xref: /linux/drivers/xen/pvcalls-front.c (revision cbae17630954cb89f2bdf5bbadfd3aa81ea67283)
1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /*
3  * (c) 2017 Stefano Stabellini <stefano@aporeto.com>
4  */
5 
6 #include <linux/module.h>
7 #include <linux/net.h>
8 #include <linux/socket.h>
9 
10 #include <net/sock.h>
11 
12 #include <xen/events.h>
13 #include <xen/grant_table.h>
14 #include <xen/xen.h>
15 #include <xen/xenbus.h>
16 #include <xen/interface/io/pvcalls.h>
17 
18 #include "pvcalls-front.h"
19 
20 #define PVCALLS_INVALID_ID UINT_MAX
21 #define PVCALLS_RING_ORDER XENBUS_MAX_RING_GRANT_ORDER
22 #define PVCALLS_NR_RSP_PER_RING __CONST_RING_SIZE(xen_pvcalls, XEN_PAGE_SIZE)
23 #define PVCALLS_FRONT_MAX_SPIN 5000
24 
25 static struct proto pvcalls_proto = {
26 	.name	= "PVCalls",
27 	.owner	= THIS_MODULE,
28 	.obj_size = sizeof(struct sock),
29 };
30 
31 struct pvcalls_bedata {
32 	struct xen_pvcalls_front_ring ring;
33 	grant_ref_t ref;
34 	int irq;
35 	bool disabled;
36 
37 	struct list_head socket_mappings;
38 	spinlock_t socket_lock;
39 
40 	wait_queue_head_t inflight_req;
41 	struct xen_pvcalls_response rsp[PVCALLS_NR_RSP_PER_RING];
42 };
43 /* Only one front/back connection supported. */
44 static struct xenbus_device *pvcalls_front_dev;
45 static atomic_t pvcalls_refcount;
46 
47 /* first increment refcount, then proceed */
48 #define pvcalls_enter() {               \
49 	atomic_inc(&pvcalls_refcount);      \
50 }
51 
52 /* first complete other operations, then decrement refcount */
53 #define pvcalls_exit() {                \
54 	atomic_dec(&pvcalls_refcount);      \
55 }
56 
57 struct sock_mapping {
58 	bool active_socket;
59 	struct list_head list;
60 	struct socket *sock;
61 	atomic_t refcount;
62 	union {
63 		struct {
64 			int irq;
65 			grant_ref_t ref;
66 			struct pvcalls_data_intf *ring;
67 			struct pvcalls_data data;
68 			struct mutex in_mutex;
69 			struct mutex out_mutex;
70 
71 			wait_queue_head_t inflight_conn_req;
72 		} active;
73 		struct {
74 		/*
75 		 * Socket status, needs to be 64-bit aligned due to the
76 		 * test_and_* functions which have this requirement on arm64.
77 		 */
78 #define PVCALLS_STATUS_UNINITALIZED  0
79 #define PVCALLS_STATUS_BIND          1
80 #define PVCALLS_STATUS_LISTEN        2
81 			uint8_t status __attribute__((aligned(8)));
82 		/*
83 		 * Internal state-machine flags.
84 		 * Only one accept operation can be inflight for a socket.
85 		 * Only one poll operation can be inflight for a given socket.
86 		 * flags needs to be 64-bit aligned due to the test_and_*
87 		 * functions which have this requirement on arm64.
88 		 */
89 #define PVCALLS_FLAG_ACCEPT_INFLIGHT 0
90 #define PVCALLS_FLAG_POLL_INFLIGHT   1
91 #define PVCALLS_FLAG_POLL_RET        2
92 			uint8_t flags __attribute__((aligned(8)));
93 			uint32_t inflight_req_id;
94 			struct sock_mapping *accept_map;
95 			wait_queue_head_t inflight_accept_req;
96 		} passive;
97 	};
98 };
99 
100 static inline struct sock_mapping *pvcalls_enter_sock(struct socket *sock)
101 {
102 	struct sock_mapping *map;
103 
104 	if (!pvcalls_front_dev ||
105 		dev_get_drvdata(&pvcalls_front_dev->dev) == NULL)
106 		return ERR_PTR(-ENOTCONN);
107 
108 	map = (struct sock_mapping *)sock->sk->sk_send_head;
109 	if (map == NULL)
110 		return ERR_PTR(-ENOTSOCK);
111 
112 	pvcalls_enter();
113 	atomic_inc(&map->refcount);
114 	return map;
115 }
116 
117 static inline void pvcalls_exit_sock(struct socket *sock)
118 {
119 	struct sock_mapping *map;
120 
121 	map = (struct sock_mapping *)sock->sk->sk_send_head;
122 	atomic_dec(&map->refcount);
123 	pvcalls_exit();
124 }
125 
126 static inline int get_request(struct pvcalls_bedata *bedata, int *req_id)
127 {
128 	*req_id = bedata->ring.req_prod_pvt & (RING_SIZE(&bedata->ring) - 1);
129 	if (RING_FULL(&bedata->ring) ||
130 	    bedata->rsp[*req_id].req_id != PVCALLS_INVALID_ID)
131 		return -EAGAIN;
132 	return 0;
133 }
134 
135 /*
136  * Wait for the backend's response to req_id, or for the frontend to be
137  * disabled because the backend violated the wire protocol. Returns 0 once
138  * the response has arrived, or -EIO if the frontend was disabled.
139  */
140 static int pvcalls_front_wait_rsp(struct pvcalls_bedata *bedata, u32 req_id)
141 {
142 	wait_event(bedata->inflight_req,
143 		   READ_ONCE(bedata->rsp[req_id].req_id) == req_id ||
144 		   READ_ONCE(bedata->disabled));
145 
146 	return READ_ONCE(bedata->disabled) ? -EIO : 0;
147 }
148 
149 static bool pvcalls_front_write_todo(struct sock_mapping *map)
150 {
151 	struct pvcalls_data_intf *intf = map->active.ring;
152 	RING_IDX cons, prod, size = XEN_FLEX_RING_SIZE(PVCALLS_RING_ORDER);
153 	int32_t error;
154 
155 	error = intf->out_error;
156 	if (error == -ENOTCONN)
157 		return false;
158 	if (error != 0)
159 		return true;
160 
161 	cons = intf->out_cons;
162 	prod = intf->out_prod;
163 	return !!(size - pvcalls_queued(prod, cons, size));
164 }
165 
166 static bool pvcalls_front_read_todo(struct sock_mapping *map)
167 {
168 	struct pvcalls_data_intf *intf = map->active.ring;
169 	RING_IDX cons, prod;
170 	int32_t error;
171 
172 	cons = intf->in_cons;
173 	prod = intf->in_prod;
174 	error = intf->in_error;
175 	return (error != 0 ||
176 		pvcalls_queued(prod, cons,
177 			       XEN_FLEX_RING_SIZE(PVCALLS_RING_ORDER)) != 0);
178 }
179 
180 static irqreturn_t pvcalls_front_event_handler(int irq, void *dev_id)
181 {
182 	struct xenbus_device *dev = dev_id;
183 	struct pvcalls_bedata *bedata;
184 	struct xen_pvcalls_response *rsp;
185 	uint8_t *src, *dst;
186 	u32 req_id = 0;
187 	int more = 0, done = 0;
188 
189 	if (dev == NULL)
190 		return IRQ_HANDLED;
191 
192 	pvcalls_enter();
193 	bedata = dev_get_drvdata(&dev->dev);
194 	if (bedata == NULL) {
195 		pvcalls_exit();
196 		return IRQ_HANDLED;
197 	}
198 	if (READ_ONCE(bedata->disabled)) {
199 		pvcalls_exit();
200 		return IRQ_HANDLED;
201 	}
202 
203 again:
204 	while (RING_HAS_UNCONSUMED_RESPONSES(&bedata->ring)) {
205 		rsp = RING_GET_RESPONSE(&bedata->ring, bedata->ring.rsp_cons);
206 
207 		req_id = rsp->req_id;
208 		if (req_id >= PVCALLS_NR_RSP_PER_RING) {
209 			/*
210 			 * The backend supplied a req_id that would index
211 			 * bedata->rsp[] out of bounds: a protocol violation
212 			 * from a malicious or buggy backend. Log once, stop
213 			 * trusting this backend and disable the frontend rather
214 			 * than silently dropping the response and continuing.
