xref: /linux/net/sctp/sm_sideeffect.c (revision f3d9478b2ce468c3115b02ecae7e975990697f15)
1 /* SCTP kernel reference Implementation
2  * (C) Copyright IBM Corp. 2001, 2004
3  * Copyright (c) 1999 Cisco, Inc.
4  * Copyright (c) 1999-2001 Motorola, Inc.
5  *
6  * This file is part of the SCTP kernel reference Implementation
7  *
8  * These functions work with the state functions in sctp_sm_statefuns.c
9  * to implement that state operations.  These functions implement the
10  * steps which require modifying existing data structures.
11  *
12  * The SCTP reference implementation is free software;
13  * you can redistribute it and/or modify it under the terms of
14  * the GNU General Public License as published by
15  * the Free Software Foundation; either version 2, or (at your option)
16  * any later version.
17  *
18  * The SCTP reference implementation is distributed in the hope that it
19  * will be useful, but WITHOUT ANY WARRANTY; without even the implied
20  *                 ************************
21  * warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
22  * See the GNU General Public License for more details.
23  *
24  * You should have received a copy of the GNU General Public License
25  * along with GNU CC; see the file COPYING.  If not, write to
26  * the Free Software Foundation, 59 Temple Place - Suite 330,
27  * Boston, MA 02111-1307, USA.
28  *
29  * Please send any bug reports or fixes you make to the
30  * email address(es):
31  *    lksctp developers <lksctp-developers@lists.sourceforge.net>
32  *
33  * Or submit a bug report through the following website:
34  *    http://www.sf.net/projects/lksctp
35  *
36  * Written or modified by:
37  *    La Monte H.P. Yarroll <piggy@acm.org>
38  *    Karl Knutson          <karl@athena.chicago.il.us>
39  *    Jon Grimm             <jgrimm@austin.ibm.com>
40  *    Hui Huang		    <hui.huang@nokia.com>
41  *    Dajiang Zhang	    <dajiang.zhang@nokia.com>
42  *    Daisy Chang	    <daisyc@us.ibm.com>
43  *    Sridhar Samudrala	    <sri@us.ibm.com>
44  *    Ardelle Fan	    <ardelle.fan@intel.com>
45  *
46  * Any bugs reported given to us we will try to fix... any fixes shared will
47  * be incorporated into the next SCTP release.
48  */
49 
50 #include <linux/skbuff.h>
51 #include <linux/types.h>
52 #include <linux/socket.h>
53 #include <linux/ip.h>
54 #include <net/sock.h>
55 #include <net/sctp/sctp.h>
56 #include <net/sctp/sm.h>
57 
58 static int sctp_cmd_interpreter(sctp_event_t event_type,
59 				sctp_subtype_t subtype,
60 				sctp_state_t state,
61 				struct sctp_endpoint *ep,
62 				struct sctp_association *asoc,
63 				void *event_arg,
64 			 	sctp_disposition_t status,
65 				sctp_cmd_seq_t *commands,
66 				gfp_t gfp);
67 static int sctp_side_effects(sctp_event_t event_type, sctp_subtype_t subtype,
68 			     sctp_state_t state,
69 			     struct sctp_endpoint *ep,
70 			     struct sctp_association *asoc,
71 			     void *event_arg,
72 			     sctp_disposition_t status,
73 			     sctp_cmd_seq_t *commands,
74 			     gfp_t gfp);
75 
76 /********************************************************************
77  * Helper functions
78  ********************************************************************/
79 
80 /* A helper function for delayed processing of INET ECN CE bit. */
81 static void sctp_do_ecn_ce_work(struct sctp_association *asoc,
82 				__u32 lowest_tsn)
83 {
84 	/* Save the TSN away for comparison when we receive CWR */
85 
86 	asoc->last_ecne_tsn = lowest_tsn;
87 	asoc->need_ecne = 1;
88 }
89 
90 /* Helper function for delayed processing of SCTP ECNE chunk.  */
91 /* RFC 2960 Appendix A
92  *
93  * RFC 2481 details a specific bit for a sender to send in
94  * the header of its next outbound TCP segment to indicate to
95  * its peer that it has reduced its congestion window.  This
96  * is termed the CWR bit.  For SCTP the same indication is made
97  * by including the CWR chunk.  This chunk contains one data
98  * element, i.e. the TSN number that was sent in the ECNE chunk.
99  * This element represents the lowest TSN number in the datagram
100  * that was originally marked with the CE bit.
101  */
102 static struct sctp_chunk *sctp_do_ecn_ecne_work(struct sctp_association *asoc,
103 					   __u32 lowest_tsn,
104 					   struct sctp_chunk *chunk)
105 {
106 	struct sctp_chunk *repl;
107 
108 	/* Our previously transmitted packet ran into some congestion
109 	 * so we should take action by reducing cwnd and ssthresh
110 	 * and then ACK our peer that we we've done so by
111 	 * sending a CWR.
112 	 */
113 
114 	/* First, try to determine if we want to actually lower
115 	 * our cwnd variables.  Only lower them if the ECNE looks more
116 	 * recent than the last response.
117 	 */
118 	if (TSN_lt(asoc->last_cwr_tsn, lowest_tsn)) {
119 		struct sctp_transport *transport;
120 
121 		/* Find which transport's congestion variables
122 		 * need to be adjusted.
123 		 */
124 		transport = sctp_assoc_lookup_tsn(asoc, lowest_tsn);
125 
126 		/* Update the congestion variables. */
127 		if (transport)
128 			sctp_transport_lower_cwnd(transport,
129 						  SCTP_LOWER_CWND_ECNE);
130 		asoc->last_cwr_tsn = lowest_tsn;
131 	}
132 
133 	/* Always try to quiet the other end.  In case of lost CWR,
134 	 * resend last_cwr_tsn.
135 	 */
136 	repl = sctp_make_cwr(asoc, asoc->last_cwr_tsn, chunk);
137 
138 	/* If we run out of memory, it will look like a lost CWR.  We'll
139 	 * get back in sync eventually.
140 	 */
141 	return repl;
142 }
143 
144 /* Helper function to do delayed processing of ECN CWR chunk.  */
145 static void sctp_do_ecn_cwr_work(struct sctp_association *asoc,
146 				 __u32 lowest_tsn)
147 {
148 	/* Turn off ECNE getting auto-prepended to every outgoing
149 	 * packet
150 	 */
151 	asoc->need_ecne = 0;
152 }
153 
154 /* Generate SACK if necessary.  We call this at the end of a packet.  */
155 static int sctp_gen_sack(struct sctp_association *asoc, int force,
156 			 sctp_cmd_seq_t *commands)
157 {
158 	__u32 ctsn, max_tsn_seen;
159 	struct sctp_chunk *sack;
160 	struct sctp_transport *trans = asoc->peer.last_data_from;
161 	int error = 0;
162 
163 	if (force ||
164 	    (!trans && (asoc->param_flags & SPP_SACKDELAY_DISABLE)) ||
165 	    (trans && (trans->param_flags & SPP_SACKDELAY_DISABLE)))
166 		asoc->peer.sack_needed = 1;
167 
168 	ctsn = sctp_tsnmap_get_ctsn(&asoc->peer.tsn_map);
169 	max_tsn_seen = sctp_tsnmap_get_max_tsn_seen(&asoc->peer.tsn_map);
170 
171 	/* From 12.2 Parameters necessary per association (i.e. the TCB):
172 	 *
173 	 * Ack State : This flag indicates if the next received packet
174 	 * 	     : is to be responded to with a SACK. ...
175 	 *	     : When DATA chunks are out of order, SACK's
176 	 *           : are not delayed (see Section 6).
