Linux Audio

Check our new training course

Loading...
v3.15
   1/*
   2 * INET		An implementation of the TCP/IP protocol suite for the LINUX
   3 *		operating system.  INET is implemented using the  BSD Socket
   4 *		interface as the means of communication with the user level.
   5 *
   6 *		Implementation of the Transmission Control Protocol(TCP).
   7 *
   8 * Authors:	Ross Biro
   9 *		Fred N. van Kempen, <waltje@uWalt.NL.Mugnet.ORG>
  10 *		Mark Evans, <evansmp@uhura.aston.ac.uk>
  11 *		Corey Minyard <wf-rch!minyard@relay.EU.net>
  12 *		Florian La Roche, <flla@stud.uni-sb.de>
  13 *		Charles Hedrick, <hedrick@klinzhai.rutgers.edu>
  14 *		Linus Torvalds, <torvalds@cs.helsinki.fi>
  15 *		Alan Cox, <gw4pts@gw4pts.ampr.org>
  16 *		Matthew Dillon, <dillon@apollo.west.oic.com>
  17 *		Arnt Gulbrandsen, <agulbra@nvg.unit.no>
  18 *		Jorge Cwik, <jorge@laser.satlink.net>
  19 */
  20
  21/*
  22 * Changes:	Pedro Roque	:	Retransmit queue handled by TCP.
  23 *				:	Fragmentation on mtu decrease
  24 *				:	Segment collapse on retransmit
  25 *				:	AF independence
  26 *
  27 *		Linus Torvalds	:	send_delayed_ack
  28 *		David S. Miller	:	Charge memory using the right skb
  29 *					during syn/ack processing.
  30 *		David S. Miller :	Output engine completely rewritten.
  31 *		Andrea Arcangeli:	SYNACK carry ts_recent in tsecr.
  32 *		Cacophonix Gaul :	draft-minshall-nagle-01
  33 *		J Hadi Salim	:	ECN support
  34 *
  35 */
  36
  37#define pr_fmt(fmt) "TCP: " fmt
  38
  39#include <net/tcp.h>
  40
  41#include <linux/compiler.h>
  42#include <linux/gfp.h>
  43#include <linux/module.h>
 
  44
  45/* People can turn this off for buggy TCP's found in printers etc. */
  46int sysctl_tcp_retrans_collapse __read_mostly = 1;
  47
  48/* People can turn this on to work with those rare, broken TCPs that
  49 * interpret the window field as a signed quantity.
  50 */
  51int sysctl_tcp_workaround_signed_windows __read_mostly = 0;
  52
  53/* Default TSQ limit of two TSO segments */
  54int sysctl_tcp_limit_output_bytes __read_mostly = 131072;
  55
  56/* This limits the percentage of the congestion window which we
  57 * will allow a single TSO frame to consume.  Building TSO frames
  58 * which are too large can cause TCP streams to be bursty.
  59 */
  60int sysctl_tcp_tso_win_divisor __read_mostly = 3;
  61
  62int sysctl_tcp_mtu_probing __read_mostly = 0;
  63int sysctl_tcp_base_mss __read_mostly = TCP_BASE_MSS;
  64
  65/* By default, RFC2861 behavior.  */
  66int sysctl_tcp_slow_start_after_idle __read_mostly = 1;
  67
  68unsigned int sysctl_tcp_notsent_lowat __read_mostly = UINT_MAX;
  69EXPORT_SYMBOL(sysctl_tcp_notsent_lowat);
  70
  71static bool tcp_write_xmit(struct sock *sk, unsigned int mss_now, int nonagle,
  72			   int push_one, gfp_t gfp);
  73
  74/* Account for new data that has been sent to the network. */
  75static void tcp_event_new_data_sent(struct sock *sk, const struct sk_buff *skb)
  76{
  77	struct inet_connection_sock *icsk = inet_csk(sk);
  78	struct tcp_sock *tp = tcp_sk(sk);
  79	unsigned int prior_packets = tp->packets_out;
  80
  81	tcp_advance_send_head(sk, skb);
  82	tp->snd_nxt = TCP_SKB_CB(skb)->end_seq;
  83
 
 
 
  84	tp->packets_out += tcp_skb_pcount(skb);
  85	if (!prior_packets || icsk->icsk_pending == ICSK_TIME_EARLY_RETRANS ||
  86	    icsk->icsk_pending == ICSK_TIME_LOSS_PROBE) {
  87		tcp_rearm_rto(sk);
  88	}
  89
  90	NET_ADD_STATS(sock_net(sk), LINUX_MIB_TCPORIGDATASENT,
  91		      tcp_skb_pcount(skb));
  92}
  93
  94/* SND.NXT, if window was not shrunk.
 
  95 * If window has been shrunk, what should we make? It is not clear at all.
  96 * Using SND.UNA we will fail to open window, SND.NXT is out of window. :-(
  97 * Anything in between SND.UNA...SND.UNA+SND.WND also can be already
  98 * invalid. OK, let's make this for now:
  99 */
 100static inline __u32 tcp_acceptable_seq(const struct sock *sk)
 101{
 102	const struct tcp_sock *tp = tcp_sk(sk);
 103
 104	if (!before(tcp_wnd_end(tp), tp->snd_nxt))
 
 
 105		return tp->snd_nxt;
 106	else
 107		return tcp_wnd_end(tp);
 108}
 109
 110/* Calculate mss to advertise in SYN segment.
 111 * RFC1122, RFC1063, draft-ietf-tcpimpl-pmtud-01 state that:
 112 *
 113 * 1. It is independent of path mtu.
 114 * 2. Ideally, it is maximal possible segment size i.e. 65535-40.
 115 * 3. For IPv4 it is reasonable to calculate it from maximal MTU of
 116 *    attached devices, because some buggy hosts are confused by
 117 *    large MSS.
 118 * 4. We do not make 3, we advertise MSS, calculated from first
 119 *    hop device mtu, but allow to raise it to ip_rt_min_advmss.
 120 *    This may be overridden via information stored in routing table.
 121 * 5. Value 65535 for MSS is valid in IPv6 and means "as large as possible,
 122 *    probably even Jumbo".
 123 */
 124static __u16 tcp_advertise_mss(struct sock *sk)
 125{
 126	struct tcp_sock *tp = tcp_sk(sk);
 127	const struct dst_entry *dst = __sk_dst_get(sk);
 128	int mss = tp->advmss;
 129
 130	if (dst) {
 131		unsigned int metric = dst_metric_advmss(dst);
 132
 133		if (metric < mss) {
 134			mss = metric;
 135			tp->advmss = mss;
 136		}
 137	}
 138
 139	return (__u16)mss;
 140}
 141
 142/* RFC2861. Reset CWND after idle period longer RTO to "restart window".
 143 * This is the first part of cwnd validation mechanism. */
 144static void tcp_cwnd_restart(struct sock *sk, const struct dst_entry *dst)
 
 145{
 146	struct tcp_sock *tp = tcp_sk(sk);
 147	s32 delta = tcp_time_stamp - tp->lsndtime;
 148	u32 restart_cwnd = tcp_init_cwnd(tp, dst);
 149	u32 cwnd = tp->snd_cwnd;
 150
 151	tcp_ca_event(sk, CA_EVENT_CWND_RESTART);
 152
 153	tp->snd_ssthresh = tcp_current_ssthresh(sk);
 154	restart_cwnd = min(restart_cwnd, cwnd);
 155
 156	while ((delta -= inet_csk(sk)->icsk_rto) > 0 && cwnd > restart_cwnd)
 157		cwnd >>= 1;
 158	tp->snd_cwnd = max(cwnd, restart_cwnd);
 159	tp->snd_cwnd_stamp = tcp_time_stamp;
 160	tp->snd_cwnd_used = 0;
 161}
 162
 163/* Congestion state accounting after a packet has been sent. */
 164static void tcp_event_data_sent(struct tcp_sock *tp,
 165				struct sock *sk)
 166{
 167	struct inet_connection_sock *icsk = inet_csk(sk);
 168	const u32 now = tcp_time_stamp;
 169	const struct dst_entry *dst = __sk_dst_get(sk);
 170
 171	if (sysctl_tcp_slow_start_after_idle &&
 172	    (!tp->packets_out && (s32)(now - tp->lsndtime) > icsk->icsk_rto))
 173		tcp_cwnd_restart(sk, __sk_dst_get(sk));
 174
 175	tp->lsndtime = now;
 176
 177	/* If it is a reply for ato after last received
 178	 * packet, enter pingpong mode.
 179	 */
 180	if ((u32)(now - icsk->icsk_ack.lrcvtime) < icsk->icsk_ack.ato &&
 181	    (!dst || !dst_metric(dst, RTAX_QUICKACK)))
 182			icsk->icsk_ack.pingpong = 1;
 183}
 184
 185/* Account for an ACK we sent. */
 186static inline void tcp_event_ack_sent(struct sock *sk, unsigned int pkts)
 187{
 188	tcp_dec_quickack_mode(sk, pkts);
 189	inet_csk_clear_xmit_timer(sk, ICSK_TIME_DACK);
 190}
 191
 192
 193u32 tcp_default_init_rwnd(u32 mss)
 194{
 195	/* Initial receive window should be twice of TCP_INIT_CWND to
 196	 * enable proper sending of new unsent data during fast recovery
 197	 * (RFC 3517, Section 4, NextSeg() rule (2)). Further place a
 198	 * limit when mss is larger than 1460.
 199	 */
 200	u32 init_rwnd = TCP_INIT_CWND * 2;
 201
 202	if (mss > 1460)
 203		init_rwnd = max((1460 * init_rwnd) / mss, 2U);
 204	return init_rwnd;
 205}
 206
 207/* Determine a window scaling and initial window to offer.
 208 * Based on the assumption that the given amount of space
 209 * will be offered. Store the results in the tp structure.
 210 * NOTE: for smooth operation initial space offering should
 211 * be a multiple of mss if possible. We assume here that mss >= 1.
 212 * This MUST be enforced by all callers.
 213 */
 214void tcp_select_initial_window(int __space, __u32 mss,
 215			       __u32 *rcv_wnd, __u32 *window_clamp,
 216			       int wscale_ok, __u8 *rcv_wscale,
 217			       __u32 init_rcv_wnd)
 218{
 219	unsigned int space = (__space < 0 ? 0 : __space);
 220
 221	/* If no clamp set the clamp to the max possible scaled window */
 222	if (*window_clamp == 0)
 223		(*window_clamp) = (65535 << 14);
 224	space = min(*window_clamp, space);
 225
 226	/* Quantize space offering to a multiple of mss if possible. */
 227	if (space > mss)
 228		space = (space / mss) * mss;
 229
 230	/* NOTE: offering an initial window larger than 32767
 231	 * will break some buggy TCP stacks. If the admin tells us
 232	 * it is likely we could be speaking with such a buggy stack
 233	 * we will truncate our initial window offering to 32K-1
 234	 * unless the remote has sent us a window scaling option,
 235	 * which we interpret as a sign the remote TCP is not
 236	 * misinterpreting the window field as a signed quantity.
 237	 */
 238	if (sysctl_tcp_workaround_signed_windows)
 239		(*rcv_wnd) = min(space, MAX_TCP_WINDOW);
 240	else
 241		(*rcv_wnd) = space;
 242
 243	(*rcv_wscale) = 0;
 244	if (wscale_ok) {
 245		/* Set window scaling on max possible window
 246		 * See RFC1323 for an explanation of the limit to 14
 247		 */
 248		space = max_t(u32, sysctl_tcp_rmem[2], sysctl_rmem_max);
 249		space = min_t(u32, space, *window_clamp);
 250		while (space > 65535 && (*rcv_wscale) < 14) {
 251			space >>= 1;
 252			(*rcv_wscale)++;
 253		}
 254	}
 255
 256	if (mss > (1 << *rcv_wscale)) {
 257		if (!init_rcv_wnd) /* Use default unless specified otherwise */
 258			init_rcv_wnd = tcp_default_init_rwnd(mss);
 259		*rcv_wnd = min(*rcv_wnd, init_rcv_wnd * mss);
 260	}
 261
 262	/* Set the clamp no higher than max representable value */
 263	(*window_clamp) = min(65535U << (*rcv_wscale), *window_clamp);
 264}
 265EXPORT_SYMBOL(tcp_select_initial_window);
 266
 267/* Chose a new window to advertise, update state in tcp_sock for the
 268 * socket, and return result with RFC1323 scaling applied.  The return
 269 * value can be stuffed directly into th->window for an outgoing
 270 * frame.
 271 */
 272static u16 tcp_select_window(struct sock *sk)
 273{
 274	struct tcp_sock *tp = tcp_sk(sk);
 275	u32 old_win = tp->rcv_wnd;
 276	u32 cur_win = tcp_receive_window(tp);
 277	u32 new_win = __tcp_select_window(sk);
 278
 279	/* Never shrink the offered window */
 280	if (new_win < cur_win) {
 281		/* Danger Will Robinson!
 282		 * Don't update rcv_wup/rcv_wnd here or else
 283		 * we will not be able to advertise a zero
 284		 * window in time.  --DaveM
 285		 *
 286		 * Relax Will Robinson.
 287		 */
 288		if (new_win == 0)
 289			NET_INC_STATS(sock_net(sk),
 290				      LINUX_MIB_TCPWANTZEROWINDOWADV);
 291		new_win = ALIGN(cur_win, 1 << tp->rx_opt.rcv_wscale);
 292	}
 293	tp->rcv_wnd = new_win;
 294	tp->rcv_wup = tp->rcv_nxt;
 295
 296	/* Make sure we do not exceed the maximum possible
 297	 * scaled window.
 298	 */
 299	if (!tp->rx_opt.rcv_wscale && sysctl_tcp_workaround_signed_windows)
 
 300		new_win = min(new_win, MAX_TCP_WINDOW);
 301	else
 302		new_win = min(new_win, (65535U << tp->rx_opt.rcv_wscale));
 303
 304	/* RFC1323 scaling applied */
 305	new_win >>= tp->rx_opt.rcv_wscale;
 306
 307	/* If we advertise zero window, disable fast path. */
 308	if (new_win == 0) {
 309		tp->pred_flags = 0;
 310		if (old_win)
 311			NET_INC_STATS(sock_net(sk),
 312				      LINUX_MIB_TCPTOZEROWINDOWADV);
 313	} else if (old_win == 0) {
 314		NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPFROMZEROWINDOWADV);
 315	}
 316
 317	return new_win;
 318}
 319
 320/* Packet ECN state for a SYN-ACK */
 321static inline void TCP_ECN_send_synack(const struct tcp_sock *tp, struct sk_buff *skb)
 322{
 
 
 323	TCP_SKB_CB(skb)->tcp_flags &= ~TCPHDR_CWR;
 324	if (!(tp->ecn_flags & TCP_ECN_OK))
 325		TCP_SKB_CB(skb)->tcp_flags &= ~TCPHDR_ECE;
 
 
 
 326}
 327
 328/* Packet ECN state for a SYN.  */
 329static inline void TCP_ECN_send_syn(struct sock *sk, struct sk_buff *skb)
 330{
 331	struct tcp_sock *tp = tcp_sk(sk);
 
 
 
 
 
 
 
 
 
 
 332
 333	tp->ecn_flags = 0;
 334	if (sock_net(sk)->ipv4.sysctl_tcp_ecn == 1) {
 
 335		TCP_SKB_CB(skb)->tcp_flags |= TCPHDR_ECE | TCPHDR_CWR;
 336		tp->ecn_flags = TCP_ECN_OK;
 
 
 337	}
 338}
 339
 340static __inline__ void
 341TCP_ECN_make_synack(const struct request_sock *req, struct tcphdr *th)
 
 
 
 
 
 
 
 
 
 342{
 343	if (inet_rsk(req)->ecn_ok)
 344		th->ece = 1;
 345}
 346
 347/* Set up ECN state for a packet on a ESTABLISHED socket that is about to
 348 * be sent.
 349 */
 350static inline void TCP_ECN_send(struct sock *sk, struct sk_buff *skb,
 351				int tcp_header_len)
 352{
 353	struct tcp_sock *tp = tcp_sk(sk);
 354
 355	if (tp->ecn_flags & TCP_ECN_OK) {
 356		/* Not-retransmitted data segment: set ECT and inject CWR. */
 357		if (skb->len != tcp_header_len &&
 358		    !before(TCP_SKB_CB(skb)->seq, tp->snd_nxt)) {
 359			INET_ECN_xmit(sk);
 360			if (tp->ecn_flags & TCP_ECN_QUEUE_CWR) {
 361				tp->ecn_flags &= ~TCP_ECN_QUEUE_CWR;
 362				tcp_hdr(skb)->cwr = 1;
 363				skb_shinfo(skb)->gso_type |= SKB_GSO_TCP_ECN;
 364			}
 365		} else {
 366			/* ACK or retransmitted segment: clear ECT|CE */
 367			INET_ECN_dontxmit(sk);
 368		}
 369		if (tp->ecn_flags & TCP_ECN_DEMAND_CWR)
 370			tcp_hdr(skb)->ece = 1;
 371	}
 372}
 373
 374/* Constructs common control bits of non-data skb. If SYN/FIN is present,
 375 * auto increment end seqno.
 376 */
 377static void tcp_init_nondata_skb(struct sk_buff *skb, u32 seq, u8 flags)
 378{
 379	struct skb_shared_info *shinfo = skb_shinfo(skb);
 380
 381	skb->ip_summed = CHECKSUM_PARTIAL;
 382	skb->csum = 0;
 383
 384	TCP_SKB_CB(skb)->tcp_flags = flags;
 385	TCP_SKB_CB(skb)->sacked = 0;
 386
 387	shinfo->gso_segs = 1;
 388	shinfo->gso_size = 0;
 389	shinfo->gso_type = 0;
 390
 391	TCP_SKB_CB(skb)->seq = seq;
 392	if (flags & (TCPHDR_SYN | TCPHDR_FIN))
 393		seq++;
 394	TCP_SKB_CB(skb)->end_seq = seq;
 395}
 396
 397static inline bool tcp_urg_mode(const struct tcp_sock *tp)
 398{
 399	return tp->snd_una != tp->snd_up;
 400}
 401
 402#define OPTION_SACK_ADVERTISE	(1 << 0)
 403#define OPTION_TS		(1 << 1)
 404#define OPTION_MD5		(1 << 2)
 405#define OPTION_WSCALE		(1 << 3)
 406#define OPTION_FAST_OPEN_COOKIE	(1 << 8)
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 407
 408struct tcp_out_options {
 409	u16 options;		/* bit field of OPTION_* */
 410	u16 mss;		/* 0 to disable */
 411	u8 ws;			/* window scale, 0 to disable */
 412	u8 num_sack_blocks;	/* number of SACK blocks to include */
 413	u8 hash_size;		/* bytes in hash_location */
 414	__u8 *hash_location;	/* temporary pointer, overloaded */
 415	__u32 tsval, tsecr;	/* need to include OPTION_TS */
 416	struct tcp_fastopen_cookie *fastopen_cookie;	/* Fast open cookie */
 417};
 418
 419/* Write previously computed TCP options to the packet.
 420 *
 421 * Beware: Something in the Internet is very sensitive to the ordering of
 422 * TCP options, we learned this through the hard way, so be careful here.
 423 * Luckily we can at least blame others for their non-compliance but from
 424 * inter-operability perspective it seems that we're somewhat stuck with
 425 * the ordering which we have been using if we want to keep working with
 426 * those broken things (not that it currently hurts anybody as there isn't
 427 * particular reason why the ordering would need to be changed).
 428 *
 429 * At least SACK_PERM as the first option is known to lead to a disaster
 430 * (but it may well be that other scenarios fail similarly).
 431 */
 432static void tcp_options_write(__be32 *ptr, struct tcp_sock *tp,
 433			      struct tcp_out_options *opts)
 434{
 435	u16 options = opts->options;	/* mungable copy */
 436
 437	if (unlikely(OPTION_MD5 & options)) {
 438		*ptr++ = htonl((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) |
 439			       (TCPOPT_MD5SIG << 8) | TCPOLEN_MD5SIG);
 440		/* overload cookie hash location */
 441		opts->hash_location = (__u8 *)ptr;
 442		ptr += 4;
 443	}
 444
 445	if (unlikely(opts->mss)) {
 446		*ptr++ = htonl((TCPOPT_MSS << 24) |
 447			       (TCPOLEN_MSS << 16) |
 448			       opts->mss);
 449	}
 450
 451	if (likely(OPTION_TS & options)) {
 452		if (unlikely(OPTION_SACK_ADVERTISE & options)) {
 453			*ptr++ = htonl((TCPOPT_SACK_PERM << 24) |
 454				       (TCPOLEN_SACK_PERM << 16) |
 455				       (TCPOPT_TIMESTAMP << 8) |
 456				       TCPOLEN_TIMESTAMP);
 457			options &= ~OPTION_SACK_ADVERTISE;
 458		} else {
 459			*ptr++ = htonl((TCPOPT_NOP << 24) |
 460				       (TCPOPT_NOP << 16) |
 461				       (TCPOPT_TIMESTAMP << 8) |
 462				       TCPOLEN_TIMESTAMP);
 463		}
 464		*ptr++ = htonl(opts->tsval);
 465		*ptr++ = htonl(opts->tsecr);
 466	}
 467
 468	if (unlikely(OPTION_SACK_ADVERTISE & options)) {
 469		*ptr++ = htonl((TCPOPT_NOP << 24) |
 470			       (TCPOPT_NOP << 16) |
 471			       (TCPOPT_SACK_PERM << 8) |
 472			       TCPOLEN_SACK_PERM);
 473	}
 474
 475	if (unlikely(OPTION_WSCALE & options)) {
 476		*ptr++ = htonl((TCPOPT_NOP << 24) |
 477			       (TCPOPT_WINDOW << 16) |
 478			       (TCPOLEN_WINDOW << 8) |
 479			       opts->ws);
 480	}
 481
 482	if (unlikely(opts->num_sack_blocks)) {
 483		struct tcp_sack_block *sp = tp->rx_opt.dsack ?
 484			tp->duplicate_sack : tp->selective_acks;
 485		int this_sack;
 486
 487		*ptr++ = htonl((TCPOPT_NOP  << 24) |
 488			       (TCPOPT_NOP  << 16) |
 489			       (TCPOPT_SACK <<  8) |
 490			       (TCPOLEN_SACK_BASE + (opts->num_sack_blocks *
 491						     TCPOLEN_SACK_PERBLOCK)));
 492
 493		for (this_sack = 0; this_sack < opts->num_sack_blocks;
 494		     ++this_sack) {
 495			*ptr++ = htonl(sp[this_sack].start_seq);
 496			*ptr++ = htonl(sp[this_sack].end_seq);
 497		}
 498
 499		tp->rx_opt.dsack = 0;
 500	}
 501
 502	if (unlikely(OPTION_FAST_OPEN_COOKIE & options)) {
 503		struct tcp_fastopen_cookie *foc = opts->fastopen_cookie;
 
 
 
 
 
 
 
 
 
 
 
 
 
 504
 505		*ptr++ = htonl((TCPOPT_EXP << 24) |
 506			       ((TCPOLEN_EXP_FASTOPEN_BASE + foc->len) << 16) |
 507			       TCPOPT_FASTOPEN_MAGIC);
 508
 509		memcpy(ptr, foc->val, foc->len);
 510		if ((foc->len & 3) == 2) {
 511			u8 *align = ((u8 *)ptr) + foc->len;
 512			align[0] = align[1] = TCPOPT_NOP;
 513		}
 514		ptr += (foc->len + 3) >> 2;
 515	}
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 516}
 517
 518/* Compute TCP options for SYN packets. This is not the final
 519 * network wire format yet.
 520 */
 521static unsigned int tcp_syn_options(struct sock *sk, struct sk_buff *skb,
 522				struct tcp_out_options *opts,
 523				struct tcp_md5sig_key **md5)
 524{
 525	struct tcp_sock *tp = tcp_sk(sk);
 526	unsigned int remaining = MAX_TCP_OPTION_SPACE;
 527	struct tcp_fastopen_request *fastopen = tp->fastopen_req;
 528
 529#ifdef CONFIG_TCP_MD5SIG
 530	*md5 = tp->af_specific->md5_lookup(sk, sk);
 531	if (*md5) {
 532		opts->options |= OPTION_MD5;
 533		remaining -= TCPOLEN_MD5SIG_ALIGNED;
 534	}
 535#else
 536	*md5 = NULL;
 537#endif
 538
 539	/* We always get an MSS option.  The option bytes which will be seen in
 540	 * normal data packets should timestamps be used, must be in the MSS
 541	 * advertised.  But we subtract them from tp->mss_cache so that
 542	 * calculations in tcp_sendmsg are simpler etc.  So account for this
 543	 * fact here if necessary.  If we don't do this correctly, as a
 544	 * receiver we won't recognize data packets as being full sized when we
 545	 * should, and thus we won't abide by the delayed ACK rules correctly.
 546	 * SACKs don't matter, we never delay an ACK when we have any of those
 547	 * going out.  */
 548	opts->mss = tcp_advertise_mss(sk);
 549	remaining -= TCPOLEN_MSS_ALIGNED;
 550
 551	if (likely(sysctl_tcp_timestamps && *md5 == NULL)) {
 552		opts->options |= OPTION_TS;
 553		opts->tsval = TCP_SKB_CB(skb)->when + tp->tsoffset;
 554		opts->tsecr = tp->rx_opt.ts_recent;
 555		remaining -= TCPOLEN_TSTAMP_ALIGNED;
 556	}
 557	if (likely(sysctl_tcp_window_scaling)) {
 558		opts->ws = tp->rx_opt.rcv_wscale;
 559		opts->options |= OPTION_WSCALE;
 560		remaining -= TCPOLEN_WSCALE_ALIGNED;
 561	}
 562	if (likely(sysctl_tcp_sack)) {
 563		opts->options |= OPTION_SACK_ADVERTISE;
 564		if (unlikely(!(OPTION_TS & opts->options)))
 565			remaining -= TCPOLEN_SACKPERM_ALIGNED;
 566	}
 567
 568	if (fastopen && fastopen->cookie.len >= 0) {
 569		u32 need = TCPOLEN_EXP_FASTOPEN_BASE + fastopen->cookie.len;
 
