xref: /linux/net/mptcp/pm_kernel.c (revision 8b4e023d79b760d217dd1c462848c4a27fcc7677)
1 // SPDX-License-Identifier: GPL-2.0
2 /* Multipath TCP
3  *
4  * Copyright (c) 2025, Matthieu Baerts.
5  */
6 
7 #define pr_fmt(fmt) "MPTCP: " fmt
8 
9 #include <net/netns/generic.h>
10 
11 #include "protocol.h"
12 #include "mib.h"
13 #include "mptcp_pm_gen.h"
14 
15 static int pm_nl_pernet_id;
16 
17 struct pm_nl_pernet {
18 	/* protects pernet updates */
19 	spinlock_t		lock;
20 	struct list_head	endp_list;
21 	u8			endpoints;
22 	u8			endp_signal_max;
23 	u8			endp_subflow_max;
24 	u8			endp_laminar_max;
25 	u8			endp_fullmesh_max;
26 	u8			limit_add_addr_accepted;
27 	u8			limit_extra_subflows;
28 	u8			next_id;
29 	DECLARE_BITMAP(id_bitmap, MPTCP_PM_MAX_ADDR_ID + 1);
30 };
31 
32 #define MPTCP_PM_ADDR_MAX	8
33 
34 static struct pm_nl_pernet *pm_nl_get_pernet(const struct net *net)
35 {
36 	return net_generic(net, pm_nl_pernet_id);
37 }
38 
39 static struct pm_nl_pernet *
40 pm_nl_get_pernet_from_msk(const struct mptcp_sock *msk)
41 {
42 	return pm_nl_get_pernet(sock_net((struct sock *)msk));
43 }
44 
45 static struct pm_nl_pernet *genl_info_pm_nl(struct genl_info *info)
46 {
47 	return pm_nl_get_pernet(genl_info_net(info));
48 }
49 
50 u8 mptcp_pm_get_endp_signal_max(const struct mptcp_sock *msk)
51 {
52 	const struct pm_nl_pernet *pernet = pm_nl_get_pernet_from_msk(msk);
53 
54 	return READ_ONCE(pernet->endp_signal_max);
55 }
56 EXPORT_SYMBOL_GPL(mptcp_pm_get_endp_signal_max);
57 
58 u8 mptcp_pm_get_endp_subflow_max(const struct mptcp_sock *msk)
59 {
60 	struct pm_nl_pernet *pernet = pm_nl_get_pernet_from_msk(msk);
61 
62 	return READ_ONCE(pernet->endp_subflow_max);
63 }
64 EXPORT_SYMBOL_GPL(mptcp_pm_get_endp_subflow_max);
65 
66 u8 mptcp_pm_get_endp_laminar_max(const struct mptcp_sock *msk)
67 {
68 	struct pm_nl_pernet *pernet = pm_nl_get_pernet_from_msk(msk);
69 
70 	return READ_ONCE(pernet->endp_laminar_max);
71 }
72 EXPORT_SYMBOL_GPL(mptcp_pm_get_endp_laminar_max);
73 
74 u8 mptcp_pm_get_endp_fullmesh_max(const struct mptcp_sock *msk)
75 {
76 	struct pm_nl_pernet *pernet = pm_nl_get_pernet_from_msk(msk);
77 
78 	return READ_ONCE(pernet->endp_fullmesh_max);
79 }
80 EXPORT_SYMBOL_GPL(mptcp_pm_get_endp_fullmesh_max);
81 
82 u8 mptcp_pm_get_limit_add_addr_accepted(const struct mptcp_sock *msk)
83 {
84 	struct pm_nl_pernet *pernet = pm_nl_get_pernet_from_msk(msk);
85 
86 	return READ_ONCE(pernet->limit_add_addr_accepted);
87 }
88 EXPORT_SYMBOL_GPL(mptcp_pm_get_limit_add_addr_accepted);
89 
90 u8 mptcp_pm_get_limit_extra_subflows(const struct mptcp_sock *msk)
91 {
92 	struct pm_nl_pernet *pernet = pm_nl_get_pernet_from_msk(msk);
93 
94 	return READ_ONCE(pernet->limit_extra_subflows);
95 }
96 EXPORT_SYMBOL_GPL(mptcp_pm_get_limit_extra_subflows);
97 
98 static bool lookup_subflow_by_daddr(const struct list_head *list,
99 				    const struct mptcp_addr_info *daddr)
100 {
101 	struct mptcp_subflow_context *subflow;
102 	struct mptcp_addr_info cur;
103 
104 	list_for_each_entry(subflow, list, node) {
105 		struct sock *ssk = mptcp_subflow_tcp_sock(subflow);
106 
107 		if (!((1 << inet_sk_state_load(ssk)) &
108 		      (TCPF_ESTABLISHED | TCPF_SYN_SENT | TCPF_SYN_RECV)))
109 			continue;
110 
111 		mptcp_remote_address((struct sock_common *)ssk, &cur);
112 		if (mptcp_addresses_equal(&cur, daddr, daddr->port))
113 			return true;
114 	}
115 
116 	return false;
117 }
118 
119 static bool
120 select_local_address(const struct pm_nl_pernet *pernet,
121 		     const struct mptcp_sock *msk,
122 		     struct mptcp_pm_local *new_local)
123 {
124 	struct mptcp_pm_addr_entry *entry;
125 	bool found = false;
126 
127 	msk_owned_by_me(msk);
128 
129 	rcu_read_lock();
130 	list_for_each_entry_rcu(entry, &pernet->endp_list, list) {
131 		if (!(entry->flags & MPTCP_PM_ADDR_FLAG_SUBFLOW))
132 			continue;
133 
134 		if (!test_bit(entry->addr.id, msk->pm.id_avail_bitmap))
135 			continue;
136 
137 		new_local->addr = entry->addr;
138 		new_local->flags = entry->flags;
139 		new_local->ifindex = entry->ifindex;
140 		found = true;
141 		break;
142 	}
143 	rcu_read_unlock();
144 
145 	return found;
146 }
147 
148 static bool
149 select_signal_address(struct pm_nl_pernet *pernet, const struct mptcp_sock *msk,
150 		      struct mptcp_pm_local *new_local)
151 {
152 	struct mptcp_pm_addr_entry *entry;
153 	bool found = false;
154 
155 	rcu_read_lock();
156 	/* do not keep any additional per socket state, just signal
157 	 * the address list in order.
158 	 * Note: removal from the local address list during the msk life-cycle
159 	 * can lead to additional addresses not being announced.
160 	 */
161 	list_for_each_entry_rcu(entry, &pernet->endp_list, list) {
162 		if (!test_bit(entry->addr.id, msk->pm.id_avail_bitmap))
163 			continue;
164 
165 		if (!(entry->flags & MPTCP_PM_ADDR_FLAG_SIGNAL))
166 			continue;
167 
168 		new_local->addr = entry->addr;
169 		new_local->flags = entry->flags;
170 		new_local->ifindex = entry->ifindex;
171 		found = true;
172 		break;
173 	}
174 	rcu_read_unlock();
175 
176 	return found;
177 }
178 
179 static unsigned int
180 fill_remote_addr(struct mptcp_sock *msk, struct mptcp_addr_info *local,
181 		 struct mptcp_addr_info *addrs)
182 {
183 	bool deny_id0 = READ_ONCE(msk->pm.remote_deny_join_id0);
184 	struct mptcp_addr_info remote = { 0 };
185 	struct sock *sk = (struct sock *)msk;
186 
187 	if (deny_id0)
188 		return 0;
189 
190 	mptcp_remote_address((struct sock_common *)sk, &remote);
191 
192 	if (!mptcp_pm_addr_families_match(sk, local, &remote))
193 		return 0;
194 
195 	msk->pm.extra_subflows++;
196 	*addrs = remote;
197 
198 	return 1;
199 }
200 
201 static unsigned int
202 fill_remote_addresses_fullmesh(struct mptcp_sock *msk,
203 			       struct mptcp_addr_info *local,
204 			       struct mptcp_addr_info *addrs)
205 {
206 	u8 limit_extra_subflows = mptcp_pm_get_limit_extra_subflows(msk);
207 	bool deny_id0 = READ_ONCE(msk->pm.remote_deny_join_id0);
208 	DECLARE_BITMAP(unavail_id, MPTCP_PM_MAX_ADDR_ID + 1);
209 	struct sock *sk = (struct sock *)msk, *ssk;
210 	struct mptcp_subflow_context *subflow;
211 	int i = 0;
212 
213 	/* Forbid creation of new subflows matching existing ones, possibly
214 	 * already created by incoming ADD_ADDR
215 	 */
216 	bitmap_zero(unavail_id, MPTCP_PM_MAX_ADDR_ID + 1);
217 	mptcp_for_each_subflow(msk, subflow)
218 		if (READ_ONCE(subflow->local_id) == local->id)
219 			__set_bit(subflow->remote_id, unavail_id);
220 
221 	mptcp_for_each_subflow(msk, subflow) {
222 		ssk = mptcp_subflow_tcp_sock(subflow);
223 		mptcp_remote_address((struct sock_common *)ssk, &addrs[i]);
224 		addrs[i].id = READ_ONCE(subflow->remote_id);
225 		if (deny_id0 && !addrs[i].id)
226 			continue;
227 
228 		if (test_bit(addrs[i].id, unavail_id))
229 			continue;
230 
231 		if (!mptcp_pm_addr_families_match(sk, local, &addrs[i]))
232 			continue;
233 
234 		/* forbid creating multiple address towards this id */
235 		__set_bit(addrs[i].id, unavail_id);
236 		msk->pm.extra_subflows++;
237 		i++;
238 
239 		if (msk->pm.extra_subflows >= limit_extra_subflows)
240 			break;
241 	}
242 
243 	return i;
244 }
245 
246 /* Fill all the remote addresses into the array addrs[],
247  * and return the array size.
