af_iucv.c

   1// SPDX-License-Identifier: GPL-2.0-only
   2/*
   3 *  IUCV protocol stack for Linux on zSeries
   4 *
   5 *  Copyright IBM Corp. 2006, 2009
   6 *
   7 *  Author(s):	Jennifer Hunt <jenhunt@us.ibm.com>
   8 *		Hendrik Brueckner <brueckner@linux.vnet.ibm.com>
   9 *  PM functions:
  10 *		Ursula Braun <ursula.braun@de.ibm.com>
  11 */
  12
  13#define pr_fmt(fmt) "af_iucv: " fmt
  14
  15#include <linux/filter.h>
  16#include <linux/module.h>
  17#include <linux/netdevice.h>
  18#include <linux/types.h>
  19#include <linux/limits.h>
  20#include <linux/list.h>
  21#include <linux/errno.h>
  22#include <linux/kernel.h>
  23#include <linux/sched/signal.h>
  24#include <linux/slab.h>
  25#include <linux/skbuff.h>
  26#include <linux/init.h>
  27#include <linux/poll.h>
  28#include <linux/security.h>
  29#include <net/sock.h>
  30#include <asm/machine.h>
  31#include <asm/ebcdic.h>
  32#include <asm/cpcmd.h>
  33#include <linux/kmod.h>
  34
  35#include <net/iucv/af_iucv.h>
  36
  37#define VERSION "1.2"
  38
  39static char iucv_userid[80];
  40
  41static struct proto iucv_proto = {
  42	.name		= "AF_IUCV",
  43	.owner		= THIS_MODULE,
  44	.obj_size	= sizeof(struct iucv_sock),
  45};
  46
  47static struct iucv_interface *pr_iucv;
  48static struct iucv_handler af_iucv_handler;
  49
  50/* special AF_IUCV IPRM messages */
  51static const u8 iprm_shutdown[8] =
  52	{0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01};
  53
  54#define TRGCLS_SIZE	sizeof_field(struct iucv_message, class)
  55
  56#define __iucv_sock_wait(sk, condition, timeo, ret)			\
  57do {									\
  58	DEFINE_WAIT(__wait);						\
  59	long __timeo = timeo;						\
  60	ret = 0;							\
  61	prepare_to_wait(sk_sleep(sk), &__wait, TASK_INTERRUPTIBLE);	\
  62	while (!(condition)) {						\
  63		if (!__timeo) {						\
  64			ret = -EAGAIN;					\
  65			break;						\
  66		}							\
  67		if (signal_pending(current)) {				\
  68			ret = sock_intr_errno(__timeo);			\
  69			break;						\
  70		}							\
  71		release_sock(sk);					\
  72		__timeo = schedule_timeout(__timeo);			\
  73		lock_sock(sk);						\
  74		ret = sock_error(sk);					\
  75		if (ret)						\
  76			break;						\
  77	}								\
  78	finish_wait(sk_sleep(sk), &__wait);				\
  79} while (0)
  80
  81#define iucv_sock_wait(sk, condition, timeo)				\
  82({									\
  83	int __ret = 0;							\
  84	if (!(condition))						\
  85		__iucv_sock_wait(sk, condition, timeo, __ret);		\
  86	__ret;								\
  87})
  88
  89static struct sock *iucv_accept_dequeue(struct sock *parent,
  90					struct socket *newsock);
  91static void iucv_sock_kill(struct sock *sk);
  92static void iucv_sock_close(struct sock *sk);
  93
  94static void afiucv_hs_callback_txnotify(struct sock *sk, enum iucv_tx_notify);
  95
  96static struct iucv_sock_list iucv_sk_list = {
  97	.lock = __RW_LOCK_UNLOCKED(iucv_sk_list.lock),
  98	.autobind_name = ATOMIC_INIT(0)
  99};
 100
 101static inline void high_nmcpy(unsigned char *dst, char *src)
 102{
 103       memcpy(dst, src, 8);
 104}
 105
 106static inline void low_nmcpy(unsigned char *dst, char *src)
 107{
 108       memcpy(&dst[8], src, 8);
 109}
 110
 111/**
 112 * iucv_msg_length() - Returns the length of an iucv message.
 113 * @msg:	Pointer to struct iucv_message, MUST NOT be NULL
 114 *
 115 * The function returns the length of the specified iucv message @msg of data
 116 * stored in a buffer and of data stored in the parameter list (PRMDATA).
 117 *
 118 * For IUCV_IPRMDATA, AF_IUCV uses the following convention to transport socket
 119 * data:
 120 *	PRMDATA[0..6]	socket data (max 7 bytes);
 121 *	PRMDATA[7]	socket data length value (len is 0xff - PRMDATA[7])
 122 *
 123 * The socket data length is computed by subtracting the socket data length
 124 * value from 0xFF.
 125 * If the socket data len is greater 7, then PRMDATA can be used for special
 126 * notifications (see iucv_sock_shutdown); and further,
 127 * if the socket data len is > 7, the function returns 8.
 128 *
 129 * Use this function to allocate socket buffers to store iucv message data.
 130 */
 131static inline size_t iucv_msg_length(struct iucv_message *msg)
 132{
 133	size_t datalen;
 134
 135	if (msg->flags & IUCV_IPRMDATA) {
 136		datalen = 0xff - msg->rmmsg[7];
 137		return (datalen < 8) ? datalen : 8;
 138	}
 139	return msg->length;
 140}
 141
 142/**
 143 * iucv_sock_in_state() - check for specific states
 144 * @sk:		sock structure
 145 * @state:	first iucv sk state
 146 * @state2:	second iucv sk state
 147 *
 148 * Returns true if the socket in either in the first or second state.
 149 */
 150static int iucv_sock_in_state(struct sock *sk, int state, int state2)
 151{
 152	return (sk->sk_state == state || sk->sk_state == state2);
 153}
 154
 155/**
 156 * iucv_below_msglim() - function to check if messages can be sent
 157 * @sk:		sock structure
 158 *
 159 * Returns true if the send queue length is lower than the message limit.
 160 * Always returns true if the socket is not connected (no iucv path for
 161 * checking the message limit).
 162 */
 163static inline int iucv_below_msglim(struct sock *sk)
 164{
 165	struct iucv_sock *iucv = iucv_sk(sk);
 166
 167	if (sk->sk_state != IUCV_CONNECTED)
 168		return 1;
 169	if (iucv->transport == AF_IUCV_TRANS_IUCV)
 170		return (atomic_read(&iucv->skbs_in_xmit) < iucv->path->msglim);
 171	else
 172		return ((atomic_read(&iucv->msg_sent) < iucv->msglimit_peer) &&
 173			(atomic_read(&iucv->pendings) <= 0));
 174}
 175
 176/*
 177 * iucv_sock_wake_msglim() - Wake up thread waiting on msg limit
 178 */
 179static void iucv_sock_wake_msglim(struct sock *sk)
 180{
 181	struct socket_wq *wq;
 182
 183	rcu_read_lock();
 184	wq = rcu_dereference(sk->sk_wq);
 185	if (skwq_has_sleeper(wq))
 186		wake_up_interruptible_all(&wq->wait);
 187	sk_wake_async_rcu(sk, SOCK_WAKE_SPACE, POLL_OUT);
 188	rcu_read_unlock();
 189}
 190
 191/*
 192 * afiucv_hs_send() - send a message through HiperSockets transport
 193 */
 194static int afiucv_hs_send(struct iucv_message *imsg, struct sock *sock,
 195		   struct sk_buff *skb, u8 flags)
 196{
 197	struct iucv_sock *iucv = iucv_sk(sock);
 198	struct af_iucv_trans_hdr *phs_hdr;
 199	int err, confirm_recv = 0;
 200
 201	phs_hdr = skb_push(skb, sizeof(*phs_hdr));
 202	memset(phs_hdr, 0, sizeof(*phs_hdr));
 203	skb_reset_network_header(skb);
 204
 205	phs_hdr->magic = ETH_P_AF_IUCV;
 206	phs_hdr->version = 1;
 207	phs_hdr->flags = flags;
 208	if (flags == AF_IUCV_FLAG_SYN)
 209		phs_hdr->window = iucv->msglimit;
 210	else if ((flags == AF_IUCV_FLAG_WIN) || !flags) {
 211		confirm_recv = atomic_read(&iucv->msg_recv);
 212		phs_hdr->window = confirm_recv;
 213		if (confirm_recv)
 214			phs_hdr->flags = phs_hdr->flags | AF_IUCV_FLAG_WIN;
 215	}
 216	memcpy(phs_hdr->destUserID, iucv->dst_user_id, 8);
 217	memcpy(phs_hdr->destAppName, iucv->dst_name, 8);
 218	memcpy(phs_hdr->srcUserID, iucv->src_user_id, 8);
 219	memcpy(phs_hdr->srcAppName, iucv->src_name, 8);
 220	ASCEBC(phs_hdr->destUserID, sizeof(phs_hdr->destUserID));
 221	ASCEBC(phs_hdr->destAppName, sizeof(phs_hdr->destAppName));
 222	ASCEBC(phs_hdr->srcUserID, sizeof(phs_hdr->srcUserID));
 223	ASCEBC(phs_hdr->srcAppName, sizeof(phs_hdr->srcAppName));
 224	if (imsg)
 225		memcpy(&phs_hdr->iucv_hdr, imsg, sizeof(struct iucv_message));
 226
 227	skb->dev = iucv->hs_dev;
 228	if (!skb->dev) {
 229		err = -ENODEV;
 230		goto err_free;
 231	}
 232
 233	dev_hard_header(skb, skb->dev, ETH_P_AF_IUCV, NULL, NULL, skb->len);
 234
 235	if (!(skb->dev->flags & IFF_UP) || !netif_carrier_ok(skb->dev)) {
 236		err = -ENETDOWN;
 237		goto err_free;
 238	}
 239	if (skb->len > skb->dev->mtu) {
 240		if (sock->sk_type == SOCK_SEQPACKET) {
 241			err = -EMSGSIZE;
 242			goto err_free;
 243		}
 244		err = pskb_trim(skb, skb->dev->mtu);
 245		if (err)
 246			goto err_free;
 247	}
 248	skb->protocol = cpu_to_be16(ETH_P_AF_IUCV);
 249
 250	atomic_inc(&iucv->skbs_in_xmit);
 251	err = dev_queue_xmit(skb);
 252	if (net_xmit_eval(err)) {
 253		atomic_dec(&iucv->skbs_in_xmit);
 254	} else {
 255		atomic_sub(confirm_recv, &iucv->msg_recv);
 256		WARN_ON(atomic_read(&iucv->msg_recv) < 0);
 257	}
 258	return net_xmit_eval(err);
 259
 260err_free:
 261	kfree_skb(skb);
 262	return err;
 263}
 264
 265static struct sock *__iucv_get_sock_by_name(char *nm)
 266{
 267	struct sock *sk;
