1// SPDX-License-Identifier: GPL-2.0-only 2/* 3 * vhost transport for vsock 4 * 5 * Copyright (C) 2013-2015 Red Hat, Inc. 6 * Author: Asias He <asias@redhat.com> 7 * Stefan Hajnoczi <stefanha@redhat.com> 8 */ 9#include <linux/miscdevice.h> 10#include <linux/atomic.h> 11#include <linux/module.h> 12#include <linux/mutex.h> 13#include <linux/vmalloc.h> 14#include <net/sock.h> 15#include <linux/virtio_vsock.h> 16#include <linux/vhost.h> 17#include <linux/hashtable.h> 18 19#include <net/af_vsock.h> 20#include "vhost.h" 21 22#define VHOST_VSOCK_DEFAULT_HOST_CID 2 23/* Max number of bytes transferred before requeueing the job. 24 * Using this limit prevents one virtqueue from starving others. */ 25#define VHOST_VSOCK_WEIGHT 0x80000 26/* Max number of packets transferred before requeueing the job. 27 * Using this limit prevents one virtqueue from starving others with 28 * small pkts. 29 */ 30#define VHOST_VSOCK_PKT_WEIGHT 256 31 32enum { 33 VHOST_VSOCK_FEATURES = VHOST_FEATURES | 34 (1ULL << VIRTIO_F_ACCESS_PLATFORM) | 35 (1ULL << VIRTIO_VSOCK_F_SEQPACKET) 36}; 37 38enum { 39 VHOST_VSOCK_BACKEND_FEATURES = (1ULL << VHOST_BACKEND_F_IOTLB_MSG_V2) 40}; 41 42/* Used to track all the vhost_vsock instances on the system. */ 43static DEFINE_MUTEX(vhost_vsock_mutex); 44static DEFINE_READ_MOSTLY_HASHTABLE(vhost_vsock_hash, 8); 45 46struct vhost_vsock { 47 struct vhost_dev dev; 48 struct vhost_virtqueue vqs[2]; 49 50 /* Link to global vhost_vsock_hash, writes use vhost_vsock_mutex */ 51 struct hlist_node hash; 52 53 struct vhost_work send_pkt_work; 54 struct sk_buff_head send_pkt_queue; /* host->guest pending packets */ 55 56 atomic_t queued_replies; 57 58 u32 guest_cid; 59 bool seqpacket_allow; 60}; 61 62static u32 vhost_transport_get_local_cid(void) 63{ 64 return VHOST_VSOCK_DEFAULT_HOST_CID; 65} 66 67/* Callers that dereference the return value must hold vhost_vsock_mutex or the 68 * RCU read lock. 69 */ 70static struct vhost_vsock *vhost_vsock_get(u32 guest_cid) 71{ 72 struct vhost_vsock *vsock; 73 74 hash_for_each_possible_rcu(vhost_vsock_hash, vsock, hash, guest_cid) { 75 u32 other_cid = vsock->guest_cid; 76 77 /* Skip instances that have no CID yet */ 78 if (other_cid == 0) 79 continue; 80 81 if (other_cid == guest_cid) 82 return vsock; 83 84 } 85 86 return NULL; 87} 88 89static void 90vhost_transport_do_send_pkt(struct vhost_vsock *vsock, 91 struct vhost_virtqueue *vq) 92{ 93 struct vhost_virtqueue *tx_vq = &vsock->vqs[VSOCK_VQ_TX]; 94 int pkts = 0, total_len = 0; 95 bool added = false; 96 bool restart_tx = false; 97 98 mutex_lock(&vq->mutex); 99 100 if (!vhost_vq_get_backend(vq)) 101 goto out; 102 103 if (!vq_meta_prefetch(vq)) 104 goto out; 105 106 /* Avoid further vmexits, we're already processing the virtqueue */ 107 vhost_disable_notify(&vsock->dev, vq); 108 109 do { 110 struct virtio_vsock_hdr *hdr; 111 size_t iov_len, payload_len; 112 struct iov_iter iov_iter; 113 u32 flags_to_restore = 0; 114 struct sk_buff *skb; 115 unsigned out, in; 116 size_t nbytes; 117 int head; 118 119 skb = virtio_vsock_skb_dequeue(&vsock->send_pkt_queue); 120 121 if (!skb) { 122 vhost_enable_notify(&vsock->dev, vq); 123 break; 124 } 125 126 head = vhost_get_vq_desc(vq, vq->iov, ARRAY_SIZE(vq->iov), 127 &out, &in, NULL, NULL); 128 if (head < 0) { 129 virtio_vsock_skb_queue_head(&vsock->send_pkt_queue, skb); 130 break; 131 } 132 133 if (head == vq->num) { 134 virtio_vsock_skb_queue_head(&vsock->send_pkt_queue, skb); 135 /* We cannot finish yet if more buffers snuck in while 136 * re-enabling notify. 