input.c 32.9 KB
Newer Older
1 2
/* RxRPC packet reception
 *
3
 * Copyright (C) 2007, 2016 Red Hat, Inc. All Rights Reserved.
4 5 6 7 8 9 10 11
 * Written by David Howells (dhowells@redhat.com)
 *
 * This program is free software; you can redistribute it and/or
 * modify it under the terms of the GNU General Public License
 * as published by the Free Software Foundation; either version
 * 2 of the License, or (at your option) any later version.
 */

12 13
#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt

14 15 16 17 18 19 20 21
#include <linux/module.h>
#include <linux/net.h>
#include <linux/skbuff.h>
#include <linux/errqueue.h>
#include <linux/udp.h>
#include <linux/in.h>
#include <linux/in6.h>
#include <linux/icmp.h>
22
#include <linux/gfp.h>
23 24 25
#include <net/sock.h>
#include <net/af_rxrpc.h>
#include <net/ip.h>
26
#include <net/udp.h>
27
#include <net/net_namespace.h>
28 29
#include "ar-internal.h"

30 31 32
static void rxrpc_proto_abort(const char *why,
			      struct rxrpc_call *call, rxrpc_seq_t seq)
{
33
	if (rxrpc_abort_call(why, call, seq, RX_PROTOCOL_ERROR, -EBADMSG)) {
34 35 36 37 38
		set_bit(RXRPC_CALL_EV_ABORT, &call->events);
		rxrpc_queue_call(call);
	}
}

David Howells's avatar
David Howells committed
39 40 41 42 43
/*
 * Do TCP-style congestion management [RFC 5681].
 */
static void rxrpc_congestion_management(struct rxrpc_call *call,
					struct sk_buff *skb,
44 45
					struct rxrpc_ack_summary *summary,
					rxrpc_serial_t acked_serial)
David Howells's avatar
David Howells committed
46 47 48 49 50 51 52 53 54 55 56 57 58 59
{
	enum rxrpc_congest_change change = rxrpc_cong_no_change;
	unsigned int cumulative_acks = call->cong_cumul_acks;
	unsigned int cwnd = call->cong_cwnd;
	bool resend = false;

	summary->flight_size =
		(call->tx_top - call->tx_hard_ack) - summary->nr_acks;

	if (test_and_clear_bit(RXRPC_CALL_RETRANS_TIMEOUT, &call->flags)) {
		summary->retrans_timeo = true;
		call->cong_ssthresh = max_t(unsigned int,
					    summary->flight_size / 2, 2);
		cwnd = 1;
60
		if (cwnd >= call->cong_ssthresh &&
David Howells's avatar
David Howells committed
61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84
		    call->cong_mode == RXRPC_CALL_SLOW_START) {
			call->cong_mode = RXRPC_CALL_CONGEST_AVOIDANCE;
			call->cong_tstamp = skb->tstamp;
			cumulative_acks = 0;
		}
	}

	cumulative_acks += summary->nr_new_acks;
	cumulative_acks += summary->nr_rot_new_acks;
	if (cumulative_acks > 255)
		cumulative_acks = 255;

	summary->mode = call->cong_mode;
	summary->cwnd = call->cong_cwnd;
	summary->ssthresh = call->cong_ssthresh;
	summary->cumulative_acks = cumulative_acks;
	summary->dup_acks = call->cong_dup_acks;

	switch (call->cong_mode) {
	case RXRPC_CALL_SLOW_START:
		if (summary->nr_nacks > 0)
			goto packet_loss_detected;
		if (summary->cumulative_acks > 0)
			cwnd += 1;
85
		if (cwnd >= call->cong_ssthresh) {
David Howells's avatar
David Howells committed
86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163
			call->cong_mode = RXRPC_CALL_CONGEST_AVOIDANCE;
			call->cong_tstamp = skb->tstamp;
		}
		goto out;

	case RXRPC_CALL_CONGEST_AVOIDANCE:
		if (summary->nr_nacks > 0)
			goto packet_loss_detected;

		/* We analyse the number of packets that get ACK'd per RTT
		 * period and increase the window if we managed to fill it.
		 */
		if (call->peer->rtt_usage == 0)
			goto out;
		if (ktime_before(skb->tstamp,
				 ktime_add_ns(call->cong_tstamp,
					      call->peer->rtt)))
			goto out_no_clear_ca;
		change = rxrpc_cong_rtt_window_end;
		call->cong_tstamp = skb->tstamp;
		if (cumulative_acks >= cwnd)
			cwnd++;
		goto out;

	case RXRPC_CALL_PACKET_LOSS:
		if (summary->nr_nacks == 0)
			goto resume_normality;

		if (summary->new_low_nack) {
			change = rxrpc_cong_new_low_nack;
			call->cong_dup_acks = 1;
			if (call->cong_extra > 1)
				call->cong_extra = 1;
			goto send_extra_data;
		}

		call->cong_dup_acks++;
		if (call->cong_dup_acks < 3)
			goto send_extra_data;

		change = rxrpc_cong_begin_retransmission;
		call->cong_mode = RXRPC_CALL_FAST_RETRANSMIT;
		call->cong_ssthresh = max_t(unsigned int,
					    summary->flight_size / 2, 2);
		cwnd = call->cong_ssthresh + 3;
		call->cong_extra = 0;
		call->cong_dup_acks = 0;
		resend = true;
		goto out;

