linux/net/ipv4/tcp_output.c
<<
>>
Prefs
   1/*
   2 * INET         An implementation of the TCP/IP protocol suite for the LINUX
   3 *              operating system.  INET is implemented using the  BSD Socket
   4 *              interface as the means of communication with the user level.
   5 *
   6 *              Implementation of the Transmission Control Protocol(TCP).
   7 *
   8 * Authors:     Ross Biro
   9 *              Fred N. van Kempen, <waltje@uWalt.NL.Mugnet.ORG>
  10 *              Mark Evans, <evansmp@uhura.aston.ac.uk>
  11 *              Corey Minyard <wf-rch!minyard@relay.EU.net>
  12 *              Florian La Roche, <flla@stud.uni-sb.de>
  13 *              Charles Hedrick, <hedrick@klinzhai.rutgers.edu>
  14 *              Linus Torvalds, <torvalds@cs.helsinki.fi>
  15 *              Alan Cox, <gw4pts@gw4pts.ampr.org>
  16 *              Matthew Dillon, <dillon@apollo.west.oic.com>
  17 *              Arnt Gulbrandsen, <agulbra@nvg.unit.no>
  18 *              Jorge Cwik, <jorge@laser.satlink.net>
  19 */
  20
  21/*
  22 * Changes:     Pedro Roque     :       Retransmit queue handled by TCP.
  23 *                              :       Fragmentation on mtu decrease
  24 *                              :       Segment collapse on retransmit
  25 *                              :       AF independence
  26 *
  27 *              Linus Torvalds  :       send_delayed_ack
  28 *              David S. Miller :       Charge memory using the right skb
  29 *                                      during syn/ack processing.
  30 *              David S. Miller :       Output engine completely rewritten.
  31 *              Andrea Arcangeli:       SYNACK carry ts_recent in tsecr.
  32 *              Cacophonix Gaul :       draft-minshall-nagle-01
  33 *              J Hadi Salim    :       ECN support
  34 *
  35 */
  36
  37#define pr_fmt(fmt) "TCP: " fmt
  38
  39#include <net/tcp.h>
  40
  41#include <linux/compiler.h>
  42#include <linux/gfp.h>
  43#include <linux/module.h>
  44
  45/* People can turn this off for buggy TCP's found in printers etc. */
  46int sysctl_tcp_retrans_collapse __read_mostly = 1;
  47
  48/* People can turn this on to work with those rare, broken TCPs that
  49 * interpret the window field as a signed quantity.
  50 */
  51int sysctl_tcp_workaround_signed_windows __read_mostly = 0;
  52
  53/* Default TSQ limit of two TSO segments */
  54int sysctl_tcp_limit_output_bytes __read_mostly = 131072;
  55
  56/* This limits the percentage of the congestion window which we
  57 * will allow a single TSO frame to consume.  Building TSO frames
  58 * which are too large can cause TCP streams to be bursty.
  59 */
  60int sysctl_tcp_tso_win_divisor __read_mostly = 3;
  61
  62int sysctl_tcp_mtu_probing __read_mostly = 0;
  63int sysctl_tcp_base_mss __read_mostly = TCP_BASE_MSS;
  64
  65/* By default, RFC2861 behavior.  */
  66int sysctl_tcp_slow_start_after_idle __read_mostly = 1;
  67
  68int sysctl_tcp_cookie_size __read_mostly = 0; /* TCP_COOKIE_MAX */
  69EXPORT_SYMBOL_GPL(sysctl_tcp_cookie_size);
  70
  71static bool tcp_write_xmit(struct sock *sk, unsigned int mss_now, int nonagle,
  72                           int push_one, gfp_t gfp);
  73
  74/* Account for new data that has been sent to the network. */
  75static void tcp_event_new_data_sent(struct sock *sk, const struct sk_buff *skb)
  76{
  77        struct tcp_sock *tp = tcp_sk(sk);
  78        unsigned int prior_packets = tp->packets_out;
  79
  80        tcp_advance_send_head(sk, skb);
  81        tp->snd_nxt = TCP_SKB_CB(skb)->end_seq;
  82
  83        /* Don't override Nagle indefinitely with F-RTO */
  84        if (tp->frto_counter == 2)
  85                tp->frto_counter = 3;
  86
  87        tp->packets_out += tcp_skb_pcount(skb);
  88        if (!prior_packets || tp->early_retrans_delayed)
  89                tcp_rearm_rto(sk);
  90}
  91
  92/* SND.NXT, if window was not shrunk.
  93 * If window has been shrunk, what should we make? It is not clear at all.
  94 * Using SND.UNA we will fail to open window, SND.NXT is out of window. :-(
  95 * Anything in between SND.UNA...SND.UNA+SND.WND also can be already
  96 * invalid. OK, let's make this for now:
  97 */
  98static inline __u32 tcp_acceptable_seq(const struct sock *sk)
  99{
 100        const struct tcp_sock *tp = tcp_sk(sk);
 101
 102        if (!before(tcp_wnd_end(tp), tp->snd_nxt))
 103                return tp->snd_nxt;
 104        else
 105                return tcp_wnd_end(tp);
 106}
 107
 108/* Calculate mss to advertise in SYN segment.
 109 * RFC1122, RFC1063, draft-ietf-tcpimpl-pmtud-01 state that:
 110 *
 111 * 1. It is independent of path mtu.
 112 * 2. Ideally, it is maximal possible segment size i.e. 65535-40.
 113 * 3. For IPv4 it is reasonable to calculate it from maximal MTU of
 114 *    attached devices, because some buggy hosts are confused by
 115 *    large MSS.
 116 * 4. We do not make 3, we advertise MSS, calculated from first
 117 *    hop device mtu, but allow to raise it to ip_rt_min_advmss.
 118 *    This may be overridden via information stored in routing table.
 119 * 5. Value 65535 for MSS is valid in IPv6 and means "as large as possible,
 120 *    probably even Jumbo".
 121 */
 122static __u16 tcp_advertise_mss(struct sock *sk)
 123{
 124        struct tcp_sock *tp = tcp_sk(sk);
 125        const struct dst_entry *dst = __sk_dst_get(sk);
 126        int mss = tp->advmss;
 127
 128        if (dst) {
 129                unsigned int metric = dst_metric_advmss(dst);
 130
 131                if (metric < mss) {
 132                        mss = metric;
 133                        tp->advmss = mss;
 134                }
 135        }
 136
 137        return (__u16)mss;
 138}
 139
 140/* RFC2861. Reset CWND after idle period longer RTO to "restart window".
 141 * This is the first part of cwnd validation mechanism. */
 142static void tcp_cwnd_restart(struct sock *sk, const struct dst_entry *dst)
 143{
 144        struct tcp_sock *tp = tcp_sk(sk);
 145        s32 delta = tcp_time_stamp - tp->lsndtime;
 146        u32 restart_cwnd = tcp_init_cwnd(tp, dst);
 147        u32 cwnd = tp->snd_cwnd;
 148
 149        tcp_ca_event(sk, CA_EVENT_CWND_RESTART);
 150
 151        tp->snd_ssthresh = tcp_current_ssthresh(sk);
 152        restart_cwnd = min(restart_cwnd, cwnd);
 153
 154        while ((delta -= inet_csk(sk)->icsk_rto) > 0 && cwnd > restart_cwnd)
 155                cwnd >>= 1;
 156        tp->snd_cwnd = max(cwnd, restart_cwnd);
 157        tp->snd_cwnd_stamp = tcp_time_stamp;
 158        tp->snd_cwnd_used = 0;
 159}
 160
 161/* Congestion state accounting after a packet has been sent. */
 162static void tcp_event_data_sent(struct tcp_sock *tp,
 163                                struct sock *sk)
 164{
 165        struct inet_connection_sock *icsk = inet_csk(sk);
 166        const u32 now = tcp_time_stamp;
 167
 168        if (sysctl_tcp_slow_start_after_idle &&
 169            (!tp->packets_out && (s32)(now - tp->lsndtime) > icsk->icsk_rto))
 170                tcp_cwnd_restart(sk, __sk_dst_get(sk));
 171
 172        tp->lsndtime = now;
 173
 174        /* If it is a reply for ato after last received
 175         * packet, enter pingpong mode.
 176         */
 177        if ((u32)(now - icsk->icsk_ack.lrcvtime) < icsk->icsk_ack.ato)
 178                icsk->icsk_ack.pingpong = 1;
 179}
 180
 181/* Account for an ACK we sent. */
 182static inline void tcp_event_ack_sent(struct sock *sk, unsigned int pkts)
 183{
 184        tcp_dec_quickack_mode(sk, pkts);
 185        inet_csk_clear_xmit_timer(sk, ICSK_TIME_DACK);
 186}
 187
 188/* Determine a window scaling and initial window to offer.
 189 * Based on the assumption that the given amount of space
 190 * will be offered. Store the results in the tp structure.
 191 * NOTE: for smooth operation initial space offering should
 192 * be a multiple of mss if possible. We assume here that mss >= 1.
 193 * This MUST be enforced by all callers.
 194 */
 195void tcp_select_initial_window(int __space, __u32 mss,
 196                               __u32 *rcv_wnd, __u32 *window_clamp,
 197                               int wscale_ok, __u8 *rcv_wscale,
 198                               __u32 init_rcv_wnd)
 199{
 200        unsigned int space = (__space < 0 ? 0 : __space);
 201
 202        /* If no clamp set the clamp to the max possible scaled window */
 203        if (*window_clamp == 0)
 204                (*window_clamp) = (65535 << 14);
 205        space = min(*window_clamp, space);
 206
 207        /* Quantize space offering to a multiple of mss if possible. */
 208        if (space > mss)
 209                space = (space / mss) * mss;
 210
 211        /* NOTE: offering an initial window larger than 32767
 212         * will break some buggy TCP stacks. If the admin tells us
 213         * it is likely we could be speaking with such a buggy stack
 214         * we will truncate our initial window offering to 32K-1
 215         * unless the remote has sent us a window scaling option,
 216         * which we interpret as a sign the remote TCP is not
 217         * misinterpreting the window field as a signed quantity.
 218         */
 219        if (sysctl_tcp_workaround_signed_windows)
 220                (*rcv_wnd) = min(space, MAX_TCP_WINDOW);
 221        else
 222                (*rcv_wnd) = space;
 223
 224        (*rcv_wscale) = 0;
 225        if (wscale_ok) {
 226                /* Set window scaling on max possible window
 227                 * See RFC1323 for an explanation of the limit to 14
 228                 */
 229                space = max_t(u32, sysctl_tcp_rmem[2], sysctl_rmem_max);
 230                space = min_t(u32, space, *window_clamp);
 231                while (space > 65535 && (*rcv_wscale) < 14) {
 232                        space >>= 1;
 233                        (*rcv_wscale)++;
 234                }
 235        }
 236
 237        /* Set initial window to a value enough for senders starting with
 238         * initial congestion window of TCP_DEFAULT_INIT_RCVWND. Place
 239         * a limit on the initial window when mss is larger than 1460.
 240         */
 241        if (mss > (1 << *rcv_wscale)) {
 242                int init_cwnd = TCP_DEFAULT_INIT_RCVWND;
 243                if (mss > 1460)
 244                        init_cwnd =
 245                        max_t(u32, (1460 * TCP_DEFAULT_INIT_RCVWND) / mss, 2);
 246                /* when initializing use the value from init_rcv_wnd
 247                 * rather than the default from above
 248                 */
 249                if (init_rcv_wnd)
 250                        *rcv_wnd = min(*rcv_wnd, init_rcv_wnd * mss);
 251                else
 252                        *rcv_wnd = min(*rcv_wnd, init_cwnd * mss);
 253        }
 254
 255        /* Set the clamp no higher than max representable value */
 256        (*window_clamp) = min(65535U << (*rcv_wscale), *window_clamp);
 257}
 258EXPORT_SYMBOL(tcp_select_initial_window);
 259
 260/* Chose a new window to advertise, update state in tcp_sock for the
 261 * socket, and return result with RFC1323 scaling applied.  The return
 262 * value can be stuffed directly into th->window for an outgoing
 263 * frame.
 264 */
 265static u16 tcp_select_window(struct sock *sk)
 266{
 267        struct tcp_sock *tp = tcp_sk(sk);
 268        u32 cur_win = tcp_receive_window(tp);
 269        u32 new_win = __tcp_select_window(sk);
 270
 271        /* Never shrink the offered window */
 272        if (new_win < cur_win) {
 273                /* Danger Will Robinson!
 274                 * Don't update rcv_wup/rcv_wnd here or else
 275                 * we will not be able to advertise a zero
 276                 * window in time.  --DaveM
 277                 *
 278                 * Relax Will Robinson.
 279                 */
 280                new_win = ALIGN(cur_win, 1 << tp->rx_opt.rcv_wscale);
 281        }
 282        tp->rcv_wnd = new_win;
 283        tp->rcv_wup = tp->rcv_nxt;
 284
 285        /* Make sure we do not exceed the maximum possible
 286         * scaled window.
 287         */
 288        if (!tp->rx_opt.rcv_wscale && sysctl_tcp_workaround_signed_windows)
 289                new_win = min(new_win, MAX_TCP_WINDOW);
 290        else
 291                new_win = min(new_win, (65535U << tp->rx_opt.rcv_wscale));
 292
 293        /* RFC1323 scaling applied */
 294        new_win >>= tp->rx_opt.rcv_wscale;
 295
 296        /* If we advertise zero window, disable fast path. */
 297        if (new_win == 0)
 298                tp->pred_flags = 0;
 299
 300        return new_win;
 301}
 302
 303/* Packet ECN state for a SYN-ACK */
 304static inline void TCP_ECN_send_synack(const struct tcp_sock *tp, struct sk_buff *skb)
 305{
 306        TCP_SKB_CB(skb)->tcp_flags &= ~TCPHDR_CWR;
 307        if (!(tp->ecn_flags & TCP_ECN_OK))
 308                TCP_SKB_CB(skb)->tcp_flags &= ~TCPHDR_ECE;
 309}
 310
 311/* Packet ECN state for a SYN.  */
 312static inline void TCP_ECN_send_syn(struct sock *sk, struct sk_buff *skb)
 313{
 314        struct tcp_sock *tp = tcp_sk(sk);
 315
 316        tp->ecn_flags = 0;
 317        if (sysctl_tcp_ecn == 1) {
 318                TCP_SKB_CB(skb)->tcp_flags |= TCPHDR_ECE | TCPHDR_CWR;
 319                tp->ecn_flags = TCP_ECN_OK;
 320        }
 321}
 322
 323static __inline__ void
 324TCP_ECN_make_synack(const struct request_sock *req, struct tcphdr *th)
 325{
 326        if (inet_rsk(req)->ecn_ok)
 327                th->ece = 1;
 328}
 329
 330/* Set up ECN state for a packet on a ESTABLISHED socket that is about to
 331 * be sent.
 332 */
 333static inline void TCP_ECN_send(struct sock *sk, struct sk_buff *skb,
 334                                int tcp_header_len)
 335{
 336        struct tcp_sock *tp = tcp_sk(sk);
 337
 338        if (tp->ecn_flags & TCP_ECN_OK) {
 339                /* Not-retransmitted data segment: set ECT and inject CWR. */
 340                if (skb->len != tcp_header_len &&
 341                    !before(TCP_SKB_CB(skb)->seq, tp->snd_nxt)) {
 342                        INET_ECN_xmit(sk);
 343                        if (tp->ecn_flags & TCP_ECN_QUEUE_CWR) {
 344                                tp->ecn_flags &= ~TCP_ECN_QUEUE_CWR;
 345                                tcp_hdr(skb)->cwr = 1;
 346                                skb_shinfo(skb)->gso_type |= SKB_GSO_TCP_ECN;
 347                        }
 348                } else {
 349                        /* ACK or retransmitted segment: clear ECT|CE */
 350                        INET_ECN_dontxmit(sk);
 351                }
 352                if (tp->ecn_flags & TCP_ECN_DEMAND_CWR)
 353                        tcp_hdr(skb)->ece = 1;
 354        }
 355}
 356
 357/* Constructs common control bits of non-data skb. If SYN/FIN is present,
 358 * auto increment end seqno.
 359 */
 360static void tcp_init_nondata_skb(struct sk_buff *skb, u32 seq, u8 flags)
 361{
 362        skb->ip_summed = CHECKSUM_PARTIAL;
 363        skb->csum = 0;
 364
 365        TCP_SKB_CB(skb)->tcp_flags = flags;
 366        TCP_SKB_CB(skb)->sacked = 0;
 367
 368        skb_shinfo(skb)->gso_segs = 1;
 369        skb_shinfo(skb)->gso_size = 0;
 370        skb_shinfo(skb)->gso_type = 0;
 371
 372        TCP_SKB_CB(skb)->seq = seq;
 373        if (flags & (TCPHDR_SYN | TCPHDR_FIN))
 374                seq++;
 375        TCP_SKB_CB(skb)->end_seq = seq;
 376}
 377
 378static inline bool tcp_urg_mode(const struct tcp_sock *tp)
 379{
 380        return tp->snd_una != tp->snd_up;
 381}
 382
 383#define OPTION_SACK_ADVERTISE   (1 << 0)
 384#define OPTION_TS               (1 << 1)
 385#define OPTION_MD5              (1 << 2)
 386#define OPTION_WSCALE           (1 << 3)
 387#define OPTION_COOKIE_EXTENSION (1 << 4)
 388#define OPTION_FAST_OPEN_COOKIE (1 << 8)
 389
 390struct tcp_out_options {
 391        u16 options;            /* bit field of OPTION_* */
 392        u16 mss;                /* 0 to disable */
 393        u8 ws;                  /* window scale, 0 to disable */
 394        u8 num_sack_blocks;     /* number of SACK blocks to include */
 395        u8 hash_size;           /* bytes in hash_location */
 396        __u8 *hash_location;    /* temporary pointer, overloaded */
 397        __u32 tsval, tsecr;     /* need to include OPTION_TS */
 398        struct tcp_fastopen_cookie *fastopen_cookie;    /* Fast open cookie */
 399};
 400
 401/* The sysctl int routines are generic, so check consistency here.
