af_vsock.c

   1// SPDX-License-Identifier: GPL-2.0-only
   2/*
   3 * VMware vSockets Driver
   4 *
   5 * Copyright (C) 2007-2013 VMware, Inc. All rights reserved.
   6 */
   7
   8/* Implementation notes:
   9 *
  10 * - There are two kinds of sockets: those created by user action (such as
  11 * calling socket(2)) and those created by incoming connection request packets.
  12 *
  13 * - There are two "global" tables, one for bound sockets (sockets that have
  14 * specified an address that they are responsible for) and one for connected
  15 * sockets (sockets that have established a connection with another socket).
  16 * These tables are "global" in that all sockets on the system are placed
  17 * within them. - Note, though, that the bound table contains an extra entry
  18 * for a list of unbound sockets and SOCK_DGRAM sockets will always remain in
  19 * that list. The bound table is used solely for lookup of sockets when packets
  20 * are received and that's not necessary for SOCK_DGRAM sockets since we create
  21 * a datagram handle for each and need not perform a lookup.  Keeping SOCK_DGRAM
  22 * sockets out of the bound hash buckets will reduce the chance of collisions
  23 * when looking for SOCK_STREAM sockets and prevents us from having to check the
  24 * socket type in the hash table lookups.
  25 *
  26 * - Sockets created by user action will either be "client" sockets that
  27 * initiate a connection or "server" sockets that listen for connections; we do
  28 * not support simultaneous connects (two "client" sockets connecting).
  29 *
  30 * - "Server" sockets are referred to as listener sockets throughout this
  31 * implementation because they are in the TCP_LISTEN state.  When a
  32 * connection request is received (the second kind of socket mentioned above),
  33 * we create a new socket and refer to it as a pending socket.  These pending
  34 * sockets are placed on the pending connection list of the listener socket.
  35 * When future packets are received for the address the listener socket is
  36 * bound to, we check if the source of the packet is from one that has an
  37 * existing pending connection.  If it does, we process the packet for the
  38 * pending socket.  When that socket reaches the connected state, it is removed
  39 * from the listener socket's pending list and enqueued in the listener
  40 * socket's accept queue.  Callers of accept(2) will accept connected sockets
  41 * from the listener socket's accept queue.  If the socket cannot be accepted
  42 * for some reason then it is marked rejected.  Once the connection is
  43 * accepted, it is owned by the user process and the responsibility for cleanup
  44 * falls with that user process.
  45 *
  46 * - It is possible that these pending sockets will never reach the connected
  47 * state; in fact, we may never receive another packet after the connection
  48 * request.  Because of this, we must schedule a cleanup function to run in the
  49 * future, after some amount of time passes where a connection should have been
  50 * established.  This function ensures that the socket is off all lists so it
  51 * cannot be retrieved, then drops all references to the socket so it is cleaned
  52 * up (sock_put() -> sk_free() -> our sk_destruct implementation).  Note this
  53 * function will also cleanup rejected sockets, those that reach the connected
  54 * state but leave it before they have been accepted.
  55 *
  56 * - Lock ordering for pending or accept queue sockets is:
  57 *
  58 *     lock_sock(listener);
  59 *     lock_sock_nested(pending, SINGLE_DEPTH_NESTING);
  60 *
  61 * Using explicit nested locking keeps lockdep happy since normally only one
  62 * lock of a given class may be taken at a time.
  63 *
  64 * - Sockets created by user action will be cleaned up when the user process
  65 * calls close(2), causing our release implementation to be called. Our release
  66 * implementation will perform some cleanup then drop the last reference so our
  67 * sk_destruct implementation is invoked.  Our sk_destruct implementation will
  68 * perform additional cleanup that's common for both types of sockets.
  69 *
  70 * - A socket's reference count is what ensures that the structure won't be
  71 * freed.  Each entry in a list (such as the "global" bound and connected tables
  72 * and the listener socket's pending list and connected queue) ensures a
  73 * reference.  When we defer work until process context and pass a socket as our
  74 * argument, we must ensure the reference count is increased to ensure the
  75 * socket isn't freed before the function is run; the deferred function will
  76 * then drop the reference.
  77 *
  78 * - sk->sk_state uses the TCP state constants because they are widely used by
  79 * other address families and exposed to userspace tools like ss(8):
  80 *
  81 *   TCP_CLOSE - unconnected
  82 *   TCP_SYN_SENT - connecting
  83 *   TCP_ESTABLISHED - connected
  84 *   TCP_CLOSING - disconnecting
  85 *   TCP_LISTEN - listening
  86 */
  87
  88#include <linux/compat.h>
  89#include <linux/types.h>
  90#include <linux/bitops.h>
  91#include <linux/cred.h>
  92#include <linux/errqueue.h>
  93#include <linux/init.h>
  94#include <linux/io.h>
  95#include <linux/kernel.h>
  96#include <linux/sched/signal.h>
  97#include <linux/kmod.h>
  98#include <linux/list.h>
  99#include <linux/miscdevice.h>
 100#include <linux/module.h>
 101#include <linux/mutex.h>
 102#include <linux/net.h>
 103#include <linux/poll.h>
 104#include <linux/random.h>
 105#include <linux/skbuff.h>
 106#include <linux/smp.h>
 107#include <linux/socket.h>
 108#include <linux/stddef.h>
 109#include <linux/unistd.h>
 110#include <linux/wait.h>
 111#include <linux/workqueue.h>
 112#include <net/sock.h>
 113#include <net/af_vsock.h>
 114#include <uapi/linux/vm_sockets.h>
 115#include <uapi/asm-generic/ioctls.h>
 116
 117static int __vsock_bind(struct sock *sk, struct sockaddr_vm *addr);
 118static void vsock_sk_destruct(struct sock *sk);
 119static int vsock_queue_rcv_skb(struct sock *sk, struct sk_buff *skb);
 120static void vsock_close(struct sock *sk, long timeout);
 121
 122/* Protocol family. */
 123struct proto vsock_proto = {
 124	.name = "AF_VSOCK",
 125	.owner = THIS_MODULE,
 126	.obj_size = sizeof(struct vsock_sock),
 127	.close = vsock_close,
 128#ifdef CONFIG_BPF_SYSCALL
 129	.psock_update_sk_prot = vsock_bpf_update_proto,
 130#endif
 131};
 132
 133/* The default peer timeout indicates how long we will wait for a peer response
 134 * to a control message.
 135 */
 136#define VSOCK_DEFAULT_CONNECT_TIMEOUT (2 * HZ)
 137
 138#define VSOCK_DEFAULT_BUFFER_SIZE     (1024 * 256)
 139#define VSOCK_DEFAULT_BUFFER_MAX_SIZE (1024 * 256)
 140#define VSOCK_DEFAULT_BUFFER_MIN_SIZE 128
 141
 142/* Transport used for host->guest communication */
 143static const struct vsock_transport *transport_h2g;
 144/* Transport used for guest->host communication */
 145static const struct vsock_transport *transport_g2h;
 146/* Transport used for DGRAM communication */
 147static const struct vsock_transport *transport_dgram;
 148/* Transport used for local communication */
 149static const struct vsock_transport *transport_local;
 150static DEFINE_MUTEX(vsock_register_mutex);
 151
 152/**** UTILS ****/
 153
 154/* Each bound VSocket is stored in the bind hash table and each connected
 155 * VSocket is stored in the connected hash table.
 156 *
 157 * Unbound sockets are all put on the same list attached to the end of the hash
 158 * table (vsock_unbound_sockets).  Bound sockets are added to the hash table in
 159 * the bucket that their local address hashes to (vsock_bound_sockets(addr)
 160 * represents the list that addr hashes to).
 161 *
 162 * Specifically, we initialize the vsock_bind_table array to a size of
 163 * VSOCK_HASH_SIZE + 1 so that vsock_bind_table[0] through
 164 * vsock_bind_table[VSOCK_HASH_SIZE - 1] are for bound sockets and
 165 * vsock_bind_table[VSOCK_HASH_SIZE] is for unbound sockets.  The hash function
 166 * mods with VSOCK_HASH_SIZE to ensure this.
 167 */
 168#define MAX_PORT_RETRIES        24
 169
 170#define VSOCK_HASH(addr)        ((addr)->svm_port % VSOCK_HASH_SIZE)
 171#define vsock_bound_sockets(addr) (&vsock_bind_table[VSOCK_HASH(addr)])
 172#define vsock_unbound_sockets     (&vsock_bind_table[VSOCK_HASH_SIZE])
 173
 174/* XXX This can probably be implemented in a better way. */
 175#define VSOCK_CONN_HASH(src, dst)				\
 176	(((src)->svm_cid ^ (dst)->svm_port) % VSOCK_HASH_SIZE)
 177#define vsock_connected_sockets(src, dst)		\
 178	(&vsock_connected_table[VSOCK_CONN_HASH(src, dst)])
 179#define vsock_connected_sockets_vsk(vsk)				\
 180	vsock_connected_sockets(&(vsk)->remote_addr, &(vsk)->local_addr)
 181
 182struct list_head vsock_bind_table[VSOCK_HASH_SIZE + 1];
 183EXPORT_SYMBOL_GPL(vsock_bind_table);
 184struct list_head vsock_connected_table[VSOCK_HASH_SIZE];
 185EXPORT_SYMBOL_GPL(vsock_connected_table);
 186DEFINE_SPINLOCK(vsock_table_lock);
 187EXPORT_SYMBOL_GPL(vsock_table_lock);
 188
 189/* Autobind this socket to the local address if necessary. */
 190static int vsock_auto_bind(struct vsock_sock *vsk)
 191{
 192	struct sock *sk = sk_vsock(vsk);
 193	struct sockaddr_vm local_addr;
 194
 195	if (vsock_addr_bound(&vsk->local_addr))
 196		return 0;
 197	vsock_addr_init(&local_addr, VMADDR_CID_ANY, VMADDR_PORT_ANY);
 198	return __vsock_bind(sk, &local_addr);
 199}
 200
 201static void vsock_init_tables(void)
 202{
 203	int i;
 204
 205	for (i = 0; i < ARRAY_SIZE(vsock_bind_table); i++)
 206		INIT_LIST_HEAD(&vsock_bind_table[i]);
 207
 208	for (i = 0; i < ARRAY_SIZE(vsock_connected_table); i++)
 209		INIT_LIST_HEAD(&vsock_connected_table[i]);
 210}
 211
 212static void __vsock_insert_bound(struct list_head *list,
 213				 struct vsock_sock *vsk)
 214{
 215	sock_hold(&vsk->sk);
 216	list_add(&vsk->bound_table, list);
 217}
 218
 219static void __vsock_insert_connected(struct list_head *list,
 220				     struct vsock_sock *vsk)
 221{
 222	sock_hold(&vsk->sk);
 223	list_add(&vsk->connected_table, list);
 224}
 225
 226static void __vsock_remove_bound(struct vsock_sock *vsk)
 227{
 228	list_del_init(&vsk->bound_table);
 229	sock_put(&vsk->sk);
 230}
 231
 232static void __vsock_remove_connected(struct vsock_sock *vsk)
 233{
 234	list_del_init(&vsk->connected_table);
 235	sock_put(&vsk->sk);
 236}
 237
 238static struct sock *__vsock_find_bound_socket(struct sockaddr_vm *addr)
 239{
 240	struct vsock_sock *vsk;
 241
 242	list_for_each_entry(vsk, vsock_bound_sockets(addr), bound_table) {
 243		if (vsock_addr_equals_addr(addr, &vsk->local_addr))
 244			return sk_vsock(vsk);
 245
