net/rxrpc/call_event.c

   1 /* Management of Tx window, Tx resend, ACKs and out-of-sequence reception
   2  *
   3  * Copyright (C) 2007 Red Hat, Inc. All Rights Reserved.
   4  * Written by David Howells (dhowells@redhat.com)
   5  *
   6  * This program is free software; you can redistribute it and/or
   7  * modify it under the terms of the GNU General Public License
   8  * as published by the Free Software Foundation; either version
   9  * 2 of the License, or (at your option) any later version.
  10  */
  11
  12 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
  13
  14 #include <linux/module.h>
  15 #include <linux/circ_buf.h>
  16 #include <linux/net.h>
  17 #include <linux/skbuff.h>
  18 #include <linux/slab.h>
  19 #include <linux/udp.h>
  20 #include <net/sock.h>
  21 #include <net/af_rxrpc.h>
  22 #include "ar-internal.h"
  23
  24 /*
  25  * propose an ACK be sent
  26  */
  27 void __rxrpc_propose_ACK(struct rxrpc_call *call, u8 ack_reason,
  28                          u16 skew, u32 serial, bool immediate)
  29 {
  30         unsigned long expiry;
  31         s8 prior = rxrpc_ack_priority[ack_reason];
  32
  33         ASSERTCMP(prior, >, 0);
  34
  35         _enter("{%d},%s,%%%x,%u",
  36                call->debug_id, rxrpc_acks(ack_reason), serial, immediate);
  37
  38         if (prior < rxrpc_ack_priority[call->ackr_reason]) {
  39                 if (immediate)
  40                         goto cancel_timer;
  41                 return;
  42         }
  43
  44         /* update DELAY, IDLE, REQUESTED and PING_RESPONSE ACK serial
  45          * numbers */
  46         if (prior == rxrpc_ack_priority[call->ackr_reason]) {
  47                 if (prior <= 4) {
  48                         call->ackr_skew = skew;
  49                         call->ackr_serial = serial;
  50                 }
  51                 if (immediate)
  52                         goto cancel_timer;
  53                 return;
  54         }
  55
  56         call->ackr_reason = ack_reason;
  57         call->ackr_serial = serial;
  58
  59         switch (ack_reason) {
  60         case RXRPC_ACK_DELAY:
  61                 _debug("run delay timer");
  62                 expiry = rxrpc_soft_ack_delay;
  63                 goto run_timer;
  64
  65         case RXRPC_ACK_IDLE:
  66                 if (!immediate) {
  67                         _debug("run defer timer");
  68                         expiry = rxrpc_idle_ack_delay;
  69                         goto run_timer;
  70                 }
  71                 goto cancel_timer;
  72
  73         case RXRPC_ACK_REQUESTED:
  74                 expiry = rxrpc_requested_ack_delay;
  75                 if (!expiry)
  76                         goto cancel_timer;
  77                 if (!immediate || serial == 1) {
  78                         _debug("run defer timer");
  79                         goto run_timer;
  80                 }
  81
  82         default:
  83                 _debug("immediate ACK");
  84                 goto cancel_timer;
  85         }
  86
  87 run_timer:
  88         expiry += jiffies;
  89         if (!timer_pending(&call->ack_timer) ||
  90             time_after(call->ack_timer.expires, expiry))
  91                 mod_timer(&call->ack_timer, expiry);
  92         return;
  93
  94 cancel_timer:
  95         _debug("cancel timer %%%u", serial);
  96         try_to_del_timer_sync(&call->ack_timer);
  97         read_lock_bh(&call->state_lock);
  98         if (call->state <= RXRPC_CALL_COMPLETE &&
  99             !test_and_set_bit(RXRPC_CALL_EV_ACK, &call->events))
 100                 rxrpc_queue_call(call);
 101         read_unlock_bh(&call->state_lock);
 102 }
 103
 104 /*
 105  * propose an ACK be sent, locking the call structure
 106  */
 107 void rxrpc_propose_ACK(struct rxrpc_call *call, u8 ack_reason,
 108                        u16 skew, u32 serial, bool immediate)
 109 {
 110         s8 prior = rxrpc_ack_priority[ack_reason];
 111
 112         if (prior > rxrpc_ack_priority[call->ackr_reason]) {
 113                 spin_lock_bh(&call->lock);
 114                 __rxrpc_propose_ACK(call, ack_reason, skew, serial, immediate);
 115                 spin_unlock_bh(&call->lock);
 116         }
 117 }
 118
 119 /*
 120  * set the resend timer
 121  */
 122 static void rxrpc_set_resend(struct rxrpc_call *call, u8 resend,
 123                              unsigned long resend_at)
 124 {
 125         read_lock_bh(&call->state_lock);
 126         if (call->state >= RXRPC_CALL_COMPLETE)
 127                 resend = 0;
 128
 129         if (resend & 1) {
 130                 _debug("SET RESEND");
 131                 set_bit(RXRPC_CALL_EV_RESEND, &call->events);
 132         }
 133
 134         if (resend & 2) {
 135                 _debug("MODIFY RESEND TIMER");
 136                 set_bit(RXRPC_CALL_RUN_RTIMER, &call->flags);
 137                 mod_timer(&call->resend_timer, resend_at);
 138         } else {
 139                 _debug("KILL RESEND TIMER");
 140                 del_timer_sync(&call->resend_timer);
 141                 clear_bit(RXRPC_CALL_EV_RESEND_TIMER, &call->events);
 142                 clear_bit(RXRPC_CALL_RUN_RTIMER, &call->flags);
 143         }
 144         read_unlock_bh(&call->state_lock);
 145 }
 146
 147 /*
 148  * resend packets
 149  */
 150 static void rxrpc_resend(struct rxrpc_call *call)
 151 {
 152         struct rxrpc_wire_header *whdr;
 153         struct rxrpc_skb_priv *sp;
 154         struct sk_buff *txb;
 155         unsigned long *p_txb, resend_at;
 156         bool stop;
 157         int loop;
 158         u8 resend;
 159
 160         _enter("{%d,%d,%d,%d},",
 161                call->acks_hard, call->acks_unacked,
 162                atomic_read(&call->sequence),
 163                CIRC_CNT(call->acks_head, call->acks_tail, call->acks_winsz));
 164
 165         stop = false;
 166         resend = 0;
 167         resend_at = 0;
 168
 169         for (loop = call->acks_tail;
 170              loop != call->acks_head || stop;
 171              loop = (loop + 1) &  (call->acks_winsz - 1)
 172              ) {
 173                 p_txb = call->acks_window + loop;
 174                 smp_read_barrier_depends();
 175                 if (*p_txb & 1)
 176                         continue;
 177
 178                 txb = (struct sk_buff *) *p_txb;
 179                 sp = rxrpc_skb(txb);
 180
 181                 if (sp->need_resend) {
 182                         sp->need_resend = false;
 183