177 	 *
178 	 * [This is actually not mentioned in Section 6, but we
179 	 * implement it here anyway. --piggy]
180 	 */
181         if (max_tsn_seen != ctsn)
182 		asoc->peer.sack_needed = 1;
183 
184 	/* From 6.2  Acknowledgement on Reception of DATA Chunks:
185 	 *
186 	 * Section 4.2 of [RFC2581] SHOULD be followed. Specifically,
187 	 * an acknowledgement SHOULD be generated for at least every
188 	 * second packet (not every second DATA chunk) received, and
189 	 * SHOULD be generated within 200 ms of the arrival of any
190 	 * unacknowledged DATA chunk. ...
191 	 */
192 	if (!asoc->peer.sack_needed) {
193 		/* We will need a SACK for the next packet.  */
194 		asoc->peer.sack_needed = 1;
195 
196 		/* Set the SACK delay timeout based on the
197 		 * SACK delay for the last transport
198 		 * data was received from, or the default
199 		 * for the association.
200 		 */
201 		if (trans)
202 			asoc->timeouts[SCTP_EVENT_TIMEOUT_SACK] =
203 				trans->sackdelay;
204 		else
205 			asoc->timeouts[SCTP_EVENT_TIMEOUT_SACK] =
206 				asoc->sackdelay;
207 
208 		/* Restart the SACK timer. */
209 		sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_RESTART,
210 				SCTP_TO(SCTP_EVENT_TIMEOUT_SACK));
211 	} else {
212 		if (asoc->a_rwnd > asoc->rwnd)
213 			asoc->a_rwnd = asoc->rwnd;
214 		sack = sctp_make_sack(asoc);
215 		if (!sack)
216 			goto nomem;
217 
218 		asoc->peer.sack_needed = 0;
219 
220 		error = sctp_outq_tail(&asoc->outqueue, sack);
221 
222 		/* Stop the SACK timer.  */
223 		sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
224 				SCTP_TO(SCTP_EVENT_TIMEOUT_SACK));
225 	}
226 
227 	return error;
228 nomem:
229 	error = -ENOMEM;
230 	return error;
231 }
232 
233 /* When the T3-RTX timer expires, it calls this function to create the
234  * relevant state machine event.
235  */
236 void sctp_generate_t3_rtx_event(unsigned long peer)
237 {
238 	int error;
239 	struct sctp_transport *transport = (struct sctp_transport *) peer;
240 	struct sctp_association *asoc = transport->asoc;
241 
242 	/* Check whether a task is in the sock.  */
243 
244 	sctp_bh_lock_sock(asoc->base.sk);
245 	if (sock_owned_by_user(asoc->base.sk)) {
246 		SCTP_DEBUG_PRINTK("%s:Sock is busy.\n", __FUNCTION__);
247 
248 		/* Try again later.  */
249 		if (!mod_timer(&transport->T3_rtx_timer, jiffies + (HZ/20)))
250 			sctp_transport_hold(transport);
251 		goto out_unlock;
252 	}
253 
254 	/* Is this transport really dead and just waiting around for
255 	 * the timer to let go of the reference?
256 	 */
257 	if (transport->dead)
258 		goto out_unlock;
259 
260 	/* Run through the state machine.  */
261 	error = sctp_do_sm(SCTP_EVENT_T_TIMEOUT,
262 			   SCTP_ST_TIMEOUT(SCTP_EVENT_TIMEOUT_T3_RTX),
263 			   asoc->state,
264 			   asoc->ep, asoc,
265 			   transport, GFP_ATOMIC);
266 
267 	if (error)
268 		asoc->base.sk->sk_err = -error;
269 
270 out_unlock:
271 	sctp_bh_unlock_sock(asoc->base.sk);
272 	sctp_transport_put(transport);
273 }
274 
275 /* This is a sa interface for producing timeout events.  It works
276  * for timeouts which use the association as their parameter.
277  */
278 static void sctp_generate_timeout_event(struct sctp_association *asoc,
279 					sctp_event_timeout_t timeout_type)
280 {
281 	int error = 0;
282 
283 	sctp_bh_lock_sock(asoc->base.sk);
284 	if (sock_owned_by_user(asoc->base.sk)) {
285 		SCTP_DEBUG_PRINTK("%s:Sock is busy: timer %d\n",
286 				  __FUNCTION__,
287 				  timeout_type);
288 
289 		/* Try again later.  */
290 		if (!mod_timer(&asoc->timers[timeout_type], jiffies + (HZ/20)))
291 			sctp_association_hold(asoc);
292 		goto out_unlock;
293 	}
294 
295 	/* Is this association really dead and just waiting around for
296 	 * the timer to let go of the reference?
297 	 */
298 	if (asoc->base.dead)
299 		goto out_unlock;
300 
301 	/* Run through the state machine.  */
302 	error = sctp_do_sm(SCTP_EVENT_T_TIMEOUT,
303 			   SCTP_ST_TIMEOUT(timeout_type),
304 			   asoc->state, asoc->ep, asoc,
305 			   (void *)timeout_type, GFP_ATOMIC);
306 
307 	if (error)
308 		asoc->base.sk->sk_err = -error;
309 
310 out_unlock:
311 	sctp_bh_unlock_sock(asoc->base.sk);
312 	sctp_association_put(asoc);
313 }
314 
315 static void sctp_generate_t1_cookie_event(unsigned long data)
316 {
317 	struct sctp_association *asoc = (struct sctp_association *) data;
318 	sctp_generate_timeout_event(asoc, SCTP_EVENT_TIMEOUT_T1_COOKIE);
319 }
320 
321 static void sctp_generate_t1_init_event(unsigned long data)
322 {
323 	struct sctp_association *asoc = (struct sctp_association *) data;
324 	sctp_generate_timeout_event(asoc, SCTP_EVENT_TIMEOUT_T1_INIT);
325 }
326 
327 static void sctp_generate_t2_shutdown_event(unsigned long data)
328 {
329 	struct sctp_association *asoc = (struct sctp_association *) data;
330 	sctp_generate_timeout_event(asoc, SCTP_EVENT_TIMEOUT_T2_SHUTDOWN);
331 }
332 
333 static void sctp_generate_t4_rto_event(unsigned long data)
334 {
335 	struct sctp_association *asoc = (struct sctp_association *) data;
336 	sctp_generate_timeout_event(asoc, SCTP_EVENT_TIMEOUT_T4_RTO);
337 }
338 
339 static void sctp_generate_t5_shutdown_guard_event(unsigned long data)
340 {
341         struct sctp_association *asoc = (struct sctp_association *)data;
342         sctp_generate_timeout_event(asoc,
343 				    SCTP_EVENT_TIMEOUT_T5_SHUTDOWN_GUARD);
344 
345 } /* sctp_generate_t5_shutdown_guard_event() */
346 
347 static void sctp_generate_autoclose_event(unsigned long data)
348 {
349 	struct sctp_association *asoc = (struct sctp_association *) data;
350 	sctp_generate_timeout_event(asoc, SCTP_EVENT_TIMEOUT_AUTOCLOSE);
351 }
352 
353 /* Generate a heart beat event.  If the sock is busy, reschedule.   Make
354  * sure that the transport is still valid.
355  */
356 void sctp_generate_heartbeat_event(unsigned long data)
357 {
358 	int error = 0;
359 	struct sctp_transport *transport = (struct sctp_transport *) data;
360 	struct sctp_association *asoc = transport->asoc;
361 
362 	sctp_bh_lock_sock(asoc->base.sk);
363 	if (sock_owned_by_user(asoc->base.sk)) {
364 		SCTP_DEBUG_PRINTK("%s:Sock is busy.\n", __FUNCTION__);
365 
366 		/* Try again later.  */
367 		if (!mod_timer(&transport->hb_timer, jiffies + (HZ/20)))
368 			sctp_transport_hold(transport);
369 		goto out_unlock;
370 	}
371 
372 	/* Is this structure just waiting around for us to actually
373 	 * get destroyed?
