net/phonet/pep.c

   1 /*
   2  * File: pep.c
   3  *
   4  * Phonet pipe protocol end point socket
   5  *
   6  * Copyright (C) 2008 Nokia Corporation.
   7  *
   8  * Author: Rémi Denis-Courmont
   9  *
  10  * This program is free software; you can redistribute it and/or
  11  * modify it under the terms of the GNU General Public License
  12  * version 2 as published by the Free Software Foundation.
  13  *
  14  * This program is distributed in the hope that it will be useful, but
  15  * WITHOUT ANY WARRANTY; without even the implied warranty of
  16  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  17  * General Public License for more details.
  18  *
  19  * You should have received a copy of the GNU General Public License
  20  * along with this program; if not, write to the Free Software
  21  * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
  22  * 02110-1301 USA
  23  */
  24
  25 #include <linux/kernel.h>
  26 #include <linux/sched/signal.h>
  27 #include <linux/slab.h>
  28 #include <linux/socket.h>
  29 #include <net/sock.h>
  30 #include <net/tcp_states.h>
  31 #include <asm/ioctls.h>
  32
  33 #include <linux/phonet.h>
  34 #include <linux/module.h>
  35 #include <net/phonet/phonet.h>
  36 #include <net/phonet/pep.h>
  37 #include <net/phonet/gprs.h>
  38
  39 /* sk_state values:
  40  * TCP_CLOSE            sock not in use yet
  41  * TCP_CLOSE_WAIT       disconnected pipe
  42  * TCP_LISTEN           listening pipe endpoint
  43  * TCP_SYN_RECV         connected pipe in disabled state
  44  * TCP_ESTABLISHED      connected pipe in enabled state
  45  *
  46  * pep_sock locking:
  47  *  - sk_state, hlist: sock lock needed
  48  *  - listener: read only
  49  *  - pipe_handle: read only
  50  */
  51
  52 #define CREDITS_MAX     10
  53 #define CREDITS_THR     7
  54
  55 #define pep_sb_size(s) (((s) + 5) & ~3) /* 2-bytes head, 32-bits aligned */
  56
  57 /* Get the next TLV sub-block. */
  58 static unsigned char *pep_get_sb(struct sk_buff *skb, u8 *ptype, u8 *plen,
  59                                         void *buf)
  60 {
  61         void *data = NULL;
  62         struct {
  63                 u8 sb_type;
  64                 u8 sb_len;
  65         } *ph, h;
  66         int buflen = *plen;
  67
  68         ph = skb_header_pointer(skb, 0, 2, &h);
  69         if (ph == NULL || ph->sb_len < 2 || !pskb_may_pull(skb, ph->sb_len))
  70                 return NULL;
  71         ph->sb_len -= 2;
  72         *ptype = ph->sb_type;
  73         *plen = ph->sb_len;
  74
  75         if (buflen > ph->sb_len)
  76                 buflen = ph->sb_len;
  77         data = skb_header_pointer(skb, 2, buflen, buf);
  78         __skb_pull(skb, 2 + ph->sb_len);
  79         return data;
  80 }
  81
  82 static struct sk_buff *pep_alloc_skb(struct sock *sk, const void *payload,
  83                                         int len, gfp_t priority)
  84 {
  85         struct sk_buff *skb = alloc_skb(MAX_PNPIPE_HEADER + len, priority);
  86         if (!skb)
  87                 return NULL;
  88         skb_set_owner_w(skb, sk);
  89
  90         skb_reserve(skb, MAX_PNPIPE_HEADER);
  91         __skb_put(skb, len);
  92         skb_copy_to_linear_data(skb, payload, len);
  93         __skb_push(skb, sizeof(struct pnpipehdr));
  94         skb_reset_transport_header(skb);
  95         return skb;
  96 }
  97
  98 static int pep_reply(struct sock *sk, struct sk_buff *oskb, u8 code,
  99                         const void *data, int len, gfp_t priority)
 100 {
 101         const struct pnpipehdr *oph = pnp_hdr(oskb);
 102         struct pnpipehdr *ph;
 103         struct sk_buff *skb;
 104         struct sockaddr_pn peer;
 105
 106         skb = pep_alloc_skb(sk, data, len, priority);
 107         if (!skb)
 108                 return -ENOMEM;
 109
 110         ph = pnp_hdr(skb);
 111         ph->utid = oph->utid;
 112         ph->message_id = oph->message_id + 1; /* REQ -> RESP */
 113         ph->pipe_handle = oph->pipe_handle;
 114         ph->error_code = code;
 115
 116         pn_skb_get_src_sockaddr(oskb, &peer);
 117         return pn_skb_send(sk, skb, &peer);
 118 }
 119
 120 static int pep_indicate(struct sock *sk, u8 id, u8 code,
 121                         const void *data, int len, gfp_t priority)
 122 {
 123         struct pep_sock *pn = pep_sk(sk);
 124         struct pnpipehdr *ph;
 125         struct sk_buff *skb;
 126
 127         skb = pep_alloc_skb(sk, data, len, priority);
 128         if (!skb)
 129                 return -ENOMEM;
 130
 131         ph = pnp_hdr(skb);
 132         ph->utid = 0;
 133         ph->message_id = id;
 134         ph->pipe_handle = pn->pipe_handle;
 135         ph->data[0] = code;
 136         return pn_skb_send(sk, skb, NULL);
 137 }
 138
 139 #define PAD 0x00
 140
 141 static int pipe_handler_request(struct sock *sk, u8 id, u8 code,
 142                                 const void *data, int len)
 143 {
 144         struct pep_sock *pn = pep_sk(sk);
 145         struct pnpipehdr *ph;
 146         struct sk_buff *skb;
 147
 148         skb = pep_alloc_skb(sk, data, len, GFP_KERNEL);
 149         if (!skb)
 150                 return -ENOMEM;
 151
 152         ph = pnp_hdr(skb);
 153         ph->utid = id; /* whatever */
 154         ph->message_id = id;
 155         ph->pipe_handle = pn->pipe_handle;
 156         ph->data[0] = code;
 157         return pn_skb_send(sk, skb, NULL);
 158 }
 159
 160 static int pipe_handler_send_created_ind(struct sock *sk)
 161 {
 162         struct pep_sock *pn = pep_sk(sk);
 163         u8 data[4] = {
 164                 PN_PIPE_SB_NEGOTIATED_FC, pep_sb_size(2),
 165                 pn->tx_fc, pn->rx_fc,
 166         };
 167
 168         return pep_indicate(sk, PNS_PIPE_CREATED_IND, 1 /* sub-blocks */,
 169                                 data, 4, GFP_ATOMIC);
 170 }
 171
 172 static int pep_accept_conn(struct sock *sk, struct sk_buff *skb)
 173 {
 174         static const u8 data[20] = {
 175                 PAD, PAD, PAD, 2 /* sub-blocks */,
 176                 PN_PIPE_SB_REQUIRED_FC_TX, pep_sb_size(5), 3, PAD,
 177                         PN_MULTI_CREDIT_FLOW_CONTROL,
 178                         PN_ONE_CREDIT_FLOW_CONTROL,
 179                         PN_LEGACY_FLOW_CONTROL,
 180                         PAD,
 181                 PN_PIPE_SB_PREFERRED_FC_RX, pep_sb_size(5), 3, PAD,
