1	// SPDX-License-Identifier: GPL-2.0-only
2	/*
3	* VMware vSockets Driver
4	*
5	* Copyright (C) 2007-2013 VMware, Inc. All rights reserved.
6	*/
7
8	/* Implementation notes:
9	*
10	* - There are two kinds of sockets: those created by user action (such as
11	* calling socket(2)) and those created by incoming connection request packets.
12	*
13	* - There are two "global" tables, one for bound sockets (sockets that have
14	* specified an address that they are responsible for) and one for connected
15	* sockets (sockets that have established a connection with another socket).
16	* These tables are "global" in that all sockets on the system are placed
17	* within them. - Note, though, that the bound table contains an extra entry
18	* for a list of unbound sockets and SOCK_DGRAM sockets will always remain in
19	* that list. The bound table is used solely for lookup of sockets when packets
20	* are received and that's not necessary for SOCK_DGRAM sockets since we create
21	* a datagram handle for each and need not perform a lookup. Keeping SOCK_DGRAM
22	* sockets out of the bound hash buckets will reduce the chance of collisions
23	* when looking for SOCK_STREAM sockets and prevents us from having to check the
24	* socket type in the hash table lookups.
25	*
26	* - Sockets created by user action will either be "client" sockets that
27	* initiate a connection or "server" sockets that listen for connections; we do
28	* not support simultaneous connects (two "client" sockets connecting).
29	*
30	* - "Server" sockets are referred to as listener sockets throughout this
31	* implementation because they are in the TCP_LISTEN state. When a
32	* connection request is received (the second kind of socket mentioned above),
33	* we create a new socket and refer to it as a pending socket. These pending
34	* sockets are placed on the pending connection list of the listener socket.
35	* When future packets are received for the address the listener socket is
36	* bound to, we check if the source of the packet is from one that has an
37	* existing pending connection. If it does, we process the packet for the
38	* pending socket. When that socket reaches the connected state, it is removed
39	* from the listener socket's pending list and enqueued in the listener
40	* socket's accept queue. Callers of accept(2) will accept connected sockets
41	* from the listener socket's accept queue. If the socket cannot be accepted
42	* for some reason then it is marked rejected. Once the connection is
43	* accepted, it is owned by the user process and the responsibility for cleanup
44	* falls with that user process.
45	*
46	* - It is possible that these pending sockets will never reach the connected
47	* state; in fact, we may never receive another packet after the connection
48	* request. Because of this, we must schedule a cleanup function to run in the
49	* future, after some amount of time passes where a connection should have been
50	* established. This function ensures that the socket is off all lists so it
51	* cannot be retrieved, then drops all references to the socket so it is cleaned
52	* up (sock_put() -> sk_free() -> our sk_destruct implementation). Note this
53	* function will also cleanup rejected sockets, those that reach the connected
54	* state but leave it before they have been accepted.
55	*
56	* - Lock ordering for pending or accept queue sockets is:
57	*
58	* lock_sock(listener);
59	* lock_sock_nested(pending, SINGLE_DEPTH_NESTING);
60	*
61	* Using explicit nested locking keeps lockdep happy since normally only one
62	* lock of a given class may be taken at a time.
63	*
64	* - Sockets created by user action will be cleaned up when the user process
65	* calls close(2), causing our release implementation to be called. Our release
66	* implementation will perform some cleanup then drop the last reference so our
67	* sk_destruct implementation is invoked. Our sk_destruct implementation will
68	* perform additional cleanup that's common for both types of sockets.
69	*
70	* - A socket's reference count is what ensures that the structure won't be
71	* freed. Each entry in a list (such as the "global" bound and connected tables
72	* and the listener socket's pending list and connected queue) ensures a
73	* reference. When we defer work until process context and pass a socket as our
74	* argument, we must ensure the reference count is increased to ensure the
75	* socket isn't freed before the function is run; the deferred function will
76	* then drop the reference.
77	*
78	* - sk->sk_state uses the TCP state constants because they are widely used by
79	* other address families and exposed to userspace tools like ss(8):
80	*
81	* TCP_CLOSE - unconnected
82	* TCP_SYN_SENT - connecting
83	* TCP_ESTABLISHED - connected
84	* TCP_CLOSING - disconnecting
85	* TCP_LISTEN - listening
86	*/
87
88	#include <linux/compat.h>
89	#include <linux/types.h>
90	#include <linux/bitops.h>
91	#include <linux/cred.h>
92	#include <linux/errqueue.h>
93	#include <linux/init.h>
94	#include <linux/io.h>
95	#include <linux/kernel.h>
96	#include <linux/sched/signal.h>
97	#include <linux/kmod.h>
98	#include <linux/list.h>
99	#include <linux/miscdevice.h>
100	#include <linux/module.h>
101	#include <linux/mutex.h>
102	#include <linux/net.h>
103	#include <linux/poll.h>
104	#include <linux/random.h>
105	#include <linux/skbuff.h>
106	#include <linux/smp.h>
107	#include <linux/socket.h>
108	#include <linux/stddef.h>
109	#include <linux/unistd.h>
110	#include <linux/wait.h>
111	#include <linux/workqueue.h>
112	#include <net/sock.h>
113	#include <net/af_vsock.h>
114	#include <uapi/linux/vm_sockets.h>
115	#include <uapi/asm-generic/ioctls.h>
116
117	static int __vsock_bind(struct sock *sk, struct sockaddr_vm *addr);
118	static void vsock_sk_destruct(struct sock *sk);
119	static int vsock_queue_rcv_skb(struct sock *sk, struct sk_buff *skb);
120	static void vsock_close(struct sock *sk, long timeout);
121
122	/* Protocol family. */
123	struct proto vsock_proto = {
124	.name = "AF_VSOCK",
125	.owner = THIS_MODULE,
126	.obj_size = sizeof(struct vsock_sock),
127	.close = vsock_close,
128	#ifdef CONFIG_BPF_SYSCALL
129	.psock_update_sk_prot = vsock_bpf_update_proto,
130	#endif
131	};
132
133	/* The default peer timeout indicates how long we will wait for a peer response
134	* to a control message.
135	*/
136	#define VSOCK_DEFAULT_CONNECT_TIMEOUT (2 * HZ)
137
138	#define VSOCK_DEFAULT_BUFFER_SIZE (1024 * 256)
139	#define VSOCK_DEFAULT_BUFFER_MAX_SIZE (1024 * 256)
140	#define VSOCK_DEFAULT_BUFFER_MIN_SIZE 128
141
142	/* Transport used for host->guest communication */
143	static const struct vsock_transport *transport_h2g;
144	/* Transport used for guest->host communication */
145	static const struct vsock_transport *transport_g2h;
146	/* Transport used for DGRAM communication */
147	static const struct vsock_transport *transport_dgram;
148	/* Transport used for local communication */
149	static const struct vsock_transport *transport_local;
150	static DEFINE_MUTEX(vsock_register_mutex);
151
152	/**** UTILS ****/
153
154	/* Each bound VSocket is stored in the bind hash table and each connected
155	* VSocket is stored in the connected hash table.
156	*
157	* Unbound sockets are all put on the same list attached to the end of the hash
158	* table (vsock_unbound_sockets). Bound sockets are added to the hash table in
159	* the bucket that their local address hashes to (vsock_bound_sockets(addr)
160	* represents the list that addr hashes to).
161	*
162	* Specifically, we initialize the vsock_bind_table array to a size of
163	* VSOCK_HASH_SIZE + 1 so that vsock_bind_table[0] through
164	* vsock_bind_table[VSOCK_HASH_SIZE - 1] are for bound sockets and
165	* vsock_bind_table[VSOCK_HASH_SIZE] is for unbound sockets. The hash function
166	* mods with VSOCK_HASH_SIZE to ensure this.
167	*/
168	#define MAX_PORT_RETRIES 24
169
170	#define VSOCK_HASH(addr) ((addr)->svm_port % VSOCK_HASH_SIZE)
171	#define vsock_bound_sockets(addr) (&vsock_bind_table[VSOCK_HASH(addr)])
172	#define vsock_unbound_sockets (&vsock_bind_table[VSOCK_HASH_SIZE])
173
174	/* XXX This can probably be implemented in a better way. */
175	#define VSOCK_CONN_HASH(src, dst) \
176	(((src)->svm_cid ^ (dst)->svm_port) % VSOCK_HASH_SIZE)
177	#define vsock_connected_sockets(src, dst) \
178	(&vsock_connected_table[VSOCK_CONN_HASH(src, dst)])
179	#define vsock_connected_sockets_vsk(vsk) \
180	vsock_connected_sockets(&(vsk)->remote_addr, &(vsk)->local_addr)
181
182	struct list_head vsock_bind_table[VSOCK_HASH_SIZE + 1];
183	EXPORT_SYMBOL_GPL(vsock_bind_table);
184	struct list_head vsock_connected_table[VSOCK_HASH_SIZE];
185	EXPORT_SYMBOL_GPL(vsock_connected_table);
186	DEFINE_SPINLOCK(vsock_table_lock);
187	EXPORT_SYMBOL_GPL(vsock_table_lock);
188
189	/* Autobind this socket to the local address if necessary. */
190	static int vsock_auto_bind(struct vsock_sock *vsk)
191	{
192	struct sock *sk = sk_vsock(vsk);
193	struct sockaddr_vm local_addr;
194
195	if (vsock_addr_bound(addr: &vsk->local_addr))
196	return 0;
197	vsock_addr_init(addr: &local_addr, VMADDR_CID_ANY, VMADDR_PORT_ANY);
198	return __vsock_bind(sk, addr: &local_addr);
199	}
200
201	static void vsock_init_tables(void)
202	{
203	int i;
204
205	for (i = 0; i < ARRAY_SIZE(vsock_bind_table); i++)
206	INIT_LIST_HEAD(list: &vsock_bind_table[i]);
207
208	for (i = 0; i < ARRAY_SIZE(vsock_connected_table); i++)
209	INIT_LIST_HEAD(list: &vsock_connected_table[i]);
210	}
211
212	static void __vsock_insert_bound(struct list_head *list,
213	struct vsock_sock *vsk)
214	{
215	sock_hold(sk: &vsk->sk);
216	list_add(new: &vsk->bound_table, head: list);
217	}
218
219	static void __vsock_insert_connected(struct list_head *list,
220	struct vsock_sock *vsk)
221	{
222	sock_hold(sk: &vsk->sk);
223	list_add(new: &vsk->connected_table, head: list);
224	}
225
226	static void __vsock_remove_bound(struct vsock_sock *vsk)
227	{
228	list_del_init(entry: &vsk->bound_table);
229	sock_put(sk: &vsk->sk);
230	}
231
232	static void __vsock_remove_connected(struct vsock_sock *vsk)
233	{
234	list_del_init(entry: &vsk->connected_table);
235	sock_put(sk: &vsk->sk);
236	}
237
238	static struct sock *__vsock_find_bound_socket(struct sockaddr_vm *addr)
239	{
240	struct vsock_sock *vsk;
241
242	list_for_each_entry(vsk, vsock_bound_sockets(addr), bound_table) {
243	if (vsock_addr_equals_addr(addr, other: &vsk->local_addr))
244	return sk_vsock(vsk);
245
246	if (addr->svm_port == vsk->local_addr.svm_port &&
247	(vsk->local_addr.svm_cid == VMADDR_CID_ANY ||
248	addr->svm_cid == VMADDR_CID_ANY))
249	return sk_vsock(vsk);
250	}
251
252	return NULL;
253	}
254
255	static struct sock *__vsock_find_connected_socket(struct sockaddr_vm *src,
256	struct sockaddr_vm *dst)
257	{
258	struct vsock_sock *vsk;
259
260	list_for_each_entry(vsk, vsock_connected_sockets(src, dst),
261	connected_table) {
262	if (vsock_addr_equals_addr(addr: src, other: &vsk->remote_addr) &&
263	dst->svm_port == vsk->local_addr.svm_port) {
264	return sk_vsock(vsk);
265	}
266	}
267
268	return NULL;
269	}
270
271	static void vsock_insert_unbound(struct vsock_sock *vsk)
272	{