248  */
249 static unsigned int
250 fill_remote_addresses_vec(struct mptcp_sock *msk, struct mptcp_addr_info *local,
251 			  bool fullmesh, struct mptcp_addr_info *addrs)
252 {
253 	/* Non-fullmesh: fill in the single entry corresponding to the primary
254 	 * MPC subflow remote address, and return 1, corresponding to 1 entry.
255 	 */
256 	if (!fullmesh)
257 		return fill_remote_addr(msk, local, addrs);
258 
259 	/* Fullmesh endpoint: fill all possible remote addresses */
260 	return fill_remote_addresses_fullmesh(msk, local, addrs);
261 }
262 
263 static struct mptcp_pm_addr_entry *
264 __lookup_addr_by_id(struct pm_nl_pernet *pernet, unsigned int id)
265 {
266 	struct mptcp_pm_addr_entry *entry;
267 
268 	list_for_each_entry_rcu(entry, &pernet->endp_list, list,
269 				lockdep_is_held(&pernet->lock)) {
270 		if (entry->addr.id == id)
271 			return entry;
272 	}
273 	return NULL;
274 }
275 
276 static struct mptcp_pm_addr_entry *
277 __lookup_addr(struct pm_nl_pernet *pernet, const struct mptcp_addr_info *info)
278 {
279 	struct mptcp_pm_addr_entry *entry;
280 
281 	list_for_each_entry_rcu(entry, &pernet->endp_list, list,
282 				lockdep_is_held(&pernet->lock)) {
283 		if (mptcp_addresses_equal(&entry->addr, info, entry->addr.port))
284 			return entry;
285 	}
286 	return NULL;
287 }
288 
289 static u8 mptcp_endp_get_local_id(struct mptcp_sock *msk,
290 				  const struct mptcp_addr_info *addr)
291 {
292 	return msk->mpc_endpoint_id == addr->id ? 0 : addr->id;
293 }
294 
295 /* Set mpc_endpoint_id, and send MP_PRIO for ID0 if needed */
296 static void mptcp_mpc_endpoint_setup(struct mptcp_sock *msk)
297 {
298 	struct mptcp_subflow_context *subflow;
299 	struct mptcp_pm_addr_entry *entry;
300 	struct mptcp_addr_info mpc_addr;
301 	struct pm_nl_pernet *pernet;
302 	bool backup = false;
303 
304 	/* do lazy endpoint usage accounting for the MPC subflows */
305 	if (likely(msk->pm.status & BIT(MPTCP_PM_MPC_ENDPOINT_ACCOUNTED)) ||
306 	    !msk->first)
307 		return;
308 
309 	subflow = mptcp_subflow_ctx(msk->first);
310 	pernet = pm_nl_get_pernet_from_msk(msk);
311 
312 	mptcp_local_address((struct sock_common *)msk->first, &mpc_addr);
313 	rcu_read_lock();
314 	entry = __lookup_addr(pernet, &mpc_addr);
315 	if (entry) {
316 		__clear_bit(entry->addr.id, msk->pm.id_avail_bitmap);
317 		msk->mpc_endpoint_id = entry->addr.id;
318 		backup = !!(entry->flags & MPTCP_PM_ADDR_FLAG_BACKUP);
319 	}
320 	rcu_read_unlock();
321 
322 	/* Send MP_PRIO */
323 	if (backup)
324 		mptcp_pm_send_ack(msk, subflow, true, backup);
325 
326 	msk->pm.status |= BIT(MPTCP_PM_MPC_ENDPOINT_ACCOUNTED);
327 }
328 
329 static void mptcp_pm_create_subflow_or_signal_addr(struct mptcp_sock *msk)
330 {
331 	u8 limit_extra_subflows = mptcp_pm_get_limit_extra_subflows(msk);
332 	struct pm_nl_pernet *pernet = pm_nl_get_pernet_from_msk(msk);
333 	u8 endp_subflow_max = mptcp_pm_get_endp_subflow_max(msk);
334 	u8 endp_signal_max = mptcp_pm_get_endp_signal_max(msk);
335 	struct sock *sk = (struct sock *)msk;
336 	bool signal_and_subflow = false;
337 	struct mptcp_pm_local local;
338 
339 	mptcp_mpc_endpoint_setup(msk);
340 
341 	pr_debug("local %d:%d signal %d:%d subflows %d:%d\n",
342 		 msk->pm.local_addr_used, endp_subflow_max,
343 		 msk->pm.add_addr_signaled, endp_signal_max,
344 		 msk->pm.extra_subflows, limit_extra_subflows);
345 
346 	/* check first for announce */
347 	if (msk->pm.add_addr_signaled < endp_signal_max) {
348 		/* due to racing events on both ends we can reach here while
349 		 * previous add address is still running: if we invoke now
350 		 * mptcp_pm_announce_addr(), that will fail and the
351 		 * corresponding id will be marked as used.
352 		 * Instead let the PM machinery reschedule us when the
353 		 * current address announce will be completed.
354 		 */
355 		if (msk->pm.addr_signal & BIT(MPTCP_ADD_ADDR_SIGNAL))
356 			return;
357 
358 		if (!select_signal_address(pernet, msk, &local))
359 			goto subflow;
360 
361 		/* If the alloc fails, we are on memory pressure, not worth
362 		 * continuing, and trying to create subflows.
