sm_sideeffect.c 50.9 KB
Newer Older
1
/* SCTP kernel implementation
L
Linus Torvalds 已提交
2 3 4 5
 * (C) Copyright IBM Corp. 2001, 2004
 * Copyright (c) 1999 Cisco, Inc.
 * Copyright (c) 1999-2001 Motorola, Inc.
 *
6
 * This file is part of the SCTP kernel implementation
L
Linus Torvalds 已提交
7 8 9 10 11
 *
 * These functions work with the state functions in sctp_sm_statefuns.c
 * to implement that state operations.  These functions implement the
 * steps which require modifying existing data structures.
 *
12
 * This SCTP implementation is free software;
L
Linus Torvalds 已提交
13 14 15 16 17
 * you can redistribute it and/or modify it under the terms of
 * the GNU General Public License as published by
 * the Free Software Foundation; either version 2, or (at your option)
 * any later version.
 *
18
 * This SCTP implementation is distributed in the hope that it
L
Linus Torvalds 已提交
19 20 21 22 23 24
 * will be useful, but WITHOUT ANY WARRANTY; without even the implied
 *                 ************************
 * warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
 * See the GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
25 26
 * along with GNU CC; see the file COPYING.  If not, see
 * <http://www.gnu.org/licenses/>.
L
Linus Torvalds 已提交
27 28 29
 *
 * Please send any bug reports or fixes you make to the
 * email address(es):
30
 *    lksctp developers <linux-sctp@vger.kernel.org>
L
Linus Torvalds 已提交
31 32 33 34 35 36 37 38 39 40 41 42
 *
 * Written or modified by:
 *    La Monte H.P. Yarroll <piggy@acm.org>
 *    Karl Knutson          <karl@athena.chicago.il.us>
 *    Jon Grimm             <jgrimm@austin.ibm.com>
 *    Hui Huang		    <hui.huang@nokia.com>
 *    Dajiang Zhang	    <dajiang.zhang@nokia.com>
 *    Daisy Chang	    <daisyc@us.ibm.com>
 *    Sridhar Samudrala	    <sri@us.ibm.com>
 *    Ardelle Fan	    <ardelle.fan@intel.com>
 */

43 44
#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt

L
Linus Torvalds 已提交
45 46 47 48
#include <linux/skbuff.h>
#include <linux/types.h>
#include <linux/socket.h>
#include <linux/ip.h>
49
#include <linux/gfp.h>
L
Linus Torvalds 已提交
50 51 52
#include <net/sock.h>
#include <net/sctp/sctp.h>
#include <net/sctp/sm.h>
53
#include <net/sctp/stream_sched.h>
L
Linus Torvalds 已提交
54

X
Xin Long 已提交
55
static int sctp_cmd_interpreter(enum sctp_event event_type,
56
				union sctp_subtype subtype,
X
Xin Long 已提交
57
				enum sctp_state state,
L
Linus Torvalds 已提交
58 59 60
				struct sctp_endpoint *ep,
				struct sctp_association *asoc,
				void *event_arg,
61
				enum sctp_disposition status,
62
				struct sctp_cmd_seq *commands,
A
Al Viro 已提交
63
				gfp_t gfp);
64 65
static int sctp_side_effects(enum sctp_event event_type,
			     union sctp_subtype subtype,
X
Xin Long 已提交
66
			     enum sctp_state state,
L
Linus Torvalds 已提交
67
			     struct sctp_endpoint *ep,
68
			     struct sctp_association **asoc,
L
Linus Torvalds 已提交
69
			     void *event_arg,
70
			     enum sctp_disposition status,
71
			     struct sctp_cmd_seq *commands,
A
Al Viro 已提交
72
			     gfp_t gfp);
L
Linus Torvalds 已提交
73 74 75 76 77 78

/********************************************************************
 * Helper functions
 ********************************************************************/

/* A helper function for delayed processing of INET ECN CE bit. */
79
static void sctp_do_ecn_ce_work(struct sctp_association *asoc,
L
Linus Torvalds 已提交
80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100
				__u32 lowest_tsn)
{
	/* Save the TSN away for comparison when we receive CWR */

	asoc->last_ecne_tsn = lowest_tsn;
	asoc->need_ecne = 1;
}

/* Helper function for delayed processing of SCTP ECNE chunk.  */
/* RFC 2960 Appendix A
 *
 * RFC 2481 details a specific bit for a sender to send in
 * the header of its next outbound TCP segment to indicate to
 * its peer that it has reduced its congestion window.  This
 * is termed the CWR bit.  For SCTP the same indication is made
 * by including the CWR chunk.  This chunk contains one data
 * element, i.e. the TSN number that was sent in the ECNE chunk.
 * This element represents the lowest TSN number in the datagram
 * that was originally marked with the CE bit.
 */
static struct sctp_chunk *sctp_do_ecn_ecne_work(struct sctp_association *asoc,
101 102
						__u32 lowest_tsn,
						struct sctp_chunk *chunk)
L
Linus Torvalds 已提交
103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153
{
	struct sctp_chunk *repl;

	/* Our previously transmitted packet ran into some congestion
	 * so we should take action by reducing cwnd and ssthresh
	 * and then ACK our peer that we we've done so by
	 * sending a CWR.
	 */

	/* First, try to determine if we want to actually lower
	 * our cwnd variables.  Only lower them if the ECNE looks more
	 * recent than the last response.
	 */
	if (TSN_lt(asoc->last_cwr_tsn, lowest_tsn)) {
		struct sctp_transport *transport;

		/* Find which transport's congestion variables
		 * need to be adjusted.
		 */
		transport = sctp_assoc_lookup_tsn(asoc, lowest_tsn);

		/* Update the congestion variables. */
		if (transport)
			sctp_transport_lower_cwnd(transport,
						  SCTP_LOWER_CWND_ECNE);
		asoc->last_cwr_tsn = lowest_tsn;
	}

	/* Always try to quiet the other end.  In case of lost CWR,
	 * resend last_cwr_tsn.
	 */
	repl = sctp_make_cwr(asoc, asoc->last_cwr_tsn, chunk);

	/* If we run out of memory, it will look like a lost CWR.  We'll
	 * get back in sync eventually.
	 */
	return repl;
}

/* Helper function to do delayed processing of ECN CWR chunk.  */
static void sctp_do_ecn_cwr_work(struct sctp_association *asoc,
				 __u32 lowest_tsn)
{
	/* Turn off ECNE getting auto-prepended to every outgoing
	 * packet
	 */
	asoc->need_ecne = 0;
}

/* Generate SACK if necessary.  We call this at the end of a packet.  */
static int sctp_gen_sack(struct sctp_association *asoc, int force,
154
			 struct sctp_cmd_seq *commands)
L
Linus Torvalds 已提交
155
{
156
	struct sctp_transport *trans = asoc->peer.last_data_from;
L
Linus Torvalds 已提交
157 158 159 160
	__u32 ctsn, max_tsn_seen;
	struct sctp_chunk *sack;
	int error = 0;

161
	if (force ||
162 163
	    (!trans && (asoc->param_flags & SPP_SACKDELAY_DISABLE)) ||
	    (trans && (trans->param_flags & SPP_SACKDELAY_DISABLE)))
L
Linus Torvalds 已提交
164 165 166 167 168 169 170 171 172 173 174 175 176 177 178
		asoc->peer.sack_needed = 1;

	ctsn = sctp_tsnmap_get_ctsn(&asoc->peer.tsn_map);
	max_tsn_seen = sctp_tsnmap_get_max_tsn_seen(&asoc->peer.tsn_map);

	/* From 12.2 Parameters necessary per association (i.e. the TCB):
	 *
	 * Ack State : This flag indicates if the next received packet
	 * 	     : is to be responded to with a SACK. ...
	 *	     : When DATA chunks are out of order, SACK's
	 *           : are not delayed (see Section 6).
	 *
	 * [This is actually not mentioned in Section 6, but we
	 * implement it here anyway. --piggy]
	 */
179
	if (max_tsn_seen != ctsn)
L
Linus Torvalds 已提交
180 181 182 183 184 185 186 187 188 189 190
		asoc->peer.sack_needed = 1;

	/* From 6.2  Acknowledgement on Reception of DATA Chunks:
	 *
	 * Section 4.2 of [RFC2581] SHOULD be followed. Specifically,
	 * an acknowledgement SHOULD be generated for at least every
	 * second packet (not every second DATA chunk) received, and
	 * SHOULD be generated within 200 ms of the arrival of any
	 * unacknowledged DATA chunk. ...
	 */
	if (!asoc->peer.sack_needed) {
191
		asoc->peer.sack_cnt++;
192 193 194 195 196 197

		/* Set the SACK delay timeout based on the
		 * SACK delay for the last transport
		 * data was received from, or the default
		 * for the association.
		 */
198 199 200 201 202
		if (trans) {
			/* We will need a SACK for the next packet.  */
			if (asoc->peer.sack_cnt >= trans->sackfreq - 1)
				asoc->peer.sack_needed = 1;

203
			asoc->timeouts[SCTP_EVENT_TIMEOUT_SACK] =
204
				trans->sackdelay;
205 206 207 208 209
		} else {
			/* We will need a SACK for the next packet.  */
			if (asoc->peer.sack_cnt >= asoc->sackfreq - 1)
				asoc->peer.sack_needed = 1;

210
			asoc->timeouts[SCTP_EVENT_TIMEOUT_SACK] =
211
				asoc->sackdelay;
212
		}
213 214 215 216

		/* Restart the SACK timer. */
		sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_RESTART,
				SCTP_TO(SCTP_EVENT_TIMEOUT_SACK));
L
Linus Torvalds 已提交
217
	} else {
218 219
		__u32 old_a_rwnd = asoc->a_rwnd;

220
		asoc->a_rwnd = asoc->rwnd;
L
Linus Torvalds 已提交
221
		sack = sctp_make_sack(asoc);
222 223
		if (!sack) {
			asoc->a_rwnd = old_a_rwnd;
L
Linus Torvalds 已提交
224
			goto nomem;
225
		}
L
Linus Torvalds 已提交
226 227

		asoc->peer.sack_needed = 0;
228
		asoc->peer.sack_cnt = 0;
L
Linus Torvalds 已提交
229

230
		sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(sack));
L
Linus Torvalds 已提交
231 232 233 234 235

		/* Stop the SACK timer.  */
		sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
				SCTP_TO(SCTP_EVENT_TIMEOUT_SACK));
	}
236

L
Linus Torvalds 已提交
237 238 239 240 241 242 243 244 245
	return error;
nomem:
	error = -ENOMEM;
	return error;
}

