1// SPDX-License-Identifier: GPL-2.0-only
2/*
3 * VMware vSockets Driver
4 *
5 * Copyright (C) 2007-2013 VMware, Inc. All rights reserved.
6 */
7
8#include <linux/types.h>
9#include <linux/bitops.h>
10#include <linux/cred.h>
11#include <linux/init.h>
12#include <linux/io.h>
13#include <linux/kernel.h>
14#include <linux/kmod.h>
15#include <linux/list.h>
16#include <linux/module.h>
17#include <linux/mutex.h>
18#include <linux/net.h>
19#include <linux/poll.h>
20#include <linux/skbuff.h>
21#include <linux/smp.h>
22#include <linux/socket.h>
23#include <linux/stddef.h>
24#include <linux/unistd.h>
25#include <linux/wait.h>
26#include <linux/workqueue.h>
27#include <net/sock.h>
28#include <net/af_vsock.h>
29
30#include "vmci_transport_notify.h"
31
32static int vmci_transport_recv_dgram_cb(void *data, struct vmci_datagram *dg);
33static int vmci_transport_recv_stream_cb(void *data, struct vmci_datagram *dg);
34static void vmci_transport_peer_detach_cb(u32 sub_id,
35					  const struct vmci_event_data *ed,
36					  void *client_data);
37static void vmci_transport_recv_pkt_work(struct work_struct *work);
38static void vmci_transport_cleanup(struct work_struct *work);
39static int vmci_transport_recv_listen(struct sock *sk,
40				      struct vmci_transport_packet *pkt);
41static int vmci_transport_recv_connecting_server(
42					struct sock *sk,
43					struct sock *pending,
44					struct vmci_transport_packet *pkt);
45static int vmci_transport_recv_connecting_client(
46					struct sock *sk,
47					struct vmci_transport_packet *pkt);
48static int vmci_transport_recv_connecting_client_negotiate(
49					struct sock *sk,
50					struct vmci_transport_packet *pkt);
51static int vmci_transport_recv_connecting_client_invalid(
52					struct sock *sk,
53					struct vmci_transport_packet *pkt);
54static int vmci_transport_recv_connected(struct sock *sk,
55					 struct vmci_transport_packet *pkt);
56static bool vmci_transport_old_proto_override(bool *old_pkt_proto);
57static u16 vmci_transport_new_proto_supported_versions(void);
58static bool vmci_transport_proto_to_notify_struct(struct sock *sk, u16 *proto,
59						  bool old_pkt_proto);
60static bool vmci_check_transport(struct vsock_sock *vsk);
61
62struct vmci_transport_recv_pkt_info {
63	struct work_struct work;
64	struct sock *sk;
65	struct vmci_transport_packet pkt;
66};
67
68static LIST_HEAD(vmci_transport_cleanup_list);
69static DEFINE_SPINLOCK(vmci_transport_cleanup_lock);
70static DECLARE_WORK(vmci_transport_cleanup_work, vmci_transport_cleanup);
71
72static struct vmci_handle vmci_transport_stream_handle = { VMCI_INVALID_ID,
73							   VMCI_INVALID_ID };
74static u32 vmci_transport_qp_resumed_sub_id = VMCI_INVALID_ID;
75
76static int PROTOCOL_OVERRIDE = -1;
77
78static struct vsock_transport vmci_transport; /* forward declaration */
79
80/* Helper function to convert from a VMCI error code to a VSock error code. */
81
82static s32 vmci_transport_error_to_vsock_error(s32 vmci_error)
83{
84	switch (vmci_error) {
85	case VMCI_ERROR_NO_MEM:
86		return -ENOMEM;
87	case VMCI_ERROR_DUPLICATE_ENTRY:
88	case VMCI_ERROR_ALREADY_EXISTS:
89		return -EADDRINUSE;
90	case VMCI_ERROR_NO_ACCESS:
91		return -EPERM;
92	case VMCI_ERROR_NO_RESOURCES:
93		return -ENOBUFS;
94	case VMCI_ERROR_INVALID_RESOURCE:
95		return -EHOSTUNREACH;
96	case VMCI_ERROR_INVALID_ARGS:
97	default:
98		break;
99	}
100	return -EINVAL;
101}
102
103static u32 vmci_transport_peer_rid(u32 peer_cid)
104{
105	if (VMADDR_CID_HYPERVISOR == peer_cid)
106		return VMCI_TRANSPORT_HYPERVISOR_PACKET_RID;
107
108	return VMCI_TRANSPORT_PACKET_RID;
109}
110
111static inline void
112vmci_transport_packet_init(struct vmci_transport_packet *pkt,
113			   struct sockaddr_vm *src,
114			   struct sockaddr_vm *dst,
115			   u8 type,
116			   u64 size,
117			   u64 mode,
118			   struct vmci_transport_waiting_info *wait,
119			   u16 proto,
120			   struct vmci_handle handle)
121{
122	/* We register the stream control handler as an any cid handle so we
123	 * must always send from a source address of VMADDR_CID_ANY
124	 */
125	pkt->dg.src = vmci_make_handle(VMADDR_CID_ANY,
126				       VMCI_TRANSPORT_PACKET_RID);
127	pkt->dg.dst = vmci_make_handle(dst->svm_cid,
128				       vmci_transport_peer_rid(dst->svm_cid));
129	pkt->dg.payload_size = sizeof(*pkt) - sizeof(pkt->dg);
130	pkt->version = VMCI_TRANSPORT_PACKET_VERSION;
131	pkt->type = type;
132	pkt->src_port = src->svm_port;
133	pkt->dst_port = dst->svm_port;
134	memset(&pkt->proto, 0, sizeof(pkt->proto));
135	memset(&pkt->_reserved2, 0, sizeof(pkt->_reserved2));
136
137	switch (pkt->type) {
138	case VMCI_TRANSPORT_PACKET_TYPE_INVALID:
139		pkt->u.size = 0;
140		break;
141
142	case VMCI_TRANSPORT_PACKET_TYPE_REQUEST:
143	case VMCI_TRANSPORT_PACKET_TYPE_NEGOTIATE:
144		pkt->u.size = size;
145		break;
146
147	case VMCI_TRANSPORT_PACKET_TYPE_OFFER:
148	case VMCI_TRANSPORT_PACKET_TYPE_ATTACH:
149		pkt->u.handle = handle;
150		break;
151
152	case VMCI_TRANSPORT_PACKET_TYPE_WROTE:
153	case VMCI_TRANSPORT_PACKET_TYPE_READ:
154	case VMCI_TRANSPORT_PACKET_TYPE_RST:
155		pkt->u.size = 0;
156		break;
157
158	case VMCI_TRANSPORT_PACKET_TYPE_SHUTDOWN:
159		pkt->u.mode = mode;
160		break;
161
162	case VMCI_TRANSPORT_PACKET_TYPE_WAITING_READ:
163	case VMCI_TRANSPORT_PACKET_TYPE_WAITING_WRITE:
164		memcpy(&pkt->u.wait, wait, sizeof(pkt->u.wait));
165		break;
166
167	case VMCI_TRANSPORT_PACKET_TYPE_REQUEST2:
168	case VMCI_TRANSPORT_PACKET_TYPE_NEGOTIATE2:
169		pkt->u.size = size;
170		pkt->proto = proto;
171		break;
172	}
173}
174
175static inline void
176vmci_transport_packet_get_addresses(struct vmci_transport_packet *pkt,
177				    struct sockaddr_vm *local,
178				    struct sockaddr_vm *remote)
179{
180	vsock_addr_init(local, pkt->dg.dst.context, pkt->dst_port);
181	vsock_addr_init(remote, pkt->dg.src.context, pkt->src_port);
182}
183
184static int
185__vmci_transport_send_control_pkt(struct vmci_transport_packet *pkt,
186				  struct sockaddr_vm *src,
187				  struct sockaddr_vm *dst,
188				  enum vmci_transport_packet_type type,
189				  u64 size,
190				  u64 mode,
191				  struct vmci_transport_waiting_info *wait,
192				  u16 proto,
193				  struct vmci_handle handle,
194				  bool convert_error)
195{
196	int err;
197
198	vmci_transport_packet_init(pkt, src, dst, type, size, mode, wait,
199				   proto, handle);
200	err = vmci_datagram_send(&pkt->dg);
201	if (convert_error && (err < 0))
202		return vmci_transport_error_to_vsock_error(err);
203
204	return err;
205}
206
207static int
208vmci_transport_reply_control_pkt_fast(struct vmci_transport_packet *pkt,
209				      enum vmci_transport_packet_type type,
210				      u64 size,
211				      u64 mode,
212				      struct vmci_transport_waiting_info *wait,
213				      struct vmci_handle handle)
214{
215	struct vmci_transport_packet reply;
216	struct sockaddr_vm src, dst;
217
218	if (pkt->type == VMCI_TRANSPORT_PACKET_TYPE_RST) {
219		return 0;
220	} else {
221		vmci_transport_packet_get_addresses(pkt, &src, &dst);
222		return __vmci_transport_send_control_pkt(&reply, &src, &dst,
223							 type,
224							 size, mode, wait,
225							 VSOCK_PROTO_INVALID,
226							 handle, true);
227	}
228}
229
230static int
231vmci_transport_send_control_pkt_bh(struct sockaddr_vm *src,
232				   struct sockaddr_vm *dst,
233				   enum vmci_transport_packet_type type,
234				   u64 size,
235				   u64 mode,
236				   struct vmci_transport_waiting_info *wait,
237				   struct vmci_handle handle)
238{
239	/* Note that it is safe to use a single packet across all CPUs since
240	 * two tasklets of the same type are guaranteed to not ever run
241	 * simultaneously. If that ever changes, or VMCI stops using tasklets,
242	 * we can use per-cpu packets.