215 			 */
216 			pr_err_once("pvcalls: backend sent out-of-range req_id %u, disabling frontend\n",
217 				    req_id);
218 			WRITE_ONCE(bedata->disabled, true);
219 			bedata->ring.rsp_cons++;
220 			done = 1;
221 			break;
222 		}
223 		if (rsp->cmd == PVCALLS_POLL) {
224 			struct sock_mapping *map = (struct sock_mapping *)(uintptr_t)
225 						   rsp->u.poll.id;
226 
227 			clear_bit(PVCALLS_FLAG_POLL_INFLIGHT,
228 				  (void *)&map->passive.flags);
229 			/*
230 			 * clear INFLIGHT, then set RET. It pairs with
231 			 * the checks at the beginning of
232 			 * pvcalls_front_poll_passive.
233 			 */
234 			smp_wmb();
235 			set_bit(PVCALLS_FLAG_POLL_RET,
236 				(void *)&map->passive.flags);
237 		} else {
238 			dst = (uint8_t *)&bedata->rsp[req_id] +
239 			      sizeof(rsp->req_id);
240 			src = (uint8_t *)rsp + sizeof(rsp->req_id);
241 			memcpy(dst, src, sizeof(*rsp) - sizeof(rsp->req_id));
242 			/*
243 			 * First copy the rest of the data, then req_id. It is
244 			 * paired with the barrier when accessing bedata->rsp.
245 			 */
246 			smp_wmb();
247 			bedata->rsp[req_id].req_id = req_id;
248 		}
249 
250 		done = 1;
251 		bedata->ring.rsp_cons++;
252 	}
253 
254 	RING_FINAL_CHECK_FOR_RESPONSES(&bedata->ring, more);
255 	if (more && !READ_ONCE(bedata->disabled))
256 		goto again;
257 	if (done)
258 		wake_up(&bedata->inflight_req);
259 	pvcalls_exit();
260 	return IRQ_HANDLED;
261 }
262 
263 static void free_active_ring(struct sock_mapping *map);
264 
265 static void pvcalls_front_destroy_active(struct pvcalls_bedata *bedata,
266 					 struct sock_mapping *map)
267 {
268 	int i;
269 
270 	unbind_from_irqhandler(map->active.irq, map);
271 
272 	if (bedata) {
273 		spin_lock(&bedata->socket_lock);
274 		if (!list_empty(&map->list))
275 			list_del_init(&map->list);
276 		spin_unlock(&bedata->socket_lock);
277 	}
278 
279 	for (i = 0; i < (1 << PVCALLS_RING_ORDER); i++)
280 		gnttab_end_foreign_access(map->active.ring->ref[i], NULL);
281 	gnttab_end_foreign_access(map->active.ref, NULL);
282 	free_active_ring(map);
283 }
284 
285 static void pvcalls_front_free_map(struct pvcalls_bedata *bedata,
286 				   struct sock_mapping *map)
287 {
288 	pvcalls_front_destroy_active(bedata, map);
289 
290 	kfree(map);
291 }
292 
293 static irqreturn_t pvcalls_front_conn_handler(int irq, void *sock_map)
294 {
295 	struct sock_mapping *map = sock_map;
296 
297 	if (map == NULL)
298 		return IRQ_HANDLED;
299 
300 	wake_up_interruptible(&map->active.inflight_conn_req);
301 
302 	return IRQ_HANDLED;
303 }
304 
305 int pvcalls_front_socket(struct socket *sock)
306 {
307 	struct pvcalls_bedata *bedata;
308 	struct sock_mapping *map = NULL;
309 	struct xen_pvcalls_request *req;
310 	int notify, req_id, ret;
311 
312 	/*
313 	 * PVCalls only supports domain AF_INET,
314 	 * type SOCK_STREAM and protocol 0 sockets for now.
315 	 *
316 	 * Check socket type here, AF_INET and protocol checks are done
317 	 * by the caller.
318 	 */
319 	if (sock->type != SOCK_STREAM)
320 		return -EOPNOTSUPP;
321 
322 	pvcalls_enter();
323 	if (!pvcalls_front_dev) {
324 		pvcalls_exit();
325 		return -EACCES;
326 	}
327 	bedata = dev_get_drvdata(&pvcalls_front_dev->dev);
328 
329 	map = kzalloc_obj(*map);
330 	if (map == NULL) {
331 		pvcalls_exit();
332 		return -ENOMEM;
333 	}
334 
335 	spin_lock(&bedata->socket_lock);
336 
337 	ret = get_request(bedata, &req_id);
338 	if (ret < 0) {
339 		kfree(map);
340 		spin_unlock(&bedata->socket_lock);
341 		pvcalls_exit();
342 		return ret;
343 	}
344 
345 	/*
346 	 * sock->sk->sk_send_head is not used for ip sockets: reuse the
347 	 * field to store a pointer to the struct sock_mapping
348 	 * corresponding to the socket. This way, we can easily get the
349 	 * struct sock_mapping from the struct socket.
