1// SPDX-License-Identifier: GPL-2.0-only 2/* 3 * File: pep.c 4 * 5 * Phonet pipe protocol end point socket 6 * 7 * Copyright (C) 2008 Nokia Corporation. 8 * 9 * Author: Rémi Denis-Courmont 10 */ 11 12#include <linux/kernel.h> 13#include <linux/sched/signal.h> 14#include <linux/slab.h> 15#include <linux/socket.h> 16#include <net/sock.h> 17#include <net/tcp_states.h> 18#include <asm/ioctls.h> 19 20#include <linux/phonet.h> 21#include <linux/module.h> 22#include <net/phonet/phonet.h> 23#include <net/phonet/pep.h> 24#include <net/phonet/gprs.h> 25 26/* sk_state values: 27 * TCP_CLOSE sock not in use yet 28 * TCP_CLOSE_WAIT disconnected pipe 29 * TCP_LISTEN listening pipe endpoint 30 * TCP_SYN_RECV connected pipe in disabled state 31 * TCP_ESTABLISHED connected pipe in enabled state 32 * 33 * pep_sock locking: 34 * - sk_state, hlist: sock lock needed 35 * - listener: read only 36 * - pipe_handle: read only 37 */ 38 39#define CREDITS_MAX 10 40#define CREDITS_THR 7 41 42#define pep_sb_size(s) (((s) + 5) & ~3) /* 2-bytes head, 32-bits aligned */ 43 44/* Get the next TLV sub-block. */ 45static unsigned char *pep_get_sb(struct sk_buff *skb, u8 *ptype, u8 *plen, 46 void *buf) 47{ 48 void *data = NULL; 49 struct { 50 u8 sb_type; 51 u8 sb_len; 52 } *ph, h; 53 int buflen = *plen; 54 55 ph = skb_header_pointer(skb, 0, 2, &h); 56 if (ph == NULL || ph->sb_len < 2 || !pskb_may_pull(skb, ph->sb_len)) 57 return NULL; 58 ph->sb_len -= 2; 59 *ptype = ph->sb_type; 60 *plen = ph->sb_len; 61 62 if (buflen > ph->sb_len) 63 buflen = ph->sb_len; 64 data = skb_header_pointer(skb, 2, buflen, buf); 65 __skb_pull(skb, 2 + ph->sb_len); 66 return data; 67} 68 69static struct sk_buff *pep_alloc_skb(struct sock *sk, const void *payload, 70 int len, gfp_t priority) 71{ 72 struct sk_buff *skb = alloc_skb(MAX_PNPIPE_HEADER + len, priority); 73 if (!skb) 74 return NULL; 75 skb_set_owner_w(skb, sk); 76 77 skb_reserve(skb, MAX_PNPIPE_HEADER); 78 __skb_put(skb, len); 79 skb_copy_to_linear_data(skb, payload, len); 80 __skb_push(skb, sizeof(struct pnpipehdr)); 81 skb_reset_transport_header(skb); 82 return skb; 83} 84 85static int pep_reply(struct sock *sk, struct sk_buff *oskb, u8 code, 86 const void *data, int len, gfp_t priority) 87{ 88 const struct pnpipehdr *oph = pnp_hdr(oskb); 89 struct pnpipehdr *ph; 90 struct sk_buff *skb; 91 struct sockaddr_pn peer; 92 93 skb = pep_alloc_skb(sk, data, len, priority); 94 if (!skb) 95 return -ENOMEM; 96 97 ph = pnp_hdr(skb); 98 ph->utid = oph->utid; 99 ph->message_id = oph->message_id + 1; /* REQ -> RESP */ 100 ph->pipe_handle = oph->pipe_handle; 101 ph->error_code = code; 102 103 pn_skb_get_src_sockaddr(oskb, &peer); 104 return pn_skb_send(sk, skb, &peer); 105} 106 107static int pep_indicate(struct sock *sk, u8 id, u8 code, 108 const void *data, int len, gfp_t priority) 109{ 110 struct pep_sock *pn = pep_sk(sk); 111 struct pnpipehdr *ph; 112 struct sk_buff *skb; 113 114 skb = pep_alloc_skb(sk, data, len, priority); 115 if (!skb) 116 return -ENOMEM; 117 118 ph = pnp_hdr(skb); 119 ph->utid = 0; 120 ph->message_id = id; 121 ph->pipe_handle = pn->pipe_handle; 122 ph->error_code = code; 123 return pn_skb_send(sk, skb, NULL); 124} 125 126#define PAD 0x00 127 128static int pipe_handler_request(struct sock *sk, u8 id, u8 code, 129 const void *data, int len) 130{ 131 struct pep_sock *pn = pep_sk(sk); 132 struct pnpipehdr *ph; 133 struct sk_buff *skb; 134 135 skb = pep_alloc_skb(sk, data, len, GFP_KERNEL); 136 if (!skb) 137 return -ENOMEM; 138 139 ph = pnp_hdr(skb); 140 ph->utid = id; /* whatever */ 141 ph->message_id = id; 142 ph->pipe_handle = pn->pipe_handle; 143 ph->error_code = code; 144 return pn_skb_send(sk, skb, NULL); 145} 146 147static int pipe_handler_send_created_ind(struct sock *sk) 148{ 149 struct pep_sock *pn = pep_sk(sk); 150 u8 data[4] = { 151 PN_PIPE_SB_NEGOTIATED_FC, pep_sb_size(2), 152 pn->tx_fc, pn->rx_fc, 153 }; 154 155 return pep_indicate(sk, PNS_PIPE_CREATED_IND, 1 /* sub-blocks */, 156 data, 4, GFP_ATOMIC); 157} 158 159static int pep_accept_conn(struct sock *sk, struct sk_buff *skb) 160{ 161 static const u8 data[20] = { 162 PAD, PAD, PAD, 2 /* sub-blocks */, 163 PN_PIPE_SB_REQUIRED_FC_TX, pep_sb_size(5), 3, PAD, 164 PN_MULTI_CREDIT_FLOW_CONTROL, 165 PN_ONE_CREDIT_FLOW_CONTROL, 166 PN_LEGACY_FLOW_CONTROL, 167 