvcalls_front_dev->otherend_id,
362 pfn_to_gfn(virt_to_pfn((void *)map->active.ring)), 0);
363
364 map->active.data.in = bytes;
365 map->active.data.out = bytes +
366 XEN_FLEX_RING_SIZE(PVCALLS_RING_ORDER);
367
368 ret = xenbus_alloc_evtchn(pvcalls_front_dev, evtchn);
369 if (ret)
370 goto out_error;
371 irq = bind_evtchn_to_irqhandler(*evtchn, pvcalls_front_conn_handler,
372 0, "pvcalls-frontend", map);
373 if (irq < 0) {
374 ret = irq;
375 goto out_error;
376 }
377
378 map->active.irq = irq;
379 map->active_socket = true;
380 mutex_init(&map->active.in_mutex);
381 mutex_init(&map->active.out_mutex);
382
383 return 0;
384
385out_error:
386 if (*evtchn >= 0)
387 xenbus_free_evtchn(pvcalls_front_dev, *evtchn);
388 kfree(map->active.data.in);
389 kfree(map->active.ring);
390 return ret;
391}
392
393int pvcalls_front_connect(struct socket *sock, struct sockaddr *addr,
394 int addr_len, int flags)
395{
396 struct pvcalls_bedata *bedata;
397 struct sock_mapping *map = NULL;
398 struct xen_pvcalls_request *req;
399 int notify, req_id, ret, evtchn;
400
401 if (addr->sa_family != AF_INET || sock->type != SOCK_STREAM)
402 return -EOPNOTSUPP;
403
404 map = pvcalls_enter_sock(sock);
405 if (IS_ERR(map))
406 return PTR_ERR(map);
407
408 bedata = dev_get_drvdata(&pvcalls_front_dev->dev);
409
410 spin_lock(&bedata->socket_lock);
411 ret = get_request(bedata, &req_id);
412 if (ret < 0) {
413 spin_unlock(&bedata->socket_lock);
414 pvcalls_exit_sock(sock);
415 return ret;
416 }
417 ret = create_active(map, &evtchn);
418 if (ret < 0) {
419 spin_unlock(&bedata->socket_lock);
420 pvcalls_exit_sock(sock);
421 return ret;
422 }
423
424 req = RING_GET_REQUEST(&bedata->ring, req_id);
425 req->req_id = req_id;
426 req->cmd = PVCALLS_CONNECT;
427 req->u.connect.id = (uintptr_t)map;
428 req->u.connect.len = addr_len;
429 req->u.connect.flags = flags;
430 req->u.connect.ref = map->active.ref;
431 req->u.connect.evtchn = evtchn;
432 memcpy(req->u.connect.addr, addr, sizeof(*addr));
433
434 map->sock = sock;
435
436 bedata->ring.req_prod_pvt++;
437 RING_PUSH_REQUESTS_AND_CHECK_NOTIFY(&bedata->ring, notify);
438 spin_unlock(&bedata->socket_lock);
439
440 if (notify)
441 notify_remote_via_irq(bedata->irq);
442
443 wait_event(bedata->inflight_req,
444 READ_ONCE(bedata->rsp[req_id].req_id) == req_id);
445
446 /* read req_id, then the content */
447 smp_rmb();
448 ret = bedata->rsp[req_id].ret;
449 bedata->rsp[req_id].req_id = PVCALLS_INVALID_ID;
450 pvcalls_exit_sock(sock);
451 return ret;
452}
453
454static int __write_ring(struct pvcalls_data_intf *intf,
455 struct pvcalls_data *data,
456 struct iov_iter *msg_iter,
457 int len)
458{
459 RING_IDX cons, prod, size, masked_prod, masked_cons;
460 RING_IDX array_size = XEN_FLEX_RING_SIZE(PVCALLS_RING_ORDER);
461 int32_t error;
462
463 error = intf->out_error;
464 if (error < 0)
465 return error;
466 cons = intf->out_cons;
467 prod = intf->out_prod;
468 /* read indexes before continuing */
469 virt_mb();
470
471 size = pvcalls_queued(prod, cons, array_size);
