net/rxrpc/ar-ack.c

   1 /* Management of Tx window, Tx resend, ACKs and out-of-sequence reception
   2  *
   3  * Copyright (C) 2007 Red Hat, Inc. All Rights Reserved.
   4  * Written by David Howells (dhowells@redhat.com)
   5  *
   6  * This program is free software; you can redistribute it and/or
   7  * modify it under the terms of the GNU General Public License
   8  * as published by the Free Software Foundation; either version
   9  * 2 of the License, or (at your option) any later version.
  10  */
  11
  12 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
  13
  14 #include <linux/module.h>
  15 #include <linux/circ_buf.h>
  16 #include <linux/net.h>
  17 #include <linux/skbuff.h>
  18 #include <linux/slab.h>
  19 #include <linux/udp.h>
  20 #include <net/sock.h>
  21 #include <net/af_rxrpc.h>
  22 #include "ar-internal.h"
  23
  24 /*
  25  * propose an ACK be sent
  26  */
  27 void __rxrpc_propose_ACK(struct rxrpc_call *call, u8 ack_reason,
  28                          u32 serial, bool immediate)
  29 {
  30         unsigned long expiry;
  31         s8 prior = rxrpc_ack_priority[ack_reason];
  32
  33         ASSERTCMP(prior, >, 0);
  34
  35         _enter("{%d},%s,%%%x,%u",
  36                call->debug_id, rxrpc_acks(ack_reason), serial, immediate);
  37
  38         if (prior < rxrpc_ack_priority[call->ackr_reason]) {
  39                 if (immediate)
  40                         goto cancel_timer;
  41                 return;
  42         }
  43
  44         /* update DELAY, IDLE, REQUESTED and PING_RESPONSE ACK serial
  45          * numbers */
  46         if (prior == rxrpc_ack_priority[call->ackr_reason]) {
  47                 if (prior <= 4)
  48                         call->ackr_serial = serial;
  49                 if (immediate)
  50                         goto cancel_timer;
  51                 return;
  52         }
  53
  54         call->ackr_reason = ack_reason;
  55         call->ackr_serial = serial;
  56
  57         switch (ack_reason) {
  58         case RXRPC_ACK_DELAY:
  59                 _debug("run delay timer");
  60                 expiry = rxrpc_soft_ack_delay;
  61                 goto run_timer;
  62
  63         case RXRPC_ACK_IDLE:
  64                 if (!immediate) {
  65                         _debug("run defer timer");
  66                         expiry = rxrpc_idle_ack_delay;
  67                         goto run_timer;
  68                 }
  69                 goto cancel_timer;
  70
  71         case RXRPC_ACK_REQUESTED:
  72                 expiry = rxrpc_requested_ack_delay;
  73                 if (!expiry)
  74                         goto cancel_timer;
  75                 if (!immediate || serial == 1) {
  76                         _debug("run defer timer");
  77                         goto run_timer;
  78                 }
  79
  80         default:
  81                 _debug("immediate ACK");
  82                 goto cancel_timer;
  83         }
  84
  85 run_timer:
  86         expiry += jiffies;
  87         if (!timer_pending(&call->ack_timer) ||
  88             time_after(call->ack_timer.expires, expiry))
  89                 mod_timer(&call->ack_timer, expiry);
  90         return;
  91
  92 cancel_timer:
  93         _debug("cancel timer %%%u", serial);
  94         try_to_del_timer_sync(&call->ack_timer);
  95         read_lock_bh(&call->state_lock);
  96         if (call->state <= RXRPC_CALL_COMPLETE &&
  97             !test_and_set_bit(RXRPC_CALL_EV_ACK, &call->events))
  98                 rxrpc_queue_call(call);
  99         read_unlock_bh(&call->state_lock);
 100 }
 101
 102 /*
 103  * propose an ACK be sent, locking the call structure
 104  */
 105 void rxrpc_propose_ACK(struct rxrpc_call *call, u8 ack_reason,
 106                        u32 serial, bool immediate)
 107 {
 108         s8 prior = rxrpc_ack_priority[ack_reason];
 109
 110         if (prior > rxrpc_ack_priority[call->ackr_reason]) {
 111                 spin_lock_bh(&call->lock);
 112                 __rxrpc_propose_ACK(call, ack_reason, serial, immediate);
 113                 spin_unlock_bh(&call->lock);
 114         }
 115 }
 116
 117 /*
 118  * set the resend timer
 119  */
 120 static void rxrpc_set_resend(struct rxrpc_call *call, u8 resend,
 121                              unsigned long resend_at)
 122 {
 123         read_lock_bh(&call->state_lock);
 124         if (call->state >= RXRPC_CALL_COMPLETE)
 125                 resend = 0;
 126
 127         if (resend & 1) {
 128                 _debug("SET RESEND");
 129                 set_bit(RXRPC_CALL_EV_RESEND, &call->events);
 130         }
 131
 132         if (resend & 2) {
 133                 _debug("MODIFY RESEND TIMER");
 134                 set_bit(RXRPC_CALL_RUN_RTIMER, &call->flags);
 135                 mod_timer(&call->resend_timer, resend_at);
 136         } else {
 137                 _debug("KILL RESEND TIMER");
 138                 del_timer_sync(&call->resend_timer);
 139                 clear_bit(RXRPC_CALL_EV_RESEND_TIMER, &call->events);
 140                 clear_bit(RXRPC_CALL_RUN_RTIMER, &call->flags);
 141         }
 142         read_unlock_bh(&call->state_lock);
 143 }
 144
 145 /*
 146  * resend packets
 147  */
 148 static void rxrpc_resend(struct rxrpc_call *call)
 149 {
 150         struct rxrpc_wire_header *whdr;
 151         struct rxrpc_skb_priv *sp;
 152         struct sk_buff *txb;
 153         unsigned long *p_txb, resend_at;
 154         bool stop;
 155         int loop;
 156         u8 resend;
 157
 158         _enter("{%d,%d,%d,%d},",
 159                call->acks_hard, call->acks_unacked,
 160                atomic_read(&call->sequence),
 161                CIRC_CNT(call->acks_head, call->acks_tail, call->acks_winsz));
 162
 163         stop = false;
 164         resend = 0;
 165         resend_at = 0;
 166
 167         for (loop = call->acks_tail;
 168              loop != call->acks_head || stop;
 169              loop = (loop + 1) &  (call->acks_winsz - 1)
 170              ) {
 171                 p_txb = call->acks_window + loop;
 172                 smp_read_barrier_depends();
 173                 if (*p_txb & 1)
 174                         continue;
 175
 176                 txb = (struct sk_buff *) *p_txb;
 177                 sp = rxrpc_skb(txb);
 178
 179                 if (sp->need_resend) {
 180                         sp->need_resend = false;
 181
