]> git.karo-electronics.de Git - karo-tx-linux.git/blob - drivers/xen/xen-scsiback.c
xen/scsiback: Fix a TMR related use-after-free
[karo-tx-linux.git] / drivers / xen / xen-scsiback.c
1 /*
2  * Xen SCSI backend driver
3  *
4  * Copyright (c) 2008, FUJITSU Limited
5  *
6  * Based on the blkback driver code.
7  * Adaption to kernel taget core infrastructure taken from vhost/scsi.c
8  *
9  * This program is free software; you can redistribute it and/or
10  * modify it under the terms of the GNU General Public License version 2
11  * as published by the Free Software Foundation; or, when distributed
12  * separately from the Linux kernel or incorporated into other
13  * software packages, subject to the following license:
14  *
15  * Permission is hereby granted, free of charge, to any person obtaining a copy
16  * of this source file (the "Software"), to deal in the Software without
17  * restriction, including without limitation the rights to use, copy, modify,
18  * merge, publish, distribute, sublicense, and/or sell copies of the Software,
19  * and to permit persons to whom the Software is furnished to do so, subject to
20  * the following conditions:
21  *
22  * The above copyright notice and this permission notice shall be included in
23  * all copies or substantial portions of the Software.
24  *
25  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
26  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
27  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
28  * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
29  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
30  * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS
31  * IN THE SOFTWARE.
32  */
33
34 #define pr_fmt(fmt) "xen-pvscsi: " fmt
35
36 #include <stdarg.h>
37
38 #include <linux/module.h>
39 #include <linux/utsname.h>
40 #include <linux/interrupt.h>
41 #include <linux/slab.h>
42 #include <linux/wait.h>
43 #include <linux/sched.h>
44 #include <linux/list.h>
45 #include <linux/gfp.h>
46 #include <linux/delay.h>
47 #include <linux/spinlock.h>
48 #include <linux/configfs.h>
49
50 #include <generated/utsrelease.h>
51
52 #include <scsi/scsi_host.h> /* SG_ALL */
53
54 #include <target/target_core_base.h>
55 #include <target/target_core_fabric.h>
56
57 #include <asm/hypervisor.h>
58
59 #include <xen/xen.h>
60 #include <xen/balloon.h>
61 #include <xen/events.h>
62 #include <xen/xenbus.h>
63 #include <xen/grant_table.h>
64 #include <xen/page.h>
65
66 #include <xen/interface/grant_table.h>
67 #include <xen/interface/io/vscsiif.h>
68
69 #define VSCSI_VERSION   "v0.1"
70 #define VSCSI_NAMELEN   32
71
72 struct ids_tuple {
73         unsigned int hst;               /* host    */
74         unsigned int chn;               /* channel */
75         unsigned int tgt;               /* target  */
76         unsigned int lun;               /* LUN     */
77 };
78
79 struct v2p_entry {
80         struct ids_tuple v;             /* translate from */
81         struct scsiback_tpg *tpg;       /* translate to   */
82         unsigned int lun;
83         struct kref kref;
84         struct list_head l;
85 };
86
87 struct vscsibk_info {
88         struct xenbus_device *dev;
89
90         domid_t domid;
91         unsigned int irq;
92
93         struct vscsiif_back_ring ring;
94         int ring_error;
95
96         spinlock_t ring_lock;
97         atomic_t nr_unreplied_reqs;
98
99         spinlock_t v2p_lock;
100         struct list_head v2p_entry_lists;
101
102         wait_queue_head_t waiting_to_free;
103 };
104
105 /* theoretical maximum of grants for one request */
106 #define VSCSI_MAX_GRANTS        (SG_ALL + VSCSIIF_SG_TABLESIZE)
107
108 /*
109  * VSCSI_GRANT_BATCH is the maximum number of grants to be processed in one
110  * call to map/unmap grants. Don't choose it too large, as there are arrays
111  * with VSCSI_GRANT_BATCH elements allocated on the stack.
112  */
113 #define VSCSI_GRANT_BATCH       16
114
115 struct vscsibk_pend {
116         uint16_t rqid;
117
118         uint8_t cmnd[VSCSIIF_MAX_COMMAND_SIZE];
119         uint8_t cmd_len;
120
121         uint8_t sc_data_direction;
122         uint16_t n_sg;          /* real length of SG list */
123         uint16_t n_grants;      /* SG pages and potentially SG list */
124         uint32_t data_len;
125         uint32_t result;
126
127         struct vscsibk_info *info;
128         struct v2p_entry *v2p;
129         struct scatterlist *sgl;
130
131         uint8_t sense_buffer[VSCSIIF_SENSE_BUFFERSIZE];
132
133         grant_handle_t grant_handles[VSCSI_MAX_GRANTS];
134         struct page *pages[VSCSI_MAX_GRANTS];
135
136         struct se_cmd se_cmd;
137
138         atomic_t tmr_complete;
139         wait_queue_head_t tmr_wait;
140 };
141
142 #define VSCSI_DEFAULT_SESSION_TAGS      128
143
144 struct scsiback_nexus {
145         /* Pointer to TCM session for I_T Nexus */
146         struct se_session *tvn_se_sess;
147 };
148
149 struct scsiback_tport {
150         /* SCSI protocol the tport is providing */
151         u8 tport_proto_id;
152         /* Binary World Wide unique Port Name for pvscsi Target port */
153         u64 tport_wwpn;
154         /* ASCII formatted WWPN for pvscsi Target port */
155         char tport_name[VSCSI_NAMELEN];
156         /* Returned by scsiback_make_tport() */
157         struct se_wwn tport_wwn;
158 };
159
160 struct scsiback_tpg {
161         /* scsiback port target portal group tag for TCM */
162         u16 tport_tpgt;
163         /* track number of TPG Port/Lun Links wrt explicit I_T Nexus shutdown */
164         int tv_tpg_port_count;
165         /* xen-pvscsi references to tpg_nexus, protected by tv_tpg_mutex */
166         int tv_tpg_fe_count;
167         /* list for scsiback_list */
168         struct list_head tv_tpg_list;
169         /* Used to protect access for tpg_nexus */
170         struct mutex tv_tpg_mutex;
171         /* Pointer to the TCM pvscsi I_T Nexus for this TPG endpoint */
172         struct scsiback_nexus *tpg_nexus;
173         /* Pointer back to scsiback_tport */
174         struct scsiback_tport *tport;
175         /* Returned by scsiback_make_tpg() */
176         struct se_portal_group se_tpg;
177         /* alias used in xenstore */
178         char param_alias[VSCSI_NAMELEN];
179         /* list of info structures related to this target portal group */
180         struct list_head info_list;
181 };
182
183 #define SCSIBACK_INVALID_HANDLE (~0)
184
185 static bool log_print_stat;
186 module_param(log_print_stat, bool, 0644);
187
188 static int scsiback_max_buffer_pages = 1024;
189 module_param_named(max_buffer_pages, scsiback_max_buffer_pages, int, 0644);
190 MODULE_PARM_DESC(max_buffer_pages,
191 "Maximum number of free pages to keep in backend buffer");
192
193 static DEFINE_SPINLOCK(free_pages_lock);
194 static int free_pages_num;
195 static LIST_HEAD(scsiback_free_pages);
196
197 /* Global spinlock to protect scsiback TPG list */
198 static DEFINE_MUTEX(scsiback_mutex);
199 static LIST_HEAD(scsiback_list);
200
201 static void scsiback_get(struct vscsibk_info *info)
202 {
203         atomic_inc(&info->nr_unreplied_reqs);
204 }
205
206 static void scsiback_put(struct vscsibk_info *info)
207 {
208         if (atomic_dec_and_test(&info->nr_unreplied_reqs))
209                 wake_up(&info->waiting_to_free);
210 }
211
212 static void put_free_pages(struct page **page, int num)
213 {
214         unsigned long flags;
215         int i = free_pages_num + num, n = num;
216
217         if (num == 0)
218                 return;
219         if (i > scsiback_max_buffer_pages) {
220                 n = min(num, i - scsiback_max_buffer_pages);
221                 gnttab_free_pages(n, page + num - n);
222                 n = num - n;
223         }
224         spin_lock_irqsave(&free_pages_lock, flags);
225         for (i = 0; i < n; i++)
226                 list_add(&page[i]->lru, &scsiback_free_pages);
227         free_pages_num += n;
228         spin_unlock_irqrestore(&free_pages_lock, flags);
229 }
230
231 static int get_free_page(struct page **page)
232 {
233         unsigned long flags;
234
235         spin_lock_irqsave(&free_pages_lock, flags);
236         if (list_empty(&scsiback_free_pages)) {
237                 spin_unlock_irqrestore(&free_pages_lock, flags);
238                 return gnttab_alloc_pages(1, page);
239         }
240         page[0] = list_first_entry(&scsiback_free_pages, struct page, lru);
241         list_del(&page[0]->lru);
242         free_pages_num--;
243         spin_unlock_irqrestore(&free_pages_lock, flags);
244         return 0;
245 }
246
247 static unsigned long vaddr_page(struct page *page)
248 {
249         unsigned long pfn = page_to_pfn(page);
250
