renegade-project/linux-next
2
0
Fork 0
mirror of https://github.com/edk2-porting/linux-next.git synced 2024-12-27 22:53:55 +08:00
Code
ef4741e90c
linux-next/net/rxrpc/ar-ack.c
Dan Carpenter 08d4d217df rxrpc: out of bound read in debug code 
Smatch complains because we are using an untrusted index into the
rxrpc_acks[] array.  It's just a read and it's only in the debug code,
but it's simple enough to add a check and fix it.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2014-01-21 17:02:52 -08:00

1315 lines
33 KiB
C
Raw Blame History

/* Management of Tx window, Tx resend, ACKs and out-of-sequence reception
*
* Copyright (C) 2007 Red Hat, Inc. All Rights Reserved.
* Written by David Howells (dhowells@redhat.com)
*
* This program is free software; you can redistribute it and/or
* modify it under the terms of the GNU General Public License
* as published by the Free Software Foundation; either version
* 2 of the License, or (at your option) any later version.
*/
#include <linux/module.h>
#include <linux/circ_buf.h>
#include <linux/net.h>
#include <linux/skbuff.h>
#include <linux/slab.h>
#include <linux/udp.h>
#include <net/sock.h>
#include <net/af_rxrpc.h>
#include "ar-internal.h"
static unsigned int rxrpc_ack_defer = 1;
static const char *rxrpc_acks(u8 reason)
{
static const char *const str[] = {
"---", "REQ", "DUP", "OOS", "WIN", "MEM", "PNG", "PNR", "DLY",
"IDL", "-?-"
};
if (reason >= ARRAY_SIZE(str))
reason = ARRAY_SIZE(str) - 1;
return str[reason];
}
static const s8 rxrpc_ack_priority[] = {
[0] = 0,
[RXRPC_ACK_DELAY] = 1,
[RXRPC_ACK_REQUESTED] = 2,
[RXRPC_ACK_IDLE] = 3,
[RXRPC_ACK_PING_RESPONSE] = 4,
[RXRPC_ACK_DUPLICATE] = 5,
[RXRPC_ACK_OUT_OF_SEQUENCE] = 6,
[RXRPC_ACK_EXCEEDS_WINDOW] = 7,
[RXRPC_ACK_NOSPACE] = 8,
};
/*
* propose an ACK be sent
*/
void __rxrpc_propose_ACK(struct rxrpc_call *call, u8 ack_reason,
__be32 serial, bool immediate)
{
unsigned long expiry;
s8 prior = rxrpc_ack_priority[ack_reason];
ASSERTCMP(prior, >, 0);
_enter("{%d},%s,%%%x,%u",
call->debug_id, rxrpc_acks(ack_reason), ntohl(serial),
immediate);
if (prior < rxrpc_ack_priority[call->ackr_reason]) {
if (immediate)
goto cancel_timer;
return;
}
/* update DELAY, IDLE, REQUESTED and PING_RESPONSE ACK serial
* numbers */
if (prior == rxrpc_ack_priority[call->ackr_reason]) {
if (prior <= 4)
call->ackr_serial = serial;
if (immediate)
goto cancel_timer;
return;
}
call->ackr_reason = ack_reason;
call->ackr_serial = serial;
switch (ack_reason) {
case RXRPC_ACK_DELAY:
_debug("run delay timer");
call->ack_timer.expires = jiffies + rxrpc_ack_timeout * HZ;
add_timer(&call->ack_timer);
return;
case RXRPC_ACK_IDLE:
if (!immediate) {
_debug("run defer timer");
expiry = 1;
goto run_timer;
}
goto cancel_timer;
case RXRPC_ACK_REQUESTED:
if (!rxrpc_ack_defer)
goto cancel_timer;
if (!immediate || serial == cpu_to_be32(1)) {
_debug("run defer timer");
expiry = rxrpc_ack_defer;
goto run_timer;
}
default:
_debug("immediate ACK");
goto cancel_timer;
}
run_timer:
expiry += jiffies;
if (!timer_pending(&call->ack_timer) ||
time_after(call->ack_timer.expires, expiry))
mod_timer(&call->ack_timer, expiry);
return;
cancel_timer:
_debug("cancel timer %%%u", ntohl(serial));
try_to_del_timer_sync(&call->ack_timer);
read_lock_bh(&call->state_lock);
if (call->state <= RXRPC_CALL_COMPLETE &&
!test_and_set_bit(RXRPC_CALL_ACK, &call->events))
rxrpc_queue_call(call);
read_unlock_bh(&call->state_lock);
}
/*
* propose an ACK be sent, locking the call structure
*/
void rxrpc_propose_ACK(struct rxrpc_call *call, u8 ack_reason,
__be32 serial, bool immediate)
{
s8 prior = rxrpc_ack_priority[ack_reason];
if (prior > rxrpc_ack_priority[call->ackr_reason]) {
spin_lock_bh(&call->lock);
__rxrpc_propose_ACK(call, ack_reason, serial, immediate);
spin_unlock_bh(&call->lock);
}
}
/*
* set the resend timer
*/
static void rxrpc_set_resend(struct rxrpc_call *call, u8 resend,
unsigned long resend_at)
{
read_lock_bh(&call->state_lock);