 246		if (addr->svm_port == vsk->local_addr.svm_port &&
 247		    (vsk->local_addr.svm_cid == VMADDR_CID_ANY ||
 248		     addr->svm_cid == VMADDR_CID_ANY))
 249			return sk_vsock(vsk);
 250	}
 251
 252	return NULL;
 253}
 254
 255static struct sock *__vsock_find_connected_socket(struct sockaddr_vm *src,
 256						  struct sockaddr_vm *dst)
 257{
 258	struct vsock_sock *vsk;
 259
 260	list_for_each_entry(vsk, vsock_connected_sockets(src, dst),
 261			    connected_table) {
 262		if (vsock_addr_equals_addr(src, &vsk->remote_addr) &&
 263		    dst->svm_port == vsk->local_addr.svm_port) {
 264			return sk_vsock(vsk);
 265		}
 266	}
 267
 268	return NULL;
 269}
 270
 271static void vsock_insert_unbound(struct vsock_sock *vsk)
 272{
 273	spin_lock_bh(&vsock_table_lock);
 274	__vsock_insert_bound(vsock_unbound_sockets, vsk);
 275	spin_unlock_bh(&vsock_table_lock);
 276}
 277
 278void vsock_insert_connected(struct vsock_sock *vsk)
 279{
 280	struct list_head *list = vsock_connected_sockets(
 281		&vsk->remote_addr, &vsk->local_addr);
 282
 283	spin_lock_bh(&vsock_table_lock);
 284	__vsock_insert_connected(list, vsk);
 285	spin_unlock_bh(&vsock_table_lock);
 286}
 287EXPORT_SYMBOL_GPL(vsock_insert_connected);
 288
 289void vsock_remove_bound(struct vsock_sock *vsk)
 290{
 291	spin_lock_bh(&vsock_table_lock);
 292	if (__vsock_in_bound_table(vsk))
 293		__vsock_remove_bound(vsk);
 294	spin_unlock_bh(&vsock_table_lock);
 295}
 296EXPORT_SYMBOL_GPL(vsock_remove_bound);
 297
 298void vsock_remove_connected(struct vsock_sock *vsk)
 299{
 300	spin_lock_bh(&vsock_table_lock);
 301	if (__vsock_in_connected_table(vsk))
 302		__vsock_remove_connected(vsk);
 303	spin_unlock_bh(&vsock_table_lock);
 304}
 305EXPORT_SYMBOL_GPL(vsock_remove_connected);
 306
 307struct sock *vsock_find_bound_socket(struct sockaddr_vm *addr)
 308{
 309	struct sock *sk;
 310
 311	spin_lock_bh(&vsock_table_lock);
 312	sk = __vsock_find_bound_socket(addr);
 313	if (sk)
 314		sock_hold(sk);
 315
 316	spin_unlock_bh(&vsock_table_lock);
 317
 318	return sk;
 319}
 320EXPORT_SYMBOL_GPL(vsock_find_bound_socket);
 321
 322struct sock *vsock_find_connected_socket(struct sockaddr_vm *src,
 323					 struct sockaddr_vm *dst)
 324{
 325	struct sock *sk;
 326
 327	spin_lock_bh(&vsock_table_lock);
 328	sk = __vsock_find_connected_socket(src, dst);
 329	if (sk)
 330		sock_hold(sk);
 331
 332	spin_unlock_bh(&vsock_table_lock);
 333
 334	return sk;
 335}
 336EXPORT_SYMBOL_GPL(vsock_find_connected_socket);
 337
 338void vsock_remove_sock(struct vsock_sock *vsk)
 339{
 340	/* Transport reassignment must not remove the binding. */
 341	if (sock_flag(sk_vsock(vsk), SOCK_DEAD))
 342		vsock_remove_bound(vsk);
 343
 344	vsock_remove_connected(vsk);
 345}
 346EXPORT_SYMBOL_GPL(vsock_remove_sock);
 347
 348void vsock_for_each_connected_socket(struct vsock_transport *transport,
 349				     void (*fn)(struct sock *sk))
 350{
 351	int i;
 352
 353	spin_lock_bh(&vsock_table_lock);
 354
 355	for (i = 0; i < ARRAY_SIZE(vsock_connected_table); i++) {
 356		struct vsock_sock *vsk;
 357		list_for_each_entry(vsk, &vsock_connected_table[i],
 358				    connected_table) {
 359			if (vsk->transport != transport)
 360				continue;
 361
 362			fn(sk_vsock(vsk));
 363		}
 364	}
 365
 366	spin_unlock_bh(&vsock_table_lock);
 367}
 368EXPORT_SYMBOL_GPL(vsock_for_each_connected_socket);
 369
 370void vsock_add_pending(struct sock *listener, struct sock *pending)
 371{
 372	struct vsock_sock *vlistener;
 373	struct vsock_sock *vpending;
 374
 375	vlistener = vsock_sk(listener);
 376	vpending = vsock_sk(pending);
 377
 378	sock_hold(pending);
 379	sock_hold(listener);
 380	list_add_tail(&vpending->pending_links, &vlistener->pending_links);
 381}
 382EXPORT_SYMBOL_GPL(vsock_add_pending);
 383
 384void vsock_remove_pending(struct sock *listener, struct sock *pending)
 385{
 386	struct vsock_sock *vpending = vsock_sk(pending);
 387
 388	list_del_init(&vpending->pending_links);
 389	sock_put(listener);
 390	sock_put(pending);
 391}
 392EXPORT_SYMBOL_GPL(vsock_remove_pending);
 393
 394void vsock_enqueue_accept(struct sock *listener, struct sock *connected)
 395{
 396	struct vsock_sock *vlistener;
 397	struct vsock_sock *vconnected;
 398
 399	vlistener = vsock_sk(listener);
 400	vconnected = vsock_sk(connected);
 401
 402	sock_hold(connected);
 403	sock_hold(listener);
 404	list_add_tail(&vconnected->accept_queue, &vlistener->accept_queue);
 405}
 406EXPORT_SYMBOL_GPL(vsock_enqueue_accept);
 407
 408static bool vsock_use_local_transport(unsigned int remote_cid)
 409{
 410	lockdep_assert_held(&vsock_register_mutex);
 411
 412	if (!transport_local)
 413		return false;
 414
 415	if (remote_cid == VMADDR_CID_LOCAL)
 416		return true;
 417
 418	if (transport_g2h) {
 419		return remote_cid == transport_g2h->get_local_cid();
 420	} else {
 421		return remote_cid == VMADDR_CID_HOST;
 422	}
 423}
 424
 425static void vsock_deassign_transport(struct vsock_sock *vsk)
 426{
 427	if (!vsk->transport)
 428		return;
 429
 430	vsk->transport->destruct(vsk);
 431	module_put(vsk->transport->module);
 432	vsk->transport = NULL;
 433}
 434
 435/* Assign a transport to a socket and call the .init transport callback.
 436 *
 437 * Note: for connection oriented socket this must be called when vsk->remote_addr
 438 * is set (e.g. during the connect() or when a connection request on a listener
 439 * socket is received).
 440 * The vsk->remote_addr is used to decide which transport to use:
 441 *  - remote CID == VMADDR_CID_LOCAL or g2h->local_cid or VMADDR_CID_HOST if
 442 *    g2h is not loaded, will use local transport;
 443 *  - remote CID <= VMADDR_CID_HOST or h2g is not loaded or remote flags field
 444 *    includes VMADDR_FLAG_TO_HOST flag value, will use guest->host transport;
 445 *  - remote CID > VMADDR_CID_HOST will use host->guest transport;
 446 */
 447int vsock_assign_transport(struct vsock_sock *vsk, struct vsock_sock *psk)
 448{
 449	const struct vsock_transport *new_transport;
 450	struct sock *sk = sk_vsock(vsk);
 451	unsigned int remote_cid = vsk->remote_addr.svm_cid;
 452	__u8 remote_flags;
 453	int ret;
 454
 455	/* If the packet is coming with the source and destination CIDs higher
 456	 * than VMADDR_CID_HOST, then a vsock channel where all the packets are
 457	 * forwarded to the host should be established. Then the host will
 458	 * need to forward the packets to the guest.
 459	 *
 460	 * The flag is set on the (listen) receive path (psk is not NULL). On
 461	 * the connect path the flag can be set by the user space application.
 462	 */
 463	if (psk && vsk->local_addr.svm_cid > VMADDR_CID_HOST &&
 464	    vsk->remote_addr.svm_cid > VMADDR_CID_HOST)
 465		vsk->remote_addr.svm_flags |= VMADDR_FLAG_TO_HOST;
 466
 467	remote_flags = vsk->remote_addr.svm_flags;
 468
 469	mutex_lock(&vsock_register_mutex);
 470
 471	switch (sk->sk_type) {
 472	case SOCK_DGRAM:
 473		new_transport = transport_dgram;
 474		break;
 475	case SOCK_STREAM:
 476	case SOCK_SEQPACKET:
 477		if (vsock_use_local_transport(remote_cid))
 478			new_transport = transport_local;
 479		else if (remote_cid <= VMADDR_CID_HOST || !transport_h2g ||
 480			 (remote_flags & VMADDR_FLAG_TO_HOST))
 481			new_transport = transport_g2h;
 482		else
 483			new_transport = transport_h2g;
 484		break;
 485	default:
 486		ret = -ESOCKTNOSUPPORT;
 487		goto err;
 488	}
 489
 490	if (vsk->transport && vsk->transport == new_transport) {
 491		ret = 0;
 492		goto err;
 493	}
 494
 495	/* We increase the module refcnt to prevent the transport unloading
 496	 * while there are open sockets assigned to it.
 497	 */
 498	if (!new_transport || !try_module_get(new_transport->module)) {
 499		ret = -ENODEV;
 500		goto err;
 501	}
 502
 503	/* It's safe to release the mutex after a successful try_module_get().
 504	 * Whichever transport `new_transport` points at, it won't go away until
 505	 * the last module_put() below or in vsock_deassign_transport().
 506	 */
 507	mutex_unlock(&vsock_register_mutex);
 508
 509	if (vsk->transport) {
 510		/* transport->release() must be called with sock lock acquired.
 511		 * This path can only be taken during vsock_connect(), where we
 512		 * have already held the sock lock. In the other cases, this
 513		 * function is called on a new socket which is not assigned to
 514		 * any transport.
 515		 */
 516		vsk->transport->release(vsk);
 517		vsock_deassign_transport(vsk);
 518
 519		/* transport's release() and destruct() can touch some socket
 520		 * state, since we are reassigning the socket to a new transport
 521		 * during vsock_connect(), let's reset these fields to have a
 522		 * clean state.
 523		 */
 524		sock_reset_flag(sk, SOCK_DONE);
 525		sk->sk_state = TCP_CLOSE;
 526		vsk->peer_shutdown = 0;
 527	}
 528
 529	if (sk->sk_type == SOCK_SEQPACKET) {
 530		if (!new_transport->seqpacket_allow ||
 531		    !new_transport->seqpacket_allow(remote_cid)) {
 532			module_put(new_transport->module);
 533			return -ESOCKTNOSUPPORT;
 534		}
 535	}
 536
 537	ret = new_transport->init(vsk, psk);
 538	if (ret) {
 539		module_put(new_transport->module);
 540		return ret;
 541	}
 542
 543	vsk->transport = new_transport;
 544
 545	return 0;
 546err:
 547	mutex_unlock(&vsock_register_mutex);
 548	return ret;
 549}
 550EXPORT_SYMBOL_GPL(vsock_assign_transport);
 551
 552/*
 553 * Provide safe access to static transport_{h2g,g2h,dgram,local} callbacks.
 554 * Otherwise we may race with module removal. Do not use on `vsk->transport`.
 555 */
 556static u32 vsock_registered_transport_cid(const struct vsock_transport **transport)
 557{
 558	u32 cid = VMADDR_CID_ANY;
 559
 560	mutex_lock(&vsock_register_mutex);
 561	if (*transport)
 562		cid = (*transport)->get_local_cid();
 563	mutex_unlock(&vsock_register_mutex);
 564
 565	return cid;
 566}
 567
 568bool vsock_find_cid(unsigned int cid)
 569{
 570	if (cid == vsock_registered_transport_cid(&transport_g2h))
 571		return true;
 572
 573	if (transport_h2g && cid == VMADDR_CID_HOST)
 574		return true;
 575
 576	if (transport_local && cid == VMADDR_CID_LOCAL)
 577		return true;
 578
 579	return false;
 580}
 581EXPORT_SYMBOL_GPL(vsock_find_cid);
 582
 583static struct sock *vsock_dequeue_accept(struct sock *listener)
 584{
 585	struct vsock_sock *vlistener;
 586	struct vsock_sock *vconnected;
 587
 588	vlistener = vsock_sk(listener);
 589
 590	if (list_empty(&vlistener->accept_queue))
 591		return NULL;
 592
 593	vconnected = list_entry(vlistener->accept_queue.next,
 594				struct vsock_sock, accept_queue);
 595
 596	list_del_init(&vconnected->accept_queue);
 597	sock_put(listener);
 598	/* The caller will need a reference on the connected socket so we let
 599	 * it call sock_put().