243	 */
244	static struct vmci_transport_packet pkt;
245
246	return __vmci_transport_send_control_pkt(&pkt, src, dst, type,
247						 size, mode, wait,
248						 VSOCK_PROTO_INVALID, handle,
249						 false);
250}
251
252static int
253vmci_transport_alloc_send_control_pkt(struct sockaddr_vm *src,
254				      struct sockaddr_vm *dst,
255				      enum vmci_transport_packet_type type,
256				      u64 size,
257				      u64 mode,
258				      struct vmci_transport_waiting_info *wait,
259				      u16 proto,
260				      struct vmci_handle handle)
261{
262	struct vmci_transport_packet *pkt;
263	int err;
264
265	pkt = kmalloc(sizeof(*pkt), GFP_KERNEL);
266	if (!pkt)
267		return -ENOMEM;
268
269	err = __vmci_transport_send_control_pkt(pkt, src, dst, type, size,
270						mode, wait, proto, handle,
271						true);
272	kfree(pkt);
273
274	return err;
275}
276
277static int
278vmci_transport_send_control_pkt(struct sock *sk,
279				enum vmci_transport_packet_type type,
280				u64 size,
281				u64 mode,
282				struct vmci_transport_waiting_info *wait,
283				u16 proto,
284				struct vmci_handle handle)
285{
286	struct vsock_sock *vsk;
287
288	vsk = vsock_sk(sk);
289
290	if (!vsock_addr_bound(&vsk->local_addr))
291		return -EINVAL;
292
293	if (!vsock_addr_bound(&vsk->remote_addr))
294		return -EINVAL;
295
296	return vmci_transport_alloc_send_control_pkt(&vsk->local_addr,
297						     &vsk->remote_addr,
298						     type, size, mode,
299						     wait, proto, handle);
300}
301
302static int vmci_transport_send_reset_bh(struct sockaddr_vm *dst,
303					struct sockaddr_vm *src,
304					struct vmci_transport_packet *pkt)
305{
306	if (pkt->type == VMCI_TRANSPORT_PACKET_TYPE_RST)
307		return 0;
308	return vmci_transport_send_control_pkt_bh(
309					dst, src,
310					VMCI_TRANSPORT_PACKET_TYPE_RST, 0,
311					0, NULL, VMCI_INVALID_HANDLE);
312}
313
314static int vmci_transport_send_reset(struct sock *sk,
315				     struct vmci_transport_packet *pkt)
316{
317	struct sockaddr_vm *dst_ptr;
318	struct sockaddr_vm dst;
319	struct vsock_sock *vsk;
320
321	if (pkt->type == VMCI_TRANSPORT_PACKET_TYPE_RST)
322		return 0;
323
324	vsk = vsock_sk(sk);
325
326	if (!vsock_addr_bound(&vsk->local_addr))
327		return -EINVAL;
328
329	if (vsock_addr_bound(&vsk->remote_addr)) {
330		dst_ptr = &vsk->remote_addr;
331	} else {
332		vsock_addr_init(&dst, pkt->dg.src.context,
333				pkt->src_port);
334		dst_ptr = &dst;
335	}
336	return vmci_transport_alloc_send_control_pkt(&vsk->local_addr, dst_ptr,
337					     VMCI_TRANSPORT_PACKET_TYPE_RST,
338					     0, 0, NULL, VSOCK_PROTO_INVALID,
339					     VMCI_INVALID_HANDLE);
340}
341
342static int vmci_transport_send_negotiate(struct sock *sk, size_t size)
343{
344	return vmci_transport_send_control_pkt(
345					sk,
346					VMCI_TRANSPORT_PACKET_TYPE_NEGOTIATE,
347					size, 0, NULL,
348					VSOCK_PROTO_INVALID,
349					VMCI_INVALID_HANDLE);
350}
351
352static int vmci_transport_send_negotiate2(struct sock *sk, size_t size,
353					  u16 version)
354{
355	return vmci_transport_send_control_pkt(
356					sk,
357					VMCI_TRANSPORT_PACKET_TYPE_NEGOTIATE2,
358					size, 0, NULL, version,
359					VMCI_INVALID_HANDLE);
360}
361
362static int vmci_transport_send_qp_offer(struct sock *sk,
363					struct vmci_handle handle)
364{
365	return vmci_transport_send_control_pkt(
366					sk, VMCI_TRANSPORT_PACKET_TYPE_OFFER, 0,
367					0, NULL,
368					VSOCK_PROTO_INVALID, handle);
369}
370
371static int vmci_transport_send_attach(struct sock *sk,
372				      struct vmci_handle handle)
373{
374	return vmci_transport_send_control_pkt(
375					sk, VMCI_TRANSPORT_PACKET_TYPE_ATTACH,
376					0, 0, NULL, VSOCK_PROTO_INVALID,
377					handle);
378}
379
380static int vmci_transport_reply_reset(struct vmci_transport_packet *pkt)
381{
382	return vmci_transport_reply_control_pkt_fast(
383						pkt,
384						VMCI_TRANSPORT_PACKET_TYPE_RST,
385						0, 0, NULL,
386						VMCI_INVALID_HANDLE);
387}
388
389static int vmci_transport_send_invalid_bh(struct sockaddr_vm *dst,
390					  struct sockaddr_vm *src)
391{
392	return vmci_transport_send_control_pkt_bh(
393					dst, src,
394					VMCI_TRANSPORT_PACKET_TYPE_INVALID,
395					0, 0, NULL, VMCI_INVALID_HANDLE);
396}
397
398int vmci_transport_send_wrote_bh(struct sockaddr_vm *dst,
399				 struct sockaddr_vm *src)
400{
401	return vmci_transport_send_control_pkt_bh(
402					dst, src,
403					VMCI_TRANSPORT_PACKET_TYPE_WROTE, 0,
404					0, NULL, VMCI_INVALID_HANDLE);
405}
406
407int vmci_transport_send_read_bh(struct sockaddr_vm *dst,
408				struct sockaddr_vm *src)
409{
410	return vmci_transport_send_control_pkt_bh(
411					dst, src,
412					VMCI_TRANSPORT_PACKET_TYPE_READ, 0,
413					0, NULL, VMCI_INVALID_HANDLE);
414}
415
416int vmci_transport_send_wrote(struct sock *sk)
417{
418	return vmci_transport_send_control_pkt(
419					sk, VMCI_TRANSPORT_PACKET_TYPE_WROTE, 0,
420					0, NULL, VSOCK_PROTO_INVALID,
421					VMCI_INVALID_HANDLE);
422}
423
424int vmci_transport_send_read(struct sock *sk)
425{
426	return vmci_transport_send_control_pkt(
427					sk, VMCI_TRANSPORT_PACKET_TYPE_READ, 0,
428					0, NULL, VSOCK_PROTO_INVALID,
429					VMCI_INVALID_HANDLE);
430}
431
432int vmci_transport_send_waiting_write(struct sock *sk,
433				      struct vmci_transport_waiting_info *wait)
434{
435	return vmci_transport_send_control_pkt(
436				sk, VMCI_TRANSPORT_PACKET_TYPE_WAITING_WRITE,
437				0, 0, wait, VSOCK_PROTO_INVALID,
438				VMCI_INVALID_HANDLE);
439}
440
441int vmci_transport_send_waiting_read(struct sock *sk,
442				     struct vmci_transport_waiting_info *wait)
443{
444	return vmci_transport_send_control_pkt(
445				sk, VMCI_TRANSPORT_PACKET_TYPE_WAITING_READ,
446				0, 0, wait, VSOCK_PROTO_INVALID,
447				VMCI_INVALID_HANDLE);
448}
449
450static int vmci_transport_shutdown(struct vsock_sock *vsk, int mode)
451{
452	return vmci_transport_send_control_pkt(
453					&vsk->sk,
454					VMCI_TRANSPORT_PACKET_TYPE_SHUTDOWN,
455					0, mode, NULL,
456					VSOCK_PROTO_INVALID,
457					VMCI_INVALID_HANDLE);
458}
459
460static int vmci_transport_send_conn_request(struct sock *sk, size_t size)
461{
462	return vmci_transport_send_control_pkt(sk,
463					VMCI_TRANSPORT_PACKET_TYPE_REQUEST,
464					size, 0, NULL,
465					VSOCK_PROTO_INVALID,
466					VMCI_INVALID_HANDLE);
467}
468
469static int vmci_transport_send_conn_request2(struct sock *sk, size_t size,
470					     u16 version)
471{
472	return vmci_transport_send_control_pkt(
473					sk, VMCI_TRANSPORT_PACKET_TYPE_REQUEST2,
474					size, 0, NULL, version,
475					VMCI_INVALID_HANDLE);
476}
477
478static struct sock *vmci_transport_get_pending(
479					struct sock *listener,
480					struct vmci_transport_packet *pkt)
481{
482	struct vsock_sock *vlistener;
483	struct vsock_sock *vpending;
484	struct sock *pending;
485	struct sockaddr_vm src;
486
487	vsock_addr_init(&src, pkt->dg.src.context, pkt->src_port);
488
489	vlistener = vsock_sk(listener);
490
491	list_for_each_entry(vpending, &vlistener->pending_links,
492			    pending_links) {
493		if (vsock_addr_equals_addr(&src, &vpending->remote_addr) &&
494		    pkt->dst_port == vpending->local_addr.svm_port) {
495			pending = sk_vsock(vpending);
496			sock_hold(pending);
497			goto found;
498		}
499	}
500
501	pending = NULL;
502found:
503	return pending;
504
505}
506
507static void vmci_transport_release_pending(struct sock *pending)
508{
509	sock_put(pending);
510}
511
512/* We allow two kinds of sockets to communicate with a restricted VM: 1)
513 * trusted sockets 2) sockets from applications running as the same user as the
514 * VM (this is only true for the host side and only when using hosted products)
515 */
516
517static bool vmci_transport_is_trusted(struct vsock_sock *vsock, u32 peer_cid)
518{
519	return vsock->trusted ||
520	       vmci_is_context_owner(peer_cid, vsock->owner->uid);
521}
522
523/* We allow sending datagrams to and receiving datagrams from a restricted VM
524 * only if it is trusted as described in vmci_transport_is_trusted.
