1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * vhost transport for vsock 4 * 5 * Copyright (C) 2013-2015 Red Hat, Inc. 6 * Author: Asias He <asias@redhat.com> 7 * Stefan Hajnoczi <stefanha@redhat.com> 8 */ 9 #include <linux/miscdevice.h> 10 #include <linux/atomic.h> 11 #include <linux/module.h> 12 #include <linux/mutex.h> 13 #include <linux/vmalloc.h> 14 #include <net/sock.h> 15 #include <linux/virtio_vsock.h> 16 #include <linux/vhost.h> 17 #include <linux/hashtable.h> 18 19 #include <net/af_vsock.h> 20 #include "vhost.h" 21 22 #define VHOST_VSOCK_DEFAULT_HOST_CID 2 23 /* Max number of bytes transferred before requeueing the job. 24 * Using this limit prevents one virtqueue from starving others. */ 25 #define VHOST_VSOCK_WEIGHT 0x80000 26 /* Max number of packets transferred before requeueing the job. 27 * Using this limit prevents one virtqueue from starving others with 28 * small pkts. 29 */ 30 #define VHOST_VSOCK_PKT_WEIGHT 256 31 32 enum { 33 VHOST_VSOCK_FEATURES = VHOST_FEATURES | 34 (1ULL << VIRTIO_F_ACCESS_PLATFORM) | 35 (1ULL << VIRTIO_VSOCK_F_SEQPACKET) 36 }; 37 38 enum { 39 VHOST_VSOCK_BACKEND_FEATURES = (1ULL << VHOST_BACKEND_F_IOTLB_MSG_V2) 40 }; 41 42 /* Used to track all the vhost_vsock instances on the system. */ 43 static DEFINE_MUTEX(vhost_vsock_mutex); 44 static DEFINE_READ_MOSTLY_HASHTABLE(vhost_vsock_hash, 8); 45 46 struct vhost_vsock { 47 struct vhost_dev dev; 48 struct vhost_virtqueue vqs[2]; 49 50 /* Link to global vhost_vsock_hash, writes use vhost_vsock_mutex */ 51 struct hlist_node hash; 52 53 struct vhost_work send_pkt_work; 54 struct sk_buff_head send_pkt_queue; /* host->guest pending packets */ 55 56 atomic_t queued_replies; 57 58 u32 guest_cid; 59 bool seqpacket_allow; 60 }; 61 62 static u32 vhost_transport_get_local_cid(void) 63 { 64 return VHOST_VSOCK_DEFAULT_HOST_CID; 65 } 66 67 /* Callers that dereference the return value must hold vhost_vsock_mutex or the 68 * RCU read lock. 69 */ 70 static struct vhost_vsock *vhost_vsock_get(u32 guest_cid) 71 { 72 struct vhost_vsock *vsock; 73 74 hash_for_each_possible_rcu(vhost_vsock_hash, vsock, hash, guest_cid) { 75 u32 other_cid = vsock->guest_cid; 76 77 /* Skip instances that have no CID yet */ 78 if (other_cid == 0) 79 continue; 80 81 if (other_cid == guest_cid) 82 return vsock; 83 84 } 85 86 return NULL; 87 } 88 89 static void 90 vhost_transport_do_send_pkt(struct vhost_vsock *vsock, 91 struct vhost_virtqueue *vq) 92 { 93 struct vhost_virtqueue *tx_vq = &vsock->vqs[VSOCK_VQ_TX]; 94 int pkts = 0, total_len = 0; 95 bool added = false; 96 bool restart_tx = false; 97 98 mutex_lock(&vq->mutex); 99 100 if (!vhost_vq_get_backend(vq)) 101 goto out; 102 103 if (!vq_meta_prefetch(vq)) 104 goto out; 105 106 /* Avoid further vmexits, we're already processing the virtqueue */ 107 vhost_disable_notify(&vsock->dev, vq); 108 109 do { 110 struct virtio_vsock_hdr *hdr; 111 size_t iov_len, payload_len; 112 struct iov_iter iov_iter; 113 u32 flags_to_restore = 0; 114 struct sk_buff *skb; 115 unsigned out, in; 116 size_t nbytes; 117 int head; 118 119 skb = virtio_vsock_skb_dequeue(&vsock->send_pkt_queue); 120 121 if (!skb) { 122 vhost_enable_notify(&vsock->dev, vq); 123 break; 124 } 125 126 head = vhost_get_vq_desc(vq, vq->iov, ARRAY_SIZE(vq->iov), 127 &out, &in, NULL, NULL); 128 if (head < 0) { 129 virtio_vsock_skb_queue_head(&vsock->send_pkt_queue, skb); 130 break; 131 } 132 133 if (head == vq->num) { 134 virtio_vsock_skb_queue_head(&vsock->send_pkt_queue, skb); 135 /* We cannot finish yet if more buffers snuck in while 136 * re-enabling notify. 