if (call->state >= RXRPC_CALL_COMPLETE)
resend = 0;
if (resend & 1) {
_debug("SET RESEND");
set_bit(RXRPC_CALL_RESEND, &call->events);
}
if (resend & 2) {
_debug("MODIFY RESEND TIMER");
set_bit(RXRPC_CALL_RUN_RTIMER, &call->flags);
mod_timer(&call->resend_timer, resend_at);
} else {
_debug("KILL RESEND TIMER");
del_timer_sync(&call->resend_timer);
clear_bit(RXRPC_CALL_RESEND_TIMER, &call->events);
clear_bit(RXRPC_CALL_RUN_RTIMER, &call->flags);
}
read_unlock_bh(&call->state_lock);
}
/*
* resend packets
*/
static void rxrpc_resend(struct rxrpc_call *call)
{
struct rxrpc_skb_priv *sp;
struct rxrpc_header *hdr;
struct sk_buff *txb;
unsigned long *p_txb, resend_at;
int loop, stop;
u8 resend;
_enter("{%d,%d,%d,%d},",
call->acks_hard, call->acks_unacked,
atomic_read(&call->sequence),
CIRC_CNT(call->acks_head, call->acks_tail, call->acks_winsz));
stop = 0;
resend = 0;
resend_at = 0;
for (loop = call->acks_tail;
loop != call->acks_head || stop;
loop = (loop + 1) & (call->acks_winsz - 1)
) {
p_txb = call->acks_window + loop;
smp_read_barrier_depends();
if (*p_txb & 1)
continue;
txb = (struct sk_buff *) *p_txb;
sp = rxrpc_skb(txb);
if (sp->need_resend) {
sp->need_resend = false;
/* each Tx packet has a new serial number */
sp->hdr.serial =
htonl(atomic_inc_return(&call->conn->serial));
hdr = (struct rxrpc_header *) txb->head;
hdr->serial = sp->hdr.serial;
_proto("Tx DATA %%%u { #%d }",
ntohl(sp->hdr.serial), ntohl(sp->hdr.seq));
if (rxrpc_send_packet(call->conn->trans, txb) < 0) {
stop = 0;
sp->resend_at = jiffies + 3;
} else {
sp->resend_at =
jiffies + rxrpc_resend_timeout * HZ;
}
}
if (time_after_eq(jiffies + 1, sp->resend_at)) {
sp->need_resend = true;
resend |= 1;
} else if (resend & 2) {
if (time_before(sp->resend_at, resend_at))
resend_at = sp->resend_at;
} else {
resend_at = sp->resend_at;
resend |= 2;
}
}
rxrpc_set_resend(call, resend, resend_at);
_leave("");
}
/*
* handle resend timer expiry
*/
static void rxrpc_resend_timer(struct rxrpc_call *call)
{
struct rxrpc_skb_priv *sp;
struct sk_buff *txb;
unsigned long *p_txb, resend_at;
int loop;
u8 resend;
_enter("%d,%d,%d",
call->acks_tail, call->acks_unacked, call->acks_head);
if (call->state >= RXRPC_CALL_COMPLETE)
return;
resend = 0;
resend_at = 0;
for (loop = call->acks_unacked;
loop != call->acks_head;
loop = (loop + 1) & (call->acks_winsz - 1)
) {
p_txb = call->acks_window + loop;
smp_read_barrier_depends();
txb = (struct sk_buff *) (*p_txb & ~1);
sp = rxrpc_skb(txb);
ASSERT(!(*p_txb & 1));
if (sp->need_resend) {
;
} else if (time_after_eq(jiffies + 1, sp->resend_at)) {
sp->need_resend = true;
resend |= 1;
} else if (resend & 2) {
if (time_before(sp->resend_at, resend_at))
resend_at = sp->resend_at;
} else {
resend_at = sp->resend_at;
resend |= 2;
}
}
rxrpc_set_resend(call, resend, resend_at);
_leave("");
}
/*
* process soft ACKs of our transmitted packets
* - these indicate packets the peer has or has not received, but hasn't yet
* given to the consumer, and so can still be discarded and re-requested
*/
static int rxrpc_process_soft_ACKs(struct rxrpc_call *call,
struct rxrpc_ackpacket *ack,
struct sk_buff *skb)
{
struct rxrpc_skb_priv *sp;
struct sk_buff *txb;
unsigned long *p_txb, resend_at;
int loop;
u8 sacks[RXRPC_MAXACKS], resend;
_enter("{%d,%d},{%d},",
call->acks_hard,
CIRC_CNT(call->acks_head, call->acks_tail, call->acks_winsz),
ack->nAcks);
if (skb_copy_bits(skb, 0, sacks, ack->nAcks) < 0)
goto protocol_error;
resend = 0;
resend_at = 0;
for (loop = 0; loop < ack->nAcks; loop++) {
p_txb = call->acks_window;
p_txb += (call->acks_tail + loop) & (call->acks_winsz - 1);
smp_read_barrier_depends();
txb = (struct sk_buff *) (*p_txb & ~1);
sp = rxrpc_skb(txb);
switch (sacks[loop]) {
case RXRPC_ACK_TYPE_ACK:
sp->need_resend = false;
*p_txb |= 1;
break;
case RXRPC_ACK_TYPE_NACK:
sp->need_resend = true;
*p_txb &= ~1;
resend = 1;
break;
default:
_debug("Unsupported ACK type %d", sacks[loop]);
goto protocol_error;