PAD, 168 PN_PIPE_SB_PREFERRED_FC_RX, pep_sb_size(5), 3, PAD, 169 PN_MULTI_CREDIT_FLOW_CONTROL, 170 PN_ONE_CREDIT_FLOW_CONTROL, 171 PN_LEGACY_FLOW_CONTROL, 172 PAD, 173 }; 174 175 might_sleep(); 176 return pep_reply(sk, skb, PN_PIPE_NO_ERROR, data, sizeof(data), 177 GFP_KERNEL); 178} 179 180static int pep_reject_conn(struct sock *sk, struct sk_buff *skb, u8 code, 181 gfp_t priority) 182{ 183 static const u8 data[4] = { PAD, PAD, PAD, 0 /* sub-blocks */ }; 184 WARN_ON(code == PN_PIPE_NO_ERROR); 185 return pep_reply(sk, skb, code, data, sizeof(data), priority); 186} 187 188/* Control requests are not sent by the pipe service and have a specific 189 * message format. */ 190static int pep_ctrlreq_error(struct sock *sk, struct sk_buff *oskb, u8 code, 191 gfp_t priority) 192{ 193 const struct pnpipehdr *oph = pnp_hdr(oskb); 194 struct sk_buff *skb; 195 struct pnpipehdr *ph; 196 struct sockaddr_pn dst; 197 u8 data[4] = { 198 oph->pep_type, /* PEP type */ 199 code, /* error code, at an unusual offset */ 200 PAD, PAD, 201 }; 202 203 skb = pep_alloc_skb(sk, data, 4, priority); 204 if (!skb) 205 return -ENOMEM; 206 207 ph = pnp_hdr(skb); 208 ph->utid = oph->utid; 209 ph->message_id = PNS_PEP_CTRL_RESP; 210 ph->pipe_handle = oph->pipe_handle; 211 ph->data0 = oph->data[0]; /* CTRL id */ 212 213 pn_skb_get_src_sockaddr(oskb, &dst); 214 return pn_skb_send(sk, skb, &dst); 215} 216 217static int pipe_snd_status(struct sock *sk, u8 type, u8 status, gfp_t priority) 218{ 219 u8 data[4] = { type, PAD, PAD, status }; 220 221 return pep_indicate(sk, PNS_PEP_STATUS_IND, PN_PEP_TYPE_COMMON, 222 data, 4, priority); 223} 224 225/* Send our RX flow control information to the sender. 226 * Socket must be locked. */ 227static void pipe_grant_credits(struct sock *sk, gfp_t priority) 228{ 229 struct pep_sock *pn = pep_sk(sk); 230 231 BUG_ON(sk->sk_state != TCP_ESTABLISHED); 232 233 switch (pn->rx_fc) { 234 case PN_LEGACY_FLOW_CONTROL: /* TODO */ 235 break; 236 case PN_ONE_CREDIT_FLOW_CONTROL: 237 if (pipe_snd_status(sk, PN_PEP_IND_FLOW_CONTROL, 238 PEP_IND_READY, priority) == 0) 239 pn->rx_credits = 1; 240 break; 241 case PN_MULTI_CREDIT_FLOW_CONTROL: 242 if ((pn->rx_credits + CREDITS_THR) > CREDITS_MAX) 243 break; 244 if (pipe_snd_status(sk, PN_PEP_IND_ID_MCFC_GRANT_CREDITS, 245 CREDITS_MAX - pn->rx_credits, 246 priority) == 0) 247 pn->rx_credits = CREDITS_MAX; 248 break; 249 } 250} 251 252static int pipe_rcv_status(struct sock *sk, struct sk_buff *skb) 253{ 254 struct pep_sock *pn = pep_sk(sk); 255 struct pnpipehdr *hdr; 256 int wake = 0; 257 258 if (!pskb_may_pull(skb, sizeof(*hdr) + 4)) 259 return -EINVAL; 260 261 hdr = pnp_hdr(skb); 262 if (hdr->pep_type != PN_PEP_TYPE_COMMON) { 263 net_dbg_ratelimited("Phonet unknown PEP type: %u\n", 264 (unsigned int)hdr->pep_type); 265 return -EOPNOTSUPP; 266 } 267 268 switch (hdr->data[0]) { 269 case PN_PEP_IND_FLOW_CONTROL: 270 switch (pn->tx_fc) { 271 case PN_LEGACY_FLOW_CONTROL: 272 switch (hdr->data[3]) { 273 case PEP_IND_BUSY: 274 atomic_set(&pn->tx_credits, 0); 275 break; 276 case PEP_IND_READY: 277 atomic_set(&pn->tx_credits, wake = 1); 278 break; 279 } 280 break; 281 case PN_ONE_CREDIT_FLOW_CONTROL: 282 if (hdr->data[3] == PEP_IND_READY) 283 atomic_set(&pn->tx_credits, wake = 1); 284 break; 285 } 286 break; 287 288 case PN_PEP_IND_ID_MCFC_GRANT_CREDITS: 289 if (pn->tx_fc != PN_MULTI_CREDIT_FLOW_CONTROL) 290 break; 291 atomic_add(wake = hdr->data[3], &pn->tx_credits); 292 break; 293 294 default: 295 net_dbg_ratelimited("Phonet unknown PEP indication: %u\n", 296 (unsigned int)hdr->data[0]); 297 return -EOPNOTSUPP; 298 } 299 if (wake) 300 sk->sk_write_space(sk); 301 return 0; 302} 303 304static int pipe_rcv_created(struct sock *sk, struct sk_buff *skb) 305{ 306 struct pep_sock *pn = pep_sk(sk); 307 struct pnpipehdr *hdr = pnp_hdr(skb); 308 u8 n_sb = hdr->data0; 309 310 pn->rx_fc = pn->tx_fc = PN_LEGACY_FLOW_CONTROL; 311 __skb_pull(skb, sizeof(*hdr)); 312 while (n_sb > 0) { 313 u8 type, buf[2], len = sizeof(buf); 314 u8 *data = pep_get_sb(skb, &type, &len, buf); 315 316 if (data == NULL) 317 return -EINVAL; 318 switch (type) { 319 case PN_PIPE_SB_NEGOTIATED_FC: 320 if (len < 2 || (data[0] | data[1]) > 3) 321 break; 322 pn->tx_fc = data[0] & 3; 323 pn->rx_fc = data[1] & 3; 324 break; 325 } 326 n_sb--; 327 } 328 