472 if (size >= array_size)
473 return -EINVAL;
474 if (len > array_size - size)
475 len = array_size - size;
476
477 masked_prod = pvcalls_mask(prod, array_size);
478 masked_cons = pvcalls_mask(cons, array_size);
479
480 if (masked_prod < masked_cons) {
481 len = copy_from_iter(data->out + masked_prod, len, msg_iter);
482 } else {
483 if (len > array_size - masked_prod) {
484 int ret = copy_from_iter(data->out + masked_prod,
485 array_size - masked_prod, msg_iter);
486 if (ret != array_size - masked_prod) {
487 len = ret;
488 goto out;
489 }
490 len = ret + copy_from_iter(data->out, len - ret, msg_iter);
491 } else {
492 len = copy_from_iter(data->out + masked_prod, len, msg_iter);
493 }
494 }
495out:
496 /* write to ring before updating pointer */
497 virt_wmb();
498 intf->out_prod += len;
499
500 return len;
501}
502
503int pvcalls_front_sendmsg(struct socket *sock, struct msghdr *msg,
504 size_t len)
505{
506 struct pvcalls_bedata *bedata;
507 struct sock_mapping *map;
508 int sent, tot_sent = 0;
509 int count = 0, flags;
510
511 flags = msg->msg_flags;
512 if (flags & (MSG_CONFIRM|MSG_DONTROUTE|MSG_EOR|MSG_OOB))
513 return -EOPNOTSUPP;
514
515 map = pvcalls_enter_sock(sock);
516 if (IS_ERR(map))
517 return PTR_ERR(map);
518 bedata = dev_get_drvdata(&pvcalls_front_dev->dev);
519
520 mutex_lock(&map->active.out_mutex);
521 if ((flags & MSG_DONTWAIT) && !pvcalls_front_write_todo(map)) {
522 mutex_unlock(&map->active.out_mutex);
523 pvcalls_exit_sock(sock);
524 return -EAGAIN;
525 }
526 if (len > INT_MAX)
527 len = INT_MAX;
528
529again:
530 count++;
531 sent = __write_ring(map->active.ring,
532 &map->active.data, &msg->msg_iter,
533 len);
534 if (sent > 0) {
535 len -= sent;
536 tot_sent += sent;
537 notify_remote_via_irq(map->active.irq);
538 }
539 if (sent >= 0 && len > 0 && count < PVCALLS_FRONT_MAX_SPIN)
540 goto again;
541 if (sent < 0)
542 tot_sent = sent;
543
544 mutex_unlock(&map->active.out_mutex);
545 pvcalls_exit_sock(sock);
546 return tot_sent;
547}
548
549static int __read_ring(struct pvcalls_data_intf *intf,
550 struct pvcalls_data *data,
551 struct iov_iter *msg_iter,
552 size_t len, int flags)
553{
554 RING_IDX cons, prod, size, masked_prod, masked_cons;
555 RING_IDX array_size = XEN_FLEX_RING_SIZE(PVCALLS_RING_ORDER);
556 int32_t error;
557
558 cons = intf->in_cons;
559 prod = intf->in_prod;
560 error = intf->in_error;
561 /* get pointers before reading from the ring */
562 virt_rmb();
563 if (error < 0)
564 return error;
565
566 size = pvcalls_queued(prod, cons, array_size);
567 masked_prod = pvcalls_mask(prod, array_size);
568 masked_cons = pvcalls_mask(cons, array_size);
569
570 if (size == 0)
571 return 0;
572
573 if (len > size)
574 len = size;
575
576 if (masked_prod > masked_cons) {
577 len = copy_to_iter(data->in + masked_cons, len, msg_iter);
578 } else {
579 if (len > (array_size - masked_cons)) {
580 int ret = copy_to_iter(data->in + masked_cons,
581 array_size - masked_cons, msg_iter);
582 if (ret != array_size - masked_cons) {