 182                         /* each Tx packet has a new serial number */
 183                         sp->hdr.serial = atomic_inc_return(&call->conn->serial);
 184
 185                         whdr = (struct rxrpc_wire_header *)txb->head;
 186                         whdr->serial = htonl(sp->hdr.serial);
 187
 188                         _proto("Tx DATA %%%u { #%d }",
 189                                sp->hdr.serial, sp->hdr.seq);
 190                         if (rxrpc_send_packet(call->conn->trans, txb) < 0) {
 191                                 stop = true;
 192                                 sp->resend_at = jiffies + 3;
 193                         } else {
 194                                 sp->resend_at =
 195                                         jiffies + rxrpc_resend_timeout;
 196                         }
 197                 }
 198
 199                 if (time_after_eq(jiffies + 1, sp->resend_at)) {
 200                         sp->need_resend = true;
 201                         resend |= 1;
 202                 } else if (resend & 2) {
 203                         if (time_before(sp->resend_at, resend_at))
 204                                 resend_at = sp->resend_at;
 205                 } else {
 206                         resend_at = sp->resend_at;
 207                         resend |= 2;
 208                 }
 209         }
 210
 211         rxrpc_set_resend(call, resend, resend_at);
 212         _leave("");
 213 }
 214
 215 /*
 216  * handle resend timer expiry
 217  */
 218 static void rxrpc_resend_timer(struct rxrpc_call *call)
 219 {
 220         struct rxrpc_skb_priv *sp;
 221         struct sk_buff *txb;
 222         unsigned long *p_txb, resend_at;
 223         int loop;
 224         u8 resend;
 225
 226         _enter("%d,%d,%d",
 227                call->acks_tail, call->acks_unacked, call->acks_head);
 228
 229         if (call->state >= RXRPC_CALL_COMPLETE)
 230                 return;
 231
 232         resend = 0;
 233         resend_at = 0;
 234
 235         for (loop = call->acks_unacked;
 236              loop != call->acks_head;
 237              loop = (loop + 1) &  (call->acks_winsz - 1)
 238              ) {
 239                 p_txb = call->acks_window + loop;
 240                 smp_read_barrier_depends();
 241                 txb = (struct sk_buff *) (*p_txb & ~1);
 242                 sp = rxrpc_skb(txb);
 243
 244                 ASSERT(!(*p_txb & 1));
 245
 246                 if (sp->need_resend) {
 247                         ;
 248                 } else if (time_after_eq(jiffies + 1, sp->resend_at)) {
 249                         sp->need_resend = true;
 250                         resend |= 1;
 251                 } else if (resend & 2) {
 252                         if (time_before(sp->resend_at, resend_at))
 253                                 resend_at = sp->resend_at;
 254                 } else {
 255                         resend_at = sp->resend_at;
 256                         resend |= 2;
 257                 }
 258         }
 259
 260         rxrpc_set_resend(call, resend, resend_at);
 261         _leave("");
 262 }
 263
 264 /*
 265  * process soft ACKs of our transmitted packets
 266  * - these indicate packets the peer has or has not received, but hasn't yet
 267  *   given to the consumer, and so can still be discarded and re-requested
 268  */
 269 static int rxrpc_process_soft_ACKs(struct rxrpc_call *call,
 270                                    struct rxrpc_ackpacket *ack,
 271                                    struct sk_buff *skb)
 272 {
 273         struct rxrpc_skb_priv *sp;
 274         struct sk_buff *txb;
 275         unsigned long *p_txb, resend_at;
 276         int loop;
 277         u8 sacks[RXRPC_MAXACKS], resend;
 278
 279         _enter("{%d,%d},{%d},",
 280                call->acks_hard,
 281                CIRC_CNT(call->acks_head, call->acks_tail, call->acks_winsz),
 282                ack->nAcks);
 283
 284         if (skb_copy_bits(skb, 0, sacks, ack->nAcks) < 0)
 285                 goto protocol_error;
 286
 287         resend = 0;
 288         resend_at = 0;
 289         for (loop = 0; loop < ack->nAcks; loop++) {
 290                 p_txb = call->acks_window;
 291                 p_txb += (call->acks_tail + loop) & (call->acks_winsz - 1);
 292                 smp_read_barrier_depends();
 293                 txb = (struct sk_buff *) (*p_txb & ~1);
 294                 sp = rxrpc_skb(txb);
 295
 296                 switch (sacks[loop]) {
 297                 case RXRPC_ACK_TYPE_ACK:
 298                         sp->need_resend = false;
 299                         *p_txb |= 1;
 300                         break;
 301                 case RXRPC_ACK_TYPE_NACK:
 302                         sp->need_resend = true;
 303                         *p_txb &= ~1;
 304                         resend = 1;
 305                         break;
 306                 default:
 307                         _debug("Unsupported ACK type %d", sacks[loop]);
 308                         goto protocol_error;
 309                 }
 310         }
 311
 312         smp_mb();
 313         call->acks_unacked = (call->acks_tail + loop) & (call->acks_winsz - 1);
 314
 315         /* anything not explicitly ACK'd is implicitly NACK'd, but may just not
 316          * have been received or processed yet by the far end */
 317         for (loop = call->acks_unacked;
 318              loop != call->acks_head;
 319              loop = (loop + 1) &  (call->acks_winsz - 1)
 320              ) {
 321                 p_txb = call->acks_window + loop;
 322                 smp_read_barrier_depends();
 323                 txb = (struct sk_buff *) (*p_txb & ~1);
 324                 sp = rxrpc_skb(txb);
 325
 326                 if (*p_txb & 1) {
 327                         /* packet must have been discarded */
 328                         sp->need_resend = true;
 329                         *p_txb &= ~1;
 330                         resend |= 1;
 331                 } else if (sp->need_resend) {
 332                         ;
 333                 } else if (time_after_eq(jiffies + 1, sp->resend_at)) {
 334                         sp->need_resend = true;
 335                         resend |= 1;
 336                 } else if (resend & 2) {
 337                         if (time_before(sp->resend_at, resend_at))
 338                                 resend_at = sp->resend_at;
 339                 } else {
 340                         resend_at = sp->resend_at;