273	spin_lock_bh(lock: &vsock_table_lock);
274	__vsock_insert_bound(vsock_unbound_sockets, vsk);
275	spin_unlock_bh(lock: &vsock_table_lock);
276	}
277
278	void vsock_insert_connected(struct vsock_sock *vsk)
279	{
280	struct list_head *list = vsock_connected_sockets(
281	&vsk->remote_addr, &vsk->local_addr);
282
283	spin_lock_bh(lock: &vsock_table_lock);
284	__vsock_insert_connected(list, vsk);
285	spin_unlock_bh(lock: &vsock_table_lock);
286	}
287	EXPORT_SYMBOL_GPL(vsock_insert_connected);
288
289	void vsock_remove_bound(struct vsock_sock *vsk)
290	{
291	spin_lock_bh(lock: &vsock_table_lock);
292	if (__vsock_in_bound_table(vsk))
293	__vsock_remove_bound(vsk);
294	spin_unlock_bh(lock: &vsock_table_lock);
295	}
296	EXPORT_SYMBOL_GPL(vsock_remove_bound);
297
298	void vsock_remove_connected(struct vsock_sock *vsk)
299	{
300	spin_lock_bh(lock: &vsock_table_lock);
301	if (__vsock_in_connected_table(vsk))
302	__vsock_remove_connected(vsk);
303	spin_unlock_bh(lock: &vsock_table_lock);
304	}
305	EXPORT_SYMBOL_GPL(vsock_remove_connected);
306
307	struct sock *vsock_find_bound_socket(struct sockaddr_vm *addr)
308	{
309	struct sock *sk;
310
311	spin_lock_bh(lock: &vsock_table_lock);
312	sk = __vsock_find_bound_socket(addr);
313	if (sk)
314	sock_hold(sk);
315
316	spin_unlock_bh(lock: &vsock_table_lock);
317
318	return sk;
319	}
320	EXPORT_SYMBOL_GPL(vsock_find_bound_socket);
321
322	struct sock *vsock_find_connected_socket(struct sockaddr_vm *src,
323	struct sockaddr_vm *dst)
324	{
325	struct sock *sk;
326
327	spin_lock_bh(lock: &vsock_table_lock);
328	sk = __vsock_find_connected_socket(src, dst);
329	if (sk)
330	sock_hold(sk);
331
332	spin_unlock_bh(lock: &vsock_table_lock);
333
334	return sk;
335	}
336	EXPORT_SYMBOL_GPL(vsock_find_connected_socket);
337
338	void vsock_remove_sock(struct vsock_sock *vsk)
339	{
340	/* Transport reassignment must not remove the binding. */
341	if (sock_flag(sk_vsock(vsk), flag: SOCK_DEAD))
342	vsock_remove_bound(vsk);
343
344	vsock_remove_connected(vsk);
345	}
346	EXPORT_SYMBOL_GPL(vsock_remove_sock);
347
348	void vsock_for_each_connected_socket(struct vsock_transport *transport,
349	void (*fn)(struct sock *sk))
350	{
351	int i;
352
353	spin_lock_bh(lock: &vsock_table_lock);
354
355	for (i = 0; i < ARRAY_SIZE(vsock_connected_table); i++) {
356	struct vsock_sock *vsk;
357	list_for_each_entry(vsk, &vsock_connected_table[i],
358	connected_table) {
359	if (vsk->transport != transport)
360	continue;
361
362	fn(sk_vsock(vsk));
363	}
364	}
365
366	spin_unlock_bh(lock: &vsock_table_lock);
367	}
368	EXPORT_SYMBOL_GPL(vsock_for_each_connected_socket);
369
370	void vsock_add_pending(struct sock *listener, struct sock *pending)
371	{
372	struct vsock_sock *vlistener;
373	struct vsock_sock *vpending;
374
375	vlistener = vsock_sk(listener);
376	vpending = vsock_sk(pending);
377
378	sock_hold(sk: pending);
379	sock_hold(sk: listener);
380	list_add_tail(new: &vpending->pending_links, head: &vlistener->pending_links);
381	}
382	EXPORT_SYMBOL_GPL(vsock_add_pending);
383
384	void vsock_remove_pending(struct sock *listener, struct sock *pending)
385	{
386	struct vsock_sock *vpending = vsock_sk(pending);
387
388	list_del_init(entry: &vpending->pending_links);
389	sock_put(sk: listener);
390	sock_put(sk: pending);
391	}
392	EXPORT_SYMBOL_GPL(vsock_remove_pending);
393
394	void vsock_enqueue_accept(struct sock *listener, struct sock *connected)
395	{
396	struct vsock_sock *vlistener;
397	struct vsock_sock *vconnected;
398
399	vlistener = vsock_sk(listener);
400	vconnected = vsock_sk(connected);
401
402	sock_hold(sk: connected);
403	sock_hold(sk: listener);
404	list_add_tail(new: &vconnected->accept_queue, head: &vlistener->accept_queue);
405	}
406	EXPORT_SYMBOL_GPL(vsock_enqueue_accept);
407
408	static bool vsock_use_local_transport(unsigned int remote_cid)
409	{
410	lockdep_assert_held(&vsock_register_mutex);
411
412	if (!transport_local)
413	return false;
414
415	if (remote_cid == VMADDR_CID_LOCAL)
416	return true;
417
418	if (transport_g2h) {
419	return remote_cid == transport_g2h->get_local_cid();
420	} else {
421	return remote_cid == VMADDR_CID_HOST;
422	}
423	}
424
425	static void vsock_deassign_transport(struct vsock_sock *vsk)
426	{
427	if (!vsk->transport)
428	return;
429
430	vsk->transport->destruct(vsk);
431	module_put(module: vsk->transport->module);
432	vsk->transport = NULL;
433	}
434
435	/* Assign a transport to a socket and call the .init transport callback.
436	*
437	* Note: for connection oriented socket this must be called when vsk->remote_addr
438	* is set (e.g. during the connect() or when a connection request on a listener
439	* socket is received).
440	* The vsk->remote_addr is used to decide which transport to use:
441	* - remote CID == VMADDR_CID_LOCAL or g2h->local_cid or VMADDR_CID_HOST if
442	* g2h is not loaded, will use local transport;
443	* - remote CID <= VMADDR_CID_HOST or h2g is not loaded or remote flags field
444	* includes VMADDR_FLAG_TO_HOST flag value, will use guest->host transport;
445	* - remote CID > VMADDR_CID_HOST will use host->guest transport;
446	*/
447	int vsock_assign_transport(struct vsock_sock *vsk, struct vsock_sock *psk)
448	{
449	const struct vsock_transport *new_transport;
450	struct sock *sk = sk_vsock(vsk);
451	unsigned int remote_cid = vsk->remote_addr.svm_cid;
452	__u8 remote_flags;
453	int ret;
454
455	/* If the packet is coming with the source and destination CIDs higher
456	* than VMADDR_CID_HOST, then a vsock channel where all the packets are
457	* forwarded to the host should be established. Then the host will
458	* need to forward the packets to the guest.
459	*
460	* The flag is set on the (listen) receive path (psk is not NULL). On
461	* the connect path the flag can be set by the user space application.
462	*/
463	if (psk && vsk->local_addr.svm_cid > VMADDR_CID_HOST &&
464	vsk->remote_addr.svm_cid > VMADDR_CID_HOST)
465	vsk->remote_addr.svm_flags |= VMADDR_FLAG_TO_HOST;
466
467	remote_flags = vsk->remote_addr.svm_flags;
468
469	mutex_lock(&vsock_register_mutex);
470
471	switch (sk->sk_type) {
472	case SOCK_DGRAM:
473	new_transport = transport_dgram;
474	break;
475	case SOCK_STREAM:
476	case SOCK_SEQPACKET:
477	if (vsock_use_local_transport(remote_cid))
478	new_transport = transport_local;
479	else if (remote_cid <= VMADDR_CID_HOST || !transport_h2g ||
480	(remote_flags & VMADDR_FLAG_TO_HOST))
481	new_transport = transport_g2h;
482	else
483	new_transport = transport_h2g;
484	break;
485	default:
486	ret = -ESOCKTNOSUPPORT;
487	goto err;
488	}
489
490	if (vsk->transport && vsk->transport == new_transport) {
491	ret = 0;
492	goto err;
493	}
494
495	/* We increase the module refcnt to prevent the transport unloading
496	* while there are open sockets assigned to it.
497	*/
498	if (!new_transport || !try_module_get(module: new_transport->module)) {
499	ret = -ENODEV;
500	goto err;
501	}
502
503	/* It's safe to release the mutex after a successful try_module_get().
504	* Whichever transport `new_transport` points at, it won't go away until
505	* the last module_put() below or in vsock_deassign_transport().
506	*/
507	mutex_unlock(lock: &vsock_register_mutex);
508
509	if (vsk->transport) {
510	/* transport->release() must be called with sock lock acquired.
511	* This path can only be taken during vsock_connect(), where we
512	* have already held the sock lock. In the other cases, this
513	* function is called on a new socket which is not assigned to
514	* any transport.
515	*/
516	vsk->transport->release(vsk);
517	vsock_deassign_transport(vsk);
518
519	/* transport's release() and destruct() can touch some socket
520	* state, since we are reassigning the socket to a new transport
521	* during vsock_connect(), let's reset these fields to have a
522	* clean state.
523	*/
524	sock_reset_flag(sk, flag: SOCK_DONE);
525	sk->sk_state = TCP_CLOSE;
526	vsk->peer_shutdown = 0;
527	}
528
529	if (sk->sk_type == SOCK_SEQPACKET) {
530	if (!new_transport->seqpacket_allow ||
531	!new_transport->seqpacket_allow(remote_cid)) {
532	module_put(module: new_transport->module);
533	return -ESOCKTNOSUPPORT;
534	}
535	}
536
537	ret = new_transport->init(vsk, psk);
538	if (ret) {
539	module_put(module: new_transport->module);
540	return ret;
541	}
542
543	vsk->transport = new_transport;
544
545	return 0;
546	err:
547	mutex_unlock(lock: &vsock_register_mutex);
548	return ret;
549	}
550	EXPORT_SYMBOL_GPL(vsock_assign_transport);
551
552	/*
553	* Provide safe access to static transport_{h2g,g2h,dgram,local} callbacks.
554	* Otherwise we may race with module removal. Do not use on `vsk->transport`.
555	*/
556	static u32 vsock_registered_transport_cid(const struct vsock_transport **transport)
557	{
558	u32 cid = VMADDR_CID_ANY;
559
560	mutex_lock(&vsock_register_mutex);
561	if (*transport)
562	cid = (*transport)->get_local_cid();
563	mutex_unlock(lock: &vsock_register_mutex);
564
565	return cid;
566	}
567
568	bool vsock_find_cid(unsigned int cid)
569	{
570	if (cid == vsock_registered_transport_cid(transport: &transport_g2h))
571	return true;
572
573	if (transport_h2g && cid == VMADDR_CID_HOST)
574	return true;
575
576	if (transport_local && cid == VMADDR_CID_LOCAL)
577	return true;
578
579	return false;
580	}
581	EXPORT_SYMBOL_GPL(vsock_find_cid);
582
583	static struct sock *vsock_dequeue_accept(struct sock *listener)
584	{
585	struct vsock_sock *vlistener;
586	struct vsock_sock *vconnected;
587
588	vlistener = vsock_sk(listener);
589
590	if (list_empty(head: &vlistener->accept_queue))
591	return NULL;
592
593	vconnected = list_entry(vlistener->accept_queue.next,
594	struct vsock_sock, accept_queue);
595
596	list_del_init(entry: &vconnected->accept_queue);
597	sock_put(sk: listener);
598	/* The caller will need a reference on the connected socket so we let
599	* it call sock_put().
600	*/
601
602	return sk_vsock(vconnected);
603	}
604
605	static bool vsock_is_accept_queue_empty(struct sock *sk)
606	{
607	struct vsock_sock *vsk = vsock_sk(sk);
608	return list_empty(head: &vsk->accept_queue);
609	}
610
611	static bool vsock_is_pending(struct sock *sk)
612	{
613	struct vsock_sock *vsk = vsock_sk(sk);
614	return !list_empty(head: &vsk->pending_links);
615	}
616
617	static int vsock_send_shutdown(struct sock *sk, int mode)
618	{
619	struct vsock_sock *vsk = vsock_sk(sk);
620
621	if (!vsk->transport)
622	return -ENODEV;
623
624	return vsk->transport->shutdown(vsk, mode);
625	}
626
627	static void vsock_pending_work(struct work_struct *work)
628	{
629	struct sock *sk;
630	struct sock *listener;
631	struct vsock_sock *vsk;
632	bool cleanup;
633
634	vsk = container_of(work, struct vsock_sock, pending_work.work);
635	sk = sk_vsock(vsk);
636	listener = vsk->listener;
637	cleanup = true;
638
639	lock_sock(sk: listener);
640	lock_sock_nested(sk, SINGLE_DEPTH_NESTING);
641
642	if (vsock_is_pending(sk)) {
643	vsock_remove_pending(listener, sk);
644
645	sk_acceptq_removed(sk: listener);
646	} else if (!vsk->rejected) {
647	/* We are not on the pending list and accept() did not reject
648	* us, so we must have been accepted by our user process. We
649	* just need to drop our references to the sockets and be on
650	* our way.