 182                         PN_MULTI_CREDIT_FLOW_CONTROL,
 183                         PN_ONE_CREDIT_FLOW_CONTROL,
 184                         PN_LEGACY_FLOW_CONTROL,
 185                         PAD,
 186         };
 187
 188         might_sleep();
 189         return pep_reply(sk, skb, PN_PIPE_NO_ERROR, data, sizeof(data),
 190                                 GFP_KERNEL);
 191 }
 192
 193 static int pep_reject_conn(struct sock *sk, struct sk_buff *skb, u8 code,
 194                                 gfp_t priority)
 195 {
 196         static const u8 data[4] = { PAD, PAD, PAD, 0 /* sub-blocks */ };
 197         WARN_ON(code == PN_PIPE_NO_ERROR);
 198         return pep_reply(sk, skb, code, data, sizeof(data), priority);
 199 }
 200
 201 /* Control requests are not sent by the pipe service and have a specific
 202  * message format. */
 203 static int pep_ctrlreq_error(struct sock *sk, struct sk_buff *oskb, u8 code,
 204                                 gfp_t priority)
 205 {
 206         const struct pnpipehdr *oph = pnp_hdr(oskb);
 207         struct sk_buff *skb;
 208         struct pnpipehdr *ph;
 209         struct sockaddr_pn dst;
 210         u8 data[4] = {
 211                 oph->data[0], /* PEP type */
 212                 code, /* error code, at an unusual offset */
 213                 PAD, PAD,
 214         };
 215
 216         skb = pep_alloc_skb(sk, data, 4, priority);
 217         if (!skb)
 218                 return -ENOMEM;
 219
 220         ph = pnp_hdr(skb);
 221         ph->utid = oph->utid;
 222         ph->message_id = PNS_PEP_CTRL_RESP;
 223         ph->pipe_handle = oph->pipe_handle;
 224         ph->data[0] = oph->data[1]; /* CTRL id */
 225
 226         pn_skb_get_src_sockaddr(oskb, &dst);
 227         return pn_skb_send(sk, skb, &dst);
 228 }
 229
 230 static int pipe_snd_status(struct sock *sk, u8 type, u8 status, gfp_t priority)
 231 {
 232         u8 data[4] = { type, PAD, PAD, status };
 233
 234         return pep_indicate(sk, PNS_PEP_STATUS_IND, PN_PEP_TYPE_COMMON,
 235                                 data, 4, priority);
 236 }
 237
 238 /* Send our RX flow control information to the sender.
 239  * Socket must be locked. */
 240 static void pipe_grant_credits(struct sock *sk, gfp_t priority)
 241 {
 242         struct pep_sock *pn = pep_sk(sk);
 243
 244         BUG_ON(sk->sk_state != TCP_ESTABLISHED);
 245
 246         switch (pn->rx_fc) {
 247         case PN_LEGACY_FLOW_CONTROL: /* TODO */
 248                 break;
 249         case PN_ONE_CREDIT_FLOW_CONTROL:
 250                 if (pipe_snd_status(sk, PN_PEP_IND_FLOW_CONTROL,
 251                                         PEP_IND_READY, priority) == 0)
 252                         pn->rx_credits = 1;
 253                 break;
 254         case PN_MULTI_CREDIT_FLOW_CONTROL:
 255                 if ((pn->rx_credits + CREDITS_THR) > CREDITS_MAX)
 256                         break;
 257                 if (pipe_snd_status(sk, PN_PEP_IND_ID_MCFC_GRANT_CREDITS,
 258                                         CREDITS_MAX - pn->rx_credits,
 259                                         priority) == 0)
 260                         pn->rx_credits = CREDITS_MAX;
 261                 break;
 262         }
 263 }
 264
 265 static int pipe_rcv_status(struct sock *sk, struct sk_buff *skb)
 266 {
 267         struct pep_sock *pn = pep_sk(sk);
 268         struct pnpipehdr *hdr;
 269         int wake = 0;
 270
 271         if (!pskb_may_pull(skb, sizeof(*hdr) + 4))
 272                 return -EINVAL;
 273
 274         hdr = pnp_hdr(skb);
 275         if (hdr->data[0] != PN_PEP_TYPE_COMMON) {
 276                 net_dbg_ratelimited("Phonet unknown PEP type: %u\n",
 277                                     (unsigned int)hdr->data[0]);
 278                 return -EOPNOTSUPP;
 279         }
 280
 281         switch (hdr->data[1]) {
 282         case PN_PEP_IND_FLOW_CONTROL:
 283                 switch (pn->tx_fc) {
 284                 case PN_LEGACY_FLOW_CONTROL:
 285                         switch (hdr->data[4]) {
 286                         case PEP_IND_BUSY:
 287                                 atomic_set(&pn->tx_credits, 0);
 288                                 break;
 289                         case PEP_IND_READY:
 290                                 atomic_set(&pn->tx_credits, wake = 1);
 291                                 break;
 292                         }
 293                         break;
 294                 case PN_ONE_CREDIT_FLOW_CONTROL:
 295                         if (hdr->data[4] == PEP_IND_READY)
 296                                 atomic_set(&pn->tx_credits, wake = 1);
 297                         break;
 298                 }
 299                 break;
 300
 301         case PN_PEP_IND_ID_MCFC_GRANT_CREDITS:
 302                 if (pn->tx_fc != PN_MULTI_CREDIT_FLOW_CONTROL)
 303                         break;
 304                 atomic_add(wake = hdr->data[4], &pn->tx_credits);
 305                 break;
 306
 307         default:
 308                 net_dbg_ratelimited("Phonet unknown PEP indication: %u\n",
 309                                     (unsigned int)hdr->data[1]);
 310                 return -EOPNOTSUPP;
 311         }
 312         if (wake)
 313                 sk->sk_write_space(sk);
 314         return 0;
 315 }
 316
 317 static int pipe_rcv_created(struct sock *sk, struct sk_buff *skb)
 318 {
 319         struct pep_sock *pn = pep_sk(sk);
 320         struct pnpipehdr *hdr = pnp_hdr(skb);
 321         u8 n_sb = hdr->data[0];
 322
 323         pn->rx_fc = pn->tx_fc = PN_LEGACY_FLOW_CONTROL;
 324         __skb_pull(skb, sizeof(*hdr));
 325         while (n_sb > 0) {
 326                 u8 type, buf[2], len = sizeof(buf);
 327                 u8 *data = pep_get_sb(skb, &type, &len, buf);
 328
 329                 if (data == NULL)
 330                         return -EINVAL;
 331                 switch (type) {
 332                 case PN_PIPE_SB_NEGOTIATED_FC:
 333                         if (len < 2 || (data[0] | data[1]) > 3)
 334                                 break;
 335                         pn->tx_fc = data[0] & 3;
 336                         pn->rx_fc = data[1] & 3;
 337                         break;
 338                 }
 339                 n_sb--;
 340         }
 341         return 0;
 342 }
 343
 344 /* Queue an skb to a connected sock.