	case RXRPC_CALL_FAST_RETRANSMIT:
		if (!summary->new_low_nack) {
			if (summary->nr_new_acks == 0)
				cwnd += 1;
			call->cong_dup_acks++;
			if (call->cong_dup_acks == 2) {
				change = rxrpc_cong_retransmit_again;
				call->cong_dup_acks = 0;
				resend = true;
			}
		} else {
			change = rxrpc_cong_progress;
			cwnd = call->cong_ssthresh;
			if (summary->nr_nacks == 0)
				goto resume_normality;
		}
		goto out;

	default:
		BUG();
		goto out;
	}

resume_normality:
	change = rxrpc_cong_cleared_nacks;
	call->cong_dup_acks = 0;
	call->cong_extra = 0;
	call->cong_tstamp = skb->tstamp;
164
	if (cwnd < call->cong_ssthresh)
David Howells's avatar
David Howells committed
165 166 167 168 169 170 171 172 173 174
		call->cong_mode = RXRPC_CALL_SLOW_START;
	else
		call->cong_mode = RXRPC_CALL_CONGEST_AVOIDANCE;
out:
	cumulative_acks = 0;
out_no_clear_ca:
	if (cwnd >= RXRPC_RXTX_BUFF_SIZE - 1)
		cwnd = RXRPC_RXTX_BUFF_SIZE - 1;
	call->cong_cwnd = cwnd;
	call->cong_cumul_acks = cumulative_acks;
175
	trace_rxrpc_congest(call, summary, acked_serial, change);
David Howells's avatar
David Howells committed
176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198
	if (resend && !test_and_set_bit(RXRPC_CALL_EV_RESEND, &call->events))
		rxrpc_queue_call(call);
	return;

packet_loss_detected:
	change = rxrpc_cong_saw_nack;
	call->cong_mode = RXRPC_CALL_PACKET_LOSS;
	call->cong_dup_acks = 0;
	goto send_extra_data;

send_extra_data:
	/* Send some previously unsent DATA if we have some to advance the ACK
	 * state.
	 */
	if (call->rxtx_annotations[call->tx_top & RXRPC_RXTX_BUFF_MASK] &
	    RXRPC_TX_ANNO_LAST ||
	    summary->nr_acks != call->tx_top - call->tx_hard_ack) {
		call->cong_extra++;
		wake_up(&call->waitq);
	}
	goto out_no_clear_ca;
}

199 200 201 202 203 204 205 206
/*
 * Ping the other end to fill our RTT cache and to retrieve the rwind
 * and MTU parameters.
 */
static void rxrpc_send_ping(struct rxrpc_call *call, struct sk_buff *skb,
			    int skew)
{
	struct rxrpc_skb_priv *sp = rxrpc_skb(skb);
207
	ktime_t now = skb->tstamp;
208

209 210 211
	if (call->peer->rtt_usage < 3 ||
	    ktime_before(ktime_add_ms(call->peer->rtt_last_req, 1000), now))
		rxrpc_propose_ACK(call, RXRPC_ACK_PING, skew, sp->hdr.serial,
212 213
				  true, true,
				  rxrpc_propose_ack_ping_for_params);
214 215
}

216
/*
217
 * Apply a hard ACK by advancing the Tx window.
218
 */
219
static bool rxrpc_rotate_tx_window(struct rxrpc_call *call, rxrpc_seq_t to,
220
				   struct rxrpc_ack_summary *summary)
221
{
222
	struct sk_buff *skb, *list = NULL;
223
	bool rot_last = false;
224
	int ix;
225
	u8 annotation;
226

227 228 229 230 231 232 233
	if (call->acks_lowest_nak == call->tx_hard_ack) {
		call->acks_lowest_nak = to;
	} else if (before_eq(call->acks_lowest_nak, to)) {
		summary->new_low_nack = true;
		call->acks_lowest_nak = to;
	}

234
	spin_lock(&call->lock);
235

236 237 238 239
	while (before(call->tx_hard_ack, to)) {
		call->tx_hard_ack++;
		ix = call->tx_hard_ack & RXRPC_RXTX_BUFF_MASK;
		skb = call->rxtx_buffer[ix];
240
		annotation = call->rxtx_annotations[ix];
David Howells's avatar
David Howells committed
241
		rxrpc_see_skb(skb, rxrpc_skb_tx_rotated);
242 243 244 245
		call->rxtx_buffer[ix] = NULL;
		call->rxtx_annotations[ix] = 0;
		skb->next = list;
		list = skb;
246

247
		if (annotation & RXRPC_TX_ANNO_LAST) {
248
			set_bit(RXRPC_CALL_TX_LAST, &call->flags);
249 250
			rot_last = true;
		}
251 252
		if ((annotation & RXRPC_TX_ANNO_MASK) != RXRPC_TX_ANNO_ACK)
			summary->nr_rot_new_acks++;
253
	}
254

255
	spin_unlock(&call->lock);
256

257
	trace_rxrpc_transmit(call, (rot_last ?
258 259
				    rxrpc_transmit_rotate_last :
				    rxrpc_transmit_rotate));
260 261
	wake_up(&call->waitq);

