/*	$NetBSD: vio9p.c,v 1.12 2025/04/22 05:56:25 ozaki-r Exp $	*/

/*
 * Copyright (c) 2019 Internet Initiative Japan, Inc.
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 */

#include <sys/cdefs.h>
__KERNEL_RCSID(0, "$NetBSD: vio9p.c,v 1.12 2025/04/22 05:56:25 ozaki-r Exp $");

#include <sys/param.h>
#include <sys/systm.h>
#include <sys/kernel.h>
#include <sys/bus.h>
#include <sys/conf.h>
#include <sys/condvar.h>
#include <sys/device.h>
#include <sys/mutex.h>
#include <sys/sysctl.h>
#include <sys/module.h>
#include <sys/syslog.h>
#include <sys/select.h>
#include <sys/kmem.h>

#include <sys/file.h>
#include <sys/filedesc.h>
#include <sys/uio.h>

#include <dev/pci/virtioreg.h>
#include <dev/pci/virtiovar.h>

#include "ioconf.h"

//#define VIO9P_DEBUG	1
//#define VIO9P_DUMP	1
#ifdef VIO9P_DEBUG
#define DLOG(fmt, args...) \
	do { log(LOG_DEBUG, "%s: " fmt "\n", __func__, ##args); } while (0)
#else
#define DLOG(fmt, args...) __nothing
#endif

/* Device-specific feature bits */
#define VIO9P_F_MOUNT_TAG	(UINT64_C(1) << 0) /* mount tag specified */

/* Configuration registers */
#define VIO9P_CONFIG_TAG_LEN	0 /* 16bit */
#define VIO9P_CONFIG_TAG	2

#define VIO9P_FLAG_BITS				\
	VIRTIO_COMMON_FLAG_BITS			\
	"b\x00" "MOUNT_TAG\0"


// Must be the same as P9P_DEFREQLEN of usr.sbin/puffs/mount_9p/ninepuffs.h
#define VIO9P_MAX_REQLEN	(16 * 1024)
#define VIO9P_SEGSIZE		PAGE_SIZE
#define VIO9P_N_SEGMENTS	(VIO9P_MAX_REQLEN / VIO9P_SEGSIZE)

/*
 * QEMU defines this as 32 but includes the final zero byte into the
 * limit.  The code below counts the final zero byte separately, so
 * adjust this define to match.
 */
#define P9_MAX_TAG_LEN		31

CTASSERT((PAGE_SIZE) == (VIRTIO_PAGE_SIZE)); /* XXX */

struct vio9p_softc {
	device_t		sc_dev;

	struct virtio_softc	*sc_virtio;
	struct virtqueue	sc_vq[1];

	uint16_t		sc_taglen;
	uint8_t			sc_tag[P9_MAX_TAG_LEN + 1];

	int			sc_flags;
#define VIO9P_INUSE		__BIT(0)

	int			sc_state;
#define VIO9P_S_INIT		0
#define VIO9P_S_REQUESTING	1
#define VIO9P_S_REPLIED		2
#define VIO9P_S_CONSUMING	3
	kcondvar_t		sc_wait;
	struct selinfo		sc_sel;
	kmutex_t		sc_lock;

	bus_dmamap_t		sc_dmamap_tx;
	bus_dmamap_t		sc_dmamap_rx;
	char			*sc_buf_tx;
	char			*sc_buf_rx;
	size_t			sc_buf_rx_len;
	off_t			sc_buf_rx_offset;
};

/*
 * Locking notes:
 * - sc_state, sc_wait and sc_sel are protected by sc_lock
 *
 * The state machine (sc_state):
 * - INIT       =(write from client)=> REQUESTING
 * - REQUESTING =(reply from host)=>   REPLIED
 * - REPLIED    =(read from client)=>  CONSUMING
 * - CONSUMING  =(read completed(*))=> INIT
 *
 * (*) read may not finish by one read(2) request, then
 *     the state remains CONSUMING.
 */

static int	vio9p_match(device_t, cfdata_t, void *);
static void	vio9p_attach(device_t, device_t, void *);
static void	vio9p_read_config(struct vio9p_softc *);
static int	vio9p_request_done(struct virtqueue *);

static int	vio9p_read(struct file *, off_t *, struct uio *, kauth_cred_t,
		    int);
static int	vio9p_write(struct file *, off_t *, struct uio *,
		    kauth_cred_t, int);
static int	vio9p_ioctl(struct file *, u_long, void *);
static int	vio9p_close(struct file *);
static int	vio9p_kqfilter(struct file *, struct knote *);