 402 */
 403static u8 tcp_cookie_size_check(u8 desired)
 404{
 405        int cookie_size;
 406
 407        if (desired > 0)
 408                /* previously specified */
 409                return desired;
 410
 411        cookie_size = ACCESS_ONCE(sysctl_tcp_cookie_size);
 412        if (cookie_size <= 0)
 413                /* no default specified */
 414                return 0;
 415
 416        if (cookie_size <= TCP_COOKIE_MIN)
 417                /* value too small, specify minimum */
 418                return TCP_COOKIE_MIN;
 419
 420        if (cookie_size >= TCP_COOKIE_MAX)
 421                /* value too large, specify maximum */
 422                return TCP_COOKIE_MAX;
 423
 424        if (cookie_size & 1)
 425                /* 8-bit multiple, illegal, fix it */
 426                cookie_size++;
 427
 428        return (u8)cookie_size;
 429}
 430
 431/* Write previously computed TCP options to the packet.
 432 *
 433 * Beware: Something in the Internet is very sensitive to the ordering of
 434 * TCP options, we learned this through the hard way, so be careful here.
 435 * Luckily we can at least blame others for their non-compliance but from
 436 * inter-operatibility perspective it seems that we're somewhat stuck with
 437 * the ordering which we have been using if we want to keep working with
 438 * those broken things (not that it currently hurts anybody as there isn't
 439 * particular reason why the ordering would need to be changed).
 440 *
 441 * At least SACK_PERM as the first option is known to lead to a disaster
 442 * (but it may well be that other scenarios fail similarly).
 443 */
 444static void tcp_options_write(__be32 *ptr, struct tcp_sock *tp,
 445                              struct tcp_out_options *opts)
 446{
 447        u16 options = opts->options;    /* mungable copy */
 448
 449        /* Having both authentication and cookies for security is redundant,
 450         * and there's certainly not enough room.  Instead, the cookie-less
 451         * extension variant is proposed.
 452         *
 453         * Consider the pessimal case with authentication.  The options
 454         * could look like:
 455         *   COOKIE|MD5(20) + MSS(4) + SACK|TS(12) + WSCALE(4) == 40
 456         */
 457        if (unlikely(OPTION_MD5 & options)) {
 458                if (unlikely(OPTION_COOKIE_EXTENSION & options)) {
 459                        *ptr++ = htonl((TCPOPT_COOKIE << 24) |
 460                                       (TCPOLEN_COOKIE_BASE << 16) |
 461                                       (TCPOPT_MD5SIG << 8) |
 462                                       TCPOLEN_MD5SIG);
 463                } else {
 464                        *ptr++ = htonl((TCPOPT_NOP << 24) |
 465                                       (TCPOPT_NOP << 16) |
 466                                       (TCPOPT_MD5SIG << 8) |
 467                                       TCPOLEN_MD5SIG);
 468                }
 469                options &= ~OPTION_COOKIE_EXTENSION;
 470                /* overload cookie hash location */
 471                opts->hash_location = (__u8 *)ptr;
 472                ptr += 4;
 473        }
 474
 475        if (unlikely(opts->mss)) {
 476                *ptr++ = htonl((TCPOPT_MSS << 24) |
 477                               (TCPOLEN_MSS << 16) |
 478                               opts->mss);
 479        }
 480
 481        if (likely(OPTION_TS & options)) {
 482                if (unlikely(OPTION_SACK_ADVERTISE & options)) {
 483                        *ptr++ = htonl((TCPOPT_SACK_PERM << 24) |
 484                                       (TCPOLEN_SACK_PERM << 16) |
 485                                       (TCPOPT_TIMESTAMP << 8) |
 486                                       TCPOLEN_TIMESTAMP);
 487                        options &= ~OPTION_SACK_ADVERTISE;
 488                } else {
 489                        *ptr++ = htonl((TCPOPT_NOP << 24) |
 490                                       (TCPOPT_NOP << 16) |
 491                                       (TCPOPT_TIMESTAMP << 8) |
 492                                       TCPOLEN_TIMESTAMP);
 493                }
 494                *ptr++ = htonl(opts->tsval);
 495                *ptr++ = htonl(opts->tsecr);
 496        }
 497
 498        /* Specification requires after timestamp, so do it now.
 499         *
 500         * Consider the pessimal case without authentication.  The options
 501         * could look like:
 502         *   MSS(4) + SACK|TS(12) + COOKIE(20) + WSCALE(4) == 40
 503         */
 504        if (unlikely(OPTION_COOKIE_EXTENSION & options)) {
 505                __u8 *cookie_copy = opts->hash_location;
 506                u8 cookie_size = opts->hash_size;
 507
 508                /* 8-bit multiple handled in tcp_cookie_size_check() above,
 509                 * and elsewhere.
 510                 */
 511                if (0x2 & cookie_size) {
 512                        __u8 *p = (__u8 *)ptr;
 513
 514                        /* 16-bit multiple */
 515                        *p++ = TCPOPT_COOKIE;
 516                        *p++ = TCPOLEN_COOKIE_BASE + cookie_size;
 517                        *p++ = *cookie_copy++;
 518                        *p++ = *cookie_copy++;
 519                        ptr++;
 520                        cookie_size -= 2;
 521                } else {
 522                        /* 32-bit multiple */
 523                        *ptr++ = htonl(((TCPOPT_NOP << 24) |
 524                                        (TCPOPT_NOP << 16) |
 525                                        (TCPOPT_COOKIE << 8) |
 526                                        TCPOLEN_COOKIE_BASE) +
 527                                       cookie_size);
 528                }
 529
 530                if (cookie_size > 0) {
 531                        memcpy(ptr, cookie_copy, cookie_size);
 532                        ptr += (cookie_size / 4);
 533                }
 534        }
 535
 536        if (unlikely(OPTION_SACK_ADVERTISE & options)) {
 537                *ptr++ = htonl((TCPOPT_NOP << 24) |
 538                               (TCPOPT_NOP << 16) |
 539                               (TCPOPT_SACK_PERM << 8) |
 540                               TCPOLEN_SACK_PERM);
 541        }
 542
 543        if (unlikely(OPTION_WSCALE & options)) {
 544                *ptr++ = htonl((TCPOPT_NOP << 24) |
 545                               (TCPOPT_WINDOW << 16) |
 546                               (TCPOLEN_WINDOW << 8) |
 547                               opts->ws);
 548        }
 549
 550        if (unlikely(opts->num_sack_blocks)) {
 551                struct tcp_sack_block *sp = tp->rx_opt.dsack ?
 552                        tp->duplicate_sack : tp->selective_acks;
 553                int this_sack;
 554
 555                *ptr++ = htonl((TCPOPT_NOP  << 24) |
 556                               (TCPOPT_NOP  << 16) |
 557                               (TCPOPT_SACK <<  8) |
 558                               (TCPOLEN_SACK_BASE + (opts->num_sack_blocks *
 559                                                     TCPOLEN_SACK_PERBLOCK)));
 560
 561                for (this_sack = 0; this_sack < opts->num_sack_blocks;
 562                     ++this_sack) {
 563                        *ptr++ = htonl(sp[this_sack].start_seq);
 564                        *ptr++ = htonl(sp[this_sack].end_seq);
 565                }
 566
 567                tp->rx_opt.dsack = 0;
 568        }
 569
 570        if (unlikely(OPTION_FAST_OPEN_COOKIE & options)) {
 571                struct tcp_fastopen_cookie *foc = opts->fastopen_cookie;
 572
 573                *ptr++ = htonl((TCPOPT_EXP << 24) |
 574                               ((TCPOLEN_EXP_FASTOPEN_BASE + foc->len) << 16) |
 575                               TCPOPT_FASTOPEN_MAGIC);
 576
 577                memcpy(ptr, foc->val, foc->len);
 578                if ((foc->len & 3) == 2) {
 579                        u8 *align = ((u8 *)ptr) + foc->len;
 580                        align[0] = align[1] = TCPOPT_NOP;
 581                }
 582                ptr += (foc->len + 3) >> 2;
 583        }
 584}
 585
 586/* Compute TCP options for SYN packets. This is not the final
 587 * network wire format yet.
 588 */
 589static unsigned int tcp_syn_options(struct sock *sk, struct sk_buff *skb,
 590                                struct tcp_out_options *opts,
 591                                struct tcp_md5sig_key **md5)
 592{
 593        struct tcp_sock *tp = tcp_sk(sk);
 594        struct tcp_cookie_values *cvp = tp->cookie_values;
 595        unsigned int remaining = MAX_TCP_OPTION_SPACE;
 596        u8 cookie_size = (!tp->rx_opt.cookie_out_never && cvp != NULL) ?
 597                         tcp_cookie_size_check(cvp->cookie_desired) :
 598                         0;
 599        struct tcp_fastopen_request *fastopen = tp->fastopen_req;
 600
 601#ifdef CONFIG_TCP_MD5SIG
 602        *md5 = tp->af_specific->md5_lookup(sk, sk);
 603        if (*md5) {
 604                opts->options |= OPTION_MD5;
 605                remaining -= TCPOLEN_MD5SIG_ALIGNED;
 606        }
 607#else
 608        *md5 = NULL;
 609#endif
 610
 611        /* We always get an MSS option.  The option bytes which will be seen in
 612         * normal data packets should timestamps be used, must be in the MSS
 613         * advertised.  But we subtract them from tp->mss_cache so that
 614         * calculations in tcp_sendmsg are simpler etc.  So account for this
 615         * fact here if necessary.  If we don't do this correctly, as a
 616         * receiver we won't recognize data packets as being full sized when we
 617         * should, and thus we won't abide by the delayed ACK rules correctly.
 618         * SACKs don't matter, we never delay an ACK when we have any of those
 619         * going out.  */
 620        opts->mss = tcp_advertise_mss(sk);
 621        remaining -= TCPOLEN_MSS_ALIGNED;
 622
 623        if (likely(sysctl_tcp_timestamps && *md5 == NULL)) {
 624                opts->options |= OPTION_TS;
 625                opts->tsval = TCP_SKB_CB(skb)->when;
 626                opts->tsecr = tp->rx_opt.ts_recent;
 627                remaining -= TCPOLEN_TSTAMP_ALIGNED;
 628        }
 629        if (likely(sysctl_tcp_window_scaling)) {
 630                opts->ws = tp->rx_opt.rcv_wscale;
 631                opts->options |= OPTION_WSCALE;
 632                remaining -= TCPOLEN_WSCALE_ALIGNED;
 633        }
 634        if (likely(sysctl_tcp_sack)) {
 635                opts->options |= OPTION_SACK_ADVERTISE;
 636                if (unlikely(!(OPTION_TS & opts->options)))
 637                        remaining -= TCPOLEN_SACKPERM_ALIGNED;
 638        }
 639
 640        if (fastopen && fastopen->cookie.len >= 0) {
 641                u32 need = TCPOLEN_EXP_FASTOPEN_BASE + fastopen->cookie.len;
 642                need = (need + 3) & ~3U;  /* Align to 32 bits */
 643                if (remaining >= need) {
 644                        opts->options |= OPTION_FAST_OPEN_COOKIE;
 645                        opts->fastopen_cookie = &fastopen->cookie;
 646                        remaining -= need;
 647                        tp->syn_fastopen = 1;
 648                }
 649        }
 650        /* Note that timestamps are required by the specification.
 651         *
 652         * Odd numbers of bytes are prohibited by the specification, ensuring
 653         * that the cookie is 16-bit aligned, and the resulting cookie pair is
 654         * 32-bit aligned.
 655         */
 656        if (*md5 == NULL &&
 657            (OPTION_TS & opts->options) &&
 658            cookie_size > 0) {
 659                int need = TCPOLEN_COOKIE_BASE + cookie_size;
 660
 661                if (0x2 & need) {
 662                        /* 32-bit multiple */
 663                        need += 2; /* NOPs */
 664
 665                        if (need > remaining) {
 666                                /* try shrinking cookie to fit */
 667                                cookie_size -= 2;
 668                                need -= 4;
 669                        }
 670                }
 671                while (need > remaining && TCP_COOKIE_MIN <= cookie_size) {
 672                        cookie_size -= 4;
 673                        need -= 4;
 674                }
 675                if (TCP_COOKIE_MIN <= cookie_size) {
 676                        opts->options |= OPTION_COOKIE_EXTENSION;
 677                        opts->hash_location = (__u8 *)&cvp->cookie_pair[0];
 678                        opts->hash_size = cookie_size;
 679
 680                        /* Remember for future incarnations. */
 681                        cvp->cookie_desired = cookie_size;
 682
 683                        if (cvp->cookie_desired != cvp->cookie_pair_size) {
 684                                /* Currently use random bytes as a nonce,
 685                                 * assuming these are completely unpredictable
 686                                 * by hostile users of the same system.
 687                                 */
 688                                get_random_bytes(&cvp->cookie_pair[0],
 689                                                 cookie_size);
 690                                cvp->cookie_pair_size = cookie_size;
 691                        }
 692
 693                        remaining -= need;
 694                }
 695        }
 696        return MAX_TCP_OPTION_SPACE - remaining;
 697}
 698
 699/* Set up TCP options for SYN-ACKs. */
 700static unsigned int tcp_synack_options(struct sock *sk,
 701                                   struct request_sock *req,
 702                                   unsigned int mss, struct sk_buff *skb,
 703                                   struct tcp_out_options *opts,
 704                                   struct tcp_md5sig_key **md5,
 705                                   struct tcp_extend_values *xvp)
 706{
 707        struct inet_request_sock *ireq = inet_rsk(req);
 708        unsigned int remaining = MAX_TCP_OPTION_SPACE;
 709        u8 cookie_plus = (xvp != NULL && !xvp->cookie_out_never) ?
 710                         xvp->cookie_plus :
 711                         0;
 712
 713#ifdef CONFIG_TCP_MD5SIG
 714        *md5 = tcp_rsk(req)->af_specific->md5_lookup(sk, req);
 715        if (*md5) {
 716                opts->options |= OPTION_MD5;
 717                remaining -= TCPOLEN_MD5SIG_ALIGNED;
 718
 719                /* We can't fit any SACK blocks in a packet with MD5 + TS
 720                 * options. There was discussion about disabling SACK
 721                 * rather than TS in order to fit in better with old,
 722                 * buggy kernels, but that was deemed to be unnecessary.
 723                 */
 724                ireq->tstamp_ok &= !ireq->sack_ok;
 725        }
 726#else
 727        *md5 = NULL;
 728#endif
 729
 730        /* We always send an MSS option. */
 731        opts->mss = mss;
 732        remaining -= TCPOLEN_MSS_ALIGNED;
 733
 734        if (likely(ireq->wscale_ok)) {
 735                opts->ws = ireq->rcv_wscale;
 736                opts->options |= OPTION_WSCALE;
 737                remaining -= TCPOLEN_WSCALE_ALIGNED;
 738        }
 739        if (likely(ireq->tstamp_ok)) {
 740                opts->options |= OPTION_TS;
 741                opts->tsval = TCP_SKB_CB(skb)->when;
 742                opts->tsecr = req->ts_recent;
 743                remaining -= TCPOLEN_TSTAMP_ALIGNED;
 744        }
 745        if (likely(ireq->sack_ok)) {
 746                opts->options |= OPTION_SACK_ADVERTISE;
 747                if (unlikely(!ireq->tstamp_ok))
 748                        remaining -= TCPOLEN_SACKPERM_ALIGNED;
 749        }
 750
 751        /* Similar rationale to tcp_syn_options() applies here, too.
 752         * If the <SYN> options fit, the same options should fit now!
 753         */
 754        if (*md5 == NULL &&
 755            ireq->tstamp_ok &&
 756            cookie_plus > TCPOLEN_COOKIE_BASE) {
 757                int need = cookie_plus; /* has TCPOLEN_COOKIE_BASE */
 758
 759                if (0x2 & need) {
 760                        /* 32-bit multiple */
 761                        need += 2; /* NOPs */
 762                }
 763                if (need <= remaining) {
 764                        opts->options |= OPTION_COOKIE_EXTENSION;
 765                        opts->hash_size = cookie_plus - TCPOLEN_COOKIE_BASE;
 766                        remaining -= need;
 767                } else {
 768                        /* There's no error return, so flag it. */
 769                        xvp->cookie_out_never = 1; /* true */
 770                        opts->hash_size = 0;
 771                }
 772        }
 773        return MAX_TCP_OPTION_SPACE - remaining;
 774}
 775
 776/* Compute TCP options for ESTABLISHED sockets. This is not the
 777 * final wire format yet.