 341                         resend |= 2;
 342                 }
 343         }
 344
 345         rxrpc_set_resend(call, resend, resend_at);
 346         _leave(" = 0");
 347         return 0;
 348
 349 protocol_error:
 350         _leave(" = -EPROTO");
 351         return -EPROTO;
 352 }
 353
 354 /*
 355  * discard hard-ACK'd packets from the Tx window
 356  */
 357 static void rxrpc_rotate_tx_window(struct rxrpc_call *call, u32 hard)
 358 {
 359         unsigned long _skb;
 360         int tail = call->acks_tail, old_tail;
 361         int win = CIRC_CNT(call->acks_head, tail, call->acks_winsz);
 362
 363         _enter("{%u,%u},%u", call->acks_hard, win, hard);
 364
 365         ASSERTCMP(hard - call->acks_hard, <=, win);
 366
 367         while (call->acks_hard < hard) {
 368                 smp_read_barrier_depends();
 369                 _skb = call->acks_window[tail] & ~1;
 370                 rxrpc_free_skb((struct sk_buff *) _skb);
 371                 old_tail = tail;
 372                 tail = (tail + 1) & (call->acks_winsz - 1);
 373                 call->acks_tail = tail;
 374                 if (call->acks_unacked == old_tail)
 375                         call->acks_unacked = tail;
 376                 call->acks_hard++;
 377         }
 378
 379         wake_up(&call->tx_waitq);
 380 }
 381
 382 /*
 383  * clear the Tx window in the event of a failure
 384  */
 385 static void rxrpc_clear_tx_window(struct rxrpc_call *call)
 386 {
 387         rxrpc_rotate_tx_window(call, atomic_read(&call->sequence));
 388 }
 389
 390 /*
 391  * drain the out of sequence received packet queue into the packet Rx queue
 392  */
 393 static int rxrpc_drain_rx_oos_queue(struct rxrpc_call *call)
 394 {
 395         struct rxrpc_skb_priv *sp;
 396         struct sk_buff *skb;
 397         bool terminal;
 398         int ret;
 399
 400         _enter("{%d,%d}", call->rx_data_post, call->rx_first_oos);
 401
 402         spin_lock_bh(&call->lock);
 403
 404         ret = -ECONNRESET;
 405         if (test_bit(RXRPC_CALL_RELEASED, &call->flags))
 406                 goto socket_unavailable;
 407
 408         skb = skb_dequeue(&call->rx_oos_queue);
 409         if (skb) {
 410                 sp = rxrpc_skb(skb);
 411
 412                 _debug("drain OOS packet %d [%d]",
 413                        sp->hdr.seq, call->rx_first_oos);
 414
 415                 if (sp->hdr.seq != call->rx_first_oos) {
 416                         skb_queue_head(&call->rx_oos_queue, skb);
 417                         call->rx_first_oos = rxrpc_skb(skb)->hdr.seq;
 418                         _debug("requeue %p {%u}", skb, call->rx_first_oos);
 419                 } else {
 420                         skb->mark = RXRPC_SKB_MARK_DATA;
 421                         terminal = ((sp->hdr.flags & RXRPC_LAST_PACKET) &&
 422                                 !(sp->hdr.flags & RXRPC_CLIENT_INITIATED));
 423                         ret = rxrpc_queue_rcv_skb(call, skb, true, terminal);
 424                         BUG_ON(ret < 0);
 425                         _debug("drain #%u", call->rx_data_post);
 426                         call->rx_data_post++;
 427
 428                         /* find out what the next packet is */
 429                         skb = skb_peek(&call->rx_oos_queue);
 430                         if (skb)
 431                                 call->rx_first_oos = rxrpc_skb(skb)->hdr.seq;
 432                         else
 433                                 call->rx_first_oos = 0;
 434                         _debug("peek %p {%u}", skb, call->rx_first_oos);
 435                 }
 436         }
 437
 438         ret = 0;
 439 socket_unavailable:
 440         spin_unlock_bh(&call->lock);
 441         _leave(" = %d", ret);
 442         return ret;
 443 }
 444
 445 /*
 446  * insert an out of sequence packet into the buffer
 447  */
 448 static void rxrpc_insert_oos_packet(struct rxrpc_call *call,
 449                                     struct sk_buff *skb)
 450 {
 451         struct rxrpc_skb_priv *sp, *psp;
 452         struct sk_buff *p;
 453         u32 seq;
 454
 455         sp = rxrpc_skb(skb);
 456         seq = sp->hdr.seq;
 457         _enter(",,{%u}", seq);
 458
 459         skb->destructor = rxrpc_packet_destructor;
 460         ASSERTCMP(sp->call, ==, NULL);
 461         sp->call = call;
 462         rxrpc_get_call(call);
 463
 464         /* insert into the buffer in sequence order */
 465         spin_lock_bh(&call->lock);
 466
 467         skb_queue_walk(&call->rx_oos_queue, p) {
 468                 psp = rxrpc_skb(p);
 469                 if (psp->hdr.seq > seq) {
 470                         _debug("insert oos #%u before #%u", seq, psp->hdr.seq);
 471                         skb_insert(p, skb, &call->rx_oos_queue);
 472                         goto inserted;
 473                 }
 474         }
 475
 476         _debug("append oos #%u", seq);
 477         skb_queue_tail(&call->rx_oos_queue, skb);
 478 inserted:
 479
 480         /* we might now have a new front to the queue */
 481         if (call->rx_first_oos == 0 || seq < call->rx_first_oos)
 482                 call->rx_first_oos = seq;
 483
 484         read_lock(&call->state_lock);
 485         if (call->state < RXRPC_CALL_COMPLETE &&
 486             call->rx_data_post == call->rx_first_oos) {
 487                 _debug("drain rx oos now");
 488                 set_bit(RXRPC_CALL_EV_DRAIN_RX_OOS, &call->events);
 489         }
 490         read_unlock(&call->state_lock);
 491
 492         spin_unlock_bh(&call->lock);
 493         _leave(" [stored #%u]", call->rx_first_oos);
 494 }
 495
 496 /*
 497  * clear the Tx window on final ACK reception
 498  */
 499 static void rxrpc_zap_tx_window(struct rxrpc_call *call)
 500 {
 501         struct rxrpc_skb_priv *sp;
 502         struct sk_buff *skb;
 503         unsigned long _skb, *acks_window;
 504         u8 winsz = call->acks_winsz;
 505         int tail;
 506
 507         acks_window = call->acks_window;
 508         call->acks_window = NULL;
 509
 510         while (CIRC_CNT(call->acks_head, call->acks_tail, winsz) > 0) {
 511                 tail = call->acks_tail;
 512                 smp_read_barrier_depends();
 513                 _skb = acks_window[tail] & ~1;
 514                 smp_mb();
 515                 call->acks_tail = (call->acks_tail + 1) & (winsz - 1);
 516
 517                 skb = (struct sk_buff *) _skb;