251         return (unsigned long)pfn_to_kaddr(pfn);
252 }
253
254 static unsigned long vaddr(struct vscsibk_pend *req, int seg)
255 {
256         return vaddr_page(req->pages[seg]);
257 }
258
259 static void scsiback_print_status(char *sense_buffer, int errors,
260                                         struct vscsibk_pend *pending_req)
261 {
262         struct scsiback_tpg *tpg = pending_req->v2p->tpg;
263
264         pr_err("[%s:%d] cmnd[0]=%02x -> st=%02x msg=%02x host=%02x drv=%02x\n",
265                tpg->tport->tport_name, pending_req->v2p->lun,
266                pending_req->cmnd[0], status_byte(errors), msg_byte(errors),
267                host_byte(errors), driver_byte(errors));
268 }
269
270 static void scsiback_fast_flush_area(struct vscsibk_pend *req)
271 {
272         struct gnttab_unmap_grant_ref unmap[VSCSI_GRANT_BATCH];
273         struct page *pages[VSCSI_GRANT_BATCH];
274         unsigned int i, invcount = 0;
275         grant_handle_t handle;
276         int err;
277
278         kfree(req->sgl);
279         req->sgl = NULL;
280         req->n_sg = 0;
281
282         if (!req->n_grants)
283                 return;
284
285         for (i = 0; i < req->n_grants; i++) {
286                 handle = req->grant_handles[i];
287                 if (handle == SCSIBACK_INVALID_HANDLE)
288                         continue;
289                 gnttab_set_unmap_op(&unmap[invcount], vaddr(req, i),
290                                     GNTMAP_host_map, handle);
291                 req->grant_handles[i] = SCSIBACK_INVALID_HANDLE;
292                 pages[invcount] = req->pages[i];
293                 put_page(pages[invcount]);
294                 invcount++;
295                 if (invcount < VSCSI_GRANT_BATCH)
296                         continue;
297                 err = gnttab_unmap_refs(unmap, NULL, pages, invcount);
298                 BUG_ON(err);
299                 invcount = 0;
300         }
301
302         if (invcount) {
303                 err = gnttab_unmap_refs(unmap, NULL, pages, invcount);
304                 BUG_ON(err);
305         }
306
307         put_free_pages(req->pages, req->n_grants);
308         req->n_grants = 0;
309 }
310
311 static void scsiback_free_translation_entry(struct kref *kref)
312 {
313         struct v2p_entry *entry = container_of(kref, struct v2p_entry, kref);
314         struct scsiback_tpg *tpg = entry->tpg;
315
316         mutex_lock(&tpg->tv_tpg_mutex);
317         tpg->tv_tpg_fe_count--;
318         mutex_unlock(&tpg->tv_tpg_mutex);
319
320         kfree(entry);
321 }
322
323 static void scsiback_send_response(struct vscsibk_info *info,
324                         char *sense_buffer, int32_t result, uint32_t resid,
325                         uint16_t rqid)
326 {
327         struct vscsiif_response *ring_res;
328         int notify;
329         struct scsi_sense_hdr sshdr;
330         unsigned long flags;
331         unsigned len;
332
333         spin_lock_irqsave(&info->ring_lock, flags);
334
335         ring_res = RING_GET_RESPONSE(&info->ring, info->ring.rsp_prod_pvt);
336         info->ring.rsp_prod_pvt++;
337
338         ring_res->rslt   = result;
339         ring_res->rqid   = rqid;
340
341         if (sense_buffer != NULL &&
342             scsi_normalize_sense(sense_buffer, VSCSIIF_SENSE_BUFFERSIZE,
343                                  &sshdr)) {
344                 len = min_t(unsigned, 8 + sense_buffer[7],
345                             VSCSIIF_SENSE_BUFFERSIZE);
346                 memcpy(ring_res->sense_buffer, sense_buffer, len);
347                 ring_res->sense_len = len;
348         } else {
349                 ring_res->sense_len = 0;
350         }
351
352         ring_res->residual_len = resid;
353
354         RING_PUSH_RESPONSES_AND_CHECK_NOTIFY(&info->ring, notify);
355         spin_unlock_irqrestore(&info->ring_lock, flags);
356
357         if (notify)
358                 notify_remote_via_irq(info->irq);
359 }
360
361 static void scsiback_do_resp_with_sense(char *sense_buffer, int32_t result,
362                         uint32_t resid, struct vscsibk_pend *pending_req)
363 {
364         scsiback_send_response(pending_req->info, sense_buffer, result,
365                                resid, pending_req->rqid);
366
367         if (pending_req->v2p)
368                 kref_put(&pending_req->v2p->kref,
369                          scsiback_free_translation_entry);
370 }
371
372 static void scsiback_cmd_done(struct vscsibk_pend *pending_req)
373 {
374         struct vscsibk_info *info = pending_req->info;
375         unsigned char *sense_buffer;
376         unsigned int resid;
377         int errors;
378
379         sense_buffer = pending_req->sense_buffer;
380         resid        = pending_req->se_cmd.residual_count;
381         errors       = pending_req->result;
382
383         if (errors && log_print_stat)
384                 scsiback_print_status(sense_buffer, errors, pending_req);
385
386         scsiback_fast_flush_area(pending_req);
387         scsiback_do_resp_with_sense(sense_buffer, errors, resid, pending_req);
388         scsiback_put(info);
389         /*
390          * Drop the extra KREF_ACK reference taken by target_submit_cmd_map_sgls()
391          * ahead of scsiback_check_stop_free() ->  transport_generic_free_cmd()
392          * final se_cmd->cmd_kref put.
393          */
394         target_put_sess_cmd(&pending_req->se_cmd);
395 }
396
397 static void scsiback_cmd_exec(struct vscsibk_pend *pending_req)
398 {
399         struct se_cmd *se_cmd = &pending_req->se_cmd;
400         struct se_session *sess = pending_req->v2p->tpg->tpg_nexus->tvn_se_sess;
401         int rc;
402
403         scsiback_get(pending_req->info);
404         se_cmd->tag = pending_req->rqid;
405         rc = target_submit_cmd_map_sgls(se_cmd, sess, pending_req->cmnd,
406                         pending_req->sense_buffer, pending_req->v2p->lun,
407                         pending_req->data_len, 0,
408                         pending_req->sc_data_direction, TARGET_SCF_ACK_KREF,
409                         pending_req->sgl, pending_req->n_sg,
410                         NULL, 0, NULL, 0);
411         if (rc < 0) {
412                 transport_send_check_condition_and_sense(se_cmd,
413                                 TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE, 0);
414                 transport_generic_free_cmd(se_cmd, 0);
415         }
416 }
417
418 static int scsiback_gnttab_data_map_batch(struct gnttab_map_grant_ref *map,
419         struct page **pg, grant_handle_t *grant, int cnt)
420 {
421         int err, i;
422
423         if (!cnt)
424                 return 0;
425
426         err = gnttab_map_refs(map, NULL, pg, cnt);
427         BUG_ON(err);
428         for (i = 0; i < cnt; i++) {
429                 if (unlikely(map[i].status != GNTST_okay)) {
430                         pr_err("invalid buffer -- could not remap it\n");
431                         map[i].handle = SCSIBACK_INVALID_HANDLE;
432                         err = -ENOMEM;
433                 } else {
434                         get_page(pg[i]);
435                 }
436                 grant[i] = map[i].handle;
437         }
438         return err;
439 }
440
441 static int scsiback_gnttab_data_map_list(struct vscsibk_pend *pending_req,
442                         struct scsiif_request_segment *seg, struct page **pg,
443                         grant_handle_t *grant, int cnt, u32 flags)
444 {
445         int mapcount = 0, i, err = 0;
446         struct gnttab_map_grant_ref map[VSCSI_GRANT_BATCH];
447         struct vscsibk_info *info = pending_req->info;
448
449         for (i = 0; i < cnt; i++) {
450                 if (get_free_page(pg + mapcount)) {
451                         put_free_pages(pg, mapcount);
452                         pr_err("no grant page\n");
453                         return -ENOMEM;
454                 }
455                 gnttab_set_map_op(&map[mapcount], vaddr_page(pg[mapcount]),
456                                   flags, seg[i].gref, info->domid);
457                 mapcount++;
458                 if (mapcount < VSCSI_GRANT_BATCH)
459                         continue;
460                 err = scsiback_gnttab_data_map_batch(map, pg, grant, mapcount);
461                 pg += mapcount;
462                 grant += mapcount;
463                 pending_req->n_grants += mapcount;
464                 if (err)
465                         return err;
466                 mapcount = 0;
467         }
468         err = scsiback_gnttab_data_map_batch(map, pg, grant, mapcount);
469         pending_req->n_grants += mapcount;
470         return err;
471 }
472
473 static int scsiback_gnttab_data_map(struct vscsiif_request *ring_req,