}
}
smp_mb();
call->acks_unacked = (call->acks_tail + loop) & (call->acks_winsz - 1);
/* anything not explicitly ACK'd is implicitly NACK'd, but may just not
* have been received or processed yet by the far end */
for (loop = call->acks_unacked;
loop != call->acks_head;
loop = (loop + 1) & (call->acks_winsz - 1)
) {
p_txb = call->acks_window + loop;
smp_read_barrier_depends();
txb = (struct sk_buff *) (*p_txb & ~1);
sp = rxrpc_skb(txb);
if (*p_txb & 1) {
/* packet must have been discarded */
sp->need_resend = true;
*p_txb &= ~1;
resend |= 1;
} else if (sp->need_resend) {
;
} else if (time_after_eq(jiffies + 1, sp->resend_at)) {
sp->need_resend = true;
resend |= 1;
} else if (resend & 2) {
if (time_before(sp->resend_at, resend_at))
resend_at = sp->resend_at;
} else {
resend_at = sp->resend_at;
resend |= 2;
}
}
rxrpc_set_resend(call, resend, resend_at);
_leave(" = 0");
return 0;
protocol_error:
_leave(" = -EPROTO");
return -EPROTO;
}
/*
* discard hard-ACK'd packets from the Tx window
*/
static void rxrpc_rotate_tx_window(struct rxrpc_call *call, u32 hard)
{
unsigned long _skb;
int tail = call->acks_tail, old_tail;
int win = CIRC_CNT(call->acks_head, tail, call->acks_winsz);
_enter("{%u,%u},%u", call->acks_hard, win, hard);
ASSERTCMP(hard - call->acks_hard, <=, win);
while (call->acks_hard < hard) {
smp_read_barrier_depends();
_skb = call->acks_window[tail] & ~1;
rxrpc_free_skb((struct sk_buff *) _skb);
old_tail = tail;
tail = (tail + 1) & (call->acks_winsz - 1);
call->acks_tail = tail;
if (call->acks_unacked == old_tail)
call->acks_unacked = tail;
call->acks_hard++;
}
wake_up(&call->tx_waitq);
}
/*
* clear the Tx window in the event of a failure
*/
static void rxrpc_clear_tx_window(struct rxrpc_call *call)
{
rxrpc_rotate_tx_window(call, atomic_read(&call->sequence));
}
/*
* drain the out of sequence received packet queue into the packet Rx queue
*/
static int rxrpc_drain_rx_oos_queue(struct rxrpc_call *call)
{
struct rxrpc_skb_priv *sp;
struct sk_buff *skb;
bool terminal;
int ret;
_enter("{%d,%d}", call->rx_data_post, call->rx_first_oos);
spin_lock_bh(&call->lock);
ret = -ECONNRESET;
if (test_bit(RXRPC_CALL_RELEASED, &call->flags))
goto socket_unavailable;
skb = skb_dequeue(&call->rx_oos_queue);
if (skb) {
sp = rxrpc_skb(skb);
_debug("drain OOS packet %d [%d]",
ntohl(sp->hdr.seq), call->rx_first_oos);
if (ntohl(sp->hdr.seq) != call->rx_first_oos) {
skb_queue_head(&call->rx_oos_queue, skb);
call->rx_first_oos = ntohl(rxrpc_skb(skb)->hdr.seq);
_debug("requeue %p {%u}", skb, call->rx_first_oos);
} else {
skb->mark = RXRPC_SKB_MARK_DATA;
terminal = ((sp->hdr.flags & RXRPC_LAST_PACKET) &&
!(sp->hdr.flags & RXRPC_CLIENT_INITIATED));
ret = rxrpc_queue_rcv_skb(call, skb, true, terminal);
BUG_ON(ret < 0);
_debug("drain #%u", call->rx_data_post);
call->rx_data_post++;
/* find out what the next packet is */
skb = skb_peek(&call->rx_oos_queue);
if (skb)
call->rx_first_oos =
ntohl(rxrpc_skb(skb)->hdr.seq);
else
call->rx_first_oos = 0;
_debug("peek %p {%u}", skb, call->rx_first_oos);
}
}
ret = 0;
socket_unavailable:
spin_unlock_bh(&call->lock);
_leave(" = %d", ret);
return ret;
}
/*
* insert an out of sequence packet into the buffer
*/
static void rxrpc_insert_oos_packet(struct rxrpc_call *call,
struct sk_buff *skb)
{
struct rxrpc_skb_priv *sp, *psp;
struct sk_buff *p;
u32 seq;
sp = rxrpc_skb(skb);
seq = ntohl(sp->hdr.seq);
_enter(",,{%u}", seq);
skb->destructor = rxrpc_packet_destructor;
ASSERTCMP(sp->call, ==, NULL);
sp->call = call;
rxrpc_get_call(call);
/* insert into the buffer in sequence order */
spin_lock_bh(&call->lock);
skb_queue_walk(&call->rx_oos_queue, p) {
psp = rxrpc_skb(p);
if (ntohl(psp->hdr.seq) > seq) {
_debug("insert oos #%u before #%u",
seq, ntohl(psp->hdr.seq));
skb_insert(p, skb, &call->rx_oos_queue);
goto inserted;
}
}
_debug("append oos #%u", seq);
skb_queue_tail(&call->rx_oos_queue, skb);
inserted:
/* we might now have a new front to the queue */