 
 
 570		need = (need + 3) & ~3U;  /* Align to 32 bits */
 571		if (remaining >= need) {
 572			opts->options |= OPTION_FAST_OPEN_COOKIE;
 573			opts->fastopen_cookie = &fastopen->cookie;
 574			remaining -= need;
 575			tp->syn_fastopen = 1;
 
 576		}
 577	}
 578
 
 
 579	return MAX_TCP_OPTION_SPACE - remaining;
 580}
 581
 582/* Set up TCP options for SYN-ACKs. */
 583static unsigned int tcp_synack_options(struct sock *sk,
 584				   struct request_sock *req,
 585				   unsigned int mss, struct sk_buff *skb,
 586				   struct tcp_out_options *opts,
 587				   struct tcp_md5sig_key **md5,
 588				   struct tcp_fastopen_cookie *foc)
 589{
 590	struct inet_request_sock *ireq = inet_rsk(req);
 591	unsigned int remaining = MAX_TCP_OPTION_SPACE;
 592
 593#ifdef CONFIG_TCP_MD5SIG
 594	*md5 = tcp_rsk(req)->af_specific->md5_lookup(sk, req);
 595	if (*md5) {
 596		opts->options |= OPTION_MD5;
 597		remaining -= TCPOLEN_MD5SIG_ALIGNED;
 598
 599		/* We can't fit any SACK blocks in a packet with MD5 + TS
 600		 * options. There was discussion about disabling SACK
 601		 * rather than TS in order to fit in better with old,
 602		 * buggy kernels, but that was deemed to be unnecessary.
 603		 */
 604		ireq->tstamp_ok &= !ireq->sack_ok;
 605	}
 606#else
 607	*md5 = NULL;
 608#endif
 609
 610	/* We always send an MSS option. */
 611	opts->mss = mss;
 612	remaining -= TCPOLEN_MSS_ALIGNED;
 613
 614	if (likely(ireq->wscale_ok)) {
 615		opts->ws = ireq->rcv_wscale;
 616		opts->options |= OPTION_WSCALE;
 617		remaining -= TCPOLEN_WSCALE_ALIGNED;
 618	}
 619	if (likely(ireq->tstamp_ok)) {
 620		opts->options |= OPTION_TS;
 621		opts->tsval = TCP_SKB_CB(skb)->when;
 622		opts->tsecr = req->ts_recent;
 623		remaining -= TCPOLEN_TSTAMP_ALIGNED;
 624	}
 625	if (likely(ireq->sack_ok)) {
 626		opts->options |= OPTION_SACK_ADVERTISE;
 627		if (unlikely(!ireq->tstamp_ok))
 628			remaining -= TCPOLEN_SACKPERM_ALIGNED;
 629	}
 630	if (foc != NULL) {
 631		u32 need = TCPOLEN_EXP_FASTOPEN_BASE + foc->len;
 
 
 
 632		need = (need + 3) & ~3U;  /* Align to 32 bits */
 633		if (remaining >= need) {
 634			opts->options |= OPTION_FAST_OPEN_COOKIE;
 635			opts->fastopen_cookie = foc;
 636			remaining -= need;
 637		}
 638	}
 639
 
 
 640	return MAX_TCP_OPTION_SPACE - remaining;
 641}
 642
 643/* Compute TCP options for ESTABLISHED sockets. This is not the
 644 * final wire format yet.
 645 */
 646static unsigned int tcp_established_options(struct sock *sk, struct sk_buff *skb,
 647					struct tcp_out_options *opts,
 648					struct tcp_md5sig_key **md5)
 649{
 650	struct tcp_skb_cb *tcb = skb ? TCP_SKB_CB(skb) : NULL;
 651	struct tcp_sock *tp = tcp_sk(sk);
 652	unsigned int size = 0;
 653	unsigned int eff_sacks;
 654
 655	opts->options = 0;
 656
 657#ifdef CONFIG_TCP_MD5SIG
 658	*md5 = tp->af_specific->md5_lookup(sk, sk);
 659	if (unlikely(*md5)) {
 660		opts->options |= OPTION_MD5;
 661		size += TCPOLEN_MD5SIG_ALIGNED;
 662	}
 663#else
 664	*md5 = NULL;
 665#endif
 666
 667	if (likely(tp->rx_opt.tstamp_ok)) {
 668		opts->options |= OPTION_TS;
 669		opts->tsval = tcb ? tcb->when + tp->tsoffset : 0;
 670		opts->tsecr = tp->rx_opt.ts_recent;
 671		size += TCPOLEN_TSTAMP_ALIGNED;
 672	}
 673
 674	eff_sacks = tp->rx_opt.num_sacks + tp->rx_opt.dsack;
 675	if (unlikely(eff_sacks)) {
 676		const unsigned int remaining = MAX_TCP_OPTION_SPACE - size;
 677		opts->num_sack_blocks =
 678			min_t(unsigned int, eff_sacks,
 679			      (remaining - TCPOLEN_SACK_BASE_ALIGNED) /
 680			      TCPOLEN_SACK_PERBLOCK);
 681		size += TCPOLEN_SACK_BASE_ALIGNED +
 682			opts->num_sack_blocks * TCPOLEN_SACK_PERBLOCK;
 683	}
 684
 685	return size;
 686}
 687
 688
 689/* TCP SMALL QUEUES (TSQ)
 690 *
 691 * TSQ goal is to keep small amount of skbs per tcp flow in tx queues (qdisc+dev)
 692 * to reduce RTT and bufferbloat.
 693 * We do this using a special skb destructor (tcp_wfree).
 694 *
 695 * Its important tcp_wfree() can be replaced by sock_wfree() in the event skb
 696 * needs to be reallocated in a driver.
 697 * The invariant being skb->truesize subtracted from sk->sk_wmem_alloc
 698 *
 699 * Since transmit from skb destructor is forbidden, we use a tasklet
 700 * to process all sockets that eventually need to send more skbs.
 701 * We use one tasklet per cpu, with its own queue of sockets.
 702 */
 703struct tsq_tasklet {
 704	struct tasklet_struct	tasklet;
 705	struct list_head	head; /* queue of tcp sockets */
 706};
 707static DEFINE_PER_CPU(struct tsq_tasklet, tsq_tasklet);
 708
 709static void tcp_tsq_handler(struct sock *sk)
 710{
 711	if ((1 << sk->sk_state) &
 712	    (TCPF_ESTABLISHED | TCPF_FIN_WAIT1 | TCPF_CLOSING |
 713	     TCPF_CLOSE_WAIT  | TCPF_LAST_ACK))
 714		tcp_write_xmit(sk, tcp_current_mss(sk), tcp_sk(sk)->nonagle,
 
 
 
 
 
 
 
 
 715			       0, GFP_ATOMIC);
 
 716}
 717/*
 718 * One tasklet per cpu tries to send more skbs.
 719 * We run in tasklet context but need to disable irqs when
 720 * transferring tsq->head because tcp_wfree() might
 721 * interrupt us (non NAPI drivers)
 722 */
 723static void tcp_tasklet_func(unsigned long data)
 724{
 725	struct tsq_tasklet *tsq = (struct tsq_tasklet *)data;
 726	LIST_HEAD(list);
 727	unsigned long flags;
 728	struct list_head *q, *n;
 729	struct tcp_sock *tp;
 730	struct sock *sk;
 731
 732	local_irq_save(flags);
 733	list_splice_init(&tsq->head, &list);
 734	local_irq_restore(flags);
 735
 736	list_for_each_safe(q, n, &list) {
 737		tp = list_entry(q, struct tcp_sock, tsq_node);
 738		list_del(&tp->tsq_node);
 739
 740		sk = (struct sock *)tp;
 741		bh_lock_sock(sk);
 
 742
 743		if (!sock_owned_by_user(sk)) {
 744			tcp_tsq_handler(sk);
 745		} else {
 746			/* defer the work to tcp_release_cb() */
 747			set_bit(TCP_TSQ_DEFERRED, &tp->tsq_flags);
 
 
 
 748		}
 749		bh_unlock_sock(sk);
 750
 751		clear_bit(TSQ_QUEUED, &tp->tsq_flags);
 752		sk_free(sk);
 753	}
 754}
 755
 756#define TCP_DEFERRED_ALL ((1UL << TCP_TSQ_DEFERRED) |		\
 757			  (1UL << TCP_WRITE_TIMER_DEFERRED) |	\
 758			  (1UL << TCP_DELACK_TIMER_DEFERRED) |	\
 759			  (1UL << TCP_MTU_REDUCED_DEFERRED))
 760/**
 761 * tcp_release_cb - tcp release_sock() callback
 762 * @sk: socket
 763 *
 764 * called from release_sock() to perform protocol dependent
 765 * actions before socket release.
 766 */
 767void tcp_release_cb(struct sock *sk)
 768{
 769	struct tcp_sock *tp = tcp_sk(sk);
 770	unsigned long flags, nflags;
 771
 772	/* perform an atomic operation only if at least one flag is set */
 773	do {
 774		flags = tp->tsq_flags;
 775		if (!(flags & TCP_DEFERRED_ALL))
 776			return;
 777		nflags = flags & ~TCP_DEFERRED_ALL;
 778	} while (cmpxchg(&tp->tsq_flags, flags, nflags) != flags);
 779
 780	if (flags & (1UL << TCP_TSQ_DEFERRED))
 781		tcp_tsq_handler(sk);
 782
 783	/* Here begins the tricky part :
 784	 * We are called from release_sock() with :
 785	 * 1) BH disabled
 786	 * 2) sk_lock.slock spinlock held
 787	 * 3) socket owned by us (sk->sk_lock.owned == 1)
 788	 *
 789	 * But following code is meant to be called from BH handlers,
 790	 * so we should keep BH disabled, but early release socket ownership
 791	 */
 792	sock_release_ownership(sk);
 793
 794	if (flags & (1UL << TCP_WRITE_TIMER_DEFERRED)) {
 795		tcp_write_timer_handler(sk);
 796		__sock_put(sk);
 797	}
 798	if (flags & (1UL << TCP_DELACK_TIMER_DEFERRED)) {
 799		tcp_delack_timer_handler(sk);
 800		__sock_put(sk);
 801	}
 802	if (flags & (1UL << TCP_MTU_REDUCED_DEFERRED)) {
 803		sk->sk_prot->mtu_reduced(sk);
 804		__sock_put(sk);
 805	}
 806}
 807EXPORT_SYMBOL(tcp_release_cb);
 808
 809void __init tcp_tasklet_init(void)
 810{
 811	int i;
 812
 813	for_each_possible_cpu(i) {
 814		struct tsq_tasklet *tsq = &per_cpu(tsq_tasklet, i);
 815
 816		INIT_LIST_HEAD(&tsq->head);
 817		tasklet_init(&tsq->tasklet,
 818			     tcp_tasklet_func,
 819			     (unsigned long)tsq);
 820	}
 821}
 822
 823/*
 824 * Write buffer destructor automatically called from kfree_skb.
 825 * We can't xmit new skbs from this context, as we might already
 826 * hold qdisc lock.
 827 */
 828void tcp_wfree(struct sk_buff *skb)
 829{
 830	struct sock *sk = skb->sk;
 831	struct tcp_sock *tp = tcp_sk(sk);
 
 832
 833	if (test_and_clear_bit(TSQ_THROTTLED, &tp->tsq_flags) &&
 834	    !test_and_set_bit(TSQ_QUEUED, &tp->tsq_flags)) {
 835		unsigned long flags;
 
 
 
 
 
 
 
 
 
 
 
 
 
 836		struct tsq_tasklet *tsq;
 
 837
 838		/* Keep a ref on socket.
 839		 * This last ref will be released in tcp_tasklet_func()
 840		 */
 841		atomic_sub(skb->truesize - 1, &sk->sk_wmem_alloc);
 
 
 
 842
 843		/* queue this socket to tasklet queue */
 844		local_irq_save(flags);
 845		tsq = &__get_cpu_var(tsq_tasklet);
 
 846		list_add(&tp->tsq_node, &tsq->head);
 847		tasklet_schedule(&tsq->tasklet);
 
 848		local_irq_restore(flags);
 849	} else {
 850		sock_wfree(skb);
 851	}
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 852}
 853
 854/* This routine actually transmits TCP packets queued in by
 855 * tcp_do_sendmsg().  This is used by both the initial
 856 * transmission and possible later retransmissions.
 857 * All SKB's seen here are completely headerless.  It is our
 858 * job to build the TCP header, and pass the packet down to
 859 * IP so it can do the same plus pass the packet off to the
 860 * device.
 861 *
 862 * We are working here with either a clone of the original
 863 * SKB, or a fresh unique copy made by the retransmit engine.
 864 */
 865static int tcp_transmit_skb(struct sock *sk, struct sk_buff *skb, int clone_it,
 866			    gfp_t gfp_mask)
 867{
 868	const struct inet_connection_sock *icsk = inet_csk(sk);
 869	struct inet_sock *inet;
 870	struct tcp_sock *tp;
 871	struct tcp_skb_cb *tcb;
 872	struct tcp_out_options opts;
 873	unsigned int tcp_options_size, tcp_header_size;
 
 874	struct tcp_md5sig_key *md5;
 875	struct tcphdr *th;
 876	int err;
 877
 878	BUG_ON(!skb || !tcp_skb_pcount(skb));
 
 879
 880	if (clone_it) {
 881		const struct sk_buff *fclone = skb + 1;
 882
 883		skb_mstamp_get(&skb->skb_mstamp);
 884
 885		if (unlikely(skb->fclone == SKB_FCLONE_ORIG &&
 886			     fclone->fclone == SKB_FCLONE_CLONE))
 887			NET_INC_STATS(sock_net(sk),
 888				      LINUX_MIB_TCPSPURIOUS_RTX_HOSTQUEUES);
 
 
 889
 890		if (unlikely(skb_cloned(skb)))
 891			skb = pskb_copy(skb, gfp_mask);
 892		else
 893			skb = skb_clone(skb, gfp_mask);
 894		if (unlikely(!skb))
 895			return -ENOBUFS;
 896		/* Our usage of tstamp should remain private */
 897		skb->tstamp.tv64 = 0;
 898	}
 
 899
 900	inet = inet_sk(sk);
 901	tp = tcp_sk(sk);
 902	tcb = TCP_SKB_CB(skb);
 903	memset(&opts, 0, sizeof(opts));
 904
 905	if (unlikely(tcb->tcp_flags & TCPHDR_SYN))
 906		tcp_options_size = tcp_syn_options(sk, skb, &opts, &md5);
 907	else
 908		tcp_options_size = tcp_established_options(sk, skb, &opts,
 909							   &md5);
 910	tcp_header_size = tcp_options_size + sizeof(struct tcphdr);
 911
 912	if (tcp_packets_in_flight(tp) == 0)
 913		tcp_ca_event(sk, CA_EVENT_TX_START);
 914
 915	/* if no packet is in qdisc/device queue, then allow XPS to select
 916	 * another queue.
 
 
 
 
 917	 */
 918	skb->ooo_okay = sk_wmem_alloc_get(sk) == 0;
 
 
 
 
 
 
 
 919
 920	skb_push(skb, tcp_header_size);
 921	skb_reset_transport_header(skb);
 922
 923	skb_orphan(skb);
 924	skb->sk = sk;
 925	skb->destructor = tcp_wfree;
 926	atomic_add(skb->truesize, &sk->sk_wmem_alloc);
 
 
 
 927
 928	/* Build TCP header and checksum it. */
 929	th = tcp_hdr(skb);
 930	th->source		= inet->inet_sport;
 931	th->dest		= inet->inet_dport;
 932	th->seq			= htonl(tcb->seq);
 933	th->ack_seq		= htonl(tp->rcv_nxt);
 934	*(((__be16 *)th) + 6)	= htons(((tcp_header_size >> 2) << 12) |
 935					tcb->tcp_flags);
 936
 937	if (unlikely(tcb->tcp_flags & TCPHDR_SYN)) {
 938		/* RFC1323: The window in SYN & SYN/ACK segments
 939		 * is never scaled.
 940		 */
 941		th->window	= htons(min(tp->rcv_wnd, 65535U));
 942	} else {
 943		th->window	= htons(tcp_select_window(sk));
 944	}
 945	th->check		= 0;
 946	th->urg_ptr		= 0;
 947
 948	/* The urg_mode check is necessary during a below snd_una win probe */
 949	if (unlikely(tcp_urg_mode(tp) && before(tcb->seq, tp->snd_up))) {
 950		if (before(tp->snd_up, tcb->seq + 0x10000)) {
 951			th->urg_ptr = htons(tp->snd_up - tcb->seq);
 952			th->urg = 1;
 953		} else if (after(tcb->seq + 0xFFFF, tp->snd_nxt)) {
 954			th->urg_ptr = htons(0xFFFF);
 955			th->urg = 1;
 956		}
 957	}
 958
 959	tcp_options_write((__be32 *)(th + 1), tp, &opts);
 960	if (likely((tcb->tcp_flags & TCPHDR_SYN) == 0))
 961		TCP_ECN_send(sk, skb, tcp_header_size);
 962
 
 
 
 
 
 
 
 963#ifdef CONFIG_TCP_MD5SIG
 964	/* Calculate the MD5 hash, as we have all we need now */
 965	if (md5) {
 966		sk_nocaps_add(sk, NETIF_F_GSO_MASK);
 967		tp->af_specific->calc_md5_hash(opts.hash_location,
 968					       md5, sk, NULL, skb);
 969	}
 970#endif
 971
 972	icsk->icsk_af_ops->send_check(sk, skb);
 973
 974	if (likely(tcb->tcp_flags & TCPHDR_ACK))
 975		tcp_event_ack_sent(sk, tcp_skb_pcount(skb));
 976
 977	if (skb->len != tcp_header_size)
 978		tcp_event_data_sent(tp, sk);
 
 
 
 979
 980	if (after(tcb->end_seq, tp->snd_nxt) || tcb->seq == tcb->end_seq)
 981		TCP_ADD_STATS(sock_net(sk), TCP_MIB_OUTSEGS,
 982			      tcp_skb_pcount(skb));
 983
 984	err = icsk->icsk_af_ops->queue_xmit(sk, skb, &inet->cork.fl);
 985	if (likely(err <= 0))
 986		return err;
 
 
 
 
 
 
 
 
 987
 988	tcp_enter_cwr(sk, 1);
 989
 990	return net_xmit_eval(err);
 
 
 
 
 
 
 
 
 991}
 992
 993/* This routine just queues the buffer for sending.
 994 *
 995 * NOTE: probe0 timer is not checked, do not forget tcp_push_pending_frames,
 996 * otherwise socket can stall.
 997 */
 998static void tcp_queue_skb(struct sock *sk, struct sk_buff *skb)
 999{
1000	struct tcp_sock *tp = tcp_sk(sk);
1001
1002	/* Advance write_seq and place onto the write_queue. */
1003	tp->write_seq = TCP_SKB_CB(skb)->end_seq;
1004	skb_header_release(skb);
1005	tcp_add_write_queue_tail(sk, skb);
1006	sk->sk_wmem_queued += skb->truesize;
1007	sk_mem_charge(sk, skb->truesize);
1008}
1009
1010/* Initialize TSO segments for a packet. */
1011static void tcp_set_skb_tso_segs(const struct sock *sk, struct sk_buff *skb,
1012				 unsigned int mss_now)
1013{
1014	struct skb_shared_info *shinfo = skb_shinfo(skb);
1015
1016	/* Make sure we own this skb before messing gso_size/gso_segs */
1017	WARN_ON_ONCE(skb_cloned(skb));
1018
1019	if (skb->len <= mss_now || skb->ip_summed == CHECKSUM_NONE) {
1020		/* Avoid the costly divide in the normal
1021		 * non-TSO case.
1022		 */
1023		shinfo->gso_segs = 1;
1024		shinfo->gso_size = 0;
1025		shinfo->gso_type = 0;
1026	} else {
1027		shinfo->gso_segs = DIV_ROUND_UP(skb->len, mss_now);
1028		shinfo->gso_size = mss_now;
1029		shinfo->gso_type = sk->sk_gso_type;
1030	}
1031}
1032
1033/* When a modification to fackets out becomes necessary, we need to check
1034 * skb is counted to fackets_out or not.
1035 */
1036static void tcp_adjust_fackets_out(struct sock *sk, const struct sk_buff *skb,
1037				   int decr)
1038{
1039	struct tcp_sock *tp = tcp_sk(sk);
1040
1041	if (!tp->sacked_out || tcp_is_reno(tp))
1042		return;
1043
1044	if (after(tcp_highest_sack_seq(tp), TCP_SKB_CB(skb)->seq))
1045		tp->fackets_out -= decr;
1046}
1047
1048/* Pcount in the middle of the write queue got changed, we need to do various
1049 * tweaks to fix counters
1050 */
1051static void tcp_adjust_pcount(struct sock *sk, const struct sk_buff *skb, int decr)
1052{
1053	struct tcp_sock *tp = tcp_sk(sk);
1054
1055	tp->packets_out -= decr;
1056
1057	if (TCP_SKB_CB(skb)->sacked & TCPCB_SACKED_ACKED)
1058		tp->sacked_out -= decr;
1059	if (TCP_SKB_CB(skb)->sacked & TCPCB_SACKED_RETRANS)
1060		tp->retrans_out -= decr;
1061	if (TCP_SKB_CB(skb)->sacked & TCPCB_LOST)
1062		tp->lost_out -= decr;
1063
1064	/* Reno case is special. Sigh... */
1065	if (tcp_is_reno(tp) && decr > 0)
1066		tp->sacked_out -= min_t(u32, tp->sacked_out, decr);
1067
1068	tcp_adjust_fackets_out(sk, skb, decr);
1069
1070	if (tp->lost_skb_hint &&
1071	    before(TCP_SKB_CB(skb)->seq, TCP_SKB_CB(tp->lost_skb_hint)->seq) &&
1072	    (tcp_is_fack(tp) || (TCP_SKB_CB(skb)->sacked & TCPCB_SACKED_ACKED)))
1073		tp->lost_cnt_hint -= decr;
1074
1075	tcp_verify_left_out(tp);
1076}
1077
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1078/* Function to create two new TCP segments.  Shrinks the given segment
1079 * to the specified size and appends a new segment with the rest of the
1080 * packet to the list.  This won't be called frequently, I hope.
1081 * Remember, these are still headerless SKBs at this point.
1082 */
1083int tcp_fragment(struct sock *sk, struct sk_buff *skb, u32 len,
1084		 unsigned int mss_now)
 
1085{
1086	struct tcp_sock *tp = tcp_sk(sk);
1087	struct sk_buff *buff;
1088	int nsize, old_factor;
1089	int nlen;
1090	u8 flags;
1091
1092	if (WARN_ON(len > skb->len))
1093		return -EINVAL;
1094
1095	nsize = skb_headlen(skb) - len;
1096	if (nsize < 0)
1097		nsize = 0;
1098
1099	if (skb_unclone(skb, GFP_ATOMIC))
1100		return -ENOMEM;
1101
1102	/* Get a new skb... force flag on. */
1103	buff = sk_stream_alloc_skb(sk, nsize, GFP_ATOMIC);
1104	if (buff == NULL)
1105		return -ENOMEM; /* We'll just try again later. */
1106
1107	sk->sk_wmem_queued += buff->truesize;
1108	sk_mem_charge(sk, buff->truesize);
1109	nlen = skb->len - len - nsize;
1110	buff->truesize += nlen;
1111	skb->truesize -= nlen;
1112
1113	/* Correct the sequence numbers. */
1114	TCP_SKB_CB(buff)->seq = TCP_SKB_CB(skb)->seq + len;
1115	TCP_SKB_CB(buff)->end_seq = TCP_SKB_CB(skb)->end_seq;
1116	TCP_SKB_CB(skb)->end_seq = TCP_SKB_CB(buff)->seq;
1117
1118	/* PSH and FIN should only be set in the second packet. */
1119	flags = TCP_SKB_CB(skb)->tcp_flags;
1120	TCP_SKB_CB(skb)->tcp_flags = flags & ~(TCPHDR_FIN | TCPHDR_PSH);
1121	TCP_SKB_CB(buff)->tcp_flags = flags;
1122	TCP_SKB_CB(buff)->sacked = TCP_SKB_CB(skb)->sacked;
 
1123
1124	if (!skb_shinfo(skb)->nr_frags && skb->ip_summed != CHECKSUM_PARTIAL) {
1125		/* Copy and checksum data tail into the new buffer. */
1126		buff->csum = csum_partial_copy_nocheck(skb->data + len,
1127						       skb_put(buff, nsize),
1128						       nsize, 0);
1129
1130		skb_trim(skb, len);
1131
1132		skb->csum = csum_block_sub(skb->csum, buff->csum, len);
1133	} else {
1134		skb->ip_summed = CHECKSUM_PARTIAL;
1135		skb_split(skb, buff, len);
1136	}
1137
1138	buff->ip_summed = skb->ip_summed;
1139
1140	/* Looks stupid, but our code really uses when of
1141	 * skbs, which it never sent before. --ANK
1142	 */
1143	TCP_SKB_CB(buff)->when = TCP_SKB_CB(skb)->when;
1144	buff->tstamp = skb->tstamp;
 
1145
1146	old_factor = tcp_skb_pcount(skb);
1147
1148	/* Fix up tso_factor for both original and new SKB.  */
1149	tcp_set_skb_tso_segs(sk, skb, mss_now);
1150	tcp_set_skb_tso_segs(sk, buff, mss_now);
 
 
 