474                                         struct vscsibk_pend *pending_req)
475 {
476         u32 flags;
477         int i, err, n_segs, i_seg = 0;
478         struct page **pg;
479         struct scsiif_request_segment *seg;
480         unsigned long end_seg = 0;
481         unsigned int nr_segments = (unsigned int)ring_req->nr_segments;
482         unsigned int nr_sgl = 0;
483         struct scatterlist *sg;
484         grant_handle_t *grant;
485
486         pending_req->n_sg = 0;
487         pending_req->n_grants = 0;
488         pending_req->data_len = 0;
489
490         nr_segments &= ~VSCSIIF_SG_GRANT;
491         if (!nr_segments)
492                 return 0;
493
494         if (nr_segments > VSCSIIF_SG_TABLESIZE) {
495                 pr_debug("invalid parameter nr_seg = %d\n",
496                         ring_req->nr_segments);
497                 return -EINVAL;
498         }
499
500         if (ring_req->nr_segments & VSCSIIF_SG_GRANT) {
501                 err = scsiback_gnttab_data_map_list(pending_req, ring_req->seg,
502                         pending_req->pages, pending_req->grant_handles,
503                         nr_segments, GNTMAP_host_map | GNTMAP_readonly);
504                 if (err)
505                         return err;
506                 nr_sgl = nr_segments;
507                 nr_segments = 0;
508                 for (i = 0; i < nr_sgl; i++) {
509                         n_segs = ring_req->seg[i].length /
510                                  sizeof(struct scsiif_request_segment);
511                         if ((unsigned)ring_req->seg[i].offset +
512                             (unsigned)ring_req->seg[i].length > PAGE_SIZE ||
513                             n_segs * sizeof(struct scsiif_request_segment) !=
514                             ring_req->seg[i].length)
515                                 return -EINVAL;
516                         nr_segments += n_segs;
517                 }
518                 if (nr_segments > SG_ALL) {
519                         pr_debug("invalid nr_seg = %d\n", nr_segments);
520                         return -EINVAL;
521                 }
522         }
523
524         /* free of (sgl) in fast_flush_area() */
525         pending_req->sgl = kmalloc_array(nr_segments,
526                                         sizeof(struct scatterlist), GFP_KERNEL);
527         if (!pending_req->sgl)
528                 return -ENOMEM;
529
530         sg_init_table(pending_req->sgl, nr_segments);
531         pending_req->n_sg = nr_segments;
532
533         flags = GNTMAP_host_map;
534         if (pending_req->sc_data_direction == DMA_TO_DEVICE)
535                 flags |= GNTMAP_readonly;
536
537         pg = pending_req->pages + nr_sgl;
538         grant = pending_req->grant_handles + nr_sgl;
539         if (!nr_sgl) {
540                 seg = ring_req->seg;
541                 err = scsiback_gnttab_data_map_list(pending_req, seg,
542                         pg, grant, nr_segments, flags);
543                 if (err)
544                         return err;
545         } else {
546                 for (i = 0; i < nr_sgl; i++) {
547                         seg = (struct scsiif_request_segment *)(
548                               vaddr(pending_req, i) + ring_req->seg[i].offset);
549                         n_segs = ring_req->seg[i].length /
550                                  sizeof(struct scsiif_request_segment);
551                         err = scsiback_gnttab_data_map_list(pending_req, seg,
552                                 pg, grant, n_segs, flags);
553                         if (err)
554                                 return err;
555                         pg += n_segs;
556                         grant += n_segs;
557                 }
558                 end_seg = vaddr(pending_req, 0) + ring_req->seg[0].offset;
559                 seg = (struct scsiif_request_segment *)end_seg;
560                 end_seg += ring_req->seg[0].length;
561                 pg = pending_req->pages + nr_sgl;
562         }
563
564         for_each_sg(pending_req->sgl, sg, nr_segments, i) {
565                 sg_set_page(sg, pg[i], seg->length, seg->offset);
566                 pending_req->data_len += seg->length;
567                 seg++;
568                 if (nr_sgl && (unsigned long)seg >= end_seg) {
569                         i_seg++;
570                         end_seg = vaddr(pending_req, i_seg) +
571                                   ring_req->seg[i_seg].offset;
572                         seg = (struct scsiif_request_segment *)end_seg;
573                         end_seg += ring_req->seg[i_seg].length;
574                 }
575                 if (sg->offset >= PAGE_SIZE ||
576                     sg->length > PAGE_SIZE ||
577                     sg->offset + sg->length > PAGE_SIZE)
578                         return -EINVAL;
579         }
580
581         return 0;
582 }
583
584 static void scsiback_disconnect(struct vscsibk_info *info)
585 {
586         wait_event(info->waiting_to_free,
587                 atomic_read(&info->nr_unreplied_reqs) == 0);
588
589         unbind_from_irqhandler(info->irq, info);
590         info->irq = 0;
591         xenbus_unmap_ring_vfree(info->dev, info->ring.sring);
592 }
593
594 static void scsiback_device_action(struct vscsibk_pend *pending_req,
595         enum tcm_tmreq_table act, int tag)
596 {
597         struct scsiback_tpg *tpg = pending_req->v2p->tpg;
598         struct scsiback_nexus *nexus = tpg->tpg_nexus;
599         struct se_cmd *se_cmd = &pending_req->se_cmd;
600         u64 unpacked_lun = pending_req->v2p->lun;
601         int rc, err = FAILED;
602
603         init_waitqueue_head(&pending_req->tmr_wait);
604
605         rc = target_submit_tmr(&pending_req->se_cmd, nexus->tvn_se_sess,
606                                &pending_req->sense_buffer[0],
607                                unpacked_lun, NULL, act, GFP_KERNEL,
608                                tag, TARGET_SCF_ACK_KREF);
609         if (rc)
610                 goto err;
611
612         wait_event(pending_req->tmr_wait,
613                    atomic_read(&pending_req->tmr_complete));
614
615         err = (se_cmd->se_tmr_req->response == TMR_FUNCTION_COMPLETE) ?
616                 SUCCESS : FAILED;
617
618         scsiback_do_resp_with_sense(NULL, err, 0, pending_req);
619         transport_generic_free_cmd(&pending_req->se_cmd, 1);
620         return;
621
622 err:
623         scsiback_do_resp_with_sense(NULL, err, 0, pending_req);
624 }
625
626 /*
627   Perform virtual to physical translation
628 */
629 static struct v2p_entry *scsiback_do_translation(struct vscsibk_info *info,
630                         struct ids_tuple *v)
631 {
632         struct v2p_entry *entry;
633         struct list_head *head = &(info->v2p_entry_lists);
634         unsigned long flags;
635
636         spin_lock_irqsave(&info->v2p_lock, flags);
637         list_for_each_entry(entry, head, l) {
638                 if ((entry->v.chn == v->chn) &&
639                     (entry->v.tgt == v->tgt) &&
640                     (entry->v.lun == v->lun)) {
641                         kref_get(&entry->kref);
642                         goto out;
643                 }
644         }
645         entry = NULL;
646
647 out:
648         spin_unlock_irqrestore(&info->v2p_lock, flags);
649         return entry;
650 }
651
652 static struct vscsibk_pend *scsiback_get_pend_req(struct vscsiif_back_ring *ring,
653                                 struct v2p_entry *v2p)
654 {
655         struct scsiback_tpg *tpg = v2p->tpg;
656         struct scsiback_nexus *nexus = tpg->tpg_nexus;
657         struct se_session *se_sess = nexus->tvn_se_sess;
658         struct vscsibk_pend *req;
659         int tag, i;
660
661         tag = percpu_ida_alloc(&se_sess->sess_tag_pool, TASK_RUNNING);
662         if (tag < 0) {
663                 pr_err("Unable to obtain tag for vscsiif_request\n");
664                 return ERR_PTR(-ENOMEM);
665         }
666
667         req = &((struct vscsibk_pend *)se_sess->sess_cmd_map)[tag];
668         memset(req, 0, sizeof(*req));
669         req->se_cmd.map_tag = tag;
670
671         for (i = 0; i < VSCSI_MAX_GRANTS; i++)
672                 req->grant_handles[i] = SCSIBACK_INVALID_HANDLE;
673
674         return req;
675 }
676
677 static struct vscsibk_pend *prepare_pending_reqs(struct vscsibk_info *info,
678                                 struct vscsiif_back_ring *ring,
679                                 struct vscsiif_request *ring_req)
680 {
681         struct vscsibk_pend *pending_req;
682         struct v2p_entry *v2p;
683         struct ids_tuple vir;
684
685         /* request range check from frontend */