583 len = ret;
584 goto out;
585 }
586 len = ret + copy_to_iter(data->in, len - ret, msg_iter);
587 } else {
588 len = copy_to_iter(data->in + masked_cons, len, msg_iter);
589 }
590 }
591out:
592 /* read data from the ring before increasing the index */
593 virt_mb();
594 if (!(flags & MSG_PEEK))
595 intf->in_cons += len;
596
597 return len;
598}
599
600int pvcalls_front_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,
601 int flags)
602{
603 struct pvcalls_bedata *bedata;
604 int ret;
605 struct sock_mapping *map;
606
607 if (flags & (MSG_CMSG_CLOEXEC|MSG_ERRQUEUE|MSG_OOB|MSG_TRUNC))
608 return -EOPNOTSUPP;
609
610 map = pvcalls_enter_sock(sock);
611 if (IS_ERR(map))
612 return PTR_ERR(map);
613 bedata = dev_get_drvdata(&pvcalls_front_dev->dev);
614
615 mutex_lock(&map->active.in_mutex);
616 if (len > XEN_FLEX_RING_SIZE(PVCALLS_RING_ORDER))
617 len = XEN_FLEX_RING_SIZE(PVCALLS_RING_ORDER);
618
619 while (!(flags & MSG_DONTWAIT) && !pvcalls_front_read_todo(map)) {
620 wait_event_interruptible(map->active.inflight_conn_req,
621 pvcalls_front_read_todo(map));
622 }
623 ret = __read_ring(map->active.ring, &map->active.data,
624 &msg->msg_iter, len, flags);
625
626 if (ret > 0)
627 notify_remote_via_irq(map->active.irq);
628 if (ret == 0)
629 ret = (flags & MSG_DONTWAIT) ? -EAGAIN : 0;
630 if (ret == -ENOTCONN)
631 ret = 0;
632
633 mutex_unlock(&map->active.in_mutex);
634 pvcalls_exit_sock(sock);
635 return ret;
636}
637
638int pvcalls_front_bind(struct socket *sock, struct sockaddr *addr, int addr_len)
639{
640 struct pvcalls_bedata *bedata;
641 struct sock_mapping *map = NULL;
642 struct xen_pvcalls_request *req;
643 int notify, req_id, ret;
644
645 if (addr->sa_family != AF_INET || sock->type != SOCK_STREAM)
646 return -EOPNOTSUPP;
647
648 map = pvcalls_enter_sock(sock);
649 if (IS_ERR(map))
650 return PTR_ERR(map);
651 bedata = dev_get_drvdata(&pvcalls_front_dev->dev);
652
653 spin_lock(&bedata->socket_lock);
654 ret = get_request(bedata, &req_id);
655 if (ret < 0) {
656 spin_unlock(&bedata->socket_lock);
657 pvcalls_exit_sock(sock);
658 return ret;
659 }
660 req = RING_GET_REQUEST(&bedata->ring, req_id);
661 req->req_id = req_id;
662 map->sock = sock;
663 req->cmd = PVCALLS_BIND;
664 req->u.bind.id = (uintptr_t)map;
665 memcpy(req->u.bind.addr, addr, sizeof(*addr));
666 req->u.bind.len = addr_len;
667
668 init_waitqueue_head(&map->passive.inflight_accept_req);
669
670 map->active_socket = false;
671
672 bedata->ring.req_prod_pvt++;
673 RING_PUSH_REQUESTS_AND_CHECK_NOTIFY(&bedata->ring, notify);
674 spin_unlock(&bedata->socket_lock);
675 if (notify)
676 notify_remote_via_irq(bedata->irq);
677
678 wait_event(bedata->inflight_req,
679 READ_ONCE(bedata->rsp[req_id].req_id) == req_id);
680
681 /* read req_id, then the content */
682 smp_rmb();
683 ret = bedata->rsp[req_id].ret;
684 bedata->rsp[req_id].req_id = PVCALLS_INVALID_ID;
685
686 map->passive.status = PVCALLS_STATUS_BIND;
687 pvcalls_exit_sock(sock);
688 return 0;
689}
690
691int pvcalls_front_listen(struct socket *sock, int backlog)