350 	 */
351 	sock->sk->sk_send_head = (void *)map;
352 	list_add_tail(&map->list, &bedata->socket_mappings);
353 
354 	req = RING_GET_REQUEST(&bedata->ring, req_id);
355 	req->req_id = req_id;
356 	req->cmd = PVCALLS_SOCKET;
357 	req->u.socket.id = (uintptr_t) map;
358 	req->u.socket.domain = AF_INET;
359 	req->u.socket.type = SOCK_STREAM;
360 	req->u.socket.protocol = IPPROTO_IP;
361 
362 	bedata->ring.req_prod_pvt++;
363 	RING_PUSH_REQUESTS_AND_CHECK_NOTIFY(&bedata->ring, notify);
364 	spin_unlock(&bedata->socket_lock);
365 	if (notify)
366 		notify_remote_via_irq(bedata->irq);
367 
368 	ret = pvcalls_front_wait_rsp(bedata, req_id);
369 	if (ret) {
370 		pvcalls_exit();
371 		return ret;
372 	}
373 
374 	/* read req_id, then the content */
375 	smp_rmb();
376 	ret = bedata->rsp[req_id].ret;
377 	bedata->rsp[req_id].req_id = PVCALLS_INVALID_ID;
378 
379 	pvcalls_exit();
380 	return ret;
381 }
382 EXPORT_SYMBOL_GPL(pvcalls_front_socket);
383 
384 static void free_active_ring(struct sock_mapping *map)
385 {
386 	if (!map->active.ring)
387 		return;
388 
389 	free_pages_exact(map->active.data.in,
390 			 PAGE_SIZE << map->active.ring->ring_order);
391 	free_page((unsigned long)map->active.ring);
392 }
393 
394 static int alloc_active_ring(struct sock_mapping *map)
395 {
396 	void *bytes;
397 
398 	map->active.ring = (struct pvcalls_data_intf *)
399 		get_zeroed_page(GFP_KERNEL);
400 	if (!map->active.ring)
401 		goto out;
402 
403 	map->active.ring->ring_order = PVCALLS_RING_ORDER;
404 	bytes = alloc_pages_exact(PAGE_SIZE << PVCALLS_RING_ORDER,
405 				  GFP_KERNEL | __GFP_ZERO);
406 	if (!bytes)
407 		goto out;
408 
409 	map->active.data.in = bytes;
410 	map->active.data.out = bytes +
411 		XEN_FLEX_RING_SIZE(PVCALLS_RING_ORDER);
412 
413 	return 0;
414 
415 out:
416 	free_active_ring(map);
417 	return -ENOMEM;
418 }
419 
420 static int create_active(struct sock_mapping *map, evtchn_port_t *evtchn)
421 {
422 	void *bytes;
423 	int ret, irq = -1, i;
424 
425 	*evtchn = 0;
426 	init_waitqueue_head(&map->active.inflight_conn_req);
427 
428 	bytes = map->active.data.in;
429 	for (i = 0; i < (1 << PVCALLS_RING_ORDER); i++)
430 		map->active.ring->ref[i] = gnttab_grant_foreign_access(
431 			pvcalls_front_dev->otherend_id,
432 			pfn_to_gfn(virt_to_pfn(bytes) + i), 0);
433 
434 	map->active.ref = gnttab_grant_foreign_access(
435 		pvcalls_front_dev->otherend_id,
436 		pfn_to_gfn(virt_to_pfn((void *)map->active.ring)), 0);
437 
438 	ret = xenbus_alloc_evtchn(pvcalls_front_dev, evtchn);
439 	if (ret)
440 		goto out_error;
441 	irq = bind_evtchn_to_irqhandler(*evtchn, pvcalls_front_conn_handler,
442 					0, "pvcalls-frontend", map);
443 	if (irq < 0) {
444 		ret = irq;
445 		goto out_error;
446 	}
447 
448 	map->active.irq = irq;
449 	map->active_socket = true;
450 	mutex_init(&map->active.in_mutex);
451 	mutex_init(&map->active.out_mutex);
452 
453 	return 0;
454 
455 out_error:
456 	if (*evtchn > 0)
457 		xenbus_free_evtchn(pvcalls_front_dev, *evtchn);
458 	return ret;
459 }
460 
461 int pvcalls_front_connect(struct socket *sock, struct sockaddr *addr,
462 				int addr_len, int flags)
463 {
464 	struct pvcalls_bedata *bedata;
465 	struct sock_mapping *map = NULL;
466 	struct xen_pvcalls_request *req;
467 	int notify, req_id, ret;
468 	evtchn_port_t evtchn;
469 
470 	if (addr->sa_family != AF_INET || sock->type != SOCK_STREAM)
471 		return -EOPNOTSUPP;
472 
473 	map = pvcalls_enter_sock(sock);
474 	if (IS_ERR(map))
475 		return PTR_ERR(map);
476 
477 	bedata = dev_get_drvdata(&pvcalls_front_dev->dev);
478 	ret = alloc_active_ring(map);
479 	if (ret < 0) {
480 		pvcalls_exit_sock(sock);
481 		return ret;
482 	}
483 	ret = create_active(map, &evtchn);
484 	if (ret < 0) {
485 		free_active_ring(map);
486 		pvcalls_exit_sock(sock);
487 		return ret;
488 	}
489 
490 	spin_lock(&bedata->socket_lock);
491 	ret = get_request(bedata, &req_id);
492 	if (ret < 0) {
493 		spin_unlock(&bedata->socket_lock);
494 		pvcalls_front_destroy_active(NULL, map);
495 		pvcalls_exit_sock(sock);
496 		return ret;
497 	}
498 
499 	req = RING_GET_REQUEST(&bedata->ring, req_id);
500 	req->req_id = req_id;
501 	req->cmd = PVCALLS_CONNECT;
502 	req->u.connect.id = (uintptr_t)map;
503 	req->u.connect.len = addr_len;
504 	req->u.connect.flags = flags;
505 	req->u.connect.ref = map->active.ref;
506 	req->u.connect.evtchn = evtchn;
507 	memcpy(req->u.connect.addr, addr, sizeof(*addr));
508 
509 	map->sock = sock;
510 
511 	bedata->ring.req_prod_pvt++;
512 	RING_PUSH_REQUESTS_AND_CHECK_NOTIFY(&bedata->ring, notify);
513 	spin_unlock(&bedata->socket_lock);
514 
515 	if (notify)
516 		notify_remote_via_irq(bedata->irq);
517 
518 	ret = pvcalls_front_wait_rsp(bedata, req_id);
519 	if (ret) {
520 		pvcalls_exit_sock(sock);
521 		return ret;
522 	}
523 
524 	/* read req_id, then the content */