 184                         /* each Tx packet has a new serial number */
 185                         sp->hdr.serial = atomic_inc_return(&call->conn->serial);
 186
 187                         whdr = (struct rxrpc_wire_header *)txb->head;
 188                         whdr->serial = htonl(sp->hdr.serial);
 189
 190                         _proto("Tx DATA %%%u { #%d }",
 191                                sp->hdr.serial, sp->hdr.seq);
 192                         if (rxrpc_send_data_packet(call->conn, txb) < 0) {
 193                                 stop = true;
 194                                 sp->resend_at = jiffies + 3;
 195                         } else {
 196                                 if (rxrpc_is_client_call(call))
 197                                         rxrpc_expose_client_call(call);
 198                                 sp->resend_at =
 199                                         jiffies + rxrpc_resend_timeout;
 200                         }
 201                 }
 202
 203                 if (time_after_eq(jiffies + 1, sp->resend_at)) {
 204                         sp->need_resend = true;
 205                         resend |= 1;
 206                 } else if (resend & 2) {
 207                         if (time_before(sp->resend_at, resend_at))
 208                                 resend_at = sp->resend_at;
 209                 } else {
 210                         resend_at = sp->resend_at;
 211                         resend |= 2;
 212                 }
 213         }
 214
 215         rxrpc_set_resend(call, resend, resend_at);
 216         _leave("");
 217 }
 218
 219 /*
 220  * handle resend timer expiry
 221  */
 222 static void rxrpc_resend_timer(struct rxrpc_call *call)
 223 {
 224         struct rxrpc_skb_priv *sp;
 225         struct sk_buff *txb;
 226         unsigned long *p_txb, resend_at;
 227         int loop;
 228         u8 resend;
 229
 230         _enter("%d,%d,%d",
 231                call->acks_tail, call->acks_unacked, call->acks_head);
 232
 233         if (call->state >= RXRPC_CALL_COMPLETE)
 234                 return;
 235
 236         resend = 0;
 237         resend_at = 0;
 238
 239         for (loop = call->acks_unacked;
 240              loop != call->acks_head;
 241              loop = (loop + 1) &  (call->acks_winsz - 1)
 242              ) {
 243                 p_txb = call->acks_window + loop;
 244                 smp_read_barrier_depends();
 245                 txb = (struct sk_buff *) (*p_txb & ~1);
 246                 sp = rxrpc_skb(txb);
 247
 248                 ASSERT(!(*p_txb & 1));
 249
 250                 if (sp->need_resend) {
 251                         ;
 252                 } else if (time_after_eq(jiffies + 1, sp->resend_at)) {
 253                         sp->need_resend = true;
 254                         resend |= 1;
 255                 } else if (resend & 2) {
 256                         if (time_before(sp->resend_at, resend_at))
 257                                 resend_at = sp->resend_at;
 258                 } else {
 259                         resend_at = sp->resend_at;
 260                         resend |= 2;
 261                 }
 262         }
 263
 264         rxrpc_set_resend(call, resend, resend_at);
 265         _leave("");
 266 }
 267
 268 /*
 269  * process soft ACKs of our transmitted packets
 270  * - these indicate packets the peer has or has not received, but hasn't yet
 271  *   given to the consumer, and so can still be discarded and re-requested
 272  */
 273 static int rxrpc_process_soft_ACKs(struct rxrpc_call *call,
 274                                    struct rxrpc_ackpacket *ack,
 275                                    struct sk_buff *skb)
 276 {
 277         struct rxrpc_skb_priv *sp;
 278         struct sk_buff *txb;
 279         unsigned long *p_txb, resend_at;
 280         int loop;
 281         u8 sacks[RXRPC_MAXACKS], resend;
 282
 283         _enter("{%d,%d},{%d},",
 284                call->acks_hard,
 285                CIRC_CNT(call->acks_head, call->acks_tail, call->acks_winsz),
 286                ack->nAcks);
 287
 288         if (skb_copy_bits(skb, 0, sacks, ack->nAcks) < 0)
 289                 goto protocol_error;
 290
 291         resend = 0;
 292         resend_at = 0;
 293         for (loop = 0; loop < ack->nAcks; loop++) {
 294                 p_txb = call->acks_window;
 295                 p_txb += (call->acks_tail + loop) & (call->acks_winsz - 1);
 296                 smp_read_barrier_depends();
 297                 txb = (struct sk_buff *) (*p_txb & ~1);
 298                 sp = rxrpc_skb(txb);
 299
 300                 switch (sacks[loop]) {
 301                 case RXRPC_ACK_TYPE_ACK:
 302                         sp->need_resend = false;
 303                         *p_txb |= 1;
 304                         break;
 305                 case RXRPC_ACK_TYPE_NACK:
 306                         sp->need_resend = true;
 307                         *p_txb &= ~1;
 308                         resend = 1;
 309                         break;
 310                 default:
 311                         _debug("Unsupported ACK type %d", sacks[loop]);
 312                         goto protocol_error;
 313                 }
 314         }
 315
 316         smp_mb();
 317         call->acks_unacked = (call->acks_tail + loop) & (call->acks_winsz - 1);
 318
 319         /* anything not explicitly ACK'd is implicitly NACK'd, but may just not
 320          * have been received or processed yet by the far end */
 321         for (loop = call->acks_unacked;
 322              loop != call->acks_head;
 323              loop = (loop + 1) &  (call->acks_winsz - 1)
 324              ) {
 325                 p_txb = call->acks_window + loop;
 326                 smp_read_barrier_depends();
 327                 txb = (struct sk_buff *) (*p_txb & ~1);
 328                 sp = rxrpc_skb(txb);
 329
 330                 if (*p_txb & 1) {
 331                         /* packet must have been discarded */
 332                         sp->need_resend = true;
 333                         *p_txb &= ~1;
 334                         resend |= 1;
 335                 } else if (sp->need_resend) {
 336                         ;
 337                 } else if (time_after_eq(jiffies + 1, sp->resend_at)) {
 338                         sp->need_resend = true;
 339                         resend |= 1;
 340                 } else if (resend & 2) {
 341                         if (time_before(sp->resend_at, resend_at))
 342                                 resend_at = sp->resend_at;