137 */ 138 if (unlikely(vhost_enable_notify(&vsock->dev, vq))) { 139 vhost_disable_notify(&vsock->dev, vq); 140 continue; 141 } 142 break; 143 } 144 145 if (out) { 146 kfree_skb(skb); 147 vq_err(vq, "Expected 0 output buffers, got %u\n", out); 148 break; 149 } 150 151 iov_len = iov_length(&vq->iov[out], in); 152 if (iov_len < sizeof(*hdr)) { 153 kfree_skb(skb); 154 vq_err(vq, "Buffer len [%zu] too small\n", iov_len); 155 break; 156 } 157 158 iov_iter_init(&iov_iter, ITER_DEST, &vq->iov[out], in, iov_len); 159 payload_len = skb->len; 160 hdr = virtio_vsock_hdr(skb); 161 162 /* If the packet is greater than the space available in the 163 * buffer, we split it using multiple buffers. 164 */ 165 if (payload_len > iov_len - sizeof(*hdr)) { 166 payload_len = iov_len - sizeof(*hdr); 167 168 /* As we are copying pieces of large packet's buffer to 169 * small rx buffers, headers of packets in rx queue are 170 * created dynamically and are initialized with header 171 * of current packet(except length). But in case of 172 * SOCK_SEQPACKET, we also must clear message delimeter 173 * bit (VIRTIO_VSOCK_SEQ_EOM) and MSG_EOR bit 174 * (VIRTIO_VSOCK_SEQ_EOR) if set. Otherwise, 175 * there will be sequence of packets with these 176 * bits set. After initialized header will be copied to 177 * rx buffer, these required bits will be restored. 178 */ 179 if (le32_to_cpu(hdr->flags) & VIRTIO_VSOCK_SEQ_EOM) { 180 hdr->flags &= ~cpu_to_le32(VIRTIO_VSOCK_SEQ_EOM); 181 flags_to_restore |= VIRTIO_VSOCK_SEQ_EOM; 182 183 if (le32_to_cpu(hdr->flags) & VIRTIO_VSOCK_SEQ_EOR) { 184 hdr->flags &= ~cpu_to_le32(VIRTIO_VSOCK_SEQ_EOR); 185 flags_to_restore |= VIRTIO_VSOCK_SEQ_EOR; 186 } 187 } 188 } 189 190 /* Set the correct length in the header */ 191 hdr->len = cpu_to_le32(payload_len); 192 193 nbytes = copy_to_iter(hdr, sizeof(*hdr), &iov_iter); 194 if (nbytes != sizeof(*hdr)) { 195 kfree_skb(skb); 196 vq_err(vq, "Faulted on copying pkt hdr\n"); 197 break; 198 } 199 200 nbytes = copy_to_iter(skb->data, payload_len, &iov_iter); 201 if (nbytes != payload_len) { 202 kfree_skb(skb); 203 vq_err(vq, "Faulted on copying pkt buf\n"); 204 break; 205 } 206 207 /* Deliver to monitoring devices all packets that we 208 * will transmit. 209 */ 210 virtio_transport_deliver_tap_pkt(skb); 211 212 vhost_add_used(vq, head, sizeof(*hdr) + payload_len); 213 added = true; 214 215 skb_pull(skb, payload_len); 216 total_len += payload_len; 217 218 /* If we didn't send all the payload we can requeue the packet 219 * to send it with the next available buffer. 220 */ 221 if (skb->len > 0) { 222 hdr->flags |= cpu_to_le32(flags_to_restore); 223 224 /* We are queueing the same skb to handle 225 * the remaining bytes, and we want to deliver it 226 * to monitoring devices in the next iteration. 227 */ 228 virtio_vsock_skb_clear_tap_delivered(skb); 229 virtio_vsock_skb_queue_head(&vsock->send_pkt_queue, skb); 230 } else { 231 if (virtio_vsock_skb_reply(skb)) { 232 int val; 233 234 val = atomic_dec_return(&vsock->queued_replies); 235 236 /* Do we have resources to resume tx 237 * processing? 