if (call->rx_first_oos == 0 || seq < call->rx_first_oos)
call->rx_first_oos = seq;
read_lock(&call->state_lock);
if (call->state < RXRPC_CALL_COMPLETE &&
call->rx_data_post == call->rx_first_oos) {
_debug("drain rx oos now");
set_bit(RXRPC_CALL_DRAIN_RX_OOS, &call->events);
}
read_unlock(&call->state_lock);
spin_unlock_bh(&call->lock);
_leave(" [stored #%u]", call->rx_first_oos);
}
/*
* clear the Tx window on final ACK reception
*/
static void rxrpc_zap_tx_window(struct rxrpc_call *call)
{
struct rxrpc_skb_priv *sp;
struct sk_buff *skb;
unsigned long _skb, *acks_window;
u8 winsz = call->acks_winsz;
int tail;
acks_window = call->acks_window;
call->acks_window = NULL;
while (CIRC_CNT(call->acks_head, call->acks_tail, winsz) > 0) {
tail = call->acks_tail;
smp_read_barrier_depends();
_skb = acks_window[tail] & ~1;
smp_mb();
call->acks_tail = (call->acks_tail + 1) & (winsz - 1);
skb = (struct sk_buff *) _skb;
sp = rxrpc_skb(skb);
_debug("+++ clear Tx %u", ntohl(sp->hdr.seq));
rxrpc_free_skb(skb);
}
kfree(acks_window);
}
/*
* process the extra information that may be appended to an ACK packet
*/
static void rxrpc_extract_ackinfo(struct rxrpc_call *call, struct sk_buff *skb,
unsigned int latest, int nAcks)
{
struct rxrpc_ackinfo ackinfo;
struct rxrpc_peer *peer;
unsigned int mtu;
if (skb_copy_bits(skb, nAcks + 3, &ackinfo, sizeof(ackinfo)) < 0) {
_leave(" [no ackinfo]");
return;
}
_proto("Rx ACK %%%u Info { rx=%u max=%u rwin=%u jm=%u }",
latest,
ntohl(ackinfo.rxMTU), ntohl(ackinfo.maxMTU),
ntohl(ackinfo.rwind), ntohl(ackinfo.jumbo_max));
mtu = min(ntohl(ackinfo.rxMTU), ntohl(ackinfo.maxMTU));
peer = call->conn->trans->peer;
if (mtu < peer->maxdata) {
spin_lock_bh(&peer->lock);
peer->maxdata = mtu;
peer->mtu = mtu + peer->hdrsize;
spin_unlock_bh(&peer->lock);
_net("Net MTU %u (maxdata %u)", peer->mtu, peer->maxdata);
}
}
/*
* process packets in the reception queue
*/
static int rxrpc_process_rx_queue(struct rxrpc_call *call,
u32 *_abort_code)
{
struct rxrpc_ackpacket ack;
struct rxrpc_skb_priv *sp;
struct sk_buff *skb;
bool post_ACK;
int latest;
u32 hard, tx;
_enter("");
process_further:
skb = skb_dequeue(&call->rx_queue);
if (!skb)
return -EAGAIN;
_net("deferred skb %p", skb);
sp = rxrpc_skb(skb);
_debug("process %s [st %d]", rxrpc_pkts[sp->hdr.type], call->state);
post_ACK = false;
switch (sp->hdr.type) {
/* data packets that wind up here have been received out of
* order, need security processing or are jumbo packets */
case RXRPC_PACKET_TYPE_DATA:
_proto("OOSQ DATA %%%u { #%u }",
ntohl(sp->hdr.serial), ntohl(sp->hdr.seq));
/* secured packets must be verified and possibly decrypted */
if (rxrpc_verify_packet(call, skb, _abort_code) < 0)
goto protocol_error;
rxrpc_insert_oos_packet(call, skb);
goto process_further;
/* partial ACK to process */
case RXRPC_PACKET_TYPE_ACK:
if (skb_copy_bits(skb, 0, &ack, sizeof(ack)) < 0) {
_debug("extraction failure");
goto protocol_error;
}
if (!skb_pull(skb, sizeof(ack)))
BUG();
latest = ntohl(sp->hdr.serial);
hard = ntohl(ack.firstPacket);
tx = atomic_read(&call->sequence);
_proto("Rx ACK %%%u { m=%hu f=#%u p=#%u s=%%%u r=%s n=%u }",
latest,
ntohs(ack.maxSkew),
hard,
ntohl(ack.previousPacket),
ntohl(ack.serial),
rxrpc_acks(ack.reason),
ack.nAcks);
rxrpc_extract_ackinfo(call, skb, latest, ack.nAcks);
if (ack.reason == RXRPC_ACK_PING) {
_proto("Rx ACK %%%u PING Request", latest);
rxrpc_propose_ACK(call, RXRPC_ACK_PING_RESPONSE,
sp->hdr.serial, true);
}
/* discard any out-of-order or duplicate ACKs */
if (latest - call->acks_latest <= 0) {
_debug("discard ACK %d <= %d",
latest, call->acks_latest);
goto discard;
}
call->acks_latest = latest;
if (call->state != RXRPC_CALL_CLIENT_SEND_REQUEST &&
call->state != RXRPC_CALL_CLIENT_AWAIT_REPLY &&
call->state != RXRPC_CALL_SERVER_SEND_REPLY &&
call->state != RXRPC_CALL_SERVER_AWAIT_ACK)
goto discard;
_debug("Tx=%d H=%u S=%d", tx, call->acks_hard, call->state);
if (hard > 0) {