262 263 264 265
	while (list) {
		skb = list;
		list = skb->next;
		skb->next = NULL;
David Howells's avatar
David Howells committed
266
		rxrpc_free_skb(skb, rxrpc_skb_tx_freed);
267
	}
268 269

	return rot_last;
270
}
271

272 273 274 275 276 277
/*
 * End the transmission phase of a call.
 *
 * This occurs when we get an ACKALL packet, the first DATA packet of a reply,
 * or a final ACK packet.
 */
278 279
static bool rxrpc_end_tx_phase(struct rxrpc_call *call, bool reply_begun,
			       const char *abort_why)
280
{
281

282
	ASSERT(test_bit(RXRPC_CALL_TX_LAST, &call->flags));
283

284
	write_lock(&call->state_lock);
285

286
	switch (call->state) {
287
	case RXRPC_CALL_CLIENT_SEND_REQUEST:
288
	case RXRPC_CALL_CLIENT_AWAIT_REPLY:
289 290 291 292
		if (reply_begun)
			call->state = RXRPC_CALL_CLIENT_RECV_REPLY;
		else
			call->state = RXRPC_CALL_CLIENT_AWAIT_REPLY;
293
		break;
294

295 296 297 298
	case RXRPC_CALL_SERVER_AWAIT_ACK:
		__rxrpc_call_completed(call);
		rxrpc_notify_socket(call);
		break;
299 300 301

	default:
		goto bad_state;
302 303
	}

304
	write_unlock(&call->state_lock);
305
	if (call->state == RXRPC_CALL_CLIENT_AWAIT_REPLY) {
306 307
		rxrpc_propose_ACK(call, RXRPC_ACK_IDLE, 0, 0, false, true,
				  rxrpc_propose_ack_client_tx_end);
308 309 310 311
		trace_rxrpc_transmit(call, rxrpc_transmit_await_reply);
	} else {
		trace_rxrpc_transmit(call, rxrpc_transmit_end);
	}
312 313
	_leave(" = ok");
	return true;
314 315 316 317 318 319 320 321 322 323 324 325 326

bad_state:
	write_unlock(&call->state_lock);
	kdebug("end_tx %s", rxrpc_call_states[call->state]);
	rxrpc_proto_abort(abort_why, call, call->tx_top);
	return false;
}

/*
 * Begin the reply reception phase of a call.
 */
static bool rxrpc_receiving_reply(struct rxrpc_call *call)
{
327
	struct rxrpc_ack_summary summary = { 0 };
328 329
	rxrpc_seq_t top = READ_ONCE(call->tx_top);

330 331 332 333 334 335
	if (call->ackr_reason) {
		spin_lock_bh(&call->lock);
		call->ackr_reason = 0;
		call->resend_at = call->expire_at;
		call->ack_at = call->expire_at;
		spin_unlock_bh(&call->lock);
336 337
		rxrpc_set_timer(call, rxrpc_timer_init_for_reply,
				ktime_get_real());
338 339
	}

340
	if (!test_bit(RXRPC_CALL_TX_LAST, &call->flags)) {
341 342 343 344
		if (!rxrpc_rotate_tx_window(call, top, &summary)) {
			rxrpc_proto_abort("TXL", call, top);
			return false;
		}
345 346 347 348 349
	}
	if (!rxrpc_end_tx_phase(call, true, "ETD"))
		return false;
	call->tx_phase = false;
	return true;
350 351 352 353 354 355 356 357 358 359 360 361 362 363 364 365 366
}

/*
 * Scan a jumbo packet to validate its structure and to work out how many
 * subpackets it contains.
 *
 * A jumbo packet is a collection of consecutive packets glued together with
 * little headers between that indicate how to change the initial header for
 * each subpacket.
 *
 * RXRPC_JUMBO_PACKET must be set on all but the last subpacket - and all but
 * the last are RXRPC_JUMBO_DATALEN in size.  The last subpacket may be of any
 * size.
 */
static bool rxrpc_validate_jumbo(struct sk_buff *skb)
{
	struct rxrpc_skb_priv *sp = rxrpc_skb(skb);
367
	unsigned int offset = sizeof(struct rxrpc_wire_header);
368
	unsigned int len = skb->len;
369 370 371 372 373 374 375 376 377 378 379 380 381 382 383 384 385
	int nr_jumbo = 1;
	u8 flags = sp->hdr.flags;

	do {
		nr_jumbo++;
		if (len - offset < RXRPC_JUMBO_SUBPKTLEN)
			goto protocol_error;
		if (flags & RXRPC_LAST_PACKET)
			goto protocol_error;
		offset += RXRPC_JUMBO_DATALEN;
		if (skb_copy_bits(skb, offset, &flags, 1) < 0)
			goto protocol_error;
		offset += sizeof(struct rxrpc_jumbo_header);
	} while (flags & RXRPC_JUMBO_PACKET);

	sp->nr_jumbo = nr_jumbo;
	return true;
386

387 388
protocol_error:
	return false;
389 390 391
}

/*
392 393 394 395 396 397 398 399 400 401 402
 * Handle reception of a duplicate packet.
 *
 * We have to take care to avoid an attack here whereby we're given a series of
 * jumbograms, each with a sequence number one before the preceding one and
 * filled up to maximum UDP size.  If they never send us the first packet in
 * the sequence, they can cause us to have to hold on to around 2MiB of kernel
 * space until the call times out.
 *
 * We limit the space usage by only accepting three duplicate jumbo packets per
 * call.  After that, we tell the other side we're no longer accepting jumbos
 * (that information is encoded in the ACK packet).
403
 */
404
static void rxrpc_input_dup_data(struct rxrpc_call *call, rxrpc_seq_t seq,
405
				 u8 annotation, bool *_jumbo_bad)
406
{
407 408 409
	/* Discard normal packets that are duplicates. */
	if (annotation == 0)
		return;
410

