sm_sideeffect.c 50.5 KB
Newer Older
1
/* SCTP kernel implementation
L
Linus Torvalds 已提交
2 3 4 5
 * (C) Copyright IBM Corp. 2001, 2004
 * Copyright (c) 1999 Cisco, Inc.
 * Copyright (c) 1999-2001 Motorola, Inc.
 *
6
 * This file is part of the SCTP kernel implementation
L
Linus Torvalds 已提交
7 8 9 10 11
 *
 * These functions work with the state functions in sctp_sm_statefuns.c
 * to implement that state operations.  These functions implement the
 * steps which require modifying existing data structures.
 *
12
 * This SCTP implementation is free software;
L
Linus Torvalds 已提交
13 14 15 16 17
 * you can redistribute it and/or modify it under the terms of
 * the GNU General Public License as published by
 * the Free Software Foundation; either version 2, or (at your option)
 * any later version.
 *
18
 * This SCTP implementation is distributed in the hope that it
L
Linus Torvalds 已提交
19 20 21 22 23 24
 * will be useful, but WITHOUT ANY WARRANTY; without even the implied
 *                 ************************
 * warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
 * See the GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
25 26
 * along with GNU CC; see the file COPYING.  If not, see
 * <http://www.gnu.org/licenses/>.
L
Linus Torvalds 已提交
27 28 29
 *
 * Please send any bug reports or fixes you make to the
 * email address(es):
30
 *    lksctp developers <linux-sctp@vger.kernel.org>
L
Linus Torvalds 已提交
31 32 33 34 35 36 37 38 39 40 41 42
 *
 * Written or modified by:
 *    La Monte H.P. Yarroll <piggy@acm.org>
 *    Karl Knutson          <karl@athena.chicago.il.us>
 *    Jon Grimm             <jgrimm@austin.ibm.com>
 *    Hui Huang		    <hui.huang@nokia.com>
 *    Dajiang Zhang	    <dajiang.zhang@nokia.com>
 *    Daisy Chang	    <daisyc@us.ibm.com>
 *    Sridhar Samudrala	    <sri@us.ibm.com>
 *    Ardelle Fan	    <ardelle.fan@intel.com>
 */

43 44
#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt

L
Linus Torvalds 已提交
45 46 47 48
#include <linux/skbuff.h>
#include <linux/types.h>
#include <linux/socket.h>
#include <linux/ip.h>
49
#include <linux/gfp.h>
L
Linus Torvalds 已提交
50 51 52
#include <net/sock.h>
#include <net/sctp/sctp.h>
#include <net/sctp/sm.h>
53
#include <net/sctp/stream_sched.h>
L
Linus Torvalds 已提交
54

X
Xin Long 已提交
55
static int sctp_cmd_interpreter(enum sctp_event event_type,
56
				union sctp_subtype subtype,
X
Xin Long 已提交
57
				enum sctp_state state,
L
Linus Torvalds 已提交
58 59 60
				struct sctp_endpoint *ep,
				struct sctp_association *asoc,
				void *event_arg,
61
				enum sctp_disposition status,
62
				struct sctp_cmd_seq *commands,
A
Al Viro 已提交
63
				gfp_t gfp);
64 65
static int sctp_side_effects(enum sctp_event event_type,
			     union sctp_subtype subtype,
X
Xin Long 已提交
66
			     enum sctp_state state,
L
Linus Torvalds 已提交
67
			     struct sctp_endpoint *ep,
68
			     struct sctp_association **asoc,
L
Linus Torvalds 已提交
69
			     void *event_arg,
70
			     enum sctp_disposition status,
71
			     struct sctp_cmd_seq *commands,
A
Al Viro 已提交
72
			     gfp_t gfp);
L
Linus Torvalds 已提交
73 74 75 76 77 78

/********************************************************************
 * Helper functions
 ********************************************************************/

/* A helper function for delayed processing of INET ECN CE bit. */
79
static void sctp_do_ecn_ce_work(struct sctp_association *asoc,
L
Linus Torvalds 已提交
80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100
				__u32 lowest_tsn)
{
	/* Save the TSN away for comparison when we receive CWR */

	asoc->last_ecne_tsn = lowest_tsn;
	asoc->need_ecne = 1;
}

/* Helper function for delayed processing of SCTP ECNE chunk.  */
/* RFC 2960 Appendix A
 *
 * RFC 2481 details a specific bit for a sender to send in
 * the header of its next outbound TCP segment to indicate to
 * its peer that it has reduced its congestion window.  This
 * is termed the CWR bit.  For SCTP the same indication is made
 * by including the CWR chunk.  This chunk contains one data
 * element, i.e. the TSN number that was sent in the ECNE chunk.
 * This element represents the lowest TSN number in the datagram
 * that was originally marked with the CE bit.
 */
static struct sctp_chunk *sctp_do_ecn_ecne_work(struct sctp_association *asoc,
101 102
						__u32 lowest_tsn,
						struct sctp_chunk *chunk)
L
Linus Torvalds 已提交
103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153
{
	struct sctp_chunk *repl;

	/* Our previously transmitted packet ran into some congestion
	 * so we should take action by reducing cwnd and ssthresh
	 * and then ACK our peer that we we've done so by
	 * sending a CWR.
	 */

	/* First, try to determine if we want to actually lower
	 * our cwnd variables.  Only lower them if the ECNE looks more
	 * recent than the last response.
	 */
	if (TSN_lt(asoc->last_cwr_tsn, lowest_tsn)) {
		struct sctp_transport *transport;

		/* Find which transport's congestion variables
		 * need to be adjusted.
		 */
		transport = sctp_assoc_lookup_tsn(asoc, lowest_tsn);

		/* Update the congestion variables. */
		if (transport)
			sctp_transport_lower_cwnd(transport,
						  SCTP_LOWER_CWND_ECNE);
		asoc->last_cwr_tsn = lowest_tsn;
	}

	/* Always try to quiet the other end.  In case of lost CWR,
	 * resend last_cwr_tsn.
	 */
	repl = sctp_make_cwr(asoc, asoc->last_cwr_tsn, chunk);

	/* If we run out of memory, it will look like a lost CWR.  We'll
	 * get back in sync eventually.
	 */
	return repl;
}

/* Helper function to do delayed processing of ECN CWR chunk.  */
static void sctp_do_ecn_cwr_work(struct sctp_association *asoc,
				 __u32 lowest_tsn)
{
	/* Turn off ECNE getting auto-prepended to every outgoing
	 * packet
	 */
	asoc->need_ecne = 0;
}

/* Generate SACK if necessary.  We call this at the end of a packet.  */
static int sctp_gen_sack(struct sctp_association *asoc, int force,
154
			 struct sctp_cmd_seq *commands)
L
Linus Torvalds 已提交
155
{
156
	struct sctp_transport *trans = asoc->peer.last_data_from;
L
Linus Torvalds 已提交
157 158 159 160
	__u32 ctsn, max_tsn_seen;
	struct sctp_chunk *sack;
	int error = 0;

161
	if (force ||
162 163
	    (!trans && (asoc->param_flags & SPP_SACKDELAY_DISABLE)) ||
	    (trans && (trans->param_flags & SPP_SACKDELAY_DISABLE)))
L
Linus Torvalds 已提交
164 165 166 167 168 169 170 171 172 173 174 175 176 177 178
		asoc->peer.sack_needed = 1;

	ctsn = sctp_tsnmap_get_ctsn(&asoc->peer.tsn_map);
	max_tsn_seen = sctp_tsnmap_get_max_tsn_seen(&asoc->peer.tsn_map);

	/* From 12.2 Parameters necessary per association (i.e. the TCB):
	 *
	 * Ack State : This flag indicates if the next received packet
	 * 	     : is to be responded to with a SACK. ...
	 *	     : When DATA chunks are out of order, SACK's
	 *           : are not delayed (see Section 6).
	 *
	 * [This is actually not mentioned in Section 6, but we
	 * implement it here anyway. --piggy]
	 */
179
	if (max_tsn_seen != ctsn)
L
Linus Torvalds 已提交
180 181 182 183 184 185 186 187 188 189 190
		asoc->peer.sack_needed = 1;

	/* From 6.2  Acknowledgement on Reception of DATA Chunks:
	 *
	 * Section 4.2 of [RFC2581] SHOULD be followed. Specifically,
	 * an acknowledgement SHOULD be generated for at least every
	 * second packet (not every second DATA chunk) received, and
	 * SHOULD be generated within 200 ms of the arrival of any
	 * unacknowledged DATA chunk. ...
	 */
	if (!asoc->peer.sack_needed) {
191
		asoc->peer.sack_cnt++;
192 193 194 195 196 197

		/* Set the SACK delay timeout based on the
		 * SACK delay for the last transport
		 * data was received from, or the default
		 * for the association.
		 */
198 199 200 201 202
		if (trans) {
			/* We will need a SACK for the next packet.  */
			if (asoc->peer.sack_cnt >= trans->sackfreq - 1)
				asoc->peer.sack_needed = 1;

203
			asoc->timeouts[SCTP_EVENT_TIMEOUT_SACK] =
204
				trans->sackdelay;
205 206 207 208 209
		} else {
			/* We will need a SACK for the next packet.  */
			if (asoc->peer.sack_cnt >= asoc->sackfreq - 1)
				asoc->peer.sack_needed = 1;

210
			asoc->timeouts[SCTP_EVENT_TIMEOUT_SACK] =
211
				asoc->sackdelay;
212
		}
213 214 215 216

		/* Restart the SACK timer. */
		sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_RESTART,
				SCTP_TO(SCTP_EVENT_TIMEOUT_SACK));
L
Linus Torvalds 已提交
217
	} else {
218 219
		__u32 old_a_rwnd = asoc->a_rwnd;

220
		asoc->a_rwnd = asoc->rwnd;
L
Linus Torvalds 已提交
221
		sack = sctp_make_sack(asoc);
222 223
		if (!sack) {
			asoc->a_rwnd = old_a_rwnd;
L
Linus Torvalds 已提交
224
			goto nomem;
225
		}
L
Linus Torvalds 已提交
226 227

		asoc->peer.sack_needed = 0;
228
		asoc->peer.sack_cnt = 0;
L
Linus Torvalds 已提交
229

230
		sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(sack));
L
Linus Torvalds 已提交
231 232 233 234 235

		/* Stop the SACK timer.  */
		sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
				SCTP_TO(SCTP_EVENT_TIMEOUT_SACK));
	}
236