 778 */
 779static unsigned int tcp_established_options(struct sock *sk, struct sk_buff *skb,
 780                                        struct tcp_out_options *opts,
 781                                        struct tcp_md5sig_key **md5)
 782{
 783        struct tcp_skb_cb *tcb = skb ? TCP_SKB_CB(skb) : NULL;
 784        struct tcp_sock *tp = tcp_sk(sk);
 785        unsigned int size = 0;
 786        unsigned int eff_sacks;
 787
 788#ifdef CONFIG_TCP_MD5SIG
 789        *md5 = tp->af_specific->md5_lookup(sk, sk);
 790        if (unlikely(*md5)) {
 791                opts->options |= OPTION_MD5;
 792                size += TCPOLEN_MD5SIG_ALIGNED;
 793        }
 794#else
 795        *md5 = NULL;
 796#endif
 797
 798        if (likely(tp->rx_opt.tstamp_ok)) {
 799                opts->options |= OPTION_TS;
 800                opts->tsval = tcb ? tcb->when : 0;
 801                opts->tsecr = tp->rx_opt.ts_recent;
 802                size += TCPOLEN_TSTAMP_ALIGNED;
 803        }
 804
 805        eff_sacks = tp->rx_opt.num_sacks + tp->rx_opt.dsack;
 806        if (unlikely(eff_sacks)) {
 807                const unsigned int remaining = MAX_TCP_OPTION_SPACE - size;
 808                opts->num_sack_blocks =
 809                        min_t(unsigned int, eff_sacks,
 810                              (remaining - TCPOLEN_SACK_BASE_ALIGNED) /
 811                              TCPOLEN_SACK_PERBLOCK);
 812                size += TCPOLEN_SACK_BASE_ALIGNED +
 813                        opts->num_sack_blocks * TCPOLEN_SACK_PERBLOCK;
 814        }
 815
 816        return size;
 817}
 818
 819
 820/* TCP SMALL QUEUES (TSQ)
 821 *
 822 * TSQ goal is to keep small amount of skbs per tcp flow in tx queues (qdisc+dev)
 823 * to reduce RTT and bufferbloat.
 824 * We do this using a special skb destructor (tcp_wfree).
 825 *
 826 * Its important tcp_wfree() can be replaced by sock_wfree() in the event skb
 827 * needs to be reallocated in a driver.
 828 * The invariant being skb->truesize substracted from sk->sk_wmem_alloc
 829 *
 830 * Since transmit from skb destructor is forbidden, we use a tasklet
 831 * to process all sockets that eventually need to send more skbs.
 832 * We use one tasklet per cpu, with its own queue of sockets.
 833 */
 834struct tsq_tasklet {
 835        struct tasklet_struct   tasklet;
 836        struct list_head        head; /* queue of tcp sockets */
 837};
 838static DEFINE_PER_CPU(struct tsq_tasklet, tsq_tasklet);
 839
 840static void tcp_tsq_handler(struct sock *sk)
 841{
 842        if ((1 << sk->sk_state) &
 843            (TCPF_ESTABLISHED | TCPF_FIN_WAIT1 | TCPF_CLOSING |
 844             TCPF_CLOSE_WAIT  | TCPF_LAST_ACK))
 845                tcp_write_xmit(sk, tcp_current_mss(sk), 0, 0, GFP_ATOMIC);
 846}
 847/*
 848 * One tasklest per cpu tries to send more skbs.
 849 * We run in tasklet context but need to disable irqs when
 850 * transfering tsq->head because tcp_wfree() might
 851 * interrupt us (non NAPI drivers)
 852 */
 853static void tcp_tasklet_func(unsigned long data)
 854{
 855        struct tsq_tasklet *tsq = (struct tsq_tasklet *)data;
 856        LIST_HEAD(list);
 857        unsigned long flags;
 858        struct list_head *q, *n;
 859        struct tcp_sock *tp;
 860        struct sock *sk;
 861
 862        local_irq_save(flags);
 863        list_splice_init(&tsq->head, &list);
 864        local_irq_restore(flags);
 865
 866        list_for_each_safe(q, n, &list) {
 867                tp = list_entry(q, struct tcp_sock, tsq_node);
 868                list_del(&tp->tsq_node);
 869
 870                sk = (struct sock *)tp;
 871                bh_lock_sock(sk);
 872
 873                if (!sock_owned_by_user(sk)) {
 874                        tcp_tsq_handler(sk);
 875                } else {
 876                        /* defer the work to tcp_release_cb() */
 877                        set_bit(TCP_TSQ_DEFERRED, &tp->tsq_flags);
 878                }
 879                bh_unlock_sock(sk);
 880
 881                clear_bit(TSQ_QUEUED, &tp->tsq_flags);
 882                sk_free(sk);
 883        }
 884}
 885
 886#define TCP_DEFERRED_ALL ((1UL << TCP_TSQ_DEFERRED) |           \
 887                          (1UL << TCP_WRITE_TIMER_DEFERRED) |   \
 888                          (1UL << TCP_DELACK_TIMER_DEFERRED) |  \
 889                          (1UL << TCP_MTU_REDUCED_DEFERRED))
 890/**
 891 * tcp_release_cb - tcp release_sock() callback
 892 * @sk: socket
 893 *
 894 * called from release_sock() to perform protocol dependent
 895 * actions before socket release.
 896 */
 897void tcp_release_cb(struct sock *sk)
 898{
 899        struct tcp_sock *tp = tcp_sk(sk);
 900        unsigned long flags, nflags;
 901
 902        /* perform an atomic operation only if at least one flag is set */
 903        do {
 904                flags = tp->tsq_flags;
 905                if (!(flags & TCP_DEFERRED_ALL))
 906                        return;
 907                nflags = flags & ~TCP_DEFERRED_ALL;
 908        } while (cmpxchg(&tp->tsq_flags, flags, nflags) != flags);
 909
 910        if (flags & (1UL << TCP_TSQ_DEFERRED))
 911                tcp_tsq_handler(sk);
 912
 913        if (flags & (1UL << TCP_WRITE_TIMER_DEFERRED)) {
 914                tcp_write_timer_handler(sk);
 915                __sock_put(sk);
 916        }
 917        if (flags & (1UL << TCP_DELACK_TIMER_DEFERRED)) {
 918                tcp_delack_timer_handler(sk);
 919                __sock_put(sk);
 920        }
 921        if (flags & (1UL << TCP_MTU_REDUCED_DEFERRED)) {
 922                sk->sk_prot->mtu_reduced(sk);
 923                __sock_put(sk);
 924        }
 925}
 926EXPORT_SYMBOL(tcp_release_cb);
 927
 928void __init tcp_tasklet_init(void)
 929{
 930        int i;
 931
 932        for_each_possible_cpu(i) {
 933                struct tsq_tasklet *tsq = &per_cpu(tsq_tasklet, i);
 934
 935                INIT_LIST_HEAD(&tsq->head);
 936                tasklet_init(&tsq->tasklet,
 937                             tcp_tasklet_func,
 938                             (unsigned long)tsq);
 939        }
 940}
 941
 942/*
 943 * Write buffer destructor automatically called from kfree_skb.
 944 * We cant xmit new skbs from this context, as we might already
 945 * hold qdisc lock.
 946 */
 947static void tcp_wfree(struct sk_buff *skb)
 948{
 949        struct sock *sk = skb->sk;
 950        struct tcp_sock *tp = tcp_sk(sk);
 951
 952        if (test_and_clear_bit(TSQ_THROTTLED, &tp->tsq_flags) &&
 953            !test_and_set_bit(TSQ_QUEUED, &tp->tsq_flags)) {
 954                unsigned long flags;
 955                struct tsq_tasklet *tsq;
 956
 957                /* Keep a ref on socket.
 958                 * This last ref will be released in tcp_tasklet_func()
 959                 */
 960                atomic_sub(skb->truesize - 1, &sk->sk_wmem_alloc);
 961
 962                /* queue this socket to tasklet queue */
 963                local_irq_save(flags);
 964                tsq = &__get_cpu_var(tsq_tasklet);
 965                list_add(&tp->tsq_node, &tsq->head);
 966                tasklet_schedule(&tsq->tasklet);
 967                local_irq_restore(flags);
 968        } else {
 969                sock_wfree(skb);
 970        }
 971}
 972
 973/* This routine actually transmits TCP packets queued in by
 974 * tcp_do_sendmsg().  This is used by both the initial
 975 * transmission and possible later retransmissions.
 976 * All SKB's seen here are completely headerless.  It is our
 977 * job to build the TCP header, and pass the packet down to
 978 * IP so it can do the same plus pass the packet off to the
 979 * device.
 980 *
 981 * We are working here with either a clone of the original
 982 * SKB, or a fresh unique copy made by the retransmit engine.
 983 */
 984static int tcp_transmit_skb(struct sock *sk, struct sk_buff *skb, int clone_it,
 985                            gfp_t gfp_mask)
 986{
 987        const struct inet_connection_sock *icsk = inet_csk(sk);
 988        struct inet_sock *inet;
 989        struct tcp_sock *tp;
 990        struct tcp_skb_cb *tcb;
 991        struct tcp_out_options opts;
 992        unsigned int tcp_options_size, tcp_header_size;
 993        struct tcp_md5sig_key *md5;
 994        struct tcphdr *th;
 995        int err;
 996
 997        BUG_ON(!skb || !tcp_skb_pcount(skb));
 998
 999        /* If congestion control is doing timestamping, we must
1000         * take such a timestamp before we potentially clone/copy.
1001         */
1002        if (icsk->icsk_ca_ops->flags & TCP_CONG_RTT_STAMP)
1003                __net_timestamp(skb);
1004
1005        if (likely(clone_it)) {
1006                if (unlikely(skb_cloned(skb)))
1007                        skb = pskb_copy(skb, gfp_mask);
1008                else
1009                        skb = skb_clone(skb, gfp_mask);
1010                if (unlikely(!skb))
1011                        return -ENOBUFS;
1012        }
1013
1014        inet = inet_sk(sk);
1015        tp = tcp_sk(sk);
1016        tcb = TCP_SKB_CB(skb);
1017        memset(&opts, 0, sizeof(opts));
1018
1019        if (unlikely(tcb->tcp_flags & TCPHDR_SYN))
1020                tcp_options_size = tcp_syn_options(sk, skb, &opts, &md5);
1021        else
1022                tcp_options_size = tcp_established_options(sk, skb, &opts,
1023                                                           &md5);
1024        tcp_header_size = tcp_options_size + sizeof(struct tcphdr);
1025
1026        if (tcp_packets_in_flight(tp) == 0) {
1027                tcp_ca_event(sk, CA_EVENT_TX_START);
1028                skb->ooo_okay = 1;
1029        } else
1030                skb->ooo_okay = 0;
1031
1032        skb_push(skb, tcp_header_size);
1033        skb_reset_transport_header(skb);
1034
1035        skb_orphan(skb);
1036        skb->sk = sk;
1037        skb->destructor = (sysctl_tcp_limit_output_bytes > 0) ?
1038                          tcp_wfree : sock_wfree;
1039        atomic_add(skb->truesize, &sk->sk_wmem_alloc);
1040
1041        /* Build TCP header and checksum it. */
1042        th = tcp_hdr(skb);
1043        th->source              = inet->inet_sport;
1044        th->dest                = inet->inet_dport;
1045        th->seq                 = htonl(tcb->seq);
1046        th->ack_seq             = htonl(tp->rcv_nxt);
1047        *(((__be16 *)th) + 6)   = htons(((tcp_header_size >> 2) << 12) |
1048                                        tcb->tcp_flags);
1049
1050        if (unlikely(tcb->tcp_flags & TCPHDR_SYN)) {
1051                /* RFC1323: The window in SYN & SYN/ACK segments
1052                 * is never scaled.
1053                 */
1054                th->window      = htons(min(tp->rcv_wnd, 65535U));
1055        } else {
1056                th->window      = htons(tcp_select_window(sk));
1057        }
1058        th->check               = 0;
1059        th->urg_ptr             = 0;
1060
1061        /* The urg_mode check is necessary during a below snd_una win probe */
1062        if (unlikely(tcp_urg_mode(tp) && before(tcb->seq, tp->snd_up))) {
1063                if (before(tp->snd_up, tcb->seq + 0x10000)) {
1064                        th->urg_ptr = htons(tp->snd_up - tcb->seq);
1065                        th->urg = 1;
1066                } else if (after(tcb->seq + 0xFFFF, tp->snd_nxt)) {
1067                        th->urg_ptr = htons(0xFFFF);
1068                        th->urg = 1;
1069                }
1070        }
1071
1072        tcp_options_write((__be32 *)(th + 1), tp, &opts);
1073        if (likely((tcb->tcp_flags & TCPHDR_SYN) == 0))
1074                TCP_ECN_send(sk, skb, tcp_header_size);
1075
1076#ifdef CONFIG_TCP_MD5SIG
1077        /* Calculate the MD5 hash, as we have all we need now */
1078        if (md5) {
1079                sk_nocaps_add(sk, NETIF_F_GSO_MASK);
1080                tp->af_specific->calc_md5_hash(opts.hash_location,
1081                                               md5, sk, NULL, skb);
1082        }
1083#endif
1084
1085        icsk->icsk_af_ops->send_check(sk, skb);
1086
1087        if (likely(tcb->tcp_flags & TCPHDR_ACK))
1088                tcp_event_ack_sent(sk, tcp_skb_pcount(skb));
1089
1090        if (skb->len != tcp_header_size)
1091                tcp_event_data_sent(tp, sk);
1092
1093        if (after(tcb->end_seq, tp->snd_nxt) || tcb->seq == tcb->end_seq)
1094                TCP_ADD_STATS(sock_net(sk), TCP_MIB_OUTSEGS,
1095                              tcp_skb_pcount(skb));
1096
1097        err = icsk->icsk_af_ops->queue_xmit(skb, &inet->cork.fl);
1098        if (likely(err <= 0))
1099                return err;
1100
1101        tcp_enter_cwr(sk, 1);
1102
1103        return net_xmit_eval(err);
1104}
1105
1106/* This routine just queues the buffer for sending.
1107 *
1108 * NOTE: probe0 timer is not checked, do not forget tcp_push_pending_frames,
1109 * otherwise socket can stall.
1110 */
1111static void tcp_queue_skb(struct sock *sk, struct sk_buff *skb)
1112{
1113        struct tcp_sock *tp = tcp_sk(sk);
1114
1115        /* Advance write_seq and place onto the write_queue. */
1116        tp->write_seq = TCP_SKB_CB(skb)->end_seq;
1117        skb_header_release(skb);
1118        tcp_add_write_queue_tail(sk, skb);
1119        sk->sk_wmem_queued += skb->truesize;
1120        sk_mem_charge(sk, skb->truesize);
1121}
1122
1123/* Initialize TSO segments for a packet. */
1124static void tcp_set_skb_tso_segs(const struct sock *sk, struct sk_buff *skb,
1125                                 unsigned int mss_now)
1126{
1127        if (skb->len <= mss_now || !sk_can_gso(sk) ||
1128            skb->ip_summed == CHECKSUM_NONE) {
1129                /* Avoid the costly divide in the normal
1130                 * non-TSO case.
1131                 */
1132                skb_shinfo(skb)->gso_segs = 1;
1133                skb_shinfo(skb)->gso_size = 0;
1134                skb_shinfo(skb)->gso_type = 0;
1135        } else {
1136                skb_shinfo(skb)->gso_segs = DIV_ROUND_UP(skb->len, mss_now);
1137                skb_shinfo(skb)->gso_size = mss_now;
1138                skb_shinfo(skb)->gso_type = sk->sk_gso_type;
1139        }
1140}
1141
1142/* When a modification to fackets out becomes necessary, we need to check
1143 * skb is counted to fackets_out or not.
1144 */
1145static void tcp_adjust_fackets_out(struct sock *sk, const struct sk_buff *skb,
1146                                   int decr)
1147{
1148        struct tcp_sock *tp = tcp_sk(sk);
1149
1150        if (!tp->sacked_out || tcp_is_reno(tp))
1151                return;
1152
1153        if (after(tcp_highest_sack_seq(tp), TCP_SKB_CB(skb)->seq))
1154                tp->fackets_out -= decr;
1155}
1156
1157/* Pcount in the middle of the write queue got changed, we need to do various
1158 * tweaks to fix counters
1159 */
1160static void tcp_adjust_pcount(struct sock *sk, const struct sk_buff *skb, int decr)
1161{
1162        struct tcp_sock *tp = tcp_sk(sk);
1163
1164        tp->packets_out -= decr;
1165
1166        if (TCP_SKB_CB(skb)->sacked & TCPCB_SACKED_ACKED)
1167                tp->sacked_out -= decr;
1168        if (TCP_SKB_CB(skb)->sacked & TCPCB_SACKED_RETRANS)
1169                tp->retrans_out -= decr;
1170        if (TCP_SKB_CB(skb)->sacked & TCPCB_LOST)
1171                tp->lost_out -= decr;
1172
1173        /* Reno case is special. Sigh... */
1174        if (tcp_is_reno(tp) && decr > 0)
1175                tp->sacked_out -= min_t(u32, tp->sacked_out, decr);
1176
1177        tcp_adjust_fackets_out(sk, skb, decr);
1178
1179        if (tp->lost_skb_hint &&
1180            before(TCP_SKB_CB(skb)->seq, TCP_SKB_CB(tp->lost_skb_hint)->seq) &&
1181            (tcp_is_fack(tp) || (TCP_SKB_CB(skb)->sacked & TCPCB_SACKED_ACKED)))
1182                tp->lost_cnt_hint -= decr;
1183
1184        tcp_verify_left_out(tp);
1185}
1186
1187/* Function to create two new TCP segments.  Shrinks the given segment
1188 * to the specified size and appends a new segment with the rest of the
1189 * packet to the list.  This won't be called frequently, I hope.
1190 * Remember, these are still headerless SKBs at this point.