525 */
526
527static bool vmci_transport_allow_dgram(struct vsock_sock *vsock, u32 peer_cid)
528{
529	if (VMADDR_CID_HYPERVISOR == peer_cid)
530		return true;
531
532	if (vsock->cached_peer != peer_cid) {
533		vsock->cached_peer = peer_cid;
534		if (!vmci_transport_is_trusted(vsock, peer_cid) &&
535		    (vmci_context_get_priv_flags(peer_cid) &
536		     VMCI_PRIVILEGE_FLAG_RESTRICTED)) {
537			vsock->cached_peer_allow_dgram = false;
538		} else {
539			vsock->cached_peer_allow_dgram = true;
540		}
541	}
542
543	return vsock->cached_peer_allow_dgram;
544}
545
546static int
547vmci_transport_queue_pair_alloc(struct vmci_qp **qpair,
548				struct vmci_handle *handle,
549				u64 produce_size,
550				u64 consume_size,
551				u32 peer, u32 flags, bool trusted)
552{
553	int err = 0;
554
555	if (trusted) {
556		/* Try to allocate our queue pair as trusted. This will only
557		 * work if vsock is running in the host.
558		 */
559
560		err = vmci_qpair_alloc(qpair, handle, produce_size,
561				       consume_size,
562				       peer, flags,
563				       VMCI_PRIVILEGE_FLAG_TRUSTED);
564		if (err != VMCI_ERROR_NO_ACCESS)
565			goto out;
566
567	}
568
569	err = vmci_qpair_alloc(qpair, handle, produce_size, consume_size,
570			       peer, flags, VMCI_NO_PRIVILEGE_FLAGS);
571out:
572	if (err < 0) {
573		pr_err_once("Could not attach to queue pair with %d\n", err);
574		err = vmci_transport_error_to_vsock_error(err);
575	}
576
577	return err;
578}
579
580static int
581vmci_transport_datagram_create_hnd(u32 resource_id,
582				   u32 flags,
583				   vmci_datagram_recv_cb recv_cb,
584				   void *client_data,
585				   struct vmci_handle *out_handle)
586{
587	int err = 0;
588
589	/* Try to allocate our datagram handler as trusted. This will only work
590	 * if vsock is running in the host.
591	 */
592
593	err = vmci_datagram_create_handle_priv(resource_id, flags,
594					       VMCI_PRIVILEGE_FLAG_TRUSTED,
595					       recv_cb,
596					       client_data, out_handle);
597
598	if (err == VMCI_ERROR_NO_ACCESS)
599		err = vmci_datagram_create_handle(resource_id, flags,
600						  recv_cb, client_data,
601						  out_handle);
602
603	return err;
604}
605
606/* This is invoked as part of a tasklet that's scheduled when the VMCI
607 * interrupt fires.  This is run in bottom-half context and if it ever needs to
608 * sleep it should defer that work to a work queue.
609 */
610
611static int vmci_transport_recv_dgram_cb(void *data, struct vmci_datagram *dg)
612{
613	struct sock *sk;
614	size_t size;
615	struct sk_buff *skb;
616	struct vsock_sock *vsk;
617
618	sk = (struct sock *)data;
619
620	/* This handler is privileged when this module is running on the host.
621	 * We will get datagrams from all endpoints (even VMs that are in a
622	 * restricted context). If we get one from a restricted context then
623	 * the destination socket must be trusted.
624	 *
625	 * NOTE: We access the socket struct without holding the lock here.
626	 * This is ok because the field we are interested is never modified
627	 * outside of the create and destruct socket functions.
628	 */
629	vsk = vsock_sk(sk);
630	if (!vmci_transport_allow_dgram(vsk, dg->src.context))
631		return VMCI_ERROR_NO_ACCESS;
632
633	size = VMCI_DG_SIZE(dg);
634
635	/* Attach the packet to the socket's receive queue as an sk_buff. */
636	skb = alloc_skb(size, GFP_ATOMIC);
637	if (!skb)
638		return VMCI_ERROR_NO_MEM;
639
640	/* sk_receive_skb() will do a sock_put(), so hold here. */
641	sock_hold(sk);
642	skb_put(skb, size);
643	memcpy(skb->data, dg, size);
644	sk_receive_skb(sk, skb, 0);
645
646	return VMCI_SUCCESS;
647}
648
649static bool vmci_transport_stream_allow(u32 cid, u32 port)
650{
651	static const u32 non_socket_contexts[] = {
652		VMADDR_CID_LOCAL,
653	};
654	int i;
655
656	BUILD_BUG_ON(sizeof(cid) != sizeof(*non_socket_contexts));
657
658	for (i = 0; i < ARRAY_SIZE(non_socket_contexts); i++) {
659		if (cid == non_socket_contexts[i])
660			return false;
661	}
662
663	return true;
664}
665
666/* This is invoked as part of a tasklet that's scheduled when the VMCI
667 * interrupt fires.  This is run in bottom-half context but it defers most of
668 * its work to the packet handling work queue.
669 */
670
671static int vmci_transport_recv_stream_cb(void *data, struct vmci_datagram *dg)
672{
673	struct sock *sk;
674	struct sockaddr_vm dst;
675	struct sockaddr_vm src;
676	struct vmci_transport_packet *pkt;
677	struct vsock_sock *vsk;
678	bool bh_process_pkt;
679	int err;
680
681	sk = NULL;
682	err = VMCI_SUCCESS;
683	bh_process_pkt = false;
684
685	/* Ignore incoming packets from contexts without sockets, or resources
686	 * that aren't vsock implementations.
687	 */
688
689	if (!vmci_transport_stream_allow(dg->src.context, -1)
690	    || vmci_transport_peer_rid(dg->src.context) != dg->src.resource)
691		return VMCI_ERROR_NO_ACCESS;
692
693	if (VMCI_DG_SIZE(dg) < sizeof(*pkt))
694		/* Drop datagrams that do not contain full VSock packets. */
695		return VMCI_ERROR_INVALID_ARGS;
696
697	pkt = (struct vmci_transport_packet *)dg;
698
699	/* Find the socket that should handle this packet.  First we look for a
700	 * connected socket and if there is none we look for a socket bound to
701	 * the destintation address.
702	 */
703	vsock_addr_init(&src, pkt->dg.src.context, pkt->src_port);
704	vsock_addr_init(&dst, pkt->dg.dst.context, pkt->dst_port);
705
706	sk = vsock_find_connected_socket(&src, &dst);
707	if (!sk) {
708		sk = vsock_find_bound_socket(&dst);
709		if (!sk) {
710			/* We could not find a socket for this specified
711			 * address.  If this packet is a RST, we just drop it.
712			 * If it is another packet, we send a RST.  Note that
713			 * we do not send a RST reply to RSTs so that we do not
714			 * continually send RSTs between two endpoints.
715			 *
716			 * Note that since this is a reply, dst is src and src
717			 * is dst.
718			 */
719			if (vmci_transport_send_reset_bh(&dst, &src, pkt) < 0)
720				pr_err("unable to send reset\n");
721
722			err = VMCI_ERROR_NOT_FOUND;
723			goto out;
724		}
725	}
726
727	/* If the received packet type is beyond all types known to this
728	 * implementation, reply with an invalid message.  Hopefully this will
729	 * help when implementing backwards compatibility in the future.
730	 */
731	if (pkt->type >= VMCI_TRANSPORT_PACKET_TYPE_MAX) {
732		vmci_transport_send_invalid_bh(&dst, &src);
733		err = VMCI_ERROR_INVALID_ARGS;
734		goto out;
735	}
736
737	/* This handler is privileged when this module is running on the host.
738	 * We will get datagram connect requests from all endpoints (even VMs
739	 * that are in a restricted context). If we get one from a restricted
740	 * context then the destination socket must be trusted.
741	 *
742	 * NOTE: We access the socket struct without holding the lock here.
743	 * This is ok because the field we are interested is never modified
744	 * outside of the create and destruct socket functions.
745	 */
746	vsk = vsock_sk(sk);
747	if (!vmci_transport_allow_dgram(vsk, pkt->dg.src.context)) {
748		err = VMCI_ERROR_NO_ACCESS;
749		goto out;
750	}
751
752	/* We do most everything in a work queue, but let's fast path the
753	 * notification of reads and writes to help data transfer performance.
754	 * We can only do this if there is no process context code executing
755	 * for this socket since that may change the state.
756	 */
757	bh_lock_sock(sk);
758
759	if (!sock_owned_by_user(sk)) {
760		/* The local context ID may be out of date, update it. */
761		vsk->local_addr.svm_cid = dst.svm_cid;
762
763		if (sk->sk_state == TCP_ESTABLISHED)
764			vmci_trans(vsk)->notify_ops->handle_notify_pkt(
765					sk, pkt, true, &dst, &src,
766					&bh_process_pkt);
767	}
768
769	bh_unlock_sock(sk);
770
771	if (!bh_process_pkt) {
772		struct vmci_transport_recv_pkt_info *recv_pkt_info;
773
774		recv_pkt_info = kmalloc(sizeof(*recv_pkt_info), GFP_ATOMIC);
775		if (!recv_pkt_info) {
776			if (vmci_transport_send_reset_bh(&dst, &src, pkt) < 0)
777				pr_err("unable to send reset\n");
778
779			err = VMCI_ERROR_NO_MEM;
780			goto out;
781		}
782
783		recv_pkt_info->sk = sk;
784		memcpy(&recv_pkt_info->pkt, pkt, sizeof(recv_pkt_info->pkt));
785		INIT_WORK(&recv_pkt_info->work, vmci_transport_recv_pkt_work);
786
787		schedule_work(&recv_pkt_info->work);
788		/* Clear sk so that the reference count incremented by one of
789		 * the Find functions above is not decremented below.  We need
790		 * that reference count for the packet handler we've scheduled
791		 * to run.
792		 */
793		sk = NULL;
794	}
795
796out:
797	if (sk)
798		sock_put(sk);
799
800	return err;
801}
802
803static void vmci_transport_handle_detach(struct sock *sk)
804{
805	struct vsock_sock *vsk;
806
807	vsk = vsock_sk(sk);
808	if (!vmci_handle_is_invalid(vmci_trans(vsk)->qp_handle)) {
809		sock_set_flag(sk, SOCK_DONE);
810
811		/* On a detach the peer will not be sending or receiving
812		 * anymore.
813		 */
814		vsk->peer_shutdown = SHUTDOWN_MASK;
815
816		/* We should not be sending anymore since the peer won't be
817		 * there to receive, but we can still receive if there is data
818		 * left in our consume queue. If the local endpoint is a host,
819		 * we can't call vsock_stream_has_data, since that may block,
820		 * but a host endpoint can't read data once the VM has
821		 * detached, so there is no available data in that case.