L
Linus Torvalds 已提交
237 238 239 240 241 242 243 244 245
	return error;
nomem:
	error = -ENOMEM;
	return error;
}

/* When the T3-RTX timer expires, it calls this function to create the
 * relevant state machine event.
 */
246
void sctp_generate_t3_rtx_event(struct timer_list *t)
L
Linus Torvalds 已提交
247
{
248 249
	struct sctp_transport *transport =
		from_timer(transport, t, T3_rtx_timer);
L
Linus Torvalds 已提交
250
	struct sctp_association *asoc = transport->asoc;
251 252
	struct sock *sk = asoc->base.sk;
	struct net *net = sock_net(sk);
253
	int error;
L
Linus Torvalds 已提交
254 255 256

	/* Check whether a task is in the sock.  */

257 258
	bh_lock_sock(sk);
	if (sock_owned_by_user(sk)) {
259
		pr_debug("%s: sock is busy\n", __func__);
L
Linus Torvalds 已提交
260 261 262 263 264 265 266 267

		/* Try again later.  */
		if (!mod_timer(&transport->T3_rtx_timer, jiffies + (HZ/20)))
			sctp_transport_hold(transport);
		goto out_unlock;
	}

	/* Run through the state machine.  */
268
	error = sctp_do_sm(net, SCTP_EVENT_T_TIMEOUT,
L
Linus Torvalds 已提交
269 270 271 272 273 274
			   SCTP_ST_TIMEOUT(SCTP_EVENT_TIMEOUT_T3_RTX),
			   asoc->state,
			   asoc->ep, asoc,
			   transport, GFP_ATOMIC);

	if (error)
275
		sk->sk_err = -error;
L
Linus Torvalds 已提交
276 277

out_unlock:
278
	bh_unlock_sock(sk);
L
Linus Torvalds 已提交
279 280 281 282 283 284 285
	sctp_transport_put(transport);
}

/* This is a sa interface for producing timeout events.  It works
 * for timeouts which use the association as their parameter.
 */
static void sctp_generate_timeout_event(struct sctp_association *asoc,
286
					enum sctp_event_timeout timeout_type)
L
Linus Torvalds 已提交
287
{
288 289
	struct sock *sk = asoc->base.sk;
	struct net *net = sock_net(sk);
L
Linus Torvalds 已提交
290 291
	int error = 0;

292 293
	bh_lock_sock(sk);
	if (sock_owned_by_user(sk)) {
294 295
		pr_debug("%s: sock is busy: timer %d\n", __func__,
			 timeout_type);
L
Linus Torvalds 已提交
296 297 298 299 300 301 302 303 304 305 306 307 308 309

		/* Try again later.  */
		if (!mod_timer(&asoc->timers[timeout_type], jiffies + (HZ/20)))
			sctp_association_hold(asoc);
		goto out_unlock;
	}

	/* Is this association really dead and just waiting around for
	 * the timer to let go of the reference?
	 */
	if (asoc->base.dead)
		goto out_unlock;

	/* Run through the state machine.  */
310
	error = sctp_do_sm(net, SCTP_EVENT_T_TIMEOUT,
L
Linus Torvalds 已提交
311 312 313 314 315
			   SCTP_ST_TIMEOUT(timeout_type),
			   asoc->state, asoc->ep, asoc,
			   (void *)timeout_type, GFP_ATOMIC);

	if (error)
316
		sk->sk_err = -error;
L
Linus Torvalds 已提交
317 318

out_unlock:
319
	bh_unlock_sock(sk);
L
Linus Torvalds 已提交
320 321 322
	sctp_association_put(asoc);
}

323
static void sctp_generate_t1_cookie_event(struct timer_list *t)
L
Linus Torvalds 已提交
324
{
325 326 327
	struct sctp_association *asoc =
		from_timer(asoc, t, timers[SCTP_EVENT_TIMEOUT_T1_COOKIE]);

L
Linus Torvalds 已提交
328 329 330
	sctp_generate_timeout_event(asoc, SCTP_EVENT_TIMEOUT_T1_COOKIE);
}

331
static void sctp_generate_t1_init_event(struct timer_list *t)
L
Linus Torvalds 已提交
332
{
333 334 335
	struct sctp_association *asoc =
		from_timer(asoc, t, timers[SCTP_EVENT_TIMEOUT_T1_INIT]);

L
Linus Torvalds 已提交
336 337 338
	sctp_generate_timeout_event(asoc, SCTP_EVENT_TIMEOUT_T1_INIT);
}

339
static void sctp_generate_t2_shutdown_event(struct timer_list *t)
L
Linus Torvalds 已提交
340
{
341 342 343
	struct sctp_association *asoc =
		from_timer(asoc, t, timers[SCTP_EVENT_TIMEOUT_T2_SHUTDOWN]);

L
Linus Torvalds 已提交
344 345 346
	sctp_generate_timeout_event(asoc, SCTP_EVENT_TIMEOUT_T2_SHUTDOWN);
}

347
static void sctp_generate_t4_rto_event(struct timer_list *t)
L
Linus Torvalds 已提交
348
{
349 350 351
	struct sctp_association *asoc =
		from_timer(asoc, t, timers[SCTP_EVENT_TIMEOUT_T4_RTO]);

L
Linus Torvalds 已提交
352 353 354
	sctp_generate_timeout_event(asoc, SCTP_EVENT_TIMEOUT_T4_RTO);
}

355
static void sctp_generate_t5_shutdown_guard_event(struct timer_list *t)
L
Linus Torvalds 已提交
356
{
357 358 359 360
	struct sctp_association *asoc =
		from_timer(asoc, t,
			   timers[SCTP_EVENT_TIMEOUT_T5_SHUTDOWN_GUARD]);

361
	sctp_generate_timeout_event(asoc,
L
Linus Torvalds 已提交
362 363 364 365
				    SCTP_EVENT_TIMEOUT_T5_SHUTDOWN_GUARD);

} /* sctp_generate_t5_shutdown_guard_event() */

366
static void sctp_generate_autoclose_event(struct timer_list *t)
L
Linus Torvalds 已提交
367
{
368 369 370
	struct sctp_association *asoc =
		from_timer(asoc, t, timers[SCTP_EVENT_TIMEOUT_AUTOCLOSE]);

L
Linus Torvalds 已提交
371 372 373 374 375 376
	sctp_generate_timeout_event(asoc, SCTP_EVENT_TIMEOUT_AUTOCLOSE);
}

/* Generate a heart beat event.  If the sock is busy, reschedule.   Make
 * sure that the transport is still valid.
 */
377
void sctp_generate_heartbeat_event(struct timer_list *t)
L
Linus Torvalds 已提交
378
{
379
	struct sctp_transport *transport = from_timer(transport, t, hb_timer);
L
Linus Torvalds 已提交
380
	struct sctp_association *asoc = transport->asoc;
381 382
	struct sock *sk = asoc->base.sk;
	struct net *net = sock_net(sk);
383
	u32 elapsed, timeout;
384
	int error = 0;
L
Linus Torvalds 已提交
385

386 387
	bh_lock_sock(sk);
	if (sock_owned_by_user(sk)) {
388
		pr_debug("%s: sock is busy\n", __func__);
L
Linus Torvalds 已提交
389 390 391 392 393 394 395

		/* Try again later.  */
		if (!mod_timer(&transport->hb_timer, jiffies + (HZ/20)))
			sctp_transport_hold(transport);
		goto out_unlock;
	}

396 397 398 399 400 401 402 403 404 405
	/* Check if we should still send the heartbeat or reschedule */
	elapsed = jiffies - transport->last_time_sent;
	timeout = sctp_transport_timeout(transport);
	if (elapsed < timeout) {
		elapsed = timeout - elapsed;
		if (!mod_timer(&transport->hb_timer, jiffies + elapsed))
			sctp_transport_hold(transport);
		goto out_unlock;
	}

406
	error = sctp_do_sm(net, SCTP_EVENT_T_TIMEOUT,
L
Linus Torvalds 已提交
407 408 409 410
			   SCTP_ST_TIMEOUT(SCTP_EVENT_TIMEOUT_HEARTBEAT),
			   asoc->state, asoc->ep, asoc,
			   transport, GFP_ATOMIC);

K
Karl Heiss 已提交
411
	if (error)
412
		sk->sk_err = -error;
L
Linus Torvalds 已提交
413 414

out_unlock:
415
	bh_unlock_sock(sk);
L
Linus Torvalds 已提交
416 417 418
	sctp_transport_put(transport);
}

419 420 421
/* Handle the timeout of the ICMP protocol unreachable timer.  Trigger
 * the correct state machine transition that will close the association.
 */
422
void sctp_generate_proto_unreach_event(struct timer_list *t)
423
{
424 425
	struct sctp_transport *transport =
		from_timer(transport, t, proto_unreach_timer);
426
	struct sctp_association *asoc = transport->asoc;
427 428
	struct sock *sk = asoc->base.sk;
	struct net *net = sock_net(sk);
429

430 431
	bh_lock_sock(sk);
	if (sock_owned_by_user(sk)) {
432
		pr_debug("%s: sock is busy\n", __func__);
433 434 435 436 437 438 439 440 441 442 443 444 445 446

		/* Try again later.  */
		if (!mod_timer(&transport->proto_unreach_timer,
				jiffies + (HZ/20)))
			sctp_association_hold(asoc);
		goto out_unlock;
	}

	/* Is this structure just waiting around for us to actually
	 * get destroyed?
	 */
	if (asoc->base.dead)
		goto out_unlock;

447
	sctp_do_sm(net, SCTP_EVENT_T_OTHER,
448 449 450 451
		   SCTP_ST_OTHER(SCTP_EVENT_ICMP_PROTO_UNREACH),
		   asoc->state, asoc->ep, asoc, transport, GFP_ATOMIC);

out_unlock:
452
	bh_unlock_sock(sk);
453 454 455
	sctp_association_put(asoc);
}

X
Xin Long 已提交
456
 /* Handle the timeout of the RE-CONFIG timer. */
457
void sctp_generate_reconf_event(struct timer_list *t)
X
Xin Long 已提交
458
{
459 460
	struct sctp_transport *transport =
		from_timer(transport, t, reconf_timer);
X
Xin Long 已提交
461 462 463 464 465 466 467 468 469 470 471 472 473 474 475 476 477 478 479 480 481 482 483 484 485 486 487
	struct sctp_association *asoc = transport->asoc;
	struct sock *sk = asoc->base.sk;
	struct net *net = sock_net(sk);
	int error = 0;

	bh_lock_sock(sk);
	if (sock_owned_by_user(sk)) {
		pr_debug("%s: sock is busy\n", __func__);

