1 files changed, 386 insertions, 202 deletions

diff --git a/net/phonet/pep.c b/net/phonet/pep.c
index 15003021f4f0..f17fd841f948 100644
--- a/net/phonet/pep.c
+++ b/net/phonet/pep.c
@@ -42,7 +42,7 @@
  * TCP_ESTABLISHED      connected pipe in enabled state
  *
  * pep_sock locking:
- *  - sk_state, ackq, hlist: sock lock needed
+ *  - sk_state, hlist: sock lock needed
  *  - listener: read only
  *  - pipe_handle: read only
  */
@@ -50,11 +50,6 @@
 #define CREDITS_MAX     10
 #define CREDITS_THR     7
 
-static const struct sockaddr_pn pipe_srv = {
-        .spn_family = AF_PHONET,
-        .spn_resource = 0xD9, /* pipe service */
-};
-
 #define pep_sb_size(s) (((s) + 5) & ~3) /* 2-bytes head, 32-bits aligned */
 
 /* Get the next TLV sub-block. */
@@ -82,33 +77,96 @@ static unsigned char *pep_get_sb(struct sk_buff *skb, u8 *ptype, u8 *plen,
         return data;
 }
 
-static int pep_reply(struct sock *sk, struct sk_buff *oskb,
-                        u8 code, const void *data, int len, gfp_t priority)
+static struct sk_buff *pep_alloc_skb(struct sock *sk, const void *payload,
+                                        int len, gfp_t priority)
+{
+        struct sk_buff *skb = alloc_skb(MAX_PNPIPE_HEADER + len, priority);
+        if (!skb)
+                return NULL;
+        skb_set_owner_w(skb, sk);
+
+        skb_reserve(skb, MAX_PNPIPE_HEADER);
+        __skb_put(skb, len);
+        skb_copy_to_linear_data(skb, payload, len);
+        __skb_push(skb, sizeof(struct pnpipehdr));
+        skb_reset_transport_header(skb);
+        return skb;
+}
+
+static int pep_reply(struct sock *sk, struct sk_buff *oskb, u8 code,
+                        const void *data, int len, gfp_t priority)
 {
         const struct pnpipehdr *oph = pnp_hdr(oskb);
         struct pnpipehdr *ph;
         struct sk_buff *skb;
+        struct sockaddr_pn peer;
 
-        skb = alloc_skb(MAX_PNPIPE_HEADER + len, priority);
+        skb = pep_alloc_skb(sk, data, len, priority);
         if (!skb)
                 return -ENOMEM;
-        skb_set_owner_w(skb, sk);
 
-        skb_reserve(skb, MAX_PNPIPE_HEADER);
-        __skb_put(skb, len);
-        skb_copy_to_linear_data(skb, data, len);
-        __skb_push(skb, sizeof(*ph));
-        skb_reset_transport_header(skb);
         ph = pnp_hdr(skb);
         ph->utid = oph->utid;
         ph->message_id = oph->message_id + 1; /* REQ -> RESP */
         ph->pipe_handle = oph->pipe_handle;
         ph->error_code = code;
 
-        return pn_skb_send(sk, skb, &pipe_srv);
+        pn_skb_get_src_sockaddr(oskb, &peer);
+        return pn_skb_send(sk, skb, &peer);
+}
+
+static int pep_indicate(struct sock *sk, u8 id, u8 code,
+                        const void *data, int len, gfp_t priority)
+{
+        struct pep_sock *pn = pep_sk(sk);
+        struct pnpipehdr *ph;
+        struct sk_buff *skb;
+
+        skb = pep_alloc_skb(sk, data, len, priority);
+        if (!skb)
+                return -ENOMEM;
+
+        ph = pnp_hdr(skb);
+        ph->utid = 0;
+        ph->message_id = id;
+        ph->pipe_handle = pn->pipe_handle;
+        ph->data[0] = code;
+        return pn_skb_send(sk, skb, NULL);
 }
 