411 412 413 414
	/* Skip jumbo subpackets that are duplicates.  When we've had three or
	 * more partially duplicate jumbo packets, we refuse to take any more
	 * jumbos for this call.
	 */
415 416 417
	if (!*_jumbo_bad) {
		call->nr_jumbo_bad++;
		*_jumbo_bad = true;
418 419
	}
}
420

421 422 423 424 425 426 427
/*
 * Process a DATA packet, adding the packet to the Rx ring.
 */
static void rxrpc_input_data(struct rxrpc_call *call, struct sk_buff *skb,
			     u16 skew)
{
	struct rxrpc_skb_priv *sp = rxrpc_skb(skb);
428
	enum rxrpc_call_state state;
429
	unsigned int offset = sizeof(struct rxrpc_wire_header);
430 431 432
	unsigned int ix;
	rxrpc_serial_t serial = sp->hdr.serial, ack_serial = 0;
	rxrpc_seq_t seq = sp->hdr.seq, hard_ack;
433
	bool immediate_ack = false, jumbo_bad = false, queued;
434 435
	u16 len;
	u8 ack = 0, flags, annotation = 0;
436

437
	_enter("{%u,%u},{%u,%u}",
438
	       call->rx_hard_ack, call->rx_top, skb->len, seq);
439

440 441
	_proto("Rx DATA %%%u { #%u f=%02x }",
	       sp->hdr.serial, seq, sp->hdr.flags);
442

443 444
	state = READ_ONCE(call->state);
	if (state >= RXRPC_CALL_COMPLETE)
445
		return;
446

447 448 449
	/* Received data implicitly ACKs all of the request packets we sent
	 * when we're acting as a client.
	 */
450 451
	if ((state == RXRPC_CALL_CLIENT_SEND_REQUEST ||
	     state == RXRPC_CALL_CLIENT_AWAIT_REPLY) &&
452
	    !rxrpc_receiving_reply(call))
453
		return;
454

455
	call->ackr_prev_seq = seq;
456

457 458
	hard_ack = READ_ONCE(call->rx_hard_ack);
	if (after(seq, hard_ack + call->rx_winsize)) {
459
		ack = RXRPC_ACK_EXCEEDS_WINDOW;
460 461
		ack_serial = serial;
		goto ack;
462 463
	}

464 465
	flags = sp->hdr.flags;
	if (flags & RXRPC_JUMBO_PACKET) {
466
		if (call->nr_jumbo_bad > 3) {
467 468 469
			ack = RXRPC_ACK_NOSPACE;
			ack_serial = serial;
			goto ack;
470
		}
471
		annotation = 1;
472 473
	}

474 475 476
next_subpacket:
	queued = false;
	ix = seq & RXRPC_RXTX_BUFF_MASK;
477
	len = skb->len;
478 479 480 481
	if (flags & RXRPC_JUMBO_PACKET)
		len = RXRPC_JUMBO_DATALEN;

	if (flags & RXRPC_LAST_PACKET) {
482
		if (test_bit(RXRPC_CALL_RX_LAST, &call->flags) &&
483 484 485 486 487 488
		    seq != call->rx_top)
			return rxrpc_proto_abort("LSN", call, seq);
	} else {
		if (test_bit(RXRPC_CALL_RX_LAST, &call->flags) &&
		    after_eq(seq, call->rx_top))
			return rxrpc_proto_abort("LSA", call, seq);
489 490
	}

David Howells's avatar
David Howells committed
491
	trace_rxrpc_rx_data(call, seq, serial, flags, annotation);
492 493 494 495 496 497 498 499 500 501 502 503
	if (before_eq(seq, hard_ack)) {
		ack = RXRPC_ACK_DUPLICATE;
		ack_serial = serial;
		goto skip;
	}

	if (flags & RXRPC_REQUEST_ACK && !ack) {
		ack = RXRPC_ACK_REQUESTED;
		ack_serial = serial;
	}

	if (call->rxtx_buffer[ix]) {
504
		rxrpc_input_dup_data(call, seq, annotation, &jumbo_bad);
505 506 507
		if (ack != RXRPC_ACK_DUPLICATE) {
			ack = RXRPC_ACK_DUPLICATE;
			ack_serial = serial;
508
		}
509 510
		immediate_ack = true;
		goto skip;
511 512
	}