 600	 */
 601
 602	return sk_vsock(vconnected);
 603}
 604
 605static bool vsock_is_accept_queue_empty(struct sock *sk)
 606{
 607	struct vsock_sock *vsk = vsock_sk(sk);
 608	return list_empty(&vsk->accept_queue);
 609}
 610
 611static bool vsock_is_pending(struct sock *sk)
 612{
 613	struct vsock_sock *vsk = vsock_sk(sk);
 614	return !list_empty(&vsk->pending_links);
 615}
 616
 617static int vsock_send_shutdown(struct sock *sk, int mode)
 618{
 619	struct vsock_sock *vsk = vsock_sk(sk);
 620
 621	if (!vsk->transport)
 622		return -ENODEV;
 623
 624	return vsk->transport->shutdown(vsk, mode);
 625}
 626
 627static void vsock_pending_work(struct work_struct *work)
 628{
 629	struct sock *sk;
 630	struct sock *listener;
 631	struct vsock_sock *vsk;
 632	bool cleanup;
 633
 634	vsk = container_of(work, struct vsock_sock, pending_work.work);
 635	sk = sk_vsock(vsk);
 636	listener = vsk->listener;
 637	cleanup = true;
 638
 639	lock_sock(listener);
 640	lock_sock_nested(sk, SINGLE_DEPTH_NESTING);
 641
 642	if (vsock_is_pending(sk)) {
 643		vsock_remove_pending(listener, sk);
 644
 645		sk_acceptq_removed(listener);
 646	} else if (!vsk->rejected) {
 647		/* We are not on the pending list and accept() did not reject
 648		 * us, so we must have been accepted by our user process.  We
 649		 * just need to drop our references to the sockets and be on
 650		 * our way.
 651		 */
 652		cleanup = false;
 653		goto out;
 654	}
 655
 656	/* We need to remove ourself from the global connected sockets list so
 657	 * incoming packets can't find this socket, and to reduce the reference
 658	 * count.
 659	 */
 660	vsock_remove_connected(vsk);
 661
 662	sk->sk_state = TCP_CLOSE;
 663
 664out:
 665	release_sock(sk);
 666	release_sock(listener);
 667	if (cleanup)
 668		sock_put(sk);
 669
 670	sock_put(sk);
 671	sock_put(listener);
 672}
 673
 674/**** SOCKET OPERATIONS ****/
 675
 676static int __vsock_bind_connectible(struct vsock_sock *vsk,
 677				    struct sockaddr_vm *addr)
 678{
 679	static u32 port;
 680	struct sockaddr_vm new_addr;
 681
 682	if (!port)
 683		port = get_random_u32_above(LAST_RESERVED_PORT);
 684
 685	vsock_addr_init(&new_addr, addr->svm_cid, addr->svm_port);
 686
 687	if (addr->svm_port == VMADDR_PORT_ANY) {
 688		bool found = false;
 689		unsigned int i;
 690
 691		for (i = 0; i < MAX_PORT_RETRIES; i++) {
 692			if (port == VMADDR_PORT_ANY ||
 693			    port <= LAST_RESERVED_PORT)
 694				port = LAST_RESERVED_PORT + 1;
 695
 696			new_addr.svm_port = port++;
 697
 698			if (!__vsock_find_bound_socket(&new_addr)) {
 699				found = true;
 700				break;
 701			}
 702		}
 703
 704		if (!found)
 705			return -EADDRNOTAVAIL;
 706	} else {
 707		/* If port is in reserved range, ensure caller
 708		 * has necessary privileges.
 709		 */
 710		if (addr->svm_port <= LAST_RESERVED_PORT &&
 711		    !capable(CAP_NET_BIND_SERVICE)) {
 712			return -EACCES;
 713		}
 714
 715		if (__vsock_find_bound_socket(&new_addr))
 716			return -EADDRINUSE;
 717	}
 718
 719	vsock_addr_init(&vsk->local_addr, new_addr.svm_cid, new_addr.svm_port);
 720
 721	/* Remove connection oriented sockets from the unbound list and add them
 722	 * to the hash table for easy lookup by its address.  The unbound list
 723	 * is simply an extra entry at the end of the hash table, a trick used
 724	 * by AF_UNIX.
 725	 */
 726	__vsock_remove_bound(vsk);
 727	__vsock_insert_bound(vsock_bound_sockets(&vsk->local_addr), vsk);
 728
 729	return 0;
 730}
 731
 732static int __vsock_bind_dgram(struct vsock_sock *vsk,
 733			      struct sockaddr_vm *addr)
 734{
 735	return vsk->transport->dgram_bind(vsk, addr);
 736}
 737
 738static int __vsock_bind(struct sock *sk, struct sockaddr_vm *addr)
 739{
 740	struct vsock_sock *vsk = vsock_sk(sk);
 741	int retval;
 742
 743	/* First ensure this socket isn't already bound. */
 744	if (vsock_addr_bound(&vsk->local_addr))
 745		return -EINVAL;
 746
 747	/* Now bind to the provided address or select appropriate values if
 748	 * none are provided (VMADDR_CID_ANY and VMADDR_PORT_ANY).  Note that
 749	 * like AF_INET prevents binding to a non-local IP address (in most
 750	 * cases), we only allow binding to a local CID.
 751	 */
 752	if (addr->svm_cid != VMADDR_CID_ANY && !vsock_find_cid(addr->svm_cid))
 753		return -EADDRNOTAVAIL;
 754
 755	switch (sk->sk_socket->type) {
 756	case SOCK_STREAM:
 757	case SOCK_SEQPACKET:
 758		spin_lock_bh(&vsock_table_lock);
 759		retval = __vsock_bind_connectible(vsk, addr);
 760		spin_unlock_bh(&vsock_table_lock);
 761		break;
 762
 763	case SOCK_DGRAM:
 764		retval = __vsock_bind_dgram(vsk, addr);
 765		break;
 766
 767	default:
 768		retval = -EINVAL;
 769		break;
 770	}
 771
 772	return retval;
 773}
 774
 775static void vsock_connect_timeout(struct work_struct *work);
 776
 777static struct sock *__vsock_create(struct net *net,
 778				   struct socket *sock,
 779				   struct sock *parent,
 780				   gfp_t priority,
 781				   unsigned short type,
 782				   int kern)
 783{
 784	struct sock *sk;
 785	struct vsock_sock *psk;
 786	struct vsock_sock *vsk;
 787
 788	sk = sk_alloc(net, AF_VSOCK, priority, &vsock_proto, kern);
 789	if (!sk)
 790		return NULL;
 791
 792	sock_init_data(sock, sk);
 793
 794	/* sk->sk_type is normally set in sock_init_data, but only if sock is
 795	 * non-NULL. We make sure that our sockets always have a type by
 796	 * setting it here if needed.
 797	 */
 798	if (!sock)
 799		sk->sk_type = type;
 800
 801	vsk = vsock_sk(sk);
 802	vsock_addr_init(&vsk->local_addr, VMADDR_CID_ANY, VMADDR_PORT_ANY);
 803	vsock_addr_init(&vsk->remote_addr, VMADDR_CID_ANY, VMADDR_PORT_ANY);
 804
 805	sk->sk_destruct = vsock_sk_destruct;
 806	sk->sk_backlog_rcv = vsock_queue_rcv_skb;
 807	sock_reset_flag(sk, SOCK_DONE);
 808
 809	INIT_LIST_HEAD(&vsk->bound_table);
 810	INIT_LIST_HEAD(&vsk->connected_table);
 811	vsk->listener = NULL;
 812	INIT_LIST_HEAD(&vsk->pending_links);
 813	INIT_LIST_HEAD(&vsk->accept_queue);
 814	vsk->rejected = false;
 815	vsk->sent_request = false;
 816	vsk->ignore_connecting_rst = false;
 817	vsk->peer_shutdown = 0;
 818	INIT_DELAYED_WORK(&vsk->connect_work, vsock_connect_timeout);
 819	INIT_DELAYED_WORK(&vsk->pending_work, vsock_pending_work);
 820
 821	psk = parent ? vsock_sk(parent) : NULL;
 822	if (parent) {
 823		vsk->trusted = psk->trusted;
 824		vsk->owner = get_cred(psk->owner);
 825		vsk->connect_timeout = psk->connect_timeout;
 826		vsk->buffer_size = psk->buffer_size;
 827		vsk->buffer_min_size = psk->buffer_min_size;
 828		vsk->buffer_max_size = psk->buffer_max_size;
 829		security_sk_clone(parent, sk);
 830	} else {
 831		vsk->trusted = ns_capable_noaudit(&init_user_ns, CAP_NET_ADMIN);
 832		vsk->owner = get_current_cred();
 833		vsk->connect_timeout = VSOCK_DEFAULT_CONNECT_TIMEOUT;
 834		vsk->buffer_size = VSOCK_DEFAULT_BUFFER_SIZE;
 835		vsk->buffer_min_size = VSOCK_DEFAULT_BUFFER_MIN_SIZE;
 836		vsk->buffer_max_size = VSOCK_DEFAULT_BUFFER_MAX_SIZE;
 837	}
 838
 839	return sk;
 840}
 841
 842static bool sock_type_connectible(u16 type)
 843{
 844	return (type == SOCK_STREAM) || (type == SOCK_SEQPACKET);
 845}
 846
 847static void __vsock_release(struct sock *sk, int level)
 848{
 849	struct vsock_sock *vsk;
 850	struct sock *pending;
 851
 852	vsk = vsock_sk(sk);
 853	pending = NULL;	/* Compiler warning. */
 854
 855	/* When "level" is SINGLE_DEPTH_NESTING, use the nested
 856	 * version to avoid the warning "possible recursive locking
 857	 * detected". When "level" is 0, lock_sock_nested(sk, level)
 858	 * is the same as lock_sock(sk).
 859	 */
 860	lock_sock_nested(sk, level);
 861
 862	/* Indicate to vsock_remove_sock() that the socket is being released and
 863	 * can be removed from the bound_table. Unlike transport reassignment
 864	 * case, where the socket must remain bound despite vsock_remove_sock()
 865	 * being called from the transport release() callback.
 866	 */
 867	sock_set_flag(sk, SOCK_DEAD);
 868
 869	if (vsk->transport)
 870		vsk->transport->release(vsk);
 871	else if (sock_type_connectible(sk->sk_type))
 872		vsock_remove_sock(vsk);
 873
 874	sock_orphan(sk);
 875	sk->sk_shutdown = SHUTDOWN_MASK;
 876
 877	skb_queue_purge(&sk->sk_receive_queue);
 878
 879	/* Clean up any sockets that never were accepted. */
 880	while ((pending = vsock_dequeue_accept(sk)) != NULL) {
 881		__vsock_release(pending, SINGLE_DEPTH_NESTING);
 882		sock_put(pending);
 883	}
 884
 885	release_sock(sk);
 886	sock_put(sk);
 887}
 888
 889static void vsock_sk_destruct(struct sock *sk)
 890{
 891	struct vsock_sock *vsk = vsock_sk(sk);
 892
 893	/* Flush MSG_ZEROCOPY leftovers. */
 894	__skb_queue_purge(&sk->sk_error_queue);
 895
 896	vsock_deassign_transport(vsk);
 897
 898	/* When clearing these addresses, there's no need to set the family and
 899	 * possibly register the address family with the kernel.
 900	 */
 901	vsock_addr_init(&vsk->local_addr, VMADDR_CID_ANY, VMADDR_PORT_ANY);
 902	vsock_addr_init(&vsk->remote_addr, VMADDR_CID_ANY, VMADDR_PORT_ANY);
 903
 904	put_cred(vsk->owner);
 905}
 906
 907static int vsock_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
 908{
 909	int err;
 910
 911	err = sock_queue_rcv_skb(sk, skb);
 912	if (err)
 913		kfree_skb(skb);
 914
 915	return err;
 916}
 917
 918struct sock *vsock_create_connected(struct sock *parent)
 919{
 920	return __vsock_create(sock_net(parent), NULL, parent, GFP_KERNEL,
 921			      parent->sk_type, 0);
 922}
 923EXPORT_SYMBOL_GPL(vsock_create_connected);
 924
 925s64 vsock_stream_has_data(struct vsock_sock *vsk)
 926{
 927	if (WARN_ON(!vsk->transport))
 928		return 0;
 929
 930	return vsk->transport->stream_has_data(vsk);
 931}
 932EXPORT_SYMBOL_GPL(vsock_stream_has_data);
 933
 934s64 vsock_connectible_has_data(struct vsock_sock *vsk)
 935{
 936	struct sock *sk = sk_vsock(vsk);
 937
 938	if (WARN_ON(!vsk->transport))
 939		return 0;
 940
 941	if (sk->sk_type == SOCK_SEQPACKET)
 942		return vsk->transport->seqpacket_has_data(vsk);
 943	else
 944		return vsock_stream_has_data(vsk);
 945}
 946EXPORT_SYMBOL_GPL(vsock_connectible_has_data);
 947
 948s64 vsock_stream_has_space(struct vsock_sock *vsk)
 949{
 950	if (WARN_ON(!vsk->transport))
 951		return 0;
 952
 953	return vsk->transport->stream_has_space(vsk);
 954}
 955EXPORT_SYMBOL_GPL(vsock_stream_has_space);
 956
 957void vsock_data_ready(struct sock *sk)
 958{
 959	struct vsock_sock *vsk = vsock_sk(sk);
 960
 961	if (vsock_stream_has_data(vsk) >= sk->sk_rcvlowat ||
 962	    sock_flag(sk, SOCK_DONE))
 963		sk->sk_data_ready(sk);
 964}
 965EXPORT_SYMBOL_GPL(vsock_data_ready);
 966
 967/* Dummy callback required by sockmap.