686         if ((ring_req->sc_data_direction != DMA_BIDIRECTIONAL) &&
687                 (ring_req->sc_data_direction != DMA_TO_DEVICE) &&
688                 (ring_req->sc_data_direction != DMA_FROM_DEVICE) &&
689                 (ring_req->sc_data_direction != DMA_NONE)) {
690                 pr_debug("invalid parameter data_dir = %d\n",
691                         ring_req->sc_data_direction);
692                 return ERR_PTR(-EINVAL);
693         }
694         if (ring_req->cmd_len > VSCSIIF_MAX_COMMAND_SIZE) {
695                 pr_debug("invalid parameter cmd_len = %d\n",
696                         ring_req->cmd_len);
697                 return ERR_PTR(-EINVAL);
698         }
699
700         vir.chn = ring_req->channel;
701         vir.tgt = ring_req->id;
702         vir.lun = ring_req->lun;
703
704         v2p = scsiback_do_translation(info, &vir);
705         if (!v2p) {
706                 pr_debug("the v2p of (chn:%d, tgt:%d, lun:%d) doesn't exist.\n",
707                          vir.chn, vir.tgt, vir.lun);
708                 return ERR_PTR(-ENODEV);
709         }
710
711         pending_req = scsiback_get_pend_req(ring, v2p);
712         if (IS_ERR(pending_req)) {
713                 kref_put(&v2p->kref, scsiback_free_translation_entry);
714                 return ERR_PTR(-ENOMEM);
715         }
716         pending_req->rqid = ring_req->rqid;
717         pending_req->info = info;
718         pending_req->v2p = v2p;
719         pending_req->sc_data_direction = ring_req->sc_data_direction;
720         pending_req->cmd_len = ring_req->cmd_len;
721         memcpy(pending_req->cmnd, ring_req->cmnd, pending_req->cmd_len);
722
723         return pending_req;
724 }
725
726 static int scsiback_do_cmd_fn(struct vscsibk_info *info)
727 {
728         struct vscsiif_back_ring *ring = &info->ring;
729         struct vscsiif_request ring_req;
730         struct vscsibk_pend *pending_req;
731         RING_IDX rc, rp;
732         int more_to_do;
733         uint32_t result;
734
735         rc = ring->req_cons;
736         rp = ring->sring->req_prod;
737         rmb();  /* guest system is accessing ring, too */
738
739         if (RING_REQUEST_PROD_OVERFLOW(ring, rp)) {
740                 rc = ring->rsp_prod_pvt;
741                 pr_warn("Dom%d provided bogus ring requests (%#x - %#x = %u). Halting ring processing\n",
742                            info->domid, rp, rc, rp - rc);
743                 info->ring_error = 1;
744                 return 0;
745         }
746
747         while ((rc != rp)) {
748                 if (RING_REQUEST_CONS_OVERFLOW(ring, rc))
749                         break;
750
751                 RING_COPY_REQUEST(ring, rc, &ring_req);
752                 ring->req_cons = ++rc;
753
754                 pending_req = prepare_pending_reqs(info, ring, &ring_req);
755                 if (IS_ERR(pending_req)) {
756                         switch (PTR_ERR(pending_req)) {
757                         case -ENODEV:
758                                 result = DID_NO_CONNECT;
759                                 break;
760                         default:
761                                 result = DRIVER_ERROR;
762                                 break;
763                         }
764                         scsiback_send_response(info, NULL, result << 24, 0,
765                                                ring_req.rqid);
766                         return 1;
767                 }
768
769                 switch (ring_req.act) {
770                 case VSCSIIF_ACT_SCSI_CDB:
771                         if (scsiback_gnttab_data_map(&ring_req, pending_req)) {
772                                 scsiback_fast_flush_area(pending_req);
773                                 scsiback_do_resp_with_sense(NULL,
774                                                 DRIVER_ERROR << 24, 0, pending_req);
775                                 transport_generic_free_cmd(&pending_req->se_cmd, 0);
776                         } else {
777                                 scsiback_cmd_exec(pending_req);
778                         }
779                         break;
780                 case VSCSIIF_ACT_SCSI_ABORT:
781                         scsiback_device_action(pending_req, TMR_ABORT_TASK,
782                                 ring_req.ref_rqid);
783                         break;
784                 case VSCSIIF_ACT_SCSI_RESET:
785                         scsiback_device_action(pending_req, TMR_LUN_RESET, 0);
786                         break;
787                 default:
788                         pr_err_ratelimited("invalid request\n");
789                         scsiback_do_resp_with_sense(NULL, DRIVER_ERROR << 24, 0,
790                                                     pending_req);
791                         transport_generic_free_cmd(&pending_req->se_cmd, 0);
792                         break;
793                 }
794
795                 /* Yield point for this unbounded loop. */
796                 cond_resched();
797         }
798
799         RING_FINAL_CHECK_FOR_REQUESTS(&info->ring, more_to_do);
800         return more_to_do;
801 }
802
803 static irqreturn_t scsiback_irq_fn(int irq, void *dev_id)
804 {
805         struct vscsibk_info *info = dev_id;
806
807         if (info->ring_error)
808                 return IRQ_HANDLED;
809
810         while (scsiback_do_cmd_fn(info))
811                 cond_resched();
812
813         return IRQ_HANDLED;
814 }
815
816 static int scsiback_init_sring(struct vscsibk_info *info, grant_ref_t ring_ref,
817                         evtchn_port_t evtchn)
818 {
819         void *area;
820         struct vscsiif_sring *sring;
821         int err;
822
823         if (info->irq)
824                 return -1;
825
826         err = xenbus_map_ring_valloc(info->dev, &ring_ref, 1, &area);
827         if (err)
828                 return err;
829
830         sring = (struct vscsiif_sring *)area;
831         BACK_RING_INIT(&info->ring, sring, PAGE_SIZE);
832
833         err = bind_interdomain_evtchn_to_irq(info->domid, evtchn);
834         if (err < 0)
835                 goto unmap_page;
836
837         info->irq = err;
838
839         err = request_threaded_irq(info->irq, NULL, scsiback_irq_fn,
840                                    IRQF_ONESHOT, "vscsiif-backend", info);
841         if (err)
842                 goto free_irq;
843
844         return 0;
845
846 free_irq:
847         unbind_from_irqhandler(info->irq, info);
848         info->irq = 0;
849 unmap_page:
850         xenbus_unmap_ring_vfree(info->dev, area);
851
852         return err;
853 }
854
855 static int scsiback_map(struct vscsibk_info *info)
856 {
857         struct xenbus_device *dev = info->dev;
858         unsigned int ring_ref, evtchn;
859         int err;
860
861         err = xenbus_gather(XBT_NIL, dev->otherend,
862                         "ring-ref", "%u", &ring_ref,
863                         "event-channel", "%u", &evtchn, NULL);
864         if (err) {
865                 xenbus_dev_fatal(dev, err, "reading %s ring", dev->otherend);
866                 return err;
867         }
868
869         return scsiback_init_sring(info, ring_ref, evtchn);
870 }
871
872 /*
873   Check for a translation entry being present
874 */
875 static struct v2p_entry *scsiback_chk_translation_entry(
876         struct vscsibk_info *info, struct ids_tuple *v)
877 {
878         struct list_head *head = &(info->v2p_entry_lists);
879         struct v2p_entry *entry;
880
881         list_for_each_entry(entry, head, l)
882                 if ((entry->v.chn == v->chn) &&
883                     (entry->v.tgt == v->tgt) &&
884                     (entry->v.lun == v->lun))
885                         return entry;
886
887         return NULL;
888 }
889
890 /*
891   Add a new translation entry
892 */
893 static int scsiback_add_translation_entry(struct vscsibk_info *info,
894                                           char *phy, struct ids_tuple *v)
895 {
896         int err = 0;
897         struct v2p_entry *new;
898         unsigned long flags;
899         char *lunp;
900         unsigned long long unpacked_lun;
901         struct se_lun *se_lun;
902         struct scsiback_tpg *tpg_entry, *tpg = NULL;
903         char *error = "doesn't exist";
904
905         lunp = strrchr(phy, ':');
906         if (!lunp) {
907                 pr_err("illegal format of physical device %s\n", phy);
908                 return -EINVAL;
909         }
910         *lunp = 0;
911         lunp++;
912         err = kstrtoull(lunp, 10, &unpacked_lun);
913         if (err < 0) {
914                 pr_err("lun number not valid: %s\n", lunp);
915                 return err;
916         }
917
918         mutex_lock(&scsiback_mutex);