1151
1152	/* If this packet has been sent out already, we must
1153	 * adjust the various packet counters.
1154	 */
1155	if (!before(tp->snd_nxt, TCP_SKB_CB(buff)->end_seq)) {
1156		int diff = old_factor - tcp_skb_pcount(skb) -
1157			tcp_skb_pcount(buff);
1158
1159		if (diff)
1160			tcp_adjust_pcount(sk, skb, diff);
1161	}
1162
1163	/* Link BUFF into the send queue. */
1164	skb_header_release(buff);
1165	tcp_insert_write_queue_after(skb, buff, sk);
 
 
1166
1167	return 0;
1168}
1169
1170/* This is similar to __pskb_pull_head() (it will go to core/skbuff.c
1171 * eventually). The difference is that pulled data not copied, but
1172 * immediately discarded.
1173 */
1174static void __pskb_trim_head(struct sk_buff *skb, int len)
1175{
1176	struct skb_shared_info *shinfo;
1177	int i, k, eat;
1178
1179	eat = min_t(int, len, skb_headlen(skb));
1180	if (eat) {
1181		__skb_pull(skb, eat);
1182		len -= eat;
1183		if (!len)
1184			return;
1185	}
1186	eat = len;
1187	k = 0;
1188	shinfo = skb_shinfo(skb);
1189	for (i = 0; i < shinfo->nr_frags; i++) {
1190		int size = skb_frag_size(&shinfo->frags[i]);
1191
1192		if (size <= eat) {
1193			skb_frag_unref(skb, i);
1194			eat -= size;
1195		} else {
1196			shinfo->frags[k] = shinfo->frags[i];
1197			if (eat) {
1198				shinfo->frags[k].page_offset += eat;
1199				skb_frag_size_sub(&shinfo->frags[k], eat);
1200				eat = 0;
1201			}
1202			k++;
1203		}
1204	}
1205	shinfo->nr_frags = k;
1206
1207	skb_reset_tail_pointer(skb);
1208	skb->data_len -= len;
1209	skb->len = skb->data_len;
 
1210}
1211
1212/* Remove acked data from a packet in the transmit queue. */
1213int tcp_trim_head(struct sock *sk, struct sk_buff *skb, u32 len)
1214{
 
 
1215	if (skb_unclone(skb, GFP_ATOMIC))
1216		return -ENOMEM;
1217
1218	__pskb_trim_head(skb, len);
1219
1220	TCP_SKB_CB(skb)->seq += len;
1221	skb->ip_summed = CHECKSUM_PARTIAL;
1222
1223	skb->truesize	     -= len;
1224	sk->sk_wmem_queued   -= len;
1225	sk_mem_uncharge(sk, len);
1226	sock_set_flag(sk, SOCK_QUEUE_SHRUNK);
 
 
1227
1228	/* Any change of skb->len requires recalculation of tso factor. */
1229	if (tcp_skb_pcount(skb) > 1)
1230		tcp_set_skb_tso_segs(sk, skb, tcp_skb_mss(skb));
1231
1232	return 0;
1233}
1234
1235/* Calculate MSS not accounting any TCP options.  */
1236static inline int __tcp_mtu_to_mss(struct sock *sk, int pmtu)
1237{
1238	const struct tcp_sock *tp = tcp_sk(sk);
1239	const struct inet_connection_sock *icsk = inet_csk(sk);
1240	int mss_now;
1241
1242	/* Calculate base mss without TCP options:
1243	   It is MMS_S - sizeof(tcphdr) of rfc1122
1244	 */
1245	mss_now = pmtu - icsk->icsk_af_ops->net_header_len - sizeof(struct tcphdr);
1246
1247	/* IPv6 adds a frag_hdr in case RTAX_FEATURE_ALLFRAG is set */
1248	if (icsk->icsk_af_ops->net_frag_header_len) {
1249		const struct dst_entry *dst = __sk_dst_get(sk);
1250
1251		if (dst && dst_allfrag(dst))
1252			mss_now -= icsk->icsk_af_ops->net_frag_header_len;
1253	}
1254
1255	/* Clamp it (mss_clamp does not include tcp options) */
1256	if (mss_now > tp->rx_opt.mss_clamp)
1257		mss_now = tp->rx_opt.mss_clamp;
1258
1259	/* Now subtract optional transport overhead */
1260	mss_now -= icsk->icsk_ext_hdr_len;
1261
1262	/* Then reserve room for full set of TCP options and 8 bytes of data */
1263	if (mss_now < 48)
1264		mss_now = 48;
1265	return mss_now;
1266}
1267
1268/* Calculate MSS. Not accounting for SACKs here.  */
1269int tcp_mtu_to_mss(struct sock *sk, int pmtu)
1270{
1271	/* Subtract TCP options size, not including SACKs */
1272	return __tcp_mtu_to_mss(sk, pmtu) -
1273	       (tcp_sk(sk)->tcp_header_len - sizeof(struct tcphdr));
1274}
1275
1276/* Inverse of above */
1277int tcp_mss_to_mtu(struct sock *sk, int mss)
1278{
1279	const struct tcp_sock *tp = tcp_sk(sk);
1280	const struct inet_connection_sock *icsk = inet_csk(sk);
1281	int mtu;
1282
1283	mtu = mss +
1284	      tp->tcp_header_len +
1285	      icsk->icsk_ext_hdr_len +
1286	      icsk->icsk_af_ops->net_header_len;
1287
1288	/* IPv6 adds a frag_hdr in case RTAX_FEATURE_ALLFRAG is set */
1289	if (icsk->icsk_af_ops->net_frag_header_len) {
1290		const struct dst_entry *dst = __sk_dst_get(sk);
1291
1292		if (dst && dst_allfrag(dst))
1293			mtu += icsk->icsk_af_ops->net_frag_header_len;
1294	}
1295	return mtu;
1296}
 
1297
1298/* MTU probing init per socket */
1299void tcp_mtup_init(struct sock *sk)
1300{
1301	struct tcp_sock *tp = tcp_sk(sk);
1302	struct inet_connection_sock *icsk = inet_csk(sk);
 
1303
1304	icsk->icsk_mtup.enabled = sysctl_tcp_mtu_probing > 1;
1305	icsk->icsk_mtup.search_high = tp->rx_opt.mss_clamp + sizeof(struct tcphdr) +
1306			       icsk->icsk_af_ops->net_header_len;
1307	icsk->icsk_mtup.search_low = tcp_mss_to_mtu(sk, sysctl_tcp_base_mss);
1308	icsk->icsk_mtup.probe_size = 0;
 
 
1309}
1310EXPORT_SYMBOL(tcp_mtup_init);
1311
1312/* This function synchronize snd mss to current pmtu/exthdr set.
1313
1314   tp->rx_opt.user_mss is mss set by user by TCP_MAXSEG. It does NOT counts
1315   for TCP options, but includes only bare TCP header.
1316
1317   tp->rx_opt.mss_clamp is mss negotiated at connection setup.
1318   It is minimum of user_mss and mss received with SYN.
1319   It also does not include TCP options.
1320
1321   inet_csk(sk)->icsk_pmtu_cookie is last pmtu, seen by this function.
1322
1323   tp->mss_cache is current effective sending mss, including
1324   all tcp options except for SACKs. It is evaluated,
1325   taking into account current pmtu, but never exceeds
1326   tp->rx_opt.mss_clamp.
1327
1328   NOTE1. rfc1122 clearly states that advertised MSS
1329   DOES NOT include either tcp or ip options.
1330
1331   NOTE2. inet_csk(sk)->icsk_pmtu_cookie and tp->mss_cache
1332   are READ ONLY outside this function.		--ANK (980731)
1333 */
1334unsigned int tcp_sync_mss(struct sock *sk, u32 pmtu)
1335{
1336	struct tcp_sock *tp = tcp_sk(sk);
1337	struct inet_connection_sock *icsk = inet_csk(sk);
1338	int mss_now;
1339
1340	if (icsk->icsk_mtup.search_high > pmtu)
1341		icsk->icsk_mtup.search_high = pmtu;
1342
1343	mss_now = tcp_mtu_to_mss(sk, pmtu);
1344	mss_now = tcp_bound_to_half_wnd(tp, mss_now);
1345
1346	/* And store cached results */
1347	icsk->icsk_pmtu_cookie = pmtu;
1348	if (icsk->icsk_mtup.enabled)
1349		mss_now = min(mss_now, tcp_mtu_to_mss(sk, icsk->icsk_mtup.search_low));
1350	tp->mss_cache = mss_now;
1351
1352	return mss_now;
1353}
1354EXPORT_SYMBOL(tcp_sync_mss);
1355
1356/* Compute the current effective MSS, taking SACKs and IP options,
1357 * and even PMTU discovery events into account.
1358 */
1359unsigned int tcp_current_mss(struct sock *sk)
1360{
1361	const struct tcp_sock *tp = tcp_sk(sk);
1362	const struct dst_entry *dst = __sk_dst_get(sk);
1363	u32 mss_now;
1364	unsigned int header_len;
1365	struct tcp_out_options opts;
1366	struct tcp_md5sig_key *md5;
1367
1368	mss_now = tp->mss_cache;
1369
1370	if (dst) {
1371		u32 mtu = dst_mtu(dst);
1372		if (mtu != inet_csk(sk)->icsk_pmtu_cookie)
1373			mss_now = tcp_sync_mss(sk, mtu);
1374	}
1375
1376	header_len = tcp_established_options(sk, NULL, &opts, &md5) +
1377		     sizeof(struct tcphdr);
1378	/* The mss_cache is sized based on tp->tcp_header_len, which assumes
1379	 * some common options. If this is an odd packet (because we have SACK
1380	 * blocks etc) then our calculated header_len will be different, and
1381	 * we have to adjust mss_now correspondingly */
1382	if (header_len != tp->tcp_header_len) {
1383		int delta = (int) header_len - tp->tcp_header_len;
1384		mss_now -= delta;
1385	}
1386
1387	return mss_now;
1388}
1389
1390/* Congestion window validation. (RFC2861) */
1391static void tcp_cwnd_validate(struct sock *sk)
 
 
 
1392{
1393	struct tcp_sock *tp = tcp_sk(sk);
1394
1395	if (tp->packets_out >= tp->snd_cwnd) {
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1396		/* Network is feed fully. */
1397		tp->snd_cwnd_used = 0;
1398		tp->snd_cwnd_stamp = tcp_time_stamp;
1399	} else {
1400		/* Network starves. */
1401		if (tp->packets_out > tp->snd_cwnd_used)
1402			tp->snd_cwnd_used = tp->packets_out;
1403
1404		if (sysctl_tcp_slow_start_after_idle &&
1405		    (s32)(tcp_time_stamp - tp->snd_cwnd_stamp) >= inet_csk(sk)->icsk_rto)
 
1406			tcp_cwnd_application_limited(sk);
 
 
 
 
 
 
 
 
 
 
 
 
1407	}
1408}
1409
1410/* Minshall's variant of the Nagle send check. */
1411static bool tcp_minshall_check(const struct tcp_sock *tp)
1412{
1413	return after(tp->snd_sml, tp->snd_una) &&
1414		!after(tp->snd_sml, tp->snd_nxt);
1415}
1416
1417/* Update snd_sml if this skb is under mss
1418 * Note that a TSO packet might end with a sub-mss segment
1419 * The test is really :
1420 * if ((skb->len % mss) != 0)
1421 *        tp->snd_sml = TCP_SKB_CB(skb)->end_seq;
1422 * But we can avoid doing the divide again given we already have
1423 *  skb_pcount = skb->len / mss_now
1424 */
1425static void tcp_minshall_update(struct tcp_sock *tp, unsigned int mss_now,
1426				const struct sk_buff *skb)
1427{
1428	if (skb->len < tcp_skb_pcount(skb) * mss_now)
1429		tp->snd_sml = TCP_SKB_CB(skb)->end_seq;
1430}
1431
1432/* Return false, if packet can be sent now without violation Nagle's rules:
1433 * 1. It is full sized. (provided by caller in %partial bool)
1434 * 2. Or it contains FIN. (already checked by caller)
1435 * 3. Or TCP_CORK is not set, and TCP_NODELAY is set.
1436 * 4. Or TCP_CORK is not set, and all sent packets are ACKed.
1437 *    With Minshall's modification: all sent small packets are ACKed.
1438 */
1439static bool tcp_nagle_check(bool partial, const struct tcp_sock *tp,
1440			    int nonagle)
1441{
1442	return partial &&
1443		((nonagle & TCP_NAGLE_CORK) ||
1444		 (!nonagle && tp->packets_out && tcp_minshall_check(tp)));
1445}
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1446/* Returns the portion of skb which can be sent right away */
1447static unsigned int tcp_mss_split_point(const struct sock *sk,
1448					const struct sk_buff *skb,
1449					unsigned int mss_now,
1450					unsigned int max_segs,
1451					int nonagle)
1452{
1453	const struct tcp_sock *tp = tcp_sk(sk);
1454	u32 partial, needed, window, max_len;
1455
1456	window = tcp_wnd_end(tp) - TCP_SKB_CB(skb)->seq;
1457	max_len = mss_now * max_segs;
1458
1459	if (likely(max_len <= window && skb != tcp_write_queue_tail(sk)))
1460		return max_len;
1461
1462	needed = min(skb->len, window);
1463
1464	if (max_len <= needed)
1465		return max_len;
1466
1467	partial = needed % mss_now;
1468	/* If last segment is not a full MSS, check if Nagle rules allow us
1469	 * to include this last segment in this skb.
1470	 * Otherwise, we'll split the skb at last MSS boundary
1471	 */
1472	if (tcp_nagle_check(partial != 0, tp, nonagle))
1473		return needed - partial;
1474
1475	return needed;
1476}
1477
1478/* Can at least one segment of SKB be sent right now, according to the
1479 * congestion window rules?  If so, return how many segments are allowed.
1480 */
1481static inline unsigned int tcp_cwnd_test(const struct tcp_sock *tp,
1482					 const struct sk_buff *skb)
1483{
1484	u32 in_flight, cwnd;
1485
1486	/* Don't be strict about the congestion window for the final FIN.  */
1487	if ((TCP_SKB_CB(skb)->tcp_flags & TCPHDR_FIN) &&
1488	    tcp_skb_pcount(skb) == 1)
1489		return 1;
1490
1491	in_flight = tcp_packets_in_flight(tp);
1492	cwnd = tp->snd_cwnd;
1493	if (in_flight < cwnd)
1494		return (cwnd - in_flight);
1495
1496	return 0;
 
 
 
 
1497}
1498
1499/* Initialize TSO state of a skb.
1500 * This must be invoked the first time we consider transmitting
1501 * SKB onto the wire.
1502 */
1503static int tcp_init_tso_segs(const struct sock *sk, struct sk_buff *skb,
1504			     unsigned int mss_now)
1505{
1506	int tso_segs = tcp_skb_pcount(skb);
1507
1508	if (!tso_segs || (tso_segs > 1 && tcp_skb_mss(skb) != mss_now)) {
1509		tcp_set_skb_tso_segs(sk, skb, mss_now);
1510		tso_segs = tcp_skb_pcount(skb);
1511	}
1512	return tso_segs;
1513}
1514
1515
1516/* Return true if the Nagle test allows this packet to be
1517 * sent now.
1518 */
1519static inline bool tcp_nagle_test(const struct tcp_sock *tp, const struct sk_buff *skb,
1520				  unsigned int cur_mss, int nonagle)
1521{
1522	/* Nagle rule does not apply to frames, which sit in the middle of the
1523	 * write_queue (they have no chances to get new data).
1524	 *
1525	 * This is implemented in the callers, where they modify the 'nonagle'
1526	 * argument based upon the location of SKB in the send queue.
1527	 */
1528	if (nonagle & TCP_NAGLE_PUSH)
1529		return true;
1530
1531	/* Don't use the nagle rule for urgent data (or for the final FIN). */
1532	if (tcp_urg_mode(tp) || (TCP_SKB_CB(skb)->tcp_flags & TCPHDR_FIN))
1533		return true;
1534
1535	if (!tcp_nagle_check(skb->len < cur_mss, tp, nonagle))
1536		return true;
1537
1538	return false;
1539}
1540
1541/* Does at least the first segment of SKB fit into the send window? */
1542static bool tcp_snd_wnd_test(const struct tcp_sock *tp,
1543			     const struct sk_buff *skb,
1544			     unsigned int cur_mss)
1545{
1546	u32 end_seq = TCP_SKB_CB(skb)->end_seq;
1547
1548	if (skb->len > cur_mss)
1549		end_seq = TCP_SKB_CB(skb)->seq + cur_mss;
1550
1551	return !after(end_seq, tcp_wnd_end(tp));
1552}
1553
1554/* This checks if the data bearing packet SKB (usually tcp_send_head(sk))
1555 * should be put on the wire right now.  If so, it returns the number of
1556 * packets allowed by the congestion window.
1557 */
1558static unsigned int tcp_snd_test(const struct sock *sk, struct sk_buff *skb,
1559				 unsigned int cur_mss, int nonagle)
1560{
1561	const struct tcp_sock *tp = tcp_sk(sk);
1562	unsigned int cwnd_quota;
1563
1564	tcp_init_tso_segs(sk, skb, cur_mss);
1565
1566	if (!tcp_nagle_test(tp, skb, cur_mss, nonagle))
1567		return 0;
1568
1569	cwnd_quota = tcp_cwnd_test(tp, skb);
1570	if (cwnd_quota && !tcp_snd_wnd_test(tp, skb, cur_mss))
1571		cwnd_quota = 0;
1572
1573	return cwnd_quota;
1574}
1575
1576/* Test if sending is allowed right now. */
1577bool tcp_may_send_now(struct sock *sk)
1578{
1579	const struct tcp_sock *tp = tcp_sk(sk);
1580	struct sk_buff *skb = tcp_send_head(sk);
1581
1582	return skb &&
1583		tcp_snd_test(sk, skb, tcp_current_mss(sk),
1584			     (tcp_skb_is_last(sk, skb) ?
1585			      tp->nonagle : TCP_NAGLE_PUSH));
1586}
1587
1588/* Trim TSO SKB to LEN bytes, put the remaining data into a new packet
1589 * which is put after SKB on the list.  It is very much like
1590 * tcp_fragment() except that it may make several kinds of assumptions
1591 * in order to speed up the splitting operation.  In particular, we
1592 * know that all the data is in scatter-gather pages, and that the
1593 * packet has never been sent out before (and thus is not cloned).
1594 */
1595static int tso_fragment(struct sock *sk, struct sk_buff *skb, unsigned int len,
 
1596			unsigned int mss_now, gfp_t gfp)
1597{
1598	struct sk_buff *buff;
1599	int nlen = skb->len - len;
1600	u8 flags;
1601
1602	/* All of a TSO frame must be composed of paged data.  */
1603	if (skb->len != skb->data_len)
1604		return tcp_fragment(sk, skb, len, mss_now);
1605
1606	buff = sk_stream_alloc_skb(sk, 0, gfp);
1607	if (unlikely(buff == NULL))
1608		return -ENOMEM;
1609
1610	sk->sk_wmem_queued += buff->truesize;
1611	sk_mem_charge(sk, buff->truesize);
1612	buff->truesize += nlen;
1613	skb->truesize -= nlen;
1614
1615	/* Correct the sequence numbers. */
1616	TCP_SKB_CB(buff)->seq = TCP_SKB_CB(skb)->seq + len;
1617	TCP_SKB_CB(buff)->end_seq = TCP_SKB_CB(skb)->end_seq;
1618	TCP_SKB_CB(skb)->end_seq = TCP_SKB_CB(buff)->seq;
1619
1620	/* PSH and FIN should only be set in the second packet. */
1621	flags = TCP_SKB_CB(skb)->tcp_flags;
1622	TCP_SKB_CB(skb)->tcp_flags = flags & ~(TCPHDR_FIN | TCPHDR_PSH);
1623	TCP_SKB_CB(buff)->tcp_flags = flags;
1624
1625	/* This packet was never sent out yet, so no SACK bits. */
1626	TCP_SKB_CB(buff)->sacked = 0;
1627
1628	buff->ip_summed = skb->ip_summed = CHECKSUM_PARTIAL;
 
 
1629	skb_split(skb, buff, len);
 
1630
1631	/* Fix up tso_factor for both original and new SKB.  */
1632	tcp_set_skb_tso_segs(sk, skb, mss_now);
1633	tcp_set_skb_tso_segs(sk, buff, mss_now);
1634
1635	/* Link BUFF into the send queue. */
1636	skb_header_release(buff);
1637	tcp_insert_write_queue_after(skb, buff, sk);
1638
1639	return 0;
1640}
1641
1642/* Try to defer sending, if possible, in order to minimize the amount
1643 * of TSO splitting we do.  View it as a kind of TSO Nagle test.
1644 *
1645 * This algorithm is from John Heffner.
1646 */
1647static bool tcp_tso_should_defer(struct sock *sk, struct sk_buff *skb)
 
1648{
1649	struct tcp_sock *tp = tcp_sk(sk);
1650	const struct inet_connection_sock *icsk = inet_csk(sk);
1651	u32 send_win, cong_win, limit, in_flight;
 
 
1652	int win_divisor;
1653
1654	if (TCP_SKB_CB(skb)->tcp_flags & TCPHDR_FIN)
1655		goto send_now;
1656
1657	if (icsk->icsk_ca_state != TCP_CA_Open)
1658		goto send_now;
1659
1660	/* Defer for less than two clock ticks. */
1661	if (tp->tso_deferred &&
1662	    (((u32)jiffies << 1) >> 1) - (tp->tso_deferred >> 1) > 1)
 
1663		goto send_now;
1664
1665	in_flight = tcp_packets_in_flight(tp);
1666
1667	BUG_ON(tcp_skb_pcount(skb) <= 1 || (tp->snd_cwnd <= in_flight));
 
1668
1669	send_win = tcp_wnd_end(tp) - TCP_SKB_CB(skb)->seq;
1670
1671	/* From in_flight test above, we know that cwnd > in_flight.  */
1672	cong_win = (tp->snd_cwnd - in_flight) * tp->mss_cache;
1673
1674	limit = min(send_win, cong_win);
1675
1676	/* If a full-sized TSO skb can be sent, do it. */
1677	if (limit >= min_t(unsigned int, sk->sk_gso_max_size,
1678			   tp->xmit_size_goal_segs * tp->mss_cache))
1679		goto send_now;
1680
1681	/* Middle in queue won't get any more data, full sendable already? */
1682	if ((skb != tcp_write_queue_tail(sk)) && (limit >= skb->len))
1683		goto send_now;
1684
1685	win_divisor = ACCESS_ONCE(sysctl_tcp_tso_win_divisor);
1686	if (win_divisor) {
1687		u32 chunk = min(tp->snd_wnd, tp->snd_cwnd * tp->mss_cache);
1688
1689		/* If at least some fraction of a window is available,
1690		 * just use it.
1691		 */
1692		chunk /= win_divisor;
1693		if (limit >= chunk)
1694			goto send_now;
1695	} else {
1696		/* Different approach, try not to defer past a single
1697		 * ACK.  Receiver should ACK every other full sized
1698		 * frame, so if we have space for more than 3 frames
1699		 * then send now.
1700		 */
1701		if (limit > tcp_max_tso_deferred_mss(tp) * tp->mss_cache)
1702			goto send_now;
1703	}
1704
1705	/* Ok, it looks like it is advisable to defer.
1706	 * Do not rearm the timer if already set to not break TCP ACK clocking.
1707	 */
1708	if (!tp->tso_deferred)
1709		tp->tso_deferred = 1 | (jiffies << 1);
 
 
 
 
 
 
 
 
1710
1711	return true;
1712
1713send_now:
1714	tp->tso_deferred = 0;
1715	return false;
1716}
1717
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1718/* Create a new MTU probe if we are ready.
1719 * MTU probe is regularly attempting to increase the path MTU by
1720 * deliberately sending larger packets.  This discovers routing
1721 * changes resulting in larger path MTUs.
1722 *
1723 * Returns 0 if we should wait to probe (no cwnd available),
1724 *         1 if a probe was sent,
1725 *         -1 otherwise
1726 */
1727static int tcp_mtu_probe(struct sock *sk)
1728{
1729	struct tcp_sock *tp = tcp_sk(sk);
1730	struct inet_connection_sock *icsk = inet_csk(sk);
 
1731	struct sk_buff *skb, *nskb, *next;
1732	int len;
1733	int probe_size;
1734	int size_needed;
1735	int copy;
1736	int mss_now;
 
1737
1738	/* Not currently probing/verifying,
1739	 * not in recovery,
1740	 * have enough cwnd, and
1741	 * not SACKing (the variable headers throw things off) */
1742	if (!icsk->icsk_mtup.enabled ||
1743	    icsk->icsk_mtup.probe_size ||
1744	    inet_csk(sk)->icsk_ca_state != TCP_CA_Open ||
1745	    tp->snd_cwnd < 11 ||
1746	    tp->rx_opt.num_sacks || tp->rx_opt.dsack)
 
1747		return -1;
1748
1749	/* Very simple search strategy: just double the MSS. */
 
 
 
1750	mss_now = tcp_current_mss(sk);
1751	probe_size = 2 * tp->mss_cache;
 
1752	size_needed = probe_size + (tp->reordering + 1) * tp->mss_cache;
1753	if (probe_size > tcp_mtu_to_mss(sk, icsk->icsk_mtup.search_high)) {
1754		/* TODO: set timer for probe_converge_event */
 
 
 
 
 
 
 
 
 
1755		return -1;
1756	}
1757
1758	/* Have enough data in the send queue to probe? */
1759	if (tp->write_seq - tp->snd_nxt < size_needed)
1760		return -1;
1761
1762	if (tp->snd_wnd < size_needed)
1763		return -1;
1764	if (after(tp->snd_nxt + size_needed, tcp_wnd_end(tp)))
1765		return 0;
1766
1767	/* Do we need to wait to drain cwnd? With none in flight, don't stall */
1768	if (tcp_packets_in_flight(tp) + 2 > tp->snd_cwnd) {
1769		if (!tcp_packets_in_flight(tp))
1770			return -1;
1771		else
1772			return 0;
1773	}
1774
 