651	*/
652	cleanup = false;
653	goto out;
654	}
655
656	/* We need to remove ourself from the global connected sockets list so
657	* incoming packets can't find this socket, and to reduce the reference
658	* count.
659	*/
660	vsock_remove_connected(vsk);
661
662	sk->sk_state = TCP_CLOSE;
663
664	out:
665	release_sock(sk);
666	release_sock(sk: listener);
667	if (cleanup)
668	sock_put(sk);
669
670	sock_put(sk);
671	sock_put(sk: listener);
672	}
673
674	/**** SOCKET OPERATIONS ****/
675
676	static int __vsock_bind_connectible(struct vsock_sock *vsk,
677	struct sockaddr_vm *addr)
678	{
679	static u32 port;
680	struct sockaddr_vm new_addr;
681
682	if (!port)
683	port = get_random_u32_above(LAST_RESERVED_PORT);
684
685	vsock_addr_init(addr: &new_addr, cid: addr->svm_cid, port: addr->svm_port);
686
687	if (addr->svm_port == VMADDR_PORT_ANY) {
688	bool found = false;
689	unsigned int i;
690
691	for (i = 0; i < MAX_PORT_RETRIES; i++) {
692	if (port == VMADDR_PORT_ANY ||
693	port <= LAST_RESERVED_PORT)
694	port = LAST_RESERVED_PORT + 1;
695
696	new_addr.svm_port = port++;
697
698	if (!__vsock_find_bound_socket(addr: &new_addr)) {
699	found = true;
700	break;
701	}
702	}
703
704	if (!found)
705	return -EADDRNOTAVAIL;
706	} else {
707	/* If port is in reserved range, ensure caller
708	* has necessary privileges.
709	*/
710	if (addr->svm_port <= LAST_RESERVED_PORT &&
711	!capable(CAP_NET_BIND_SERVICE)) {
712	return -EACCES;
713	}
714
715	if (__vsock_find_bound_socket(addr: &new_addr))
716	return -EADDRINUSE;
717	}
718
719	vsock_addr_init(addr: &vsk->local_addr, cid: new_addr.svm_cid, port: new_addr.svm_port);
720
721	/* Remove connection oriented sockets from the unbound list and add them
722	* to the hash table for easy lookup by its address. The unbound list
723	* is simply an extra entry at the end of the hash table, a trick used
724	* by AF_UNIX.
725	*/
726	__vsock_remove_bound(vsk);
727	__vsock_insert_bound(vsock_bound_sockets(&vsk->local_addr), vsk);
728
729	return 0;
730	}
731
732	static int __vsock_bind_dgram(struct vsock_sock *vsk,
733	struct sockaddr_vm *addr)
734	{
735	return vsk->transport->dgram_bind(vsk, addr);
736	}
737
738	static int __vsock_bind(struct sock *sk, struct sockaddr_vm *addr)
739	{
740	struct vsock_sock *vsk = vsock_sk(sk);
741	int retval;
742
743	/* First ensure this socket isn't already bound. */
744	if (vsock_addr_bound(addr: &vsk->local_addr))
745	return -EINVAL;
746
747	/* Now bind to the provided address or select appropriate values if
748	* none are provided (VMADDR_CID_ANY and VMADDR_PORT_ANY). Note that
749	* like AF_INET prevents binding to a non-local IP address (in most
750	* cases), we only allow binding to a local CID.
751	*/
752	if (addr->svm_cid != VMADDR_CID_ANY && !vsock_find_cid(addr->svm_cid))
753	return -EADDRNOTAVAIL;
754
755	switch (sk->sk_socket->type) {
756	case SOCK_STREAM:
757	case SOCK_SEQPACKET:
758	spin_lock_bh(lock: &vsock_table_lock);
759	retval = __vsock_bind_connectible(vsk, addr);
760	spin_unlock_bh(lock: &vsock_table_lock);
761	break;
762
763	case SOCK_DGRAM:
764	retval = __vsock_bind_dgram(vsk, addr);
765	break;
766
767	default:
768	retval = -EINVAL;
769	break;
770	}
771
772	return retval;
773	}
774
775	static void vsock_connect_timeout(struct work_struct *work);
776
777	static struct sock *__vsock_create(struct net *net,
778	struct socket *sock,
779	struct sock *parent,
780	gfp_t priority,
781	unsigned short type,
782	int kern)
783	{
784	struct sock *sk;
785	struct vsock_sock *psk;
786	struct vsock_sock *vsk;
787
788	sk = sk_alloc(net, AF_VSOCK, priority, prot: &vsock_proto, kern);
789	if (!sk)
790	return NULL;
791
792	sock_init_data(sock, sk);
793
794	/* sk->sk_type is normally set in sock_init_data, but only if sock is
795	* non-NULL. We make sure that our sockets always have a type by
796	* setting it here if needed.
797	*/
798	if (!sock)
799	sk->sk_type = type;
800
801	vsk = vsock_sk(sk);
802	vsock_addr_init(addr: &vsk->local_addr, VMADDR_CID_ANY, VMADDR_PORT_ANY);
803	vsock_addr_init(addr: &vsk->remote_addr, VMADDR_CID_ANY, VMADDR_PORT_ANY);
804
805	sk->sk_destruct = vsock_sk_destruct;
806	sk->sk_backlog_rcv = vsock_queue_rcv_skb;
807	sock_reset_flag(sk, flag: SOCK_DONE);
808
809	INIT_LIST_HEAD(list: &vsk->bound_table);
810	INIT_LIST_HEAD(list: &vsk->connected_table);
811	vsk->listener = NULL;
812	INIT_LIST_HEAD(list: &vsk->pending_links);
813	INIT_LIST_HEAD(list: &vsk->accept_queue);
814	vsk->rejected = false;
815	vsk->sent_request = false;
816	vsk->ignore_connecting_rst = false;
817	vsk->peer_shutdown = 0;
818	INIT_DELAYED_WORK(&vsk->connect_work, vsock_connect_timeout);
819	INIT_DELAYED_WORK(&vsk->pending_work, vsock_pending_work);
820
821	psk = parent ? vsock_sk(parent) : NULL;
822	if (parent) {
823	vsk->trusted = psk->trusted;
824	vsk->owner = get_cred(cred: psk->owner);
825	vsk->connect_timeout = psk->connect_timeout;
826	vsk->buffer_size = psk->buffer_size;
827	vsk->buffer_min_size = psk->buffer_min_size;
828	vsk->buffer_max_size = psk->buffer_max_size;
829	security_sk_clone(sk: parent, newsk: sk);
830	} else {
831	vsk->trusted = ns_capable_noaudit(ns: &init_user_ns, CAP_NET_ADMIN);
832	vsk->owner = get_current_cred();
833	vsk->connect_timeout = VSOCK_DEFAULT_CONNECT_TIMEOUT;
834	vsk->buffer_size = VSOCK_DEFAULT_BUFFER_SIZE;
835	vsk->buffer_min_size = VSOCK_DEFAULT_BUFFER_MIN_SIZE;
836	vsk->buffer_max_size = VSOCK_DEFAULT_BUFFER_MAX_SIZE;
837	}
838
839	return sk;
840	}
841
842	static bool sock_type_connectible(u16 type)
843	{
844	return (type == SOCK_STREAM) || (type == SOCK_SEQPACKET);
845	}
846
847	static void __vsock_release(struct sock *sk, int level)
848	{
849	struct vsock_sock *vsk;
850	struct sock *pending;
851
852	vsk = vsock_sk(sk);
853	pending = NULL; /* Compiler warning. */
854
855	/* When "level" is SINGLE_DEPTH_NESTING, use the nested
856	* version to avoid the warning "possible recursive locking
857	* detected". When "level" is 0, lock_sock_nested(sk, level)
858	* is the same as lock_sock(sk).
859	*/
860	lock_sock_nested(sk, subclass: level);
861
862	/* Indicate to vsock_remove_sock() that the socket is being released and
863	* can be removed from the bound_table. Unlike transport reassignment
864	* case, where the socket must remain bound despite vsock_remove_sock()
865	* being called from the transport release() callback.
866	*/
867	sock_set_flag(sk, flag: SOCK_DEAD);
868
869	if (vsk->transport)
870	vsk->transport->release(vsk);
871	else if (sock_type_connectible(type: sk->sk_type))
872	vsock_remove_sock(vsk);
873
874	sock_orphan(sk);
875	sk->sk_shutdown = SHUTDOWN_MASK;
876
877	skb_queue_purge(list: &sk->sk_receive_queue);
878
879	/* Clean up any sockets that never were accepted. */
880	while ((pending = vsock_dequeue_accept(listener: sk)) != NULL) {
881	__vsock_release(sk: pending, SINGLE_DEPTH_NESTING);
882	sock_put(sk: pending);
883	}
884
885	release_sock(sk);
886	sock_put(sk);
887	}
888
889	static void vsock_sk_destruct(struct sock *sk)
890	{
891	struct vsock_sock *vsk = vsock_sk(sk);
892
893	/* Flush MSG_ZEROCOPY leftovers. */
894	__skb_queue_purge(list: &sk->sk_error_queue);
895
896	vsock_deassign_transport(vsk);
897
898	/* When clearing these addresses, there's no need to set the family and
899	* possibly register the address family with the kernel.
900	*/
901	vsock_addr_init(addr: &vsk->local_addr, VMADDR_CID_ANY, VMADDR_PORT_ANY);
902	vsock_addr_init(addr: &vsk->remote_addr, VMADDR_CID_ANY, VMADDR_PORT_ANY);
903
904	put_cred(cred: vsk->owner);
905	}
906
907	static int vsock_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
908	{
909	int err;
910
911	err = sock_queue_rcv_skb(sk, skb);
912	if (err)
913	kfree_skb(skb);
914
915	return err;
916	}
917
918	struct sock *vsock_create_connected(struct sock *parent)
919	{
920	return __vsock_create(net: sock_net(sk: parent), NULL, parent, GFP_KERNEL,
921	type: parent->sk_type, kern: 0);
922	}
923	EXPORT_SYMBOL_GPL(vsock_create_connected);
924
925	s64 vsock_stream_has_data(struct vsock_sock *vsk)
926	{
927	if (WARN_ON(!vsk->transport))
928	return 0;
929
930	return vsk->transport->stream_has_data(vsk);
931	}
932	EXPORT_SYMBOL_GPL(vsock_stream_has_data);
933
934	s64 vsock_connectible_has_data(struct vsock_sock *vsk)
935	{
936	struct sock *sk = sk_vsock(vsk);
937
938	if (WARN_ON(!vsk->transport))
939	return 0;
940
941	if (sk->sk_type == SOCK_SEQPACKET)
942	return vsk->transport->seqpacket_has_data(vsk);
943	else
944	return vsock_stream_has_data(vsk);
945	}
946	EXPORT_SYMBOL_GPL(vsock_connectible_has_data);
947
948	s64 vsock_stream_has_space(struct vsock_sock *vsk)
949	{
950	if (WARN_ON(!vsk->transport))
951	return 0;
952
953	return vsk->transport->stream_has_space(vsk);
954	}
955	EXPORT_SYMBOL_GPL(vsock_stream_has_space);
956
957	void vsock_data_ready(struct sock *sk)
958	{
959	struct vsock_sock *vsk = vsock_sk(sk);
960
961	if (vsock_stream_has_data(vsk) >= sk->sk_rcvlowat ||
962	sock_flag(sk, flag: SOCK_DONE))
963	sk->sk_data_ready(sk);
964	}
965	EXPORT_SYMBOL_GPL(vsock_data_ready);
966
967	/* Dummy callback required by sockmap.
968	* See unconditional call of saved_close() in sock_map_close().