513 514 515 516 517 518 519 520
	/* Queue the packet.  We use a couple of memory barriers here as need
	 * to make sure that rx_top is perceived to be set after the buffer
	 * pointer and that the buffer pointer is set after the annotation and
	 * the skb data.
	 *
	 * Barriers against rxrpc_recvmsg_data() and rxrpc_rotate_rx_window()
	 * and also rxrpc_fill_out_ack().
	 */
David Howells's avatar
David Howells committed
521
	rxrpc_get_skb(skb, rxrpc_skb_rx_got);
522 523 524
	call->rxtx_annotations[ix] = annotation;
	smp_wmb();
	call->rxtx_buffer[ix] = skb;
525
	if (after(seq, call->rx_top)) {
526
		smp_store_release(&call->rx_top, seq);
527 528 529 530 531 532 533 534
	} else if (before(seq, call->rx_top)) {
		/* Send an immediate ACK if we fill in a hole */
		if (!ack) {
			ack = RXRPC_ACK_DELAY;
			ack_serial = serial;
		}
		immediate_ack = true;
	}
535
	if (flags & RXRPC_LAST_PACKET) {
536
		set_bit(RXRPC_CALL_RX_LAST, &call->flags);
537 538 539 540
		trace_rxrpc_receive(call, rxrpc_receive_queue_last, serial, seq);
	} else {
		trace_rxrpc_receive(call, rxrpc_receive_queue, serial, seq);
	}
541 542 543 544 545 546 547 548 549
	queued = true;

	if (after_eq(seq, call->rx_expect_next)) {
		if (after(seq, call->rx_expect_next)) {
			_net("OOS %u > %u", seq, call->rx_expect_next);
			ack = RXRPC_ACK_OUT_OF_SEQUENCE;
			ack_serial = serial;
		}
		call->rx_expect_next = seq + 1;
550 551
	}

552 553 554 555 556 557 558 559 560 561 562
skip:
	offset += len;
	if (flags & RXRPC_JUMBO_PACKET) {
		if (skb_copy_bits(skb, offset, &flags, 1) < 0)
			return rxrpc_proto_abort("XJF", call, seq);
		offset += sizeof(struct rxrpc_jumbo_header);
		seq++;
		serial++;
		annotation++;
		if (flags & RXRPC_JUMBO_PACKET)
			annotation |= RXRPC_RX_ANNO_JLAST;
563 564 565 566 567 568 569 570 571
		if (after(seq, hard_ack + call->rx_winsize)) {
			ack = RXRPC_ACK_EXCEEDS_WINDOW;
			ack_serial = serial;
			if (!jumbo_bad) {
				call->nr_jumbo_bad++;
				jumbo_bad = true;
			}
			goto ack;
		}
572 573 574 575

		_proto("Rx DATA Jumbo %%%u", serial);
		goto next_subpacket;
	}
576

577 578 579 580
	if (queued && flags & RXRPC_LAST_PACKET && !ack) {
		ack = RXRPC_ACK_DELAY;
		ack_serial = serial;
	}
581

582 583 584
ack:
	if (ack)
		rxrpc_propose_ACK(call, ack, skew, ack_serial,
585 586
				  immediate_ack, true,
				  rxrpc_propose_ack_input_data);
587

588 589 590
	if (sp->hdr.seq == READ_ONCE(call->rx_hard_ack) + 1)
		rxrpc_notify_socket(call);
	_leave(" [queued]");
591 592
}

593 594 595 596 597 598 599 600 601 602 603 604 605 606 607 608 609 610 611 612 613 614 615 616 617 618 619 620 621 622 623 624
/*
 * Process a requested ACK.
 */
static void rxrpc_input_requested_ack(struct rxrpc_call *call,
				      ktime_t resp_time,
				      rxrpc_serial_t orig_serial,
				      rxrpc_serial_t ack_serial)
{
	struct rxrpc_skb_priv *sp;
	struct sk_buff *skb;
	ktime_t sent_at;
	int ix;

	for (ix = 0; ix < RXRPC_RXTX_BUFF_SIZE; ix++) {
		skb = call->rxtx_buffer[ix];
		if (!skb)
			continue;

		sp = rxrpc_skb(skb);
		if (sp->hdr.serial != orig_serial)
			continue;
		smp_rmb();
		sent_at = skb->tstamp;
		goto found;
	}
	return;

found:
	rxrpc_peer_add_rtt(call, rxrpc_rtt_rx_requested_ack,
			   orig_serial, ack_serial, sent_at, resp_time);
}

625 626 627 628 629 630 631 632 633 634 635
/*
 * Process a ping response.
 */
static void rxrpc_input_ping_response(struct rxrpc_call *call,
				      ktime_t resp_time,
				      rxrpc_serial_t orig_serial,
				      rxrpc_serial_t ack_serial)
{
	rxrpc_serial_t ping_serial;
	ktime_t ping_time;

636
	ping_time = call->ping_time;
637
	smp_rmb();
638
	ping_serial = call->ping_serial;
639 640 641 642 643 644 645 646 647 648 649 650

	if (!test_bit(RXRPC_CALL_PINGING, &call->flags) ||
	    before(orig_serial, ping_serial))
		return;
	clear_bit(RXRPC_CALL_PINGING, &call->flags);
	if (after(orig_serial, ping_serial))
		return;

	rxrpc_peer_add_rtt(call, rxrpc_rtt_rx_ping_response,
			   orig_serial, ack_serial, ping_time, resp_time);
}

651
/*
652
 * Process the extra information that may be appended to an ACK packet
653
 */
654 655
static void rxrpc_input_ackinfo(struct rxrpc_call *call, struct sk_buff *skb,
				struct rxrpc_ackinfo *ackinfo)
656
{
657 658 659
	struct rxrpc_skb_priv *sp = rxrpc_skb(skb);
	struct rxrpc_peer *peer;
	unsigned int mtu;
660
	bool wake = false;
661
	u32 rwind = ntohl(ackinfo->rwind);
662 663 664 665