 345  * Socket lock must be held. */
 346 static int pipe_do_rcv(struct sock *sk, struct sk_buff *skb)
 347 {
 348         struct pep_sock *pn = pep_sk(sk);
 349         struct pnpipehdr *hdr = pnp_hdr(skb);
 350         struct sk_buff_head *queue;
 351         int err = 0;
 352
 353         BUG_ON(sk->sk_state == TCP_CLOSE_WAIT);
 354
 355         switch (hdr->message_id) {
 356         case PNS_PEP_CONNECT_REQ:
 357                 pep_reject_conn(sk, skb, PN_PIPE_ERR_PEP_IN_USE, GFP_ATOMIC);
 358                 break;
 359
 360         case PNS_PEP_DISCONNECT_REQ:
 361                 pep_reply(sk, skb, PN_PIPE_NO_ERROR, NULL, 0, GFP_ATOMIC);
 362                 sk->sk_state = TCP_CLOSE_WAIT;
 363                 if (!sock_flag(sk, SOCK_DEAD))
 364                         sk->sk_state_change(sk);
 365                 break;
 366
 367         case PNS_PEP_ENABLE_REQ:
 368                 /* Wait for PNS_PIPE_(ENABLED|REDIRECTED)_IND */
 369                 pep_reply(sk, skb, PN_PIPE_NO_ERROR, NULL, 0, GFP_ATOMIC);
 370                 break;
 371
 372         case PNS_PEP_RESET_REQ:
 373                 switch (hdr->state_after_reset) {
 374                 case PN_PIPE_DISABLE:
 375                         pn->init_enable = 0;
 376                         break;
 377                 case PN_PIPE_ENABLE:
 378                         pn->init_enable = 1;
 379                         break;
 380                 default: /* not allowed to send an error here!? */
 381                         err = -EINVAL;
 382                         goto out;
 383                 }
 384                 /* fall through */
 385         case PNS_PEP_DISABLE_REQ:
 386                 atomic_set(&pn->tx_credits, 0);
 387                 pep_reply(sk, skb, PN_PIPE_NO_ERROR, NULL, 0, GFP_ATOMIC);
 388                 break;
 389
 390         case PNS_PEP_CTRL_REQ:
 391                 if (skb_queue_len(&pn->ctrlreq_queue) >= PNPIPE_CTRLREQ_MAX) {
 392                         atomic_inc(&sk->sk_drops);
 393                         break;
 394                 }
 395                 __skb_pull(skb, 4);
 396                 queue = &pn->ctrlreq_queue;
 397                 goto queue;
 398
 399         case PNS_PIPE_ALIGNED_DATA:
 400                 __skb_pull(skb, 1);
 401                 /* fall through */
 402         case PNS_PIPE_DATA:
 403                 __skb_pull(skb, 3); /* Pipe data header */
 404                 if (!pn_flow_safe(pn->rx_fc)) {
 405                         err = sock_queue_rcv_skb(sk, skb);
 406                         if (!err)
 407                                 return NET_RX_SUCCESS;
 408                         err = -ENOBUFS;
 409                         break;
 410                 }
 411
 412                 if (pn->rx_credits == 0) {
 413                         atomic_inc(&sk->sk_drops);
 414                         err = -ENOBUFS;
 415                         break;
 416                 }
 417                 pn->rx_credits--;
 418                 queue = &sk->sk_receive_queue;
 419                 goto queue;
 420
 421         case PNS_PEP_STATUS_IND:
 422                 pipe_rcv_status(sk, skb);
 423                 break;
 424
 425         case PNS_PIPE_REDIRECTED_IND:
 426                 err = pipe_rcv_created(sk, skb);
 427                 break;
 428
 429         case PNS_PIPE_CREATED_IND:
 430                 err = pipe_rcv_created(sk, skb);
 431                 if (err)
 432                         break;
 433                 /* fall through */
 434         case PNS_PIPE_RESET_IND:
 435                 if (!pn->init_enable)
 436                         break;
 437                 /* fall through */
 438         case PNS_PIPE_ENABLED_IND:
 439                 if (!pn_flow_safe(pn->tx_fc)) {
 440                         atomic_set(&pn->tx_credits, 1);
 441                         sk->sk_write_space(sk);
 442                 }
 443                 if (sk->sk_state == TCP_ESTABLISHED)
 444                         break; /* Nothing to do */
 445                 sk->sk_state = TCP_ESTABLISHED;
 446                 pipe_grant_credits(sk, GFP_ATOMIC);
 447                 break;
 448
 449         case PNS_PIPE_DISABLED_IND:
 450                 sk->sk_state = TCP_SYN_RECV;
 451                 pn->rx_credits = 0;
 452                 break;
 453
 454         default:
 455                 net_dbg_ratelimited("Phonet unknown PEP message: %u\n",
 456                                     hdr->message_id);
 457                 err = -EINVAL;
 458         }
 459 out:
 460         kfree_skb(skb);
 461         return (err == -ENOBUFS) ? NET_RX_DROP : NET_RX_SUCCESS;
 462
 463 queue:
 464         skb->dev = NULL;
 465         skb_set_owner_r(skb, sk);
 466         skb_queue_tail(queue, skb);
 467         if (!sock_flag(sk, SOCK_DEAD))
 468                 sk->sk_data_ready(sk);
 469         return NET_RX_SUCCESS;
 470 }
 471
 472 /* Destroy connected sock. */
 473 static void pipe_destruct(struct sock *sk)
 474 {
 475         struct pep_sock *pn = pep_sk(sk);
 476
 477         skb_queue_purge(&sk->sk_receive_queue);
 478         skb_queue_purge(&pn->ctrlreq_queue);
 479 }
 480
 481 static u8 pipe_negotiate_fc(const u8 *fcs, unsigned int n)
 482 {
 483         unsigned int i;
 484         u8 final_fc = PN_NO_FLOW_CONTROL;
 485
 486         for (i = 0; i < n; i++) {
 487                 u8 fc = fcs[i];
 488
 489                 if (fc > final_fc && fc < PN_MAX_FLOW_CONTROL)
 490                         final_fc = fc;
 491         }
 492         return final_fc;
 493 }
 494
 495 static int pep_connresp_rcv(struct sock *sk, struct sk_buff *skb)
 496 {
 497         struct pep_sock *pn = pep_sk(sk);
 498         struct pnpipehdr *hdr;
 499         u8 n_sb;
 500
 501         if (!pskb_pull(skb, sizeof(*hdr) + 4))
 502                 return -EINVAL;
 503
 504         hdr = pnp_hdr(skb);
 505         if (hdr->error_code != PN_PIPE_NO_ERROR)