363 		 */
364 		if (!mptcp_pm_alloc_anno_list(msk, &local.addr))
365 			return;
366 
367 		__clear_bit(local.addr.id, msk->pm.id_avail_bitmap);
368 		msk->pm.add_addr_signaled++;
369 
370 		/* Special case for ID0: set the correct ID */
371 		if (local.addr.id == msk->mpc_endpoint_id)
372 			local.addr.id = 0;
373 
374 		mptcp_pm_announce_addr(msk, &local.addr, false);
375 		mptcp_pm_addr_send_ack(msk);
376 
377 		if (local.flags & MPTCP_PM_ADDR_FLAG_SUBFLOW)
378 			signal_and_subflow = true;
379 	}
380 
381 subflow:
382 	/* No need to try establishing subflows to remote id0 if not allowed */
383 	if (mptcp_pm_add_addr_c_flag_case(msk))
384 		goto exit;
385 
386 	/* check if should create a new subflow */
387 	while (msk->pm.local_addr_used < endp_subflow_max &&
388 	       msk->pm.extra_subflows < limit_extra_subflows) {
389 		struct mptcp_addr_info addrs[MPTCP_PM_ADDR_MAX];
390 		bool fullmesh;
391 		int i, nr;
392 
393 		if (signal_and_subflow)
394 			signal_and_subflow = false;
395 		else if (!select_local_address(pernet, msk, &local))
396 			break;
397 
398 		fullmesh = !!(local.flags & MPTCP_PM_ADDR_FLAG_FULLMESH);
399 
400 		__clear_bit(local.addr.id, msk->pm.id_avail_bitmap);
401 
402 		/* Special case for ID0: set the correct ID */
403 		if (local.addr.id == msk->mpc_endpoint_id)
404 			local.addr.id = 0;
405 		else /* local_addr_used is not decr for ID 0 */
406 			msk->pm.local_addr_used++;
407 
408 		nr = fill_remote_addresses_vec(msk, &local.addr, fullmesh, addrs);
409 		if (nr == 0)
410 			continue;
411 
412 		spin_unlock_bh(&msk->pm.lock);
413 		for (i = 0; i < nr; i++)
414 			__mptcp_subflow_connect(sk, &local, &addrs[i]);
415 		spin_lock_bh(&msk->pm.lock);
416 	}
417 
418 exit:
419 	mptcp_pm_nl_check_work_pending(msk);
420 }
421 
422 static void mptcp_pm_nl_fully_established(struct mptcp_sock *msk)
423 {
424 	mptcp_pm_create_subflow_or_signal_addr(msk);
425 }
426 
427 static void mptcp_pm_nl_subflow_established(struct mptcp_sock *msk)
428 {
429 	mptcp_pm_create_subflow_or_signal_addr(msk);
430 }
431 
432 static unsigned int
433 fill_local_addresses_vec_fullmesh(struct mptcp_sock *msk,
434 				  struct mptcp_addr_info *remote,
435 				  struct mptcp_pm_local *locals,
436 				  bool c_flag_case)
437 {
438 	u8 limit_extra_subflows = mptcp_pm_get_limit_extra_subflows(msk);
439 	struct pm_nl_pernet *pernet = pm_nl_get_pernet_from_msk(msk);
440 	struct sock *sk = (struct sock *)msk;
441 	struct mptcp_pm_addr_entry *entry;
442 	struct mptcp_pm_local *local;
443 	int i = 0;
444 
445 	rcu_read_lock();
446 	list_for_each_entry_rcu(entry, &pernet->endp_list, list) {
447 		bool is_id0;
448 
449 		if (!(entry->flags & MPTCP_PM_ADDR_FLAG_FULLMESH))
450 			continue;
451 
452 		if (!mptcp_pm_addr_families_match(sk, &entry->addr, remote))
453 			continue;
454 
455 		local = &locals[i];
456 		local->addr = entry->addr;
457 		local->flags = entry->flags;
458 		local->ifindex = entry->ifindex;
459 
460 		is_id0 = local->addr.id == msk->mpc_endpoint_id;
461 
462 		if (c_flag_case &&
463 		    (entry->flags & MPTCP_PM_ADDR_FLAG_SUBFLOW)) {
464 			__clear_bit(local->addr.id, msk->pm.id_avail_bitmap);
465 
466 			if (!is_id0)
467 				msk->pm.local_addr_used++;
468 		}
469 
470 		/* Special case for ID0: set the correct ID */
471 		if (is_id0)
472 			local->addr.id = 0;
473 
474 		msk->pm.extra_subflows++;
475 		i++;
476 
477 		if (msk->pm.extra_subflows >= limit_extra_subflows)
478 			break;
479 	}
480 	rcu_read_unlock();
481 
482 	return i;
483 }
484 
485 static unsigned int
486 fill_local_laminar_endp(struct mptcp_sock *msk, struct mptcp_addr_info *remote,
487 			struct mptcp_pm_local *locals)
488 {
489 	struct pm_nl_pernet *pernet = pm_nl_get_pernet_from_msk(msk);
490 	DECLARE_BITMAP(unavail_id, MPTCP_PM_MAX_ADDR_ID + 1);
491 	struct mptcp_subflow_context *subflow;
492 	struct sock *sk = (struct sock *)msk;
493 	struct mptcp_pm_addr_entry *entry;
494 	struct mptcp_pm_local *local;
495 	int found = 0;
496 
497 	/* Forbid creation of new subflows matching existing ones, possibly
498 	 * already created by 'subflow' endpoints
499 	 */
500 	bitmap_zero(unavail_id, MPTCP_PM_MAX_ADDR_ID + 1);
501 	mptcp_for_each_subflow(msk, subflow) {
502 		struct sock *ssk = mptcp_subflow_tcp_sock(subflow);
503 
504 		if ((1 << inet_sk_state_load(ssk)) &
505 		    (TCPF_FIN_WAIT1 | TCPF_FIN_WAIT2 | TCPF_CLOSING |
506 		     TCPF_CLOSE))
507 			continue;
508 
509 		__set_bit(subflow_get_local_id(subflow), unavail_id);
510 	}
511 
512 	rcu_read_lock();
513 	list_for_each_entry_rcu(entry, &pernet->endp_list, list) {
514 		if (!(entry->flags & MPTCP_PM_ADDR_FLAG_LAMINAR))
515 			continue;
516 
517 		if (!mptcp_pm_addr_families_match(sk, &entry->addr, remote))
518 			continue;
519 
520 		if (test_bit(mptcp_endp_get_local_id(msk, &entry->addr),
521 			     unavail_id))
522 			continue;
523 
524 		local = &locals[0];
525 		local->addr = entry->addr;
526 		local->flags = entry->flags;
527 		local->ifindex = entry->ifindex;
528 
529 		if (entry->flags & MPTCP_PM_ADDR_FLAG_SUBFLOW) {
530 			__clear_bit(local->addr.id, msk->pm.id_avail_bitmap);
531 
532 			if (local->addr.id != msk->mpc_endpoint_id)
533 				msk->pm.local_addr_used++;
534 		}
535 
536 		msk->pm.extra_subflows++;
537 		found = 1;
538 		break;
539 	}
540 	rcu_read_unlock();
541 
542 	return found;
543 }
544 
545 static unsigned int
546 fill_local_addresses_vec_c_flag(struct mptcp_sock *msk,
547 				struct mptcp_addr_info *remote,
548 				struct mptcp_pm_local *locals)
549 {
550 	u8 limit_extra_subflows = mptcp_pm_get_limit_extra_subflows(msk);
551 	struct pm_nl_pernet *pernet = pm_nl_get_pernet_from_msk(msk);
552 	u8 endp_subflow_max = mptcp_pm_get_endp_subflow_max(msk);
553 	struct sock *sk = (struct sock *)msk;
554 	struct mptcp_pm_local *local;
555 	int i = 0;
556 
557 	while (msk->pm.local_addr_used < endp_subflow_max) {
558 		local = &locals[i];
559 
560 		if (!select_local_address(pernet, msk, local))
561 			break;
562 
563 		__clear_bit(local->addr.id, msk->pm.id_avail_bitmap);
564 
565 		if (!mptcp_pm_addr_families_match(sk, &local->addr, remote))
566 			continue;
567 
568 		if (local->addr.id == msk->mpc_endpoint_id)
569 			continue;
570 
571 		msk->pm.local_addr_used++;
572 		msk->pm.extra_subflows++;
573 		i++;
574 
575 		if (msk->pm.extra_subflows >= limit_extra_subflows)
576 			break;
577 	}
578 
579 	return i;
580 }
581 
582 static unsigned int
583 fill_local_address_any(struct mptcp_sock *msk, struct mptcp_addr_info *remote,
584 		       struct mptcp_pm_local *local)
585 {
586 	struct sock *sk = (struct sock *)msk;
587 
588 	memset(local, 0, sizeof(*local));
589 	local->addr.family =
590 #if IS_ENABLED(CONFIG_MPTCP_IPV6)
591 			remote->family == AF_INET6 &&
592 			ipv6_addr_v4mapped(&remote->addr6) ? AF_INET :
593 #endif
594 			remote->family;
595 
596 	if (!mptcp_pm_addr_families_match(sk, &local->addr, remote))
597 		return 0;
598 
599 	msk->pm.extra_subflows++;
600 
601 	return 1;
602 }
603 
604 /* Fill all the local addresses into the array addrs[],
605  * and return the array size.
606  */
607 static unsigned int
608 fill_local_addresses_vec(struct mptcp_sock *msk, struct mptcp_addr_info *remote,
609 			 struct mptcp_pm_local *locals)
610 {
611 	bool c_flag_case = remote->id && mptcp_pm_add_addr_c_flag_case(msk);
612 
613 	/* If there is at least one MPTCP endpoint with a fullmesh flag */
614 	if (mptcp_pm_get_endp_fullmesh_max(msk))
615 		return fill_local_addresses_vec_fullmesh(msk, remote, locals,
616 							 c_flag_case);
617 
618 	/* If there is at least one MPTCP endpoint with a laminar flag */
619 	if (mptcp_pm_get_endp_laminar_max(msk))
620 		return fill_local_laminar_endp(msk, remote, locals);
621 
622 	/* Special case: peer sets the C flag, accept one ADD_ADDR if default
623 	 * limits are used -- accepting no ADD_ADDR -- and use subflow endpoints
624 	 */
625 	if (c_flag_case)
626 		return fill_local_addresses_vec_c_flag(msk, remote, locals);
627 
628 	/* No special case: fill in the single 'IPADDRANY' local address */
629 	return fill_local_address_any(msk, remote, &locals[0]);
630 }
631 
632 static void mptcp_pm_nl_add_addr_received(struct mptcp_sock *msk)
633 {
634 	u8 limit_add_addr_accepted = mptcp_pm_get_limit_add_addr_accepted(msk);
635 	u8 limit_extra_subflows = mptcp_pm_get_limit_extra_subflows(msk);
636 	struct mptcp_pm_local locals[MPTCP_PM_ADDR_MAX];
637 	struct sock *sk = (struct sock *)msk;
638 	struct mptcp_addr_info remote;
639 	bool sf_created = false;
640 	int i, nr;
641 
642 	pr_debug("accepted %d:%d remote family %d\n",
643 		 msk->pm.add_addr_accepted, limit_add_addr_accepted,
644 		 msk->pm.remote.family);
645 
646 	remote = msk->pm.remote;
647 	mptcp_pm_announce_addr(msk, &remote, true);
648 	mptcp_pm_addr_send_ack(msk);
649 	mptcp_mpc_endpoint_setup(msk);
650 
651 	if (lookup_subflow_by_daddr(&msk->conn_list, &remote))
652 		return;
653 
654 	/* pick id 0 port, if none is provided the remote address */
655 	if (!remote.port)
656 		remote.port = sk->sk_dport;
657 
658 	/* connect to the specified remote address, using whatever
659 	 * local address the routing configuration will pick.