static const struct fileops vio9p_fileops = {
	.fo_name = "vio9p",
	.fo_read = vio9p_read,
	.fo_write = vio9p_write,
	.fo_ioctl = vio9p_ioctl,
	.fo_fcntl = fnullop_fcntl,
	.fo_poll = fnullop_poll,
	.fo_stat = fbadop_stat,
	.fo_close = vio9p_close,
	.fo_kqfilter = vio9p_kqfilter,
	.fo_restart = fnullop_restart,
};

static dev_type_open(vio9p_dev_open);

const struct cdevsw vio9p_cdevsw = {
	.d_open = vio9p_dev_open,
	.d_read = noread,
	.d_write = nowrite,
	.d_ioctl = noioctl,
	.d_stop = nostop,
	.d_tty = notty,
	.d_poll = nopoll,
	.d_mmap = nommap,
	.d_kqfilter = nokqfilter,
	.d_discard = nodiscard,
	.d_flag = D_OTHER | D_MPSAFE,
};

static int
vio9p_dev_open(dev_t dev, int flag, int mode, struct lwp *l)
{
	struct vio9p_softc *sc;
	struct file *fp;
	int error, fd;

	sc = device_lookup_private(&vio9p_cd, minor(dev));
	if (sc == NULL)
		return ENXIO;

	/* FIXME TOCTOU */
	if (ISSET(sc->sc_flags, VIO9P_INUSE))
		return EBUSY;

	/* falloc() will fill in the descriptor for us. */
	error = fd_allocfile(&fp, &fd);
	if (error != 0)
		return error;

	sc->sc_flags |= VIO9P_INUSE;

	return fd_clone(fp, fd, flag, &vio9p_fileops, sc);
}

static int
vio9p_ioctl(struct file *fp, u_long cmd, void *addr)
{
	int error = 0;

	switch (cmd) {
	case FIONBIO:
		break;
	default:
		error = EINVAL;
		break;
	}

	return error;
}

static int
vio9p_read(struct file *fp, off_t *offp, struct uio *uio,
    kauth_cred_t cred, int flags)
{
	struct vio9p_softc *sc = fp->f_data;
	struct virtio_softc *vsc = sc->sc_virtio;
	struct virtqueue *vq = &sc->sc_vq[0];
	int error, slot, len;

	DLOG("enter");

	mutex_enter(&sc->sc_lock);

	if (sc->sc_state == VIO9P_S_INIT) {
		DLOG("%s: not requested", device_xname(sc->sc_dev));
		error = EAGAIN;
		goto out;
	}

	if (sc->sc_state == VIO9P_S_CONSUMING) {
		KASSERT(sc->sc_buf_rx_len > 0);
		/* We already have some remaining, consume it. */
		len = sc->sc_buf_rx_len - sc->sc_buf_rx_offset;
		goto consume;
	}

#if 0
	if (uio->uio_resid != VIO9P_MAX_REQLEN)
		return EINVAL;
#else
	if (uio->uio_resid > VIO9P_MAX_REQLEN) {
		error = EINVAL;
		goto out;
	}
#endif

	error = 0;
	while (sc->sc_state == VIO9P_S_REQUESTING) {
		error = cv_timedwait_sig(&sc->sc_wait, &sc->sc_lock, hz);
		if (error != 0)
			break;
	}
	if (sc->sc_state == VIO9P_S_REPLIED)
		sc->sc_state = VIO9P_S_CONSUMING;

	if (error != 0)
		goto out;

	error = virtio_dequeue(vsc, vq, &slot, &len);
	if (error != 0) {
		log(LOG_ERR, "%s: virtio_dequeue failed: %d\n",
		       device_xname(sc->sc_dev), error);
		goto out;
	}
	DLOG("len=%d", len);
	sc->sc_buf_rx_len = len;
	sc->sc_buf_rx_offset = 0;
	bus_dmamap_sync(virtio_dmat(vsc), sc->sc_dmamap_tx, 0, VIO9P_MAX_REQLEN,
	    BUS_DMASYNC_POSTWRITE);
	bus_dmamap_sync(virtio_dmat(vsc), sc->sc_dmamap_rx, 0, VIO9P_MAX_REQLEN,
	    BUS_DMASYNC_POSTREAD);
	virtio_dequeue_commit(vsc, vq, slot);
#ifdef VIO9P_DUMP
	int i;
	log(LOG_DEBUG, "%s: buf: ", __func__);
	for (i = 0; i < len; i++) {
		log(LOG_DEBUG, "%c", (char)sc->sc_buf_rx[i]);
	}
	log(LOG_DEBUG, "\n");
#endif