822		 */
823		if (vsk->local_addr.svm_cid == VMADDR_CID_HOST ||
824		    vsock_stream_has_data(vsk) <= 0) {
825			if (sk->sk_state == TCP_SYN_SENT) {
826				/* The peer may detach from a queue pair while
827				 * we are still in the connecting state, i.e.,
828				 * if the peer VM is killed after attaching to
829				 * a queue pair, but before we complete the
830				 * handshake. In that case, we treat the detach
831				 * event like a reset.
832				 */
833
834				sk->sk_state = TCP_CLOSE;
835				sk->sk_err = ECONNRESET;
836				sk->sk_error_report(sk);
837				return;
838			}
839			sk->sk_state = TCP_CLOSE;
840		}
841		sk->sk_state_change(sk);
842	}
843}
844
845static void vmci_transport_peer_detach_cb(u32 sub_id,
846					  const struct vmci_event_data *e_data,
847					  void *client_data)
848{
849	struct vmci_transport *trans = client_data;
850	const struct vmci_event_payload_qp *e_payload;
851
852	e_payload = vmci_event_data_const_payload(e_data);
853
854	/* XXX This is lame, we should provide a way to lookup sockets by
855	 * qp_handle.
856	 */
857	if (vmci_handle_is_invalid(e_payload->handle) ||
858	    !vmci_handle_is_equal(trans->qp_handle, e_payload->handle))
859		return;
860
861	/* We don't ask for delayed CBs when we subscribe to this event (we
862	 * pass 0 as flags to vmci_event_subscribe()).  VMCI makes no
863	 * guarantees in that case about what context we might be running in,
864	 * so it could be BH or process, blockable or non-blockable.  So we
865	 * need to account for all possible contexts here.
866	 */
867	spin_lock_bh(&trans->lock);
868	if (!trans->sk)
869		goto out;
870
871	/* Apart from here, trans->lock is only grabbed as part of sk destruct,
872	 * where trans->sk isn't locked.
873	 */
874	bh_lock_sock(trans->sk);
875
876	vmci_transport_handle_detach(trans->sk);
877
878	bh_unlock_sock(trans->sk);
879 out:
880	spin_unlock_bh(&trans->lock);
881}
882
883static void vmci_transport_qp_resumed_cb(u32 sub_id,
884					 const struct vmci_event_data *e_data,
885					 void *client_data)
886{
887	vsock_for_each_connected_socket(&vmci_transport,
888					vmci_transport_handle_detach);
889}
890
891static void vmci_transport_recv_pkt_work(struct work_struct *work)
892{
893	struct vmci_transport_recv_pkt_info *recv_pkt_info;
894	struct vmci_transport_packet *pkt;
895	struct sock *sk;
896
897	recv_pkt_info =
898		container_of(work, struct vmci_transport_recv_pkt_info, work);
899	sk = recv_pkt_info->sk;
900	pkt = &recv_pkt_info->pkt;
901
902	lock_sock(sk);
903
904	/* The local context ID may be out of date. */
905	vsock_sk(sk)->local_addr.svm_cid = pkt->dg.dst.context;
906
907	switch (sk->sk_state) {
908	case TCP_LISTEN:
909		vmci_transport_recv_listen(sk, pkt);
910		break;
911	case TCP_SYN_SENT:
912		/* Processing of pending connections for servers goes through
913		 * the listening socket, so see vmci_transport_recv_listen()
914		 * for that path.
915		 */
916		vmci_transport_recv_connecting_client(sk, pkt);
917		break;
918	case TCP_ESTABLISHED:
919		vmci_transport_recv_connected(sk, pkt);
920		break;
921	default:
922		/* Because this function does not run in the same context as
923		 * vmci_transport_recv_stream_cb it is possible that the
924		 * socket has closed. We need to let the other side know or it
925		 * could be sitting in a connect and hang forever. Send a
926		 * reset to prevent that.
927		 */
928		vmci_transport_send_reset(sk, pkt);
929		break;
930	}
931
932	release_sock(sk);
933	kfree(recv_pkt_info);
934	/* Release reference obtained in the stream callback when we fetched
935	 * this socket out of the bound or connected list.
936	 */
937	sock_put(sk);
938}
939
940static int vmci_transport_recv_listen(struct sock *sk,
941				      struct vmci_transport_packet *pkt)
942{
943	struct sock *pending;
944	struct vsock_sock *vpending;
945	int err;
946	u64 qp_size;
947	bool old_request = false;
948	bool old_pkt_proto = false;
949
950	err = 0;
951
952	/* Because we are in the listen state, we could be receiving a packet
953	 * for ourself or any previous connection requests that we received.
954	 * If it's the latter, we try to find a socket in our list of pending
955	 * connections and, if we do, call the appropriate handler for the
956	 * state that that socket is in.  Otherwise we try to service the
957	 * connection request.
958	 */
959	pending = vmci_transport_get_pending(sk, pkt);
960	if (pending) {
961		lock_sock(pending);
962
963		/* The local context ID may be out of date. */
964		vsock_sk(pending)->local_addr.svm_cid = pkt->dg.dst.context;
965
966		switch (pending->sk_state) {
967		case TCP_SYN_SENT:
968			err = vmci_transport_recv_connecting_server(sk,
969								    pending,
970								    pkt);
971			break;
972		default:
973			vmci_transport_send_reset(pending, pkt);
974			err = -EINVAL;
975		}
976
977		if (err < 0)
978			vsock_remove_pending(sk, pending);
979
980		release_sock(pending);
981		vmci_transport_release_pending(pending);
982
983		return err;
984	}
985
986	/* The listen state only accepts connection requests.  Reply with a
987	 * reset unless we received a reset.
988	 */
989
990	if (!(pkt->type == VMCI_TRANSPORT_PACKET_TYPE_REQUEST ||
991	      pkt->type == VMCI_TRANSPORT_PACKET_TYPE_REQUEST2)) {
992		vmci_transport_reply_reset(pkt);
993		return -EINVAL;
994	}
995
996	if (pkt->u.size == 0) {
997		vmci_transport_reply_reset(pkt);
998		return -EINVAL;
999	}
1000
1001	/* If this socket can't accommodate this connection request, we send a
1002	 * reset.  Otherwise we create and initialize a child socket and reply
1003	 * with a connection negotiation.
1004	 */
1005	if (sk->sk_ack_backlog >= sk->sk_max_ack_backlog) {
1006		vmci_transport_reply_reset(pkt);
1007		return -ECONNREFUSED;
1008	}
1009
1010	pending = vsock_create_connected(sk);
1011	if (!pending) {
1012		vmci_transport_send_reset(sk, pkt);
1013		return -ENOMEM;
1014	}
1015
1016	vpending = vsock_sk(pending);
1017
1018	vsock_addr_init(&vpending->local_addr, pkt->dg.dst.context,
1019			pkt->dst_port);
1020	vsock_addr_init(&vpending->remote_addr, pkt->dg.src.context,
1021			pkt->src_port);
1022
1023	err = vsock_assign_transport(vpending, vsock_sk(sk));
1024	/* Transport assigned (looking at remote_addr) must be the same
1025	 * where we received the request.
1026	 */
1027	if (err || !vmci_check_transport(vpending)) {
1028		vmci_transport_send_reset(sk, pkt);
1029		sock_put(pending);
1030		return err;
1031	}
1032
1033	/* If the proposed size fits within our min/max, accept it. Otherwise
1034	 * propose our own size.
1035	 */
1036	if (pkt->u.size >= vpending->buffer_min_size &&
1037	    pkt->u.size <= vpending->buffer_max_size) {
1038		qp_size = pkt->u.size;
1039	} else {
1040		qp_size = vpending->buffer_size;
1041	}
1042
1043	/* Figure out if we are using old or new requests based on the
1044	 * overrides pkt types sent by our peer.
1045	 */
1046	if (vmci_transport_old_proto_override(&old_pkt_proto)) {
1047		old_request = old_pkt_proto;
1048	} else {
1049		if (pkt->type == VMCI_TRANSPORT_PACKET_TYPE_REQUEST)
1050			old_request = true;
1051		else if (pkt->type == VMCI_TRANSPORT_PACKET_TYPE_REQUEST2)
1052			old_request = false;
1053
1054	}
1055
1056	if (old_request) {
1057		/* Handle a REQUEST (or override) */
1058		u16 version = VSOCK_PROTO_INVALID;
1059		if (vmci_transport_proto_to_notify_struct(
1060			pending, &version, true))
1061			err = vmci_transport_send_negotiate(pending, qp_size);
1062		else
1063			err = -EINVAL;
1064
1065	} else {
1066		/* Handle a REQUEST2 (or override) */
1067		int proto_int = pkt->proto;
1068		int pos;
1069		u16 active_proto_version = 0;
1070
1071		/* The list of possible protocols is the intersection of all
1072		 * protocols the client supports ... plus all the protocols we
1073		 * support.
1074		 */
1075		proto_int &= vmci_transport_new_proto_supported_versions();
1076
1077		/* We choose the highest possible protocol version and use that
1078		 * one.
1079		 */
1080		pos = fls(proto_int);
1081		if (pos) {
1082			active_proto_version = (1 << (pos - 1));
1083			if (vmci_transport_proto_to_notify_struct(
1084				pending, &active_proto_version, false))
1085				err = vmci_transport_send_negotiate2(pending,
1086							qp_size,
1087							active_proto_version);
1088			else
1089				err = -EINVAL;
1090
1091		} else {
1092			err = -EINVAL;
1093		}
1094	}
1095
1096	if (err < 0) {
1097		vmci_transport_send_reset(sk, pkt);
1098		sock_put(pending);
1099		err = vmci_transport_error_to_vsock_error(err);
1100		goto out;
1101	}
1102
1103	vsock_add_pending(sk, pending);
1104	sk_acceptq_added(sk);
1105
1106	pending->sk_state = TCP_SYN_SENT;
1107	vmci_trans(vpending)->produce_size =
1108		vmci_trans(vpending)->consume_size = qp_size;
1109	vpending->buffer_size = qp_size;
1110
1111	vmci_trans(vpending)->notify_ops->process_request(pending);
1112
1113	/* We might never receive another message for this socket and it's not
1114	 * connected to any process, so we have to ensure it gets cleaned up
1115	 * ourself.  Our delayed work function will take care of that.  Note
1116	 * that we do not ever cancel this function since we have few
1117	 * guarantees about its state when calling cancel_delayed_work().