		/* Try again later.  */
		if (!mod_timer(&transport->reconf_timer, jiffies + (HZ / 20)))
			sctp_transport_hold(transport);
		goto out_unlock;
	}

	error = sctp_do_sm(net, SCTP_EVENT_T_TIMEOUT,
			   SCTP_ST_TIMEOUT(SCTP_EVENT_TIMEOUT_RECONF),
			   asoc->state, asoc->ep, asoc,
			   transport, GFP_ATOMIC);

	if (error)
		sk->sk_err = -error;

out_unlock:
	bh_unlock_sock(sk);
	sctp_transport_put(transport);
}
488

L
Linus Torvalds 已提交
489
/* Inject a SACK Timeout event into the state machine.  */
490
static void sctp_generate_sack_event(struct timer_list *t)
L
Linus Torvalds 已提交
491
{
492 493 494
	struct sctp_association *asoc =
		from_timer(asoc, t, timers[SCTP_EVENT_TIMEOUT_SACK]);

L
Linus Torvalds 已提交
495 496 497 498
	sctp_generate_timeout_event(asoc, SCTP_EVENT_TIMEOUT_SACK);
}

sctp_timer_event_t *sctp_timer_events[SCTP_NUM_TIMEOUT_TYPES] = {
499 500 501 502 503 504 505 506 507 508 509 510
	[SCTP_EVENT_TIMEOUT_NONE] =		NULL,
	[SCTP_EVENT_TIMEOUT_T1_COOKIE] =	sctp_generate_t1_cookie_event,
	[SCTP_EVENT_TIMEOUT_T1_INIT] =		sctp_generate_t1_init_event,
	[SCTP_EVENT_TIMEOUT_T2_SHUTDOWN] =	sctp_generate_t2_shutdown_event,
	[SCTP_EVENT_TIMEOUT_T3_RTX] =		NULL,
	[SCTP_EVENT_TIMEOUT_T4_RTO] =		sctp_generate_t4_rto_event,
	[SCTP_EVENT_TIMEOUT_T5_SHUTDOWN_GUARD] =
					sctp_generate_t5_shutdown_guard_event,
	[SCTP_EVENT_TIMEOUT_HEARTBEAT] =	NULL,
	[SCTP_EVENT_TIMEOUT_RECONF] =		NULL,
	[SCTP_EVENT_TIMEOUT_SACK] =		sctp_generate_sack_event,
	[SCTP_EVENT_TIMEOUT_AUTOCLOSE] =	sctp_generate_autoclose_event,
L
Linus Torvalds 已提交
511 512 513 514 515 516 517 518 519 520 521 522 523 524 525 526 527 528
};


/* RFC 2960 8.2 Path Failure Detection
 *
 * When its peer endpoint is multi-homed, an endpoint should keep a
 * error counter for each of the destination transport addresses of the
 * peer endpoint.
 *
 * Each time the T3-rtx timer expires on any address, or when a
 * HEARTBEAT sent to an idle address is not acknowledged within a RTO,
 * the error counter of that destination address will be incremented.
 * When the value in the error counter exceeds the protocol parameter
 * 'Path.Max.Retrans' of that destination address, the endpoint should
 * mark the destination transport address as inactive, and a
 * notification SHOULD be sent to the upper layer.
 *
 */
529
static void sctp_do_8_2_transport_strike(struct sctp_cmd_seq *commands,
530
					 struct sctp_association *asoc,
531 532
					 struct sctp_transport *transport,
					 int is_hb)
L
Linus Torvalds 已提交
533
{
534 535
	struct net *net = sock_net(asoc->base.sk);

L
Linus Torvalds 已提交
536 537 538
	/* The check for association's overall error counter exceeding the
	 * threshold is done in the state function.
	 */
539 540 541 542 543
	/* We are here due to a timer expiration.  If the timer was
	 * not a HEARTBEAT, then normal error tracking is done.
	 * If the timer was a heartbeat, we only increment error counts
	 * when we already have an outstanding HEARTBEAT that has not
	 * been acknowledged.
L
Lucas De Marchi 已提交
544
	 * Additionally, some tranport states inhibit error increments.
545
	 */
546
	if (!is_hb) {
547
		asoc->overall_error_count++;
548 549 550 551 552 553 554 555
		if (transport->state != SCTP_INACTIVE)
			transport->error_count++;
	 } else if (transport->hb_sent) {
		if (transport->state != SCTP_UNCONFIRMED)
			asoc->overall_error_count++;
		if (transport->state != SCTP_INACTIVE)
			transport->error_count++;
	}
L
Linus Torvalds 已提交
556

557
	/* If the transport error count is greater than the pf_retrans
558
	 * threshold, and less than pathmaxrtx, and if the current state
559 560
	 * is SCTP_ACTIVE, then mark this transport as Partially Failed,
	 * see SCTP Quick Failover Draft, section 5.1
561
	 */
562 563
	if (net->sctp.pf_enable &&
	   (transport->state == SCTP_ACTIVE) &&
564
	   (transport->error_count < transport->pathmaxrxt) &&
565 566 567 568 569 570 571
	   (transport->error_count > asoc->pf_retrans)) {

		sctp_assoc_control_transport(asoc, transport,
					     SCTP_TRANSPORT_PF,
					     0);

		/* Update the hb timer to resend a heartbeat every rto */
572
		sctp_transport_reset_hb_timer(transport);
573 574
	}

F
Frank Filz 已提交
575
	if (transport->state != SCTP_INACTIVE &&
576
	    (transport->error_count > transport->pathmaxrxt)) {
577 578 579
		pr_debug("%s: association:%p transport addr:%pISpc failed\n",
			 __func__, asoc, &transport->ipaddr.sa);

L
Linus Torvalds 已提交
580 581 582 583 584 585 586 587 588
		sctp_assoc_control_transport(asoc, transport,
					     SCTP_TRANSPORT_DOWN,
					     SCTP_FAILED_THRESHOLD);
	}

	/* E2) For the destination address for which the timer
	 * expires, set RTO <- RTO * 2 ("back off the timer").  The
	 * maximum value discussed in rule C7 above (RTO.max) may be
	 * used to provide an upper bound to this doubling operation.
589 590
	 *
	 * Special Case:  the first HB doesn't trigger exponential backoff.
D
Daniel Mack 已提交
591
	 * The first unacknowledged HB triggers it.  We do this with a flag
592
	 * that indicates that we have an outstanding HB.
L
Linus Torvalds 已提交
593
	 */
594
	if (!is_hb || transport->hb_sent) {
595
		transport->rto = min((transport->rto * 2), transport->asoc->rto_max);
596
		sctp_max_rto(asoc, transport);
597
	}
L
Linus Torvalds 已提交
598 599 600
}

/* Worker routine to handle INIT command failure.  */
601
static void sctp_cmd_init_failed(struct sctp_cmd_seq *commands,
L
Linus Torvalds 已提交
602
				 struct sctp_association *asoc,
603
				 unsigned int error)
L
Linus Torvalds 已提交
604 605 606
{
	struct sctp_ulpevent *event;

607
	event = sctp_ulpevent_make_assoc_change(asoc, 0, SCTP_CANT_STR_ASSOC,
608
						(__u16)error, 0, 0, NULL,
L
Linus Torvalds 已提交
609 610 611 612 613 614 615 616 617 618 619 620 621 622 623
						GFP_ATOMIC);

	if (event)
		sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP,
				SCTP_ULPEVENT(event));

	sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
			SCTP_STATE(SCTP_STATE_CLOSED));

	/* SEND_FAILED sent later when cleaning up the association. */
	asoc->outqueue.error = error;
	sctp_add_cmd_sf(commands, SCTP_CMD_DELETE_TCB, SCTP_NULL());
}

/* Worker routine to handle SCTP_CMD_ASSOC_FAILED.  */
624
static void sctp_cmd_assoc_failed(struct sctp_cmd_seq *commands,
L
Linus Torvalds 已提交
625
				  struct sctp_association *asoc,
X
Xin Long 已提交
626
				  enum sctp_event event_type,
627
				  union sctp_subtype subtype,
L
Linus Torvalds 已提交
628
				  struct sctp_chunk *chunk,
629
				  unsigned int error)
L
Linus Torvalds 已提交
630 631
{
	struct sctp_ulpevent *event;
632
	struct sctp_chunk *abort;
633

L
Linus Torvalds 已提交
634
	/* Cancel any partial delivery in progress. */
635
	asoc->stream.si->abort_pd(&asoc->ulpq, GFP_ATOMIC);
L
Linus Torvalds 已提交
636

637 638 639 640 641 642 643
	if (event_type == SCTP_EVENT_T_CHUNK && subtype.chunk == SCTP_CID_ABORT)
		event = sctp_ulpevent_make_assoc_change(asoc, 0, SCTP_COMM_LOST,
						(__u16)error, 0, 0, chunk,
						GFP_ATOMIC);
	else
		event = sctp_ulpevent_make_assoc_change(asoc, 0, SCTP_COMM_LOST,
						(__u16)error, 0, 0, NULL,
L
Linus Torvalds 已提交
644 645 646 647 648
						GFP_ATOMIC);
	if (event)
		sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP,
				SCTP_ULPEVENT(event));

649 650 651 652 653 654 655
	if (asoc->overall_error_count >= asoc->max_retrans) {
		abort = sctp_make_violation_max_retrans(asoc, chunk);
		if (abort)
			sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
					SCTP_CHUNK(abort));
	}

L
Linus Torvalds 已提交
656 657 658 659 660 661 662 663 664 665 666 667 668
	sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
			SCTP_STATE(SCTP_STATE_CLOSED));

	/* SEND_FAILED sent later when cleaning up the association. */
	asoc->outqueue.error = error;
	sctp_add_cmd_sf(commands, SCTP_CMD_DELETE_TCB, SCTP_NULL());
}

/* Process an init chunk (may be real INIT/INIT-ACK or an embedded INIT
 * inside the cookie.  In reality, this is only used for INIT-ACK processing
 * since all other cases use "temporary" associations and can do all
 * their work in statefuns directly.
 */
669
static int sctp_cmd_process_init(struct sctp_cmd_seq *commands,
L
Linus Torvalds 已提交
670 671
				 struct sctp_association *asoc,
				 struct sctp_chunk *chunk,
672
				 struct sctp_init_chunk *peer_init,
A
Al Viro 已提交
673
				 gfp_t gfp)
L
Linus Torvalds 已提交
674 675 676 677 678 679 680 681
{
	int error;