 968 * See unconditional call of saved_close() in sock_map_close().
 969 */
 970static void vsock_close(struct sock *sk, long timeout)
 971{
 972}
 973
 974static int vsock_release(struct socket *sock)
 975{
 976	struct sock *sk = sock->sk;
 977
 978	if (!sk)
 979		return 0;
 980
 981	sk->sk_prot->close(sk, 0);
 982	__vsock_release(sk, 0);
 983	sock->sk = NULL;
 984	sock->state = SS_FREE;
 985
 986	return 0;
 987}
 988
 989static int
 990vsock_bind(struct socket *sock, struct sockaddr_unsized *addr, int addr_len)
 991{
 992	int err;
 993	struct sock *sk;
 994	struct sockaddr_vm *vm_addr;
 995
 996	sk = sock->sk;
 997
 998	if (vsock_addr_cast(addr, addr_len, &vm_addr) != 0)
 999		return -EINVAL;
1000
1001	lock_sock(sk);
1002	err = __vsock_bind(sk, vm_addr);
1003	release_sock(sk);
1004
1005	return err;
1006}
1007
1008static int vsock_getname(struct socket *sock,
1009			 struct sockaddr *addr, int peer)
1010{
1011	int err;
1012	struct sock *sk;
1013	struct vsock_sock *vsk;
1014	struct sockaddr_vm *vm_addr;
1015
1016	sk = sock->sk;
1017	vsk = vsock_sk(sk);
1018	err = 0;
1019
1020	lock_sock(sk);
1021
1022	if (peer) {
1023		if (sock->state != SS_CONNECTED) {
1024			err = -ENOTCONN;
1025			goto out;
1026		}
1027		vm_addr = &vsk->remote_addr;
1028	} else {
1029		vm_addr = &vsk->local_addr;
1030	}
1031
1032	BUILD_BUG_ON(sizeof(*vm_addr) > sizeof(struct sockaddr_storage));
1033	memcpy(addr, vm_addr, sizeof(*vm_addr));
1034	err = sizeof(*vm_addr);
1035
1036out:
1037	release_sock(sk);
1038	return err;
1039}
1040
1041void vsock_linger(struct sock *sk)
1042{
1043	DEFINE_WAIT_FUNC(wait, woken_wake_function);
1044	ssize_t (*unsent)(struct vsock_sock *vsk);
1045	struct vsock_sock *vsk = vsock_sk(sk);
1046	long timeout;
1047
1048	if (!sock_flag(sk, SOCK_LINGER))
1049		return;
1050
1051	timeout = sk->sk_lingertime;
1052	if (!timeout)
1053		return;
1054
1055	/* Transports must implement `unsent_bytes` if they want to support
1056	 * SOCK_LINGER through `vsock_linger()` since we use it to check when
1057	 * the socket can be closed.
1058	 */
1059	unsent = vsk->transport->unsent_bytes;
1060	if (!unsent)
1061		return;
1062
1063	add_wait_queue(sk_sleep(sk), &wait);
1064
1065	do {
1066		if (sk_wait_event(sk, &timeout, unsent(vsk) == 0, &wait))
1067			break;
1068	} while (!signal_pending(current) && timeout);
1069
1070	remove_wait_queue(sk_sleep(sk), &wait);
1071}
1072EXPORT_SYMBOL_GPL(vsock_linger);
1073
1074static int vsock_shutdown(struct socket *sock, int mode)
1075{
1076	int err;
1077	struct sock *sk;
1078
1079	/* User level uses SHUT_RD (0) and SHUT_WR (1), but the kernel uses
1080	 * RCV_SHUTDOWN (1) and SEND_SHUTDOWN (2), so we must increment mode
1081	 * here like the other address families do.  Note also that the
1082	 * increment makes SHUT_RDWR (2) into RCV_SHUTDOWN | SEND_SHUTDOWN (3),
1083	 * which is what we want.
1084	 */
1085	mode++;
1086
1087	if ((mode & ~SHUTDOWN_MASK) || !mode)
1088		return -EINVAL;
1089
1090	/* If this is a connection oriented socket and it is not connected then
1091	 * bail out immediately.  If it is a DGRAM socket then we must first
1092	 * kick the socket so that it wakes up from any sleeping calls, for
1093	 * example recv(), and then afterwards return the error.
1094	 */
1095
1096	sk = sock->sk;
1097
1098	lock_sock(sk);
1099	if (sock->state == SS_UNCONNECTED) {
1100		err = -ENOTCONN;
1101		if (sock_type_connectible(sk->sk_type))
1102			goto out;
1103	} else {
1104		sock->state = SS_DISCONNECTING;
1105		err = 0;
1106	}
1107
1108	/* Receive and send shutdowns are treated alike. */
1109	mode = mode & (RCV_SHUTDOWN | SEND_SHUTDOWN);
1110	if (mode) {
1111		sk->sk_shutdown |= mode;
1112		sk->sk_state_change(sk);
1113
1114		if (sock_type_connectible(sk->sk_type)) {
1115			sock_reset_flag(sk, SOCK_DONE);
1116			vsock_send_shutdown(sk, mode);
1117		}
1118	}
1119
1120out:
1121	release_sock(sk);
1122	return err;
1123}
1124
1125static __poll_t vsock_poll(struct file *file, struct socket *sock,
1126			       poll_table *wait)
1127{
1128	struct sock *sk;
1129	__poll_t mask;
1130	struct vsock_sock *vsk;
1131
1132	sk = sock->sk;
1133	vsk = vsock_sk(sk);
1134
1135	poll_wait(file, sk_sleep(sk), wait);
1136	mask = 0;
1137
1138	if (sk->sk_err || !skb_queue_empty_lockless(&sk->sk_error_queue))
1139		/* Signify that there has been an error on this socket. */
1140		mask |= EPOLLERR;
1141
1142	/* INET sockets treat local write shutdown and peer write shutdown as a
1143	 * case of EPOLLHUP set.
1144	 */
1145	if ((sk->sk_shutdown == SHUTDOWN_MASK) ||
1146	    ((sk->sk_shutdown & SEND_SHUTDOWN) &&
1147	     (vsk->peer_shutdown & SEND_SHUTDOWN))) {
1148		mask |= EPOLLHUP;
1149	}
1150
1151	if (sk->sk_shutdown & RCV_SHUTDOWN ||
1152	    vsk->peer_shutdown & SEND_SHUTDOWN) {
1153		mask |= EPOLLRDHUP;
1154	}
1155
1156	if (sk_is_readable(sk))
1157		mask |= EPOLLIN | EPOLLRDNORM;
1158
1159	if (sock->type == SOCK_DGRAM) {
1160		/* For datagram sockets we can read if there is something in
1161		 * the queue and write as long as the socket isn't shutdown for
1162		 * sending.
1163		 */
1164		if (!skb_queue_empty_lockless(&sk->sk_receive_queue) ||
1165		    (sk->sk_shutdown & RCV_SHUTDOWN)) {
1166			mask |= EPOLLIN | EPOLLRDNORM;
1167		}
1168
1169		if (!(sk->sk_shutdown & SEND_SHUTDOWN))
1170			mask |= EPOLLOUT | EPOLLWRNORM | EPOLLWRBAND;
1171
1172	} else if (sock_type_connectible(sk->sk_type)) {
1173		const struct vsock_transport *transport;
1174
1175		lock_sock(sk);
1176
1177		transport = vsk->transport;
1178
1179		/* Listening sockets that have connections in their accept
1180		 * queue can be read.
1181		 */
1182		if (sk->sk_state == TCP_LISTEN
1183		    && !vsock_is_accept_queue_empty(sk))
1184			mask |= EPOLLIN | EPOLLRDNORM;
1185
1186		/* If there is something in the queue then we can read. */
1187		if (transport && transport->stream_is_active(vsk) &&
1188		    !(sk->sk_shutdown & RCV_SHUTDOWN)) {
1189			bool data_ready_now = false;
1190			int target = sock_rcvlowat(sk, 0, INT_MAX);
1191			int ret = transport->notify_poll_in(
1192					vsk, target, &data_ready_now);
1193			if (ret < 0) {
1194				mask |= EPOLLERR;
1195			} else {
1196				if (data_ready_now)
1197					mask |= EPOLLIN | EPOLLRDNORM;
1198
1199			}
1200		}
1201
1202		/* Sockets whose connections have been closed, reset, or
1203		 * terminated should also be considered read, and we check the
1204		 * shutdown flag for that.
1205		 */
1206		if (sk->sk_shutdown & RCV_SHUTDOWN ||
1207		    vsk->peer_shutdown & SEND_SHUTDOWN) {
1208			mask |= EPOLLIN | EPOLLRDNORM;
1209		}
1210
1211		/* Connected sockets that can produce data can be written. */
1212		if (transport && sk->sk_state == TCP_ESTABLISHED) {
1213			if (!(sk->sk_shutdown & SEND_SHUTDOWN)) {
1214				bool space_avail_now = false;
1215				int ret = transport->notify_poll_out(
1216						vsk, 1, &space_avail_now);
1217				if (ret < 0) {
1218					mask |= EPOLLERR;
1219				} else {
1220					if (space_avail_now)
1221						/* Remove EPOLLWRBAND since INET
1222						 * sockets are not setting it.
1223						 */
1224						mask |= EPOLLOUT | EPOLLWRNORM;
1225
1226				}
1227			}
1228		}
1229
1230		/* Simulate INET socket poll behaviors, which sets
1231		 * EPOLLOUT|EPOLLWRNORM when peer is closed and nothing to read,
1232		 * but local send is not shutdown.
1233		 */
1234		if (sk->sk_state == TCP_CLOSE || sk->sk_state == TCP_CLOSING) {
1235			if (!(sk->sk_shutdown & SEND_SHUTDOWN))
1236				mask |= EPOLLOUT | EPOLLWRNORM;
1237
1238		}
1239
1240		release_sock(sk);
1241	}
1242
1243	return mask;
1244}
1245
1246static int vsock_read_skb(struct sock *sk, skb_read_actor_t read_actor)
1247{
1248	struct vsock_sock *vsk = vsock_sk(sk);
1249
1250	if (WARN_ON_ONCE(!vsk->transport))
1251		return -ENODEV;
1252
1253	return vsk->transport->read_skb(vsk, read_actor);
1254}
1255
1256static int vsock_dgram_sendmsg(struct socket *sock, struct msghdr *msg,
1257			       size_t len)
1258{
1259	int err;
1260	struct sock *sk;
1261	struct vsock_sock *vsk;
1262	struct sockaddr_vm *remote_addr;
1263	const struct vsock_transport *transport;
1264
1265	if (msg->msg_flags & MSG_OOB)
1266		return -EOPNOTSUPP;
1267
1268	/* For now, MSG_DONTWAIT is always assumed... */
1269	err = 0;
1270	sk = sock->sk;
1271	vsk = vsock_sk(sk);
1272
1273	lock_sock(sk);
1274
1275	transport = vsk->transport;
1276
1277	err = vsock_auto_bind(vsk);
1278	if (err)
1279		goto out;
1280
1281
1282	/* If the provided message contains an address, use that.  Otherwise
1283	 * fall back on the socket's remote handle (if it has been connected).
1284	 */
1285	if (msg->msg_name &&
1286	    vsock_addr_cast(msg->msg_name, msg->msg_namelen,
1287			    &remote_addr) == 0) {
1288		/* Ensure this address is of the right type and is a valid
1289		 * destination.