1118	 * Instead we hold a reference on the socket for that function and make
1119	 * it capable of handling cases where it needs to do nothing but
1120	 * release that reference.
1121	 */
1122	vpending->listener = sk;
1123	sock_hold(sk);
1124	sock_hold(pending);
1125	schedule_delayed_work(&vpending->pending_work, HZ);
1126
1127out:
1128	return err;
1129}
1130
1131static int
1132vmci_transport_recv_connecting_server(struct sock *listener,
1133				      struct sock *pending,
1134				      struct vmci_transport_packet *pkt)
1135{
1136	struct vsock_sock *vpending;
1137	struct vmci_handle handle;
1138	struct vmci_qp *qpair;
1139	bool is_local;
1140	u32 flags;
1141	u32 detach_sub_id;
1142	int err;
1143	int skerr;
1144
1145	vpending = vsock_sk(pending);
1146	detach_sub_id = VMCI_INVALID_ID;
1147
1148	switch (pkt->type) {
1149	case VMCI_TRANSPORT_PACKET_TYPE_OFFER:
1150		if (vmci_handle_is_invalid(pkt->u.handle)) {
1151			vmci_transport_send_reset(pending, pkt);
1152			skerr = EPROTO;
1153			err = -EINVAL;
1154			goto destroy;
1155		}
1156		break;
1157	default:
1158		/* Close and cleanup the connection. */
1159		vmci_transport_send_reset(pending, pkt);
1160		skerr = EPROTO;
1161		err = pkt->type == VMCI_TRANSPORT_PACKET_TYPE_RST ? 0 : -EINVAL;
1162		goto destroy;
1163	}
1164
1165	/* In order to complete the connection we need to attach to the offered
1166	 * queue pair and send an attach notification.  We also subscribe to the
1167	 * detach event so we know when our peer goes away, and we do that
1168	 * before attaching so we don't miss an event.  If all this succeeds,
1169	 * we update our state and wakeup anything waiting in accept() for a
1170	 * connection.
1171	 */
1172
1173	/* We don't care about attach since we ensure the other side has
1174	 * attached by specifying the ATTACH_ONLY flag below.
1175	 */
1176	err = vmci_event_subscribe(VMCI_EVENT_QP_PEER_DETACH,
1177				   vmci_transport_peer_detach_cb,
1178				   vmci_trans(vpending), &detach_sub_id);
1179	if (err < VMCI_SUCCESS) {
1180		vmci_transport_send_reset(pending, pkt);
1181		err = vmci_transport_error_to_vsock_error(err);
1182		skerr = -err;
1183		goto destroy;
1184	}
1185
1186	vmci_trans(vpending)->detach_sub_id = detach_sub_id;
1187
1188	/* Now attach to the queue pair the client created. */
1189	handle = pkt->u.handle;
1190
1191	/* vpending->local_addr always has a context id so we do not need to
1192	 * worry about VMADDR_CID_ANY in this case.
1193	 */
1194	is_local =
1195	    vpending->remote_addr.svm_cid == vpending->local_addr.svm_cid;
1196	flags = VMCI_QPFLAG_ATTACH_ONLY;
1197	flags |= is_local ? VMCI_QPFLAG_LOCAL : 0;
1198
1199	err = vmci_transport_queue_pair_alloc(
1200					&qpair,
1201					&handle,
1202					vmci_trans(vpending)->produce_size,
1203					vmci_trans(vpending)->consume_size,
1204					pkt->dg.src.context,
1205					flags,
1206					vmci_transport_is_trusted(
1207						vpending,
1208						vpending->remote_addr.svm_cid));
1209	if (err < 0) {
1210		vmci_transport_send_reset(pending, pkt);
1211		skerr = -err;
1212		goto destroy;
1213	}
1214
1215	vmci_trans(vpending)->qp_handle = handle;
1216	vmci_trans(vpending)->qpair = qpair;
1217
1218	/* When we send the attach message, we must be ready to handle incoming
1219	 * control messages on the newly connected socket. So we move the
1220	 * pending socket to the connected state before sending the attach
1221	 * message. Otherwise, an incoming packet triggered by the attach being
1222	 * received by the peer may be processed concurrently with what happens
1223	 * below after sending the attach message, and that incoming packet
1224	 * will find the listening socket instead of the (currently) pending
1225	 * socket. Note that enqueueing the socket increments the reference
1226	 * count, so even if a reset comes before the connection is accepted,
1227	 * the socket will be valid until it is removed from the queue.
1228	 *
1229	 * If we fail sending the attach below, we remove the socket from the
1230	 * connected list and move the socket to TCP_CLOSE before
1231	 * releasing the lock, so a pending slow path processing of an incoming
1232	 * packet will not see the socket in the connected state in that case.
1233	 */
1234	pending->sk_state = TCP_ESTABLISHED;
1235
1236	vsock_insert_connected(vpending);
1237
1238	/* Notify our peer of our attach. */
1239	err = vmci_transport_send_attach(pending, handle);
1240	if (err < 0) {
1241		vsock_remove_connected(vpending);
1242		pr_err("Could not send attach\n");
1243		vmci_transport_send_reset(pending, pkt);
1244		err = vmci_transport_error_to_vsock_error(err);
1245		skerr = -err;
1246		goto destroy;
1247	}
1248
1249	/* We have a connection. Move the now connected socket from the
1250	 * listener's pending list to the accept queue so callers of accept()
1251	 * can find it.
1252	 */
1253	vsock_remove_pending(listener, pending);
1254	vsock_enqueue_accept(listener, pending);
1255
1256	/* Callers of accept() will be be waiting on the listening socket, not
1257	 * the pending socket.
1258	 */
1259	listener->sk_data_ready(listener);
1260
1261	return 0;
1262
1263destroy:
1264	pending->sk_err = skerr;
1265	pending->sk_state = TCP_CLOSE;
1266	/* As long as we drop our reference, all necessary cleanup will handle
1267	 * when the cleanup function drops its reference and our destruct
1268	 * implementation is called.  Note that since the listen handler will
1269	 * remove pending from the pending list upon our failure, the cleanup
1270	 * function won't drop the additional reference, which is why we do it
1271	 * here.
1272	 */
1273	sock_put(pending);
1274
1275	return err;
1276}
1277
1278static int
1279vmci_transport_recv_connecting_client(struct sock *sk,
1280				      struct vmci_transport_packet *pkt)
1281{
1282	struct vsock_sock *vsk;
1283	int err;
1284	int skerr;
1285
1286	vsk = vsock_sk(sk);
1287
1288	switch (pkt->type) {
1289	case VMCI_TRANSPORT_PACKET_TYPE_ATTACH:
1290		if (vmci_handle_is_invalid(pkt->u.handle) ||
1291		    !vmci_handle_is_equal(pkt->u.handle,
1292					  vmci_trans(vsk)->qp_handle)) {
1293			skerr = EPROTO;
1294			err = -EINVAL;
1295			goto destroy;
1296		}
1297
1298		/* Signify the socket is connected and wakeup the waiter in
1299		 * connect(). Also place the socket in the connected table for
1300		 * accounting (it can already be found since it's in the bound
1301		 * table).
1302		 */
1303		sk->sk_state = TCP_ESTABLISHED;
1304		sk->sk_socket->state = SS_CONNECTED;
1305		vsock_insert_connected(vsk);
1306		sk->sk_state_change(sk);
1307
1308		break;
1309	case VMCI_TRANSPORT_PACKET_TYPE_NEGOTIATE:
1310	case VMCI_TRANSPORT_PACKET_TYPE_NEGOTIATE2:
1311		if (pkt->u.size == 0
1312		    || pkt->dg.src.context != vsk->remote_addr.svm_cid
1313		    || pkt->src_port != vsk->remote_addr.svm_port
1314		    || !vmci_handle_is_invalid(vmci_trans(vsk)->qp_handle)
1315		    || vmci_trans(vsk)->qpair
1316		    || vmci_trans(vsk)->produce_size != 0
1317		    || vmci_trans(vsk)->consume_size != 0
1318		    || vmci_trans(vsk)->detach_sub_id != VMCI_INVALID_ID) {
1319			skerr = EPROTO;
1320			err = -EINVAL;
1321
1322			goto destroy;
1323		}
1324
1325		err = vmci_transport_recv_connecting_client_negotiate(sk, pkt);
1326		if (err) {
1327			skerr = -err;
1328			goto destroy;
1329		}
1330
1331		break;
1332	case VMCI_TRANSPORT_PACKET_TYPE_INVALID:
1333		err = vmci_transport_recv_connecting_client_invalid(sk, pkt);
1334		if (err) {
1335			skerr = -err;
1336			goto destroy;
1337		}
1338
1339		break;
1340	case VMCI_TRANSPORT_PACKET_TYPE_RST:
1341		/* Older versions of the linux code (WS 6.5 / ESX 4.0) used to
1342		 * continue processing here after they sent an INVALID packet.
1343		 * This meant that we got a RST after the INVALID. We ignore a
1344		 * RST after an INVALID. The common code doesn't send the RST
1345		 * ... so we can hang if an old version of the common code
1346		 * fails between getting a REQUEST and sending an OFFER back.
1347		 * Not much we can do about it... except hope that it doesn't
1348		 * happen.