 268
 269	sk_for_each(sk, &iucv_sk_list.head)
 270		if (!memcmp(&iucv_sk(sk)->src_name, nm, 8))
 271			return sk;
 272
 273	return NULL;
 274}
 275
 276static void iucv_sock_destruct(struct sock *sk)
 277{
 278	skb_queue_purge(&sk->sk_receive_queue);
 279	skb_queue_purge(&sk->sk_error_queue);
 280
 281	if (!sock_flag(sk, SOCK_DEAD)) {
 282		pr_err("Attempt to release alive iucv socket %p\n", sk);
 283		return;
 284	}
 285
 286	WARN_ON(atomic_read(&sk->sk_rmem_alloc));
 287	WARN_ON(refcount_read(&sk->sk_wmem_alloc));
 288	WARN_ON(sk->sk_wmem_queued);
 289	WARN_ON(sk->sk_forward_alloc);
 290}
 291
 292/* Cleanup Listen */
 293static void iucv_sock_cleanup_listen(struct sock *parent)
 294{
 295	struct sock *sk;
 296
 297	/* Close non-accepted connections */
 298	while ((sk = iucv_accept_dequeue(parent, NULL))) {
 299		iucv_sock_close(sk);
 300		iucv_sock_kill(sk);
 301	}
 302
 303	parent->sk_state = IUCV_CLOSED;
 304}
 305
 306static void iucv_sock_link(struct iucv_sock_list *l, struct sock *sk)
 307{
 308	write_lock_bh(&l->lock);
 309	sk_add_node(sk, &l->head);
 310	write_unlock_bh(&l->lock);
 311}
 312
 313static void iucv_sock_unlink(struct iucv_sock_list *l, struct sock *sk)
 314{
 315	write_lock_bh(&l->lock);
 316	sk_del_node_init(sk);
 317	write_unlock_bh(&l->lock);
 318}
 319
 320/* Kill socket (only if zapped and orphaned) */
 321static void iucv_sock_kill(struct sock *sk)
 322{
 323	if (!sock_flag(sk, SOCK_ZAPPED) || sk->sk_socket)
 324		return;
 325
 326	iucv_sock_unlink(&iucv_sk_list, sk);
 327	sock_set_flag(sk, SOCK_DEAD);
 328	sock_put(sk);
 329}
 330
 331/* Terminate an IUCV path */
 332static void iucv_sever_path(struct sock *sk, int with_user_data)
 333{
 334	unsigned char user_data[16];
 335	struct iucv_sock *iucv = iucv_sk(sk);
 336	struct iucv_path *path = iucv->path;
 337
 338	/* Whoever resets the path pointer, must sever and free it. */
 339	if (xchg(&iucv->path, NULL)) {
 340		if (with_user_data) {
 341			low_nmcpy(user_data, iucv->src_name);
 342			high_nmcpy(user_data, iucv->dst_name);
 343			ASCEBC(user_data, sizeof(user_data));
 344			pr_iucv->path_sever(path, user_data);
 345		} else
 346			pr_iucv->path_sever(path, NULL);
 347		iucv_path_free(path);
 348	}
 349}
 350
 351/* Send controlling flags through an IUCV socket for HIPER transport */
 352static int iucv_send_ctrl(struct sock *sk, u8 flags)
 353{
 354	struct iucv_sock *iucv = iucv_sk(sk);
 355	int err = 0;
 356	int blen;
 357	struct sk_buff *skb;
 358	u8 shutdown = 0;
 359
 360	blen = sizeof(struct af_iucv_trans_hdr) +
 361	       LL_RESERVED_SPACE(iucv->hs_dev);
 362	if (sk->sk_shutdown & SEND_SHUTDOWN) {
 363		/* controlling flags should be sent anyway */
 364		shutdown = sk->sk_shutdown;
 365		sk->sk_shutdown &= RCV_SHUTDOWN;
 366	}
 367	skb = sock_alloc_send_skb(sk, blen, 1, &err);
 368	if (skb) {
 369		skb_reserve(skb, blen);
 370		err = afiucv_hs_send(NULL, sk, skb, flags);
 371	}
 372	if (shutdown)
 373		sk->sk_shutdown = shutdown;
 374	return err;
 375}
 376
 377/* Close an IUCV socket */
 378static void iucv_sock_close(struct sock *sk)
 379{
 380	struct iucv_sock *iucv = iucv_sk(sk);
 381	unsigned long timeo;
 382	int err = 0;
 383
 384	lock_sock(sk);
 385
 386	switch (sk->sk_state) {
 387	case IUCV_LISTEN:
 388		iucv_sock_cleanup_listen(sk);
 389		break;
 390
 391	case IUCV_CONNECTED:
 392		if (iucv->transport == AF_IUCV_TRANS_HIPER) {
 393			err = iucv_send_ctrl(sk, AF_IUCV_FLAG_FIN);
 394			sk->sk_state = IUCV_DISCONN;
 395			sk->sk_state_change(sk);
 396		}
 397		fallthrough;
 398
 399	case IUCV_DISCONN:
 400		sk->sk_state = IUCV_CLOSING;
 401		sk->sk_state_change(sk);
 402
 403		if (!err && atomic_read(&iucv->skbs_in_xmit) > 0) {
 404			if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime)
 405				timeo = sk->sk_lingertime;
 406			else
 407				timeo = IUCV_DISCONN_TIMEOUT;
 408			iucv_sock_wait(sk,
 409					iucv_sock_in_state(sk, IUCV_CLOSED, 0),
 410					timeo);
 411		}
 412		fallthrough;
 413
 414	case IUCV_CLOSING:
 415		sk->sk_state = IUCV_CLOSED;
 416		sk->sk_state_change(sk);
 417
 418		sk->sk_err = ECONNRESET;
 419		sk->sk_state_change(sk);
 420
 421		skb_queue_purge(&iucv->send_skb_q);
 422		skb_queue_purge(&iucv->backlog_skb_q);
 423		fallthrough;
 424
 425	default:
 426		iucv_sever_path(sk, 1);
 427	}
 428
 429	if (iucv->hs_dev) {
 430		dev_put(iucv->hs_dev);
 431		iucv->hs_dev = NULL;
 432		sk->sk_bound_dev_if = 0;
 433	}
 434
 435	/* mark socket for deletion by iucv_sock_kill() */
 436	sock_set_flag(sk, SOCK_ZAPPED);
 437
 438	release_sock(sk);
 439}
 440
 441static void iucv_sock_init(struct sock *sk, struct sock *parent)
 442{
 443	if (parent) {
 444		sk->sk_type = parent->sk_type;
 445		security_sk_clone(parent, sk);
 446	}
 447}
 448
 449static struct sock *iucv_sock_alloc(struct socket *sock, int proto, gfp_t prio, int kern)
 450{
 451	struct sock *sk;
 452	struct iucv_sock *iucv;
 453
 454	sk = sk_alloc(&init_net, PF_IUCV, prio, &iucv_proto, kern);
 455	if (!sk)
 456		return NULL;
 457	iucv = iucv_sk(sk);
 458
 459	sock_init_data(sock, sk);
 460	INIT_LIST_HEAD(&iucv->accept_q);
 461	spin_lock_init(&iucv->accept_q_lock);
 462	skb_queue_head_init(&iucv->send_skb_q);
 463	INIT_LIST_HEAD(&iucv->message_q.list);
 464	spin_lock_init(&iucv->message_q.lock);
 465	skb_queue_head_init(&iucv->backlog_skb_q);
 466	iucv->send_tag = 0;
 467	atomic_set(&iucv->pendings, 0);
 468	iucv->flags = 0;
 469	iucv->msglimit = 0;
 470	atomic_set(&iucv->skbs_in_xmit, 0);
 471	atomic_set(&iucv->msg_sent, 0);
 472	atomic_set(&iucv->msg_recv, 0);
 473	iucv->path = NULL;
 474	iucv->sk_txnotify = afiucv_hs_callback_txnotify;
 475	memset(&iucv->init, 0, sizeof(iucv->init));
 476	if (pr_iucv)
 477		iucv->transport = AF_IUCV_TRANS_IUCV;
 478	else
 479		iucv->transport = AF_IUCV_TRANS_HIPER;
 480
 481	sk->sk_destruct = iucv_sock_destruct;
 482	sk->sk_sndtimeo = IUCV_CONN_TIMEOUT;
 483
 484	sock_reset_flag(sk, SOCK_ZAPPED);
 485
 486	sk->sk_protocol = proto;
 487	sk->sk_state	= IUCV_OPEN;
 488
 489	iucv_sock_link(&iucv_sk_list, sk);
 490	return sk;
 491}
 492
 493static void iucv_accept_enqueue(struct sock *parent, struct sock *sk)
 494{
 495	unsigned long flags;
 496	struct iucv_sock *par = iucv_sk(parent);
 497
 498	sock_hold(sk);
 499	spin_lock_irqsave(&par->accept_q_lock, flags);
 500	list_add_tail(&iucv_sk(sk)->accept_q, &par->accept_q);
 501	spin_unlock_irqrestore(&par->accept_q_lock, flags);
 502	iucv_sk(sk)->parent = parent;
 503	sk_acceptq_added(parent);
 504}
 505
 506static void iucv_accept_unlink(struct sock *sk)
 507{
 508	unsigned long flags;
 509	struct iucv_sock *par = iucv_sk(iucv_sk(sk)->parent);
 510
 511	spin_lock_irqsave(&par->accept_q_lock, flags);
 512	list_del_init(&iucv_sk(sk)->accept_q);
 513	spin_unlock_irqrestore(&par->accept_q_lock, flags);
 514	sk_acceptq_removed(iucv_sk(sk)->parent);
 515	iucv_sk(sk)->parent = NULL;
 516	sock_put(sk);
 517}
 518
 519static struct sock *iucv_accept_dequeue(struct sock *parent,
 520					struct socket *newsock)
 521{
 522	struct iucv_sock *isk, *n;
 523	struct sock *sk;
 524
 525	list_for_each_entry_safe(isk, n, &iucv_sk(parent)->accept_q, accept_q) {
 526		sk = (struct sock *) isk;
 527		lock_sock(sk);
 528
 529		if (sk->sk_state == IUCV_CLOSED) {
 530			iucv_accept_unlink(sk);
 531			release_sock(sk);
 532			continue;
 533		}
 534
 535		if (sk->sk_state == IUCV_CONNECTED ||
 536		    sk->sk_state == IUCV_DISCONN ||
 537		    !newsock) {
 538			iucv_accept_unlink(sk);
 539			if (newsock)
 540				sock_graft(sk, newsock);
 541
 542			release_sock(sk);
 543			return sk;
 544		}
 545
 546		release_sock(sk);
 547	}
 548	return NULL;
 549}
 550
 551static void __iucv_auto_name(struct iucv_sock *iucv)
 552{
 553	char name[12];
 554
 555	scnprintf(name, sizeof(name),
 556		  "%08x", atomic_inc_return(&iucv_sk_list.autobind_name));
 557	while (__iucv_get_sock_by_name(name)) {
 558		scnprintf(name, sizeof(name), "%08x",
 559			  atomic_inc_return(&iucv_sk_list.autobind_name));
 560	}
 561	memcpy(iucv->src_name, name, 8);
 562}
 563
 564/* Bind an unbound socket */
 565static int iucv_sock_bind(struct socket *sock, struct sockaddr_unsized *addr,
 566			  int addr_len)
 567{
 568	DECLARE_SOCKADDR(struct sockaddr_iucv *, sa, addr);
 569	char uid[sizeof(sa->siucv_user_id)];
 570	struct sock *sk = sock->sk;
 571	struct iucv_sock *iucv;
 572	int err = 0;