374 	 */
375 	if (transport->dead)
376 		goto out_unlock;
377 
378 	error = sctp_do_sm(SCTP_EVENT_T_TIMEOUT,
379 			   SCTP_ST_TIMEOUT(SCTP_EVENT_TIMEOUT_HEARTBEAT),
380 			   asoc->state, asoc->ep, asoc,
381 			   transport, GFP_ATOMIC);
382 
383          if (error)
384 		 asoc->base.sk->sk_err = -error;
385 
386 out_unlock:
387 	sctp_bh_unlock_sock(asoc->base.sk);
388 	sctp_transport_put(transport);
389 }
390 
391 /* Inject a SACK Timeout event into the state machine.  */
392 static void sctp_generate_sack_event(unsigned long data)
393 {
394 	struct sctp_association *asoc = (struct sctp_association *) data;
395 	sctp_generate_timeout_event(asoc, SCTP_EVENT_TIMEOUT_SACK);
396 }
397 
398 sctp_timer_event_t *sctp_timer_events[SCTP_NUM_TIMEOUT_TYPES] = {
399 	NULL,
400 	sctp_generate_t1_cookie_event,
401 	sctp_generate_t1_init_event,
402 	sctp_generate_t2_shutdown_event,
403 	NULL,
404 	sctp_generate_t4_rto_event,
405 	sctp_generate_t5_shutdown_guard_event,
406 	NULL,
407 	sctp_generate_sack_event,
408 	sctp_generate_autoclose_event,
409 };
410 
411 
412 /* RFC 2960 8.2 Path Failure Detection
413  *
414  * When its peer endpoint is multi-homed, an endpoint should keep a
415  * error counter for each of the destination transport addresses of the
416  * peer endpoint.
417  *
418  * Each time the T3-rtx timer expires on any address, or when a
419  * HEARTBEAT sent to an idle address is not acknowledged within a RTO,
420  * the error counter of that destination address will be incremented.
421  * When the value in the error counter exceeds the protocol parameter
422  * 'Path.Max.Retrans' of that destination address, the endpoint should
423  * mark the destination transport address as inactive, and a
424  * notification SHOULD be sent to the upper layer.
425  *
426  */
427 static void sctp_do_8_2_transport_strike(struct sctp_association *asoc,
428 					 struct sctp_transport *transport)
429 {
430 	/* The check for association's overall error counter exceeding the
431 	 * threshold is done in the state function.
432 	 */
433 	asoc->overall_error_count++;
434 
435 	if (transport->state != SCTP_INACTIVE &&
436 	    (transport->error_count++ >= transport->pathmaxrxt)) {
437 		SCTP_DEBUG_PRINTK_IPADDR("transport_strike:association %p",
438 					 " transport IP: port:%d failed.\n",
439 					 asoc,
440 					 (&transport->ipaddr),
441 					 transport->ipaddr.v4.sin_port);
442 		sctp_assoc_control_transport(asoc, transport,
443 					     SCTP_TRANSPORT_DOWN,
444 					     SCTP_FAILED_THRESHOLD);
445 	}
446 
447 	/* E2) For the destination address for which the timer
448 	 * expires, set RTO <- RTO * 2 ("back off the timer").  The
449 	 * maximum value discussed in rule C7 above (RTO.max) may be
450 	 * used to provide an upper bound to this doubling operation.
451 	 */
452 	transport->rto = min((transport->rto * 2), transport->asoc->rto_max);
453 }
454 
455 /* Worker routine to handle INIT command failure.  */
456 static void sctp_cmd_init_failed(sctp_cmd_seq_t *commands,
457 				 struct sctp_association *asoc,
458 				 unsigned error)
459 {
460 	struct sctp_ulpevent *event;
461 
462 	event = sctp_ulpevent_make_assoc_change(asoc,0, SCTP_CANT_STR_ASSOC,
463 						(__u16)error, 0, 0,
464 						GFP_ATOMIC);
465 
466 	if (event)
467 		sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP,
468 				SCTP_ULPEVENT(event));
469 
470 	sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
471 			SCTP_STATE(SCTP_STATE_CLOSED));
472 
473 	/* SEND_FAILED sent later when cleaning up the association. */
474 	asoc->outqueue.error = error;
475 	sctp_add_cmd_sf(commands, SCTP_CMD_DELETE_TCB, SCTP_NULL());
476 }
477 
478 /* Worker routine to handle SCTP_CMD_ASSOC_FAILED.  */
479 static void sctp_cmd_assoc_failed(sctp_cmd_seq_t *commands,
480 				  struct sctp_association *asoc,
481 				  sctp_event_t event_type,
482 				  sctp_subtype_t subtype,
483 				  struct sctp_chunk *chunk,
484 				  unsigned error)
485 {
486 	struct sctp_ulpevent *event;
487 
488 	/* Cancel any partial delivery in progress. */
489 	sctp_ulpq_abort_pd(&asoc->ulpq, GFP_ATOMIC);
490 
491 	event = sctp_ulpevent_make_assoc_change(asoc, 0, SCTP_COMM_LOST,
492 						(__u16)error, 0, 0,
493 						GFP_ATOMIC);
494 	if (event)
495 		sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP,
496 				SCTP_ULPEVENT(event));
497 
498 	sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
499 			SCTP_STATE(SCTP_STATE_CLOSED));
500 
501 	/* SEND_FAILED sent later when cleaning up the association. */
502 	asoc->outqueue.error = error;
503 	sctp_add_cmd_sf(commands, SCTP_CMD_DELETE_TCB, SCTP_NULL());
504 }
505 
506 /* Process an init chunk (may be real INIT/INIT-ACK or an embedded INIT
507  * inside the cookie.  In reality, this is only used for INIT-ACK processing
508  * since all other cases use "temporary" associations and can do all
509  * their work in statefuns directly.
510  */
511 static int sctp_cmd_process_init(sctp_cmd_seq_t *commands,
512 				 struct sctp_association *asoc,
513 				 struct sctp_chunk *chunk,
514 				 sctp_init_chunk_t *peer_init,
515 				 gfp_t gfp)
516 {
517 	int error;
518 
519 	/* We only process the init as a sideeffect in a single
520 	 * case.   This is when we process the INIT-ACK.   If we
521 	 * fail during INIT processing (due to malloc problems),
522 	 * just return the error and stop processing the stack.
523 	 */
524 	if (!sctp_process_init(asoc, chunk->chunk_hdr->type,
525 			       sctp_source(chunk), peer_init, gfp))
526 		error = -ENOMEM;
527 	else
528 		error = 0;
529 
530 	return error;
531 }
532 
533 /* Helper function to break out starting up of heartbeat timers.  */
534 static void sctp_cmd_hb_timers_start(sctp_cmd_seq_t *cmds,
535 				     struct sctp_association *asoc)
536 {
537 	struct sctp_transport *t;
538 	struct list_head *pos;
539 
540 	/* Start a heartbeat timer for each transport on the association.
541 	 * hold a reference on the transport to make sure none of
542 	 * the needed data structures go away.