1349		 */
1350		if (vsk->ignore_connecting_rst) {
1351			vsk->ignore_connecting_rst = false;
1352		} else {
1353			skerr = ECONNRESET;
1354			err = 0;
1355			goto destroy;
1356		}
1357
1358		break;
1359	default:
1360		/* Close and cleanup the connection. */
1361		skerr = EPROTO;
1362		err = -EINVAL;
1363		goto destroy;
1364	}
1365
1366	return 0;
1367
1368destroy:
1369	vmci_transport_send_reset(sk, pkt);
1370
1371	sk->sk_state = TCP_CLOSE;
1372	sk->sk_err = skerr;
1373	sk->sk_error_report(sk);
1374	return err;
1375}
1376
1377static int vmci_transport_recv_connecting_client_negotiate(
1378					struct sock *sk,
1379					struct vmci_transport_packet *pkt)
1380{
1381	int err;
1382	struct vsock_sock *vsk;
1383	struct vmci_handle handle;
1384	struct vmci_qp *qpair;
1385	u32 detach_sub_id;
1386	bool is_local;
1387	u32 flags;
1388	bool old_proto = true;
1389	bool old_pkt_proto;
1390	u16 version;
1391
1392	vsk = vsock_sk(sk);
1393	handle = VMCI_INVALID_HANDLE;
1394	detach_sub_id = VMCI_INVALID_ID;
1395
1396	/* If we have gotten here then we should be past the point where old
1397	 * linux vsock could have sent the bogus rst.
1398	 */
1399	vsk->sent_request = false;
1400	vsk->ignore_connecting_rst = false;
1401
1402	/* Verify that we're OK with the proposed queue pair size */
1403	if (pkt->u.size < vsk->buffer_min_size ||
1404	    pkt->u.size > vsk->buffer_max_size) {
1405		err = -EINVAL;
1406		goto destroy;
1407	}
1408
1409	/* At this point we know the CID the peer is using to talk to us. */
1410
1411	if (vsk->local_addr.svm_cid == VMADDR_CID_ANY)
1412		vsk->local_addr.svm_cid = pkt->dg.dst.context;
1413
1414	/* Setup the notify ops to be the highest supported version that both
1415	 * the server and the client support.
1416	 */
1417
1418	if (vmci_transport_old_proto_override(&old_pkt_proto)) {
1419		old_proto = old_pkt_proto;
1420	} else {
1421		if (pkt->type == VMCI_TRANSPORT_PACKET_TYPE_NEGOTIATE)
1422			old_proto = true;
1423		else if (pkt->type == VMCI_TRANSPORT_PACKET_TYPE_NEGOTIATE2)
1424			old_proto = false;
1425
1426	}
1427
1428	if (old_proto)
1429		version = VSOCK_PROTO_INVALID;
1430	else
1431		version = pkt->proto;
1432
1433	if (!vmci_transport_proto_to_notify_struct(sk, &version, old_proto)) {
1434		err = -EINVAL;
1435		goto destroy;
1436	}
1437
1438	/* Subscribe to detach events first.
1439	 *
1440	 * XXX We attach once for each queue pair created for now so it is easy
1441	 * to find the socket (it's provided), but later we should only
1442	 * subscribe once and add a way to lookup sockets by queue pair handle.
1443	 */
1444	err = vmci_event_subscribe(VMCI_EVENT_QP_PEER_DETACH,
1445				   vmci_transport_peer_detach_cb,
1446				   vmci_trans(vsk), &detach_sub_id);
1447	if (err < VMCI_SUCCESS) {
1448		err = vmci_transport_error_to_vsock_error(err);
1449		goto destroy;
1450	}
1451
1452	/* Make VMCI select the handle for us. */
1453	handle = VMCI_INVALID_HANDLE;
1454	is_local = vsk->remote_addr.svm_cid == vsk->local_addr.svm_cid;
1455	flags = is_local ? VMCI_QPFLAG_LOCAL : 0;
1456
1457	err = vmci_transport_queue_pair_alloc(&qpair,
1458					      &handle,
1459					      pkt->u.size,
1460					      pkt->u.size,
1461					      vsk->remote_addr.svm_cid,
1462					      flags,
1463					      vmci_transport_is_trusted(
1464						  vsk,
1465						  vsk->
1466						  remote_addr.svm_cid));
1467	if (err < 0)
1468		goto destroy;
1469
1470	err = vmci_transport_send_qp_offer(sk, handle);
1471	if (err < 0) {
1472		err = vmci_transport_error_to_vsock_error(err);
1473		goto destroy;
1474	}
1475
1476	vmci_trans(vsk)->qp_handle = handle;
1477	vmci_trans(vsk)->qpair = qpair;
1478
1479	vmci_trans(vsk)->produce_size = vmci_trans(vsk)->consume_size =
1480		pkt->u.size;
1481
1482	vmci_trans(vsk)->detach_sub_id = detach_sub_id;
1483
1484	vmci_trans(vsk)->notify_ops->process_negotiate(sk);
1485
1486	return 0;
1487
1488destroy:
1489	if (detach_sub_id != VMCI_INVALID_ID)
1490		vmci_event_unsubscribe(detach_sub_id);
1491
1492	if (!vmci_handle_is_invalid(handle))
1493		vmci_qpair_detach(&qpair);
1494
1495	return err;
1496}
1497
1498static int
1499vmci_transport_recv_connecting_client_invalid(struct sock *sk,
1500					      struct vmci_transport_packet *pkt)
1501{
1502	int err = 0;
1503	struct vsock_sock *vsk = vsock_sk(sk);
1504
1505	if (vsk->sent_request) {
1506		vsk->sent_request = false;
1507		vsk->ignore_connecting_rst = true;
1508
1509		err = vmci_transport_send_conn_request(sk, vsk->buffer_size);
1510		if (err < 0)
1511			err = vmci_transport_error_to_vsock_error(err);
1512		else
1513			err = 0;
1514
1515	}
1516
1517	return err;
1518}
1519
1520static int vmci_transport_recv_connected(struct sock *sk,
1521					 struct vmci_transport_packet *pkt)
1522{
1523	struct vsock_sock *vsk;
1524	bool pkt_processed = false;
1525
1526	/* In cases where we are closing the connection, it's sufficient to
1527	 * mark the state change (and maybe error) and wake up any waiting
1528	 * threads. Since this is a connected socket, it's owned by a user
1529	 * process and will be cleaned up when the failure is passed back on
1530	 * the current or next system call.  Our system call implementations
1531	 * must therefore check for error and state changes on entry and when
1532	 * being awoken.
1533	 */
1534	switch (pkt->type) {
1535	case VMCI_TRANSPORT_PACKET_TYPE_SHUTDOWN:
1536		if (pkt->u.mode) {
1537			vsk = vsock_sk(sk);
1538
1539			vsk->peer_shutdown |= pkt->u.mode;
1540			sk->sk_state_change(sk);
1541		}
1542		break;
1543
1544	case VMCI_TRANSPORT_PACKET_TYPE_RST:
1545		vsk = vsock_sk(sk);
1546		/* It is possible that we sent our peer a message (e.g a
1547		 * WAITING_READ) right before we got notified that the peer had
1548		 * detached. If that happens then we can get a RST pkt back
1549		 * from our peer even though there is data available for us to
1550		 * read. In that case, don't shutdown the socket completely but
1551		 * instead allow the local client to finish reading data off
1552		 * the queuepair. Always treat a RST pkt in connected mode like
1553		 * a clean shutdown.
1554		 */
1555		sock_set_flag(sk, SOCK_DONE);
1556		vsk->peer_shutdown = SHUTDOWN_MASK;
1557		if (vsock_stream_has_data(vsk) <= 0)
1558			sk->sk_state = TCP_CLOSING;
1559
1560		sk->sk_state_change(sk);
1561		break;
1562
1563	default:
1564		vsk = vsock_sk(sk);
1565		vmci_trans(vsk)->notify_ops->handle_notify_pkt(
1566				sk, pkt, false, NULL, NULL,
1567				&pkt_processed);
1568		if (!pkt_processed)
1569			return -EINVAL;
1570
1571		break;
1572	}
1573
1574	return 0;
1575}
1576
1577static int vmci_transport_socket_init(struct vsock_sock *vsk,
1578				      struct vsock_sock *psk)
1579{
1580	vsk->trans = kmalloc(sizeof(struct vmci_transport), GFP_KERNEL);
1581	if (!vsk->trans)
1582		return -ENOMEM;
1583
1584	vmci_trans(vsk)->dg_handle = VMCI_INVALID_HANDLE;
1585	vmci_trans(vsk)->qp_handle = VMCI_INVALID_HANDLE;
1586	vmci_trans(vsk)->qpair = NULL;
1587	vmci_trans(vsk)->produce_size = vmci_trans(vsk)->consume_size = 0;
1588	vmci_trans(vsk)->detach_sub_id = VMCI_INVALID_ID;
1589	vmci_trans(vsk)->notify_ops = NULL;
1590	INIT_LIST_HEAD(&vmci_trans(vsk)->elem);
1591	vmci_trans(vsk)->sk = &vsk->sk;
1592	spin_lock_init(&vmci_trans(vsk)->lock);
1593
1594	return 0;
1595}
1596
1597static void vmci_transport_free_resources(struct list_head *transport_list)
1598{
1599	while (!list_empty(transport_list)) {
1600		struct vmci_transport *transport =
1601		    list_first_entry(transport_list, struct vmci_transport,
1602				     elem);
1603		list_del(&transport->elem);
1604
1605		if (transport->detach_sub_id != VMCI_INVALID_ID) {
1606			vmci_event_unsubscribe(transport->detach_sub_id);
1607			transport->detach_sub_id = VMCI_INVALID_ID;
1608		}
1609
1610		if (!vmci_handle_is_invalid(transport->qp_handle)) {
1611			vmci_qpair_detach(&transport->qpair);
1612			transport->qp_handle = VMCI_INVALID_HANDLE;
1613			transport->produce_size = 0;
1614			transport->consume_size = 0;
1615		}
1616
1617		kfree(transport);
1618	}
1619}
1620
1621static void vmci_transport_cleanup(struct work_struct *work)
1622{
1623	LIST_HEAD(pending);
1624
1625	spin_lock_bh(&vmci_transport_cleanup_lock);
1626	list_replace_init(&vmci_transport_cleanup_list, &pending);
1627	spin_unlock_bh(&vmci_transport_cleanup_lock);
1628	vmci_transport_free_resources(&pending);
1629}
1630
1631static void vmci_transport_destruct(struct vsock_sock *vsk)
1632{
1633	/* transport can be NULL if we hit a failure at init() time */
1634	if (!vmci_trans(vsk))
1635		return;
1636
1637	/* Ensure that the detach callback doesn't use the sk/vsk
1638	 * we are about to destruct.