238 */ 239 if (val + 1 == tx_vq->num) 240 restart_tx = true; 241 } 242 243 consume_skb(skb); 244 } 245 } while(likely(!vhost_exceeds_weight(vq, ++pkts, total_len))); 246 if (added) 247 vhost_signal(&vsock->dev, vq); 248 249 out: 250 mutex_unlock(&vq->mutex); 251 252 if (restart_tx) 253 vhost_poll_queue(&tx_vq->poll); 254 } 255 256 static void vhost_transport_send_pkt_work(struct vhost_work *work) 257 { 258 struct vhost_virtqueue *vq; 259 struct vhost_vsock *vsock; 260 261 vsock = container_of(work, struct vhost_vsock, send_pkt_work); 262 vq = &vsock->vqs[VSOCK_VQ_RX]; 263 264 vhost_transport_do_send_pkt(vsock, vq); 265 } 266 267 static int 268 vhost_transport_send_pkt(struct sk_buff *skb) 269 { 270 struct virtio_vsock_hdr *hdr = virtio_vsock_hdr(skb); 271 struct vhost_vsock *vsock; 272 int len = skb->len; 273 274 rcu_read_lock(); 275 276 /* Find the vhost_vsock according to guest context id */ 277 vsock = vhost_vsock_get(le64_to_cpu(hdr->dst_cid)); 278 if (!vsock) { 279 rcu_read_unlock(); 280 kfree_skb(skb); 281 return -ENODEV; 282 } 283 284 if (virtio_vsock_skb_reply(skb)) 285 atomic_inc(&vsock->queued_replies); 286 287 virtio_vsock_skb_queue_tail(&vsock->send_pkt_queue, skb); 288 vhost_vq_work_queue(&vsock->vqs[VSOCK_VQ_RX], &vsock->send_pkt_work); 289 290 rcu_read_unlock(); 291 return len; 292 } 293 294 static int 295 vhost_transport_cancel_pkt(struct vsock_sock *vsk) 296 { 297 struct vhost_vsock *vsock; 298 int cnt = 0; 299 int ret = -ENODEV; 300 301 rcu_read_lock(); 302 303 /* Find the vhost_vsock according to guest context id */ 304 vsock = vhost_vsock_get(vsk->remote_addr.svm_cid); 305 if (!vsock) 306 goto out; 307 308 cnt = virtio_transport_purge_skbs(vsk, &vsock->send_pkt_queue); 309 310 if (cnt) { 311 struct vhost_virtqueue *tx_vq = &vsock->vqs[VSOCK_VQ_TX]; 312 int new_cnt; 313 314 new_cnt = atomic_sub_return(cnt, &vsock->queued_replies); 315 if (new_cnt + cnt >= tx_vq->num && new_cnt < tx_vq->num) 316 vhost_poll_queue(&tx_vq->poll); 317 } 318 319 ret = 0; 320 out: 321 rcu_read_unlock(); 322 return ret; 323 } 324 325 static struct sk_buff * 326 vhost_vsock_alloc_skb(struct vhost_virtqueue *vq, 327 unsigned int out, unsigned int in) 328 { 329 struct virtio_vsock_hdr *hdr; 330 struct iov_iter iov_iter; 331 struct sk_buff *skb; 332 size_t payload_len; 333 size_t nbytes; 334 size_t len; 335 336 if (in != 0) { 337 vq_err(vq, "Expected 0 input buffers, got %u\n", in); 338 return NULL; 339 } 340 341 len = iov_length(vq->iov, out); 342 343 /* len contains both payload and hdr */ 344 skb = virtio_vsock_alloc_skb(len, GFP_KERNEL); 345 if (!skb) 346 return NULL; 347 348 iov_iter_init(&iov_iter, ITER_SOURCE, vq->iov, out, len); 349 350 hdr = virtio_vsock_hdr(skb); 351 nbytes = copy_from_iter(hdr, sizeof(*hdr), &iov_iter); 352 if (nbytes != sizeof(*hdr)) { 353 vq_err(vq, "Expected %zu bytes for pkt->hdr, got %zu bytes\n", 354 sizeof(*hdr), nbytes); 355 kfree_skb(skb); 356 return NULL; 357 } 358 359 payload_len = le32_to_cpu(hdr->len); 360 361 /* No payload */ 362 if (!payload_len) 363 return skb; 364 365 /* The pkt is too big or the length in the header is invalid */ 366 if (payload_len > VIRTIO_VSOCK_MAX_PKT_BUF_SIZE || 367 payload_len + sizeof(*hdr) > len) { 368 kfree_skb(skb); 369 return NULL; 370 } 371 372 virtio_vsock_skb_rx_put(skb); 373 374 nbytes = copy_from_iter(skb->data, payload_len, &iov_iter); 375 if (nbytes != payload_len) { 376 vq_err(vq, "Expected %zu byte payload, got %zu bytes\n", 377 payload_len, nbytes); 378 kfree_skb(skb); 379 return NULL; 380 } 381 382 return skb; 383 } 384 385 /* Is there space left for replies to rx packets? */ 386 static bool vhost_vsock_more_replies(struct vhost_vsock *vsock) 387 { 388 struct vhost_virtqueue *vq = &vsock->vqs[VSOCK_VQ_TX]; 389 int val; 390 391 smp_rmb(); /* paired with atomic_inc() and atomic_dec_return() */ 392 val = atomic_read(&vsock->queued_replies); 393 394 return val < vq->num; 395 } 396 397 static bool vhost_transport_seqpacket_allow(u32 remote_cid); 398 399 static struct virtio_transport vhost_transport = { 400 .transport = { 401 .module = THIS_MODULE, 402 403 .get_local_cid = vhost_transport_get_local_cid, 404 405 .init = virtio_transport_do_socket_init, 406 .destruct = virtio_transport_destruct, 407 .release = virtio_transport_release, 408 .connect = virtio_transport_connect, 409 .shutdown = virtio_transport_shutdown, 410 .cancel_pkt = vhost_transport_cancel_pkt, 411 412 .dgram_enqueue = virtio_transport_dgram_enqueue, 413 .dgram_dequeue = virtio_transport_dgram_dequeue, 414 .dgram_bind = virtio_transport_dgram_bind, 415 .dgram_allow = virtio_transport_dgram_allow, 416 417 .stream_enqueue = virtio_transport_stream_enqueue, 418 .stream_dequeue = virtio_transport_stream_dequeue, 419 .stream_has_data = virtio_transport_stream_has_data, 420 .stream_has_space = virtio_transport_stream_has_space, 421 .stream_rcvhiwat = virtio_transport_stream_rcvhiwat, 422 .stream_is_active = virtio_transport_stream_is_active, 423 .stream_allow = virtio_transport_stream_allow, 424 425 .seqpacket_dequeue = virtio_transport_seqpacket_dequeue, 426 .seqpacket_enqueue = virtio_transport_seqpacket_enqueue, 427 .seqpacket_allow = vhost_transport_seqpacket_allow, 428 .seqpacket_has_data = virtio_transport_seqpacket_has_data, 429 430 .notify_poll_in = virtio_transport_notify_poll_in, 431 .notify_poll_out = virtio_transport_notify_poll_out, 432 .notify_recv_init = virtio_transport_notify_recv_init, 433 .notify_recv_pre_block = virtio_transport_notify_recv_pre_block, 434 .notify_recv_pre_dequeue = virtio_transport_notify_recv_pre_dequeue, 435 .notify_recv_post_dequeue = virtio_transport_notify_recv_post_dequeue, 436 .notify_send_init = virtio_transport_notify_send_init, 437 .notify_send_pre_block = virtio_transport_notify_send_pre_block, 438 .notify_send_pre_enqueue = virtio_transport_notify_send_pre_enqueue, 439 .notify_send_post_enqueue = virtio_transport_notify_send_post_enqueue, 440 .notify_buffer_size = virtio_transport_notify_buffer_size, 441 442 .read_skb = virtio_transport_read_skb, 443 }, 444 445 .send_pkt = vhost_transport_send_pkt, 446 }; 447 448 static bool vhost_transport_seqpacket_allow(u32 remote_cid) 449 { 450 struct vhost_vsock *vsock; 451 bool seqpacket_allow = false; 452 453 rcu_read_lock(); 454 vsock = vhost_vsock_get(remote_cid); 455 456 if (vsock) 457 seqpacket_allow = vsock->seqpacket_allow; 458 459 rcu_read_unlock(); 460 461 return