919         list_for_each_entry(tpg_entry, &scsiback_list, tv_tpg_list) {
920                 if (!strcmp(phy, tpg_entry->tport->tport_name) ||
921                     !strcmp(phy, tpg_entry->param_alias)) {
922                         mutex_lock(&tpg_entry->se_tpg.tpg_lun_mutex);
923                         hlist_for_each_entry(se_lun, &tpg_entry->se_tpg.tpg_lun_hlist, link) {
924                                 if (se_lun->unpacked_lun == unpacked_lun) {
925                                         if (!tpg_entry->tpg_nexus)
926                                                 error = "nexus undefined";
927                                         else
928                                                 tpg = tpg_entry;
929                                         break;
930                                 }
931                         }
932                         mutex_unlock(&tpg_entry->se_tpg.tpg_lun_mutex);
933                         break;
934                 }
935         }
936         if (tpg) {
937                 mutex_lock(&tpg->tv_tpg_mutex);
938                 tpg->tv_tpg_fe_count++;
939                 mutex_unlock(&tpg->tv_tpg_mutex);
940         }
941         mutex_unlock(&scsiback_mutex);
942
943         if (!tpg) {
944                 pr_err("%s:%llu %s\n", phy, unpacked_lun, error);
945                 return -ENODEV;
946         }
947
948         new = kmalloc(sizeof(struct v2p_entry), GFP_KERNEL);
949         if (new == NULL) {
950                 err = -ENOMEM;
951                 goto out_free;
952         }
953
954         spin_lock_irqsave(&info->v2p_lock, flags);
955
956         /* Check double assignment to identical virtual ID */
957         if (scsiback_chk_translation_entry(info, v)) {
958                 pr_warn("Virtual ID is already used. Assignment was not performed.\n");
959                 err = -EEXIST;
960                 goto out;
961         }
962
963         /* Create a new translation entry and add to the list */
964         kref_init(&new->kref);
965         new->v = *v;
966         new->tpg = tpg;
967         new->lun = unpacked_lun;
968         list_add_tail(&new->l, &info->v2p_entry_lists);
969
970 out:
971         spin_unlock_irqrestore(&info->v2p_lock, flags);
972
973 out_free:
974         if (err) {
975                 mutex_lock(&tpg->tv_tpg_mutex);
976                 tpg->tv_tpg_fe_count--;
977                 mutex_unlock(&tpg->tv_tpg_mutex);
978                 kfree(new);
979         }
980
981         return err;
982 }
983
984 static void __scsiback_del_translation_entry(struct v2p_entry *entry)
985 {
986         list_del(&entry->l);
987         kref_put(&entry->kref, scsiback_free_translation_entry);
988 }
989
990 /*
991   Delete the translation entry specified
992 */
993 static int scsiback_del_translation_entry(struct vscsibk_info *info,
994                                           struct ids_tuple *v)
995 {
996         struct v2p_entry *entry;
997         unsigned long flags;
998         int ret = 0;
999
1000         spin_lock_irqsave(&info->v2p_lock, flags);
1001         /* Find out the translation entry specified */
1002         entry = scsiback_chk_translation_entry(info, v);
1003         if (entry)
1004                 __scsiback_del_translation_entry(entry);
1005         else
1006                 ret = -ENOENT;
1007
1008         spin_unlock_irqrestore(&info->v2p_lock, flags);
1009         return ret;
1010 }
1011
1012 static void scsiback_do_add_lun(struct vscsibk_info *info, const char *state,
1013                                 char *phy, struct ids_tuple *vir, int try)
1014 {
1015         struct v2p_entry *entry;
1016         unsigned long flags;
1017
1018         if (try) {
1019                 spin_lock_irqsave(&info->v2p_lock, flags);
1020                 entry = scsiback_chk_translation_entry(info, vir);
1021                 spin_unlock_irqrestore(&info->v2p_lock, flags);
1022                 if (entry)
1023                         return;
1024         }
1025         if (!scsiback_add_translation_entry(info, phy, vir)) {
1026                 if (xenbus_printf(XBT_NIL, info->dev->nodename, state,
1027                                   "%d", XenbusStateInitialised)) {
1028                         pr_err("xenbus_printf error %s\n", state);
1029                         scsiback_del_translation_entry(info, vir);
1030                 }
1031         } else if (!try) {
1032                 xenbus_printf(XBT_NIL, info->dev->nodename, state,
1033                               "%d", XenbusStateClosed);
1034         }
1035 }
1036
1037 static void scsiback_do_del_lun(struct vscsibk_info *info, const char *state,
1038                                 struct ids_tuple *vir)
1039 {
1040         if (!scsiback_del_translation_entry(info, vir)) {
1041                 if (xenbus_printf(XBT_NIL, info->dev->nodename, state,
1042                                   "%d", XenbusStateClosed))
1043                         pr_err("xenbus_printf error %s\n", state);
1044         }
1045 }
1046
1047 #define VSCSIBACK_OP_ADD_OR_DEL_LUN     1
1048 #define VSCSIBACK_OP_UPDATEDEV_STATE    2
1049
1050 static void scsiback_do_1lun_hotplug(struct vscsibk_info *info, int op,
1051                                      char *ent)
1052 {
1053         int err;
1054         struct ids_tuple vir;
1055         char *val;
1056         int device_state;
1057         char phy[VSCSI_NAMELEN];
1058         char str[64];
1059         char state[64];
1060         struct xenbus_device *dev = info->dev;
1061
1062         /* read status */
1063         snprintf(state, sizeof(state), "vscsi-devs/%s/state", ent);
1064         err = xenbus_scanf(XBT_NIL, dev->nodename, state, "%u", &device_state);
1065         if (XENBUS_EXIST_ERR(err))
1066                 return;
1067
1068         /* physical SCSI device */
1069         snprintf(str, sizeof(str), "vscsi-devs/%s/p-dev", ent);
1070         val = xenbus_read(XBT_NIL, dev->nodename, str, NULL);
1071         if (IS_ERR(val)) {
1072                 xenbus_printf(XBT_NIL, dev->nodename, state,
1073                               "%d", XenbusStateClosed);
1074                 return;
1075         }
1076         strlcpy(phy, val, VSCSI_NAMELEN);
1077         kfree(val);
1078
1079         /* virtual SCSI device */
1080         snprintf(str, sizeof(str), "vscsi-devs/%s/v-dev", ent);
1081         err = xenbus_scanf(XBT_NIL, dev->nodename, str, "%u:%u:%u:%u",
1082                            &vir.hst, &vir.chn, &vir.tgt, &vir.lun);
1083         if (XENBUS_EXIST_ERR(err)) {
1084                 xenbus_printf(XBT_NIL, dev->nodename, state,
1085                               "%d", XenbusStateClosed);
1086                 return;
1087         }
1088
1089         switch (op) {
1090         case VSCSIBACK_OP_ADD_OR_DEL_LUN:
1091                 switch (device_state) {
1092                 case XenbusStateInitialising:
1093                         scsiback_do_add_lun(info, state, phy, &vir, 0);
1094                         break;
1095                 case XenbusStateConnected:
1096                         scsiback_do_add_lun(info, state, phy, &vir, 1);
1097                         break;
1098                 case XenbusStateClosing:
1099                         scsiback_do_del_lun(info, state, &vir);
1100                         break;
1101                 default:
1102                         break;
1103                 }
1104                 break;
1105
1106         case VSCSIBACK_OP_UPDATEDEV_STATE:
1107                 if (device_state == XenbusStateInitialised) {
1108                         /* modify vscsi-devs/dev-x/state */
1109                         if (xenbus_printf(XBT_NIL, dev->nodename, state,
1110                                           "%d", XenbusStateConnected)) {
1111                                 pr_err("xenbus_printf error %s\n", str);
1112                                 scsiback_del_translation_entry(info, &vir);
1113                                 xenbus_printf(XBT_NIL, dev->nodename, state,
1114                                               "%d", XenbusStateClosed);
1115                         }
1116                 }
1117                 break;
1118         /* When it is necessary, processing is added here. */
1119         default:
1120                 break;
1121         }
1122 }
1123
1124 static void scsiback_do_lun_hotplug(struct vscsibk_info *info, int op)
1125 {
1126         int i;
1127         char **dir;
1128         unsigned int ndir = 0;
1129
1130         dir = xenbus_directory(XBT_NIL, info->dev->nodename, "vscsi-devs",
1131                                &ndir);
1132         if (IS_ERR(dir))
1133                 return;
1134
1135         for (i = 0; i < ndir; i++)
1136                 scsiback_do_1lun_hotplug(info, op, dir[i]);