137 */ 138 if (unlikely(vhost_enable_notify(&vsock->dev, vq))) { 139 vhost_disable_notify(&vsock->dev, vq); 140 continue; 141 } 142 break; 143 } 144 145 if (out) { 146 kfree_skb(skb); 147 vq_err(vq, "Expected 0 output buffers, got %u\n", out); 148 break; 149 } 150 151 iov_len = iov_length(&vq->iov[out], in); 152 if (iov_len < sizeof(*hdr)) { 153 kfree_skb(skb); 154 vq_err(vq, "Buffer len [%zu] too small\n", iov_len); 155 break; 156 } 157 158 iov_iter_init(&iov_iter, ITER_DEST, &vq->iov[out], in, iov_len); 159 payload_len = skb->len; 160 hdr = virtio_vsock_hdr(skb); 161 162 /* If the packet is greater than the space available in the 163 * buffer, we split it using multiple buffers. 164 */ 165 if (payload_len > iov_len - sizeof(*hdr)) { 166 payload_len = iov_len - sizeof(*hdr); 167 168 /* As we are copying pieces of large packet's buffer to 169 * small rx buffers, headers of packets in rx queue are 170 * created dynamically and are initialized with header 171 * of current packet(except length). But in case of 172 * SOCK_SEQPACKET, we also must clear message delimeter 173 * bit (VIRTIO_VSOCK_SEQ_EOM) and MSG_EOR bit 174 * (VIRTIO_VSOCK_SEQ_EOR) if set. Otherwise, 175 * there will be sequence of packets with these 176 * bits set. After initialized header will be copied to 177 * rx buffer, these required bits will be restored. 178 */ 179 if (le32_to_cpu(hdr->flags) & VIRTIO_VSOCK_SEQ_EOM) { 180 hdr->flags &= ~cpu_to_le32(VIRTIO_VSOCK_SEQ_EOM); 181 flags_to_restore |= VIRTIO_VSOCK_SEQ_EOM; 182 183 if (le32_to_cpu(hdr->flags) & VIRTIO_VSOCK_SEQ_EOR) { 184 hdr->flags &= ~cpu_to_le32(VIRTIO_VSOCK_SEQ_EOR); 185 flags_to_restore |= VIRTIO_VSOCK_SEQ_EOR; 186 } 187 } 188 } 189 190 /* Set the correct length in the header */ 191 hdr->len = cpu_to_le32(payload_len); 192 193 nbytes = copy_to_iter(hdr, sizeof(*hdr), &iov_iter); 194 if (nbytes != sizeof(*hdr)) { 195 kfree_skb(skb); 196 vq_err(vq, "Faulted on copying pkt hdr\n"); 197 break; 198 } 199 200 nbytes = copy_to_iter(skb->data, payload_len, &iov_iter); 201 if (nbytes != payload_len) { 202 kfree_skb(skb); 203 vq_err(vq, "Faulted on copying pkt buf\n"); 204 break; 205 } 206 207 /* Deliver to monitoring devices all packets that we 208 * will transmit. 209 */ 210 virtio_transport_deliver_tap_pkt(skb); 211 212 vhost_add_used(vq, head, sizeof(*hdr) + payload_len); 213 added = true; 214 215 skb_pull(skb, payload_len); 216 total_len += payload_len; 217 218 /* If we didn't send all the payload we can requeue the packet 219 * to send it with the next available buffer. 220 */ 221 if (skb->len > 0) { 222 hdr->flags |= cpu_to_le32(flags_to_restore); 223 224 /* We are queueing the same skb to handle 225 * the remaining bytes, and we want to deliver it 226 * to monitoring devices in the next iteration. 227 */ 228 virtio_vsock_skb_clear_tap_delivered(skb); 229 virtio_vsock_skb_queue_head(&vsock->send_pkt_queue, skb); 230 } else { 231 if (virtio_vsock_skb_reply(skb)) { 232 int val; 233 234 val = atomic_dec_return(&vsock->queued_replies); 235 236 /* Do we have resources to resume tx 237 * processing? 