1290		 */
1291
1292		if (remote_addr->svm_cid == VMADDR_CID_ANY)
1293			remote_addr->svm_cid = transport->get_local_cid();
1294
1295		if (!vsock_addr_bound(remote_addr)) {
1296			err = -EINVAL;
1297			goto out;
1298		}
1299	} else if (sock->state == SS_CONNECTED) {
1300		remote_addr = &vsk->remote_addr;
1301
1302		if (remote_addr->svm_cid == VMADDR_CID_ANY)
1303			remote_addr->svm_cid = transport->get_local_cid();
1304
1305		/* XXX Should connect() or this function ensure remote_addr is
1306		 * bound?
1307		 */
1308		if (!vsock_addr_bound(&vsk->remote_addr)) {
1309			err = -EINVAL;
1310			goto out;
1311		}
1312	} else {
1313		err = -EINVAL;
1314		goto out;
1315	}
1316
1317	if (!transport->dgram_allow(remote_addr->svm_cid,
1318				    remote_addr->svm_port)) {
1319		err = -EINVAL;
1320		goto out;
1321	}
1322
1323	err = transport->dgram_enqueue(vsk, remote_addr, msg, len);
1324
1325out:
1326	release_sock(sk);
1327	return err;
1328}
1329
1330static int vsock_dgram_connect(struct socket *sock,
1331			       struct sockaddr_unsized *addr, int addr_len, int flags)
1332{
1333	int err;
1334	struct sock *sk;
1335	struct vsock_sock *vsk;
1336	struct sockaddr_vm *remote_addr;
1337
1338	sk = sock->sk;
1339	vsk = vsock_sk(sk);
1340
1341	err = vsock_addr_cast(addr, addr_len, &remote_addr);
1342	if (err == -EAFNOSUPPORT && remote_addr->svm_family == AF_UNSPEC) {
1343		lock_sock(sk);
1344		vsock_addr_init(&vsk->remote_addr, VMADDR_CID_ANY,
1345				VMADDR_PORT_ANY);
1346		sock->state = SS_UNCONNECTED;
1347		release_sock(sk);
1348		return 0;
1349	} else if (err != 0)
1350		return -EINVAL;
1351
1352	lock_sock(sk);
1353
1354	err = vsock_auto_bind(vsk);
1355	if (err)
1356		goto out;
1357
1358	if (!vsk->transport->dgram_allow(remote_addr->svm_cid,
1359					 remote_addr->svm_port)) {
1360		err = -EINVAL;
1361		goto out;
1362	}
1363
1364	memcpy(&vsk->remote_addr, remote_addr, sizeof(vsk->remote_addr));
1365	sock->state = SS_CONNECTED;
1366
1367	/* sock map disallows redirection of non-TCP sockets with sk_state !=
1368	 * TCP_ESTABLISHED (see sock_map_redirect_allowed()), so we set
1369	 * TCP_ESTABLISHED here to allow redirection of connected vsock dgrams.
1370	 *
1371	 * This doesn't seem to be abnormal state for datagram sockets, as the
1372	 * same approach can be see in other datagram socket types as well
1373	 * (such as unix sockets).
1374	 */
1375	sk->sk_state = TCP_ESTABLISHED;
1376
1377out:
1378	release_sock(sk);
1379	return err;
1380}
1381
1382int __vsock_dgram_recvmsg(struct socket *sock, struct msghdr *msg,
1383			  size_t len, int flags)
1384{
1385	struct sock *sk = sock->sk;
1386	struct vsock_sock *vsk = vsock_sk(sk);
1387
1388	return vsk->transport->dgram_dequeue(vsk, msg, len, flags);
1389}
1390
1391int vsock_dgram_recvmsg(struct socket *sock, struct msghdr *msg,
1392			size_t len, int flags)
1393{
1394#ifdef CONFIG_BPF_SYSCALL
1395	struct sock *sk = sock->sk;
1396	const struct proto *prot;
1397
1398	prot = READ_ONCE(sk->sk_prot);
1399	if (prot != &vsock_proto)
1400		return prot->recvmsg(sk, msg, len, flags, NULL);
1401#endif
1402
1403	return __vsock_dgram_recvmsg(sock, msg, len, flags);
1404}
1405EXPORT_SYMBOL_GPL(vsock_dgram_recvmsg);
1406
1407static int vsock_do_ioctl(struct socket *sock, unsigned int cmd,
1408			  int __user *arg)
1409{
1410	struct sock *sk = sock->sk;
1411	struct vsock_sock *vsk;
1412	int ret;
1413
1414	vsk = vsock_sk(sk);
1415
1416	switch (cmd) {
1417	case SIOCINQ: {
1418		ssize_t n_bytes;
1419
1420		if (!vsk->transport) {
1421			ret = -EOPNOTSUPP;
1422			break;
1423		}
1424
1425		if (sock_type_connectible(sk->sk_type) &&
1426		    sk->sk_state == TCP_LISTEN) {
1427			ret = -EINVAL;
1428			break;
1429		}
1430
1431		n_bytes = vsock_stream_has_data(vsk);
1432		if (n_bytes < 0) {
1433			ret = n_bytes;
1434			break;
1435		}
1436		ret = put_user(n_bytes, arg);
1437		break;
1438	}
1439	case SIOCOUTQ: {
1440		ssize_t n_bytes;
1441
1442		if (!vsk->transport || !vsk->transport->unsent_bytes) {
1443			ret = -EOPNOTSUPP;
1444			break;
1445		}
1446
1447		if (sock_type_connectible(sk->sk_type) && sk->sk_state == TCP_LISTEN) {
1448			ret = -EINVAL;
1449			break;
1450		}
1451
1452		n_bytes = vsk->transport->unsent_bytes(vsk);
1453		if (n_bytes < 0) {
1454			ret = n_bytes;
1455			break;
1456		}
1457
1458		ret = put_user(n_bytes, arg);
1459		break;
1460	}
1461	default:
1462		ret = -ENOIOCTLCMD;
1463	}
1464
1465	return ret;
1466}
1467
1468static int vsock_ioctl(struct socket *sock, unsigned int cmd,
1469		       unsigned long arg)
1470{
1471	int ret;
1472
1473	lock_sock(sock->sk);
1474	ret = vsock_do_ioctl(sock, cmd, (int __user *)arg);
1475	release_sock(sock->sk);
1476
1477	return ret;
1478}
1479
1480static const struct proto_ops vsock_dgram_ops = {
1481	.family = PF_VSOCK,
1482	.owner = THIS_MODULE,
1483	.release = vsock_release,
1484	.bind = vsock_bind,
1485	.connect = vsock_dgram_connect,
1486	.socketpair = sock_no_socketpair,
1487	.accept = sock_no_accept,
1488	.getname = vsock_getname,
1489	.poll = vsock_poll,
1490	.ioctl = vsock_ioctl,
1491	.listen = sock_no_listen,
1492	.shutdown = vsock_shutdown,
1493	.sendmsg = vsock_dgram_sendmsg,
1494	.recvmsg = vsock_dgram_recvmsg,
1495	.mmap = sock_no_mmap,
1496	.read_skb = vsock_read_skb,
1497};
1498
1499static int vsock_transport_cancel_pkt(struct vsock_sock *vsk)
1500{
1501	const struct vsock_transport *transport = vsk->transport;
1502
1503	if (!transport || !transport->cancel_pkt)
1504		return -EOPNOTSUPP;
1505
1506	return transport->cancel_pkt(vsk);
1507}
1508
1509static void vsock_connect_timeout(struct work_struct *work)
1510{
1511	struct sock *sk;
1512	struct vsock_sock *vsk;
1513
1514	vsk = container_of(work, struct vsock_sock, connect_work.work);
1515	sk = sk_vsock(vsk);
1516
1517	lock_sock(sk);
1518	if (sk->sk_state == TCP_SYN_SENT &&
1519	    (sk->sk_shutdown != SHUTDOWN_MASK)) {
1520		sk->sk_state = TCP_CLOSE;
1521		sk->sk_socket->state = SS_UNCONNECTED;
1522		sk->sk_err = ETIMEDOUT;
1523		sk_error_report(sk);
1524		vsock_transport_cancel_pkt(vsk);
1525	}
1526	release_sock(sk);
1527
1528	sock_put(sk);
1529}
1530
1531static int vsock_connect(struct socket *sock, struct sockaddr_unsized *addr,
1532			 int addr_len, int flags)
1533{
1534	int err;
1535	struct sock *sk;
1536	struct vsock_sock *vsk;
1537	const struct vsock_transport *transport;
1538	struct sockaddr_vm *remote_addr;
1539	long timeout;
1540	DEFINE_WAIT(wait);
1541
1542	err = 0;
1543	sk = sock->sk;
1544	vsk = vsock_sk(sk);
1545
1546	lock_sock(sk);
1547
1548	/* XXX AF_UNSPEC should make us disconnect like AF_INET. */
1549	switch (sock->state) {
1550	case SS_CONNECTED:
1551		err = -EISCONN;
1552		goto out;
1553	case SS_DISCONNECTING:
1554		err = -EINVAL;
1555		goto out;
1556	case SS_CONNECTING:
1557		/* This continues on so we can move sock into the SS_CONNECTED
1558		 * state once the connection has completed (at which point err
1559		 * will be set to zero also).  Otherwise, we will either wait
1560		 * for the connection or return -EALREADY should this be a
1561		 * non-blocking call.
1562		 */
1563		err = -EALREADY;
1564		if (flags & O_NONBLOCK)
1565			goto out;
1566		break;
1567	default:
1568		if ((sk->sk_state == TCP_LISTEN) ||
1569		    vsock_addr_cast(addr, addr_len, &remote_addr) != 0) {
1570			err = -EINVAL;
1571			goto out;
1572		}
1573
1574		/* Set the remote address that we are connecting to. */
1575		memcpy(&vsk->remote_addr, remote_addr,
1576		       sizeof(vsk->remote_addr));
1577
1578		err = vsock_assign_transport(vsk, NULL);
1579		if (err)
1580			goto out;
1581
1582		transport = vsk->transport;
1583
1584		/* The hypervisor and well-known contexts do not have socket
1585		 * endpoints.
1586		 */
1587		if (!transport ||
1588		    !transport->stream_allow(remote_addr->svm_cid,
1589					     remote_addr->svm_port)) {
1590			err = -ENETUNREACH;
1591			goto out;
1592		}
1593
1594		if (vsock_msgzerocopy_allow(transport)) {
1595			set_bit(SOCK_SUPPORT_ZC, &sk->sk_socket->flags);
1596		} else if (sock_flag(sk, SOCK_ZEROCOPY)) {
1597			/* If this option was set before 'connect()',
1598			 * when transport was unknown, check that this
1599			 * feature is supported here.
1600			 */
1601			err = -EOPNOTSUPP;
1602			goto out;
1603		}
1604
1605		err = vsock_auto_bind(vsk);
1606		if (err)
1607			goto out;
1608
1609		sk->sk_state = TCP_SYN_SENT;
1610
1611		err = transport->connect(vsk);
1612		if (err < 0)
1613			goto out;
1614
1615		/* sk_err might have been set as a result of an earlier
1616		 * (failed) connect attempt.
1617		 */
1618		sk->sk_err = 0;
1619
1620		/* Mark sock as connecting and set the error code to in
1621		 * progress in case this is a non-blocking connect.
1622		 */
1623		sock->state = SS_CONNECTING;
1624		err = -EINPROGRESS;
1625	}
1626
1627	/* The receive path will handle all communication until we are able to
1628	 * enter the connected state.  Here we wait for the connection to be
1629	 * completed or a notification of an error.
1630	 */
1631	timeout = vsk->connect_timeout;
1632	prepare_to_wait(sk_sleep(sk), &wait, TASK_INTERRUPTIBLE);
1633
1634	/* If the socket is already closing or it is in an error state, there
1635	 * is no point in waiting.
1636	 */
1637	while (sk->sk_state != TCP_ESTABLISHED &&
1638	       sk->sk_state != TCP_CLOSING && sk->sk_err == 0) {
1639		if (flags & O_NONBLOCK) {
1640			/* If we're not going to block, we schedule a timeout
1641			 * function to generate a timeout on the connection
1642			 * attempt, in case the peer doesn't respond in a
1643			 * timely manner. We hold on to the socket until the
1644			 * timeout fires.
1645			 */
1646			sock_hold(sk);
1647
1648			/* If the timeout function is already scheduled,
1649			 * reschedule it, then ungrab the socket refcount to
1650			 * keep it balanced.
1651			 */
1652			if (mod_delayed_work(system_percpu_wq, &vsk->connect_work,
1653					     timeout))
1654				sock_put(sk);
1655
1656			/* Skip ahead to preserve error code set above. */
1657			goto out_wait;
1658		}
1659
1660		release_sock(sk);
1661		timeout = schedule_timeout(timeout);
1662		lock_sock(sk);
1663
1664		/* Connection established. Whatever happens to socket once we
1665		 * release it, that's not connect()'s concern. No need to go
1666		 * into signal and timeout handling. Call it a day.