543 	 */
544 	list_for_each(pos, &asoc->peer.transport_addr_list) {
545 		t = list_entry(pos, struct sctp_transport, transports);
546 
547 		if (!mod_timer(&t->hb_timer, sctp_transport_timeout(t)))
548 			sctp_transport_hold(t);
549 	}
550 }
551 
552 static void sctp_cmd_hb_timers_stop(sctp_cmd_seq_t *cmds,
553 				    struct sctp_association *asoc)
554 {
555 	struct sctp_transport *t;
556 	struct list_head *pos;
557 
558 	/* Stop all heartbeat timers. */
559 
560 	list_for_each(pos, &asoc->peer.transport_addr_list) {
561 		t = list_entry(pos, struct sctp_transport, transports);
562 		if (del_timer(&t->hb_timer))
563 			sctp_transport_put(t);
564 	}
565 }
566 
567 /* Helper function to stop any pending T3-RTX timers */
568 static void sctp_cmd_t3_rtx_timers_stop(sctp_cmd_seq_t *cmds,
569 				        struct sctp_association *asoc)
570 {
571 	struct sctp_transport *t;
572 	struct list_head *pos;
573 
574 	list_for_each(pos, &asoc->peer.transport_addr_list) {
575 		t = list_entry(pos, struct sctp_transport, transports);
576 		if (timer_pending(&t->T3_rtx_timer) &&
577 		    del_timer(&t->T3_rtx_timer)) {
578 			sctp_transport_put(t);
579 		}
580 	}
581 }
582 
583 
584 /* Helper function to update the heartbeat timer. */
585 static void sctp_cmd_hb_timer_update(sctp_cmd_seq_t *cmds,
586 				     struct sctp_association *asoc,
587 				     struct sctp_transport *t)
588 {
589 	/* Update the heartbeat timer.  */
590 	if (!mod_timer(&t->hb_timer, sctp_transport_timeout(t)))
591 		sctp_transport_hold(t);
592 }
593 
594 /* Helper function to handle the reception of an HEARTBEAT ACK.  */
595 static void sctp_cmd_transport_on(sctp_cmd_seq_t *cmds,
596 				  struct sctp_association *asoc,
597 				  struct sctp_transport *t,
598 				  struct sctp_chunk *chunk)
599 {
600 	sctp_sender_hb_info_t *hbinfo;
601 
602 	/* 8.3 Upon the receipt of the HEARTBEAT ACK, the sender of the
603 	 * HEARTBEAT should clear the error counter of the destination
604 	 * transport address to which the HEARTBEAT was sent.
605 	 * The association's overall error count is also cleared.
606 	 */
607 	t->error_count = 0;
608 	t->asoc->overall_error_count = 0;
609 
610 	/* Mark the destination transport address as active if it is not so
611 	 * marked.
612 	 */
613 	if (t->state == SCTP_INACTIVE)
614 		sctp_assoc_control_transport(asoc, t, SCTP_TRANSPORT_UP,
615 					     SCTP_HEARTBEAT_SUCCESS);
616 
617 	/* The receiver of the HEARTBEAT ACK should also perform an
618 	 * RTT measurement for that destination transport address
619 	 * using the time value carried in the HEARTBEAT ACK chunk.
620 	 */
621 	hbinfo = (sctp_sender_hb_info_t *) chunk->skb->data;
622 	sctp_transport_update_rto(t, (jiffies - hbinfo->sent_at));
623 }
624 
625 /* Helper function to do a transport reset at the expiry of the hearbeat
626  * timer.
627  */
628 static void sctp_cmd_transport_reset(sctp_cmd_seq_t *cmds,
629 				     struct sctp_association *asoc,
630 				     struct sctp_transport *t)
631 {
632 	sctp_transport_lower_cwnd(t, SCTP_LOWER_CWND_INACTIVE);
633 
634 	/* Mark one strike against a transport.  */
635 	sctp_do_8_2_transport_strike(asoc, t);
636 }
637 
638 /* Helper function to process the process SACK command.  */
639 static int sctp_cmd_process_sack(sctp_cmd_seq_t *cmds,
640 				 struct sctp_association *asoc,
641 				 struct sctp_sackhdr *sackh)
642 {
643 	int err;
644 
645 	if (sctp_outq_sack(&asoc->outqueue, sackh)) {
646 		/* There are no more TSNs awaiting SACK.  */
647 		err = sctp_do_sm(SCTP_EVENT_T_OTHER,
648 				 SCTP_ST_OTHER(SCTP_EVENT_NO_PENDING_TSN),
649 				 asoc->state, asoc->ep, asoc, NULL,
650 				 GFP_ATOMIC);
651 	} else {
652 		/* Windows may have opened, so we need
653 		 * to check if we have DATA to transmit
654 		 */
655 		err = sctp_outq_flush(&asoc->outqueue, 0);
656 	}
657 
658 	return err;
659 }
660 
661 /* Helper function to set the timeout value for T2-SHUTDOWN timer and to set
662  * the transport for a shutdown chunk.
663  */
664 static void sctp_cmd_setup_t2(sctp_cmd_seq_t *cmds,
665 			      struct sctp_association *asoc,
666 			      struct sctp_chunk *chunk)
667 {
668 	struct sctp_transport *t;
669 
670 	t = sctp_assoc_choose_shutdown_transport(asoc);
671 	asoc->shutdown_last_sent_to = t;
672 	asoc->timeouts[SCTP_EVENT_TIMEOUT_T2_SHUTDOWN] = t->rto;
673 	chunk->transport = t;
674 }
675 
676 /* Helper function to change the state of an association. */
677 static void sctp_cmd_new_state(sctp_cmd_seq_t *cmds,
678 			       struct sctp_association *asoc,
679 			       sctp_state_t state)
680 {
681 	struct sock *sk = asoc->base.sk;
682 
683 	asoc->state = state;
684 
685 	SCTP_DEBUG_PRINTK("sctp_cmd_new_state: asoc %p[%s]\n",
686 			  asoc, sctp_state_tbl[state]);
687 
688 	if (sctp_style(sk, TCP)) {
689 		/* Change the sk->sk_state of a TCP-style socket that has
690 		 * sucessfully completed a connect() call.
691 		 */
692 		if (sctp_state(asoc, ESTABLISHED) && sctp_sstate(sk, CLOSED))
693 			sk->sk_state = SCTP_SS_ESTABLISHED;
694 
695 		/* Set the RCV_SHUTDOWN flag when a SHUTDOWN is received. */
696 		if (sctp_state(asoc, SHUTDOWN_RECEIVED) &&
697 		    sctp_sstate(sk, ESTABLISHED))
698 			sk->sk_shutdown |= RCV_SHUTDOWN;
699 	}
700 
701 	if (sctp_state(asoc, COOKIE_WAIT)) {
702 		/* Reset init timeouts since they may have been
703 		 * increased due to timer expirations.
704 		 */
705 		asoc->timeouts[SCTP_EVENT_TIMEOUT_T1_INIT] =
706 						asoc->rto_initial;
707 		asoc->timeouts[SCTP_EVENT_TIMEOUT_T1_COOKIE] =
708 						asoc->rto_initial;
709 	}
710 
711 	if (sctp_state(asoc, ESTABLISHED) ||
712 	    sctp_state(asoc, CLOSED) ||
713 	    sctp_state(asoc, SHUTDOWN_RECEIVED)) {
714 		/* Wake up any processes waiting in the asoc's wait queue in
715 		 * sctp_wait_for_connect() or sctp_wait_for_sndbuf().
716 	 	 */
717 		if (waitqueue_active(&asoc->wait))
718 			wake_up_interruptible(&asoc->wait);
719 
720 		/* Wake up any processes waiting in the sk's sleep queue of
721 		 * a TCP-style or UDP-style peeled-off socket in
722 		 * sctp_wait_for_accept() or sctp_wait_for_packet().
723 		 * For a UDP-style socket, the waiters are woken up by the
724 		 * notifications.
725 		 */
726 		if (!sctp_style(sk, UDP))
727 			sk->sk_state_change(sk);
728 	}
729 }
730 
731 /* Helper function to delete an association. */
732 static void sctp_cmd_delete_tcb(sctp_cmd_seq_t *cmds,
733 				struct sctp_association *asoc)
734 {
735 	struct sock *sk = asoc->base.sk;
736 
737 	/* If it is a non-temporary association belonging to a TCP-style
738 	 * listening socket that is not closed, do not free it so that accept()
739 	 * can pick it up later.