seqpacket_allow; 462 } 463 464 static void vhost_vsock_handle_tx_kick(struct vhost_work *work) 465 { 466 struct vhost_virtqueue *vq = container_of(work, struct vhost_virtqueue, 467 poll.work); 468 struct vhost_vsock *vsock = container_of(vq->dev, struct vhost_vsock, 469 dev); 470 int head, pkts = 0, total_len = 0; 471 unsigned int out, in; 472 struct sk_buff *skb; 473 bool added = false; 474 475 mutex_lock(&vq->mutex); 476 477 if (!vhost_vq_get_backend(vq)) 478 goto out; 479 480 if (!vq_meta_prefetch(vq)) 481 goto out; 482 483 vhost_disable_notify(&vsock->dev, vq); 484 do { 485 struct virtio_vsock_hdr *hdr; 486 487 if (!vhost_vsock_more_replies(vsock)) { 488 /* Stop tx until the device processes already 489 * pending replies. Leave tx virtqueue 490 * callbacks disabled. 491 */ 492 goto no_more_replies; 493 } 494 495 head = vhost_get_vq_desc(vq, vq->iov, ARRAY_SIZE(vq->iov), 496 &out, &in, NULL, NULL); 497 if (head < 0) 498 break; 499 500 if (head == vq->num) { 501 if (unlikely(vhost_enable_notify(&vsock->dev, vq))) { 502 vhost_disable_notify(&vsock->dev, vq); 503 continue; 504 } 505 break; 506 } 507 508 skb = vhost_vsock_alloc_skb(vq, out, in); 509 if (!skb) { 510 vq_err(vq, "Faulted on pkt\n"); 511 continue; 512 } 513 514 total_len += sizeof(*hdr) + skb->len; 515 516 /* Deliver to monitoring devices all received packets */ 517 virtio_transport_deliver_tap_pkt(skb); 518 519 hdr = virtio_vsock_hdr(skb); 520 521 /* Only accept correctly addressed packets */ 522 if (le64_to_cpu(hdr->src_cid) == vsock->guest_cid && 523 le64_to_cpu(hdr->dst_cid) == 524 vhost_transport_get_local_cid()) 525 virtio_transport_recv_pkt(&vhost_transport, skb); 526 else 527 kfree_skb(skb); 528 529 vhost_add_used(vq, head, 0); 530 added = true; 531 } while(likely(!vhost_exceeds_weight(vq, ++pkts, total_len))); 532 533 no_more_replies: 534 if (added) 535 vhost_signal(&vsock->dev, vq); 536 537 out: 538 mutex_unlock(&vq->mutex); 539 } 540 541 static void vhost_vsock_handle_rx_kick(struct vhost_work *work) 542 { 543 struct vhost_virtqueue *vq = container_of(work, struct vhost_virtqueue, 544 poll.work); 545 struct vhost_vsock *vsock = container_of(vq->dev, struct vhost_vsock, 546 dev); 547 548 vhost_transport_do_send_pkt(vsock, vq); 549 } 550 551 static int vhost_vsock_start(struct vhost_vsock *vsock) 552 { 553 struct vhost_virtqueue *vq; 554 size_t i; 555 int ret; 556 557 mutex_lock(&vsock->dev.mutex); 558 559 ret = vhost_dev_check_owner(&vsock->dev); 560 if (ret) 561 goto err; 562 563 for (i = 0; i < ARRAY_SIZE(vsock->vqs); i++) { 564 vq = &vsock->vqs[i]; 565 566 mutex_lock(&vq->mutex); 567 568 if (!vhost_vq_access_ok(vq)) { 569 ret = -EFAULT; 570 goto err_vq; 571 } 572 573 if (!vhost_vq_get_backend(vq)) { 574 vhost_vq_set_backend(vq, vsock); 575 ret = vhost_vq_init_access(vq); 576 if (ret) 577 goto err_vq; 578 } 579 580 mutex_unlock(&vq->mutex); 581 } 582 583 /* Some packets may have been queued before the device was started, 584 * let's kick the send worker to send them. 585 */ 586 vhost_vq_work_queue(&vsock->vqs[VSOCK_VQ_RX], &vsock->send_pkt_work); 587 588 mutex_unlock(&vsock->dev.mutex); 589 return 0; 590 591 err_vq: 592 vhost_vq_set_backend(vq, NULL); 593 mutex_unlock(&vq->mutex); 594 595 for (i = 0; i < ARRAY_SIZE(vsock->vqs); i++) { 