 573	struct net_device *dev;
 574
 575	/* Verify the input sockaddr */
 576	if (addr_len < sizeof(struct sockaddr_iucv) ||
 577	    addr->sa_family != AF_IUCV)
 578		return -EINVAL;
 579
 580	lock_sock(sk);
 581	if (sk->sk_state != IUCV_OPEN) {
 582		err = -EBADFD;
 583		goto done;
 584	}
 585
 586	write_lock_bh(&iucv_sk_list.lock);
 587
 588	iucv = iucv_sk(sk);
 589	if (__iucv_get_sock_by_name(sa->siucv_name)) {
 590		err = -EADDRINUSE;
 591		goto done_unlock;
 592	}
 593	if (iucv->path)
 594		goto done_unlock;
 595
 596	/* Bind the socket */
 597	if (pr_iucv)
 598		if (!memcmp(sa->siucv_user_id, iucv_userid, 8))
 599			goto vm_bind; /* VM IUCV transport */
 600
 601	/* try hiper transport */
 602	memcpy(uid, sa->siucv_user_id, sizeof(uid));
 603	ASCEBC(uid, 8);
 604	rcu_read_lock();
 605	for_each_netdev_rcu(&init_net, dev) {
 606		if (!memcmp(dev->perm_addr, uid, 8)) {
 607			memcpy(iucv->src_user_id, sa->siucv_user_id, 8);
 608			/* Check for uninitialized siucv_name */
 609			if (strncmp(sa->siucv_name, "        ", 8) == 0)
 610				__iucv_auto_name(iucv);
 611			else
 612				memcpy(iucv->src_name, sa->siucv_name, 8);
 613			sk->sk_bound_dev_if = dev->ifindex;
 614			iucv->hs_dev = dev;
 615			dev_hold(dev);
 616			sk->sk_state = IUCV_BOUND;
 617			iucv->transport = AF_IUCV_TRANS_HIPER;
 618			if (!iucv->msglimit)
 619				iucv->msglimit = IUCV_HIPER_MSGLIM_DEFAULT;
 620			rcu_read_unlock();
 621			goto done_unlock;
 622		}
 623	}
 624	rcu_read_unlock();
 625vm_bind:
 626	if (pr_iucv) {
 627		/* use local userid for backward compat */
 628		memcpy(iucv->src_name, sa->siucv_name, 8);
 629		memcpy(iucv->src_user_id, iucv_userid, 8);
 630		sk->sk_state = IUCV_BOUND;
 631		iucv->transport = AF_IUCV_TRANS_IUCV;
 632		sk->sk_allocation |= GFP_DMA;
 633		if (!iucv->msglimit)
 634			iucv->msglimit = IUCV_QUEUELEN_DEFAULT;
 635		goto done_unlock;
 636	}
 637	/* found no dev to bind */
 638	err = -ENODEV;
 639done_unlock:
 640	/* Release the socket list lock */
 641	write_unlock_bh(&iucv_sk_list.lock);
 642done:
 643	release_sock(sk);
 644	return err;
 645}
 646
 647/* Automatically bind an unbound socket */
 648static int iucv_sock_autobind(struct sock *sk)
 649{
 650	struct iucv_sock *iucv = iucv_sk(sk);
 651	int err = 0;
 652
 653	if (unlikely(!pr_iucv))
 654		return -EPROTO;
 655
 656	memcpy(iucv->src_user_id, iucv_userid, 8);
 657	iucv->transport = AF_IUCV_TRANS_IUCV;
 658	sk->sk_allocation |= GFP_DMA;
 659
 660	write_lock_bh(&iucv_sk_list.lock);
 661	__iucv_auto_name(iucv);
 662	write_unlock_bh(&iucv_sk_list.lock);
 663
 664	if (!iucv->msglimit)
 665		iucv->msglimit = IUCV_QUEUELEN_DEFAULT;
 666
 667	return err;
 668}
 669
 670static int afiucv_path_connect(struct socket *sock, struct sockaddr_unsized *addr)
 671{
 672	DECLARE_SOCKADDR(struct sockaddr_iucv *, sa, addr);
 673	struct sock *sk = sock->sk;
 674	struct iucv_sock *iucv = iucv_sk(sk);
 675	unsigned char user_data[16];
 676	int err;
 677
 678	high_nmcpy(user_data, sa->siucv_name);
 679	low_nmcpy(user_data, iucv->src_name);
 680	ASCEBC(user_data, sizeof(user_data));
 681
 682	/* Create path. */
 683	iucv->path = iucv_path_alloc(iucv->msglimit,
 684				     IUCV_IPRMDATA, GFP_KERNEL);
 685	if (!iucv->path) {
 686		err = -ENOMEM;
 687		goto done;
 688	}
 689	err = pr_iucv->path_connect(iucv->path, &af_iucv_handler,
 690				    sa->siucv_user_id, NULL, user_data,
 691				    sk);
 692	if (err) {
 693		iucv_path_free(iucv->path);
 694		iucv->path = NULL;
 695		switch (err) {
 696		case 0x0b:	/* Target communicator is not logged on */
 697			err = -ENETUNREACH;
 698			break;
 699		case 0x0d:	/* Max connections for this guest exceeded */
 700		case 0x0e:	/* Max connections for target guest exceeded */
 701			err = -EAGAIN;
 702			break;
 703		case 0x0f:	/* Missing IUCV authorization */
 704			err = -EACCES;
 705			break;
 706		default:
 707			err = -ECONNREFUSED;
 708			break;
 709		}
 710	}
 711done:
 712	return err;
 713}
 714
 715/* Connect an unconnected socket */
 716static int iucv_sock_connect(struct socket *sock, struct sockaddr_unsized *addr,
 717			     int alen, int flags)
 718{
 719	DECLARE_SOCKADDR(struct sockaddr_iucv *, sa, addr);
 720	struct sock *sk = sock->sk;
 721	struct iucv_sock *iucv = iucv_sk(sk);
 722	int err;
 723
 724	if (alen < sizeof(struct sockaddr_iucv) || addr->sa_family != AF_IUCV)
 725		return -EINVAL;
 726
 727	if (sk->sk_state != IUCV_OPEN && sk->sk_state != IUCV_BOUND)
 728		return -EBADFD;
 729
 730	if (sk->sk_state == IUCV_OPEN &&
 731	    iucv->transport == AF_IUCV_TRANS_HIPER)
 732		return -EBADFD; /* explicit bind required */
 733
 734	if (sk->sk_type != SOCK_STREAM && sk->sk_type != SOCK_SEQPACKET)
 735		return -EINVAL;
 736
 737	if (sk->sk_state == IUCV_OPEN) {
 738		err = iucv_sock_autobind(sk);
 739		if (unlikely(err))
 740			return err;
 741	}
 742
 743	lock_sock(sk);
 744
 745	/* Set the destination information */
 746	memcpy(iucv->dst_user_id, sa->siucv_user_id, 8);
 747	memcpy(iucv->dst_name, sa->siucv_name, 8);
 748
 749	if (iucv->transport == AF_IUCV_TRANS_HIPER)
 750		err = iucv_send_ctrl(sock->sk, AF_IUCV_FLAG_SYN);
 751	else
 752		err = afiucv_path_connect(sock, addr);
 753	if (err)
 754		goto done;
 755
 756	if (sk->sk_state != IUCV_CONNECTED)
 757		err = iucv_sock_wait(sk, iucv_sock_in_state(sk, IUCV_CONNECTED,
 758							    IUCV_DISCONN),
 759				     sock_sndtimeo(sk, flags & O_NONBLOCK));
 760
 761	if (sk->sk_state == IUCV_DISCONN || sk->sk_state == IUCV_CLOSED)
 762		err = -ECONNREFUSED;
 763
 764	if (err && iucv->transport == AF_IUCV_TRANS_IUCV)
 765		iucv_sever_path(sk, 0);
 766
 767done:
 768	release_sock(sk);
 769	return err;
 770}
 771
 772/* Move a socket into listening state. */
 773static int iucv_sock_listen(struct socket *sock, int backlog)
 774{
 775	struct sock *sk = sock->sk;
 776	int err;
 777
 778	lock_sock(sk);
 779
 780	err = -EINVAL;
 781	if (sk->sk_state != IUCV_BOUND)
 782		goto done;
 783
 784	if (sock->type != SOCK_STREAM && sock->type != SOCK_SEQPACKET)
 785		goto done;
 786
 787	sk->sk_max_ack_backlog = backlog;
 788	sk->sk_ack_backlog = 0;
 789	sk->sk_state = IUCV_LISTEN;
 790	err = 0;
 791
 792done:
 793	release_sock(sk);
 794	return err;
 795}
 796
 797/* Accept a pending connection */
 798static int iucv_sock_accept(struct socket *sock, struct socket *newsock,
 799			    struct proto_accept_arg *arg)
 800{
 801	DECLARE_WAITQUEUE(wait, current);
 802	struct sock *sk = sock->sk, *nsk;
 803	long timeo;
 804	int err = 0;
 805
 806	lock_sock_nested(sk, SINGLE_DEPTH_NESTING);
 807
 808	if (sk->sk_state != IUCV_LISTEN) {
 809		err = -EBADFD;
 810		goto done;
 811	}
 812
 813	timeo = sock_rcvtimeo(sk, arg->flags & O_NONBLOCK);
 814
 815	/* Wait for an incoming connection */
 816	add_wait_queue_exclusive(sk_sleep(sk), &wait);
 817	while (!(nsk = iucv_accept_dequeue(sk, newsock))) {
 818		set_current_state(TASK_INTERRUPTIBLE);
 819		if (!timeo) {
 820			err = -EAGAIN;
 821			break;
 822		}
 823
 824		release_sock(sk);
 825		timeo = schedule_timeout(timeo);
 826		lock_sock_nested(sk, SINGLE_DEPTH_NESTING);
 827
 828		if (sk->sk_state != IUCV_LISTEN) {
 829			err = -EBADFD;
 830			break;
 831		}
 832
 833		if (signal_pending(current)) {
 834			err = sock_intr_errno(timeo);
 835			break;
 836		}
 837	}
 838
 839	set_current_state(TASK_RUNNING);
 840	remove_wait_queue(sk_sleep(sk), &wait);
 841
 842	if (err)
 843		goto done;
 844
 845	newsock->state = SS_CONNECTED;
 846
 847done:
 848	release_sock(sk);
 849	return err;
 850}
 851
 852static int iucv_sock_getname(struct socket *sock, struct sockaddr *addr,
 853			     int peer)
 854{
 855	DECLARE_SOCKADDR(struct sockaddr_iucv *, siucv, addr);
 856	struct sock *sk = sock->sk;
 857	struct iucv_sock *iucv = iucv_sk(sk);
 858
 859	addr->sa_family = AF_IUCV;
 860
 861	if (peer) {
 862		memcpy(siucv->siucv_user_id, iucv->dst_user_id, 8);
 863		memcpy(siucv->siucv_name, iucv->dst_name, 8);
 864	} else {
 865		memcpy(siucv->siucv_user_id, iucv->src_user_id, 8);
 866		memcpy(siucv->siucv_name, iucv->src_name, 8);
 867	}
 868	memset(&siucv->siucv_port, 0, sizeof(siucv->siucv_port));
 869	memset(&siucv->siucv_addr, 0, sizeof(siucv->siucv_addr));
 870	memset(&siucv->siucv_nodeid, 0, sizeof(siucv->siucv_nodeid));
 871
 872	return sizeof(struct sockaddr_iucv);
 873}
 874
 875/**
 876 * iucv_send_iprm() - Send socket data in parameter list of an iucv message.