525 	smp_rmb();
526 	ret = bedata->rsp[req_id].ret;
527 	bedata->rsp[req_id].req_id = PVCALLS_INVALID_ID;
528 	pvcalls_exit_sock(sock);
529 	return ret;
530 }
531 EXPORT_SYMBOL_GPL(pvcalls_front_connect);
532 
533 static int __write_ring(struct pvcalls_data_intf *intf,
534 			struct pvcalls_data *data,
535 			struct iov_iter *msg_iter,
536 			int len)
537 {
538 	RING_IDX cons, prod, size, masked_prod, masked_cons;
539 	RING_IDX array_size = XEN_FLEX_RING_SIZE(PVCALLS_RING_ORDER);
540 	int32_t error;
541 
542 	error = intf->out_error;
543 	if (error < 0)
544 		return error;
545 	cons = intf->out_cons;
546 	prod = intf->out_prod;
547 	/* read indexes before continuing */
548 	virt_mb();
549 
550 	size = pvcalls_queued(prod, cons, array_size);
551 	if (size > array_size)
552 		return -EINVAL;
553 	if (size == array_size)
554 		return 0;
555 	if (len > array_size - size)
556 		len = array_size - size;
557 
558 	masked_prod = pvcalls_mask(prod, array_size);
559 	masked_cons = pvcalls_mask(cons, array_size);
560 
561 	if (masked_prod < masked_cons) {
562 		len = copy_from_iter(data->out + masked_prod, len, msg_iter);
563 	} else {
564 		if (len > array_size - masked_prod) {
565 			int ret = copy_from_iter(data->out + masked_prod,
566 				       array_size - masked_prod, msg_iter);
567 			if (ret != array_size - masked_prod) {
568 				len = ret;
569 				goto out;
570 			}
571 			len = ret + copy_from_iter(data->out, len - ret, msg_iter);
572 		} else {
573 			len = copy_from_iter(data->out + masked_prod, len, msg_iter);
574 		}
575 	}
576 out:
577 	/* write to ring before updating pointer */
578 	virt_wmb();
579 	intf->out_prod += len;
580 
581 	return len;
582 }
583 
584 int pvcalls_front_sendmsg(struct socket *sock, struct msghdr *msg,
585 			  size_t len)
586 {
587 	struct sock_mapping *map;
588 	int sent, tot_sent = 0;
589 	int count = 0, flags;
590 
591 	flags = msg->msg_flags;
592 	if (flags & (MSG_CONFIRM|MSG_DONTROUTE|MSG_EOR|MSG_OOB))
593 		return -EOPNOTSUPP;
594 
595 	map = pvcalls_enter_sock(sock);
596 	if (IS_ERR(map))
597 		return PTR_ERR(map);
598 
599 	mutex_lock(&map->active.out_mutex);
600 	if ((flags & MSG_DONTWAIT) && !pvcalls_front_write_todo(map)) {
601 		mutex_unlock(&map->active.out_mutex);
602 		pvcalls_exit_sock(sock);
603 		return -EAGAIN;
604 	}
605 	if (len > INT_MAX)
606 		len = INT_MAX;
607 
608 again:
609 	count++;
610 	sent = __write_ring(map->active.ring,
611 			    &map->active.data, &msg->msg_iter,
612 			    len);
613 	if (sent > 0) {
614 		len -= sent;
615 		tot_sent += sent;
616 		notify_remote_via_irq(map->active.irq);
617 	}
618 	if (sent >= 0 && len > 0 && count < PVCALLS_FRONT_MAX_SPIN)
619 		goto again;
620 	if (sent < 0)
621 		tot_sent = sent;
622 
623 	mutex_unlock(&map->active.out_mutex);
624 	pvcalls_exit_sock(sock);
625 	return tot_sent;
626 }
627 EXPORT_SYMBOL_GPL(pvcalls_front_sendmsg);
628 
629 static int __read_ring(struct pvcalls_data_intf *intf,
630 		       struct pvcalls_data *data,
631 		       struct iov_iter *msg_iter,
632 		       size_t len, int flags)
633 {
634 	RING_IDX cons, prod, size, masked_prod, masked_cons;
635 	RING_IDX array_size = XEN_FLEX_RING_SIZE(PVCALLS_RING_ORDER);
636 	int32_t error;
637 
638 	cons = intf->in_cons;
639 	prod = intf->in_prod;
640 	error = intf->in_error;
641 	/* get pointers before reading from the ring */
642 	virt_rmb();
643 
644 	size = pvcalls_queued(prod, cons, array_size);
645 	masked_prod = pvcalls_mask(prod, array_size);
646 	masked_cons = pvcalls_mask(cons, array_size);
647 
648 	if (size == 0)
649 		return error ?: size;
650 
651 	if (len > size)
652 		len = size;
653 
654 	if (masked_prod > masked_cons) {
655 		len = copy_to_iter(data->in + masked_cons, len, msg_iter);
656 	} else {
657 		if (len > (array_size - masked_cons)) {
658 			int ret = copy_to_iter(data->in + masked_cons,
659 				     array_size - masked_cons, msg_iter);
660 			if (ret != array_size - masked_cons) {
661 				len = ret;
662 				goto out;
663 			}
664 			len = ret + copy_to_iter(data->in, len - ret, msg_iter);
665 		} else {
666 			len = copy_to_iter(data->in + masked_cons, len, msg_iter);
667 		}
668 	}
669 out:
670 	/* read data from the ring before increasing the index */
671 	virt_mb();
672 	if (!(flags & MSG_PEEK))
673 		intf->in_cons += len;
674 
675 	return len;
676 }
677 
678 int pvcalls_front_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,
679 		     int flags)
680 {
681 	int ret;
682 	struct sock_mapping *map;
683 
684 	if (flags & (MSG_CMSG_CLOEXEC|MSG_ERRQUEUE|MSG_OOB|MSG_TRUNC))
685 		return -EOPNOTSUPP;
686 
687 	map = pvcalls_enter_sock(sock);
688 	if (IS_ERR(map))
689 		return PTR_ERR(map);
690 
691 	mutex_lock(&map->active.in_mutex);
692 	if (len > XEN_FLEX_RING_SIZE(PVCALLS_RING_ORDER))
693 		len = XEN_FLEX_RING_SIZE(PVCALLS_RING_ORDER);
