1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * vhost transport for vsock 4 * 5 * Copyright (C) 2013-2015 Red Hat, Inc. 6 * Author: Asias He <asias@redhat.com> 7 * Stefan Hajnoczi <stefanha@redhat.com> 8 */ 9 #include <linux/miscdevice.h> 10 #include <linux/atomic.h> 11 #include <linux/module.h> 12 #include <linux/mutex.h> 13 #include <linux/vmalloc.h> 14 #include <net/sock.h> 15 #include <linux/virtio_vsock.h> 16 #include <linux/vhost.h> 17 #include <linux/hashtable.h> 18 19 #include <net/af_vsock.h> 20 #include "vhost.h" 21 22 #define VHOST_VSOCK_DEFAULT_HOST_CID 2 23 /* Max number of bytes transferred before requeueing the job. 24 * Using this limit prevents one virtqueue from starving others. */ 25 #define VHOST_VSOCK_WEIGHT 0x80000 26 /* Max number of packets transferred before requeueing the job. 27 * Using this limit prevents one virtqueue from starving others with 28 * small pkts. 29 */ 30 #define VHOST_VSOCK_PKT_WEIGHT 256 31 32 enum { 33 VHOST_VSOCK_FEATURES = VHOST_FEATURES | 34 (1ULL << VIRTIO_F_ACCESS_PLATFORM) | 35 (1ULL << VIRTIO_VSOCK_F_SEQPACKET) 36 }; 37 38 enum { 39 VHOST_VSOCK_BACKEND_FEATURES = (1ULL << VHOST_BACKEND_F_IOTLB_MSG_V2) 40 }; 41 42 /* Used to track all the vhost_vsock instances on the system. */ 43 static DEFINE_MUTEX(vhost_vsock_mutex); 44 static DEFINE_READ_MOSTLY_HASHTABLE(vhost_vsock_hash, 8); 45 46 struct vhost_vsock { 47 struct vhost_dev dev; 48 struct vhost_virtqueue vqs[2]; 49 50 /* Link to global vhost_vsock_hash, writes use vhost_vsock_mutex */ 51 struct hlist_node hash; 52 53 struct vhost_work send_pkt_work; 54 struct sk_buff_head send_pkt_queue; /* host->guest pending packets */ 55 56 atomic_t queued_replies; 57 58 u32 guest_cid; 59 bool seqpacket_allow; 60 }; 61 62 static u32 vhost_transport_get_local_cid(void) 63 { 64 return VHOST_VSOCK_DEFAULT_HOST_CID; 65 } 66 67 /* Callers that dereference the return value must hold vhost_vsock_mutex or the 68 * RCU read lock. 69 */ 70 static struct vhost_vsock *vhost_vsock_get(u32 guest_cid) 71 { 72 struct vhost_vsock *vsock; 73 74 hash_for_each_possible_rcu(vhost_vsock_hash, vsock, hash, guest_cid) { 75 u32 other_cid = vsock->guest_cid; 76 77 /* Skip instances that have no CID yet */ 78 if (other_cid == 0) 79 continue; 80 81 if (other_cid == guest_cid) 82 return vsock; 83 84 } 85 86 return NULL; 87 } 88 89 static void 90 vhost_transport_do_send_pkt(struct vhost_vsock *vsock, 91 struct vhost_virtqueue *vq) 92 { 93 struct vhost_virtqueue *tx_vq = &vsock->vqs[VSOCK_VQ_TX]; 94 int pkts = 0, total_len = 0; 95 bool added = false; 96 bool restart_tx = false; 97 98 mutex_lock(&vq->mutex); 99 100 if (!vhost_vq_get_backend(vq)) 101 goto out; 102 103 if (!vq_meta_prefetch(vq)) 104 goto out; 105 106 /* Avoid further vmexits, we're already processing the virtqueue */ 107 vhost_disable_notify(&vsock->dev, vq); 108 109 do { 110 struct virtio_vsock_hdr *hdr; 111 size_t iov_len, payload_len; 112 struct iov_iter iov_iter; 113 u32 flags_to_restore = 0; 114 struct sk_buff *skb; 115 unsigned out, in; 116 size_t nbytes; 117 u32 offset; 118 int head; 119 120 skb = virtio_vsock_skb_dequeue(&vsock->send_pkt_queue); 121 122 if (!skb) { 123 vhost_enable_notify(&vsock->dev, vq); 124 break; 125 } 126 127 head = vhost_get_vq_desc(vq, vq->iov, ARRAY_SIZE(vq->iov), 128 &out, &in, NULL, NULL); 129 if (head < 0) { 130 virtio_vsock_skb_queue_head(&vsock->send_pkt_queue, skb); 131 break; 132 } 133 134 if (head == vq->num) { 135 virtio_vsock_skb_queue_head(&vsock->send_pkt_queue, skb); 136 /* We cannot finish yet if more buffers snuck in while 137 * re-enabling notify. 