969	*/
970	static void vsock_close(struct sock *sk, long timeout)
971	{
972	}
973
974	static int vsock_release(struct socket *sock)
975	{
976	struct sock *sk = sock->sk;
977
978	if (!sk)
979	return 0;
980
981	sk->sk_prot->close(sk, 0);
982	__vsock_release(sk, level: 0);
983	sock->sk = NULL;
984	sock->state = SS_FREE;
985
986	return 0;
987	}
988
989	static int
990	vsock_bind(struct socket *sock, struct sockaddr_unsized *addr, int addr_len)
991	{
992	int err;
993	struct sock *sk;
994	struct sockaddr_vm *vm_addr;
995
996	sk = sock->sk;
997
998	if (vsock_addr_cast(addr, len: addr_len, out_addr: &vm_addr) != 0)
999	return -EINVAL;
1000
1001	lock_sock(sk);
1002	err = __vsock_bind(sk, addr: vm_addr);
1003	release_sock(sk);
1004
1005	return err;
1006	}
1007
1008	static int vsock_getname(struct socket *sock,
1009	struct sockaddr *addr, int peer)
1010	{
1011	int err;
1012	struct sock *sk;
1013	struct vsock_sock *vsk;
1014	struct sockaddr_vm *vm_addr;
1015
1016	sk = sock->sk;
1017	vsk = vsock_sk(sk);
1018	err = 0;
1019
1020	lock_sock(sk);
1021
1022	if (peer) {
1023	if (sock->state != SS_CONNECTED) {
1024	err = -ENOTCONN;
1025	goto out;
1026	}
1027	vm_addr = &vsk->remote_addr;
1028	} else {
1029	vm_addr = &vsk->local_addr;
1030	}
1031
1032	BUILD_BUG_ON(sizeof(*vm_addr) > sizeof(struct sockaddr_storage));
1033	memcpy(addr, vm_addr, sizeof(*vm_addr));
1034	err = sizeof(*vm_addr);
1035
1036	out:
1037	release_sock(sk);
1038	return err;
1039	}
1040
1041	void vsock_linger(struct sock *sk)
1042	{
1043	DEFINE_WAIT_FUNC(wait, woken_wake_function);
1044	ssize_t (*unsent)(struct vsock_sock *vsk);
1045	struct vsock_sock *vsk = vsock_sk(sk);
1046	long timeout;
1047
1048	if (!sock_flag(sk, flag: SOCK_LINGER))
1049	return;
1050
1051	timeout = sk->sk_lingertime;
1052	if (!timeout)
1053	return;
1054
1055	/* Transports must implement `unsent_bytes` if they want to support
1056	* SOCK_LINGER through `vsock_linger()` since we use it to check when
1057	* the socket can be closed.
1058	*/
1059	unsent = vsk->transport->unsent_bytes;
1060	if (!unsent)
1061	return;
1062
1063	add_wait_queue(wq_head: sk_sleep(sk), wq_entry: &wait);
1064
1065	do {
1066	if (sk_wait_event(sk, &timeout, unsent(vsk) == 0, &wait))
1067	break;
1068	} while (!signal_pending(current) && timeout);
1069
1070	remove_wait_queue(wq_head: sk_sleep(sk), wq_entry: &wait);
1071	}
1072	EXPORT_SYMBOL_GPL(vsock_linger);
1073
1074	static int vsock_shutdown(struct socket *sock, int mode)
1075	{
1076	int err;
1077	struct sock *sk;
1078
1079	/* User level uses SHUT_RD (0) and SHUT_WR (1), but the kernel uses
1080	* RCV_SHUTDOWN (1) and SEND_SHUTDOWN (2), so we must increment mode
1081	* here like the other address families do. Note also that the
1082	* increment makes SHUT_RDWR (2) into RCV_SHUTDOWN | SEND_SHUTDOWN (3),
1083	* which is what we want.
1084	*/
1085	mode++;
1086
1087	if ((mode & ~SHUTDOWN_MASK) || !mode)
1088	return -EINVAL;
1089
1090	/* If this is a connection oriented socket and it is not connected then
1091	* bail out immediately. If it is a DGRAM socket then we must first
1092	* kick the socket so that it wakes up from any sleeping calls, for
1093	* example recv(), and then afterwards return the error.
1094	*/
1095
1096	sk = sock->sk;
1097
1098	lock_sock(sk);
1099	if (sock->state == SS_UNCONNECTED) {
1100	err = -ENOTCONN;
1101	if (sock_type_connectible(type: sk->sk_type))
1102	goto out;
1103	} else {
1104	sock->state = SS_DISCONNECTING;
1105	err = 0;
1106	}
1107
1108	/* Receive and send shutdowns are treated alike. */
1109	mode = mode & (RCV_SHUTDOWN | SEND_SHUTDOWN);
1110	if (mode) {
1111	sk->sk_shutdown |= mode;
1112	sk->sk_state_change(sk);
1113
1114	if (sock_type_connectible(type: sk->sk_type)) {
1115	sock_reset_flag(sk, flag: SOCK_DONE);
1116	vsock_send_shutdown(sk, mode);
1117	}
1118	}
1119
1120	out:
1121	release_sock(sk);
1122	return err;
1123	}
1124
1125	static __poll_t vsock_poll(struct file *file, struct socket *sock,
1126	poll_table *wait)
1127	{
1128	struct sock *sk;
1129	__poll_t mask;
1130	struct vsock_sock *vsk;
1131
1132	sk = sock->sk;
1133	vsk = vsock_sk(sk);
1134
1135	poll_wait(filp: file, wait_address: sk_sleep(sk), p: wait);
1136	mask = 0;
1137
1138	if (sk->sk_err || !skb_queue_empty_lockless(list: &sk->sk_error_queue))
1139	/* Signify that there has been an error on this socket. */
1140	mask |= EPOLLERR;
1141
1142	/* INET sockets treat local write shutdown and peer write shutdown as a
1143	* case of EPOLLHUP set.
1144	*/
1145	if ((sk->sk_shutdown == SHUTDOWN_MASK) ||
1146	((sk->sk_shutdown & SEND_SHUTDOWN) &&
1147	(vsk->peer_shutdown & SEND_SHUTDOWN))) {
1148	mask |= EPOLLHUP;
1149	}
1150
1151	if (sk->sk_shutdown & RCV_SHUTDOWN ||
1152	vsk->peer_shutdown & SEND_SHUTDOWN) {
1153	mask |= EPOLLRDHUP;
1154	}
1155
1156	if (sk_is_readable(sk))
1157	mask |= EPOLLIN | EPOLLRDNORM;
1158
1159	if (sock->type == SOCK_DGRAM) {
1160	/* For datagram sockets we can read if there is something in
1161	* the queue and write as long as the socket isn't shutdown for
1162	* sending.
1163	*/
1164	if (!skb_queue_empty_lockless(list: &sk->sk_receive_queue) ||
1165	(sk->sk_shutdown & RCV_SHUTDOWN)) {
1166	mask |= EPOLLIN | EPOLLRDNORM;
1167	}
1168
1169	if (!(sk->sk_shutdown & SEND_SHUTDOWN))
1170	mask |= EPOLLOUT | EPOLLWRNORM | EPOLLWRBAND;
1171
1172	} else if (sock_type_connectible(type: sk->sk_type)) {
1173	const struct vsock_transport *transport;
1174
1175	lock_sock(sk);
1176
1177	transport = vsk->transport;
1178
1179	/* Listening sockets that have connections in their accept
1180	* queue can be read.
1181	*/
1182	if (sk->sk_state == TCP_LISTEN
1183	&& !vsock_is_accept_queue_empty(sk))
1184	mask |= EPOLLIN | EPOLLRDNORM;
1185
1186	/* If there is something in the queue then we can read. */
1187	if (transport && transport->stream_is_active(vsk) &&
1188	!(sk->sk_shutdown & RCV_SHUTDOWN)) {
1189	bool data_ready_now = false;
1190	int target = sock_rcvlowat(sk, waitall: 0, INT_MAX);
1191	int ret = transport->notify_poll_in(
1192	vsk, target, &data_ready_now);
1193	if (ret < 0) {
1194	mask |= EPOLLERR;
1195	} else {
1196	if (data_ready_now)
1197	mask |= EPOLLIN | EPOLLRDNORM;
1198
1199	}
1200	}
1201
1202	/* Sockets whose connections have been closed, reset, or
1203	* terminated should also be considered read, and we check the
1204	* shutdown flag for that.
1205	*/
1206	if (sk->sk_shutdown & RCV_SHUTDOWN ||
1207	vsk->peer_shutdown & SEND_SHUTDOWN) {
1208	mask |= EPOLLIN | EPOLLRDNORM;
1209	}
1210
1211	/* Connected sockets that can produce data can be written. */
1212	if (transport && sk->sk_state == TCP_ESTABLISHED) {
1213	if (!(sk->sk_shutdown & SEND_SHUTDOWN)) {
1214	bool space_avail_now = false;
1215	int ret = transport->notify_poll_out(
1216	vsk, 1, &space_avail_now);
1217	if (ret < 0) {
1218	mask |= EPOLLERR;
1219	} else {
1220	if (space_avail_now)
1221	/* Remove EPOLLWRBAND since INET
1222	* sockets are not setting it.
1223	*/
1224	mask |= EPOLLOUT | EPOLLWRNORM;
1225
1226	}
1227	}
1228	}
1229
1230	/* Simulate INET socket poll behaviors, which sets
1231	* EPOLLOUT|EPOLLWRNORM when peer is closed and nothing to read,
1232	* but local send is not shutdown.
1233	*/
1234	if (sk->sk_state == TCP_CLOSE || sk->sk_state == TCP_CLOSING) {
1235	if (!(sk->sk_shutdown & SEND_SHUTDOWN))
1236	mask |= EPOLLOUT | EPOLLWRNORM;
1237
1238	}
1239
1240	release_sock(sk);
1241	}
1242
1243	return mask;
1244	}
1245
1246	static int vsock_read_skb(struct sock *sk, skb_read_actor_t read_actor)
1247	{
1248	struct vsock_sock *vsk = vsock_sk(sk);
1249
1250	if (WARN_ON_ONCE(!vsk->transport))
1251	return -ENODEV;
1252
1253	return vsk->transport->read_skb(vsk, read_actor);
1254	}
1255
1256	static int vsock_dgram_sendmsg(struct socket *sock, struct msghdr *msg,
1257	size_t len)
1258	{
1259	int err;
1260	struct sock *sk;
1261	struct vsock_sock *vsk;
1262	struct sockaddr_vm *remote_addr;
1263	const struct vsock_transport *transport;
1264
1265	if (msg->msg_flags & MSG_OOB)
1266	return -EOPNOTSUPP;
1267
1268	/* For now, MSG_DONTWAIT is always assumed... */
1269	err = 0;
1270	sk = sock->sk;
1271	vsk = vsock_sk(sk);
1272
1273	lock_sock(sk);
1274
1275	transport = vsk->transport;
1276
1277	err = vsock_auto_bind(vsk);
1278	if (err)
1279	goto out;
1280
1281
1282	/* If the provided message contains an address, use that. Otherwise
1283	* fall back on the socket's remote handle (if it has been connected).
1284	*/
1285	if (msg->msg_name &&
1286	vsock_addr_cast(addr: msg->msg_name, len: msg->msg_namelen,
1287	out_addr: &remote_addr) == 0) {
1288	/* Ensure this address is of the right type and is a valid
1289	* destination.
1290	*/
1291
1292	if (remote_addr->svm_cid == VMADDR_CID_ANY)
1293	remote_addr->svm_cid = transport->get_local_cid();
1294
1295	if (!vsock_addr_bound(addr: remote_addr)) {
1296	err = -EINVAL;
1297	goto out;
1298	}
1299	} else if (sock->state == SS_CONNECTED) {
1300	remote_addr = &vsk->remote_addr;
1301
1302	if (remote_addr->svm_cid == VMADDR_CID_ANY)
1303	remote_addr->svm_cid = transport->get_local_cid();
1304
1305	/* XXX Should connect() or this function ensure remote_addr is
1306	* bound?