 343                 } else {
 344                         resend_at = sp->resend_at;
 345                         resend |= 2;
 346                 }
 347         }
 348
 349         rxrpc_set_resend(call, resend, resend_at);
 350         _leave(" = 0");
 351         return 0;
 352
 353 protocol_error:
 354         _leave(" = -EPROTO");
 355         return -EPROTO;
 356 }
 357
 358 /*
 359  * discard hard-ACK'd packets from the Tx window
 360  */
 361 static void rxrpc_rotate_tx_window(struct rxrpc_call *call, u32 hard)
 362 {
 363         unsigned long _skb;
 364         int tail = call->acks_tail, old_tail;
 365         int win = CIRC_CNT(call->acks_head, tail, call->acks_winsz);
 366
 367         _enter("{%u,%u},%u", call->acks_hard, win, hard);
 368
 369         ASSERTCMP(hard - call->acks_hard, <=, win);
 370
 371         while (call->acks_hard < hard) {
 372                 smp_read_barrier_depends();
 373                 _skb = call->acks_window[tail] & ~1;
 374                 rxrpc_free_skb((struct sk_buff *) _skb);
 375                 old_tail = tail;
 376                 tail = (tail + 1) & (call->acks_winsz - 1);
 377                 call->acks_tail = tail;
 378                 if (call->acks_unacked == old_tail)
 379                         call->acks_unacked = tail;
 380                 call->acks_hard++;
 381         }
 382
 383         wake_up(&call->waitq);
 384 }
 385
 386 /*
 387  * clear the Tx window in the event of a failure
 388  */
 389 static void rxrpc_clear_tx_window(struct rxrpc_call *call)
 390 {
 391         rxrpc_rotate_tx_window(call, atomic_read(&call->sequence));
 392 }
 393
 394 /*
 395  * drain the out of sequence received packet queue into the packet Rx queue
 396  */
 397 static int rxrpc_drain_rx_oos_queue(struct rxrpc_call *call)
 398 {
 399         struct rxrpc_skb_priv *sp;
 400         struct sk_buff *skb;
 401         bool terminal;
 402         int ret;
 403
 404         _enter("{%d,%d}", call->rx_data_post, call->rx_first_oos);
 405
 406         spin_lock_bh(&call->lock);
 407
 408         ret = -ECONNRESET;
 409         if (test_bit(RXRPC_CALL_RELEASED, &call->flags))
 410                 goto socket_unavailable;
 411
 412         skb = skb_dequeue(&call->rx_oos_queue);
 413         if (skb) {
 414                 rxrpc_see_skb(skb);
 415                 sp = rxrpc_skb(skb);
 416
 417                 _debug("drain OOS packet %d [%d]",
 418                        sp->hdr.seq, call->rx_first_oos);
 419
 420                 if (sp->hdr.seq != call->rx_first_oos) {
 421                         skb_queue_head(&call->rx_oos_queue, skb);
 422                         call->rx_first_oos = rxrpc_skb(skb)->hdr.seq;
 423                         _debug("requeue %p {%u}", skb, call->rx_first_oos);
 424                 } else {
 425                         skb->mark = RXRPC_SKB_MARK_DATA;
 426                         terminal = ((sp->hdr.flags & RXRPC_LAST_PACKET) &&
 427                                 !(sp->hdr.flags & RXRPC_CLIENT_INITIATED));
 428                         ret = rxrpc_queue_rcv_skb(call, skb, true, terminal);
 429                         BUG_ON(ret < 0);
 430                         _debug("drain #%u", call->rx_data_post);
 431                         call->rx_data_post++;
 432
 433                         /* find out what the next packet is */
 434                         skb = skb_peek(&call->rx_oos_queue);
 435                         rxrpc_see_skb(skb);
 436                         if (skb)
 437                                 call->rx_first_oos = rxrpc_skb(skb)->hdr.seq;
 438                         else
 439                                 call->rx_first_oos = 0;
 440                         _debug("peek %p {%u}", skb, call->rx_first_oos);
 441                 }
 442         }
 443
 444         ret = 0;
 445 socket_unavailable:
 446         spin_unlock_bh(&call->lock);
 447         _leave(" = %d", ret);
 448         return ret;
 449 }
 450
 451 /*
 452  * insert an out of sequence packet into the buffer
 453  */
 454 static void rxrpc_insert_oos_packet(struct rxrpc_call *call,
 455                                     struct sk_buff *skb)
 456 {
 457         struct rxrpc_skb_priv *sp, *psp;
 458         struct sk_buff *p;
 459         u32 seq;
 460
 461         sp = rxrpc_skb(skb);
 462         seq = sp->hdr.seq;
 463         _enter(",,{%u}", seq);
 464
 465         skb->destructor = rxrpc_packet_destructor;
 466         ASSERTCMP(sp->call, ==, NULL);
 467         sp->call = call;
 468         rxrpc_get_call(call);
 469         atomic_inc(&call->skb_count);
 470
 471         /* insert into the buffer in sequence order */
 472         spin_lock_bh(&call->lock);
 473
 474         skb_queue_walk(&call->rx_oos_queue, p) {
 475                 psp = rxrpc_skb(p);
 476                 if (psp->hdr.seq > seq) {
 477                         _debug("insert oos #%u before #%u", seq, psp->hdr.seq);
 478                         skb_insert(p, skb, &call->rx_oos_queue);
 479                         goto inserted;
 480                 }
 481         }
 482
 483         _debug("append oos #%u", seq);
 484         skb_queue_tail(&call->rx_oos_queue, skb);
 485 inserted:
 486
 487         /* we might now have a new front to the queue */
 488         if (call->rx_first_oos == 0 || seq < call->rx_first_oos)
 489                 call->rx_first_oos = seq;
 490
 491         read_lock(&call->state_lock);
 492         if (call->state < RXRPC_CALL_COMPLETE &&
 493             call->rx_data_post == call->rx_first_oos) {
 494                 _debug("drain rx oos now");
 495                 set_bit(RXRPC_CALL_EV_DRAIN_RX_OOS, &call->events);
 496         }
 497         read_unlock(&call->state_lock);
 498
 499         spin_unlock_bh(&call->lock);
 500         _leave(" [stored #%u]", call->rx_first_oos);
 501 }
 502
 503 /*
 504  * clear the Tx window on final ACK reception
 505  */
 506 static void rxrpc_zap_tx_window(struct rxrpc_call *call)
 507 {
 508         struct rxrpc_skb_priv *sp;
 509         struct sk_buff *skb;
 510         unsigned long _skb, *acks_window;
 511         u8 winsz = call->acks_winsz;
 512         int tail;
 513
 514         acks_window = call->acks_window;
 515         call->acks_window = NULL;
 516
 517         while (CIRC_CNT(call->acks_head, call->acks_tail, winsz) > 0) {
 518                 tail = call->acks_tail;
 519                 smp_read_barrier_depends();
 520                 _skb = acks_window[tail] & ~1;
 521                 smp_mb();
 522                 call->acks_tail = (call->acks_tail + 1) & (winsz - 1);