 877 * @path:	IUCV path
 878 * @msg:	Pointer to a struct iucv_message
 879 * @skb:	The socket data to send, skb->len MUST BE <= 7
 880 *
 881 * Send the socket data in the parameter list in the iucv message
 882 * (IUCV_IPRMDATA). The socket data is stored at index 0 to 6 in the parameter
 883 * list and the socket data len at index 7 (last byte).
 884 * See also iucv_msg_length().
 885 *
 886 * Returns the error code from the iucv_message_send() call.
 887 */
 888static int iucv_send_iprm(struct iucv_path *path, struct iucv_message *msg,
 889			  struct sk_buff *skb)
 890{
 891	u8 prmdata[8];
 892
 893	memcpy(prmdata, (void *) skb->data, skb->len);
 894	prmdata[7] = 0xff - (u8) skb->len;
 895	return pr_iucv->message_send(path, msg, IUCV_IPRMDATA, 0,
 896				 (void *) prmdata, 8);
 897}
 898
 899static int iucv_sock_sendmsg(struct socket *sock, struct msghdr *msg,
 900			     size_t len)
 901{
 902	struct sock *sk = sock->sk;
 903	struct iucv_sock *iucv = iucv_sk(sk);
 904	size_t headroom = 0;
 905	size_t linear;
 906	struct sk_buff *skb;
 907	struct iucv_message txmsg = {0};
 908	struct cmsghdr *cmsg;
 909	int cmsg_done;
 910	long timeo;
 911	char user_id[9];
 912	char appl_id[9];
 913	int err;
 914	int noblock = msg->msg_flags & MSG_DONTWAIT;
 915
 916	err = sock_error(sk);
 917	if (err)
 918		return err;
 919
 920	if (msg->msg_flags & MSG_OOB)
 921		return -EOPNOTSUPP;
 922
 923	/* SOCK_SEQPACKET: we do not support segmented records */
 924	if (sk->sk_type == SOCK_SEQPACKET && !(msg->msg_flags & MSG_EOR))
 925		return -EOPNOTSUPP;
 926
 927	lock_sock(sk);
 928
 929	if (sk->sk_shutdown & SEND_SHUTDOWN) {
 930		err = -EPIPE;
 931		goto out;
 932	}
 933
 934	/* Return if the socket is not in connected state */
 935	if (sk->sk_state != IUCV_CONNECTED) {
 936		err = -ENOTCONN;
 937		goto out;
 938	}
 939
 940	/* initialize defaults */
 941	cmsg_done   = 0;	/* check for duplicate headers */
 942
 943	/* iterate over control messages */
 944	for_each_cmsghdr(cmsg, msg) {
 945		if (!CMSG_OK(msg, cmsg)) {
 946			err = -EINVAL;
 947			goto out;
 948		}
 949
 950		if (cmsg->cmsg_level != SOL_IUCV)
 951			continue;
 952
 953		if (cmsg->cmsg_type & cmsg_done) {
 954			err = -EINVAL;
 955			goto out;
 956		}
 957		cmsg_done |= cmsg->cmsg_type;
 958
 959		switch (cmsg->cmsg_type) {
 960		case SCM_IUCV_TRGCLS:
 961			if (cmsg->cmsg_len != CMSG_LEN(TRGCLS_SIZE)) {
 962				err = -EINVAL;
 963				goto out;
 964			}
 965
 966			/* set iucv message target class */
 967			memcpy(&txmsg.class,
 968				(void *) CMSG_DATA(cmsg), TRGCLS_SIZE);
 969
 970			break;
 971
 972		default:
 973			err = -EINVAL;
 974			goto out;
 975		}
 976	}
 977
 978	/* allocate one skb for each iucv message:
 979	 * this is fine for SOCK_SEQPACKET (unless we want to support
 980	 * segmented records using the MSG_EOR flag), but
 981	 * for SOCK_STREAM we might want to improve it in future */
 982	if (iucv->transport == AF_IUCV_TRANS_HIPER) {
 983		headroom = sizeof(struct af_iucv_trans_hdr) +
 984			   LL_RESERVED_SPACE(iucv->hs_dev);
 985		linear = min(len, PAGE_SIZE - headroom);
 986	} else {
 987		if (len < PAGE_SIZE) {
 988			linear = len;
 989		} else {
 990			/* In nonlinear "classic" iucv skb,
 991			 * reserve space for iucv_array
 992			 */
 993			headroom = sizeof(struct iucv_array) *
 994				   (MAX_SKB_FRAGS + 1);
 995			linear = PAGE_SIZE - headroom;
 996		}
 997	}
 998	skb = sock_alloc_send_pskb(sk, headroom + linear, len - linear,
 999				   noblock, &err, 0);
1000	if (!skb)
1001		goto out;
1002	if (headroom)
1003		skb_reserve(skb, headroom);
1004	skb_put(skb, linear);
1005	skb->len = len;
1006	skb->data_len = len - linear;
1007	err = skb_copy_datagram_from_iter(skb, 0, &msg->msg_iter, len);
1008	if (err)
1009		goto fail;
1010
1011	/* wait if outstanding messages for iucv path has reached */
1012	timeo = sock_sndtimeo(sk, noblock);
1013	err = iucv_sock_wait(sk, iucv_below_msglim(sk), timeo);
1014	if (err)
1015		goto fail;
1016
1017	/* return -ECONNRESET if the socket is no longer connected */
1018	if (sk->sk_state != IUCV_CONNECTED) {
1019		err = -ECONNRESET;
1020		goto fail;
1021	}
1022
1023	/* increment and save iucv message tag for msg_completion cbk */
1024	txmsg.tag = iucv->send_tag++;
1025	IUCV_SKB_CB(skb)->tag = txmsg.tag;
1026
1027	if (iucv->transport == AF_IUCV_TRANS_HIPER) {
1028		atomic_inc(&iucv->msg_sent);
1029		err = afiucv_hs_send(&txmsg, sk, skb, 0);
1030		if (err) {
1031			atomic_dec(&iucv->msg_sent);
1032			goto out;
1033		}
1034	} else { /* Classic VM IUCV transport */
1035		skb_queue_tail(&iucv->send_skb_q, skb);
1036		atomic_inc(&iucv->skbs_in_xmit);
1037
1038		if (((iucv->path->flags & IUCV_IPRMDATA) & iucv->flags) &&
1039		    skb->len <= 7) {
1040			err = iucv_send_iprm(iucv->path, &txmsg, skb);
1041
1042			/* on success: there is no message_complete callback */
1043			/* for an IPRMDATA msg; remove skb from send queue   */
1044			if (err == 0) {
1045				atomic_dec(&iucv->skbs_in_xmit);
1046				skb_unlink(skb, &iucv->send_skb_q);
1047				consume_skb(skb);
1048			}
1049
1050			/* this error should never happen since the	*/
1051			/* IUCV_IPRMDATA path flag is set... sever path */
1052			if (err == 0x15) {
1053				pr_iucv->path_sever(iucv->path, NULL);
1054				atomic_dec(&iucv->skbs_in_xmit);
1055				skb_unlink(skb, &iucv->send_skb_q);
1056				err = -EPIPE;
1057				goto fail;
1058			}
1059		} else if (skb_is_nonlinear(skb)) {
1060			struct iucv_array *iba = (struct iucv_array *)skb->head;
1061			int i;
1062
1063			/* skip iucv_array lying in the headroom */
1064			iba[0].address = virt_to_dma32(skb->data);
1065			iba[0].length = (u32)skb_headlen(skb);
1066			for (i = 0; i < skb_shinfo(skb)->nr_frags; i++) {
1067				skb_frag_t *frag = &skb_shinfo(skb)->frags[i];
1068
1069				iba[i + 1].address = virt_to_dma32(skb_frag_address(frag));
1070				iba[i + 1].length = (u32)skb_frag_size(frag);
1071			}
1072			err = pr_iucv->message_send(iucv->path, &txmsg,
1073						    IUCV_IPBUFLST, 0,
1074						    (void *)iba, skb->len);
1075		} else { /* non-IPRM Linear skb */
1076			err = pr_iucv->message_send(iucv->path, &txmsg,
1077					0, 0, (void *)skb->data, skb->len);
1078		}
1079		if (err) {
1080			if (err == 3) {
1081				user_id[8] = 0;
1082				memcpy(user_id, iucv->dst_user_id, 8);
1083				appl_id[8] = 0;
1084				memcpy(appl_id, iucv->dst_name, 8);
1085				pr_err(
1086		"Application %s on z/VM guest %s exceeds message limit\n",
1087					appl_id, user_id);
1088				err = -EAGAIN;
1089			} else {
1090				err = -EPIPE;
1091			}
1092
1093			atomic_dec(&iucv->skbs_in_xmit);
1094			skb_unlink(skb, &iucv->send_skb_q);
1095			goto fail;
1096		}
1097	}
1098
1099	release_sock(sk);
1100	return len;
1101
1102fail:
1103	kfree_skb(skb);
1104out:
1105	release_sock(sk);
1106	return err;
1107}
1108
1109static struct sk_buff *alloc_iucv_recv_skb(unsigned long len)
1110{
1111	size_t headroom, linear;
1112	struct sk_buff *skb;
1113	int err;
1114
1115	if (len < PAGE_SIZE) {
1116		headroom = 0;
1117		linear = len;
1118	} else {
1119		headroom = sizeof(struct iucv_array) * (MAX_SKB_FRAGS + 1);
1120		linear = PAGE_SIZE - headroom;
1121	}
1122	skb = alloc_skb_with_frags(headroom + linear, len - linear,
1123				   0, &err, GFP_ATOMIC | GFP_DMA);
1124	WARN_ONCE(!skb,
1125		  "alloc of recv iucv skb len=%lu failed with errcode=%d\n",
1126		  len, err);
1127	if (skb) {
1128		if (headroom)
1129			skb_reserve(skb, headroom);
1130		skb_put(skb, linear);
1131		skb->len = len;
1132		skb->data_len = len - linear;
1133	}
1134	return skb;
1135}
1136
1137/* iucv_process_message() - Receive a single outstanding IUCV message
1138 *
1139 * Locking: must be called with message_q.lock held
1140 */
1141static void iucv_process_message(struct sock *sk, struct sk_buff *skb,
1142				 struct iucv_path *path,
1143				 struct iucv_message *msg)
1144{
1145	int rc;
1146	unsigned int len;
1147
1148	len = iucv_msg_length(msg);
1149
1150	/* store msg target class in the second 4 bytes of skb ctrl buffer */
1151	/* Note: the first 4 bytes are reserved for msg tag */
1152	IUCV_SKB_CB(skb)->class = msg->class;
1153
1154	/* check for special IPRM messages (e.g. iucv_sock_shutdown) */
1155	if ((msg->flags & IUCV_IPRMDATA) && len > 7) {
1156		if (memcmp(msg->rmmsg, iprm_shutdown, 8) == 0) {
1157			skb->data = NULL;
1158			skb->len = 0;
1159		}
1160	} else {
1161		if (skb_is_nonlinear(skb)) {
1162			struct iucv_array *iba = (struct iucv_array *)skb->head;
1163			int i;
1164
1165			iba[0].address = virt_to_dma32(skb->data);
1166			iba[0].length = (u32)skb_headlen(skb);
1167			for (i = 0; i < skb_shinfo(skb)->nr_frags; i++) {
1168				skb_frag_t *frag = &skb_shinfo(skb)->frags[i];
1169
1170				iba[i + 1].address = virt_to_dma32(skb_frag_address(frag));
1171				iba[i + 1].length = (u32)skb_frag_size(frag);
1172			}
1173			rc = pr_iucv->message_receive(path, msg,
1174					      IUCV_IPBUFLST,
1175					      (void *)iba, len, NULL);
1176		} else {
1177			rc = pr_iucv->message_receive(path, msg,
1178					      msg->flags & IUCV_IPRMDATA,
1179					      skb->data, len, NULL);
1180		}
1181		if (rc) {
1182			kfree_skb(skb);
1183			return;
1184		}
1185		WARN_ON_ONCE(skb->len != len);
1186	}
1187
1188	IUCV_SKB_CB(skb)->offset = 0;
1189	if (sk_filter(sk, skb)) {
1190		sk_drops_inc(sk);	/* skb rejected by filter */
1191		kfree_skb(skb);
1192		return;
1193	}
1194	if (__sock_queue_rcv_skb(sk, skb))	/* handle rcv queue full */
1195		skb_queue_tail(&iucv_sk(sk)->backlog_skb_q, skb);
1196}
1197
1198/* iucv_process_message_q() - Process outstanding IUCV messages
1199 *
1200 * Locking: must be called with message_q.lock held
1201 */
1202static void iucv_process_message_q(struct sock *sk)
1203{
1204	struct iucv_sock *iucv = iucv_sk(sk);
1205	struct sk_buff *skb;
1206	struct sock_msg_q *p, *n;
1207
1208	list_for_each_entry_safe(p, n, &iucv->message_q.list, list) {
1209		skb = alloc_iucv_recv_skb(iucv_msg_length(&p->msg));
1210		if (!skb)
1211			break;
1212		iucv_process_message(sk, skb, p->path, &p->msg);
1213		list_del(&p->list);
1214		kfree(p);
1215		if (!skb_queue_empty(&iucv->backlog_skb_q))
1216			break;
1217	}
1218}
1219
1220static int iucv_sock_recvmsg(struct socket *sock, struct msghdr *msg,
1221			     size_t len, int flags)
1222{
1223	struct sock *sk = sock->sk;
1224	struct iucv_sock *iucv = iucv_sk(sk);
1225	unsigned int copied, rlen;
1226	struct sk_buff *skb, *rskb, *cskb;
1227	int err = 0;
1228	u32 offset;
1229
1230	if ((sk->sk_state == IUCV_DISCONN) &&
1231	    skb_queue_empty(&iucv->backlog_skb_q) &&
1232	    skb_queue_empty(&sk->sk_receive_queue) &&
1233	    list_empty(&iucv->message_q.list))
1234		return 0;
1235
1236	if (flags & (MSG_OOB))
1237		return -EOPNOTSUPP;
1238
1239	/* receive/dequeue next skb:
1240	 * the function understands MSG_PEEK and, thus, does not dequeue skb
1241	 * only refcount is increased.