return 0; 329} 330 331/* Queue an skb to a connected sock. 332 * Socket lock must be held. */ 333static int pipe_do_rcv(struct sock *sk, struct sk_buff *skb) 334{ 335 struct pep_sock *pn = pep_sk(sk); 336 struct pnpipehdr *hdr = pnp_hdr(skb); 337 struct sk_buff_head *queue; 338 int err = 0; 339 340 BUG_ON(sk->sk_state == TCP_CLOSE_WAIT); 341 342 switch (hdr->message_id) { 343 case PNS_PEP_CONNECT_REQ: 344 pep_reject_conn(sk, skb, PN_PIPE_ERR_PEP_IN_USE, GFP_ATOMIC); 345 break; 346 347 case PNS_PEP_DISCONNECT_REQ: 348 pep_reply(sk, skb, PN_PIPE_NO_ERROR, NULL, 0, GFP_ATOMIC); 349 sk->sk_state = TCP_CLOSE_WAIT; 350 if (!sock_flag(sk, SOCK_DEAD)) 351 sk->sk_state_change(sk); 352 break; 353 354 case PNS_PEP_ENABLE_REQ: 355 /* Wait for PNS_PIPE_(ENABLED|REDIRECTED)_IND */ 356 pep_reply(sk, skb, PN_PIPE_NO_ERROR, NULL, 0, GFP_ATOMIC); 357 break; 358 359 case PNS_PEP_RESET_REQ: 360 switch (hdr->state_after_reset) { 361 case PN_PIPE_DISABLE: 362 pn->init_enable = 0; 363 break; 364 case PN_PIPE_ENABLE: 365 pn->init_enable = 1; 366 break; 367 default: /* not allowed to send an error here!? */ 368 err = -EINVAL; 369 goto out; 370 } 371 fallthrough; 372 case PNS_PEP_DISABLE_REQ: 373 atomic_set(&pn->tx_credits, 0); 374 pep_reply(sk, skb, PN_PIPE_NO_ERROR, NULL, 0, GFP_ATOMIC); 375 break; 376 377 case PNS_PEP_CTRL_REQ: 378 if (skb_queue_len(&pn->ctrlreq_queue) >= PNPIPE_CTRLREQ_MAX) { 379 atomic_inc(&sk->sk_drops); 380 break; 381 } 382 __skb_pull(skb, 4); 383 queue = &pn->ctrlreq_queue; 384 goto queue; 385 386 case PNS_PIPE_ALIGNED_DATA: 387 __skb_pull(skb, 1); 388 fallthrough; 389 case PNS_PIPE_DATA: 390 __skb_pull(skb, 3); /* Pipe data header */ 391 if (!pn_flow_safe(pn->rx_fc)) { 392 err = sock_queue_rcv_skb(sk, skb); 393 if (!err) 394 return NET_RX_SUCCESS; 395 err = -ENOBUFS; 396 break; 397 } 398 399 if (pn->rx_credits == 0) { 400 atomic_inc(&sk->sk_drops); 401 err = -ENOBUFS; 402 break; 403 } 404 pn->rx_credits--; 405 queue = &sk->sk_receive_queue; 406 goto queue; 407 408 case PNS_PEP_STATUS_IND: 409 pipe_rcv_status(sk, skb); 410 break; 411 412 case PNS_PIPE_REDIRECTED_IND: 413 err = pipe_rcv_created(sk, skb); 414 break; 415 416 case PNS_PIPE_CREATED_IND: 417 err = pipe_rcv_created(sk, skb); 418 if (err) 419 break; 420 fallthrough; 421 case PNS_PIPE_RESET_IND: 422 if (!pn->init_enable) 423 break; 424 fallthrough; 425 case PNS_PIPE_ENABLED_IND: 426 if (!pn_flow_safe(pn->tx_fc)) { 427 atomic_set(&pn->tx_credits, 1); 428 sk->sk_write_space(sk); 429 } 430 if (sk->sk_state == TCP_ESTABLISHED) 431 break; /* Nothing to do */ 432 sk->sk_state = TCP_ESTABLISHED; 433 pipe_grant_credits(sk, GFP_ATOMIC); 434 break; 435 436 case PNS_PIPE_DISABLED_IND: 437 sk->sk_state = TCP_SYN_RECV; 438 pn->rx_credits = 0; 439 break; 440 441 default: 442 net_dbg_ratelimited("Phonet unknown PEP message: %u\n", 443 hdr->message_id); 444 err = -EINVAL; 445 } 446out: 447 kfree_skb(skb); 448 return (err == -ENOBUFS) ? NET_RX_DROP : NET_RX_SUCCESS; 449 450queue: 451 skb->dev = NULL; 452 skb_set_owner_r(skb, sk); 453 skb_queue_tail(queue, skb); 454 if (!sock_flag(sk, SOCK_DEAD)) 455 sk->sk_data_ready(sk); 456 return NET_RX_SUCCESS; 457} 458 459/* Destroy connected sock. */ 460static void pipe_destruct(struct sock *sk) 461{ 462 struct pep_sock *pn = pep_sk(sk); 463 464 skb_queue_purge(&sk->sk_receive_queue); 465 skb_queue_purge(&pn->ctrlreq_queue); 466} 467 468static u8 pipe_negotiate_fc(const u8 *fcs, unsigned int n) 469{ 470 unsigned int i; 471 u8 final_fc = PN_NO_FLOW_CONTROL; 472 473 for (i = 0; i < n; i++) { 474 u8 fc = fcs[i]; 475 476 if (fc > final_fc && fc < PN_MAX_FLOW_CONTROL) 477 final_fc = fc; 478 } 479 return final_fc; 480} 481 482static int pep_connresp_rcv(struct sock *sk, struct sk_buff *skb) 483{ 484 struct pep_sock *pn = pep_sk(sk); 485 struct pnpipehdr *hdr; 486 u8 n_sb; 487 488 if (!pskb_pull(skb, sizeof(*hdr) + 4)) 489 return -EINVAL; 490 491 hdr = pnp_hdr(skb); 492 if (hdr->error_code != PN_PIPE_NO_ERROR) 493 return -ECONNREFUSED; 494 495 /* Parse sub-blocks */ 496 n_sb = hdr->data[3]; 497 while (n_sb > 0) { 498 u8 type, buf[6], len = sizeof(buf); 499 const u8 *data = pep_get_sb(skb, &type, &len, buf); 500 501 if (data == NULL) 502 return -EINVAL; 503 504 switch (type) { 505 case PN_PIPE_SB_REQUIRED_FC_TX: 506 if (len < 2 || len < data[0]) 507 