 523
 524                 skb = (struct sk_buff *) _skb;
 525                 sp = rxrpc_skb(skb);
 526                 _debug("+++ clear Tx %u", sp->hdr.seq);
 527                 rxrpc_free_skb(skb);
 528         }
 529
 530         kfree(acks_window);
 531 }
 532
 533 /*
 534  * process the extra information that may be appended to an ACK packet
 535  */
 536 static void rxrpc_extract_ackinfo(struct rxrpc_call *call, struct sk_buff *skb,
 537                                   unsigned int latest, int nAcks)
 538 {
 539         struct rxrpc_ackinfo ackinfo;
 540         struct rxrpc_peer *peer;
 541         unsigned int mtu;
 542
 543         if (skb_copy_bits(skb, nAcks + 3, &ackinfo, sizeof(ackinfo)) < 0) {
 544                 _leave(" [no ackinfo]");
 545                 return;
 546         }
 547
 548         _proto("Rx ACK %%%u Info { rx=%u max=%u rwin=%u jm=%u }",
 549                latest,
 550                ntohl(ackinfo.rxMTU), ntohl(ackinfo.maxMTU),
 551                ntohl(ackinfo.rwind), ntohl(ackinfo.jumbo_max));
 552
 553         mtu = min(ntohl(ackinfo.rxMTU), ntohl(ackinfo.maxMTU));
 554
 555         peer = call->conn->params.peer;
 556         if (mtu < peer->maxdata) {
 557                 spin_lock_bh(&peer->lock);
 558                 peer->maxdata = mtu;
 559                 peer->mtu = mtu + peer->hdrsize;
 560                 spin_unlock_bh(&peer->lock);
 561                 _net("Net MTU %u (maxdata %u)", peer->mtu, peer->maxdata);
 562         }
 563 }
 564
 565 /*
 566  * process packets in the reception queue
 567  */
 568 static int rxrpc_process_rx_queue(struct rxrpc_call *call,
 569                                   u32 *_abort_code)
 570 {
 571         struct rxrpc_ackpacket ack;
 572         struct rxrpc_skb_priv *sp;
 573         struct sk_buff *skb;
 574         bool post_ACK;
 575         int latest;
 576         u32 hard, tx;
 577
 578         _enter("");
 579
 580 process_further:
 581         skb = skb_dequeue(&call->rx_queue);
 582         if (!skb)
 583                 return -EAGAIN;
 584
 585         rxrpc_see_skb(skb);
 586         _net("deferred skb %p", skb);
 587
 588         sp = rxrpc_skb(skb);
 589
 590         _debug("process %s [st %d]", rxrpc_pkts[sp->hdr.type], call->state);
 591
 592         post_ACK = false;
 593
 594         switch (sp->hdr.type) {
 595                 /* data packets that wind up here have been received out of
 596                  * order, need security processing or are jumbo packets */
 597         case RXRPC_PACKET_TYPE_DATA:
 598                 _proto("OOSQ DATA %%%u { #%u }", sp->hdr.serial, sp->hdr.seq);
 599
 600                 /* secured packets must be verified and possibly decrypted */
 601                 if (call->conn->security->verify_packet(call, skb,
 602                                                         _abort_code) < 0)
 603                         goto protocol_error;
 604
 605                 rxrpc_insert_oos_packet(call, skb);
 606                 goto process_further;
 607
 608                 /* partial ACK to process */
 609         case RXRPC_PACKET_TYPE_ACK:
 610                 if (skb_copy_bits(skb, 0, &ack, sizeof(ack)) < 0) {
 611                         _debug("extraction failure");
 612                         goto protocol_error;
 613                 }
 614                 if (!skb_pull(skb, sizeof(ack)))
 615                         BUG();
 616
 617                 latest = sp->hdr.serial;
 618                 hard = ntohl(ack.firstPacket);
 619                 tx = atomic_read(&call->sequence);
 620
 621                 _proto("Rx ACK %%%u { m=%hu f=#%u p=#%u s=%%%u r=%s n=%u }",
 622                        latest,
 623                        ntohs(ack.maxSkew),
 624                        hard,
 625                        ntohl(ack.previousPacket),
 626                        ntohl(ack.serial),
 627                        rxrpc_acks(ack.reason),
 628                        ack.nAcks);
 629
 630                 rxrpc_extract_ackinfo(call, skb, latest, ack.nAcks);
 631
 632                 if (ack.reason == RXRPC_ACK_PING) {
 633                         _proto("Rx ACK %%%u PING Request", latest);
 634                         rxrpc_propose_ACK(call, RXRPC_ACK_PING_RESPONSE,
 635                                           skb->priority, sp->hdr.serial, true);
 636                 }
 637
 638                 /* discard any out-of-order or duplicate ACKs */
 639                 if (latest - call->acks_latest <= 0) {
 640                         _debug("discard ACK %d <= %d",
 641                                latest, call->acks_latest);
 642                         goto discard;
 643                 }
 644                 call->acks_latest = latest;
 645
 646                 if (call->state != RXRPC_CALL_CLIENT_SEND_REQUEST &&
 647                     call->state != RXRPC_CALL_CLIENT_AWAIT_REPLY &&
 648                     call->state != RXRPC_CALL_SERVER_SEND_REPLY &&
 649                     call->state != RXRPC_CALL_SERVER_AWAIT_ACK)
 650                         goto discard;
 651
 652                 _debug("Tx=%d H=%u S=%d", tx, call->acks_hard, call->state);
 653
 654                 if (hard > 0) {
 655                         if (hard - 1 > tx) {
 656                                 _debug("hard-ACK'd packet %d not transmitted"
 657                                        " (%d top)",
 658                                        hard - 1, tx);
 659                                 goto protocol_error;
 660                         }
 661
 662                         if ((call->state == RXRPC_CALL_CLIENT_AWAIT_REPLY ||
 663                              call->state == RXRPC_CALL_SERVER_AWAIT_ACK) &&
 664                             hard > tx) {
 665                                 call->acks_hard = tx;
 666                                 goto all_acked;
 667                         }
 668
 669                         smp_rmb();
 670                         rxrpc_rotate_tx_window(call, hard - 1);
 671                 }
 672
 673                 if (ack.nAcks > 0) {
 674                         if (hard - 1 + ack.nAcks > tx) {
 675                                 _debug("soft-ACK'd packet %d+%d not"
 676                                        " transmitted (%d top)",
 677                                        hard - 1, ack.nAcks, tx);
 678                                 goto protocol_error;
 679                         }
 680
 681                         if (rxrpc_process_soft_ACKs(call, &ack, skb) < 0)