1191 */
1192int tcp_fragment(struct sock *sk, struct sk_buff *skb, u32 len,
1193                 unsigned int mss_now)
1194{
1195        struct tcp_sock *tp = tcp_sk(sk);
1196        struct sk_buff *buff;
1197        int nsize, old_factor;
1198        int nlen;
1199        u8 flags;
1200
1201        if (WARN_ON(len > skb->len))
1202                return -EINVAL;
1203
1204        nsize = skb_headlen(skb) - len;
1205        if (nsize < 0)
1206                nsize = 0;
1207
1208        if (skb_cloned(skb) &&
1209            skb_is_nonlinear(skb) &&
1210            pskb_expand_head(skb, 0, 0, GFP_ATOMIC))
1211                return -ENOMEM;
1212
1213        /* Get a new skb... force flag on. */
1214        buff = sk_stream_alloc_skb(sk, nsize, GFP_ATOMIC);
1215        if (buff == NULL)
1216                return -ENOMEM; /* We'll just try again later. */
1217
1218        sk->sk_wmem_queued += buff->truesize;
1219        sk_mem_charge(sk, buff->truesize);
1220        nlen = skb->len - len - nsize;
1221        buff->truesize += nlen;
1222        skb->truesize -= nlen;
1223
1224        /* Correct the sequence numbers. */
1225        TCP_SKB_CB(buff)->seq = TCP_SKB_CB(skb)->seq + len;
1226        TCP_SKB_CB(buff)->end_seq = TCP_SKB_CB(skb)->end_seq;
1227        TCP_SKB_CB(skb)->end_seq = TCP_SKB_CB(buff)->seq;
1228
1229        /* PSH and FIN should only be set in the second packet. */
1230        flags = TCP_SKB_CB(skb)->tcp_flags;
1231        TCP_SKB_CB(skb)->tcp_flags = flags & ~(TCPHDR_FIN | TCPHDR_PSH);
1232        TCP_SKB_CB(buff)->tcp_flags = flags;
1233        TCP_SKB_CB(buff)->sacked = TCP_SKB_CB(skb)->sacked;
1234
1235        if (!skb_shinfo(skb)->nr_frags && skb->ip_summed != CHECKSUM_PARTIAL) {
1236                /* Copy and checksum data tail into the new buffer. */
1237                buff->csum = csum_partial_copy_nocheck(skb->data + len,
1238                                                       skb_put(buff, nsize),
1239                                                       nsize, 0);
1240
1241                skb_trim(skb, len);
1242
1243                skb->csum = csum_block_sub(skb->csum, buff->csum, len);
1244        } else {
1245                skb->ip_summed = CHECKSUM_PARTIAL;
1246                skb_split(skb, buff, len);
1247        }
1248
1249        buff->ip_summed = skb->ip_summed;
1250
1251        /* Looks stupid, but our code really uses when of
1252         * skbs, which it never sent before. --ANK
1253         */
1254        TCP_SKB_CB(buff)->when = TCP_SKB_CB(skb)->when;
1255        buff->tstamp = skb->tstamp;
1256
1257        old_factor = tcp_skb_pcount(skb);
1258
1259        /* Fix up tso_factor for both original and new SKB.  */
1260        tcp_set_skb_tso_segs(sk, skb, mss_now);
1261        tcp_set_skb_tso_segs(sk, buff, mss_now);
1262
1263        /* If this packet has been sent out already, we must
1264         * adjust the various packet counters.
1265         */
1266        if (!before(tp->snd_nxt, TCP_SKB_CB(buff)->end_seq)) {
1267                int diff = old_factor - tcp_skb_pcount(skb) -
1268                        tcp_skb_pcount(buff);
1269
1270                if (diff)
1271                        tcp_adjust_pcount(sk, skb, diff);
1272        }
1273
1274        /* Link BUFF into the send queue. */
1275        skb_header_release(buff);
1276        tcp_insert_write_queue_after(skb, buff, sk);
1277
1278        return 0;
1279}
1280
1281/* This is similar to __pskb_pull_head() (it will go to core/skbuff.c
1282 * eventually). The difference is that pulled data not copied, but
1283 * immediately discarded.
1284 */
1285static void __pskb_trim_head(struct sk_buff *skb, int len)
1286{
1287        int i, k, eat;
1288
1289        eat = min_t(int, len, skb_headlen(skb));
1290        if (eat) {
1291                __skb_pull(skb, eat);
1292                skb->avail_size -= eat;
1293                len -= eat;
1294                if (!len)
1295                        return;
1296        }
1297        eat = len;
1298        k = 0;
1299        for (i = 0; i < skb_shinfo(skb)->nr_frags; i++) {
1300                int size = skb_frag_size(&skb_shinfo(skb)->frags[i]);
1301
1302                if (size <= eat) {
1303                        skb_frag_unref(skb, i);
1304                        eat -= size;
1305                } else {
1306                        skb_shinfo(skb)->frags[k] = skb_shinfo(skb)->frags[i];
1307                        if (eat) {
1308                                skb_shinfo(skb)->frags[k].page_offset += eat;
1309                                skb_frag_size_sub(&skb_shinfo(skb)->frags[k], eat);
1310                                eat = 0;
1311                        }
1312                        k++;
1313                }
1314        }
1315        skb_shinfo(skb)->nr_frags = k;
1316
1317        skb_reset_tail_pointer(skb);
1318        skb->data_len -= len;
1319        skb->len = skb->data_len;
1320}
1321
1322/* Remove acked data from a packet in the transmit queue. */
1323int tcp_trim_head(struct sock *sk, struct sk_buff *skb, u32 len)
1324{
1325        if (skb_cloned(skb) && pskb_expand_head(skb, 0, 0, GFP_ATOMIC))
1326                return -ENOMEM;
1327
1328        __pskb_trim_head(skb, len);
1329
1330        TCP_SKB_CB(skb)->seq += len;
1331        skb->ip_summed = CHECKSUM_PARTIAL;
1332
1333        skb->truesize        -= len;
1334        sk->sk_wmem_queued   -= len;
1335        sk_mem_uncharge(sk, len);
1336        sock_set_flag(sk, SOCK_QUEUE_SHRUNK);
1337
1338        /* Any change of skb->len requires recalculation of tso factor. */
1339        if (tcp_skb_pcount(skb) > 1)
1340                tcp_set_skb_tso_segs(sk, skb, tcp_skb_mss(skb));
1341
1342        return 0;
1343}
1344
1345/* Calculate MSS. Not accounting for SACKs here.  */
1346int tcp_mtu_to_mss(struct sock *sk, int pmtu)
1347{
1348        const struct tcp_sock *tp = tcp_sk(sk);
1349        const struct inet_connection_sock *icsk = inet_csk(sk);
1350        int mss_now;
1351
1352        /* Calculate base mss without TCP options:
1353           It is MMS_S - sizeof(tcphdr) of rfc1122
1354         */
1355        mss_now = pmtu - icsk->icsk_af_ops->net_header_len - sizeof(struct tcphdr);
1356
1357        /* IPv6 adds a frag_hdr in case RTAX_FEATURE_ALLFRAG is set */
1358        if (icsk->icsk_af_ops->net_frag_header_len) {
1359                const struct dst_entry *dst = __sk_dst_get(sk);
1360
1361                if (dst && dst_allfrag(dst))
1362                        mss_now -= icsk->icsk_af_ops->net_frag_header_len;
1363        }
1364
1365        /* Clamp it (mss_clamp does not include tcp options) */
1366        if (mss_now > tp->rx_opt.mss_clamp)
1367                mss_now = tp->rx_opt.mss_clamp;
1368
1369        /* Now subtract optional transport overhead */
1370        mss_now -= icsk->icsk_ext_hdr_len;
1371
1372        /* Then reserve room for full set of TCP options and 8 bytes of data */
1373        if (mss_now < 48)
1374                mss_now = 48;
1375
1376        /* Now subtract TCP options size, not including SACKs */
1377        mss_now -= tp->tcp_header_len - sizeof(struct tcphdr);
1378
1379        return mss_now;
1380}
1381
1382/* Inverse of above */
1383int tcp_mss_to_mtu(struct sock *sk, int mss)
1384{
1385        const struct tcp_sock *tp = tcp_sk(sk);
1386        const struct inet_connection_sock *icsk = inet_csk(sk);
1387        int mtu;
1388
1389        mtu = mss +
1390              tp->tcp_header_len +
1391              icsk->icsk_ext_hdr_len +
1392              icsk->icsk_af_ops->net_header_len;
1393
1394        /* IPv6 adds a frag_hdr in case RTAX_FEATURE_ALLFRAG is set */
1395        if (icsk->icsk_af_ops->net_frag_header_len) {
1396                const struct dst_entry *dst = __sk_dst_get(sk);
1397
1398                if (dst && dst_allfrag(dst))
1399                        mtu += icsk->icsk_af_ops->net_frag_header_len;
1400        }
1401        return mtu;
1402}
1403
1404/* MTU probing init per socket */
1405void tcp_mtup_init(struct sock *sk)
1406{
1407        struct tcp_sock *tp = tcp_sk(sk);
1408        struct inet_connection_sock *icsk = inet_csk(sk);
1409
1410        icsk->icsk_mtup.enabled = sysctl_tcp_mtu_probing > 1;
1411        icsk->icsk_mtup.search_high = tp->rx_opt.mss_clamp + sizeof(struct tcphdr) +
1412                               icsk->icsk_af_ops->net_header_len;
1413        icsk->icsk_mtup.search_low = tcp_mss_to_mtu(sk, sysctl_tcp_base_mss);
1414        icsk->icsk_mtup.probe_size = 0;
1415}
1416EXPORT_SYMBOL(tcp_mtup_init);
1417
1418/* This function synchronize snd mss to current pmtu/exthdr set.
1419
1420   tp->rx_opt.user_mss is mss set by user by TCP_MAXSEG. It does NOT counts
1421   for TCP options, but includes only bare TCP header.
1422
1423   tp->rx_opt.mss_clamp is mss negotiated at connection setup.
1424   It is minimum of user_mss and mss received with SYN.
1425   It also does not include TCP options.
1426
1427   inet_csk(sk)->icsk_pmtu_cookie is last pmtu, seen by this function.
1428
1429   tp->mss_cache is current effective sending mss, including
1430   all tcp options except for SACKs. It is evaluated,
1431   taking into account current pmtu, but never exceeds
1432   tp->rx_opt.mss_clamp.
1433
1434   NOTE1. rfc1122 clearly states that advertised MSS
1435   DOES NOT include either tcp or ip options.
1436
1437   NOTE2. inet_csk(sk)->icsk_pmtu_cookie and tp->mss_cache
1438   are READ ONLY outside this function.         --ANK (980731)
1439 */
1440unsigned int tcp_sync_mss(struct sock *sk, u32 pmtu)
1441{
1442        struct tcp_sock *tp = tcp_sk(sk);
1443        struct inet_connection_sock *icsk = inet_csk(sk);
1444        int mss_now;
1445
1446        if (icsk->icsk_mtup.search_high > pmtu)
1447                icsk->icsk_mtup.search_high = pmtu;
1448
1449        mss_now = tcp_mtu_to_mss(sk, pmtu);
1450        mss_now = tcp_bound_to_half_wnd(tp, mss_now);
1451
1452        /* And store cached results */
1453        icsk->icsk_pmtu_cookie = pmtu;
1454        if (icsk->icsk_mtup.enabled)
1455                mss_now = min(mss_now, tcp_mtu_to_mss(sk, icsk->icsk_mtup.search_low));
1456        tp->mss_cache = mss_now;
1457
1458        return mss_now;
1459}
1460EXPORT_SYMBOL(tcp_sync_mss);
1461
1462/* Compute the current effective MSS, taking SACKs and IP options,
1463 * and even PMTU discovery events into account.
1464 */
1465unsigned int tcp_current_mss(struct sock *sk)
1466{
1467        const struct tcp_sock *tp = tcp_sk(sk);
1468        const struct dst_entry *dst = __sk_dst_get(sk);
1469        u32 mss_now;
1470        unsigned int header_len;
1471        struct tcp_out_options opts;
1472        struct tcp_md5sig_key *md5;
1473
1474        mss_now = tp->mss_cache;
1475
1476        if (dst) {
1477                u32 mtu = dst_mtu(dst);
1478                if (mtu != inet_csk(sk)->icsk_pmtu_cookie)
1479                        mss_now = tcp_sync_mss(sk, mtu);
1480        }
1481
1482        header_len = tcp_established_options(sk, NULL, &opts, &md5) +
1483                     sizeof(struct tcphdr);
1484        /* The mss_cache is sized based on tp->tcp_header_len, which assumes
1485         * some common options. If this is an odd packet (because we have SACK
1486         * blocks etc) then our calculated header_len will be different, and
1487         * we have to adjust mss_now correspondingly */
1488        if (header_len != tp->tcp_header_len) {
1489                int delta = (int) header_len - tp->tcp_header_len;
1490                mss_now -= delta;
1491        }
1492
1493        return mss_now;
1494}
1495
1496/* Congestion window validation. (RFC2861) */
1497static void tcp_cwnd_validate(struct sock *sk)
1498{
1499        struct tcp_sock *tp = tcp_sk(sk);
1500
1501        if (tp->packets_out >= tp->snd_cwnd) {
1502                /* Network is feed fully. */
1503                tp->snd_cwnd_used = 0;
1504                tp->snd_cwnd_stamp = tcp_time_stamp;
1505        } else {
1506                /* Network starves. */
1507                if (tp->packets_out > tp->snd_cwnd_used)
1508                        tp->snd_cwnd_used = tp->packets_out;
1509
1510                if (sysctl_tcp_slow_start_after_idle &&
1511                    (s32)(tcp_time_stamp - tp->snd_cwnd_stamp) >= inet_csk(sk)->icsk_rto)
1512                        tcp_cwnd_application_limited(sk);
1513        }
1514}
1515
1516/* Returns the portion of skb which can be sent right away without
1517 * introducing MSS oddities to segment boundaries. In rare cases where
1518 * mss_now != mss_cache, we will request caller to create a small skb
1519 * per input skb which could be mostly avoided here (if desired).
1520 *
1521 * We explicitly want to create a request for splitting write queue tail
1522 * to a small skb for Nagle purposes while avoiding unnecessary modulos,
1523 * thus all the complexity (cwnd_len is always MSS multiple which we
1524 * return whenever allowed by the other factors). Basically we need the
1525 * modulo only when the receiver window alone is the limiting factor or
1526 * when we would be allowed to send the split-due-to-Nagle skb fully.
1527 */
1528static unsigned int tcp_mss_split_point(const struct sock *sk, const struct sk_buff *skb,
1529                                        unsigned int mss_now, unsigned int max_segs)
1530{
1531        const struct tcp_sock *tp = tcp_sk(sk);
1532        u32 needed, window, max_len;
1533
1534        window = tcp_wnd_end(tp) - TCP_SKB_CB(skb)->seq;
1535        max_len = mss_now * max_segs;
1536
1537        if (likely(max_len <= window && skb != tcp_write_queue_tail(sk)))
1538                return max_len;
1539
1540        needed = min(skb->len, window);
1541
1542        if (max_len <= needed)
1543                return max_len;
1544
1545        return needed - needed % mss_now;
1546}
1547
1548/* Can at least one segment of SKB be sent right now, according to the
1549 * congestion window rules?  If so, return how many segments are allowed.
1550 */
1551static inline unsigned int tcp_cwnd_test(const struct tcp_sock *tp,
1552                                         const struct sk_buff *skb)
1553{
1554        u32 in_flight, cwnd;
1555
1556        /* Don't be strict about the congestion window for the final FIN.  */
1557        if ((TCP_SKB_CB(skb)->tcp_flags & TCPHDR_FIN) &&
1558            tcp_skb_pcount(skb) == 1)
1559                return 1;
1560
1561        in_flight = tcp_packets_in_flight(tp);
1562        cwnd = tp->snd_cwnd;
1563        if (in_flight < cwnd)
1564                return (cwnd - in_flight);
1565
1566        return 0;
1567}
1568
1569/* Initialize TSO state of a skb.
1570 * This must be invoked the first time we consider transmitting
1571 * SKB onto the wire.
1572 */
1573static int tcp_init_tso_segs(const struct sock *sk, struct sk_buff *skb,
1574                             unsigned int mss_now)
1575{
1576        int tso_segs = tcp_skb_pcount(skb);
1577
1578        if (!tso_segs || (tso_segs > 1 && tcp_skb_mss(skb) != mss_now)) {
1579                tcp_set_skb_tso_segs(sk, skb, mss_now);
1580                tso_segs = tcp_skb_pcount(skb);
1581        }
1582        return tso_segs;
1583}
1584
1585/* Minshall's variant of the Nagle send check. */
1586static inline bool tcp_minshall_check(const struct tcp_sock *tp)
1587{
1588        return after(tp->snd_sml, tp->snd_una) &&
1589                !after(tp->snd_sml, tp->snd_nxt);
1590}
1591
1592/* Return false, if packet can be sent now without violation Nagle's rules:
1593 * 1. It is full sized.
1594 * 2. Or it contains FIN. (already checked by caller)
1595 * 3. Or TCP_CORK is not set, and TCP_NODELAY is set.
1596 * 4. Or TCP_CORK is not set, and all sent packets are ACKed.
1597 *    With Minshall's modification: all sent small packets are ACKed.
1598 */
1599static inline bool tcp_nagle_check(const struct tcp_sock *tp,
1600                                  const struct sk_buff *skb,
1601                                  unsigned int mss_now, int nonagle)
1602{
1603        return skb->len < mss_now &&
1604                ((nonagle & TCP_NAGLE_CORK) ||
1605                 (!nonagle && tp->packets_out && tcp_minshall_check(tp)));
1606}
1607
1608/* Return true if the Nagle test allows this packet to be
1609 * sent now.
1610 */
1611static inline bool tcp_nagle_test(const struct tcp_sock *tp, const struct sk_buff *skb,
1612                                  unsigned int cur_mss, int nonagle)
1613{
1614        /* Nagle rule does not apply to frames, which sit in the middle of the
1615         * write_queue (they have no chances to get new data).