596 vq = &vsock->vqs[i]; 597 598 mutex_lock(&vq->mutex); 599 vhost_vq_set_backend(vq, NULL); 600 mutex_unlock(&vq->mutex); 601 } 602 err: 603 mutex_unlock(&vsock->dev.mutex); 604 return ret; 605 } 606 607 static int vhost_vsock_stop(struct vhost_vsock *vsock, bool check_owner) 608 { 609 size_t i; 610 int ret = 0; 611 612 mutex_lock(&vsock->dev.mutex); 613 614 if (check_owner) { 615 ret = vhost_dev_check_owner(&vsock->dev); 616 if (ret) 617 goto err; 618 } 619 620 for (i = 0; i < ARRAY_SIZE(vsock->vqs); i++) { 621 struct vhost_virtqueue *vq = &vsock->vqs[i]; 622 623 mutex_lock(&vq->mutex); 624 vhost_vq_set_backend(vq, NULL); 625 mutex_unlock(&vq->mutex); 626 } 627 628 err: 629 mutex_unlock(&vsock->dev.mutex); 630 return ret; 631 } 632 633 static void vhost_vsock_free(struct vhost_vsock *vsock) 634 { 635 kvfree(vsock); 636 } 637 638 static int vhost_vsock_dev_open(struct inode *inode, struct file *file) 639 { 640 struct vhost_virtqueue **vqs; 641 struct vhost_vsock *vsock; 642 int ret; 643 644 /* This struct is large and allocation could fail, fall back to vmalloc 645 * if there is no other way. 646 */ 647 vsock = kvmalloc(sizeof(*vsock), GFP_KERNEL | __GFP_RETRY_MAYFAIL); 648 if (!vsock) 649 return -ENOMEM; 650 651 vqs = kmalloc_array(ARRAY_SIZE(vsock->vqs), sizeof(*vqs), GFP_KERNEL); 652 if (!vqs) { 653 ret = -ENOMEM; 654 goto out; 655 } 656 657 vsock->guest_cid = 0; /* no CID assigned yet */ 658 659 atomic_set(&vsock->queued_replies, 0); 660 661 vqs[VSOCK_VQ_TX] = &vsock->vqs[VSOCK_VQ_TX]; 662 vqs[VSOCK_VQ_RX] = &vsock->vqs[VSOCK_VQ_RX]; 663 vsock->vqs[VSOCK_VQ_TX].handle_kick = vhost_vsock_handle_tx_kick; 664 vsock->vqs[VSOCK_VQ_RX].handle_kick = vhost_vsock_handle_rx_kick; 665 666 vhost_dev_init(&vsock->dev, vqs, ARRAY_SIZE(vsock->vqs), 667 UIO_MAXIOV, VHOST_VSOCK_PKT_WEIGHT, 668 VHOST_VSOCK_WEIGHT, true, NULL); 669 670 file->private_data = vsock; 671 skb_queue_head_init(&vsock->send_pkt_queue); 672 vhost_work_init(&vsock->send_pkt_work, vhost_transport_send_pkt_work); 673 return 0; 674 675 out: 676 vhost_vsock_free(vsock); 677 return ret; 678 } 679 680 static void vhost_vsock_flush(struct vhost_vsock *vsock) 681 { 682 vhost_dev_flush(&vsock->dev); 683 } 684 685 static void vhost_vsock_reset_orphans(struct sock *sk) 686 { 687 struct vsock_sock *vsk = vsock_sk(sk); 688 689 /* vmci_transport.c doesn't take sk_lock here either. At least we're 690 * under vsock_table_lock so the sock cannot disappear while we're 691 * executing. 692 */ 693 694 /* If the peer is still valid, no need to reset connection */ 695 if (vhost_vsock_get(vsk->remote_addr.svm_cid)) 696 return; 697 698 /* If the close timeout is pending, let it expire. This avoids races 699 * with the timeout callback. 700 */ 701 if (vsk->close_work_scheduled) 702 return; 703 704 sock_set_flag(sk, SOCK_DONE); 705 vsk->peer_shutdown = SHUTDOWN_MASK; 706 sk->sk_state = SS_UNCONNECTED; 707 sk->sk_err = ECONNRESET; 708 sk_error_report(sk); 709 } 710 711 static int vhost_vsock_dev_release(struct inode *inode, struct file *file) 712 { 713 struct vhost_vsock *vsock = file->private_data; 714 715 mutex_lock(&vhost_vsock_mutex); 716 if (vsock->guest_cid) 717 hash_del_rcu(&vsock->hash); 718 mutex_unlock(&vhost_vsock_mutex); 719 720 /* Wait for other CPUs to