740 	 */
741 	if (sctp_style(sk, TCP) && sctp_sstate(sk, LISTENING) &&
742 	    (!asoc->temp) && (sk->sk_shutdown != SHUTDOWN_MASK))
743 		return;
744 
745 	sctp_unhash_established(asoc);
746 	sctp_association_free(asoc);
747 }
748 
749 /*
750  * ADDIP Section 4.1 ASCONF Chunk Procedures
751  * A4) Start a T-4 RTO timer, using the RTO value of the selected
752  * destination address (we use active path instead of primary path just
753  * because primary path may be inactive.
754  */
755 static void sctp_cmd_setup_t4(sctp_cmd_seq_t *cmds,
756 				struct sctp_association *asoc,
757 				struct sctp_chunk *chunk)
758 {
759 	struct sctp_transport *t;
760 
761 	t = asoc->peer.active_path;
762 	asoc->timeouts[SCTP_EVENT_TIMEOUT_T4_RTO] = t->rto;
763 	chunk->transport = t;
764 }
765 
766 /* Process an incoming Operation Error Chunk. */
767 static void sctp_cmd_process_operr(sctp_cmd_seq_t *cmds,
768 				   struct sctp_association *asoc,
769 				   struct sctp_chunk *chunk)
770 {
771 	struct sctp_operr_chunk *operr_chunk;
772 	struct sctp_errhdr *err_hdr;
773 
774 	operr_chunk = (struct sctp_operr_chunk *)chunk->chunk_hdr;
775 	err_hdr = &operr_chunk->err_hdr;
776 
777 	switch (err_hdr->cause) {
778 	case SCTP_ERROR_UNKNOWN_CHUNK:
779 	{
780 		struct sctp_chunkhdr *unk_chunk_hdr;
781 
782 		unk_chunk_hdr = (struct sctp_chunkhdr *)err_hdr->variable;
783 		switch (unk_chunk_hdr->type) {
784 		/* ADDIP 4.1 A9) If the peer responds to an ASCONF with an
785 		 * ERROR chunk reporting that it did not recognized the ASCONF
786 		 * chunk type, the sender of the ASCONF MUST NOT send any
787 		 * further ASCONF chunks and MUST stop its T-4 timer.
788 		 */
789 		case SCTP_CID_ASCONF:
790 			asoc->peer.asconf_capable = 0;
791 			sctp_add_cmd_sf(cmds, SCTP_CMD_TIMER_STOP,
792 					SCTP_TO(SCTP_EVENT_TIMEOUT_T4_RTO));
793 			break;
794 		default:
795 			break;
796 		}
797 		break;
798 	}
799 	default:
800 		break;
801 	}
802 }
803 
804 /* Process variable FWDTSN chunk information. */
805 static void sctp_cmd_process_fwdtsn(struct sctp_ulpq *ulpq,
806 				    struct sctp_chunk *chunk)
807 {
808 	struct sctp_fwdtsn_skip *skip;
809 	/* Walk through all the skipped SSNs */
810 	sctp_walk_fwdtsn(skip, chunk) {
811 		sctp_ulpq_skip(ulpq, ntohs(skip->stream), ntohs(skip->ssn));
812 	}
813 
814 	return;
815 }
816 
817 /* Helper function to remove the association non-primary peer
818  * transports.
819  */
820 static void sctp_cmd_del_non_primary(struct sctp_association *asoc)
821 {
822 	struct sctp_transport *t;
823 	struct list_head *pos;
824 	struct list_head *temp;
825 
826 	list_for_each_safe(pos, temp, &asoc->peer.transport_addr_list) {
827 		t = list_entry(pos, struct sctp_transport, transports);
828 		if (!sctp_cmp_addr_exact(&t->ipaddr,
829 		                         &asoc->peer.primary_addr)) {
830 			sctp_assoc_del_peer(asoc, &t->ipaddr);
831 		}
832 	}
833 
834 	return;
835 }
836 
837 /* Helper function to set sk_err on a 1-1 style socket. */
838 static void sctp_cmd_set_sk_err(struct sctp_association *asoc, int error)
839 {
840 	struct sock *sk = asoc->base.sk;
841 
842 	if (!sctp_style(sk, UDP))
843 		sk->sk_err = error;
844 }
845 
846 /* These three macros allow us to pull the debugging code out of the
847  * main flow of sctp_do_sm() to keep attention focused on the real
848  * functionality there.
849  */
850 #define DEBUG_PRE \
851 	SCTP_DEBUG_PRINTK("sctp_do_sm prefn: " \
852 			  "ep %p, %s, %s, asoc %p[%s], %s\n", \
853 			  ep, sctp_evttype_tbl[event_type], \
854 			  (*debug_fn)(subtype), asoc, \
855 			  sctp_state_tbl[state], state_fn->name)
856 
857 #define DEBUG_POST \
858 	SCTP_DEBUG_PRINTK("sctp_do_sm postfn: " \
859 			  "asoc %p, status: %s\n", \
860 			  asoc, sctp_status_tbl[status])
861 
862 #define DEBUG_POST_SFX \
863 	SCTP_DEBUG_PRINTK("sctp_do_sm post sfx: error %d, asoc %p[%s]\n", \
864 			  error, asoc, \
865 			  sctp_state_tbl[(asoc && sctp_id2assoc(ep->base.sk, \
866 			  sctp_assoc2id(asoc)))?asoc->state:SCTP_STATE_CLOSED])
867 
868 /*
869  * This is the master state machine processing function.
870  *
871  * If you want to understand all of lksctp, this is a
872  * good place to start.
873  */
874 int sctp_do_sm(sctp_event_t event_type, sctp_subtype_t subtype,
875 	       sctp_state_t state,
876 	       struct sctp_endpoint *ep,
877 	       struct sctp_association *asoc,
878 	       void *event_arg,
879 	       gfp_t gfp)
880 {
881 	sctp_cmd_seq_t commands;
882 	const sctp_sm_table_entry_t *state_fn;
883 	sctp_disposition_t status;
884 	int error = 0;
885 	typedef const char *(printfn_t)(sctp_subtype_t);
886 
887 	static printfn_t *table[] = {
888 		NULL, sctp_cname, sctp_tname, sctp_oname, sctp_pname,
889 	};
890 	printfn_t *debug_fn  __attribute__ ((unused)) = table[event_type];
891 
892 	/* Look up the state function, run it, and then process the
893 	 * side effects.  These three steps are the heart of lksctp.
894 	 */
895 	state_fn = sctp_sm_lookup_event(event_type, state, subtype);
896 
897 	sctp_init_cmd_seq(&commands);
898 
899 	DEBUG_PRE;
900 	status = (*state_fn->fn)(ep, asoc, subtype, event_arg, &commands);
901 	DEBUG_POST;
902 
903 	error = sctp_side_effects(event_type, subtype, state,
904 				  ep, asoc, event_arg, status,
905 				  &commands, gfp);
906 	DEBUG_POST_SFX;
907 
908 	return error;
909 }
910 
911 #undef DEBUG_PRE
912 #undef DEBUG_POST
913 
914 /*****************************************************************
915  * This the master state function side effect processing function.
916  *****************************************************************/
917 static int sctp_side_effects(sctp_event_t event_type, sctp_subtype_t subtype,
918 			     sctp_state_t state,
919 			     struct sctp_endpoint *ep,
920 			     struct sctp_association *asoc,
921 			     void *event_arg,
922 			     sctp_disposition_t status,
923 			     sctp_cmd_seq_t *commands,
924 			     gfp_t gfp)
925 {
926 	int error;
927 
928 	/* FIXME - Most of the dispositions left today would be categorized
929 	 * as "exceptional" dispositions.  For those dispositions, it
930 	 * may not be proper to run through any of the commands at all.
931 	 * For example, the command interpreter might be run only with
932 	 * disposition SCTP_DISPOSITION_CONSUME.