1307	*/
1308	if (!vsock_addr_bound(addr: &vsk->remote_addr)) {
1309	err = -EINVAL;
1310	goto out;
1311	}
1312	} else {
1313	err = -EINVAL;
1314	goto out;
1315	}
1316
1317	if (!transport->dgram_allow(remote_addr->svm_cid,
1318	remote_addr->svm_port)) {
1319	err = -EINVAL;
1320	goto out;
1321	}
1322
1323	err = transport->dgram_enqueue(vsk, remote_addr, msg, len);
1324
1325	out:
1326	release_sock(sk);
1327	return err;
1328	}
1329
1330	static int vsock_dgram_connect(struct socket *sock,
1331	struct sockaddr_unsized *addr, int addr_len, int flags)
1332	{
1333	int err;
1334	struct sock *sk;
1335	struct vsock_sock *vsk;
1336	struct sockaddr_vm *remote_addr;
1337
1338	sk = sock->sk;
1339	vsk = vsock_sk(sk);
1340
1341	err = vsock_addr_cast(addr, len: addr_len, out_addr: &remote_addr);
1342	if (err == -EAFNOSUPPORT && remote_addr->svm_family == AF_UNSPEC) {
1343	lock_sock(sk);
1344	vsock_addr_init(addr: &vsk->remote_addr, VMADDR_CID_ANY,
1345	VMADDR_PORT_ANY);
1346	sock->state = SS_UNCONNECTED;
1347	release_sock(sk);
1348	return 0;
1349	} else if (err != 0)
1350	return -EINVAL;
1351
1352	lock_sock(sk);
1353
1354	err = vsock_auto_bind(vsk);
1355	if (err)
1356	goto out;
1357
1358	if (!vsk->transport->dgram_allow(remote_addr->svm_cid,
1359	remote_addr->svm_port)) {
1360	err = -EINVAL;
1361	goto out;
1362	}
1363
1364	memcpy(&vsk->remote_addr, remote_addr, sizeof(vsk->remote_addr));
1365	sock->state = SS_CONNECTED;
1366
1367	/* sock map disallows redirection of non-TCP sockets with sk_state !=
1368	* TCP_ESTABLISHED (see sock_map_redirect_allowed()), so we set
1369	* TCP_ESTABLISHED here to allow redirection of connected vsock dgrams.
1370	*
1371	* This doesn't seem to be abnormal state for datagram sockets, as the
1372	* same approach can be see in other datagram socket types as well
1373	* (such as unix sockets).
1374	*/
1375	sk->sk_state = TCP_ESTABLISHED;
1376
1377	out:
1378	release_sock(sk);
1379	return err;
1380	}
1381
1382	int __vsock_dgram_recvmsg(struct socket *sock, struct msghdr *msg,
1383	size_t len, int flags)
1384	{
1385	struct sock *sk = sock->sk;
1386	struct vsock_sock *vsk = vsock_sk(sk);
1387
1388	return vsk->transport->dgram_dequeue(vsk, msg, len, flags);
1389	}
1390
1391	int vsock_dgram_recvmsg(struct socket *sock, struct msghdr *msg,
1392	size_t len, int flags)
1393	{
1394	#ifdef CONFIG_BPF_SYSCALL
1395	struct sock *sk = sock->sk;
1396	const struct proto *prot;
1397
1398	prot = READ_ONCE(sk->sk_prot);
1399	if (prot != &vsock_proto)
1400	return prot->recvmsg(sk, msg, len, flags, NULL);
1401	#endif
1402
1403	return __vsock_dgram_recvmsg(sock, msg, len, flags);
1404	}
1405	EXPORT_SYMBOL_GPL(vsock_dgram_recvmsg);
1406
1407	static int vsock_do_ioctl(struct socket *sock, unsigned int cmd,
1408	int __user *arg)
1409	{
1410	struct sock *sk = sock->sk;
1411	struct vsock_sock *vsk;
1412	int ret;
1413
1414	vsk = vsock_sk(sk);
1415
1416	switch (cmd) {
1417	case SIOCINQ: {
1418	ssize_t n_bytes;
1419
1420	if (!vsk->transport) {
1421	ret = -EOPNOTSUPP;
1422	break;
1423	}
1424
1425	if (sock_type_connectible(type: sk->sk_type) &&
1426	sk->sk_state == TCP_LISTEN) {
1427	ret = -EINVAL;
1428	break;
1429	}
1430
1431	n_bytes = vsock_stream_has_data(vsk);
1432	if (n_bytes < 0) {
1433	ret = n_bytes;
1434	break;
1435	}
1436	ret = put_user(n_bytes, arg);
1437	break;
1438	}
1439	case SIOCOUTQ: {
1440	ssize_t n_bytes;
1441
1442	if (!vsk->transport || !vsk->transport->unsent_bytes) {
1443	ret = -EOPNOTSUPP;
1444	break;
1445	}
1446
1447	if (sock_type_connectible(type: sk->sk_type) && sk->sk_state == TCP_LISTEN) {
1448	ret = -EINVAL;
1449	break;
1450	}
1451
1452	n_bytes = vsk->transport->unsent_bytes(vsk);
1453	if (n_bytes < 0) {
1454	ret = n_bytes;
1455	break;
1456	}
1457
1458	ret = put_user(n_bytes, arg);
1459	break;
1460	}
1461	default:
1462	ret = -ENOIOCTLCMD;
1463	}
1464
1465	return ret;
1466	}
1467
1468	static int vsock_ioctl(struct socket *sock, unsigned int cmd,
1469	unsigned long arg)
1470	{
1471	int ret;
1472
1473	lock_sock(sk: sock->sk);
1474	ret = vsock_do_ioctl(sock, cmd, arg: (int __user *)arg);
1475	release_sock(sk: sock->sk);
1476
1477	return ret;
1478	}
1479
1480	static const struct proto_ops vsock_dgram_ops = {
1481	.family = PF_VSOCK,
1482	.owner = THIS_MODULE,
1483	.release = vsock_release,
1484	.bind = vsock_bind,
1485	.connect = vsock_dgram_connect,
1486	.socketpair = sock_no_socketpair,
1487	.accept = sock_no_accept,
1488	.getname = vsock_getname,
1489	.poll = vsock_poll,
1490	.ioctl = vsock_ioctl,
1491	.listen = sock_no_listen,
1492	.shutdown = vsock_shutdown,
1493	.sendmsg = vsock_dgram_sendmsg,
1494	.recvmsg = vsock_dgram_recvmsg,
1495	.mmap = sock_no_mmap,
1496	.read_skb = vsock_read_skb,
1497	};
1498
1499	static int vsock_transport_cancel_pkt(struct vsock_sock *vsk)
1500	{
1501	const struct vsock_transport *transport = vsk->transport;
1502
1503	if (!transport || !transport->cancel_pkt)
1504	return -EOPNOTSUPP;
1505
1506	return transport->cancel_pkt(vsk);
1507	}
1508
1509	static void vsock_connect_timeout(struct work_struct *work)
1510	{
1511	struct sock *sk;
1512	struct vsock_sock *vsk;
1513
1514	vsk = container_of(work, struct vsock_sock, connect_work.work);
1515	sk = sk_vsock(vsk);
1516
1517	lock_sock(sk);
1518	if (sk->sk_state == TCP_SYN_SENT &&
1519	(sk->sk_shutdown != SHUTDOWN_MASK)) {
1520	sk->sk_state = TCP_CLOSE;
1521	sk->sk_socket->state = SS_UNCONNECTED;
1522	sk->sk_err = ETIMEDOUT;
1523	sk_error_report(sk);
1524	vsock_transport_cancel_pkt(vsk);
1525	}
1526	release_sock(sk);
1527
1528	sock_put(sk);
1529	}
1530
1531	static int vsock_connect(struct socket *sock, struct sockaddr_unsized *addr,
1532	int addr_len, int flags)
1533	{
1534	int err;
1535	struct sock *sk;
1536	struct vsock_sock *vsk;
1537	const struct vsock_transport *transport;
1538	struct sockaddr_vm *remote_addr;
1539	long timeout;
1540	DEFINE_WAIT(wait);
1541
1542	err = 0;
1543	sk = sock->sk;
1544	vsk = vsock_sk(sk);
1545
1546	lock_sock(sk);
1547
1548	/* XXX AF_UNSPEC should make us disconnect like AF_INET. */
1549	switch (sock->state) {
1550	case SS_CONNECTED:
1551	err = -EISCONN;
1552	goto out;
1553	case SS_DISCONNECTING:
1554	err = -EINVAL;
1555	goto out;
1556	case SS_CONNECTING:
1557	/* This continues on so we can move sock into the SS_CONNECTED
1558	* state once the connection has completed (at which point err
1559	* will be set to zero also). Otherwise, we will either wait
1560	* for the connection or return -EALREADY should this be a
1561	* non-blocking call.
1562	*/
1563	err = -EALREADY;
1564	if (flags & O_NONBLOCK)
1565	goto out;
1566	break;
1567	default:
1568	if ((sk->sk_state == TCP_LISTEN) ||
1569	vsock_addr_cast(addr, len: addr_len, out_addr: &remote_addr) != 0) {
1570	err = -EINVAL;
1571	goto out;
1572	}
1573
1574	/* Set the remote address that we are connecting to. */
1575	memcpy(&vsk->remote_addr, remote_addr,
1576	sizeof(vsk->remote_addr));
1577
1578	err = vsock_assign_transport(vsk, NULL);
1579	if (err)
1580	goto out;
1581
1582	transport = vsk->transport;
1583
1584	/* The hypervisor and well-known contexts do not have socket
1585	* endpoints.
1586	*/
1587	if (!transport ||
1588	!transport->stream_allow(remote_addr->svm_cid,
1589	remote_addr->svm_port)) {
1590	err = -ENETUNREACH;
1591	goto out;
1592	}
1593
1594	if (vsock_msgzerocopy_allow(t: transport)) {
1595	set_bit(nr: SOCK_SUPPORT_ZC, addr: &sk->sk_socket->flags);
1596	} else if (sock_flag(sk, flag: SOCK_ZEROCOPY)) {
1597	/* If this option was set before 'connect()',
1598	* when transport was unknown, check that this
1599	* feature is supported here.
1600	*/
1601	err = -EOPNOTSUPP;
1602	goto out;
1603	}
1604
1605	err = vsock_auto_bind(vsk);
1606	if (err)
1607	goto out;
1608
1609	sk->sk_state = TCP_SYN_SENT;
1610
1611	err = transport->connect(vsk);
1612	if (err < 0)
1613	goto out;
1614
1615	/* sk_err might have been set as a result of an earlier
1616	* (failed) connect attempt.
1617	*/
1618	sk->sk_err = 0;
1619
1620	/* Mark sock as connecting and set the error code to in
1621	* progress in case this is a non-blocking connect.
1622	*/
1623	sock->state = SS_CONNECTING;
1624	err = -EINPROGRESS;
1625	}
1626
1627	/* The receive path will handle all communication until we are able to
1628	* enter the connected state. Here we wait for the connection to be
1629	* completed or a notification of an error.
1630	*/
1631	timeout = vsk->connect_timeout;
1632	prepare_to_wait(wq_head: sk_sleep(sk), wq_entry: &wait, TASK_INTERRUPTIBLE);
1633
1634	/* If the socket is already closing or it is in an error state, there
1635	* is no point in waiting.
1636	*/
1637	while (sk->sk_state != TCP_ESTABLISHED &&
1638	sk->sk_state != TCP_CLOSING && sk->sk_err == 0) {
1639	if (flags & O_NONBLOCK) {
1640	/* If we're not going to block, we schedule a timeout
1641	* function to generate a timeout on the connection
1642	* attempt, in case the peer doesn't respond in a
1643	* timely manner. We hold on to the socket until the
1644	* timeout fires.
1645	*/
1646	sock_hold(sk);
1647
1648	/* If the timeout function is already scheduled,
1649	* reschedule it, then ungrab the socket refcount to
1650	* keep it balanced.
1651	*/
1652	if (mod_delayed_work(wq: system_percpu_wq, dwork: &vsk->connect_work,
1653	delay: timeout))
1654	sock_put(sk);
1655
1656	/* Skip ahead to preserve error code set above. */
1657	goto out_wait;
1658	}
1659
1660	release_sock(sk);
1661	timeout = schedule_timeout(timeout);
1662	lock_sock(sk);
1663
1664	/* Connection established. Whatever happens to socket once we
1665	* release it, that's not connect()'s concern. No need to go
1666	* into signal and timeout handling. Call it a day.
1667	*
1668	* Note that allowing to "reset" an already established socket
1669	* here is racy and insecure.
1670	*/
1671	if (sk->sk_state == TCP_ESTABLISHED)
1672	break;
1673
1674	/* If connection was _not_ established and a signal/timeout came
1675	* to be, we want the socket's state reset. User space may want
1676	* to retry.
1677	*
1678	* sk_state != TCP_ESTABLISHED implies that socket is not on
1679	* vsock_connected_table. We keep the binding and the transport
1680	* assigned.
1681	*/
1682	if (signal_pending(current) || timeout == 0) {
1683	err = timeout == 0 ? -ETIMEDOUT : sock_intr_errno(timeo: timeout);
1684
1685	/* Listener might have already responded with
1686	* VIRTIO_VSOCK_OP_RESPONSE. Its handling expects our
1687	* sk_state == TCP_SYN_SENT, which hereby we break.