 682                                 goto protocol_error;
 683                 }
 684                 goto discard;
 685
 686                 /* complete ACK to process */
 687         case RXRPC_PACKET_TYPE_ACKALL:
 688                 goto all_acked;
 689
 690                 /* abort and busy are handled elsewhere */
 691         case RXRPC_PACKET_TYPE_BUSY:
 692         case RXRPC_PACKET_TYPE_ABORT:
 693                 BUG();
 694
 695                 /* connection level events - also handled elsewhere */
 696         case RXRPC_PACKET_TYPE_CHALLENGE:
 697         case RXRPC_PACKET_TYPE_RESPONSE:
 698         case RXRPC_PACKET_TYPE_DEBUG:
 699                 BUG();
 700         }
 701
 702         /* if we've had a hard ACK that covers all the packets we've sent, then
 703          * that ends that phase of the operation */
 704 all_acked:
 705         write_lock_bh(&call->state_lock);
 706         _debug("ack all %d", call->state);
 707
 708         switch (call->state) {
 709         case RXRPC_CALL_CLIENT_AWAIT_REPLY:
 710                 call->state = RXRPC_CALL_CLIENT_RECV_REPLY;
 711                 break;
 712         case RXRPC_CALL_SERVER_AWAIT_ACK:
 713                 _debug("srv complete");
 714                 call->state = RXRPC_CALL_COMPLETE;
 715                 post_ACK = true;
 716                 break;
 717         case RXRPC_CALL_CLIENT_SEND_REQUEST:
 718         case RXRPC_CALL_SERVER_RECV_REQUEST:
 719                 goto protocol_error_unlock; /* can't occur yet */
 720         default:
 721                 write_unlock_bh(&call->state_lock);
 722                 goto discard; /* assume packet left over from earlier phase */
 723         }
 724
 725         write_unlock_bh(&call->state_lock);
 726
 727         /* if all the packets we sent are hard-ACK'd, then we can discard
 728          * whatever we've got left */
 729         _debug("clear Tx %d",
 730                CIRC_CNT(call->acks_head, call->acks_tail, call->acks_winsz));
 731
 732         del_timer_sync(&call->resend_timer);
 733         clear_bit(RXRPC_CALL_RUN_RTIMER, &call->flags);
 734         clear_bit(RXRPC_CALL_EV_RESEND_TIMER, &call->events);
 735
 736         if (call->acks_window)
 737                 rxrpc_zap_tx_window(call);
 738
 739         if (post_ACK) {
 740                 /* post the final ACK message for userspace to pick up */
 741                 _debug("post ACK");
 742                 skb->mark = RXRPC_SKB_MARK_FINAL_ACK;
 743                 sp->call = call;
 744                 rxrpc_get_call(call);
 745                 atomic_inc(&call->skb_count);
 746                 spin_lock_bh(&call->lock);
 747                 if (rxrpc_queue_rcv_skb(call, skb, true, true) < 0)
 748                         BUG();
 749                 spin_unlock_bh(&call->lock);
 750                 goto process_further;
 751         }
 752
 753 discard:
 754         rxrpc_free_skb(skb);
 755         goto process_further;
 756
 757 protocol_error_unlock:
 758         write_unlock_bh(&call->state_lock);
 759 protocol_error:
 760         rxrpc_free_skb(skb);
 761         _leave(" = -EPROTO");
 762         return -EPROTO;
 763 }
 764
 765 /*
 766  * post a message to the socket Rx queue for recvmsg() to pick up
 767  */
 768 static int rxrpc_post_message(struct rxrpc_call *call, u32 mark, u32 error,
 769                               bool fatal)
 770 {
 771         struct rxrpc_skb_priv *sp;
 772         struct sk_buff *skb;
 773         int ret;
 774
 775         _enter("{%d,%lx},%u,%u,%d",
 776                call->debug_id, call->flags, mark, error, fatal);
 777
 778         /* remove timers and things for fatal messages */
 779         if (fatal) {
 780                 del_timer_sync(&call->resend_timer);
 781                 del_timer_sync(&call->ack_timer);
 782                 clear_bit(RXRPC_CALL_RUN_RTIMER, &call->flags);
 783         }
 784
 785         if (mark != RXRPC_SKB_MARK_NEW_CALL &&
 786             !test_bit(RXRPC_CALL_HAS_USERID, &call->flags)) {
 787                 _leave("[no userid]");
 788                 return 0;
 789         }
 790
 791         if (!test_bit(RXRPC_CALL_TERMINAL_MSG, &call->flags)) {
 792                 skb = alloc_skb(0, GFP_NOFS);
 793                 if (!skb)
 794                         return -ENOMEM;
 795
 796                 rxrpc_new_skb(skb);
 797
 798                 skb->mark = mark;
 799
 800                 sp = rxrpc_skb(skb);
 801                 memset(sp, 0, sizeof(*sp));
 802                 sp->error = error;
 803                 sp->call = call;
 804                 rxrpc_get_call(call);
 805                 atomic_inc(&call->skb_count);
 806
 807                 spin_lock_bh(&call->lock);
 808                 ret = rxrpc_queue_rcv_skb(call, skb, true, fatal);
 809                 spin_unlock_bh(&call->lock);
 810                 BUG_ON(ret < 0);
 811         }
 812
 813         return 0;
 814 }
 815
 816 /*
 817  * handle background processing of incoming call packets and ACK / abort
 818  * generation
 819  */
 820 void rxrpc_process_call(struct work_struct *work)
 821 {
 822         struct rxrpc_call *call =
 823                 container_of(work, struct rxrpc_call, processor);
 824         struct rxrpc_wire_header whdr;
 825         struct rxrpc_ackpacket ack;
 826         struct rxrpc_ackinfo ackinfo;
 827         struct msghdr msg;
 828         struct kvec iov[5];
 829         enum rxrpc_call_event genbit;
 830         unsigned long bits;
 831         __be32 data, pad;
 832         size_t len;
 833         int loop, nbit, ioc, ret, mtu;
 834         u32 serial, abort_code = RX_PROTOCOL_ERROR;
 835         u8 *acks = NULL;
 836
 837         //printk("\n--------------------\n");
 838         _enter("{%d,%s,%lx} [%lu]",
 839                call->debug_id, rxrpc_call_states[call->state], call->events,
 840                (jiffies - call->creation_jif) / (HZ / 10));
 841
 842         if (!call->conn)
 843                 goto skip_msg_init;
 844
 845         /* there's a good chance we're going to have to send a message, so set
 846          * one up in advance */
 847         msg.msg_name    = &call->conn->params.peer->srx.transport;
 848         msg.msg_namelen = call->conn->params.peer->srx.transport_len;
 849         msg.msg_control = NULL;
 850         msg.msg_controllen = 0;
 851         msg.msg_flags   = 0;
 852
 853         whdr.epoch      = htonl(call->conn->proto.epoch);
 854         whdr.cid        = htonl(call->cid);
 855         whdr.callNumber = htonl(call->call_id);