/* When the T3-RTX timer expires, it calls this function to create the
 * relevant state machine event.
 */
246
void sctp_generate_t3_rtx_event(struct timer_list *t)
L
Linus Torvalds 已提交
247
{
248 249
	struct sctp_transport *transport =
		from_timer(transport, t, T3_rtx_timer);
L
Linus Torvalds 已提交
250
	struct sctp_association *asoc = transport->asoc;
251 252
	struct sock *sk = asoc->base.sk;
	struct net *net = sock_net(sk);
253
	int error;
L
Linus Torvalds 已提交
254 255 256

	/* Check whether a task is in the sock.  */

257 258
	bh_lock_sock(sk);
	if (sock_owned_by_user(sk)) {
259
		pr_debug("%s: sock is busy\n", __func__);
L
Linus Torvalds 已提交
260 261 262 263 264 265 266 267

		/* Try again later.  */
		if (!mod_timer(&transport->T3_rtx_timer, jiffies + (HZ/20)))
			sctp_transport_hold(transport);
		goto out_unlock;
	}

	/* Run through the state machine.  */
268
	error = sctp_do_sm(net, SCTP_EVENT_T_TIMEOUT,
L
Linus Torvalds 已提交
269 270 271 272 273 274
			   SCTP_ST_TIMEOUT(SCTP_EVENT_TIMEOUT_T3_RTX),
			   asoc->state,
			   asoc->ep, asoc,
			   transport, GFP_ATOMIC);

	if (error)
275
		sk->sk_err = -error;
L
Linus Torvalds 已提交
276 277

out_unlock:
278
	bh_unlock_sock(sk);
L
Linus Torvalds 已提交
279 280 281 282 283 284 285
	sctp_transport_put(transport);
}

/* This is a sa interface for producing timeout events.  It works
 * for timeouts which use the association as their parameter.
 */
static void sctp_generate_timeout_event(struct sctp_association *asoc,
286
					enum sctp_event_timeout timeout_type)
L
Linus Torvalds 已提交
287
{
288 289
	struct sock *sk = asoc->base.sk;
	struct net *net = sock_net(sk);
L
Linus Torvalds 已提交
290 291
	int error = 0;

292 293
	bh_lock_sock(sk);
	if (sock_owned_by_user(sk)) {
294 295
		pr_debug("%s: sock is busy: timer %d\n", __func__,
			 timeout_type);
L
Linus Torvalds 已提交
296 297 298 299 300 301 302 303 304 305 306 307 308 309

		/* Try again later.  */
		if (!mod_timer(&asoc->timers[timeout_type], jiffies + (HZ/20)))
			sctp_association_hold(asoc);
		goto out_unlock;
	}

	/* Is this association really dead and just waiting around for
	 * the timer to let go of the reference?
	 */
	if (asoc->base.dead)
		goto out_unlock;

	/* Run through the state machine.  */
310
	error = sctp_do_sm(net, SCTP_EVENT_T_TIMEOUT,
L
Linus Torvalds 已提交
311 312 313 314 315
			   SCTP_ST_TIMEOUT(timeout_type),
			   asoc->state, asoc->ep, asoc,
			   (void *)timeout_type, GFP_ATOMIC);

	if (error)
316
		sk->sk_err = -error;
L
Linus Torvalds 已提交
317 318

out_unlock:
319
	bh_unlock_sock(sk);
L
Linus Torvalds 已提交
320 321 322
	sctp_association_put(asoc);
}

323
static void sctp_generate_t1_cookie_event(struct timer_list *t)
L
Linus Torvalds 已提交
324
{
325 326 327
	struct sctp_association *asoc =
		from_timer(asoc, t, timers[SCTP_EVENT_TIMEOUT_T1_COOKIE]);

L
Linus Torvalds 已提交
328 329 330
	sctp_generate_timeout_event(asoc, SCTP_EVENT_TIMEOUT_T1_COOKIE);
}

331
static void sctp_generate_t1_init_event(struct timer_list *t)
L
Linus Torvalds 已提交
332
{
333 334 335
	struct sctp_association *asoc =
		from_timer(asoc, t, timers[SCTP_EVENT_TIMEOUT_T1_INIT]);

L
Linus Torvalds 已提交
336 337 338
	sctp_generate_timeout_event(asoc, SCTP_EVENT_TIMEOUT_T1_INIT);
}

339
static void sctp_generate_t2_shutdown_event(struct timer_list *t)
L
Linus Torvalds 已提交
340
{
341 342 343
	struct sctp_association *asoc =
		from_timer(asoc, t, timers[SCTP_EVENT_TIMEOUT_T2_SHUTDOWN]);

L
Linus Torvalds 已提交
344 345 346
	sctp_generate_timeout_event(asoc, SCTP_EVENT_TIMEOUT_T2_SHUTDOWN);
}

347
static void sctp_generate_t4_rto_event(struct timer_list *t)
L
Linus Torvalds 已提交
348
{
349 350 351
	struct sctp_association *asoc =
		from_timer(asoc, t, timers[SCTP_EVENT_TIMEOUT_T4_RTO]);

L
Linus Torvalds 已提交
352 353 354
	sctp_generate_timeout_event(asoc, SCTP_EVENT_TIMEOUT_T4_RTO);
}

355
static void sctp_generate_t5_shutdown_guard_event(struct timer_list *t)
L
Linus Torvalds 已提交
356
{
357 358 359 360
	struct sctp_association *asoc =
		from_timer(asoc, t,
			   timers[SCTP_EVENT_TIMEOUT_T5_SHUTDOWN_GUARD]);

361
	sctp_generate_timeout_event(asoc,
L
Linus Torvalds 已提交
362 363 364 365
				    SCTP_EVENT_TIMEOUT_T5_SHUTDOWN_GUARD);

} /* sctp_generate_t5_shutdown_guard_event() */

366
static void sctp_generate_autoclose_event(struct timer_list *t)
L
Linus Torvalds 已提交
367
{
368 369 370
	struct sctp_association *asoc =
		from_timer(asoc, t, timers[SCTP_EVENT_TIMEOUT_AUTOCLOSE]);

L
Linus Torvalds 已提交
371 372 373 374 375 376
	sctp_generate_timeout_event(asoc, SCTP_EVENT_TIMEOUT_AUTOCLOSE);
}

/* Generate a heart beat event.  If the sock is busy, reschedule.   Make
 * sure that the transport is still valid.
 */
377
void sctp_generate_heartbeat_event(struct timer_list *t)
L
Linus Torvalds 已提交
378
{
379
	struct sctp_transport *transport = from_timer(transport, t, hb_timer);
L
Linus Torvalds 已提交
380
	struct sctp_association *asoc = transport->asoc;
381 382
	struct sock *sk = asoc->base.sk;
	struct net *net = sock_net(sk);
383
	u32 elapsed, timeout;
384
	int error = 0;
L
Linus Torvalds 已提交
385

386 387
	bh_lock_sock(sk);
	if (sock_owned_by_user(sk)) {
388
		pr_debug("%s: sock is busy\n", __func__);
L
Linus Torvalds 已提交
389 390 391 392 393 394 395

		/* Try again later.  */
		if (!mod_timer(&transport->hb_timer, jiffies + (HZ/20)))
			sctp_transport_hold(transport);
		goto out_unlock;
	}

396 397 398 399 400 401 402 403 404 405
	/* Check if we should still send the heartbeat or reschedule */
	elapsed = jiffies - transport->last_time_sent;
	timeout = sctp_transport_timeout(transport);
	if (elapsed < timeout) {
		elapsed = timeout - elapsed;
		if (!mod_timer(&transport->hb_timer, jiffies + elapsed))
			sctp_transport_hold(transport);
		goto out_unlock;
	}

406
	error = sctp_do_sm(net, SCTP_EVENT_T_TIMEOUT,
L
Linus Torvalds 已提交
407 408 409 410
			   SCTP_ST_TIMEOUT(SCTP_EVENT_TIMEOUT_HEARTBEAT),
			   asoc->state, asoc->ep, asoc,
			   transport, GFP_ATOMIC);

K
Karl Heiss 已提交
411
	if (error)
412
		sk->sk_err = -error;
L
Linus Torvalds 已提交
413 414

out_unlock:
415
	bh_unlock_sock(sk);
L
Linus Torvalds 已提交
416 417 418
	sctp_transport_put(transport);
}

419 420 421
/* Handle the timeout of the ICMP protocol unreachable timer.  Trigger
 * the correct state machine transition that will close the association.
 */
422
void sctp_generate_proto_unreach_event(struct timer_list *t)
423
{
424 425
	struct sctp_transport *transport =
		from_timer(transport, t, proto_unreach_timer);
426
	struct sctp_association *asoc = transport->asoc;
427 428
	struct sock *sk = asoc->base.sk;
	struct net *net = sock_net(sk);
429

430 431
	bh_lock_sock(sk);
	if (sock_owned_by_user(sk)) {
432
		pr_debug("%s: sock is busy\n", __func__);
433 434 435 436 437 438 439 440 441 442 443 444 445 446

		/* Try again later.  */
		if (!mod_timer(&transport->proto_unreach_timer,
				jiffies + (HZ/20)))
			sctp_association_hold(asoc);
		goto out_unlock;
	}

	/* Is this structure just waiting around for us to actually
	 * get destroyed?
	 */
	if (asoc->base.dead)
		goto out_unlock;

447
	sctp_do_sm(net, SCTP_EVENT_T_OTHER,
448 449 450 451
		   SCTP_ST_OTHER(SCTP_EVENT_ICMP_PROTO_UNREACH),
		   asoc->state, asoc->ep, asoc, transport, GFP_ATOMIC);

out_unlock:
452
	bh_unlock_sock(sk);
453 454 455
	sctp_association_put(asoc);
}

X
Xin Long 已提交
456
 /* Handle the timeout of the RE-CONFIG timer. */
457
void sctp_generate_reconf_event(struct timer_list *t)
X
Xin Long 已提交
458
{
459 460
	struct sctp_transport *transport =
		from_timer(transport, t, reconf_timer);
X
Xin Long 已提交
461 462 463 464 465 466 467 468 469 470 471 472 473 474 475 476 477 478 479 480 481 482 483 484 485 486 487
	struct sctp_association *asoc = transport->asoc;
	struct sock *sk = asoc->base.sk;
	struct net *net = sock_net(sk);
	int error = 0;

	bh_lock_sock(sk);
	if (sock_owned_by_user(sk)) {
		pr_debug("%s: sock is busy\n", __func__);