1688	* In such case VIRTIO_VSOCK_OP_RST will follow.
1689	*/
1690	sk->sk_state = TCP_CLOSE;
1691	sock->state = SS_UNCONNECTED;
1692
1693	/* Try to cancel VIRTIO_VSOCK_OP_REQUEST skb sent out by
1694	* transport->connect().
1695	*/
1696	vsock_transport_cancel_pkt(vsk);
1697
1698	goto out_wait;
1699	}
1700
1701	prepare_to_wait(wq_head: sk_sleep(sk), wq_entry: &wait, TASK_INTERRUPTIBLE);
1702	}
1703
1704	if (sk->sk_err) {
1705	err = -sk->sk_err;
1706	sk->sk_state = TCP_CLOSE;
1707	sock->state = SS_UNCONNECTED;
1708	} else {
1709	err = 0;
1710	}
1711
1712	out_wait:
1713	finish_wait(wq_head: sk_sleep(sk), wq_entry: &wait);
1714	out:
1715	release_sock(sk);
1716	return err;
1717	}
1718
1719	static int vsock_accept(struct socket *sock, struct socket *newsock,
1720	struct proto_accept_arg *arg)
1721	{
1722	struct sock *listener;
1723	int err;
1724	struct sock *connected;
1725	struct vsock_sock *vconnected;
1726	long timeout;
1727	DEFINE_WAIT(wait);
1728
1729	err = 0;
1730	listener = sock->sk;
1731
1732	lock_sock(sk: listener);
1733
1734	if (!sock_type_connectible(type: sock->type)) {
1735	err = -EOPNOTSUPP;
1736	goto out;
1737	}
1738
1739	if (listener->sk_state != TCP_LISTEN) {
1740	err = -EINVAL;
1741	goto out;
1742	}
1743
1744	/* Wait for children sockets to appear; these are the new sockets
1745	* created upon connection establishment.
1746	*/
1747	timeout = sock_rcvtimeo(sk: listener, noblock: arg->flags & O_NONBLOCK);
1748	prepare_to_wait(wq_head: sk_sleep(sk: listener), wq_entry: &wait, TASK_INTERRUPTIBLE);
1749
1750	while ((connected = vsock_dequeue_accept(listener)) == NULL &&
1751	listener->sk_err == 0) {
1752	release_sock(sk: listener);
1753	timeout = schedule_timeout(timeout);
1754	finish_wait(wq_head: sk_sleep(sk: listener), wq_entry: &wait);
1755	lock_sock(sk: listener);
1756
1757	if (signal_pending(current)) {
1758	err = sock_intr_errno(timeo: timeout);
1759	goto out;
1760	} else if (timeout == 0) {
1761	err = -EAGAIN;
1762	goto out;
1763	}
1764
1765	prepare_to_wait(wq_head: sk_sleep(sk: listener), wq_entry: &wait, TASK_INTERRUPTIBLE);
1766	}
1767	finish_wait(wq_head: sk_sleep(sk: listener), wq_entry: &wait);
1768
1769	if (listener->sk_err)
1770	err = -listener->sk_err;
1771
1772	if (connected) {
1773	sk_acceptq_removed(sk: listener);
1774
1775	lock_sock_nested(sk: connected, SINGLE_DEPTH_NESTING);
1776	vconnected = vsock_sk(connected);
1777
1778	/* If the listener socket has received an error, then we should
1779	* reject this socket and return. Note that we simply mark the
1780	* socket rejected, drop our reference, and let the cleanup
1781	* function handle the cleanup; the fact that we found it in
1782	* the listener's accept queue guarantees that the cleanup
1783	* function hasn't run yet.
1784	*/
1785	if (err) {
1786	vconnected->rejected = true;
1787	} else {
1788	newsock->state = SS_CONNECTED;
1789	sock_graft(sk: connected, parent: newsock);
1790
1791	set_bit(nr: SOCK_CUSTOM_SOCKOPT,
1792	addr: &connected->sk_socket->flags);
1793
1794	if (vsock_msgzerocopy_allow(t: vconnected->transport))
1795	set_bit(nr: SOCK_SUPPORT_ZC,
1796	addr: &connected->sk_socket->flags);
1797	}
1798
1799	release_sock(sk: connected);
1800	sock_put(sk: connected);
1801	}
1802
1803	out:
1804	release_sock(sk: listener);
1805	return err;
1806	}
1807
1808	static int vsock_listen(struct socket *sock, int backlog)
1809	{
1810	int err;
1811	struct sock *sk;
1812	struct vsock_sock *vsk;
1813
1814	sk = sock->sk;
1815
1816	lock_sock(sk);
1817
1818	if (!sock_type_connectible(type: sk->sk_type)) {
1819	err = -EOPNOTSUPP;
1820	goto out;
1821	}
1822
1823	if (sock->state != SS_UNCONNECTED) {
1824	err = -EINVAL;
1825	goto out;
1826	}
1827
1828	vsk = vsock_sk(sk);
1829
1830	if (!vsock_addr_bound(addr: &vsk->local_addr)) {
1831	err = -EINVAL;
1832	goto out;
1833	}
1834
1835	sk->sk_max_ack_backlog = backlog;
1836	sk->sk_state = TCP_LISTEN;
1837
1838	err = 0;
1839
1840	out:
1841	release_sock(sk);
1842	return err;
1843	}
1844
1845	static void vsock_update_buffer_size(struct vsock_sock *vsk,
1846	const struct vsock_transport *transport,
1847	u64 val)
1848	{
1849	if (val > vsk->buffer_max_size)
1850	val = vsk->buffer_max_size;
1851
1852	if (val < vsk->buffer_min_size)
1853	val = vsk->buffer_min_size;
1854
1855	if (val != vsk->buffer_size &&
1856	transport && transport->notify_buffer_size)
1857	transport->notify_buffer_size(vsk, &val);
1858
1859	vsk->buffer_size = val;
1860	}
1861
1862	static int vsock_connectible_setsockopt(struct socket *sock,
1863	int level,
1864	int optname,
1865	sockptr_t optval,
1866	unsigned int optlen)
1867	{
1868	int err;
1869	struct sock *sk;
1870	struct vsock_sock *vsk;
1871	const struct vsock_transport *transport;
1872	u64 val;
1873
1874	if (level != AF_VSOCK && level != SOL_SOCKET)
1875	return -ENOPROTOOPT;
1876
1877	#define COPY_IN(_v) \
1878	do { \
1879	if (optlen < sizeof(_v)) { \
1880	err = -EINVAL; \
1881	goto exit; \
1882	} \
1883	if (copy_from_sockptr(&_v, optval, sizeof(_v)) != 0) { \
1884	err = -EFAULT; \
1885	goto exit; \
1886	} \
1887	} while (0)
1888
1889	err = 0;
1890	sk = sock->sk;
1891	vsk = vsock_sk(sk);
1892
1893	lock_sock(sk);
1894
1895	transport = vsk->transport;
1896
1897	if (level == SOL_SOCKET) {
1898	int zerocopy;
1899
1900	if (optname != SO_ZEROCOPY) {
1901	release_sock(sk);
1902	return sock_setsockopt(sock, level, op: optname, optval, optlen);
1903	}
1904
1905	/* Use 'int' type here, because variable to
1906	* set this option usually has this type.
1907	*/
1908	COPY_IN(zerocopy);
1909
1910	if (zerocopy < 0 || zerocopy > 1) {
1911	err = -EINVAL;
1912	goto exit;
1913	}
1914
1915	if (transport && !vsock_msgzerocopy_allow(t: transport)) {
1916	err = -EOPNOTSUPP;
1917	goto exit;
1918	}
1919
1920	sock_valbool_flag(sk, bit: SOCK_ZEROCOPY, valbool: zerocopy);
1921	goto exit;
1922	}
1923
1924	switch (optname) {
1925	case SO_VM_SOCKETS_BUFFER_SIZE:
1926	COPY_IN(val);
1927	vsock_update_buffer_size(vsk, transport, val);
1928	break;
1929
1930	case SO_VM_SOCKETS_BUFFER_MAX_SIZE:
1931	COPY_IN(val);
1932	vsk->buffer_max_size = val;
1933	vsock_update_buffer_size(vsk, transport, val: vsk->buffer_size);
1934	break;
1935
1936	case SO_VM_SOCKETS_BUFFER_MIN_SIZE:
1937	COPY_IN(val);
1938	vsk->buffer_min_size = val;
1939	vsock_update_buffer_size(vsk, transport, val: vsk->buffer_size);
1940	break;
1941
1942	case SO_VM_SOCKETS_CONNECT_TIMEOUT_NEW:
1943	case SO_VM_SOCKETS_CONNECT_TIMEOUT_OLD: {
1944	struct __kernel_sock_timeval tv;
1945
1946	err = sock_copy_user_timeval(tv: &tv, optval, optlen,
1947	old_timeval: optname == SO_VM_SOCKETS_CONNECT_TIMEOUT_OLD);
1948	if (err)
1949	break;
1950	if (tv.tv_sec >= 0 && tv.tv_usec < USEC_PER_SEC &&
1951	tv.tv_sec < (MAX_SCHEDULE_TIMEOUT / HZ - 1)) {
1952	vsk->connect_timeout = tv.tv_sec * HZ +
1953	DIV_ROUND_UP((unsigned long)tv.tv_usec, (USEC_PER_SEC / HZ));
1954	if (vsk->connect_timeout == 0)
1955	vsk->connect_timeout =
1956	VSOCK_DEFAULT_CONNECT_TIMEOUT;
1957
1958	} else {
1959	err = -ERANGE;
1960	}
1961	break;
1962	}
1963
1964	default:
1965	err = -ENOPROTOOPT;
1966	break;
1967	}
1968
1969	#undef COPY_IN
1970
1971	exit:
1972	release_sock(sk);
1973	return err;
1974	}
1975
1976	static int vsock_connectible_getsockopt(struct socket *sock,
1977	int level, int optname,
1978	char __user *optval,
1979	int __user *optlen)
1980	{
1981	struct sock *sk = sock->sk;
1982	struct vsock_sock *vsk = vsock_sk(sk);
1983
1984	union {
1985	u64 val64;
1986	struct old_timeval32 tm32;
1987	struct __kernel_old_timeval tm;
1988	struct __kernel_sock_timeval stm;
1989	} v;
1990
1991	int lv = sizeof(v.val64);
1992	int len;
1993
1994	if (level != AF_VSOCK)
1995	return -ENOPROTOOPT;
1996
1997	if (get_user(len, optlen))
1998	return -EFAULT;
1999
2000	memset(&v, 0, sizeof(v));
2001
2002	switch (optname) {
2003	case SO_VM_SOCKETS_BUFFER_SIZE:
2004	v.val64 = vsk->buffer_size;
2005	break;
2006
2007	case SO_VM_SOCKETS_BUFFER_MAX_SIZE:
2008	v.val64 = vsk->buffer_max_size;
2009	break;
2010
2011	case SO_VM_SOCKETS_BUFFER_MIN_SIZE:
2012	v.val64 = vsk->buffer_min_size;
2013	break;
2014
2015	case SO_VM_SOCKETS_CONNECT_TIMEOUT_NEW:
2016	case SO_VM_SOCKETS_CONNECT_TIMEOUT_OLD:
2017	lv = sock_get_timeout(timeo: vsk->connect_timeout, optval: &v,
2018	old_timeval: optname == SO_VM_SOCKETS_CONNECT_TIMEOUT_OLD);
2019	break;
2020
2021	default:
2022	return -ENOPROTOOPT;
2023	}
2024
2025	if (len < lv)
2026	return -EINVAL;
2027	if (len > lv)
2028	len = lv;
2029	if (copy_to_user(to: optval, from: &v, n: len))
2030	return -EFAULT;
2031
2032	if (put_user(len, optlen))
2033	return -EFAULT;
2034
2035	return 0;
2036	}
2037
2038	static int vsock_connectible_sendmsg(struct socket *sock, struct msghdr *msg,
2039	size_t len)
2040	{
2041	struct sock *sk;
2042	struct vsock_sock *vsk;
2043	const struct vsock_transport *transport;
2044	ssize_t total_written;
2045	long timeout;
2046	int err;
2047	struct vsock_transport_send_notify_data send_data;
2048	DEFINE_WAIT_FUNC(wait, woken_wake_function);
2049
2050	sk = sock->sk;
2051	vsk = vsock_sk(sk);
2052	total_written = 0;
2053	err = 0;
2054
2055	if (msg->msg_flags & MSG_OOB)
2056	return -EOPNOTSUPP;
2057
2058	lock_sock(sk);
2059
2060	transport = vsk->transport;
2061
2062	/* Callers should not provide a destination with connection oriented
2063	* sockets.