238 */ 239 if (val + 1 == tx_vq->num) 240 restart_tx = true; 241 } 242 243 consume_skb(skb); 244 } 245 } while(likely(!vhost_exceeds_weight(vq, ++pkts, total_len))); 246 if (added) 247 vhost_signal(&vsock->dev, vq); 248 249out: 250 mutex_unlock(&vq->mutex); 251 252 if (restart_tx) 253 vhost_poll_queue(&tx_vq->poll); 254} 255 256static void vhost_transport_send_pkt_work(struct vhost_work *work) 257{ 258 struct vhost_virtqueue *vq; 259 struct vhost_vsock *vsock; 260 261 vsock = container_of(work, struct vhost_vsock, send_pkt_work); 262 vq = &vsock->vqs[VSOCK_VQ_RX]; 263 264 vhost_transport_do_send_pkt(vsock, vq); 265} 266 267static int 268vhost_transport_send_pkt(struct sk_buff *skb) 269{ 270 struct virtio_vsock_hdr *hdr = virtio_vsock_hdr(skb); 271 struct vhost_vsock *vsock; 272 int len = skb->len; 273 274 rcu_read_lock(); 275 276 /* Find the vhost_vsock according to guest context id */ 277 vsock = vhost_vsock_get(le64_to_cpu(hdr->dst_cid)); 278 if (!vsock) { 279 rcu_read_unlock(); 280 kfree_skb(skb); 281 return -ENODEV; 282 } 283 284 if (virtio_vsock_skb_reply(skb)) 285 atomic_inc(&vsock->queued_replies); 286 287 virtio_vsock_skb_queue_tail(&vsock->send_pkt_queue, skb); 288 vhost_vq_work_queue(&vsock->vqs[VSOCK_VQ_RX], &vsock->send_pkt_work); 289 290 rcu_read_unlock(); 291 return len; 292} 293 294static int 295vhost_transport_cancel_pkt(struct vsock_sock *vsk) 296{ 297 struct vhost_vsock *vsock; 298 int cnt = 0; 299 int ret = -ENODEV; 300 301 rcu_read_lock(); 302 303 /* Find the vhost_vsock according to guest context id */ 304 vsock = vhost_vsock_get(vsk->remote_addr.svm_cid); 305 if (!vsock) 306 goto out; 307 308 cnt = virtio_transport_purge_skbs(vsk, &vsock->send_pkt_queue); 309 310 if (cnt) { 311 struct vhost_virtqueue *tx_vq = &vsock->vqs[VSOCK_VQ_TX]; 312 int new_cnt; 313 314 new_cnt = atomic_sub_return(cnt, &vsock->queued_replies); 315 if (new_cnt + cnt >= tx_vq->num && new_cnt < tx_vq->num) 316 vhost_poll_queue(&tx_vq->poll); 317 } 318 319 ret = 0; 320out: 321 rcu_read_unlock(); 322 return ret; 323} 324 325static struct sk_buff * 326vhost_vsock_alloc_skb(struct vhost_virtqueue *vq, 327 unsigned int out, unsigned int in) 328{ 329 struct virtio_vsock_hdr *hdr; 330 struct iov_iter iov_iter; 331 struct sk_buff *skb; 332 size_t payload_len; 333 size_t nbytes; 334 size_t len; 335 336 if (in != 0) { 337 vq_err(vq, "Expected 0 input buffers, got %u\n", in); 338 return NULL; 339 } 340 341 len = iov_length(vq->iov, out); 342 343 /* len contains both payload and hdr */ 344 skb = virtio_vsock_alloc_skb(len, GFP_KERNEL); 345 if (!skb) 346 return NULL; 347 348 iov_iter_init(&iov_iter, ITER_SOURCE, vq->iov, out, len); 349 350 hdr = virtio_vsock_hdr(skb); 351 nbytes = copy_from_iter(hdr, sizeof(*hdr), &iov_iter); 352 if (nbytes != sizeof(*hdr)) { 353 vq_err(vq, "Expected %zu bytes for pkt->hdr, got %zu bytes\n", 354 sizeof(*hdr), nbytes); 355 kfree_skb(skb); 356 return NULL; 357 } 358 359 payload_len = le32_to_cpu(hdr->len); 360 361 /* No payload */ 362 if (!payload_len) 363 return skb; 364 365 /* The pkt is too big or the length in the header is invalid */ 366 if (payload_len > VIRTIO_VSOCK_MAX_PKT_BUF_SIZE || 367 payload_len + sizeof(*hdr) > len) { 368 kfree_skb(skb); 369 return NULL; 370 } 371 372 virtio_vsock_skb_rx_put(skb); 373 374 nbytes = copy_from_iter(skb->data, payload_len, &iov_iter); 375 if (nbytes != payload_len) { 376 vq_err(vq, "Expected %zu byte payload, got %zu bytes\n", 377 payload_len, nbytes); 378 kfree_skb(skb); 379 return NULL; 380 } 381 382 return skb; 383} 384 385/* Is there space left for replies to rx packets? */ 386static bool vhost_vsock_more_replies(struct vhost_vsock *vsock) 387{ 388 struct vhost_virtqueue *vq = &vsock->vqs[VSOCK_VQ_TX]; 389 int val; 390 391 smp_rmb(); /* paired with atomic_inc() and atomic_dec_return() */ 392 val = atomic_read(&vsock->queued_replies); 393 394 return val < vq->num; 395} 396 397static bool vhost_transport_seqpacket_allow(u32 remote_cid); 398 399static struct virtio_transport vhost_transport = { 400 .transport = { 401 .module = THIS_MODULE, 402 403 .get_local_cid = vhost_transport_get_local_cid, 404 405 .init = virtio_transport_do_socket_init, 406 .destruct = virtio_transport_destruct, 407 .release = virtio_transport_release, 408 .connect = virtio_transport_connect, 409 .shutdown = virtio_transport_shutdown, 410 .cancel_pkt = vhost_transport_cancel_pkt, 411 412 .dgram_enqueue = virtio_transport_dgram_enqueue, 413 .dgram_dequeue = virtio_transport_dgram_dequeue, 414 .dgram_bind = virtio_transport_dgram_bind, 415 .dgram_allow = virtio_transport_dgram_allow, 416 417 .stream_enqueue = virtio_transport_stream_enqueue, 418 .stream_dequeue = virtio_transport_stream_dequeue, 419 .stream_has_data = virtio_transport_stream_has_data, 420 .stream_has_space = virtio_transport_stream_has_space, 421 .stream_rcvhiwat = virtio_transport_stream_rcvhiwat, 422 .stream_is_active = virtio_transport_stream_is_active, 423 .stream_allow = virtio_transport_stream_allow, 424 425 .seqpacket_dequeue = virtio_transport_seqpacket_dequeue, 426 .seqpacket_enqueue = virtio_transport_seqpacket_enqueue, 427 .seqpacket_allow = vhost_transport_seqpacket_allow, 428 .seqpacket_has_data = virtio_transport_seqpacket_has_data, 429 430 .notify_poll_in = virtio_transport_notify_poll_in, 431 .notify_poll_out = virtio_transport_notify_poll_out, 432 .notify_recv_init = virtio_transport_notify_recv_init, 433 .notify_recv_pre_block = virtio_transport_notify_recv_pre_block, 434 .notify_recv_pre_dequeue = virtio_transport_notify_recv_pre_dequeue, 435 .notify_recv_post_dequeue = virtio_transport_notify_recv_post_dequeue, 436 .notify_send_init = virtio_transport_notify_send_init, 437 .notify_send_pre_block = virtio_transport_notify_send_pre_block, 438 .notify_send_pre_enqueue = virtio_transport_notify_send_pre_enqueue, 439 .notify_send_post_enqueue = virtio_transport_notify_send_post_enqueue, 440 .notify_buffer_size = virtio_transport_notify_buffer_size, 441 .notify_set_rcvlowat = virtio_transport_notify_set_rcvlowat, 442 443 .read_skb = virtio_transport_read_skb, 444 }, 445 446 .send_pkt = vhost_transport_send_pkt, 447}; 448 449static bool vhost_transport_seqpacket_allow(u32 remote_cid) 450{ 451 struct vhost_vsock *vsock; 452 bool seqpacket_allow = false; 453 454 rcu_read_lock(); 455 vsock = vhost_vsock_get(remote_cid); 456 457 if (vsock) 458 seqpacket_allow = vsock->seqpacket_allow; 459 460 