finish using vsock */ 721 synchronize_rcu(); 722 723 /* Iterating over all connections for all CIDs to find orphans is 724 * inefficient. Room for improvement here. */ 725 vsock_for_each_connected_socket(&vhost_transport.transport, 726 vhost_vsock_reset_orphans); 727 728 /* Don't check the owner, because we are in the release path, so we 729 * need to stop the vsock device in any case. 730 * vhost_vsock_stop() can not fail in this case, so we don't need to 731 * check the return code. 732 */ 733 vhost_vsock_stop(vsock, false); 734 vhost_vsock_flush(vsock); 735 vhost_dev_stop(&vsock->dev); 736 737 virtio_vsock_skb_queue_purge(&vsock->send_pkt_queue); 738 739 vhost_dev_cleanup(&vsock->dev); 740 kfree(vsock->dev.vqs); 741 vhost_vsock_free(vsock); 742 return 0; 743 } 744 745 static int vhost_vsock_set_cid(struct vhost_vsock *vsock, u64 guest_cid) 746 { 747 struct vhost_vsock *other; 748 749 /* Refuse reserved CIDs */ 750 if (guest_cid <= VMADDR_CID_HOST || 751 guest_cid == U32_MAX) 752 return -EINVAL; 753 754 /* 64-bit CIDs are not yet supported */ 755 if (guest_cid > U32_MAX) 756 return -EINVAL; 757 758 /* Refuse if CID is assigned to the guest->host transport (i.e. nested 759 * VM), to make the loopback work. 760 */ 761 if (vsock_find_cid(guest_cid)) 762 return -EADDRINUSE; 763 764 /* Refuse if CID is already in use */ 765 mutex_lock(&vhost_vsock_mutex); 766 other = vhost_vsock_get(guest_cid); 767 if (other && other != vsock) { 768 mutex_unlock(&vhost_vsock_mutex); 769 return -EADDRINUSE; 770 } 771 772 if (vsock->guest_cid) 773 hash_del_rcu(&vsock->hash); 774 775 vsock->guest_cid = guest_cid; 776 hash_add_rcu(vhost_vsock_hash, &vsock->hash, vsock->guest_cid); 777 mutex_unlock(&vhost_vsock_mutex); 778 779 return 0; 780 } 781 782 static int vhost_vsock_set_features(struct vhost_vsock *vsock, u64 features) 783 { 784 struct vhost_virtqueue *vq; 785 int i; 786 787 if (features & ~VHOST_VSOCK_FEATURES) 788 return -EOPNOTSUPP; 789 790 mutex_lock(&vsock->dev.mutex); 791 if ((features & (1 << VHOST_F_LOG_ALL)) && 792 !vhost_log_access_ok(&vsock->dev)) { 793 goto err; 794 } 795 796 if ((features & (1ULL << VIRTIO_F_ACCESS_PLATFORM))) { 797 if (vhost_init_device_iotlb(&vsock->dev)) 798 goto err; 799 } 800 801 if (features & (1ULL << VIRTIO_VSOCK_F_SEQPACKET)) 802 vsock->seqpacket_allow = true; 803 804 for (i = 0; i < ARRAY_SIZE(vsock->vqs); i++) { 805 vq = &vsock->vqs[i]; 806 mutex_lock(&vq->mutex); 807 vq->acked_features = features; 808 mutex_unlock(&vq->mutex); 809 } 810 mutex_unlock(&vsock->dev.mutex); 811 return 0; 812 813 err: 814 mutex_unlock(&vsock->dev.mutex); 815 return -EFAULT; 816 } 817 818 static long vhost_vsock_dev_ioctl(struct file *f, unsigned int ioctl, 819 unsigned long arg) 820 { 821 struct vhost_vsock *vsock = f->private_data; 822 void __user *argp = (void __user *)arg; 823 u64 guest_cid; 824 u64 features; 825 int start; 826 int r; 827 828 switch (ioctl) { 829 case VHOST_VSOCK_SET_GUEST_CID: 830 if (copy_from_user(&guest_cid, argp, sizeof(guest_cid))) 831 return -EFAULT; 832 return vhost_vsock_set_cid(vsock, guest_cid); 833 case VHOST_VSOCK_SET_RUNNING: 834 if (copy_from_user(&start, argp, sizeof(start))) 835 return -EFAULT; 836 if (start) 837 return vhost_vsock_start(vsock); 838 else 839 return