138 */ 139 if (unlikely(vhost_enable_notify(&vsock->dev, vq))) { 140 vhost_disable_notify(&vsock->dev, vq); 141 continue; 142 } 143 break; 144 } 145 146 if (out) { 147 kfree_skb(skb); 148 vq_err(vq, "Expected 0 output buffers, got %u\n", out); 149 break; 150 } 151 152 iov_len = iov_length(&vq->iov[out], in); 153 if (iov_len < sizeof(*hdr)) { 154 kfree_skb(skb); 155 vq_err(vq, "Buffer len [%zu] too small\n", iov_len); 156 break; 157 } 158 159 iov_iter_init(&iov_iter, ITER_DEST, &vq->iov[out], in, iov_len); 160 offset = VIRTIO_VSOCK_SKB_CB(skb)->offset; 161 payload_len = skb->len - offset; 162 hdr = virtio_vsock_hdr(skb); 163 164 /* If the packet is greater than the space available in the 165 * buffer, we split it using multiple buffers. 166 */ 167 if (payload_len > iov_len - sizeof(*hdr)) { 168 payload_len = iov_len - sizeof(*hdr); 169 170 /* As we are copying pieces of large packet's buffer to 171 * small rx buffers, headers of packets in rx queue are 172 * created dynamically and are initialized with header 173 * of current packet(except length). But in case of 174 * SOCK_SEQPACKET, we also must clear message delimeter 175 * bit (VIRTIO_VSOCK_SEQ_EOM) and MSG_EOR bit 176 * (VIRTIO_VSOCK_SEQ_EOR) if set. Otherwise, 177 * there will be sequence of packets with these 178 * bits set. After initialized header will be copied to 179 * rx buffer, these required bits will be restored. 180 */ 181 if (le32_to_cpu(hdr->flags) & VIRTIO_VSOCK_SEQ_EOM) { 182 hdr->flags &= ~cpu_to_le32(VIRTIO_VSOCK_SEQ_EOM); 183 flags_to_restore |= VIRTIO_VSOCK_SEQ_EOM; 184 185 if (le32_to_cpu(hdr->flags) & VIRTIO_VSOCK_SEQ_EOR) { 186 hdr->flags &= ~cpu_to_le32(VIRTIO_VSOCK_SEQ_EOR); 187 flags_to_restore |= VIRTIO_VSOCK_SEQ_EOR; 188 } 189 } 190 } 191 192 /* Set the correct length in the header */ 193 hdr->len = cpu_to_le32(payload_len); 194 195 nbytes = copy_to_iter(hdr, sizeof(*hdr), &iov_iter); 196 if (nbytes != sizeof(*hdr)) { 197 kfree_skb(skb); 198 vq_err(vq, "Faulted on copying pkt hdr\n"); 199 break; 200 } 201 202 if (skb_copy_datagram_iter(skb, 203 offset, 204 &iov_iter, 205 payload_len)) { 206 kfree_skb(skb); 207 vq_err(vq, "Faulted on copying pkt buf\n"); 208 break; 209 } 210 211 /* Deliver to monitoring devices all packets that we 212 * will transmit. 213 */ 214 virtio_transport_deliver_tap_pkt(skb); 215 216 vhost_add_used(vq, head, sizeof(*hdr) + payload_len); 217 added = true; 218 219 VIRTIO_VSOCK_SKB_CB(skb)->offset += payload_len; 220 total_len += payload_len; 221 222 /* If we didn't send all the payload we can requeue the packet 223 * to send it with the next available buffer. 224 */ 225 if (VIRTIO_VSOCK_SKB_CB(skb)->offset < skb->len) { 226 hdr->flags |= cpu_to_le32(flags_to_restore); 227 228 /* We are queueing the same skb to handle 229 * the remaining bytes, and we want to deliver it 230 * to monitoring devices in the next iteration. 