		/* Try again later.  */
		if (!mod_timer(&transport->reconf_timer, jiffies + (HZ / 20)))
			sctp_transport_hold(transport);
		goto out_unlock;
	}

	error = sctp_do_sm(net, SCTP_EVENT_T_TIMEOUT,
			   SCTP_ST_TIMEOUT(SCTP_EVENT_TIMEOUT_RECONF),
			   asoc->state, asoc->ep, asoc,
			   transport, GFP_ATOMIC);

	if (error)
		sk->sk_err = -error;

out_unlock:
	bh_unlock_sock(sk);
	sctp_transport_put(transport);
}
488

L
Linus Torvalds 已提交
489
/* Inject a SACK Timeout event into the state machine.  */
490
static void sctp_generate_sack_event(struct timer_list *t)
L
Linus Torvalds 已提交
491
{
492 493 494
	struct sctp_association *asoc =
		from_timer(asoc, t, timers[SCTP_EVENT_TIMEOUT_SACK]);

L
Linus Torvalds 已提交
495 496 497 498
	sctp_generate_timeout_event(asoc, SCTP_EVENT_TIMEOUT_SACK);
}

sctp_timer_event_t *sctp_timer_events[SCTP_NUM_TIMEOUT_TYPES] = {
499 500 501 502 503 504 505 506 507 508 509 510
	[SCTP_EVENT_TIMEOUT_NONE] =		NULL,
	[SCTP_EVENT_TIMEOUT_T1_COOKIE] =	sctp_generate_t1_cookie_event,
	[SCTP_EVENT_TIMEOUT_T1_INIT] =		sctp_generate_t1_init_event,
	[SCTP_EVENT_TIMEOUT_T2_SHUTDOWN] =	sctp_generate_t2_shutdown_event,
	[SCTP_EVENT_TIMEOUT_T3_RTX] =		NULL,
	[SCTP_EVENT_TIMEOUT_T4_RTO] =		sctp_generate_t4_rto_event,
	[SCTP_EVENT_TIMEOUT_T5_SHUTDOWN_GUARD] =
					sctp_generate_t5_shutdown_guard_event,
	[SCTP_EVENT_TIMEOUT_HEARTBEAT] =	NULL,
	[SCTP_EVENT_TIMEOUT_RECONF] =		NULL,
	[SCTP_EVENT_TIMEOUT_SACK] =		sctp_generate_sack_event,
	[SCTP_EVENT_TIMEOUT_AUTOCLOSE] =	sctp_generate_autoclose_event,
L
Linus Torvalds 已提交
511 512 513 514 515 516 517 518 519 520 521 522 523 524 525 526 527 528
};


/* RFC 2960 8.2 Path Failure Detection
 *
 * When its peer endpoint is multi-homed, an endpoint should keep a
 * error counter for each of the destination transport addresses of the
 * peer endpoint.
 *
 * Each time the T3-rtx timer expires on any address, or when a
 * HEARTBEAT sent to an idle address is not acknowledged within a RTO,
 * the error counter of that destination address will be incremented.
 * When the value in the error counter exceeds the protocol parameter
 * 'Path.Max.Retrans' of that destination address, the endpoint should
 * mark the destination transport address as inactive, and a
 * notification SHOULD be sent to the upper layer.
 *
 */
529
static void sctp_do_8_2_transport_strike(struct sctp_cmd_seq *commands,
530
					 struct sctp_association *asoc,
531 532
					 struct sctp_transport *transport,
					 int is_hb)
L
Linus Torvalds 已提交
533
{
534 535
	struct net *net = sock_net(asoc->base.sk);

L
Linus Torvalds 已提交
536 537 538
	/* The check for association's overall error counter exceeding the
	 * threshold is done in the state function.
	 */
539 540 541 542 543
	/* We are here due to a timer expiration.  If the timer was
	 * not a HEARTBEAT, then normal error tracking is done.
	 * If the timer was a heartbeat, we only increment error counts
	 * when we already have an outstanding HEARTBEAT that has not
	 * been acknowledged.
L
Lucas De Marchi 已提交
544
	 * Additionally, some tranport states inhibit error increments.
545
	 */
546
	if (!is_hb) {
547
		asoc->overall_error_count++;
548 549 550 551 552 553 554 555
		if (transport->state != SCTP_INACTIVE)
			transport->error_count++;
	 } else if (transport->hb_sent) {
		if (transport->state != SCTP_UNCONFIRMED)
			asoc->overall_error_count++;
		if (transport->state != SCTP_INACTIVE)
			transport->error_count++;
	}
L
Linus Torvalds 已提交
556

557
	/* If the transport error count is greater than the pf_retrans
558
	 * threshold, and less than pathmaxrtx, and if the current state
559 560
	 * is SCTP_ACTIVE, then mark this transport as Partially Failed,
	 * see SCTP Quick Failover Draft, section 5.1
561
	 */
562 563
	if (net->sctp.pf_enable &&
	   (transport->state == SCTP_ACTIVE) &&
564 565 566 567 568 569 570 571
	   (asoc->pf_retrans < transport->pathmaxrxt) &&
	   (transport->error_count > asoc->pf_retrans)) {

		sctp_assoc_control_transport(asoc, transport,
					     SCTP_TRANSPORT_PF,
					     0);

		/* Update the hb timer to resend a heartbeat every rto */
572
		sctp_transport_reset_hb_timer(transport);
573 574
	}

F
Frank Filz 已提交
575
	if (transport->state != SCTP_INACTIVE &&
576
	    (transport->error_count > transport->pathmaxrxt)) {
577 578 579
		pr_debug("%s: association:%p transport addr:%pISpc failed\n",
			 __func__, asoc, &transport->ipaddr.sa);

L
Linus Torvalds 已提交
580 581 582 583 584 585 586 587 588
		sctp_assoc_control_transport(asoc, transport,
					     SCTP_TRANSPORT_DOWN,
					     SCTP_FAILED_THRESHOLD);
	}

	/* E2) For the destination address for which the timer
	 * expires, set RTO <- RTO * 2 ("back off the timer").  The
	 * maximum value discussed in rule C7 above (RTO.max) may be
	 * used to provide an upper bound to this doubling operation.
589 590
	 *
	 * Special Case:  the first HB doesn't trigger exponential backoff.
D
Daniel Mack 已提交
591
	 * The first unacknowledged HB triggers it.  We do this with a flag
592
	 * that indicates that we have an outstanding HB.
L
Linus Torvalds 已提交
593
	 */
594
	if (!is_hb || transport->hb_sent) {
595
		transport->rto = min((transport->rto * 2), transport->asoc->rto_max);
596
		sctp_max_rto(asoc, transport);
597
	}
L
Linus Torvalds 已提交
598 599 600
}

/* Worker routine to handle INIT command failure.  */
601
static void sctp_cmd_init_failed(struct sctp_cmd_seq *commands,
L
Linus Torvalds 已提交
602
				 struct sctp_association *asoc,
603
				 unsigned int error)
L
Linus Torvalds 已提交
604 605 606
{
	struct sctp_ulpevent *event;

607
	event = sctp_ulpevent_make_assoc_change(asoc, 0, SCTP_CANT_STR_ASSOC,
608
						(__u16)error, 0, 0, NULL,
L
Linus Torvalds 已提交
609 610 611 612 613 614 615 616 617 618 619 620 621 622 623
						GFP_ATOMIC);

	if (event)
		sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP,
				SCTP_ULPEVENT(event));

	sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
			SCTP_STATE(SCTP_STATE_CLOSED));

	/* SEND_FAILED sent later when cleaning up the association. */
	asoc->outqueue.error = error;
	sctp_add_cmd_sf(commands, SCTP_CMD_DELETE_TCB, SCTP_NULL());
}

/* Worker routine to handle SCTP_CMD_ASSOC_FAILED.  */
624
static void sctp_cmd_assoc_failed(struct sctp_cmd_seq *commands,
L
Linus Torvalds 已提交
625
				  struct sctp_association *asoc,
X
Xin Long 已提交
626
				  enum sctp_event event_type,
627
				  union sctp_subtype subtype,
L
Linus Torvalds 已提交
628
				  struct sctp_chunk *chunk,
629
				  unsigned int error)
L
Linus Torvalds 已提交
630 631
{
	struct sctp_ulpevent *event;
632
	struct sctp_chunk *abort;
633

L
Linus Torvalds 已提交
634
	/* Cancel any partial delivery in progress. */
635
	asoc->stream.si->abort_pd(&asoc->ulpq, GFP_ATOMIC);
L
Linus Torvalds 已提交
636

637 638 639 640 641 642 643
	if (event_type == SCTP_EVENT_T_CHUNK && subtype.chunk == SCTP_CID_ABORT)
		event = sctp_ulpevent_make_assoc_change(asoc, 0, SCTP_COMM_LOST,
						(__u16)error, 0, 0, chunk,
						GFP_ATOMIC);
	else
		event = sctp_ulpevent_make_assoc_change(asoc, 0, SCTP_COMM_LOST,
						(__u16)error, 0, 0, NULL,
L
Linus Torvalds 已提交
644 645 646 647 648
						GFP_ATOMIC);
	if (event)
		sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP,
				SCTP_ULPEVENT(event));

649 650 651 652 653 654 655
	if (asoc->overall_error_count >= asoc->max_retrans) {
		abort = sctp_make_violation_max_retrans(asoc, chunk);
		if (abort)
			sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
					SCTP_CHUNK(abort));
	}

L
Linus Torvalds 已提交
656 657 658 659 660 661 662 663 664 665 666 667 668
	sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
			SCTP_STATE(SCTP_STATE_CLOSED));

	/* SEND_FAILED sent later when cleaning up the association. */
	asoc->outqueue.error = error;
	sctp_add_cmd_sf(commands, SCTP_CMD_DELETE_TCB, SCTP_NULL());
}

/* Process an init chunk (may be real INIT/INIT-ACK or an embedded INIT
 * inside the cookie.  In reality, this is only used for INIT-ACK processing
 * since all other cases use "temporary" associations and can do all
 * their work in statefuns directly.
 */
669
static int sctp_cmd_process_init(struct sctp_cmd_seq *commands,
L
Linus Torvalds 已提交
670 671
				 struct sctp_association *asoc,
				 struct sctp_chunk *chunk,
672
				 struct sctp_init_chunk *peer_init,
A
Al Viro 已提交
673
				 gfp_t gfp)
L
Linus Torvalds 已提交
674 675 676 677 678 679 680 681
{
	int error;