 #define PAD 0x00
+
+static int pipe_handler_request(struct sock *sk, u8 id, u8 code,
+                                const void *data, int len)
+{
+        struct pep_sock *pn = pep_sk(sk);
+        struct pnpipehdr *ph;
+        struct sk_buff *skb;
+
+        skb = pep_alloc_skb(sk, data, len, GFP_KERNEL);
+        if (!skb)
+                return -ENOMEM;
+
+        ph = pnp_hdr(skb);
+        ph->utid = id; /* whatever */
+        ph->message_id = id;
+        ph->pipe_handle = pn->pipe_handle;
+        ph->data[0] = code;
+        return pn_skb_send(sk, skb, NULL);
+}
+
+static int pipe_handler_send_created_ind(struct sock *sk)
+{
+        struct pep_sock *pn = pep_sk(sk);
+        u8 data[4] = {
+                PN_PIPE_SB_NEGOTIATED_FC, pep_sb_size(2),
+                pn->tx_fc, pn->rx_fc,
+        };
+
+        return pep_indicate(sk, PNS_PIPE_CREATED_IND, 1 /* sub-blocks */,
+                                data, 4, GFP_ATOMIC);
+}
+
 static int pep_accept_conn(struct sock *sk, struct sk_buff *skb)
 {
         static const u8 data[20] = {
@@ -130,11 +188,12 @@ static int pep_accept_conn(struct sock *sk, struct sk_buff *skb)
                                 GFP_KERNEL);
 }
 
-static int pep_reject_conn(struct sock *sk, struct sk_buff *skb, u8 code)
+static int pep_reject_conn(struct sock *sk, struct sk_buff *skb, u8 code,
+                                gfp_t priority)
 {
         static const u8 data[4] = { PAD, PAD, PAD, 0 /* sub-blocks */ };
         WARN_ON(code == PN_PIPE_NO_ERROR);
-        return pep_reply(sk, skb, code, data, sizeof(data), GFP_ATOMIC);
+        return pep_reply(sk, skb, code, data, sizeof(data), priority);
 }
 
 /* Control requests are not sent by the pipe service and have a specific
@@ -146,23 +205,21 @@ static int pep_ctrlreq_error(struct sock *sk, struct sk_buff *oskb, u8 code,
         struct sk_buff *skb;
         struct pnpipehdr *ph;
         struct sockaddr_pn dst;
+        u8 data[4] = {
+                oph->data[0], /* PEP type */
+                code, /* error code, at an unusual offset */
+                PAD, PAD,
+        };
 
-        skb = alloc_skb(MAX_PNPIPE_HEADER + 4, priority);
+        skb = pep_alloc_skb(sk, data, 4, priority);
         if (!skb)
                 return -ENOMEM;
-        skb_set_owner_w(skb, sk);
-
-        skb_reserve(skb, MAX_PHONET_HEADER);
-        ph = (struct pnpipehdr *)skb_put(skb, sizeof(*ph) + 4);
 
+        ph = pnp_hdr(skb);
         ph->utid = oph->utid;
         ph->message_id = PNS_PEP_CTRL_RESP;
         ph->pipe_handle = oph->pipe_handle;
         ph->data[0] = oph->data[1]; /* CTRL id */
-        ph->data[1] = oph->data[0]; /* PEP type */
-        ph->data[2] = code; /* error code, at an usual offset */
-        ph->data[3] = PAD;
-        ph->data[4] = PAD;
 
         pn_skb_get_src_sockaddr(oskb, &dst);
         return pn_skb_send(sk, skb, &dst);
@@ -170,34 +227,15 @@ static int pep_ctrlreq_error(struct sock *sk, struct sk_buff *oskb, u8 code,
 
 static int pipe_snd_status(struct sock *sk, u8 type, u8 status, gfp_t priority)
 {
-        struct pep_sock *pn = pep_sk(sk);
-        struct pnpipehdr *ph;
-        struct sk_buff *skb;
+        u8 data[4] = { type, PAD, PAD, status };
 
-        skb = alloc_skb(MAX_PNPIPE_HEADER + 4, priority);
-        if (!skb)
-                return -ENOMEM;
-        skb_set_owner_w(skb, sk);
-
-        skb_reserve(skb, MAX_PNPIPE_HEADER + 4);
-        __skb_push(skb, sizeof(*ph) + 4);
-        skb_reset_transport_header(skb);
-        ph = pnp_hdr(skb);
-        ph->utid = 0;
-        ph->message_id = PNS_PEP_STATUS_IND;
-        ph->pipe_handle = pn->pipe_handle;
-        ph->pep_type = PN_PEP_TYPE_COMMON;
-        ph->data[1] = type;
-        ph->data[2] = PAD;
-        ph->data[3] = PAD;
-        ph->data[4] = status;
-
-        return pn_skb_send(sk, skb, &pipe_srv);
+        return pep_indicate(sk, PNS_PEP_STATUS_IND, PN_PEP_TYPE_COMMON,
+                                data, 4, priority);
 }
 
 /* Send our RX flow control information to the sender.
  * Socket must be locked. */
-static void pipe_grant_credits(struct sock *sk)
+static void pipe_grant_credits(struct sock *sk, gfp_t priority)
 {
         struct pep_sock *pn = pep_sk(sk);
 