consume:
	DLOG("uio_resid=%lu", uio->uio_resid);
	if (len < uio->uio_resid) {
		error = EINVAL;
		goto out;
	}
	len = uio->uio_resid;
	error = uiomove(sc->sc_buf_rx + sc->sc_buf_rx_offset, len, uio);
	if (error != 0)
		goto out;

	sc->sc_buf_rx_offset += len;
	if (sc->sc_buf_rx_offset == sc->sc_buf_rx_len) {
		sc->sc_buf_rx_len = 0;
		sc->sc_buf_rx_offset = 0;

		sc->sc_state = VIO9P_S_INIT;
		selnotify(&sc->sc_sel, 0, 1);
	}

out:
	mutex_exit(&sc->sc_lock);
	return error;
}

static int
vio9p_write(struct file *fp, off_t *offp, struct uio *uio,
    kauth_cred_t cred, int flags)
{
	struct vio9p_softc *sc = fp->f_data;
	struct virtio_softc *vsc = sc->sc_virtio;
	struct virtqueue *vq = &sc->sc_vq[0];
	int error, slot;
	size_t len;

	DLOG("enter");

	mutex_enter(&sc->sc_lock);

	if (sc->sc_state != VIO9P_S_INIT) {
		DLOG("already requesting");
		error = EAGAIN;
		goto out;
	}

	if (uio->uio_resid == 0) {
		error = 0;
		goto out;
	}

	if (uio->uio_resid > VIO9P_MAX_REQLEN) {
		error = EINVAL;
		goto out;
	}

	len = uio->uio_resid;
	error = uiomove(sc->sc_buf_tx, len, uio);
	if (error != 0)
		goto out;

	DLOG("len=%lu", len);
#ifdef VIO9P_DUMP
	int i;
	log(LOG_DEBUG, "%s: buf: ", __func__);
	for (i = 0; i < len; i++) {
		log(LOG_DEBUG, "%c", (char)sc->sc_buf_tx[i]);
	}
	log(LOG_DEBUG, "\n");
#endif

	error = virtio_enqueue_prep(vsc, vq, &slot);
	if (error != 0) {
		log(LOG_ERR, "%s: virtio_enqueue_prep failed\n",
		       device_xname(sc->sc_dev));
		goto out;
	}
	DLOG("slot=%d", slot);
	error = virtio_enqueue_reserve(vsc, vq, slot,
	    sc->sc_dmamap_tx->dm_nsegs + sc->sc_dmamap_rx->dm_nsegs);
	if (error != 0) {
		log(LOG_ERR, "%s: virtio_enqueue_reserve failed\n",
		       device_xname(sc->sc_dev));
		goto out;
	}

	/* Tx */
	bus_dmamap_sync(virtio_dmat(vsc), sc->sc_dmamap_tx, 0,
	    len, BUS_DMASYNC_PREWRITE);
	virtio_enqueue(vsc, vq, slot, sc->sc_dmamap_tx, true);
	/* Rx */
	bus_dmamap_sync(virtio_dmat(vsc), sc->sc_dmamap_rx, 0,
	    VIO9P_MAX_REQLEN, BUS_DMASYNC_PREREAD);
	virtio_enqueue(vsc, vq, slot, sc->sc_dmamap_rx, false);
	virtio_enqueue_commit(vsc, vq, slot, true);

	sc->sc_state = VIO9P_S_REQUESTING;
out:
	mutex_exit(&sc->sc_lock);
	return error;
}

static int
vio9p_close(struct file *fp)
{
	struct vio9p_softc *sc = fp->f_data;

	KASSERT(ISSET(sc->sc_flags, VIO9P_INUSE));
	sc->sc_flags &= ~VIO9P_INUSE;

	return 0;
}

static void
filt_vio9p_detach(struct knote *kn)
{
	struct vio9p_softc *sc = kn->kn_hook;

	mutex_enter(&sc->sc_lock);
	selremove_knote(&sc->sc_sel, kn);
	mutex_exit(&sc->sc_lock);
}

static int
filt_vio9p_read(struct knote *kn, long hint)
{
	struct vio9p_softc *sc = kn->kn_hook;
	int rv;

	kn->kn_data = sc->sc_buf_rx_len;
	/* XXX need sc_lock? */
	rv = (kn->kn_data > 0) || sc->sc_state != VIO9P_S_INIT;

	return rv;
}

static const struct filterops vio9p_read_filtops = {
	.f_flags = FILTEROP_ISFD,
	.f_attach = NULL,
	.f_detach = filt_vio9p_detach,
	.f_event = filt_vio9p_read,
};

static int
filt_vio9p_write(struct knote *kn, long hint)
{
	struct vio9p_softc *sc = kn->kn_hook;