1242	 */
1243	skb = skb_recv_datagram(sk, flags, &err);
1244	if (!skb) {
1245		if (sk->sk_shutdown & RCV_SHUTDOWN)
1246			return 0;
1247		return err;
1248	}
1249
1250	offset = IUCV_SKB_CB(skb)->offset;
1251	rlen   = skb->len - offset;		/* real length of skb */
1252	copied = min_t(unsigned int, rlen, len);
1253	if (!rlen)
1254		sk->sk_shutdown = sk->sk_shutdown | RCV_SHUTDOWN;
1255
1256	cskb = skb;
1257	if (skb_copy_datagram_msg(cskb, offset, msg, copied)) {
1258		err = -EFAULT;
1259		goto err_out;
1260	}
1261
1262	/* SOCK_SEQPACKET: set MSG_TRUNC if recv buf size is too small */
1263	if (sk->sk_type == SOCK_SEQPACKET) {
1264		if (copied < rlen)
1265			msg->msg_flags |= MSG_TRUNC;
1266		/* each iucv message contains a complete record */
1267		msg->msg_flags |= MSG_EOR;
1268	}
1269
1270	/* create control message to store iucv msg target class:
1271	 * get the trgcls from the control buffer of the skb due to
1272	 * fragmentation of original iucv message. */
1273	err = put_cmsg(msg, SOL_IUCV, SCM_IUCV_TRGCLS,
1274		       sizeof(IUCV_SKB_CB(skb)->class),
1275		       (void *)&IUCV_SKB_CB(skb)->class);
1276	if (err)
1277		goto err_out;
1278
1279	/* Mark read part of skb as used */
1280	if (!(flags & MSG_PEEK)) {
1281
1282		/* SOCK_STREAM: re-queue skb if it contains unreceived data */
1283		if (sk->sk_type == SOCK_STREAM) {
1284			if (copied < rlen) {
1285				IUCV_SKB_CB(skb)->offset = offset + copied;
1286				skb_queue_head(&sk->sk_receive_queue, skb);
1287				goto done;
1288			}
1289		}
1290
1291		consume_skb(skb);
1292		if (iucv->transport == AF_IUCV_TRANS_HIPER) {
1293			atomic_inc(&iucv->msg_recv);
1294			if (atomic_read(&iucv->msg_recv) > iucv->msglimit) {
1295				WARN_ON(1);
1296				iucv_sock_close(sk);
1297				return -EFAULT;
1298			}
1299		}
1300
1301		/* Queue backlog skbs */
1302		spin_lock_bh(&iucv->message_q.lock);
1303		rskb = skb_dequeue(&iucv->backlog_skb_q);
1304		while (rskb) {
1305			IUCV_SKB_CB(rskb)->offset = 0;
1306			if (__sock_queue_rcv_skb(sk, rskb)) {
1307				/* handle rcv queue full */
1308				skb_queue_head(&iucv->backlog_skb_q,
1309						rskb);
1310				break;
1311			}
1312			rskb = skb_dequeue(&iucv->backlog_skb_q);
1313		}
1314		if (skb_queue_empty(&iucv->backlog_skb_q)) {
1315			if (!list_empty(&iucv->message_q.list))
1316				iucv_process_message_q(sk);
1317			if (atomic_read(&iucv->msg_recv) >=
1318							iucv->msglimit / 2) {
1319				err = iucv_send_ctrl(sk, AF_IUCV_FLAG_WIN);
1320				if (err) {
1321					sk->sk_state = IUCV_DISCONN;
1322					sk->sk_state_change(sk);
1323				}
1324			}
1325		}
1326		spin_unlock_bh(&iucv->message_q.lock);
1327	}
1328
1329done:
1330	/* SOCK_SEQPACKET: return real length if MSG_TRUNC is set */
1331	if (sk->sk_type == SOCK_SEQPACKET && (flags & MSG_TRUNC))
1332		copied = rlen;
1333	if (flags & MSG_PEEK)
1334		skb_unref(skb);
1335
1336	return copied;
1337
1338err_out:
1339	if (!(flags & MSG_PEEK))
1340		skb_queue_head(&sk->sk_receive_queue, skb);
1341	else
1342		skb_unref(skb);
1343
1344	return err;
1345}
1346
1347static inline __poll_t iucv_accept_poll(struct sock *parent)
1348{
1349	struct iucv_sock *isk, *n;
1350	struct sock *sk;
1351
1352	list_for_each_entry_safe(isk, n, &iucv_sk(parent)->accept_q, accept_q) {
1353		sk = (struct sock *) isk;
1354
1355		if (sk->sk_state == IUCV_CONNECTED)
1356			return EPOLLIN | EPOLLRDNORM;
1357	}
1358
1359	return 0;
1360}
1361
1362static __poll_t iucv_sock_poll(struct file *file, struct socket *sock,
1363			       poll_table *wait)
1364{
1365	struct sock *sk = sock->sk;
1366	__poll_t mask = 0;
1367
1368	sock_poll_wait(file, sock, wait);
1369
1370	if (sk->sk_state == IUCV_LISTEN)
1371		return iucv_accept_poll(sk);
1372
1373	if (sk->sk_err || !skb_queue_empty(&sk->sk_error_queue))
1374		mask |= EPOLLERR |
1375			(sock_flag(sk, SOCK_SELECT_ERR_QUEUE) ? EPOLLPRI : 0);
1376
1377	if (sk->sk_shutdown & RCV_SHUTDOWN)
1378		mask |= EPOLLRDHUP;
1379
1380	if (sk->sk_shutdown == SHUTDOWN_MASK)
1381		mask |= EPOLLHUP;
1382
1383	if (!skb_queue_empty(&sk->sk_receive_queue) ||
1384	    (sk->sk_shutdown & RCV_SHUTDOWN))
1385		mask |= EPOLLIN | EPOLLRDNORM;
1386
1387	if (sk->sk_state == IUCV_CLOSED)
1388		mask |= EPOLLHUP;
1389
1390	if (sk->sk_state == IUCV_DISCONN)
1391		mask |= EPOLLIN;
1392
1393	if (sock_writeable(sk) && iucv_below_msglim(sk))
1394		mask |= EPOLLOUT | EPOLLWRNORM | EPOLLWRBAND;
1395	else
1396		sk_set_bit(SOCKWQ_ASYNC_NOSPACE, sk);
1397
1398	return mask;
1399}
1400
1401static int iucv_sock_shutdown(struct socket *sock, int how)
1402{
1403	struct sock *sk = sock->sk;
1404	struct iucv_sock *iucv = iucv_sk(sk);
1405	struct iucv_message txmsg;
1406	int err = 0;
1407
1408	how++;
1409
1410	if ((how & ~SHUTDOWN_MASK) || !how)
1411		return -EINVAL;
1412
1413	lock_sock(sk);
1414	switch (sk->sk_state) {
1415	case IUCV_LISTEN:
1416	case IUCV_DISCONN:
1417	case IUCV_CLOSING:
1418	case IUCV_CLOSED:
1419		err = -ENOTCONN;
1420		goto fail;
1421	default:
1422		break;
1423	}
1424
1425	if ((how == SEND_SHUTDOWN || how == SHUTDOWN_MASK) &&
1426	    sk->sk_state == IUCV_CONNECTED) {
1427		if (iucv->transport == AF_IUCV_TRANS_IUCV) {
1428			txmsg.class = 0;
1429			txmsg.tag = 0;
1430			err = pr_iucv->message_send(iucv->path, &txmsg,
1431				IUCV_IPRMDATA, 0, (void *) iprm_shutdown, 8);
1432			if (err) {
1433				switch (err) {
1434				case 1:
1435					err = -ENOTCONN;
1436					break;
1437				case 2:
1438					err = -ECONNRESET;
1439					break;
1440				default:
1441					err = -ENOTCONN;
1442					break;
1443				}
1444			}
1445		} else
1446			iucv_send_ctrl(sk, AF_IUCV_FLAG_SHT);
1447	}
1448
1449	sk->sk_shutdown |= how;
1450	if (how == RCV_SHUTDOWN || how == SHUTDOWN_MASK) {
1451		if ((iucv->transport == AF_IUCV_TRANS_IUCV) &&
1452		    iucv->path) {
1453			err = pr_iucv->path_quiesce(iucv->path, NULL);
1454			if (err)
1455				err = -ENOTCONN;
1456/*			skb_queue_purge(&sk->sk_receive_queue); */
1457		}
1458		skb_queue_purge(&sk->sk_receive_queue);
1459	}
1460
1461	/* Wake up anyone sleeping in poll */
1462	sk->sk_state_change(sk);
1463
1464fail:
1465	release_sock(sk);
1466	return err;
1467}
1468
1469static int iucv_sock_release(struct socket *sock)
1470{
1471	struct sock *sk = sock->sk;
1472	int err = 0;
1473
1474	if (!sk)
1475		return 0;
1476
1477	iucv_sock_close(sk);
1478
1479	sock_orphan(sk);
1480	iucv_sock_kill(sk);
1481	return err;
1482}
1483
1484/* getsockopt and setsockopt */
1485static int iucv_sock_setsockopt(struct socket *sock, int level, int optname,
1486				sockptr_t optval, unsigned int optlen)
1487{
1488	struct sock *sk = sock->sk;
1489	struct iucv_sock *iucv = iucv_sk(sk);
1490	int val;
1491	int rc;
1492
1493	if (level != SOL_IUCV)
1494		return -ENOPROTOOPT;
1495
1496	if (optlen < sizeof(int))
1497		return -EINVAL;
1498
1499	if (copy_from_sockptr(&val, optval, sizeof(int)))
1500		return -EFAULT;
1501
1502	rc = 0;
1503
1504	lock_sock(sk);
1505	switch (optname) {
1506	case SO_IPRMDATA_MSG:
1507		if (val)
1508			iucv->flags |= IUCV_IPRMDATA;
1509		else
1510			iucv->flags &= ~IUCV_IPRMDATA;
1511		break;
1512	case SO_MSGLIMIT:
1513		switch (sk->sk_state) {
1514		case IUCV_OPEN:
1515		case IUCV_BOUND:
1516			if (val < 1 || val > U16_MAX)
1517				rc = -EINVAL;
1518			else
1519				iucv->msglimit = val;