break; 508 pn->tx_fc = pipe_negotiate_fc(data + 2, len - 2); 509 break; 510 511 case PN_PIPE_SB_PREFERRED_FC_RX: 512 if (len < 2 || len < data[0]) 513 break; 514 pn->rx_fc = pipe_negotiate_fc(data + 2, len - 2); 515 break; 516 517 } 518 n_sb--; 519 } 520 521 return pipe_handler_send_created_ind(sk); 522} 523 524static int pep_enableresp_rcv(struct sock *sk, struct sk_buff *skb) 525{ 526 struct pnpipehdr *hdr = pnp_hdr(skb); 527 528 if (hdr->error_code != PN_PIPE_NO_ERROR) 529 return -ECONNREFUSED; 530 531 return pep_indicate(sk, PNS_PIPE_ENABLED_IND, 0 /* sub-blocks */, 532 NULL, 0, GFP_ATOMIC); 533 534} 535 536static void pipe_start_flow_control(struct sock *sk) 537{ 538 struct pep_sock *pn = pep_sk(sk); 539 540 if (!pn_flow_safe(pn->tx_fc)) { 541 atomic_set(&pn->tx_credits, 1); 542 sk->sk_write_space(sk); 543 } 544 pipe_grant_credits(sk, GFP_ATOMIC); 545} 546 547/* Queue an skb to an actively connected sock. 548 * Socket lock must be held. */ 549static int pipe_handler_do_rcv(struct sock *sk, struct sk_buff *skb) 550{ 551 struct pep_sock *pn = pep_sk(sk); 552 struct pnpipehdr *hdr = pnp_hdr(skb); 553 int err = NET_RX_SUCCESS; 554 555 switch (hdr->message_id) { 556 case PNS_PIPE_ALIGNED_DATA: 557 __skb_pull(skb, 1); 558 fallthrough; 559 case PNS_PIPE_DATA: 560 __skb_pull(skb, 3); /* Pipe data header */ 561 if (!pn_flow_safe(pn->rx_fc)) { 562 err = sock_queue_rcv_skb(sk, skb); 563 if (!err) 564 return NET_RX_SUCCESS; 565 err = NET_RX_DROP; 566 break; 567 } 568 569 if (pn->rx_credits == 0) { 570 atomic_inc(&sk->sk_drops); 571 err = NET_RX_DROP; 572 break; 573 } 574 pn->rx_credits--; 575 skb->dev = NULL; 576 skb_set_owner_r(skb, sk); 577 skb_queue_tail(&sk->sk_receive_queue, skb); 578 if (!sock_flag(sk, SOCK_DEAD)) 579 sk->sk_data_ready(sk); 580 return NET_RX_SUCCESS; 581 582 case PNS_PEP_CONNECT_RESP: 583 if (sk->sk_state != TCP_SYN_SENT) 584 break; 585 if (!sock_flag(sk, SOCK_DEAD)) 586 sk->sk_state_change(sk); 587 if (pep_connresp_rcv(sk, skb)) { 588 sk->sk_state = TCP_CLOSE_WAIT; 589 break; 590 } 591 if (pn->init_enable == PN_PIPE_DISABLE) 592 sk->sk_state = TCP_SYN_RECV; 593 else { 594 sk->sk_state = TCP_ESTABLISHED; 595 pipe_start_flow_control(sk); 596 } 597 break; 598 599 case PNS_PEP_ENABLE_RESP: 600 if (sk->sk_state != TCP_SYN_SENT) 601 break; 602 603 if (pep_enableresp_rcv(sk, skb)) { 604 sk->sk_state = TCP_CLOSE_WAIT; 605 break; 606 } 607 608 sk->sk_state = TCP_ESTABLISHED; 609 pipe_start_flow_control(sk); 610 break; 611 612 case PNS_PEP_DISCONNECT_RESP: 613 /* sock should already be dead, nothing to do */ 614 break; 615 616 case PNS_PEP_STATUS_IND: 617 pipe_rcv_status(sk, skb); 618 break; 619 } 620 kfree_skb(skb); 621 return err; 622} 623 624/* Listening sock must be locked */ 625static struct sock *pep_find_pipe(const struct hlist_head *hlist, 626 const struct sockaddr_pn *dst, 627 u8 pipe_handle) 628{ 629 struct sock *sknode; 630 u16 dobj = pn_sockaddr_get_object(dst); 631 632 sk_for_each(sknode, hlist) { 633 struct pep_sock *pnnode = pep_sk(sknode); 634 635 /* Ports match, but addresses might not: */ 636 if (pnnode->pn_sk.sobject != dobj) 637 continue; 638 if (pnnode->pipe_handle != pipe_handle) 639 continue; 640 if (sknode->sk_state == TCP_CLOSE_WAIT) 641 continue; 642 643 sock_hold(sknode); 644 return sknode; 645 } 646 return NULL; 647} 648 649/* 650 * Deliver an skb to a listening sock. 651 * Socket lock must be held. 652 * We then queue the skb to the right connected sock (if any). 653 */ 654static int pep_do_rcv(struct sock *sk, struct sk_buff *skb) 655{ 656 struct pep_sock *pn = pep_sk(sk); 657 struct sock *sknode; 658 struct pnpipehdr *hdr; 659 struct sockaddr_pn dst; 660 u8 pipe_handle; 661 662 if (!pskb_may_pull(skb, sizeof(*hdr))) 663 goto drop; 664 665 hdr = pnp_hdr(skb); 666 pipe_handle = hdr->pipe_handle; 667 if (pipe_handle == PN_PIPE_INVALID_HANDLE) 668 goto drop; 669 670 pn_skb_get_dst_sockaddr(skb, &dst); 671 672 /* Look for an existing pipe handle */ 673 sknode = pep_find_pipe(&pn->hlist, &dst, pipe_handle); 674 if (sknode) 675 return sk_receive_skb(sknode, skb, 1); 676 677 switch (hdr->message_id) { 678 case PNS_PEP_CONNECT_REQ: 679 if (sk->sk_state != TCP_LISTEN || sk_acceptq_is_full(sk)) { 680 pep_reject_conn(sk, skb, PN_PIPE_ERR_PEP_IN_USE, 681 GFP_ATOMIC); 682 break; 683 } 684 