	/* We only process the init as a sideeffect in a single
	 * case.   This is when we process the INIT-ACK.   If we
	 * fail during INIT processing (due to malloc problems),
	 * just return the error and stop processing the stack.
	 */
682
	if (!sctp_process_init(asoc, chunk, sctp_source(chunk), peer_init, gfp))
L
Linus Torvalds 已提交
683 684 685 686 687 688 689 690
		error = -ENOMEM;
	else
		error = 0;

	return error;
}

/* Helper function to break out starting up of heartbeat timers.  */
691
static void sctp_cmd_hb_timers_start(struct sctp_cmd_seq *cmds,
L
Linus Torvalds 已提交
692 693 694 695 696 697 698 699
				     struct sctp_association *asoc)
{
	struct sctp_transport *t;

	/* Start a heartbeat timer for each transport on the association.
	 * hold a reference on the transport to make sure none of
	 * the needed data structures go away.
	 */
700 701
	list_for_each_entry(t, &asoc->peer.transport_addr_list, transports)
		sctp_transport_reset_hb_timer(t);
L
Linus Torvalds 已提交
702 703
}

704
static void sctp_cmd_hb_timers_stop(struct sctp_cmd_seq *cmds,
L
Linus Torvalds 已提交
705 706 707 708 709 710
				    struct sctp_association *asoc)
{
	struct sctp_transport *t;

	/* Stop all heartbeat timers. */

711 712
	list_for_each_entry(t, &asoc->peer.transport_addr_list,
			transports) {
L
Linus Torvalds 已提交
713 714 715 716 717 718
		if (del_timer(&t->hb_timer))
			sctp_transport_put(t);
	}
}

/* Helper function to stop any pending T3-RTX timers */
719
static void sctp_cmd_t3_rtx_timers_stop(struct sctp_cmd_seq *cmds,
720
					struct sctp_association *asoc)
L
Linus Torvalds 已提交
721 722 723
{
	struct sctp_transport *t;

724 725
	list_for_each_entry(t, &asoc->peer.transport_addr_list,
			transports) {
726
		if (del_timer(&t->T3_rtx_timer))
L
Linus Torvalds 已提交
727 728 729 730 731 732
			sctp_transport_put(t);
	}
}


/* Helper function to handle the reception of an HEARTBEAT ACK.  */
733
static void sctp_cmd_transport_on(struct sctp_cmd_seq *cmds,
L
Linus Torvalds 已提交
734 735 736 737
				  struct sctp_association *asoc,
				  struct sctp_transport *t,
				  struct sctp_chunk *chunk)
{
738
	struct sctp_sender_hb_info *hbinfo;
739
	int was_unconfirmed = 0;
L
Linus Torvalds 已提交
740 741 742 743 744 745

	/* 8.3 Upon the receipt of the HEARTBEAT ACK, the sender of the
	 * HEARTBEAT should clear the error counter of the destination
	 * transport address to which the HEARTBEAT was sent.
	 */
	t->error_count = 0;
746 747 748 749 750 751 752 753 754

	/*
	 * Although RFC4960 specifies that the overall error count must
	 * be cleared when a HEARTBEAT ACK is received, we make an
	 * exception while in SHUTDOWN PENDING. If the peer keeps its
	 * window shut forever, we may never be able to transmit our
	 * outstanding data and rely on the retransmission limit be reached
	 * to shutdown the association.
	 */
755
	if (t->asoc->state < SCTP_STATE_SHUTDOWN_PENDING)
756
		t->asoc->overall_error_count = 0;
L
Linus Torvalds 已提交
757

758 759 760 761 762
	/* Clear the hb_sent flag to signal that we had a good
	 * acknowledgement.
	 */
	t->hb_sent = 0;

L
Linus Torvalds 已提交
763 764 765
	/* Mark the destination transport address as active if it is not so
	 * marked.
	 */
766 767
	if ((t->state == SCTP_INACTIVE) || (t->state == SCTP_UNCONFIRMED)) {
		was_unconfirmed = 1;
L
Linus Torvalds 已提交
768 769
		sctp_assoc_control_transport(asoc, t, SCTP_TRANSPORT_UP,
					     SCTP_HEARTBEAT_SUCCESS);
770
	}
L
Linus Torvalds 已提交
771

772 773 774 775
	if (t->state == SCTP_PF)
		sctp_assoc_control_transport(asoc, t, SCTP_TRANSPORT_UP,
					     SCTP_HEARTBEAT_SUCCESS);

776 777 778 779
	/* HB-ACK was received for a the proper HB.  Consider this
	 * forward progress.
	 */
	if (t->dst)
780
		sctp_transport_dst_confirm(t);
781

L
Linus Torvalds 已提交
782 783 784
	/* The receiver of the HEARTBEAT ACK should also perform an
	 * RTT measurement for that destination transport address
	 * using the time value carried in the HEARTBEAT ACK chunk.
785 786 787
	 * If the transport's rto_pending variable has been cleared,
	 * it was most likely due to a retransmit.  However, we want
	 * to re-enable it to properly update the rto.
L
Linus Torvalds 已提交
788
	 */
789 790 791
	if (t->rto_pending == 0)
		t->rto_pending = 1;

792
	hbinfo = (struct sctp_sender_hb_info *)chunk->skb->data;
L
Linus Torvalds 已提交
793
	sctp_transport_update_rto(t, (jiffies - hbinfo->sent_at));
794 795

	/* Update the heartbeat timer.  */
796
	sctp_transport_reset_hb_timer(t);
797 798 799

	if (was_unconfirmed && asoc->peer.transport_count == 1)
		sctp_transport_immediate_rtx(t);
L
Linus Torvalds 已提交
800 801 802 803
}


/* Helper function to process the process SACK command.  */
804
static int sctp_cmd_process_sack(struct sctp_cmd_seq *cmds,
L
Linus Torvalds 已提交
805
				 struct sctp_association *asoc,
806
				 struct sctp_chunk *chunk)
L
Linus Torvalds 已提交
807
{
808
	int err = 0;
L
Linus Torvalds 已提交
809

810
	if (sctp_outq_sack(&asoc->outqueue, chunk)) {
811 812
		struct net *net = sock_net(asoc->base.sk);

L
Linus Torvalds 已提交
813
		/* There are no more TSNs awaiting SACK.  */
814
		err = sctp_do_sm(net, SCTP_EVENT_T_OTHER,
L
Linus Torvalds 已提交
815 816 817 818 819 820 821 822 823 824 825
				 SCTP_ST_OTHER(SCTP_EVENT_NO_PENDING_TSN),
				 asoc->state, asoc->ep, asoc, NULL,
				 GFP_ATOMIC);
	}

	return err;
}

/* Helper function to set the timeout value for T2-SHUTDOWN timer and to set
 * the transport for a shutdown chunk.
 */
826
static void sctp_cmd_setup_t2(struct sctp_cmd_seq *cmds,
L
Linus Torvalds 已提交
827 828 829 830 831
			      struct sctp_association *asoc,
			      struct sctp_chunk *chunk)
{
	struct sctp_transport *t;

832 833 834 835
	if (chunk->transport)
		t = chunk->transport;
	else {
		t = sctp_assoc_choose_alter_transport(asoc,
836
					      asoc->shutdown_last_sent_to);
837 838
		chunk->transport = t;
	}
L
Linus Torvalds 已提交
839 840 841 842
	asoc->shutdown_last_sent_to = t;
	asoc->timeouts[SCTP_EVENT_TIMEOUT_T2_SHUTDOWN] = t->rto;
}

843
static void sctp_cmd_assoc_update(struct sctp_cmd_seq *cmds,
844 845 846 847 848 849 850 851 852
				  struct sctp_association *asoc,
				  struct sctp_association *new)
{
	struct net *net = sock_net(asoc->base.sk);
	struct sctp_chunk *abort;

	if (!sctp_assoc_update(asoc, new))
		return;

853
	abort = sctp_make_abort(asoc, NULL, sizeof(struct sctp_errhdr));
854 855 856 857 858 859 860 861 862 863 864
	if (abort) {
		sctp_init_cause(abort, SCTP_ERROR_RSRC_LOW, 0);
		sctp_add_cmd_sf(cmds, SCTP_CMD_REPLY, SCTP_CHUNK(abort));
	}
	sctp_add_cmd_sf(cmds, SCTP_CMD_SET_SK_ERR, SCTP_ERROR(ECONNABORTED));
	sctp_add_cmd_sf(cmds, SCTP_CMD_ASSOC_FAILED,
			SCTP_PERR(SCTP_ERROR_RSRC_LOW));
	SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS);
	SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB);
}

L
Linus Torvalds 已提交
865
/* Helper function to change the state of an association. */
866
static void sctp_cmd_new_state(struct sctp_cmd_seq *cmds,
L
Linus Torvalds 已提交
867
			       struct sctp_association *asoc,
X
Xin Long 已提交
868
			       enum sctp_state state)
L
Linus Torvalds 已提交
869 870 871 872 873
{
	struct sock *sk = asoc->base.sk;

	asoc->state = state;

874
	pr_debug("%s: asoc:%p[%s]\n", __func__, asoc, sctp_state_tbl[state]);
F
Frank Filz 已提交
875

L
Linus Torvalds 已提交
876
	if (sctp_style(sk, TCP)) {
F
Frank Filz 已提交
877
		/* Change the sk->sk_state of a TCP-style socket that has
878
		 * successfully completed a connect() call.
L
Linus Torvalds 已提交
879 880
		 */
		if (sctp_state(asoc, ESTABLISHED) && sctp_sstate(sk, CLOSED))
881
			inet_sk_set_state(sk, SCTP_SS_ESTABLISHED);
L
Linus Torvalds 已提交
882 883 884

		/* Set the RCV_SHUTDOWN flag when a SHUTDOWN is received. */
		if (sctp_state(asoc, SHUTDOWN_RECEIVED) &&
885
		    sctp_sstate(sk, ESTABLISHED)) {
886
			inet_sk_set_state(sk, SCTP_SS_CLOSING);
L
Linus Torvalds 已提交
887
			sk->sk_shutdown |= RCV_SHUTDOWN;
888
		}
L
Linus Torvalds 已提交
889 890
	}

F
Frank Filz 已提交
891 892 893 894 895
	if (sctp_state(asoc, COOKIE_WAIT)) {
		/* Reset init timeouts since they may have been
		 * increased due to timer expirations.
		 */
		asoc->timeouts[SCTP_EVENT_TIMEOUT_T1_INIT] =
896
						asoc->rto_initial;
F
Frank Filz 已提交
897
		asoc->timeouts[SCTP_EVENT_TIMEOUT_T1_COOKIE] =
898
						asoc->rto_initial;
F
Frank Filz 已提交
899 900
	}