1639	 */
1640	spin_lock_bh(&vmci_trans(vsk)->lock);
1641	vmci_trans(vsk)->sk = NULL;
1642	spin_unlock_bh(&vmci_trans(vsk)->lock);
1643
1644	if (vmci_trans(vsk)->notify_ops)
1645		vmci_trans(vsk)->notify_ops->socket_destruct(vsk);
1646
1647	spin_lock_bh(&vmci_transport_cleanup_lock);
1648	list_add(&vmci_trans(vsk)->elem, &vmci_transport_cleanup_list);
1649	spin_unlock_bh(&vmci_transport_cleanup_lock);
1650	schedule_work(&vmci_transport_cleanup_work);
1651
1652	vsk->trans = NULL;
1653}
1654
1655static void vmci_transport_release(struct vsock_sock *vsk)
1656{
1657	vsock_remove_sock(vsk);
1658
1659	if (!vmci_handle_is_invalid(vmci_trans(vsk)->dg_handle)) {
1660		vmci_datagram_destroy_handle(vmci_trans(vsk)->dg_handle);
1661		vmci_trans(vsk)->dg_handle = VMCI_INVALID_HANDLE;
1662	}
1663}
1664
1665static int vmci_transport_dgram_bind(struct vsock_sock *vsk,
1666				     struct sockaddr_vm *addr)
1667{
1668	u32 port;
1669	u32 flags;
1670	int err;
1671
1672	/* VMCI will select a resource ID for us if we provide
1673	 * VMCI_INVALID_ID.
1674	 */
1675	port = addr->svm_port == VMADDR_PORT_ANY ?
1676			VMCI_INVALID_ID : addr->svm_port;
1677
1678	if (port <= LAST_RESERVED_PORT && !capable(CAP_NET_BIND_SERVICE))
1679		return -EACCES;
1680
1681	flags = addr->svm_cid == VMADDR_CID_ANY ?
1682				VMCI_FLAG_ANYCID_DG_HND : 0;
1683
1684	err = vmci_transport_datagram_create_hnd(port, flags,
1685						 vmci_transport_recv_dgram_cb,
1686						 &vsk->sk,
1687						 &vmci_trans(vsk)->dg_handle);
1688	if (err < VMCI_SUCCESS)
1689		return vmci_transport_error_to_vsock_error(err);
1690	vsock_addr_init(&vsk->local_addr, addr->svm_cid,
1691			vmci_trans(vsk)->dg_handle.resource);
1692
1693	return 0;
1694}
1695
1696static int vmci_transport_dgram_enqueue(
1697	struct vsock_sock *vsk,
1698	struct sockaddr_vm *remote_addr,
1699	struct msghdr *msg,
1700	size_t len)
1701{
1702	int err;
1703	struct vmci_datagram *dg;
1704
1705	if (len > VMCI_MAX_DG_PAYLOAD_SIZE)
1706		return -EMSGSIZE;
1707
1708	if (!vmci_transport_allow_dgram(vsk, remote_addr->svm_cid))
1709		return -EPERM;
1710
1711	/* Allocate a buffer for the user's message and our packet header. */
1712	dg = kmalloc(len + sizeof(*dg), GFP_KERNEL);
1713	if (!dg)
1714		return -ENOMEM;
1715
1716	err = memcpy_from_msg(VMCI_DG_PAYLOAD(dg), msg, len);
1717	if (err) {
1718		kfree(dg);
1719		return err;
1720	}
1721
1722	dg->dst = vmci_make_handle(remote_addr->svm_cid,
1723				   remote_addr->svm_port);
1724	dg->src = vmci_make_handle(vsk->local_addr.svm_cid,
1725				   vsk->local_addr.svm_port);
1726	dg->payload_size = len;
1727
1728	err = vmci_datagram_send(dg);
1729	kfree(dg);
1730	if (err < 0)
1731		return vmci_transport_error_to_vsock_error(err);
1732
1733	return err - sizeof(*dg);
1734}
1735
1736static int vmci_transport_dgram_dequeue(struct vsock_sock *vsk,
1737					struct msghdr *msg, size_t len,
1738					int flags)
1739{
1740	int err;
1741	int noblock;
1742	struct vmci_datagram *dg;
1743	size_t payload_len;
1744	struct sk_buff *skb;
1745
1746	noblock = flags & MSG_DONTWAIT;
1747
1748	if (flags & MSG_OOB || flags & MSG_ERRQUEUE)
1749		return -EOPNOTSUPP;
1750
1751	/* Retrieve the head sk_buff from the socket's receive queue. */
1752	err = 0;
1753	skb = skb_recv_datagram(&vsk->sk, flags, noblock, &err);
1754	if (!skb)
1755		return err;
1756
1757	dg = (struct vmci_datagram *)skb->data;
1758	if (!dg)
1759		/* err is 0, meaning we read zero bytes. */
1760		goto out;
1761
1762	payload_len = dg->payload_size;
1763	/* Ensure the sk_buff matches the payload size claimed in the packet. */
1764	if (payload_len != skb->len - sizeof(*dg)) {
1765		err = -EINVAL;
1766		goto out;
1767	}
1768
1769	if (payload_len > len) {
1770		payload_len = len;
1771		msg->msg_flags |= MSG_TRUNC;
1772	}
1773
1774	/* Place the datagram payload in the user's iovec. */
1775	err = skb_copy_datagram_msg(skb, sizeof(*dg), msg, payload_len);
1776	if (err)
1777		goto out;
1778
1779	if (msg->msg_name) {
1780		/* Provide the address of the sender. */
1781		DECLARE_SOCKADDR(struct sockaddr_vm *, vm_addr, msg->msg_name);
1782		vsock_addr_init(vm_addr, dg->src.context, dg->src.resource);
1783		msg->msg_namelen = sizeof(*vm_addr);
1784	}
1785	err = payload_len;
1786
1787out:
1788	skb_free_datagram(&vsk->sk, skb);
1789	return err;
1790}
1791
1792static bool vmci_transport_dgram_allow(u32 cid, u32 port)
1793{
1794	if (cid == VMADDR_CID_HYPERVISOR) {
1795		/* Registrations of PBRPC Servers do not modify VMX/Hypervisor
1796		 * state and are allowed.
1797		 */
1798		return port == VMCI_UNITY_PBRPC_REGISTER;
1799	}
1800
1801	return true;
1802}
1803
1804static int vmci_transport_connect(struct vsock_sock *vsk)
1805{
1806	int err;
1807	bool old_pkt_proto = false;
1808	struct sock *sk = &vsk->sk;
1809
1810	if (vmci_transport_old_proto_override(&old_pkt_proto) &&
1811		old_pkt_proto) {
1812		err = vmci_transport_send_conn_request(sk, vsk->buffer_size);
1813		if (err < 0) {
1814			sk->sk_state = TCP_CLOSE;
1815			return err;
1816		}
1817	} else {
1818		int supported_proto_versions =
1819			vmci_transport_new_proto_supported_versions();
1820		err = vmci_transport_send_conn_request2(sk, vsk->buffer_size,
1821				supported_proto_versions);
1822		if (err < 0) {
1823			sk->sk_state = TCP_CLOSE;
1824			return err;
1825		}
1826
1827		vsk->sent_request = true;
1828	}
1829
1830	return err;
1831}
1832
1833static ssize_t vmci_transport_stream_dequeue(
1834	struct vsock_sock *vsk,
1835	struct msghdr *msg,
1836	size_t len,
1837	int flags)
1838{
1839	if (flags & MSG_PEEK)
1840		return vmci_qpair_peekv(vmci_trans(vsk)->qpair, msg, len, 0);
1841	else
1842		return vmci_qpair_dequev(vmci_trans(vsk)->qpair, msg, len, 0);
1843}
1844
1845static ssize_t vmci_transport_stream_enqueue(
1846	struct vsock_sock *vsk,
1847	struct msghdr *msg,
1848	size_t len)
1849{
1850	return vmci_qpair_enquev(vmci_trans(vsk)->qpair, msg, len, 0);
1851}
1852
1853static s64 vmci_transport_stream_has_data(struct vsock_sock *vsk)
1854{
1855	return vmci_qpair_consume_buf_ready(vmci_trans(vsk)->qpair);
1856}
1857
1858static s64 vmci_transport_stream_has_space(struct vsock_sock *vsk)
1859{
1860	return vmci_qpair_produce_free_space(vmci_trans(vsk)->qpair);
1861}
1862
1863static u64 vmci_transport_stream_rcvhiwat(struct vsock_sock *vsk)
1864{
1865	return vmci_trans(vsk)->consume_size;
1866}
1867
1868static bool vmci_transport_stream_is_active(struct vsock_sock *vsk)
1869{
1870	return !vmci_handle_is_invalid(vmci_trans(vsk)->qp_handle);
1871}
1872
1873static int vmci_transport_notify_poll_in(
1874	struct vsock_sock *vsk,
1875	size_t target,
1876	bool *data_ready_now)
1877{
1878	return vmci_trans(vsk)->notify_ops->poll_in(
1879			&vsk->sk, target, data_ready_now);
1880}
1881
1882static int vmci_transport_notify_poll_out(
1883	struct vsock_sock *vsk,
1884	size_t target,
1885	bool *space_available_now)
1886{
1887	return vmci_trans(vsk)->notify_ops->poll_out(
1888			&vsk->sk, target, space_available_now);
1889}
1890
1891static int vmci_transport_notify_recv_init(
1892	struct vsock_sock *vsk,
1893	size_t target,
1894	struct vsock_transport_recv_notify_data *data)
1895{
1896	return vmci_trans(vsk)->notify_ops->recv_init(
1897			&vsk->sk, target,
1898			(struct vmci_transport_recv_notify_data *)data);
1899}
1900
1901static int vmci_transport_notify_recv_pre_block(
1902	struct vsock_sock *vsk,
1903	size_t target,
1904	struct vsock_transport_recv_notify_data *data)
1905{
1906	return vmci_trans(vsk)->notify_ops->recv_pre_block(
1907			&vsk->sk, target,
1908			(struct vmci_transport_recv_notify_data *)data);
1909}
1910
1911static int vmci_transport_notify_recv_pre_dequeue(
1912	struct vsock_sock *vsk,
1913	size_t target,
1914	struct vsock_transport_recv_notify_data *data)
1915{
1916	return vmci_trans(vsk)->notify_ops->recv_pre_dequeue(