@@ -207,16 +245,16 @@ static void pipe_grant_credits(struct sock *sk)
         case PN_LEGACY_FLOW_CONTROL: /* TODO */
                 break;
         case PN_ONE_CREDIT_FLOW_CONTROL:
-                pipe_snd_status(sk, PN_PEP_IND_FLOW_CONTROL,
-                                PEP_IND_READY, GFP_ATOMIC);
-                pn->rx_credits = 1;
+                if (pipe_snd_status(sk, PN_PEP_IND_FLOW_CONTROL,
+                                        PEP_IND_READY, priority) == 0)
+                        pn->rx_credits = 1;
                 break;
         case PN_MULTI_CREDIT_FLOW_CONTROL:
                 if ((pn->rx_credits + CREDITS_THR) > CREDITS_MAX)
                         break;
                 if (pipe_snd_status(sk, PN_PEP_IND_ID_MCFC_GRANT_CREDITS,
                                         CREDITS_MAX - pn->rx_credits,
-                                        GFP_ATOMIC) == 0)
+                                        priority) == 0)
                         pn->rx_credits = CREDITS_MAX;
                 break;
         }
@@ -314,7 +352,7 @@ static int pipe_do_rcv(struct sock *sk, struct sk_buff *skb)
 
         switch (hdr->message_id) {
         case PNS_PEP_CONNECT_REQ:
-                pep_reject_conn(sk, skb, PN_PIPE_ERR_PEP_IN_USE);
+                pep_reject_conn(sk, skb, PN_PIPE_ERR_PEP_IN_USE, GFP_ATOMIC);
                 break;
 
         case PNS_PEP_DISCONNECT_REQ:
@@ -364,7 +402,8 @@ static int pipe_do_rcv(struct sock *sk, struct sk_buff *skb)
                 if (!pn_flow_safe(pn->rx_fc)) {
                         err = sock_queue_rcv_skb(sk, skb);
                         if (!err)
-                                return 0;
+                                return NET_RX_SUCCESS;
+                        err = -ENOBUFS;
                         break;
                 }
 
@@ -402,7 +441,7 @@ static int pipe_do_rcv(struct sock *sk, struct sk_buff *skb)
                 if (sk->sk_state == TCP_ESTABLISHED)
                         break; /* Nothing to do */
                 sk->sk_state = TCP_ESTABLISHED;
-                pipe_grant_credits(sk);
+                pipe_grant_credits(sk, GFP_ATOMIC);
                 break;
 
         case PNS_PIPE_DISABLED_IND:
@@ -417,7 +456,7 @@ static int pipe_do_rcv(struct sock *sk, struct sk_buff *skb)
         }
 out:
         kfree_skb(skb);
-        return err;
+        return (err == -ENOBUFS) ? NET_RX_DROP : NET_RX_SUCCESS;
 
 queue:
         skb->dev = NULL;
@@ -426,7 +465,7 @@ queue:
         skb_queue_tail(queue, skb);
         if (!sock_flag(sk, SOCK_DEAD))
                 sk->sk_data_ready(sk, err);
-        return 0;
+        return NET_RX_SUCCESS;
 }
 
 /* Destroy connected sock. */
@@ -438,97 +477,126 @@ static void pipe_destruct(struct sock *sk)
         skb_queue_purge(&pn->ctrlreq_queue);
 }
 
-static int pep_connreq_rcv(struct sock *sk, struct sk_buff *skb)
+static u8 pipe_negotiate_fc(const u8 *fcs, unsigned n)
+{
+        unsigned i;
+        u8 final_fc = PN_NO_FLOW_CONTROL;
+
+        for (i = 0; i < n; i++) {
+                u8 fc = fcs[i];
+
+                if (fc > final_fc && fc < PN_MAX_FLOW_CONTROL)
+                        final_fc = fc;
+        }
+        return final_fc;
+}
+
+static int pep_connresp_rcv(struct sock *sk, struct sk_buff *skb)
 {
-        struct sock *newsk;
-        struct pep_sock *newpn, *pn = pep_sk(sk);
+        struct pep_sock *pn = pep_sk(sk);
         struct pnpipehdr *hdr;
-        struct sockaddr_pn dst;
-        u16 peer_type;
-        u8 pipe_handle, enabled, n_sb;
-        u8 aligned = 0;
+        u8 n_sb;
 
         if (!pskb_pull(skb, sizeof(*hdr) + 4))
                 return -EINVAL;
 
         hdr = pnp_hdr(skb);
-        pipe_handle = hdr->pipe_handle;
-        switch (hdr->state_after_connect) {
-        case PN_PIPE_DISABLE:
-                enabled = 0;
-                break;
-        case PN_PIPE_ENABLE:
-                enabled = 1;
-                break;
-        default:
-                pep_reject_conn(sk, skb, PN_PIPE_ERR_INVALID_PARAM);
-                return -EINVAL;
-        }
-        peer_type = hdr->other_pep_type << 8;
+        if (hdr->error_code != PN_PIPE_NO_ERROR)
+                return -ECONNREFUSED;
 