692{
693 struct pvcalls_bedata *bedata;
694 struct sock_mapping *map;
695 struct xen_pvcalls_request *req;
696 int notify, req_id, ret;
697
698 map = pvcalls_enter_sock(sock);
699 if (IS_ERR(map))
700 return PTR_ERR(map);
701 bedata = dev_get_drvdata(&pvcalls_front_dev->dev);
702
703 if (map->passive.status != PVCALLS_STATUS_BIND) {
704 pvcalls_exit_sock(sock);
705 return -EOPNOTSUPP;
706 }
707
708 spin_lock(&bedata->socket_lock);
709 ret = get_request(bedata, &req_id);
710 if (ret < 0) {
711 spin_unlock(&bedata->socket_lock);
712 pvcalls_exit_sock(sock);
713 return ret;
714 }
715 req = RING_GET_REQUEST(&bedata->ring, req_id);
716 req->req_id = req_id;
717 req->cmd = PVCALLS_LISTEN;
718 req->u.listen.id = (uintptr_t) map;
719 req->u.listen.backlog = backlog;
720
721 bedata->ring.req_prod_pvt++;
722 RING_PUSH_REQUESTS_AND_CHECK_NOTIFY(&bedata->ring, notify);
723 spin_unlock(&bedata->socket_lock);
724 if (notify)
725 notify_remote_via_irq(bedata->irq);
726
727 wait_event(bedata->inflight_req,
728 READ_ONCE(bedata->rsp[req_id].req_id) == req_id);
729
730 /* read req_id, then the content */
731 smp_rmb();
732 ret = bedata->rsp[req_id].ret;
733 bedata->rsp[req_id].req_id = PVCALLS_INVALID_ID;
734
735 map->passive.status = PVCALLS_STATUS_LISTEN;
736 pvcalls_exit_sock(sock);
737 return ret;
738}
739
740int pvcalls_front_accept(struct socket *sock, struct socket *newsock, int flags)
741{
742 struct pvcalls_bedata *bedata;
743 struct sock_mapping *map;
744 struct sock_mapping *map2 = NULL;
745 struct xen_pvcalls_request *req;
746 int notify, req_id, ret, evtchn, nonblock;
747
748 map = pvcalls_enter_sock(sock);
749 if (IS_ERR(map))
750 return PTR_ERR(map);
751 bedata = dev_get_drvdata(&pvcalls_front_dev->dev);
752
753 if (map->passive.status != PVCALLS_STATUS_LISTEN) {
754 pvcalls_exit_sock(sock);
755 return -EINVAL;
756 }
757
758 nonblock = flags & SOCK_NONBLOCK;
759 /*
760 * Backend only supports 1 inflight accept request, will return
761 * errors for the others
762 */
763 if (test_and_set_bit(PVCALLS_FLAG_ACCEPT_INFLIGHT,
764 (void *)&map->passive.flags)) {
765 req_id = READ_ONCE(map->passive.inflight_req_id);
766 if (req_id != PVCALLS_INVALID_ID &&
767 READ_ONCE(bedata->rsp[req_id].req_id) == req_id) {
768 map2 = map->passive.accept_map;
769 goto received;
770 }
771 if (nonblock) {
772 pvcalls_exit_sock(sock);
773 return -EAGAIN;
774 }
775 if (wait_event_interruptible(map->passive.inflight_accept_req,
776 !test_and_set_bit(PVCALLS_FLAG_ACCEPT_INFLIGHT,
777 (void *)&map->passive.flags))) {
778 pvcalls_exit_sock(sock);
779 return -EINTR;
780 }
781 }
782
783 spin_lock(&bedata->socket_lock);
784 ret = get_request(bedata, &req_id);
785 if (ret < 0) {
786 clear_bit(PVCALLS_FLAG_ACCEPT_INFLIGHT,
787 (void *)&map->passive.flags);
788 spin_unlock(&bedata->socket_lock);
789 pvcalls_exit_sock(sock);
790 return ret;
791 }
792 map2 = kzalloc(sizeof(*map2), GFP_ATOMIC);
793 if (map2 == NULL) {
794 clear_bit(PVCALLS_FLAG_ACCEPT_INFLIGHT,
795 (void *)&map->passive.flags);