1616         *
1617         * This is implemented in the callers, where they modify the 'nonagle'
1618         * argument based upon the location of SKB in the send queue.
1619         */
1620        if (nonagle & TCP_NAGLE_PUSH)
1621                return true;
1622
1623        /* Don't use the nagle rule for urgent data (or for the final FIN).
1624         * Nagle can be ignored during F-RTO too (see RFC4138).
1625         */
1626        if (tcp_urg_mode(tp) || (tp->frto_counter == 2) ||
1627            (TCP_SKB_CB(skb)->tcp_flags & TCPHDR_FIN))
1628                return true;
1629
1630        if (!tcp_nagle_check(tp, skb, cur_mss, nonagle))
1631                return true;
1632
1633        return false;
1634}
1635
1636/* Does at least the first segment of SKB fit into the send window? */
1637static bool tcp_snd_wnd_test(const struct tcp_sock *tp,
1638                             const struct sk_buff *skb,
1639                             unsigned int cur_mss)
1640{
1641        u32 end_seq = TCP_SKB_CB(skb)->end_seq;
1642
1643        if (skb->len > cur_mss)
1644                end_seq = TCP_SKB_CB(skb)->seq + cur_mss;
1645
1646        return !after(end_seq, tcp_wnd_end(tp));
1647}
1648
1649/* This checks if the data bearing packet SKB (usually tcp_send_head(sk))
1650 * should be put on the wire right now.  If so, it returns the number of
1651 * packets allowed by the congestion window.
1652 */
1653static unsigned int tcp_snd_test(const struct sock *sk, struct sk_buff *skb,
1654                                 unsigned int cur_mss, int nonagle)
1655{
1656        const struct tcp_sock *tp = tcp_sk(sk);
1657        unsigned int cwnd_quota;
1658
1659        tcp_init_tso_segs(sk, skb, cur_mss);
1660
1661        if (!tcp_nagle_test(tp, skb, cur_mss, nonagle))
1662                return 0;
1663
1664        cwnd_quota = tcp_cwnd_test(tp, skb);
1665        if (cwnd_quota && !tcp_snd_wnd_test(tp, skb, cur_mss))
1666                cwnd_quota = 0;
1667
1668        return cwnd_quota;
1669}
1670
1671/* Test if sending is allowed right now. */
1672bool tcp_may_send_now(struct sock *sk)
1673{
1674        const struct tcp_sock *tp = tcp_sk(sk);
1675        struct sk_buff *skb = tcp_send_head(sk);
1676
1677        return skb &&
1678                tcp_snd_test(sk, skb, tcp_current_mss(sk),
1679                             (tcp_skb_is_last(sk, skb) ?
1680                              tp->nonagle : TCP_NAGLE_PUSH));
1681}
1682
1683/* Trim TSO SKB to LEN bytes, put the remaining data into a new packet
1684 * which is put after SKB on the list.  It is very much like
1685 * tcp_fragment() except that it may make several kinds of assumptions
1686 * in order to speed up the splitting operation.  In particular, we
1687 * know that all the data is in scatter-gather pages, and that the
1688 * packet has never been sent out before (and thus is not cloned).
1689 */
1690static int tso_fragment(struct sock *sk, struct sk_buff *skb, unsigned int len,
1691                        unsigned int mss_now, gfp_t gfp)
1692{
1693        struct sk_buff *buff;
1694        int nlen = skb->len - len;
1695        u8 flags;
1696
1697        /* All of a TSO frame must be composed of paged data.  */
1698        if (skb->len != skb->data_len)
1699                return tcp_fragment(sk, skb, len, mss_now);
1700
1701        buff = sk_stream_alloc_skb(sk, 0, gfp);
1702        if (unlikely(buff == NULL))
1703                return -ENOMEM;
1704
1705        sk->sk_wmem_queued += buff->truesize;
1706        sk_mem_charge(sk, buff->truesize);
1707        buff->truesize += nlen;
1708        skb->truesize -= nlen;
1709
1710        /* Correct the sequence numbers. */
1711        TCP_SKB_CB(buff)->seq = TCP_SKB_CB(skb)->seq + len;
1712        TCP_SKB_CB(buff)->end_seq = TCP_SKB_CB(skb)->end_seq;
1713        TCP_SKB_CB(skb)->end_seq = TCP_SKB_CB(buff)->seq;
1714
1715        /* PSH and FIN should only be set in the second packet. */
1716        flags = TCP_SKB_CB(skb)->tcp_flags;
1717        TCP_SKB_CB(skb)->tcp_flags = flags & ~(TCPHDR_FIN | TCPHDR_PSH);
1718        TCP_SKB_CB(buff)->tcp_flags = flags;
1719
1720        /* This packet was never sent out yet, so no SACK bits. */
1721        TCP_SKB_CB(buff)->sacked = 0;
1722
1723        buff->ip_summed = skb->ip_summed = CHECKSUM_PARTIAL;
1724        skb_split(skb, buff, len);
1725
1726        /* Fix up tso_factor for both original and new SKB.  */
1727        tcp_set_skb_tso_segs(sk, skb, mss_now);
1728        tcp_set_skb_tso_segs(sk, buff, mss_now);
1729
1730        /* Link BUFF into the send queue. */
1731        skb_header_release(buff);
1732        tcp_insert_write_queue_after(skb, buff, sk);
1733
1734        return 0;
1735}
1736
1737/* Try to defer sending, if possible, in order to minimize the amount
1738 * of TSO splitting we do.  View it as a kind of TSO Nagle test.
1739 *
1740 * This algorithm is from John Heffner.
1741 */
1742static bool tcp_tso_should_defer(struct sock *sk, struct sk_buff *skb)
1743{
1744        struct tcp_sock *tp = tcp_sk(sk);
1745        const struct inet_connection_sock *icsk = inet_csk(sk);
1746        u32 send_win, cong_win, limit, in_flight;
1747        int win_divisor;
1748
1749        if (TCP_SKB_CB(skb)->tcp_flags & TCPHDR_FIN)
1750                goto send_now;
1751
1752        if (icsk->icsk_ca_state != TCP_CA_Open)
1753                goto send_now;
1754
1755        /* Defer for less than two clock ticks. */
1756        if (tp->tso_deferred &&
1757            (((u32)jiffies << 1) >> 1) - (tp->tso_deferred >> 1) > 1)
1758                goto send_now;
1759
1760        in_flight = tcp_packets_in_flight(tp);
1761
1762        BUG_ON(tcp_skb_pcount(skb) <= 1 || (tp->snd_cwnd <= in_flight));
1763
1764        send_win = tcp_wnd_end(tp) - TCP_SKB_CB(skb)->seq;
1765
1766        /* From in_flight test above, we know that cwnd > in_flight.  */
1767        cong_win = (tp->snd_cwnd - in_flight) * tp->mss_cache;
1768
1769        limit = min(send_win, cong_win);
1770
1771        /* If a full-sized TSO skb can be sent, do it. */
1772        if (limit >= min_t(unsigned int, sk->sk_gso_max_size,
1773                           sk->sk_gso_max_segs * tp->mss_cache))
1774                goto send_now;
1775
1776        /* Middle in queue won't get any more data, full sendable already? */
1777        if ((skb != tcp_write_queue_tail(sk)) && (limit >= skb->len))
1778                goto send_now;
1779
1780        win_divisor = ACCESS_ONCE(sysctl_tcp_tso_win_divisor);
1781        if (win_divisor) {
1782                u32 chunk = min(tp->snd_wnd, tp->snd_cwnd * tp->mss_cache);
1783
1784                /* If at least some fraction of a window is available,
1785                 * just use it.
1786                 */
1787                chunk /= win_divisor;
1788                if (limit >= chunk)
1789                        goto send_now;
1790        } else {
1791                /* Different approach, try not to defer past a single
1792                 * ACK.  Receiver should ACK every other full sized
1793                 * frame, so if we have space for more than 3 frames
1794                 * then send now.
1795                 */
1796                if (limit > tcp_max_tso_deferred_mss(tp) * tp->mss_cache)
1797                        goto send_now;
1798        }
1799
1800        /* Ok, it looks like it is advisable to defer.  */
1801        tp->tso_deferred = 1 | (jiffies << 1);
1802
1803        return true;
1804
1805send_now:
1806        tp->tso_deferred = 0;
1807        return false;
1808}
1809
1810/* Create a new MTU probe if we are ready.
1811 * MTU probe is regularly attempting to increase the path MTU by
1812 * deliberately sending larger packets.  This discovers routing
1813 * changes resulting in larger path MTUs.
1814 *
1815 * Returns 0 if we should wait to probe (no cwnd available),
1816 *         1 if a probe was sent,
1817 *         -1 otherwise
1818 */
1819static int tcp_mtu_probe(struct sock *sk)
1820{
1821        struct tcp_sock *tp = tcp_sk(sk);
1822        struct inet_connection_sock *icsk = inet_csk(sk);
1823        struct sk_buff *skb, *nskb, *next;
1824        int len;
1825        int probe_size;
1826        int size_needed;
1827        int copy;
1828        int mss_now;
1829
1830        /* Not currently probing/verifying,
1831         * not in recovery,
1832         * have enough cwnd, and
1833         * not SACKing (the variable headers throw things off) */
1834        if (!icsk->icsk_mtup.enabled ||
1835            icsk->icsk_mtup.probe_size ||
1836            inet_csk(sk)->icsk_ca_state != TCP_CA_Open ||
1837            tp->snd_cwnd < 11 ||
1838            tp->rx_opt.num_sacks || tp->rx_opt.dsack)
1839                return -1;
1840
1841        /* Very simple search strategy: just double the MSS. */
1842        mss_now = tcp_current_mss(sk);
1843        probe_size = 2 * tp->mss_cache;
1844        size_needed = probe_size + (tp->reordering + 1) * tp->mss_cache;
1845        if (probe_size > tcp_mtu_to_mss(sk, icsk->icsk_mtup.search_high)) {
1846                /* TODO: set timer for probe_converge_event */
1847                return -1;
1848        }
1849
1850        /* Have enough data in the send queue to probe? */
1851        if (tp->write_seq - tp->snd_nxt < size_needed)
1852                return -1;
1853
1854        if (tp->snd_wnd < size_needed)
1855                return -1;
1856        if (after(tp->snd_nxt + size_needed, tcp_wnd_end(tp)))
1857                return 0;
1858
1859        /* Do we need to wait to drain cwnd? With none in flight, don't stall */
1860        if (tcp_packets_in_flight(tp) + 2 > tp->snd_cwnd) {
1861                if (!tcp_packets_in_flight(tp))
1862                        return -1;
1863                else
1864                        return 0;
1865        }
1866
1867        /* We're allowed to probe.  Build it now. */
1868        if ((nskb = sk_stream_alloc_skb(sk, probe_size, GFP_ATOMIC)) == NULL)
1869                return -1;
1870        sk->sk_wmem_queued += nskb->truesize;
1871        sk_mem_charge(sk, nskb->truesize);
1872
1873        skb = tcp_send_head(sk);
1874
1875        TCP_SKB_CB(nskb)->seq = TCP_SKB_CB(skb)->seq;
1876        TCP_SKB_CB(nskb)->end_seq = TCP_SKB_CB(skb)->seq + probe_size;
1877        TCP_SKB_CB(nskb)->tcp_flags = TCPHDR_ACK;
1878        TCP_SKB_CB(nskb)->sacked = 0;
1879        nskb->csum = 0;
1880        nskb->ip_summed = skb->ip_summed;
1881
1882        tcp_insert_write_queue_before(nskb, skb, sk);
1883
1884        len = 0;
1885        tcp_for_write_queue_from_safe(skb, next, sk) {
1886                copy = min_t(int, skb->len, probe_size - len);
1887                if (nskb->ip_summed)
1888                        skb_copy_bits(skb, 0, skb_put(nskb, copy), copy);
1889                else
1890                        nskb->csum = skb_copy_and_csum_bits(skb, 0,
1891                                                            skb_put(nskb, copy),
1892                                                            copy, nskb->csum);
1893
1894                if (skb->len <= copy) {
1895                        /* We've eaten all the data from this skb.
1896                         * Throw it away. */
1897                        TCP_SKB_CB(nskb)->tcp_flags |= TCP_SKB_CB(skb)->tcp_flags;
1898                        tcp_unlink_write_queue(skb, sk);
1899                        sk_wmem_free_skb(sk, skb);
1900                } else {
1901                        TCP_SKB_CB(nskb)->tcp_flags |= TCP_SKB_CB(skb)->tcp_flags &
1902                                                   ~(TCPHDR_FIN|TCPHDR_PSH);
1903                        if (!skb_shinfo(skb)->nr_frags) {
1904                                skb_pull(skb, copy);
1905                                if (skb->ip_summed != CHECKSUM_PARTIAL)
1906                                        skb->csum = csum_partial(skb->data,
1907                                                                 skb->len, 0);
1908                        } else {
1909                                __pskb_trim_head(skb, copy);
1910                                tcp_set_skb_tso_segs(sk, skb, mss_now);
1911                        }
1912                        TCP_SKB_CB(skb)->seq += copy;
1913                }
1914
1915                len += copy;
1916
1917                if (len >= probe_size)
1918                        break;
1919        }
1920        tcp_init_tso_segs(sk, nskb, nskb->len);
1921
1922        /* We're ready to send.  If this fails, the probe will
1923         * be resegmented into mss-sized pieces by tcp_write_xmit(). */
1924        TCP_SKB_CB(nskb)->when = tcp_time_stamp;
1925        if (!tcp_transmit_skb(sk, nskb, 1, GFP_ATOMIC)) {
1926                /* Decrement cwnd here because we are sending
1927                 * effectively two packets. */
1928                tp->snd_cwnd--;
1929                tcp_event_new_data_sent(sk, nskb);
1930
1931                icsk->icsk_mtup.probe_size = tcp_mss_to_mtu(sk, nskb->len);
1932                tp->mtu_probe.probe_seq_start = TCP_SKB_CB(nskb)->seq;
1933                tp->mtu_probe.probe_seq_end = TCP_SKB_CB(nskb)->end_seq;
1934
1935                return 1;
1936        }
1937
1938        return -1;
1939}
1940
1941/* This routine writes packets to the network.  It advances the
1942 * send_head.  This happens as incoming acks open up the remote
1943 * window for us.
1944 *
1945 * LARGESEND note: !tcp_urg_mode is overkill, only frames between
1946 * snd_up-64k-mss .. snd_up cannot be large. However, taking into
1947 * account rare use of URG, this is not a big flaw.
1948 *
1949 * Returns true, if no segments are in flight and we have queued segments,
1950 * but cannot send anything now because of SWS or another problem.
1951 */
1952static bool tcp_write_xmit(struct sock *sk, unsigned int mss_now, int nonagle,
1953                           int push_one, gfp_t gfp)
1954{
1955        struct tcp_sock *tp = tcp_sk(sk);
1956        struct sk_buff *skb;
1957        unsigned int tso_segs, sent_pkts;
1958        int cwnd_quota;
1959        int result;
1960
1961        sent_pkts = 0;
1962
1963        if (!push_one) {
1964                /* Do MTU probing. */
1965                result = tcp_mtu_probe(sk);
1966                if (!result) {
1967                        return false;
1968                } else if (result > 0) {
1969                        sent_pkts = 1;
1970                }
1971        }
1972
1973        while ((skb = tcp_send_head(sk))) {
1974                unsigned int limit;
1975
1976
1977                tso_segs = tcp_init_tso_segs(sk, skb, mss_now);
1978                BUG_ON(!tso_segs);
1979
1980                cwnd_quota = tcp_cwnd_test(tp, skb);
1981                if (!cwnd_quota)
1982                        break;
1983
1984                if (unlikely(!tcp_snd_wnd_test(tp, skb, mss_now)))
1985                        break;
1986
1987                if (tso_segs == 1) {
1988                        if (unlikely(!tcp_nagle_test(tp, skb, mss_now,
1989                                                     (tcp_skb_is_last(sk, skb) ?
1990                                                      nonagle : TCP_NAGLE_PUSH))))
1991                                break;
1992                } else {
1993                        if (!push_one && tcp_tso_should_defer(sk, skb))
1994                                break;
1995                }
1996
1997                /* TSQ : sk_wmem_alloc accounts skb truesize,
1998                 * including skb overhead. But thats OK.
1999                 */
2000                if (atomic_read(&sk->sk_wmem_alloc) >= sysctl_tcp_limit_output_bytes) {
2001                        set_bit(TSQ_THROTTLED, &tp->tsq_flags);
2002                        break;
2003                }
2004                limit = mss_now;
2005                if (tso_segs > 1 && !tcp_urg_mode(tp))
2006                        limit = tcp_mss_split_point(sk, skb, mss_now,
2007                                                    min_t(unsigned int,
2008                                                          cwnd_quota,
2009                                                          sk->sk_gso_max_segs));
2010
2011                if (skb->len > limit &&
2012                    unlikely(tso_fragment(sk, skb, limit, mss_now, gfp)))
2013                        break;
2014
2015                TCP_SKB_CB(skb)->when = tcp_time_stamp;
2016
2017                if (unlikely(tcp_transmit_skb(sk, skb, 1, gfp)))
2018                        break;
2019
2020                /* Advance the send_head.  This one is sent out.
2021                 * This call will increment packets_out.