L
Linus Torvalds 已提交
901 902 903 904 905
	if (sctp_state(asoc, ESTABLISHED) ||
	    sctp_state(asoc, CLOSED) ||
	    sctp_state(asoc, SHUTDOWN_RECEIVED)) {
		/* Wake up any processes waiting in the asoc's wait queue in
		 * sctp_wait_for_connect() or sctp_wait_for_sndbuf().
906
		 */
L
Linus Torvalds 已提交
907 908 909 910 911 912 913 914 915 916 917 918
		if (waitqueue_active(&asoc->wait))
			wake_up_interruptible(&asoc->wait);

		/* Wake up any processes waiting in the sk's sleep queue of
		 * a TCP-style or UDP-style peeled-off socket in
		 * sctp_wait_for_accept() or sctp_wait_for_packet().
		 * For a UDP-style socket, the waiters are woken up by the
		 * notifications.
		 */
		if (!sctp_style(sk, UDP))
			sk->sk_state_change(sk);
	}
919 920 921 922

	if (sctp_state(asoc, SHUTDOWN_PENDING) &&
	    !sctp_outq_is_empty(&asoc->outqueue))
		sctp_outq_uncork(&asoc->outqueue, GFP_ATOMIC);
L
Linus Torvalds 已提交
923 924 925
}

/* Helper function to delete an association. */
926
static void sctp_cmd_delete_tcb(struct sctp_cmd_seq *cmds,
L
Linus Torvalds 已提交
927 928 929 930 931
				struct sctp_association *asoc)
{
	struct sock *sk = asoc->base.sk;

	/* If it is a non-temporary association belonging to a TCP-style
932
	 * listening socket that is not closed, do not free it so that accept()
L
Linus Torvalds 已提交
933
	 * can pick it up later.
934
	 */
L
Linus Torvalds 已提交
935 936 937 938 939 940 941 942 943 944 945
	if (sctp_style(sk, TCP) && sctp_sstate(sk, LISTENING) &&
	    (!asoc->temp) && (sk->sk_shutdown != SHUTDOWN_MASK))
		return;

	sctp_association_free(asoc);
}

/*
 * ADDIP Section 4.1 ASCONF Chunk Procedures
 * A4) Start a T-4 RTO timer, using the RTO value of the selected
 * destination address (we use active path instead of primary path just
946
 * because primary path may be inactive.
L
Linus Torvalds 已提交
947
 */
948 949 950
static void sctp_cmd_setup_t4(struct sctp_cmd_seq *cmds,
			      struct sctp_association *asoc,
			      struct sctp_chunk *chunk)
L
Linus Torvalds 已提交
951 952 953
{
	struct sctp_transport *t;

954
	t = sctp_assoc_choose_alter_transport(asoc, chunk->transport);
L
Linus Torvalds 已提交
955 956 957 958
	asoc->timeouts[SCTP_EVENT_TIMEOUT_T4_RTO] = t->rto;
	chunk->transport = t;
}

959
/* Process an incoming Operation Error Chunk. */
960
static void sctp_cmd_process_operr(struct sctp_cmd_seq *cmds,
L
Linus Torvalds 已提交
961 962 963 964
				   struct sctp_association *asoc,
				   struct sctp_chunk *chunk)
{
	struct sctp_errhdr *err_hdr;
965 966 967 968 969 970 971 972 973 974
	struct sctp_ulpevent *ev;

	while (chunk->chunk_end > chunk->skb->data) {
		err_hdr = (struct sctp_errhdr *)(chunk->skb->data);

		ev = sctp_ulpevent_make_remote_error(asoc, chunk, 0,
						     GFP_ATOMIC);
		if (!ev)
			return;

975
		asoc->stream.si->enqueue_event(&asoc->ulpq, ev);
976 977 978 979

		switch (err_hdr->cause) {
		case SCTP_ERROR_UNKNOWN_CHUNK:
		{
980
			struct sctp_chunkhdr *unk_chunk_hdr;
981

982 983
			unk_chunk_hdr = (struct sctp_chunkhdr *)
							err_hdr->variable;
984 985 986 987 988 989 990 991 992 993 994 995 996
			switch (unk_chunk_hdr->type) {
			/* ADDIP 4.1 A9) If the peer responds to an ASCONF with
			 * an ERROR chunk reporting that it did not recognized
			 * the ASCONF chunk type, the sender of the ASCONF MUST
			 * NOT send any further ASCONF chunks and MUST stop its
			 * T-4 timer.
			 */
			case SCTP_CID_ASCONF:
				if (asoc->peer.asconf_capable == 0)
					break;

				asoc->peer.asconf_capable = 0;
				sctp_add_cmd_sf(cmds, SCTP_CMD_TIMER_STOP,
L
Linus Torvalds 已提交
997
					SCTP_TO(SCTP_EVENT_TIMEOUT_T4_RTO));
998 999 1000 1001
				break;
			default:
				break;
			}
L
Linus Torvalds 已提交
1002
			break;
1003
		}
L
Linus Torvalds 已提交
1004 1005 1006 1007 1008 1009
		default:
			break;
		}
	}
}

1010
/* Helper function to remove the association non-primary peer
L
Linus Torvalds 已提交
1011
 * transports.
1012
 */
L
Linus Torvalds 已提交
1013 1014 1015 1016
static void sctp_cmd_del_non_primary(struct sctp_association *asoc)
{
	struct sctp_transport *t;
	struct list_head *temp;
1017
	struct list_head *pos;
L
Linus Torvalds 已提交
1018 1019 1020

	list_for_each_safe(pos, temp, &asoc->peer.transport_addr_list) {
		t = list_entry(pos, struct sctp_transport, transports);
1021
		if (!sctp_cmp_addr_exact(&t->ipaddr,
1022
					 &asoc->peer.primary_addr)) {
1023
			sctp_assoc_rm_peer(asoc, t);
L
Linus Torvalds 已提交
1024 1025 1026 1027
		}
	}
}

1028 1029 1030 1031 1032 1033 1034 1035 1036
/* Helper function to set sk_err on a 1-1 style socket. */
static void sctp_cmd_set_sk_err(struct sctp_association *asoc, int error)
{
	struct sock *sk = asoc->base.sk;

	if (!sctp_style(sk, UDP))
		sk->sk_err = error;
}

1037
/* Helper function to generate an association change event */
1038 1039 1040
static void sctp_cmd_assoc_change(struct sctp_cmd_seq *commands,
				  struct sctp_association *asoc,
				  u8 state)
1041 1042 1043 1044 1045 1046 1047 1048
{
	struct sctp_ulpevent *ev;

	ev = sctp_ulpevent_make_assoc_change(asoc, 0, state, 0,
					    asoc->c.sinit_num_ostreams,
					    asoc->c.sinit_max_instreams,
					    NULL, GFP_ATOMIC);
	if (ev)
1049
		asoc->stream.si->enqueue_event(&asoc->ulpq, ev);
1050 1051 1052
}

/* Helper function to generate an adaptation indication event */
1053
static void sctp_cmd_adaptation_ind(struct sctp_cmd_seq *commands,
1054 1055 1056 1057 1058 1059 1060
				    struct sctp_association *asoc)
{
	struct sctp_ulpevent *ev;

	ev = sctp_ulpevent_make_adaptation_indication(asoc, GFP_ATOMIC);

	if (ev)
1061
		asoc->stream.si->enqueue_event(&asoc->ulpq, ev);
1062 1063
}

1064 1065

static void sctp_cmd_t1_timer_update(struct sctp_association *asoc,
1066 1067
				     enum sctp_event_timeout timer,
				     char *name)
1068 1069 1070 1071 1072 1073 1074 1075 1076 1077 1078 1079
{
	struct sctp_transport *t;

	t = asoc->init_last_sent_to;
	asoc->init_err_counter++;

	if (t->init_sent_count > (asoc->init_cycle + 1)) {
		asoc->timeouts[timer] *= 2;
		if (asoc->timeouts[timer] > asoc->max_init_timeo) {
			asoc->timeouts[timer] = asoc->max_init_timeo;
		}
		asoc->init_cycle++;
1080 1081 1082 1083 1084

		pr_debug("%s: T1[%s] timeout adjustment init_err_counter:%d"
			 " cycle:%d timeout:%ld\n", __func__, name,
			 asoc->init_err_counter, asoc->init_cycle,
			 asoc->timeouts[timer]);
1085 1086 1087 1088
	}

}

1089 1090 1091 1092
/* Send the whole message, chunk by chunk, to the outqueue.
 * This way the whole message is queued up and bundling if
 * encouraged for small fragments.
 */
1093 1094
static void sctp_cmd_send_msg(struct sctp_association *asoc,
			      struct sctp_datamsg *msg, gfp_t gfp)
1095 1096 1097
{
	struct sctp_chunk *chunk;

1098 1099
	list_for_each_entry(chunk, &msg->chunks, frag_list)
		sctp_outq_tail(&asoc->outqueue, chunk, gfp);
1100 1101

	asoc->outqueue.sched->enqueue(&asoc->outqueue, msg);
1102 1103 1104
}


1105 1106 1107 1108 1109
/* Sent the next ASCONF packet currently stored in the association.
 * This happens after the ASCONF_ACK was succeffully processed.
 */
static void sctp_cmd_send_asconf(struct sctp_association *asoc)
{
1110 1111
	struct net *net = sock_net(asoc->base.sk);

1112 1113 1114 1115 1116 1117 1118 1119 1120 1121 1122
	/* Send the next asconf chunk from the addip chunk
	 * queue.
	 */
	if (!list_empty(&asoc->addip_chunk_list)) {
		struct list_head *entry = asoc->addip_chunk_list.next;
		struct sctp_chunk *asconf = list_entry(entry,
						struct sctp_chunk, list);
		list_del_init(entry);

		/* Hold the chunk until an ASCONF_ACK is received. */
		sctp_chunk_hold(asconf);
1123
		if (sctp_primitive_ASCONF(net, asoc, asconf))
1124 1125 1126 1127 1128 1129
			sctp_chunk_free(asconf);
		else
			asoc->addip_last_asconf = asconf;
	}
}

1130

L
Linus Torvalds 已提交
1131 1132 1133 1134
/* These three macros allow us to pull the debugging code out of the
 * main flow of sctp_do_sm() to keep attention focused on the real
 * functionality there.
 */
1135 1136 1137 1138 1139 1140 1141 1142 1143 1144 1145 1146 1147
#define debug_pre_sfn() \
	pr_debug("%s[pre-fn]: ep:%p, %s, %s, asoc:%p[%s], %s\n", __func__, \
		 ep, sctp_evttype_tbl[event_type], (*debug_fn)(subtype),   \
		 asoc, sctp_state_tbl[state], state_fn->name)