796 spin_unlock(&bedata->socket_lock);
797 pvcalls_exit_sock(sock);
798 return -ENOMEM;
799 }
800 ret = create_active(map2, &evtchn);
801 if (ret < 0) {
802 kfree(map2);
803 clear_bit(PVCALLS_FLAG_ACCEPT_INFLIGHT,
804 (void *)&map->passive.flags);
805 spin_unlock(&bedata->socket_lock);
806 pvcalls_exit_sock(sock);
807 return ret;
808 }
809 list_add_tail(&map2->list, &bedata->socket_mappings);
810
811 req = RING_GET_REQUEST(&bedata->ring, req_id);
812 req->req_id = req_id;
813 req->cmd = PVCALLS_ACCEPT;
814 req->u.accept.id = (uintptr_t) map;
815 req->u.accept.ref = map2->active.ref;
816 req->u.accept.id_new = (uintptr_t) map2;
817 req->u.accept.evtchn = evtchn;
818 map->passive.accept_map = map2;
819
820 bedata->ring.req_prod_pvt++;
821 RING_PUSH_REQUESTS_AND_CHECK_NOTIFY(&bedata->ring, notify);
822 spin_unlock(&bedata->socket_lock);
823 if (notify)
824 notify_remote_via_irq(bedata->irq);
825 /* We could check if we have received a response before returning. */
826 if (nonblock) {
827 WRITE_ONCE(map->passive.inflight_req_id, req_id);
828 pvcalls_exit_sock(sock);
829 return -EAGAIN;
830 }
831
832 if (wait_event_interruptible(bedata->inflight_req,
833 READ_ONCE(bedata->rsp[req_id].req_id) == req_id)) {
834 pvcalls_exit_sock(sock);
835 return -EINTR;
836 }
837 /* read req_id, then the content */
838 smp_rmb();
839
840received:
841 map2->sock = newsock;
842 newsock->sk = kzalloc(sizeof(*newsock->sk), GFP_KERNEL);
843 if (!newsock->sk) {
844 bedata->rsp[req_id].req_id = PVCALLS_INVALID_ID;
845 map->passive.inflight_req_id = PVCALLS_INVALID_ID;
846 clear_bit(PVCALLS_FLAG_ACCEPT_INFLIGHT,
847 (void *)&map->passive.flags);
848 pvcalls_front_free_map(bedata, map2);
849 pvcalls_exit_sock(sock);
850 return -ENOMEM;
851 }
852 newsock->sk->sk_send_head = (void *)map2;
853
854 ret = bedata->rsp[req_id].ret;
855 bedata->rsp[req_id].req_id = PVCALLS_INVALID_ID;
856 map->passive.inflight_req_id = PVCALLS_INVALID_ID;
857
858 clear_bit(PVCALLS_FLAG_ACCEPT_INFLIGHT, (void *)&map->passive.flags);
859 wake_up(&map->passive.inflight_accept_req);
860
861 pvcalls_exit_sock(sock);
862 return ret;
863}
864
865static __poll_t pvcalls_front_poll_passive(struct file *file,
866 struct pvcalls_bedata *bedata,
867 struct sock_mapping *map,
868 poll_table *wait)
869{
870 int notify, req_id, ret;
871 struct xen_pvcalls_request *req;
872
873 if (test_bit(PVCALLS_FLAG_ACCEPT_INFLIGHT,
874 (void *)&map->passive.flags)) {
875 uint32_t req_id = READ_ONCE(map->passive.inflight_req_id);
876
877 if (req_id != PVCALLS_INVALID_ID &&
878 READ_ONCE(bedata->rsp[req_id].req_id) == req_id)
879 return EPOLLIN | EPOLLRDNORM;
880
881 poll_wait(file, &map->passive.inflight_accept_req, wait);
882 return 0;
883 }
884
885 if (test_and_clear_bit(PVCALLS_FLAG_POLL_RET,
886 (void *)&map->passive.flags))
887 return EPOLLIN | EPOLLRDNORM;
888
889 /*
890 * First check RET, then INFLIGHT. No barriers necessary to
891 * ensure execution ordering because of the conditional
892 * instructions creating control dependencies.