	/* We only process the init as a sideeffect in a single
	 * case.   This is when we process the INIT-ACK.   If we
	 * fail during INIT processing (due to malloc problems),
	 * just return the error and stop processing the stack.
	 */
682
	if (!sctp_process_init(asoc, chunk, sctp_source(chunk), peer_init, gfp))
L
Linus Torvalds 已提交
683 684 685 686 687 688 689 690
		error = -ENOMEM;
	else
		error = 0;

	return error;
}

/* Helper function to break out starting up of heartbeat timers.  */
691
static void sctp_cmd_hb_timers_start(struct sctp_cmd_seq *cmds,
L
Linus Torvalds 已提交
692 693 694 695 696 697 698 699
				     struct sctp_association *asoc)
{
	struct sctp_transport *t;

	/* Start a heartbeat timer for each transport on the association.
	 * hold a reference on the transport to make sure none of
	 * the needed data structures go away.
	 */
700 701
	list_for_each_entry(t, &asoc->peer.transport_addr_list, transports)
		sctp_transport_reset_hb_timer(t);
L
Linus Torvalds 已提交
702 703
}

704
static void sctp_cmd_hb_timers_stop(struct sctp_cmd_seq *cmds,
L
Linus Torvalds 已提交
705 706 707 708 709 710
				    struct sctp_association *asoc)
{
	struct sctp_transport *t;

	/* Stop all heartbeat timers. */

711 712
	list_for_each_entry(t, &asoc->peer.transport_addr_list,
			transports) {
L
Linus Torvalds 已提交
713 714 715 716 717 718
		if (del_timer(&t->hb_timer))
			sctp_transport_put(t);
	}
}

/* Helper function to stop any pending T3-RTX timers */
719
static void sctp_cmd_t3_rtx_timers_stop(struct sctp_cmd_seq *cmds,
720
					struct sctp_association *asoc)
L
Linus Torvalds 已提交
721 722 723
{
	struct sctp_transport *t;

724 725
	list_for_each_entry(t, &asoc->peer.transport_addr_list,
			transports) {
726
		if (del_timer(&t->T3_rtx_timer))
L
Linus Torvalds 已提交
727 728 729 730 731 732
			sctp_transport_put(t);
	}
}


/* Helper function to handle the reception of an HEARTBEAT ACK.  */
733
static void sctp_cmd_transport_on(struct sctp_cmd_seq *cmds,
L
Linus Torvalds 已提交
734 735 736 737
				  struct sctp_association *asoc,
				  struct sctp_transport *t,
				  struct sctp_chunk *chunk)
{
738
	struct sctp_sender_hb_info *hbinfo;
739
	int was_unconfirmed = 0;
L
Linus Torvalds 已提交
740 741 742 743 744 745

	/* 8.3 Upon the receipt of the HEARTBEAT ACK, the sender of the
	 * HEARTBEAT should clear the error counter of the destination
	 * transport address to which the HEARTBEAT was sent.
	 */
	t->error_count = 0;
746 747 748 749 750 751 752 753 754

	/*
	 * Although RFC4960 specifies that the overall error count must
	 * be cleared when a HEARTBEAT ACK is received, we make an
	 * exception while in SHUTDOWN PENDING. If the peer keeps its
	 * window shut forever, we may never be able to transmit our
	 * outstanding data and rely on the retransmission limit be reached
	 * to shutdown the association.
	 */
755
	if (t->asoc->state < SCTP_STATE_SHUTDOWN_PENDING)
756
		t->asoc->overall_error_count = 0;
L
Linus Torvalds 已提交
757

758 759 760 761 762
	/* Clear the hb_sent flag to signal that we had a good
	 * acknowledgement.
	 */
	t->hb_sent = 0;

L
Linus Torvalds 已提交
763 764 765
	/* Mark the destination transport address as active if it is not so
	 * marked.
	 */
766 767
	if ((t->state == SCTP_INACTIVE) || (t->state == SCTP_UNCONFIRMED)) {
		was_unconfirmed = 1;
L
Linus Torvalds 已提交
768 769
		sctp_assoc_control_transport(asoc, t, SCTP_TRANSPORT_UP,
					     SCTP_HEARTBEAT_SUCCESS);
770
	}
L
Linus Torvalds 已提交
771

772 773 774 775
	if (t->state == SCTP_PF)
		sctp_assoc_control_transport(asoc, t, SCTP_TRANSPORT_UP,
					     SCTP_HEARTBEAT_SUCCESS);

776 777 778 779
	/* HB-ACK was received for a the proper HB.  Consider this
	 * forward progress.
	 */
	if (t->dst)
780
		sctp_transport_dst_confirm(t);
781

L
Linus Torvalds 已提交
782 783 784
	/* The receiver of the HEARTBEAT ACK should also perform an
	 * RTT measurement for that destination transport address
	 * using the time value carried in the HEARTBEAT ACK chunk.
785 786 787
	 * If the transport's rto_pending variable has been cleared,
	 * it was most likely due to a retransmit.  However, we want
	 * to re-enable it to properly update the rto.
L
Linus Torvalds 已提交
788
	 */
789 790 791
	if (t->rto_pending == 0)
		t->rto_pending = 1;

792
	hbinfo = (struct sctp_sender_hb_info *)chunk->skb->data;
L
Linus Torvalds 已提交
793
	sctp_transport_update_rto(t, (jiffies - hbinfo->sent_at));
794 795

	/* Update the heartbeat timer.  */
796
	sctp_transport_reset_hb_timer(t);
797 798 799

	if (was_unconfirmed && asoc->peer.transport_count == 1)
		sctp_transport_immediate_rtx(t);
L
Linus Torvalds 已提交
800 801 802 803
}


/* Helper function to process the process SACK command.  */
804
static int sctp_cmd_process_sack(struct sctp_cmd_seq *cmds,
L
Linus Torvalds 已提交
805
				 struct sctp_association *asoc,
806
				 struct sctp_chunk *chunk)
L
Linus Torvalds 已提交
807
{
808
	int err = 0;
L
Linus Torvalds 已提交
809

810
	if (sctp_outq_sack(&asoc->outqueue, chunk)) {
811 812
		struct net *net = sock_net(asoc->base.sk);

L
Linus Torvalds 已提交
813
		/* There are no more TSNs awaiting SACK.  */
814
		err = sctp_do_sm(net, SCTP_EVENT_T_OTHER,
L
Linus Torvalds 已提交
815 816 817 818 819 820 821 822 823 824 825
				 SCTP_ST_OTHER(SCTP_EVENT_NO_PENDING_TSN),
				 asoc->state, asoc->ep, asoc, NULL,
				 GFP_ATOMIC);
	}

	return err;
}

/* Helper function to set the timeout value for T2-SHUTDOWN timer and to set
 * the transport for a shutdown chunk.
 */
826
static void sctp_cmd_setup_t2(struct sctp_cmd_seq *cmds,
L
Linus Torvalds 已提交
827 828 829 830 831
			      struct sctp_association *asoc,
			      struct sctp_chunk *chunk)
{
	struct sctp_transport *t;

832 833 834 835
	if (chunk->transport)
		t = chunk->transport;
	else {
		t = sctp_assoc_choose_alter_transport(asoc,
836
					      asoc->shutdown_last_sent_to);
837 838
		chunk->transport = t;
	}
L
Linus Torvalds 已提交
839 840 841 842
	asoc->shutdown_last_sent_to = t;
	asoc->timeouts[SCTP_EVENT_TIMEOUT_T2_SHUTDOWN] = t->rto;
}

843
static void sctp_cmd_assoc_update(struct sctp_cmd_seq *cmds,
844 845 846 847 848 849 850 851 852
				  struct sctp_association *asoc,
				  struct sctp_association *new)
{
	struct net *net = sock_net(asoc->base.sk);
	struct sctp_chunk *abort;

	if (!sctp_assoc_update(asoc, new))
		return;

853
	abort = sctp_make_abort(asoc, NULL, sizeof(struct sctp_errhdr));
854 855 856 857 858 859 860 861 862 863 864
	if (abort) {
		sctp_init_cause(abort, SCTP_ERROR_RSRC_LOW, 0);
		sctp_add_cmd_sf(cmds, SCTP_CMD_REPLY, SCTP_CHUNK(abort));
	}
	sctp_add_cmd_sf(cmds, SCTP_CMD_SET_SK_ERR, SCTP_ERROR(ECONNABORTED));
	sctp_add_cmd_sf(cmds, SCTP_CMD_ASSOC_FAILED,
			SCTP_PERR(SCTP_ERROR_RSRC_LOW));
	SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS);
	SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB);
}

L
Linus Torvalds 已提交
865
/* Helper function to change the state of an association. */
866
static void sctp_cmd_new_state(struct sctp_cmd_seq *cmds,
L
Linus Torvalds 已提交
867
			       struct sctp_association *asoc,
X
Xin Long 已提交
868
			       enum sctp_state state)
L
Linus Torvalds 已提交
869 870 871 872 873
{
	struct sock *sk = asoc->base.sk;

	asoc->state = state;

874
	pr_debug("%s: asoc:%p[%s]\n", __func__, asoc, sctp_state_tbl[state]);
F
Frank Filz 已提交
875

L
Linus Torvalds 已提交
876
	if (sctp_style(sk, TCP)) {
F
Frank Filz 已提交
877
		/* Change the sk->sk_state of a TCP-style socket that has
878
		 * successfully completed a connect() call.
L
Linus Torvalds 已提交
879 880
		 */
		if (sctp_state(asoc, ESTABLISHED) && sctp_sstate(sk, CLOSED))
881
			inet_sk_set_state(sk, SCTP_SS_ESTABLISHED);
L
Linus Torvalds 已提交
882 883 884

		/* Set the RCV_SHUTDOWN flag when a SHUTDOWN is received. */
		if (sctp_state(asoc, SHUTDOWN_RECEIVED) &&
885
		    sctp_sstate(sk, ESTABLISHED)) {
886
			inet_sk_set_state(sk, SCTP_SS_CLOSING);
L
Linus Torvalds 已提交
887
			sk->sk_shutdown |= RCV_SHUTDOWN;
888
		}
L
Linus Torvalds 已提交
889 890
	}