660 	 */
661 	nr = fill_local_addresses_vec(msk, &remote, locals);
662 	if (nr == 0)
663 		return;
664 
665 	spin_unlock_bh(&msk->pm.lock);
666 	for (i = 0; i < nr; i++)
667 		if (__mptcp_subflow_connect(sk, &locals[i], &remote) == 0)
668 			sf_created = true;
669 	spin_lock_bh(&msk->pm.lock);
670 
671 	if (sf_created) {
672 		/* add_addr_accepted is not decr for ID 0 */
673 		if (remote.id)
674 			msk->pm.add_addr_accepted++;
675 		if (msk->pm.add_addr_accepted >= limit_add_addr_accepted ||
676 		    msk->pm.extra_subflows >= limit_extra_subflows)
677 			WRITE_ONCE(msk->pm.accept_addr, false);
678 	}
679 }
680 
681 void mptcp_pm_nl_rm_addr(struct mptcp_sock *msk, u8 rm_id)
682 {
683 	if (rm_id && !WARN_ON_ONCE(msk->pm.add_addr_accepted == 0)) {
684 		u8 limit_add_addr_accepted =
685 			mptcp_pm_get_limit_add_addr_accepted(msk);
686 
687 		/* Note: if the subflow has been closed before, this
688 		 * add_addr_accepted counter will not be decremented.
689 		 */
690 		if (--msk->pm.add_addr_accepted < limit_add_addr_accepted)
691 			WRITE_ONCE(msk->pm.accept_addr, true);
692 	}
693 }
694 
695 static bool address_use_port(struct mptcp_pm_addr_entry *entry)
696 {
697 	return (entry->flags &
698 		(MPTCP_PM_ADDR_FLAG_SIGNAL | MPTCP_PM_ADDR_FLAG_SUBFLOW)) ==
699 		MPTCP_PM_ADDR_FLAG_SIGNAL;
700 }
701 
702 /* caller must ensure the RCU grace period is already elapsed */
703 static void __mptcp_pm_release_addr_entry(struct mptcp_pm_addr_entry *entry)
704 {
705 	if (entry->lsk)
706 		sock_release(entry->lsk);
707 	kfree(entry);
708 }
709 
710 static int mptcp_pm_nl_append_new_local_addr(struct pm_nl_pernet *pernet,
711 					     struct mptcp_pm_addr_entry *entry,
712 					     bool needs_id, bool replace)
713 {
714 	struct mptcp_pm_addr_entry *cur, *del_entry = NULL;
715 	int ret = -EINVAL;
716 	u8 addr_max;
717 
718 	spin_lock_bh(&pernet->lock);
719 	/* to keep the code simple, don't do IDR-like allocation for address ID,
720 	 * just bail when we exceed limits
721 	 */
722 	if (pernet->next_id == MPTCP_PM_MAX_ADDR_ID)
723 		pernet->next_id = 1;
724 	if (pernet->endpoints >= MPTCP_PM_ADDR_MAX) {
725 		ret = -ERANGE;
726 		goto out;
727 	}
728 	if (test_bit(entry->addr.id, pernet->id_bitmap)) {
729 		ret = -EBUSY;
730 		goto out;
731 	}
732 
733 	/* do not insert duplicate address, differentiate on port only
734 	 * singled addresses
735 	 */
736 	if (!address_use_port(entry))
737 		entry->addr.port = 0;
738 	list_for_each_entry(cur, &pernet->endp_list, list) {
739 		if (mptcp_addresses_equal(&cur->addr, &entry->addr,
740 					  cur->addr.port || entry->addr.port)) {
741 			/* allow replacing the exiting endpoint only if such
742 			 * endpoint is an implicit one and the user-space
743 			 * did not provide an endpoint id
744 			 */
745 			if (!(cur->flags & MPTCP_PM_ADDR_FLAG_IMPLICIT)) {
746 				ret = -EEXIST;
747 				goto out;
748 			}
749 			if (entry->addr.id)
750 				goto out;
751 
752 			/* allow callers that only need to look up the local
753 			 * addr's id to skip replacement. This allows them to
754 			 * avoid calling synchronize_rcu in the packet recv
755 			 * path.
756 			 */
757 			if (!replace) {
758 				kfree(entry);
759 				ret = cur->addr.id;
760 				goto out;
761 			}
762 
763 			pernet->endpoints--;
764 			entry->addr.id = cur->addr.id;
765 			list_del_rcu(&cur->list);
766 			del_entry = cur;
767 			break;
768 		}
769 	}
770 
771 	if (!entry->addr.id && needs_id) {
772 find_next:
773 		entry->addr.id = find_next_zero_bit(pernet->id_bitmap,
774 						    MPTCP_PM_MAX_ADDR_ID + 1,
775 						    pernet->next_id);
776 		if (!entry->addr.id && pernet->next_id != 1) {
777 			pernet->next_id = 1;
778 			goto find_next;
779 		}
780 	}
781 
782 	if (!entry->addr.id && needs_id)
783 		goto out;
784 
785 	__set_bit(entry->addr.id, pernet->id_bitmap);
786 	if (entry->addr.id > pernet->next_id)
787 		pernet->next_id = entry->addr.id;
788 
789 	if (entry->flags & MPTCP_PM_ADDR_FLAG_SIGNAL) {
790 		addr_max = pernet->endp_signal_max;
791 		WRITE_ONCE(pernet->endp_signal_max, addr_max + 1);
792 	}
793 	if (entry->flags & MPTCP_PM_ADDR_FLAG_SUBFLOW) {
794 		addr_max = pernet->endp_subflow_max;
795 		WRITE_ONCE(pernet->endp_subflow_max, addr_max + 1);
796 	}
797 	if (entry->flags & MPTCP_PM_ADDR_FLAG_LAMINAR) {
798 		addr_max = pernet->endp_laminar_max;
799 		WRITE_ONCE(pernet->endp_laminar_max, addr_max + 1);
800 	}
801 	if (entry->flags & MPTCP_PM_ADDR_FLAG_FULLMESH) {
802 		addr_max = pernet->endp_fullmesh_max;
803 		WRITE_ONCE(pernet->endp_fullmesh_max, addr_max + 1);
804 	}
805 
806 	pernet->endpoints++;
807 	if (!entry->addr.port)
808 		list_add_tail_rcu(&entry->list, &pernet->endp_list);
809 	else
810 		list_add_rcu(&entry->list, &pernet->endp_list);
811 	ret = entry->addr.id;
812 
813 out:
814 	spin_unlock_bh(&pernet->lock);
815 
816 	/* just replaced an existing entry, free it */
817 	if (del_entry) {
818 		synchronize_rcu();
819 		__mptcp_pm_release_addr_entry(del_entry);
820 	}
821 	return ret;
822 }
823 
824 static struct lock_class_key mptcp_slock_keys[2];
825 static struct lock_class_key mptcp_keys[2];
826 
827 static int mptcp_pm_nl_create_listen_socket(struct sock *sk,
828 					    struct mptcp_pm_addr_entry *entry)
829 {
830 	bool is_ipv6 = sk->sk_family == AF_INET6;
831 	int addrlen = sizeof(struct sockaddr_in);
832 	struct sockaddr_storage addr;
833 	struct sock *newsk, *ssk;
834 	int backlog = 1024;
835 	int err;
836 
837 	err = sock_create_kern(sock_net(sk), entry->addr.family,
838 			       SOCK_STREAM, IPPROTO_MPTCP, &entry->lsk);
839 	if (err)
840 		return err;
841 
842 	newsk = entry->lsk->sk;
843 	if (!newsk)
844 		return -EINVAL;
845 
846 	/* The subflow socket lock is acquired in a nested to the msk one
847 	 * in several places, even by the TCP stack, and this msk is a kernel
848 	 * socket: lockdep complains. Instead of propagating the _nested
849 	 * modifiers in several places, re-init the lock class for the msk
850 	 * socket to an mptcp specific one.