893 */
894
895 if (test_and_set_bit(PVCALLS_FLAG_POLL_INFLIGHT,
896 (void *)&map->passive.flags)) {
897 poll_wait(file, &bedata->inflight_req, wait);
898 return 0;
899 }
900
901 spin_lock(&bedata->socket_lock);
902 ret = get_request(bedata, &req_id);
903 if (ret < 0) {
904 spin_unlock(&bedata->socket_lock);
905 return ret;
906 }
907 req = RING_GET_REQUEST(&bedata->ring, req_id);
908 req->req_id = req_id;
909 req->cmd = PVCALLS_POLL;
910 req->u.poll.id = (uintptr_t) map;
911
912 bedata->ring.req_prod_pvt++;
913 RING_PUSH_REQUESTS_AND_CHECK_NOTIFY(&bedata->ring, notify);
914 spin_unlock(&bedata->socket_lock);
915 if (notify)
916 notify_remote_via_irq(bedata->irq);
917
918 poll_wait(file, &bedata->inflight_req, wait);
919 return 0;
920}
921
922static __poll_t pvcalls_front_poll_active(struct file *file,
923 struct pvcalls_bedata *bedata,
924 struct sock_mapping *map,
925 poll_table *wait)
926{
927 __poll_t mask = 0;
928 int32_t in_error, out_error;
929 struct pvcalls_data_intf *intf = map->active.ring;
930
931 out_error = intf->out_error;
932 in_error = intf->in_error;
933
934 poll_wait(file, &map->active.inflight_conn_req, wait);
935 if (pvcalls_front_write_todo(map))
936 mask |= EPOLLOUT | EPOLLWRNORM;
937 if (pvcalls_front_read_todo(map))
938 mask |= EPOLLIN | EPOLLRDNORM;
939 if (in_error != 0 || out_error != 0)
940 mask |= EPOLLERR;
941
942 return mask;
943}
944
945__poll_t pvcalls_front_poll(struct file *file, struct socket *sock,
946 poll_table *wait)
947{
948 struct pvcalls_bedata *bedata;
949 struct sock_mapping *map;
950 __poll_t ret;
951
952 map = pvcalls_enter_sock(sock);
953 if (IS_ERR(map))
954 return EPOLLNVAL;
955 bedata = dev_get_drvdata(&pvcalls_front_dev->dev);
956
957 if (map->active_socket)
958 ret = pvcalls_front_poll_active(file, bedata, map, wait);
959 else
960 ret = pvcalls_front_poll_passive(file, bedata, map, wait);
961 pvcalls_exit_sock(sock);
962 return ret;
963}
964
965int pvcalls_front_release(struct socket *sock)
966{
967 struct pvcalls_bedata *bedata;
968 struct sock_mapping *map;
969 int req_id, notify, ret;
970 struct xen_pvcalls_request *req;
971
972 if (sock->sk == NULL)
973 return 0;
974
975 map = pvcalls_enter_sock(sock);
976 if (IS_ERR(map)) {
977 if (PTR_ERR(map) == -ENOTCONN)
978 return -EIO;
979 else
980 return 0;
981 }
982 bedata = dev_get_drvdata(&pvcalls_front_dev->dev);
983
984 spin_lock(&bedata->socket_lock);
985 ret = get_request(bedata, &req_id);
986 if (ret < 0) {
987 spin_unlock(&bedata->socket_lock);
988 pvcalls_exit_sock(sock);
989 return ret;
990 }
991 sock->sk->sk_send_head = NULL;
992
993 req = RING_GET_REQUEST(&bedata->ring, req_id);
994 req->req_id = req_id;
995 req->cmd = PVCALLS_RELEASE;
996 req->u.release.id = (uintptr_t)map;
997
998 bedata->ring.req_prod_pvt++;
999 RING_PUSH_REQUESTS_AND_CHECK_NOTIFY(&bedata->ring, notify);
1000 spin_unlock(&bedata->socket_lock);
1001 if (notify)
1002 notify_remote_via_irq(bedata->irq);
1003
1004 wait_event(bedata->inflight_req,
1005 READ_ONCE(bedata->rsp[req_id].req_id) == req_id);
1006
1007 if (map->active_socket) {
1008 /*
1009 * Set in_error and wake up inflight_conn_req to force
1010 * recvmsg waiters to exit.
1011 */
1012 map->active.ring->in_error = -EBADF;
1013 wake_up_interruptible(&map->active.inflight_conn_req);
1014
1015 /*
1016 * We need to make sure that sendmsg/recvmsg on this socket have
1017 * not started before we've cleared sk_send_head here. The
1018 * easiest way to guarantee this is to see that no pvcalls
1019 * (other than us) is in progress on this socket.