 
 
1775	/* We're allowed to probe.  Build it now. */
1776	if ((nskb = sk_stream_alloc_skb(sk, probe_size, GFP_ATOMIC)) == NULL)
 
1777		return -1;
1778	sk->sk_wmem_queued += nskb->truesize;
1779	sk_mem_charge(sk, nskb->truesize);
1780
1781	skb = tcp_send_head(sk);
1782
1783	TCP_SKB_CB(nskb)->seq = TCP_SKB_CB(skb)->seq;
1784	TCP_SKB_CB(nskb)->end_seq = TCP_SKB_CB(skb)->seq + probe_size;
1785	TCP_SKB_CB(nskb)->tcp_flags = TCPHDR_ACK;
1786	TCP_SKB_CB(nskb)->sacked = 0;
1787	nskb->csum = 0;
1788	nskb->ip_summed = skb->ip_summed;
1789
1790	tcp_insert_write_queue_before(nskb, skb, sk);
 
1791
1792	len = 0;
1793	tcp_for_write_queue_from_safe(skb, next, sk) {
1794		copy = min_t(int, skb->len, probe_size - len);
1795		if (nskb->ip_summed)
1796			skb_copy_bits(skb, 0, skb_put(nskb, copy), copy);
1797		else
1798			nskb->csum = skb_copy_and_csum_bits(skb, 0,
1799							    skb_put(nskb, copy),
1800							    copy, nskb->csum);
1801
1802		if (skb->len <= copy) {
1803			/* We've eaten all the data from this skb.
1804			 * Throw it away. */
1805			TCP_SKB_CB(nskb)->tcp_flags |= TCP_SKB_CB(skb)->tcp_flags;
 
 
 
 
1806			tcp_unlink_write_queue(skb, sk);
1807			sk_wmem_free_skb(sk, skb);
1808		} else {
1809			TCP_SKB_CB(nskb)->tcp_flags |= TCP_SKB_CB(skb)->tcp_flags &
1810						   ~(TCPHDR_FIN|TCPHDR_PSH);
1811			if (!skb_shinfo(skb)->nr_frags) {
1812				skb_pull(skb, copy);
1813				if (skb->ip_summed != CHECKSUM_PARTIAL)
1814					skb->csum = csum_partial(skb->data,
1815								 skb->len, 0);
1816			} else {
1817				__pskb_trim_head(skb, copy);
1818				tcp_set_skb_tso_segs(sk, skb, mss_now);
1819			}
1820			TCP_SKB_CB(skb)->seq += copy;
1821		}
1822
1823		len += copy;
1824
1825		if (len >= probe_size)
1826			break;
1827	}
1828	tcp_init_tso_segs(sk, nskb, nskb->len);
1829
1830	/* We're ready to send.  If this fails, the probe will
1831	 * be resegmented into mss-sized pieces by tcp_write_xmit(). */
1832	TCP_SKB_CB(nskb)->when = tcp_time_stamp;
1833	if (!tcp_transmit_skb(sk, nskb, 1, GFP_ATOMIC)) {
1834		/* Decrement cwnd here because we are sending
1835		 * effectively two packets. */
1836		tp->snd_cwnd--;
1837		tcp_event_new_data_sent(sk, nskb);
1838
1839		icsk->icsk_mtup.probe_size = tcp_mss_to_mtu(sk, nskb->len);
1840		tp->mtu_probe.probe_seq_start = TCP_SKB_CB(nskb)->seq;
1841		tp->mtu_probe.probe_seq_end = TCP_SKB_CB(nskb)->end_seq;
1842
1843		return 1;
1844	}
1845
1846	return -1;
1847}
1848
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1849/* This routine writes packets to the network.  It advances the
1850 * send_head.  This happens as incoming acks open up the remote
1851 * window for us.
1852 *
1853 * LARGESEND note: !tcp_urg_mode is overkill, only frames between
1854 * snd_up-64k-mss .. snd_up cannot be large. However, taking into
1855 * account rare use of URG, this is not a big flaw.
1856 *
1857 * Send at most one packet when push_one > 0. Temporarily ignore
1858 * cwnd limit to force at most one packet out when push_one == 2.
1859
1860 * Returns true, if no segments are in flight and we have queued segments,
1861 * but cannot send anything now because of SWS or another problem.
1862 */
1863static bool tcp_write_xmit(struct sock *sk, unsigned int mss_now, int nonagle,
1864			   int push_one, gfp_t gfp)
1865{
1866	struct tcp_sock *tp = tcp_sk(sk);
1867	struct sk_buff *skb;
1868	unsigned int tso_segs, sent_pkts;
1869	int cwnd_quota;
1870	int result;
 
 
1871
1872	sent_pkts = 0;
1873
 
1874	if (!push_one) {
1875		/* Do MTU probing. */
1876		result = tcp_mtu_probe(sk);
1877		if (!result) {
1878			return false;
1879		} else if (result > 0) {
1880			sent_pkts = 1;
1881		}
1882	}
1883
 
1884	while ((skb = tcp_send_head(sk))) {
1885		unsigned int limit;
1886
1887		tso_segs = tcp_init_tso_segs(sk, skb, mss_now);
 
 
 
1888		BUG_ON(!tso_segs);
1889
1890		if (unlikely(tp->repair) && tp->repair_queue == TCP_SEND_QUEUE)
 
 
1891			goto repair; /* Skip network transmission */
 
1892
1893		cwnd_quota = tcp_cwnd_test(tp, skb);
1894		if (!cwnd_quota) {
1895			if (push_one == 2)
1896				/* Force out a loss probe pkt. */
1897				cwnd_quota = 1;
1898			else
1899				break;
1900		}
1901
1902		if (unlikely(!tcp_snd_wnd_test(tp, skb, mss_now)))
 
1903			break;
 
1904
1905		if (tso_segs == 1) {
1906			if (unlikely(!tcp_nagle_test(tp, skb, mss_now,
1907						     (tcp_skb_is_last(sk, skb) ?
1908						      nonagle : TCP_NAGLE_PUSH))))
1909				break;
1910		} else {
1911			if (!push_one && tcp_tso_should_defer(sk, skb))
1912				break;
1913		}
1914
1915		/* TCP Small Queues :
1916		 * Control number of packets in qdisc/devices to two packets / or ~1 ms.
1917		 * This allows for :
1918		 *  - better RTT estimation and ACK scheduling
1919		 *  - faster recovery
1920		 *  - high rates
1921		 * Alas, some drivers / subsystems require a fair amount
1922		 * of queued bytes to ensure line rate.
1923		 * One example is wifi aggregation (802.11 AMPDU)
1924		 */
1925		limit = max_t(unsigned int, sysctl_tcp_limit_output_bytes,
1926			      sk->sk_pacing_rate >> 10);
1927
1928		if (atomic_read(&sk->sk_wmem_alloc) > limit) {
1929			set_bit(TSQ_THROTTLED, &tp->tsq_flags);
1930			/* It is possible TX completion already happened
1931			 * before we set TSQ_THROTTLED, so we must
1932			 * test again the condition.
1933			 * We abuse smp_mb__after_clear_bit() because
1934			 * there is no smp_mb__after_set_bit() yet
1935			 */
1936			smp_mb__after_clear_bit();
1937			if (atomic_read(&sk->sk_wmem_alloc) > limit)
1938				break;
1939		}
1940
1941		limit = mss_now;
1942		if (tso_segs > 1 && !tcp_urg_mode(tp))
1943			limit = tcp_mss_split_point(sk, skb, mss_now,
1944						    min_t(unsigned int,
1945							  cwnd_quota,
1946							  sk->sk_gso_max_segs),
1947						    nonagle);
1948
1949		if (skb->len > limit &&
1950		    unlikely(tso_fragment(sk, skb, limit, mss_now, gfp)))
 
1951			break;
1952
1953		TCP_SKB_CB(skb)->when = tcp_time_stamp;
 
 
 
1954
1955		if (unlikely(tcp_transmit_skb(sk, skb, 1, gfp)))
1956			break;
1957
1958repair:
1959		/* Advance the send_head.  This one is sent out.
1960		 * This call will increment packets_out.
1961		 */
1962		tcp_event_new_data_sent(sk, skb);
1963
1964		tcp_minshall_update(tp, mss_now, skb);
1965		sent_pkts += tcp_skb_pcount(skb);
1966
1967		if (push_one)
1968			break;
1969	}
1970
 
 
 
 
 
1971	if (likely(sent_pkts)) {
1972		if (tcp_in_cwnd_reduction(sk))
1973			tp->prr_out += sent_pkts;
1974
1975		/* Send one loss probe per tail loss episode. */
1976		if (push_one != 2)
1977			tcp_schedule_loss_probe(sk);
1978		tcp_cwnd_validate(sk);
 
1979		return false;
1980	}
1981	return (push_one == 2) || (!tp->packets_out && tcp_send_head(sk));
1982}
1983
1984bool tcp_schedule_loss_probe(struct sock *sk)
1985{
1986	struct inet_connection_sock *icsk = inet_csk(sk);
1987	struct tcp_sock *tp = tcp_sk(sk);
1988	u32 timeout, tlp_time_stamp, rto_time_stamp;
1989	u32 rtt = usecs_to_jiffies(tp->srtt_us >> 3);
1990
1991	if (WARN_ON(icsk->icsk_pending == ICSK_TIME_EARLY_RETRANS))
1992		return false;
1993	/* No consecutive loss probes. */
1994	if (WARN_ON(icsk->icsk_pending == ICSK_TIME_LOSS_PROBE)) {
1995		tcp_rearm_rto(sk);
1996		return false;
1997	}
1998	/* Don't do any loss probe on a Fast Open connection before 3WHS
1999	 * finishes.
2000	 */
2001	if (sk->sk_state == TCP_SYN_RECV)
2002		return false;
2003
2004	/* TLP is only scheduled when next timer event is RTO. */
2005	if (icsk->icsk_pending != ICSK_TIME_RETRANS)
2006		return false;
2007
 
2008	/* Schedule a loss probe in 2*RTT for SACK capable connections
2009	 * in Open state, that are either limited by cwnd or application.
2010	 */
2011	if (sysctl_tcp_early_retrans < 3 || !tp->srtt_us || !tp->packets_out ||
2012	    !tcp_is_sack(tp) || inet_csk(sk)->icsk_ca_state != TCP_CA_Open)
2013		return false;
2014
2015	if ((tp->snd_cwnd > tcp_packets_in_flight(tp)) &&
2016	     tcp_send_head(sk))
2017		return false;
2018
2019	/* Probe timeout is at least 1.5*rtt + TCP_DELACK_MAX to account
2020	 * for delayed ack when there's one outstanding packet.
2021	 */
2022	timeout = rtt << 1;
2023	if (tp->packets_out == 1)
2024		timeout = max_t(u32, timeout,
2025				(rtt + (rtt >> 1) + TCP_DELACK_MAX));
2026	timeout = max_t(u32, timeout, msecs_to_jiffies(10));
2027
2028	/* If RTO is shorter, just schedule TLP in its place. */
2029	tlp_time_stamp = tcp_time_stamp + timeout;
2030	rto_time_stamp = (u32)inet_csk(sk)->icsk_timeout;
2031	if ((s32)(tlp_time_stamp - rto_time_stamp) > 0) {
2032		s32 delta = rto_time_stamp - tcp_time_stamp;
2033		if (delta > 0)
2034			timeout = delta;
2035	}
2036
 
 
 
 
 
 
 
2037	inet_csk_reset_xmit_timer(sk, ICSK_TIME_LOSS_PROBE, timeout,
2038				  TCP_RTO_MAX);
2039	return true;
2040}
2041
2042/* When probe timeout (PTO) fires, send a new segment if one exists, else
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
2043 * retransmit the last segment.
2044 */
2045void tcp_send_loss_probe(struct sock *sk)
2046{
2047	struct tcp_sock *tp = tcp_sk(sk);
2048	struct sk_buff *skb;
2049	int pcount;
2050	int mss = tcp_current_mss(sk);
2051	int err = -1;
2052
2053	if (tcp_send_head(sk) != NULL) {
2054		err = tcp_write_xmit(sk, mss, TCP_NAGLE_OFF, 2, GFP_ATOMIC);
 
 
 
 
2055		goto rearm_timer;
2056	}
 
2057
2058	/* At most one outstanding TLP retransmission. */
2059	if (tp->tlp_high_seq)
2060		goto rearm_timer;
2061
2062	/* Retransmit last segment. */
2063	skb = tcp_write_queue_tail(sk);
2064	if (WARN_ON(!skb))
2065		goto rearm_timer;
2066
 
 
 
2067	pcount = tcp_skb_pcount(skb);
2068	if (WARN_ON(!pcount))
2069		goto rearm_timer;
2070
2071	if ((pcount > 1) && (skb->len > (pcount - 1) * mss)) {
2072		if (unlikely(tcp_fragment(sk, skb, (pcount - 1) * mss, mss)))
 
 
2073			goto rearm_timer;
2074		skb = tcp_write_queue_tail(sk);
2075	}
2076
2077	if (WARN_ON(!skb || !tcp_skb_pcount(skb)))
2078		goto rearm_timer;
2079
2080	/* Probe with zero data doesn't trigger fast recovery. */
2081	if (skb->len > 0)
2082		err = __tcp_retransmit_skb(sk, skb);
2083
2084	/* Record snd_nxt for loss detection. */
2085	if (likely(!err))
2086		tp->tlp_high_seq = tp->snd_nxt;
2087
 
 
 
 
2088rearm_timer:
2089	inet_csk_reset_xmit_timer(sk, ICSK_TIME_RETRANS,
2090				  inet_csk(sk)->icsk_rto,
2091				  TCP_RTO_MAX);
2092
2093	if (likely(!err))
2094		NET_INC_STATS_BH(sock_net(sk),
2095				 LINUX_MIB_TCPLOSSPROBES);
2096}
2097
2098/* Push out any pending frames which were held back due to
2099 * TCP_CORK or attempt at coalescing tiny packets.
2100 * The socket must be locked by the caller.
2101 */
2102void __tcp_push_pending_frames(struct sock *sk, unsigned int cur_mss,
2103			       int nonagle)
2104{
2105	/* If we are closed, the bytes will have to remain here.
2106	 * In time closedown will finish, we empty the write queue and
2107	 * all will be happy.
2108	 */
2109	if (unlikely(sk->sk_state == TCP_CLOSE))
2110		return;
2111
2112	if (tcp_write_xmit(sk, cur_mss, nonagle, 0,
2113			   sk_gfp_atomic(sk, GFP_ATOMIC)))
2114		tcp_check_probe_timer(sk);
2115}
2116
2117/* Send _single_ skb sitting at the send head. This function requires
2118 * true push pending frames to setup probe timer etc.
2119 */
2120void tcp_push_one(struct sock *sk, unsigned int mss_now)
2121{
2122	struct sk_buff *skb = tcp_send_head(sk);
2123
2124	BUG_ON(!skb || skb->len < mss_now);
2125
2126	tcp_write_xmit(sk, mss_now, TCP_NAGLE_PUSH, 1, sk->sk_allocation);
2127}
2128
2129/* This function returns the amount that we can raise the
2130 * usable window based on the following constraints
2131 *
2132 * 1. The window can never be shrunk once it is offered (RFC 793)
2133 * 2. We limit memory per socket
2134 *
2135 * RFC 1122:
2136 * "the suggested [SWS] avoidance algorithm for the receiver is to keep
2137 *  RECV.NEXT + RCV.WIN fixed until:
2138 *  RCV.BUFF - RCV.USER - RCV.WINDOW >= min(1/2 RCV.BUFF, MSS)"
2139 *
2140 * i.e. don't raise the right edge of the window until you can raise
2141 * it at least MSS bytes.
2142 *
2143 * Unfortunately, the recommended algorithm breaks header prediction,
2144 * since header prediction assumes th->window stays fixed.
2145 *
2146 * Strictly speaking, keeping th->window fixed violates the receiver
2147 * side SWS prevention criteria. The problem is that under this rule
2148 * a stream of single byte packets will cause the right side of the
2149 * window to always advance by a single byte.
2150 *
2151 * Of course, if the sender implements sender side SWS prevention
2152 * then this will not be a problem.
2153 *
2154 * BSD seems to make the following compromise:
2155 *
2156 *	If the free space is less than the 1/4 of the maximum
2157 *	space available and the free space is less than 1/2 mss,
2158 *	then set the window to 0.
2159 *	[ Actually, bsd uses MSS and 1/4 of maximal _window_ ]
2160 *	Otherwise, just prevent the window from shrinking
2161 *	and from being larger than the largest representable value.
2162 *
2163 * This prevents incremental opening of the window in the regime
2164 * where TCP is limited by the speed of the reader side taking
2165 * data out of the TCP receive queue. It does nothing about
2166 * those cases where the window is constrained on the sender side
2167 * because the pipeline is full.
2168 *
2169 * BSD also seems to "accidentally" limit itself to windows that are a
2170 * multiple of MSS, at least until the free space gets quite small.
2171 * This would appear to be a side effect of the mbuf implementation.
2172 * Combining these two algorithms results in the observed behavior
2173 * of having a fixed window size at almost all times.
2174 *
2175 * Below we obtain similar behavior by forcing the offered window to
2176 * a multiple of the mss when it is feasible to do so.
2177 *
2178 * Note, we don't "adjust" for TIMESTAMP or SACK option bytes.
2179 * Regular options like TIMESTAMP are taken into account.
2180 */
2181u32 __tcp_select_window(struct sock *sk)
2182{
2183	struct inet_connection_sock *icsk = inet_csk(sk);
2184	struct tcp_sock *tp = tcp_sk(sk);
2185	/* MSS for the peer's data.  Previous versions used mss_clamp
2186	 * here.  I don't know if the value based on our guesses
2187	 * of peer's MSS is better for the performance.  It's more correct
2188	 * but may be worse for the performance because of rcv_mss
2189	 * fluctuations.  --SAW  1998/11/1
2190	 */
2191	int mss = icsk->icsk_ack.rcv_mss;
2192	int free_space = tcp_space(sk);
2193	int allowed_space = tcp_full_space(sk);
2194	int full_space = min_t(int, tp->window_clamp, allowed_space);
2195	int window;
2196
2197	if (mss > full_space)
2198		mss = full_space;
2199
 
 
2200	if (free_space < (full_space >> 1)) {
2201		icsk->icsk_ack.quick = 0;
2202
2203		if (sk_under_memory_pressure(sk))
2204			tp->rcv_ssthresh = min(tp->rcv_ssthresh,
2205					       4U * tp->advmss);
2206
2207		/* free_space might become our new window, make sure we don't
2208		 * increase it due to wscale.
2209		 */
2210		free_space = round_down(free_space, 1 << tp->rx_opt.rcv_wscale);
2211
2212		/* if free space is less than mss estimate, or is below 1/16th
2213		 * of the maximum allowed, try to move to zero-window, else
2214		 * tcp_clamp_window() will grow rcv buf up to tcp_rmem[2], and
2215		 * new incoming data is dropped due to memory limits.
2216		 * With large window, mss test triggers way too late in order
2217		 * to announce zero window in time before rmem limit kicks in.
2218		 */
2219		if (free_space < (allowed_space >> 4) || free_space < mss)
2220			return 0;
2221	}
2222
2223	if (free_space > tp->rcv_ssthresh)
2224		free_space = tp->rcv_ssthresh;
2225
2226	/* Don't do rounding if we are using window scaling, since the
2227	 * scaled window will not line up with the MSS boundary anyway.
2228	 */
2229	window = tp->rcv_wnd;
2230	if (tp->rx_opt.rcv_wscale) {
2231		window = free_space;
2232
2233		/* Advertise enough space so that it won't get scaled away.
2234		 * Import case: prevent zero window announcement if
2235		 * 1<<rcv_wscale > mss.
2236		 */
2237		if (((window >> tp->rx_opt.rcv_wscale) << tp->rx_opt.rcv_wscale) != window)
2238			window = (((window >> tp->rx_opt.rcv_wscale) + 1)
2239				  << tp->rx_opt.rcv_wscale);
2240	} else {
 
2241		/* Get the largest window that is a nice multiple of mss.
2242		 * Window clamp already applied above.
2243		 * If our current window offering is within 1 mss of the
2244		 * free space we just keep it. This prevents the divide
2245		 * and multiply from happening most of the time.
2246		 * We also don't do any window rounding when the free space
2247		 * is too small.
2248		 */
2249		if (window <= free_space - mss || window > free_space)
2250			window = (free_space / mss) * mss;
2251		else if (mss == full_space &&
2252			 free_space > window + (full_space >> 1))
2253			window = free_space;
2254	}
2255
2256	return window;
2257}
2258
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
2259/* Collapses two adjacent SKB's during retransmission. */
2260static void tcp_collapse_retrans(struct sock *sk, struct sk_buff *skb)
2261{
2262	struct tcp_sock *tp = tcp_sk(sk);
2263	struct sk_buff *next_skb = tcp_write_queue_next(sk, skb);
2264	int skb_size, next_skb_size;
2265
2266	skb_size = skb->len;
2267	next_skb_size = next_skb->len;
2268
2269	BUG_ON(tcp_skb_pcount(skb) != 1 || tcp_skb_pcount(next_skb) != 1);
2270
2271	tcp_highest_sack_combine(sk, next_skb, skb);
2272
2273	tcp_unlink_write_queue(next_skb, sk);
2274
2275	skb_copy_from_linear_data(next_skb, skb_put(skb, next_skb_size),
2276				  next_skb_size);
2277
2278	if (next_skb->ip_summed == CHECKSUM_PARTIAL)
2279		skb->ip_summed = CHECKSUM_PARTIAL;
2280
2281	if (skb->ip_summed != CHECKSUM_PARTIAL)
2282		skb->csum = csum_block_add(skb->csum, next_skb->csum, skb_size);
2283
2284	/* Update sequence range on original skb. */
2285	TCP_SKB_CB(skb)->end_seq = TCP_SKB_CB(next_skb)->end_seq;
2286
2287	/* Merge over control information. This moves PSH/FIN etc. over */
2288	TCP_SKB_CB(skb)->tcp_flags |= TCP_SKB_CB(next_skb)->tcp_flags;
2289
2290	/* All done, get rid of second SKB and account for it so
2291	 * packet counting does not break.
2292	 */
2293	TCP_SKB_CB(skb)->sacked |= TCP_SKB_CB(next_skb)->sacked & TCPCB_EVER_RETRANS;
 
2294
2295	/* changed transmit queue under us so clear hints */
2296	tcp_clear_retrans_hints_partial(tp);
2297	if (next_skb == tp->retransmit_skb_hint)
2298		tp->retransmit_skb_hint = skb;
2299
2300	tcp_adjust_pcount(sk, next_skb, tcp_skb_pcount(next_skb));
2301
2302	sk_wmem_free_skb(sk, next_skb);
 
 
 
2303}
2304
2305/* Check if coalescing SKBs is legal. */
2306static bool tcp_can_collapse(const struct sock *sk, const struct sk_buff *skb)
2307{
2308	if (tcp_skb_pcount(skb) > 1)
2309		return false;
2310	/* TODO: SACK collapsing could be used to remove this condition */
2311	if (skb_shinfo(skb)->nr_frags != 0)
2312		return false;
2313	if (skb_cloned(skb))
2314		return false;
2315	if (skb == tcp_send_head(sk))
2316		return false;
2317	/* Some heurestics for collapsing over SACK'd could be invented */
2318	if (TCP_SKB_CB(skb)->sacked & TCPCB_SACKED_ACKED)
2319		return false;
2320
2321	return true;
2322}
2323
2324/* Collapse packets in the retransmit queue to make to create
2325 * less packets on the wire. This is only done on retransmission.
2326 */
2327static void tcp_retrans_try_collapse(struct sock *sk, struct sk_buff *to,
2328				     int space)
2329{
2330	struct tcp_sock *tp = tcp_sk(sk);
2331	struct sk_buff *skb = to, *tmp;
2332	bool first = true;
2333
2334	if (!sysctl_tcp_retrans_collapse)
2335		return;
2336	if (TCP_SKB_CB(skb)->tcp_flags & TCPHDR_SYN)
2337		return;
2338
2339	tcp_for_write_queue_from_safe(skb, tmp, sk) {
2340		if (!tcp_can_collapse(sk, skb))
2341			break;
2342
 
 
 
2343		space -= skb->len;
2344
2345		if (first) {
2346			first = false;
2347			continue;
2348		}
2349
2350		if (space < 0)
2351			break;
2352		/* Punt if not enough space exists in the first SKB for
2353		 * the data in the second
2354		 */
2355		if (skb->len > skb_availroom(to))
2356			break;
2357
2358		if (after(TCP_SKB_CB(skb)->end_seq, tcp_wnd_end(tp)))
2359			break;
2360
2361		tcp_collapse_retrans(sk, to);
 
2362	}
2363}
2364
2365/* This retransmits one SKB.  Policy decisions and retransmit queue
2366 * state updates are done by the caller.  Returns non-zero if an
2367 * error occurred which prevented the send.
2368 */
2369int __tcp_retransmit_skb(struct sock *sk, struct sk_buff *skb)
2370{
2371	struct tcp_sock *tp = tcp_sk(sk);
2372	struct inet_connection_sock *icsk = inet_csk(sk);
 
2373	unsigned int cur_mss;
2374	int err;
2375
2376	/* Inconslusive MTU probe */
2377	if (icsk->icsk_mtup.probe_size) {
 