2064	*/
2065	if (msg->msg_namelen) {
2066	err = sk->sk_state == TCP_ESTABLISHED ? -EISCONN : -EOPNOTSUPP;
2067	goto out;
2068	}
2069
2070	/* Send data only if both sides are not shutdown in the direction. */
2071	if (sk->sk_shutdown & SEND_SHUTDOWN ||
2072	vsk->peer_shutdown & RCV_SHUTDOWN) {
2073	err = -EPIPE;
2074	goto out;
2075	}
2076
2077	if (!transport || sk->sk_state != TCP_ESTABLISHED ||
2078	!vsock_addr_bound(addr: &vsk->local_addr)) {
2079	err = -ENOTCONN;
2080	goto out;
2081	}
2082
2083	if (!vsock_addr_bound(addr: &vsk->remote_addr)) {
2084	err = -EDESTADDRREQ;
2085	goto out;
2086	}
2087
2088	if (msg->msg_flags & MSG_ZEROCOPY &&
2089	!vsock_msgzerocopy_allow(t: transport)) {
2090	err = -EOPNOTSUPP;
2091	goto out;
2092	}
2093
2094	/* Wait for room in the produce queue to enqueue our user's data. */
2095	timeout = sock_sndtimeo(sk, noblock: msg->msg_flags & MSG_DONTWAIT);
2096
2097	err = transport->notify_send_init(vsk, &send_data);
2098	if (err < 0)
2099	goto out;
2100
2101	while (total_written < len) {
2102	ssize_t written;
2103
2104	add_wait_queue(wq_head: sk_sleep(sk), wq_entry: &wait);
2105	while (vsock_stream_has_space(vsk) == 0 &&
2106	sk->sk_err == 0 &&
2107	!(sk->sk_shutdown & SEND_SHUTDOWN) &&
2108	!(vsk->peer_shutdown & RCV_SHUTDOWN)) {
2109
2110	/* Don't wait for non-blocking sockets. */
2111	if (timeout == 0) {
2112	err = -EAGAIN;
2113	remove_wait_queue(wq_head: sk_sleep(sk), wq_entry: &wait);
2114	goto out_err;
2115	}
2116
2117	err = transport->notify_send_pre_block(vsk, &send_data);
2118	if (err < 0) {
2119	remove_wait_queue(wq_head: sk_sleep(sk), wq_entry: &wait);
2120	goto out_err;
2121	}
2122
2123	release_sock(sk);
2124	timeout = wait_woken(wq_entry: &wait, TASK_INTERRUPTIBLE, timeout);
2125	lock_sock(sk);
2126	if (signal_pending(current)) {
2127	err = sock_intr_errno(timeo: timeout);
2128	remove_wait_queue(wq_head: sk_sleep(sk), wq_entry: &wait);
2129	goto out_err;
2130	} else if (timeout == 0) {
2131	err = -EAGAIN;
2132	remove_wait_queue(wq_head: sk_sleep(sk), wq_entry: &wait);
2133	goto out_err;
2134	}
2135	}
2136	remove_wait_queue(wq_head: sk_sleep(sk), wq_entry: &wait);
2137
2138	/* These checks occur both as part of and after the loop
2139	* conditional since we need to check before and after
2140	* sleeping.
2141	*/
2142	if (sk->sk_err) {
2143	err = -sk->sk_err;
2144	goto out_err;
2145	} else if ((sk->sk_shutdown & SEND_SHUTDOWN) ||
2146	(vsk->peer_shutdown & RCV_SHUTDOWN)) {
2147	err = -EPIPE;
2148	goto out_err;
2149	}
2150
2151	err = transport->notify_send_pre_enqueue(vsk, &send_data);
2152	if (err < 0)
2153	goto out_err;
2154
2155	/* Note that enqueue will only write as many bytes as are free
2156	* in the produce queue, so we don't need to ensure len is
2157	* smaller than the queue size. It is the caller's
2158	* responsibility to check how many bytes we were able to send.
2159	*/
2160
2161	if (sk->sk_type == SOCK_SEQPACKET) {
2162	written = transport->seqpacket_enqueue(vsk,
2163	msg, len - total_written);
2164	} else {
2165	written = transport->stream_enqueue(vsk,
2166	msg, len - total_written);
2167	}
2168
2169	if (written < 0) {
2170	err = written;
2171	goto out_err;
2172	}
2173
2174	total_written += written;
2175
2176	err = transport->notify_send_post_enqueue(
2177	vsk, written, &send_data);
2178	if (err < 0)
2179	goto out_err;
2180
2181	}
2182
2183	out_err:
2184	if (total_written > 0) {
2185	/* Return number of written bytes only if:
2186	* 1) SOCK_STREAM socket.
2187	* 2) SOCK_SEQPACKET socket when whole buffer is sent.
2188	*/
2189	if (sk->sk_type == SOCK_STREAM || total_written == len)
2190	err = total_written;
2191	}
2192	out:
2193	if (sk->sk_type == SOCK_STREAM)
2194	err = sk_stream_error(sk, flags: msg->msg_flags, err);
2195
2196	release_sock(sk);
2197	return err;
2198	}
2199
2200	static int vsock_connectible_wait_data(struct sock *sk,
2201	struct wait_queue_entry *wait,
2202	long timeout,
2203	struct vsock_transport_recv_notify_data *recv_data,
2204	size_t target)
2205	{
2206	const struct vsock_transport *transport;
2207	struct vsock_sock *vsk;
2208	s64 data;
2209	int err;
2210
2211	vsk = vsock_sk(sk);
2212	err = 0;
2213	transport = vsk->transport;
2214
2215	while (1) {
2216	prepare_to_wait(wq_head: sk_sleep(sk), wq_entry: wait, TASK_INTERRUPTIBLE);
2217	data = vsock_connectible_has_data(vsk);
2218	if (data != 0)
2219	break;
2220
2221	if (sk->sk_err != 0 ||
2222	(sk->sk_shutdown & RCV_SHUTDOWN) ||
2223	(vsk->peer_shutdown & SEND_SHUTDOWN)) {
2224	break;
2225	}
2226
2227	/* Don't wait for non-blocking sockets. */
2228	if (timeout == 0) {
2229	err = -EAGAIN;
2230	break;
2231	}
2232
2233	if (recv_data) {
2234	err = transport->notify_recv_pre_block(vsk, target, recv_data);
2235	if (err < 0)
2236	break;
2237	}
2238
2239	release_sock(sk);
2240	timeout = schedule_timeout(timeout);
2241	lock_sock(sk);
2242
2243	if (signal_pending(current)) {
2244	err = sock_intr_errno(timeo: timeout);
2245	break;
2246	} else if (timeout == 0) {
2247	err = -EAGAIN;
2248	break;
2249	}
2250	}
2251
2252	finish_wait(wq_head: sk_sleep(sk), wq_entry: wait);
2253
2254	if (err)
2255	return err;
2256
2257	/* Internal transport error when checking for available
2258	* data. XXX This should be changed to a connection
2259	* reset in a later change.
2260	*/
2261	if (data < 0)
2262	return -ENOMEM;
2263
2264	return data;
2265	}
2266
2267	static int __vsock_stream_recvmsg(struct sock *sk, struct msghdr *msg,
2268	size_t len, int flags)
2269	{
2270	struct vsock_transport_recv_notify_data recv_data;
2271	const struct vsock_transport *transport;
2272	struct vsock_sock *vsk;
2273	ssize_t copied;
2274	size_t target;
2275	long timeout;
2276	int err;
2277
2278	DEFINE_WAIT(wait);
2279
2280	vsk = vsock_sk(sk);
2281	transport = vsk->transport;
2282
2283	/* We must not copy less than target bytes into the user's buffer
2284	* before returning successfully, so we wait for the consume queue to
2285	* have that much data to consume before dequeueing. Note that this
2286	* makes it impossible to handle cases where target is greater than the
2287	* queue size.
2288	*/
2289	target = sock_rcvlowat(sk, waitall: flags & MSG_WAITALL, len);
2290	if (target >= transport->stream_rcvhiwat(vsk)) {
2291	err = -ENOMEM;
2292	goto out;
2293	}
2294	timeout = sock_rcvtimeo(sk, noblock: flags & MSG_DONTWAIT);
2295	copied = 0;
2296
2297	err = transport->notify_recv_init(vsk, target, &recv_data);
2298	if (err < 0)
2299	goto out;
2300
2301
2302	while (1) {
2303	ssize_t read;
2304
2305	err = vsock_connectible_wait_data(sk, wait: &wait, timeout,
2306	recv_data: &recv_data, target);
2307	if (err <= 0)
2308	break;
2309
2310	err = transport->notify_recv_pre_dequeue(vsk, target,
2311	&recv_data);
2312	if (err < 0)
2313	break;
2314
2315	read = transport->stream_dequeue(vsk, msg, len - copied, flags);
2316	if (read < 0) {
2317	err = read;
2318	break;
2319	}
2320
2321	copied += read;
2322
2323	err = transport->notify_recv_post_dequeue(vsk, target, read,
2324	!(flags & MSG_PEEK), &recv_data);
2325	if (err < 0)
2326	goto out;
2327
2328	if (read >= target || flags & MSG_PEEK)
2329	break;
2330
2331	target -= read;
2332	}
2333
2334	if (sk->sk_err)
2335	err = -sk->sk_err;
2336	else if (sk->sk_shutdown & RCV_SHUTDOWN)
2337	err = 0;
2338
2339	if (copied > 0)
2340	err = copied;
2341
2342	out:
2343	return err;
2344	}
2345
2346	static int __vsock_seqpacket_recvmsg(struct sock *sk, struct msghdr *msg,
2347	size_t len, int flags)
2348	{
2349	const struct vsock_transport *transport;
2350	struct vsock_sock *vsk;
2351	ssize_t msg_len;
2352	long timeout;
2353	int err = 0;
2354	DEFINE_WAIT(wait);
2355
2356	vsk = vsock_sk(sk);
2357	transport = vsk->transport;
2358
2359	timeout = sock_rcvtimeo(sk, noblock: flags & MSG_DONTWAIT);
2360
2361	err = vsock_connectible_wait_data(sk, wait: &wait, timeout, NULL, target: 0);
2362	if (err <= 0)
2363	goto out;
2364
2365	msg_len = transport->seqpacket_dequeue(vsk, msg, flags);
2366
2367	if (msg_len < 0) {
2368	err = msg_len;
2369	goto out;
2370	}
2371
2372	if (sk->sk_err) {
2373	err = -sk->sk_err;
2374	} else if (sk->sk_shutdown & RCV_SHUTDOWN) {
2375	err = 0;
2376	} else {
2377	/* User sets MSG_TRUNC, so return real length of
2378	* packet.
2379	*/
2380	if (flags & MSG_TRUNC)
2381	err = msg_len;
2382	else
2383	err = len - msg_data_left(msg);
2384
2385	/* Always set MSG_TRUNC if real length of packet is
2386	* bigger than user's buffer.
2387	*/
2388	if (msg_len > len)
2389	msg->msg_flags |= MSG_TRUNC;
2390	}
2391
2392	out:
2393	return err;
2394	}
2395
2396	int
2397	__vsock_connectible_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,
2398	int flags)
2399	{
2400	struct sock *sk;
2401	struct vsock_sock *vsk;
2402	const struct vsock_transport *transport;
2403	int err;
2404
2405	sk = sock->sk;
2406
2407	if (unlikely(flags & MSG_ERRQUEUE))
2408	return sock_recv_errqueue(sk, msg, len, SOL_VSOCK, VSOCK_RECVERR);
2409
2410	vsk = vsock_sk(sk);
2411	err = 0;
2412
2413	lock_sock(sk);
2414
2415	transport = vsk->transport;
2416
2417	if (!transport || sk->sk_state != TCP_ESTABLISHED) {
2418	/* Recvmsg is supposed to return 0 if a peer performs an
2419	* orderly shutdown. Differentiate between that case and when a
2420	* peer has not connected or a local shutdown occurred with the
2421	* SOCK_DONE flag.
2422	*/
2423	if (sock_flag(sk, flag: SOCK_DONE))
2424	err = 0;
2425	else
2426	err = -ENOTCONN;
2427
2428	goto out;
2429	}
2430
2431	if (flags & MSG_OOB) {
2432	err = -EOPNOTSUPP;
2433	goto out;
2434	}
2435
2436	/* We don't check peer_shutdown flag here since peer may actually shut
2437	* down, but there can be data in the queue that a local socket can
2438	* receive.