 518                 sp = rxrpc_skb(skb);
 519                 _debug("+++ clear Tx %u", sp->hdr.seq);
 520                 rxrpc_free_skb(skb);
 521         }
 522
 523         kfree(acks_window);
 524 }
 525
 526 /*
 527  * process the extra information that may be appended to an ACK packet
 528  */
 529 static void rxrpc_extract_ackinfo(struct rxrpc_call *call, struct sk_buff *skb,
 530                                   unsigned int latest, int nAcks)
 531 {
 532         struct rxrpc_ackinfo ackinfo;
 533         struct rxrpc_peer *peer;
 534         unsigned int mtu;
 535
 536         if (skb_copy_bits(skb, nAcks + 3, &ackinfo, sizeof(ackinfo)) < 0) {
 537                 _leave(" [no ackinfo]");
 538                 return;
 539         }
 540
 541         _proto("Rx ACK %%%u Info { rx=%u max=%u rwin=%u jm=%u }",
 542                latest,
 543                ntohl(ackinfo.rxMTU), ntohl(ackinfo.maxMTU),
 544                ntohl(ackinfo.rwind), ntohl(ackinfo.jumbo_max));
 545
 546         mtu = min(ntohl(ackinfo.rxMTU), ntohl(ackinfo.maxMTU));
 547
 548         peer = call->conn->trans->peer;
 549         if (mtu < peer->maxdata) {
 550                 spin_lock_bh(&peer->lock);
 551                 peer->maxdata = mtu;
 552                 peer->mtu = mtu + peer->hdrsize;
 553                 spin_unlock_bh(&peer->lock);
 554                 _net("Net MTU %u (maxdata %u)", peer->mtu, peer->maxdata);
 555         }
 556 }
 557
 558 /*
 559  * process packets in the reception queue
 560  */
 561 static int rxrpc_process_rx_queue(struct rxrpc_call *call,
 562                                   u32 *_abort_code)
 563 {
 564         struct rxrpc_ackpacket ack;
 565         struct rxrpc_skb_priv *sp;
 566         struct sk_buff *skb;
 567         bool post_ACK;
 568         int latest;
 569         u32 hard, tx;
 570
 571         _enter("");
 572
 573 process_further:
 574         skb = skb_dequeue(&call->rx_queue);
 575         if (!skb)
 576                 return -EAGAIN;
 577
 578         _net("deferred skb %p", skb);
 579
 580         sp = rxrpc_skb(skb);
 581
 582         _debug("process %s [st %d]", rxrpc_pkts[sp->hdr.type], call->state);
 583
 584         post_ACK = false;
 585
 586         switch (sp->hdr.type) {
 587                 /* data packets that wind up here have been received out of
 588                  * order, need security processing or are jumbo packets */
 589         case RXRPC_PACKET_TYPE_DATA:
 590                 _proto("OOSQ DATA %%%u { #%u }", sp->hdr.serial, sp->hdr.seq);
 591
 592                 /* secured packets must be verified and possibly decrypted */
 593                 if (call->conn->security->verify_packet(call, skb,
 594                                                         _abort_code) < 0)
 595                         goto protocol_error;
 596
 597                 rxrpc_insert_oos_packet(call, skb);
 598                 goto process_further;
 599
 600                 /* partial ACK to process */
 601         case RXRPC_PACKET_TYPE_ACK:
 602                 if (skb_copy_bits(skb, 0, &ack, sizeof(ack)) < 0) {
 603                         _debug("extraction failure");
 604                         goto protocol_error;
 605                 }
 606                 if (!skb_pull(skb, sizeof(ack)))
 607                         BUG();
 608
 609                 latest = sp->hdr.serial;
 610                 hard = ntohl(ack.firstPacket);
 611                 tx = atomic_read(&call->sequence);
 612
 613                 _proto("Rx ACK %%%u { m=%hu f=#%u p=#%u s=%%%u r=%s n=%u }",
 614                        latest,
 615                        ntohs(ack.maxSkew),
 616                        hard,
 617                        ntohl(ack.previousPacket),
 618                        ntohl(ack.serial),
 619                        rxrpc_acks(ack.reason),
 620                        ack.nAcks);
 621
 622                 rxrpc_extract_ackinfo(call, skb, latest, ack.nAcks);
 623
 624                 if (ack.reason == RXRPC_ACK_PING) {
 625                         _proto("Rx ACK %%%u PING Request", latest);
 626                         rxrpc_propose_ACK(call, RXRPC_ACK_PING_RESPONSE,
 627                                           sp->hdr.serial, true);
 628                 }
 629
 630                 /* discard any out-of-order or duplicate ACKs */
 631                 if (latest - call->acks_latest <= 0) {
 632                         _debug("discard ACK %d <= %d",
 633                                latest, call->acks_latest);
 634                         goto discard;
 635                 }
 636                 call->acks_latest = latest;
 637
 638                 if (call->state != RXRPC_CALL_CLIENT_SEND_REQUEST &&
 639                     call->state != RXRPC_CALL_CLIENT_AWAIT_REPLY &&
 640                     call->state != RXRPC_CALL_SERVER_SEND_REPLY &&
 641                     call->state != RXRPC_CALL_SERVER_AWAIT_ACK)
 642                         goto discard;
 643
 644                 _debug("Tx=%d H=%u S=%d", tx, call->acks_hard, call->state);
 645
 646                 if (hard > 0) {
 647                         if (hard - 1 > tx) {
 648                                 _debug("hard-ACK'd packet %d not transmitted"
 649                                        " (%d top)",
 650                                        hard - 1, tx);
 651                                 goto protocol_error;
 652                         }
 653
 654                         if ((call->state == RXRPC_CALL_CLIENT_AWAIT_REPLY ||
 655                              call->state == RXRPC_CALL_SERVER_AWAIT_ACK) &&
 656                             hard > tx) {
 657                                 call->acks_hard = tx;
 658                                 goto all_acked;
 659                         }
 660
 661                         smp_rmb();
 662                         rxrpc_rotate_tx_window(call, hard - 1);
 663                 }
 664
 665                 if (ack.nAcks > 0) {
 666                         if (hard - 1 + ack.nAcks > tx) {
 667                                 _debug("soft-ACK'd packet %d+%d not"
 668                                        " transmitted (%d top)",
 669                                        hard - 1, ack.nAcks, tx);
 670                                 goto protocol_error;
 671                         }
 672
 673                         if (rxrpc_process_soft_ACKs(call, &ack, skb) < 0)
 674                                 goto protocol_error;