851 	 */
852 	sock_lock_init_class_and_name(newsk,
853 				      is_ipv6 ? "mlock-AF_INET6" : "mlock-AF_INET",
854 				      &mptcp_slock_keys[is_ipv6],
855 				      is_ipv6 ? "msk_lock-AF_INET6" : "msk_lock-AF_INET",
856 				      &mptcp_keys[is_ipv6]);
857 
858 	lock_sock(newsk);
859 	ssk = __mptcp_nmpc_sk(mptcp_sk(newsk));
860 	release_sock(newsk);
861 	if (IS_ERR(ssk))
862 		return PTR_ERR(ssk);
863 
864 	mptcp_info2sockaddr(&entry->addr, &addr, entry->addr.family);
865 #if IS_ENABLED(CONFIG_MPTCP_IPV6)
866 	if (entry->addr.family == AF_INET6)
867 		addrlen = sizeof(struct sockaddr_in6);
868 #endif
869 	if (ssk->sk_family == AF_INET)
870 		err = inet_bind_sk(ssk, (struct sockaddr_unsized *)&addr, addrlen);
871 #if IS_ENABLED(CONFIG_MPTCP_IPV6)
872 	else if (ssk->sk_family == AF_INET6)
873 		err = inet6_bind_sk(ssk, (struct sockaddr_unsized *)&addr, addrlen);
874 #endif
875 	if (err)
876 		return err;
877 
878 	/* We don't use mptcp_set_state() here because it needs to be called
879 	 * under the msk socket lock. For the moment, that will not bring
880 	 * anything more than only calling inet_sk_state_store(), because the
881 	 * old status is known (TCP_CLOSE).
882 	 */
883 	inet_sk_state_store(newsk, TCP_LISTEN);
884 	lock_sock(ssk);
885 	WRITE_ONCE(mptcp_subflow_ctx(ssk)->pm_listener, true);
886 	err = __inet_listen_sk(ssk, backlog);
887 	if (!err)
888 		mptcp_event_pm_listener(ssk, MPTCP_EVENT_LISTENER_CREATED);
889 	release_sock(ssk);
890 	return err;
891 }
892 
893 int mptcp_pm_nl_get_local_id(struct mptcp_sock *msk,
894 			     struct mptcp_pm_addr_entry *skc)
895 {
896 	struct mptcp_pm_addr_entry *entry;
897 	struct pm_nl_pernet *pernet;
898 	int ret;
899 
900 	pernet = pm_nl_get_pernet_from_msk(msk);
901 
902 	rcu_read_lock();
903 	entry = __lookup_addr(pernet, &skc->addr);
904 	ret = entry ? entry->addr.id : -1;
905 	rcu_read_unlock();
906 	if (ret >= 0)
907 		return ret;
908 
909 	/* address not found, add to local list */
910 	entry = kmemdup(skc, sizeof(*skc), GFP_ATOMIC);
911 	if (!entry)
912 		return -ENOMEM;
913 
914 	entry->addr.port = 0;
915 	ret = mptcp_pm_nl_append_new_local_addr(pernet, entry, true, false);
916 	if (ret < 0)
917 		kfree(entry);
918 
919 	return ret;
920 }
921 
922 bool mptcp_pm_nl_is_backup(struct mptcp_sock *msk, struct mptcp_addr_info *skc)
923 {
924 	struct pm_nl_pernet *pernet = pm_nl_get_pernet_from_msk(msk);
925 	struct mptcp_pm_addr_entry *entry;
926 	bool backup;
927 
928 	rcu_read_lock();
929 	entry = __lookup_addr(pernet, skc);
930 	backup = entry && !!(entry->flags & MPTCP_PM_ADDR_FLAG_BACKUP);
931 	rcu_read_unlock();
932 
933 	return backup;
934 }
935 
936 static int mptcp_nl_add_subflow_or_signal_addr(struct net *net,
937 					       struct mptcp_addr_info *addr)
938 {
939 	struct mptcp_sock *msk;
940 	long s_slot = 0, s_num = 0;
941 
942 	while ((msk = mptcp_token_iter_next(net, &s_slot, &s_num)) != NULL) {
943 		struct sock *sk = (struct sock *)msk;
944 		struct mptcp_addr_info mpc_addr;
945 
946 		if (!READ_ONCE(msk->fully_established) ||
947 		    mptcp_pm_is_userspace(msk))
948 			goto next;
949 
950 		/* if the endp linked to the init sf is re-added with a != ID */
951 		mptcp_local_address((struct sock_common *)msk, &mpc_addr);
952 
953 		lock_sock(sk);
954 		spin_lock_bh(&msk->pm.lock);
955 		if (mptcp_addresses_equal(addr, &mpc_addr, addr->port))
956 			msk->mpc_endpoint_id = addr->id;
957 		mptcp_pm_create_subflow_or_signal_addr(msk);
958 		spin_unlock_bh(&msk->pm.lock);
959 		release_sock(sk);
960 
961 next:
962 		sock_put(sk);
963 		cond_resched();
964 	}
965 
966 	return 0;
967 }
968 
969 static bool mptcp_pm_has_addr_attr_id(const struct nlattr *attr,
970 				      struct genl_info *info)
971 {
972 	struct nlattr *tb[MPTCP_PM_ADDR_ATTR_MAX + 1];
973 
974 	if (!nla_parse_nested_deprecated(tb, MPTCP_PM_ADDR_ATTR_MAX, attr,
975 					 mptcp_pm_address_nl_policy, info->extack) &&
976 	    tb[MPTCP_PM_ADDR_ATTR_ID])
977 		return true;
978 	return false;
979 }
980 
981 /* Add an MPTCP endpoint */
982 int mptcp_pm_nl_add_addr_doit(struct sk_buff *skb, struct genl_info *info)
983 {
984 	struct pm_nl_pernet *pernet = genl_info_pm_nl(info);
985 	struct mptcp_pm_addr_entry addr, *entry;
986 	struct nlattr *attr;
987 	int ret;
988 
989 	if (GENL_REQ_ATTR_CHECK(info, MPTCP_PM_ENDPOINT_ADDR))
990 		return -EINVAL;
991 
992 	attr = info->attrs[MPTCP_PM_ENDPOINT_ADDR];
993 	ret = mptcp_pm_parse_entry(attr, info, true, &addr);
994 	if (ret < 0)
995 		return ret;
996 
997 	if (addr.addr.port && !address_use_port(&addr)) {
998 		NL_SET_ERR_MSG_ATTR(info->extack, attr,
999 				    "flags must have signal and not subflow when using port");
1000 		return -EINVAL;
1001 	}
1002 
1003 	if (addr.flags & MPTCP_PM_ADDR_FLAG_SIGNAL &&
1004 	    addr.flags & MPTCP_PM_ADDR_FLAG_FULLMESH) {
1005 		NL_SET_ERR_MSG_ATTR(info->extack, attr,
1006 				    "flags mustn't have both signal and fullmesh");
1007 		return -EINVAL;
1008 	}
1009 
1010 	if (addr.flags & MPTCP_PM_ADDR_FLAG_IMPLICIT) {
1011 		NL_SET_ERR_MSG_ATTR(info->extack, attr,
1012 				    "can't create IMPLICIT endpoint");
1013 		return -EINVAL;
1014 	}
1015 
1016 	entry = kmemdup(&addr, sizeof(addr), GFP_KERNEL_ACCOUNT);
1017 	if (!entry) {
1018 		GENL_SET_ERR_MSG(info, "can't allocate addr");
1019 		return -ENOMEM;
1020 	}
1021 
1022 	if (entry->addr.port) {
1023 		ret = mptcp_pm_nl_create_listen_socket(skb->sk, entry);
1024 		if (ret) {
1025 			GENL_SET_ERR_MSG_FMT(info, "create listen socket error: %d", ret);
1026 			goto out_free;
1027 		}
1028 	}
1029 	ret = mptcp_pm_nl_append_new_local_addr(pernet, entry,
1030 						!mptcp_pm_has_addr_attr_id(attr, info),
1031 						true);
1032 	if (ret < 0) {
1033 		GENL_SET_ERR_MSG_FMT(info, "too many addresses or duplicate one: %d", ret);
1034 		goto out_free;
1035 	}
1036 
1037 	mptcp_nl_add_subflow_or_signal_addr(sock_net(skb->sk), &entry->addr);
1038 	return 0;
1039 
1040 out_free:
1041 	__mptcp_pm_release_addr_entry(entry);
1042 	return ret;
1043 }
1044 