1137
1138         kfree(dir);
1139 }
1140
1141 static void scsiback_frontend_changed(struct xenbus_device *dev,
1142                                         enum xenbus_state frontend_state)
1143 {
1144         struct vscsibk_info *info = dev_get_drvdata(&dev->dev);
1145
1146         switch (frontend_state) {
1147         case XenbusStateInitialising:
1148                 break;
1149
1150         case XenbusStateInitialised:
1151                 if (scsiback_map(info))
1152                         break;
1153
1154                 scsiback_do_lun_hotplug(info, VSCSIBACK_OP_ADD_OR_DEL_LUN);
1155                 xenbus_switch_state(dev, XenbusStateConnected);
1156                 break;
1157
1158         case XenbusStateConnected:
1159                 scsiback_do_lun_hotplug(info, VSCSIBACK_OP_UPDATEDEV_STATE);
1160
1161                 if (dev->state == XenbusStateConnected)
1162                         break;
1163
1164                 xenbus_switch_state(dev, XenbusStateConnected);
1165                 break;
1166
1167         case XenbusStateClosing:
1168                 if (info->irq)
1169                         scsiback_disconnect(info);
1170
1171                 xenbus_switch_state(dev, XenbusStateClosing);
1172                 break;
1173
1174         case XenbusStateClosed:
1175                 xenbus_switch_state(dev, XenbusStateClosed);
1176                 if (xenbus_dev_is_online(dev))
1177                         break;
1178                 /* fall through if not online */
1179         case XenbusStateUnknown:
1180                 device_unregister(&dev->dev);
1181                 break;
1182
1183         case XenbusStateReconfiguring:
1184                 scsiback_do_lun_hotplug(info, VSCSIBACK_OP_ADD_OR_DEL_LUN);
1185                 xenbus_switch_state(dev, XenbusStateReconfigured);
1186
1187                 break;
1188
1189         default:
1190                 xenbus_dev_fatal(dev, -EINVAL, "saw state %d at frontend",
1191                                         frontend_state);
1192                 break;
1193         }
1194 }
1195
1196 /*
1197   Release the translation entry specfied
1198 */
1199 static void scsiback_release_translation_entry(struct vscsibk_info *info)
1200 {
1201         struct v2p_entry *entry, *tmp;
1202         struct list_head *head = &(info->v2p_entry_lists);
1203         unsigned long flags;
1204
1205         spin_lock_irqsave(&info->v2p_lock, flags);
1206
1207         list_for_each_entry_safe(entry, tmp, head, l)
1208                 __scsiback_del_translation_entry(entry);
1209
1210         spin_unlock_irqrestore(&info->v2p_lock, flags);
1211 }
1212
1213 static int scsiback_remove(struct xenbus_device *dev)
1214 {
1215         struct vscsibk_info *info = dev_get_drvdata(&dev->dev);
1216
1217         if (info->irq)
1218                 scsiback_disconnect(info);
1219
1220         scsiback_release_translation_entry(info);
1221
1222         dev_set_drvdata(&dev->dev, NULL);
1223
1224         return 0;
1225 }
1226
1227 static int scsiback_probe(struct xenbus_device *dev,
1228                            const struct xenbus_device_id *id)
1229 {
1230         int err;
1231
1232         struct vscsibk_info *info = kzalloc(sizeof(struct vscsibk_info),
1233                                             GFP_KERNEL);
1234
1235         pr_debug("%s %p %d\n", __func__, dev, dev->otherend_id);
1236
1237         if (!info) {
1238                 xenbus_dev_fatal(dev, -ENOMEM, "allocating backend structure");
1239                 return -ENOMEM;
1240         }
1241         info->dev = dev;
1242         dev_set_drvdata(&dev->dev, info);
1243
1244         info->domid = dev->otherend_id;
1245         spin_lock_init(&info->ring_lock);
1246         info->ring_error = 0;
1247         atomic_set(&info->nr_unreplied_reqs, 0);
1248         init_waitqueue_head(&info->waiting_to_free);
1249         info->dev = dev;
1250         info->irq = 0;
1251         INIT_LIST_HEAD(&info->v2p_entry_lists);
1252         spin_lock_init(&info->v2p_lock);
1253
1254         err = xenbus_printf(XBT_NIL, dev->nodename, "feature-sg-grant", "%u",
1255                             SG_ALL);
1256         if (err)
1257                 xenbus_dev_error(dev, err, "writing feature-sg-grant");
1258
1259         err = xenbus_switch_state(dev, XenbusStateInitWait);
1260         if (err)
1261                 goto fail;
1262
1263         return 0;
1264
1265 fail:
1266         pr_warn("%s failed\n", __func__);
1267         scsiback_remove(dev);
1268
1269         return err;
1270 }
1271
1272 static char *scsiback_dump_proto_id(struct scsiback_tport *tport)
1273 {
1274         switch (tport->tport_proto_id) {
1275         case SCSI_PROTOCOL_SAS:
1276                 return "SAS";
1277         case SCSI_PROTOCOL_FCP:
1278                 return "FCP";
1279         case SCSI_PROTOCOL_ISCSI:
1280                 return "iSCSI";
1281         default:
1282                 break;
1283         }
1284
1285         return "Unknown";
1286 }
1287
1288 static char *scsiback_get_fabric_wwn(struct se_portal_group *se_tpg)
1289 {
1290         struct scsiback_tpg *tpg = container_of(se_tpg,
1291                                 struct scsiback_tpg, se_tpg);
1292         struct scsiback_tport *tport = tpg->tport;
1293
1294         return &tport->tport_name[0];
1295 }
1296
1297 static u16 scsiback_get_tag(struct se_portal_group *se_tpg)
1298 {
1299         struct scsiback_tpg *tpg = container_of(se_tpg,
1300                                 struct scsiback_tpg, se_tpg);
1301         return tpg->tport_tpgt;
1302 }
1303
1304 static struct se_wwn *
1305 scsiback_make_tport(struct target_fabric_configfs *tf,
1306                      struct config_group *group,
1307                      const char *name)
1308 {
1309         struct scsiback_tport *tport;
1310         char *ptr;
1311         u64 wwpn = 0;
1312         int off = 0;
1313
1314         tport = kzalloc(sizeof(struct scsiback_tport), GFP_KERNEL);
1315         if (!tport)
1316                 return ERR_PTR(-ENOMEM);
1317
1318         tport->tport_wwpn = wwpn;
1319         /*
1320          * Determine the emulated Protocol Identifier and Target Port Name
1321          * based on the incoming configfs directory name.
1322          */
1323         ptr = strstr(name, "naa.");
1324         if (ptr) {
1325                 tport->tport_proto_id = SCSI_PROTOCOL_SAS;
1326                 goto check_len;
1327         }
1328         ptr = strstr(name, "fc.");
1329         if (ptr) {
1330                 tport->tport_proto_id = SCSI_PROTOCOL_FCP;
1331                 off = 3; /* Skip over "fc." */
1332                 goto check_len;
1333         }
1334         ptr = strstr(name, "iqn.");
1335         if (ptr) {
1336                 tport->tport_proto_id = SCSI_PROTOCOL_ISCSI;
1337                 goto check_len;
1338         }
1339
1340         pr_err("Unable to locate prefix for emulated Target Port: %s\n", name);
1341         kfree(tport);
1342         return ERR_PTR(-EINVAL);
1343
1344 check_len:
1345         if (strlen(name) >= VSCSI_NAMELEN) {
1346                 pr_err("Emulated %s Address: %s, exceeds max: %d\n", name,
1347                         scsiback_dump_proto_id(tport), VSCSI_NAMELEN);
1348                 kfree(tport);
1349                 return ERR_PTR(-EINVAL);
1350         }
1351         snprintf(&tport->tport_name[0], VSCSI_NAMELEN, "%s", &name[off]);
1352
1353         pr_debug("Allocated emulated Target %s Address: %s\n",
1354                  scsiback_dump_proto_id(tport), name);
1355
1356         return &tport->tport_wwn;
1357 }
1358
1359 static void scsiback_drop_tport(struct se_wwn *wwn)
1360 {
1361         struct scsiback_tport *tport = container_of(wwn,
1362                                 struct scsiback_tport, tport_wwn);
1363
1364         pr_debug("Deallocating emulated Target %s Address: %s\n",
1365                  scsiback_dump_proto_id(tport), tport->tport_name);
1366
1367         kfree(tport);
1368 }
1369
1370 static u32 scsiback_tpg_get_inst_index(struct se_portal_group *se_tpg)
1371 {
1372         return 1;
1373 }
1374
1375 static int scsiback_check_stop_free(struct se_cmd *se_cmd)
1376 {
1377         return transport_generic_free_cmd(se_cmd, 0);
1378 }
1379
1380 static void scsiback_release_cmd(struct se_cmd *se_cmd)
1381 {
1382         struct se_session *se_sess = se_cmd->se_sess;
1383
1384         percpu_ida_free(&se_sess->sess_tag_pool, se_cmd->map_tag);
1385 }
1386
1387 static u32 scsiback_sess_get_index(struct se_session *se_sess)
1388 {
1389         return 0;
1390 }
1391
1392 static int scsiback_write_pending(struct se_cmd *se_cmd)
1393 {
1394         /* Go ahead and process the write immediately */