if (hard - 1 > tx) {
_debug("hard-ACK'd packet %d not transmitted"
" (%d top)",
hard - 1, tx);
goto protocol_error;
}
if ((call->state == RXRPC_CALL_CLIENT_AWAIT_REPLY ||
call->state == RXRPC_CALL_SERVER_AWAIT_ACK) &&
hard > tx)
goto all_acked;
smp_rmb();
rxrpc_rotate_tx_window(call, hard - 1);
}
if (ack.nAcks > 0) {
if (hard - 1 + ack.nAcks > tx) {
_debug("soft-ACK'd packet %d+%d not"
" transmitted (%d top)",
hard - 1, ack.nAcks, tx);
goto protocol_error;
}
if (rxrpc_process_soft_ACKs(call, &ack, skb) < 0)
goto protocol_error;
}
goto discard;
/* complete ACK to process */
case RXRPC_PACKET_TYPE_ACKALL:
goto all_acked;
/* abort and busy are handled elsewhere */
case RXRPC_PACKET_TYPE_BUSY:
case RXRPC_PACKET_TYPE_ABORT:
BUG();
/* connection level events - also handled elsewhere */
case RXRPC_PACKET_TYPE_CHALLENGE:
case RXRPC_PACKET_TYPE_RESPONSE:
case RXRPC_PACKET_TYPE_DEBUG:
BUG();
}
/* if we've had a hard ACK that covers all the packets we've sent, then
* that ends that phase of the operation */
all_acked:
write_lock_bh(&call->state_lock);
_debug("ack all %d", call->state);
switch (call->state) {
case RXRPC_CALL_CLIENT_AWAIT_REPLY:
call->state = RXRPC_CALL_CLIENT_RECV_REPLY;
break;
case RXRPC_CALL_SERVER_AWAIT_ACK:
_debug("srv complete");
call->state = RXRPC_CALL_COMPLETE;
post_ACK = true;
break;
case RXRPC_CALL_CLIENT_SEND_REQUEST:
case RXRPC_CALL_SERVER_RECV_REQUEST:
goto protocol_error_unlock; /* can't occur yet */
default:
write_unlock_bh(&call->state_lock);
goto discard; /* assume packet left over from earlier phase */
}
write_unlock_bh(&call->state_lock);
/* if all the packets we sent are hard-ACK'd, then we can discard
* whatever we've got left */
_debug("clear Tx %d",
CIRC_CNT(call->acks_head, call->acks_tail, call->acks_winsz));
del_timer_sync(&call->resend_timer);
clear_bit(RXRPC_CALL_RUN_RTIMER, &call->flags);
clear_bit(RXRPC_CALL_RESEND_TIMER, &call->events);
if (call->acks_window)
rxrpc_zap_tx_window(call);
if (post_ACK) {
/* post the final ACK message for userspace to pick up */
_debug("post ACK");
skb->mark = RXRPC_SKB_MARK_FINAL_ACK;
sp->call = call;
rxrpc_get_call(call);
spin_lock_bh(&call->lock);
if (rxrpc_queue_rcv_skb(call, skb, true, true) < 0)
BUG();
spin_unlock_bh(&call->lock);
goto process_further;
}
discard:
rxrpc_free_skb(skb);
goto process_further;
protocol_error_unlock:
write_unlock_bh(&call->state_lock);
protocol_error:
rxrpc_free_skb(skb);
_leave(" = -EPROTO");
return -EPROTO;
}
/*
* post a message to the socket Rx queue for recvmsg() to pick up
*/
static int rxrpc_post_message(struct rxrpc_call *call, u32 mark, u32 error,
bool fatal)
{
struct rxrpc_skb_priv *sp;
struct sk_buff *skb;
int ret;
_enter("{%d,%lx},%u,%u,%d",
call->debug_id, call->flags, mark, error, fatal);
/* remove timers and things for fatal messages */
if (fatal) {
del_timer_sync(&call->resend_timer);
del_timer_sync(&call->ack_timer);
clear_bit(RXRPC_CALL_RUN_RTIMER, &call->flags);
}
if (mark != RXRPC_SKB_MARK_NEW_CALL &&
!test_bit(RXRPC_CALL_HAS_USERID, &call->flags)) {
_leave("[no userid]");
return 0;
}
if (!test_bit(RXRPC_CALL_TERMINAL_MSG, &call->flags)) {
skb = alloc_skb(0, GFP_NOFS);
if (!skb)
return -ENOMEM;
rxrpc_new_skb(skb);
skb->mark = mark;
sp = rxrpc_skb(skb);
memset(sp, 0, sizeof(*sp));
sp->error = error;
sp->call = call;
rxrpc_get_call(call);
spin_lock_bh(&call->lock);
ret = rxrpc_queue_rcv_skb(call, skb, true, fatal);
spin_unlock_bh(&call->lock);
BUG_ON(ret < 0);
}
return 0;
}
/*
* handle background processing of incoming call packets and ACK / abort
* generation
*/
void rxrpc_process_call(struct work_struct *work)
{
struct rxrpc_call *call =
container_of(work, struct rxrpc_call, processor);
struct rxrpc_ackpacket ack;
struct rxrpc_ackinfo ackinfo;
struct rxrpc_header hdr;
struct msghdr msg;
struct kvec iov[5];
unsigned long bits;
__be32 data, pad;
size_t len;
int genbit, loop, nbit, ioc, ret, mtu;
u32 abort_code = RX_PROTOCOL_ERROR;
u8 *acks = NULL;