vhost_vsock_stop(vsock, true); 840 case VHOST_GET_FEATURES: 841 features = VHOST_VSOCK_FEATURES; 842 if (copy_to_user(argp, &features, sizeof(features))) 843 return -EFAULT; 844 return 0; 845 case VHOST_SET_FEATURES: 846 if (copy_from_user(&features, argp, sizeof(features))) 847 return -EFAULT; 848 return vhost_vsock_set_features(vsock, features); 849 case VHOST_GET_BACKEND_FEATURES: 850 features = VHOST_VSOCK_BACKEND_FEATURES; 851 if (copy_to_user(argp, &features, sizeof(features))) 852 return -EFAULT; 853 return 0; 854 case VHOST_SET_BACKEND_FEATURES: 855 if (copy_from_user(&features, argp, sizeof(features))) 856 return -EFAULT; 857 if (features & ~VHOST_VSOCK_BACKEND_FEATURES) 858 return -EOPNOTSUPP; 859 vhost_set_backend_features(&vsock->dev, features); 860 return 0; 861 default: 862 mutex_lock(&vsock->dev.mutex); 863 r = vhost_dev_ioctl(&vsock->dev, ioctl, argp); 864 if (r == -ENOIOCTLCMD) 865 r = vhost_vring_ioctl(&vsock->dev, ioctl, argp); 866 else 867 vhost_vsock_flush(vsock); 868 mutex_unlock(&vsock->dev.mutex); 869 return r; 870 } 871 } 872 873 static ssize_t vhost_vsock_chr_read_iter(struct kiocb *iocb, struct iov_iter *to) 874 { 875 struct file *file = iocb->ki_filp; 876 struct vhost_vsock *vsock = file->private_data; 877 struct vhost_dev *dev = &vsock->dev; 878 int noblock = file->f_flags & O_NONBLOCK; 879 880 return vhost_chr_read_iter(dev, to, noblock); 881 } 882 883 static ssize_t vhost_vsock_chr_write_iter(struct kiocb *iocb, 884 struct iov_iter *from) 885 { 886 struct file *file = iocb->ki_filp; 887 struct vhost_vsock *vsock = file->private_data; 888 struct vhost_dev *dev = &vsock->dev; 889 890 return vhost_chr_write_iter(dev, from); 891 } 892 893 static __poll_t vhost_vsock_chr_poll(struct file *file, poll_table *wait) 894 { 895 struct vhost_vsock *vsock = file->private_data; 896 struct vhost_dev *dev = &vsock->dev; 897 898 return vhost_chr_poll(file, dev, wait); 899 } 900 901 static const struct file_operations vhost_vsock_fops = { 902 .owner = THIS_MODULE, 903 .open = vhost_vsock_dev_open, 904 .release = vhost_vsock_dev_release, 905 .llseek = noop_llseek, 906 .unlocked_ioctl = vhost_vsock_dev_ioctl, 907 .compat_ioctl = compat_ptr_ioctl, 908 .read_iter = vhost_vsock_chr_read_iter, 909 .write_iter = vhost_vsock_chr_write_iter, 910 .poll = vhost_vsock_chr_poll, 911 }; 912 913 static struct miscdevice vhost_vsock_misc = { 914 .minor = VHOST_VSOCK_MINOR, 915 .name = "vhost-vsock", 916 .fops = &vhost_vsock_fops, 917 }; 918 919 static int __init vhost_vsock_init(void) 920 { 921 int ret; 922 923 ret = vsock_core_register(&vhost_transport.transport, 924 VSOCK_TRANSPORT_F_H2G); 925 if (ret < 0) 926 return ret; 927 928 ret = misc_register(&vhost_vsock_misc); 929 if (ret) { 930 vsock_core_unregister(&vhost_transport.transport); 931 return ret; 932 } 933 934 return 0; 935 }; 936 937 static void __exit vhost_vsock_exit(void) 938 { 939 misc_deregister(&vhost_vsock_misc); 940 vsock_core_unregister(&vhost_transport.transport); 941 }; 942 943 module_init(vhost_vsock_init); 944 module_exit(vhost_vsock_exit); 945 MODULE_LICENSE("GPL v2"); 946 MODULE_AUTHOR("Asias He"); 947 MODULE_DESCRIPTION("vhost transport for vsock "); 948 MODULE_ALIAS_MISCDEV(VHOST_VSOCK_MINOR); 949 MODULE_ALIAS("devname:vhost-vsock"); 950