2378		icsk->icsk_mtup.probe_size = 0;
2379	}
2380
2381	/* Do not sent more than we queued. 1/4 is reserved for possible
2382	 * copying overhead: fragmentation, tunneling, mangling etc.
2383	 */
2384	if (atomic_read(&sk->sk_wmem_alloc) >
2385	    min(sk->sk_wmem_queued + (sk->sk_wmem_queued >> 2), sk->sk_sndbuf))
 
2386		return -EAGAIN;
2387
 
 
 
2388	if (before(TCP_SKB_CB(skb)->seq, tp->snd_una)) {
2389		if (before(TCP_SKB_CB(skb)->end_seq, tp->snd_una))
2390			BUG();
 
 
2391		if (tcp_trim_head(sk, skb, tp->snd_una - TCP_SKB_CB(skb)->seq))
2392			return -ENOMEM;
2393	}
2394
2395	if (inet_csk(sk)->icsk_af_ops->rebuild_header(sk))
2396		return -EHOSTUNREACH; /* Routing failure or similar. */
2397
2398	cur_mss = tcp_current_mss(sk);
2399
2400	/* If receiver has shrunk his window, and skb is out of
2401	 * new window, do not retransmit it. The exception is the
2402	 * case, when window is shrunk to zero. In this case
2403	 * our retransmit serves as a zero window probe.
2404	 */
2405	if (!before(TCP_SKB_CB(skb)->seq, tcp_wnd_end(tp)) &&
2406	    TCP_SKB_CB(skb)->seq != tp->snd_una)
2407		return -EAGAIN;
2408
2409	if (skb->len > cur_mss) {
2410		if (tcp_fragment(sk, skb, cur_mss, cur_mss))
 
 
2411			return -ENOMEM; /* We'll try again later. */
2412	} else {
2413		int oldpcount = tcp_skb_pcount(skb);
 
2414
2415		if (unlikely(oldpcount > 1)) {
2416			if (skb_unclone(skb, GFP_ATOMIC))
2417				return -ENOMEM;
2418			tcp_init_tso_segs(sk, skb, cur_mss);
2419			tcp_adjust_pcount(sk, skb, oldpcount - tcp_skb_pcount(skb));
2420		}
 
2421	}
2422
2423	tcp_retrans_try_collapse(sk, skb, cur_mss);
 
 
2424
2425	/* Make a copy, if the first transmission SKB clone we made
2426	 * is still in somebody's hands, else make a clone.
2427	 */
2428	TCP_SKB_CB(skb)->when = tcp_time_stamp;
 
 
2429
2430	/* make sure skb->data is aligned on arches that require it
2431	 * and check if ack-trimming & collapsing extended the headroom
2432	 * beyond what csum_start can cover.
2433	 */
2434	if (unlikely((NET_IP_ALIGN && ((unsigned long)skb->data & 3)) ||
2435		     skb_headroom(skb) >= 0xFFFF)) {
2436		struct sk_buff *nskb = __pskb_copy(skb, MAX_TCP_HEADER,
2437						   GFP_ATOMIC);
2438		err = nskb ? tcp_transmit_skb(sk, nskb, 0, GFP_ATOMIC) :
2439			     -ENOBUFS;
 
 
 
 
 
 
 
 
2440	} else {
2441		err = tcp_transmit_skb(sk, skb, 1, GFP_ATOMIC);
2442	}
2443
 
 
 
 
2444	if (likely(!err)) {
2445		TCP_SKB_CB(skb)->sacked |= TCPCB_EVER_RETRANS;
2446		/* Update global TCP statistics. */
2447		TCP_INC_STATS(sock_net(sk), TCP_MIB_RETRANSSEGS);
2448		if (TCP_SKB_CB(skb)->tcp_flags & TCPHDR_SYN)
2449			NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPSYNRETRANS);
2450		tp->total_retrans++;
2451	}
2452	return err;
2453}
2454
2455int tcp_retransmit_skb(struct sock *sk, struct sk_buff *skb)
2456{
2457	struct tcp_sock *tp = tcp_sk(sk);
2458	int err = __tcp_retransmit_skb(sk, skb);
2459
2460	if (err == 0) {
2461#if FASTRETRANS_DEBUG > 0
2462		if (TCP_SKB_CB(skb)->sacked & TCPCB_SACKED_RETRANS) {
2463			net_dbg_ratelimited("retrans_out leaked\n");
2464		}
2465#endif
2466		if (!tp->retrans_out)
2467			tp->lost_retrans_low = tp->snd_nxt;
2468		TCP_SKB_CB(skb)->sacked |= TCPCB_RETRANS;
2469		tp->retrans_out += tcp_skb_pcount(skb);
2470
2471		/* Save stamp of the first retransmit. */
2472		if (!tp->retrans_stamp)
2473			tp->retrans_stamp = TCP_SKB_CB(skb)->when;
2474
2475		tp->undo_retrans += tcp_skb_pcount(skb);
2476
2477		/* snd_nxt is stored to detect loss of retransmitted segment,
2478		 * see tcp_input.c tcp_sacktag_write_queue().
2479		 */
2480		TCP_SKB_CB(skb)->ack_seq = tp->snd_nxt;
2481	} else {
2482		NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPRETRANSFAIL);
2483	}
2484	return err;
2485}
2486
2487/* Check if we forward retransmits are possible in the current
2488 * window/congestion state.
2489 */
2490static bool tcp_can_forward_retransmit(struct sock *sk)
2491{
2492	const struct inet_connection_sock *icsk = inet_csk(sk);
2493	const struct tcp_sock *tp = tcp_sk(sk);
2494
2495	/* Forward retransmissions are possible only during Recovery. */
2496	if (icsk->icsk_ca_state != TCP_CA_Recovery)
2497		return false;
2498
2499	/* No forward retransmissions in Reno are possible. */
2500	if (tcp_is_reno(tp))
2501		return false;
2502
2503	/* Yeah, we have to make difficult choice between forward transmission
2504	 * and retransmission... Both ways have their merits...
2505	 *
2506	 * For now we do not retransmit anything, while we have some new
2507	 * segments to send. In the other cases, follow rule 3 for
2508	 * NextSeg() specified in RFC3517.
2509	 */
2510
2511	if (tcp_may_send_now(sk))
2512		return false;
2513
2514	return true;
2515}
2516
2517/* This gets called after a retransmit timeout, and the initially
2518 * retransmitted data is acknowledged.  It tries to continue
2519 * resending the rest of the retransmit queue, until either
2520 * we've sent it all or the congestion window limit is reached.
2521 * If doing SACK, the first ACK which comes back for a timeout
2522 * based retransmit packet might feed us FACK information again.
2523 * If so, we use it to avoid unnecessarily retransmissions.
2524 */
2525void tcp_xmit_retransmit_queue(struct sock *sk)
2526{
2527	const struct inet_connection_sock *icsk = inet_csk(sk);
 
2528	struct tcp_sock *tp = tcp_sk(sk);
2529	struct sk_buff *skb;
2530	struct sk_buff *hole = NULL;
2531	u32 last_lost;
2532	int mib_idx;
2533	int fwd_rexmitting = 0;
2534
2535	if (!tp->packets_out)
2536		return;
2537
2538	if (!tp->lost_out)
2539		tp->retransmit_high = tp->snd_una;
2540
2541	if (tp->retransmit_skb_hint) {
2542		skb = tp->retransmit_skb_hint;
2543		last_lost = TCP_SKB_CB(skb)->end_seq;
2544		if (after(last_lost, tp->retransmit_high))
2545			last_lost = tp->retransmit_high;
2546	} else {
2547		skb = tcp_write_queue_head(sk);
2548		last_lost = tp->snd_una;
2549	}
2550
2551	tcp_for_write_queue_from(skb, sk) {
2552		__u8 sacked = TCP_SKB_CB(skb)->sacked;
2553
2554		if (skb == tcp_send_head(sk))
2555			break;
 
2556		/* we could do better than to assign each time */
2557		if (hole == NULL)
2558			tp->retransmit_skb_hint = skb;
2559
2560		/* Assume this retransmit will generate
2561		 * only one packet for congestion window
2562		 * calculation purposes.  This works because
2563		 * tcp_retransmit_skb() will chop up the
2564		 * packet to be MSS sized and all the
2565		 * packet counting works out.
2566		 */
2567		if (tcp_packets_in_flight(tp) >= tp->snd_cwnd)
2568			return;
 
 
 
 
 
2569
2570		if (fwd_rexmitting) {
2571begin_fwd:
2572			if (!before(TCP_SKB_CB(skb)->seq, tcp_highest_sack_seq(tp)))
2573				break;
2574			mib_idx = LINUX_MIB_TCPFORWARDRETRANS;
2575
2576		} else if (!before(TCP_SKB_CB(skb)->seq, tp->retransmit_high)) {
2577			tp->retransmit_high = last_lost;
2578			if (!tcp_can_forward_retransmit(sk))
2579				break;
2580			/* Backtrack if necessary to non-L'ed skb */
2581			if (hole != NULL) {
2582				skb = hole;
2583				hole = NULL;
2584			}
2585			fwd_rexmitting = 1;
2586			goto begin_fwd;
2587
2588		} else if (!(sacked & TCPCB_LOST)) {
2589			if (hole == NULL && !(sacked & (TCPCB_SACKED_RETRANS|TCPCB_SACKED_ACKED)))
2590				hole = skb;
2591			continue;
2592
2593		} else {
2594			last_lost = TCP_SKB_CB(skb)->end_seq;
2595			if (icsk->icsk_ca_state != TCP_CA_Loss)
2596				mib_idx = LINUX_MIB_TCPFASTRETRANS;
2597			else
2598				mib_idx = LINUX_MIB_TCPSLOWSTARTRETRANS;
2599		}
2600
2601		if (sacked & (TCPCB_SACKED_ACKED|TCPCB_SACKED_RETRANS))
2602			continue;
2603
2604		if (tcp_retransmit_skb(sk, skb))
 
 
 
2605			return;
2606
2607		NET_INC_STATS_BH(sock_net(sk), mib_idx);
2608
2609		if (tcp_in_cwnd_reduction(sk))
2610			tp->prr_out += tcp_skb_pcount(skb);
2611
2612		if (skb == tcp_write_queue_head(sk))
 
2613			inet_csk_reset_xmit_timer(sk, ICSK_TIME_RETRANS,
2614						  inet_csk(sk)->icsk_rto,
2615						  TCP_RTO_MAX);
2616	}
2617}
2618
2619/* Send a fin.  The caller locks the socket for us.  This cannot be
2620 * allowed to fail queueing a FIN frame under any circumstances.
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
2621 */
2622void tcp_send_fin(struct sock *sk)
2623{
 
2624	struct tcp_sock *tp = tcp_sk(sk);
2625	struct sk_buff *skb = tcp_write_queue_tail(sk);
2626	int mss_now;
2627
2628	/* Optimization, tack on the FIN if we have a queue of
2629	 * unsent frames.  But be careful about outgoing SACKS
2630	 * and IP options.
 
2631	 */
2632	mss_now = tcp_current_mss(sk);
 
2633
2634	if (tcp_send_head(sk) != NULL) {
2635		TCP_SKB_CB(skb)->tcp_flags |= TCPHDR_FIN;
2636		TCP_SKB_CB(skb)->end_seq++;
 
2637		tp->write_seq++;
 
 
 
 
 
 
 
 
 
 
2638	} else {
2639		/* Socket is locked, keep trying until memory is available. */
2640		for (;;) {
2641			skb = alloc_skb_fclone(MAX_TCP_HEADER,
2642					       sk->sk_allocation);
2643			if (skb)
2644				break;
2645			yield();
2646		}
2647
2648		/* Reserve space for headers and prepare control bits. */
2649		skb_reserve(skb, MAX_TCP_HEADER);
 
2650		/* FIN eats a sequence byte, write_seq advanced by tcp_queue_skb(). */
2651		tcp_init_nondata_skb(skb, tp->write_seq,
2652				     TCPHDR_ACK | TCPHDR_FIN);
2653		tcp_queue_skb(sk, skb);
2654	}
2655	__tcp_push_pending_frames(sk, mss_now, TCP_NAGLE_OFF);
2656}
2657
2658/* We get here when a process closes a file descriptor (either due to
2659 * an explicit close() or as a byproduct of exit()'ing) and there
2660 * was unread data in the receive queue.  This behavior is recommended
2661 * by RFC 2525, section 2.17.  -DaveM
2662 */
2663void tcp_send_active_reset(struct sock *sk, gfp_t priority)
2664{
2665	struct sk_buff *skb;
2666
 
 
2667	/* NOTE: No TCP options attached and we never retransmit this. */
2668	skb = alloc_skb(MAX_TCP_HEADER, priority);
2669	if (!skb) {
2670		NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPABORTFAILED);
2671		return;
2672	}
2673
2674	/* Reserve space for headers and prepare control bits. */
2675	skb_reserve(skb, MAX_TCP_HEADER);
2676	tcp_init_nondata_skb(skb, tcp_acceptable_seq(sk),
2677			     TCPHDR_ACK | TCPHDR_RST);
 
2678	/* Send it off. */
2679	TCP_SKB_CB(skb)->when = tcp_time_stamp;
2680	if (tcp_transmit_skb(sk, skb, 0, priority))
2681		NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPABORTFAILED);
2682
2683	TCP_INC_STATS(sock_net(sk), TCP_MIB_OUTRSTS);
 
 
 
2684}
2685
2686/* Send a crossed SYN-ACK during socket establishment.
2687 * WARNING: This routine must only be called when we have already sent
2688 * a SYN packet that crossed the incoming SYN that caused this routine
2689 * to get called. If this assumption fails then the initial rcv_wnd
2690 * and rcv_wscale values will not be correct.
2691 */
2692int tcp_send_synack(struct sock *sk)
2693{
2694	struct sk_buff *skb;
2695
2696	skb = tcp_write_queue_head(sk);
2697	if (skb == NULL || !(TCP_SKB_CB(skb)->tcp_flags & TCPHDR_SYN)) {
2698		pr_debug("%s: wrong queue state\n", __func__);
2699		return -EFAULT;
2700	}
2701	if (!(TCP_SKB_CB(skb)->tcp_flags & TCPHDR_ACK)) {
2702		if (skb_cloned(skb)) {
2703			struct sk_buff *nskb = skb_copy(skb, GFP_ATOMIC);
2704			if (nskb == NULL)
 
 
 
 
2705				return -ENOMEM;
2706			tcp_unlink_write_queue(skb, sk);
2707			skb_header_release(nskb);
2708			__tcp_add_write_queue_head(sk, nskb);
2709			sk_wmem_free_skb(sk, skb);
2710			sk->sk_wmem_queued += nskb->truesize;
2711			sk_mem_charge(sk, nskb->truesize);
2712			skb = nskb;
2713		}
2714
2715		TCP_SKB_CB(skb)->tcp_flags |= TCPHDR_ACK;
2716		TCP_ECN_send_synack(tcp_sk(sk), skb);
2717	}
2718	TCP_SKB_CB(skb)->when = tcp_time_stamp;
2719	return tcp_transmit_skb(sk, skb, 1, GFP_ATOMIC);
2720}
2721
2722/**
2723 * tcp_make_synack - Prepare a SYN-ACK.
2724 * sk: listener socket
2725 * dst: dst entry attached to the SYNACK
2726 * req: request_sock pointer
2727 *
2728 * Allocate one skb and build a SYNACK packet.
2729 * @dst is consumed : Caller should not use it again.
2730 */
2731struct sk_buff *tcp_make_synack(struct sock *sk, struct dst_entry *dst,
2732				struct request_sock *req,
2733				struct tcp_fastopen_cookie *foc)
 
2734{
2735	struct tcp_out_options opts;
2736	struct inet_request_sock *ireq = inet_rsk(req);
2737	struct tcp_sock *tp = tcp_sk(sk);
2738	struct tcphdr *th;
 
2739	struct sk_buff *skb;
2740	struct tcp_md5sig_key *md5;
2741	int tcp_header_size;
 
2742	int mss;
2743
2744	skb = sock_wmalloc(sk, MAX_TCP_HEADER, 1, GFP_ATOMIC);
2745	if (unlikely(!skb)) {
2746		dst_release(dst);
2747		return NULL;
2748	}
2749	/* Reserve space for headers. */
2750	skb_reserve(skb, MAX_TCP_HEADER);
2751
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
2752	skb_dst_set(skb, dst);
2753	security_skb_owned_by(skb, sk);
2754
2755	mss = dst_metric_advmss(dst);
2756	if (tp->rx_opt.user_mss && tp->rx_opt.user_mss < mss)
2757		mss = tp->rx_opt.user_mss;
2758
2759	if (req->rcv_wnd == 0) { /* ignored for retransmitted syns */
2760		__u8 rcv_wscale;
2761		/* Set this up on the first call only */
2762		req->window_clamp = tp->window_clamp ? : dst_metric(dst, RTAX_WINDOW);
2763
2764		/* limit the window selection if the user enforce a smaller rx buffer */
2765		if (sk->sk_userlocks & SOCK_RCVBUF_LOCK &&
2766		    (req->window_clamp > tcp_full_space(sk) || req->window_clamp == 0))
2767			req->window_clamp = tcp_full_space(sk);
2768
2769		/* tcp_full_space because it is guaranteed to be the first packet */
2770		tcp_select_initial_window(tcp_full_space(sk),
2771			mss - (ireq->tstamp_ok ? TCPOLEN_TSTAMP_ALIGNED : 0),
2772			&req->rcv_wnd,
2773			&req->window_clamp,
2774			ireq->wscale_ok,
2775			&rcv_wscale,
2776			dst_metric(dst, RTAX_INITRWND));
2777		ireq->rcv_wscale = rcv_wscale;
2778	}
2779
2780	memset(&opts, 0, sizeof(opts));
2781#ifdef CONFIG_SYN_COOKIES
2782	if (unlikely(req->cookie_ts))
2783		TCP_SKB_CB(skb)->when = cookie_init_timestamp(req);
2784	else
2785#endif
2786	TCP_SKB_CB(skb)->when = tcp_time_stamp;
2787	tcp_header_size = tcp_synack_options(sk, req, mss, skb, &opts, &md5,
 
 
 
 
 
 
2788					     foc) + sizeof(*th);
2789
2790	skb_push(skb, tcp_header_size);
2791	skb_reset_transport_header(skb);
2792
2793	th = tcp_hdr(skb);
2794	memset(th, 0, sizeof(struct tcphdr));
2795	th->syn = 1;
2796	th->ack = 1;
2797	TCP_ECN_make_synack(req, th);
2798	th->source = htons(ireq->ir_num);
2799	th->dest = ireq->ir_rmt_port;
2800	/* Setting of flags are superfluous here for callers (and ECE is
2801	 * not even correctly set)
2802	 */
2803	tcp_init_nondata_skb(skb, tcp_rsk(req)->snt_isn,
2804			     TCPHDR_SYN | TCPHDR_ACK);
2805
2806	th->seq = htonl(TCP_SKB_CB(skb)->seq);
2807	/* XXX data is queued and acked as is. No buffer/window check */
2808	th->ack_seq = htonl(tcp_rsk(req)->rcv_nxt);
2809
2810	/* RFC1323: The window in SYN & SYN/ACK segments is never scaled. */
2811	th->window = htons(min(req->rcv_wnd, 65535U));
2812	tcp_options_write((__be32 *)(th + 1), tp, &opts);
2813	th->doff = (tcp_header_size >> 2);
2814	TCP_INC_STATS_BH(sock_net(sk), TCP_MIB_OUTSEGS);
2815
2816#ifdef CONFIG_TCP_MD5SIG
2817	/* Okay, we have all we need - do the md5 hash if needed */
2818	if (md5) {
2819		tcp_rsk(req)->af_specific->calc_md5_hash(opts.hash_location,
2820					       md5, NULL, req, skb);
2821	}
2822#endif
2823
 
 
2824	return skb;
2825}
2826EXPORT_SYMBOL(tcp_make_synack);
2827
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
2828/* Do all connect socket setups that can be done AF independent. */
2829static void tcp_connect_init(struct sock *sk)
2830{
2831	const struct dst_entry *dst = __sk_dst_get(sk);
2832	struct tcp_sock *tp = tcp_sk(sk);
2833	__u8 rcv_wscale;
 
2834
2835	/* We'll fix this up when we get a response from the other end.
2836	 * See tcp_input.c:tcp_rcv_state_process case TCP_SYN_SENT.
2837	 */
2838	tp->tcp_header_len = sizeof(struct tcphdr) +
2839		(sysctl_tcp_timestamps ? TCPOLEN_TSTAMP_ALIGNED : 0);
 
2840
2841#ifdef CONFIG_TCP_MD5SIG
2842	if (tp->af_specific->md5_lookup(sk, sk) != NULL)
2843		tp->tcp_header_len += TCPOLEN_MD5SIG_ALIGNED;
2844#endif
2845
2846	/* If user gave his TCP_MAXSEG, record it to clamp */
2847	if (tp->rx_opt.user_mss)
2848		tp->rx_opt.mss_clamp = tp->rx_opt.user_mss;
2849	tp->max_window = 0;
2850	tcp_mtup_init(sk);
2851	tcp_sync_mss(sk, dst_mtu(dst));
2852
 
 
2853	if (!tp->window_clamp)
2854		tp->window_clamp = dst_metric(dst, RTAX_WINDOW);
2855	tp->advmss = dst_metric_advmss(dst);
2856	if (tp->rx_opt.user_mss && tp->rx_opt.user_mss < tp->advmss)
2857		tp->advmss = tp->rx_opt.user_mss;
2858
2859	tcp_initialize_rcv_mss(sk);
2860
2861	/* limit the window selection if the user enforce a smaller rx buffer */
2862	if (sk->sk_userlocks & SOCK_RCVBUF_LOCK &&
2863	    (tp->window_clamp > tcp_full_space(sk) || tp->window_clamp == 0))
2864		tp->window_clamp = tcp_full_space(sk);
2865
2866	tcp_select_initial_window(tcp_full_space(sk),
 
 
 
 
2867				  tp->advmss - (tp->rx_opt.ts_recent_stamp ? tp->tcp_header_len - sizeof(struct tcphdr) : 0),
2868				  &tp->rcv_wnd,
2869				  &tp->window_clamp,
2870				  sysctl_tcp_window_scaling,
2871				  &rcv_wscale,
2872				  dst_metric(dst, RTAX_INITRWND));
2873
2874	tp->rx_opt.rcv_wscale = rcv_wscale;
2875	tp->rcv_ssthresh = tp->rcv_wnd;
2876
2877	sk->sk_err = 0;
2878	sock_reset_flag(sk, SOCK_DONE);
2879	tp->snd_wnd = 0;
2880	tcp_init_wl(tp, 0);
 
2881	tp->snd_una = tp->write_seq;
2882	tp->snd_sml = tp->write_seq;
2883	tp->snd_up = tp->write_seq;
2884	tp->snd_nxt = tp->write_seq;
2885
2886	if (likely(!tp->repair))
2887		tp->rcv_nxt = 0;
2888	else
2889		tp->rcv_tstamp = tcp_time_stamp;
2890	tp->rcv_wup = tp->rcv_nxt;
2891	tp->copied_seq = tp->rcv_nxt;
2892
2893	inet_csk(sk)->icsk_rto = TCP_TIMEOUT_INIT;
2894	inet_csk(sk)->icsk_retransmits = 0;
2895	tcp_clear_retrans(tp);
2896}
2897
2898static void tcp_connect_queue_skb(struct sock *sk, struct sk_buff *skb)
2899{
2900	struct tcp_sock *tp = tcp_sk(sk);
2901	struct tcp_skb_cb *tcb = TCP_SKB_CB(skb);
2902
2903	tcb->end_seq += skb->len;
2904	skb_header_release(skb);
2905	__tcp_add_write_queue_tail(sk, skb);
2906	sk->sk_wmem_queued += skb->truesize;
2907	sk_mem_charge(sk, skb->truesize);
2908	tp->write_seq = tcb->end_seq;
2909	tp->packets_out += tcp_skb_pcount(skb);
2910}
2911
2912/* Build and send a SYN with data and (cached) Fast Open cookie. However,
2913 * queue a data-only packet after the regular SYN, such that regular SYNs
2914 * are retransmitted on timeouts. Also if the remote SYN-ACK acknowledges
2915 * only the SYN sequence, the data are retransmitted in the first ACK.
2916 * If cookie is not cached or other error occurs, falls back to send a
2917 * regular SYN with Fast Open cookie request option.
2918 */
2919static int tcp_send_syn_data(struct sock *sk, struct sk_buff *syn)
2920{
2921	struct tcp_sock *tp = tcp_sk(sk);
2922	struct tcp_fastopen_request *fo = tp->fastopen_req;
2923	int syn_loss = 0, space, i, err = 0, iovlen = fo->data->msg_iovlen;
2924	struct sk_buff *syn_data = NULL, *data;
2925	unsigned long last_syn_loss = 0;
2926
2927	tp->rx_opt.mss_clamp = tp->advmss;  /* If MSS is not cached */
2928	tcp_fastopen_cache_get(sk, &tp->rx_opt.mss_clamp, &fo->cookie,
2929			       &syn_loss, &last_syn_loss);
2930	/* Recurring FO SYN losses: revert to regular handshake temporarily */
2931	if (syn_loss > 1 &&
2932	    time_before(jiffies, last_syn_loss + (60*HZ << syn_loss))) {
2933		fo->cookie.len = -1;
2934		goto fallback;
2935	}
2936
2937	if (sysctl_tcp_fastopen & TFO_CLIENT_NO_COOKIE)
2938		fo->cookie.len = -1;
2939	else if (fo->cookie.len <= 0)
2940		goto fallback;
2941
2942	/* MSS for SYN-data is based on cached MSS and bounded by PMTU and
2943	 * user-MSS. Reserve maximum option space for middleboxes that add
2944	 * private TCP options. The cost is reduced data space in SYN :(
2945	 */
2946	if (tp->rx_opt.user_mss && tp->rx_opt.user_mss < tp->rx_opt.mss_clamp)
2947		tp->rx_opt.mss_clamp = tp->rx_opt.user_mss;
2948	space = __tcp_mtu_to_mss(sk, inet_csk(sk)->icsk_pmtu_cookie) -
2949		MAX_TCP_OPTION_SPACE;
2950
2951	space = min_t(size_t, space, fo->size);
2952
2953	/* limit to order-0 allocations */
2954	space = min_t(size_t, space, SKB_MAX_HEAD(MAX_TCP_HEADER));
2955
2956	syn_data = skb_copy_expand(syn, MAX_TCP_HEADER, space,
2957				   sk->sk_allocation);
2958	if (syn_data == NULL)
2959		goto fallback;
2960
2961	for (i = 0; i < iovlen && syn_data->len < space; ++i) {
2962		struct iovec *iov = &fo->data->msg_iov[i];
2963		unsigned char __user *from = iov->iov_base;
2964		int len = iov->iov_len;
2965
2966		if (syn_data->len + len > space)
2967			len = space - syn_data->len;
2968		else if (i + 1 == iovlen)
2969			/* No more data pending in inet_wait_for_connect() */
2970			fo->data = NULL;
2971
2972		if (skb_add_data(syn_data, from, len))
2973			goto fallback;
 