-        if (unlikely(sk->sk_state != TCP_LISTEN) || sk_acceptq_is_full(sk)) {
-                pep_reject_conn(sk, skb, PN_PIPE_ERR_PEP_IN_USE);
-                return -ENOBUFS;
-        }
-
-        /* Parse sub-blocks (options) */
+        /* Parse sub-blocks */
         n_sb = hdr->data[4];
         while (n_sb > 0) {
-                u8 type, buf[1], len = sizeof(buf);
+                u8 type, buf[6], len = sizeof(buf);
                 const u8 *data = pep_get_sb(skb, &type, &len, buf);
 
                 if (data == NULL)
                         return -EINVAL;
+
                 switch (type) {
-                case PN_PIPE_SB_CONNECT_REQ_PEP_SUB_TYPE:
-                        if (len < 1)
-                                return -EINVAL;
-                        peer_type = (peer_type & 0xff00) | data[0];
+                case PN_PIPE_SB_REQUIRED_FC_TX:
+                        if (len < 2 || len < data[0])
+                                break;
+                        pn->tx_fc = pipe_negotiate_fc(data + 2, len - 2);
                         break;
-                case PN_PIPE_SB_ALIGNED_DATA:
-                        aligned = data[0] != 0;
+
+                case PN_PIPE_SB_PREFERRED_FC_RX:
+                        if (len < 2 || len < data[0])
+                                break;
+                        pn->rx_fc = pipe_negotiate_fc(data + 2, len - 2);
                         break;
+
                 }
                 n_sb--;
         }
 
-        skb = skb_clone(skb, GFP_ATOMIC);
-        if (!skb)
-                return -ENOMEM;
+        return pipe_handler_send_created_ind(sk);
+}
 
-        /* Create a new to-be-accepted sock */
-        newsk = sk_alloc(sock_net(sk), PF_PHONET, GFP_ATOMIC, sk->sk_prot);
-        if (!newsk) {
-                kfree_skb(skb);
-                return -ENOMEM;
-        }
-        sock_init_data(NULL, newsk);
-        newsk->sk_state = TCP_SYN_RECV;
-        newsk->sk_backlog_rcv = pipe_do_rcv;
-        newsk->sk_protocol = sk->sk_protocol;
-        newsk->sk_destruct = pipe_destruct;
+/* Queue an skb to an actively connected sock.
+ * Socket lock must be held. */
+static int pipe_handler_do_rcv(struct sock *sk, struct sk_buff *skb)
+{
+        struct pep_sock *pn = pep_sk(sk);
+        struct pnpipehdr *hdr = pnp_hdr(skb);
+        int err = NET_RX_SUCCESS;
 
-        newpn = pep_sk(newsk);
-        pn_skb_get_dst_sockaddr(skb, &dst);
-        newpn->pn_sk.sobject = pn_sockaddr_get_object(&dst);
-        newpn->pn_sk.resource = pn->pn_sk.resource;
-        skb_queue_head_init(&newpn->ctrlreq_queue);
-        newpn->pipe_handle = pipe_handle;
-        atomic_set(&newpn->tx_credits, 0);
-        newpn->peer_type = peer_type;
-        newpn->rx_credits = 0;
-        newpn->rx_fc = newpn->tx_fc = PN_LEGACY_FLOW_CONTROL;
-        newpn->init_enable = enabled;
-        newpn->aligned = aligned;
+        switch (hdr->message_id) {
+        case PNS_PIPE_ALIGNED_DATA:
+                __skb_pull(skb, 1);
+                /* fall through */
+        case PNS_PIPE_DATA:
+                __skb_pull(skb, 3); /* Pipe data header */
+                if (!pn_flow_safe(pn->rx_fc)) {
+                        err = sock_queue_rcv_skb(sk, skb);
+                        if (!err)
+                                return NET_RX_SUCCESS;
+                        err = NET_RX_DROP;
+                        break;
+                }
 
-        BUG_ON(!skb_queue_empty(&newsk->sk_receive_queue));
-        skb_queue_head(&newsk->sk_receive_queue, skb);
-        if (!sock_flag(sk, SOCK_DEAD))
-                sk->sk_data_ready(sk, 0);
+                if (pn->rx_credits == 0) {
+                        atomic_inc(&sk->sk_drops);
+                        err = NET_RX_DROP;
+                        break;
+                }
+                pn->rx_credits--;
+                skb->dev = NULL;
+                skb_set_owner_r(skb, sk);
+                err = skb->len;
+                skb_queue_tail(&sk->sk_receive_queue, skb);
+                if (!sock_flag(sk, SOCK_DEAD))
+                        sk->sk_data_ready(sk, err);
+                return NET_RX_SUCCESS;
 