1395         target_execute_cmd(se_cmd);
1396
1397         return 0;
1398 }
1399
1400 static int scsiback_write_pending_status(struct se_cmd *se_cmd)
1401 {
1402         return 0;
1403 }
1404
1405 static void scsiback_set_default_node_attrs(struct se_node_acl *nacl)
1406 {
1407 }
1408
1409 static int scsiback_get_cmd_state(struct se_cmd *se_cmd)
1410 {
1411         return 0;
1412 }
1413
1414 static int scsiback_queue_data_in(struct se_cmd *se_cmd)
1415 {
1416         struct vscsibk_pend *pending_req = container_of(se_cmd,
1417                                 struct vscsibk_pend, se_cmd);
1418
1419         pending_req->result = SAM_STAT_GOOD;
1420         scsiback_cmd_done(pending_req);
1421         return 0;
1422 }
1423
1424 static int scsiback_queue_status(struct se_cmd *se_cmd)
1425 {
1426         struct vscsibk_pend *pending_req = container_of(se_cmd,
1427                                 struct vscsibk_pend, se_cmd);
1428
1429         if (se_cmd->sense_buffer &&
1430             ((se_cmd->se_cmd_flags & SCF_TRANSPORT_TASK_SENSE) ||
1431              (se_cmd->se_cmd_flags & SCF_EMULATED_TASK_SENSE)))
1432                 pending_req->result = (DRIVER_SENSE << 24) |
1433                                       SAM_STAT_CHECK_CONDITION;
1434         else
1435                 pending_req->result = se_cmd->scsi_status;
1436
1437         scsiback_cmd_done(pending_req);
1438         return 0;
1439 }
1440
1441 static void scsiback_queue_tm_rsp(struct se_cmd *se_cmd)
1442 {
1443         struct vscsibk_pend *pending_req = container_of(se_cmd,
1444                                 struct vscsibk_pend, se_cmd);
1445
1446         atomic_set(&pending_req->tmr_complete, 1);
1447         wake_up(&pending_req->tmr_wait);
1448 }
1449
1450 static void scsiback_aborted_task(struct se_cmd *se_cmd)
1451 {
1452 }
1453
1454 static ssize_t scsiback_tpg_param_alias_show(struct config_item *item,
1455                                              char *page)
1456 {
1457         struct se_portal_group *se_tpg = param_to_tpg(item);
1458         struct scsiback_tpg *tpg = container_of(se_tpg, struct scsiback_tpg,
1459                                                 se_tpg);
1460         ssize_t rb;
1461
1462         mutex_lock(&tpg->tv_tpg_mutex);
1463         rb = snprintf(page, PAGE_SIZE, "%s\n", tpg->param_alias);
1464         mutex_unlock(&tpg->tv_tpg_mutex);
1465
1466         return rb;
1467 }
1468
1469 static ssize_t scsiback_tpg_param_alias_store(struct config_item *item,
1470                                               const char *page, size_t count)
1471 {
1472         struct se_portal_group *se_tpg = param_to_tpg(item);
1473         struct scsiback_tpg *tpg = container_of(se_tpg, struct scsiback_tpg,
1474                                                 se_tpg);
1475         int len;
1476
1477         if (strlen(page) >= VSCSI_NAMELEN) {
1478                 pr_err("param alias: %s, exceeds max: %d\n", page,
1479                         VSCSI_NAMELEN);
1480                 return -EINVAL;
1481         }
1482
1483         mutex_lock(&tpg->tv_tpg_mutex);
1484         len = snprintf(tpg->param_alias, VSCSI_NAMELEN, "%s", page);
1485         if (tpg->param_alias[len - 1] == '\n')
1486                 tpg->param_alias[len - 1] = '\0';
1487         mutex_unlock(&tpg->tv_tpg_mutex);
1488
1489         return count;
1490 }
1491
1492 CONFIGFS_ATTR(scsiback_tpg_param_, alias);
1493
1494 static struct configfs_attribute *scsiback_param_attrs[] = {
1495         &scsiback_tpg_param_attr_alias,
1496         NULL,
1497 };
1498
1499 static int scsiback_alloc_sess_cb(struct se_portal_group *se_tpg,
1500                                   struct se_session *se_sess, void *p)
1501 {
1502         struct scsiback_tpg *tpg = container_of(se_tpg,
1503                                 struct scsiback_tpg, se_tpg);
1504
1505         tpg->tpg_nexus = p;
1506         return 0;
1507 }
1508
1509 static int scsiback_make_nexus(struct scsiback_tpg *tpg,
1510                                 const char *name)
1511 {
1512         struct scsiback_nexus *tv_nexus;
1513         int ret = 0;
1514
1515         mutex_lock(&tpg->tv_tpg_mutex);
1516         if (tpg->tpg_nexus) {
1517                 pr_debug("tpg->tpg_nexus already exists\n");
1518                 ret = -EEXIST;
1519                 goto out_unlock;
1520         }
1521
1522         tv_nexus = kzalloc(sizeof(struct scsiback_nexus), GFP_KERNEL);
1523         if (!tv_nexus) {
1524                 ret = -ENOMEM;
1525                 goto out_unlock;
1526         }
1527
1528         tv_nexus->tvn_se_sess = target_alloc_session(&tpg->se_tpg,
1529                                                      VSCSI_DEFAULT_SESSION_TAGS,
1530                                                      sizeof(struct vscsibk_pend),
1531                                                      TARGET_PROT_NORMAL, name,
1532                                                      tv_nexus, scsiback_alloc_sess_cb);
1533         if (IS_ERR(tv_nexus->tvn_se_sess)) {
1534                 kfree(tv_nexus);
1535                 ret = -ENOMEM;
1536                 goto out_unlock;
1537         }
1538
1539 out_unlock:
1540         mutex_unlock(&tpg->tv_tpg_mutex);
1541         return ret;
1542 }
1543
1544 static int scsiback_drop_nexus(struct scsiback_tpg *tpg)
1545 {
1546         struct se_session *se_sess;
1547         struct scsiback_nexus *tv_nexus;
1548
1549         mutex_lock(&tpg->tv_tpg_mutex);
1550         tv_nexus = tpg->tpg_nexus;
1551         if (!tv_nexus) {
1552                 mutex_unlock(&tpg->tv_tpg_mutex);
1553                 return -ENODEV;
1554         }
1555
1556         se_sess = tv_nexus->tvn_se_sess;
1557         if (!se_sess) {
1558                 mutex_unlock(&tpg->tv_tpg_mutex);
1559                 return -ENODEV;
1560         }
1561
1562         if (tpg->tv_tpg_port_count != 0) {
1563                 mutex_unlock(&tpg->tv_tpg_mutex);
1564                 pr_err("Unable to remove xen-pvscsi I_T Nexus with active TPG port count: %d\n",
1565                         tpg->tv_tpg_port_count);
1566                 return -EBUSY;
1567         }
1568
1569         if (tpg->tv_tpg_fe_count != 0) {
1570                 mutex_unlock(&tpg->tv_tpg_mutex);
1571                 pr_err("Unable to remove xen-pvscsi I_T Nexus with active TPG frontend count: %d\n",
1572                         tpg->tv_tpg_fe_count);
1573                 return -EBUSY;
1574         }
1575
1576         pr_debug("Removing I_T Nexus to emulated %s Initiator Port: %s\n",
1577                 scsiback_dump_proto_id(tpg->tport),
1578                 tv_nexus->tvn_se_sess->se_node_acl->initiatorname);
1579
1580         /*
1581          * Release the SCSI I_T Nexus to the emulated xen-pvscsi Target Port
1582          */
1583         transport_deregister_session(tv_nexus->tvn_se_sess);
1584         tpg->tpg_nexus = NULL;
1585         mutex_unlock(&tpg->tv_tpg_mutex);
1586
1587         kfree(tv_nexus);
1588         return 0;
1589 }
1590
1591 static ssize_t scsiback_tpg_nexus_show(struct config_item *item, char *page)
1592 {
1593         struct se_portal_group *se_tpg = to_tpg(item);
1594         struct scsiback_tpg *tpg = container_of(se_tpg,
1595                                 struct scsiback_tpg, se_tpg);
1596         struct scsiback_nexus *tv_nexus;
1597         ssize_t ret;
1598
1599         mutex_lock(&tpg->tv_tpg_mutex);
1600         tv_nexus = tpg->tpg_nexus;
1601         if (!tv_nexus) {
1602                 mutex_unlock(&tpg->tv_tpg_mutex);
1603                 return -ENODEV;
1604         }
1605         ret = snprintf(page, PAGE_SIZE, "%s\n",
1606                         tv_nexus->tvn_se_sess->se_node_acl->initiatorname);
1607         mutex_unlock(&tpg->tv_tpg_mutex);
1608
1609         return ret;
1610 }
1611
1612 static ssize_t scsiback_tpg_nexus_store(struct config_item *item,
1613                 const char *page, size_t count)
1614 {
1615         struct se_portal_group *se_tpg = to_tpg(item);
1616         struct scsiback_tpg *tpg = container_of(se_tpg,
1617                                 struct scsiback_tpg, se_tpg);
1618         struct scsiback_tport *tport_wwn = tpg->tport;
1619         unsigned char i_port[VSCSI_NAMELEN], *ptr, *port_ptr;
1620         int ret;
1621         /*
1622          * Shutdown the active I_T nexus if 'NULL' is passed.
1623          */
1624         if (!strncmp(page, "NULL", 4)) {
1625                 ret = scsiback_drop_nexus(tpg);
1626                 return (!ret) ? count : ret;
1627         }
1628         /*
1629          * Otherwise make sure the passed virtual Initiator port WWN matches
1630          * the fabric protocol_id set in scsiback_make_tport(), and call
1631          * scsiback_make_nexus().