	/* XXX need sc_lock? */
	return sc->sc_state == VIO9P_S_INIT;
}

static const struct filterops vio9p_write_filtops = {
	.f_flags = FILTEROP_ISFD,
	.f_attach = NULL,
	.f_detach = filt_vio9p_detach,
	.f_event = filt_vio9p_write,
};

static int
vio9p_kqfilter(struct file *fp, struct knote *kn)
{
	struct vio9p_softc *sc = fp->f_data;

	switch (kn->kn_filter) {
	case EVFILT_READ:
		kn->kn_fop = &vio9p_read_filtops;
		break;

	case EVFILT_WRITE:
		kn->kn_fop = &vio9p_write_filtops;
		break;

	default:
		log(LOG_ERR, "%s: kn_filter=%u\n", __func__, kn->kn_filter);
		return EINVAL;
	}

	kn->kn_hook = sc;

	mutex_enter(&sc->sc_lock);
	selrecord_knote(&sc->sc_sel, kn);
	mutex_exit(&sc->sc_lock);

	return 0;
}

CFATTACH_DECL_NEW(vio9p, sizeof(struct vio9p_softc),
    vio9p_match, vio9p_attach, NULL, NULL);

static int
vio9p_match(device_t parent, cfdata_t match, void *aux)
{
	struct virtio_attach_args *va = aux;

	if (va->sc_childdevid == VIRTIO_DEVICE_ID_9P)
		return 1;

	return 0;
}

static void
vio9p_attach(device_t parent, device_t self, void *aux)
{
	struct vio9p_softc *sc = device_private(self);
	struct virtio_softc *vsc = device_private(parent);
	uint64_t features;
	int error;
	const struct sysctlnode *node;

	if (virtio_child(vsc) != NULL) {
		aprint_normal(": child already attached for %s; "
			      "something wrong...\n", device_xname(parent));
		return;
	}

	sc->sc_dev = self;
	sc->sc_virtio = vsc;

	virtio_child_attach_start(vsc, self, IPL_VM,
	    VIO9P_F_MOUNT_TAG, VIO9P_FLAG_BITS);

	features = virtio_features(vsc);
	if ((features & VIO9P_F_MOUNT_TAG) == 0)
		goto err_none;

	virtio_init_vq_vqdone(vsc, &sc->sc_vq[0], 0, vio9p_request_done);
	error = virtio_alloc_vq(vsc, &sc->sc_vq[0], VIO9P_MAX_REQLEN,
	    VIO9P_N_SEGMENTS * 2, "vio9p");
	if (error != 0)
		goto err_none;

	sc->sc_buf_tx = kmem_alloc(VIO9P_MAX_REQLEN, KM_SLEEP);
	sc->sc_buf_rx = kmem_alloc(VIO9P_MAX_REQLEN, KM_SLEEP);

	error = bus_dmamap_create(virtio_dmat(vsc), VIO9P_MAX_REQLEN,
	    VIO9P_N_SEGMENTS, VIO9P_SEGSIZE, 0, BUS_DMA_WAITOK, &sc->sc_dmamap_tx);
	if (error != 0) {
		aprint_error_dev(sc->sc_dev, "bus_dmamap_create failed: %d\n",
		    error);
		goto err_vq;
	}
	error = bus_dmamap_create(virtio_dmat(vsc), VIO9P_MAX_REQLEN,
	    VIO9P_N_SEGMENTS, VIO9P_SEGSIZE, 0, BUS_DMA_WAITOK, &sc->sc_dmamap_rx);
	if (error != 0) {
		aprint_error_dev(sc->sc_dev, "bus_dmamap_create failed: %d\n",
		    error);
		goto err_vq;
	}

	error = bus_dmamap_load(virtio_dmat(vsc), sc->sc_dmamap_tx,
	    sc->sc_buf_tx, VIO9P_MAX_REQLEN, NULL, BUS_DMA_WAITOK | BUS_DMA_WRITE);
	if (error != 0) {
		aprint_error_dev(sc->sc_dev, "bus_dmamap_load failed: %d\n",
		    error);
		goto err_dmamap;
	}
	error = bus_dmamap_load(virtio_dmat(vsc), sc->sc_dmamap_rx,
	    sc->sc_buf_rx, VIO9P_MAX_REQLEN, NULL, BUS_DMA_WAITOK | BUS_DMA_READ);
	if (error != 0) {
		aprint_error_dev(sc->sc_dev, "bus_dmamap_load failed: %d\n",
		    error);
		goto err_dmamap;
	}