-        sk_acceptq_added(sk);
-        sk_add_node(newsk, &pn->ackq);
-        return 0;
+        case PNS_PEP_CONNECT_RESP:
+                if (sk->sk_state != TCP_SYN_SENT)
+                        break;
+                if (!sock_flag(sk, SOCK_DEAD))
+                        sk->sk_state_change(sk);
+                if (pep_connresp_rcv(sk, skb)) {
+                        sk->sk_state = TCP_CLOSE_WAIT;
+                        break;
+                }
+
+                sk->sk_state = TCP_ESTABLISHED;
+                if (!pn_flow_safe(pn->tx_fc)) {
+                        atomic_set(&pn->tx_credits, 1);
+                        sk->sk_write_space(sk);
+                }
+                pipe_grant_credits(sk, GFP_ATOMIC);
+                break;
+
+        case PNS_PEP_DISCONNECT_RESP:
+                /* sock should already be dead, nothing to do */
+                break;
+
+        case PNS_PEP_STATUS_IND:
+                pipe_rcv_status(sk, skb);
+                break;
+        }
+        kfree_skb(skb);
+        return err;
 }
 
 /* Listening sock must be locked */
@@ -568,7 +636,6 @@ static int pep_do_rcv(struct sock *sk, struct sk_buff *skb)
         struct sock *sknode;
         struct pnpipehdr *hdr;
         struct sockaddr_pn dst;
-        int err = NET_RX_SUCCESS;
         u8 pipe_handle;
 
         if (!pskb_may_pull(skb, sizeof(*hdr)))
@@ -586,20 +653,18 @@ static int pep_do_rcv(struct sock *sk, struct sk_buff *skb)
         if (sknode)
                 return sk_receive_skb(sknode, skb, 1);
 
-        /* Look for a pipe handle pending accept */
-        sknode = pep_find_pipe(&pn->ackq, &dst, pipe_handle);
-        if (sknode) {
-                sock_put(sknode);
-                if (net_ratelimit())
-                        printk(KERN_WARNING"Phonet unconnected PEP ignored");
-                err = NET_RX_DROP;
-                goto drop;
-        }
-
         switch (hdr->message_id) {
         case PNS_PEP_CONNECT_REQ:
-                err = pep_connreq_rcv(sk, skb);
-                break;
+                if (sk->sk_state != TCP_LISTEN || sk_acceptq_is_full(sk)) {
+                        pep_reject_conn(sk, skb, PN_PIPE_ERR_PEP_IN_USE,
+                                        GFP_ATOMIC);
+                        break;
+                }
+                skb_queue_head(&sk->sk_receive_queue, skb);
+                sk_acceptq_added(sk);
+                if (!sock_flag(sk, SOCK_DEAD))
+                        sk->sk_data_ready(sk, 0);
+                return NET_RX_SUCCESS;
 
         case PNS_PEP_DISCONNECT_REQ:
                 pep_reply(sk, skb, PN_PIPE_NO_ERROR, NULL, 0, GFP_ATOMIC);
@@ -613,12 +678,35 @@ static int pep_do_rcv(struct sock *sk, struct sk_buff *skb)
         case PNS_PEP_ENABLE_REQ:
         case PNS_PEP_DISABLE_REQ:
                 /* invalid handle is not even allowed here! */
+                break;
+
         default:
-                err = NET_RX_DROP;
+                if ((1 << sk->sk_state)
+                                & ~(TCPF_CLOSE|TCPF_LISTEN|TCPF_CLOSE_WAIT))
+                        /* actively connected socket */
+                        return pipe_handler_do_rcv(sk, skb);
         }
 drop:
         kfree_skb(skb);
-        return err;
+        return NET_RX_SUCCESS;
+}
+
+static int pipe_do_remove(struct sock *sk)
+{
+        struct pep_sock *pn = pep_sk(sk);
+        struct pnpipehdr *ph;
+        struct sk_buff *skb;
+
+        skb = pep_alloc_skb(sk, NULL, 0, GFP_KERNEL);
+        if (!skb)
+                return -ENOMEM;
+
+        ph = pnp_hdr(skb);
+        ph->utid = 0;
+        ph->message_id = PNS_PIPE_REMOVE_REQ;
+        ph->pipe_handle = pn->pipe_handle;
+        ph->data[0] = PAD;
+        return pn_skb_send(sk, skb, NULL);
 }
 