933 	 */
934 	if (0 != (error = sctp_cmd_interpreter(event_type, subtype, state,
935 					       ep, asoc,
936 					       event_arg, status,
937 					       commands, gfp)))
938 		goto bail;
939 
940 	switch (status) {
941 	case SCTP_DISPOSITION_DISCARD:
942 		SCTP_DEBUG_PRINTK("Ignored sctp protocol event - state %d, "
943 				  "event_type %d, event_id %d\n",
944 				  state, event_type, subtype.chunk);
945 		break;
946 
947 	case SCTP_DISPOSITION_NOMEM:
948 		/* We ran out of memory, so we need to discard this
949 		 * packet.
950 		 */
951 		/* BUG--we should now recover some memory, probably by
952 		 * reneging...
953 		 */
954 		error = -ENOMEM;
955 		break;
956 
957         case SCTP_DISPOSITION_DELETE_TCB:
958 		/* This should now be a command. */
959 		break;
960 
961 	case SCTP_DISPOSITION_CONSUME:
962 	case SCTP_DISPOSITION_ABORT:
963 		/*
964 		 * We should no longer have much work to do here as the
965 		 * real work has been done as explicit commands above.
966 		 */
967 		break;
968 
969 	case SCTP_DISPOSITION_VIOLATION:
970 		printk(KERN_ERR "sctp protocol violation state %d "
971 		       "chunkid %d\n", state, subtype.chunk);
972 		break;
973 
974 	case SCTP_DISPOSITION_NOT_IMPL:
975 		printk(KERN_WARNING "sctp unimplemented feature in state %d, "
976 		       "event_type %d, event_id %d\n",
977 		       state, event_type, subtype.chunk);
978 		break;
979 
980 	case SCTP_DISPOSITION_BUG:
981 		printk(KERN_ERR "sctp bug in state %d, "
982 		       "event_type %d, event_id %d\n",
983 		       state, event_type, subtype.chunk);
984 		BUG();
985 		break;
986 
987 	default:
988 		printk(KERN_ERR "sctp impossible disposition %d "
989 		       "in state %d, event_type %d, event_id %d\n",
990 		       status, state, event_type, subtype.chunk);
991 		BUG();
992 		break;
993 	};
994 
995 bail:
996 	return error;
997 }
998 
999 /********************************************************************
1000  * 2nd Level Abstractions
1001  ********************************************************************/
1002 
1003 /* This is the side-effect interpreter.  */
1004 static int sctp_cmd_interpreter(sctp_event_t event_type,
1005 				sctp_subtype_t subtype,
1006 				sctp_state_t state,
1007 				struct sctp_endpoint *ep,
1008 				struct sctp_association *asoc,
1009 				void *event_arg,
1010 			 	sctp_disposition_t status,
1011 				sctp_cmd_seq_t *commands,
1012 				gfp_t gfp)
1013 {
1014 	int error = 0;
1015 	int force;
1016 	sctp_cmd_t *cmd;
1017 	struct sctp_chunk *new_obj;
1018 	struct sctp_chunk *chunk = NULL;
1019 	struct sctp_packet *packet;
1020 	struct list_head *pos;
1021 	struct timer_list *timer;
1022 	unsigned long timeout;
1023 	struct sctp_transport *t;
1024 	struct sctp_sackhdr sackh;
1025 	int local_cork = 0;
1026 
1027 	if (SCTP_EVENT_T_TIMEOUT != event_type)
1028 		chunk = (struct sctp_chunk *) event_arg;
1029 
1030 	/* Note:  This whole file is a huge candidate for rework.
1031 	 * For example, each command could either have its own handler, so
1032 	 * the loop would look like:
1033 	 *     while (cmds)
1034 	 *         cmd->handle(x, y, z)
1035 	 * --jgrimm
1036 	 */
1037 	while (NULL != (cmd = sctp_next_cmd(commands))) {
1038 		switch (cmd->verb) {
1039 		case SCTP_CMD_NOP:
1040 			/* Do nothing. */
1041 			break;
1042 
1043 		case SCTP_CMD_NEW_ASOC:
1044 			/* Register a new association.  */
1045 			if (local_cork) {
1046 				sctp_outq_uncork(&asoc->outqueue);
1047 				local_cork = 0;
1048 			}
1049 			asoc = cmd->obj.ptr;
1050 			/* Register with the endpoint.  */
1051 			sctp_endpoint_add_asoc(ep, asoc);
1052 			sctp_hash_established(asoc);
1053 			break;
1054 
1055 		case SCTP_CMD_UPDATE_ASSOC:
1056 		       sctp_assoc_update(asoc, cmd->obj.ptr);
1057 		       break;
1058 
1059 		case SCTP_CMD_PURGE_OUTQUEUE:
1060 		       sctp_outq_teardown(&asoc->outqueue);
1061 		       break;
1062 
1063 		case SCTP_CMD_DELETE_TCB:
1064 			if (local_cork) {
1065 				sctp_outq_uncork(&asoc->outqueue);
1066 				local_cork = 0;
1067 			}
1068 			/* Delete the current association.  */
1069 			sctp_cmd_delete_tcb(commands, asoc);
1070 			asoc = NULL;
1071 			break;
1072 
1073 		case SCTP_CMD_NEW_STATE:
1074 			/* Enter a new state.  */
1075 			sctp_cmd_new_state(commands, asoc, cmd->obj.state);
1076 			break;
1077 
1078 		case SCTP_CMD_REPORT_TSN:
1079 			/* Record the arrival of a TSN.  */
1080 			sctp_tsnmap_mark(&asoc->peer.tsn_map, cmd->obj.u32);
1081 			break;
1082 
1083 		case SCTP_CMD_REPORT_FWDTSN:
1084 			/* Move the Cumulattive TSN Ack ahead. */
1085 			sctp_tsnmap_skip(&asoc->peer.tsn_map, cmd->obj.u32);
1086 
1087 			/* Abort any in progress partial delivery. */
1088 			sctp_ulpq_abort_pd(&asoc->ulpq, GFP_ATOMIC);
1089 			break;
1090 
1091 		case SCTP_CMD_PROCESS_FWDTSN:
1092 			sctp_cmd_process_fwdtsn(&asoc->ulpq, cmd->obj.ptr);
1093                         break;
1094 
1095 		case SCTP_CMD_GEN_SACK:
1096 			/* Generate a Selective ACK.
1097 			 * The argument tells us whether to just count
1098 			 * the packet and MAYBE generate a SACK, or
1099 			 * force a SACK out.
1100 			 */
1101 			force = cmd->obj.i32;
1102 			error = sctp_gen_sack(asoc, force, commands);
1103 			break;
1104 
1105 		case SCTP_CMD_PROCESS_SACK:
1106 			/* Process an inbound SACK.  */
1107 			error = sctp_cmd_process_sack(commands, asoc,
1108 						      cmd->obj.ptr);
1109 			break;
1110 
1111 		case SCTP_CMD_GEN_INIT_ACK:
1112 			/* Generate an INIT ACK chunk.  */
1113 			new_obj = sctp_make_init_ack(asoc, chunk, GFP_ATOMIC,
1114 						     0);
1115 			if (!new_obj)
1116 				goto nomem;
1117 
1118 			sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
1119 					SCTP_CHUNK(new_obj));
1120 			break;
1121 
1122 		case SCTP_CMD_PEER_INIT:
1123 			/* Process a unified INIT from the peer.
1124 			 * Note: Only used during INIT-ACK processing.  If
1125 			 * there is an error just return to the outter
1126 			 * layer which will bail.