	sc->sc_state = VIO9P_S_INIT;
	mutex_init(&sc->sc_lock, MUTEX_DEFAULT, IPL_NONE);
	cv_init(&sc->sc_wait, "vio9p");

	vio9p_read_config(sc);
	aprint_normal_dev(self, "tagged as %s\n", sc->sc_tag);

	sysctl_createv(NULL, 0, NULL, &node, 0, CTLTYPE_NODE,
	    "vio9p", SYSCTL_DESCR("VirtIO 9p toplevel"),
	    NULL, 0, NULL, 0,
	    CTL_HW, CTL_CREATE, CTL_EOL);
	sysctl_createv(NULL, 0, &node, &node, 0, CTLTYPE_NODE,
	    device_xname(self), SYSCTL_DESCR("VirtIO 9p device"),
	    NULL, 0, NULL, 0,
	    CTL_CREATE, CTL_EOL);
	sysctl_createv(NULL, 0, &node, NULL, 0, CTLTYPE_STRING,
	    "tag", SYSCTL_DESCR("VirtIO 9p tag value"),
	    NULL, 0, sc->sc_tag, 0,
	    CTL_CREATE, CTL_EOL);

	error = virtio_child_attach_finish(vsc, sc->sc_vq,
	    __arraycount(sc->sc_vq), NULL,
	    VIRTIO_F_INTR_MPSAFE | VIRTIO_F_INTR_SOFTINT);
	if (error != 0)
		goto err_mutex;

	return;

err_mutex:
	cv_destroy(&sc->sc_wait);
	mutex_destroy(&sc->sc_lock);
err_dmamap:
	bus_dmamap_destroy(virtio_dmat(vsc), sc->sc_dmamap_tx);
	bus_dmamap_destroy(virtio_dmat(vsc), sc->sc_dmamap_rx);
err_vq:
	virtio_free_vq(vsc, &sc->sc_vq[0]);
err_none:
	virtio_child_attach_failed(vsc);
	return;
}

static void
vio9p_read_config(struct vio9p_softc *sc)
{
	device_t dev = sc->sc_dev;
	uint8_t reg;
	int i;

	/* these values are explicitly specified as little-endian */
	sc->sc_taglen = virtio_read_device_config_le_2(sc->sc_virtio,
		VIO9P_CONFIG_TAG_LEN);

	if (sc->sc_taglen > P9_MAX_TAG_LEN) {
		aprint_error_dev(dev, "warning: tag is trimmed from %u to %u\n",
		    sc->sc_taglen, P9_MAX_TAG_LEN);
		sc->sc_taglen = P9_MAX_TAG_LEN;
	}

	for (i = 0; i < sc->sc_taglen; i++) {
		reg = virtio_read_device_config_1(sc->sc_virtio,
		    VIO9P_CONFIG_TAG + i);
		sc->sc_tag[i] = reg;
	}
	sc->sc_tag[i] = '\0';
}

static int
vio9p_request_done(struct virtqueue *vq)
{
	struct virtio_softc *vsc = vq->vq_owner;
	struct vio9p_softc *sc = device_private(virtio_child(vsc));

	DLOG("enter");

	mutex_enter(&sc->sc_lock);
	sc->sc_state = VIO9P_S_REPLIED;
	cv_broadcast(&sc->sc_wait);
	selnotify(&sc->sc_sel, 0, 1);
	mutex_exit(&sc->sc_lock);

	return 1;
}

MODULE(MODULE_CLASS_DRIVER, vio9p, "virtio");

#ifdef _MODULE
#include "ioconf.c"
#endif

static int
vio9p_modcmd(modcmd_t cmd, void *opaque)
{
#ifdef _MODULE
	devmajor_t bmajor = NODEVMAJOR, cmajor = NODEVMAJOR;
#endif
	int error = 0;

#ifdef _MODULE
	switch (cmd) {
	case MODULE_CMD_INIT:
		devsw_attach(vio9p_cd.cd_name, NULL, &bmajor,
		    &vio9p_cdevsw, &cmajor);
		error = config_init_component(cfdriver_ioconf_vio9p,
		    cfattach_ioconf_vio9p, cfdata_ioconf_vio9p);
		break;
	case MODULE_CMD_FINI:
		error = config_fini_component(cfdriver_ioconf_vio9p,
		    cfattach_ioconf_vio9p, cfdata_ioconf_vio9p);
		devsw_detach(NULL, &vio9p_cdevsw);
		break;
	default:
		error = ENOTTY;
		break;
	}
#endif

	return error;
}