skb_queue_head(&sk->sk_receive_queue, skb); 685 sk_acceptq_added(sk); 686 if (!sock_flag(sk, SOCK_DEAD)) 687 sk->sk_data_ready(sk); 688 return NET_RX_SUCCESS; 689 690 case PNS_PEP_DISCONNECT_REQ: 691 pep_reply(sk, skb, PN_PIPE_NO_ERROR, NULL, 0, GFP_ATOMIC); 692 break; 693 694 case PNS_PEP_CTRL_REQ: 695 pep_ctrlreq_error(sk, skb, PN_PIPE_INVALID_HANDLE, GFP_ATOMIC); 696 break; 697 698 case PNS_PEP_RESET_REQ: 699 case PNS_PEP_ENABLE_REQ: 700 case PNS_PEP_DISABLE_REQ: 701 /* invalid handle is not even allowed here! */ 702 break; 703 704 default: 705 if ((1 << sk->sk_state) 706 & ~(TCPF_CLOSE|TCPF_LISTEN|TCPF_CLOSE_WAIT)) 707 /* actively connected socket */ 708 return pipe_handler_do_rcv(sk, skb); 709 } 710drop: 711 kfree_skb(skb); 712 return NET_RX_SUCCESS; 713} 714 715static int pipe_do_remove(struct sock *sk) 716{ 717 struct pep_sock *pn = pep_sk(sk); 718 struct pnpipehdr *ph; 719 struct sk_buff *skb; 720 721 skb = pep_alloc_skb(sk, NULL, 0, GFP_KERNEL); 722 if (!skb) 723 return -ENOMEM; 724 725 ph = pnp_hdr(skb); 726 ph->utid = 0; 727 ph->message_id = PNS_PIPE_REMOVE_REQ; 728 ph->pipe_handle = pn->pipe_handle; 729 ph->data0 = PAD; 730 return pn_skb_send(sk, skb, NULL); 731} 732 733/* associated socket ceases to exist */ 734static void pep_sock_close(struct sock *sk, long timeout) 735{ 736 struct pep_sock *pn = pep_sk(sk); 737 int ifindex = 0; 738 739 sock_hold(sk); /* keep a reference after sk_common_release() */ 740 sk_common_release(sk); 741 742 lock_sock(sk); 743 if ((1 << sk->sk_state) & (TCPF_SYN_RECV|TCPF_ESTABLISHED)) { 744 if (sk->sk_backlog_rcv == pipe_do_rcv) 745 /* Forcefully remove dangling Phonet pipe */ 746 pipe_do_remove(sk); 747 else 748 pipe_handler_request(sk, PNS_PEP_DISCONNECT_REQ, PAD, 749 NULL, 0); 750 } 751 sk->sk_state = TCP_CLOSE; 752 753 ifindex = pn->ifindex; 754 pn->ifindex = 0; 755 release_sock(sk); 756 757 if (ifindex) 758 gprs_detach(sk); 759 sock_put(sk); 760} 761 762static struct sock *pep_sock_accept(struct sock *sk, int flags, int *errp, 763 bool kern) 764{ 765 struct pep_sock *pn = pep_sk(sk), *newpn; 766 struct sock *newsk = NULL; 767 struct sk_buff *skb; 768 struct pnpipehdr *hdr; 769 struct sockaddr_pn dst, src; 770 int err; 771 u16 peer_type; 772 u8 pipe_handle, enabled, n_sb; 773 u8 aligned = 0; 774 775 skb = skb_recv_datagram(sk, (flags & O_NONBLOCK) ? MSG_DONTWAIT : 0, 776 errp); 777 if (!skb) 778 return NULL; 779 780 lock_sock(sk); 781 if (sk->sk_state != TCP_LISTEN) { 782 err = -EINVAL; 783 goto drop; 784 } 785 sk_acceptq_removed(sk); 786 787 err = -EPROTO; 788 if (!pskb_may_pull(skb, sizeof(*hdr) + 4)) 789 goto drop; 790 791 hdr = pnp_hdr(skb); 792 pipe_handle = hdr->pipe_handle; 793 switch (hdr->state_after_connect) { 794 case PN_PIPE_DISABLE: 795 enabled = 0; 796 break; 797 case PN_PIPE_ENABLE: 798 enabled = 1; 799 break; 800 default: 801 pep_reject_conn(sk, skb, PN_PIPE_ERR_INVALID_PARAM, 802 GFP_KERNEL); 803 goto drop; 804 } 805 peer_type = hdr->other_pep_type << 8; 806 807 /* Parse sub-blocks (options) */ 808 n_sb = hdr->data[3]; 809 while (n_sb > 0) { 810 u8 type, buf[1], len = sizeof(buf); 811 const u8 *data = pep_get_sb(skb, &type, &len, buf); 812 813 if (data == NULL) 814 goto drop; 815 switch (type) { 816 case PN_PIPE_SB_CONNECT_REQ_PEP_SUB_TYPE: 817 if (len < 1) 818 goto drop; 819 peer_type = (peer_type & 0xff00) | data[0]; 820 break; 821 case PN_PIPE_SB_ALIGNED_DATA: 822 aligned = data[0] != 0; 823 break; 824 } 825 n_sb--; 826 } 827 828 /* Check for duplicate pipe handle */ 829 newsk = pep_find_pipe(&pn->hlist, &dst, pipe_handle); 830 if (unlikely(newsk)) { 831 __sock_put(newsk); 832 newsk = NULL; 833 pep_reject_conn(sk, skb, PN_PIPE_ERR_PEP_IN_USE, GFP_KERNEL); 834 goto drop; 835 } 836 837 /* Create a new to-be-accepted sock */ 838 newsk = sk_alloc(sock_net(sk), PF_PHONET, GFP_KERNEL, sk->sk_prot, 839 kern); 840 if (!newsk) { 841 pep_reject_conn(sk, skb, PN_PIPE_ERR_OVERLOAD, GFP_KERNEL); 842 err = -ENOBUFS; 843 goto drop; 844 } 845 846 sock_init_data(NULL, newsk); 847 newsk->sk_state = TCP_SYN_RECV; 848 newsk->sk_backlog_rcv = pipe_do_rcv; 849 newsk->sk_protocol = sk->sk_protocol; 850 newsk->sk_destruct = pipe_destruct; 851 852 newpn = pep_sk(newsk); 853 pn_skb_get_dst_sockaddr(skb, &dst); 854 pn_skb_get_src_sockaddr(skb, &src); 855 newpn->pn_sk.sobject = pn_sockaddr_get_object(&dst); 