#define debug_post_sfn() \
	pr_debug("%s[post-fn]: asoc:%p, status:%s\n", __func__, asoc, \
		 sctp_status_tbl[status])

#define debug_post_sfx() \
	pr_debug("%s[post-sfx]: error:%d, asoc:%p[%s]\n", __func__, error, \
		 asoc, sctp_state_tbl[(asoc && sctp_id2assoc(ep->base.sk, \
		 sctp_assoc2id(asoc))) ? asoc->state : SCTP_STATE_CLOSED])
L
Linus Torvalds 已提交
1148 1149 1150 1151 1152 1153 1154

/*
 * This is the master state machine processing function.
 *
 * If you want to understand all of lksctp, this is a
 * good place to start.
 */
X
Xin Long 已提交
1155
int sctp_do_sm(struct net *net, enum sctp_event event_type,
1156
	       union sctp_subtype subtype, enum sctp_state state,
X
Xin Long 已提交
1157 1158
	       struct sctp_endpoint *ep, struct sctp_association *asoc,
	       void *event_arg, gfp_t gfp)
L
Linus Torvalds 已提交
1159
{
1160
	typedef const char *(printfn_t)(union sctp_subtype);
L
Linus Torvalds 已提交
1161 1162 1163 1164
	static printfn_t *table[] = {
		NULL, sctp_cname, sctp_tname, sctp_oname, sctp_pname,
	};
	printfn_t *debug_fn  __attribute__ ((unused)) = table[event_type];
1165 1166 1167 1168
	const struct sctp_sm_table_entry *state_fn;
	struct sctp_cmd_seq commands;
	enum sctp_disposition status;
	int error = 0;
L
Linus Torvalds 已提交
1169 1170 1171 1172

	/* Look up the state function, run it, and then process the
	 * side effects.  These three steps are the heart of lksctp.
	 */
1173
	state_fn = sctp_sm_lookup_event(net, event_type, state, subtype);
L
Linus Torvalds 已提交
1174 1175 1176

	sctp_init_cmd_seq(&commands);

1177
	debug_pre_sfn();
1178
	status = state_fn->fn(net, ep, asoc, subtype, event_arg, &commands);
1179
	debug_post_sfn();
L
Linus Torvalds 已提交
1180 1181

	error = sctp_side_effects(event_type, subtype, state,
1182
				  ep, &asoc, event_arg, status,
L
Linus Torvalds 已提交
1183
				  &commands, gfp);
1184
	debug_post_sfx();
L
Linus Torvalds 已提交
1185 1186 1187 1188 1189 1190 1191

	return error;
}

/*****************************************************************
 * This the master state function side effect processing function.
 *****************************************************************/
1192 1193
static int sctp_side_effects(enum sctp_event event_type,
			     union sctp_subtype subtype,
X
Xin Long 已提交
1194
			     enum sctp_state state,
L
Linus Torvalds 已提交
1195
			     struct sctp_endpoint *ep,
1196
			     struct sctp_association **asoc,
L
Linus Torvalds 已提交
1197
			     void *event_arg,
1198
			     enum sctp_disposition status,
1199
			     struct sctp_cmd_seq *commands,
A
Al Viro 已提交
1200
			     gfp_t gfp)
L
Linus Torvalds 已提交
1201 1202 1203 1204 1205 1206 1207 1208 1209 1210
{
	int error;

	/* FIXME - Most of the dispositions left today would be categorized
	 * as "exceptional" dispositions.  For those dispositions, it
	 * may not be proper to run through any of the commands at all.
	 * For example, the command interpreter might be run only with
	 * disposition SCTP_DISPOSITION_CONSUME.
	 */
	if (0 != (error = sctp_cmd_interpreter(event_type, subtype, state,
1211
					       ep, *asoc,
L
Linus Torvalds 已提交
1212 1213 1214 1215 1216 1217
					       event_arg, status,
					       commands, gfp)))
		goto bail;

	switch (status) {
	case SCTP_DISPOSITION_DISCARD:
1218 1219 1220
		pr_debug("%s: ignored sctp protocol event - state:%d, "
			 "event_type:%d, event_id:%d\n", __func__, state,
			 event_type, subtype.chunk);
L
Linus Torvalds 已提交
1221 1222 1223 1224 1225 1226 1227 1228 1229 1230 1231 1232
		break;

	case SCTP_DISPOSITION_NOMEM:
		/* We ran out of memory, so we need to discard this
		 * packet.
		 */
		/* BUG--we should now recover some memory, probably by
		 * reneging...
		 */
		error = -ENOMEM;
		break;

1233
	case SCTP_DISPOSITION_DELETE_TCB:
1234
	case SCTP_DISPOSITION_ABORT:
L
Linus Torvalds 已提交
1235
		/* This should now be a command. */
1236
		*asoc = NULL;
L
Linus Torvalds 已提交
1237 1238 1239 1240 1241 1242 1243 1244 1245 1246
		break;

	case SCTP_DISPOSITION_CONSUME:
		/*
		 * We should no longer have much work to do here as the
		 * real work has been done as explicit commands above.
		 */
		break;

	case SCTP_DISPOSITION_VIOLATION:
1247 1248
		net_err_ratelimited("protocol violation state %d chunkid %d\n",
				    state, subtype.chunk);
L
Linus Torvalds 已提交
1249 1250 1251
		break;

	case SCTP_DISPOSITION_NOT_IMPL:
1252 1253
		pr_warn("unimplemented feature in state %d, event_type %d, event_id %d\n",
			state, event_type, subtype.chunk);
L
Linus Torvalds 已提交
1254 1255 1256
		break;

	case SCTP_DISPOSITION_BUG:
1257
		pr_err("bug in state %d, event_type %d, event_id %d\n",
L
Linus Torvalds 已提交
1258 1259 1260 1261 1262
		       state, event_type, subtype.chunk);
		BUG();
		break;

	default:
1263
		pr_err("impossible disposition %d in state %d, event_type %d, event_id %d\n",
L
Linus Torvalds 已提交
1264 1265 1266
		       status, state, event_type, subtype.chunk);
		BUG();
		break;
1267
	}
L
Linus Torvalds 已提交
1268 1269 1270 1271 1272 1273 1274 1275 1276 1277

bail:
	return error;
}

/********************************************************************
 * 2nd Level Abstractions
 ********************************************************************/

/* This is the side-effect interpreter.  */
X
Xin Long 已提交
1278
static int sctp_cmd_interpreter(enum sctp_event event_type,
1279
				union sctp_subtype subtype,
X
Xin Long 已提交
1280
				enum sctp_state state,
L
Linus Torvalds 已提交
1281 1282 1283
				struct sctp_endpoint *ep,
				struct sctp_association *asoc,
				void *event_arg,
1284
				enum sctp_disposition status,
1285
				struct sctp_cmd_seq *commands,
A
Al Viro 已提交
1286
				gfp_t gfp)
L
Linus Torvalds 已提交
1287
{
1288 1289
	struct sctp_sock *sp = sctp_sk(ep->base.sk);
	struct sctp_chunk *chunk = NULL, *new_obj;
L
Linus Torvalds 已提交
1290
	struct sctp_packet *packet;
1291
	struct sctp_sackhdr sackh;
L
Linus Torvalds 已提交
1292 1293
	struct timer_list *timer;
	struct sctp_transport *t;
1294 1295
	unsigned long timeout;
	struct sctp_cmd *cmd;
L
Linus Torvalds 已提交
1296
	int local_cork = 0;
1297 1298
	int error = 0;
	int force;
L
Linus Torvalds 已提交
1299 1300

	if (SCTP_EVENT_T_TIMEOUT != event_type)
J
Joe Perches 已提交
1301
		chunk = event_arg;
L
Linus Torvalds 已提交
1302 1303 1304 1305 1306 1307 1308 1309 1310 1311 1312 1313 1314 1315 1316 1317 1318

	/* Note:  This whole file is a huge candidate for rework.
	 * For example, each command could either have its own handler, so
	 * the loop would look like:
	 *     while (cmds)
	 *         cmd->handle(x, y, z)
	 * --jgrimm
	 */
	while (NULL != (cmd = sctp_next_cmd(commands))) {
		switch (cmd->verb) {
		case SCTP_CMD_NOP:
			/* Do nothing. */
			break;

		case SCTP_CMD_NEW_ASOC:
			/* Register a new association.  */
			if (local_cork) {
1319
				sctp_outq_uncork(&asoc->outqueue, gfp);
L
Linus Torvalds 已提交
1320 1321
				local_cork = 0;
			}
1322

L
Linus Torvalds 已提交
1323
			/* Register with the endpoint.  */
1324 1325
			asoc = cmd->obj.asoc;
			BUG_ON(asoc->peer.primary_path == NULL);
L
Linus Torvalds 已提交
1326 1327 1328 1329
			sctp_endpoint_add_asoc(ep, asoc);
			break;

		case SCTP_CMD_UPDATE_ASSOC:
1330
		       sctp_cmd_assoc_update(commands, asoc, cmd->obj.asoc);
L
Linus Torvalds 已提交
1331 1332 1333 1334 1335 1336
		       break;

		case SCTP_CMD_PURGE_OUTQUEUE:
		       sctp_outq_teardown(&asoc->outqueue);
		       break;