1520			break;
1521		default:
1522			rc = -EINVAL;
1523			break;
1524		}
1525		break;
1526	default:
1527		rc = -ENOPROTOOPT;
1528		break;
1529	}
1530	release_sock(sk);
1531
1532	return rc;
1533}
1534
1535static int iucv_sock_getsockopt(struct socket *sock, int level, int optname,
1536				char __user *optval, int __user *optlen)
1537{
1538	struct sock *sk = sock->sk;
1539	struct iucv_sock *iucv = iucv_sk(sk);
1540	unsigned int val;
1541	int len;
1542
1543	if (level != SOL_IUCV)
1544		return -ENOPROTOOPT;
1545
1546	if (get_user(len, optlen))
1547		return -EFAULT;
1548
1549	if (len < 0)
1550		return -EINVAL;
1551
1552	len = min_t(unsigned int, len, sizeof(int));
1553
1554	switch (optname) {
1555	case SO_IPRMDATA_MSG:
1556		val = (iucv->flags & IUCV_IPRMDATA) ? 1 : 0;
1557		break;
1558	case SO_MSGLIMIT:
1559		lock_sock(sk);
1560		val = (iucv->path != NULL) ? iucv->path->msglim	/* connected */
1561					   : iucv->msglimit;	/* default */
1562		release_sock(sk);
1563		break;
1564	case SO_MSGSIZE:
1565		if (sk->sk_state == IUCV_OPEN)
1566			return -EBADFD;
1567		val = (iucv->hs_dev) ? iucv->hs_dev->mtu -
1568				sizeof(struct af_iucv_trans_hdr) - ETH_HLEN :
1569				0x7fffffff;
1570		break;
1571	default:
1572		return -ENOPROTOOPT;
1573	}
1574
1575	if (put_user(len, optlen))
1576		return -EFAULT;
1577	if (copy_to_user(optval, &val, len))
1578		return -EFAULT;
1579
1580	return 0;
1581}
1582
1583
1584/* Callback wrappers - called from iucv base support */
1585static int iucv_callback_connreq(struct iucv_path *path,
1586				 u8 ipvmid[8], u8 ipuser[16])
1587{
1588	unsigned char user_data[16];
1589	unsigned char nuser_data[16];
1590	unsigned char src_name[8];
1591	struct sock *sk, *nsk;
1592	struct iucv_sock *iucv, *niucv;
1593	int err;
1594
1595	memcpy(src_name, ipuser, 8);
1596	EBCASC(src_name, 8);
1597	/* Find out if this path belongs to af_iucv. */
1598	read_lock(&iucv_sk_list.lock);
1599	iucv = NULL;
1600	sk = NULL;
1601	sk_for_each(sk, &iucv_sk_list.head)
1602		if (sk->sk_state == IUCV_LISTEN &&
1603		    !memcmp(&iucv_sk(sk)->src_name, src_name, 8)) {
1604			/*
1605			 * Found a listening socket with
1606			 * src_name == ipuser[0-7].
1607			 */
1608			iucv = iucv_sk(sk);
1609			break;
1610		}
1611	read_unlock(&iucv_sk_list.lock);
1612	if (!iucv)
1613		/* No socket found, not one of our paths. */
1614		return -EINVAL;
1615
1616	bh_lock_sock(sk);
1617
1618	/* Check if parent socket is listening */
1619	low_nmcpy(user_data, iucv->src_name);
1620	high_nmcpy(user_data, iucv->dst_name);
1621	ASCEBC(user_data, sizeof(user_data));
1622	if (sk->sk_state != IUCV_LISTEN) {
1623		err = pr_iucv->path_sever(path, user_data);
1624		iucv_path_free(path);
1625		goto fail;
1626	}
1627
1628	/* Check for backlog size */
1629	if (sk_acceptq_is_full(sk)) {
1630		err = pr_iucv->path_sever(path, user_data);
1631		iucv_path_free(path);
1632		goto fail;
1633	}
1634
1635	/* Create the new socket */
1636	nsk = iucv_sock_alloc(NULL, sk->sk_protocol, GFP_ATOMIC, 0);
1637	if (!nsk) {
1638		err = pr_iucv->path_sever(path, user_data);
1639		iucv_path_free(path);
1640		goto fail;
1641	}
1642
1643	niucv = iucv_sk(nsk);
1644	iucv_sock_init(nsk, sk);
1645	niucv->transport = AF_IUCV_TRANS_IUCV;
1646	nsk->sk_allocation |= GFP_DMA;
1647
1648	/* Set the new iucv_sock */
1649	memcpy(niucv->dst_name, ipuser + 8, 8);
1650	EBCASC(niucv->dst_name, 8);
1651	memcpy(niucv->dst_user_id, ipvmid, 8);
1652	memcpy(niucv->src_name, iucv->src_name, 8);
1653	memcpy(niucv->src_user_id, iucv->src_user_id, 8);
1654	niucv->path = path;
1655
1656	/* Call iucv_accept */
1657	high_nmcpy(nuser_data, ipuser + 8);
1658	memcpy(nuser_data + 8, niucv->src_name, 8);
1659	ASCEBC(nuser_data + 8, 8);
1660
1661	/* set message limit for path based on msglimit of accepting socket */
1662	niucv->msglimit = iucv->msglimit;
1663	path->msglim = iucv->msglimit;
1664	err = pr_iucv->path_accept(path, &af_iucv_handler, nuser_data, nsk);
1665	if (err) {
1666		iucv_sever_path(nsk, 1);
1667		iucv_sock_kill(nsk);
1668		goto fail;
1669	}
1670
1671	iucv_accept_enqueue(sk, nsk);
1672
1673	/* Wake up accept */
1674	nsk->sk_state = IUCV_CONNECTED;
1675	sk->sk_data_ready(sk);
1676	err = 0;
1677fail:
1678	bh_unlock_sock(sk);
1679	return 0;
1680}
1681
1682static void iucv_callback_connack(struct iucv_path *path, u8 ipuser[16])
1683{
1684	struct sock *sk = path->private;
1685
1686	sk->sk_state = IUCV_CONNECTED;
1687	sk->sk_state_change(sk);
1688}
1689
1690static void iucv_callback_rx(struct iucv_path *path, struct iucv_message *msg)
1691{
1692	struct sock *sk = path->private;
1693	struct iucv_sock *iucv = iucv_sk(sk);
1694	struct sk_buff *skb;
1695	struct sock_msg_q *save_msg;
1696	int len;
1697
1698	if (sk->sk_shutdown & RCV_SHUTDOWN) {
1699		pr_iucv->message_reject(path, msg);
1700		return;
1701	}
1702
1703	spin_lock(&iucv->message_q.lock);
1704
1705	if (!list_empty(&iucv->message_q.list) ||
1706	    !skb_queue_empty(&iucv->backlog_skb_q))
1707		goto save_message;
1708
1709	len = atomic_read(&sk->sk_rmem_alloc);
1710	len += SKB_TRUESIZE(iucv_msg_length(msg));
1711	if (len > sk->sk_rcvbuf)
1712		goto save_message;
1713
1714	skb = alloc_iucv_recv_skb(iucv_msg_length(msg));
1715	if (!skb)
1716		goto save_message;
1717
1718	iucv_process_message(sk, skb, path, msg);
1719	goto out_unlock;
1720
1721save_message:
1722	save_msg = kzalloc(sizeof(struct sock_msg_q), GFP_ATOMIC | GFP_DMA);
1723	if (!save_msg)
1724		goto out_unlock;
1725	save_msg->path = path;
1726	save_msg->msg = *msg;
1727
1728	list_add_tail(&save_msg->list, &iucv->message_q.list);
1729
1730out_unlock:
1731	spin_unlock(&iucv->message_q.lock);
1732}
1733
1734static void iucv_callback_txdone(struct iucv_path *path,
1735				 struct iucv_message *msg)
1736{
1737	struct sock *sk = path->private;
1738	struct sk_buff *this = NULL;
1739	struct sk_buff_head *list;
1740	struct sk_buff *list_skb;
1741	struct iucv_sock *iucv;
1742	unsigned long flags;
1743
1744	iucv = iucv_sk(sk);
1745	list = &iucv->send_skb_q;
1746
1747	bh_lock_sock(sk);
1748
1749	spin_lock_irqsave(&list->lock, flags);
1750	skb_queue_walk(list, list_skb) {
1751		if (msg->tag == IUCV_SKB_CB(list_skb)->tag) {
1752			this = list_skb;
1753			break;
1754		}
1755	}
1756	if (this) {
1757		atomic_dec(&iucv->skbs_in_xmit);
1758		__skb_unlink(this, list);
1759	}
1760
1761	spin_unlock_irqrestore(&list->lock, flags);
1762
1763	if (this) {
1764		consume_skb(this);
1765		/* wake up any process waiting for sending */
1766		iucv_sock_wake_msglim(sk);
1767	}
1768
1769	if (sk->sk_state == IUCV_CLOSING) {
1770		if (atomic_read(&iucv->skbs_in_xmit) == 0) {
1771			sk->sk_state = IUCV_CLOSED;
1772			sk->sk_state_change(sk);
1773		}
1774	}
1775	bh_unlock_sock(sk);
1776
1777}
1778
1779static void iucv_callback_connrej(struct iucv_path *path, u8 ipuser[16])
1780{
1781	struct sock *sk = path->private;
1782
1783	if (sk->sk_state == IUCV_CLOSED)
1784		return;
1785
1786	bh_lock_sock(sk);
1787	iucv_sever_path(sk, 1);
1788	sk->sk_state = IUCV_DISCONN;
1789
1790	sk->sk_state_change(sk);
1791	bh_unlock_sock(sk);
1792}
1793
1794/* called if the other communication side shuts down its RECV direction;
1795 * in turn, the callback sets SEND_SHUTDOWN to disable sending of data.