rcu_read_unlock(); 461 462 return seqpacket_allow; 463} 464 465static void vhost_vsock_handle_tx_kick(struct vhost_work *work) 466{ 467 struct vhost_virtqueue *vq = container_of(work, struct vhost_virtqueue, 468 poll.work); 469 struct vhost_vsock *vsock = container_of(vq->dev, struct vhost_vsock, 470 dev); 471 int head, pkts = 0, total_len = 0; 472 unsigned int out, in; 473 struct sk_buff *skb; 474 bool added = false; 475 476 mutex_lock(&vq->mutex); 477 478 if (!vhost_vq_get_backend(vq)) 479 goto out; 480 481 if (!vq_meta_prefetch(vq)) 482 goto out; 483 484 vhost_disable_notify(&vsock->dev, vq); 485 do { 486 struct virtio_vsock_hdr *hdr; 487 488 if (!vhost_vsock_more_replies(vsock)) { 489 /* Stop tx until the device processes already 490 * pending replies. Leave tx virtqueue 491 * callbacks disabled. 492 */ 493 goto no_more_replies; 494 } 495 496 head = vhost_get_vq_desc(vq, vq->iov, ARRAY_SIZE(vq->iov), 497 &out, &in, NULL, NULL); 498 if (head < 0) 499 break; 500 501 if (head == vq->num) { 502 if (unlikely(vhost_enable_notify(&vsock->dev, vq))) { 503 vhost_disable_notify(&vsock->dev, vq); 504 continue; 505 } 506 break; 507 } 508 509 skb = vhost_vsock_alloc_skb(vq, out, in); 510 if (!skb) { 511 vq_err(vq, "Faulted on pkt\n"); 512 continue; 513 } 514 515 total_len += sizeof(*hdr) + skb->len; 516 517 /* Deliver to monitoring devices all received packets */ 518 virtio_transport_deliver_tap_pkt(skb); 519 520 hdr = virtio_vsock_hdr(skb); 521 522 /* Only accept correctly addressed packets */ 523 if (le64_to_cpu(hdr->src_cid) == vsock->guest_cid && 524 le64_to_cpu(hdr->dst_cid) == 525 vhost_transport_get_local_cid()) 526 virtio_transport_recv_pkt(&vhost_transport, skb); 527 else 528 kfree_skb(skb); 529 530 vhost_add_used(vq, head, 0); 531 added = true; 532 } while(likely(!vhost_exceeds_weight(vq, ++pkts, total_len))); 533 534no_more_replies: 535 if (added) 536 vhost_signal(&vsock->dev, vq); 537 538out: 539 mutex_unlock(&vq->mutex); 540} 541 542static void vhost_vsock_handle_rx_kick(struct vhost_work *work) 543{ 544 struct vhost_virtqueue *vq = container_of(work, struct vhost_virtqueue, 545 poll.work); 546 struct vhost_vsock *vsock = container_of(vq->dev, struct vhost_vsock, 547 dev); 548 549 vhost_transport_do_send_pkt(vsock, vq); 550} 551 552static int vhost_vsock_start(struct vhost_vsock *vsock) 553{ 554 struct vhost_virtqueue *vq; 555 size_t i; 556 int ret; 557 558 mutex_lock(&vsock->dev.mutex); 559 560 ret = vhost_dev_check_owner(&vsock->dev); 561 if (ret) 562 goto err; 563 564 for (i = 0; i < ARRAY_SIZE(vsock->vqs); i++) { 565 vq = &vsock->vqs[i]; 566 567 mutex_lock(&vq->mutex); 568 569 if (!vhost_vq_access_ok(vq)) { 570 ret = -EFAULT; 571 goto err_vq; 572 } 573 574 if (!vhost_vq_get_backend(vq)) { 575 vhost_vq_set_backend(vq, vsock); 576 ret = vhost_vq_init_access(vq); 577 if (ret) 578 goto err_vq; 579 } 580 581 mutex_unlock(&vq->mutex); 582 } 583 584 /* Some packets may have been queued before the device was started, 585 * let's kick the send worker to send them. 586 */ 587 vhost_vq_work_queue(&vsock->vqs[VSOCK_VQ_RX], &vsock->send_pkt_work); 588 589 mutex_unlock(&vsock->dev.mutex); 590 return 0; 591 592err_vq: 593 vhost_vq_set_backend(vq, NULL); 594 mutex_unlock(&vq->mutex); 595 596 for (i = 0; i < ARRAY_SIZE(vsock->vqs); i++) { 597 vq = &vsock->vqs[i]; 598 599 mutex_lock(&vq->mutex); 600 vhost_vq_set_backend(vq, NULL); 601 mutex_unlock(&vq->mutex); 602 } 603err: 604 mutex_unlock(&vsock->dev.mutex); 605 return ret; 606} 607 608static int vhost_vsock_stop(struct vhost_vsock *vsock, bool check_owner) 609{ 610 size_t i; 611 int ret = 0; 612 613 mutex_lock(&vsock->dev.mutex); 614 615 if (check_owner) { 616 ret = vhost_dev_check_owner(&vsock->dev); 617 if (ret) 618 goto err; 619 } 620 621 for (i = 0; i < ARRAY_SIZE(vsock->vqs); i++) { 622 struct vhost_virtqueue *vq = &vsock->vqs[i]; 623 624 mutex_lock(&vq->mutex); 625 vhost_vq_set_backend(vq, NULL); 626 mutex_unlock(&vq->mutex); 627 } 628 629err: 630 mutex_unlock(&vsock->dev.mutex); 631 return ret; 632} 633 634static void vhost_vsock_free(struct vhost_vsock *vsock) 635{ 636 kvfree(vsock); 637} 638 639static int vhost_vsock_dev_open(struct inode *inode, struct file *file) 640{ 641 struct vhost_virtqueue **vqs; 642 struct vhost_vsock *vsock; 643 int ret; 644 645 /* This struct is large and allocation could fail, fall back to vmalloc 646 * if there is no other way. 647 */ 648 vsock = kvmalloc(sizeof(*vsock), GFP_KERNEL | __GFP_RETRY_MAYFAIL); 649 if (!vsock) 650 return -ENOMEM; 651 652 vqs = kmalloc_array(ARRAY_SIZE(vsock->vqs), sizeof(*vqs), GFP_KERNEL); 653 if (!vqs) { 654 ret = -ENOMEM; 655 goto out; 656 } 657 658 vsock->guest_cid = 0; /* no CID assigned yet */ 659 660 atomic_set(&vsock->queued_replies, 0); 661 662 vqs[VSOCK_VQ_TX] = &vsock->vqs[VSOCK_VQ_TX]; 663 vqs[VSOCK_VQ_RX] = &vsock->vqs[VSOCK_VQ_RX]; 664 vsock->vqs[VSOCK_VQ_TX].handle_kick = vhost_vsock_handle_tx_kick; 665 vsock->vqs[VSOCK_VQ_RX].handle_kick = vhost_vsock_handle_rx_kick; 666 667 vhost_dev_init(&vsock->dev, vqs, ARRAY_SIZE(vsock->vqs), 668 UIO_MAXIOV, VHOST_VSOCK_PKT_WEIGHT, 669 VHOST_VSOCK_WEIGHT, true, NULL); 670 671 file->private_data = vsock; 672 skb_queue_head_init(&vsock->send_pkt_queue); 673 vhost_work_init(&vsock->send_pkt_work, vhost_transport_send_pkt_work); 674 return 0; 675 676out: 677 vhost_vsock_free(vsock); 678 return ret; 679} 680 681static void vhost_vsock_flush(struct vhost_vsock *vsock) 682{ 683 vhost_dev_flush(&vsock->dev); 684} 685 686static void vhost_vsock_reset_orphans(struct sock *sk) 687{ 688 struct vsock_sock *vsk = vsock_sk(sk); 689 690 /* vmci_transport.c doesn't take sk_lock here either. At least we're 691 * under vsock_table_lock so the sock cannot disappear while we're 692 * executing. 693 */ 694 695 /* If the peer is still valid, no need to reset connection */ 696 if (vhost_vsock_get(vsk->remote_addr.svm_cid)) 697 return; 698 699 /* If the close timeout is pending, let it expire. This avoids races 700 * with the timeout callback. 701 */ 702 if (vsk->close_work_scheduled) 703 return; 704 705 sock_set_flag(sk, SOCK_DONE); 706 vsk->peer_shutdown = SHUTDOWN_MASK; 707 sk->sk_state = SS_UNCONNECTED; 708 sk->sk_err = ECONNRESET; 709 sk_error_report(sk); 710} 711 712static int vhost_vsock_dev_release(struct inode *inode, struct file *file) 713{ 714 struct vhost_vsock *vsock = file->private_data; 715 716 mutex_lock(&vhost_vsock_mutex); 717 if (vsock->guest_cid) 718 hash_del_rcu(&vsock->hash); 719 mutex_unlock(&vhost_vsock_mutex); 720 721 /* Wait