 506                 return -ECONNREFUSED;
 507
 508         /* Parse sub-blocks */
 509         n_sb = hdr->data[4];
 510         while (n_sb > 0) {
 511                 u8 type, buf[6], len = sizeof(buf);
 512                 const u8 *data = pep_get_sb(skb, &type, &len, buf);
 513
 514                 if (data == NULL)
 515                         return -EINVAL;
 516
 517                 switch (type) {
 518                 case PN_PIPE_SB_REQUIRED_FC_TX:
 519                         if (len < 2 || len < data[0])
 520                                 break;
 521                         pn->tx_fc = pipe_negotiate_fc(data + 2, len - 2);
 522                         break;
 523
 524                 case PN_PIPE_SB_PREFERRED_FC_RX:
 525                         if (len < 2 || len < data[0])
 526                                 break;
 527                         pn->rx_fc = pipe_negotiate_fc(data + 2, len - 2);
 528                         break;
 529
 530                 }
 531                 n_sb--;
 532         }
 533
 534         return pipe_handler_send_created_ind(sk);
 535 }
 536
 537 static int pep_enableresp_rcv(struct sock *sk, struct sk_buff *skb)
 538 {
 539         struct pnpipehdr *hdr = pnp_hdr(skb);
 540
 541         if (hdr->error_code != PN_PIPE_NO_ERROR)
 542                 return -ECONNREFUSED;
 543
 544         return pep_indicate(sk, PNS_PIPE_ENABLED_IND, 0 /* sub-blocks */,
 545                 NULL, 0, GFP_ATOMIC);
 546
 547 }
 548
 549 static void pipe_start_flow_control(struct sock *sk)
 550 {
 551         struct pep_sock *pn = pep_sk(sk);
 552
 553         if (!pn_flow_safe(pn->tx_fc)) {
 554                 atomic_set(&pn->tx_credits, 1);
 555                 sk->sk_write_space(sk);
 556         }
 557         pipe_grant_credits(sk, GFP_ATOMIC);
 558 }
 559
 560 /* Queue an skb to an actively connected sock.
 561  * Socket lock must be held. */
 562 static int pipe_handler_do_rcv(struct sock *sk, struct sk_buff *skb)
 563 {
 564         struct pep_sock *pn = pep_sk(sk);
 565         struct pnpipehdr *hdr = pnp_hdr(skb);
 566         int err = NET_RX_SUCCESS;
 567
 568         switch (hdr->message_id) {
 569         case PNS_PIPE_ALIGNED_DATA:
 570                 __skb_pull(skb, 1);
 571                 /* fall through */
 572         case PNS_PIPE_DATA:
 573                 __skb_pull(skb, 3); /* Pipe data header */
 574                 if (!pn_flow_safe(pn->rx_fc)) {
 575                         err = sock_queue_rcv_skb(sk, skb);
 576                         if (!err)
 577                                 return NET_RX_SUCCESS;
 578                         err = NET_RX_DROP;
 579                         break;
 580                 }
 581
 582                 if (pn->rx_credits == 0) {
 583                         atomic_inc(&sk->sk_drops);
 584                         err = NET_RX_DROP;
 585                         break;
 586                 }
 587                 pn->rx_credits--;
 588                 skb->dev = NULL;
 589                 skb_set_owner_r(skb, sk);
 590                 skb_queue_tail(&sk->sk_receive_queue, skb);
 591                 if (!sock_flag(sk, SOCK_DEAD))
 592                         sk->sk_data_ready(sk);
 593                 return NET_RX_SUCCESS;
 594
 595         case PNS_PEP_CONNECT_RESP:
 596                 if (sk->sk_state != TCP_SYN_SENT)
 597                         break;
 598                 if (!sock_flag(sk, SOCK_DEAD))
 599                         sk->sk_state_change(sk);
 600                 if (pep_connresp_rcv(sk, skb)) {
 601                         sk->sk_state = TCP_CLOSE_WAIT;
 602                         break;
 603                 }
 604                 if (pn->init_enable == PN_PIPE_DISABLE)
 605                         sk->sk_state = TCP_SYN_RECV;
 606                 else {
 607                         sk->sk_state = TCP_ESTABLISHED;
 608                         pipe_start_flow_control(sk);
 609                 }
 610                 break;
 611
 612         case PNS_PEP_ENABLE_RESP:
 613                 if (sk->sk_state != TCP_SYN_SENT)
 614                         break;
 615
 616                 if (pep_enableresp_rcv(sk, skb)) {
 617                         sk->sk_state = TCP_CLOSE_WAIT;
 618                         break;
 619                 }
 620
 621                 sk->sk_state = TCP_ESTABLISHED;
 622                 pipe_start_flow_control(sk);
 623                 break;
 624
 625         case PNS_PEP_DISCONNECT_RESP:
 626                 /* sock should already be dead, nothing to do */
 627                 break;
 628
 629         case PNS_PEP_STATUS_IND:
 630                 pipe_rcv_status(sk, skb);
 631                 break;
 632         }
 633         kfree_skb(skb);
 634         return err;
 635 }
 636
 637 /* Listening sock must be locked */
 638 static struct sock *pep_find_pipe(const struct hlist_head *hlist,
 639                                         const struct sockaddr_pn *dst,
 640                                         u8 pipe_handle)
 641 {
 642         struct sock *sknode;
 643         u16 dobj = pn_sockaddr_get_object(dst);
 644
 645         sk_for_each(sknode, hlist) {
 646                 struct pep_sock *pnnode = pep_sk(sknode);
 647
 648                 /* Ports match, but addresses might not: */
 649                 if (pnnode->pn_sk.sobject != dobj)
 650                         continue;
 651                 if (pnnode->pipe_handle != pipe_handle)
 652                         continue;
 653                 if (sknode->sk_state == TCP_CLOSE_WAIT)
 654                         continue;
 655
 656                 sock_hold(sknode);
 657                 return sknode;
 658         }
 659         return NULL;
 660 }
 661
 662 /*
 663  * Deliver an skb to a listening sock.
 664  * Socket lock must be held.
 665  * We then queue the skb to the right connected sock (if any).