1045 static bool mptcp_pm_remove_anno_addr(struct mptcp_sock *msk,
1046 				      const struct mptcp_addr_info *addr,
1047 				      bool force)
1048 {
1049 	struct mptcp_rm_list list = { .nr = 0 };
1050 	bool ret;
1051 
1052 	list.ids[list.nr++] = mptcp_endp_get_local_id(msk, addr);
1053 
1054 	ret = mptcp_remove_anno_list_by_saddr(msk, addr);
1055 	if (ret || force) {
1056 		spin_lock_bh(&msk->pm.lock);
1057 		if (ret) {
1058 			__set_bit(addr->id, msk->pm.id_avail_bitmap);
1059 			msk->pm.add_addr_signaled--;
1060 		}
1061 		mptcp_pm_remove_addr(msk, &list);
1062 		spin_unlock_bh(&msk->pm.lock);
1063 	}
1064 	return ret;
1065 }
1066 
1067 static void __mark_subflow_endp_available(struct mptcp_sock *msk, u8 id)
1068 {
1069 	/* If it was marked as used, and not ID 0, decrement local_addr_used */
1070 	if (!__test_and_set_bit(id ? : msk->mpc_endpoint_id, msk->pm.id_avail_bitmap) &&
1071 	    id && !WARN_ON_ONCE(msk->pm.local_addr_used == 0))
1072 		msk->pm.local_addr_used--;
1073 }
1074 
1075 static int mptcp_nl_remove_subflow_and_signal_addr(struct net *net,
1076 						   const struct mptcp_pm_addr_entry *entry)
1077 {
1078 	const struct mptcp_addr_info *addr = &entry->addr;
1079 	struct mptcp_rm_list list = { .nr = 1 };
1080 	long s_slot = 0, s_num = 0;
1081 	struct mptcp_sock *msk;
1082 
1083 	pr_debug("remove_id=%d\n", addr->id);
1084 
1085 	while ((msk = mptcp_token_iter_next(net, &s_slot, &s_num)) != NULL) {
1086 		struct sock *sk = (struct sock *)msk;
1087 		bool remove_subflow;
1088 
1089 		if (mptcp_pm_is_userspace(msk))
1090 			goto next;
1091 
1092 		lock_sock(sk);
1093 		remove_subflow = mptcp_lookup_subflow_by_saddr(&msk->conn_list, addr);
1094 		mptcp_pm_remove_anno_addr(msk, addr, remove_subflow &&
1095 					  !(entry->flags & MPTCP_PM_ADDR_FLAG_IMPLICIT));
1096 
1097 		list.ids[0] = mptcp_endp_get_local_id(msk, addr);
1098 		if (remove_subflow) {
1099 			spin_lock_bh(&msk->pm.lock);
1100 			mptcp_pm_rm_subflow(msk, &list);
1101 			spin_unlock_bh(&msk->pm.lock);
1102 		}
1103 
1104 		if (entry->flags & MPTCP_PM_ADDR_FLAG_SUBFLOW) {
1105 			spin_lock_bh(&msk->pm.lock);
1106 			__mark_subflow_endp_available(msk, list.ids[0]);
1107 			spin_unlock_bh(&msk->pm.lock);
1108 		}
1109 
1110 		if (msk->mpc_endpoint_id == entry->addr.id)
1111 			msk->mpc_endpoint_id = 0;
1112 		release_sock(sk);
1113 
1114 next:
1115 		sock_put(sk);
1116 		cond_resched();
1117 	}
1118 
1119 	return 0;
1120 }
1121 
1122 static int mptcp_nl_remove_id_zero_address(struct net *net,
1123 					   struct mptcp_addr_info *addr)
1124 {
1125 	struct mptcp_rm_list list = { .nr = 0 };
1126 	long s_slot = 0, s_num = 0;
1127 	struct mptcp_sock *msk;
1128 
1129 	list.ids[list.nr++] = 0;
1130 
1131 	while ((msk = mptcp_token_iter_next(net, &s_slot, &s_num)) != NULL) {
1132 		struct sock *sk = (struct sock *)msk;
1133 		struct mptcp_addr_info msk_local;
1134 
1135 		if (list_empty(&msk->conn_list) || mptcp_pm_is_userspace(msk))
1136 			goto next;
1137 
1138 		mptcp_local_address((struct sock_common *)msk, &msk_local);
1139 		if (!mptcp_addresses_equal(&msk_local, addr, addr->port))
1140 			goto next;
1141 
1142 		lock_sock(sk);
1143 		spin_lock_bh(&msk->pm.lock);
1144 		mptcp_pm_remove_addr(msk, &list);
1145 		mptcp_pm_rm_subflow(msk, &list);
1146 		__mark_subflow_endp_available(msk, 0);
1147 		spin_unlock_bh(&msk->pm.lock);
1148 		release_sock(sk);
1149 
1150 next:
1151 		sock_put(sk);
1152 		cond_resched();
1153 	}
1154 
1155 	return 0;
1156 }
1157 
1158 /* Remove an MPTCP endpoint */
1159 int mptcp_pm_nl_del_addr_doit(struct sk_buff *skb, struct genl_info *info)
1160 {
1161 	struct pm_nl_pernet *pernet = genl_info_pm_nl(info);
1162 	struct mptcp_pm_addr_entry addr, *entry;
1163 	struct nlattr *attr;
1164 	u8 addr_max;
1165 	int ret;
1166 
1167 	if (GENL_REQ_ATTR_CHECK(info, MPTCP_PM_ENDPOINT_ADDR))
1168 		return -EINVAL;
1169 
1170 	attr = info->attrs[MPTCP_PM_ENDPOINT_ADDR];
1171 	ret = mptcp_pm_parse_entry(attr, info, false, &addr);
1172 	if (ret < 0)
1173 		return ret;
1174 
1175 	/* the zero id address is special: the first address used by the msk
1176 	 * always gets such an id, so different subflows can have different zero
1177 	 * id addresses. Additionally zero id is not accounted for in id_bitmap.
1178 	 * Let's use an 'mptcp_rm_list' instead of the common remove code.
1179 	 */
1180 	if (addr.addr.id == 0)
1181 		return mptcp_nl_remove_id_zero_address(sock_net(skb->sk), &addr.addr);
1182 
1183 	spin_lock_bh(&pernet->lock);
1184 	entry = __lookup_addr_by_id(pernet, addr.addr.id);
1185 	if (!entry) {
1186 		NL_SET_ERR_MSG_ATTR(info->extack, attr, "address not found");
1187 		spin_unlock_bh(&pernet->lock);
1188 		return -EINVAL;
1189 	}
1190 	if (entry->flags & MPTCP_PM_ADDR_FLAG_SIGNAL) {
1191 		addr_max = pernet->endp_signal_max;
1192 		WRITE_ONCE(pernet->endp_signal_max, addr_max - 1);
1193 	}
1194 	if (entry->flags & MPTCP_PM_ADDR_FLAG_SUBFLOW) {
1195 		addr_max = pernet->endp_subflow_max;
1196 		WRITE_ONCE(pernet->endp_subflow_max, addr_max - 1);
1197 	}
1198 	if (entry->flags & MPTCP_PM_ADDR_FLAG_LAMINAR) {
1199 		addr_max = pernet->endp_laminar_max;
1200 		WRITE_ONCE(pernet->endp_laminar_max, addr_max - 1);
1201 	}
1202 	if (entry->flags & MPTCP_PM_ADDR_FLAG_FULLMESH) {
1203 		addr_max = pernet->endp_fullmesh_max;
1204 		WRITE_ONCE(pernet->endp_fullmesh_max, addr_max - 1);
1205 	}
1206 
1207 	pernet->endpoints--;
1208 	list_del_rcu(&entry->list);
1209 	__clear_bit(entry->addr.id, pernet->id_bitmap);
1210 	spin_unlock_bh(&pernet->lock);
1211 
1212 	mptcp_nl_remove_subflow_and_signal_addr(sock_net(skb->sk), entry);
1213 	synchronize_rcu();
1214 	__mptcp_pm_release_addr_entry(entry);
1215 
1216 	return ret;
1217 }
1218 
1219 static void mptcp_pm_flush_addrs_and_subflows(struct mptcp_sock *msk,
1220 					      struct list_head *rm_list)
1221 {
1222 	struct mptcp_rm_list alist = { .nr = 0 }, slist = { .nr = 0 };
1223 	struct mptcp_pm_addr_entry *entry;
1224 
1225 	list_for_each_entry(entry, rm_list, list) {
1226 		if (slist.nr < MPTCP_RM_IDS_MAX &&