694 
695 	while (!(flags & MSG_DONTWAIT) && !pvcalls_front_read_todo(map)) {
696 		wait_event_interruptible(map->active.inflight_conn_req,
697 					 pvcalls_front_read_todo(map));
698 	}
699 	ret = __read_ring(map->active.ring, &map->active.data,
700 			  &msg->msg_iter, len, flags);
701 
702 	if (ret > 0)
703 		notify_remote_via_irq(map->active.irq);
704 	if (ret == 0)
705 		ret = (flags & MSG_DONTWAIT) ? -EAGAIN : 0;
706 	if (ret == -ENOTCONN)
707 		ret = 0;
708 
709 	mutex_unlock(&map->active.in_mutex);
710 	pvcalls_exit_sock(sock);
711 	return ret;
712 }
713 EXPORT_SYMBOL_GPL(pvcalls_front_recvmsg);
714 
715 int pvcalls_front_bind(struct socket *sock, struct sockaddr *addr, int addr_len)
716 {
717 	struct pvcalls_bedata *bedata;
718 	struct sock_mapping *map = NULL;
719 	struct xen_pvcalls_request *req;
720 	int notify, req_id, ret;
721 
722 	if (addr->sa_family != AF_INET || sock->type != SOCK_STREAM)
723 		return -EOPNOTSUPP;
724 
725 	map = pvcalls_enter_sock(sock);
726 	if (IS_ERR(map))
727 		return PTR_ERR(map);
728 	bedata = dev_get_drvdata(&pvcalls_front_dev->dev);
729 
730 	spin_lock(&bedata->socket_lock);
731 	ret = get_request(bedata, &req_id);
732 	if (ret < 0) {
733 		spin_unlock(&bedata->socket_lock);
734 		pvcalls_exit_sock(sock);
735 		return ret;
736 	}
737 	req = RING_GET_REQUEST(&bedata->ring, req_id);
738 	req->req_id = req_id;
739 	map->sock = sock;
740 	req->cmd = PVCALLS_BIND;
741 	req->u.bind.id = (uintptr_t)map;
742 	memcpy(req->u.bind.addr, addr, sizeof(*addr));
743 	req->u.bind.len = addr_len;
744 
745 	init_waitqueue_head(&map->passive.inflight_accept_req);
746 
747 	map->active_socket = false;
748 
749 	bedata->ring.req_prod_pvt++;
750 	RING_PUSH_REQUESTS_AND_CHECK_NOTIFY(&bedata->ring, notify);
751 	spin_unlock(&bedata->socket_lock);
752 	if (notify)
753 		notify_remote_via_irq(bedata->irq);
754 
755 	ret = pvcalls_front_wait_rsp(bedata, req_id);
756 	if (ret) {
757 		pvcalls_exit_sock(sock);
758 		return ret;
759 	}
760 
761 	/* read req_id, then the content */
762 	smp_rmb();
763 	ret = bedata->rsp[req_id].ret;
764 	bedata->rsp[req_id].req_id = PVCALLS_INVALID_ID;
765 
766 	map->passive.status = PVCALLS_STATUS_BIND;
767 	pvcalls_exit_sock(sock);
768 	return 0;
769 }
770 EXPORT_SYMBOL_GPL(pvcalls_front_bind);
771 
772 int pvcalls_front_listen(struct socket *sock, int backlog)
773 {
774 	struct pvcalls_bedata *bedata;
775 	struct sock_mapping *map;
776 	struct xen_pvcalls_request *req;
777 	int notify, req_id, ret;
778 
779 	map = pvcalls_enter_sock(sock);
780 	if (IS_ERR(map))
781 		return PTR_ERR(map);
782 	bedata = dev_get_drvdata(&pvcalls_front_dev->dev);
783 
784 	if (map->passive.status != PVCALLS_STATUS_BIND) {
785 		pvcalls_exit_sock(sock);
786 		return -EOPNOTSUPP;
787 	}
788 
789 	spin_lock(&bedata->socket_lock);
790 	ret = get_request(bedata, &req_id);
791 	if (ret < 0) {
792 		spin_unlock(&bedata->socket_lock);
793 		pvcalls_exit_sock(sock);
794 		return ret;
795 	}
796 	req = RING_GET_REQUEST(&bedata->ring, req_id);
797 	req->req_id = req_id;
798 	req->cmd = PVCALLS_LISTEN;
799 	req->u.listen.id = (uintptr_t) map;
800 	req->u.listen.backlog = backlog;
801 
802 	bedata->ring.req_prod_pvt++;
803 	RING_PUSH_REQUESTS_AND_CHECK_NOTIFY(&bedata->ring, notify);
804 	spin_unlock(&bedata->socket_lock);
805 	if (notify)
806 		notify_remote_via_irq(bedata->irq);
807 
808 	ret = pvcalls_front_wait_rsp(bedata, req_id);
809 	if (ret) {
810 		pvcalls_exit_sock(sock);
811 		return ret;
812 	}
813 
814 	/* read req_id, then the content */
815 	smp_rmb();
816 	ret = bedata->rsp[req_id].ret;
817 	bedata->rsp[req_id].req_id = PVCALLS_INVALID_ID;
818 
819 	map->passive.status = PVCALLS_STATUS_LISTEN;
820 	pvcalls_exit_sock(sock);
821 	return ret;
822 }
823 EXPORT_SYMBOL_GPL(pvcalls_front_listen);
824 
825 int pvcalls_front_accept(struct socket *sock, struct socket *newsock,
826 			 struct proto_accept_arg *arg)
827 {
828 	struct pvcalls_bedata *bedata;
829 	struct sock_mapping *map;
830 	struct sock_mapping *map2 = NULL;
831 	struct xen_pvcalls_request *req;
832 	int notify, req_id, ret, nonblock;
833 	evtchn_port_t evtchn;
834 
835 	map = pvcalls_enter_sock(sock);
836 	if (IS_ERR(map))
837 		return PTR_ERR(map);
838 	bedata = dev_get_drvdata(&pvcalls_front_dev->dev);
839 
840 	if (map->passive.status != PVCALLS_STATUS_LISTEN) {
841 		pvcalls_exit_sock(sock);
842 		return -EINVAL;
843 	}
844 
845 	nonblock = arg->flags & SOCK_NONBLOCK;
846 	/*
847 	 * Backend only supports 1 inflight accept request, will return
848 	 * errors for the others
849 	 */
850 	if (test_and_set_bit(PVCALLS_FLAG_ACCEPT_INFLIGHT,
851 			     (void *)&map->passive.flags)) {
852 		req_id = READ_ONCE(map->passive.inflight_req_id);
853 		if (req_id != PVCALLS_INVALID_ID &&
854 		    READ_ONCE(bedata->rsp[req_id].req_id) == req_id) {