1667		 *
1668		 * Note that allowing to "reset" an already established socket
1669		 * here is racy and insecure.
1670		 */
1671		if (sk->sk_state == TCP_ESTABLISHED)
1672			break;
1673
1674		/* If connection was _not_ established and a signal/timeout came
1675		 * to be, we want the socket's state reset. User space may want
1676		 * to retry.
1677		 *
1678		 * sk_state != TCP_ESTABLISHED implies that socket is not on
1679		 * vsock_connected_table. We keep the binding and the transport
1680		 * assigned.
1681		 */
1682		if (signal_pending(current) || timeout == 0) {
1683			err = timeout == 0 ? -ETIMEDOUT : sock_intr_errno(timeout);
1684
1685			/* Listener might have already responded with
1686			 * VIRTIO_VSOCK_OP_RESPONSE. Its handling expects our
1687			 * sk_state == TCP_SYN_SENT, which hereby we break.
1688			 * In such case VIRTIO_VSOCK_OP_RST will follow.
1689			 */
1690			sk->sk_state = TCP_CLOSE;
1691			sock->state = SS_UNCONNECTED;
1692
1693			/* Try to cancel VIRTIO_VSOCK_OP_REQUEST skb sent out by
1694			 * transport->connect().
1695			 */
1696			vsock_transport_cancel_pkt(vsk);
1697
1698			goto out_wait;
1699		}
1700
1701		prepare_to_wait(sk_sleep(sk), &wait, TASK_INTERRUPTIBLE);
1702	}
1703
1704	if (sk->sk_err) {
1705		err = -sk->sk_err;
1706		sk->sk_state = TCP_CLOSE;
1707		sock->state = SS_UNCONNECTED;
1708	} else {
1709		err = 0;
1710	}
1711
1712out_wait:
1713	finish_wait(sk_sleep(sk), &wait);
1714out:
1715	release_sock(sk);
1716	return err;
1717}
1718
1719static int vsock_accept(struct socket *sock, struct socket *newsock,
1720			struct proto_accept_arg *arg)
1721{
1722	struct sock *listener;
1723	int err;
1724	struct sock *connected;
1725	struct vsock_sock *vconnected;
1726	long timeout;
1727	DEFINE_WAIT(wait);
1728
1729	err = 0;
1730	listener = sock->sk;
1731
1732	lock_sock(listener);
1733
1734	if (!sock_type_connectible(sock->type)) {
1735		err = -EOPNOTSUPP;
1736		goto out;
1737	}
1738
1739	if (listener->sk_state != TCP_LISTEN) {
1740		err = -EINVAL;
1741		goto out;
1742	}
1743
1744	/* Wait for children sockets to appear; these are the new sockets
1745	 * created upon connection establishment.
1746	 */
1747	timeout = sock_rcvtimeo(listener, arg->flags & O_NONBLOCK);
1748	prepare_to_wait(sk_sleep(listener), &wait, TASK_INTERRUPTIBLE);
1749
1750	while ((connected = vsock_dequeue_accept(listener)) == NULL &&
1751	       listener->sk_err == 0) {
1752		release_sock(listener);
1753		timeout = schedule_timeout(timeout);
1754		finish_wait(sk_sleep(listener), &wait);
1755		lock_sock(listener);
1756
1757		if (signal_pending(current)) {
1758			err = sock_intr_errno(timeout);
1759			goto out;
1760		} else if (timeout == 0) {
1761			err = -EAGAIN;
1762			goto out;
1763		}
1764
1765		prepare_to_wait(sk_sleep(listener), &wait, TASK_INTERRUPTIBLE);
1766	}
1767	finish_wait(sk_sleep(listener), &wait);
1768
1769	if (listener->sk_err)
1770		err = -listener->sk_err;
1771
1772	if (connected) {
1773		sk_acceptq_removed(listener);
1774
1775		lock_sock_nested(connected, SINGLE_DEPTH_NESTING);
1776		vconnected = vsock_sk(connected);
1777
1778		/* If the listener socket has received an error, then we should
1779		 * reject this socket and return.  Note that we simply mark the
1780		 * socket rejected, drop our reference, and let the cleanup
1781		 * function handle the cleanup; the fact that we found it in
1782		 * the listener's accept queue guarantees that the cleanup
1783		 * function hasn't run yet.
1784		 */
1785		if (err) {
1786			vconnected->rejected = true;
1787		} else {
1788			newsock->state = SS_CONNECTED;
1789			sock_graft(connected, newsock);
1790
1791			set_bit(SOCK_CUSTOM_SOCKOPT,
1792				&connected->sk_socket->flags);
1793
1794			if (vsock_msgzerocopy_allow(vconnected->transport))
1795				set_bit(SOCK_SUPPORT_ZC,
1796					&connected->sk_socket->flags);
1797		}
1798
1799		release_sock(connected);
1800		sock_put(connected);
1801	}
1802
1803out:
1804	release_sock(listener);
1805	return err;
1806}
1807
1808static int vsock_listen(struct socket *sock, int backlog)
1809{
1810	int err;
1811	struct sock *sk;
1812	struct vsock_sock *vsk;
1813
1814	sk = sock->sk;
1815
1816	lock_sock(sk);
1817
1818	if (!sock_type_connectible(sk->sk_type)) {
1819		err = -EOPNOTSUPP;
1820		goto out;
1821	}
1822
1823	if (sock->state != SS_UNCONNECTED) {
1824		err = -EINVAL;
1825		goto out;
1826	}
1827
1828	vsk = vsock_sk(sk);
1829
1830	if (!vsock_addr_bound(&vsk->local_addr)) {
1831		err = -EINVAL;
1832		goto out;
1833	}
1834
1835	sk->sk_max_ack_backlog = backlog;
1836	sk->sk_state = TCP_LISTEN;
1837
1838	err = 0;
1839
1840out:
1841	release_sock(sk);
1842	return err;
1843}
1844
1845static void vsock_update_buffer_size(struct vsock_sock *vsk,
1846				     const struct vsock_transport *transport,
1847				     u64 val)
1848{
1849	if (val > vsk->buffer_max_size)
1850		val = vsk->buffer_max_size;
1851
1852	if (val < vsk->buffer_min_size)
1853		val = vsk->buffer_min_size;
1854
1855	if (val != vsk->buffer_size &&
1856	    transport && transport->notify_buffer_size)
1857		transport->notify_buffer_size(vsk, &val);
1858
1859	vsk->buffer_size = val;
1860}
1861
1862static int vsock_connectible_setsockopt(struct socket *sock,
1863					int level,
1864					int optname,
1865					sockptr_t optval,
1866					unsigned int optlen)
1867{
1868	int err;
1869	struct sock *sk;
1870	struct vsock_sock *vsk;
1871	const struct vsock_transport *transport;
1872	u64 val;
1873
1874	if (level != AF_VSOCK && level != SOL_SOCKET)
1875		return -ENOPROTOOPT;
1876
1877#define COPY_IN(_v)                                       \
1878	do {						  \
1879		if (optlen < sizeof(_v)) {		  \
1880			err = -EINVAL;			  \
1881			goto exit;			  \
1882		}					  \
1883		if (copy_from_sockptr(&_v, optval, sizeof(_v)) != 0) {	\
1884			err = -EFAULT;					\
1885			goto exit;					\
1886		}							\
1887	} while (0)
1888
1889	err = 0;
1890	sk = sock->sk;
1891	vsk = vsock_sk(sk);
1892
1893	lock_sock(sk);
1894
1895	transport = vsk->transport;
1896
1897	if (level == SOL_SOCKET) {
1898		int zerocopy;
1899
1900		if (optname != SO_ZEROCOPY) {
1901			release_sock(sk);
1902			return sock_setsockopt(sock, level, optname, optval, optlen);
1903		}
1904
1905		/* Use 'int' type here, because variable to
1906		 * set this option usually has this type.
1907		 */
1908		COPY_IN(zerocopy);
1909
1910		if (zerocopy < 0 || zerocopy > 1) {
1911			err = -EINVAL;
1912			goto exit;
1913		}
1914
1915		if (transport && !vsock_msgzerocopy_allow(transport)) {
1916			err = -EOPNOTSUPP;
1917			goto exit;
1918		}
1919
1920		sock_valbool_flag(sk, SOCK_ZEROCOPY, zerocopy);
1921		goto exit;
1922	}
1923
1924	switch (optname) {
1925	case SO_VM_SOCKETS_BUFFER_SIZE:
1926		COPY_IN(val);
1927		vsock_update_buffer_size(vsk, transport, val);
1928		break;
1929
1930	case SO_VM_SOCKETS_BUFFER_MAX_SIZE:
1931		COPY_IN(val);
1932		vsk->buffer_max_size = val;
1933		vsock_update_buffer_size(vsk, transport, vsk->buffer_size);
1934		break;
1935
1936	case SO_VM_SOCKETS_BUFFER_MIN_SIZE:
1937		COPY_IN(val);
1938		vsk->buffer_min_size = val;
1939		vsock_update_buffer_size(vsk, transport, vsk->buffer_size);
1940		break;
1941
1942	case SO_VM_SOCKETS_CONNECT_TIMEOUT_NEW:
1943	case SO_VM_SOCKETS_CONNECT_TIMEOUT_OLD: {
1944		struct __kernel_sock_timeval tv;
1945
1946		err = sock_copy_user_timeval(&tv, optval, optlen,
1947					     optname == SO_VM_SOCKETS_CONNECT_TIMEOUT_OLD);
1948		if (err)
1949			break;
1950		if (tv.tv_sec >= 0 && tv.tv_usec < USEC_PER_SEC &&
1951		    tv.tv_sec < (MAX_SCHEDULE_TIMEOUT / HZ - 1)) {
1952			vsk->connect_timeout = tv.tv_sec * HZ +
1953				DIV_ROUND_UP((unsigned long)tv.tv_usec, (USEC_PER_SEC / HZ));
1954			if (vsk->connect_timeout == 0)
1955				vsk->connect_timeout =
1956				    VSOCK_DEFAULT_CONNECT_TIMEOUT;
1957
1958		} else {
1959			err = -ERANGE;
1960		}
1961		break;
1962	}
1963
1964	default:
1965		err = -ENOPROTOOPT;
1966		break;
1967	}
1968
1969#undef COPY_IN
1970
1971exit:
1972	release_sock(sk);
1973	return err;
1974}
1975
1976static int vsock_connectible_getsockopt(struct socket *sock,
1977					int level, int optname,
1978					char __user *optval,
1979					int __user *optlen)
1980{
1981	struct sock *sk = sock->sk;
1982	struct vsock_sock *vsk = vsock_sk(sk);
1983
1984	union {
1985		u64 val64;
1986		struct old_timeval32 tm32;
1987		struct __kernel_old_timeval tm;
1988		struct  __kernel_sock_timeval stm;
1989	} v;
1990
1991	int lv = sizeof(v.val64);
1992	int len;
1993
1994	if (level != AF_VSOCK)
1995		return -ENOPROTOOPT;
1996
1997	if (get_user(len, optlen))
1998		return -EFAULT;
1999
2000	memset(&v, 0, sizeof(v));
2001
2002	switch (optname) {
2003	case SO_VM_SOCKETS_BUFFER_SIZE:
2004		v.val64 = vsk->buffer_size;
2005		break;
2006
2007	case SO_VM_SOCKETS_BUFFER_MAX_SIZE:
2008		v.val64 = vsk->buffer_max_size;
2009		break;
2010
2011	case SO_VM_SOCKETS_BUFFER_MIN_SIZE:
2012		v.val64 = vsk->buffer_min_size;
2013		break;
2014
2015	case SO_VM_SOCKETS_CONNECT_TIMEOUT_NEW:
2016	case SO_VM_SOCKETS_CONNECT_TIMEOUT_OLD:
2017		lv = sock_get_timeout(vsk->connect_timeout, &v,
2018				      optname == SO_VM_SOCKETS_CONNECT_TIMEOUT_OLD);
2019		break;
2020
2021	default:
2022		return -ENOPROTOOPT;
2023	}
2024
2025	if (len < lv)
2026		return -EINVAL;
2027	if (len > lv)
2028		len = lv;
2029	if (copy_to_user(optval, &v, len))
2030		return -EFAULT;
2031
2032	if (put_user(len, optlen))
2033		return -EFAULT;
2034
2035	return 0;
2036}
2037
2038static int vsock_connectible_sendmsg(struct socket *sock, struct msghdr *msg,
2039				     size_t len)
2040{
2041	struct sock *sk;
2042	struct vsock_sock *vsk;
2043	const struct vsock_transport *transport;
2044	ssize_t total_written;
2045	long timeout;
2046	int err;
2047	struct vsock_transport_send_notify_data send_data;
2048	DEFINE_WAIT_FUNC(wait, woken_wake_function);
2049
2050	sk = sock->sk;
2051	vsk = vsock_sk(sk);
2052	total_written = 0;
2053	err = 0;
2054
2055	if (msg->msg_flags & MSG_OOB)
2056		return -EOPNOTSUPP;
2057
2058	lock_sock(sk);
2059
2060	transport = vsk->transport;
2061
2062	/* Callers should not provide a destination with connection oriented
2063	 * sockets.