 666  */
 667 static int pep_do_rcv(struct sock *sk, struct sk_buff *skb)
 668 {
 669         struct pep_sock *pn = pep_sk(sk);
 670         struct sock *sknode;
 671         struct pnpipehdr *hdr;
 672         struct sockaddr_pn dst;
 673         u8 pipe_handle;
 674
 675         if (!pskb_may_pull(skb, sizeof(*hdr)))
 676                 goto drop;
 677
 678         hdr = pnp_hdr(skb);
 679         pipe_handle = hdr->pipe_handle;
 680         if (pipe_handle == PN_PIPE_INVALID_HANDLE)
 681                 goto drop;
 682
 683         pn_skb_get_dst_sockaddr(skb, &dst);
 684
 685         /* Look for an existing pipe handle */
 686         sknode = pep_find_pipe(&pn->hlist, &dst, pipe_handle);
 687         if (sknode)
 688                 return sk_receive_skb(sknode, skb, 1);
 689
 690         switch (hdr->message_id) {
 691         case PNS_PEP_CONNECT_REQ:
 692                 if (sk->sk_state != TCP_LISTEN || sk_acceptq_is_full(sk)) {
 693                         pep_reject_conn(sk, skb, PN_PIPE_ERR_PEP_IN_USE,
 694                                         GFP_ATOMIC);
 695                         break;
 696                 }
 697                 skb_queue_head(&sk->sk_receive_queue, skb);
 698                 sk_acceptq_added(sk);
 699                 if (!sock_flag(sk, SOCK_DEAD))
 700                         sk->sk_data_ready(sk);
 701                 return NET_RX_SUCCESS;
 702
 703         case PNS_PEP_DISCONNECT_REQ:
 704                 pep_reply(sk, skb, PN_PIPE_NO_ERROR, NULL, 0, GFP_ATOMIC);
 705                 break;
 706
 707         case PNS_PEP_CTRL_REQ:
 708                 pep_ctrlreq_error(sk, skb, PN_PIPE_INVALID_HANDLE, GFP_ATOMIC);
 709                 break;
 710
 711         case PNS_PEP_RESET_REQ:
 712         case PNS_PEP_ENABLE_REQ:
 713         case PNS_PEP_DISABLE_REQ:
 714                 /* invalid handle is not even allowed here! */
 715                 break;
 716
 717         default:
 718                 if ((1 << sk->sk_state)
 719                                 & ~(TCPF_CLOSE|TCPF_LISTEN|TCPF_CLOSE_WAIT))
 720                         /* actively connected socket */
 721                         return pipe_handler_do_rcv(sk, skb);
 722         }
 723 drop:
 724         kfree_skb(skb);
 725         return NET_RX_SUCCESS;
 726 }
 727
 728 static int pipe_do_remove(struct sock *sk)
 729 {
 730         struct pep_sock *pn = pep_sk(sk);
 731         struct pnpipehdr *ph;
 732         struct sk_buff *skb;
 733
 734         skb = pep_alloc_skb(sk, NULL, 0, GFP_KERNEL);
 735         if (!skb)
 736                 return -ENOMEM;
 737
 738         ph = pnp_hdr(skb);
 739         ph->utid = 0;
 740         ph->message_id = PNS_PIPE_REMOVE_REQ;
 741         ph->pipe_handle = pn->pipe_handle;
 742         ph->data[0] = PAD;
 743         return pn_skb_send(sk, skb, NULL);
 744 }
 745
 746 /* associated socket ceases to exist */
 747 static void pep_sock_close(struct sock *sk, long timeout)
 748 {
 749         struct pep_sock *pn = pep_sk(sk);
 750         int ifindex = 0;
 751
 752         sock_hold(sk); /* keep a reference after sk_common_release() */
 753         sk_common_release(sk);
 754
 755         lock_sock(sk);
 756         if ((1 << sk->sk_state) & (TCPF_SYN_RECV|TCPF_ESTABLISHED)) {
 757                 if (sk->sk_backlog_rcv == pipe_do_rcv)
 758                         /* Forcefully remove dangling Phonet pipe */
 759                         pipe_do_remove(sk);
 760                 else
 761                         pipe_handler_request(sk, PNS_PEP_DISCONNECT_REQ, PAD,
 762                                                 NULL, 0);
 763         }
 764         sk->sk_state = TCP_CLOSE;
 765
 766         ifindex = pn->ifindex;
 767         pn->ifindex = 0;
 768         release_sock(sk);
 769
 770         if (ifindex)
 771                 gprs_detach(sk);
 772         sock_put(sk);
 773 }
 774
 775 static struct sock *pep_sock_accept(struct sock *sk, int flags, int *errp)
 776 {
 777         struct pep_sock *pn = pep_sk(sk), *newpn;
 778         struct sock *newsk = NULL;
 779         struct sk_buff *skb;
 780         struct pnpipehdr *hdr;
 781         struct sockaddr_pn dst, src;
 782         int err;
 783         u16 peer_type;
 784         u8 pipe_handle, enabled, n_sb;
 785         u8 aligned = 0;
 786
 787         skb = skb_recv_datagram(sk, 0, flags & O_NONBLOCK, errp);
 788         if (!skb)
 789                 return NULL;
 790
 791         lock_sock(sk);
 792         if (sk->sk_state != TCP_LISTEN) {
 793                 err = -EINVAL;
 794                 goto drop;
 795         }
 796         sk_acceptq_removed(sk);
 797
 798         err = -EPROTO;
 799         if (!pskb_may_pull(skb, sizeof(*hdr) + 4))
 800                 goto drop;
 801
 802         hdr = pnp_hdr(skb);
 803         pipe_handle = hdr->pipe_handle;
 804         switch (hdr->state_after_connect) {
 805         case PN_PIPE_DISABLE:
 806                 enabled = 0;
 807                 break;
 808         case PN_PIPE_ENABLE:
 809                 enabled = 1;
 810                 break;
 811         default:
 812                 pep_reject_conn(sk, skb, PN_PIPE_ERR_INVALID_PARAM,
 813                                 GFP_KERNEL);
 814                 goto drop;
 815         }
 816         peer_type = hdr->other_pep_type << 8;
 817
 818         /* Parse sub-blocks (options) */
 819         n_sb = hdr->data[4];
 820         while (n_sb > 0) {
 821                 u8 type, buf[1], len = sizeof(buf);
 822                 const u8 *data = pep_get_sb(skb, &type, &len, buf);
 823
 824                 if (data == NULL)
 825                         goto drop;
 826                 switch (type) {
 827                 case PN_PIPE_SB_CONNECT_REQ_PEP_SUB_TYPE:
 828                         if (len < 1)
 829                                 goto drop;
 830                         peer_type = (peer_type & 0xff00) | data[0];
 831                         break;
 832                 case PN_PIPE_SB_ALIGNED_DATA:
 833                         aligned = data[0] != 0;
 834                         break;
 835                 }
 836                 n_sb--;
 837         }
 838
 839         /* Check for duplicate pipe handle */