 675                 }
 676                 goto discard;
 677
 678                 /* complete ACK to process */
 679         case RXRPC_PACKET_TYPE_ACKALL:
 680                 goto all_acked;
 681
 682                 /* abort and busy are handled elsewhere */
 683         case RXRPC_PACKET_TYPE_BUSY:
 684         case RXRPC_PACKET_TYPE_ABORT:
 685                 BUG();
 686
 687                 /* connection level events - also handled elsewhere */
 688         case RXRPC_PACKET_TYPE_CHALLENGE:
 689         case RXRPC_PACKET_TYPE_RESPONSE:
 690         case RXRPC_PACKET_TYPE_DEBUG:
 691                 BUG();
 692         }
 693
 694         /* if we've had a hard ACK that covers all the packets we've sent, then
 695          * that ends that phase of the operation */
 696 all_acked:
 697         write_lock_bh(&call->state_lock);
 698         _debug("ack all %d", call->state);
 699
 700         switch (call->state) {
 701         case RXRPC_CALL_CLIENT_AWAIT_REPLY:
 702                 call->state = RXRPC_CALL_CLIENT_RECV_REPLY;
 703                 break;
 704         case RXRPC_CALL_SERVER_AWAIT_ACK:
 705                 _debug("srv complete");
 706                 call->state = RXRPC_CALL_COMPLETE;
 707                 post_ACK = true;
 708                 break;
 709         case RXRPC_CALL_CLIENT_SEND_REQUEST:
 710         case RXRPC_CALL_SERVER_RECV_REQUEST:
 711                 goto protocol_error_unlock; /* can't occur yet */
 712         default:
 713                 write_unlock_bh(&call->state_lock);
 714                 goto discard; /* assume packet left over from earlier phase */
 715         }
 716
 717         write_unlock_bh(&call->state_lock);
 718
 719         /* if all the packets we sent are hard-ACK'd, then we can discard
 720          * whatever we've got left */
 721         _debug("clear Tx %d",
 722                CIRC_CNT(call->acks_head, call->acks_tail, call->acks_winsz));
 723
 724         del_timer_sync(&call->resend_timer);
 725         clear_bit(RXRPC_CALL_RUN_RTIMER, &call->flags);
 726         clear_bit(RXRPC_CALL_EV_RESEND_TIMER, &call->events);
 727
 728         if (call->acks_window)
 729                 rxrpc_zap_tx_window(call);
 730
 731         if (post_ACK) {
 732                 /* post the final ACK message for userspace to pick up */
 733                 _debug("post ACK");
 734                 skb->mark = RXRPC_SKB_MARK_FINAL_ACK;
 735                 sp->call = call;
 736                 rxrpc_get_call(call);
 737                 spin_lock_bh(&call->lock);
 738                 if (rxrpc_queue_rcv_skb(call, skb, true, true) < 0)
 739                         BUG();
 740                 spin_unlock_bh(&call->lock);
 741                 goto process_further;
 742         }
 743
 744 discard:
 745         rxrpc_free_skb(skb);
 746         goto process_further;
 747
 748 protocol_error_unlock:
 749         write_unlock_bh(&call->state_lock);
 750 protocol_error:
 751         rxrpc_free_skb(skb);
 752         _leave(" = -EPROTO");
 753         return -EPROTO;
 754 }
 755
 756 /*
 757  * post a message to the socket Rx queue for recvmsg() to pick up
 758  */
 759 static int rxrpc_post_message(struct rxrpc_call *call, u32 mark, u32 error,
 760                               bool fatal)
 761 {
 762         struct rxrpc_skb_priv *sp;
 763         struct sk_buff *skb;
 764         int ret;
 765
 766         _enter("{%d,%lx},%u,%u,%d",
 767                call->debug_id, call->flags, mark, error, fatal);
 768
 769         /* remove timers and things for fatal messages */
 770         if (fatal) {
 771                 del_timer_sync(&call->resend_timer);
 772                 del_timer_sync(&call->ack_timer);
 773                 clear_bit(RXRPC_CALL_RUN_RTIMER, &call->flags);
 774         }
 775
 776         if (mark != RXRPC_SKB_MARK_NEW_CALL &&
 777             !test_bit(RXRPC_CALL_HAS_USERID, &call->flags)) {
 778                 _leave("[no userid]");
 779                 return 0;
 780         }
 781
 782         if (!test_bit(RXRPC_CALL_TERMINAL_MSG, &call->flags)) {
 783                 skb = alloc_skb(0, GFP_NOFS);
 784                 if (!skb)
 785                         return -ENOMEM;
 786
 787                 rxrpc_new_skb(skb);
 788
 789                 skb->mark = mark;
 790
 791                 sp = rxrpc_skb(skb);
 792                 memset(sp, 0, sizeof(*sp));
 793                 sp->error = error;
 794                 sp->call = call;
 795                 rxrpc_get_call(call);
 796
 797                 spin_lock_bh(&call->lock);
 798                 ret = rxrpc_queue_rcv_skb(call, skb, true, fatal);
 799                 spin_unlock_bh(&call->lock);
 800                 BUG_ON(ret < 0);
 801         }
 802
 803         return 0;
 804 }
 805
 806 /*
 807  * handle background processing of incoming call packets and ACK / abort
 808  * generation
 809  */
 810 void rxrpc_process_call(struct work_struct *work)
 811 {
 812         struct rxrpc_call *call =
 813                 container_of(work, struct rxrpc_call, processor);
 814         struct rxrpc_wire_header whdr;
 815         struct rxrpc_ackpacket ack;
 816         struct rxrpc_ackinfo ackinfo;
 817         struct msghdr msg;
 818         struct kvec iov[5];
 819         enum rxrpc_call_event genbit;
 820         unsigned long bits;
 821         __be32 data, pad;
 822         size_t len;
 823         int loop, nbit, ioc, ret, mtu;
 824         u32 serial, abort_code = RX_PROTOCOL_ERROR;
 825         u8 *acks = NULL;
 826
 827         //printk("\n--------------------\n");
 828         _enter("{%d,%s,%lx} [%lu]",
 829                call->debug_id, rxrpc_call_states[call->state], call->events,
 830                (jiffies - call->creation_jif) / (HZ / 10));
 831
 832         if (test_and_set_bit(RXRPC_CALL_PROC_BUSY, &call->flags)) {
 833                 _debug("XXXXXXXXXXXXX RUNNING ON MULTIPLE CPUS XXXXXXXXXXXXX");
 834                 return;
 835         }
 836
 837         /* there's a good chance we're going to have to send a message, so set
 838          * one up in advance */
 839         msg.msg_name    = &call->conn->trans->peer->srx.transport;
 840         msg.msg_namelen = call->conn->trans->peer->srx.transport_len;
 841         msg.msg_control = NULL;
 842         msg.msg_controllen = 0;
 843         msg.msg_flags   = 0;
 844
 845         whdr.epoch      = htonl(call->conn->epoch);
 846         whdr.cid        = htonl(call->cid);