2022                 */
2023                tcp_event_new_data_sent(sk, skb);
2024
2025                tcp_minshall_update(tp, mss_now, skb);
2026                sent_pkts += tcp_skb_pcount(skb);
2027
2028                if (push_one)
2029                        break;
2030        }
2031        if (inet_csk(sk)->icsk_ca_state == TCP_CA_Recovery)
2032                tp->prr_out += sent_pkts;
2033
2034        if (likely(sent_pkts)) {
2035                tcp_cwnd_validate(sk);
2036                return false;
2037        }
2038        return !tp->packets_out && tcp_send_head(sk);
2039}
2040
2041/* Push out any pending frames which were held back due to
2042 * TCP_CORK or attempt at coalescing tiny packets.
2043 * The socket must be locked by the caller.
2044 */
2045void __tcp_push_pending_frames(struct sock *sk, unsigned int cur_mss,
2046                               int nonagle)
2047{
2048        /* If we are closed, the bytes will have to remain here.
2049         * In time closedown will finish, we empty the write queue and
2050         * all will be happy.
2051         */
2052        if (unlikely(sk->sk_state == TCP_CLOSE))
2053                return;
2054
2055        if (tcp_write_xmit(sk, cur_mss, nonagle, 0,
2056                           sk_gfp_atomic(sk, GFP_ATOMIC)))
2057                tcp_check_probe_timer(sk);
2058}
2059
2060/* Send _single_ skb sitting at the send head. This function requires
2061 * true push pending frames to setup probe timer etc.
2062 */
2063void tcp_push_one(struct sock *sk, unsigned int mss_now)
2064{
2065        struct sk_buff *skb = tcp_send_head(sk);
2066
2067        BUG_ON(!skb || skb->len < mss_now);
2068
2069        tcp_write_xmit(sk, mss_now, TCP_NAGLE_PUSH, 1, sk->sk_allocation);
2070}
2071
2072/* This function returns the amount that we can raise the
2073 * usable window based on the following constraints
2074 *
2075 * 1. The window can never be shrunk once it is offered (RFC 793)
2076 * 2. We limit memory per socket
2077 *
2078 * RFC 1122:
2079 * "the suggested [SWS] avoidance algorithm for the receiver is to keep
2080 *  RECV.NEXT + RCV.WIN fixed until:
2081 *  RCV.BUFF - RCV.USER - RCV.WINDOW >= min(1/2 RCV.BUFF, MSS)"
2082 *
2083 * i.e. don't raise the right edge of the window until you can raise
2084 * it at least MSS bytes.
2085 *
2086 * Unfortunately, the recommended algorithm breaks header prediction,
2087 * since header prediction assumes th->window stays fixed.
2088 *
2089 * Strictly speaking, keeping th->window fixed violates the receiver
2090 * side SWS prevention criteria. The problem is that under this rule
2091 * a stream of single byte packets will cause the right side of the
2092 * window to always advance by a single byte.
2093 *
2094 * Of course, if the sender implements sender side SWS prevention
2095 * then this will not be a problem.
2096 *
2097 * BSD seems to make the following compromise:
2098 *
2099 *      If the free space is less than the 1/4 of the maximum
2100 *      space available and the free space is less than 1/2 mss,
2101 *      then set the window to 0.
2102 *      [ Actually, bsd uses MSS and 1/4 of maximal _window_ ]
2103 *      Otherwise, just prevent the window from shrinking
2104 *      and from being larger than the largest representable value.
2105 *
2106 * This prevents incremental opening of the window in the regime
2107 * where TCP is limited by the speed of the reader side taking
2108 * data out of the TCP receive queue. It does nothing about
2109 * those cases where the window is constrained on the sender side
2110 * because the pipeline is full.
2111 *
2112 * BSD also seems to "accidentally" limit itself to windows that are a
2113 * multiple of MSS, at least until the free space gets quite small.
2114 * This would appear to be a side effect of the mbuf implementation.
2115 * Combining these two algorithms results in the observed behavior
2116 * of having a fixed window size at almost all times.
2117 *
2118 * Below we obtain similar behavior by forcing the offered window to
2119 * a multiple of the mss when it is feasible to do so.
2120 *
2121 * Note, we don't "adjust" for TIMESTAMP or SACK option bytes.
2122 * Regular options like TIMESTAMP are taken into account.
2123 */
2124u32 __tcp_select_window(struct sock *sk)
2125{
2126        struct inet_connection_sock *icsk = inet_csk(sk);
2127        struct tcp_sock *tp = tcp_sk(sk);
2128        /* MSS for the peer's data.  Previous versions used mss_clamp
2129         * here.  I don't know if the value based on our guesses
2130         * of peer's MSS is better for the performance.  It's more correct
2131         * but may be worse for the performance because of rcv_mss
2132         * fluctuations.  --SAW  1998/11/1
2133         */
2134        int mss = icsk->icsk_ack.rcv_mss;
2135        int free_space = tcp_space(sk);
2136        int full_space = min_t(int, tp->window_clamp, tcp_full_space(sk));
2137        int window;
2138
2139        if (mss > full_space)
2140                mss = full_space;
2141
2142        if (free_space < (full_space >> 1)) {
2143                icsk->icsk_ack.quick = 0;
2144
2145                if (sk_under_memory_pressure(sk))
2146                        tp->rcv_ssthresh = min(tp->rcv_ssthresh,
2147                                               4U * tp->advmss);
2148
2149                if (free_space < mss)
2150                        return 0;
2151        }
2152
2153        if (free_space > tp->rcv_ssthresh)
2154                free_space = tp->rcv_ssthresh;
2155
2156        /* Don't do rounding if we are using window scaling, since the
2157         * scaled window will not line up with the MSS boundary anyway.
2158         */
2159        window = tp->rcv_wnd;
2160        if (tp->rx_opt.rcv_wscale) {
2161                window = free_space;
2162
2163                /* Advertise enough space so that it won't get scaled away.
2164                 * Import case: prevent zero window announcement if
2165                 * 1<<rcv_wscale > mss.
2166                 */
2167                if (((window >> tp->rx_opt.rcv_wscale) << tp->rx_opt.rcv_wscale) != window)
2168                        window = (((window >> tp->rx_opt.rcv_wscale) + 1)
2169                                  << tp->rx_opt.rcv_wscale);
2170        } else {
2171                /* Get the largest window that is a nice multiple of mss.
2172                 * Window clamp already applied above.
2173                 * If our current window offering is within 1 mss of the
2174                 * free space we just keep it. This prevents the divide
2175                 * and multiply from happening most of the time.
2176                 * We also don't do any window rounding when the free space
2177                 * is too small.
2178                 */
2179                if (window <= free_space - mss || window > free_space)
2180                        window = (free_space / mss) * mss;
2181                else if (mss == full_space &&
2182                         free_space > window + (full_space >> 1))
2183                        window = free_space;
2184        }
2185
2186        return window;
2187}
2188
2189/* Collapses two adjacent SKB's during retransmission. */
2190static void tcp_collapse_retrans(struct sock *sk, struct sk_buff *skb)
2191{
2192        struct tcp_sock *tp = tcp_sk(sk);
2193        struct sk_buff *next_skb = tcp_write_queue_next(sk, skb);
2194        int skb_size, next_skb_size;
2195
2196        skb_size = skb->len;
2197        next_skb_size = next_skb->len;
2198
2199        BUG_ON(tcp_skb_pcount(skb) != 1 || tcp_skb_pcount(next_skb) != 1);
2200
2201        tcp_highest_sack_combine(sk, next_skb, skb);
2202
2203        tcp_unlink_write_queue(next_skb, sk);
2204
2205        skb_copy_from_linear_data(next_skb, skb_put(skb, next_skb_size),
2206                                  next_skb_size);
2207
2208        if (next_skb->ip_summed == CHECKSUM_PARTIAL)
2209                skb->ip_summed = CHECKSUM_PARTIAL;
2210
2211        if (skb->ip_summed != CHECKSUM_PARTIAL)
2212                skb->csum = csum_block_add(skb->csum, next_skb->csum, skb_size);
2213
2214        /* Update sequence range on original skb. */
2215        TCP_SKB_CB(skb)->end_seq = TCP_SKB_CB(next_skb)->end_seq;
2216
2217        /* Merge over control information. This moves PSH/FIN etc. over */
2218        TCP_SKB_CB(skb)->tcp_flags |= TCP_SKB_CB(next_skb)->tcp_flags;
2219
2220        /* All done, get rid of second SKB and account for it so
2221         * packet counting does not break.
2222         */
2223        TCP_SKB_CB(skb)->sacked |= TCP_SKB_CB(next_skb)->sacked & TCPCB_EVER_RETRANS;
2224
2225        /* changed transmit queue under us so clear hints */
2226        tcp_clear_retrans_hints_partial(tp);
2227        if (next_skb == tp->retransmit_skb_hint)
2228                tp->retransmit_skb_hint = skb;
2229
2230        tcp_adjust_pcount(sk, next_skb, tcp_skb_pcount(next_skb));
2231
2232        sk_wmem_free_skb(sk, next_skb);
2233}
2234
2235/* Check if coalescing SKBs is legal. */
2236static bool tcp_can_collapse(const struct sock *sk, const struct sk_buff *skb)
2237{
2238        if (tcp_skb_pcount(skb) > 1)
2239                return false;
2240        /* TODO: SACK collapsing could be used to remove this condition */
2241        if (skb_shinfo(skb)->nr_frags != 0)
2242                return false;
2243        if (skb_cloned(skb))
2244                return false;
2245        if (skb == tcp_send_head(sk))
2246                return false;
2247        /* Some heurestics for collapsing over SACK'd could be invented */
2248        if (TCP_SKB_CB(skb)->sacked & TCPCB_SACKED_ACKED)
2249                return false;
2250
2251        return true;
2252}
2253
2254/* Collapse packets in the retransmit queue to make to create
2255 * less packets on the wire. This is only done on retransmission.
2256 */
2257static void tcp_retrans_try_collapse(struct sock *sk, struct sk_buff *to,
2258                                     int space)
2259{
2260        struct tcp_sock *tp = tcp_sk(sk);
2261        struct sk_buff *skb = to, *tmp;
2262        bool first = true;
2263
2264        if (!sysctl_tcp_retrans_collapse)
2265                return;
2266        if (TCP_SKB_CB(skb)->tcp_flags & TCPHDR_SYN)
2267                return;
2268
2269        tcp_for_write_queue_from_safe(skb, tmp, sk) {
2270                if (!tcp_can_collapse(sk, skb))
2271                        break;
2272
2273                space -= skb->len;
2274
2275                if (first) {
2276                        first = false;
2277                        continue;
2278                }
2279
2280                if (space < 0)
2281                        break;
2282                /* Punt if not enough space exists in the first SKB for
2283                 * the data in the second
2284                 */
2285                if (skb->len > skb_availroom(to))
2286                        break;
2287
2288                if (after(TCP_SKB_CB(skb)->end_seq, tcp_wnd_end(tp)))
2289                        break;
2290
2291                tcp_collapse_retrans(sk, to);
2292        }
2293}
2294
2295/* This retransmits one SKB.  Policy decisions and retransmit queue
2296 * state updates are done by the caller.  Returns non-zero if an
2297 * error occurred which prevented the send.
2298 */
2299int tcp_retransmit_skb(struct sock *sk, struct sk_buff *skb)
2300{
2301        struct tcp_sock *tp = tcp_sk(sk);
2302        struct inet_connection_sock *icsk = inet_csk(sk);
2303        unsigned int cur_mss;
2304        int err;
2305
2306        /* Inconslusive MTU probe */
2307        if (icsk->icsk_mtup.probe_size) {
2308                icsk->icsk_mtup.probe_size = 0;
2309        }
2310
2311        /* Do not sent more than we queued. 1/4 is reserved for possible
2312         * copying overhead: fragmentation, tunneling, mangling etc.
2313         */
2314        if (atomic_read(&sk->sk_wmem_alloc) >
2315            min(sk->sk_wmem_queued + (sk->sk_wmem_queued >> 2), sk->sk_sndbuf))
2316                return -EAGAIN;
2317
2318        if (before(TCP_SKB_CB(skb)->seq, tp->snd_una)) {
2319                if (before(TCP_SKB_CB(skb)->end_seq, tp->snd_una))
2320                        BUG();
2321                if (tcp_trim_head(sk, skb, tp->snd_una - TCP_SKB_CB(skb)->seq))
2322                        return -ENOMEM;
2323        }
2324
2325        if (inet_csk(sk)->icsk_af_ops->rebuild_header(sk))
2326                return -EHOSTUNREACH; /* Routing failure or similar. */
2327
2328        cur_mss = tcp_current_mss(sk);
2329
2330        /* If receiver has shrunk his window, and skb is out of
2331         * new window, do not retransmit it. The exception is the
2332         * case, when window is shrunk to zero. In this case
2333         * our retransmit serves as a zero window probe.
2334         */
2335        if (!before(TCP_SKB_CB(skb)->seq, tcp_wnd_end(tp)) &&
2336            TCP_SKB_CB(skb)->seq != tp->snd_una)
2337                return -EAGAIN;
2338
2339        if (skb->len > cur_mss) {
2340                if (tcp_fragment(sk, skb, cur_mss, cur_mss))
2341                        return -ENOMEM; /* We'll try again later. */
2342        } else {
2343                int oldpcount = tcp_skb_pcount(skb);
2344
2345                if (unlikely(oldpcount > 1)) {
2346                        tcp_init_tso_segs(sk, skb, cur_mss);
2347                        tcp_adjust_pcount(sk, skb, oldpcount - tcp_skb_pcount(skb));
2348                }
2349        }
2350
2351        tcp_retrans_try_collapse(sk, skb, cur_mss);
2352
2353        /* Some Solaris stacks overoptimize and ignore the FIN on a
2354         * retransmit when old data is attached.  So strip it off
2355         * since it is cheap to do so and saves bytes on the network.
2356         */
2357        if (skb->len > 0 &&
2358            (TCP_SKB_CB(skb)->tcp_flags & TCPHDR_FIN) &&
2359            tp->snd_una == (TCP_SKB_CB(skb)->end_seq - 1)) {
2360                if (!pskb_trim(skb, 0)) {
2361                        /* Reuse, even though it does some unnecessary work */
2362                        tcp_init_nondata_skb(skb, TCP_SKB_CB(skb)->end_seq - 1,
2363                                             TCP_SKB_CB(skb)->tcp_flags);
2364                        skb->ip_summed = CHECKSUM_NONE;
2365                }
2366        }
2367
2368        /* Make a copy, if the first transmission SKB clone we made
2369         * is still in somebody's hands, else make a clone.
2370         */
2371        TCP_SKB_CB(skb)->when = tcp_time_stamp;
2372
2373        /* make sure skb->data is aligned on arches that require it */
2374        if (unlikely(NET_IP_ALIGN && ((unsigned long)skb->data & 3))) {
2375                struct sk_buff *nskb = __pskb_copy(skb, MAX_TCP_HEADER,
2376                                                   GFP_ATOMIC);
2377                err = nskb ? tcp_transmit_skb(sk, nskb, 0, GFP_ATOMIC) :
2378                             -ENOBUFS;
2379        } else {
2380                err = tcp_transmit_skb(sk, skb, 1, GFP_ATOMIC);
2381        }
2382
2383        if (err == 0) {
2384                /* Update global TCP statistics. */
2385                TCP_INC_STATS(sock_net(sk), TCP_MIB_RETRANSSEGS);
2386
2387                tp->total_retrans++;
2388
2389#if FASTRETRANS_DEBUG > 0
2390                if (TCP_SKB_CB(skb)->sacked & TCPCB_SACKED_RETRANS) {
2391                        net_dbg_ratelimited("retrans_out leaked\n");
2392                }
2393#endif
2394                if (!tp->retrans_out)
2395                        tp->lost_retrans_low = tp->snd_nxt;
2396                TCP_SKB_CB(skb)->sacked |= TCPCB_RETRANS;
2397                tp->retrans_out += tcp_skb_pcount(skb);
2398
2399                /* Save stamp of the first retransmit. */
2400                if (!tp->retrans_stamp)
2401                        tp->retrans_stamp = TCP_SKB_CB(skb)->when;
2402
2403                tp->undo_retrans += tcp_skb_pcount(skb);
2404
2405                /* snd_nxt is stored to detect loss of retransmitted segment,
2406                 * see tcp_input.c tcp_sacktag_write_queue().
2407                 */
2408                TCP_SKB_CB(skb)->ack_seq = tp->snd_nxt;
2409        }
2410        return err;
2411}
2412
2413/* Check if we forward retransmits are possible in the current
2414 * window/congestion state.
2415 */
2416static bool tcp_can_forward_retransmit(struct sock *sk)
2417{
2418        const struct inet_connection_sock *icsk = inet_csk(sk);
2419        const struct tcp_sock *tp = tcp_sk(sk);
2420
2421        /* Forward retransmissions are possible only during Recovery. */
2422        if (icsk->icsk_ca_state != TCP_CA_Recovery)
2423                return false;
2424
2425        /* No forward retransmissions in Reno are possible. */
2426        if (tcp_is_reno(tp))
2427                return false;
2428
2429        /* Yeah, we have to make difficult choice between forward transmission
2430         * and retransmission... Both ways have their merits...
2431         *
2432         * For now we do not retransmit anything, while we have some new
2433         * segments to send. In the other cases, follow rule 3 for
2434         * NextSeg() specified in RFC3517.
2435         */
2436
2437        if (tcp_may_send_now(sk))
2438                return false;
2439
2440        return true;
2441}
2442
2443/* This gets called after a retransmit timeout, and the initially
2444 * retransmitted data is acknowledged.  It tries to continue
2445 * resending the rest of the retransmit queue, until either
2446 * we've sent it all or the congestion window limit is reached.
2447 * If doing SACK, the first ACK which comes back for a timeout
2448 * based retransmit packet might feed us FACK information again.
2449 * If so, we use it to avoid unnecessarily retransmissions.