 840         newsk = pep_find_pipe(&pn->hlist, &dst, pipe_handle);
 841         if (unlikely(newsk)) {
 842                 __sock_put(newsk);
 843                 newsk = NULL;
 844                 pep_reject_conn(sk, skb, PN_PIPE_ERR_PEP_IN_USE, GFP_KERNEL);
 845                 goto drop;
 846         }
 847
 848         /* Create a new to-be-accepted sock */
 849         newsk = sk_alloc(sock_net(sk), PF_PHONET, GFP_KERNEL, sk->sk_prot, 0);
 850         if (!newsk) {
 851                 pep_reject_conn(sk, skb, PN_PIPE_ERR_OVERLOAD, GFP_KERNEL);
 852                 err = -ENOBUFS;
 853                 goto drop;
 854         }
 855
 856         sock_init_data(NULL, newsk);
 857         newsk->sk_state = TCP_SYN_RECV;
 858         newsk->sk_backlog_rcv = pipe_do_rcv;
 859         newsk->sk_protocol = sk->sk_protocol;
 860         newsk->sk_destruct = pipe_destruct;
 861
 862         newpn = pep_sk(newsk);
 863         pn_skb_get_dst_sockaddr(skb, &dst);
 864         pn_skb_get_src_sockaddr(skb, &src);
 865         newpn->pn_sk.sobject = pn_sockaddr_get_object(&dst);
 866         newpn->pn_sk.dobject = pn_sockaddr_get_object(&src);
 867         newpn->pn_sk.resource = pn_sockaddr_get_resource(&dst);
 868         sock_hold(sk);
 869         newpn->listener = sk;
 870         skb_queue_head_init(&newpn->ctrlreq_queue);
 871         newpn->pipe_handle = pipe_handle;
 872         atomic_set(&newpn->tx_credits, 0);
 873         newpn->ifindex = 0;
 874         newpn->peer_type = peer_type;
 875         newpn->rx_credits = 0;
 876         newpn->rx_fc = newpn->tx_fc = PN_LEGACY_FLOW_CONTROL;
 877         newpn->init_enable = enabled;
 878         newpn->aligned = aligned;
 879
 880         err = pep_accept_conn(newsk, skb);
 881         if (err) {
 882                 sock_put(newsk);
 883                 newsk = NULL;
 884                 goto drop;
 885         }
 886         sk_add_node(newsk, &pn->hlist);
 887 drop:
 888         release_sock(sk);
 889         kfree_skb(skb);
 890         *errp = err;
 891         return newsk;
 892 }
 893
 894 static int pep_sock_connect(struct sock *sk, struct sockaddr *addr, int len)
 895 {
 896         struct pep_sock *pn = pep_sk(sk);
 897         int err;
 898         u8 data[4] = { 0 /* sub-blocks */, PAD, PAD, PAD };
 899
 900         if (pn->pipe_handle == PN_PIPE_INVALID_HANDLE)
 901                 pn->pipe_handle = 1; /* anything but INVALID_HANDLE */
 902
 903         err = pipe_handler_request(sk, PNS_PEP_CONNECT_REQ,
 904                                 pn->init_enable, data, 4);
 905         if (err) {
 906                 pn->pipe_handle = PN_PIPE_INVALID_HANDLE;
 907                 return err;
 908         }
 909
 910         sk->sk_state = TCP_SYN_SENT;
 911
 912         return 0;
 913 }
 914
 915 static int pep_sock_enable(struct sock *sk, struct sockaddr *addr, int len)
 916 {
 917         int err;
 918
 919         err = pipe_handler_request(sk, PNS_PEP_ENABLE_REQ, PAD,
 920                                 NULL, 0);
 921         if (err)
 922                 return err;
 923
 924         sk->sk_state = TCP_SYN_SENT;
 925
 926         return 0;
 927 }
 928
 929 static int pep_ioctl(struct sock *sk, int cmd, unsigned long arg)
 930 {
 931         struct pep_sock *pn = pep_sk(sk);
 932         int answ;
 933         int ret = -ENOIOCTLCMD;
 934
 935         switch (cmd) {
 936         case SIOCINQ:
 937                 if (sk->sk_state == TCP_LISTEN) {
 938                         ret = -EINVAL;
 939                         break;
 940                 }
 941
 942                 lock_sock(sk);
 943                 if (sock_flag(sk, SOCK_URGINLINE) &&
 944                     !skb_queue_empty(&pn->ctrlreq_queue))
 945                         answ = skb_peek(&pn->ctrlreq_queue)->len;
 946                 else if (!skb_queue_empty(&sk->sk_receive_queue))
 947                         answ = skb_peek(&sk->sk_receive_queue)->len;
 948                 else
 949                         answ = 0;
 950                 release_sock(sk);
 951                 ret = put_user(answ, (int __user *)arg);
 952                 break;
 953
 954         case SIOCPNENABLEPIPE:
 955                 lock_sock(sk);
 956                 if (sk->sk_state == TCP_SYN_SENT)
 957                         ret =  -EBUSY;
 958                 else if (sk->sk_state == TCP_ESTABLISHED)
 959                         ret = -EISCONN;
 960                 else
 961                         ret = pep_sock_enable(sk, NULL, 0);
 962                 release_sock(sk);
 963                 break;
 964         }
 965
 966         return ret;
 967 }
 968
 969 static int pep_init(struct sock *sk)
 970 {
 971         struct pep_sock *pn = pep_sk(sk);
 972
 973         sk->sk_destruct = pipe_destruct;
 974         INIT_HLIST_HEAD(&pn->hlist);
 975         pn->listener = NULL;
 976         skb_queue_head_init(&pn->ctrlreq_queue);
 977         atomic_set(&pn->tx_credits, 0);
 978         pn->ifindex = 0;
 979         pn->peer_type = 0;
 980         pn->pipe_handle = PN_PIPE_INVALID_HANDLE;
 981         pn->rx_credits = 0;
 982         pn->rx_fc = pn->tx_fc = PN_LEGACY_FLOW_CONTROL;
 983         pn->init_enable = 1;
 984         pn->aligned = 0;
 985         return 0;
 986 }
 987
 988 static int pep_setsockopt(struct sock *sk, int level, int optname,
 989                                 char __user *optval, unsigned int optlen)
 990 {
 991         struct pep_sock *pn = pep_sk(sk);
 992         int val = 0, err = 0;
 993
 994         if (level != SOL_PNPIPE)
 995                 return -ENOPROTOOPT;
 996         if (optlen >= sizeof(int)) {
 997                 if (get_user(val, (int __user *) optval))
 998                         return -EFAULT;
 999         }
1000
1001         lock_sock(sk);
1002         switch (optname) {
1003         case PNPIPE_ENCAP:
1004                 if (val && val != PNPIPE_ENCAP_IP) {
1005                         err = -EINVAL;
1006                         break;
1007                 }
1008                 if (!pn->ifindex == !val)
1009                         break; /* Nothing to do! */
1010                 if (!capable(CAP_NET_ADMIN)) {
1011                         err = -EPERM;