	_proto("Rx ACK %%%u Info { rx=%u max=%u rwin=%u jm=%u }",
	       sp->hdr.serial,
	       ntohl(ackinfo->rxMTU), ntohl(ackinfo->maxMTU),
666
	       rwind, ntohl(ackinfo->jumbo_max));
667

668 669 670 671 672
	if (call->tx_winsize != rwind) {
		if (rwind > RXRPC_RXTX_BUFF_SIZE - 1)
			rwind = RXRPC_RXTX_BUFF_SIZE - 1;
		if (rwind > call->tx_winsize)
			wake = true;
673 674
		trace_rxrpc_rx_rwind_change(call, sp->hdr.serial,
					    ntohl(ackinfo->rwind), wake);
675 676 677
		call->tx_winsize = rwind;
	}

678 679
	if (call->cong_ssthresh > rwind)
		call->cong_ssthresh = rwind;
680 681 682 683 684 685 686 687 688 689 690

	mtu = min(ntohl(ackinfo->rxMTU), ntohl(ackinfo->maxMTU));

	peer = call->peer;
	if (mtu < peer->maxdata) {
		spin_lock_bh(&peer->lock);
		peer->maxdata = mtu;
		peer->mtu = mtu + peer->hdrsize;
		spin_unlock_bh(&peer->lock);
		_net("Net MTU %u (maxdata %u)", peer->mtu, peer->maxdata);
	}
691 692 693

	if (wake)
		wake_up(&call->waitq);
694
}
695

696 697 698 699 700 701 702 703 704 705
/*
 * Process individual soft ACKs.
 *
 * Each ACK in the array corresponds to one packet and can be either an ACK or
 * a NAK.  If we get find an explicitly NAK'd packet we resend immediately;
 * packets that lie beyond the end of the ACK list are scheduled for resend by
 * the timer on the basis that the peer might just not have processed them at
 * the time the ACK was sent.
 */
static void rxrpc_input_soft_acks(struct rxrpc_call *call, u8 *acks,
706 707
				  rxrpc_seq_t seq, int nr_acks,
				  struct rxrpc_ack_summary *summary)
708 709
{
	int ix;
710
	u8 annotation, anno_type;
711 712 713

	for (; nr_acks > 0; nr_acks--, seq++) {
		ix = seq & RXRPC_RXTX_BUFF_MASK;
714 715 716
		annotation = call->rxtx_annotations[ix];
		anno_type = annotation & RXRPC_TX_ANNO_MASK;
		annotation &= ~RXRPC_TX_ANNO_MASK;
717
		switch (*acks++) {
718
		case RXRPC_ACK_TYPE_ACK:
719
			summary->nr_acks++;
720 721
			if (anno_type == RXRPC_TX_ANNO_ACK)
				continue;
722
			summary->nr_new_acks++;
723 724
			call->rxtx_annotations[ix] =
				RXRPC_TX_ANNO_ACK | annotation;
725 726
			break;
		case RXRPC_ACK_TYPE_NACK:
727 728 729 730 731 732
			if (!summary->nr_nacks &&
			    call->acks_lowest_nak != seq) {
				call->acks_lowest_nak = seq;
				summary->new_low_nack = true;
			}
			summary->nr_nacks++;
733
			if (anno_type == RXRPC_TX_ANNO_NAK)
734
				continue;
735
			summary->nr_new_nacks++;
736 737
			if (anno_type == RXRPC_TX_ANNO_RETRANS)
				continue;
738 739
			call->rxtx_annotations[ix] =
				RXRPC_TX_ANNO_NAK | annotation;
740 741 742
			break;
		default:
			return rxrpc_proto_abort("SFT", call, 0);
743 744 745 746 747
		}
	}
}

/*
748 749 750 751 752 753 754 755
 * Process an ACK packet.
 *
 * ack.firstPacket is the sequence number of the first soft-ACK'd/NAK'd packet
 * in the ACK array.  Anything before that is hard-ACK'd and may be discarded.
 *
 * A hard-ACK means that a packet has been processed and may be discarded; a
 * soft-ACK means that the packet may be discarded and retransmission
 * requested.  A phase is complete when all packets are hard-ACK'd.
756
 */
757 758
static void rxrpc_input_ack(struct rxrpc_call *call, struct sk_buff *skb,
			    u16 skew)
759
{
760
	struct rxrpc_ack_summary summary = { 0 };
761
	struct rxrpc_skb_priv *sp = rxrpc_skb(skb);
762 763 764 765 766
	union {
		struct rxrpc_ackpacket ack;
		struct rxrpc_ackinfo info;
		u8 acks[RXRPC_MAXACKS];
	} buf;
767
	rxrpc_serial_t acked_serial;
768
	rxrpc_seq_t first_soft_ack, hard_ack;
769
	int nr_acks, offset, ioffset;
770 771 772

	_enter("");

773 774
	offset = sizeof(struct rxrpc_wire_header);
	if (skb_copy_bits(skb, offset, &buf.ack, sizeof(buf.ack)) < 0) {
775 776
		_debug("extraction failure");
		return rxrpc_proto_abort("XAK", call, 0);
777
	}
778
	offset += sizeof(buf.ack);
779

780
	acked_serial = ntohl(buf.ack.serial);
781 782 783
	first_soft_ack = ntohl(buf.ack.firstPacket);
	hard_ack = first_soft_ack - 1;
	nr_acks = buf.ack.nAcks;
784 785
	summary.ack_reason = (buf.ack.reason < RXRPC_ACK__INVALID ?
			      buf.ack.reason : RXRPC_ACK__INVALID);
786