1127 			 */
1128 			error = sctp_cmd_process_init(commands, asoc, chunk,
1129 						      cmd->obj.ptr, gfp);
1130 			break;
1131 
1132 		case SCTP_CMD_GEN_COOKIE_ECHO:
1133 			/* Generate a COOKIE ECHO chunk.  */
1134 			new_obj = sctp_make_cookie_echo(asoc, chunk);
1135 			if (!new_obj) {
1136 				if (cmd->obj.ptr)
1137 					sctp_chunk_free(cmd->obj.ptr);
1138 				goto nomem;
1139 			}
1140 			sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
1141 					SCTP_CHUNK(new_obj));
1142 
1143 			/* If there is an ERROR chunk to be sent along with
1144 			 * the COOKIE_ECHO, send it, too.
1145 			 */
1146 			if (cmd->obj.ptr)
1147 				sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
1148 						SCTP_CHUNK(cmd->obj.ptr));
1149 
1150 			/* FIXME - Eventually come up with a cleaner way to
1151 			 * enabling COOKIE-ECHO + DATA bundling during
1152 			 * multihoming stale cookie scenarios, the following
1153 			 * command plays with asoc->peer.retran_path to
1154 			 * avoid the problem of sending the COOKIE-ECHO and
1155 			 * DATA in different paths, which could result
1156 			 * in the association being ABORTed if the DATA chunk
1157 			 * is processed first by the server.  Checking the
1158 			 * init error counter simply causes this command
1159 			 * to be executed only during failed attempts of
1160 			 * association establishment.
1161 			 */
1162 			if ((asoc->peer.retran_path !=
1163 			     asoc->peer.primary_path) &&
1164 			    (asoc->init_err_counter > 0)) {
1165 				sctp_add_cmd_sf(commands,
1166 				                SCTP_CMD_FORCE_PRIM_RETRAN,
1167 						SCTP_NULL());
1168 			}
1169 
1170 			break;
1171 
1172 		case SCTP_CMD_GEN_SHUTDOWN:
1173 			/* Generate SHUTDOWN when in SHUTDOWN_SENT state.
1174 			 * Reset error counts.
1175 			 */
1176 			asoc->overall_error_count = 0;
1177 
1178 			/* Generate a SHUTDOWN chunk.  */
1179 			new_obj = sctp_make_shutdown(asoc, chunk);
1180 			if (!new_obj)
1181 				goto nomem;
1182 			sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
1183 					SCTP_CHUNK(new_obj));
1184 			break;
1185 
1186 		case SCTP_CMD_CHUNK_ULP:
1187 			/* Send a chunk to the sockets layer.  */
1188 			SCTP_DEBUG_PRINTK("sm_sideff: %s %p, %s %p.\n",
1189 					  "chunk_up:", cmd->obj.ptr,
1190 					  "ulpq:", &asoc->ulpq);
1191 			sctp_ulpq_tail_data(&asoc->ulpq, cmd->obj.ptr,
1192 					    GFP_ATOMIC);
1193 			break;
1194 
1195 		case SCTP_CMD_EVENT_ULP:
1196 			/* Send a notification to the sockets layer.  */
1197 			SCTP_DEBUG_PRINTK("sm_sideff: %s %p, %s %p.\n",
1198 					  "event_up:",cmd->obj.ptr,
1199 					  "ulpq:",&asoc->ulpq);
1200 			sctp_ulpq_tail_event(&asoc->ulpq, cmd->obj.ptr);
1201 			break;
1202 
1203 		case SCTP_CMD_REPLY:
1204 			/* If an caller has not already corked, do cork. */
1205 			if (!asoc->outqueue.cork) {
1206 				sctp_outq_cork(&asoc->outqueue);
1207 				local_cork = 1;
1208 			}
1209 			/* Send a chunk to our peer.  */
1210 			error = sctp_outq_tail(&asoc->outqueue, cmd->obj.ptr);
1211 			break;
1212 
1213 		case SCTP_CMD_SEND_PKT:
1214 			/* Send a full packet to our peer.  */
1215 			packet = cmd->obj.ptr;
1216 			sctp_packet_transmit(packet);
1217 			sctp_ootb_pkt_free(packet);
1218 			break;
1219 
1220 		case SCTP_CMD_RETRAN:
1221 			/* Mark a transport for retransmission.  */
1222 			sctp_retransmit(&asoc->outqueue, cmd->obj.transport,
1223 					SCTP_RTXR_T3_RTX);
1224 			break;
1225 
1226 		case SCTP_CMD_TRANSMIT:
1227 			/* Kick start transmission. */
1228 			error = sctp_outq_uncork(&asoc->outqueue);
1229 			local_cork = 0;
1230 			break;
1231 
1232 		case SCTP_CMD_ECN_CE:
1233 			/* Do delayed CE processing.   */
1234 			sctp_do_ecn_ce_work(asoc, cmd->obj.u32);
1235 			break;
1236 
1237 		case SCTP_CMD_ECN_ECNE:
1238 			/* Do delayed ECNE processing. */
1239 			new_obj = sctp_do_ecn_ecne_work(asoc, cmd->obj.u32,
1240 							chunk);
1241 			if (new_obj)
1242 				sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
1243 						SCTP_CHUNK(new_obj));
1244 			break;
1245 
1246 		case SCTP_CMD_ECN_CWR:
1247 			/* Do delayed CWR processing.  */
1248 			sctp_do_ecn_cwr_work(asoc, cmd->obj.u32);
1249 			break;
1250 
1251 		case SCTP_CMD_SETUP_T2:
1252 			sctp_cmd_setup_t2(commands, asoc, cmd->obj.ptr);
1253 			break;
1254 
1255 		case SCTP_CMD_TIMER_START:
1256 			timer = &asoc->timers[cmd->obj.to];
1257 			timeout = asoc->timeouts[cmd->obj.to];
1258 			BUG_ON(!timeout);
1259 
1260 			timer->expires = jiffies + timeout;
1261 			sctp_association_hold(asoc);
1262 			add_timer(timer);
1263 			break;
1264 
1265 		case SCTP_CMD_TIMER_RESTART:
1266 			timer = &asoc->timers[cmd->obj.to];
1267 			timeout = asoc->timeouts[cmd->obj.to];
1268 			if (!mod_timer(timer, jiffies + timeout))
1269 				sctp_association_hold(asoc);
1270 			break;
1271 
1272 		case SCTP_CMD_TIMER_STOP:
1273 			timer = &asoc->timers[cmd->obj.to];
1274 			if (timer_pending(timer) && del_timer(timer))
1275 				sctp_association_put(asoc);
1276 			break;
1277 
1278 		case SCTP_CMD_INIT_CHOOSE_TRANSPORT:
1279 			chunk = cmd->obj.ptr;
1280 			t = sctp_assoc_choose_init_transport(asoc);
1281 			asoc->init_last_sent_to = t;
1282 			chunk->transport = t;
1283 			t->init_sent_count++;
1284 			break;
1285 
1286 		case SCTP_CMD_INIT_RESTART:
1287 			/* Do the needed accounting and updates
1288 			 * associated with restarting an initialization
1289 			 * timer. Only multiply the timeout by two if
1290 			 * all transports have been tried at the current
1291 			 * timeout.
1292 			 */
1293 			t = asoc->init_last_sent_to;
1294 			asoc->init_err_counter++;
1295 
1296 			if (t->init_sent_count > (asoc->init_cycle + 1)) {
1297 				asoc->timeouts[SCTP_EVENT_TIMEOUT_T1_INIT] *= 2;
1298 				if (asoc->timeouts[SCTP_EVENT_TIMEOUT_T1_INIT] >
1299 				    asoc->max_init_timeo) {
1300 					asoc->timeouts[SCTP_EVENT_TIMEOUT_T1_INIT] =
1301 						asoc->max_init_timeo;
1302 				}
1303 				asoc->init_cycle++;
1304 				SCTP_DEBUG_PRINTK(
1305 					"T1 INIT Timeout adjustment"
1306 					" init_err_counter: %d"
1307 					" cycle: %d"
1308 					" timeout: %ld\n",
1309 					asoc->init_err_counter,
1310 					asoc->init_cycle,
1311 					asoc->timeouts[SCTP_EVENT_TIMEOUT_T1_INIT]);
1312 			}
1313 
1314 			sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_RESTART,
1315 					SCTP_TO(SCTP_EVENT_TIMEOUT_T1_INIT));
1316 			break;
1317 
1318 		case SCTP_CMD_COOKIEECHO_RESTART:
1319 			/* Do the needed accounting and updates
1320 			 * associated with restarting an initialization
1321 			 * timer. Only multiply the timeout by two if
1322 			 * all transports have been tried at the current
1323 			 * timeout.