856 newpn->pn_sk.dobject = pn_sockaddr_get_object(&src); 857 newpn->pn_sk.resource = pn_sockaddr_get_resource(&dst); 858 sock_hold(sk); 859 newpn->listener = sk; 860 skb_queue_head_init(&newpn->ctrlreq_queue); 861 newpn->pipe_handle = pipe_handle; 862 atomic_set(&newpn->tx_credits, 0); 863 newpn->ifindex = 0; 864 newpn->peer_type = peer_type; 865 newpn->rx_credits = 0; 866 newpn->rx_fc = newpn->tx_fc = PN_LEGACY_FLOW_CONTROL; 867 newpn->init_enable = enabled; 868 newpn->aligned = aligned; 869 870 err = pep_accept_conn(newsk, skb); 871 if (err) { 872 __sock_put(sk); 873 sock_put(newsk); 874 newsk = NULL; 875 goto drop; 876 } 877 sk_add_node(newsk, &pn->hlist); 878drop: 879 release_sock(sk); 880 kfree_skb(skb); 881 *errp = err; 882 return newsk; 883} 884 885static int pep_sock_connect(struct sock *sk, struct sockaddr *addr, int len) 886{ 887 struct pep_sock *pn = pep_sk(sk); 888 int err; 889 u8 data[4] = { 0 /* sub-blocks */, PAD, PAD, PAD }; 890 891 if (pn->pipe_handle == PN_PIPE_INVALID_HANDLE) 892 pn->pipe_handle = 1; /* anything but INVALID_HANDLE */ 893 894 err = pipe_handler_request(sk, PNS_PEP_CONNECT_REQ, 895 pn->init_enable, data, 4); 896 if (err) { 897 pn->pipe_handle = PN_PIPE_INVALID_HANDLE; 898 return err; 899 } 900 901 sk->sk_state = TCP_SYN_SENT; 902 903 return 0; 904} 905 906static int pep_sock_enable(struct sock *sk, struct sockaddr *addr, int len) 907{ 908 int err; 909 910 err = pipe_handler_request(sk, PNS_PEP_ENABLE_REQ, PAD, 911 NULL, 0); 912 if (err) 913 return err; 914 915 sk->sk_state = TCP_SYN_SENT; 916 917 return 0; 918} 919 920static unsigned int pep_first_packet_length(struct sock *sk) 921{ 922 struct pep_sock *pn = pep_sk(sk); 923 struct sk_buff_head *q; 924 struct sk_buff *skb; 925 unsigned int len = 0; 926 bool found = false; 927 928 if (sock_flag(sk, SOCK_URGINLINE)) { 929 q = &pn->ctrlreq_queue; 930 spin_lock_bh(&q->lock); 931 skb = skb_peek(q); 932 if (skb) { 933 len = skb->len; 934 found = true; 935 } 936 spin_unlock_bh(&q->lock); 937 } 938 939 if (likely(!found)) { 940 q = &sk->sk_receive_queue; 941 spin_lock_bh(&q->lock); 942 skb = skb_peek(q); 943 if (skb) 944 len = skb->len; 945 spin_unlock_bh(&q->lock); 946 } 947 948 return len; 949} 950 951static int pep_ioctl(struct sock *sk, int cmd, int *karg) 952{ 953 struct pep_sock *pn = pep_sk(sk); 954 int ret = -ENOIOCTLCMD; 955 956 switch (cmd) { 957 case SIOCINQ: 958 if (sk->sk_state == TCP_LISTEN) { 959 ret = -EINVAL; 960 break; 961 } 962 963 *karg = pep_first_packet_length(sk); 964 ret = 0; 965 break; 966 967 case SIOCPNENABLEPIPE: 968 lock_sock(sk); 969 if (sk->sk_state == TCP_SYN_SENT) 970 ret = -EBUSY; 971 else if (sk->sk_state == TCP_ESTABLISHED) 972 ret = -EISCONN; 973 else if (!pn->pn_sk.sobject) 974 ret = -EADDRNOTAVAIL; 975 else 976 ret = pep_sock_enable(sk, NULL, 0); 977 release_sock(sk); 978 break; 979 } 980 981 return ret; 982} 983 984static int pep_init(struct sock *sk) 985{ 986 struct pep_sock *pn = pep_sk(sk); 987 988 sk->sk_destruct = pipe_destruct; 989 INIT_HLIST_HEAD(&pn->hlist); 990 pn->listener = NULL; 991 skb_queue_head_init(&pn->ctrlreq_queue); 992 atomic_set(&pn->tx_credits, 0); 993 pn->ifindex = 0; 994 pn->peer_type = 0; 995 pn->pipe_handle = PN_PIPE_INVALID_HANDLE; 996 pn->rx_credits = 0; 997 pn->rx_fc = pn->tx_fc = PN_LEGACY_FLOW_CONTROL; 998 pn->init_enable = 1; 999 pn->aligned = 0; 1000 return 0; 1001} 1002 1003static int pep_setsockopt(struct sock *sk, int level, int optname, 1004 sockptr_t optval, unsigned int optlen) 1005{ 1006 struct pep_sock *pn = pep_sk(sk); 1007 int val = 0, err = 0; 1008 1009 if (level != SOL_PNPIPE) 1010 return -ENOPROTOOPT; 1011 if (optlen >= sizeof(int)) { 1012 if (copy_from_sockptr(&val, optval, sizeof(int))) 1013 return -EFAULT; 1014 } 1015 1016 lock_sock(sk); 1017 switch (optname) { 1018 case PNPIPE_ENCAP: 1019 if (val && val != PNPIPE_ENCAP_IP) { 1020 err = -EINVAL; 1021 break; 1022 } 1023 if (!pn->ifindex == !val) 1024 break; /* Nothing to do! */ 1025 if (!capable(CAP_NET_ADMIN)) { 1026 err = -EPERM; 1027 break; 1028 } 1029 if (val) { 1030 release_sock(sk); 1031 err = gprs_attach(sk); 1032 if (err > 0) { 1033 pn->ifindex = err; 1034 err = 0; 1035 } 1036 } else { 1037 pn->ifindex = 0; 1038 release_sock(sk); 1039 gprs_detach(sk); 1040 err = 0; 1041 } 1042 goto out_norel; 