// SPDX-License-Identifier: GPL-2.0-only
/*
 * An implementation of file copy service.
 *
 * Copyright (C) 2014, Microsoft, Inc.
 *
 * Author : K. Y. Srinivasan <ksrinivasan@novell.com>
 */

#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt

#include <linux/nls.h>
#include <linux/workqueue.h>
#include <linux/hyperv.h>
#include <linux/sched.h>
#include <asm/hyperv-tlfs.h>

#include "hyperv_vmbus.h"
#include "hv_utils_transport.h"

#define WIN8_SRV_MAJOR          1
#define WIN8_SRV_MINOR          1
#define WIN8_SRV_VERSION        (WIN8_SRV_MAJOR << 16 | WIN8_SRV_MINOR)

#define FCOPY_VER_COUNT 1
static const int fcopy_versions[] = {
        WIN8_SRV_VERSION
};

#define FW_VER_COUNT 1
static const int fw_versions[] = {
        UTIL_FW_VERSION
};

/*
 * Global state maintained for transaction that is being processed.
 * For a class of integration services, including the "file copy service",
 * the specified protocol is a "request/response" protocol which means that
 * there can only be single outstanding transaction from the host at any
 * given point in time. We use this to simplify memory management in this
 * driver - we cache and process only one message at a time.
 *
 * While the request/response protocol is guaranteed by the host, we further
 * ensure this by serializing packet processing in this driver - we do not
 * read additional packets from the VMBUs until the current packet is fully
 * handled.
 */

static struct {
        int state;   /* hvutil_device_state */
        int recv_len; /* number of bytes received. */
        struct hv_fcopy_hdr  *fcopy_msg; /* current message */
        struct vmbus_channel *recv_channel; /* chn we got the request */
        u64 recv_req_id; /* request ID. */
} fcopy_transaction;

static void fcopy_respond_to_host(int error);
static void fcopy_send_data(struct work_struct *dummy);
static void fcopy_timeout_func(struct work_struct *dummy);
static DECLARE_DELAYED_WORK(fcopy_timeout_work, fcopy_timeout_func);
static DECLARE_WORK(fcopy_send_work, fcopy_send_data);
static const char fcopy_devname[] = "vmbus/hv_fcopy";
static u8 *recv_buffer;
static struct hvutil_transport *hvt;
/*
 * This state maintains the version number registered by the daemon.
 */
static int dm_reg_value;

static void fcopy_poll_wrapper(void *channel)
{
        /* Transaction is finished, reset the state here to avoid races. */
        fcopy_transaction.state = HVUTIL_READY;
        tasklet_schedule(&((struct vmbus_channel *)channel)->callback_event);
}

static void fcopy_timeout_func(struct work_struct *dummy)
{
        /*
         * If the timer fires, the user-mode component has not responded;
         * process the pending transaction.
         */
        fcopy_respond_to_host(HV_E_FAIL);
        hv_poll_channel(fcopy_transaction.recv_channel, fcopy_poll_wrapper);
}

static void fcopy_register_done(void)
{
        pr_debug("FCP: userspace daemon registered\n");
        hv_poll_channel(fcopy_transaction.recv_channel, fcopy_poll_wrapper);
}

static int fcopy_handle_handshake(u32 version)
{
        u32 our_ver = FCOPY_CURRENT_VERSION;

        switch (version) {
        case FCOPY_VERSION_0:
                /* Daemon doesn't expect us to reply */
                dm_reg_value = version;
                break;
        case FCOPY_VERSION_1:
                /* Daemon expects us to reply with our own version */
                if (hvutil_transport_send(hvt, &our_ver, sizeof(our_ver),
                    fcopy_register_done))
                        return -EFAULT;
                dm_reg_value = version;
                break;
        default:
                /*
                 * For now we will fail the registration.
                 * If and when we have multiple versions to
                 * deal with, we will be backward compatible.
                 * We will add this code when needed.
                 */
                return -EINVAL;
        }
        pr_debug("FCP: userspace daemon ver. %d connected\n", version);
        return 0;
}

static void fcopy_send_data(struct work_struct *dummy)
{
        struct hv_start_fcopy *smsg_out = NULL;
        int operation = fcopy_transaction.fcopy_msg->operation;
        struct hv_start_fcopy *smsg_in;
        void *out_src;
        int rc, out_len;