1012                         break;
1013                 }
1014                 if (val) {
1015                         release_sock(sk);
1016                         err = gprs_attach(sk);
1017                         if (err > 0) {
1018                                 pn->ifindex = err;
1019                                 err = 0;
1020                         }
1021                 } else {
1022                         pn->ifindex = 0;
1023                         release_sock(sk);
1024                         gprs_detach(sk);
1025                         err = 0;
1026                 }
1027                 goto out_norel;
1028
1029         case PNPIPE_HANDLE:
1030                 if ((sk->sk_state == TCP_CLOSE) &&
1031                         (val >= 0) && (val < PN_PIPE_INVALID_HANDLE))
1032                         pn->pipe_handle = val;
1033                 else
1034                         err = -EINVAL;
1035                 break;
1036
1037         case PNPIPE_INITSTATE:
1038                 pn->init_enable = !!val;
1039                 break;
1040
1041         default:
1042                 err = -ENOPROTOOPT;
1043         }
1044         release_sock(sk);
1045
1046 out_norel:
1047         return err;
1048 }
1049
1050 static int pep_getsockopt(struct sock *sk, int level, int optname,
1051                                 char __user *optval, int __user *optlen)
1052 {
1053         struct pep_sock *pn = pep_sk(sk);
1054         int len, val;
1055
1056         if (level != SOL_PNPIPE)
1057                 return -ENOPROTOOPT;
1058         if (get_user(len, optlen))
1059                 return -EFAULT;
1060
1061         switch (optname) {
1062         case PNPIPE_ENCAP:
1063                 val = pn->ifindex ? PNPIPE_ENCAP_IP : PNPIPE_ENCAP_NONE;
1064                 break;
1065
1066         case PNPIPE_IFINDEX:
1067                 val = pn->ifindex;
1068                 break;
1069
1070         case PNPIPE_HANDLE:
1071                 val = pn->pipe_handle;
1072                 if (val == PN_PIPE_INVALID_HANDLE)
1073                         return -EINVAL;
1074                 break;
1075
1076         case PNPIPE_INITSTATE:
1077                 val = pn->init_enable;
1078                 break;
1079
1080         default:
1081                 return -ENOPROTOOPT;
1082         }
1083
1084         len = min_t(unsigned int, sizeof(int), len);
1085         if (put_user(len, optlen))
1086                 return -EFAULT;
1087         if (put_user(val, (int __user *) optval))
1088                 return -EFAULT;
1089         return 0;
1090 }
1091
1092 static int pipe_skb_send(struct sock *sk, struct sk_buff *skb)
1093 {
1094         struct pep_sock *pn = pep_sk(sk);
1095         struct pnpipehdr *ph;
1096         int err;
1097
1098         if (pn_flow_safe(pn->tx_fc) &&
1099             !atomic_add_unless(&pn->tx_credits, -1, 0)) {
1100                 kfree_skb(skb);
1101                 return -ENOBUFS;
1102         }
1103
1104         skb_push(skb, 3 + pn->aligned);
1105         skb_reset_transport_header(skb);
1106         ph = pnp_hdr(skb);
1107         ph->utid = 0;
1108         if (pn->aligned) {
1109                 ph->message_id = PNS_PIPE_ALIGNED_DATA;
1110                 ph->data[0] = 0; /* padding */
1111         } else
1112                 ph->message_id = PNS_PIPE_DATA;
1113         ph->pipe_handle = pn->pipe_handle;
1114         err = pn_skb_send(sk, skb, NULL);
1115
1116         if (err && pn_flow_safe(pn->tx_fc))
1117                 atomic_inc(&pn->tx_credits);
1118         return err;
1119
1120 }
1121
1122 static int pep_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)
1123 {
1124         struct pep_sock *pn = pep_sk(sk);
1125         struct sk_buff *skb;
1126         long timeo;
1127         int flags = msg->msg_flags;
1128         int err, done;
1129
1130         if (len > USHRT_MAX)
1131                 return -EMSGSIZE;
1132
1133         if ((msg->msg_flags & ~(MSG_DONTWAIT|MSG_EOR|MSG_NOSIGNAL|
1134                                 MSG_CMSG_COMPAT)) ||
1135                         !(msg->msg_flags & MSG_EOR))
1136                 return -EOPNOTSUPP;
1137
1138         skb = sock_alloc_send_skb(sk, MAX_PNPIPE_HEADER + len,
1139                                         flags & MSG_DONTWAIT, &err);
1140         if (!skb)
1141                 return err;
1142
1143         skb_reserve(skb, MAX_PHONET_HEADER + 3 + pn->aligned);
1144         err = memcpy_from_msg(skb_put(skb, len), msg, len);
1145         if (err < 0)
1146                 goto outfree;
1147
1148         lock_sock(sk);
1149         timeo = sock_sndtimeo(sk, flags & MSG_DONTWAIT);
1150         if ((1 << sk->sk_state) & (TCPF_LISTEN|TCPF_CLOSE)) {
1151                 err = -ENOTCONN;
1152                 goto out;
1153         }
1154         if (sk->sk_state != TCP_ESTABLISHED) {
1155                 /* Wait until the pipe gets to enabled state */
1156 disabled:
1157                 err = sk_stream_wait_connect(sk, &timeo);
1158                 if (err)
1159                         goto out;
1160
1161                 if (sk->sk_state == TCP_CLOSE_WAIT) {
1162                         err = -ECONNRESET;
1163                         goto out;
1164                 }
1165         }
1166         BUG_ON(sk->sk_state != TCP_ESTABLISHED);
1167
1168         /* Wait until flow control allows TX */
1169         done = atomic_read(&pn->tx_credits);
1170         while (!done) {
1171                 DEFINE_WAIT_FUNC(wait, woken_wake_function);
1172
1173                 if (!timeo) {
1174                         err = -EAGAIN;
1175                         goto out;
1176                 }
1177                 if (signal_pending(current)) {
1178                         err = sock_intr_errno(timeo);
1179                         goto out;
1180                 }
1181
1182                 add_wait_queue(sk_sleep(sk), &wait);
1183                 done = sk_wait_event(sk, &timeo, atomic_read(&pn->tx_credits), &wait);
1184                 remove_wait_queue(sk_sleep(sk), &wait);
1185
1186                 if (sk->sk_state != TCP_ESTABLISHED)
1187                         goto disabled;
1188         }
1189
1190         err = pipe_skb_send(sk, skb);