F
Frank Filz 已提交
891 892 893 894 895
	if (sctp_state(asoc, COOKIE_WAIT)) {
		/* Reset init timeouts since they may have been
		 * increased due to timer expirations.
		 */
		asoc->timeouts[SCTP_EVENT_TIMEOUT_T1_INIT] =
896
						asoc->rto_initial;
F
Frank Filz 已提交
897
		asoc->timeouts[SCTP_EVENT_TIMEOUT_T1_COOKIE] =
898
						asoc->rto_initial;
F
Frank Filz 已提交
899 900
	}

901 902 903 904 905
	if (sctp_state(asoc, ESTABLISHED)) {
		kfree(asoc->peer.cookie);
		asoc->peer.cookie = NULL;
	}

L
Linus Torvalds 已提交
906 907 908 909 910
	if (sctp_state(asoc, ESTABLISHED) ||
	    sctp_state(asoc, CLOSED) ||
	    sctp_state(asoc, SHUTDOWN_RECEIVED)) {
		/* Wake up any processes waiting in the asoc's wait queue in
		 * sctp_wait_for_connect() or sctp_wait_for_sndbuf().
911
		 */
L
Linus Torvalds 已提交
912 913 914 915 916 917 918 919 920 921 922 923
		if (waitqueue_active(&asoc->wait))
			wake_up_interruptible(&asoc->wait);

		/* Wake up any processes waiting in the sk's sleep queue of
		 * a TCP-style or UDP-style peeled-off socket in
		 * sctp_wait_for_accept() or sctp_wait_for_packet().
		 * For a UDP-style socket, the waiters are woken up by the
		 * notifications.
		 */
		if (!sctp_style(sk, UDP))
			sk->sk_state_change(sk);
	}
924 925 926 927

	if (sctp_state(asoc, SHUTDOWN_PENDING) &&
	    !sctp_outq_is_empty(&asoc->outqueue))
		sctp_outq_uncork(&asoc->outqueue, GFP_ATOMIC);
L
Linus Torvalds 已提交
928 929 930
}

/* Helper function to delete an association. */
931
static void sctp_cmd_delete_tcb(struct sctp_cmd_seq *cmds,
L
Linus Torvalds 已提交
932 933 934 935 936
				struct sctp_association *asoc)
{
	struct sock *sk = asoc->base.sk;

	/* If it is a non-temporary association belonging to a TCP-style
937
	 * listening socket that is not closed, do not free it so that accept()
L
Linus Torvalds 已提交
938
	 * can pick it up later.
939
	 */
L
Linus Torvalds 已提交
940 941 942 943 944 945 946 947 948 949 950
	if (sctp_style(sk, TCP) && sctp_sstate(sk, LISTENING) &&
	    (!asoc->temp) && (sk->sk_shutdown != SHUTDOWN_MASK))
		return;

	sctp_association_free(asoc);
}

/*
 * ADDIP Section 4.1 ASCONF Chunk Procedures
 * A4) Start a T-4 RTO timer, using the RTO value of the selected
 * destination address (we use active path instead of primary path just
951
 * because primary path may be inactive.
L
Linus Torvalds 已提交
952
 */
953 954 955
static void sctp_cmd_setup_t4(struct sctp_cmd_seq *cmds,
			      struct sctp_association *asoc,
			      struct sctp_chunk *chunk)
L
Linus Torvalds 已提交
956 957 958
{
	struct sctp_transport *t;

959
	t = sctp_assoc_choose_alter_transport(asoc, chunk->transport);
L
Linus Torvalds 已提交
960 961 962 963
	asoc->timeouts[SCTP_EVENT_TIMEOUT_T4_RTO] = t->rto;
	chunk->transport = t;
}

964
/* Process an incoming Operation Error Chunk. */
965
static void sctp_cmd_process_operr(struct sctp_cmd_seq *cmds,
L
Linus Torvalds 已提交
966 967 968 969
				   struct sctp_association *asoc,
				   struct sctp_chunk *chunk)
{
	struct sctp_errhdr *err_hdr;
970 971 972 973 974 975 976 977 978 979
	struct sctp_ulpevent *ev;

	while (chunk->chunk_end > chunk->skb->data) {
		err_hdr = (struct sctp_errhdr *)(chunk->skb->data);

		ev = sctp_ulpevent_make_remote_error(asoc, chunk, 0,
						     GFP_ATOMIC);
		if (!ev)
			return;

980
		asoc->stream.si->enqueue_event(&asoc->ulpq, ev);
981 982 983 984

		switch (err_hdr->cause) {
		case SCTP_ERROR_UNKNOWN_CHUNK:
		{
985
			struct sctp_chunkhdr *unk_chunk_hdr;
986

987 988
			unk_chunk_hdr = (struct sctp_chunkhdr *)
							err_hdr->variable;
989 990 991 992 993 994 995 996 997 998 999 1000 1001
			switch (unk_chunk_hdr->type) {
			/* ADDIP 4.1 A9) If the peer responds to an ASCONF with
			 * an ERROR chunk reporting that it did not recognized
			 * the ASCONF chunk type, the sender of the ASCONF MUST
			 * NOT send any further ASCONF chunks and MUST stop its
			 * T-4 timer.
			 */
			case SCTP_CID_ASCONF:
				if (asoc->peer.asconf_capable == 0)
					break;

				asoc->peer.asconf_capable = 0;
				sctp_add_cmd_sf(cmds, SCTP_CMD_TIMER_STOP,
L
Linus Torvalds 已提交
1002
					SCTP_TO(SCTP_EVENT_TIMEOUT_T4_RTO));
1003 1004 1005 1006
				break;
			default:
				break;
			}
L
Linus Torvalds 已提交
1007
			break;
1008
		}
L
Linus Torvalds 已提交
1009 1010 1011 1012 1013 1014
		default:
			break;
		}
	}
}

1015
/* Helper function to remove the association non-primary peer
L
Linus Torvalds 已提交
1016
 * transports.
1017
 */
L
Linus Torvalds 已提交
1018 1019 1020 1021
static void sctp_cmd_del_non_primary(struct sctp_association *asoc)
{
	struct sctp_transport *t;
	struct list_head *temp;
1022
	struct list_head *pos;
L
Linus Torvalds 已提交
1023 1024 1025

	list_for_each_safe(pos, temp, &asoc->peer.transport_addr_list) {
		t = list_entry(pos, struct sctp_transport, transports);
1026
		if (!sctp_cmp_addr_exact(&t->ipaddr,
1027
					 &asoc->peer.primary_addr)) {
1028
			sctp_assoc_rm_peer(asoc, t);
L
Linus Torvalds 已提交
1029 1030 1031 1032
		}
	}
}

1033 1034 1035 1036 1037 1038 1039 1040 1041
/* Helper function to set sk_err on a 1-1 style socket. */
static void sctp_cmd_set_sk_err(struct sctp_association *asoc, int error)
{
	struct sock *sk = asoc->base.sk;

	if (!sctp_style(sk, UDP))
		sk->sk_err = error;
}

1042
/* Helper function to generate an association change event */
1043 1044 1045
static void sctp_cmd_assoc_change(struct sctp_cmd_seq *commands,
				  struct sctp_association *asoc,
				  u8 state)
1046 1047 1048 1049 1050 1051 1052 1053
{
	struct sctp_ulpevent *ev;

	ev = sctp_ulpevent_make_assoc_change(asoc, 0, state, 0,
					    asoc->c.sinit_num_ostreams,
					    asoc->c.sinit_max_instreams,
					    NULL, GFP_ATOMIC);
	if (ev)
1054
		asoc->stream.si->enqueue_event(&asoc->ulpq, ev);
1055 1056
}

1057 1058 1059 1060 1061 1062 1063 1064 1065 1066
static void sctp_cmd_peer_no_auth(struct sctp_cmd_seq *commands,
				  struct sctp_association *asoc)
{
	struct sctp_ulpevent *ev;

	ev = sctp_ulpevent_make_authkey(asoc, 0, SCTP_AUTH_NO_AUTH, GFP_ATOMIC);
	if (ev)
		asoc->stream.si->enqueue_event(&asoc->ulpq, ev);
}

1067
/* Helper function to generate an adaptation indication event */
1068
static void sctp_cmd_adaptation_ind(struct sctp_cmd_seq *commands,
1069 1070 1071 1072 1073 1074 1075
				    struct sctp_association *asoc)
{
	struct sctp_ulpevent *ev;

	ev = sctp_ulpevent_make_adaptation_indication(asoc, GFP_ATOMIC);

	if (ev)
1076
		asoc->stream.si->enqueue_event(&asoc->ulpq, ev);
1077 1078
}

1079 1080

static void sctp_cmd_t1_timer_update(struct sctp_association *asoc,
1081 1082
				     enum sctp_event_timeout timer,
				     char *name)
1083 1084 1085 1086 1087 1088 1089 1090 1091 1092 1093 1094
{
	struct sctp_transport *t;

	t = asoc->init_last_sent_to;
	asoc->init_err_counter++;

	if (t->init_sent_count > (asoc->init_cycle + 1)) {
		asoc->timeouts[timer] *= 2;
		if (asoc->timeouts[timer] > asoc->max_init_timeo) {
			asoc->timeouts[timer] = asoc->max_init_timeo;
		}
		asoc->init_cycle++;
1095 1096 1097 1098 1099

		pr_debug("%s: T1[%s] timeout adjustment init_err_counter:%d"
			 " cycle:%d timeout:%ld\n", __func__, name,
			 asoc->init_err_counter, asoc->init_cycle,
			 asoc->timeouts[timer]);
1100 1101 1102 1103
	}

}

1104 1105 1106 1107
/* Send the whole message, chunk by chunk, to the outqueue.
 * This way the whole message is queued up and bundling if
 * encouraged for small fragments.
 */
1108 1109
static void sctp_cmd_send_msg(struct sctp_association *asoc,
			      struct sctp_datamsg *msg, gfp_t gfp)
1110 1111 1112
{
	struct sctp_chunk *chunk;

1113 1114
	list_for_each_entry(chunk, &msg->chunks, frag_list)
		sctp_outq_tail(&asoc->outqueue, chunk, gfp);
1115 1116

	asoc->outqueue.sched->enqueue(&asoc->outqueue, msg);
1117 1118 1119
}


L
Linus Torvalds 已提交
1120 1121 1122 1123
/* These three macros allow us to pull the debugging code out of the
 * main flow of sctp_do_sm() to keep attention focused on the real
 * functionality there.
 */
1124 1125 1126 1127 1128 1129 1130 1131 1132 1133 1134 1135 1136
#define debug_pre_sfn() \
	pr_debug("%s[pre-fn]: ep:%p, %s, %s, asoc:%p[%s], %s\n", __func__, \
		 ep, sctp_evttype_tbl[event_type], (*debug_fn)(subtype),   \
		 asoc, sctp_state_tbl[state], state_fn->name)