David Howells's avatar
David Howells committed
787 788 789
	trace_rxrpc_rx_ack(call, sp->hdr.serial, acked_serial,
			   first_soft_ack, ntohl(buf.ack.previousPacket),
			   summary.ack_reason, nr_acks);
790

791 792 793
	if (buf.ack.reason == RXRPC_ACK_PING_RESPONSE)
		rxrpc_input_ping_response(call, skb->tstamp, acked_serial,
					  sp->hdr.serial);
794 795 796
	if (buf.ack.reason == RXRPC_ACK_REQUESTED)
		rxrpc_input_requested_ack(call, skb->tstamp, acked_serial,
					  sp->hdr.serial);
797

798 799 800
	if (buf.ack.reason == RXRPC_ACK_PING) {
		_proto("Rx ACK %%%u PING Request", sp->hdr.serial);
		rxrpc_propose_ACK(call, RXRPC_ACK_PING_RESPONSE,
801 802
				  skew, sp->hdr.serial, true, true,
				  rxrpc_propose_ack_respond_to_ping);
803
	} else if (sp->hdr.flags & RXRPC_REQUEST_ACK) {
804
		rxrpc_propose_ACK(call, RXRPC_ACK_REQUESTED,
805 806
				  skew, sp->hdr.serial, true, true,
				  rxrpc_propose_ack_respond_to_ack);
807 808
	}

809 810 811 812 813 814 815 816 817 818
	/* Discard any out-of-order or duplicate ACKs. */
	if (before_eq(sp->hdr.serial, call->acks_latest)) {
		_debug("discard ACK %d <= %d",
		       sp->hdr.serial, call->acks_latest);
		return;
	}
	call->acks_latest_ts = skb->tstamp;
	call->acks_latest = sp->hdr.serial;

	/* Parse rwind and mtu sizes if provided. */
819 820 821
	ioffset = offset + nr_acks + 3;
	if (skb->len >= ioffset + sizeof(buf.info)) {
		if (skb_copy_bits(skb, ioffset, &buf.info, sizeof(buf.info)) < 0)
822 823 824
			return rxrpc_proto_abort("XAI", call, 0);
		rxrpc_input_ackinfo(call, skb, &buf.info);
	}
825

826 827
	if (first_soft_ack == 0)
		return rxrpc_proto_abort("AK0", call, 0);
828

829
	/* Ignore ACKs unless we are or have just been transmitting. */
830
	switch (READ_ONCE(call->state)) {
831 832 833 834 835
	case RXRPC_CALL_CLIENT_SEND_REQUEST:
	case RXRPC_CALL_CLIENT_AWAIT_REPLY:
	case RXRPC_CALL_SERVER_SEND_REPLY:
	case RXRPC_CALL_SERVER_AWAIT_ACK:
		break;
836
	default:
837 838
		return;
	}
839

840 841 842
	if (before(hard_ack, call->tx_hard_ack) ||
	    after(hard_ack, call->tx_top))
		return rxrpc_proto_abort("AKW", call, 0);
843 844
	if (nr_acks > call->tx_top - hard_ack)
		return rxrpc_proto_abort("AKN", call, 0);
845

846 847 848 849 850 851
	if (after(hard_ack, call->tx_hard_ack)) {
		if (rxrpc_rotate_tx_window(call, hard_ack, &summary)) {
			rxrpc_end_tx_phase(call, false, "ETA");
			return;
		}
	}
852

853
	if (nr_acks > 0) {
854
		if (skb_copy_bits(skb, offset, buf.acks, nr_acks) < 0)
855
			return rxrpc_proto_abort("XSA", call, 0);
856 857
		rxrpc_input_soft_acks(call, buf.acks, first_soft_ack, nr_acks,
				      &summary);
858 859
	}

860 861
	if (call->rxtx_annotations[call->tx_top & RXRPC_RXTX_BUFF_MASK] &
	    RXRPC_TX_ANNO_LAST &&
862 863
	    summary.nr_acks == call->tx_top - hard_ack &&
	    rxrpc_is_client_call(call))
864 865 866
		rxrpc_propose_ACK(call, RXRPC_ACK_PING, skew, sp->hdr.serial,
				  false, true,
				  rxrpc_propose_ack_ping_for_lost_reply);
David Howells's avatar
David Howells committed
867

868
	return rxrpc_congestion_management(call, skb, &summary, acked_serial);
869 870 871
}

/*
872
 * Process an ACKALL packet.
873
 */
874
static void rxrpc_input_ackall(struct rxrpc_call *call, struct sk_buff *skb)
875
{
876
	struct rxrpc_ack_summary summary = { 0 };
877
	struct rxrpc_skb_priv *sp = rxrpc_skb(skb);
878

879
	_proto("Rx ACKALL %%%u", sp->hdr.serial);
880

881
	if (rxrpc_rotate_tx_window(call, call->tx_top, &summary))
882
		rxrpc_end_tx_phase(call, false, "ETL");
883
}
884

885
/*
David Howells's avatar
David Howells committed
886
 * Process an ABORT packet directed at a call.
887 888 889 890 891 892
 */
static void rxrpc_input_abort(struct rxrpc_call *call, struct sk_buff *skb)
{
	struct rxrpc_skb_priv *sp = rxrpc_skb(skb);
	__be32 wtmp;
	u32 abort_code = RX_CALL_DEAD;
893