231 */ 232 virtio_vsock_skb_clear_tap_delivered(skb); 233 virtio_vsock_skb_queue_head(&vsock->send_pkt_queue, skb); 234 } else { 235 if (virtio_vsock_skb_reply(skb)) { 236 int val; 237 238 val = atomic_dec_return(&vsock->queued_replies); 239 240 /* Do we have resources to resume tx 241 * processing? 242 */ 243 if (val + 1 == tx_vq->num) 244 restart_tx = true; 245 } 246 247 consume_skb(skb); 248 } 249 } while(likely(!vhost_exceeds_weight(vq, ++pkts, total_len))); 250 if (added) 251 vhost_signal(&vsock->dev, vq); 252 253 out: 254 mutex_unlock(&vq->mutex); 255 256 if (restart_tx) 257 vhost_poll_queue(&tx_vq->poll); 258 } 259 260 static void vhost_transport_send_pkt_work(struct vhost_work *work) 261 { 262 struct vhost_virtqueue *vq; 263 struct vhost_vsock *vsock; 264 265 vsock = container_of(work, struct vhost_vsock, send_pkt_work); 266 vq = &vsock->vqs[VSOCK_VQ_RX]; 267 268 vhost_transport_do_send_pkt(vsock, vq); 269 } 270 271 static int 272 vhost_transport_send_pkt(struct sk_buff *skb) 273 { 274 struct virtio_vsock_hdr *hdr = virtio_vsock_hdr(skb); 275 struct vhost_vsock *vsock; 276 int len = skb->len; 277 278 rcu_read_lock(); 279 280 /* Find the vhost_vsock according to guest context id */ 281 vsock = vhost_vsock_get(le64_to_cpu(hdr->dst_cid)); 282 if (!vsock) { 283 rcu_read_unlock(); 284 kfree_skb(skb); 285 return -ENODEV; 286 } 287 288 if (virtio_vsock_skb_reply(skb)) 289 atomic_inc(&vsock->queued_replies); 290 291 virtio_vsock_skb_queue_tail(&vsock->send_pkt_queue, skb); 292 vhost_vq_work_queue(&vsock->vqs[VSOCK_VQ_RX], &vsock->send_pkt_work); 293 294 rcu_read_unlock(); 295 return len; 296 } 297 298 static int 299 vhost_transport_cancel_pkt(struct vsock_sock *vsk) 300 { 301 struct vhost_vsock *vsock; 302 int cnt = 0; 303 int ret = -ENODEV; 304 305 rcu_read_lock(); 306 307 /* Find the vhost_vsock according to guest context id */ 308 vsock = vhost_vsock_get(vsk->remote_addr.svm_cid); 309 if (!vsock) 310 goto out; 311 312 cnt = virtio_transport_purge_skbs(vsk, &vsock->send_pkt_queue); 313 314 if (cnt) { 315 struct vhost_virtqueue *tx_vq = &vsock->vqs[VSOCK_VQ_TX]; 316 int new_cnt; 317 318 new_cnt = atomic_sub_return(cnt, &vsock->queued_replies); 319 if (new_cnt + cnt >= tx_vq->num && new_cnt < tx_vq->num) 320 vhost_poll_queue(&tx_vq->poll); 321 } 322 323 ret = 0; 324 out: 325 rcu_read_unlock(); 326 return ret; 327 } 328 329 static struct sk_buff * 330 vhost_vsock_alloc_skb(struct vhost_virtqueue *vq, 331 unsigned int out, unsigned int in) 332 { 333 struct virtio_vsock_hdr *hdr; 334 struct iov_iter iov_iter; 335 struct sk_buff *skb; 336 size_t payload_len; 337 size_t nbytes; 338 size_t len; 339 340 if (in != 0) { 341 vq_err(vq, "Expected 0 input buffers, got %u\n", in); 342 return NULL; 343 } 344 345 len = iov_length(vq->iov, out); 346 347 /* len contains both payload and hdr */ 348 skb = virtio_vsock_alloc_skb(len, GFP_KERNEL); 349 if (!skb) 350 return NULL; 351 352 iov_iter_init(&iov_iter, ITER_SOURCE, vq->iov, out, len); 353 354 hdr = virtio_vsock_hdr(skb); 355 nbytes = copy_from_iter(hdr, sizeof(*hdr), &iov_iter); 356 if (nbytes != sizeof(*hdr)) { 357 vq_err(vq, "Expected %zu bytes for pkt->hdr, got %zu bytes\n", 358 sizeof(*hdr), nbytes); 359 kfree_skb(skb); 360 return NULL; 361 } 362 363 payload_len = le32_to_cpu(hdr->len); 364 365 /* No payload */ 366 if (!payload_len) 367 return skb; 368 369 /* The pkt is