 
 
 
 
2974	}
 
 
 
 
2975
2976	/* Queue a data-only packet after the regular SYN for retransmission */
2977	data = pskb_copy(syn_data, sk->sk_allocation);
2978	if (data == NULL)
2979		goto fallback;
2980	TCP_SKB_CB(data)->seq++;
2981	TCP_SKB_CB(data)->tcp_flags &= ~TCPHDR_SYN;
2982	TCP_SKB_CB(data)->tcp_flags = (TCPHDR_ACK|TCPHDR_PSH);
2983	tcp_connect_queue_skb(sk, data);
2984	fo->copied = data->len;
2985
2986	/* syn_data is about to be sent, we need to take current time stamps
2987	 * for the packets that are in write queue : SYN packet and DATA
2988	 */
2989	skb_mstamp_get(&syn->skb_mstamp);
2990	data->skb_mstamp = syn->skb_mstamp;
2991
2992	if (tcp_transmit_skb(sk, syn_data, 0, sk->sk_allocation) == 0) {
 
 
 
 
 
 
 
2993		tp->syn_data = (fo->copied > 0);
 
2994		NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPORIGDATASENT);
2995		goto done;
2996	}
2997	syn_data = NULL;
 
 
 
2998
2999fallback:
3000	/* Send a regular SYN with Fast Open cookie request option */
3001	if (fo->cookie.len > 0)
3002		fo->cookie.len = 0;
3003	err = tcp_transmit_skb(sk, syn, 1, sk->sk_allocation);
3004	if (err)
3005		tp->syn_fastopen = 0;
3006	kfree_skb(syn_data);
3007done:
3008	fo->cookie.len = -1;  /* Exclude Fast Open option for SYN retries */
3009	return err;
3010}
3011
3012/* Build a SYN and send it off. */
3013int tcp_connect(struct sock *sk)
3014{
3015	struct tcp_sock *tp = tcp_sk(sk);
3016	struct sk_buff *buff;
3017	int err;
3018
 
 
 
 
 
3019	tcp_connect_init(sk);
3020
3021	if (unlikely(tp->repair)) {
3022		tcp_finish_connect(sk, NULL);
3023		return 0;
3024	}
3025
3026	buff = alloc_skb_fclone(MAX_TCP_HEADER + 15, sk->sk_allocation);
3027	if (unlikely(buff == NULL))
3028		return -ENOBUFS;
3029
3030	/* Reserve space for headers. */
3031	skb_reserve(buff, MAX_TCP_HEADER);
3032
3033	tcp_init_nondata_skb(buff, tp->write_seq++, TCPHDR_SYN);
3034	tp->retrans_stamp = TCP_SKB_CB(buff)->when = tcp_time_stamp;
 
3035	tcp_connect_queue_skb(sk, buff);
3036	TCP_ECN_send_syn(sk, buff);
 
3037
3038	/* Send off SYN; include data in Fast Open. */
3039	err = tp->fastopen_req ? tcp_send_syn_data(sk, buff) :
3040	      tcp_transmit_skb(sk, buff, 1, sk->sk_allocation);
3041	if (err == -ECONNREFUSED)
3042		return err;
3043
3044	/* We change tp->snd_nxt after the tcp_transmit_skb() call
3045	 * in order to make this packet get counted in tcpOutSegs.
3046	 */
3047	tp->snd_nxt = tp->write_seq;
3048	tp->pushed_seq = tp->write_seq;
 
 
 
 
 
3049	TCP_INC_STATS(sock_net(sk), TCP_MIB_ACTIVEOPENS);
3050
3051	/* Timer for repeating the SYN until an answer. */
3052	inet_csk_reset_xmit_timer(sk, ICSK_TIME_RETRANS,
3053				  inet_csk(sk)->icsk_rto, TCP_RTO_MAX);
3054	return 0;
3055}
3056EXPORT_SYMBOL(tcp_connect);
3057
3058/* Send out a delayed ack, the caller does the policy checking
3059 * to see if we should even be here.  See tcp_input.c:tcp_ack_snd_check()
3060 * for details.
3061 */
3062void tcp_send_delayed_ack(struct sock *sk)
3063{
3064	struct inet_connection_sock *icsk = inet_csk(sk);
3065	int ato = icsk->icsk_ack.ato;
3066	unsigned long timeout;
3067
 
 
3068	if (ato > TCP_DELACK_MIN) {
3069		const struct tcp_sock *tp = tcp_sk(sk);
3070		int max_ato = HZ / 2;
3071
3072		if (icsk->icsk_ack.pingpong ||
3073		    (icsk->icsk_ack.pending & ICSK_ACK_PUSHED))
3074			max_ato = TCP_DELACK_MAX;
3075
3076		/* Slow path, intersegment interval is "high". */
3077
3078		/* If some rtt estimate is known, use it to bound delayed ack.
3079		 * Do not use inet_csk(sk)->icsk_rto here, use results of rtt measurements
3080		 * directly.
3081		 */
3082		if (tp->srtt_us) {
3083			int rtt = max_t(int, usecs_to_jiffies(tp->srtt_us >> 3),
3084					TCP_DELACK_MIN);
3085
3086			if (rtt < max_ato)
3087				max_ato = rtt;
3088		}
3089
3090		ato = min(ato, max_ato);
3091	}
3092
3093	/* Stay within the limit we were given */
3094	timeout = jiffies + ato;
3095
3096	/* Use new timeout only if there wasn't a older one earlier. */
3097	if (icsk->icsk_ack.pending & ICSK_ACK_TIMER) {
3098		/* If delack timer was blocked or is about to expire,
3099		 * send ACK now.
3100		 */
3101		if (icsk->icsk_ack.blocked ||
3102		    time_before_eq(icsk->icsk_ack.timeout, jiffies + (ato >> 2))) {
3103			tcp_send_ack(sk);
3104			return;
3105		}
3106
3107		if (!time_before(timeout, icsk->icsk_ack.timeout))
3108			timeout = icsk->icsk_ack.timeout;
3109	}
3110	icsk->icsk_ack.pending |= ICSK_ACK_SCHED | ICSK_ACK_TIMER;
3111	icsk->icsk_ack.timeout = timeout;
3112	sk_reset_timer(sk, &icsk->icsk_delack_timer, timeout);
3113}
3114
3115/* This routine sends an ack and also updates the window. */
3116void tcp_send_ack(struct sock *sk)
3117{
3118	struct sk_buff *buff;
3119
3120	/* If we have been reset, we may not send again. */
3121	if (sk->sk_state == TCP_CLOSE)
3122		return;
3123
 
 
3124	/* We are not putting this on the write queue, so
3125	 * tcp_transmit_skb() will set the ownership to this
3126	 * sock.
3127	 */
3128	buff = alloc_skb(MAX_TCP_HEADER, sk_gfp_atomic(sk, GFP_ATOMIC));
3129	if (buff == NULL) {
 
3130		inet_csk_schedule_ack(sk);
3131		inet_csk(sk)->icsk_ack.ato = TCP_ATO_MIN;
3132		inet_csk_reset_xmit_timer(sk, ICSK_TIME_DACK,
3133					  TCP_DELACK_MAX, TCP_RTO_MAX);
3134		return;
3135	}
3136
3137	/* Reserve space for headers and prepare control bits. */
3138	skb_reserve(buff, MAX_TCP_HEADER);
3139	tcp_init_nondata_skb(buff, tcp_acceptable_seq(sk), TCPHDR_ACK);
3140
 
 
 
 
 
 
3141	/* Send it off, this clears delayed acks for us. */
3142	TCP_SKB_CB(buff)->when = tcp_time_stamp;
3143	tcp_transmit_skb(sk, buff, 0, sk_gfp_atomic(sk, GFP_ATOMIC));
3144}
 
3145
3146/* This routine sends a packet with an out of date sequence
3147 * number. It assumes the other end will try to ack it.
3148 *
3149 * Question: what should we make while urgent mode?
3150 * 4.4BSD forces sending single byte of data. We cannot send
3151 * out of window data, because we have SND.NXT==SND.MAX...
3152 *
3153 * Current solution: to send TWO zero-length segments in urgent mode:
3154 * one is with SEG.SEQ=SND.UNA to deliver urgent pointer, another is
3155 * out-of-date with SND.UNA-1 to probe window.
3156 */
3157static int tcp_xmit_probe_skb(struct sock *sk, int urgent)
3158{
3159	struct tcp_sock *tp = tcp_sk(sk);
3160	struct sk_buff *skb;
3161
3162	/* We don't queue it, tcp_transmit_skb() sets ownership. */
3163	skb = alloc_skb(MAX_TCP_HEADER, sk_gfp_atomic(sk, GFP_ATOMIC));
3164	if (skb == NULL)
 
3165		return -1;
3166
3167	/* Reserve space for headers and set control bits. */
3168	skb_reserve(skb, MAX_TCP_HEADER);
3169	/* Use a previous sequence.  This should cause the other
3170	 * end to send an ack.  Don't queue or clone SKB, just
3171	 * send it.
3172	 */
3173	tcp_init_nondata_skb(skb, tp->snd_una - !urgent, TCPHDR_ACK);
3174	TCP_SKB_CB(skb)->when = tcp_time_stamp;
3175	return tcp_transmit_skb(sk, skb, 0, GFP_ATOMIC);
3176}
3177
 
3178void tcp_send_window_probe(struct sock *sk)
3179{
3180	if (sk->sk_state == TCP_ESTABLISHED) {
3181		tcp_sk(sk)->snd_wl1 = tcp_sk(sk)->rcv_nxt - 1;
3182		tcp_xmit_probe_skb(sk, 0);
 
3183	}
3184}
3185
3186/* Initiate keepalive or window probe from timer. */
3187int tcp_write_wakeup(struct sock *sk)
3188{
3189	struct tcp_sock *tp = tcp_sk(sk);
3190	struct sk_buff *skb;
3191
3192	if (sk->sk_state == TCP_CLOSE)
3193		return -1;
3194
3195	if ((skb = tcp_send_head(sk)) != NULL &&
3196	    before(TCP_SKB_CB(skb)->seq, tcp_wnd_end(tp))) {
3197		int err;
3198		unsigned int mss = tcp_current_mss(sk);
3199		unsigned int seg_size = tcp_wnd_end(tp) - TCP_SKB_CB(skb)->seq;
3200
3201		if (before(tp->pushed_seq, TCP_SKB_CB(skb)->end_seq))
3202			tp->pushed_seq = TCP_SKB_CB(skb)->end_seq;
3203
3204		/* We are probing the opening of a window
3205		 * but the window size is != 0
3206		 * must have been a result SWS avoidance ( sender )
3207		 */
3208		if (seg_size < TCP_SKB_CB(skb)->end_seq - TCP_SKB_CB(skb)->seq ||
3209		    skb->len > mss) {
3210			seg_size = min(seg_size, mss);
3211			TCP_SKB_CB(skb)->tcp_flags |= TCPHDR_PSH;
3212			if (tcp_fragment(sk, skb, seg_size, mss))
 
3213				return -1;
3214		} else if (!tcp_skb_pcount(skb))
3215			tcp_set_skb_tso_segs(sk, skb, mss);
3216
3217		TCP_SKB_CB(skb)->tcp_flags |= TCPHDR_PSH;
3218		TCP_SKB_CB(skb)->when = tcp_time_stamp;
3219		err = tcp_transmit_skb(sk, skb, 1, GFP_ATOMIC);
3220		if (!err)
3221			tcp_event_new_data_sent(sk, skb);
3222		return err;
3223	} else {
3224		if (between(tp->snd_up, tp->snd_una + 1, tp->snd_una + 0xFFFF))
3225			tcp_xmit_probe_skb(sk, 1);
3226		return tcp_xmit_probe_skb(sk, 0);
3227	}
3228}
3229
3230/* A window probe timeout has occurred.  If window is not closed send
3231 * a partial packet else a zero probe.
3232 */
3233void tcp_send_probe0(struct sock *sk)
3234{
3235	struct inet_connection_sock *icsk = inet_csk(sk);
3236	struct tcp_sock *tp = tcp_sk(sk);
 
 
3237	int err;
3238
3239	err = tcp_write_wakeup(sk);
3240
3241	if (tp->packets_out || !tcp_send_head(sk)) {
3242		/* Cancel probe timer, if it is not required. */
3243		icsk->icsk_probes_out = 0;
3244		icsk->icsk_backoff = 0;
3245		return;
3246	}
3247
3248	if (err <= 0) {
3249		if (icsk->icsk_backoff < sysctl_tcp_retries2)
3250			icsk->icsk_backoff++;
3251		icsk->icsk_probes_out++;
3252		inet_csk_reset_xmit_timer(sk, ICSK_TIME_PROBE0,
3253					  min(icsk->icsk_rto << icsk->icsk_backoff, TCP_RTO_MAX),
3254					  TCP_RTO_MAX);
3255	} else {
3256		/* If packet was not sent due to local congestion,
3257		 * do not backoff and do not remember icsk_probes_out.
3258		 * Let local senders to fight for local resources.
3259		 *
3260		 * Use accumulated backoff yet.
3261		 */
3262		if (!icsk->icsk_probes_out)
3263			icsk->icsk_probes_out = 1;
3264		inet_csk_reset_xmit_timer(sk, ICSK_TIME_PROBE0,
3265					  min(icsk->icsk_rto << icsk->icsk_backoff,
3266					      TCP_RESOURCE_PROBE_INTERVAL),
3267					  TCP_RTO_MAX);
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
3268	}
 
3269}
v4.17
   1/*
   2 * INET		An implementation of the TCP/IP protocol suite for the LINUX
   3 *		operating system.  INET is implemented using the  BSD Socket
   4 *		interface as the means of communication with the user level.
   5 *
   6 *		Implementation of the Transmission Control Protocol(TCP).
   7 *
   8 * Authors:	Ross Biro
   9 *		Fred N. van Kempen, <waltje@uWalt.NL.Mugnet.ORG>
  10 *		Mark Evans, <evansmp@uhura.aston.ac.uk>
  11 *		Corey Minyard <wf-rch!minyard@relay.EU.net>
  12 *		Florian La Roche, <flla@stud.uni-sb.de>
  13 *		Charles Hedrick, <hedrick@klinzhai.rutgers.edu>
  14 *		Linus Torvalds, <torvalds@cs.helsinki.fi>
  15 *		Alan Cox, <gw4pts@gw4pts.ampr.org>
  16 *		Matthew Dillon, <dillon@apollo.west.oic.com>
  17 *		Arnt Gulbrandsen, <agulbra@nvg.unit.no>
  18 *		Jorge Cwik, <jorge@laser.satlink.net>
  19 */
  20
  21/*
  22 * Changes:	Pedro Roque	:	Retransmit queue handled by TCP.
  23 *				:	Fragmentation on mtu decrease
  24 *				:	Segment collapse on retransmit
  25 *				:	AF independence
  26 *
  27 *		Linus Torvalds	:	send_delayed_ack
  28 *		David S. Miller	:	Charge memory using the right skb
  29 *					during syn/ack processing.
  30 *		David S. Miller :	Output engine completely rewritten.
  31 *		Andrea Arcangeli:	SYNACK carry ts_recent in tsecr.
  32 *		Cacophonix Gaul :	draft-minshall-nagle-01
  33 *		J Hadi Salim	:	ECN support
  34 *
  35 */
  36
  37#define pr_fmt(fmt) "TCP: " fmt
  38
  39#include <net/tcp.h>
  40
  41#include <linux/compiler.h>
  42#include <linux/gfp.h>
  43#include <linux/module.h>
  44#include <linux/static_key.h>
  45
  46#include <trace/events/tcp.h>
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
  47
  48static bool tcp_write_xmit(struct sock *sk, unsigned int mss_now, int nonagle,
  49			   int push_one, gfp_t gfp);
  50
  51/* Account for new data that has been sent to the network. */
  52static void tcp_event_new_data_sent(struct sock *sk, struct sk_buff *skb)
  53{
  54	struct inet_connection_sock *icsk = inet_csk(sk);
  55	struct tcp_sock *tp = tcp_sk(sk);
  56	unsigned int prior_packets = tp->packets_out;
  57
 
  58	tp->snd_nxt = TCP_SKB_CB(skb)->end_seq;
  59
  60	__skb_unlink(skb, &sk->sk_write_queue);
  61	tcp_rbtree_insert(&sk->tcp_rtx_queue, skb);
  62
  63	tp->packets_out += tcp_skb_pcount(skb);
  64	if (!prior_packets || icsk->icsk_pending == ICSK_TIME_LOSS_PROBE)
 
  65		tcp_rearm_rto(sk);
 
  66
  67	NET_ADD_STATS(sock_net(sk), LINUX_MIB_TCPORIGDATASENT,
  68		      tcp_skb_pcount(skb));
  69}
  70
  71/* SND.NXT, if window was not shrunk or the amount of shrunk was less than one
  72 * window scaling factor due to loss of precision.
  73 * If window has been shrunk, what should we make? It is not clear at all.
  74 * Using SND.UNA we will fail to open window, SND.NXT is out of window. :-(
  75 * Anything in between SND.UNA...SND.UNA+SND.WND also can be already
  76 * invalid. OK, let's make this for now:
  77 */
  78static inline __u32 tcp_acceptable_seq(const struct sock *sk)
  79{
  80	const struct tcp_sock *tp = tcp_sk(sk);
  81
  82	if (!before(tcp_wnd_end(tp), tp->snd_nxt) ||
  83	    (tp->rx_opt.wscale_ok &&
  84	     ((tp->snd_nxt - tcp_wnd_end(tp)) < (1 << tp->rx_opt.rcv_wscale))))
  85		return tp->snd_nxt;
  86	else
  87		return tcp_wnd_end(tp);
  88}
  89
  90/* Calculate mss to advertise in SYN segment.
  91 * RFC1122, RFC1063, draft-ietf-tcpimpl-pmtud-01 state that:
  92 *
  93 * 1. It is independent of path mtu.
  94 * 2. Ideally, it is maximal possible segment size i.e. 65535-40.
  95 * 3. For IPv4 it is reasonable to calculate it from maximal MTU of
  96 *    attached devices, because some buggy hosts are confused by
  97 *    large MSS.
  98 * 4. We do not make 3, we advertise MSS, calculated from first
  99 *    hop device mtu, but allow to raise it to ip_rt_min_advmss.
 100 *    This may be overridden via information stored in routing table.
 101 * 5. Value 65535 for MSS is valid in IPv6 and means "as large as possible,
 102 *    probably even Jumbo".
 103 */
 104static __u16 tcp_advertise_mss(struct sock *sk)
 105{
 106	struct tcp_sock *tp = tcp_sk(sk);
 107	const struct dst_entry *dst = __sk_dst_get(sk);
 108	int mss = tp->advmss;
 109
 110	if (dst) {
 111		unsigned int metric = dst_metric_advmss(dst);
 112
 113		if (metric < mss) {
 114			mss = metric;
 115			tp->advmss = mss;
 116		}
 117	}
 118
 119	return (__u16)mss;
 120}
 121
 122/* RFC2861. Reset CWND after idle period longer RTO to "restart window".
 123 * This is the first part of cwnd validation mechanism.
 124 */
 125void tcp_cwnd_restart(struct sock *sk, s32 delta)
 126{
 127	struct tcp_sock *tp = tcp_sk(sk);
 128	u32 restart_cwnd = tcp_init_cwnd(tp, __sk_dst_get(sk));
 
 129	u32 cwnd = tp->snd_cwnd;
 130
 131	tcp_ca_event(sk, CA_EVENT_CWND_RESTART);
 132
 133	tp->snd_ssthresh = tcp_current_ssthresh(sk);
 134	restart_cwnd = min(restart_cwnd, cwnd);
 135
 136	while ((delta -= inet_csk(sk)->icsk_rto) > 0 && cwnd > restart_cwnd)
 137		cwnd >>= 1;
 138	tp->snd_cwnd = max(cwnd, restart_cwnd);
 139	tp->snd_cwnd_stamp = tcp_jiffies32;
 140	tp->snd_cwnd_used = 0;
 141}
 142
 143/* Congestion state accounting after a packet has been sent. */
 144static void tcp_event_data_sent(struct tcp_sock *tp,
 145				struct sock *sk)
 146{
 147	struct inet_connection_sock *icsk = inet_csk(sk);
 148	const u32 now = tcp_jiffies32;
 
 149
 150	if (tcp_packets_in_flight(tp) == 0)
 151		tcp_ca_event(sk, CA_EVENT_TX_START);
 
 152
 153	tp->lsndtime = now;
 154
 155	/* If it is a reply for ato after last received
 156	 * packet, enter pingpong mode.
 157	 */
 158	if ((u32)(now - icsk->icsk_ack.lrcvtime) < icsk->icsk_ack.ato)
 159		icsk->icsk_ack.pingpong = 1;
 
 160}
 161
 162/* Account for an ACK we sent. */
 163static inline void tcp_event_ack_sent(struct sock *sk, unsigned int pkts)
 164{
 165	tcp_dec_quickack_mode(sk, pkts);
 166	inet_csk_clear_xmit_timer(sk, ICSK_TIME_DACK);
 167}
 168
 169
 170u32 tcp_default_init_rwnd(u32 mss)
 171{
 172	/* Initial receive window should be twice of TCP_INIT_CWND to
 173	 * enable proper sending of new unsent data during fast recovery
 174	 * (RFC 3517, Section 4, NextSeg() rule (2)). Further place a
 175	 * limit when mss is larger than 1460.
 176	 */
 177	u32 init_rwnd = TCP_INIT_CWND * 2;
 178
 179	if (mss > 1460)
 180		init_rwnd = max((1460 * init_rwnd) / mss, 2U);
 181	return init_rwnd;
 182}
 183
 184/* Determine a window scaling and initial window to offer.
 185 * Based on the assumption that the given amount of space
 186 * will be offered. Store the results in the tp structure.
 187 * NOTE: for smooth operation initial space offering should
 188 * be a multiple of mss if possible. We assume here that mss >= 1.
 189 * This MUST be enforced by all callers.
 190 */
 191void tcp_select_initial_window(const struct sock *sk, int __space, __u32 mss,
 192			       __u32 *rcv_wnd, __u32 *window_clamp,
 193			       int wscale_ok, __u8 *rcv_wscale,
 194			       __u32 init_rcv_wnd)
 195{
 196	unsigned int space = (__space < 0 ? 0 : __space);
 197
 198	/* If no clamp set the clamp to the max possible scaled window */
 199	if (*window_clamp == 0)
 200		(*window_clamp) = (U16_MAX << TCP_MAX_WSCALE);
 201	space = min(*window_clamp, space);
 202
 203	/* Quantize space offering to a multiple of mss if possible. */
 204	if (space > mss)
 205		space = rounddown(space, mss);
 206
 207	/* NOTE: offering an initial window larger than 32767
 208	 * will break some buggy TCP stacks. If the admin tells us
 209	 * it is likely we could be speaking with such a buggy stack
 210	 * we will truncate our initial window offering to 32K-1
 211	 * unless the remote has sent us a window scaling option,
 212	 * which we interpret as a sign the remote TCP is not
 213	 * misinterpreting the window field as a signed quantity.
 214	 */
 215	if (sock_net(sk)->ipv4.sysctl_tcp_workaround_signed_windows)
 216		(*rcv_wnd) = min(space, MAX_TCP_WINDOW);
 217	else
 218		(*rcv_wnd) = space;
 219
 220	(*rcv_wscale) = 0;
 221	if (wscale_ok) {
 222		/* Set window scaling on max possible window */
 223		space = max_t(u32, space, sock_net(sk)->ipv4.sysctl_tcp_rmem[2]);
 224		space = max_t(u32, space, sysctl_rmem_max);
 