 /* associated socket ceases to exist */
@@ -631,15 +719,16 @@ static void pep_sock_close(struct sock *sk, long timeout)
         sk_common_release(sk);
 
         lock_sock(sk);
-        if (sk->sk_state == TCP_LISTEN) {
-                /* Destroy the listen queue */
-                struct sock *sknode;
-                struct hlist_node *p, *n;
-
-                sk_for_each_safe(sknode, p, n, &pn->ackq)
-                        sk_del_node_init(sknode);
-                sk->sk_state = TCP_CLOSE;
+        if ((1 << sk->sk_state) & (TCPF_SYN_RECV|TCPF_ESTABLISHED)) {
+                if (sk->sk_backlog_rcv == pipe_do_rcv)
+                        /* Forcefully remove dangling Phonet pipe */
+                        pipe_do_remove(sk);
+                else
+                        pipe_handler_request(sk, PNS_PEP_DISCONNECT_REQ, PAD,
+                                                NULL, 0);
         }
+        sk->sk_state = TCP_CLOSE;
+
         ifindex = pn->ifindex;
         pn->ifindex = 0;
         release_sock(sk);
@@ -649,73 +738,142 @@ static void pep_sock_close(struct sock *sk, long timeout)
         sock_put(sk);
 }
 
-static int pep_wait_connreq(struct sock *sk, int noblock)
+static struct sock *pep_sock_accept(struct sock *sk, int flags, int *errp)
 {
-        struct task_struct *tsk = current;
-        struct pep_sock *pn = pep_sk(sk);
-        long timeo = sock_rcvtimeo(sk, noblock);
-
-        for (;;) {
-                DEFINE_WAIT(wait);
+        struct pep_sock *pn = pep_sk(sk), *newpn;
+        struct sock *newsk = NULL;
+        struct sk_buff *skb;
+        struct pnpipehdr *hdr;
+        struct sockaddr_pn dst, src;
+        int err;
+        u16 peer_type;
+        u8 pipe_handle, enabled, n_sb;
+        u8 aligned = 0;
 
-                if (sk->sk_state != TCP_LISTEN)
-                        return -EINVAL;
-                if (!hlist_empty(&pn->ackq))
-                        break;
-                if (!timeo)
-                        return -EWOULDBLOCK;
-                if (signal_pending(tsk))
-                        return sock_intr_errno(timeo);
+        skb = skb_recv_datagram(sk, 0, flags & O_NONBLOCK, errp);
+        if (!skb)
+                return NULL;
 
-                prepare_to_wait_exclusive(sk_sleep(sk), &wait,
-                                                TASK_INTERRUPTIBLE);
-                release_sock(sk);
-                timeo = schedule_timeout(timeo);
-                lock_sock(sk);
-                finish_wait(sk_sleep(sk), &wait);
+        lock_sock(sk);
+        if (sk->sk_state != TCP_LISTEN) {
+                err = -EINVAL;
+                goto drop;
         }
+        sk_acceptq_removed(sk);
 
-        return 0;
-}
+        err = -EPROTO;
+        if (!pskb_may_pull(skb, sizeof(*hdr) + 4))
+                goto drop;
 
-static struct sock *pep_sock_accept(struct sock *sk, int flags, int *errp)
-{
-        struct pep_sock *pn = pep_sk(sk);
-        struct sock *newsk = NULL;
-        struct sk_buff *oskb;
-        int err;
+        hdr = pnp_hdr(skb);
+        pipe_handle = hdr->pipe_handle;
+        switch (hdr->state_after_connect) {
+        case PN_PIPE_DISABLE:
+                enabled = 0;
+                break;
+        case PN_PIPE_ENABLE:
+                enabled = 1;
+                break;
+        default:
+                pep_reject_conn(sk, skb, PN_PIPE_ERR_INVALID_PARAM,
+                                GFP_KERNEL);
+                goto drop;
+        }
+        peer_type = hdr->other_pep_type << 8;
 
-        lock_sock(sk);
-        err = pep_wait_connreq(sk, flags & O_NONBLOCK);
-        if (err)
-                goto out;
+        /* Parse sub-blocks (options) */
+        n_sb = hdr->data[4];
+        while (n_sb > 0) {
+                u8 type, buf[1], len = sizeof(buf);
+                const u8 *data = pep_get_sb(skb, &type, &len, buf);
 