1796 */
1797static void iucv_callback_shutdown(struct iucv_path *path, u8 ipuser[16])
1798{
1799	struct sock *sk = path->private;
1800
1801	bh_lock_sock(sk);
1802	if (sk->sk_state != IUCV_CLOSED) {
1803		sk->sk_shutdown |= SEND_SHUTDOWN;
1804		sk->sk_state_change(sk);
1805	}
1806	bh_unlock_sock(sk);
1807}
1808
1809static struct iucv_handler af_iucv_handler = {
1810	.path_pending		= iucv_callback_connreq,
1811	.path_complete		= iucv_callback_connack,
1812	.path_severed		= iucv_callback_connrej,
1813	.message_pending	= iucv_callback_rx,
1814	.message_complete	= iucv_callback_txdone,
1815	.path_quiesced		= iucv_callback_shutdown,
1816};
1817
1818/***************** HiperSockets transport callbacks ********************/
1819static void afiucv_swap_src_dest(struct sk_buff *skb)
1820{
1821	struct af_iucv_trans_hdr *trans_hdr = iucv_trans_hdr(skb);
1822	char tmpID[8];
1823	char tmpName[8];
1824
1825	ASCEBC(trans_hdr->destUserID, sizeof(trans_hdr->destUserID));
1826	ASCEBC(trans_hdr->destAppName, sizeof(trans_hdr->destAppName));
1827	ASCEBC(trans_hdr->srcUserID, sizeof(trans_hdr->srcUserID));
1828	ASCEBC(trans_hdr->srcAppName, sizeof(trans_hdr->srcAppName));
1829	memcpy(tmpID, trans_hdr->srcUserID, 8);
1830	memcpy(tmpName, trans_hdr->srcAppName, 8);
1831	memcpy(trans_hdr->srcUserID, trans_hdr->destUserID, 8);
1832	memcpy(trans_hdr->srcAppName, trans_hdr->destAppName, 8);
1833	memcpy(trans_hdr->destUserID, tmpID, 8);
1834	memcpy(trans_hdr->destAppName, tmpName, 8);
1835	skb_push(skb, ETH_HLEN);
1836	memset(skb->data, 0, ETH_HLEN);
1837}
1838
1839/*
1840 * afiucv_hs_callback_syn - react on received SYN
1841 */
1842static int afiucv_hs_callback_syn(struct sock *sk, struct sk_buff *skb)
1843{
1844	struct af_iucv_trans_hdr *trans_hdr = iucv_trans_hdr(skb);
1845	struct sock *nsk;
1846	struct iucv_sock *iucv, *niucv;
1847	int err;
1848
1849	iucv = iucv_sk(sk);
1850	if (!iucv) {
1851		/* no sock - connection refused */
1852		afiucv_swap_src_dest(skb);
1853		trans_hdr->flags = AF_IUCV_FLAG_SYN | AF_IUCV_FLAG_FIN;
1854		err = dev_queue_xmit(skb);
1855		goto out;
1856	}
1857
1858	nsk = iucv_sock_alloc(NULL, sk->sk_protocol, GFP_ATOMIC, 0);
1859	bh_lock_sock(sk);
1860	if ((sk->sk_state != IUCV_LISTEN) ||
1861	    sk_acceptq_is_full(sk) ||
1862	    !nsk) {
1863		/* error on server socket - connection refused */
1864		afiucv_swap_src_dest(skb);
1865		trans_hdr->flags = AF_IUCV_FLAG_SYN | AF_IUCV_FLAG_FIN;
1866		err = dev_queue_xmit(skb);
1867		iucv_sock_kill(nsk);
1868		bh_unlock_sock(sk);
1869		goto out;
1870	}
1871
1872	niucv = iucv_sk(nsk);
1873	iucv_sock_init(nsk, sk);
1874	niucv->transport = AF_IUCV_TRANS_HIPER;
1875	niucv->msglimit = iucv->msglimit;
1876	if (!trans_hdr->window)
1877		niucv->msglimit_peer = IUCV_HIPER_MSGLIM_DEFAULT;
1878	else
1879		niucv->msglimit_peer = trans_hdr->window;
1880	memcpy(niucv->dst_name, trans_hdr->srcAppName, 8);
1881	memcpy(niucv->dst_user_id, trans_hdr->srcUserID, 8);
1882	memcpy(niucv->src_name, iucv->src_name, 8);
1883	memcpy(niucv->src_user_id, iucv->src_user_id, 8);
1884	nsk->sk_bound_dev_if = sk->sk_bound_dev_if;
1885	niucv->hs_dev = iucv->hs_dev;
1886	dev_hold(niucv->hs_dev);
1887	afiucv_swap_src_dest(skb);
1888	trans_hdr->flags = AF_IUCV_FLAG_SYN | AF_IUCV_FLAG_ACK;
1889	trans_hdr->window = niucv->msglimit;
1890	/* if receiver acks the xmit connection is established */
1891	err = dev_queue_xmit(skb);
1892	if (!err) {
1893		iucv_accept_enqueue(sk, nsk);
1894		nsk->sk_state = IUCV_CONNECTED;
1895		sk->sk_data_ready(sk);
1896	} else
1897		iucv_sock_kill(nsk);
1898	bh_unlock_sock(sk);
1899
1900out:
1901	return NET_RX_SUCCESS;
1902}
1903
1904/*
1905 * afiucv_hs_callback_synack() - react on received SYN-ACK
1906 */
1907static int afiucv_hs_callback_synack(struct sock *sk, struct sk_buff *skb)
1908{
1909	struct iucv_sock *iucv = iucv_sk(sk);
1910
1911	if (!iucv || sk->sk_state != IUCV_BOUND) {
1912		kfree_skb(skb);
1913		return NET_RX_SUCCESS;
1914	}
1915
1916	bh_lock_sock(sk);
1917	iucv->msglimit_peer = iucv_trans_hdr(skb)->window;
1918	sk->sk_state = IUCV_CONNECTED;
1919	sk->sk_state_change(sk);
1920	bh_unlock_sock(sk);
1921	consume_skb(skb);
1922	return NET_RX_SUCCESS;
1923}
1924
1925/*
1926 * afiucv_hs_callback_synfin() - react on received SYN_FIN
1927 */
1928static int afiucv_hs_callback_synfin(struct sock *sk, struct sk_buff *skb)
1929{
1930	struct iucv_sock *iucv = iucv_sk(sk);
1931
1932	if (!iucv || sk->sk_state != IUCV_BOUND) {
1933		kfree_skb(skb);
1934		return NET_RX_SUCCESS;
1935	}
1936
1937	bh_lock_sock(sk);
1938	sk->sk_state = IUCV_DISCONN;
1939	sk->sk_state_change(sk);
1940	bh_unlock_sock(sk);
1941	consume_skb(skb);
1942	return NET_RX_SUCCESS;
1943}
1944
1945/*
1946 * afiucv_hs_callback_fin() - react on received FIN
1947 */
1948static int afiucv_hs_callback_fin(struct sock *sk, struct sk_buff *skb)
1949{
1950	struct iucv_sock *iucv = iucv_sk(sk);
1951
1952	/* other end of connection closed */
1953	if (!iucv) {
1954		kfree_skb(skb);
1955		return NET_RX_SUCCESS;
1956	}
1957
1958	bh_lock_sock(sk);
1959	if (sk->sk_state == IUCV_CONNECTED) {
1960		sk->sk_state = IUCV_DISCONN;
1961		sk->sk_state_change(sk);
1962	}
1963	bh_unlock_sock(sk);
1964	consume_skb(skb);
1965	return NET_RX_SUCCESS;
1966}
1967
1968/*
1969 * afiucv_hs_callback_win() - react on received WIN
1970 */
1971static int afiucv_hs_callback_win(struct sock *sk, struct sk_buff *skb)
1972{
1973	struct iucv_sock *iucv = iucv_sk(sk);
1974
1975	if (!iucv)
1976		return NET_RX_SUCCESS;
1977
1978	if (sk->sk_state != IUCV_CONNECTED)
1979		return NET_RX_SUCCESS;
1980
1981	atomic_sub(iucv_trans_hdr(skb)->window, &iucv->msg_sent);
1982	iucv_sock_wake_msglim(sk);
1983	return NET_RX_SUCCESS;
1984}
1985
1986/*
1987 * afiucv_hs_callback_rx() - react on received data
1988 */
1989static int afiucv_hs_callback_rx(struct sock *sk, struct sk_buff *skb)
1990{
1991	struct iucv_sock *iucv = iucv_sk(sk);
1992
1993	if (!iucv) {
1994		kfree_skb(skb);
1995		return NET_RX_SUCCESS;
1996	}
1997
1998	if (sk->sk_state != IUCV_CONNECTED) {
1999		kfree_skb(skb);
2000		return NET_RX_SUCCESS;
2001	}
2002
2003	if (sk->sk_shutdown & RCV_SHUTDOWN) {
2004		kfree_skb(skb);
2005		return NET_RX_SUCCESS;
2006	}
2007
2008	/* write stuff from iucv_msg to skb cb */
2009	skb_pull(skb, sizeof(struct af_iucv_trans_hdr));
2010	skb_reset_transport_header(skb);
2011	skb_reset_network_header(skb);
2012	IUCV_SKB_CB(skb)->offset = 0;
2013	if (sk_filter(sk, skb)) {
2014		sk_drops_inc(sk);	/* skb rejected by filter */
2015		kfree_skb(skb);
2016		return NET_RX_SUCCESS;
2017	}
2018
2019	spin_lock(&iucv->message_q.lock);
2020	if (skb_queue_empty(&iucv->backlog_skb_q)) {
2021		if (__sock_queue_rcv_skb(sk, skb))
2022			/* handle rcv queue full */
2023			skb_queue_tail(&iucv->backlog_skb_q, skb);
2024	} else
2025		skb_queue_tail(&iucv_sk(sk)->backlog_skb_q, skb);
2026	spin_unlock(&iucv->message_q.lock);
2027	return NET_RX_SUCCESS;
2028}
2029
2030/*
2031 * afiucv_hs_rcv() - base function for arriving data through HiperSockets
2032 *                   transport
2033 *                   called from netif RX softirq
2034 */
2035static int afiucv_hs_rcv(struct sk_buff *skb, struct net_device *dev,
2036	struct packet_type *pt, struct net_device *orig_dev)
2037{
2038	struct sock *sk;
2039	struct iucv_sock *iucv;
2040	struct af_iucv_trans_hdr *trans_hdr;
2041	int err = NET_RX_SUCCESS;
2042	char nullstring[8];
2043
2044	if (!pskb_may_pull(skb, sizeof(*trans_hdr))) {
2045		kfree_skb(skb);
2046		return NET_RX_SUCCESS;
2047	}
2048
2049	trans_hdr = iucv_trans_hdr(skb);
2050	EBCASC(trans_hdr->destAppName, sizeof(trans_hdr->destAppName));
2051	EBCASC(trans_hdr->destUserID, sizeof(trans_hdr->destUserID));
2052	EBCASC(trans_hdr->srcAppName, sizeof(trans_hdr->srcAppName));
2053	EBCASC(trans_hdr->srcUserID, sizeof(trans_hdr->srcUserID));
2054	memset(nullstring, 0, sizeof(nullstring));
2055	iucv = NULL;
2056	sk = NULL;
2057	read_lock(&iucv_sk_list.lock);
2058	sk_for_each(sk, &iucv_sk_list.head) {
2059		if (trans_hdr->flags == AF_IUCV_FLAG_SYN) {
2060			if ((!memcmp(&iucv_sk(sk)->src_name,
2061				     trans_hdr->destAppName, 8)) &&
2062			    (!memcmp(&iucv_sk(sk)->src_user_id,
2063				     trans_hdr->destUserID, 8)) &&
2064			    (!memcmp(&iucv_sk(sk)->dst_name, nullstring, 8)) &&
2065			    (!memcmp(&iucv_sk(sk)->dst_user_id,
2066				     nullstring, 8))) {
2067				iucv = iucv_sk(sk);
2068				break;
2069			}
2070		} else {
2071			if ((!memcmp(&iucv_sk(sk)->src_name,
2072				     trans_hdr->destAppName, 8)) &&
2073			    (!memcmp(&iucv_sk(sk)->src_user_id,
2074				     trans_hdr->destUserID, 8)) &&
2075			    (!memcmp(&iucv_sk(sk)->dst_name,
2076				     trans_hdr->srcAppName, 8)) &&
2077			    (!memcmp(&iucv_sk(sk)->dst_user_id,
2078				     trans_hdr->srcUserID, 8))) {
2079				iucv = iucv_sk(sk);
2080				break;
2081			}
2082		}
2083	}
2084	read_unlock(&iucv_sk_list.lock);
2085	if (!iucv)
2086		sk = NULL;
2087
2088	/* no sock
2089	how should we send with no sock
2090	1) send without sock no send rc checking?