1020 */
1021 while (atomic_read(&map->refcount) > 1)
1022 cpu_relax();
1023
1024 pvcalls_front_free_map(bedata, map);
1025 } else {
1026 wake_up(&bedata->inflight_req);
1027 wake_up(&map->passive.inflight_accept_req);
1028
1029 while (atomic_read(&map->refcount) > 1)
1030 cpu_relax();
1031
1032 spin_lock(&bedata->socket_lock);
1033 list_del(&map->list);
1034 spin_unlock(&bedata->socket_lock);
1035 if (READ_ONCE(map->passive.inflight_req_id) !=
1036 PVCALLS_INVALID_ID) {
1037 pvcalls_front_free_map(bedata,
1038 map->passive.accept_map);
1039 }
1040 kfree(map);
1041 }
1042 WRITE_ONCE(bedata->rsp[req_id].req_id, PVCALLS_INVALID_ID);
1043
1044 pvcalls_exit();
1045 return 0;
1046}
1047
1048static const struct xenbus_device_id pvcalls_front_ids[] = {
1049 { "pvcalls" },
1050 { "" }
1051};
1052
1053static int pvcalls_front_remove(struct xenbus_device *dev)
1054{
1055 struct pvcalls_bedata *bedata;
1056 struct sock_mapping *map = NULL, *n;
1057
1058 bedata = dev_get_drvdata(&pvcalls_front_dev->dev);
1059 dev_set_drvdata(&dev->dev, NULL);
1060 pvcalls_front_dev = NULL;
1061 if (bedata->irq >= 0)
1062 unbind_from_irqhandler(bedata->irq, dev);
1063
1064 list_for_each_entry_safe(map, n, &bedata->socket_mappings, list) {
1065 map->sock->sk->sk_send_head = NULL;
1066 if (map->active_socket) {
1067 map->active.ring->in_error = -EBADF;
1068 wake_up_interruptible(&map->active.inflight_conn_req);
1069 }
1070 }
1071
1072 smp_mb();
1073 while (atomic_read(&pvcalls_refcount) > 0)
1074 cpu_relax();
1075 list_for_each_entry_safe(map, n, &bedata->socket_mappings, list) {
1076 if (map->active_socket) {
1077 /* No need to lock, refcount is 0 */
1078 pvcalls_front_free_map(bedata, map);
1079 } else {
1080 list_del(&map->list);
1081 kfree(map);
1082 }
1083 }
1084 if (bedata->ref != -1)
1085 gnttab_end_foreign_access(bedata->ref, 0, 0);
1086 kfree(bedata->ring.sring);
1087 kfree(bedata);
1088 xenbus_switch_state(dev, XenbusStateClosed);
1089 return 0;
1090}
1091
1092static int pvcalls_front_probe(struct xenbus_device *dev,
1093 const struct xenbus_device_id *id)
1094{
1095 int ret = -ENOMEM, evtchn, i;
1096 unsigned int max_page_order, function_calls, len;
1097 char *versions;
1098 grant_ref_t gref_head = 0;
1099 struct xenbus_transaction xbt;
1100 struct pvcalls_bedata *bedata = NULL;
1101 struct xen_pvcalls_sring *sring;
1102
1103 if (pvcalls_front_dev != NULL) {
1104 dev_err(&dev->dev, "only one PV Calls connection supported\n");
1105 return -EINVAL;
1106 }
1107
1108 versions = xenbus_read(XBT_NIL, dev->otherend, "versions", &len);
1109 if (IS_ERR(versions))
1110 return PTR_ERR(versions);
1111 if (!len)
1112 return -EINVAL;
1113 if (strcmp(versions, "1")) {
1114 kfree(versions);
1115 return -EINVAL;
1116 }
1117 kfree(versions);
1118 max_page_order = xenbus_read_unsigned(dev->otherend,
1119 "max-page-order", 0);
1120 if (max_page_order < PVCALLS_RING_ORDER)
1121 return -ENODEV;
1122 function_calls = xenbus_read_unsigned(dev->otherend,
1123 "function-calls", 0);
1124 /* See XENBUS_FUNCTIONS_CALLS in pvcalls.h */
1125 if (function_calls != 1)
1126 return -ENODEV;
1127 pr_info("%s max-page-order is %u\n", __func__, max_page_order);
1128
1129 bedata = kzalloc(sizeof(struct pvcalls_bedata), GFP_KERNEL);
1130 if (!bedata)
1131 return -ENOMEM;
1132
1133 dev_set_drvdata(&dev->dev, bedata);
1134 pvcalls_front_dev = dev;
1135 init_waitqueue_head(&bedata->inflight_req);