 225		space = min_t(u32, space, *window_clamp);
 226		while (space > U16_MAX && (*rcv_wscale) < TCP_MAX_WSCALE) {
 227			space >>= 1;
 228			(*rcv_wscale)++;
 229		}
 230	}
 231
 232	if (mss > (1 << *rcv_wscale)) {
 233		if (!init_rcv_wnd) /* Use default unless specified otherwise */
 234			init_rcv_wnd = tcp_default_init_rwnd(mss);
 235		*rcv_wnd = min(*rcv_wnd, init_rcv_wnd * mss);
 236	}
 237
 238	/* Set the clamp no higher than max representable value */
 239	(*window_clamp) = min_t(__u32, U16_MAX << (*rcv_wscale), *window_clamp);
 240}
 241EXPORT_SYMBOL(tcp_select_initial_window);
 242
 243/* Chose a new window to advertise, update state in tcp_sock for the
 244 * socket, and return result with RFC1323 scaling applied.  The return
 245 * value can be stuffed directly into th->window for an outgoing
 246 * frame.
 247 */
 248static u16 tcp_select_window(struct sock *sk)
 249{
 250	struct tcp_sock *tp = tcp_sk(sk);
 251	u32 old_win = tp->rcv_wnd;
 252	u32 cur_win = tcp_receive_window(tp);
 253	u32 new_win = __tcp_select_window(sk);
 254
 255	/* Never shrink the offered window */
 256	if (new_win < cur_win) {
 257		/* Danger Will Robinson!
 258		 * Don't update rcv_wup/rcv_wnd here or else
 259		 * we will not be able to advertise a zero
 260		 * window in time.  --DaveM
 261		 *
 262		 * Relax Will Robinson.
 263		 */
 264		if (new_win == 0)
 265			NET_INC_STATS(sock_net(sk),
 266				      LINUX_MIB_TCPWANTZEROWINDOWADV);
 267		new_win = ALIGN(cur_win, 1 << tp->rx_opt.rcv_wscale);
 268	}
 269	tp->rcv_wnd = new_win;
 270	tp->rcv_wup = tp->rcv_nxt;
 271
 272	/* Make sure we do not exceed the maximum possible
 273	 * scaled window.
 274	 */
 275	if (!tp->rx_opt.rcv_wscale &&
 276	    sock_net(sk)->ipv4.sysctl_tcp_workaround_signed_windows)
 277		new_win = min(new_win, MAX_TCP_WINDOW);
 278	else
 279		new_win = min(new_win, (65535U << tp->rx_opt.rcv_wscale));
 280
 281	/* RFC1323 scaling applied */
 282	new_win >>= tp->rx_opt.rcv_wscale;
 283
 284	/* If we advertise zero window, disable fast path. */
 285	if (new_win == 0) {
 286		tp->pred_flags = 0;
 287		if (old_win)
 288			NET_INC_STATS(sock_net(sk),
 289				      LINUX_MIB_TCPTOZEROWINDOWADV);
 290	} else if (old_win == 0) {
 291		NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPFROMZEROWINDOWADV);
 292	}
 293
 294	return new_win;
 295}
 296
 297/* Packet ECN state for a SYN-ACK */
 298static void tcp_ecn_send_synack(struct sock *sk, struct sk_buff *skb)
 299{
 300	const struct tcp_sock *tp = tcp_sk(sk);
 301
 302	TCP_SKB_CB(skb)->tcp_flags &= ~TCPHDR_CWR;
 303	if (!(tp->ecn_flags & TCP_ECN_OK))
 304		TCP_SKB_CB(skb)->tcp_flags &= ~TCPHDR_ECE;
 305	else if (tcp_ca_needs_ecn(sk) ||
 306		 tcp_bpf_ca_needs_ecn(sk))
 307		INET_ECN_xmit(sk);
 308}
 309
 310/* Packet ECN state for a SYN.  */
 311static void tcp_ecn_send_syn(struct sock *sk, struct sk_buff *skb)
 312{
 313	struct tcp_sock *tp = tcp_sk(sk);
 314	bool bpf_needs_ecn = tcp_bpf_ca_needs_ecn(sk);
 315	bool use_ecn = sock_net(sk)->ipv4.sysctl_tcp_ecn == 1 ||
 316		tcp_ca_needs_ecn(sk) || bpf_needs_ecn;
 317
 318	if (!use_ecn) {
 319		const struct dst_entry *dst = __sk_dst_get(sk);
 320
 321		if (dst && dst_feature(dst, RTAX_FEATURE_ECN))
 322			use_ecn = true;
 323	}
 324
 325	tp->ecn_flags = 0;
 326
 327	if (use_ecn) {
 328		TCP_SKB_CB(skb)->tcp_flags |= TCPHDR_ECE | TCPHDR_CWR;
 329		tp->ecn_flags = TCP_ECN_OK;
 330		if (tcp_ca_needs_ecn(sk) || bpf_needs_ecn)
 331			INET_ECN_xmit(sk);
 332	}
 333}
 334
 335static void tcp_ecn_clear_syn(struct sock *sk, struct sk_buff *skb)
 336{
 337	if (sock_net(sk)->ipv4.sysctl_tcp_ecn_fallback)
 338		/* tp->ecn_flags are cleared at a later point in time when
 339		 * SYN ACK is ultimatively being received.
 340		 */
 341		TCP_SKB_CB(skb)->tcp_flags &= ~(TCPHDR_ECE | TCPHDR_CWR);
 342}
 343
 344static void
 345tcp_ecn_make_synack(const struct request_sock *req, struct tcphdr *th)
 346{
 347	if (inet_rsk(req)->ecn_ok)
 348		th->ece = 1;
 349}
 350
 351/* Set up ECN state for a packet on a ESTABLISHED socket that is about to
 352 * be sent.
 353 */
 354static void tcp_ecn_send(struct sock *sk, struct sk_buff *skb,
 355			 struct tcphdr *th, int tcp_header_len)
 356{
 357	struct tcp_sock *tp = tcp_sk(sk);
 358
 359	if (tp->ecn_flags & TCP_ECN_OK) {
 360		/* Not-retransmitted data segment: set ECT and inject CWR. */
 361		if (skb->len != tcp_header_len &&
 362		    !before(TCP_SKB_CB(skb)->seq, tp->snd_nxt)) {
 363			INET_ECN_xmit(sk);
 364			if (tp->ecn_flags & TCP_ECN_QUEUE_CWR) {
 365				tp->ecn_flags &= ~TCP_ECN_QUEUE_CWR;
 366				th->cwr = 1;
 367				skb_shinfo(skb)->gso_type |= SKB_GSO_TCP_ECN;
 368			}
 369		} else if (!tcp_ca_needs_ecn(sk)) {
 370			/* ACK or retransmitted segment: clear ECT|CE */
 371			INET_ECN_dontxmit(sk);
 372		}
 373		if (tp->ecn_flags & TCP_ECN_DEMAND_CWR)
 374			th->ece = 1;
 375	}
 376}
 377
 378/* Constructs common control bits of non-data skb. If SYN/FIN is present,
 379 * auto increment end seqno.
 380 */
 381static void tcp_init_nondata_skb(struct sk_buff *skb, u32 seq, u8 flags)
 382{
 
 
 383	skb->ip_summed = CHECKSUM_PARTIAL;
 
 384
 385	TCP_SKB_CB(skb)->tcp_flags = flags;
 386	TCP_SKB_CB(skb)->sacked = 0;
 387
 388	tcp_skb_pcount_set(skb, 1);
 
 
 389
 390	TCP_SKB_CB(skb)->seq = seq;
 391	if (flags & (TCPHDR_SYN | TCPHDR_FIN))
 392		seq++;
 393	TCP_SKB_CB(skb)->end_seq = seq;
 394}
 395
 396static inline bool tcp_urg_mode(const struct tcp_sock *tp)
 397{
 398	return tp->snd_una != tp->snd_up;
 399}
 400
 401#define OPTION_SACK_ADVERTISE	(1 << 0)
 402#define OPTION_TS		(1 << 1)
 403#define OPTION_MD5		(1 << 2)
 404#define OPTION_WSCALE		(1 << 3)
 405#define OPTION_FAST_OPEN_COOKIE	(1 << 8)
 406#define OPTION_SMC		(1 << 9)
 407
 408static void smc_options_write(__be32 *ptr, u16 *options)
 409{
 410#if IS_ENABLED(CONFIG_SMC)
 411	if (static_branch_unlikely(&tcp_have_smc)) {
 412		if (unlikely(OPTION_SMC & *options)) {
 413			*ptr++ = htonl((TCPOPT_NOP  << 24) |
 414				       (TCPOPT_NOP  << 16) |
 415				       (TCPOPT_EXP <<  8) |
 416				       (TCPOLEN_EXP_SMC_BASE));
 417			*ptr++ = htonl(TCPOPT_SMC_MAGIC);
 418		}
 419	}
 420#endif
 421}
 422
 423struct tcp_out_options {
 424	u16 options;		/* bit field of OPTION_* */
 425	u16 mss;		/* 0 to disable */
 426	u8 ws;			/* window scale, 0 to disable */
 427	u8 num_sack_blocks;	/* number of SACK blocks to include */
 428	u8 hash_size;		/* bytes in hash_location */
 429	__u8 *hash_location;	/* temporary pointer, overloaded */
 430	__u32 tsval, tsecr;	/* need to include OPTION_TS */
 431	struct tcp_fastopen_cookie *fastopen_cookie;	/* Fast open cookie */
 432};
 433
 434/* Write previously computed TCP options to the packet.
 435 *
 436 * Beware: Something in the Internet is very sensitive to the ordering of
 437 * TCP options, we learned this through the hard way, so be careful here.
 438 * Luckily we can at least blame others for their non-compliance but from
 439 * inter-operability perspective it seems that we're somewhat stuck with
 440 * the ordering which we have been using if we want to keep working with
 441 * those broken things (not that it currently hurts anybody as there isn't
 442 * particular reason why the ordering would need to be changed).
 443 *
 444 * At least SACK_PERM as the first option is known to lead to a disaster
 445 * (but it may well be that other scenarios fail similarly).
 446 */
 447static void tcp_options_write(__be32 *ptr, struct tcp_sock *tp,
 448			      struct tcp_out_options *opts)
 449{
 450	u16 options = opts->options;	/* mungable copy */
 451
 452	if (unlikely(OPTION_MD5 & options)) {
 453		*ptr++ = htonl((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) |
 454			       (TCPOPT_MD5SIG << 8) | TCPOLEN_MD5SIG);
 455		/* overload cookie hash location */
 456		opts->hash_location = (__u8 *)ptr;
 457		ptr += 4;
 458	}
 459
 460	if (unlikely(opts->mss)) {
 461		*ptr++ = htonl((TCPOPT_MSS << 24) |
 462			       (TCPOLEN_MSS << 16) |
 463			       opts->mss);
 464	}
 465
 466	if (likely(OPTION_TS & options)) {
 467		if (unlikely(OPTION_SACK_ADVERTISE & options)) {
 468			*ptr++ = htonl((TCPOPT_SACK_PERM << 24) |
 469				       (TCPOLEN_SACK_PERM << 16) |
 470				       (TCPOPT_TIMESTAMP << 8) |
 471				       TCPOLEN_TIMESTAMP);
 472			options &= ~OPTION_SACK_ADVERTISE;
 473		} else {
 474			*ptr++ = htonl((TCPOPT_NOP << 24) |
 475				       (TCPOPT_NOP << 16) |
 476				       (TCPOPT_TIMESTAMP << 8) |
 477				       TCPOLEN_TIMESTAMP);
 478		}
 479		*ptr++ = htonl(opts->tsval);
 480		*ptr++ = htonl(opts->tsecr);
 481	}
 482
 483	if (unlikely(OPTION_SACK_ADVERTISE & options)) {
 484		*ptr++ = htonl((TCPOPT_NOP << 24) |
 485			       (TCPOPT_NOP << 16) |
 486			       (TCPOPT_SACK_PERM << 8) |
 487			       TCPOLEN_SACK_PERM);
 488	}
 489
 490	if (unlikely(OPTION_WSCALE & options)) {
 491		*ptr++ = htonl((TCPOPT_NOP << 24) |
 492			       (TCPOPT_WINDOW << 16) |
 493			       (TCPOLEN_WINDOW << 8) |
 494			       opts->ws);
 495	}
 496
 497	if (unlikely(opts->num_sack_blocks)) {
 498		struct tcp_sack_block *sp = tp->rx_opt.dsack ?
 499			tp->duplicate_sack : tp->selective_acks;
 500		int this_sack;
 501
 502		*ptr++ = htonl((TCPOPT_NOP  << 24) |
 503			       (TCPOPT_NOP  << 16) |
 504			       (TCPOPT_SACK <<  8) |
 505			       (TCPOLEN_SACK_BASE + (opts->num_sack_blocks *
 506						     TCPOLEN_SACK_PERBLOCK)));
 507
 508		for (this_sack = 0; this_sack < opts->num_sack_blocks;
 509		     ++this_sack) {
 510			*ptr++ = htonl(sp[this_sack].start_seq);
 511			*ptr++ = htonl(sp[this_sack].end_seq);
 512		}
 513
 514		tp->rx_opt.dsack = 0;
 515	}
 516
 517	if (unlikely(OPTION_FAST_OPEN_COOKIE & options)) {
 518		struct tcp_fastopen_cookie *foc = opts->fastopen_cookie;
 519		u8 *p = (u8 *)ptr;
 520		u32 len; /* Fast Open option length */
 521
 522		if (foc->exp) {
 523			len = TCPOLEN_EXP_FASTOPEN_BASE + foc->len;
 524			*ptr = htonl((TCPOPT_EXP << 24) | (len << 16) |
 525				     TCPOPT_FASTOPEN_MAGIC);
 526			p += TCPOLEN_EXP_FASTOPEN_BASE;
 527		} else {
 528			len = TCPOLEN_FASTOPEN_BASE + foc->len;
 529			*p++ = TCPOPT_FASTOPEN;
 530			*p++ = len;
 531		}
 532
 533		memcpy(p, foc->val, foc->len);
 534		if ((len & 3) == 2) {
 535			p[foc->len] = TCPOPT_NOP;
 536			p[foc->len + 1] = TCPOPT_NOP;
 
 
 
 
 537		}
 538		ptr += (len + 3) >> 2;
 539	}
 540
 541	smc_options_write(ptr, &options);
 542}
 543
 544static void smc_set_option(const struct tcp_sock *tp,
 545			   struct tcp_out_options *opts,
 546			   unsigned int *remaining)
 547{
 548#if IS_ENABLED(CONFIG_SMC)
 549	if (static_branch_unlikely(&tcp_have_smc)) {
 550		if (tp->syn_smc) {
 551			if (*remaining >= TCPOLEN_EXP_SMC_BASE_ALIGNED) {
 552				opts->options |= OPTION_SMC;
 553				*remaining -= TCPOLEN_EXP_SMC_BASE_ALIGNED;
 554			}
 555		}
 556	}
 557#endif
 558}
 559
 560static void smc_set_option_cond(const struct tcp_sock *tp,
 561				const struct inet_request_sock *ireq,
 562				struct tcp_out_options *opts,
 563				unsigned int *remaining)
 564{
 565#if IS_ENABLED(CONFIG_SMC)
 566	if (static_branch_unlikely(&tcp_have_smc)) {
 567		if (tp->syn_smc && ireq->smc_ok) {
 568			if (*remaining >= TCPOLEN_EXP_SMC_BASE_ALIGNED) {
 569				opts->options |= OPTION_SMC;
 570				*remaining -= TCPOLEN_EXP_SMC_BASE_ALIGNED;
 571			}
 572		}
 573	}
 574#endif
 575}
 576
 577/* Compute TCP options for SYN packets. This is not the final
 578 * network wire format yet.
 579 */
 580static unsigned int tcp_syn_options(struct sock *sk, struct sk_buff *skb,
 581				struct tcp_out_options *opts,
 582				struct tcp_md5sig_key **md5)
 583{
 584	struct tcp_sock *tp = tcp_sk(sk);
 585	unsigned int remaining = MAX_TCP_OPTION_SPACE;
 586	struct tcp_fastopen_request *fastopen = tp->fastopen_req;
 587
 588#ifdef CONFIG_TCP_MD5SIG
 589	*md5 = tp->af_specific->md5_lookup(sk, sk);
 590	if (*md5) {
 591		opts->options |= OPTION_MD5;
 592		remaining -= TCPOLEN_MD5SIG_ALIGNED;
 593	}
 594#else
 595	*md5 = NULL;
 596#endif
 597
 598	/* We always get an MSS option.  The option bytes which will be seen in
 599	 * normal data packets should timestamps be used, must be in the MSS
 600	 * advertised.  But we subtract them from tp->mss_cache so that
 601	 * calculations in tcp_sendmsg are simpler etc.  So account for this
 602	 * fact here if necessary.  If we don't do this correctly, as a
 603	 * receiver we won't recognize data packets as being full sized when we
 604	 * should, and thus we won't abide by the delayed ACK rules correctly.
 605	 * SACKs don't matter, we never delay an ACK when we have any of those
 606	 * going out.  */
 607	opts->mss = tcp_advertise_mss(sk);
 608	remaining -= TCPOLEN_MSS_ALIGNED;
 609
 610	if (likely(sock_net(sk)->ipv4.sysctl_tcp_timestamps && !*md5)) {
 611		opts->options |= OPTION_TS;
 612		opts->tsval = tcp_skb_timestamp(skb) + tp->tsoffset;
 613		opts->tsecr = tp->rx_opt.ts_recent;
 614		remaining -= TCPOLEN_TSTAMP_ALIGNED;
 615	}
 616	if (likely(sock_net(sk)->ipv4.sysctl_tcp_window_scaling)) {
 617		opts->ws = tp->rx_opt.rcv_wscale;
 618		opts->options |= OPTION_WSCALE;
 619		remaining -= TCPOLEN_WSCALE_ALIGNED;
 620	}
 621	if (likely(sock_net(sk)->ipv4.sysctl_tcp_sack)) {
 622		opts->options |= OPTION_SACK_ADVERTISE;
 623		if (unlikely(!(OPTION_TS & opts->options)))
 624			remaining -= TCPOLEN_SACKPERM_ALIGNED;
 625	}
 626
 627	if (fastopen && fastopen->cookie.len >= 0) {
 628		u32 need = fastopen->cookie.len;
 629
 630		need += fastopen->cookie.exp ? TCPOLEN_EXP_FASTOPEN_BASE :
 631					       TCPOLEN_FASTOPEN_BASE;
 632		need = (need + 3) & ~3U;  /* Align to 32 bits */
 633		if (remaining >= need) {
 634			opts->options |= OPTION_FAST_OPEN_COOKIE;
 635			opts->fastopen_cookie = &fastopen->cookie;
 636			remaining -= need;
 637			tp->syn_fastopen = 1;
 638			tp->syn_fastopen_exp = fastopen->cookie.exp ? 1 : 0;
 639		}
 640	}
 641
 642	smc_set_option(tp, opts, &remaining);
 643
 644	return MAX_TCP_OPTION_SPACE - remaining;
 645}
 646
 647/* Set up TCP options for SYN-ACKs. */
 648static unsigned int tcp_synack_options(const struct sock *sk,
 649				       struct request_sock *req,
 650				       unsigned int mss, struct sk_buff *skb,
 651				       struct tcp_out_options *opts,
 652				       const struct tcp_md5sig_key *md5,
 653				       struct tcp_fastopen_cookie *foc)
 654{
 655	struct inet_request_sock *ireq = inet_rsk(req);
 656	unsigned int remaining = MAX_TCP_OPTION_SPACE;
 657
 658#ifdef CONFIG_TCP_MD5SIG
 659	if (md5) {
 
 660		opts->options |= OPTION_MD5;
 661		remaining -= TCPOLEN_MD5SIG_ALIGNED;
 662
 663		/* We can't fit any SACK blocks in a packet with MD5 + TS
 664		 * options. There was discussion about disabling SACK
 665		 * rather than TS in order to fit in better with old,
 666		 * buggy kernels, but that was deemed to be unnecessary.
 667		 */
 668		ireq->tstamp_ok &= !ireq->sack_ok;
 669	}
 
 
 670#endif
 671
 672	/* We always send an MSS option. */
 673	opts->mss = mss;
 674	remaining -= TCPOLEN_MSS_ALIGNED;
 675
 676	if (likely(ireq->wscale_ok)) {
 677		opts->ws = ireq->rcv_wscale;
 678		opts->options |= OPTION_WSCALE;
 679		remaining -= TCPOLEN_WSCALE_ALIGNED;
 680	}
 681	if (likely(ireq->tstamp_ok)) {
 682		opts->options |= OPTION_TS;
 683		opts->tsval = tcp_skb_timestamp(skb) + tcp_rsk(req)->ts_off;
 684		opts->tsecr = req->ts_recent;
 685		remaining -= TCPOLEN_TSTAMP_ALIGNED;
 686	}
 687	if (likely(ireq->sack_ok)) {
 688		opts->options |= OPTION_SACK_ADVERTISE;
 689		if (unlikely(!ireq->tstamp_ok))
 690			remaining -= TCPOLEN_SACKPERM_ALIGNED;
 691	}
 692	if (foc != NULL && foc->len >= 0) {
 693		u32 need = foc->len;
 694
 695		need += foc->exp ? TCPOLEN_EXP_FASTOPEN_BASE :
 696				   TCPOLEN_FASTOPEN_BASE;
 697		need = (need + 3) & ~3U;  /* Align to 32 bits */
 698		if (remaining >= need) {
 699			opts->options |= OPTION_FAST_OPEN_COOKIE;
 700			opts->fastopen_cookie = foc;
 701			remaining -= need;
 702		}
 703	}
 704
 705	smc_set_option_cond(tcp_sk(sk), ireq, opts, &remaining);
 706
 707	return MAX_TCP_OPTION_SPACE - remaining;
 708}
 709
 710/* Compute TCP options for ESTABLISHED sockets. This is not the
 711 * final wire format yet.
 712 */
 713static unsigned int tcp_established_options(struct sock *sk, struct sk_buff *skb,
 714					struct tcp_out_options *opts,
 715					struct tcp_md5sig_key **md5)
 716{
 
 717	struct tcp_sock *tp = tcp_sk(sk);
 718	unsigned int size = 0;
 719	unsigned int eff_sacks;
 720
 721	opts->options = 0;
 722
 723#ifdef CONFIG_TCP_MD5SIG
 724	*md5 = tp->af_specific->md5_lookup(sk, sk);
 725	if (unlikely(*md5)) {
 726		opts->options |= OPTION_MD5;
 727		size += TCPOLEN_MD5SIG_ALIGNED;
 728	}
 729#else
 730	*md5 = NULL;
 731#endif
 732
 733	if (likely(tp->rx_opt.tstamp_ok)) {
 734		opts->options |= OPTION_TS;
 735		opts->tsval = skb ? tcp_skb_timestamp(skb) + tp->tsoffset : 0;
 736		opts->tsecr = tp->rx_opt.ts_recent;
 737		size += TCPOLEN_TSTAMP_ALIGNED;
 738	}
 739
 740	eff_sacks = tp->rx_opt.num_sacks + tp->rx_opt.dsack;
 741	if (unlikely(eff_sacks)) {
 742		const unsigned int remaining = MAX_TCP_OPTION_SPACE - size;
 743		opts->num_sack_blocks =
 744			min_t(unsigned int, eff_sacks,
 745			      (remaining - TCPOLEN_SACK_BASE_ALIGNED) /
 746			      TCPOLEN_SACK_PERBLOCK);
 747		size += TCPOLEN_SACK_BASE_ALIGNED +
 748			opts->num_sack_blocks * TCPOLEN_SACK_PERBLOCK;
 749	}
 750
 751	return size;
 752}
 753
 754
 755/* TCP SMALL QUEUES (TSQ)
 756 *
 757 * TSQ goal is to keep small amount of skbs per tcp flow in tx queues (qdisc+dev)
 758 * to reduce RTT and bufferbloat.
 759 * We do this using a special skb destructor (tcp_wfree).
 760 *
 761 * Its important tcp_wfree() can be replaced by sock_wfree() in the event skb
 762 * needs to be reallocated in a driver.
 763 * The invariant being skb->truesize subtracted from sk->sk_wmem_alloc
 764 *
 765 * Since transmit from skb destructor is forbidden, we use a tasklet
 766 * to process all sockets that eventually need to send more skbs.
 767 * We use one tasklet per cpu, with its own queue of sockets.
 768 */
 769struct tsq_tasklet {
 770	struct tasklet_struct	tasklet;
 771	struct list_head	head; /* queue of tcp sockets */
 772};
 773static DEFINE_PER_CPU(struct tsq_tasklet, tsq_tasklet);
 774
 775static void tcp_tsq_handler(struct sock *sk)
 776{
 777	if ((1 << sk->sk_state) &
 778	    (TCPF_ESTABLISHED | TCPF_FIN_WAIT1 | TCPF_CLOSING |
 779	     TCPF_CLOSE_WAIT  | TCPF_LAST_ACK)) {
 780		struct tcp_sock *tp = tcp_sk(sk);
 781
 782		if (tp->lost_out > tp->retrans_out &&
 783		    tp->snd_cwnd > tcp_packets_in_flight(tp)) {
 784			tcp_mstamp_refresh(tp);
 785			tcp_xmit_retransmit_queue(sk);
 786		}
 787
 788		tcp_write_xmit(sk, tcp_current_mss(sk), tp->nonagle,
 789			       0, GFP_ATOMIC);
 790	}
 791}
 792/*
 793 * One tasklet per cpu tries to send more skbs.
 794 * We run in tasklet context but need to disable irqs when
 795 * transferring tsq->head because tcp_wfree() might
 796 * interrupt us (non NAPI drivers)
 797 */
 798static void tcp_tasklet_func(unsigned long data)
 799{
 800	struct tsq_tasklet *tsq = (struct tsq_tasklet *)data;
 801	LIST_HEAD(list);
 802	unsigned long flags;
 803	struct list_head *q, *n;
 804	struct tcp_sock *tp;
 805	struct sock *sk;
 806
 807	local_irq_save(flags);
 808	list_splice_init(&tsq->head, &list);
 809	local_irq_restore(flags);
 810
 811	list_for_each_safe(q, n, &list) {
 812		tp = list_entry(q, struct tcp_sock, tsq_node);
 813		list_del(&tp->tsq_node);
 814
 815		sk = (struct sock *)tp;
 816		smp_mb__before_atomic();
 817		clear_bit(TSQ_QUEUED, &sk->sk_tsq_flags);
 818
 819		if (!sk->sk_lock.owned &&
 820		    test_bit(TCP_TSQ_DEFERRED, &sk->sk_tsq_flags)) {
 821			bh_lock_sock(sk);
 822			if (!sock_owned_by_user(sk)) {
 823				clear_bit(TCP_TSQ_DEFERRED, &sk->sk_tsq_flags);
 824				tcp_tsq_handler(sk);
 825			}
 826			bh_unlock_sock(sk);
 827		}
 