 847         whdr.callNumber = htonl(call->call_id);
 848         whdr.seq        = 0;
 849         whdr.type       = RXRPC_PACKET_TYPE_ACK;
 850         whdr.flags      = call->conn->out_clientflag;
 851         whdr.userStatus = 0;
 852         whdr.securityIndex = call->conn->security_ix;
 853         whdr._rsvd      = 0;
 854         whdr.serviceId  = htons(call->service_id);
 855
 856         memset(iov, 0, sizeof(iov));
 857         iov[0].iov_base = &whdr;
 858         iov[0].iov_len  = sizeof(whdr);
 859
 860         /* deal with events of a final nature */
 861         if (test_bit(RXRPC_CALL_EV_RELEASE, &call->events)) {
 862                 rxrpc_release_call(call);
 863                 clear_bit(RXRPC_CALL_EV_RELEASE, &call->events);
 864         }
 865
 866         if (test_bit(RXRPC_CALL_EV_RCVD_ERROR, &call->events)) {
 867                 int error;
 868
 869                 clear_bit(RXRPC_CALL_EV_CONN_ABORT, &call->events);
 870                 clear_bit(RXRPC_CALL_EV_REJECT_BUSY, &call->events);
 871                 clear_bit(RXRPC_CALL_EV_ABORT, &call->events);
 872
 873                 error = call->conn->trans->peer->net_error;
 874                 _debug("post net error %d", error);
 875
 876                 if (rxrpc_post_message(call, RXRPC_SKB_MARK_NET_ERROR,
 877                                        error, true) < 0)
 878                         goto no_mem;
 879                 clear_bit(RXRPC_CALL_EV_RCVD_ERROR, &call->events);
 880                 goto kill_ACKs;
 881         }
 882
 883         if (test_bit(RXRPC_CALL_EV_CONN_ABORT, &call->events)) {
 884                 ASSERTCMP(call->state, >, RXRPC_CALL_COMPLETE);
 885
 886                 clear_bit(RXRPC_CALL_EV_REJECT_BUSY, &call->events);
 887                 clear_bit(RXRPC_CALL_EV_ABORT, &call->events);
 888
 889                 _debug("post conn abort");
 890
 891                 if (rxrpc_post_message(call, RXRPC_SKB_MARK_LOCAL_ERROR,
 892                                        call->conn->error, true) < 0)
 893                         goto no_mem;
 894                 clear_bit(RXRPC_CALL_EV_CONN_ABORT, &call->events);
 895                 goto kill_ACKs;
 896         }
 897
 898         if (test_bit(RXRPC_CALL_EV_REJECT_BUSY, &call->events)) {
 899                 whdr.type = RXRPC_PACKET_TYPE_BUSY;
 900                 genbit = RXRPC_CALL_EV_REJECT_BUSY;
 901                 goto send_message;
 902         }
 903
 904         if (test_bit(RXRPC_CALL_EV_ABORT, &call->events)) {
 905                 ASSERTCMP(call->state, >, RXRPC_CALL_COMPLETE);
 906
 907                 if (rxrpc_post_message(call, RXRPC_SKB_MARK_LOCAL_ERROR,
 908                                        ECONNABORTED, true) < 0)
 909                         goto no_mem;
 910                 whdr.type = RXRPC_PACKET_TYPE_ABORT;
 911                 data = htonl(call->local_abort);
 912                 iov[1].iov_base = &data;
 913                 iov[1].iov_len = sizeof(data);
 914                 genbit = RXRPC_CALL_EV_ABORT;
 915                 goto send_message;
 916         }
 917
 918         if (test_bit(RXRPC_CALL_EV_ACK_FINAL, &call->events)) {
 919                 genbit = RXRPC_CALL_EV_ACK_FINAL;
 920
 921                 ack.bufferSpace = htons(8);
 922                 ack.maxSkew     = 0;
 923                 ack.serial      = 0;
 924                 ack.reason      = RXRPC_ACK_IDLE;
 925                 ack.nAcks       = 0;
 926                 call->ackr_reason = 0;
 927
 928                 spin_lock_bh(&call->lock);
 929                 ack.serial      = htonl(call->ackr_serial);
 930                 ack.previousPacket = htonl(call->ackr_prev_seq);
 931                 ack.firstPacket = htonl(call->rx_data_eaten + 1);
 932                 spin_unlock_bh(&call->lock);
 933
 934                 pad = 0;
 935
 936                 iov[1].iov_base = &ack;
 937                 iov[1].iov_len  = sizeof(ack);
 938                 iov[2].iov_base = &pad;
 939                 iov[2].iov_len  = 3;
 940                 iov[3].iov_base = &ackinfo;
 941                 iov[3].iov_len  = sizeof(ackinfo);
 942                 goto send_ACK;
 943         }
 944
 945         if (call->events & ((1 << RXRPC_CALL_EV_RCVD_BUSY) |
 946                             (1 << RXRPC_CALL_EV_RCVD_ABORT))
 947             ) {
 948                 u32 mark;
 949
 950                 if (test_bit(RXRPC_CALL_EV_RCVD_ABORT, &call->events))
 951                         mark = RXRPC_SKB_MARK_REMOTE_ABORT;
 952                 else
 953                         mark = RXRPC_SKB_MARK_BUSY;
 954
 955                 _debug("post abort/busy");
 956                 rxrpc_clear_tx_window(call);
 957                 if (rxrpc_post_message(call, mark, ECONNABORTED, true) < 0)
 958                         goto no_mem;
 959
 960                 clear_bit(RXRPC_CALL_EV_RCVD_BUSY, &call->events);
 961                 clear_bit(RXRPC_CALL_EV_RCVD_ABORT, &call->events);
 962                 goto kill_ACKs;
 963         }
 964
 965         if (test_and_clear_bit(RXRPC_CALL_EV_RCVD_ACKALL, &call->events)) {
 966                 _debug("do implicit ackall");
 967                 rxrpc_clear_tx_window(call);
 968         }
 969
 970         if (test_bit(RXRPC_CALL_EV_LIFE_TIMER, &call->events)) {
 971                 write_lock_bh(&call->state_lock);
 972                 if (call->state <= RXRPC_CALL_COMPLETE) {
 973                         call->state = RXRPC_CALL_LOCALLY_ABORTED;
 974                         call->local_abort = RX_CALL_TIMEOUT;
 975                         set_bit(RXRPC_CALL_EV_ABORT, &call->events);
 976                 }
 977                 write_unlock_bh(&call->state_lock);
 978
 979                 _debug("post timeout");
 980                 if (rxrpc_post_message(call, RXRPC_SKB_MARK_LOCAL_ERROR,
 981                                        ETIME, true) < 0)
 982                         goto no_mem;
 983
 984                 clear_bit(RXRPC_CALL_EV_LIFE_TIMER, &call->events);
 985                 goto kill_ACKs;
 986         }
 987
 988         /* deal with assorted inbound messages */
 989         if (!skb_queue_empty(&call->rx_queue)) {
 990                 switch (rxrpc_process_rx_queue(call, &abort_code)) {
 991                 case 0:
 992                 case -EAGAIN:
 993                         break;
 994                 case -ENOMEM:
 995                         goto no_mem;
 996                 case -EKEYEXPIRED:
 997                 case -EKEYREJECTED:
 998                 case -EPROTO:
 999                         rxrpc_abort_call(call, abort_code);
1000                         goto kill_ACKs;
1001                 }
1002         }
1003
1004         /* handle resending */
1005         if (test_and_clear_bit(RXRPC_CALL_EV_RESEND_TIMER, &call->events))
1006                 rxrpc_resend_timer(call);
1007         if (test_and_clear_bit(RXRPC_CALL_EV_RESEND, &call->events))
1008                 rxrpc_resend(call);
1009
1010         /* consider sending an ordinary ACK */
1011         if (test_bit(RXRPC_CALL_EV_ACK, &call->events)) {
1012                 _debug("send ACK: window: %d - %d { %lx }",
1013                        call->rx_data_eaten, call->ackr_win_top,
1014                        call->ackr_window[0]);
1015
1016                 if (call->state > RXRPC_CALL_SERVER_ACK_REQUEST &&
1017                     call->ackr_reason != RXRPC_ACK_PING_RESPONSE) {
1018                         /* ACK by sending reply DATA packet in this state */
1019                         clear_bit(RXRPC_CALL_EV_ACK, &call->events);
1020                         goto maybe_reschedule;
1021                 }
1022
1023                 genbit = RXRPC_CALL_EV_ACK;
1024
1025                 acks = kzalloc(call->ackr_win_top - call->rx_data_eaten,
1026                                GFP_NOFS);
1027                 if (!acks)
1028                         goto no_mem;
1029
1030                 //hdr.flags     = RXRPC_SLOW_START_OK;
1031                 ack.bufferSpace = htons(8);
1032                 ack.maxSkew     = 0;
1033
1034                 spin_lock_bh(&call->lock);
1035                 ack.reason      = call->ackr_reason;
1036                 ack.serial      = htonl(call->ackr_serial);
1037                 ack.previousPacket = htonl(call->ackr_prev_seq);
1038                 ack.firstPacket = htonl(call->rx_data_eaten + 1);
1039
1040                 ack.nAcks = 0;
1041                 for (loop = 0; loop < RXRPC_ACKR_WINDOW_ASZ; loop++) {
1042                         nbit = loop * BITS_PER_LONG;
1043                         for (bits = call->ackr_window[loop]; bits; bits >>= 1
1044                              ) {
1045                                 _debug("- l=%d n=%d b=%lx", loop, nbit, bits);
1046                                 if (bits & 1) {
1047                                         acks[nbit] = RXRPC_ACK_TYPE_ACK;
1048                                         ack.nAcks = nbit + 1;
1049                                 }
1050                                 nbit++;
1051                         }
1052                 }
1053                 call->ackr_reason = 0;
1054                 spin_unlock_bh(&call->lock);
1055
1056                 pad = 0;
1057
1058                 iov[1].iov_base = &ack;
1059                 iov[1].iov_len  = sizeof(ack);
1060                 iov[2].iov_base = acks;
1061                 iov[2].iov_len  = ack.nAcks;
1062                 iov[3].iov_base = &pad;
1063                 iov[3].iov_len  = 3;
1064                 iov[4].iov_base = &ackinfo;
1065                 iov[4].iov_len  = sizeof(ackinfo);
1066
1067                 switch (ack.reason) {
1068                 case RXRPC_ACK_REQUESTED:
1069                 case RXRPC_ACK_DUPLICATE:
1070                 case RXRPC_ACK_OUT_OF_SEQUENCE:
1071                 case RXRPC_ACK_EXCEEDS_WINDOW:
1072                 case RXRPC_ACK_NOSPACE:
1073                 case RXRPC_ACK_PING:
1074                 case RXRPC_ACK_PING_RESPONSE:
1075                         goto send_ACK_with_skew;
1076                 case RXRPC_ACK_DELAY:
1077                 case RXRPC_ACK_IDLE:
1078                         goto send_ACK;
1079                 }
1080         }
1081
1082         /* handle completion of security negotiations on an incoming
1083          * connection */
1084         if (test_and_clear_bit(RXRPC_CALL_EV_SECURED, &call->events)) {
1085                 _debug("secured");
1086                 spin_lock_bh(&call->lock);
1087
1088                 if (call->state == RXRPC_CALL_SERVER_SECURING) {
1089                         _debug("securing");
1090                         write_lock(&call->conn->lock);
1091                         if (!test_bit(RXRPC_CALL_RELEASED, &call->flags) &&
1092                             !test_bit(RXRPC_CALL_EV_RELEASE, &call->events)) {
1093                                 _debug("not released");
1094                                 call->state = RXRPC_CALL_SERVER_ACCEPTING;
1095                                 list_move_tail(&call->accept_link,
1096                                                &call->socket->acceptq);
1097                         }
1098                         write_unlock(&call->conn->lock);
1099                         read_lock(&call->state_lock);
1100                         if (call->state < RXRPC_CALL_COMPLETE)
1101                                 set_bit(RXRPC_CALL_EV_POST_ACCEPT, &call->events);
1102                         read_unlock(&call->state_lock);
1103                 }
1104
1105                 spin_unlock_bh(&call->lock);
1106                 if (!test_bit(RXRPC_CALL_EV_POST_ACCEPT, &call->events))
1107                         goto maybe_reschedule;
1108         }
1109
1110         /* post a notification of an acceptable connection to the app */
1111         if (test_bit(RXRPC_CALL_EV_POST_ACCEPT, &call->events)) {
1112                 _debug("post accept");
1113                 if (rxrpc_post_message(call, RXRPC_SKB_MARK_NEW_CALL,
1114                                        0, false) < 0)
1115                         goto no_mem;
1116                 clear_bit(RXRPC_CALL_EV_POST_ACCEPT, &call->events);
1117                 goto maybe_reschedule;
1118         }
1119
1120         /* handle incoming call acceptance */
1121         if (test_and_clear_bit(RXRPC_CALL_EV_ACCEPTED, &call->events)) {
1122                 _debug("accepted");
1123                 ASSERTCMP(call->rx_data_post, ==, 0);
1124                 call->rx_data_post = 1;
1125                 read_lock_bh(&call->state_lock);
1126                 if (call->state < RXRPC_CALL_COMPLETE)
1127                         set_bit(RXRPC_CALL_EV_DRAIN_RX_OOS, &call->events);
1128                 read_unlock_bh(&call->state_lock);
1129         }
1130
1131         /* drain the out of sequence received packet queue into the packet Rx
1132          * queue */