 856         whdr.seq        = 0;
 857         whdr.type       = RXRPC_PACKET_TYPE_ACK;
 858         whdr.flags      = call->conn->out_clientflag;
 859         whdr.userStatus = 0;
 860         whdr.securityIndex = call->conn->security_ix;
 861         whdr._rsvd      = 0;
 862         whdr.serviceId  = htons(call->service_id);
 863
 864         memset(iov, 0, sizeof(iov));
 865         iov[0].iov_base = &whdr;
 866         iov[0].iov_len  = sizeof(whdr);
 867 skip_msg_init:
 868
 869         /* deal with events of a final nature */
 870         if (test_bit(RXRPC_CALL_EV_RCVD_ERROR, &call->events)) {
 871                 enum rxrpc_skb_mark mark;
 872                 int error;
 873
 874                 clear_bit(RXRPC_CALL_EV_CONN_ABORT, &call->events);
 875                 clear_bit(RXRPC_CALL_EV_REJECT_BUSY, &call->events);
 876                 clear_bit(RXRPC_CALL_EV_ABORT, &call->events);
 877
 878                 error = call->error_report;
 879                 if (error < RXRPC_LOCAL_ERROR_OFFSET) {
 880                         mark = RXRPC_SKB_MARK_NET_ERROR;
 881                         _debug("post net error %d", error);
 882                 } else {
 883                         mark = RXRPC_SKB_MARK_LOCAL_ERROR;
 884                         error -= RXRPC_LOCAL_ERROR_OFFSET;
 885                         _debug("post net local error %d", error);
 886                 }
 887
 888                 if (rxrpc_post_message(call, mark, error, true) < 0)
 889                         goto no_mem;
 890                 clear_bit(RXRPC_CALL_EV_RCVD_ERROR, &call->events);
 891                 goto kill_ACKs;
 892         }
 893
 894         if (test_bit(RXRPC_CALL_EV_CONN_ABORT, &call->events)) {
 895                 ASSERTCMP(call->state, >, RXRPC_CALL_COMPLETE);
 896
 897                 clear_bit(RXRPC_CALL_EV_REJECT_BUSY, &call->events);
 898                 clear_bit(RXRPC_CALL_EV_ABORT, &call->events);
 899
 900                 _debug("post conn abort");
 901
 902                 if (rxrpc_post_message(call, RXRPC_SKB_MARK_LOCAL_ERROR,
 903                                        call->conn->error, true) < 0)
 904                         goto no_mem;
 905                 clear_bit(RXRPC_CALL_EV_CONN_ABORT, &call->events);
 906                 goto kill_ACKs;
 907         }
 908
 909         if (test_bit(RXRPC_CALL_EV_REJECT_BUSY, &call->events)) {
 910                 whdr.type = RXRPC_PACKET_TYPE_BUSY;
 911                 genbit = RXRPC_CALL_EV_REJECT_BUSY;
 912                 goto send_message;
 913         }
 914
 915         if (test_bit(RXRPC_CALL_EV_ABORT, &call->events)) {
 916                 ASSERTCMP(call->state, >, RXRPC_CALL_COMPLETE);
 917
 918                 if (rxrpc_post_message(call, RXRPC_SKB_MARK_LOCAL_ERROR,
 919                                        ECONNABORTED, true) < 0)
 920                         goto no_mem;
 921                 whdr.type = RXRPC_PACKET_TYPE_ABORT;
 922                 data = htonl(call->local_abort);
 923                 iov[1].iov_base = &data;
 924                 iov[1].iov_len = sizeof(data);
 925                 genbit = RXRPC_CALL_EV_ABORT;
 926                 goto send_message;
 927         }
 928
 929         if (test_bit(RXRPC_CALL_EV_ACK_FINAL, &call->events)) {
 930                 genbit = RXRPC_CALL_EV_ACK_FINAL;
 931
 932                 ack.bufferSpace = htons(8);
 933                 ack.maxSkew     = 0;
 934                 ack.serial      = 0;
 935                 ack.reason      = RXRPC_ACK_IDLE;
 936                 ack.nAcks       = 0;
 937                 call->ackr_reason = 0;
 938
 939                 spin_lock_bh(&call->lock);
 940                 ack.serial      = htonl(call->ackr_serial);
 941                 ack.previousPacket = htonl(call->ackr_prev_seq);
 942                 ack.firstPacket = htonl(call->rx_data_eaten + 1);
 943                 spin_unlock_bh(&call->lock);
 944
 945                 pad = 0;
 946
 947                 iov[1].iov_base = &ack;
 948                 iov[1].iov_len  = sizeof(ack);
 949                 iov[2].iov_base = &pad;
 950                 iov[2].iov_len  = 3;
 951                 iov[3].iov_base = &ackinfo;
 952                 iov[3].iov_len  = sizeof(ackinfo);
 953                 goto send_ACK;
 954         }
 955
 956         if (call->events & ((1 << RXRPC_CALL_EV_RCVD_BUSY) |
 957                             (1 << RXRPC_CALL_EV_RCVD_ABORT))
 958             ) {
 959                 u32 mark;
 960
 961                 if (test_bit(RXRPC_CALL_EV_RCVD_ABORT, &call->events))
 962                         mark = RXRPC_SKB_MARK_REMOTE_ABORT;
 963                 else
 964                         mark = RXRPC_SKB_MARK_BUSY;
 965
 966                 _debug("post abort/busy");
 967                 rxrpc_clear_tx_window(call);
 968                 if (rxrpc_post_message(call, mark, ECONNABORTED, true) < 0)
 969                         goto no_mem;
 970
 971                 clear_bit(RXRPC_CALL_EV_RCVD_BUSY, &call->events);
 972                 clear_bit(RXRPC_CALL_EV_RCVD_ABORT, &call->events);
 973                 goto kill_ACKs;
 974         }
 975
 976         if (test_and_clear_bit(RXRPC_CALL_EV_RCVD_ACKALL, &call->events)) {
 977                 _debug("do implicit ackall");
 978                 rxrpc_clear_tx_window(call);
 979         }
 980
 981         if (test_bit(RXRPC_CALL_EV_LIFE_TIMER, &call->events)) {
 982                 write_lock_bh(&call->state_lock);
 983                 if (call->state <= RXRPC_CALL_COMPLETE) {
 984                         call->state = RXRPC_CALL_LOCALLY_ABORTED;
 985                         call->local_abort = RX_CALL_TIMEOUT;
 986                         set_bit(RXRPC_CALL_EV_ABORT, &call->events);
 987                 }
 988                 write_unlock_bh(&call->state_lock);
 989
 990                 _debug("post timeout");
 991                 if (rxrpc_post_message(call, RXRPC_SKB_MARK_LOCAL_ERROR,
 992                                        ETIME, true) < 0)
 993                         goto no_mem;
 994
 995                 clear_bit(RXRPC_CALL_EV_LIFE_TIMER, &call->events);
 996                 goto kill_ACKs;
 997         }
 998
 999         /* deal with assorted inbound messages */
1000         if (!skb_queue_empty(&call->rx_queue)) {
1001                 switch (rxrpc_process_rx_queue(call, &abort_code)) {
1002                 case 0:
1003                 case -EAGAIN:
1004                         break;
1005                 case -ENOMEM:
1006                         goto no_mem;