//printk("\n--------------------\n");
_enter("{%d,%s,%lx} [%lu]",
call->debug_id, rxrpc_call_states[call->state], call->events,
(jiffies - call->creation_jif) / (HZ / 10));
if (test_and_set_bit(RXRPC_CALL_PROC_BUSY, &call->flags)) {
_debug("XXXXXXXXXXXXX RUNNING ON MULTIPLE CPUS XXXXXXXXXXXXX");
return;
}
/* there's a good chance we're going to have to send a message, so set
* one up in advance */
msg.msg_name = &call->conn->trans->peer->srx.transport.sin;
msg.msg_namelen = sizeof(call->conn->trans->peer->srx.transport.sin);
msg.msg_control = NULL;
msg.msg_controllen = 0;
msg.msg_flags = 0;
hdr.epoch = call->conn->epoch;
hdr.cid = call->cid;
hdr.callNumber = call->call_id;
hdr.seq = 0;
hdr.type = RXRPC_PACKET_TYPE_ACK;
hdr.flags = call->conn->out_clientflag;
hdr.userStatus = 0;
hdr.securityIndex = call->conn->security_ix;
hdr._rsvd = 0;
hdr.serviceId = call->conn->service_id;
memset(iov, 0, sizeof(iov));
iov[0].iov_base = &hdr;
iov[0].iov_len = sizeof(hdr);
/* deal with events of a final nature */
if (test_bit(RXRPC_CALL_RELEASE, &call->events)) {
rxrpc_release_call(call);
clear_bit(RXRPC_CALL_RELEASE, &call->events);
}
if (test_bit(RXRPC_CALL_RCVD_ERROR, &call->events)) {
int error;
clear_bit(RXRPC_CALL_CONN_ABORT, &call->events);
clear_bit(RXRPC_CALL_REJECT_BUSY, &call->events);
clear_bit(RXRPC_CALL_ABORT, &call->events);
error = call->conn->trans->peer->net_error;
_debug("post net error %d", error);
if (rxrpc_post_message(call, RXRPC_SKB_MARK_NET_ERROR,
error, true) < 0)
goto no_mem;
clear_bit(RXRPC_CALL_RCVD_ERROR, &call->events);
goto kill_ACKs;
}
if (test_bit(RXRPC_CALL_CONN_ABORT, &call->events)) {
ASSERTCMP(call->state, >, RXRPC_CALL_COMPLETE);
clear_bit(RXRPC_CALL_REJECT_BUSY, &call->events);
clear_bit(RXRPC_CALL_ABORT, &call->events);
_debug("post conn abort");
if (rxrpc_post_message(call, RXRPC_SKB_MARK_LOCAL_ERROR,
call->conn->error, true) < 0)
goto no_mem;
clear_bit(RXRPC_CALL_CONN_ABORT, &call->events);
goto kill_ACKs;
}
if (test_bit(RXRPC_CALL_REJECT_BUSY, &call->events)) {
hdr.type = RXRPC_PACKET_TYPE_BUSY;
genbit = RXRPC_CALL_REJECT_BUSY;
goto send_message;
}
if (test_bit(RXRPC_CALL_ABORT, &call->events)) {
ASSERTCMP(call->state, >, RXRPC_CALL_COMPLETE);
if (rxrpc_post_message(call, RXRPC_SKB_MARK_LOCAL_ERROR,
ECONNABORTED, true) < 0)
goto no_mem;
hdr.type = RXRPC_PACKET_TYPE_ABORT;
data = htonl(call->abort_code);
iov[1].iov_base = &data;
iov[1].iov_len = sizeof(data);
genbit = RXRPC_CALL_ABORT;
goto send_message;
}
if (test_bit(RXRPC_CALL_ACK_FINAL, &call->events)) {
genbit = RXRPC_CALL_ACK_FINAL;
ack.bufferSpace = htons(8);
ack.maxSkew = 0;
ack.serial = 0;
ack.reason = RXRPC_ACK_IDLE;
ack.nAcks = 0;
call->ackr_reason = 0;
spin_lock_bh(&call->lock);
ack.serial = call->ackr_serial;
ack.previousPacket = call->ackr_prev_seq;
ack.firstPacket = htonl(call->rx_data_eaten + 1);
spin_unlock_bh(&call->lock);
pad = 0;
iov[1].iov_base = &ack;
iov[1].iov_len = sizeof(ack);
iov[2].iov_base = &pad;
iov[2].iov_len = 3;
iov[3].iov_base = &ackinfo;
iov[3].iov_len = sizeof(ackinfo);
goto send_ACK;
}
if (call->events & ((1 << RXRPC_CALL_RCVD_BUSY) |
(1 << RXRPC_CALL_RCVD_ABORT))
) {
u32 mark;
if (test_bit(RXRPC_CALL_RCVD_ABORT, &call->events))
mark = RXRPC_SKB_MARK_REMOTE_ABORT;
else
mark = RXRPC_SKB_MARK_BUSY;
_debug("post abort/busy");
rxrpc_clear_tx_window(call);
if (rxrpc_post_message(call, mark, ECONNABORTED, true) < 0)
goto no_mem;
clear_bit(RXRPC_CALL_RCVD_BUSY, &call->events);
clear_bit(RXRPC_CALL_RCVD_ABORT, &call->events);
goto kill_ACKs;
}
if (test_and_clear_bit(RXRPC_CALL_RCVD_ACKALL, &call->events)) {
_debug("do implicit ackall");
rxrpc_clear_tx_window(call);
}
if (test_bit(RXRPC_CALL_LIFE_TIMER, &call->events)) {
write_lock_bh(&call->state_lock);
if (call->state <= RXRPC_CALL_COMPLETE) {
call->state = RXRPC_CALL_LOCALLY_ABORTED;
call->abort_code = RX_CALL_TIMEOUT;
set_bit(RXRPC_CALL_ABORT, &call->events);
}
write_unlock_bh(&call->state_lock);