1227 		    mptcp_lookup_subflow_by_saddr(&msk->conn_list, &entry->addr))
1228 			slist.ids[slist.nr++] = mptcp_endp_get_local_id(msk, &entry->addr);
1229 
1230 		if (alist.nr < MPTCP_RM_IDS_MAX &&
1231 		    mptcp_remove_anno_list_by_saddr(msk, &entry->addr))
1232 			alist.ids[alist.nr++] = mptcp_endp_get_local_id(msk, &entry->addr);
1233 	}
1234 
1235 	spin_lock_bh(&msk->pm.lock);
1236 	if (alist.nr) {
1237 		msk->pm.add_addr_signaled -= alist.nr;
1238 		mptcp_pm_remove_addr(msk, &alist);
1239 	}
1240 	if (slist.nr)
1241 		mptcp_pm_rm_subflow(msk, &slist);
1242 	/* Reset counters: maybe some subflows have been removed before */
1243 	bitmap_fill(msk->pm.id_avail_bitmap, MPTCP_PM_MAX_ADDR_ID + 1);
1244 	msk->pm.local_addr_used = 0;
1245 	spin_unlock_bh(&msk->pm.lock);
1246 }
1247 
1248 static void mptcp_nl_flush_addrs_list(struct net *net,
1249 				      struct list_head *rm_list)
1250 {
1251 	long s_slot = 0, s_num = 0;
1252 	struct mptcp_sock *msk;
1253 
1254 	if (list_empty(rm_list))
1255 		return;
1256 
1257 	while ((msk = mptcp_token_iter_next(net, &s_slot, &s_num)) != NULL) {
1258 		struct sock *sk = (struct sock *)msk;
1259 
1260 		if (!mptcp_pm_is_userspace(msk)) {
1261 			lock_sock(sk);
1262 			mptcp_pm_flush_addrs_and_subflows(msk, rm_list);
1263 			release_sock(sk);
1264 		}
1265 
1266 		sock_put(sk);
1267 		cond_resched();
1268 	}
1269 }
1270 
1271 /* caller must ensure the RCU grace period is already elapsed */
1272 static void __flush_addrs(struct list_head *list)
1273 {
1274 	while (!list_empty(list)) {
1275 		struct mptcp_pm_addr_entry *cur;
1276 
1277 		cur = list_entry(list->next,
1278 				 struct mptcp_pm_addr_entry, list);
1279 		list_del_rcu(&cur->list);
1280 		__mptcp_pm_release_addr_entry(cur);
1281 	}
1282 }
1283 
1284 static void __reset_counters(struct pm_nl_pernet *pernet)
1285 {
1286 	WRITE_ONCE(pernet->endp_signal_max, 0);
1287 	WRITE_ONCE(pernet->endp_subflow_max, 0);
1288 	WRITE_ONCE(pernet->endp_laminar_max, 0);
1289 	pernet->endpoints = 0;
1290 }
1291 
1292 int mptcp_pm_nl_flush_addrs_doit(struct sk_buff *skb, struct genl_info *info)
1293 {
1294 	struct pm_nl_pernet *pernet = genl_info_pm_nl(info);
1295 	LIST_HEAD(free_list);
1296 
1297 	spin_lock_bh(&pernet->lock);
1298 	list_splice_init(&pernet->endp_list, &free_list);
1299 	__reset_counters(pernet);
1300 	pernet->next_id = 1;
1301 	bitmap_zero(pernet->id_bitmap, MPTCP_PM_MAX_ADDR_ID + 1);
1302 	spin_unlock_bh(&pernet->lock);
1303 	mptcp_nl_flush_addrs_list(sock_net(skb->sk), &free_list);
1304 	synchronize_rcu();
1305 	__flush_addrs(&free_list);
1306 	return 0;
1307 }
1308 
1309 int mptcp_pm_nl_get_addr(u8 id, struct mptcp_pm_addr_entry *addr,
1310 			 struct genl_info *info)
1311 {
1312 	struct pm_nl_pernet *pernet = genl_info_pm_nl(info);
1313 	struct mptcp_pm_addr_entry *entry;
1314 	int ret = -EINVAL;
1315 
1316 	rcu_read_lock();
1317 	entry = __lookup_addr_by_id(pernet, id);
1318 	if (entry) {
1319 		*addr = *entry;
1320 		ret = 0;
1321 	}
1322 	rcu_read_unlock();
1323 
1324 	return ret;
1325 }
1326 
1327 int mptcp_pm_nl_dump_addr(struct sk_buff *msg,
1328 			  struct netlink_callback *cb)
1329 {
1330 	struct net *net = sock_net(msg->sk);
1331 	struct mptcp_pm_addr_entry *entry;
1332 	struct pm_nl_pernet *pernet;
1333 	int id = cb->args[0];
1334 	int i;
1335 
1336 	pernet = pm_nl_get_pernet(net);
1337 
1338 	rcu_read_lock();
1339 	for (i = id; i < MPTCP_PM_MAX_ADDR_ID + 1; i++) {
1340 		if (test_bit(i, pernet->id_bitmap)) {
1341 			entry = __lookup_addr_by_id(pernet, i);
1342 			if (!entry)
1343 				break;
1344 
1345 			if (entry->addr.id <= id)
1346 				continue;
1347 
1348 			if (mptcp_pm_genl_fill_addr(msg, cb, entry) < 0)
1349 				break;
1350 
1351 			id = entry->addr.id;
1352 		}
1353 	}
1354 	rcu_read_unlock();
1355 
1356 	cb->args[0] = id;
1357 	return msg->len;
1358 }
1359 
1360 static int parse_limit(struct genl_info *info, int id, unsigned int *limit)
1361 {
1362 	struct nlattr *attr = info->attrs[id];
1363 
1364 	if (!attr)
1365 		return 0;
1366 
1367 	*limit = nla_get_u32(attr);
1368 	if (*limit > MPTCP_PM_ADDR_MAX) {
1369 		NL_SET_ERR_MSG_ATTR_FMT(info->extack, attr,
1370 					"limit greater than maximum (%u)",
1371 					MPTCP_PM_ADDR_MAX);
1372 		return -EINVAL;
1373 	}
1374 	return 0;
1375 }
1376 
1377 int mptcp_pm_nl_set_limits_doit(struct sk_buff *skb, struct genl_info *info)
1378 {
1379 	struct pm_nl_pernet *pernet = genl_info_pm_nl(info);
1380 	unsigned int rcv_addrs, subflows;
1381 	int ret;
1382 
1383 	spin_lock_bh(&pernet->lock);
1384 	rcv_addrs = pernet->limit_add_addr_accepted;
1385 	ret = parse_limit(info, MPTCP_PM_ATTR_RCV_ADD_ADDRS, &rcv_addrs);
1386 	if (ret)
1387 		goto unlock;
1388 
1389 	subflows = pernet->limit_extra_subflows;
1390 	ret = parse_limit(info, MPTCP_PM_ATTR_SUBFLOWS, &subflows);
1391 	if (ret)
1392 		goto unlock;
1393 
1394 	WRITE_ONCE(pernet->limit_add_addr_accepted, rcv_addrs);
1395 	WRITE_ONCE(pernet->limit_extra_subflows, subflows);
1396 
1397 unlock:
1398 	spin_unlock_bh(&pernet->lock);
1399 	return ret;
1400 }
1401 
1402 int mptcp_pm_nl_get_limits_doit(struct sk_buff *skb, struct genl_info *info)
1403 {
1404 	struct pm_nl_pernet *pernet = genl_info_pm_nl(info);
1405 	struct sk_buff *msg;
1406 	void *reply;
1407 
1408 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
1409 	if (!msg)
1410 		return -ENOMEM;
1411 
1412 	reply = genlmsg_put_reply(msg, info, &mptcp_genl_family, 0,
1413 				  MPTCP_PM_CMD_GET_LIMITS);
1414 	if (!reply)
1415 		goto fail;
1416 
1417 	if (nla_put_u32(msg, MPTCP_PM_ATTR_RCV_ADD_ADDRS,
1418 			READ_ONCE(pernet->limit_add_addr_accepted)))
1419 		goto fail;
1420 
1421 	if (nla_put_u32(msg, MPTCP_PM_ATTR_SUBFLOWS,
1422 			READ_ONCE(pernet->limit_extra_subflows)))
1423 		goto fail;
1424 
1425 	genlmsg_end(msg, reply);
1426 	return genlmsg_reply(msg, info);
1427 
1428 fail:
1429 	GENL_SET_ERR_MSG(info, "not enough space in Netlink message");
1430 	nlmsg_free(msg);
1431 	return -EMSGSIZE;
1432 }
1433 
1434 static void mptcp_pm_nl_fullmesh(struct mptcp_sock *msk,