2450 */
2451void tcp_xmit_retransmit_queue(struct sock *sk)
2452{
2453        const struct inet_connection_sock *icsk = inet_csk(sk);
2454        struct tcp_sock *tp = tcp_sk(sk);
2455        struct sk_buff *skb;
2456        struct sk_buff *hole = NULL;
2457        u32 last_lost;
2458        int mib_idx;
2459        int fwd_rexmitting = 0;
2460
2461        if (!tp->packets_out)
2462                return;
2463
2464        if (!tp->lost_out)
2465                tp->retransmit_high = tp->snd_una;
2466
2467        if (tp->retransmit_skb_hint) {
2468                skb = tp->retransmit_skb_hint;
2469                last_lost = TCP_SKB_CB(skb)->end_seq;
2470                if (after(last_lost, tp->retransmit_high))
2471                        last_lost = tp->retransmit_high;
2472        } else {
2473                skb = tcp_write_queue_head(sk);
2474                last_lost = tp->snd_una;
2475        }
2476
2477        tcp_for_write_queue_from(skb, sk) {
2478                __u8 sacked = TCP_SKB_CB(skb)->sacked;
2479
2480                if (skb == tcp_send_head(sk))
2481                        break;
2482                /* we could do better than to assign each time */
2483                if (hole == NULL)
2484                        tp->retransmit_skb_hint = skb;
2485
2486                /* Assume this retransmit will generate
2487                 * only one packet for congestion window
2488                 * calculation purposes.  This works because
2489                 * tcp_retransmit_skb() will chop up the
2490                 * packet to be MSS sized and all the
2491                 * packet counting works out.
2492                 */
2493                if (tcp_packets_in_flight(tp) >= tp->snd_cwnd)
2494                        return;
2495
2496                if (fwd_rexmitting) {
2497begin_fwd:
2498                        if (!before(TCP_SKB_CB(skb)->seq, tcp_highest_sack_seq(tp)))
2499                                break;
2500                        mib_idx = LINUX_MIB_TCPFORWARDRETRANS;
2501
2502                } else if (!before(TCP_SKB_CB(skb)->seq, tp->retransmit_high)) {
2503                        tp->retransmit_high = last_lost;
2504                        if (!tcp_can_forward_retransmit(sk))
2505                                break;
2506                        /* Backtrack if necessary to non-L'ed skb */
2507                        if (hole != NULL) {
2508                                skb = hole;
2509                                hole = NULL;
2510                        }
2511                        fwd_rexmitting = 1;
2512                        goto begin_fwd;
2513
2514                } else if (!(sacked & TCPCB_LOST)) {
2515                        if (hole == NULL && !(sacked & (TCPCB_SACKED_RETRANS|TCPCB_SACKED_ACKED)))
2516                                hole = skb;
2517                        continue;
2518
2519                } else {
2520                        last_lost = TCP_SKB_CB(skb)->end_seq;
2521                        if (icsk->icsk_ca_state != TCP_CA_Loss)
2522                                mib_idx = LINUX_MIB_TCPFASTRETRANS;
2523                        else
2524                                mib_idx = LINUX_MIB_TCPSLOWSTARTRETRANS;
2525                }
2526
2527                if (sacked & (TCPCB_SACKED_ACKED|TCPCB_SACKED_RETRANS))
2528                        continue;
2529
2530                if (tcp_retransmit_skb(sk, skb)) {
2531                        NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPRETRANSFAIL);
2532                        return;
2533                }
2534                NET_INC_STATS_BH(sock_net(sk), mib_idx);
2535
2536                if (inet_csk(sk)->icsk_ca_state == TCP_CA_Recovery)
2537                        tp->prr_out += tcp_skb_pcount(skb);
2538
2539                if (skb == tcp_write_queue_head(sk))
2540                        inet_csk_reset_xmit_timer(sk, ICSK_TIME_RETRANS,
2541                                                  inet_csk(sk)->icsk_rto,
2542                                                  TCP_RTO_MAX);
2543        }
2544}
2545
2546/* Send a fin.  The caller locks the socket for us.  This cannot be
2547 * allowed to fail queueing a FIN frame under any circumstances.
2548 */
2549void tcp_send_fin(struct sock *sk)
2550{
2551        struct tcp_sock *tp = tcp_sk(sk);
2552        struct sk_buff *skb = tcp_write_queue_tail(sk);
2553        int mss_now;
2554
2555        /* Optimization, tack on the FIN if we have a queue of
2556         * unsent frames.  But be careful about outgoing SACKS
2557         * and IP options.
2558         */
2559        mss_now = tcp_current_mss(sk);
2560
2561        if (tcp_send_head(sk) != NULL) {
2562                TCP_SKB_CB(skb)->tcp_flags |= TCPHDR_FIN;
2563                TCP_SKB_CB(skb)->end_seq++;
2564                tp->write_seq++;
2565        } else {
2566                /* Socket is locked, keep trying until memory is available. */
2567                for (;;) {
2568                        skb = alloc_skb_fclone(MAX_TCP_HEADER,
2569                                               sk->sk_allocation);
2570                        if (skb)
2571                                break;
2572                        yield();
2573                }
2574
2575                /* Reserve space for headers and prepare control bits. */
2576                skb_reserve(skb, MAX_TCP_HEADER);
2577                /* FIN eats a sequence byte, write_seq advanced by tcp_queue_skb(). */
2578                tcp_init_nondata_skb(skb, tp->write_seq,
2579                                     TCPHDR_ACK | TCPHDR_FIN);
2580                tcp_queue_skb(sk, skb);
2581        }
2582        __tcp_push_pending_frames(sk, mss_now, TCP_NAGLE_OFF);
2583}
2584
2585/* We get here when a process closes a file descriptor (either due to
2586 * an explicit close() or as a byproduct of exit()'ing) and there
2587 * was unread data in the receive queue.  This behavior is recommended
2588 * by RFC 2525, section 2.17.  -DaveM
2589 */
2590void tcp_send_active_reset(struct sock *sk, gfp_t priority)
2591{
2592        struct sk_buff *skb;
2593
2594        /* NOTE: No TCP options attached and we never retransmit this. */
2595        skb = alloc_skb(MAX_TCP_HEADER, priority);
2596        if (!skb) {
2597                NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPABORTFAILED);
2598                return;
2599        }
2600
2601        /* Reserve space for headers and prepare control bits. */
2602        skb_reserve(skb, MAX_TCP_HEADER);
2603        tcp_init_nondata_skb(skb, tcp_acceptable_seq(sk),
2604                             TCPHDR_ACK | TCPHDR_RST);
2605        /* Send it off. */
2606        TCP_SKB_CB(skb)->when = tcp_time_stamp;
2607        if (tcp_transmit_skb(sk, skb, 0, priority))
2608                NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPABORTFAILED);
2609
2610        TCP_INC_STATS(sock_net(sk), TCP_MIB_OUTRSTS);
2611}
2612
2613/* Send a crossed SYN-ACK during socket establishment.
2614 * WARNING: This routine must only be called when we have already sent
2615 * a SYN packet that crossed the incoming SYN that caused this routine
2616 * to get called. If this assumption fails then the initial rcv_wnd
2617 * and rcv_wscale values will not be correct.
2618 */
2619int tcp_send_synack(struct sock *sk)
2620{
2621        struct sk_buff *skb;
2622
2623        skb = tcp_write_queue_head(sk);
2624        if (skb == NULL || !(TCP_SKB_CB(skb)->tcp_flags & TCPHDR_SYN)) {
2625                pr_debug("%s: wrong queue state\n", __func__);
2626                return -EFAULT;
2627        }
2628        if (!(TCP_SKB_CB(skb)->tcp_flags & TCPHDR_ACK)) {
2629                if (skb_cloned(skb)) {
2630                        struct sk_buff *nskb = skb_copy(skb, GFP_ATOMIC);
2631                        if (nskb == NULL)
2632                                return -ENOMEM;
2633                        tcp_unlink_write_queue(skb, sk);
2634                        skb_header_release(nskb);
2635                        __tcp_add_write_queue_head(sk, nskb);
2636                        sk_wmem_free_skb(sk, skb);
2637                        sk->sk_wmem_queued += nskb->truesize;
2638                        sk_mem_charge(sk, nskb->truesize);
2639                        skb = nskb;
2640                }
2641
2642                TCP_SKB_CB(skb)->tcp_flags |= TCPHDR_ACK;
2643                TCP_ECN_send_synack(tcp_sk(sk), skb);
2644        }
2645        TCP_SKB_CB(skb)->when = tcp_time_stamp;
2646        return tcp_transmit_skb(sk, skb, 1, GFP_ATOMIC);
2647}
2648
2649/**
2650 * tcp_make_synack - Prepare a SYN-ACK.
2651 * sk: listener socket
2652 * dst: dst entry attached to the SYNACK
2653 * req: request_sock pointer
2654 * rvp: request_values pointer
2655 *
2656 * Allocate one skb and build a SYNACK packet.
2657 * @dst is consumed : Caller should not use it again.
2658 */
2659struct sk_buff *tcp_make_synack(struct sock *sk, struct dst_entry *dst,
2660                                struct request_sock *req,
2661                                struct request_values *rvp)
2662{
2663        struct tcp_out_options opts;
2664        struct tcp_extend_values *xvp = tcp_xv(rvp);
2665        struct inet_request_sock *ireq = inet_rsk(req);
2666        struct tcp_sock *tp = tcp_sk(sk);
2667        const struct tcp_cookie_values *cvp = tp->cookie_values;
2668        struct tcphdr *th;
2669        struct sk_buff *skb;
2670        struct tcp_md5sig_key *md5;
2671        int tcp_header_size;
2672        int mss;
2673        int s_data_desired = 0;
2674
2675        if (cvp != NULL && cvp->s_data_constant && cvp->s_data_desired)
2676                s_data_desired = cvp->s_data_desired;
2677        skb = alloc_skb(MAX_TCP_HEADER + 15 + s_data_desired,
2678                        sk_gfp_atomic(sk, GFP_ATOMIC));
2679        if (unlikely(!skb)) {
2680                dst_release(dst);
2681                return NULL;
2682        }
2683        /* Reserve space for headers. */
2684        skb_reserve(skb, MAX_TCP_HEADER);
2685
2686        skb_dst_set(skb, dst);
2687
2688        mss = dst_metric_advmss(dst);
2689        if (tp->rx_opt.user_mss && tp->rx_opt.user_mss < mss)
2690                mss = tp->rx_opt.user_mss;
2691
2692        if (req->rcv_wnd == 0) { /* ignored for retransmitted syns */
2693                __u8 rcv_wscale;
2694                /* Set this up on the first call only */
2695                req->window_clamp = tp->window_clamp ? : dst_metric(dst, RTAX_WINDOW);
2696
2697                /* limit the window selection if the user enforce a smaller rx buffer */
2698                if (sk->sk_userlocks & SOCK_RCVBUF_LOCK &&
2699                    (req->window_clamp > tcp_full_space(sk) || req->window_clamp == 0))
2700                        req->window_clamp = tcp_full_space(sk);
2701
2702                /* tcp_full_space because it is guaranteed to be the first packet */
2703                tcp_select_initial_window(tcp_full_space(sk),
2704                        mss - (ireq->tstamp_ok ? TCPOLEN_TSTAMP_ALIGNED : 0),
2705                        &req->rcv_wnd,
2706                        &req->window_clamp,
2707                        ireq->wscale_ok,
2708                        &rcv_wscale,
2709                        dst_metric(dst, RTAX_INITRWND));
2710                ireq->rcv_wscale = rcv_wscale;
2711        }
2712
2713        memset(&opts, 0, sizeof(opts));
2714#ifdef CONFIG_SYN_COOKIES
2715        if (unlikely(req->cookie_ts))
2716                TCP_SKB_CB(skb)->when = cookie_init_timestamp(req);
2717        else
2718#endif
2719        TCP_SKB_CB(skb)->when = tcp_time_stamp;
2720        tcp_header_size = tcp_synack_options(sk, req, mss,
2721                                             skb, &opts, &md5, xvp)
2722                        + sizeof(*th);
2723
2724        skb_push(skb, tcp_header_size);
2725        skb_reset_transport_header(skb);
2726
2727        th = tcp_hdr(skb);
2728        memset(th, 0, sizeof(struct tcphdr));
2729        th->syn = 1;
2730        th->ack = 1;
2731        TCP_ECN_make_synack(req, th);
2732        th->source = ireq->loc_port;
2733        th->dest = ireq->rmt_port;
2734        /* Setting of flags are superfluous here for callers (and ECE is
2735         * not even correctly set)
2736         */
2737        tcp_init_nondata_skb(skb, tcp_rsk(req)->snt_isn,
2738                             TCPHDR_SYN | TCPHDR_ACK);
2739
2740        if (OPTION_COOKIE_EXTENSION & opts.options) {
2741                if (s_data_desired) {
2742                        u8 *buf = skb_put(skb, s_data_desired);
2743
2744                        /* copy data directly from the listening socket. */
2745                        memcpy(buf, cvp->s_data_payload, s_data_desired);
2746                        TCP_SKB_CB(skb)->end_seq += s_data_desired;
2747                }
2748
2749                if (opts.hash_size > 0) {
2750                        __u32 workspace[SHA_WORKSPACE_WORDS];
2751                        u32 *mess = &xvp->cookie_bakery[COOKIE_DIGEST_WORDS];
2752                        u32 *tail = &mess[COOKIE_MESSAGE_WORDS-1];
2753
2754                        /* Secret recipe depends on the Timestamp, (future)
2755                         * Sequence and Acknowledgment Numbers, Initiator
2756                         * Cookie, and others handled by IP variant caller.
2757                         */
2758                        *tail-- ^= opts.tsval;
2759                        *tail-- ^= tcp_rsk(req)->rcv_isn + 1;
2760                        *tail-- ^= TCP_SKB_CB(skb)->seq + 1;
2761
2762                        /* recommended */
2763                        *tail-- ^= (((__force u32)th->dest << 16) | (__force u32)th->source);
2764                        *tail-- ^= (u32)(unsigned long)cvp; /* per sockopt */
2765
2766                        sha_transform((__u32 *)&xvp->cookie_bakery[0],
2767                                      (char *)mess,
2768                                      &workspace[0]);
2769                        opts.hash_location =
2770                                (__u8 *)&xvp->cookie_bakery[0];
2771                }
2772        }
2773
2774        th->seq = htonl(TCP_SKB_CB(skb)->seq);
2775        th->ack_seq = htonl(tcp_rsk(req)->rcv_isn + 1);
2776
2777        /* RFC1323: The window in SYN & SYN/ACK segments is never scaled. */
2778        th->window = htons(min(req->rcv_wnd, 65535U));
2779        tcp_options_write((__be32 *)(th + 1), tp, &opts);
2780        th->doff = (tcp_header_size >> 2);
2781        TCP_ADD_STATS(sock_net(sk), TCP_MIB_OUTSEGS, tcp_skb_pcount(skb));
2782
2783#ifdef CONFIG_TCP_MD5SIG
2784        /* Okay, we have all we need - do the md5 hash if needed */
2785        if (md5) {
2786                tcp_rsk(req)->af_specific->calc_md5_hash(opts.hash_location,
2787                                               md5, NULL, req, skb);
2788        }
2789#endif
2790
2791        return skb;
2792}
2793EXPORT_SYMBOL(tcp_make_synack);
2794
2795/* Do all connect socket setups that can be done AF independent. */
2796void tcp_connect_init(struct sock *sk)
2797{
2798        const struct dst_entry *dst = __sk_dst_get(sk);
2799        struct tcp_sock *tp = tcp_sk(sk);
2800        __u8 rcv_wscale;
2801
2802        /* We'll fix this up when we get a response from the other end.
2803         * See tcp_input.c:tcp_rcv_state_process case TCP_SYN_SENT.