too big or the length in the header is invalid */ 370 if (payload_len > VIRTIO_VSOCK_MAX_PKT_BUF_SIZE || 371 payload_len + sizeof(*hdr) > len) { 372 kfree_skb(skb); 373 return NULL; 374 } 375 376 virtio_vsock_skb_rx_put(skb); 377 378 nbytes = copy_from_iter(skb->data, payload_len, &iov_iter); 379 if (nbytes != payload_len) { 380 vq_err(vq, "Expected %zu byte payload, got %zu bytes\n", 381 payload_len, nbytes); 382 kfree_skb(skb); 383 return NULL; 384 } 385 386 return skb; 387 } 388 389 /* Is there space left for replies to rx packets? */ 390 static bool vhost_vsock_more_replies(struct vhost_vsock *vsock) 391 { 392 struct vhost_virtqueue *vq = &vsock->vqs[VSOCK_VQ_TX]; 393 int val; 394 395 smp_rmb(); /* paired with atomic_inc() and atomic_dec_return() */ 396 val = atomic_read(&vsock->queued_replies); 397 398 return val < vq->num; 399 } 400 401 static bool vhost_transport_seqpacket_allow(u32 remote_cid); 402 403 static struct virtio_transport vhost_transport = { 404 .transport = { 405 .module = THIS_MODULE, 406 407 .get_local_cid = vhost_transport_get_local_cid, 408 409 .init = virtio_transport_do_socket_init, 410 .destruct = virtio_transport_destruct, 411 .release = virtio_transport_release, 412 .connect = virtio_transport_connect, 413 .shutdown = virtio_transport_shutdown, 414 .cancel_pkt = vhost_transport_cancel_pkt, 415 416 .dgram_enqueue = virtio_transport_dgram_enqueue, 417 .dgram_dequeue = virtio_transport_dgram_dequeue, 418 .dgram_bind = virtio_transport_dgram_bind, 419 .dgram_allow = virtio_transport_dgram_allow, 420 421 .stream_enqueue = virtio_transport_stream_enqueue, 422 .stream_dequeue = virtio_transport_stream_dequeue, 423 .stream_has_data = virtio_transport_stream_has_data, 424 .stream_has_space = virtio_transport_stream_has_space, 425 .stream_rcvhiwat = virtio_transport_stream_rcvhiwat, 426 .stream_is_active = virtio_transport_stream_is_active, 427 .stream_allow = virtio_transport_stream_allow, 428 429 .seqpacket_dequeue = virtio_transport_seqpacket_dequeue, 430 .seqpacket_enqueue = virtio_transport_seqpacket_enqueue, 431 .seqpacket_allow = vhost_transport_seqpacket_allow, 432 .seqpacket_has_data = virtio_transport_seqpacket_has_data, 433 434 .notify_poll_in = virtio_transport_notify_poll_in, 435 .notify_poll_out = virtio_transport_notify_poll_out, 436 .notify_recv_init = virtio_transport_notify_recv_init, 437 .notify_recv_pre_block = virtio_transport_notify_recv_pre_block, 438 .notify_recv_pre_dequeue = virtio_transport_notify_recv_pre_dequeue, 439 .notify_recv_post_dequeue = virtio_transport_notify_recv_post_dequeue, 440 .notify_send_init = virtio_transport_notify_send_init, 441 .notify_send_pre_block = virtio_transport_notify_send_pre_block, 442 .notify_send_pre_enqueue = virtio_transport_notify_send_pre_enqueue, 443 .notify_send_post_enqueue = virtio_transport_notify_send_post_enqueue, 444 .notify_buffer_size = virtio_transport_notify_buffer_size, 445 446 .read_skb = virtio_transport_read_skb, 447 }, 448 449 .send_pkt = vhost_transport_send_pkt, 450 }; 451 452 static bool vhost_transport_seqpacket_allow(u32 remote_cid) 453 { 454 struct vhost_vsock *vsock; 455 bool seqpacket_allow = false; 456 457 rcu_read_lock(); 458 vsock = vhost_vsock_get(remote_cid); 459 460 if (vsock) 461 seqpacket_allow = vsock->seqpacket_allow; 462 463 rcu_read_unlock(); 464 465 return seqpacket_allow; 466 } 467 468 static void vhost_vsock_handle_tx_kick(struct vhost_work *work) 469 { 470 struct vhost_virtqueue *vq = container_of(work, struct vhost_virtqueue, 471 poll.work); 472 struct vhost_vsock *vsock = container_of(vq->dev, struct vhost_vsock, 473 dev); 474 int head, pkts = 0, total_len = 0; 475 unsigned int out, in; 476 struct sk_buff *skb; 477 bool added = false; 478 479 mutex_lock(&vq->mutex); 480 481 if (!vhost_vq_get_backend(vq)) 482 goto out; 483 484 if (!vq_meta_prefetch(vq)) 485 goto out; 486 487 vhost_disable_notify(&vsock->dev, vq); 488 do { 489 struct virtio_vsock_hdr *hdr; 490 491 if (!vhost_vsock_more_replies(vsock)) { 492 /* Stop tx until the device processes already 493 * pending replies. Leave tx virtqueue 494 * callbacks disabled. 495 */ 496 goto no_more_replies; 497 } 498 499 head = vhost_get_vq_desc(vq, vq->iov, ARRAY_SIZE(vq->iov), 500 &out, &in, NULL, NULL); 501 if (head < 0) 502 break; 503 504 if (head == vq->num) { 505 if (unlikely(vhost_enable_notify(&vsock->dev, vq))) { 506 vhost_disable_notify(&vsock->dev, vq); 507 continue; 508 } 509 break; 510 } 511 512 skb = vhost_vsock_alloc_skb(vq, out, in); 513 if (!skb) { 514 vq_err(vq, "Faulted on pkt\n"); 515 continue; 516 } 517 518 total_len += sizeof(*hdr) + skb->len; 519 520 /* Deliver to monitoring devices all received packets */ 521 virtio_transport_deliver_tap_pkt(skb); 522 523 hdr = virtio_vsock_hdr(skb); 524 525 /* Only accept correctly addressed packets */ 526 if (le64_to_cpu(hdr->src_cid) == vsock->guest_cid && 527 le64_to_cpu(hdr->dst_cid) == 528 vhost_transport_get_local_cid()) 529 virtio_transport_recv_pkt(&vhost_transport, skb); 530 else 531 kfree_skb(skb); 532 533 vhost_add_used(vq, head, 0); 534 added = true; 535 } while(likely(!vhost_exceeds_weight(vq, ++pkts, total_len))); 536 537 no_more_replies: 538 if (added) 539 vhost_signal(&vsock->dev, vq); 540 541 out: 542 mutex_unlock(&vq->mutex); 543 } 544 545 static void vhost_vsock_handle_rx_kick(struct vhost_work *work) 546 { 547 struct vhost_virtqueue *vq = container_of(work, struct vhost_virtqueue, 548 poll.work); 549 struct vhost_vsock *vsock = container_of(vq->dev, struct vhost_vsock, 550 dev); 551 552 vhost_transport_do_send_pkt(vsock, vq); 553 } 554 555 static int vhost_vsock_start(struct vhost_vsock *vsock) 556 { 557 struct vhost_virtqueue *vq; 558 size_t i; 559 int ret; 560 561 mutex_lock(&vsock->dev.mutex); 562 563 ret = vhost_dev_check_owner(&vsock->dev); 564 if (ret) 565 goto err; 566 567 for (i = 0; i < ARRAY_SIZE(vsock->vqs); i++) { 568 vq = &vsock->vqs[i]; 569 570 mutex_lock(&vq->mutex); 571 572 if (!vhost_vq_access_ok(vq)) { 573 ret = -EFAULT; 574 goto err_vq; 575 } 576 577 if (!vhost_vq_get_backend(vq)) { 578 vhost_vq_set_backend(vq, vsock); 579 ret = vhost_vq_init_access(vq); 580 if (ret) 581 goto err_vq; 582 } 583 584 mutex_unlock(&vq->mutex); 585 } 586 587 /* Some packets may have been queued before the device was started, 588 * let's kick the send worker to send them. 589 */ 590 vhost_vq_work_queue(&vsock->vqs[VSOCK_VQ_RX], &vsock->send_pkt_work); 591 592 mutex_unlock(&vsock->dev.mutex); 593 return 0; 594 595 err_vq: 596 vhost_vq_set_backend(vq, NULL); 597 mutex_unlock(&vq->mutex); 598 599 