855 			map2 = map->passive.accept_map;
856 			goto received;
857 		}
858 		if (nonblock) {
859 			pvcalls_exit_sock(sock);
860 			return -EAGAIN;
861 		}
862 		if (wait_event_interruptible(map->passive.inflight_accept_req,
863 			!test_and_set_bit(PVCALLS_FLAG_ACCEPT_INFLIGHT,
864 					  (void *)&map->passive.flags))) {
865 			pvcalls_exit_sock(sock);
866 			return -EINTR;
867 		}
868 	}
869 
870 	if (READ_ONCE(bedata->disabled)) {
871 		clear_bit(PVCALLS_FLAG_ACCEPT_INFLIGHT,
872 			  (void *)&map->passive.flags);
873 		wake_up(&map->passive.inflight_accept_req);
874 		pvcalls_exit_sock(sock);
875 		return -EIO;
876 	}
877 
878 	map2 = kzalloc_obj(*map2);
879 	if (map2 == NULL) {
880 		clear_bit(PVCALLS_FLAG_ACCEPT_INFLIGHT,
881 			  (void *)&map->passive.flags);
882 		pvcalls_exit_sock(sock);
883 		return -ENOMEM;
884 	}
885 	ret = alloc_active_ring(map2);
886 	if (ret < 0) {
887 		clear_bit(PVCALLS_FLAG_ACCEPT_INFLIGHT,
888 				(void *)&map->passive.flags);
889 		kfree(map2);
890 		pvcalls_exit_sock(sock);
891 		return ret;
892 	}
893 	ret = create_active(map2, &evtchn);
894 	if (ret < 0) {
895 		free_active_ring(map2);
896 		kfree(map2);
897 		clear_bit(PVCALLS_FLAG_ACCEPT_INFLIGHT,
898 			  (void *)&map->passive.flags);
899 		pvcalls_exit_sock(sock);
900 		return ret;
901 	}
902 
903 	spin_lock(&bedata->socket_lock);
904 	ret = get_request(bedata, &req_id);
905 	if (ret < 0) {
906 		clear_bit(PVCALLS_FLAG_ACCEPT_INFLIGHT,
907 			  (void *)&map->passive.flags);
908 		spin_unlock(&bedata->socket_lock);
909 		pvcalls_front_free_map(bedata, map2);
910 		pvcalls_exit_sock(sock);
911 		return ret;
912 	}
913 
914 	list_add_tail(&map2->list, &bedata->socket_mappings);
915 
916 	req = RING_GET_REQUEST(&bedata->ring, req_id);
917 	req->req_id = req_id;
918 	req->cmd = PVCALLS_ACCEPT;
919 	req->u.accept.id = (uintptr_t) map;
920 	req->u.accept.ref = map2->active.ref;
921 	req->u.accept.id_new = (uintptr_t) map2;
922 	req->u.accept.evtchn = evtchn;
923 	map->passive.accept_map = map2;
924 
925 	bedata->ring.req_prod_pvt++;
926 	RING_PUSH_REQUESTS_AND_CHECK_NOTIFY(&bedata->ring, notify);
927 	spin_unlock(&bedata->socket_lock);
928 	if (notify)
929 		notify_remote_via_irq(bedata->irq);
930 	/* We could check if we have received a response before returning. */
931 	if (nonblock) {
932 		WRITE_ONCE(map->passive.inflight_req_id, req_id);
933 		pvcalls_exit_sock(sock);
934 		return -EAGAIN;
935 	}
936 
937 	if (wait_event_interruptible(bedata->inflight_req,
938 		READ_ONCE(bedata->rsp[req_id].req_id) == req_id ||
939 		READ_ONCE(bedata->disabled))) {
940 		pvcalls_exit_sock(sock);
941 		return -EINTR;
942 	}
943 	if (READ_ONCE(bedata->disabled)) {
944 		clear_bit(PVCALLS_FLAG_ACCEPT_INFLIGHT,
945 			  (void *)&map->passive.flags);
946 		wake_up(&map->passive.inflight_accept_req);
947 		pvcalls_exit_sock(sock);
948 		return -EIO;
949 	}
950 	/* read req_id, then the content */
951 	smp_rmb();
952 
953 received:
954 	map2->sock = newsock;
955 	newsock->sk = sk_alloc(sock_net(sock->sk), PF_INET, GFP_KERNEL, &pvcalls_proto, false);
956 	if (!newsock->sk) {
957 		bedata->rsp[req_id].req_id = PVCALLS_INVALID_ID;
958 		map->passive.inflight_req_id = PVCALLS_INVALID_ID;
959 		clear_bit(PVCALLS_FLAG_ACCEPT_INFLIGHT,
960 			  (void *)&map->passive.flags);
961 		pvcalls_front_free_map(bedata, map2);
962 		pvcalls_exit_sock(sock);
963 		return -ENOMEM;
964 	}
965 	newsock->sk->sk_send_head = (void *)map2;
966 
967 	ret = bedata->rsp[req_id].ret;
968 	bedata->rsp[req_id].req_id = PVCALLS_INVALID_ID;
969 	map->passive.inflight_req_id = PVCALLS_INVALID_ID;
970 
971 	clear_bit(PVCALLS_FLAG_ACCEPT_INFLIGHT, (void *)&map->passive.flags);
972 	wake_up(&map->passive.inflight_accept_req);
973 
974 	pvcalls_exit_sock(sock);
975 	return ret;
976 }
977 EXPORT_SYMBOL_GPL(pvcalls_front_accept);
978 
979 static __poll_t pvcalls_front_poll_passive(struct file *file,
980 					       struct pvcalls_bedata *bedata,
981 					       struct sock_mapping *map,
982 					       poll_table *wait)
983 {
984 	int notify, req_id, ret;
985 	struct xen_pvcalls_request *req;
986 
987 	if (test_bit(PVCALLS_FLAG_ACCEPT_INFLIGHT,
988 		     (void *)&map->passive.flags)) {
989 		uint32_t req_id = READ_ONCE(map->passive.inflight_req_id);
990 
991 		if (req_id != PVCALLS_INVALID_ID &&
992 		    READ_ONCE(bedata->rsp[req_id].req_id) == req_id)
993 			return EPOLLIN | EPOLLRDNORM;
994 
995 		poll_wait(file, &map->passive.inflight_accept_req, wait);
996 		return 0;
997 	}
998 
999 	if (test_and_clear_bit(PVCALLS_FLAG_POLL_RET,
1000 			       (void *)&map->passive.flags))
1001 		return EPOLLIN | EPOLLRDNORM;
1002 
1003 	/*
1004 	 * First check RET, then INFLIGHT. No barriers necessary to
1005 	 * ensure execution ordering because of the conditional
1006 	 * instructions creating control dependencies.