-        newsk = __sk_head(&pn->ackq);
+                if (data == NULL)
+                        goto drop;
+                switch (type) {
+                case PN_PIPE_SB_CONNECT_REQ_PEP_SUB_TYPE:
+                        if (len < 1)
+                                goto drop;
+                        peer_type = (peer_type & 0xff00) | data[0];
+                        break;
+                case PN_PIPE_SB_ALIGNED_DATA:
+                        aligned = data[0] != 0;
+                        break;
+                }
+                n_sb--;
+        }
 
-        oskb = skb_dequeue(&newsk->sk_receive_queue);
-        err = pep_accept_conn(newsk, oskb);
-        if (err) {
-                skb_queue_head(&newsk->sk_receive_queue, oskb);
+        /* Check for duplicate pipe handle */
+        newsk = pep_find_pipe(&pn->hlist, &dst, pipe_handle);
+        if (unlikely(newsk)) {
+                __sock_put(newsk);
                 newsk = NULL;
-                goto out;
+                pep_reject_conn(sk, skb, PN_PIPE_ERR_PEP_IN_USE, GFP_KERNEL);
+                goto drop;
+        }
+
+        /* Create a new to-be-accepted sock */
+        newsk = sk_alloc(sock_net(sk), PF_PHONET, GFP_KERNEL, sk->sk_prot);
+        if (!newsk) {
+                pep_reject_conn(sk, skb, PN_PIPE_ERR_OVERLOAD, GFP_KERNEL);
+                err = -ENOBUFS;
+                goto drop;
         }
-        kfree_skb(oskb);
 
+        sock_init_data(NULL, newsk);
+        newsk->sk_state = TCP_SYN_RECV;
+        newsk->sk_backlog_rcv = pipe_do_rcv;
+        newsk->sk_protocol = sk->sk_protocol;
+        newsk->sk_destruct = pipe_destruct;
+
+        newpn = pep_sk(newsk);
+        pn_skb_get_dst_sockaddr(skb, &dst);
+        pn_skb_get_src_sockaddr(skb, &src);
+        newpn->pn_sk.sobject = pn_sockaddr_get_object(&dst);
+        newpn->pn_sk.dobject = pn_sockaddr_get_object(&src);
+        newpn->pn_sk.resource = pn_sockaddr_get_resource(&dst);
         sock_hold(sk);
-        pep_sk(newsk)->listener = sk;
+        newpn->listener = sk;
+        skb_queue_head_init(&newpn->ctrlreq_queue);
+        newpn->pipe_handle = pipe_handle;
+        atomic_set(&newpn->tx_credits, 0);
+        newpn->ifindex = 0;
+        newpn->peer_type = peer_type;
+        newpn->rx_credits = 0;
+        newpn->rx_fc = newpn->tx_fc = PN_LEGACY_FLOW_CONTROL;
+        newpn->init_enable = enabled;
+        newpn->aligned = aligned;
 
-        sock_hold(newsk);
-        sk_del_node_init(newsk);
-        sk_acceptq_removed(sk);
+        err = pep_accept_conn(newsk, skb);
+        if (err) {
+                sock_put(newsk);
+                newsk = NULL;
+                goto drop;
+        }
         sk_add_node(newsk, &pn->hlist);
-        __sock_put(newsk);
-
-out:
+drop:
         release_sock(sk);
+        kfree_skb(skb);
         *errp = err;
         return newsk;
 }
 
+static int pep_sock_connect(struct sock *sk, struct sockaddr *addr, int len)
+{
+        struct pep_sock *pn = pep_sk(sk);
+        int err;
+        u8 data[4] = { 0 /* sub-blocks */, PAD, PAD, PAD };
+
+        pn->pipe_handle = 1; /* anything but INVALID_HANDLE */
+        err = pipe_handler_request(sk, PNS_PEP_CONNECT_REQ,
+                                        PN_PIPE_ENABLE, data, 4);
+        if (err) {
+                pn->pipe_handle = PN_PIPE_INVALID_HANDLE;
+                return err;
+        }
+        sk->sk_state = TCP_SYN_SENT;
+        return 0;
+}
+
 static int pep_ioctl(struct sock *sk, int cmd, unsigned long arg)
 {
         struct pep_sock *pn = pep_sk(sk);
@@ -745,10 +903,18 @@ static int pep_init(struct sock *sk)
 {
         struct pep_sock *pn = pep_sk(sk);
 
-        INIT_HLIST_HEAD(&pn->ackq);
+        sk->sk_destruct = pipe_destruct;
         INIT_HLIST_HEAD(&pn->hlist);
+        pn->listener = NULL;
         skb_queue_head_init(&pn->ctrlreq_queue);
+        atomic_set(&pn->tx_credits, 0);
+        pn->ifindex = 0;
+        pn->peer_type = 0;
         pn->pipe_handle = PN_PIPE_INVALID_HANDLE;
+        pn->rx_credits = 0;
+        pn->rx_fc = pn->tx_fc = PN_LEGACY_FLOW_CONTROL;
+        pn->init_enable = 1;
+        pn->aligned = 0;
         return 0;
 }
 