#define debug_post_sfn() \
	pr_debug("%s[post-fn]: asoc:%p, status:%s\n", __func__, asoc, \
		 sctp_status_tbl[status])

#define debug_post_sfx() \
	pr_debug("%s[post-sfx]: error:%d, asoc:%p[%s]\n", __func__, error, \
		 asoc, sctp_state_tbl[(asoc && sctp_id2assoc(ep->base.sk, \
		 sctp_assoc2id(asoc))) ? asoc->state : SCTP_STATE_CLOSED])
L
Linus Torvalds 已提交
1137 1138 1139 1140 1141 1142 1143

/*
 * This is the master state machine processing function.
 *
 * If you want to understand all of lksctp, this is a
 * good place to start.
 */
X
Xin Long 已提交
1144
int sctp_do_sm(struct net *net, enum sctp_event event_type,
1145
	       union sctp_subtype subtype, enum sctp_state state,
X
Xin Long 已提交
1146 1147
	       struct sctp_endpoint *ep, struct sctp_association *asoc,
	       void *event_arg, gfp_t gfp)
L
Linus Torvalds 已提交
1148
{
1149
	typedef const char *(printfn_t)(union sctp_subtype);
L
Linus Torvalds 已提交
1150 1151 1152 1153
	static printfn_t *table[] = {
		NULL, sctp_cname, sctp_tname, sctp_oname, sctp_pname,
	};
	printfn_t *debug_fn  __attribute__ ((unused)) = table[event_type];
1154 1155 1156 1157
	const struct sctp_sm_table_entry *state_fn;
	struct sctp_cmd_seq commands;
	enum sctp_disposition status;
	int error = 0;
L
Linus Torvalds 已提交
1158 1159 1160 1161

	/* Look up the state function, run it, and then process the
	 * side effects.  These three steps are the heart of lksctp.
	 */
1162
	state_fn = sctp_sm_lookup_event(net, event_type, state, subtype);
L
Linus Torvalds 已提交
1163 1164 1165

	sctp_init_cmd_seq(&commands);

1166
	debug_pre_sfn();
1167
	status = state_fn->fn(net, ep, asoc, subtype, event_arg, &commands);
1168
	debug_post_sfn();
L
Linus Torvalds 已提交
1169 1170

	error = sctp_side_effects(event_type, subtype, state,
1171
				  ep, &asoc, event_arg, status,
L
Linus Torvalds 已提交
1172
				  &commands, gfp);
1173
	debug_post_sfx();
L
Linus Torvalds 已提交
1174 1175 1176 1177 1178 1179 1180

	return error;
}

/*****************************************************************
 * This the master state function side effect processing function.
 *****************************************************************/
1181 1182
static int sctp_side_effects(enum sctp_event event_type,
			     union sctp_subtype subtype,
X
Xin Long 已提交
1183
			     enum sctp_state state,
L
Linus Torvalds 已提交
1184
			     struct sctp_endpoint *ep,
1185
			     struct sctp_association **asoc,
L
Linus Torvalds 已提交
1186
			     void *event_arg,
1187
			     enum sctp_disposition status,
1188
			     struct sctp_cmd_seq *commands,
A
Al Viro 已提交
1189
			     gfp_t gfp)
L
Linus Torvalds 已提交
1190 1191 1192 1193 1194 1195 1196 1197 1198 1199
{
	int error;

	/* FIXME - Most of the dispositions left today would be categorized
	 * as "exceptional" dispositions.  For those dispositions, it
	 * may not be proper to run through any of the commands at all.
	 * For example, the command interpreter might be run only with
	 * disposition SCTP_DISPOSITION_CONSUME.
	 */
	if (0 != (error = sctp_cmd_interpreter(event_type, subtype, state,
1200
					       ep, *asoc,
L
Linus Torvalds 已提交
1201 1202 1203 1204 1205 1206
					       event_arg, status,
					       commands, gfp)))
		goto bail;

	switch (status) {
	case SCTP_DISPOSITION_DISCARD:
1207 1208 1209
		pr_debug("%s: ignored sctp protocol event - state:%d, "
			 "event_type:%d, event_id:%d\n", __func__, state,
			 event_type, subtype.chunk);
L
Linus Torvalds 已提交
1210 1211 1212 1213 1214 1215 1216 1217 1218 1219 1220 1221
		break;

	case SCTP_DISPOSITION_NOMEM:
		/* We ran out of memory, so we need to discard this
		 * packet.
		 */
		/* BUG--we should now recover some memory, probably by
		 * reneging...
		 */
		error = -ENOMEM;
		break;

1222
	case SCTP_DISPOSITION_DELETE_TCB:
1223
	case SCTP_DISPOSITION_ABORT:
L
Linus Torvalds 已提交
1224
		/* This should now be a command. */
1225
		*asoc = NULL;
L
Linus Torvalds 已提交
1226 1227 1228 1229 1230 1231 1232 1233 1234 1235
		break;

	case SCTP_DISPOSITION_CONSUME:
		/*
		 * We should no longer have much work to do here as the
		 * real work has been done as explicit commands above.
		 */
		break;

	case SCTP_DISPOSITION_VIOLATION:
1236 1237
		net_err_ratelimited("protocol violation state %d chunkid %d\n",
				    state, subtype.chunk);
L
Linus Torvalds 已提交
1238 1239 1240
		break;

	case SCTP_DISPOSITION_NOT_IMPL:
1241 1242
		pr_warn("unimplemented feature in state %d, event_type %d, event_id %d\n",
			state, event_type, subtype.chunk);
L
Linus Torvalds 已提交
1243 1244 1245
		break;

	case SCTP_DISPOSITION_BUG:
1246
		pr_err("bug in state %d, event_type %d, event_id %d\n",
L
Linus Torvalds 已提交
1247 1248 1249 1250 1251
		       state, event_type, subtype.chunk);
		BUG();
		break;

	default:
1252
		pr_err("impossible disposition %d in state %d, event_type %d, event_id %d\n",
L
Linus Torvalds 已提交
1253 1254 1255
		       status, state, event_type, subtype.chunk);
		BUG();
		break;
1256
	}
L
Linus Torvalds 已提交
1257 1258 1259 1260 1261 1262 1263 1264 1265 1266

bail:
	return error;
}

/********************************************************************
 * 2nd Level Abstractions
 ********************************************************************/

/* This is the side-effect interpreter.  */
X
Xin Long 已提交
1267
static int sctp_cmd_interpreter(enum sctp_event event_type,
1268
				union sctp_subtype subtype,
X
Xin Long 已提交
1269
				enum sctp_state state,
L
Linus Torvalds 已提交
1270 1271 1272
				struct sctp_endpoint *ep,
				struct sctp_association *asoc,
				void *event_arg,
1273
				enum sctp_disposition status,
1274
				struct sctp_cmd_seq *commands,
A
Al Viro 已提交
1275
				gfp_t gfp)
L
Linus Torvalds 已提交
1276
{
1277 1278
	struct sctp_sock *sp = sctp_sk(ep->base.sk);
	struct sctp_chunk *chunk = NULL, *new_obj;
L
Linus Torvalds 已提交
1279
	struct sctp_packet *packet;
1280
	struct sctp_sackhdr sackh;
L
Linus Torvalds 已提交
1281 1282
	struct timer_list *timer;
	struct sctp_transport *t;
1283 1284
	unsigned long timeout;
	struct sctp_cmd *cmd;
L
Linus Torvalds 已提交
1285
	int local_cork = 0;
1286 1287
	int error = 0;
	int force;
L
Linus Torvalds 已提交
1288 1289

	if (SCTP_EVENT_T_TIMEOUT != event_type)
J
Joe Perches 已提交
1290
		chunk = event_arg;
L
Linus Torvalds 已提交
1291 1292 1293 1294 1295 1296 1297 1298 1299 1300 1301 1302 1303 1304 1305 1306 1307

	/* Note:  This whole file is a huge candidate for rework.
	 * For example, each command could either have its own handler, so
	 * the loop would look like:
	 *     while (cmds)
	 *         cmd->handle(x, y, z)
	 * --jgrimm
	 */
	while (NULL != (cmd = sctp_next_cmd(commands))) {
		switch (cmd->verb) {
		case SCTP_CMD_NOP:
			/* Do nothing. */
			break;

		case SCTP_CMD_NEW_ASOC:
			/* Register a new association.  */
			if (local_cork) {
1308
				sctp_outq_uncork(&asoc->outqueue, gfp);
L
Linus Torvalds 已提交
1309 1310
				local_cork = 0;
			}
1311

L
Linus Torvalds 已提交
1312
			/* Register with the endpoint.  */
1313 1314
			asoc = cmd->obj.asoc;
			BUG_ON(asoc->peer.primary_path == NULL);
L
Linus Torvalds 已提交
1315 1316 1317 1318
			sctp_endpoint_add_asoc(ep, asoc);
			break;

		case SCTP_CMD_UPDATE_ASSOC:
1319
		       sctp_cmd_assoc_update(commands, asoc, cmd->obj.asoc);
L
Linus Torvalds 已提交
1320 1321 1322 1323 1324 1325
		       break;

		case SCTP_CMD_PURGE_OUTQUEUE:
		       sctp_outq_teardown(&asoc->outqueue);
		       break;