1917			&vsk->sk, target,
1918			(struct vmci_transport_recv_notify_data *)data);
1919}
1920
1921static int vmci_transport_notify_recv_post_dequeue(
1922	struct vsock_sock *vsk,
1923	size_t target,
1924	ssize_t copied,
1925	bool data_read,
1926	struct vsock_transport_recv_notify_data *data)
1927{
1928	return vmci_trans(vsk)->notify_ops->recv_post_dequeue(
1929			&vsk->sk, target, copied, data_read,
1930			(struct vmci_transport_recv_notify_data *)data);
1931}
1932
1933static int vmci_transport_notify_send_init(
1934	struct vsock_sock *vsk,
1935	struct vsock_transport_send_notify_data *data)
1936{
1937	return vmci_trans(vsk)->notify_ops->send_init(
1938			&vsk->sk,
1939			(struct vmci_transport_send_notify_data *)data);
1940}
1941
1942static int vmci_transport_notify_send_pre_block(
1943	struct vsock_sock *vsk,
1944	struct vsock_transport_send_notify_data *data)
1945{
1946	return vmci_trans(vsk)->notify_ops->send_pre_block(
1947			&vsk->sk,
1948			(struct vmci_transport_send_notify_data *)data);
1949}
1950
1951static int vmci_transport_notify_send_pre_enqueue(
1952	struct vsock_sock *vsk,
1953	struct vsock_transport_send_notify_data *data)
1954{
1955	return vmci_trans(vsk)->notify_ops->send_pre_enqueue(
1956			&vsk->sk,
1957			(struct vmci_transport_send_notify_data *)data);
1958}
1959
1960static int vmci_transport_notify_send_post_enqueue(
1961	struct vsock_sock *vsk,
1962	ssize_t written,
1963	struct vsock_transport_send_notify_data *data)
1964{
1965	return vmci_trans(vsk)->notify_ops->send_post_enqueue(
1966			&vsk->sk, written,
1967			(struct vmci_transport_send_notify_data *)data);
1968}
1969
1970static bool vmci_transport_old_proto_override(bool *old_pkt_proto)
1971{
1972	if (PROTOCOL_OVERRIDE != -1) {
1973		if (PROTOCOL_OVERRIDE == 0)
1974			*old_pkt_proto = true;
1975		else
1976			*old_pkt_proto = false;
1977
1978		pr_info("Proto override in use\n");
1979		return true;
1980	}
1981
1982	return false;
1983}
1984
1985static bool vmci_transport_proto_to_notify_struct(struct sock *sk,
1986						  u16 *proto,
1987						  bool old_pkt_proto)
1988{
1989	struct vsock_sock *vsk = vsock_sk(sk);
1990
1991	if (old_pkt_proto) {
1992		if (*proto != VSOCK_PROTO_INVALID) {
1993			pr_err("Can't set both an old and new protocol\n");
1994			return false;
1995		}
1996		vmci_trans(vsk)->notify_ops = &vmci_transport_notify_pkt_ops;
1997		goto exit;
1998	}
1999
2000	switch (*proto) {
2001	case VSOCK_PROTO_PKT_ON_NOTIFY:
2002		vmci_trans(vsk)->notify_ops =
2003			&vmci_transport_notify_pkt_q_state_ops;
2004		break;
2005	default:
2006		pr_err("Unknown notify protocol version\n");
2007		return false;
2008	}
2009
2010exit:
2011	vmci_trans(vsk)->notify_ops->socket_init(sk);
2012	return true;
2013}
2014
2015static u16 vmci_transport_new_proto_supported_versions(void)
2016{
2017	if (PROTOCOL_OVERRIDE != -1)
2018		return PROTOCOL_OVERRIDE;
2019
2020	return VSOCK_PROTO_ALL_SUPPORTED;
2021}
2022
2023static u32 vmci_transport_get_local_cid(void)
2024{
2025	return vmci_get_context_id();
2026}
2027
2028static struct vsock_transport vmci_transport = {
2029	.module = THIS_MODULE,
2030	.init = vmci_transport_socket_init,
2031	.destruct = vmci_transport_destruct,
2032	.release = vmci_transport_release,
2033	.connect = vmci_transport_connect,
2034	.dgram_bind = vmci_transport_dgram_bind,
2035	.dgram_dequeue = vmci_transport_dgram_dequeue,
2036	.dgram_enqueue = vmci_transport_dgram_enqueue,
2037	.dgram_allow = vmci_transport_dgram_allow,
2038	.stream_dequeue = vmci_transport_stream_dequeue,
2039	.stream_enqueue = vmci_transport_stream_enqueue,
2040	.stream_has_data = vmci_transport_stream_has_data,
2041	.stream_has_space = vmci_transport_stream_has_space,
2042	.stream_rcvhiwat = vmci_transport_stream_rcvhiwat,
2043	.stream_is_active = vmci_transport_stream_is_active,
2044	.stream_allow = vmci_transport_stream_allow,
2045	.notify_poll_in = vmci_transport_notify_poll_in,
2046	.notify_poll_out = vmci_transport_notify_poll_out,
2047	.notify_recv_init = vmci_transport_notify_recv_init,
2048	.notify_recv_pre_block = vmci_transport_notify_recv_pre_block,
2049	.notify_recv_pre_dequeue = vmci_transport_notify_recv_pre_dequeue,
2050	.notify_recv_post_dequeue = vmci_transport_notify_recv_post_dequeue,
2051	.notify_send_init = vmci_transport_notify_send_init,
2052	.notify_send_pre_block = vmci_transport_notify_send_pre_block,
2053	.notify_send_pre_enqueue = vmci_transport_notify_send_pre_enqueue,
2054	.notify_send_post_enqueue = vmci_transport_notify_send_post_enqueue,
2055	.shutdown = vmci_transport_shutdown,
2056	.get_local_cid = vmci_transport_get_local_cid,
2057};
2058
2059static bool vmci_check_transport(struct vsock_sock *vsk)
2060{
2061	return vsk->transport == &vmci_transport;
2062}
2063
2064static void vmci_vsock_transport_cb(bool is_host)
2065{
2066	int features;
2067
2068	if (is_host)
2069		features = VSOCK_TRANSPORT_F_H2G;
2070	else
2071		features = VSOCK_TRANSPORT_F_G2H;
2072
2073	vsock_core_register(&vmci_transport, features);
2074}
2075
2076static int __init vmci_transport_init(void)
2077{
2078	int err;
2079
2080	/* Create the datagram handle that we will use to send and receive all
2081	 * VSocket control messages for this context.
2082	 */
2083	err = vmci_transport_datagram_create_hnd(VMCI_TRANSPORT_PACKET_RID,
2084						 VMCI_FLAG_ANYCID_DG_HND,
2085						 vmci_transport_recv_stream_cb,
2086						 NULL,
2087						 &vmci_transport_stream_handle);
2088	if (err < VMCI_SUCCESS) {
2089		pr_err("Unable to create datagram handle. (%d)\n", err);
2090		return vmci_transport_error_to_vsock_error(err);
2091	}
2092	err = vmci_event_subscribe(VMCI_EVENT_QP_RESUMED,
2093				   vmci_transport_qp_resumed_cb,
2094				   NULL, &vmci_transport_qp_resumed_sub_id);
2095	if (err < VMCI_SUCCESS) {
2096		pr_err("Unable to subscribe to resumed event. (%d)\n", err);
2097		err = vmci_transport_error_to_vsock_error(err);
2098		vmci_transport_qp_resumed_sub_id = VMCI_INVALID_ID;
2099		goto err_destroy_stream_handle;
2100	}
2101
2102	/* Register only with dgram feature, other features (H2G, G2H) will be
2103	 * registered when the first host or guest becomes active.
2104	 */
2105	err = vsock_core_register(&vmci_transport, VSOCK_TRANSPORT_F_DGRAM);
2106	if (err < 0)
2107		goto err_unsubscribe;
2108
2109	err = vmci_register_vsock_callback(vmci_vsock_transport_cb);
2110	if (err < 0)
2111		goto err_unregister;
2112
2113	return 0;
2114
2115err_unregister:
2116	vsock_core_unregister(&vmci_transport);
2117err_unsubscribe:
2118	vmci_event_unsubscribe(vmci_transport_qp_resumed_sub_id);
2119err_destroy_stream_handle:
2120	vmci_datagram_destroy_handle(vmci_transport_stream_handle);
2121	return err;
2122}
2123module_init(vmci_transport_init);
2124
2125static void __exit vmci_transport_exit(void)
2126{
2127	cancel_work_sync(&vmci_transport_cleanup_work);
2128	vmci_transport_free_resources(&vmci_transport_cleanup_list);
2129
2130	if (!vmci_handle_is_invalid(vmci_transport_stream_handle)) {
2131		if (vmci_datagram_destroy_handle(
2132			vmci_transport_stream_handle) != VMCI_SUCCESS)
2133			pr_err("Couldn't destroy datagram handle\n");
2134		vmci_transport_stream_handle = VMCI_INVALID_HANDLE;
2135	}
2136
2137	if (vmci_transport_qp_resumed_sub_id != VMCI_INVALID_ID) {
2138		vmci_event_unsubscribe(vmci_transport_qp_resumed_sub_id);
2139		vmci_transport_qp_resumed_sub_id = VMCI_INVALID_ID;
2140	}
2141
2142	vmci_register_vsock_callback(NULL);
2143	vsock_core_unregister(&vmci_transport);
2144}
2145module_exit(vmci_transport_exit);
2146
2147MODULE_AUTHOR("VMware, Inc.");
2148MODULE_DESCRIPTION("VMCI transport for Virtual Sockets");
2149MODULE_VERSION("1.0.5.0-k");
2150MODULE_LICENSE("GPL v2");
2151MODULE_ALIAS("vmware_vsock");
2152MODULE_ALIAS_NETPROTO(PF_VSOCK);
2153