for other CPUs to finish using vsock */ 722 synchronize_rcu(); 723 724 /* Iterating over all connections for all CIDs to find orphans is 725 * inefficient. Room for improvement here. */ 726 vsock_for_each_connected_socket(&vhost_transport.transport, 727 vhost_vsock_reset_orphans); 728 729 /* Don't check the owner, because we are in the release path, so we 730 * need to stop the vsock device in any case. 731 * vhost_vsock_stop() can not fail in this case, so we don't need to 732 * check the return code. 733 */ 734 vhost_vsock_stop(vsock, false); 735 vhost_vsock_flush(vsock); 736 vhost_dev_stop(&vsock->dev); 737 738 virtio_vsock_skb_queue_purge(&vsock->send_pkt_queue); 739 740 vhost_dev_cleanup(&vsock->dev); 741 kfree(vsock->dev.vqs); 742 vhost_vsock_free(vsock); 743 return 0; 744} 745 746static int vhost_vsock_set_cid(struct vhost_vsock *vsock, u64 guest_cid) 747{ 748 struct vhost_vsock *other; 749 750 /* Refuse reserved CIDs */ 751 if (guest_cid <= VMADDR_CID_HOST || 752 guest_cid == U32_MAX) 753 return -EINVAL; 754 755 /* 64-bit CIDs are not yet supported */ 756 if (guest_cid > U32_MAX) 757 return -EINVAL; 758 759 /* Refuse if CID is assigned to the guest->host transport (i.e. nested 760 * VM), to make the loopback work. 761 */ 762 if (vsock_find_cid(guest_cid)) 763 return -EADDRINUSE; 764 765 /* Refuse if CID is already in use */ 766 mutex_lock(&vhost_vsock_mutex); 767 other = vhost_vsock_get(guest_cid); 768 if (other && other != vsock) { 769 mutex_unlock(&vhost_vsock_mutex); 770 return -EADDRINUSE; 771 } 772 773 if (vsock->guest_cid) 774 hash_del_rcu(&vsock->hash); 775 776 vsock->guest_cid = guest_cid; 777 hash_add_rcu(vhost_vsock_hash, &vsock->hash, vsock->guest_cid); 778 mutex_unlock(&vhost_vsock_mutex); 779 780 return 0; 781} 782 783static int vhost_vsock_set_features(struct vhost_vsock *vsock, u64 features) 784{ 785 struct vhost_virtqueue *vq; 786 int i; 787 788 if (features & ~VHOST_VSOCK_FEATURES) 789 return -EOPNOTSUPP; 790 791 mutex_lock(&vsock->dev.mutex); 792 if ((features & (1 << VHOST_F_LOG_ALL)) && 793 !vhost_log_access_ok(&vsock->dev)) { 794 goto err; 795 } 796 797 if ((features & (1ULL << VIRTIO_F_ACCESS_PLATFORM))) { 798 if (vhost_init_device_iotlb(&vsock->dev)) 799 goto err; 800 } 801 802 if (features & (1ULL << VIRTIO_VSOCK_F_SEQPACKET)) 803 vsock->seqpacket_allow = true; 804 805 for (i = 0; i < ARRAY_SIZE(vsock->vqs); i++) { 806 vq = &vsock->vqs[i]; 807 mutex_lock(&vq->mutex); 808 vq->acked_features = features; 809 mutex_unlock(&vq->mutex); 810 } 811 mutex_unlock(&vsock->dev.mutex); 812 return 0; 813 814err: 815 mutex_unlock(&vsock->dev.mutex); 816 return -EFAULT; 817} 818 819static long vhost_vsock_dev_ioctl(struct file *f, unsigned int ioctl, 820 unsigned long arg) 821{ 822 struct vhost_vsock *vsock = f->private_data; 823 void __user *argp = (void __user *)arg; 824 u64 guest_cid; 825 u64 features; 826 int start; 827 int r; 828 829 switch (ioctl) { 830 case VHOST_VSOCK_SET_GUEST_CID: 831 if (copy_from_user(&guest_cid, argp, sizeof(guest_cid))) 832 return -EFAULT; 833 return vhost_vsock_set_cid(vsock, guest_cid); 834 case VHOST_VSOCK_SET_RUNNING: 835 if (copy_from_user(&start, argp, sizeof(start))) 836 return -EFAULT; 837 if (start) 838 return vhost_vsock_start(vsock); 839 else 