1326
		case SCTP_CMD_DELETE_TCB:
L
Linus Torvalds 已提交
1327
			if (local_cork) {
1328
				sctp_outq_uncork(&asoc->outqueue, gfp);
L
Linus Torvalds 已提交
1329 1330 1331 1332 1333 1334 1335 1336 1337 1338 1339 1340 1341 1342
				local_cork = 0;
			}
			/* Delete the current association.  */
			sctp_cmd_delete_tcb(commands, asoc);
			asoc = NULL;
			break;

		case SCTP_CMD_NEW_STATE:
			/* Enter a new state.  */
			sctp_cmd_new_state(commands, asoc, cmd->obj.state);
			break;

		case SCTP_CMD_REPORT_TSN:
			/* Record the arrival of a TSN.  */
1343
			error = sctp_tsnmap_mark(&asoc->peer.tsn_map,
1344
						 cmd->obj.u32, NULL);
L
Linus Torvalds 已提交
1345 1346 1347
			break;

		case SCTP_CMD_REPORT_FWDTSN:
1348
			asoc->stream.si->report_ftsn(&asoc->ulpq, cmd->obj.u32);
L
Linus Torvalds 已提交
1349 1350 1351
			break;

		case SCTP_CMD_PROCESS_FWDTSN:
1352 1353
			asoc->stream.si->handle_ftsn(&asoc->ulpq,
						     cmd->obj.chunk);
1354
			break;
L
Linus Torvalds 已提交
1355 1356 1357 1358 1359 1360 1361 1362 1363 1364 1365 1366 1367 1368

		case SCTP_CMD_GEN_SACK:
			/* Generate a Selective ACK.
			 * The argument tells us whether to just count
			 * the packet and MAYBE generate a SACK, or
			 * force a SACK out.
			 */
			force = cmd->obj.i32;
			error = sctp_gen_sack(asoc, force, commands);
			break;

		case SCTP_CMD_PROCESS_SACK:
			/* Process an inbound SACK.  */
			error = sctp_cmd_process_sack(commands, asoc,
1369
						      cmd->obj.chunk);
L
Linus Torvalds 已提交
1370 1371 1372 1373 1374 1375 1376 1377 1378 1379 1380 1381 1382 1383 1384 1385 1386 1387 1388 1389
			break;

		case SCTP_CMD_GEN_INIT_ACK:
			/* Generate an INIT ACK chunk.  */
			new_obj = sctp_make_init_ack(asoc, chunk, GFP_ATOMIC,
						     0);
			if (!new_obj)
				goto nomem;

			sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
					SCTP_CHUNK(new_obj));
			break;

		case SCTP_CMD_PEER_INIT:
			/* Process a unified INIT from the peer.
			 * Note: Only used during INIT-ACK processing.  If
			 * there is an error just return to the outter
			 * layer which will bail.
			 */
			error = sctp_cmd_process_init(commands, asoc, chunk,
1390
						      cmd->obj.init, gfp);
L
Linus Torvalds 已提交
1391 1392 1393 1394 1395 1396
			break;

		case SCTP_CMD_GEN_COOKIE_ECHO:
			/* Generate a COOKIE ECHO chunk.  */
			new_obj = sctp_make_cookie_echo(asoc, chunk);
			if (!new_obj) {
1397 1398
				if (cmd->obj.chunk)
					sctp_chunk_free(cmd->obj.chunk);
L
Linus Torvalds 已提交
1399 1400 1401 1402 1403 1404 1405 1406
				goto nomem;
			}
			sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
					SCTP_CHUNK(new_obj));

			/* If there is an ERROR chunk to be sent along with
			 * the COOKIE_ECHO, send it, too.
			 */
1407
			if (cmd->obj.chunk)
L
Linus Torvalds 已提交
1408
				sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
1409
						SCTP_CHUNK(cmd->obj.chunk));
L
Linus Torvalds 已提交
1410

1411 1412 1413 1414 1415
			if (new_obj->transport) {
				new_obj->transport->init_sent_count++;
				asoc->init_last_sent_to = new_obj->transport;
			}

L
Linus Torvalds 已提交
1416
			/* FIXME - Eventually come up with a cleaner way to
1417 1418 1419 1420 1421 1422
			 * enabling COOKIE-ECHO + DATA bundling during
			 * multihoming stale cookie scenarios, the following
			 * command plays with asoc->peer.retran_path to
			 * avoid the problem of sending the COOKIE-ECHO and
			 * DATA in different paths, which could result
			 * in the association being ABORTed if the DATA chunk
L
Linus Torvalds 已提交
1423 1424 1425 1426 1427
			 * is processed first by the server.  Checking the
			 * init error counter simply causes this command
			 * to be executed only during failed attempts of
			 * association establishment.
			 */
F
Frank Filz 已提交
1428 1429 1430 1431
			if ((asoc->peer.retran_path !=
			     asoc->peer.primary_path) &&
			    (asoc->init_err_counter > 0)) {
				sctp_add_cmd_sf(commands,
1432
						SCTP_CMD_FORCE_PRIM_RETRAN,
L
Linus Torvalds 已提交
1433 1434 1435 1436 1437 1438 1439 1440 1441 1442 1443 1444 1445 1446 1447 1448 1449 1450 1451 1452 1453
						SCTP_NULL());
			}

			break;

		case SCTP_CMD_GEN_SHUTDOWN:
			/* Generate SHUTDOWN when in SHUTDOWN_SENT state.
			 * Reset error counts.
			 */
			asoc->overall_error_count = 0;

			/* Generate a SHUTDOWN chunk.  */
			new_obj = sctp_make_shutdown(asoc, chunk);
			if (!new_obj)
				goto nomem;
			sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
					SCTP_CHUNK(new_obj));
			break;

		case SCTP_CMD_CHUNK_ULP:
			/* Send a chunk to the sockets layer.  */
1454 1455 1456
			pr_debug("%s: sm_sideff: chunk_up:%p, ulpq:%p\n",
				 __func__, cmd->obj.chunk, &asoc->ulpq);

1457 1458 1459
			asoc->stream.si->ulpevent_data(&asoc->ulpq,
						       cmd->obj.chunk,
						       GFP_ATOMIC);
L
Linus Torvalds 已提交
1460 1461 1462 1463
			break;

		case SCTP_CMD_EVENT_ULP:
			/* Send a notification to the sockets layer.  */
1464 1465 1466
			pr_debug("%s: sm_sideff: event_up:%p, ulpq:%p\n",
				 __func__, cmd->obj.ulpevent, &asoc->ulpq);

1467 1468
			asoc->stream.si->enqueue_event(&asoc->ulpq,
						       cmd->obj.ulpevent);
L
Linus Torvalds 已提交
1469 1470 1471 1472 1473 1474 1475 1476 1477
			break;

		case SCTP_CMD_REPLY:
			/* If an caller has not already corked, do cork. */
			if (!asoc->outqueue.cork) {
				sctp_outq_cork(&asoc->outqueue);
				local_cork = 1;
			}
			/* Send a chunk to our peer.  */
1478
			sctp_outq_tail(&asoc->outqueue, cmd->obj.chunk, gfp);
L
Linus Torvalds 已提交
1479 1480 1481 1482
			break;

		case SCTP_CMD_SEND_PKT:
			/* Send a full packet to our peer.  */
1483
			packet = cmd->obj.packet;
1484
			sctp_packet_transmit(packet, gfp);
L
Linus Torvalds 已提交
1485 1486 1487
			sctp_ootb_pkt_free(packet);
			break;

1488 1489 1490 1491 1492 1493
		case SCTP_CMD_T1_RETRAN:
			/* Mark a transport for retransmission.  */
			sctp_retransmit(&asoc->outqueue, cmd->obj.transport,
					SCTP_RTXR_T1_RTX);
			break;

L
Linus Torvalds 已提交
1494 1495 1496 1497 1498 1499 1500 1501 1502 1503 1504 1505 1506 1507 1508 1509 1510 1511 1512 1513 1514 1515 1516 1517 1518 1519
		case SCTP_CMD_RETRAN:
			/* Mark a transport for retransmission.  */
			sctp_retransmit(&asoc->outqueue, cmd->obj.transport,
					SCTP_RTXR_T3_RTX);
			break;

		case SCTP_CMD_ECN_CE:
			/* Do delayed CE processing.   */
			sctp_do_ecn_ce_work(asoc, cmd->obj.u32);
			break;

		case SCTP_CMD_ECN_ECNE:
			/* Do delayed ECNE processing. */
			new_obj = sctp_do_ecn_ecne_work(asoc, cmd->obj.u32,
							chunk);
			if (new_obj)
				sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
						SCTP_CHUNK(new_obj));
			break;

		case SCTP_CMD_ECN_CWR:
			/* Do delayed CWR processing.  */
			sctp_do_ecn_cwr_work(asoc, cmd->obj.u32);
			break;

		case SCTP_CMD_SETUP_T2:
1520
			sctp_cmd_setup_t2(commands, asoc, cmd->obj.chunk);
L
Linus Torvalds 已提交
1521 1522
			break;

1523 1524 1525 1526 1527 1528 1529
		case SCTP_CMD_TIMER_START_ONCE:
			timer = &asoc->timers[cmd->obj.to];

			if (timer_pending(timer))
				break;
			/* fall through */

L
Linus Torvalds 已提交
1530 1531 1532
		case SCTP_CMD_TIMER_START:
			timer = &asoc->timers[cmd->obj.to];
			timeout = asoc->timeouts[cmd->obj.to];
1533
			BUG_ON(!timeout);
L
Linus Torvalds 已提交
1534 1535 1536 1537 1538 1539 1540 1541 1542 1543 1544 1545 1546 1547 1548

			timer->expires = jiffies + timeout;
			sctp_association_hold(asoc);
			add_timer(timer);
			break;

		case SCTP_CMD_TIMER_RESTART:
			timer = &asoc->timers[cmd->obj.to];
			timeout = asoc->timeouts[cmd->obj.to];
			if (!mod_timer(timer, jiffies + timeout))
				sctp_association_hold(asoc);
			break;

		case SCTP_CMD_TIMER_STOP:
			timer = &asoc->timers[cmd->obj.to];
1549
			if (del_timer(timer))
L
Linus Torvalds 已提交
1550 1551 1552
				sctp_association_put(asoc);
			break;

F
Frank Filz 已提交
1553
		case SCTP_CMD_INIT_CHOOSE_TRANSPORT:
1554
			chunk = cmd->obj.chunk;
1555 1556
			t = sctp_assoc_choose_alter_transport(asoc,
						asoc->init_last_sent_to);
F
Frank Filz 已提交
1557 1558 1559
			asoc->init_last_sent_to = t;
			chunk->transport = t;
			t->init_sent_count++;
1560 1561
			/* Set the new transport as primary */
			sctp_assoc_set_primary(asoc, t);
F
Frank Filz 已提交
1562 1563
			break;

L
Linus Torvalds 已提交
1564 1565 1566
		case SCTP_CMD_INIT_RESTART:
			/* Do the needed accounting and updates
			 * associated with restarting an initialization
F
Frank Filz 已提交
1567 1568 1569 1570
			 * timer. Only multiply the timeout by two if
			 * all transports have been tried at the current
			 * timeout.
			 */
1571 1572 1573
			sctp_cmd_t1_timer_update(asoc,
						SCTP_EVENT_TIMEOUT_T1_INIT,
						"INIT");
F
Frank Filz 已提交
1574 1575 1576 1577 1578 1579 1580 1581 1582 1583 1584

			sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_RESTART,
					SCTP_TO(SCTP_EVENT_TIMEOUT_T1_INIT));
			break;

		case SCTP_CMD_COOKIEECHO_RESTART:
			/* Do the needed accounting and updates
			 * associated with restarting an initialization
			 * timer. Only multiply the timeout by two if
			 * all transports have been tried at the current
			 * timeout.
L
Linus Torvalds 已提交
1585
			 */
1586 1587 1588
			sctp_cmd_t1_timer_update(asoc,
						SCTP_EVENT_TIMEOUT_T1_COOKIE,
						"COOKIE");
L
Linus Torvalds 已提交
1589 1590 1591 1592