2064	 */
2065	if (msg->msg_namelen) {
2066		err = sk->sk_state == TCP_ESTABLISHED ? -EISCONN : -EOPNOTSUPP;
2067		goto out;
2068	}
2069
2070	/* Send data only if both sides are not shutdown in the direction. */
2071	if (sk->sk_shutdown & SEND_SHUTDOWN ||
2072	    vsk->peer_shutdown & RCV_SHUTDOWN) {
2073		err = -EPIPE;
2074		goto out;
2075	}
2076
2077	if (!transport || sk->sk_state != TCP_ESTABLISHED ||
2078	    !vsock_addr_bound(&vsk->local_addr)) {
2079		err = -ENOTCONN;
2080		goto out;
2081	}
2082
2083	if (!vsock_addr_bound(&vsk->remote_addr)) {
2084		err = -EDESTADDRREQ;
2085		goto out;
2086	}
2087
2088	if (msg->msg_flags & MSG_ZEROCOPY &&
2089	    !vsock_msgzerocopy_allow(transport)) {
2090		err = -EOPNOTSUPP;
2091		goto out;
2092	}
2093
2094	/* Wait for room in the produce queue to enqueue our user's data. */
2095	timeout = sock_sndtimeo(sk, msg->msg_flags & MSG_DONTWAIT);
2096
2097	err = transport->notify_send_init(vsk, &send_data);
2098	if (err < 0)
2099		goto out;
2100
2101	while (total_written < len) {
2102		ssize_t written;
2103
2104		add_wait_queue(sk_sleep(sk), &wait);
2105		while (vsock_stream_has_space(vsk) == 0 &&
2106		       sk->sk_err == 0 &&
2107		       !(sk->sk_shutdown & SEND_SHUTDOWN) &&
2108		       !(vsk->peer_shutdown & RCV_SHUTDOWN)) {
2109
2110			/* Don't wait for non-blocking sockets. */
2111			if (timeout == 0) {
2112				err = -EAGAIN;
2113				remove_wait_queue(sk_sleep(sk), &wait);
2114				goto out_err;
2115			}
2116
2117			err = transport->notify_send_pre_block(vsk, &send_data);
2118			if (err < 0) {
2119				remove_wait_queue(sk_sleep(sk), &wait);
2120				goto out_err;
2121			}
2122
2123			release_sock(sk);
2124			timeout = wait_woken(&wait, TASK_INTERRUPTIBLE, timeout);
2125			lock_sock(sk);
2126			if (signal_pending(current)) {
2127				err = sock_intr_errno(timeout);
2128				remove_wait_queue(sk_sleep(sk), &wait);
2129				goto out_err;
2130			} else if (timeout == 0) {
2131				err = -EAGAIN;
2132				remove_wait_queue(sk_sleep(sk), &wait);
2133				goto out_err;
2134			}
2135		}
2136		remove_wait_queue(sk_sleep(sk), &wait);
2137
2138		/* These checks occur both as part of and after the loop
2139		 * conditional since we need to check before and after
2140		 * sleeping.
2141		 */
2142		if (sk->sk_err) {
2143			err = -sk->sk_err;
2144			goto out_err;
2145		} else if ((sk->sk_shutdown & SEND_SHUTDOWN) ||
2146			   (vsk->peer_shutdown & RCV_SHUTDOWN)) {
2147			err = -EPIPE;
2148			goto out_err;
2149		}
2150
2151		err = transport->notify_send_pre_enqueue(vsk, &send_data);
2152		if (err < 0)
2153			goto out_err;
2154
2155		/* Note that enqueue will only write as many bytes as are free
2156		 * in the produce queue, so we don't need to ensure len is
2157		 * smaller than the queue size.  It is the caller's
2158		 * responsibility to check how many bytes we were able to send.
2159		 */
2160
2161		if (sk->sk_type == SOCK_SEQPACKET) {
2162			written = transport->seqpacket_enqueue(vsk,
2163						msg, len - total_written);
2164		} else {
2165			written = transport->stream_enqueue(vsk,
2166					msg, len - total_written);
2167		}
2168
2169		if (written < 0) {
2170			err = written;
2171			goto out_err;
2172		}
2173
2174		total_written += written;
2175
2176		err = transport->notify_send_post_enqueue(
2177				vsk, written, &send_data);
2178		if (err < 0)
2179			goto out_err;
2180
2181	}
2182
2183out_err:
2184	if (total_written > 0) {
2185		/* Return number of written bytes only if:
2186		 * 1) SOCK_STREAM socket.
2187		 * 2) SOCK_SEQPACKET socket when whole buffer is sent.
2188		 */
2189		if (sk->sk_type == SOCK_STREAM || total_written == len)
2190			err = total_written;
2191	}
2192out:
2193	if (sk->sk_type == SOCK_STREAM)
2194		err = sk_stream_error(sk, msg->msg_flags, err);
2195
2196	release_sock(sk);
2197	return err;
2198}
2199
2200static int vsock_connectible_wait_data(struct sock *sk,
2201				       struct wait_queue_entry *wait,
2202				       long timeout,
2203				       struct vsock_transport_recv_notify_data *recv_data,
2204				       size_t target)
2205{
2206	const struct vsock_transport *transport;
2207	struct vsock_sock *vsk;
2208	s64 data;
2209	int err;
2210
2211	vsk = vsock_sk(sk);
2212	err = 0;
2213	transport = vsk->transport;
2214
2215	while (1) {
2216		prepare_to_wait(sk_sleep(sk), wait, TASK_INTERRUPTIBLE);
2217		data = vsock_connectible_has_data(vsk);
2218		if (data != 0)
2219			break;
2220
2221		if (sk->sk_err != 0 ||
2222		    (sk->sk_shutdown & RCV_SHUTDOWN) ||
2223		    (vsk->peer_shutdown & SEND_SHUTDOWN)) {
2224			break;
2225		}
2226
2227		/* Don't wait for non-blocking sockets. */
2228		if (timeout == 0) {
2229			err = -EAGAIN;
2230			break;
2231		}
2232
2233		if (recv_data) {
2234			err = transport->notify_recv_pre_block(vsk, target, recv_data);
2235			if (err < 0)
2236				break;
2237		}
2238
2239		release_sock(sk);
2240		timeout = schedule_timeout(timeout);
2241		lock_sock(sk);
2242
2243		if (signal_pending(current)) {
2244			err = sock_intr_errno(timeout);
2245			break;
2246		} else if (timeout == 0) {
2247			err = -EAGAIN;
2248			break;
2249		}
2250	}
2251
2252	finish_wait(sk_sleep(sk), wait);
2253
2254	if (err)
2255		return err;
2256
2257	/* Internal transport error when checking for available
2258	 * data. XXX This should be changed to a connection
2259	 * reset in a later change.
2260	 */
2261	if (data < 0)
2262		return -ENOMEM;
2263
2264	return data;
2265}
2266
2267static int __vsock_stream_recvmsg(struct sock *sk, struct msghdr *msg,
2268				  size_t len, int flags)
2269{
2270	struct vsock_transport_recv_notify_data recv_data;
2271	const struct vsock_transport *transport;
2272	struct vsock_sock *vsk;
2273	ssize_t copied;
2274	size_t target;
2275	long timeout;
2276	int err;
2277
2278	DEFINE_WAIT(wait);
2279
2280	vsk = vsock_sk(sk);
2281	transport = vsk->transport;
2282
2283	/* We must not copy less than target bytes into the user's buffer
2284	 * before returning successfully, so we wait for the consume queue to
2285	 * have that much data to consume before dequeueing.  Note that this
2286	 * makes it impossible to handle cases where target is greater than the
2287	 * queue size.
2288	 */
2289	target = sock_rcvlowat(sk, flags & MSG_WAITALL, len);
2290	if (target >= transport->stream_rcvhiwat(vsk)) {
2291		err = -ENOMEM;
2292		goto out;
2293	}
2294	timeout = sock_rcvtimeo(sk, flags & MSG_DONTWAIT);
2295	copied = 0;
2296
2297	err = transport->notify_recv_init(vsk, target, &recv_data);
2298	if (err < 0)
2299		goto out;
2300
2301
2302	while (1) {
2303		ssize_t read;
2304
2305		err = vsock_connectible_wait_data(sk, &wait, timeout,
2306						  &recv_data, target);
2307		if (err <= 0)
2308			break;
2309
2310		err = transport->notify_recv_pre_dequeue(vsk, target,
2311							 &recv_data);
2312		if (err < 0)
2313			break;
2314
2315		read = transport->stream_dequeue(vsk, msg, len - copied, flags);
2316		if (read < 0) {
2317			err = read;
2318			break;
2319		}
2320
2321		copied += read;
2322
2323		err = transport->notify_recv_post_dequeue(vsk, target, read,
2324						!(flags & MSG_PEEK), &recv_data);
2325		if (err < 0)
2326			goto out;
2327
2328		if (read >= target || flags & MSG_PEEK)
2329			break;
2330
2331		target -= read;
2332	}
2333
2334	if (sk->sk_err)
2335		err = -sk->sk_err;
2336	else if (sk->sk_shutdown & RCV_SHUTDOWN)
2337		err = 0;
2338
2339	if (copied > 0)
2340		err = copied;
2341
2342out:
2343	return err;
2344}
2345
2346static int __vsock_seqpacket_recvmsg(struct sock *sk, struct msghdr *msg,
2347				     size_t len, int flags)
2348{
2349	const struct vsock_transport *transport;
2350	struct vsock_sock *vsk;
2351	ssize_t msg_len;
2352	long timeout;
2353	int err = 0;
2354	DEFINE_WAIT(wait);
2355
2356	vsk = vsock_sk(sk);
2357	transport = vsk->transport;
2358
2359	timeout = sock_rcvtimeo(sk, flags & MSG_DONTWAIT);
2360
2361	err = vsock_connectible_wait_data(sk, &wait, timeout, NULL, 0);
2362	if (err <= 0)
2363		goto out;
2364
2365	msg_len = transport->seqpacket_dequeue(vsk, msg, flags);
2366
2367	if (msg_len < 0) {
2368		err = msg_len;
2369		goto out;
2370	}
2371
2372	if (sk->sk_err) {
2373		err = -sk->sk_err;
2374	} else if (sk->sk_shutdown & RCV_SHUTDOWN) {
2375		err = 0;
2376	} else {
2377		/* User sets MSG_TRUNC, so return real length of
2378		 * packet.
2379		 */
2380		if (flags & MSG_TRUNC)
2381			err = msg_len;
2382		else
2383			err = len - msg_data_left(msg);
2384
2385		/* Always set MSG_TRUNC if real length of packet is
2386		 * bigger than user's buffer.
2387		 */
2388		if (msg_len > len)
2389			msg->msg_flags |= MSG_TRUNC;
2390	}
2391
2392out:
2393	return err;
2394}
2395
2396int
2397__vsock_connectible_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,
2398			    int flags)
2399{
2400	struct sock *sk;
2401	struct vsock_sock *vsk;
2402	const struct vsock_transport *transport;
2403	int err;
2404
2405	sk = sock->sk;
2406
2407	if (unlikely(flags & MSG_ERRQUEUE))
2408		return sock_recv_errqueue(sk, msg, len, SOL_VSOCK, VSOCK_RECVERR);
2409
2410	vsk = vsock_sk(sk);
2411	err = 0;
2412
2413	lock_sock(sk);
2414
2415	transport = vsk->transport;
2416
2417	if (!transport || sk->sk_state != TCP_ESTABLISHED) {
2418		/* Recvmsg is supposed to return 0 if a peer performs an
2419		 * orderly shutdown. Differentiate between that case and when a
2420		 * peer has not connected or a local shutdown occurred with the
2421		 * SOCK_DONE flag.