1632          */
1633         if (strlen(page) >= VSCSI_NAMELEN) {
1634                 pr_err("Emulated NAA Sas Address: %s, exceeds max: %d\n",
1635                         page, VSCSI_NAMELEN);
1636                 return -EINVAL;
1637         }
1638         snprintf(&i_port[0], VSCSI_NAMELEN, "%s", page);
1639
1640         ptr = strstr(i_port, "naa.");
1641         if (ptr) {
1642                 if (tport_wwn->tport_proto_id != SCSI_PROTOCOL_SAS) {
1643                         pr_err("Passed SAS Initiator Port %s does not match target port protoid: %s\n",
1644                                 i_port, scsiback_dump_proto_id(tport_wwn));
1645                         return -EINVAL;
1646                 }
1647                 port_ptr = &i_port[0];
1648                 goto check_newline;
1649         }
1650         ptr = strstr(i_port, "fc.");
1651         if (ptr) {
1652                 if (tport_wwn->tport_proto_id != SCSI_PROTOCOL_FCP) {
1653                         pr_err("Passed FCP Initiator Port %s does not match target port protoid: %s\n",
1654                                 i_port, scsiback_dump_proto_id(tport_wwn));
1655                         return -EINVAL;
1656                 }
1657                 port_ptr = &i_port[3]; /* Skip over "fc." */
1658                 goto check_newline;
1659         }
1660         ptr = strstr(i_port, "iqn.");
1661         if (ptr) {
1662                 if (tport_wwn->tport_proto_id != SCSI_PROTOCOL_ISCSI) {
1663                         pr_err("Passed iSCSI Initiator Port %s does not match target port protoid: %s\n",
1664                                 i_port, scsiback_dump_proto_id(tport_wwn));
1665                         return -EINVAL;
1666                 }
1667                 port_ptr = &i_port[0];
1668                 goto check_newline;
1669         }
1670         pr_err("Unable to locate prefix for emulated Initiator Port: %s\n",
1671                 i_port);
1672         return -EINVAL;
1673         /*
1674          * Clear any trailing newline for the NAA WWN
1675          */
1676 check_newline:
1677         if (i_port[strlen(i_port) - 1] == '\n')
1678                 i_port[strlen(i_port) - 1] = '\0';
1679
1680         ret = scsiback_make_nexus(tpg, port_ptr);
1681         if (ret < 0)
1682                 return ret;
1683
1684         return count;
1685 }
1686
1687 CONFIGFS_ATTR(scsiback_tpg_, nexus);
1688
1689 static struct configfs_attribute *scsiback_tpg_attrs[] = {
1690         &scsiback_tpg_attr_nexus,
1691         NULL,
1692 };
1693
1694 static ssize_t
1695 scsiback_wwn_version_show(struct config_item *item, char *page)
1696 {
1697         return sprintf(page, "xen-pvscsi fabric module %s on %s/%s on "
1698                 UTS_RELEASE"\n",
1699                 VSCSI_VERSION, utsname()->sysname, utsname()->machine);
1700 }
1701
1702 CONFIGFS_ATTR_RO(scsiback_wwn_, version);
1703
1704 static struct configfs_attribute *scsiback_wwn_attrs[] = {
1705         &scsiback_wwn_attr_version,
1706         NULL,
1707 };
1708
1709 static char *scsiback_get_fabric_name(void)
1710 {
1711         return "xen-pvscsi";
1712 }
1713
1714 static int scsiback_port_link(struct se_portal_group *se_tpg,
1715                                struct se_lun *lun)
1716 {
1717         struct scsiback_tpg *tpg = container_of(se_tpg,
1718                                 struct scsiback_tpg, se_tpg);
1719
1720         mutex_lock(&tpg->tv_tpg_mutex);
1721         tpg->tv_tpg_port_count++;
1722         mutex_unlock(&tpg->tv_tpg_mutex);
1723
1724         return 0;
1725 }
1726
1727 static void scsiback_port_unlink(struct se_portal_group *se_tpg,
1728                                   struct se_lun *lun)
1729 {
1730         struct scsiback_tpg *tpg = container_of(se_tpg,
1731                                 struct scsiback_tpg, se_tpg);
1732
1733         mutex_lock(&tpg->tv_tpg_mutex);
1734         tpg->tv_tpg_port_count--;
1735         mutex_unlock(&tpg->tv_tpg_mutex);
1736 }
1737
1738 static struct se_portal_group *
1739 scsiback_make_tpg(struct se_wwn *wwn,
1740                    struct config_group *group,
1741                    const char *name)
1742 {
1743         struct scsiback_tport *tport = container_of(wwn,
1744                         struct scsiback_tport, tport_wwn);
1745
1746         struct scsiback_tpg *tpg;
1747         u16 tpgt;
1748         int ret;
1749
1750         if (strstr(name, "tpgt_") != name)
1751                 return ERR_PTR(-EINVAL);
1752         ret = kstrtou16(name + 5, 10, &tpgt);
1753         if (ret)
1754                 return ERR_PTR(ret);
1755
1756         tpg = kzalloc(sizeof(struct scsiback_tpg), GFP_KERNEL);
1757         if (!tpg)
1758                 return ERR_PTR(-ENOMEM);
1759
1760         mutex_init(&tpg->tv_tpg_mutex);
1761         INIT_LIST_HEAD(&tpg->tv_tpg_list);
1762         INIT_LIST_HEAD(&tpg->info_list);
1763         tpg->tport = tport;
1764         tpg->tport_tpgt = tpgt;
1765
1766         ret = core_tpg_register(wwn, &tpg->se_tpg, tport->tport_proto_id);
1767         if (ret < 0) {
1768                 kfree(tpg);
1769                 return NULL;
1770         }
1771         mutex_lock(&scsiback_mutex);
1772         list_add_tail(&tpg->tv_tpg_list, &scsiback_list);
1773         mutex_unlock(&scsiback_mutex);
1774
1775         return &tpg->se_tpg;
1776 }
1777
1778 static void scsiback_drop_tpg(struct se_portal_group *se_tpg)
1779 {
1780         struct scsiback_tpg *tpg = container_of(se_tpg,
1781                                 struct scsiback_tpg, se_tpg);
1782
1783         mutex_lock(&scsiback_mutex);
1784         list_del(&tpg->tv_tpg_list);
1785         mutex_unlock(&scsiback_mutex);
1786         /*
1787          * Release the virtual I_T Nexus for this xen-pvscsi TPG
1788          */
1789         scsiback_drop_nexus(tpg);
1790         /*
1791          * Deregister the se_tpg from TCM.
1792          */
1793         core_tpg_deregister(se_tpg);
1794         kfree(tpg);
1795 }
1796
1797 static int scsiback_check_true(struct se_portal_group *se_tpg)
1798 {
1799         return 1;
1800 }
1801
1802 static int scsiback_check_false(struct se_portal_group *se_tpg)
1803 {
1804         return 0;
1805 }
1806
1807 static const struct target_core_fabric_ops scsiback_ops = {
1808         .module                         = THIS_MODULE,
1809         .name                           = "xen-pvscsi",
1810         .get_fabric_name                = scsiback_get_fabric_name,
1811         .tpg_get_wwn                    = scsiback_get_fabric_wwn,
1812         .tpg_get_tag                    = scsiback_get_tag,
1813         .tpg_check_demo_mode            = scsiback_check_true,
1814         .tpg_check_demo_mode_cache      = scsiback_check_true,
1815         .tpg_check_demo_mode_write_protect = scsiback_check_false,
1816         .tpg_check_prod_mode_write_protect = scsiback_check_false,
1817         .tpg_get_inst_index             = scsiback_tpg_get_inst_index,
1818         .check_stop_free                = scsiback_check_stop_free,
1819         .release_cmd                    = scsiback_release_cmd,
1820         .sess_get_index                 = scsiback_sess_get_index,
1821         .sess_get_initiator_sid         = NULL,
1822         .write_pending                  = scsiback_write_pending,
1823         .write_pending_status           = scsiback_write_pending_status,
1824         .set_default_node_attributes    = scsiback_set_default_node_attrs,
1825         .get_cmd_state                  = scsiback_get_cmd_state,
1826         .queue_data_in                  = scsiback_queue_data_in,
1827         .queue_status                   = scsiback_queue_status,
1828         .queue_tm_rsp                   = scsiback_queue_tm_rsp,
1829         .aborted_task                   = scsiback_aborted_task,
1830         /*
1831          * Setup callers for generic logic in target_core_fabric_configfs.c
1832          */
1833         .fabric_make_wwn                = scsiback_make_tport,
1834         .fabric_drop_wwn                = scsiback_drop_tport,
1835         .fabric_make_tpg                = scsiback_make_tpg,
1836         .fabric_drop_tpg                = scsiback_drop_tpg,
1837         .fabric_post_link               = scsiback_port_link,
1838         .fabric_pre_unlink              = scsiback_port_unlink,
1839
1840         .tfc_wwn_attrs                  = scsiback_wwn_attrs,
1841         .tfc_tpg_base_attrs             = scsiback_tpg_attrs,
1842         .tfc_tpg_param_attrs            = scsiback_param_attrs,
1843 };
1844
1845 static const struct xenbus_device_id scsiback_ids[] = {
1846         { "vscsi" },
1847         { "" }
1848 };
1849
1850 static struct xenbus_driver scsiback_driver = {
1851         .ids                    = scsiback_ids,
1852         .probe                  = scsiback_probe,
1853         .remove                 = scsiback_remove,
1854         .otherend_changed       = scsiback_frontend_changed
1855 };
1856
1857 static int __init scsiback_init(void)
1858 {
1859         int ret;
1860
1861         if (!xen_domain())
1862                 return -ENODEV;
1863
1864         pr_debug("xen-pvscsi: fabric module %s on %s/%s on "UTS_RELEASE"\n",
1865                  VSCSI_VERSION, utsname()->sysname, utsname()->machine);
1866
1867         ret = xenbus_register_backend(&scsiback_driver);
1868         if (ret)
1869                 goto out;
1870
1871         ret = target_register_template(&scsiback_ops);
1872         if (ret)
1873                 goto out_unregister_xenbus;
1874
1875         return 0;
1876
1877 out_unregister_xenbus:
1878         xenbus_unregister_driver(&scsiback_driver);
1879 out:
1880         pr_err("%s: error %d\n", __func__, ret);
1881         return ret;
1882 }
1883
1884 static void __exit scsiback_exit(void)
1885 {
1886         struct page *page;
1887
1888         while (free_pages_num) {
1889                 if (get_free_page(&page))
1890                         BUG();
1891                 gnttab_free_pages(1, &page);
1892         }
1893         target_unregister_template(&scsiback_ops);
1894         xenbus_unregister_driver(&scsiback_driver);
1895 }
1896
1897 module_init(scsiback_init);
1898 module_exit(scsiback_exit);
1899
1900 MODULE_DESCRIPTION("Xen SCSI backend driver");
1901 MODULE_LICENSE("Dual BSD/GPL");
1902 MODULE_ALIAS("xen-backend:vscsi");
1903 MODULE_AUTHOR("Juergen Gross <jgross@suse.com>");