2091	2) introduce default sock to handle this cases
2092
2093	 SYN -> send SYN|ACK in good case, send SYN|FIN in bad case
2094	 data -> send FIN
2095	 SYN|ACK, SYN|FIN, FIN -> no action? */
2096
2097	switch (trans_hdr->flags) {
2098	case AF_IUCV_FLAG_SYN:
2099		/* connect request */
2100		err = afiucv_hs_callback_syn(sk, skb);
2101		break;
2102	case (AF_IUCV_FLAG_SYN | AF_IUCV_FLAG_ACK):
2103		/* connect request confirmed */
2104		err = afiucv_hs_callback_synack(sk, skb);
2105		break;
2106	case (AF_IUCV_FLAG_SYN | AF_IUCV_FLAG_FIN):
2107		/* connect request refused */
2108		err = afiucv_hs_callback_synfin(sk, skb);
2109		break;
2110	case (AF_IUCV_FLAG_FIN):
2111		/* close request */
2112		err = afiucv_hs_callback_fin(sk, skb);
2113		break;
2114	case (AF_IUCV_FLAG_WIN):
2115		err = afiucv_hs_callback_win(sk, skb);
2116		if (skb->len == sizeof(struct af_iucv_trans_hdr)) {
2117			consume_skb(skb);
2118			break;
2119		}
2120		fallthrough;	/* and receive non-zero length data */
2121	case (AF_IUCV_FLAG_SHT):
2122		/* shutdown request */
2123		fallthrough;	/* and receive zero length data */
2124	case 0:
2125		/* plain data frame */
2126		IUCV_SKB_CB(skb)->class = trans_hdr->iucv_hdr.class;
2127		err = afiucv_hs_callback_rx(sk, skb);
2128		break;
2129	default:
2130		kfree_skb(skb);
2131	}
2132
2133	return err;
2134}
2135
2136/*
2137 * afiucv_hs_callback_txnotify() - handle send notifications from HiperSockets
2138 *                                 transport
2139 */
2140static void afiucv_hs_callback_txnotify(struct sock *sk, enum iucv_tx_notify n)
2141{
2142	struct iucv_sock *iucv = iucv_sk(sk);
2143
2144	if (sock_flag(sk, SOCK_ZAPPED))
2145		return;
2146
2147	switch (n) {
2148	case TX_NOTIFY_OK:
2149		atomic_dec(&iucv->skbs_in_xmit);
2150		iucv_sock_wake_msglim(sk);
2151		break;
2152	case TX_NOTIFY_PENDING:
2153		atomic_inc(&iucv->pendings);
2154		break;
2155	case TX_NOTIFY_DELAYED_OK:
2156		atomic_dec(&iucv->skbs_in_xmit);
2157		if (atomic_dec_return(&iucv->pendings) <= 0)
2158			iucv_sock_wake_msglim(sk);
2159		break;
2160	default:
2161		atomic_dec(&iucv->skbs_in_xmit);
2162		if (sk->sk_state == IUCV_CONNECTED) {
2163			sk->sk_state = IUCV_DISCONN;
2164			sk->sk_state_change(sk);
2165		}
2166	}
2167
2168	if (sk->sk_state == IUCV_CLOSING) {
2169		if (atomic_read(&iucv->skbs_in_xmit) == 0) {
2170			sk->sk_state = IUCV_CLOSED;
2171			sk->sk_state_change(sk);
2172		}
2173	}
2174}
2175
2176/*
2177 * afiucv_netdev_event: handle netdev notifier chain events
2178 */
2179static int afiucv_netdev_event(struct notifier_block *this,
2180			       unsigned long event, void *ptr)
2181{
2182	struct net_device *event_dev = netdev_notifier_info_to_dev(ptr);
2183	struct sock *sk;
2184	struct iucv_sock *iucv;
2185
2186	switch (event) {
2187	case NETDEV_REBOOT:
2188	case NETDEV_GOING_DOWN:
2189		sk_for_each(sk, &iucv_sk_list.head) {
2190			iucv = iucv_sk(sk);
2191			if ((iucv->hs_dev == event_dev) &&
2192			    (sk->sk_state == IUCV_CONNECTED)) {
2193				if (event == NETDEV_GOING_DOWN)
2194					iucv_send_ctrl(sk, AF_IUCV_FLAG_FIN);
2195				sk->sk_state = IUCV_DISCONN;
2196				sk->sk_state_change(sk);
2197			}
2198		}
2199		break;
2200	case NETDEV_DOWN:
2201	case NETDEV_UNREGISTER:
2202	default:
2203		break;
2204	}
2205	return NOTIFY_DONE;
2206}
2207
2208static struct notifier_block afiucv_netdev_notifier = {
2209	.notifier_call = afiucv_netdev_event,
2210};
2211
2212static const struct proto_ops iucv_sock_ops = {
2213	.family		= PF_IUCV,
2214	.owner		= THIS_MODULE,
2215	.release	= iucv_sock_release,
2216	.bind		= iucv_sock_bind,
2217	.connect	= iucv_sock_connect,
2218	.listen		= iucv_sock_listen,
2219	.accept		= iucv_sock_accept,
2220	.getname	= iucv_sock_getname,
2221	.sendmsg	= iucv_sock_sendmsg,
2222	.recvmsg	= iucv_sock_recvmsg,
2223	.poll		= iucv_sock_poll,
2224	.ioctl		= sock_no_ioctl,
2225	.mmap		= sock_no_mmap,
2226	.socketpair	= sock_no_socketpair,
2227	.shutdown	= iucv_sock_shutdown,
2228	.setsockopt	= iucv_sock_setsockopt,
2229	.getsockopt	= iucv_sock_getsockopt,
2230};
2231
2232static int iucv_sock_create(struct net *net, struct socket *sock, int protocol,
2233			    int kern)
2234{
2235	struct sock *sk;
2236
2237	if (protocol && protocol != PF_IUCV)
2238		return -EPROTONOSUPPORT;
2239
2240	sock->state = SS_UNCONNECTED;
2241
2242	switch (sock->type) {
2243	case SOCK_STREAM:
2244	case SOCK_SEQPACKET:
2245		/* currently, proto ops can handle both sk types */
2246		sock->ops = &iucv_sock_ops;
2247		break;
2248	default:
2249		return -ESOCKTNOSUPPORT;
2250	}
2251
2252	sk = iucv_sock_alloc(sock, protocol, GFP_KERNEL, kern);
2253	if (!sk)
2254		return -ENOMEM;
2255
2256	iucv_sock_init(sk, NULL);
2257
2258	return 0;
2259}
2260
2261static const struct net_proto_family iucv_sock_family_ops = {
2262	.family	= AF_IUCV,
2263	.owner	= THIS_MODULE,
2264	.create	= iucv_sock_create,
2265};
2266
2267static struct packet_type iucv_packet_type = {
2268	.type = cpu_to_be16(ETH_P_AF_IUCV),
2269	.func = afiucv_hs_rcv,
2270};
2271
2272static int __init afiucv_init(void)
2273{
2274	int err;
2275
2276	if (machine_is_vm() && IS_ENABLED(CONFIG_IUCV)) {
2277		cpcmd("QUERY USERID", iucv_userid, sizeof(iucv_userid), &err);
2278		if (unlikely(err)) {
2279			WARN_ON(err);
2280			err = -EPROTONOSUPPORT;
2281			goto out;
2282		}
2283
2284		pr_iucv = &iucv_if;
2285	} else {
2286		memset(&iucv_userid, 0, sizeof(iucv_userid));
2287		pr_iucv = NULL;
2288	}
2289
2290	err = proto_register(&iucv_proto, 0);
2291	if (err)
2292		goto out;
2293	err = sock_register(&iucv_sock_family_ops);
2294	if (err)
2295		goto out_proto;
2296
2297	if (pr_iucv) {
2298		err = pr_iucv->iucv_register(&af_iucv_handler, 0);
2299		if (err)
2300			goto out_sock;
2301	}
2302
2303	err = register_netdevice_notifier(&afiucv_netdev_notifier);
2304	if (err)
2305		goto out_notifier;
2306
2307	dev_add_pack(&iucv_packet_type);
2308	return 0;
2309
2310out_notifier:
2311	if (pr_iucv)
2312		pr_iucv->iucv_unregister(&af_iucv_handler, 0);
2313out_sock:
2314	sock_unregister(PF_IUCV);
2315out_proto:
2316	proto_unregister(&iucv_proto);
2317out:
2318	return err;
2319}
2320
2321static void __exit afiucv_exit(void)
2322{
2323	if (pr_iucv)
2324		pr_iucv->iucv_unregister(&af_iucv_handler, 0);
2325
2326	unregister_netdevice_notifier(&afiucv_netdev_notifier);
2327	dev_remove_pack(&iucv_packet_type);
2328	sock_unregister(PF_IUCV);
2329	proto_unregister(&iucv_proto);
2330}
2331
2332module_init(afiucv_init);
2333module_exit(afiucv_exit);
2334
2335MODULE_AUTHOR("Jennifer Hunt <jenhunt@us.ibm.com>");
2336MODULE_DESCRIPTION("IUCV Sockets ver " VERSION);
2337MODULE_VERSION(VERSION);
2338MODULE_LICENSE("GPL");
2339MODULE_ALIAS_NETPROTO(PF_IUCV);