1007 	 */
1008 
1009 	if (test_and_set_bit(PVCALLS_FLAG_POLL_INFLIGHT,
1010 			     (void *)&map->passive.flags)) {
1011 		poll_wait(file, &bedata->inflight_req, wait);
1012 		return 0;
1013 	}
1014 
1015 	spin_lock(&bedata->socket_lock);
1016 	ret = get_request(bedata, &req_id);
1017 	if (ret < 0) {
1018 		spin_unlock(&bedata->socket_lock);
1019 		return ret;
1020 	}
1021 	req = RING_GET_REQUEST(&bedata->ring, req_id);
1022 	req->req_id = req_id;
1023 	req->cmd = PVCALLS_POLL;
1024 	req->u.poll.id = (uintptr_t) map;
1025 
1026 	bedata->ring.req_prod_pvt++;
1027 	RING_PUSH_REQUESTS_AND_CHECK_NOTIFY(&bedata->ring, notify);
1028 	spin_unlock(&bedata->socket_lock);
1029 	if (notify)
1030 		notify_remote_via_irq(bedata->irq);
1031 
1032 	poll_wait(file, &bedata->inflight_req, wait);
1033 	return 0;
1034 }
1035 
1036 static __poll_t pvcalls_front_poll_active(struct file *file,
1037 					      struct pvcalls_bedata *bedata,
1038 					      struct sock_mapping *map,
1039 					      poll_table *wait)
1040 {
1041 	__poll_t mask = 0;
1042 	int32_t in_error, out_error;
1043 	struct pvcalls_data_intf *intf = map->active.ring;
1044 
1045 	out_error = intf->out_error;
1046 	in_error = intf->in_error;
1047 
1048 	poll_wait(file, &map->active.inflight_conn_req, wait);
1049 	if (pvcalls_front_write_todo(map))
1050 		mask |= EPOLLOUT | EPOLLWRNORM;
1051 	if (pvcalls_front_read_todo(map))
1052 		mask |= EPOLLIN | EPOLLRDNORM;
1053 	if (in_error != 0 || out_error != 0)
1054 		mask |= EPOLLERR;
1055 
1056 	return mask;
1057 }
1058 
1059 __poll_t pvcalls_front_poll(struct file *file, struct socket *sock,
1060 			       poll_table *wait)
1061 {
1062 	struct pvcalls_bedata *bedata;
1063 	struct sock_mapping *map;
1064 	__poll_t ret;
1065 
1066 	map = pvcalls_enter_sock(sock);
1067 	if (IS_ERR(map))
1068 		return EPOLLNVAL;
1069 	bedata = dev_get_drvdata(&pvcalls_front_dev->dev);
1070 
1071 	if (map->active_socket)
1072 		ret = pvcalls_front_poll_active(file, bedata, map, wait);
1073 	else
1074 		ret = pvcalls_front_poll_passive(file, bedata, map, wait);
1075 	pvcalls_exit_sock(sock);
1076 	return ret;
1077 }
1078 EXPORT_SYMBOL_GPL(pvcalls_front_poll);
1079 
1080 int pvcalls_front_release(struct socket *sock)
1081 {
1082 	struct pvcalls_bedata *bedata;
1083 	struct sock_mapping *map;
1084 	int req_id, notify, ret;
1085 	struct xen_pvcalls_request *req;
1086 
1087 	if (sock->sk == NULL)
1088 		return 0;
1089 
1090 	map = pvcalls_enter_sock(sock);
1091 	if (IS_ERR(map)) {
1092 		if (PTR_ERR(map) == -ENOTCONN)
1093 			return -EIO;
1094 		else
1095 			return 0;
1096 	}
1097 	bedata = dev_get_drvdata(&pvcalls_front_dev->dev);
1098 
1099 	spin_lock(&bedata->socket_lock);
1100 	ret = get_request(bedata, &req_id);
1101 	if (ret < 0) {
1102 		spin_unlock(&bedata->socket_lock);
1103 		pvcalls_exit_sock(sock);
1104 		return ret;
1105 	}
1106 	sock->sk->sk_send_head = NULL;
1107 
1108 	req = RING_GET_REQUEST(&bedata->ring, req_id);
1109 	req->req_id = req_id;
1110 	req->cmd = PVCALLS_RELEASE;
1111 	req->u.release.id = (uintptr_t)map;
1112 
1113 	bedata->ring.req_prod_pvt++;
1114 	RING_PUSH_REQUESTS_AND_CHECK_NOTIFY(&bedata->ring, notify);
1115 	spin_unlock(&bedata->socket_lock);
1116 	if (notify)
1117 		notify_remote_via_irq(bedata->irq);
1118 
1119 	wait_event(bedata->inflight_req,
1120 		   READ_ONCE(bedata->rsp[req_id].req_id) == req_id ||
1121 		   READ_ONCE(bedata->disabled));
1122 
1123 	if (map->active_socket) {
1124 		/*
1125 		 * Set in_error and wake up inflight_conn_req to force
1126 		 * recvmsg waiters to exit.
1127 		 */
1128 		map->active.ring->in_error = -EBADF;
1129 		wake_up_interruptible(&map->active.inflight_conn_req);
1130 
1131 		/*
1132 		 * We need to make sure that sendmsg/recvmsg on this socket have
1133 		 * not started before we've cleared sk_send_head here. The
1134 		 * easiest way to guarantee this is to see that no pvcalls
1135 		 * (other than us) is in progress on this socket.
1136 		 */
1137 		while (atomic_read(&map->refcount) > 1)
1138 			cpu_relax();
1139 
1140 		pvcalls_front_free_map(bedata, map);
1141 	} else {
1142 		wake_up(&bedata->inflight_req);
1143 		wake_up(&map->passive.inflight_accept_req);
1144 
1145 		while (atomic_read(&map->refcount) > 1)
1146 			cpu_relax();
1147 
1148 		spin_lock(&bedata->socket_lock);
1149 		list_del(&map->list);
1150 		spin_unlock(&bedata->socket_lock);
1151 		if (READ_ONCE(map->passive.inflight_req_id) != PVCALLS_INVALID_ID &&
1152 			READ_ONCE(map->passive.inflight_req_id) != 0) {
1153 			pvcalls_front_free_map(bedata,
1154 					       map->passive.accept_map);
1155 		}
1156 		kfree(map);
1157 	}
1158 	WRITE_ONCE(bedata->rsp[req_id].req_id, PVCALLS_INVALID_ID);
1159 
1160 	pvcalls_exit();
1161 	return 0;
1162 }
1163 EXPORT_SYMBOL_GPL(pvcalls_front_release);
1164 
1165 static const struct xenbus_device_id pvcalls_front_ids[] = {
1166 	{ "pvcalls" },
1167 	{ "" }
1168 };
1169 
1170 static void pvcalls_front_remove(struct xenbus_device *dev)
1171 {
1172 	struct pvcalls_bedata *bedata;
1173 	struct sock_mapping *map = NULL, *n;
1174 
1175 	bedata = dev_get_drvdata(&pvcalls_front_dev->dev);
1176 	dev_set_drvdata(&dev->dev, NULL);
1177 	pvcalls_front_dev = NULL;
1178 	if (bedata->irq >= 0)
1179 		unbind_from_irqhandler(bedata->irq, dev);
1180 
1181 	list_for_each_entry_safe(map, n, &bedata->socket_mappings, list) {
1182 		map->sock->sk->sk_send_head = NULL;
1183 		if (map->active_socket) {
1184 			map->active.ring->in_error = -EBADF;
1185 			wake_up_interruptible(&map->active.inflight_conn_req);
1186 		}
1187 	}
1188 
1189 	smp_mb();
1190 	while (atomic_read(&pvcalls_refcount) > 0)