2422		 */
2423		if (sock_flag(sk, SOCK_DONE))
2424			err = 0;
2425		else
2426			err = -ENOTCONN;
2427
2428		goto out;
2429	}
2430
2431	if (flags & MSG_OOB) {
2432		err = -EOPNOTSUPP;
2433		goto out;
2434	}
2435
2436	/* We don't check peer_shutdown flag here since peer may actually shut
2437	 * down, but there can be data in the queue that a local socket can
2438	 * receive.
2439	 */
2440	if (sk->sk_shutdown & RCV_SHUTDOWN) {
2441		err = 0;
2442		goto out;
2443	}
2444
2445	/* It is valid on Linux to pass in a zero-length receive buffer.  This
2446	 * is not an error.  We may as well bail out now.
2447	 */
2448	if (!len) {
2449		err = 0;
2450		goto out;
2451	}
2452
2453	if (sk->sk_type == SOCK_STREAM)
2454		err = __vsock_stream_recvmsg(sk, msg, len, flags);
2455	else
2456		err = __vsock_seqpacket_recvmsg(sk, msg, len, flags);
2457
2458out:
2459	release_sock(sk);
2460	return err;
2461}
2462
2463int
2464vsock_connectible_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,
2465			  int flags)
2466{
2467#ifdef CONFIG_BPF_SYSCALL
2468	struct sock *sk = sock->sk;
2469	const struct proto *prot;
2470
2471	prot = READ_ONCE(sk->sk_prot);
2472	if (prot != &vsock_proto)
2473		return prot->recvmsg(sk, msg, len, flags, NULL);
2474#endif
2475
2476	return __vsock_connectible_recvmsg(sock, msg, len, flags);
2477}
2478EXPORT_SYMBOL_GPL(vsock_connectible_recvmsg);
2479
2480static int vsock_set_rcvlowat(struct sock *sk, int val)
2481{
2482	const struct vsock_transport *transport;
2483	struct vsock_sock *vsk;
2484
2485	vsk = vsock_sk(sk);
2486
2487	if (val > vsk->buffer_size)
2488		return -EINVAL;
2489
2490	transport = vsk->transport;
2491
2492	if (transport && transport->notify_set_rcvlowat) {
2493		int err;
2494
2495		err = transport->notify_set_rcvlowat(vsk, val);
2496		if (err)
2497			return err;
2498	}
2499
2500	WRITE_ONCE(sk->sk_rcvlowat, val ? : 1);
2501	return 0;
2502}
2503
2504static const struct proto_ops vsock_stream_ops = {
2505	.family = PF_VSOCK,
2506	.owner = THIS_MODULE,
2507	.release = vsock_release,
2508	.bind = vsock_bind,
2509	.connect = vsock_connect,
2510	.socketpair = sock_no_socketpair,
2511	.accept = vsock_accept,
2512	.getname = vsock_getname,
2513	.poll = vsock_poll,
2514	.ioctl = vsock_ioctl,
2515	.listen = vsock_listen,
2516	.shutdown = vsock_shutdown,
2517	.setsockopt = vsock_connectible_setsockopt,
2518	.getsockopt = vsock_connectible_getsockopt,
2519	.sendmsg = vsock_connectible_sendmsg,
2520	.recvmsg = vsock_connectible_recvmsg,
2521	.mmap = sock_no_mmap,
2522	.set_rcvlowat = vsock_set_rcvlowat,
2523	.read_skb = vsock_read_skb,
2524};
2525
2526static const struct proto_ops vsock_seqpacket_ops = {
2527	.family = PF_VSOCK,
2528	.owner = THIS_MODULE,
2529	.release = vsock_release,
2530	.bind = vsock_bind,
2531	.connect = vsock_connect,
2532	.socketpair = sock_no_socketpair,
2533	.accept = vsock_accept,
2534	.getname = vsock_getname,
2535	.poll = vsock_poll,
2536	.ioctl = vsock_ioctl,
2537	.listen = vsock_listen,
2538	.shutdown = vsock_shutdown,
2539	.setsockopt = vsock_connectible_setsockopt,
2540	.getsockopt = vsock_connectible_getsockopt,
2541	.sendmsg = vsock_connectible_sendmsg,
2542	.recvmsg = vsock_connectible_recvmsg,
2543	.mmap = sock_no_mmap,
2544	.read_skb = vsock_read_skb,
2545};
2546
2547static int vsock_create(struct net *net, struct socket *sock,
2548			int protocol, int kern)
2549{
2550	struct vsock_sock *vsk;
2551	struct sock *sk;
2552	int ret;
2553
2554	if (!sock)
2555		return -EINVAL;
2556
2557	if (protocol && protocol != PF_VSOCK)
2558		return -EPROTONOSUPPORT;
2559
2560	switch (sock->type) {
2561	case SOCK_DGRAM:
2562		sock->ops = &vsock_dgram_ops;
2563		break;
2564	case SOCK_STREAM:
2565		sock->ops = &vsock_stream_ops;
2566		break;
2567	case SOCK_SEQPACKET:
2568		sock->ops = &vsock_seqpacket_ops;
2569		break;
2570	default:
2571		return -ESOCKTNOSUPPORT;
2572	}
2573
2574	sock->state = SS_UNCONNECTED;
2575
2576	sk = __vsock_create(net, sock, NULL, GFP_KERNEL, 0, kern);
2577	if (!sk)
2578		return -ENOMEM;
2579
2580	vsk = vsock_sk(sk);
2581
2582	if (sock->type == SOCK_DGRAM) {
2583		ret = vsock_assign_transport(vsk, NULL);
2584		if (ret < 0) {
2585			sock->sk = NULL;
2586			sock_put(sk);
2587			return ret;
2588		}
2589	}
2590
2591	/* SOCK_DGRAM doesn't have 'setsockopt' callback set in its
2592	 * proto_ops, so there is no handler for custom logic.
2593	 */
2594	if (sock_type_connectible(sock->type))
2595		set_bit(SOCK_CUSTOM_SOCKOPT, &sk->sk_socket->flags);
2596
2597	vsock_insert_unbound(vsk);
2598
2599	return 0;
2600}
2601
2602static const struct net_proto_family vsock_family_ops = {
2603	.family = AF_VSOCK,
2604	.create = vsock_create,
2605	.owner = THIS_MODULE,
2606};
2607
2608static long vsock_dev_do_ioctl(struct file *filp,
2609			       unsigned int cmd, void __user *ptr)
2610{
2611	u32 __user *p = ptr;
2612	int retval = 0;
2613	u32 cid;
2614
2615	switch (cmd) {
2616	case IOCTL_VM_SOCKETS_GET_LOCAL_CID:
2617		/* To be compatible with the VMCI behavior, we prioritize the
2618		 * guest CID instead of well-know host CID (VMADDR_CID_HOST).
2619		 */
2620		cid = vsock_registered_transport_cid(&transport_g2h);
2621		if (cid == VMADDR_CID_ANY)
2622			cid = vsock_registered_transport_cid(&transport_h2g);
2623		if (cid == VMADDR_CID_ANY)
2624			cid = vsock_registered_transport_cid(&transport_local);
2625
2626		if (put_user(cid, p) != 0)
2627			retval = -EFAULT;
2628		break;
2629
2630	default:
2631		retval = -ENOIOCTLCMD;
2632	}
2633
2634	return retval;
2635}
2636
2637static long vsock_dev_ioctl(struct file *filp,
2638			    unsigned int cmd, unsigned long arg)
2639{
2640	return vsock_dev_do_ioctl(filp, cmd, (void __user *)arg);
2641}
2642
2643#ifdef CONFIG_COMPAT
2644static long vsock_dev_compat_ioctl(struct file *filp,
2645				   unsigned int cmd, unsigned long arg)
2646{
2647	return vsock_dev_do_ioctl(filp, cmd, compat_ptr(arg));
2648}
2649#endif
2650
2651static const struct file_operations vsock_device_ops = {
2652	.owner		= THIS_MODULE,
2653	.unlocked_ioctl	= vsock_dev_ioctl,
2654#ifdef CONFIG_COMPAT
2655	.compat_ioctl	= vsock_dev_compat_ioctl,
2656#endif
2657	.open		= nonseekable_open,
2658};
2659
2660static struct miscdevice vsock_device = {
2661	.name		= "vsock",
2662	.fops		= &vsock_device_ops,
2663};
2664
2665static int __init vsock_init(void)
2666{
2667	int err = 0;
2668
2669	vsock_init_tables();
2670
2671	vsock_proto.owner = THIS_MODULE;
2672	vsock_device.minor = MISC_DYNAMIC_MINOR;
2673	err = misc_register(&vsock_device);
2674	if (err) {
2675		pr_err("Failed to register misc device\n");
2676		goto err_reset_transport;
2677	}
2678
2679	err = proto_register(&vsock_proto, 1);	/* we want our slab */
2680	if (err) {
2681		pr_err("Cannot register vsock protocol\n");
2682		goto err_deregister_misc;
2683	}
2684
2685	err = sock_register(&vsock_family_ops);
2686	if (err) {
2687		pr_err("could not register af_vsock (%d) address family: %d\n",
2688		       AF_VSOCK, err);
2689		goto err_unregister_proto;
2690	}
2691
2692	vsock_bpf_build_proto();
2693
2694	return 0;
2695
2696err_unregister_proto:
2697	proto_unregister(&vsock_proto);
2698err_deregister_misc:
2699	misc_deregister(&vsock_device);
2700err_reset_transport:
2701	return err;
2702}
2703
2704static void __exit vsock_exit(void)
2705{
2706	misc_deregister(&vsock_device);
2707	sock_unregister(AF_VSOCK);
2708	proto_unregister(&vsock_proto);
2709}
2710
2711const struct vsock_transport *vsock_core_get_transport(struct vsock_sock *vsk)
2712{
2713	return vsk->transport;
2714}
2715EXPORT_SYMBOL_GPL(vsock_core_get_transport);
2716
2717int vsock_core_register(const struct vsock_transport *t, int features)
2718{
2719	const struct vsock_transport *t_h2g, *t_g2h, *t_dgram, *t_local;
2720	int err = mutex_lock_interruptible(&vsock_register_mutex);
2721
2722	if (err)
2723		return err;
2724
2725	t_h2g = transport_h2g;
2726	t_g2h = transport_g2h;
2727	t_dgram = transport_dgram;
2728	t_local = transport_local;
2729
2730	if (features & VSOCK_TRANSPORT_F_H2G) {
2731		if (t_h2g) {
2732			err = -EBUSY;
2733			goto err_busy;
2734		}
2735		t_h2g = t;
2736	}
2737
2738	if (features & VSOCK_TRANSPORT_F_G2H) {
2739		if (t_g2h) {
2740			err = -EBUSY;
2741			goto err_busy;
2742		}
2743		t_g2h = t;
2744	}
2745
2746	if (features & VSOCK_TRANSPORT_F_DGRAM) {
2747		if (t_dgram) {
2748			err = -EBUSY;
2749			goto err_busy;
2750		}
2751		t_dgram = t;
2752	}
2753
2754	if (features & VSOCK_TRANSPORT_F_LOCAL) {
2755		if (t_local) {
2756			err = -EBUSY;
2757			goto err_busy;
2758		}
2759		t_local = t;
2760	}
2761
2762	transport_h2g = t_h2g;
2763	transport_g2h = t_g2h;
2764	transport_dgram = t_dgram;
2765	transport_local = t_local;
2766
2767err_busy:
2768	mutex_unlock(&vsock_register_mutex);
2769	return err;
2770}
2771EXPORT_SYMBOL_GPL(vsock_core_register);
2772
2773void vsock_core_unregister(const struct vsock_transport *t)
2774{
2775	mutex_lock(&vsock_register_mutex);
2776
2777	if (transport_h2g == t)
2778		transport_h2g = NULL;
2779
2780	if (transport_g2h == t)
2781		transport_g2h = NULL;
2782
2783	if (transport_dgram == t)
2784		transport_dgram = NULL;
2785
2786	if (transport_local == t)
2787		transport_local = NULL;
2788
2789	mutex_unlock(&vsock_register_mutex);
2790}
2791EXPORT_SYMBOL_GPL(vsock_core_unregister);
2792
2793module_init(vsock_init);
2794module_exit(vsock_exit);
2795
2796MODULE_AUTHOR("VMware, Inc.");
2797MODULE_DESCRIPTION("VMware Virtual Socket Family");
2798MODULE_VERSION("1.0.2.0-k");
2799MODULE_LICENSE("GPL v2");