1007                 case -EKEYEXPIRED:
1008                 case -EKEYREJECTED:
1009                 case -EPROTO:
1010                         rxrpc_abort_call(call, abort_code);
1011                         goto kill_ACKs;
1012                 }
1013         }
1014
1015         /* handle resending */
1016         if (test_and_clear_bit(RXRPC_CALL_EV_RESEND_TIMER, &call->events))
1017                 rxrpc_resend_timer(call);
1018         if (test_and_clear_bit(RXRPC_CALL_EV_RESEND, &call->events))
1019                 rxrpc_resend(call);
1020
1021         /* consider sending an ordinary ACK */
1022         if (test_bit(RXRPC_CALL_EV_ACK, &call->events)) {
1023                 _debug("send ACK: window: %d - %d { %lx }",
1024                        call->rx_data_eaten, call->ackr_win_top,
1025                        call->ackr_window[0]);
1026
1027                 if (call->state > RXRPC_CALL_SERVER_ACK_REQUEST &&
1028                     call->ackr_reason != RXRPC_ACK_PING_RESPONSE) {
1029                         /* ACK by sending reply DATA packet in this state */
1030                         clear_bit(RXRPC_CALL_EV_ACK, &call->events);
1031                         goto maybe_reschedule;
1032                 }
1033
1034                 genbit = RXRPC_CALL_EV_ACK;
1035
1036                 acks = kzalloc(call->ackr_win_top - call->rx_data_eaten,
1037                                GFP_NOFS);
1038                 if (!acks)
1039                         goto no_mem;
1040
1041                 //hdr.flags     = RXRPC_SLOW_START_OK;
1042                 ack.bufferSpace = htons(8);
1043                 ack.maxSkew     = 0;
1044
1045                 spin_lock_bh(&call->lock);
1046                 ack.reason      = call->ackr_reason;
1047                 ack.serial      = htonl(call->ackr_serial);
1048                 ack.previousPacket = htonl(call->ackr_prev_seq);
1049                 ack.firstPacket = htonl(call->rx_data_eaten + 1);
1050
1051                 ack.nAcks = 0;
1052                 for (loop = 0; loop < RXRPC_ACKR_WINDOW_ASZ; loop++) {
1053                         nbit = loop * BITS_PER_LONG;
1054                         for (bits = call->ackr_window[loop]; bits; bits >>= 1
1055                              ) {
1056                                 _debug("- l=%d n=%d b=%lx", loop, nbit, bits);
1057                                 if (bits & 1) {
1058                                         acks[nbit] = RXRPC_ACK_TYPE_ACK;
1059                                         ack.nAcks = nbit + 1;
1060                                 }
1061                                 nbit++;
1062                         }
1063                 }
1064                 call->ackr_reason = 0;
1065                 spin_unlock_bh(&call->lock);
1066
1067                 pad = 0;
1068
1069                 iov[1].iov_base = &ack;
1070                 iov[1].iov_len  = sizeof(ack);
1071                 iov[2].iov_base = acks;
1072                 iov[2].iov_len  = ack.nAcks;
1073                 iov[3].iov_base = &pad;
1074                 iov[3].iov_len  = 3;
1075                 iov[4].iov_base = &ackinfo;
1076                 iov[4].iov_len  = sizeof(ackinfo);
1077
1078                 switch (ack.reason) {
1079                 case RXRPC_ACK_REQUESTED:
1080                 case RXRPC_ACK_DUPLICATE:
1081                 case RXRPC_ACK_OUT_OF_SEQUENCE:
1082                 case RXRPC_ACK_EXCEEDS_WINDOW:
1083                 case RXRPC_ACK_NOSPACE:
1084                 case RXRPC_ACK_PING:
1085                 case RXRPC_ACK_PING_RESPONSE:
1086                         goto send_ACK_with_skew;
1087                 case RXRPC_ACK_DELAY:
1088                 case RXRPC_ACK_IDLE:
1089                         goto send_ACK;
1090                 }
1091         }
1092
1093         /* handle completion of security negotiations on an incoming
1094          * connection */
1095         if (test_and_clear_bit(RXRPC_CALL_EV_SECURED, &call->events)) {
1096                 _debug("secured");
1097                 spin_lock_bh(&call->lock);
1098
1099                 if (call->state == RXRPC_CALL_SERVER_SECURING) {
1100                         _debug("securing");
1101                         write_lock(&call->socket->call_lock);
1102                         if (!test_bit(RXRPC_CALL_RELEASED, &call->flags) &&
1103                             !test_bit(RXRPC_CALL_EV_RELEASE, &call->events)) {
1104                                 _debug("not released");
1105                                 call->state = RXRPC_CALL_SERVER_ACCEPTING;
1106                                 list_move_tail(&call->accept_link,
1107                                                &call->socket->acceptq);
1108                         }
1109                         write_unlock(&call->socket->call_lock);
1110                         read_lock(&call->state_lock);
1111                         if (call->state < RXRPC_CALL_COMPLETE)
1112                                 set_bit(RXRPC_CALL_EV_POST_ACCEPT, &call->events);
1113                         read_unlock(&call->state_lock);
1114                 }
1115
1116                 spin_unlock_bh(&call->lock);
1117                 if (!test_bit(RXRPC_CALL_EV_POST_ACCEPT, &call->events))
1118                         goto maybe_reschedule;
1119         }
1120
1121         /* post a notification of an acceptable connection to the app */
1122         if (test_bit(RXRPC_CALL_EV_POST_ACCEPT, &call->events)) {
1123                 _debug("post accept");
1124                 if (rxrpc_post_message(call, RXRPC_SKB_MARK_NEW_CALL,
1125                                        0, false) < 0)
1126                         goto no_mem;
1127                 clear_bit(RXRPC_CALL_EV_POST_ACCEPT, &call->events);
1128                 goto maybe_reschedule;
1129         }
1130
1131         /* handle incoming call acceptance */
1132         if (test_and_clear_bit(RXRPC_CALL_EV_ACCEPTED, &call->events)) {
1133                 _debug("accepted");
1134                 ASSERTCMP(call->rx_data_post, ==, 0);
1135                 call->rx_data_post = 1;
1136                 read_lock_bh(&call->state_lock);
1137                 if (call->state < RXRPC_CALL_COMPLETE)
1138                         set_bit(RXRPC_CALL_EV_DRAIN_RX_OOS, &call->events);
1139                 read_unlock_bh(&call->state_lock);
1140         }
1141
1142         /* drain the out of sequence received packet queue into the packet Rx
1143          * queue */
1144         if (test_and_clear_bit(RXRPC_CALL_EV_DRAIN_RX_OOS, &call->events)) {