1191 		cpu_relax();
1192 	list_for_each_entry_safe(map, n, &bedata->socket_mappings, list) {
1193 		if (map->active_socket) {
1194 			/* No need to lock, refcount is 0 */
1195 			pvcalls_front_free_map(bedata, map);
1196 		} else {
1197 			list_del(&map->list);
1198 			kfree(map);
1199 		}
1200 	}
1201 	if (bedata->ref != -1)
1202 		gnttab_end_foreign_access(bedata->ref, NULL);
1203 	kfree(bedata->ring.sring);
1204 	kfree(bedata);
1205 	xenbus_switch_state(dev, XenbusStateClosed);
1206 }
1207 
1208 static int pvcalls_front_probe(struct xenbus_device *dev,
1209 			  const struct xenbus_device_id *id)
1210 {
1211 	int ret = -ENOMEM, i;
1212 	evtchn_port_t evtchn;
1213 	unsigned int max_page_order, function_calls, len;
1214 	char *versions;
1215 	grant_ref_t gref_head = 0;
1216 	struct xenbus_transaction xbt;
1217 	struct pvcalls_bedata *bedata = NULL;
1218 	struct xen_pvcalls_sring *sring;
1219 
1220 	if (pvcalls_front_dev != NULL) {
1221 		dev_err(&dev->dev, "only one PV Calls connection supported\n");
1222 		return -EINVAL;
1223 	}
1224 
1225 	versions = xenbus_read(XBT_NIL, dev->otherend, "versions", &len);
1226 	if (IS_ERR(versions))
1227 		return PTR_ERR(versions);
1228 	if (!len)
1229 		return -EINVAL;
1230 	if (strcmp(versions, "1")) {
1231 		kfree(versions);
1232 		return -EINVAL;
1233 	}
1234 	kfree(versions);
1235 	max_page_order = xenbus_read_unsigned(dev->otherend,
1236 					      "max-page-order", 0);
1237 	if (max_page_order < PVCALLS_RING_ORDER)
1238 		return -ENODEV;
1239 	function_calls = xenbus_read_unsigned(dev->otherend,
1240 					      "function-calls", 0);
1241 	/* See XENBUS_FUNCTIONS_CALLS in pvcalls.h */
1242 	if (function_calls != 1)
1243 		return -ENODEV;
1244 	pr_info("%s max-page-order is %u\n", __func__, max_page_order);
1245 
1246 	bedata = kzalloc_obj(struct pvcalls_bedata);
1247 	if (!bedata)
1248 		return -ENOMEM;
1249 
1250 	dev_set_drvdata(&dev->dev, bedata);
1251 	pvcalls_front_dev = dev;
1252 	init_waitqueue_head(&bedata->inflight_req);
1253 	INIT_LIST_HEAD(&bedata->socket_mappings);
1254 	spin_lock_init(&bedata->socket_lock);
1255 	bedata->irq = -1;
1256 	bedata->ref = -1;
1257 
1258 	for (i = 0; i < PVCALLS_NR_RSP_PER_RING; i++)
1259 		bedata->rsp[i].req_id = PVCALLS_INVALID_ID;
1260 
1261 	sring = (struct xen_pvcalls_sring *) __get_free_page(GFP_KERNEL |
1262 							     __GFP_ZERO);
1263 	if (!sring)
1264 		goto error;
1265 	SHARED_RING_INIT(sring);
1266 	FRONT_RING_INIT(&bedata->ring, sring, XEN_PAGE_SIZE);
1267 
1268 	ret = xenbus_alloc_evtchn(dev, &evtchn);
1269 	if (ret)
1270 		goto error;
1271 
1272 	bedata->irq = bind_evtchn_to_irqhandler(evtchn,
1273 						pvcalls_front_event_handler,
1274 						0, "pvcalls-frontend", dev);
1275 	if (bedata->irq < 0) {
1276 		ret = bedata->irq;
1277 		goto error;
1278 	}
1279 
1280 	ret = gnttab_alloc_grant_references(1, &gref_head);
1281 	if (ret < 0)
1282 		goto error;
1283 	ret = gnttab_claim_grant_reference(&gref_head);
1284 	if (ret < 0)
1285 		goto error;
1286 	bedata->ref = ret;
1287 	gnttab_grant_foreign_access_ref(bedata->ref, dev->otherend_id,
1288 					virt_to_gfn((void *)sring), 0);
1289 
1290  again:
1291 	ret = xenbus_transaction_start(&xbt);
1292 	if (ret) {
1293 		xenbus_dev_fatal(dev, ret, "starting transaction");
1294 		goto error;
1295 	}
1296 	ret = xenbus_printf(xbt, dev->nodename, "version", "%u", 1);
1297 	if (ret)
1298 		goto error_xenbus;
1299 	ret = xenbus_printf(xbt, dev->nodename, "ring-ref", "%d", bedata->ref);
1300 	if (ret)
1301 		goto error_xenbus;
1302 	ret = xenbus_printf(xbt, dev->nodename, "port", "%u",
1303 			    evtchn);
1304 	if (ret)
1305 		goto error_xenbus;
1306 	ret = xenbus_transaction_end(xbt, 0);
1307 	if (ret) {
1308 		if (ret == -EAGAIN)
1309 			goto again;
1310 		xenbus_dev_fatal(dev, ret, "completing transaction");
1311 		goto error;
1312 	}
1313 	xenbus_switch_state(dev, XenbusStateInitialised);
1314 
1315 	return 0;
1316 
1317  error_xenbus:
1318 	xenbus_transaction_end(xbt, 1);
1319 	xenbus_dev_fatal(dev, ret, "writing xenstore");
1320  error:
1321 	pvcalls_front_remove(dev);
1322 	return ret;
1323 }
1324 
1325 static void pvcalls_front_changed(struct xenbus_device *dev,
1326 			    enum xenbus_state backend_state)
1327 {
1328 	switch (backend_state) {
1329 	case XenbusStateReconfiguring:
1330 	case XenbusStateReconfigured:
1331 	case XenbusStateInitialising:
1332 	case XenbusStateInitialised:
1333 	case XenbusStateUnknown:
1334 		break;
1335 
1336 	case XenbusStateInitWait:
1337 		break;
1338 
1339 	case XenbusStateConnected:
1340 		xenbus_switch_state(dev, XenbusStateConnected);
1341 		break;
1342 
1343 	case XenbusStateClosed:
1344 		if (dev->state == XenbusStateClosed)
1345 			break;
1346 		/* Missed the backend's CLOSING state */
1347 		fallthrough;
1348 	case XenbusStateClosing:
1349 		xenbus_frontend_closed(dev);
1350 		break;
1351 	}
1352 }
1353 
1354 static struct xenbus_driver pvcalls_front_driver = {
1355 	.ids = pvcalls_front_ids,
1356 	.probe = pvcalls_front_probe,
1357 	.remove = pvcalls_front_remove,
1358 	.otherend_changed = pvcalls_front_changed,
1359 	.not_essential = true,
1360 };
1361 
1362 static int __init pvcalls_frontend_init(void)
1363 {
1364 	if (!xen_domain())
1365 		return -ENODEV;
1366 
1367 	pr_info("Initialising Xen pvcalls frontend driver\n");
1368 
1369 	return xenbus_register_frontend(&pvcalls_front_driver);
1370 }
1371 
1372 module_init(pvcalls_frontend_init);
1373 
1374 MODULE_DESCRIPTION("Xen PV Calls frontend driver");
1375 MODULE_AUTHOR("Stefano Stabellini <sstabellini@kernel.org>");
1376 MODULE_LICENSE("GPL");
1377