for (i = 0; i < ARRAY_SIZE(vsock->vqs); i++) { 600 vq = &vsock->vqs[i]; 601 602 mutex_lock(&vq->mutex); 603 vhost_vq_set_backend(vq, NULL); 604 mutex_unlock(&vq->mutex); 605 } 606 err: 607 mutex_unlock(&vsock->dev.mutex); 608 return ret; 609 } 610 611 static int vhost_vsock_stop(struct vhost_vsock *vsock, bool check_owner) 612 { 613 size_t i; 614 int ret = 0; 615 616 mutex_lock(&vsock->dev.mutex); 617 618 if (check_owner) { 619 ret = vhost_dev_check_owner(&vsock->dev); 620 if (ret) 621 goto err; 622 } 623 624 for (i = 0; i < ARRAY_SIZE(vsock->vqs); i++) { 625 struct vhost_virtqueue *vq = &vsock->vqs[i]; 626 627 mutex_lock(&vq->mutex); 628 vhost_vq_set_backend(vq, NULL); 629 mutex_unlock(&vq->mutex); 630 } 631 632 err: 633 mutex_unlock(&vsock->dev.mutex); 634 return ret; 635 } 636 637 static void vhost_vsock_free(struct vhost_vsock *vsock) 638 { 639 kvfree(vsock); 640 } 641 642 static int vhost_vsock_dev_open(struct inode *inode, struct file *file) 643 { 644 struct vhost_virtqueue **vqs; 645 struct vhost_vsock *vsock; 646 int ret; 647 648 /* This struct is large and allocation could fail, fall back to vmalloc 649 * if there is no other way. 650 */ 651 vsock = kvmalloc(sizeof(*vsock), GFP_KERNEL | __GFP_RETRY_MAYFAIL); 652 if (!vsock) 653 return -ENOMEM; 654 655 vqs = kmalloc_array(ARRAY_SIZE(vsock->vqs), sizeof(*vqs), GFP_KERNEL); 656 if (!vqs) { 657 ret = -ENOMEM; 658 goto out; 659 } 660 661 vsock->guest_cid = 0; /* no CID assigned yet */ 662 663 atomic_set(&vsock->queued_replies, 0); 664 665 vqs[VSOCK_VQ_TX] = &vsock->vqs[VSOCK_VQ_TX]; 666 vqs[VSOCK_VQ_RX] = &vsock->vqs[VSOCK_VQ_RX]; 667 vsock->vqs[VSOCK_VQ_TX].handle_kick = vhost_vsock_handle_tx_kick; 668 vsock->vqs[VSOCK_VQ_RX].handle_kick = vhost_vsock_handle_rx_kick; 669 670 vhost_dev_init(&vsock->dev, vqs, ARRAY_SIZE(vsock->vqs), 671 UIO_MAXIOV, VHOST_VSOCK_PKT_WEIGHT, 672 VHOST_VSOCK_WEIGHT, true, NULL); 673 674 file->private_data = vsock; 675 skb_queue_head_init(&vsock->send_pkt_queue); 676 vhost_work_init(&vsock->send_pkt_work, vhost_transport_send_pkt_work); 677 return 0; 678 679 out: 680 vhost_vsock_free(vsock); 681 return ret; 682 } 683 684 static void vhost_vsock_flush(struct vhost_vsock *vsock) 685 { 686 vhost_dev_flush(&vsock->dev); 687 } 688 689 static void vhost_vsock_reset_orphans(struct sock *sk) 690 { 691 struct vsock_sock *vsk = vsock_sk(sk); 692 693 /* vmci_transport.c doesn't take sk_lock here either. At least we're 694 * under vsock_table_lock so the sock cannot disappear while we're 695 * executing. 696 */ 697 698 /* If the peer is still valid, no need to reset connection */ 699 if (vhost_vsock_get(vsk->remote_addr.svm_cid)) 700 return; 701 702 /* If the close timeout is pending, let it expire. This avoids races 703 * with the timeout callback. 704 */ 705 if (vsk->close_work_scheduled) 706 return; 707 708 sock_set_flag(sk, SOCK_DONE); 709 vsk->peer_shutdown = SHUTDOWN_MASK; 710 sk->sk_state = SS_UNCONNECTED; 711 sk->sk_err = ECONNRESET; 712 sk_error_report(sk); 713 } 714 715 static int vhost_vsock_dev_release(struct inode *inode, struct file *file) 716 { 717 struct vhost_vsock *vsock = file->private_data; 718 719 mutex_lock(&vhost_vsock_mutex); 720 if (vsock->guest_cid) 721 hash_del_rcu(&vsock->hash); 722 mutex_unlock(&vhost_vsock_mutex); 723 724 /* Wait for other CPUs to finish using vsock */ 725 synchronize_rcu(); 726 727 /* Iterating over all connections for all CIDs to find orphans is 728 * inefficient. Room for improvement here. */ 729 vsock_for_each_connected_socket(&vhost_transport.transport, 730 vhost_vsock_reset_orphans); 731 732 /* Don't check the owner, because we are in the release path, so we 733 * need to stop the vsock device in any case. 734 * vhost_vsock_stop() can not fail in this case, so we don't need to 735 * check the return code. 736 */ 737 vhost_vsock_stop(vsock, false); 738 vhost_vsock_flush(vsock); 739 vhost_dev_stop(&vsock->dev); 740 741 virtio_vsock_skb_queue_purge(&vsock->send_pkt_queue); 742 743 vhost_dev_cleanup(&vsock->dev); 744 kfree(vsock->dev.vqs); 745 vhost_vsock_free(vsock); 746 return 0; 747 } 748 749 static int vhost_vsock_set_cid(struct vhost_vsock *vsock, u64 guest_cid) 750 { 751 struct vhost_vsock *other; 752 753 /* Refuse reserved CIDs */ 754 if (guest_cid <= VMADDR_CID_HOST || 755 guest_cid == U32_MAX) 756 return -EINVAL; 757 758 /* 64-bit CIDs are not yet supported */ 759 if (guest_cid > U32_MAX) 760 return -EINVAL; 761 762 /* Refuse if CID is assigned to the guest->host transport (i.e. nested 763 * VM), to make the loopback work. 764 */ 765 if (vsock_find_cid(guest_cid)) 766 return -EADDRINUSE; 767 768 /* Refuse if CID is already in use */ 769 mutex_lock(&vhost_vsock_mutex); 770 other = vhost_vsock_get(guest_cid); 771 if (other && other != vsock) { 772 mutex_unlock(&vhost_vsock_mutex); 773 return -EADDRINUSE; 774 } 775 776 if (vsock->guest_cid) 777 hash_del_rcu(&vsock->hash); 778 779 vsock->guest_cid = guest_cid; 780 hash_add_rcu(vhost_vsock_hash, &vsock->hash, vsock->guest_cid); 781 mutex_unlock(&vhost_vsock_mutex); 782 783 return 0; 784 } 785 786 static int vhost_vsock_set_features(struct vhost_vsock *vsock, u64 features) 787 { 788 struct vhost_virtqueue *vq; 789 int i; 790 791 if (features & ~VHOST_VSOCK_FEATURES) 792 return -EOPNOTSUPP; 793 794 mutex_lock(&vsock->dev.mutex); 795 if ((features & (1 << VHOST_F_LOG_ALL)) && 796 !vhost_log_access_ok(&vsock->dev)) { 797 goto err; 798 } 799 800 if ((features & (1ULL << VIRTIO_F_ACCESS_PLATFORM))) { 801 if (vhost_init_device_iotlb(&vsock->dev)) 802 goto err; 803 } 804 805 if (features & (1ULL << VIRTIO_VSOCK_F_SEQPACKET)) 806 vsock->seqpacket_allow = true; 807 808 for (i = 0; i < ARRAY_SIZE(vsock->vqs); i++) { 809 vq = &vsock->vqs[i]; 810 mutex_lock(&vq->mutex); 811 vq->acked_features = features; 812 mutex_unlock(&vq->mutex); 813 } 814 mutex_unlock(&vsock->dev.mutex); 815 return 0; 816 817 err: 818 mutex_unlock(&vsock->dev.mutex); 819 return -EFAULT; 820 } 821 822 static long vhost_vsock_dev_ioctl(struct file *f, unsigned int ioctl, 823 unsigned long arg) 824 { 825 struct vhost_vsock *vsock = f->private_data; 826 void __user *argp = (void __user *)arg; 827 u64 guest_cid; 828 u64 features; 829 int start; 830 int r; 831 832 switch (ioctl) { 833 case VHOST_VSOCK_SET_GUEST_CID: 834 if (copy_from_user(&guest_cid, argp, sizeof(guest_cid))) 835 return -EFAULT; 836 return vhost_vsock_set_cid(vsock, guest_cid); 837 case VHOST_VSOCK_SET_RUNNING: 838 if (copy_from_user(&start, argp, sizeof(start))) 839 return -EFAULT; 840 if (start) 841 return vhost_vsock_start(vsock); 842 else 