1337
		case SCTP_CMD_DELETE_TCB:
L
Linus Torvalds 已提交
1338
			if (local_cork) {
1339
				sctp_outq_uncork(&asoc->outqueue, gfp);
L
Linus Torvalds 已提交
1340 1341 1342 1343 1344 1345 1346 1347 1348 1349 1350 1351 1352 1353
				local_cork = 0;
			}
			/* Delete the current association.  */
			sctp_cmd_delete_tcb(commands, asoc);
			asoc = NULL;
			break;

		case SCTP_CMD_NEW_STATE:
			/* Enter a new state.  */
			sctp_cmd_new_state(commands, asoc, cmd->obj.state);
			break;

		case SCTP_CMD_REPORT_TSN:
			/* Record the arrival of a TSN.  */
1354
			error = sctp_tsnmap_mark(&asoc->peer.tsn_map,
1355
						 cmd->obj.u32, NULL);
L
Linus Torvalds 已提交
1356 1357 1358
			break;

		case SCTP_CMD_REPORT_FWDTSN:
1359
			asoc->stream.si->report_ftsn(&asoc->ulpq, cmd->obj.u32);
L
Linus Torvalds 已提交
1360 1361 1362
			break;

		case SCTP_CMD_PROCESS_FWDTSN:
1363 1364
			asoc->stream.si->handle_ftsn(&asoc->ulpq,
						     cmd->obj.chunk);
1365
			break;
L
Linus Torvalds 已提交
1366 1367 1368 1369 1370 1371 1372 1373 1374 1375 1376 1377 1378 1379

		case SCTP_CMD_GEN_SACK:
			/* Generate a Selective ACK.
			 * The argument tells us whether to just count
			 * the packet and MAYBE generate a SACK, or
			 * force a SACK out.
			 */
			force = cmd->obj.i32;
			error = sctp_gen_sack(asoc, force, commands);
			break;

		case SCTP_CMD_PROCESS_SACK:
			/* Process an inbound SACK.  */
			error = sctp_cmd_process_sack(commands, asoc,
1380
						      cmd->obj.chunk);
L
Linus Torvalds 已提交
1381 1382 1383 1384 1385 1386 1387 1388 1389 1390 1391 1392 1393 1394 1395 1396 1397 1398 1399 1400
			break;

		case SCTP_CMD_GEN_INIT_ACK:
			/* Generate an INIT ACK chunk.  */
			new_obj = sctp_make_init_ack(asoc, chunk, GFP_ATOMIC,
						     0);
			if (!new_obj)
				goto nomem;

			sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
					SCTP_CHUNK(new_obj));
			break;

		case SCTP_CMD_PEER_INIT:
			/* Process a unified INIT from the peer.
			 * Note: Only used during INIT-ACK processing.  If
			 * there is an error just return to the outter
			 * layer which will bail.
			 */
			error = sctp_cmd_process_init(commands, asoc, chunk,
1401
						      cmd->obj.init, gfp);
L
Linus Torvalds 已提交
1402 1403 1404 1405 1406 1407
			break;

		case SCTP_CMD_GEN_COOKIE_ECHO:
			/* Generate a COOKIE ECHO chunk.  */
			new_obj = sctp_make_cookie_echo(asoc, chunk);
			if (!new_obj) {
1408 1409
				if (cmd->obj.chunk)
					sctp_chunk_free(cmd->obj.chunk);
L
Linus Torvalds 已提交
1410 1411 1412 1413 1414 1415 1416 1417
				goto nomem;
			}
			sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
					SCTP_CHUNK(new_obj));

			/* If there is an ERROR chunk to be sent along with
			 * the COOKIE_ECHO, send it, too.
			 */
1418
			if (cmd->obj.chunk)
L
Linus Torvalds 已提交
1419
				sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
1420
						SCTP_CHUNK(cmd->obj.chunk));
L
Linus Torvalds 已提交
1421

1422 1423 1424 1425 1426
			if (new_obj->transport) {
				new_obj->transport->init_sent_count++;
				asoc->init_last_sent_to = new_obj->transport;
			}

L
Linus Torvalds 已提交
1427
			/* FIXME - Eventually come up with a cleaner way to
1428 1429 1430 1431 1432 1433
			 * enabling COOKIE-ECHO + DATA bundling during
			 * multihoming stale cookie scenarios, the following
			 * command plays with asoc->peer.retran_path to
			 * avoid the problem of sending the COOKIE-ECHO and
			 * DATA in different paths, which could result
			 * in the association being ABORTed if the DATA chunk
L
Linus Torvalds 已提交
1434 1435 1436 1437 1438
			 * is processed first by the server.  Checking the
			 * init error counter simply causes this command
			 * to be executed only during failed attempts of
			 * association establishment.
			 */
F
Frank Filz 已提交
1439 1440 1441 1442
			if ((asoc->peer.retran_path !=
			     asoc->peer.primary_path) &&
			    (asoc->init_err_counter > 0)) {
				sctp_add_cmd_sf(commands,
1443
						SCTP_CMD_FORCE_PRIM_RETRAN,
L
Linus Torvalds 已提交
1444 1445 1446 1447 1448 1449 1450 1451 1452 1453 1454 1455 1456 1457 1458 1459 1460 1461 1462 1463 1464
						SCTP_NULL());
			}

			break;

		case SCTP_CMD_GEN_SHUTDOWN:
			/* Generate SHUTDOWN when in SHUTDOWN_SENT state.
			 * Reset error counts.
			 */
			asoc->overall_error_count = 0;

			/* Generate a SHUTDOWN chunk.  */
			new_obj = sctp_make_shutdown(asoc, chunk);
			if (!new_obj)
				goto nomem;
			sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
					SCTP_CHUNK(new_obj));
			break;

		case SCTP_CMD_CHUNK_ULP:
			/* Send a chunk to the sockets layer.  */
1465 1466 1467
			pr_debug("%s: sm_sideff: chunk_up:%p, ulpq:%p\n",
				 __func__, cmd->obj.chunk, &asoc->ulpq);

1468 1469 1470
			asoc->stream.si->ulpevent_data(&asoc->ulpq,
						       cmd->obj.chunk,
						       GFP_ATOMIC);
L
Linus Torvalds 已提交
1471 1472 1473 1474
			break;

		case SCTP_CMD_EVENT_ULP:
			/* Send a notification to the sockets layer.  */
1475 1476 1477
			pr_debug("%s: sm_sideff: event_up:%p, ulpq:%p\n",
				 __func__, cmd->obj.ulpevent, &asoc->ulpq);

1478 1479
			asoc->stream.si->enqueue_event(&asoc->ulpq,
						       cmd->obj.ulpevent);
L
Linus Torvalds 已提交
1480 1481 1482 1483 1484 1485 1486 1487 1488
			break;

		case SCTP_CMD_REPLY:
			/* If an caller has not already corked, do cork. */
			if (!asoc->outqueue.cork) {
				sctp_outq_cork(&asoc->outqueue);
				local_cork = 1;
			}
			/* Send a chunk to our peer.  */
1489
			sctp_outq_tail(&asoc->outqueue, cmd->obj.chunk, gfp);
L
Linus Torvalds 已提交
1490 1491 1492 1493
			break;

		case SCTP_CMD_SEND_PKT:
			/* Send a full packet to our peer.  */
1494
			packet = cmd->obj.packet;
1495
			sctp_packet_transmit(packet, gfp);
L
Linus Torvalds 已提交
1496 1497 1498
			sctp_ootb_pkt_free(packet);
			break;

1499 1500 1501 1502 1503 1504
		case SCTP_CMD_T1_RETRAN:
			/* Mark a transport for retransmission.  */
			sctp_retransmit(&asoc->outqueue, cmd->obj.transport,
					SCTP_RTXR_T1_RTX);
			break;

L
Linus Torvalds 已提交
1505 1506 1507 1508 1509 1510 1511 1512 1513 1514 1515 1516 1517 1518 1519 1520 1521 1522 1523 1524 1525 1526 1527 1528 1529 1530
		case SCTP_CMD_RETRAN:
			/* Mark a transport for retransmission.  */
			sctp_retransmit(&asoc->outqueue, cmd->obj.transport,
					SCTP_RTXR_T3_RTX);
			break;

		case SCTP_CMD_ECN_CE:
			/* Do delayed CE processing.   */
			sctp_do_ecn_ce_work(asoc, cmd->obj.u32);
			break;

		case SCTP_CMD_ECN_ECNE:
			/* Do delayed ECNE processing. */
			new_obj = sctp_do_ecn_ecne_work(asoc, cmd->obj.u32,
							chunk);
			if (new_obj)
				sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
						SCTP_CHUNK(new_obj));
			break;

		case SCTP_CMD_ECN_CWR:
			/* Do delayed CWR processing.  */
			sctp_do_ecn_cwr_work(asoc, cmd->obj.u32);
			break;

		case SCTP_CMD_SETUP_T2:
1531
			sctp_cmd_setup_t2(commands, asoc, cmd->obj.chunk);
L
Linus Torvalds 已提交
1532 1533
			break;

1534 1535 1536 1537 1538 1539 1540
		case SCTP_CMD_TIMER_START_ONCE:
			timer = &asoc->timers[cmd->obj.to];

			if (timer_pending(timer))
				break;
			/* fall through */

L
Linus Torvalds 已提交
1541 1542 1543
		case SCTP_CMD_TIMER_START:
			timer = &asoc->timers[cmd->obj.to];
			timeout = asoc->timeouts[cmd->obj.to];
1544
			BUG_ON(!timeout);
L
Linus Torvalds 已提交
1545 1546 1547 1548 1549 1550 1551 1552 1553 1554 1555 1556 1557 1558 1559

			timer->expires = jiffies + timeout;
			sctp_association_hold(asoc);
			add_timer(timer);
			break;

		case SCTP_CMD_TIMER_RESTART:
			timer = &asoc->timers[cmd->obj.to];
			timeout = asoc->timeouts[cmd->obj.to];
			if (!mod_timer(timer, jiffies + timeout))
				sctp_association_hold(asoc);
			break;

		case SCTP_CMD_TIMER_STOP:
			timer = &asoc->timers[cmd->obj.to];
1560
			if (del_timer(timer))
L
Linus Torvalds 已提交
1561 1562 1563
				sctp_association_put(asoc);
			break;

F
Frank Filz 已提交
1564
		case SCTP_CMD_INIT_CHOOSE_TRANSPORT:
1565
			chunk = cmd->obj.chunk;
1566 1567
			t = sctp_assoc_choose_alter_transport(asoc,
						asoc->init_last_sent_to);
F
Frank Filz 已提交
1568 1569 1570
			asoc->init_last_sent_to = t;
			chunk->transport = t;
			t->init_sent_count++;
1571 1572
			/* Set the new transport as primary */
			sctp_assoc_set_primary(asoc, t);
F
Frank Filz 已提交
1573 1574
			break;

L
Linus Torvalds 已提交
1575 1576 1577
		case SCTP_CMD_INIT_RESTART:
			/* Do the needed accounting and updates
			 * associated with restarting an initialization
F
Frank Filz 已提交
1578 1579 1580 1581
			 * timer. Only multiply the timeout by two if
			 * all transports have been tried at the current
			 * timeout.
			 */
1582 1583 1584
			sctp_cmd_t1_timer_update(asoc,
						SCTP_EVENT_TIMEOUT_T1_INIT,
						"INIT");
F
Frank Filz 已提交
1585 1586 1587 1588 1589 1590 1591 1592 1593 1594 1595

			sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_RESTART,
					SCTP_TO(SCTP_EVENT_TIMEOUT_T1_INIT));
			break;

		case SCTP_CMD_COOKIEECHO_RESTART:
			/* Do the needed accounting and updates
			 * associated with restarting an initialization
			 * timer. Only multiply the timeout by two if
			 * all transports have been tried at the current
			 * timeout.
L
Linus Torvalds 已提交
1596
			 */
1597 1598 1599
			sctp_cmd_t1_timer_update(asoc,
						SCTP_EVENT_TIMEOUT_T1_COOKIE,
						"COOKIE");
L
Linus Torvalds 已提交
1600 1601 1602 1603