894
	_enter("");
895

896
	if (skb->len >= 4 &&
897 898
	    skb_copy_bits(skb, sizeof(struct rxrpc_wire_header),
			  &wtmp, sizeof(wtmp)) >= 0)
899
		abort_code = ntohl(wtmp);
900

David Howells's avatar
David Howells committed
901 902
	trace_rxrpc_rx_abort(call, sp->hdr.serial, abort_code);

903
	_proto("Rx ABORT %%%u { %x }", sp->hdr.serial, abort_code);
904

905
	if (rxrpc_set_call_completion(call, RXRPC_CALL_REMOTELY_ABORTED,
906
				      abort_code, -ECONNABORTED))
907
		rxrpc_notify_socket(call);
908 909 910
}

/*
911
 * Process an incoming call packet.
912
 */
913 914
static void rxrpc_input_call_packet(struct rxrpc_call *call,
				    struct sk_buff *skb, u16 skew)
915
{
916
	struct rxrpc_skb_priv *sp = rxrpc_skb(skb);
917

918
	_enter("%p,%p", call, skb);
919

920 921 922 923
	switch (sp->hdr.type) {
	case RXRPC_PACKET_TYPE_DATA:
		rxrpc_input_data(call, skb, skew);
		break;
924

925 926
	case RXRPC_PACKET_TYPE_ACK:
		rxrpc_input_ack(call, skb, skew);
927 928
		break;

929 930
	case RXRPC_PACKET_TYPE_BUSY:
		_proto("Rx BUSY %%%u", sp->hdr.serial);
931

932 933 934 935 936
		/* Just ignore BUSY packets from the server; the retry and
		 * lifespan timers will take care of business.  BUSY packets
		 * from the client don't make sense.
		 */
		break;
937

938 939 940
	case RXRPC_PACKET_TYPE_ABORT:
		rxrpc_input_abort(call, skb);
		break;
941

942 943 944
	case RXRPC_PACKET_TYPE_ACKALL:
		rxrpc_input_ackall(call, skb);
		break;
945

946 947
	default:
		break;
948
	}
949

950 951 952
	_leave("");
}

953 954 955 956 957 958 959 960 961
/*
 * Handle a new call on a channel implicitly completing the preceding call on
 * that channel.
 *
 * TODO: If callNumber > call_id + 1, renegotiate security.
 */
static void rxrpc_input_implicit_end_call(struct rxrpc_connection *conn,
					  struct rxrpc_call *call)
{
962
	switch (READ_ONCE(call->state)) {
963 964 965 966 967 968
	case RXRPC_CALL_SERVER_AWAIT_ACK:
		rxrpc_call_completed(call);
		break;
	case RXRPC_CALL_COMPLETE:
		break;
	default:
969
		if (rxrpc_abort_call("IMP", call, 0, RX_CALL_DEAD, -ESHUTDOWN)) {
970 971 972 973 974 975
			set_bit(RXRPC_CALL_EV_ABORT, &call->events);
			rxrpc_queue_call(call);
		}
		break;
	}

David Howells's avatar
David Howells committed
976
	trace_rxrpc_improper_term(call);
977 978 979 980
	__rxrpc_disconnect_call(conn, call);
	rxrpc_notify_socket(call);
}

981 982
/*
 * post connection-level events to the connection
983 984
 * - this includes challenges, responses, some aborts and call terminal packet
 *   retransmission.
985
 */
986
static void rxrpc_post_packet_to_conn(struct rxrpc_connection *conn,
987 988 989 990 991
				      struct sk_buff *skb)
{
	_enter("%p,%p", conn, skb);

	skb_queue_tail(&conn->rx_queue, skb);
992
	rxrpc_queue_conn(conn);
993 994
}

995 996 997 998 999 1000 1001 1002 1003 1004
/*
 * post endpoint-level events to the local endpoint
 * - this includes debug and version messages
 */
static void rxrpc_post_packet_to_local(struct rxrpc_local *local,
				       struct sk_buff *skb)
{
	_enter("%p,%p", local, skb);

	skb_queue_tail(&local->event_queue, skb);
1005
	rxrpc_queue_local(local);
1006 1007
}

1008 1009 1010 1011 1012 1013 1014 1015 1016 1017 1018
/*
 * put a packet up for transport-level abort
 */
static void rxrpc_reject_packet(struct rxrpc_local *local, struct sk_buff *skb)
{
	CHECK_SLAB_OKAY(&local->usage);

	skb_queue_tail(&local->reject_queue, skb);
	rxrpc_queue_local(local);
}

1019 1020 1021 1022 1023 1024 1025 1026 1027
/*
 * Extract the wire header from a packet and translate the byte order.
 */
static noinline
int rxrpc_extract_header(struct rxrpc_skb_priv *sp, struct sk_buff *skb)
{
	struct rxrpc_wire_header whdr;

	/* dig out the RxRPC connection details */
1028 1029 1030
	if (skb_copy_bits(skb, 0, &whdr, sizeof(whdr)) < 0) {
		trace_rxrpc_rx_eproto(NULL, sp->hdr.serial,
				      tracepoint_string("bad_hdr"));
1031
		return -EBADMSG;
1032
	}