1324 			 */
1325 			asoc->init_err_counter++;
1326 
1327 			asoc->timeouts[SCTP_EVENT_TIMEOUT_T1_COOKIE] *= 2;
1328 			if (asoc->timeouts[SCTP_EVENT_TIMEOUT_T1_COOKIE] >
1329 			    asoc->max_init_timeo) {
1330 				asoc->timeouts[SCTP_EVENT_TIMEOUT_T1_COOKIE] =
1331 					asoc->max_init_timeo;
1332 			}
1333 			SCTP_DEBUG_PRINTK(
1334 				"T1 COOKIE Timeout adjustment"
1335 				" init_err_counter: %d"
1336 				" timeout: %ld\n",
1337 				asoc->init_err_counter,
1338 				asoc->timeouts[SCTP_EVENT_TIMEOUT_T1_COOKIE]);
1339 
1340 			/* If we've sent any data bundled with
1341 			 * COOKIE-ECHO we need to resend.
1342 			 */
1343 			list_for_each(pos, &asoc->peer.transport_addr_list) {
1344 				t = list_entry(pos, struct sctp_transport,
1345 					       transports);
1346 				sctp_retransmit_mark(&asoc->outqueue, t, 0);
1347 			}
1348 
1349 			sctp_add_cmd_sf(commands,
1350 					SCTP_CMD_TIMER_RESTART,
1351 					SCTP_TO(SCTP_EVENT_TIMEOUT_T1_COOKIE));
1352 			break;
1353 
1354 		case SCTP_CMD_INIT_FAILED:
1355 			sctp_cmd_init_failed(commands, asoc, cmd->obj.u32);
1356 			break;
1357 
1358 		case SCTP_CMD_ASSOC_FAILED:
1359 			sctp_cmd_assoc_failed(commands, asoc, event_type,
1360 					      subtype, chunk, cmd->obj.u32);
1361 			break;
1362 
1363 		case SCTP_CMD_INIT_COUNTER_INC:
1364 			asoc->init_err_counter++;
1365 			break;
1366 
1367 		case SCTP_CMD_INIT_COUNTER_RESET:
1368 			asoc->init_err_counter = 0;
1369 			asoc->init_cycle = 0;
1370 			break;
1371 
1372 		case SCTP_CMD_REPORT_DUP:
1373 			sctp_tsnmap_mark_dup(&asoc->peer.tsn_map,
1374 					     cmd->obj.u32);
1375 			break;
1376 
1377 		case SCTP_CMD_REPORT_BAD_TAG:
1378 			SCTP_DEBUG_PRINTK("vtag mismatch!\n");
1379 			break;
1380 
1381 		case SCTP_CMD_STRIKE:
1382 			/* Mark one strike against a transport.  */
1383 			sctp_do_8_2_transport_strike(asoc, cmd->obj.transport);
1384 			break;
1385 
1386 		case SCTP_CMD_TRANSPORT_RESET:
1387 			t = cmd->obj.transport;
1388 			sctp_cmd_transport_reset(commands, asoc, t);
1389 			break;
1390 
1391 		case SCTP_CMD_TRANSPORT_ON:
1392 			t = cmd->obj.transport;
1393 			sctp_cmd_transport_on(commands, asoc, t, chunk);
1394 			break;
1395 
1396 		case SCTP_CMD_HB_TIMERS_START:
1397 			sctp_cmd_hb_timers_start(commands, asoc);
1398 			break;
1399 
1400 		case SCTP_CMD_HB_TIMER_UPDATE:
1401 			t = cmd->obj.transport;
1402 			sctp_cmd_hb_timer_update(commands, asoc, t);
1403 			break;
1404 
1405 		case SCTP_CMD_HB_TIMERS_STOP:
1406 			sctp_cmd_hb_timers_stop(commands, asoc);
1407 			break;
1408 
1409 		case SCTP_CMD_REPORT_ERROR:
1410 			error = cmd->obj.error;
1411 			break;
1412 
1413 		case SCTP_CMD_PROCESS_CTSN:
1414 			/* Dummy up a SACK for processing. */
1415 			sackh.cum_tsn_ack = cmd->obj.u32;
1416 			sackh.a_rwnd = 0;
1417 			sackh.num_gap_ack_blocks = 0;
1418 			sackh.num_dup_tsns = 0;
1419 			sctp_add_cmd_sf(commands, SCTP_CMD_PROCESS_SACK,
1420 					SCTP_SACKH(&sackh));
1421 			break;
1422 
1423 		case SCTP_CMD_DISCARD_PACKET:
1424 			/* We need to discard the whole packet.  */
1425 			chunk->pdiscard = 1;
1426 			break;
1427 
1428 		case SCTP_CMD_RTO_PENDING:
1429 			t = cmd->obj.transport;
1430 			t->rto_pending = 1;
1431 			break;
1432 
1433 		case SCTP_CMD_PART_DELIVER:
1434 			sctp_ulpq_partial_delivery(&asoc->ulpq, cmd->obj.ptr,
1435 						   GFP_ATOMIC);
1436 			break;
1437 
1438 		case SCTP_CMD_RENEGE:
1439 			sctp_ulpq_renege(&asoc->ulpq, cmd->obj.ptr,
1440 					 GFP_ATOMIC);
1441 			break;
1442 
1443 		case SCTP_CMD_SETUP_T4:
1444 			sctp_cmd_setup_t4(commands, asoc, cmd->obj.ptr);
1445 			break;
1446 
1447 		case SCTP_CMD_PROCESS_OPERR:
1448 			sctp_cmd_process_operr(commands, asoc, chunk);
1449 			break;
1450 		case SCTP_CMD_CLEAR_INIT_TAG:
1451 			asoc->peer.i.init_tag = 0;
1452 			break;
1453 		case SCTP_CMD_DEL_NON_PRIMARY:
1454 			sctp_cmd_del_non_primary(asoc);
1455 			break;
1456 		case SCTP_CMD_T3_RTX_TIMERS_STOP:
1457 			sctp_cmd_t3_rtx_timers_stop(commands, asoc);
1458 			break;
1459 		case SCTP_CMD_FORCE_PRIM_RETRAN:
1460 			t = asoc->peer.retran_path;
1461 			asoc->peer.retran_path = asoc->peer.primary_path;
1462 			error = sctp_outq_uncork(&asoc->outqueue);
1463 			local_cork = 0;
1464 			asoc->peer.retran_path = t;
1465 			break;
1466 		case SCTP_CMD_SET_SK_ERR:
1467 			sctp_cmd_set_sk_err(asoc, cmd->obj.error);
1468 			break;
1469 		default:
1470 			printk(KERN_WARNING "Impossible command: %u, %p\n",
1471 			       cmd->verb, cmd->obj.ptr);
1472 			break;
1473 		};
1474 		if (error)
1475 			break;
1476 	}
1477 
1478 out:
1479 	if (local_cork)
1480 		sctp_outq_uncork(&asoc->outqueue);
1481 	return error;
1482 nomem:
1483 	error = -ENOMEM;
1484 	goto out;
1485 }
1486 
1487