1191         if (err >= 0)
1192                 err = len; /* success! */
1193         skb = NULL;
1194 out:
1195         release_sock(sk);
1196 outfree:
1197         kfree_skb(skb);
1198         return err;
1199 }
1200
1201 int pep_writeable(struct sock *sk)
1202 {
1203         struct pep_sock *pn = pep_sk(sk);
1204
1205         return atomic_read(&pn->tx_credits);
1206 }
1207
1208 int pep_write(struct sock *sk, struct sk_buff *skb)
1209 {
1210         struct sk_buff *rskb, *fs;
1211         int flen = 0;
1212
1213         if (pep_sk(sk)->aligned)
1214                 return pipe_skb_send(sk, skb);
1215
1216         rskb = alloc_skb(MAX_PNPIPE_HEADER, GFP_ATOMIC);
1217         if (!rskb) {
1218                 kfree_skb(skb);
1219                 return -ENOMEM;
1220         }
1221         skb_shinfo(rskb)->frag_list = skb;
1222         rskb->len += skb->len;
1223         rskb->data_len += rskb->len;
1224         rskb->truesize += rskb->len;
1225
1226         /* Avoid nested fragments */
1227         skb_walk_frags(skb, fs)
1228                 flen += fs->len;
1229         skb->next = skb_shinfo(skb)->frag_list;
1230         skb_frag_list_init(skb);
1231         skb->len -= flen;
1232         skb->data_len -= flen;
1233         skb->truesize -= flen;
1234
1235         skb_reserve(rskb, MAX_PHONET_HEADER + 3);
1236         return pipe_skb_send(sk, rskb);
1237 }
1238
1239 struct sk_buff *pep_read(struct sock *sk)
1240 {
1241         struct sk_buff *skb = skb_dequeue(&sk->sk_receive_queue);
1242
1243         if (sk->sk_state == TCP_ESTABLISHED)
1244                 pipe_grant_credits(sk, GFP_ATOMIC);
1245         return skb;
1246 }
1247
1248 static int pep_recvmsg(struct sock *sk, struct msghdr *msg, size_t len,
1249                        int noblock, int flags, int *addr_len)
1250 {
1251         struct sk_buff *skb;
1252         int err;
1253
1254         if (flags & ~(MSG_OOB|MSG_PEEK|MSG_TRUNC|MSG_DONTWAIT|MSG_WAITALL|
1255                         MSG_NOSIGNAL|MSG_CMSG_COMPAT))
1256                 return -EOPNOTSUPP;
1257
1258         if (unlikely(1 << sk->sk_state & (TCPF_LISTEN | TCPF_CLOSE)))
1259                 return -ENOTCONN;
1260
1261         if ((flags & MSG_OOB) || sock_flag(sk, SOCK_URGINLINE)) {
1262                 /* Dequeue and acknowledge control request */
1263                 struct pep_sock *pn = pep_sk(sk);
1264
1265                 if (flags & MSG_PEEK)
1266                         return -EOPNOTSUPP;
1267                 skb = skb_dequeue(&pn->ctrlreq_queue);
1268                 if (skb) {
1269                         pep_ctrlreq_error(sk, skb, PN_PIPE_NO_ERROR,
1270                                                 GFP_KERNEL);
1271                         msg->msg_flags |= MSG_OOB;
1272                         goto copy;
1273                 }
1274                 if (flags & MSG_OOB)
1275                         return -EINVAL;
1276         }
1277
1278         skb = skb_recv_datagram(sk, flags, noblock, &err);
1279         lock_sock(sk);
1280         if (skb == NULL) {
1281                 if (err == -ENOTCONN && sk->sk_state == TCP_CLOSE_WAIT)
1282                         err = -ECONNRESET;
1283                 release_sock(sk);
1284                 return err;
1285         }
1286
1287         if (sk->sk_state == TCP_ESTABLISHED)
1288                 pipe_grant_credits(sk, GFP_KERNEL);
1289         release_sock(sk);
1290 copy:
1291         msg->msg_flags |= MSG_EOR;
1292         if (skb->len > len)
1293                 msg->msg_flags |= MSG_TRUNC;
1294         else
1295                 len = skb->len;
1296
1297         err = skb_copy_datagram_msg(skb, 0, msg, len);
1298         if (!err)
1299                 err = (flags & MSG_TRUNC) ? skb->len : len;
1300
1301         skb_free_datagram(sk, skb);
1302         return err;
1303 }
1304
1305 static void pep_sock_unhash(struct sock *sk)
1306 {
1307         struct pep_sock *pn = pep_sk(sk);
1308         struct sock *skparent = NULL;
1309
1310         lock_sock(sk);
1311
1312         if (pn->listener != NULL) {
1313                 skparent = pn->listener;
1314                 pn->listener = NULL;
1315                 release_sock(sk);
1316
1317                 pn = pep_sk(skparent);
1318                 lock_sock(skparent);
1319                 sk_del_node_init(sk);
1320                 sk = skparent;
1321         }
1322
1323         /* Unhash a listening sock only when it is closed
1324          * and all of its active connected pipes are closed. */
1325         if (hlist_empty(&pn->hlist))
1326                 pn_sock_unhash(&pn->pn_sk.sk);
1327         release_sock(sk);
1328
1329         if (skparent)
1330                 sock_put(skparent);
1331 }
1332
1333 static struct proto pep_proto = {
1334         .close          = pep_sock_close,
1335         .accept         = pep_sock_accept,
1336         .connect        = pep_sock_connect,
1337         .ioctl          = pep_ioctl,
1338         .init           = pep_init,
1339         .setsockopt     = pep_setsockopt,
1340         .getsockopt     = pep_getsockopt,
1341         .sendmsg        = pep_sendmsg,
1342         .recvmsg        = pep_recvmsg,
1343         .backlog_rcv    = pep_do_rcv,
1344         .hash           = pn_sock_hash,
1345         .unhash         = pep_sock_unhash,
1346         .get_port       = pn_sock_get_port,
1347         .obj_size       = sizeof(struct pep_sock),
1348         .owner          = THIS_MODULE,
1349         .name           = "PNPIPE",
1350 };
1351
1352 static struct phonet_protocol pep_pn_proto = {
1353         .ops            = &phonet_stream_ops,
1354         .prot           = &pep_proto,
1355         .sock_type      = SOCK_SEQPACKET,
1356 };
1357
1358 static int __init pep_register(void)
1359 {
1360         return phonet_proto_register(PN_PROTO_PIPE, &pep_pn_proto);
1361 }
1362
1363 static void __exit pep_unregister(void)
1364 {
1365         phonet_proto_unregister(PN_PROTO_PIPE, &pep_pn_proto);
1366 }
1367
1368 module_init(pep_register);
1369 module_exit(pep_unregister);
1370 MODULE_AUTHOR("Remi Denis-Courmont, Nokia");
1371 MODULE_DESCRIPTION("Phonet pipe protocol");
1372 MODULE_LICENSE("GPL");
1373 MODULE_ALIAS_NET_PF_PROTO(PF_PHONET, PN_PROTO_PIPE);