1133         if (test_and_clear_bit(RXRPC_CALL_EV_DRAIN_RX_OOS, &call->events)) {
1134                 while (call->rx_data_post == call->rx_first_oos)
1135                         if (rxrpc_drain_rx_oos_queue(call) < 0)
1136                                 break;
1137                 goto maybe_reschedule;
1138         }
1139
1140         /* other events may have been raised since we started checking */
1141         goto maybe_reschedule;
1142
1143 send_ACK_with_skew:
1144         ack.maxSkew = htons(atomic_read(&call->conn->hi_serial) -
1145                             ntohl(ack.serial));
1146 send_ACK:
1147         mtu = call->conn->trans->peer->if_mtu;
1148         mtu -= call->conn->trans->peer->hdrsize;
1149         ackinfo.maxMTU  = htonl(mtu);
1150         ackinfo.rwind   = htonl(rxrpc_rx_window_size);
1151
1152         /* permit the peer to send us jumbo packets if it wants to */
1153         ackinfo.rxMTU   = htonl(rxrpc_rx_mtu);
1154         ackinfo.jumbo_max = htonl(rxrpc_rx_jumbo_max);
1155
1156         serial = atomic_inc_return(&call->conn->serial);
1157         whdr.serial = htonl(serial);
1158         _proto("Tx ACK %%%u { m=%hu f=#%u p=#%u s=%%%u r=%s n=%u }",
1159                serial,
1160                ntohs(ack.maxSkew),
1161                ntohl(ack.firstPacket),
1162                ntohl(ack.previousPacket),
1163                ntohl(ack.serial),
1164                rxrpc_acks(ack.reason),
1165                ack.nAcks);
1166
1167         del_timer_sync(&call->ack_timer);
1168         if (ack.nAcks > 0)
1169                 set_bit(RXRPC_CALL_TX_SOFT_ACK, &call->flags);
1170         goto send_message_2;
1171
1172 send_message:
1173         _debug("send message");
1174
1175         serial = atomic_inc_return(&call->conn->serial);
1176         whdr.serial = htonl(serial);
1177         _proto("Tx %s %%%u", rxrpc_pkts[whdr.type], serial);
1178 send_message_2:
1179
1180         len = iov[0].iov_len;
1181         ioc = 1;
1182         if (iov[4].iov_len) {
1183                 ioc = 5;
1184                 len += iov[4].iov_len;
1185                 len += iov[3].iov_len;
1186                 len += iov[2].iov_len;
1187                 len += iov[1].iov_len;
1188         } else if (iov[3].iov_len) {
1189                 ioc = 4;
1190                 len += iov[3].iov_len;
1191                 len += iov[2].iov_len;
1192                 len += iov[1].iov_len;
1193         } else if (iov[2].iov_len) {
1194                 ioc = 3;
1195                 len += iov[2].iov_len;
1196                 len += iov[1].iov_len;
1197         } else if (iov[1].iov_len) {
1198                 ioc = 2;
1199                 len += iov[1].iov_len;
1200         }
1201
1202         ret = kernel_sendmsg(call->conn->trans->local->socket,
1203                              &msg, iov, ioc, len);
1204         if (ret < 0) {
1205                 _debug("sendmsg failed: %d", ret);
1206                 read_lock_bh(&call->state_lock);
1207                 if (call->state < RXRPC_CALL_DEAD)
1208                         rxrpc_queue_call(call);
1209                 read_unlock_bh(&call->state_lock);
1210                 goto error;
1211         }
1212
1213         switch (genbit) {
1214         case RXRPC_CALL_EV_ABORT:
1215                 clear_bit(genbit, &call->events);
1216                 clear_bit(RXRPC_CALL_EV_RCVD_ABORT, &call->events);
1217                 goto kill_ACKs;
1218
1219         case RXRPC_CALL_EV_ACK_FINAL:
1220                 write_lock_bh(&call->state_lock);
1221                 if (call->state == RXRPC_CALL_CLIENT_FINAL_ACK)
1222                         call->state = RXRPC_CALL_COMPLETE;
1223                 write_unlock_bh(&call->state_lock);
1224                 goto kill_ACKs;
1225
1226         default:
1227                 clear_bit(genbit, &call->events);
1228                 switch (call->state) {
1229                 case RXRPC_CALL_CLIENT_AWAIT_REPLY:
1230                 case RXRPC_CALL_CLIENT_RECV_REPLY:
1231                 case RXRPC_CALL_SERVER_RECV_REQUEST:
1232                 case RXRPC_CALL_SERVER_ACK_REQUEST:
1233                         _debug("start ACK timer");
1234                         rxrpc_propose_ACK(call, RXRPC_ACK_DELAY,
1235                                           call->ackr_serial, false);
1236                 default:
1237                         break;
1238                 }
1239                 goto maybe_reschedule;
1240         }
1241
1242 kill_ACKs:
1243         del_timer_sync(&call->ack_timer);
1244         if (test_and_clear_bit(RXRPC_CALL_EV_ACK_FINAL, &call->events))
1245                 rxrpc_put_call(call);
1246         clear_bit(RXRPC_CALL_EV_ACK, &call->events);
1247
1248 maybe_reschedule:
1249         if (call->events || !skb_queue_empty(&call->rx_queue)) {
1250                 read_lock_bh(&call->state_lock);
1251                 if (call->state < RXRPC_CALL_DEAD)
1252                         rxrpc_queue_call(call);
1253                 read_unlock_bh(&call->state_lock);
1254         }
1255
1256         /* don't leave aborted connections on the accept queue */
1257         if (call->state >= RXRPC_CALL_COMPLETE &&
1258             !list_empty(&call->accept_link)) {
1259                 _debug("X unlinking once-pending call %p { e=%lx f=%lx c=%x }",
1260                        call, call->events, call->flags, call->conn->cid);
1261
1262                 read_lock_bh(&call->state_lock);
1263                 if (!test_bit(RXRPC_CALL_RELEASED, &call->flags) &&
1264                     !test_and_set_bit(RXRPC_CALL_EV_RELEASE, &call->events))
1265                         rxrpc_queue_call(call);
1266                 read_unlock_bh(&call->state_lock);
1267         }
1268
1269 error:
1270         clear_bit(RXRPC_CALL_PROC_BUSY, &call->flags);
1271         kfree(acks);
1272
1273         /* because we don't want two CPUs both processing the work item for one
1274          * call at the same time, we use a flag to note when it's busy; however
1275          * this means there's a race between clearing the flag and setting the
1276          * work pending bit and the work item being processed again */
1277         if (call->events && !work_pending(&call->processor)) {
1278                 _debug("jumpstart %x", call->conn->cid);
1279                 rxrpc_queue_call(call);
1280         }
1281
1282         _leave("");
1283         return;
1284
1285 no_mem:
1286         _debug("out of memory");
1287         goto maybe_reschedule;
1288 }