1435 				 struct mptcp_addr_info *addr)
1436 {
1437 	struct mptcp_rm_list list = { .nr = 0 };
1438 
1439 	list.ids[list.nr++] = mptcp_endp_get_local_id(msk, addr);
1440 
1441 	spin_lock_bh(&msk->pm.lock);
1442 	mptcp_pm_rm_subflow(msk, &list);
1443 	__mark_subflow_endp_available(msk, list.ids[0]);
1444 	mptcp_pm_create_subflow_or_signal_addr(msk);
1445 	spin_unlock_bh(&msk->pm.lock);
1446 }
1447 
1448 static void mptcp_pm_nl_set_flags_all(struct net *net,
1449 				      struct mptcp_pm_addr_entry *local,
1450 				      u8 changed)
1451 {
1452 	u8 is_subflow = !!(local->flags & MPTCP_PM_ADDR_FLAG_SUBFLOW);
1453 	u8 bkup = !!(local->flags & MPTCP_PM_ADDR_FLAG_BACKUP);
1454 	long s_slot = 0, s_num = 0;
1455 	struct mptcp_sock *msk;
1456 
1457 	if (changed == MPTCP_PM_ADDR_FLAG_FULLMESH && !is_subflow)
1458 		return;
1459 
1460 	while ((msk = mptcp_token_iter_next(net, &s_slot, &s_num)) != NULL) {
1461 		struct sock *sk = (struct sock *)msk;
1462 
1463 		if (list_empty(&msk->conn_list) || mptcp_pm_is_userspace(msk))
1464 			goto next;
1465 
1466 		lock_sock(sk);
1467 		if (changed & MPTCP_PM_ADDR_FLAG_BACKUP)
1468 			mptcp_pm_mp_prio_send_ack(msk, &local->addr, NULL, bkup);
1469 		/* Subflows will only be recreated if the SUBFLOW flag is set */
1470 		if (is_subflow && (changed & MPTCP_PM_ADDR_FLAG_FULLMESH))
1471 			mptcp_pm_nl_fullmesh(msk, &local->addr);
1472 		release_sock(sk);
1473 
1474 next:
1475 		sock_put(sk);
1476 		cond_resched();
1477 	}
1478 }
1479 
1480 int mptcp_pm_nl_set_flags(struct mptcp_pm_addr_entry *local,
1481 			  struct genl_info *info)
1482 {
1483 	struct nlattr *attr = info->attrs[MPTCP_PM_ATTR_ADDR];
1484 	u8 changed, mask = MPTCP_PM_ADDR_FLAG_BACKUP |
1485 			   MPTCP_PM_ADDR_FLAG_FULLMESH;
1486 	struct net *net = genl_info_net(info);
1487 	struct mptcp_pm_addr_entry *entry;
1488 	struct pm_nl_pernet *pernet;
1489 	u8 lookup_by_id = 0;
1490 
1491 	pernet = pm_nl_get_pernet(net);
1492 
1493 	if (local->addr.family == AF_UNSPEC) {
1494 		lookup_by_id = 1;
1495 		if (!local->addr.id) {
1496 			NL_SET_ERR_MSG_ATTR(info->extack, attr,
1497 					    "missing address ID");
1498 			return -EOPNOTSUPP;
1499 		}
1500 	}
1501 
1502 	spin_lock_bh(&pernet->lock);
1503 	entry = lookup_by_id ? __lookup_addr_by_id(pernet, local->addr.id) :
1504 			       __lookup_addr(pernet, &local->addr);
1505 	if (!entry) {
1506 		spin_unlock_bh(&pernet->lock);
1507 		NL_SET_ERR_MSG_ATTR(info->extack, attr, "address not found");
1508 		return -EINVAL;
1509 	}
1510 	if ((local->flags & MPTCP_PM_ADDR_FLAG_FULLMESH) &&
1511 	    (entry->flags & (MPTCP_PM_ADDR_FLAG_SIGNAL |
1512 			     MPTCP_PM_ADDR_FLAG_IMPLICIT))) {
1513 		spin_unlock_bh(&pernet->lock);
1514 		NL_SET_ERR_MSG_ATTR(info->extack, attr, "invalid addr flags");
1515 		return -EINVAL;
1516 	}
1517 
1518 	changed = (local->flags ^ entry->flags) & mask;
1519 	entry->flags = (entry->flags & ~mask) | (local->flags & mask);
1520 	*local = *entry;
1521 
1522 	if (changed & MPTCP_PM_ADDR_FLAG_FULLMESH) {
1523 		u8 addr_max = pernet->endp_fullmesh_max;
1524 
1525 		if (entry->flags & MPTCP_PM_ADDR_FLAG_FULLMESH)
1526 			addr_max++;
1527 		else
1528 			addr_max--;
1529 
1530 		WRITE_ONCE(pernet->endp_fullmesh_max, addr_max);
1531 	}
1532 
1533 	spin_unlock_bh(&pernet->lock);
1534 
1535 	mptcp_pm_nl_set_flags_all(net, local, changed);
1536 	return 0;
1537 }
1538 
1539 bool mptcp_pm_nl_check_work_pending(struct mptcp_sock *msk)
1540 {
1541 	struct pm_nl_pernet *pernet = pm_nl_get_pernet_from_msk(msk);
1542 
1543 	if (msk->pm.extra_subflows == mptcp_pm_get_limit_extra_subflows(msk) ||
1544 	    (find_next_and_bit(pernet->id_bitmap, msk->pm.id_avail_bitmap,
1545 			       MPTCP_PM_MAX_ADDR_ID + 1, 0) == MPTCP_PM_MAX_ADDR_ID + 1)) {
1546 		WRITE_ONCE(msk->pm.work_pending, false);
1547 		return false;
1548 	}
1549 	return true;
1550 }
1551 
1552 /* Called under PM lock */
1553 void __mptcp_pm_kernel_worker(struct mptcp_sock *msk)
1554 {
1555 	struct mptcp_pm_data *pm = &msk->pm;
1556 
1557 	if (pm->status & BIT(MPTCP_PM_ADD_ADDR_RECEIVED)) {
1558 		pm->status &= ~BIT(MPTCP_PM_ADD_ADDR_RECEIVED);
1559 		mptcp_pm_nl_add_addr_received(msk);
1560 	}
1561 	if (pm->status & BIT(MPTCP_PM_ESTABLISHED)) {
1562 		pm->status &= ~BIT(MPTCP_PM_ESTABLISHED);
1563 		mptcp_pm_nl_fully_established(msk);
1564 	}
1565 	if (pm->status & BIT(MPTCP_PM_SUBFLOW_ESTABLISHED)) {
1566 		pm->status &= ~BIT(MPTCP_PM_SUBFLOW_ESTABLISHED);
1567 		mptcp_pm_nl_subflow_established(msk);
1568 	}
1569 }
1570 
1571 static int __net_init pm_nl_init_net(struct net *net)
1572 {
1573 	struct pm_nl_pernet *pernet = pm_nl_get_pernet(net);
1574 
1575 	INIT_LIST_HEAD_RCU(&pernet->endp_list);
1576 
1577 	/* Cit. 2 subflows ought to be enough for anybody. */
1578 	pernet->limit_extra_subflows = 2;
1579 	pernet->next_id = 1;
1580 	spin_lock_init(&pernet->lock);
1581 
1582 	/* No need to initialize other pernet fields, the struct is zeroed at
1583 	 * allocation time.
1584 	 */
1585 
1586 	return 0;
1587 }
1588 
1589 static void __net_exit pm_nl_exit_net(struct list_head *net_list)
1590 {
1591 	struct net *net;
1592 
1593 	list_for_each_entry(net, net_list, exit_list) {
1594 		struct pm_nl_pernet *pernet = pm_nl_get_pernet(net);
1595 
1596 		/* net is removed from namespace list, can't race with
1597 		 * other modifiers, also netns core already waited for a
1598 		 * RCU grace period.
1599 		 */
1600 		__flush_addrs(&pernet->endp_list);
1601 	}
1602 }
1603 
1604 static struct pernet_operations mptcp_pm_pernet_ops = {
1605 	.init = pm_nl_init_net,
1606 	.exit_batch = pm_nl_exit_net,
1607 	.id = &pm_nl_pernet_id,
1608 	.size = sizeof(struct pm_nl_pernet),
1609 };
1610 
1611 struct mptcp_pm_ops mptcp_pm_kernel = {
1612 	.name			= "kernel",
1613 	.owner			= THIS_MODULE,
1614 };
1615 
1616 void __init mptcp_pm_kernel_register(void)
1617 {
1618 	if (register_pernet_subsys(&mptcp_pm_pernet_ops) < 0)
1619 		panic("Failed to register MPTCP PM pernet subsystem.\n");
1620 
1621 	mptcp_pm_register(&mptcp_pm_kernel);
1622 }
1623