@@ -792,6 +958,7 @@ static int pep_setsockopt(struct sock *sk, int level, int optname,
                         err = 0;
                 }
                 goto out_norel;
+
         default:
                 err = -ENOPROTOOPT;
         }
@@ -816,9 +983,17 @@ static int pep_getsockopt(struct sock *sk, int level, int optname,
         case PNPIPE_ENCAP:
                 val = pn->ifindex ? PNPIPE_ENCAP_IP : PNPIPE_ENCAP_NONE;
                 break;
+
         case PNPIPE_IFINDEX:
                 val = pn->ifindex;
                 break;
+
+        case PNPIPE_HANDLE:
+                val = pn->pipe_handle;
+                if (val == PN_PIPE_INVALID_HANDLE)
+                        return -EINVAL;
+                break;
+
         default:
                 return -ENOPROTOOPT;
         }
@@ -835,6 +1010,7 @@ static int pipe_skb_send(struct sock *sk, struct sk_buff *skb)
 {
         struct pep_sock *pn = pep_sk(sk);
         struct pnpipehdr *ph;
+        int err;
 
         if (pn_flow_safe(pn->tx_fc) &&
             !atomic_add_unless(&pn->tx_credits, -1, 0)) {
@@ -852,8 +1028,12 @@ static int pipe_skb_send(struct sock *sk, struct sk_buff *skb)
         } else
                 ph->message_id = PNS_PIPE_DATA;
         ph->pipe_handle = pn->pipe_handle;
+        err = pn_skb_send(sk, skb, NULL);
+
+        if (err && pn_flow_safe(pn->tx_fc))
+                atomic_inc(&pn->tx_credits);
+        return err;
 
-        return pn_skb_send(sk, skb, &pipe_srv);
 }
 
 static int pep_sendmsg(struct kiocb *iocb, struct sock *sk,
@@ -873,9 +1053,9 @@ static int pep_sendmsg(struct kiocb *iocb, struct sock *sk,
         skb = sock_alloc_send_skb(sk, MAX_PNPIPE_HEADER + len,
                                         flags & MSG_DONTWAIT, &err);
         if (!skb)
-                return -ENOBUFS;
+                return err;
 
-        skb_reserve(skb, MAX_PHONET_HEADER + 3);
+        skb_reserve(skb, MAX_PHONET_HEADER + 3 + pn->aligned);
         err = memcpy_fromiovec(skb_put(skb, len), msg->msg_iov, len);
         if (err < 0)
                 goto outfree;
@@ -977,7 +1157,7 @@ struct sk_buff *pep_read(struct sock *sk)
         struct sk_buff *skb = skb_dequeue(&sk->sk_receive_queue);
 
         if (sk->sk_state == TCP_ESTABLISHED)
-                pipe_grant_credits(sk);
+                pipe_grant_credits(sk, GFP_ATOMIC);
         return skb;
 }
 
@@ -1022,7 +1202,7 @@ static int pep_recvmsg(struct kiocb *iocb, struct sock *sk,
         }
 
         if (sk->sk_state == TCP_ESTABLISHED)
-                pipe_grant_credits(sk);
+                pipe_grant_credits(sk, GFP_KERNEL);
         release_sock(sk);
 copy:
         msg->msg_flags |= MSG_EOR;
@@ -1045,8 +1225,10 @@ static void pep_sock_unhash(struct sock *sk)
         struct sock *skparent = NULL;
 
         lock_sock(sk);
-        if ((1 << sk->sk_state) & ~(TCPF_CLOSE|TCPF_LISTEN)) {
+
+        if (pn->listener != NULL) {
                 skparent = pn->listener;
+                pn->listener = NULL;
                 release_sock(sk);
 
                 pn = pep_sk(skparent);
@@ -1054,6 +1236,7 @@ static void pep_sock_unhash(struct sock *sk)
                 sk_del_node_init(sk);
                 sk = skparent;
         }
+
         /* Unhash a listening sock only when it is closed
          * and all of its active connected pipes are closed. */
         if (hlist_empty(&pn->hlist))
@@ -1067,6 +1250,7 @@ static void pep_sock_unhash(struct sock *sk)
 static struct proto pep_proto = {
         .close          = pep_sock_close,
         .accept         = pep_sock_accept,
+        .connect        = pep_sock_connect,
         .ioctl          = pep_ioctl,
         .init           = pep_init,
         .setsockopt     = pep_setsockopt,