2439	*/
2440	if (sk->sk_shutdown & RCV_SHUTDOWN) {
2441	err = 0;
2442	goto out;
2443	}
2444
2445	/* It is valid on Linux to pass in a zero-length receive buffer. This
2446	* is not an error. We may as well bail out now.
2447	*/
2448	if (!len) {
2449	err = 0;
2450	goto out;
2451	}
2452
2453	if (sk->sk_type == SOCK_STREAM)
2454	err = __vsock_stream_recvmsg(sk, msg, len, flags);
2455	else
2456	err = __vsock_seqpacket_recvmsg(sk, msg, len, flags);
2457
2458	out:
2459	release_sock(sk);
2460	return err;
2461	}
2462
2463	int
2464	vsock_connectible_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,
2465	int flags)
2466	{
2467	#ifdef CONFIG_BPF_SYSCALL
2468	struct sock *sk = sock->sk;
2469	const struct proto *prot;
2470
2471	prot = READ_ONCE(sk->sk_prot);
2472	if (prot != &vsock_proto)
2473	return prot->recvmsg(sk, msg, len, flags, NULL);
2474	#endif
2475
2476	return __vsock_connectible_recvmsg(sock, msg, len, flags);
2477	}
2478	EXPORT_SYMBOL_GPL(vsock_connectible_recvmsg);
2479
2480	static int vsock_set_rcvlowat(struct sock *sk, int val)
2481	{
2482	const struct vsock_transport *transport;
2483	struct vsock_sock *vsk;
2484
2485	vsk = vsock_sk(sk);
2486
2487	if (val > vsk->buffer_size)
2488	return -EINVAL;
2489
2490	transport = vsk->transport;
2491
2492	if (transport && transport->notify_set_rcvlowat) {
2493	int err;
2494
2495	err = transport->notify_set_rcvlowat(vsk, val);
2496	if (err)
2497	return err;
2498	}
2499
2500	WRITE_ONCE(sk->sk_rcvlowat, val ? : 1);
2501	return 0;
2502	}
2503
2504	static const struct proto_ops vsock_stream_ops = {
2505	.family = PF_VSOCK,
2506	.owner = THIS_MODULE,
2507	.release = vsock_release,
2508	.bind = vsock_bind,
2509	.connect = vsock_connect,
2510	.socketpair = sock_no_socketpair,
2511	.accept = vsock_accept,
2512	.getname = vsock_getname,
2513	.poll = vsock_poll,
2514	.ioctl = vsock_ioctl,
2515	.listen = vsock_listen,
2516	.shutdown = vsock_shutdown,
2517	.setsockopt = vsock_connectible_setsockopt,
2518	.getsockopt = vsock_connectible_getsockopt,
2519	.sendmsg = vsock_connectible_sendmsg,
2520	.recvmsg = vsock_connectible_recvmsg,
2521	.mmap = sock_no_mmap,
2522	.set_rcvlowat = vsock_set_rcvlowat,
2523	.read_skb = vsock_read_skb,
2524	};
2525
2526	static const struct proto_ops vsock_seqpacket_ops = {
2527	.family = PF_VSOCK,
2528	.owner = THIS_MODULE,
2529	.release = vsock_release,
2530	.bind = vsock_bind,
2531	.connect = vsock_connect,
2532	.socketpair = sock_no_socketpair,
2533	.accept = vsock_accept,
2534	.getname = vsock_getname,
2535	.poll = vsock_poll,
2536	.ioctl = vsock_ioctl,
2537	.listen = vsock_listen,
2538	.shutdown = vsock_shutdown,
2539	.setsockopt = vsock_connectible_setsockopt,
2540	.getsockopt = vsock_connectible_getsockopt,
2541	.sendmsg = vsock_connectible_sendmsg,
2542	.recvmsg = vsock_connectible_recvmsg,
2543	.mmap = sock_no_mmap,
2544	.read_skb = vsock_read_skb,
2545	};
2546
2547	static int vsock_create(struct net *net, struct socket *sock,
2548	int protocol, int kern)
2549	{
2550	struct vsock_sock *vsk;
2551	struct sock *sk;
2552	int ret;
2553
2554	if (!sock)
2555	return -EINVAL;
2556
2557	if (protocol && protocol != PF_VSOCK)
2558	return -EPROTONOSUPPORT;
2559
2560	switch (sock->type) {
2561	case SOCK_DGRAM:
2562	sock->ops = &vsock_dgram_ops;
2563	break;
2564	case SOCK_STREAM:
2565	sock->ops = &vsock_stream_ops;
2566	break;
2567	case SOCK_SEQPACKET:
2568	sock->ops = &vsock_seqpacket_ops;
2569	break;
2570	default:
2571	return -ESOCKTNOSUPPORT;
2572	}
2573
2574	sock->state = SS_UNCONNECTED;
2575
2576	sk = __vsock_create(net, sock, NULL, GFP_KERNEL, type: 0, kern);
2577	if (!sk)
2578	return -ENOMEM;
2579
2580	vsk = vsock_sk(sk);
2581
2582	if (sock->type == SOCK_DGRAM) {
2583	ret = vsock_assign_transport(vsk, NULL);
2584	if (ret < 0) {
2585	sock->sk = NULL;
2586	sock_put(sk);
2587	return ret;
2588	}
2589	}
2590
2591	/* SOCK_DGRAM doesn't have 'setsockopt' callback set in its
2592	* proto_ops, so there is no handler for custom logic.
2593	*/
2594	if (sock_type_connectible(type: sock->type))
2595	set_bit(nr: SOCK_CUSTOM_SOCKOPT, addr: &sk->sk_socket->flags);
2596
2597	vsock_insert_unbound(vsk);
2598
2599	return 0;
2600	}
2601
2602	static const struct net_proto_family vsock_family_ops = {
2603	.family = AF_VSOCK,
2604	.create = vsock_create,
2605	.owner = THIS_MODULE,
2606	};
2607
2608	static long vsock_dev_do_ioctl(struct file *filp,
2609	unsigned int cmd, void __user *ptr)
2610	{
2611	u32 __user *p = ptr;
2612	int retval = 0;
2613	u32 cid;
2614
2615	switch (cmd) {
2616	case IOCTL_VM_SOCKETS_GET_LOCAL_CID:
2617	/* To be compatible with the VMCI behavior, we prioritize the
2618	* guest CID instead of well-know host CID (VMADDR_CID_HOST).
2619	*/
2620	cid = vsock_registered_transport_cid(transport: &transport_g2h);
2621	if (cid == VMADDR_CID_ANY)
2622	cid = vsock_registered_transport_cid(transport: &transport_h2g);
2623	if (cid == VMADDR_CID_ANY)
2624	cid = vsock_registered_transport_cid(transport: &transport_local);
2625
2626	if (put_user(cid, p) != 0)
2627	retval = -EFAULT;
2628	break;
2629
2630	default:
2631	retval = -ENOIOCTLCMD;
2632	}
2633
2634	return retval;
2635	}
2636
2637	static long vsock_dev_ioctl(struct file *filp,
2638	unsigned int cmd, unsigned long arg)
2639	{
2640	return vsock_dev_do_ioctl(filp, cmd, ptr: (void __user *)arg);
2641	}
2642
2643	#ifdef CONFIG_COMPAT
2644	static long vsock_dev_compat_ioctl(struct file *filp,
2645	unsigned int cmd, unsigned long arg)
2646	{
2647	return vsock_dev_do_ioctl(filp, cmd, ptr: compat_ptr(uptr: arg));
2648	}
2649	#endif
2650
2651	static const struct file_operations vsock_device_ops = {
2652	.owner = THIS_MODULE,
2653	.unlocked_ioctl = vsock_dev_ioctl,
2654	#ifdef CONFIG_COMPAT
2655	.compat_ioctl = vsock_dev_compat_ioctl,
2656	#endif
2657	.open = nonseekable_open,
2658	};
2659
2660	static struct miscdevice vsock_device = {
2661	.name = "vsock",
2662	.fops = &vsock_device_ops,
2663	};
2664
2665	static int __init vsock_init(void)
2666	{
2667	int err = 0;
2668
2669	vsock_init_tables();
2670
2671	vsock_proto.owner = THIS_MODULE;
2672	vsock_device.minor = MISC_DYNAMIC_MINOR;
2673	err = misc_register(misc: &vsock_device);
2674	if (err) {
2675	pr_err("Failed to register misc device\n");
2676	goto err_reset_transport;
2677	}
2678
2679	err = proto_register(prot: &vsock_proto, alloc_slab: 1); /* we want our slab */
2680	if (err) {
2681	pr_err("Cannot register vsock protocol\n");
2682	goto err_deregister_misc;
2683	}
2684
2685	err = sock_register(fam: &vsock_family_ops);
2686	if (err) {
2687	pr_err("could not register af_vsock (%d) address family: %d\n",
2688	AF_VSOCK, err);
2689	goto err_unregister_proto;
2690	}
2691
2692	vsock_bpf_build_proto();
2693
2694	return 0;
2695
2696	err_unregister_proto:
2697	proto_unregister(prot: &vsock_proto);
2698	err_deregister_misc:
2699	misc_deregister(misc: &vsock_device);
2700	err_reset_transport:
2701	return err;
2702	}
2703
2704	static void __exit vsock_exit(void)
2705	{
2706	misc_deregister(misc: &vsock_device);
2707	sock_unregister(AF_VSOCK);
2708	proto_unregister(prot: &vsock_proto);
2709	}
2710
2711	const struct vsock_transport *vsock_core_get_transport(struct vsock_sock *vsk)
2712	{
2713	return vsk->transport;
2714	}
2715	EXPORT_SYMBOL_GPL(vsock_core_get_transport);
2716
2717	int vsock_core_register(const struct vsock_transport *t, int features)
2718	{
2719	const struct vsock_transport *t_h2g, *t_g2h, *t_dgram, *t_local;
2720	int err = mutex_lock_interruptible(&vsock_register_mutex);
2721
2722	if (err)
2723	return err;
2724
2725	t_h2g = transport_h2g;
2726	t_g2h = transport_g2h;
2727	t_dgram = transport_dgram;
2728	t_local = transport_local;
2729
2730	if (features & VSOCK_TRANSPORT_F_H2G) {
2731	if (t_h2g) {
2732	err = -EBUSY;
2733	goto err_busy;
2734	}
2735	t_h2g = t;
2736	}
2737
2738	if (features & VSOCK_TRANSPORT_F_G2H) {
2739	if (t_g2h) {
2740	err = -EBUSY;
2741	goto err_busy;
2742	}
2743	t_g2h = t;
2744	}
2745
2746	if (features & VSOCK_TRANSPORT_F_DGRAM) {
2747	if (t_dgram) {
2748	err = -EBUSY;
2749	goto err_busy;
2750	}
2751	t_dgram = t;
2752	}
2753
2754	if (features & VSOCK_TRANSPORT_F_LOCAL) {
2755	if (t_local) {
2756	err = -EBUSY;
2757	goto err_busy;
2758	}
2759	t_local = t;
2760	}
2761
2762	transport_h2g = t_h2g;
2763	transport_g2h = t_g2h;
2764	transport_dgram = t_dgram;
2765	transport_local = t_local;
2766
2767	err_busy:
2768	mutex_unlock(lock: &vsock_register_mutex);
2769	return err;
2770	}
2771	EXPORT_SYMBOL_GPL(vsock_core_register);
2772
2773	void vsock_core_unregister(const struct vsock_transport *t)
2774	{
2775	mutex_lock(&vsock_register_mutex);
2776
2777	if (transport_h2g == t)
2778	transport_h2g = NULL;
2779
2780	if (transport_g2h == t)
2781	transport_g2h = NULL;
2782
2783	if (transport_dgram == t)
2784	transport_dgram = NULL;
2785
2786	if (transport_local == t)
2787	transport_local = NULL;
2788
2789	mutex_unlock(lock: &vsock_register_mutex);
2790	}
2791	EXPORT_SYMBOL_GPL(vsock_core_unregister);
2792
2793	module_init(vsock_init);
2794	module_exit(vsock_exit);
2795
2796	MODULE_AUTHOR("VMware, Inc.");
2797	MODULE_DESCRIPTION("VMware Virtual Socket Family");
2798	MODULE_VERSION("1.0.2.0-k");
2799	MODULE_LICENSE("GPL v2");
2800