_debug("post timeout");
if (rxrpc_post_message(call, RXRPC_SKB_MARK_LOCAL_ERROR,
ETIME, true) < 0)
goto no_mem;
clear_bit(RXRPC_CALL_LIFE_TIMER, &call->events);
goto kill_ACKs;
}
/* deal with assorted inbound messages */
if (!skb_queue_empty(&call->rx_queue)) {
switch (rxrpc_process_rx_queue(call, &abort_code)) {
case 0:
case -EAGAIN:
break;
case -ENOMEM:
goto no_mem;
case -EKEYEXPIRED:
case -EKEYREJECTED:
case -EPROTO:
rxrpc_abort_call(call, abort_code);
goto kill_ACKs;
}
}
/* handle resending */
if (test_and_clear_bit(RXRPC_CALL_RESEND_TIMER, &call->events))
rxrpc_resend_timer(call);
if (test_and_clear_bit(RXRPC_CALL_RESEND, &call->events))
rxrpc_resend(call);
/* consider sending an ordinary ACK */
if (test_bit(RXRPC_CALL_ACK, &call->events)) {
_debug("send ACK: window: %d - %d { %lx }",
call->rx_data_eaten, call->ackr_win_top,
call->ackr_window[0]);
if (call->state > RXRPC_CALL_SERVER_ACK_REQUEST &&
call->ackr_reason != RXRPC_ACK_PING_RESPONSE) {
/* ACK by sending reply DATA packet in this state */
clear_bit(RXRPC_CALL_ACK, &call->events);
goto maybe_reschedule;
}
genbit = RXRPC_CALL_ACK;
acks = kzalloc(call->ackr_win_top - call->rx_data_eaten,
GFP_NOFS);
if (!acks)
goto no_mem;
//hdr.flags = RXRPC_SLOW_START_OK;
ack.bufferSpace = htons(8);
ack.maxSkew = 0;
ack.serial = 0;
ack.reason = 0;
spin_lock_bh(&call->lock);
ack.reason = call->ackr_reason;
ack.serial = call->ackr_serial;
ack.previousPacket = call->ackr_prev_seq;
ack.firstPacket = htonl(call->rx_data_eaten + 1);
ack.nAcks = 0;
for (loop = 0; loop < RXRPC_ACKR_WINDOW_ASZ; loop++) {
nbit = loop * BITS_PER_LONG;
for (bits = call->ackr_window[loop]; bits; bits >>= 1
) {
_debug("- l=%d n=%d b=%lx", loop, nbit, bits);
if (bits & 1) {
acks[nbit] = RXRPC_ACK_TYPE_ACK;
ack.nAcks = nbit + 1;
}
nbit++;
}
}
call->ackr_reason = 0;
spin_unlock_bh(&call->lock);
pad = 0;
iov[1].iov_base = &ack;
iov[1].iov_len = sizeof(ack);
iov[2].iov_base = acks;
iov[2].iov_len = ack.nAcks;
iov[3].iov_base = &pad;
iov[3].iov_len = 3;
iov[4].iov_base = &ackinfo;
iov[4].iov_len = sizeof(ackinfo);
switch (ack.reason) {
case RXRPC_ACK_REQUESTED:
case RXRPC_ACK_DUPLICATE:
case RXRPC_ACK_OUT_OF_SEQUENCE:
case RXRPC_ACK_EXCEEDS_WINDOW:
case RXRPC_ACK_NOSPACE:
case RXRPC_ACK_PING:
case RXRPC_ACK_PING_RESPONSE:
goto send_ACK_with_skew;
case RXRPC_ACK_DELAY:
case RXRPC_ACK_IDLE:
goto send_ACK;
}
}
/* handle completion of security negotiations on an incoming
* connection */
if (test_and_clear_bit(RXRPC_CALL_SECURED, &call->events)) {
_debug("secured");
spin_lock_bh(&call->lock);
if (call->state == RXRPC_CALL_SERVER_SECURING) {
_debug("securing");
write_lock(&call->conn->lock);
if (!test_bit(RXRPC_CALL_RELEASED, &call->flags) &&
!test_bit(RXRPC_CALL_RELEASE, &call->events)) {
_debug("not released");
call->state = RXRPC_CALL_SERVER_ACCEPTING;
list_move_tail(&call->accept_link,
&call->socket->acceptq);
}
write_unlock(&call->conn->lock);
read_lock(&call->state_lock);
if (call->state < RXRPC_CALL_COMPLETE)
set_bit(RXRPC_CALL_POST_ACCEPT, &call->events);
read_unlock(&call->state_lock);
}
spin_unlock_bh(&call->lock);
if (!test_bit(RXRPC_CALL_POST_ACCEPT, &call->events))
goto maybe_reschedule;
}
/* post a notification of an acceptable connection to the app */
if (test_bit(RXRPC_CALL_POST_ACCEPT, &call->events)) {
_debug("post accept");
if (rxrpc_post_message(call, RXRPC_SKB_MARK_NEW_CALL,
0, false) < 0)
goto no_mem;
clear_bit(RXRPC_CALL_POST_ACCEPT, &call->events);
goto maybe_reschedule;
}
/* handle incoming call acceptance */
if (test_and_clear_bit(RXRPC_CALL_ACCEPTED, &call->events)) {
_debug("accepted");
ASSERTCMP(call->rx_data_post, ==, 0);
call->rx_data_post = 1;
read_lock_bh(&call->state_lock);
if (call->state < RXRPC_CALL_COMPLETE)
set_bit(RXRPC_CALL_DRAIN_RX_OOS, &call->events);
read_unlock_bh(&call->state_lock);
}
/* drain the out of sequence received packet queue into the packet Rx
* queue */
if (test_and_clear_bit(RXRPC_CALL_DRAIN_RX_OOS, &call->events)) {