1136 INIT_LIST_HEAD(&bedata->socket_mappings);
1137 spin_lock_init(&bedata->socket_lock);
1138 bedata->irq = -1;
1139 bedata->ref = -1;
1140
1141 for (i = 0; i < PVCALLS_NR_RSP_PER_RING; i++)
1142 bedata->rsp[i].req_id = PVCALLS_INVALID_ID;
1143
1144 sring = (struct xen_pvcalls_sring *) __get_free_page(GFP_KERNEL |
1145 __GFP_ZERO);
1146 if (!sring)
1147 goto error;
1148 SHARED_RING_INIT(sring);
1149 FRONT_RING_INIT(&bedata->ring, sring, XEN_PAGE_SIZE);
1150
1151 ret = xenbus_alloc_evtchn(dev, &evtchn);
1152 if (ret)
1153 goto error;
1154
1155 bedata->irq = bind_evtchn_to_irqhandler(evtchn,
1156 pvcalls_front_event_handler,
1157 0, "pvcalls-frontend", dev);
1158 if (bedata->irq < 0) {
1159 ret = bedata->irq;
1160 goto error;
1161 }
1162
1163 ret = gnttab_alloc_grant_references(1, &gref_head);
1164 if (ret < 0)
1165 goto error;
1166 ret = gnttab_claim_grant_reference(&gref_head);
1167 if (ret < 0)
1168 goto error;
1169 bedata->ref = ret;
1170 gnttab_grant_foreign_access_ref(bedata->ref, dev->otherend_id,
1171 virt_to_gfn((void *)sring), 0);
1172
1173 again:
1174 ret = xenbus_transaction_start(&xbt);
1175 if (ret) {
1176 xenbus_dev_fatal(dev, ret, "starting transaction");
1177 goto error;
1178 }
1179 ret = xenbus_printf(xbt, dev->nodename, "version", "%u", 1);
1180 if (ret)
1181 goto error_xenbus;
1182 ret = xenbus_printf(xbt, dev->nodename, "ring-ref", "%d", bedata->ref);
1183 if (ret)
1184 goto error_xenbus;
1185 ret = xenbus_printf(xbt, dev->nodename, "port", "%u",
1186 evtchn);
1187 if (ret)
1188 goto error_xenbus;
1189 ret = xenbus_transaction_end(xbt, 0);
1190 if (ret) {
1191 if (ret == -EAGAIN)
1192 goto again;
1193 xenbus_dev_fatal(dev, ret, "completing transaction");
1194 goto error;
1195 }
1196 xenbus_switch_state(dev, XenbusStateInitialised);
1197
1198 return 0;
1199
1200 error_xenbus:
1201 xenbus_transaction_end(xbt, 1);
1202 xenbus_dev_fatal(dev, ret, "writing xenstore");
1203 error:
1204 pvcalls_front_remove(dev);
1205 return ret;
1206}
1207
1208static void pvcalls_front_changed(struct xenbus_device *dev,
1209 enum xenbus_state backend_state)
1210{
1211 switch (backend_state) {
1212 case XenbusStateReconfiguring:
1213 case XenbusStateReconfigured:
1214 case XenbusStateInitialising:
1215 case XenbusStateInitialised:
1216 case XenbusStateUnknown:
1217 break;
1218
1219 case XenbusStateInitWait:
1220 break;
1221
1222 case XenbusStateConnected:
1223 xenbus_switch_state(dev, XenbusStateConnected);
1224 break;
1225
1226 case XenbusStateClosed:
1227 if (dev->state == XenbusStateClosed)
1228 break;
1229 /* Missed the backend's CLOSING state */
1230 /* fall through */
1231 case XenbusStateClosing:
1232 xenbus_frontend_closed(dev);
1233 break;
1234 }
1235}
1236
1237static struct xenbus_driver pvcalls_front_driver = {
1238 .ids = pvcalls_front_ids,
1239 .probe = pvcalls_front_probe,
1240 .remove = pvcalls_front_remove,
1241 .otherend_changed = pvcalls_front_changed,
1242};
1243
1244static int __init pvcalls_frontend_init(void)
1245{
1246 if (!xen_domain())
1247 return -ENODEV;
1248
1249 pr_info("Initialising Xen pvcalls frontend driver\n");
1250
1251 return xenbus_register_frontend(&pvcalls_front_driver);
1252}
1253
1254module_init(pvcalls_frontend_init);
1255
1256MODULE_DESCRIPTION("Xen PV Calls frontend driver");
1257MODULE_AUTHOR("Stefano Stabellini <sstabellini@kernel.org>");
1258MODULE_LICENSE("GPL");