840 return vhost_vsock_stop(vsock, true); 841 case VHOST_GET_FEATURES: 842 features = VHOST_VSOCK_FEATURES; 843 if (copy_to_user(argp, &features, sizeof(features))) 844 return -EFAULT; 845 return 0; 846 case VHOST_SET_FEATURES: 847 if (copy_from_user(&features, argp, sizeof(features))) 848 return -EFAULT; 849 return vhost_vsock_set_features(vsock, features); 850 case VHOST_GET_BACKEND_FEATURES: 851 features = VHOST_VSOCK_BACKEND_FEATURES; 852 if (copy_to_user(argp, &features, sizeof(features))) 853 return -EFAULT; 854 return 0; 855 case VHOST_SET_BACKEND_FEATURES: 856 if (copy_from_user(&features, argp, sizeof(features))) 857 return -EFAULT; 858 if (features & ~VHOST_VSOCK_BACKEND_FEATURES) 859 return -EOPNOTSUPP; 860 vhost_set_backend_features(&vsock->dev, features); 861 return 0; 862 default: 863 mutex_lock(&vsock->dev.mutex); 864 r = vhost_dev_ioctl(&vsock->dev, ioctl, argp); 865 if (r == -ENOIOCTLCMD) 866 r = vhost_vring_ioctl(&vsock->dev, ioctl, argp); 867 else 868 vhost_vsock_flush(vsock); 869 mutex_unlock(&vsock->dev.mutex); 870 return r; 871 } 872} 873 874static ssize_t vhost_vsock_chr_read_iter(struct kiocb *iocb, struct iov_iter *to) 875{ 876 struct file *file = iocb->ki_filp; 877 struct vhost_vsock *vsock = file->private_data; 878 struct vhost_dev *dev = &vsock->dev; 879 int noblock = file->f_flags & O_NONBLOCK; 880 881 return vhost_chr_read_iter(dev, to, noblock); 882} 883 884static ssize_t vhost_vsock_chr_write_iter(struct kiocb *iocb, 885 struct iov_iter *from) 886{ 887 struct file *file = iocb->ki_filp; 888 struct vhost_vsock *vsock = file->private_data; 889 struct vhost_dev *dev = &vsock->dev; 890 891 return vhost_chr_write_iter(dev, from); 892} 893 894static __poll_t vhost_vsock_chr_poll(struct file *file, poll_table *wait) 895{ 896 struct vhost_vsock *vsock = file->private_data; 897 struct vhost_dev *dev = &vsock->dev; 898 899 return vhost_chr_poll(file, dev, wait); 900} 901 902static const struct file_operations vhost_vsock_fops = { 903 .owner = THIS_MODULE, 904 .open = vhost_vsock_dev_open, 905 .release = vhost_vsock_dev_release, 906 .llseek = noop_llseek, 907 .unlocked_ioctl = vhost_vsock_dev_ioctl, 908 .compat_ioctl = compat_ptr_ioctl, 909 .read_iter = vhost_vsock_chr_read_iter, 910 .write_iter = vhost_vsock_chr_write_iter, 911 .poll = vhost_vsock_chr_poll, 912}; 913 914static struct miscdevice vhost_vsock_misc = { 915 .minor = VHOST_VSOCK_MINOR, 916 .name = "vhost-vsock", 917 .fops = &vhost_vsock_fops, 918}; 919 920static int __init vhost_vsock_init(void) 921{ 922 int ret; 923 924 ret = vsock_core_register(&vhost_transport.transport, 925 VSOCK_TRANSPORT_F_H2G); 926 if (ret < 0) 927 return ret; 928 929 ret = misc_register(&vhost_vsock_misc); 930 if (ret) { 931 vsock_core_unregister(&vhost_transport.transport); 932 return ret; 933 } 934 935 return 0; 936}; 937 938static void __exit vhost_vsock_exit(void) 939{ 940 misc_deregister(&vhost_vsock_misc); 941 vsock_core_unregister(&vhost_transport.transport); 942}; 943 944module_init(vhost_vsock_init); 945module_exit(vhost_vsock_exit); 946MODULE_LICENSE("GPL v2"); 947MODULE_AUTHOR("Asias He"); 948MODULE_DESCRIPTION("vhost transport for vsock "); 949MODULE_ALIAS_MISCDEV(VHOST_VSOCK_MINOR); 950MODULE_ALIAS("devname:vhost-vsock"); 951