			/* If we've sent any data bundled with
			 * COOKIE-ECHO we need to resend.
			 */
1604 1605
			list_for_each_entry(t, &asoc->peer.transport_addr_list,
					transports) {
1606 1607
				sctp_retransmit_mark(&asoc->outqueue, t,
					    SCTP_RTXR_T1_RTX);
L
Linus Torvalds 已提交
1608 1609 1610 1611
			}

			sctp_add_cmd_sf(commands,
					SCTP_CMD_TIMER_RESTART,
F
Frank Filz 已提交
1612
					SCTP_TO(SCTP_EVENT_TIMEOUT_T1_COOKIE));
L
Linus Torvalds 已提交
1613 1614 1615
			break;

		case SCTP_CMD_INIT_FAILED:
1616
			sctp_cmd_init_failed(commands, asoc, cmd->obj.u32);
L
Linus Torvalds 已提交
1617 1618 1619 1620
			break;

		case SCTP_CMD_ASSOC_FAILED:
			sctp_cmd_assoc_failed(commands, asoc, event_type,
1621
					      subtype, chunk, cmd->obj.u32);
L
Linus Torvalds 已提交
1622 1623
			break;

F
Frank Filz 已提交
1624 1625
		case SCTP_CMD_INIT_COUNTER_INC:
			asoc->init_err_counter++;
L
Linus Torvalds 已提交
1626 1627
			break;

F
Frank Filz 已提交
1628 1629 1630
		case SCTP_CMD_INIT_COUNTER_RESET:
			asoc->init_err_counter = 0;
			asoc->init_cycle = 0;
1631 1632 1633 1634
			list_for_each_entry(t, &asoc->peer.transport_addr_list,
					    transports) {
				t->init_sent_count = 0;
			}
L
Linus Torvalds 已提交
1635 1636 1637 1638 1639 1640 1641 1642
			break;

		case SCTP_CMD_REPORT_DUP:
			sctp_tsnmap_mark_dup(&asoc->peer.tsn_map,
					     cmd->obj.u32);
			break;

		case SCTP_CMD_REPORT_BAD_TAG:
1643
			pr_debug("%s: vtag mismatch!\n", __func__);
L
Linus Torvalds 已提交
1644 1645 1646 1647
			break;

		case SCTP_CMD_STRIKE:
			/* Mark one strike against a transport.  */
1648 1649
			sctp_do_8_2_transport_strike(commands, asoc,
						    cmd->obj.transport, 0);
1650 1651 1652 1653 1654
			break;

		case SCTP_CMD_TRANSPORT_IDLE:
			t = cmd->obj.transport;
			sctp_transport_lower_cwnd(t, SCTP_LOWER_CWND_INACTIVE);
L
Linus Torvalds 已提交
1655 1656
			break;

1657
		case SCTP_CMD_TRANSPORT_HB_SENT:
L
Linus Torvalds 已提交
1658
			t = cmd->obj.transport;
1659 1660
			sctp_do_8_2_transport_strike(commands, asoc,
						     t, 1);
1661
			t->hb_sent = 1;
L
Linus Torvalds 已提交
1662 1663 1664 1665 1666 1667 1668 1669 1670 1671 1672 1673 1674
			break;

		case SCTP_CMD_TRANSPORT_ON:
			t = cmd->obj.transport;
			sctp_cmd_transport_on(commands, asoc, t, chunk);
			break;

		case SCTP_CMD_HB_TIMERS_START:
			sctp_cmd_hb_timers_start(commands, asoc);
			break;

		case SCTP_CMD_HB_TIMER_UPDATE:
			t = cmd->obj.transport;
1675
			sctp_transport_reset_hb_timer(t);
L
Linus Torvalds 已提交
1676 1677 1678 1679 1680 1681 1682 1683 1684 1685 1686 1687
			break;

		case SCTP_CMD_HB_TIMERS_STOP:
			sctp_cmd_hb_timers_stop(commands, asoc);
			break;

		case SCTP_CMD_REPORT_ERROR:
			error = cmd->obj.error;
			break;

		case SCTP_CMD_PROCESS_CTSN:
			/* Dummy up a SACK for processing. */
1688
			sackh.cum_tsn_ack = cmd->obj.be32;
1689 1690
			sackh.a_rwnd = htonl(asoc->peer.rwnd +
					     asoc->outqueue.outstanding_bytes);
L
Linus Torvalds 已提交
1691 1692
			sackh.num_gap_ack_blocks = 0;
			sackh.num_dup_tsns = 0;
1693
			chunk->subh.sack_hdr = &sackh;
L
Linus Torvalds 已提交
1694
			sctp_add_cmd_sf(commands, SCTP_CMD_PROCESS_SACK,
1695
					SCTP_CHUNK(chunk));
L
Linus Torvalds 已提交
1696 1697 1698
			break;

		case SCTP_CMD_DISCARD_PACKET:
1699 1700 1701 1702
			/* We need to discard the whole packet.
			 * Uncork the queue since there might be
			 * responses pending
			 */
L
Linus Torvalds 已提交
1703
			chunk->pdiscard = 1;
1704
			if (asoc) {
1705
				sctp_outq_uncork(&asoc->outqueue, gfp);
1706 1707
				local_cork = 0;
			}
L
Linus Torvalds 已提交
1708 1709 1710 1711 1712 1713 1714 1715
			break;

		case SCTP_CMD_RTO_PENDING:
			t = cmd->obj.transport;
			t->rto_pending = 1;
			break;

		case SCTP_CMD_PART_DELIVER:
1716
			asoc->stream.si->start_pd(&asoc->ulpq, GFP_ATOMIC);
L
Linus Torvalds 已提交
1717 1718 1719
			break;

		case SCTP_CMD_RENEGE:
1720 1721 1722
			asoc->stream.si->renege_events(&asoc->ulpq,
						       cmd->obj.chunk,
						       GFP_ATOMIC);
L
Linus Torvalds 已提交
1723 1724 1725
			break;

		case SCTP_CMD_SETUP_T4:
1726
			sctp_cmd_setup_t4(commands, asoc, cmd->obj.chunk);
L
Linus Torvalds 已提交
1727 1728 1729 1730 1731 1732 1733 1734 1735 1736 1737 1738 1739 1740 1741 1742 1743
			break;

		case SCTP_CMD_PROCESS_OPERR:
			sctp_cmd_process_operr(commands, asoc, chunk);
			break;
		case SCTP_CMD_CLEAR_INIT_TAG:
			asoc->peer.i.init_tag = 0;
			break;
		case SCTP_CMD_DEL_NON_PRIMARY:
			sctp_cmd_del_non_primary(asoc);
			break;
		case SCTP_CMD_T3_RTX_TIMERS_STOP:
			sctp_cmd_t3_rtx_timers_stop(commands, asoc);
			break;
		case SCTP_CMD_FORCE_PRIM_RETRAN:
			t = asoc->peer.retran_path;
			asoc->peer.retran_path = asoc->peer.primary_path;
1744
			sctp_outq_uncork(&asoc->outqueue, gfp);
L
Linus Torvalds 已提交
1745 1746 1747
			local_cork = 0;
			asoc->peer.retran_path = t;
			break;
1748 1749 1750
		case SCTP_CMD_SET_SK_ERR:
			sctp_cmd_set_sk_err(asoc, cmd->obj.error);
			break;
1751 1752 1753 1754 1755 1756 1757 1758
		case SCTP_CMD_ASSOC_CHANGE:
			sctp_cmd_assoc_change(commands, asoc,
					      cmd->obj.u8);
			break;
		case SCTP_CMD_ADAPTATION_IND:
			sctp_cmd_adaptation_ind(commands, asoc);
			break;

1759 1760 1761 1762
		case SCTP_CMD_ASSOC_SHKEY:
			error = sctp_auth_asoc_init_active_key(asoc,
						GFP_ATOMIC);
			break;
1763 1764 1765
		case SCTP_CMD_UPDATE_INITTAG:
			asoc->peer.i.init_tag = cmd->obj.u32;
			break;
1766 1767 1768 1769 1770
		case SCTP_CMD_SEND_MSG:
			if (!asoc->outqueue.cork) {
				sctp_outq_cork(&asoc->outqueue);
				local_cork = 1;
			}
1771
			sctp_cmd_send_msg(asoc, cmd->obj.msg, gfp);
1772
			break;
1773 1774 1775
		case SCTP_CMD_SEND_NEXT_ASCONF:
			sctp_cmd_send_asconf(asoc);
			break;
1776 1777 1778
		case SCTP_CMD_PURGE_ASCONF_QUEUE:
			sctp_asconf_queue_teardown(asoc);
			break;
1779 1780

		case SCTP_CMD_SET_ASOC:
1781 1782 1783 1784
			if (asoc && local_cork) {
				sctp_outq_uncork(&asoc->outqueue, gfp);
				local_cork = 0;
			}
1785 1786 1787
			asoc = cmd->obj.asoc;
			break;

L
Linus Torvalds 已提交
1788
		default:
1789 1790
			pr_warn("Impossible command: %u\n",
				cmd->verb);
L
Linus Torvalds 已提交
1791
			break;
1792 1793
		}

L
Linus Torvalds 已提交
1794 1795 1796 1797 1798
		if (error)
			break;
	}

out:
1799 1800 1801 1802 1803 1804
	/* If this is in response to a received chunk, wait until
	 * we are done with the packet to open the queue so that we don't
	 * send multiple packets in response to a single request.
	 */
	if (asoc && SCTP_EVENT_T_CHUNK == event_type && chunk) {
		if (chunk->end_of_packet || chunk->singleton)
1805
			sctp_outq_uncork(&asoc->outqueue, gfp);
1806
	} else if (local_cork)
1807
		sctp_outq_uncork(&asoc->outqueue, gfp);
1808

1809 1810 1811
	if (sp->data_ready_signalled)
		sp->data_ready_signalled = 0;

L
Linus Torvalds 已提交
1812 1813 1814 1815 1816 1817
	return error;
nomem:
	error = -ENOMEM;
	goto out;
}