1043 1044 case PNPIPE_HANDLE: 1045 if ((sk->sk_state == TCP_CLOSE) && 1046 (val >= 0) && (val < PN_PIPE_INVALID_HANDLE)) 1047 pn->pipe_handle = val; 1048 else 1049 err = -EINVAL; 1050 break; 1051 1052 case PNPIPE_INITSTATE: 1053 pn->init_enable = !!val; 1054 break; 1055 1056 default: 1057 err = -ENOPROTOOPT; 1058 } 1059 release_sock(sk); 1060 1061out_norel: 1062 return err; 1063} 1064 1065static int pep_getsockopt(struct sock *sk, int level, int optname, 1066 char __user *optval, int __user *optlen) 1067{ 1068 struct pep_sock *pn = pep_sk(sk); 1069 int len, val; 1070 1071 if (level != SOL_PNPIPE) 1072 return -ENOPROTOOPT; 1073 if (get_user(len, optlen)) 1074 return -EFAULT; 1075 1076 switch (optname) { 1077 case PNPIPE_ENCAP: 1078 val = pn->ifindex ? PNPIPE_ENCAP_IP : PNPIPE_ENCAP_NONE; 1079 break; 1080 1081 case PNPIPE_IFINDEX: 1082 val = pn->ifindex; 1083 break; 1084 1085 case PNPIPE_HANDLE: 1086 val = pn->pipe_handle; 1087 if (val == PN_PIPE_INVALID_HANDLE) 1088 return -EINVAL; 1089 break; 1090 1091 case PNPIPE_INITSTATE: 1092 val = pn->init_enable; 1093 break; 1094 1095 default: 1096 return -ENOPROTOOPT; 1097 } 1098 1099 len = min_t(unsigned int, sizeof(int), len); 1100 if (put_user(len, optlen)) 1101 return -EFAULT; 1102 if (put_user(val, (int __user *) optval)) 1103 return -EFAULT; 1104 return 0; 1105} 1106 1107static int pipe_skb_send(struct sock *sk, struct sk_buff *skb) 1108{ 1109 struct pep_sock *pn = pep_sk(sk); 1110 struct pnpipehdr *ph; 1111 int err; 1112 1113 if (pn_flow_safe(pn->tx_fc) && 1114 !atomic_add_unless(&pn->tx_credits, -1, 0)) { 1115 kfree_skb(skb); 1116 return -ENOBUFS; 1117 } 1118 1119 skb_push(skb, 3 + pn->aligned); 1120 skb_reset_transport_header(skb); 1121 ph = pnp_hdr(skb); 1122 ph->utid = 0; 1123 if (pn->aligned) { 1124 ph->message_id = PNS_PIPE_ALIGNED_DATA; 1125 ph->data0 = 0; /* padding */ 1126 } else 1127 ph->message_id = PNS_PIPE_DATA; 1128 ph->pipe_handle = pn->pipe_handle; 1129 err = pn_skb_send(sk, skb, NULL); 1130 1131 if (err && pn_flow_safe(pn->tx_fc)) 1132 atomic_inc(&pn->tx_credits); 1133 return err; 1134 1135} 1136 1137static int pep_sendmsg(struct sock *sk, struct msghdr *msg, size_t len) 1138{ 1139 struct pep_sock *pn = pep_sk(sk); 1140 struct sk_buff *skb; 1141 long timeo; 1142 int flags = msg->msg_flags; 1143 int err, done; 1144 1145 if (len > USHRT_MAX) 1146 return -EMSGSIZE; 1147 1148 if ((msg->msg_flags & ~(MSG_DONTWAIT|MSG_EOR|MSG_NOSIGNAL| 1149 MSG_CMSG_COMPAT)) || 1150 !(msg->msg_flags & MSG_EOR)) 1151 return -EOPNOTSUPP; 1152 1153 skb = sock_alloc_send_skb(sk, MAX_PNPIPE_HEADER + len, 1154 flags & MSG_DONTWAIT, &err); 1155 if (!skb) 1156 return err; 1157 1158 skb_reserve(skb, MAX_PHONET_HEADER + 3 + pn->aligned); 1159 err = memcpy_from_msg(skb_put(skb, len), msg, len); 1160 if (err < 0) 1161 goto outfree; 1162 1163 lock_sock(sk); 1164 timeo = sock_sndtimeo(sk, flags & MSG_DONTWAIT); 1165 if ((1 << sk->sk_state) & (TCPF_LISTEN|TCPF_CLOSE)) { 1166 err = -ENOTCONN; 1167 goto out; 1168 } 1169 if (sk->sk_state != TCP_ESTABLISHED) { 1170 /* Wait until the pipe gets to enabled state */ 1171disabled: 1172 err = sk_stream_wait_connect(sk, &timeo); 1173 if (err) 1174 goto out; 1175 1176 if (sk->sk_state == TCP_CLOSE_WAIT) { 1177 err = -ECONNRESET; 1178 goto out; 1179 } 1180 } 1181 BUG_ON(sk->sk_state != TCP_ESTABLISHED); 1182 1183 /* Wait until flow control allows TX */ 1184 done = atomic_read(&pn->tx_credits); 1185 while (!done) { 1186 DEFINE_WAIT_FUNC(wait, woken_wake_function); 1187 1188 if (!timeo) { 1189 err = -EAGAIN; 1190 goto out; 1191 } 1192 if (signal_pending(current)) { 1193 err = sock_intr_errno(timeo); 1194 goto out; 1195 } 1196 1197 add_wait_queue(sk_sleep(sk), &wait); 1198 done = sk_wait_event(sk, &timeo, atomic_read(&pn->tx_credits), &wait); 1199 remove_wait_queue(sk_sleep(sk), &wait); 1200 1201 if (sk->sk_state != TCP_ESTABLISHED) 1202 goto disabled; 1203 } 1204 1205 err = pipe_skb_send(sk, skb); 1206 if (err >= 0) 1207 err = len; /* success! */ 1208 skb = NULL; 1209out: 1210 release_sock(sk); 1211outfree: 1212 kfree_skb(skb); 1213 return err; 1214} 1215 1216int pep_writeable(struct sock *sk) 1217{ 1218 struct pep_sock *pn = pep_sk(sk); 1219 1220 return atomic_read(&pn->tx_credits); 1221} 1222 1223int pep_write(struct sock *sk, struct sk_buff *skb) 1224{ 1225 