        /*
         * The  strings sent from the host are encoded in
         * in utf16; convert it to utf8 strings.
         * The host assures us that the utf16 strings will not exceed
         * the max lengths specified. We will however, reserve room
         * for the string terminating character - in the utf16s_utf8s()
         * function we limit the size of the buffer where the converted
         * string is placed to W_MAX_PATH -1 to guarantee
         * that the strings can be properly terminated!
         */

        switch (operation) {
        case START_FILE_COPY:
                out_len = sizeof(struct hv_start_fcopy);
                smsg_out = kzalloc(sizeof(*smsg_out), GFP_KERNEL);
                if (!smsg_out)
                        return;

                smsg_out->hdr.operation = operation;
                smsg_in = (struct hv_start_fcopy *)fcopy_transaction.fcopy_msg;

                utf16s_to_utf8s((wchar_t *)smsg_in->file_name, W_MAX_PATH,
                                UTF16_LITTLE_ENDIAN,
                                (__u8 *)&smsg_out->file_name, W_MAX_PATH - 1);

                utf16s_to_utf8s((wchar_t *)smsg_in->path_name, W_MAX_PATH,
                                UTF16_LITTLE_ENDIAN,
                                (__u8 *)&smsg_out->path_name, W_MAX_PATH - 1);

                smsg_out->copy_flags = smsg_in->copy_flags;
                smsg_out->file_size = smsg_in->file_size;
                out_src = smsg_out;
                break;

        case WRITE_TO_FILE:
                out_src = fcopy_transaction.fcopy_msg;
                out_len = sizeof(struct hv_do_fcopy);
                break;
        default:
                out_src = fcopy_transaction.fcopy_msg;
                out_len = fcopy_transaction.recv_len;
                break;
        }

        fcopy_transaction.state = HVUTIL_USERSPACE_REQ;
        rc = hvutil_transport_send(hvt, out_src, out_len, NULL);
        if (rc) {
                pr_debug("FCP: failed to communicate to the daemon: %d\n", rc);
                if (cancel_delayed_work_sync(&fcopy_timeout_work)) {
                        fcopy_respond_to_host(HV_E_FAIL);
                        fcopy_transaction.state = HVUTIL_READY;
                }
        }
        kfree(smsg_out);
}

/*
 * Send a response back to the host.
 */

static void
fcopy_respond_to_host(int error)
{
        struct icmsg_hdr *icmsghdr;
        u32 buf_len;
        struct vmbus_channel *channel;
        u64 req_id;

        /*
         * Copy the global state for completing the transaction. Note that
         * only one transaction can be active at a time. This is guaranteed
         * by the file copy protocol implemented by the host. Furthermore,
         * the "transaction active" state we maintain ensures that there can
         * only be one active transaction at a time.
         */

        buf_len = fcopy_transaction.recv_len;
        channel = fcopy_transaction.recv_channel;
        req_id = fcopy_transaction.recv_req_id;

        icmsghdr = (struct icmsg_hdr *)
                        &recv_buffer[sizeof(struct vmbuspipe_hdr)];

        if (channel->onchannel_callback == NULL)
                /*
                 * We have raced with util driver being unloaded;
                 * silently return.
                 */
                return;

        icmsghdr->status = error;
        icmsghdr->icflags = ICMSGHDRFLAG_TRANSACTION | ICMSGHDRFLAG_RESPONSE;
        vmbus_sendpacket(channel, recv_buffer, buf_len, req_id,
                                VM_PKT_DATA_INBAND, 0);
}

void hv_fcopy_onchannelcallback(void *context)
{
        struct vmbus_channel *channel = context;
        u32 recvlen;
        u64 requestid;
        struct hv_fcopy_hdr *fcopy_msg;
        struct icmsg_hdr *icmsghdr;
        int fcopy_srv_version;

        if (fcopy_transaction.state > HVUTIL_READY)
                return;

        if (vmbus_recvpacket(channel, recv_buffer, HV_HYP_PAGE_SIZE * 2, &recvlen, &requestid)) {
                pr_err_ratelimited("Fcopy request received. Could not read into recv buf\n");
                return;
        }

        if (!recvlen)
                return;

        /* Ensure recvlen is big enough to read header data */
        if (recvlen < ICMSG_HDR) {
                pr_err_ratelimited("Fcopy request received. Packet length too small: %d\n",
                                   recvlen);
                return;
        }

        icmsghdr = (struct icmsg_hdr *)&recv_buffer[
                        sizeof(struct vmbuspipe_hdr)];

        if (icmsghdr->icmsgtype == ICMSGTYPE_NEGOTIATE) {
                if (vmbus_prep_negotiate_resp(icmsghdr,
                                recv_buffer, recvlen,
                                fw_versions, FW_VER_COUNT,
                                fcopy_versions, FCOPY_VER_COUNT,
                                NULL, &fcopy_srv_version)) {

                        pr_info("FCopy IC version %d.%d\n",
                                fcopy_srv_version >> 16,
                                fcopy_srv_version & 0xFFFF);
                }
        } else if (icmsghdr->icmsgtype == ICMSGTYPE_FCOPY) {
                /* Ensure recvlen is big enough to contain hv_fcopy_hdr */
                if (recvlen < ICMSG_HDR + sizeof(struct hv_fcopy_hdr)) {
                        pr_err_ratelimited("Invalid Fcopy hdr. Packet length too small: %u\n",
                                           recvlen);
                        return;
                }
                fcopy_msg = (struct hv_fcopy_hdr *)&recv_buffer[ICMSG_HDR];