			/* If we've sent any data bundled with
			 * COOKIE-ECHO we need to resend.
			 */
1593 1594
			list_for_each_entry(t, &asoc->peer.transport_addr_list,
					transports) {
1595 1596
				sctp_retransmit_mark(&asoc->outqueue, t,
					    SCTP_RTXR_T1_RTX);
L
Linus Torvalds 已提交
1597 1598 1599 1600
			}

			sctp_add_cmd_sf(commands,
					SCTP_CMD_TIMER_RESTART,
F
Frank Filz 已提交
1601
					SCTP_TO(SCTP_EVENT_TIMEOUT_T1_COOKIE));
L
Linus Torvalds 已提交
1602 1603 1604
			break;

		case SCTP_CMD_INIT_FAILED:
1605
			sctp_cmd_init_failed(commands, asoc, cmd->obj.u32);
L
Linus Torvalds 已提交
1606 1607 1608 1609
			break;

		case SCTP_CMD_ASSOC_FAILED:
			sctp_cmd_assoc_failed(commands, asoc, event_type,
1610
					      subtype, chunk, cmd->obj.u32);
L
Linus Torvalds 已提交
1611 1612
			break;

F
Frank Filz 已提交
1613 1614
		case SCTP_CMD_INIT_COUNTER_INC:
			asoc->init_err_counter++;
L
Linus Torvalds 已提交
1615 1616
			break;

F
Frank Filz 已提交
1617 1618 1619
		case SCTP_CMD_INIT_COUNTER_RESET:
			asoc->init_err_counter = 0;
			asoc->init_cycle = 0;
1620 1621 1622 1623
			list_for_each_entry(t, &asoc->peer.transport_addr_list,
					    transports) {
				t->init_sent_count = 0;
			}
L
Linus Torvalds 已提交
1624 1625 1626 1627 1628 1629 1630 1631
			break;

		case SCTP_CMD_REPORT_DUP:
			sctp_tsnmap_mark_dup(&asoc->peer.tsn_map,
					     cmd->obj.u32);
			break;

		case SCTP_CMD_REPORT_BAD_TAG:
1632
			pr_debug("%s: vtag mismatch!\n", __func__);
L
Linus Torvalds 已提交
1633 1634 1635 1636
			break;

		case SCTP_CMD_STRIKE:
			/* Mark one strike against a transport.  */
1637 1638
			sctp_do_8_2_transport_strike(commands, asoc,
						    cmd->obj.transport, 0);
1639 1640 1641 1642 1643
			break;

		case SCTP_CMD_TRANSPORT_IDLE:
			t = cmd->obj.transport;
			sctp_transport_lower_cwnd(t, SCTP_LOWER_CWND_INACTIVE);
L
Linus Torvalds 已提交
1644 1645
			break;

1646
		case SCTP_CMD_TRANSPORT_HB_SENT:
L
Linus Torvalds 已提交
1647
			t = cmd->obj.transport;
1648 1649
			sctp_do_8_2_transport_strike(commands, asoc,
						     t, 1);
1650
			t->hb_sent = 1;
L
Linus Torvalds 已提交
1651 1652 1653 1654 1655 1656 1657 1658 1659 1660 1661 1662 1663
			break;

		case SCTP_CMD_TRANSPORT_ON:
			t = cmd->obj.transport;
			sctp_cmd_transport_on(commands, asoc, t, chunk);
			break;

		case SCTP_CMD_HB_TIMERS_START:
			sctp_cmd_hb_timers_start(commands, asoc);
			break;

		case SCTP_CMD_HB_TIMER_UPDATE:
			t = cmd->obj.transport;
1664
			sctp_transport_reset_hb_timer(t);
L
Linus Torvalds 已提交
1665 1666 1667 1668 1669 1670 1671 1672 1673 1674 1675 1676
			break;

		case SCTP_CMD_HB_TIMERS_STOP:
			sctp_cmd_hb_timers_stop(commands, asoc);
			break;

		case SCTP_CMD_REPORT_ERROR:
			error = cmd->obj.error;
			break;

		case SCTP_CMD_PROCESS_CTSN:
			/* Dummy up a SACK for processing. */
1677
			sackh.cum_tsn_ack = cmd->obj.be32;
1678 1679
			sackh.a_rwnd = htonl(asoc->peer.rwnd +
					     asoc->outqueue.outstanding_bytes);
L
Linus Torvalds 已提交
1680 1681
			sackh.num_gap_ack_blocks = 0;
			sackh.num_dup_tsns = 0;
1682
			chunk->subh.sack_hdr = &sackh;
L
Linus Torvalds 已提交
1683
			sctp_add_cmd_sf(commands, SCTP_CMD_PROCESS_SACK,
1684
					SCTP_CHUNK(chunk));
L
Linus Torvalds 已提交
1685 1686 1687
			break;

		case SCTP_CMD_DISCARD_PACKET:
1688 1689 1690 1691
			/* We need to discard the whole packet.
			 * Uncork the queue since there might be
			 * responses pending
			 */
L
Linus Torvalds 已提交
1692
			chunk->pdiscard = 1;
1693
			if (asoc) {
1694
				sctp_outq_uncork(&asoc->outqueue, gfp);
1695 1696
				local_cork = 0;
			}
L
Linus Torvalds 已提交
1697 1698 1699 1700 1701 1702 1703 1704
			break;

		case SCTP_CMD_RTO_PENDING:
			t = cmd->obj.transport;
			t->rto_pending = 1;
			break;

		case SCTP_CMD_PART_DELIVER:
1705
			asoc->stream.si->start_pd(&asoc->ulpq, GFP_ATOMIC);
L
Linus Torvalds 已提交
1706 1707 1708
			break;

		case SCTP_CMD_RENEGE:
1709 1710 1711
			asoc->stream.si->renege_events(&asoc->ulpq,
						       cmd->obj.chunk,
						       GFP_ATOMIC);
L
Linus Torvalds 已提交
1712 1713 1714
			break;

		case SCTP_CMD_SETUP_T4:
1715
			sctp_cmd_setup_t4(commands, asoc, cmd->obj.chunk);
L
Linus Torvalds 已提交
1716 1717 1718 1719 1720 1721 1722 1723 1724 1725 1726 1727 1728 1729 1730 1731 1732
			break;

		case SCTP_CMD_PROCESS_OPERR:
			sctp_cmd_process_operr(commands, asoc, chunk);
			break;
		case SCTP_CMD_CLEAR_INIT_TAG:
			asoc->peer.i.init_tag = 0;
			break;
		case SCTP_CMD_DEL_NON_PRIMARY:
			sctp_cmd_del_non_primary(asoc);
			break;
		case SCTP_CMD_T3_RTX_TIMERS_STOP:
			sctp_cmd_t3_rtx_timers_stop(commands, asoc);
			break;
		case SCTP_CMD_FORCE_PRIM_RETRAN:
			t = asoc->peer.retran_path;
			asoc->peer.retran_path = asoc->peer.primary_path;
1733
			sctp_outq_uncork(&asoc->outqueue, gfp);
L
Linus Torvalds 已提交
1734 1735 1736
			local_cork = 0;
			asoc->peer.retran_path = t;
			break;
1737 1738 1739
		case SCTP_CMD_SET_SK_ERR:
			sctp_cmd_set_sk_err(asoc, cmd->obj.error);
			break;
1740 1741 1742 1743 1744 1745 1746
		case SCTP_CMD_ASSOC_CHANGE:
			sctp_cmd_assoc_change(commands, asoc,
					      cmd->obj.u8);
			break;
		case SCTP_CMD_ADAPTATION_IND:
			sctp_cmd_adaptation_ind(commands, asoc);
			break;
1747 1748 1749
		case SCTP_CMD_PEER_NO_AUTH:
			sctp_cmd_peer_no_auth(commands, asoc);
			break;
1750

1751 1752 1753 1754
		case SCTP_CMD_ASSOC_SHKEY:
			error = sctp_auth_asoc_init_active_key(asoc,
						GFP_ATOMIC);
			break;
1755 1756 1757
		case SCTP_CMD_UPDATE_INITTAG:
			asoc->peer.i.init_tag = cmd->obj.u32;
			break;
1758 1759 1760 1761 1762
		case SCTP_CMD_SEND_MSG:
			if (!asoc->outqueue.cork) {
				sctp_outq_cork(&asoc->outqueue);
				local_cork = 1;
			}
1763
			sctp_cmd_send_msg(asoc, cmd->obj.msg, gfp);
1764
			break;
1765 1766 1767
		case SCTP_CMD_PURGE_ASCONF_QUEUE:
			sctp_asconf_queue_teardown(asoc);
			break;
1768 1769

		case SCTP_CMD_SET_ASOC:
1770 1771 1772 1773
			if (asoc && local_cork) {
				sctp_outq_uncork(&asoc->outqueue, gfp);
				local_cork = 0;
			}
1774 1775 1776
			asoc = cmd->obj.asoc;
			break;

L
Linus Torvalds 已提交
1777
		default:
1778 1779
			pr_warn("Impossible command: %u\n",
				cmd->verb);
L
Linus Torvalds 已提交
1780
			break;
1781 1782
		}

L
Linus Torvalds 已提交
1783 1784 1785 1786 1787
		if (error)
			break;
	}

out:
1788 1789 1790 1791 1792 1793
	/* If this is in response to a received chunk, wait until
	 * we are done with the packet to open the queue so that we don't
	 * send multiple packets in response to a single request.
	 */
	if (asoc && SCTP_EVENT_T_CHUNK == event_type && chunk) {
		if (chunk->end_of_packet || chunk->singleton)
1794
			sctp_outq_uncork(&asoc->outqueue, gfp);
1795
	} else if (local_cork)
1796
		sctp_outq_uncork(&asoc->outqueue, gfp);
1797

1798 1799 1800
	if (sp->data_ready_signalled)
		sp->data_ready_signalled = 0;

L
Linus Torvalds 已提交
1801 1802 1803 1804 1805
	return error;
nomem:
	error = -ENOMEM;
	goto out;
}