struct sk_buff *rskb, *fs; 1226 int flen = 0; 1227 1228 if (pep_sk(sk)->aligned) 1229 return pipe_skb_send(sk, skb); 1230 1231 rskb = alloc_skb(MAX_PNPIPE_HEADER, GFP_ATOMIC); 1232 if (!rskb) { 1233 kfree_skb(skb); 1234 return -ENOMEM; 1235 } 1236 skb_shinfo(rskb)->frag_list = skb; 1237 rskb->len += skb->len; 1238 rskb->data_len += rskb->len; 1239 rskb->truesize += rskb->len; 1240 1241 /* Avoid nested fragments */ 1242 skb_walk_frags(skb, fs) 1243 flen += fs->len; 1244 skb->next = skb_shinfo(skb)->frag_list; 1245 skb_frag_list_init(skb); 1246 skb->len -= flen; 1247 skb->data_len -= flen; 1248 skb->truesize -= flen; 1249 1250 skb_reserve(rskb, MAX_PHONET_HEADER + 3); 1251 return pipe_skb_send(sk, rskb); 1252} 1253 1254struct sk_buff *pep_read(struct sock *sk) 1255{ 1256 struct sk_buff *skb = skb_dequeue(&sk->sk_receive_queue); 1257 1258 if (sk->sk_state == TCP_ESTABLISHED) 1259 pipe_grant_credits(sk, GFP_ATOMIC); 1260 return skb; 1261} 1262 1263static int pep_recvmsg(struct sock *sk, struct msghdr *msg, size_t len, 1264 int flags, int *addr_len) 1265{ 1266 struct sk_buff *skb; 1267 int err; 1268 1269 if (flags & ~(MSG_OOB|MSG_PEEK|MSG_TRUNC|MSG_DONTWAIT|MSG_WAITALL| 1270 MSG_NOSIGNAL|MSG_CMSG_COMPAT)) 1271 return -EOPNOTSUPP; 1272 1273 if (unlikely(1 << sk->sk_state & (TCPF_LISTEN | TCPF_CLOSE))) 1274 return -ENOTCONN; 1275 1276 if ((flags & MSG_OOB) || sock_flag(sk, SOCK_URGINLINE)) { 1277 /* Dequeue and acknowledge control request */ 1278 struct pep_sock *pn = pep_sk(sk); 1279 1280 if (flags & MSG_PEEK) 1281 return -EOPNOTSUPP; 1282 skb = skb_dequeue(&pn->ctrlreq_queue); 1283 if (skb) { 1284 pep_ctrlreq_error(sk, skb, PN_PIPE_NO_ERROR, 1285 GFP_KERNEL); 1286 msg->msg_flags |= MSG_OOB; 1287 goto copy; 1288 } 1289 if (flags & MSG_OOB) 1290 return -EINVAL; 1291 } 1292 1293 skb = skb_recv_datagram(sk, flags, &err); 1294 lock_sock(sk); 1295 if (skb == NULL) { 1296 if (err == -ENOTCONN && sk->sk_state == TCP_CLOSE_WAIT) 1297 err = -ECONNRESET; 1298 release_sock(sk); 1299 return err; 1300 } 1301 1302 if (sk->sk_state == TCP_ESTABLISHED) 1303 pipe_grant_credits(sk, GFP_KERNEL); 1304 release_sock(sk); 1305copy: 1306 msg->msg_flags |= MSG_EOR; 1307 if (skb->len > len) 1308 msg->msg_flags |= MSG_TRUNC; 1309 else 1310 len = skb->len; 1311 1312 err = skb_copy_datagram_msg(skb, 0, msg, len); 1313 if (!err) 1314 err = (flags & MSG_TRUNC) ? skb->len : len; 1315 1316 skb_free_datagram(sk, skb); 1317 return err; 1318} 1319 1320static void pep_sock_unhash(struct sock *sk) 1321{ 1322 struct pep_sock *pn = pep_sk(sk); 1323 struct sock *skparent = NULL; 1324 1325 lock_sock(sk); 1326 1327 if (pn->listener != NULL) { 1328 skparent = pn->listener; 1329 pn->listener = NULL; 1330 release_sock(sk); 1331 1332 pn = pep_sk(skparent); 1333 lock_sock(skparent); 1334 sk_del_node_init(sk); 1335 sk = skparent; 1336 } 1337 1338 /* Unhash a listening sock only when it is closed 1339 * and all of its active connected pipes are closed. */ 1340 if (hlist_empty(&pn->hlist)) 1341 pn_sock_unhash(&pn->pn_sk.sk); 1342 release_sock(sk); 1343 1344 if (skparent) 1345 sock_put(skparent); 1346} 1347 1348static struct proto pep_proto = { 1349 .close = pep_sock_close, 1350 .accept = pep_sock_accept, 1351 .connect = pep_sock_connect, 1352 .ioctl = pep_ioctl, 1353 .init = pep_init, 1354 .setsockopt = pep_setsockopt, 1355 .getsockopt = pep_getsockopt, 1356 .sendmsg = pep_sendmsg, 1357 .recvmsg = pep_recvmsg, 1358 .backlog_rcv = pep_do_rcv, 1359 .hash = pn_sock_hash, 1360 .unhash = pep_sock_unhash, 1361 .get_port = pn_sock_get_port, 1362 .obj_size = sizeof(struct pep_sock), 1363 .owner = THIS_MODULE, 1364 .name = "PNPIPE", 1365}; 1366 1367static const struct phonet_protocol pep_pn_proto = { 1368 .ops = &phonet_stream_ops, 1369 .prot = &pep_proto, 1370 .sock_type = SOCK_SEQPACKET, 1371}; 1372 1373static int __init pep_register(void) 1374{ 1375 return phonet_proto_register(PN_PROTO_PIPE, &pep_pn_proto); 1376} 1377 1378static void __exit pep_unregister(void) 1379{ 1380 phonet_proto_unregister(PN_PROTO_PIPE, &pep_pn_proto); 1381} 1382 1383module_init(pep_register); 1384module_exit(pep_unregister); 1385MODULE_AUTHOR("Remi Denis-Courmont, Nokia"); 1386MODULE_DESCRIPTION("Phonet pipe protocol"); 1387MODULE_LICENSE("GPL"); 1388MODULE_ALIAS_NET_PF_PROTO(PF_PHONET, PN_PROTO_PIPE); 1389