2804         */
2805        tp->tcp_header_len = sizeof(struct tcphdr) +
2806                (sysctl_tcp_timestamps ? TCPOLEN_TSTAMP_ALIGNED : 0);
2807
2808#ifdef CONFIG_TCP_MD5SIG
2809        if (tp->af_specific->md5_lookup(sk, sk) != NULL)
2810                tp->tcp_header_len += TCPOLEN_MD5SIG_ALIGNED;
2811#endif
2812
2813        /* If user gave his TCP_MAXSEG, record it to clamp */
2814        if (tp->rx_opt.user_mss)
2815                tp->rx_opt.mss_clamp = tp->rx_opt.user_mss;
2816        tp->max_window = 0;
2817        tcp_mtup_init(sk);
2818        tcp_sync_mss(sk, dst_mtu(dst));
2819
2820        if (!tp->window_clamp)
2821                tp->window_clamp = dst_metric(dst, RTAX_WINDOW);
2822        tp->advmss = dst_metric_advmss(dst);
2823        if (tp->rx_opt.user_mss && tp->rx_opt.user_mss < tp->advmss)
2824                tp->advmss = tp->rx_opt.user_mss;
2825
2826        tcp_initialize_rcv_mss(sk);
2827
2828        /* limit the window selection if the user enforce a smaller rx buffer */
2829        if (sk->sk_userlocks & SOCK_RCVBUF_LOCK &&
2830            (tp->window_clamp > tcp_full_space(sk) || tp->window_clamp == 0))
2831                tp->window_clamp = tcp_full_space(sk);
2832
2833        tcp_select_initial_window(tcp_full_space(sk),
2834                                  tp->advmss - (tp->rx_opt.ts_recent_stamp ? tp->tcp_header_len - sizeof(struct tcphdr) : 0),
2835                                  &tp->rcv_wnd,
2836                                  &tp->window_clamp,
2837                                  sysctl_tcp_window_scaling,
2838                                  &rcv_wscale,
2839                                  dst_metric(dst, RTAX_INITRWND));
2840
2841        tp->rx_opt.rcv_wscale = rcv_wscale;
2842        tp->rcv_ssthresh = tp->rcv_wnd;
2843
2844        sk->sk_err = 0;
2845        sock_reset_flag(sk, SOCK_DONE);
2846        tp->snd_wnd = 0;
2847        tcp_init_wl(tp, 0);
2848        tp->snd_una = tp->write_seq;
2849        tp->snd_sml = tp->write_seq;
2850        tp->snd_up = tp->write_seq;
2851        tp->snd_nxt = tp->write_seq;
2852
2853        if (likely(!tp->repair))
2854                tp->rcv_nxt = 0;
2855        tp->rcv_wup = tp->rcv_nxt;
2856        tp->copied_seq = tp->rcv_nxt;
2857
2858        inet_csk(sk)->icsk_rto = TCP_TIMEOUT_INIT;
2859        inet_csk(sk)->icsk_retransmits = 0;
2860        tcp_clear_retrans(tp);
2861}
2862
2863static void tcp_connect_queue_skb(struct sock *sk, struct sk_buff *skb)
2864{
2865        struct tcp_sock *tp = tcp_sk(sk);
2866        struct tcp_skb_cb *tcb = TCP_SKB_CB(skb);
2867
2868        tcb->end_seq += skb->len;
2869        skb_header_release(skb);
2870        __tcp_add_write_queue_tail(sk, skb);
2871        sk->sk_wmem_queued += skb->truesize;
2872        sk_mem_charge(sk, skb->truesize);
2873        tp->write_seq = tcb->end_seq;
2874        tp->packets_out += tcp_skb_pcount(skb);
2875}
2876
2877/* Build and send a SYN with data and (cached) Fast Open cookie. However,
2878 * queue a data-only packet after the regular SYN, such that regular SYNs
2879 * are retransmitted on timeouts. Also if the remote SYN-ACK acknowledges
2880 * only the SYN sequence, the data are retransmitted in the first ACK.
2881 * If cookie is not cached or other error occurs, falls back to send a
2882 * regular SYN with Fast Open cookie request option.
2883 */
2884static int tcp_send_syn_data(struct sock *sk, struct sk_buff *syn)
2885{
2886        struct tcp_sock *tp = tcp_sk(sk);
2887        struct tcp_fastopen_request *fo = tp->fastopen_req;
2888        int syn_loss = 0, space, i, err = 0, iovlen = fo->data->msg_iovlen;
2889        struct sk_buff *syn_data = NULL, *data;
2890        unsigned long last_syn_loss = 0;
2891
2892        tp->rx_opt.mss_clamp = tp->advmss;  /* If MSS is not cached */
2893        tcp_fastopen_cache_get(sk, &tp->rx_opt.mss_clamp, &fo->cookie,
2894                               &syn_loss, &last_syn_loss);
2895        /* Recurring FO SYN losses: revert to regular handshake temporarily */
2896        if (syn_loss > 1 &&
2897            time_before(jiffies, last_syn_loss + (60*HZ << syn_loss))) {
2898                fo->cookie.len = -1;
2899                goto fallback;
2900        }
2901
2902        if (sysctl_tcp_fastopen & TFO_CLIENT_NO_COOKIE)
2903                fo->cookie.len = -1;
2904        else if (fo->cookie.len <= 0)
2905                goto fallback;
2906
2907        /* MSS for SYN-data is based on cached MSS and bounded by PMTU and
2908         * user-MSS. Reserve maximum option space for middleboxes that add
2909         * private TCP options. The cost is reduced data space in SYN :(
2910         */
2911        if (tp->rx_opt.user_mss && tp->rx_opt.user_mss < tp->rx_opt.mss_clamp)
2912                tp->rx_opt.mss_clamp = tp->rx_opt.user_mss;
2913        space = tcp_mtu_to_mss(sk, inet_csk(sk)->icsk_pmtu_cookie) -
2914                MAX_TCP_OPTION_SPACE;
2915
2916        syn_data = skb_copy_expand(syn, skb_headroom(syn), space,
2917                                   sk->sk_allocation);
2918        if (syn_data == NULL)
2919                goto fallback;
2920
2921        for (i = 0; i < iovlen && syn_data->len < space; ++i) {
2922                struct iovec *iov = &fo->data->msg_iov[i];
2923                unsigned char __user *from = iov->iov_base;
2924                int len = iov->iov_len;
2925
2926                if (syn_data->len + len > space)
2927                        len = space - syn_data->len;
2928                else if (i + 1 == iovlen)
2929                        /* No more data pending in inet_wait_for_connect() */
2930                        fo->data = NULL;
2931
2932                if (skb_add_data(syn_data, from, len))
2933                        goto fallback;
2934        }
2935
2936        /* Queue a data-only packet after the regular SYN for retransmission */
2937        data = pskb_copy(syn_data, sk->sk_allocation);
2938        if (data == NULL)
2939                goto fallback;
2940        TCP_SKB_CB(data)->seq++;
2941        TCP_SKB_CB(data)->tcp_flags &= ~TCPHDR_SYN;
2942        TCP_SKB_CB(data)->tcp_flags = (TCPHDR_ACK|TCPHDR_PSH);
2943        tcp_connect_queue_skb(sk, data);
2944        fo->copied = data->len;
2945
2946        if (tcp_transmit_skb(sk, syn_data, 0, sk->sk_allocation) == 0) {
2947                tp->syn_data = (fo->copied > 0);
2948                NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPFASTOPENACTIVE);
2949                goto done;
2950        }
2951        syn_data = NULL;
2952
2953fallback:
2954        /* Send a regular SYN with Fast Open cookie request option */
2955        if (fo->cookie.len > 0)
2956                fo->cookie.len = 0;
2957        err = tcp_transmit_skb(sk, syn, 1, sk->sk_allocation);
2958        if (err)
2959                tp->syn_fastopen = 0;
2960        kfree_skb(syn_data);
2961done:
2962        fo->cookie.len = -1;  /* Exclude Fast Open option for SYN retries */
2963        return err;
2964}
2965
2966/* Build a SYN and send it off. */
2967int tcp_connect(struct sock *sk)
2968{
2969        struct tcp_sock *tp = tcp_sk(sk);
2970        struct sk_buff *buff;
2971        int err;
2972
2973        tcp_connect_init(sk);
2974
2975        buff = alloc_skb_fclone(MAX_TCP_HEADER + 15, sk->sk_allocation);
2976        if (unlikely(buff == NULL))
2977                return -ENOBUFS;
2978
2979        /* Reserve space for headers. */
2980        skb_reserve(buff, MAX_TCP_HEADER);
2981
2982        tcp_init_nondata_skb(buff, tp->write_seq++, TCPHDR_SYN);
2983        tp->retrans_stamp = TCP_SKB_CB(buff)->when = tcp_time_stamp;
2984        tcp_connect_queue_skb(sk, buff);
2985        TCP_ECN_send_syn(sk, buff);
2986
2987        /* Send off SYN; include data in Fast Open. */
2988        err = tp->fastopen_req ? tcp_send_syn_data(sk, buff) :
2989              tcp_transmit_skb(sk, buff, 1, sk->sk_allocation);
2990        if (err == -ECONNREFUSED)
2991                return err;
2992
2993        /* We change tp->snd_nxt after the tcp_transmit_skb() call
2994         * in order to make this packet get counted in tcpOutSegs.
2995         */
2996        tp->snd_nxt = tp->write_seq;
2997        tp->pushed_seq = tp->write_seq;
2998        TCP_INC_STATS(sock_net(sk), TCP_MIB_ACTIVEOPENS);
2999
3000        /* Timer for repeating the SYN until an answer. */
3001        inet_csk_reset_xmit_timer(sk, ICSK_TIME_RETRANS,
3002                                  inet_csk(sk)->icsk_rto, TCP_RTO_MAX);
3003        return 0;
3004}
3005EXPORT_SYMBOL(tcp_connect);
3006
3007/* Send out a delayed ack, the caller does the policy checking
3008 * to see if we should even be here.  See tcp_input.c:tcp_ack_snd_check()
3009 * for details.
3010 */
3011void tcp_send_delayed_ack(struct sock *sk)
3012{
3013        struct inet_connection_sock *icsk = inet_csk(sk);
3014        int ato = icsk->icsk_ack.ato;
3015        unsigned long timeout;
3016
3017        if (ato > TCP_DELACK_MIN) {
3018                const struct tcp_sock *tp = tcp_sk(sk);
3019                int max_ato = HZ / 2;
3020
3021                if (icsk->icsk_ack.pingpong ||
3022                    (icsk->icsk_ack.pending & ICSK_ACK_PUSHED))
3023                        max_ato = TCP_DELACK_MAX;
3024
3025                /* Slow path, intersegment interval is "high". */
3026
3027                /* If some rtt estimate is known, use it to bound delayed ack.
3028                 * Do not use inet_csk(sk)->icsk_rto here, use results of rtt measurements
3029                 * directly.
3030                 */
3031                if (tp->srtt) {
3032                        int rtt = max(tp->srtt >> 3, TCP_DELACK_MIN);
3033
3034                        if (rtt < max_ato)
3035                                max_ato = rtt;
3036                }
3037
3038                ato = min(ato, max_ato);
3039        }
3040
3041        /* Stay within the limit we were given */
3042        timeout = jiffies + ato;
3043
3044        /* Use new timeout only if there wasn't a older one earlier. */
3045        if (icsk->icsk_ack.pending & ICSK_ACK_TIMER) {
3046                /* If delack timer was blocked or is about to expire,
3047                 * send ACK now.
3048                 */
3049                if (icsk->icsk_ack.blocked ||
3050                    time_before_eq(icsk->icsk_ack.timeout, jiffies + (ato >> 2))) {
3051                        tcp_send_ack(sk);
3052                        return;
3053                }
3054
3055                if (!time_before(timeout, icsk->icsk_ack.timeout))
3056                        timeout = icsk->icsk_ack.timeout;
3057        }
3058        icsk->icsk_ack.pending |= ICSK_ACK_SCHED | ICSK_ACK_TIMER;
3059        icsk->icsk_ack.timeout = timeout;
3060        sk_reset_timer(sk, &icsk->icsk_delack_timer, timeout);
3061}
3062
3063/* This routine sends an ack and also updates the window. */
3064void tcp_send_ack(struct sock *sk)
3065{
3066        struct sk_buff *buff;
3067
3068        /* If we have been reset, we may not send again. */
3069        if (sk->sk_state == TCP_CLOSE)
3070                return;
3071
3072        /* We are not putting this on the write queue, so
3073         * tcp_transmit_skb() will set the ownership to this
3074         * sock.
3075         */
3076        buff = alloc_skb(MAX_TCP_HEADER, sk_gfp_atomic(sk, GFP_ATOMIC));
3077        if (buff == NULL) {
3078                inet_csk_schedule_ack(sk);
3079                inet_csk(sk)->icsk_ack.ato = TCP_ATO_MIN;
3080                inet_csk_reset_xmit_timer(sk, ICSK_TIME_DACK,
3081                                          TCP_DELACK_MAX, TCP_RTO_MAX);
3082                return;
3083        }
3084
3085        /* Reserve space for headers and prepare control bits. */
3086        skb_reserve(buff, MAX_TCP_HEADER);
3087        tcp_init_nondata_skb(buff, tcp_acceptable_seq(sk), TCPHDR_ACK);
3088
3089        /* Send it off, this clears delayed acks for us. */
3090        TCP_SKB_CB(buff)->when = tcp_time_stamp;
3091        tcp_transmit_skb(sk, buff, 0, sk_gfp_atomic(sk, GFP_ATOMIC));
3092}
3093
3094/* This routine sends a packet with an out of date sequence
3095 * number. It assumes the other end will try to ack it.
3096 *
3097 * Question: what should we make while urgent mode?
3098 * 4.4BSD forces sending single byte of data. We cannot send
3099 * out of window data, because we have SND.NXT==SND.MAX...
3100 *
3101 * Current solution: to send TWO zero-length segments in urgent mode:
3102 * one is with SEG.SEQ=SND.UNA to deliver urgent pointer, another is
3103 * out-of-date with SND.UNA-1 to probe window.
3104 */
3105static int tcp_xmit_probe_skb(struct sock *sk, int urgent)
3106{
3107        struct tcp_sock *tp = tcp_sk(sk);
3108        struct sk_buff *skb;
3109
3110        /* We don't queue it, tcp_transmit_skb() sets ownership. */
3111        skb = alloc_skb(MAX_TCP_HEADER, sk_gfp_atomic(sk, GFP_ATOMIC));
3112        if (skb == NULL)
3113                return -1;
3114
3115        /* Reserve space for headers and set control bits. */
3116        skb_reserve(skb, MAX_TCP_HEADER);
3117        /* Use a previous sequence.  This should cause the other
3118         * end to send an ack.  Don't queue or clone SKB, just
3119         * send it.
3120         */
3121        tcp_init_nondata_skb(skb, tp->snd_una - !urgent, TCPHDR_ACK);
3122        TCP_SKB_CB(skb)->when = tcp_time_stamp;
3123        return tcp_transmit_skb(sk, skb, 0, GFP_ATOMIC);
3124}
3125
3126void tcp_send_window_probe(struct sock *sk)
3127{
3128        if (sk->sk_state == TCP_ESTABLISHED) {
3129                tcp_sk(sk)->snd_wl1 = tcp_sk(sk)->rcv_nxt - 1;
3130                tcp_sk(sk)->snd_nxt = tcp_sk(sk)->write_seq;
3131                tcp_xmit_probe_skb(sk, 0);
3132        }
3133}
3134
3135/* Initiate keepalive or window probe from timer. */
3136int tcp_write_wakeup(struct sock *sk)
3137{
3138        struct tcp_sock *tp = tcp_sk(sk);
3139        struct sk_buff *skb;
3140
3141        if (sk->sk_state == TCP_CLOSE)
3142                return -1;
3143
3144        if ((skb = tcp_send_head(sk)) != NULL &&
3145            before(TCP_SKB_CB(skb)->seq, tcp_wnd_end(tp))) {
3146                int err;
3147                unsigned int mss = tcp_current_mss(sk);
3148                unsigned int seg_size = tcp_wnd_end(tp) - TCP_SKB_CB(skb)->seq;
3149
3150                if (before(tp->pushed_seq, TCP_SKB_CB(skb)->end_seq))
3151                        tp->pushed_seq = TCP_SKB_CB(skb)->end_seq;
3152
3153                /* We are probing the opening of a window
3154                 * but the window size is != 0
3155                 * must have been a result SWS avoidance ( sender )
3156                 */
3157                if (seg_size < TCP_SKB_CB(skb)->end_seq - TCP_SKB_CB(skb)->seq ||
3158                    skb->len > mss) {
3159                        seg_size = min(seg_size, mss);
3160                        TCP_SKB_CB(skb)->tcp_flags |= TCPHDR_PSH;
3161                        if (tcp_fragment(sk, skb, seg_size, mss))
3162                                return -1;
3163                } else if (!tcp_skb_pcount(skb))
3164                        tcp_set_skb_tso_segs(sk, skb, mss);
3165
3166                TCP_SKB_CB(skb)->tcp_flags |= TCPHDR_PSH;
3167                TCP_SKB_CB(skb)->when = tcp_time_stamp;
3168                err = tcp_transmit_skb(sk, skb, 1, GFP_ATOMIC);
3169                if (!err)
3170                        tcp_event_new_data_sent(sk, skb);
3171                return err;
3172        } else {
3173                if (between(tp->snd_up, tp->snd_una + 1, tp->snd_una + 0xFFFF))
3174                        tcp_xmit_probe_skb(sk, 1);
3175                return tcp_xmit_probe_skb(sk, 0);
3176        }
3177}
3178
3179/* A window probe timeout has occurred.  If window is not closed send
3180 * a partial packet else a zero probe.
3181 */
3182void tcp_send_probe0(struct sock *sk)
3183{
3184        struct inet_connection_sock *icsk = inet_csk(sk);
3185        struct tcp_sock *tp = tcp_sk(sk);
3186        int err;
3187
3188        err = tcp_write_wakeup(sk);
3189
3190        if (tp->packets_out || !tcp_send_head(sk)) {
3191                /* Cancel probe timer, if it is not required. */
3192                icsk->icsk_probes_out = 0;
3193                icsk->icsk_backoff = 0;
3194                return;
3195        }
3196
3197        if (err <= 0) {
3198                if (icsk->icsk_backoff < sysctl_tcp_retries2)
3199                        icsk->icsk_backoff++;
3200                icsk->icsk_probes_out++;
3201                inet_csk_reset_xmit_timer(sk, ICSK_TIME_PROBE0,
3202                                          min(icsk->icsk_rto << icsk->icsk_backoff, TCP_RTO_MAX),
3203                                          TCP_RTO_MAX);
3204        } else {
3205                /* If packet was not sent due to local congestion,
3206                 * do not backoff and do not remember icsk_probes_out.
3207                 * Let local senders to fight for local resources.
3208                 *
3209                 * Use accumulated backoff yet.
3210                 */
3211                if (!icsk->icsk_probes_out)
3212                        icsk->icsk_probes_out = 1;
3213                inet_csk_reset_xmit_timer(sk, ICSK_TIME_PROBE0,
3214                                          min(icsk->icsk_rto << icsk->icsk_backoff,
3215                                              TCP_RESOURCE_PROBE_INTERVAL),
3216                                          TCP_RTO_MAX);
3217        }
3218}
3219
lxr.linux.no kindly hosted by Redpill Linpro AS, provider of Linux consulting and operations services since 1995.