843 return vhost_vsock_stop(vsock, true); 844 case VHOST_GET_FEATURES: 845 features = VHOST_VSOCK_FEATURES; 846 if (copy_to_user(argp, &features, sizeof(features))) 847 return -EFAULT; 848 return 0; 849 case VHOST_SET_FEATURES: 850 if (copy_from_user(&features, argp, sizeof(features))) 851 return -EFAULT; 852 return vhost_vsock_set_features(vsock, features); 853 case VHOST_GET_BACKEND_FEATURES: 854 features = VHOST_VSOCK_BACKEND_FEATURES; 855 if (copy_to_user(argp, &features, sizeof(features))) 856 return -EFAULT; 857 return 0; 858 case VHOST_SET_BACKEND_FEATURES: 859 if (copy_from_user(&features, argp, sizeof(features))) 860 return -EFAULT; 861 if (features & ~VHOST_VSOCK_BACKEND_FEATURES) 862 return -EOPNOTSUPP; 863 vhost_set_backend_features(&vsock->dev, features); 864 return 0; 865 default: 866 mutex_lock(&vsock->dev.mutex); 867 r = vhost_dev_ioctl(&vsock->dev, ioctl, argp); 868 if (r == -ENOIOCTLCMD) 869 r = vhost_vring_ioctl(&vsock->dev, ioctl, argp); 870 else 871 vhost_vsock_flush(vsock); 872 mutex_unlock(&vsock->dev.mutex); 873 return r; 874 } 875 } 876 877 static ssize_t vhost_vsock_chr_read_iter(struct kiocb *iocb, struct iov_iter *to) 878 { 879 struct file *file = iocb->ki_filp; 880 struct vhost_vsock *vsock = file->private_data; 881 struct vhost_dev *dev = &vsock->dev; 882 int noblock = file->f_flags & O_NONBLOCK; 883 884 return vhost_chr_read_iter(dev, to, noblock); 885 } 886 887 static ssize_t vhost_vsock_chr_write_iter(struct kiocb *iocb, 888 struct iov_iter *from) 889 { 890 struct file *file = iocb->ki_filp; 891 struct vhost_vsock *vsock = file->private_data; 892 struct vhost_dev *dev = &vsock->dev; 893 894 return vhost_chr_write_iter(dev, from); 895 } 896 897 static __poll_t vhost_vsock_chr_poll(struct file *file, poll_table *wait) 898 { 899 struct vhost_vsock *vsock = file->private_data; 900 struct vhost_dev *dev = &vsock->dev; 901 902 return vhost_chr_poll(file, dev, wait); 903 } 904 905 static const struct file_operations vhost_vsock_fops = { 906 .owner = THIS_MODULE, 907 .open = vhost_vsock_dev_open, 908 .release = vhost_vsock_dev_release, 909 .llseek = noop_llseek, 910 .unlocked_ioctl = vhost_vsock_dev_ioctl, 911 .compat_ioctl = compat_ptr_ioctl, 912 .read_iter = vhost_vsock_chr_read_iter, 913 .write_iter = vhost_vsock_chr_write_iter, 914 .poll = vhost_vsock_chr_poll, 915 }; 916 917 static struct miscdevice vhost_vsock_misc = { 918 .minor = VHOST_VSOCK_MINOR, 919 .name = "vhost-vsock", 920 .fops = &vhost_vsock_fops, 921 }; 922 923 static int __init vhost_vsock_init(void) 924 { 925 int ret; 926 927 ret = vsock_core_register(&vhost_transport.transport, 928 VSOCK_TRANSPORT_F_H2G); 929 if (ret < 0) 930 return ret; 931 932 ret = misc_register(&vhost_vsock_misc); 933 if (ret) { 934 vsock_core_unregister(&vhost_transport.transport); 935 return ret; 936 } 937 938 return 0; 939 }; 940 941 static void __exit vhost_vsock_exit(void) 942 { 943 misc_deregister(&vhost_vsock_misc); 944 vsock_core_unregister(&vhost_transport.transport); 945 }; 946 947 module_init(vhost_vsock_init); 948 module_exit(vhost_vsock_exit); 949 MODULE_LICENSE("GPL v2"); 950 MODULE_AUTHOR("Asias He"); 951 MODULE_DESCRIPTION("vhost transport for vsock "); 952 MODULE_ALIAS_MISCDEV(VHOST_VSOCK_MINOR); 953 MODULE_ALIAS("devname:vhost-vsock"); 954