                /*
                 * Stash away this global state for completing the
                 * transaction; note transactions are serialized.
                 */

                fcopy_transaction.recv_len = recvlen;
                fcopy_transaction.recv_req_id = requestid;
                fcopy_transaction.fcopy_msg = fcopy_msg;

                if (fcopy_transaction.state < HVUTIL_READY) {
                        /* Userspace is not registered yet */
                        fcopy_respond_to_host(HV_E_FAIL);
                        return;
                }
                fcopy_transaction.state = HVUTIL_HOSTMSG_RECEIVED;

                /*
                 * Send the information to the user-level daemon.
                 */
                schedule_work(&fcopy_send_work);
                schedule_delayed_work(&fcopy_timeout_work,
                                      HV_UTIL_TIMEOUT * HZ);
                return;
        } else {
                pr_err_ratelimited("Fcopy request received. Invalid msg type: %d\n",
                                   icmsghdr->icmsgtype);
                return;
        }
        icmsghdr->icflags = ICMSGHDRFLAG_TRANSACTION | ICMSGHDRFLAG_RESPONSE;
        vmbus_sendpacket(channel, recv_buffer, recvlen, requestid,
                        VM_PKT_DATA_INBAND, 0);
}

/* Callback when data is received from userspace */
static int fcopy_on_msg(void *msg, int len)
{
        int *val = (int *)msg;

        if (len != sizeof(int))
                return -EINVAL;

        if (fcopy_transaction.state == HVUTIL_DEVICE_INIT)
                return fcopy_handle_handshake(*val);

        if (fcopy_transaction.state != HVUTIL_USERSPACE_REQ)
                return -EINVAL;

        /*
         * Complete the transaction by forwarding the result
         * to the host. But first, cancel the timeout.
         */
        if (cancel_delayed_work_sync(&fcopy_timeout_work)) {
                fcopy_transaction.state = HVUTIL_USERSPACE_RECV;
                fcopy_respond_to_host(*val);
                hv_poll_channel(fcopy_transaction.recv_channel,
                                fcopy_poll_wrapper);
        }

        return 0;
}

static void fcopy_on_reset(void)
{
        /*
         * The daemon has exited; reset the state.
         */
        fcopy_transaction.state = HVUTIL_DEVICE_INIT;

        if (cancel_delayed_work_sync(&fcopy_timeout_work))
                fcopy_respond_to_host(HV_E_FAIL);
}

int hv_fcopy_init(struct hv_util_service *srv)
{
        recv_buffer = srv->recv_buffer;
        fcopy_transaction.recv_channel = srv->channel;
        fcopy_transaction.recv_channel->max_pkt_size = HV_HYP_PAGE_SIZE * 2;

        /*
         * When this driver loads, the user level daemon that
         * processes the host requests may not yet be running.
         * Defer processing channel callbacks until the daemon
         * has registered.
         */
        fcopy_transaction.state = HVUTIL_DEVICE_INIT;

        hvt = hvutil_transport_init(fcopy_devname, 0, 0,
                                    fcopy_on_msg, fcopy_on_reset);
        if (!hvt)
                return -EFAULT;

        return 0;
}

static void hv_fcopy_cancel_work(void)
{
        cancel_delayed_work_sync(&fcopy_timeout_work);
        cancel_work_sync(&fcopy_send_work);
}

int hv_fcopy_pre_suspend(void)
{
        struct vmbus_channel *channel = fcopy_transaction.recv_channel;
        struct hv_fcopy_hdr *fcopy_msg;

        /*
         * Fake a CANCEL_FCOPY message for the user space daemon in case the
         * daemon is in the middle of copying some file. It doesn't matter if
         * there is already a message pending to be delivered to the user
         * space since we force fcopy_transaction.state to be HVUTIL_READY, so
         * the user space daemon's write() will fail with EINVAL (see
         * fcopy_on_msg()), and the daemon will reset the device by closing
         * and re-opening it.
         */
        fcopy_msg = kzalloc(sizeof(*fcopy_msg), GFP_KERNEL);
        if (!fcopy_msg)
                return -ENOMEM;

        tasklet_disable(&channel->callback_event);

        fcopy_msg->operation = CANCEL_FCOPY;

        hv_fcopy_cancel_work();

        /* We don't care about the return value. */
        hvutil_transport_send(hvt, fcopy_msg, sizeof(*fcopy_msg), NULL);

        kfree(fcopy_msg);

        fcopy_transaction.state = HVUTIL_READY;

        /* tasklet_enable() will be called in hv_fcopy_pre_resume(). */
        return 0;
}

int hv_fcopy_pre_resume(void)
{
        struct vmbus_channel *channel = fcopy_transaction.recv_channel;

        tasklet_enable(&channel->callback_event);

        return 0;
}

void hv_fcopy_deinit(void)
{
        fcopy_transaction.state = HVUTIL_DEVICE_DYING;

        hv_fcopy_cancel_work();

        hvutil_transport_destroy(hvt);
}