1145                 while (call->rx_data_post == call->rx_first_oos)
1146                         if (rxrpc_drain_rx_oos_queue(call) < 0)
1147                                 break;
1148                 goto maybe_reschedule;
1149         }
1150
1151         if (test_bit(RXRPC_CALL_EV_RELEASE, &call->events)) {
1152                 rxrpc_release_call(call);
1153                 clear_bit(RXRPC_CALL_EV_RELEASE, &call->events);
1154         }
1155
1156         /* other events may have been raised since we started checking */
1157         goto maybe_reschedule;
1158
1159 send_ACK_with_skew:
1160         ack.maxSkew = htons(call->ackr_skew);
1161 send_ACK:
1162         mtu = call->conn->params.peer->if_mtu;
1163         mtu -= call->conn->params.peer->hdrsize;
1164         ackinfo.maxMTU  = htonl(mtu);
1165         ackinfo.rwind   = htonl(rxrpc_rx_window_size);
1166
1167         /* permit the peer to send us jumbo packets if it wants to */
1168         ackinfo.rxMTU   = htonl(rxrpc_rx_mtu);
1169         ackinfo.jumbo_max = htonl(rxrpc_rx_jumbo_max);
1170
1171         serial = atomic_inc_return(&call->conn->serial);
1172         whdr.serial = htonl(serial);
1173         _proto("Tx ACK %%%u { m=%hu f=#%u p=#%u s=%%%u r=%s n=%u }",
1174                serial,
1175                ntohs(ack.maxSkew),
1176                ntohl(ack.firstPacket),
1177                ntohl(ack.previousPacket),
1178                ntohl(ack.serial),
1179                rxrpc_acks(ack.reason),
1180                ack.nAcks);
1181
1182         del_timer_sync(&call->ack_timer);
1183         if (ack.nAcks > 0)
1184                 set_bit(RXRPC_CALL_TX_SOFT_ACK, &call->flags);
1185         goto send_message_2;
1186
1187 send_message:
1188         _debug("send message");
1189
1190         serial = atomic_inc_return(&call->conn->serial);
1191         whdr.serial = htonl(serial);
1192         _proto("Tx %s %%%u", rxrpc_pkts[whdr.type], serial);
1193 send_message_2:
1194
1195         len = iov[0].iov_len;
1196         ioc = 1;
1197         if (iov[4].iov_len) {
1198                 ioc = 5;
1199                 len += iov[4].iov_len;
1200                 len += iov[3].iov_len;
1201                 len += iov[2].iov_len;
1202                 len += iov[1].iov_len;
1203         } else if (iov[3].iov_len) {
1204                 ioc = 4;
1205                 len += iov[3].iov_len;
1206                 len += iov[2].iov_len;
1207                 len += iov[1].iov_len;
1208         } else if (iov[2].iov_len) {
1209                 ioc = 3;
1210                 len += iov[2].iov_len;
1211                 len += iov[1].iov_len;
1212         } else if (iov[1].iov_len) {
1213                 ioc = 2;
1214                 len += iov[1].iov_len;
1215         }
1216
1217         ret = kernel_sendmsg(call->conn->params.local->socket,
1218                              &msg, iov, ioc, len);
1219         if (ret < 0) {
1220                 _debug("sendmsg failed: %d", ret);
1221                 read_lock_bh(&call->state_lock);
1222                 if (call->state < RXRPC_CALL_DEAD)
1223                         rxrpc_queue_call(call);
1224                 read_unlock_bh(&call->state_lock);
1225                 goto error;
1226         }
1227
1228         switch (genbit) {
1229         case RXRPC_CALL_EV_ABORT:
1230                 clear_bit(genbit, &call->events);
1231                 clear_bit(RXRPC_CALL_EV_RCVD_ABORT, &call->events);
1232                 goto kill_ACKs;
1233
1234         case RXRPC_CALL_EV_ACK_FINAL:
1235                 write_lock_bh(&call->state_lock);
1236                 if (call->state == RXRPC_CALL_CLIENT_FINAL_ACK)
1237                         call->state = RXRPC_CALL_COMPLETE;
1238                 write_unlock_bh(&call->state_lock);
1239                 goto kill_ACKs;
1240
1241         default:
1242                 clear_bit(genbit, &call->events);
1243                 switch (call->state) {
1244                 case RXRPC_CALL_CLIENT_AWAIT_REPLY:
1245                 case RXRPC_CALL_CLIENT_RECV_REPLY:
1246                 case RXRPC_CALL_SERVER_RECV_REQUEST:
1247                 case RXRPC_CALL_SERVER_ACK_REQUEST:
1248                         _debug("start ACK timer");
1249                         rxrpc_propose_ACK(call, RXRPC_ACK_DELAY,
1250                                           call->ackr_skew, call->ackr_serial,
1251                                           false);
1252                 default:
1253                         break;
1254                 }
1255                 goto maybe_reschedule;
1256         }
1257
1258 kill_ACKs:
1259         del_timer_sync(&call->ack_timer);
1260         if (test_and_clear_bit(RXRPC_CALL_EV_ACK_FINAL, &call->events))
1261                 rxrpc_put_call(call);
1262         clear_bit(RXRPC_CALL_EV_ACK, &call->events);
1263
1264 maybe_reschedule:
1265         if (call->events || !skb_queue_empty(&call->rx_queue)) {
1266                 read_lock_bh(&call->state_lock);
1267                 if (call->state < RXRPC_CALL_DEAD)
1268                         rxrpc_queue_call(call);
1269                 read_unlock_bh(&call->state_lock);
1270         }
1271
1272         /* don't leave aborted connections on the accept queue */
1273         if (call->state >= RXRPC_CALL_COMPLETE &&
1274             !list_empty(&call->accept_link)) {
1275                 _debug("X unlinking once-pending call %p { e=%lx f=%lx c=%x }",
1276                        call, call->events, call->flags, call->conn->proto.cid);
1277
1278                 read_lock_bh(&call->state_lock);
1279                 if (!test_bit(RXRPC_CALL_RELEASED, &call->flags) &&
1280                     !test_and_set_bit(RXRPC_CALL_EV_RELEASE, &call->events))
1281                         rxrpc_queue_call(call);
1282                 read_unlock_bh(&call->state_lock);
1283         }
1284
1285 error:
1286         kfree(acks);
1287
1288         /* because we don't want two CPUs both processing the work item for one
1289          * call at the same time, we use a flag to note when it's busy; however
1290          * this means there's a race between clearing the flag and setting the
1291          * work pending bit and the work item being processed again */
1292         if (call->events && !work_pending(&call->processor)) {
1293                 _debug("jumpstart %x", call->conn->proto.cid);
1294                 rxrpc_queue_call(call);
1295         }
1296
1297         _leave("");
1298         return;
1299
1300 no_mem:
1301         _debug("out of memory");
1302         goto maybe_reschedule;
1303 }