while (call->rx_data_post == call->rx_first_oos)
if (rxrpc_drain_rx_oos_queue(call) < 0)
break;
goto maybe_reschedule;
}
/* other events may have been raised since we started checking */
goto maybe_reschedule;
send_ACK_with_skew:
ack.maxSkew = htons(atomic_read(&call->conn->hi_serial) -
ntohl(ack.serial));
send_ACK:
mtu = call->conn->trans->peer->if_mtu;
mtu -= call->conn->trans->peer->hdrsize;
ackinfo.maxMTU = htonl(mtu);
ackinfo.rwind = htonl(32);
/* permit the peer to send us jumbo packets if it wants to */
ackinfo.rxMTU = htonl(5692);
ackinfo.jumbo_max = htonl(4);
hdr.serial = htonl(atomic_inc_return(&call->conn->serial));
_proto("Tx ACK %%%u { m=%hu f=#%u p=#%u s=%%%u r=%s n=%u }",
ntohl(hdr.serial),
ntohs(ack.maxSkew),
ntohl(ack.firstPacket),
ntohl(ack.previousPacket),
ntohl(ack.serial),
rxrpc_acks(ack.reason),
ack.nAcks);
del_timer_sync(&call->ack_timer);
if (ack.nAcks > 0)
set_bit(RXRPC_CALL_TX_SOFT_ACK, &call->flags);
goto send_message_2;
send_message:
_debug("send message");
hdr.serial = htonl(atomic_inc_return(&call->conn->serial));
_proto("Tx %s %%%u", rxrpc_pkts[hdr.type], ntohl(hdr.serial));
send_message_2:
len = iov[0].iov_len;
ioc = 1;
if (iov[4].iov_len) {
ioc = 5;
len += iov[4].iov_len;
len += iov[3].iov_len;
len += iov[2].iov_len;
len += iov[1].iov_len;
} else if (iov[3].iov_len) {
ioc = 4;
len += iov[3].iov_len;
len += iov[2].iov_len;
len += iov[1].iov_len;
} else if (iov[2].iov_len) {
ioc = 3;
len += iov[2].iov_len;
len += iov[1].iov_len;
} else if (iov[1].iov_len) {
ioc = 2;
len += iov[1].iov_len;
}
ret = kernel_sendmsg(call->conn->trans->local->socket,
&msg, iov, ioc, len);
if (ret < 0) {
_debug("sendmsg failed: %d", ret);
read_lock_bh(&call->state_lock);
if (call->state < RXRPC_CALL_DEAD)
rxrpc_queue_call(call);
read_unlock_bh(&call->state_lock);
goto error;
}
switch (genbit) {
case RXRPC_CALL_ABORT:
clear_bit(genbit, &call->events);
clear_bit(RXRPC_CALL_RCVD_ABORT, &call->events);
goto kill_ACKs;
case RXRPC_CALL_ACK_FINAL:
write_lock_bh(&call->state_lock);
if (call->state == RXRPC_CALL_CLIENT_FINAL_ACK)
call->state = RXRPC_CALL_COMPLETE;
write_unlock_bh(&call->state_lock);
goto kill_ACKs;
default:
clear_bit(genbit, &call->events);
switch (call->state) {
case RXRPC_CALL_CLIENT_AWAIT_REPLY:
case RXRPC_CALL_CLIENT_RECV_REPLY:
case RXRPC_CALL_SERVER_RECV_REQUEST:
case RXRPC_CALL_SERVER_ACK_REQUEST:
_debug("start ACK timer");
rxrpc_propose_ACK(call, RXRPC_ACK_DELAY,
call->ackr_serial, false);
default:
break;
}
goto maybe_reschedule;
}
kill_ACKs:
del_timer_sync(&call->ack_timer);
if (test_and_clear_bit(RXRPC_CALL_ACK_FINAL, &call->events))
rxrpc_put_call(call);
clear_bit(RXRPC_CALL_ACK, &call->events);
maybe_reschedule:
if (call->events || !skb_queue_empty(&call->rx_queue)) {
read_lock_bh(&call->state_lock);
if (call->state < RXRPC_CALL_DEAD)
rxrpc_queue_call(call);
read_unlock_bh(&call->state_lock);
}
/* don't leave aborted connections on the accept queue */
if (call->state >= RXRPC_CALL_COMPLETE &&
!list_empty(&call->accept_link)) {
_debug("X unlinking once-pending call %p { e=%lx f=%lx c=%x }",
call, call->events, call->flags,
ntohl(call->conn->cid));
read_lock_bh(&call->state_lock);
if (!test_bit(RXRPC_CALL_RELEASED, &call->flags) &&
!test_and_set_bit(RXRPC_CALL_RELEASE, &call->events))
rxrpc_queue_call(call);
read_unlock_bh(&call->state_lock);
}
error:
clear_bit(RXRPC_CALL_PROC_BUSY, &call->flags);
kfree(acks);
/* because we don't want two CPUs both processing the work item for one
* call at the same time, we use a flag to note when it's busy; however
* this means there's a race between clearing the flag and setting the
* work pending bit and the work item being processed again */
if (call->events && !work_pending(&call->processor)) {
_debug("jumpstart %x", ntohl(call->conn->cid));
rxrpc_queue_call(call);
}
_leave("");
return;
no_mem:
_debug("out of memory");
goto maybe_reschedule;
}
View Git Blame Copy Permalink