 828
 
 829		sk_free(sk);
 830	}
 831}
 832
 833#define TCP_DEFERRED_ALL (TCPF_TSQ_DEFERRED |		\
 834			  TCPF_WRITE_TIMER_DEFERRED |	\
 835			  TCPF_DELACK_TIMER_DEFERRED |	\
 836			  TCPF_MTU_REDUCED_DEFERRED)
 837/**
 838 * tcp_release_cb - tcp release_sock() callback
 839 * @sk: socket
 840 *
 841 * called from release_sock() to perform protocol dependent
 842 * actions before socket release.
 843 */
 844void tcp_release_cb(struct sock *sk)
 845{
 
 846	unsigned long flags, nflags;
 847
 848	/* perform an atomic operation only if at least one flag is set */
 849	do {
 850		flags = sk->sk_tsq_flags;
 851		if (!(flags & TCP_DEFERRED_ALL))
 852			return;
 853		nflags = flags & ~TCP_DEFERRED_ALL;
 854	} while (cmpxchg(&sk->sk_tsq_flags, flags, nflags) != flags);
 855
 856	if (flags & TCPF_TSQ_DEFERRED)
 857		tcp_tsq_handler(sk);
 858
 859	/* Here begins the tricky part :
 860	 * We are called from release_sock() with :
 861	 * 1) BH disabled
 862	 * 2) sk_lock.slock spinlock held
 863	 * 3) socket owned by us (sk->sk_lock.owned == 1)
 864	 *
 865	 * But following code is meant to be called from BH handlers,
 866	 * so we should keep BH disabled, but early release socket ownership
 867	 */
 868	sock_release_ownership(sk);
 869
 870	if (flags & TCPF_WRITE_TIMER_DEFERRED) {
 871		tcp_write_timer_handler(sk);
 872		__sock_put(sk);
 873	}
 874	if (flags & TCPF_DELACK_TIMER_DEFERRED) {
 875		tcp_delack_timer_handler(sk);
 876		__sock_put(sk);
 877	}
 878	if (flags & TCPF_MTU_REDUCED_DEFERRED) {
 879		inet_csk(sk)->icsk_af_ops->mtu_reduced(sk);
 880		__sock_put(sk);
 881	}
 882}
 883EXPORT_SYMBOL(tcp_release_cb);
 884
 885void __init tcp_tasklet_init(void)
 886{
 887	int i;
 888
 889	for_each_possible_cpu(i) {
 890		struct tsq_tasklet *tsq = &per_cpu(tsq_tasklet, i);
 891
 892		INIT_LIST_HEAD(&tsq->head);
 893		tasklet_init(&tsq->tasklet,
 894			     tcp_tasklet_func,
 895			     (unsigned long)tsq);
 896	}
 897}
 898
 899/*
 900 * Write buffer destructor automatically called from kfree_skb.
 901 * We can't xmit new skbs from this context, as we might already
 902 * hold qdisc lock.
 903 */
 904void tcp_wfree(struct sk_buff *skb)
 905{
 906	struct sock *sk = skb->sk;
 907	struct tcp_sock *tp = tcp_sk(sk);
 908	unsigned long flags, nval, oval;
 909
 910	/* Keep one reference on sk_wmem_alloc.
 911	 * Will be released by sk_free() from here or tcp_tasklet_func()
 912	 */
 913	WARN_ON(refcount_sub_and_test(skb->truesize - 1, &sk->sk_wmem_alloc));
 914
 915	/* If this softirq is serviced by ksoftirqd, we are likely under stress.
 916	 * Wait until our queues (qdisc + devices) are drained.
 917	 * This gives :
 918	 * - less callbacks to tcp_write_xmit(), reducing stress (batches)
 919	 * - chance for incoming ACK (processed by another cpu maybe)
 920	 *   to migrate this flow (skb->ooo_okay will be eventually set)
 921	 */
 922	if (refcount_read(&sk->sk_wmem_alloc) >= SKB_TRUESIZE(1) && this_cpu_ksoftirqd() == current)
 923		goto out;
 924
 925	for (oval = READ_ONCE(sk->sk_tsq_flags);; oval = nval) {
 926		struct tsq_tasklet *tsq;
 927		bool empty;
 928
 929		if (!(oval & TSQF_THROTTLED) || (oval & TSQF_QUEUED))
 930			goto out;
 931
 932		nval = (oval & ~TSQF_THROTTLED) | TSQF_QUEUED | TCPF_TSQ_DEFERRED;
 933		nval = cmpxchg(&sk->sk_tsq_flags, oval, nval);
 934		if (nval != oval)
 935			continue;
 936
 937		/* queue this socket to tasklet queue */
 938		local_irq_save(flags);
 939		tsq = this_cpu_ptr(&tsq_tasklet);
 940		empty = list_empty(&tsq->head);
 941		list_add(&tp->tsq_node, &tsq->head);
 942		if (empty)
 943			tasklet_schedule(&tsq->tasklet);
 944		local_irq_restore(flags);
 945		return;
 
 946	}
 947out:
 948	sk_free(sk);
 949}
 950
 951/* Note: Called under hard irq.
 952 * We can not call TCP stack right away.
 953 */
 954enum hrtimer_restart tcp_pace_kick(struct hrtimer *timer)
 955{
 956	struct tcp_sock *tp = container_of(timer, struct tcp_sock, pacing_timer);
 957	struct sock *sk = (struct sock *)tp;
 958	unsigned long nval, oval;
 959
 960	for (oval = READ_ONCE(sk->sk_tsq_flags);; oval = nval) {
 961		struct tsq_tasklet *tsq;
 962		bool empty;
 963
 964		if (oval & TSQF_QUEUED)
 965			break;
 966
 967		nval = (oval & ~TSQF_THROTTLED) | TSQF_QUEUED | TCPF_TSQ_DEFERRED;
 968		nval = cmpxchg(&sk->sk_tsq_flags, oval, nval);
 969		if (nval != oval)
 970			continue;
 971
 972		if (!refcount_inc_not_zero(&sk->sk_wmem_alloc))
 973			break;
 974		/* queue this socket to tasklet queue */
 975		tsq = this_cpu_ptr(&tsq_tasklet);
 976		empty = list_empty(&tsq->head);
 977		list_add(&tp->tsq_node, &tsq->head);
 978		if (empty)
 979			tasklet_schedule(&tsq->tasklet);
 980		break;
 981	}
 982	return HRTIMER_NORESTART;
 983}
 984
 985/* BBR congestion control needs pacing.
 986 * Same remark for SO_MAX_PACING_RATE.
 987 * sch_fq packet scheduler is efficiently handling pacing,
 988 * but is not always installed/used.
 989 * Return true if TCP stack should pace packets itself.
 990 */
 991static bool tcp_needs_internal_pacing(const struct sock *sk)
 992{
 993	return smp_load_acquire(&sk->sk_pacing_status) == SK_PACING_NEEDED;
 994}
 995
 996static void tcp_internal_pacing(struct sock *sk, const struct sk_buff *skb)
 997{
 998	u64 len_ns;
 999	u32 rate;
1000
1001	if (!tcp_needs_internal_pacing(sk))
1002		return;
1003	rate = sk->sk_pacing_rate;
1004	if (!rate || rate == ~0U)
1005		return;
1006
1007	/* Should account for header sizes as sch_fq does,
1008	 * but lets make things simple.
1009	 */
1010	len_ns = (u64)skb->len * NSEC_PER_SEC;
1011	do_div(len_ns, rate);
1012	hrtimer_start(&tcp_sk(sk)->pacing_timer,
1013		      ktime_add_ns(ktime_get(), len_ns),
1014		      HRTIMER_MODE_ABS_PINNED);
1015}
1016
1017static void tcp_update_skb_after_send(struct tcp_sock *tp, struct sk_buff *skb)
1018{
1019	skb->skb_mstamp = tp->tcp_mstamp;
1020	list_move_tail(&skb->tcp_tsorted_anchor, &tp->tsorted_sent_queue);
1021}
1022
1023/* This routine actually transmits TCP packets queued in by
1024 * tcp_do_sendmsg().  This is used by both the initial
1025 * transmission and possible later retransmissions.
1026 * All SKB's seen here are completely headerless.  It is our
1027 * job to build the TCP header, and pass the packet down to
1028 * IP so it can do the same plus pass the packet off to the
1029 * device.
1030 *
1031 * We are working here with either a clone of the original
1032 * SKB, or a fresh unique copy made by the retransmit engine.
1033 */
1034static int tcp_transmit_skb(struct sock *sk, struct sk_buff *skb, int clone_it,
1035			    gfp_t gfp_mask)
1036{
1037	const struct inet_connection_sock *icsk = inet_csk(sk);
1038	struct inet_sock *inet;
1039	struct tcp_sock *tp;
1040	struct tcp_skb_cb *tcb;
1041	struct tcp_out_options opts;
1042	unsigned int tcp_options_size, tcp_header_size;
1043	struct sk_buff *oskb = NULL;
1044	struct tcp_md5sig_key *md5;
1045	struct tcphdr *th;
1046	int err;
1047
1048	BUG_ON(!skb || !tcp_skb_pcount(skb));
1049	tp = tcp_sk(sk);
1050
1051	if (clone_it) {
1052		TCP_SKB_CB(skb)->tx.in_flight = TCP_SKB_CB(skb)->end_seq
1053			- tp->snd_una;
1054		oskb = skb;
1055
1056		tcp_skb_tsorted_save(oskb) {
1057			if (unlikely(skb_cloned(oskb)))
1058				skb = pskb_copy(oskb, gfp_mask);
1059			else
1060				skb = skb_clone(oskb, gfp_mask);
1061		} tcp_skb_tsorted_restore(oskb);
1062
 
 
 
 
1063		if (unlikely(!skb))
1064			return -ENOBUFS;
 
 
1065	}
1066	skb->skb_mstamp = tp->tcp_mstamp;
1067
1068	inet = inet_sk(sk);
 
1069	tcb = TCP_SKB_CB(skb);
1070	memset(&opts, 0, sizeof(opts));
1071
1072	if (unlikely(tcb->tcp_flags & TCPHDR_SYN))
1073		tcp_options_size = tcp_syn_options(sk, skb, &opts, &md5);
1074	else
1075		tcp_options_size = tcp_established_options(sk, skb, &opts,
1076							   &md5);
1077	tcp_header_size = tcp_options_size + sizeof(struct tcphdr);
1078
 
 
 
1079	/* if no packet is in qdisc/device queue, then allow XPS to select
1080	 * another queue. We can be called from tcp_tsq_handler()
1081	 * which holds one reference to sk_wmem_alloc.
1082	 *
1083	 * TODO: Ideally, in-flight pure ACK packets should not matter here.
1084	 * One way to get this would be to set skb->truesize = 2 on them.
1085	 */
1086	skb->ooo_okay = sk_wmem_alloc_get(sk) < SKB_TRUESIZE(1);
1087
1088	/* If we had to use memory reserve to allocate this skb,
1089	 * this might cause drops if packet is looped back :
1090	 * Other socket might not have SOCK_MEMALLOC.
1091	 * Packets not looped back do not care about pfmemalloc.
1092	 */
1093	skb->pfmemalloc = 0;
1094
1095	skb_push(skb, tcp_header_size);
1096	skb_reset_transport_header(skb);
1097
1098	skb_orphan(skb);
1099	skb->sk = sk;
1100	skb->destructor = skb_is_tcp_pure_ack(skb) ? __sock_wfree : tcp_wfree;
1101	skb_set_hash_from_sk(skb, sk);
1102	refcount_add(skb->truesize, &sk->sk_wmem_alloc);
1103
1104	skb_set_dst_pending_confirm(skb, sk->sk_dst_pending_confirm);
1105
1106	/* Build TCP header and checksum it. */
1107	th = (struct tcphdr *)skb->data;
1108	th->source		= inet->inet_sport;
1109	th->dest		= inet->inet_dport;
1110	th->seq			= htonl(tcb->seq);
1111	th->ack_seq		= htonl(tp->rcv_nxt);
1112	*(((__be16 *)th) + 6)	= htons(((tcp_header_size >> 2) << 12) |
1113					tcb->tcp_flags);
1114
 
 
 
 
 
 
 
 
1115	th->check		= 0;
1116	th->urg_ptr		= 0;
1117
1118	/* The urg_mode check is necessary during a below snd_una win probe */
1119	if (unlikely(tcp_urg_mode(tp) && before(tcb->seq, tp->snd_up))) {
1120		if (before(tp->snd_up, tcb->seq + 0x10000)) {
1121			th->urg_ptr = htons(tp->snd_up - tcb->seq);
1122			th->urg = 1;
1123		} else if (after(tcb->seq + 0xFFFF, tp->snd_nxt)) {
1124			th->urg_ptr = htons(0xFFFF);
1125			th->urg = 1;
1126		}
1127	}
1128
1129	tcp_options_write((__be32 *)(th + 1), tp, &opts);
1130	skb_shinfo(skb)->gso_type = sk->sk_gso_type;
1131	if (likely(!(tcb->tcp_flags & TCPHDR_SYN))) {
1132		th->window      = htons(tcp_select_window(sk));
1133		tcp_ecn_send(sk, skb, th, tcp_header_size);
1134	} else {
1135		/* RFC1323: The window in SYN & SYN/ACK segments
1136		 * is never scaled.
1137		 */
1138		th->window	= htons(min(tp->rcv_wnd, 65535U));
1139	}
1140#ifdef CONFIG_TCP_MD5SIG
1141	/* Calculate the MD5 hash, as we have all we need now */
1142	if (md5) {
1143		sk_nocaps_add(sk, NETIF_F_GSO_MASK);
1144		tp->af_specific->calc_md5_hash(opts.hash_location,
1145					       md5, sk, skb);
1146	}
1147#endif
1148
1149	icsk->icsk_af_ops->send_check(sk, skb);
1150
1151	if (likely(tcb->tcp_flags & TCPHDR_ACK))
1152		tcp_event_ack_sent(sk, tcp_skb_pcount(skb));
1153
1154	if (skb->len != tcp_header_size) {
1155		tcp_event_data_sent(tp, sk);
1156		tp->data_segs_out += tcp_skb_pcount(skb);
1157		tcp_internal_pacing(sk, skb);
1158	}
1159
1160	if (after(tcb->end_seq, tp->snd_nxt) || tcb->seq == tcb->end_seq)
1161		TCP_ADD_STATS(sock_net(sk), TCP_MIB_OUTSEGS,
1162			      tcp_skb_pcount(skb));
1163
1164	tp->segs_out += tcp_skb_pcount(skb);
1165	/* OK, its time to fill skb_shinfo(skb)->gso_{segs|size} */
1166	skb_shinfo(skb)->gso_segs = tcp_skb_pcount(skb);
1167	skb_shinfo(skb)->gso_size = tcp_skb_mss(skb);
1168
1169	/* Our usage of tstamp should remain private */
1170	skb->tstamp = 0;
1171
1172	/* Cleanup our debris for IP stacks */
1173	memset(skb->cb, 0, max(sizeof(struct inet_skb_parm),
1174			       sizeof(struct inet6_skb_parm)));
1175
1176	err = icsk->icsk_af_ops->queue_xmit(sk, skb, &inet->cork.fl);
1177
1178	if (unlikely(err > 0)) {
1179		tcp_enter_cwr(sk);
1180		err = net_xmit_eval(err);
1181	}
1182	if (!err && oskb) {
1183		tcp_update_skb_after_send(tp, oskb);
1184		tcp_rate_skb_sent(sk, oskb);
1185	}
1186	return err;
1187}
1188
1189/* This routine just queues the buffer for sending.
1190 *
1191 * NOTE: probe0 timer is not checked, do not forget tcp_push_pending_frames,
1192 * otherwise socket can stall.
1193 */
1194static void tcp_queue_skb(struct sock *sk, struct sk_buff *skb)
1195{
1196	struct tcp_sock *tp = tcp_sk(sk);
1197
1198	/* Advance write_seq and place onto the write_queue. */
1199	tp->write_seq = TCP_SKB_CB(skb)->end_seq;
1200	__skb_header_release(skb);
1201	tcp_add_write_queue_tail(sk, skb);
1202	sk->sk_wmem_queued += skb->truesize;
1203	sk_mem_charge(sk, skb->truesize);
1204}
1205
1206/* Initialize TSO segments for a packet. */
1207static void tcp_set_skb_tso_segs(struct sk_buff *skb, unsigned int mss_now)
 
1208{
1209	if (skb->len <= mss_now) {
 
 
 
 
 
1210		/* Avoid the costly divide in the normal
1211		 * non-TSO case.
1212		 */
1213		tcp_skb_pcount_set(skb, 1);
1214		TCP_SKB_CB(skb)->tcp_gso_size = 0;
 
1215	} else {
1216		tcp_skb_pcount_set(skb, DIV_ROUND_UP(skb->len, mss_now));
1217		TCP_SKB_CB(skb)->tcp_gso_size = mss_now;
 
1218	}
1219}
1220
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1221/* Pcount in the middle of the write queue got changed, we need to do various
1222 * tweaks to fix counters
1223 */
1224static void tcp_adjust_pcount(struct sock *sk, const struct sk_buff *skb, int decr)
1225{
1226	struct tcp_sock *tp = tcp_sk(sk);
1227
1228	tp->packets_out -= decr;
1229
1230	if (TCP_SKB_CB(skb)->sacked & TCPCB_SACKED_ACKED)
1231		tp->sacked_out -= decr;
1232	if (TCP_SKB_CB(skb)->sacked & TCPCB_SACKED_RETRANS)
1233		tp->retrans_out -= decr;
1234	if (TCP_SKB_CB(skb)->sacked & TCPCB_LOST)
1235		tp->lost_out -= decr;
1236
1237	/* Reno case is special. Sigh... */
1238	if (tcp_is_reno(tp) && decr > 0)
1239		tp->sacked_out -= min_t(u32, tp->sacked_out, decr);
1240
 
 
1241	if (tp->lost_skb_hint &&
1242	    before(TCP_SKB_CB(skb)->seq, TCP_SKB_CB(tp->lost_skb_hint)->seq) &&
1243	    (TCP_SKB_CB(skb)->sacked & TCPCB_SACKED_ACKED))
1244		tp->lost_cnt_hint -= decr;
1245
1246	tcp_verify_left_out(tp);
1247}
1248
1249static bool tcp_has_tx_tstamp(const struct sk_buff *skb)
1250{
1251	return TCP_SKB_CB(skb)->txstamp_ack ||
1252		(skb_shinfo(skb)->tx_flags & SKBTX_ANY_TSTAMP);
1253}
1254
1255static void tcp_fragment_tstamp(struct sk_buff *skb, struct sk_buff *skb2)
1256{
1257	struct skb_shared_info *shinfo = skb_shinfo(skb);
1258
1259	if (unlikely(tcp_has_tx_tstamp(skb)) &&
1260	    !before(shinfo->tskey, TCP_SKB_CB(skb2)->seq)) {
1261		struct skb_shared_info *shinfo2 = skb_shinfo(skb2);
1262		u8 tsflags = shinfo->tx_flags & SKBTX_ANY_TSTAMP;
1263
1264		shinfo->tx_flags &= ~tsflags;
1265		shinfo2->tx_flags |= tsflags;
1266		swap(shinfo->tskey, shinfo2->tskey);
1267		TCP_SKB_CB(skb2)->txstamp_ack = TCP_SKB_CB(skb)->txstamp_ack;
1268		TCP_SKB_CB(skb)->txstamp_ack = 0;
1269	}
1270}
1271
1272static void tcp_skb_fragment_eor(struct sk_buff *skb, struct sk_buff *skb2)
1273{
1274	TCP_SKB_CB(skb2)->eor = TCP_SKB_CB(skb)->eor;
1275	TCP_SKB_CB(skb)->eor = 0;
1276}
1277
1278/* Insert buff after skb on the write or rtx queue of sk.  */
1279static void tcp_insert_write_queue_after(struct sk_buff *skb,
1280					 struct sk_buff *buff,
1281					 struct sock *sk,
1282					 enum tcp_queue tcp_queue)
1283{
1284	if (tcp_queue == TCP_FRAG_IN_WRITE_QUEUE)
1285		__skb_queue_after(&sk->sk_write_queue, skb, buff);
1286	else
1287		tcp_rbtree_insert(&sk->tcp_rtx_queue, buff);
1288}
1289
1290/* Function to create two new TCP segments.  Shrinks the given segment
1291 * to the specified size and appends a new segment with the rest of the
1292 * packet to the list.  This won't be called frequently, I hope.
1293 * Remember, these are still headerless SKBs at this point.
1294 */
1295int tcp_fragment(struct sock *sk, enum tcp_queue tcp_queue,
1296		 struct sk_buff *skb, u32 len,
1297		 unsigned int mss_now, gfp_t gfp)
1298{
1299	struct tcp_sock *tp = tcp_sk(sk);
1300	struct sk_buff *buff;
1301	int nsize, old_factor;
1302	int nlen;
1303	u8 flags;
1304
1305	if (WARN_ON(len > skb->len))
1306		return -EINVAL;
1307
1308	nsize = skb_headlen(skb) - len;
1309	if (nsize < 0)
1310		nsize = 0;
1311
1312	if (skb_unclone(skb, gfp))
1313		return -ENOMEM;
1314
1315	/* Get a new skb... force flag on. */
1316	buff = sk_stream_alloc_skb(sk, nsize, gfp, true);
1317	if (!buff)
1318		return -ENOMEM; /* We'll just try again later. */
1319
1320	sk->sk_wmem_queued += buff->truesize;
1321	sk_mem_charge(sk, buff->truesize);
1322	nlen = skb->len - len - nsize;
1323	buff->truesize += nlen;
1324	skb->truesize -= nlen;
1325
1326	/* Correct the sequence numbers. */
1327	TCP_SKB_CB(buff)->seq = TCP_SKB_CB(skb)->seq + len;
1328	TCP_SKB_CB(buff)->end_seq = TCP_SKB_CB(skb)->end_seq;
1329	TCP_SKB_CB(skb)->end_seq = TCP_SKB_CB(buff)->seq;
1330
1331	/* PSH and FIN should only be set in the second packet. */
1332	flags = TCP_SKB_CB(skb)->tcp_flags;
1333	TCP_SKB_CB(skb)->tcp_flags = flags & ~(TCPHDR_FIN | TCPHDR_PSH);
1334	TCP_SKB_CB(buff)->tcp_flags = flags;
1335	TCP_SKB_CB(buff)->sacked = TCP_SKB_CB(skb)->sacked;
1336	tcp_skb_fragment_eor(skb, buff);
1337
1338	skb_split(skb, buff, len);
 
 
 
 
 
 
 
 
 
 
 
 
1339
1340	buff->ip_summed = CHECKSUM_PARTIAL;
1341
 
 
 
 
1342	buff->tstamp = skb->tstamp;
1343	tcp_fragment_tstamp(skb, buff);
1344
1345	old_factor = tcp_skb_pcount(skb);
1346
1347	/* Fix up tso_factor for both original and new SKB.  */
1348	tcp_set_skb_tso_segs(skb, mss_now);
1349	tcp_set_skb_tso_segs(buff, mss_now);
1350
1351	/* Update delivered info for the new segment */
1352	TCP_SKB_CB(buff)->tx = TCP_SKB_CB(skb)->tx;
1353
1354	/* If this packet has been sent out already, we must
1355	 * adjust the various packet counters.
1356	 */
1357	if (!before(tp->snd_nxt, TCP_SKB_CB(buff)->end_seq)) {
1358		int diff = old_factor - tcp_skb_pcount(skb) -
1359			tcp_skb_pcount(buff);
1360
1361		if (diff)
1362			tcp_adjust_pcount(sk, skb, diff);
1363	}
1364
1365	/* Link BUFF into the send queue. */
1366	__skb_header_release(buff);
1367	tcp_insert_write_queue_after(skb, buff, sk, tcp_queue);
1368	if (tcp_queue == TCP_FRAG_IN_RTX_QUEUE)
1369		list_add(&buff->tcp_tsorted_anchor, &skb->tcp_tsorted_anchor);
1370
1371	return 0;
1372}
1373
1374/* This is similar to __pskb_pull_tail(). The difference is that pulled
1375 * data is not copied, but immediately discarded.
 
1376 */
1377static int __pskb_trim_head(struct sk_buff *skb, int len)
1378{
1379	struct skb_shared_info *shinfo;
1380	int i, k, eat;
1381
1382	eat = min_t(int, len, skb_headlen(skb));
1383	if (eat) {
1384		__skb_pull(skb, eat);
1385		len -= eat;
1386		if (!len)
1387			return 0;
1388	}
1389	eat = len;
1390	k = 0;
1391	shinfo = skb_shinfo(skb);
1392	for (i = 0; i < shinfo->nr_frags; i++) {
1393		int size = skb_frag_size(&shinfo->frags[i]);
1394
1395		if (size <= eat) {
1396			skb_frag_unref(skb, i);
1397			eat -= size;
1398		} else {
1399			shinfo->frags[k] = shinfo->frags[i];
1400			if (eat) {
1401				shinfo->frags[k].page_offset += eat;
1402				skb_frag_size_sub(&shinfo->frags[k], eat);
1403				eat = 0;
1404			}
1405			k++;
1406		}
1407	}
1408	shinfo->nr_frags = k;
1409
 
1410	skb->data_len -= len;
1411	skb->len = skb->data_len;
1412	return len;
1413}
1414
1415/* Remove acked data from a packet in the transmit queue. */
1416int tcp_trim_head(struct sock *sk, struct sk_buff *skb, u32 len)
1417{
1418	u32 delta_truesize;
1419
1420	if (skb_unclone(skb, GFP_ATOMIC))
1421		return -ENOMEM;
1422
1423	delta_truesize = __pskb_trim_head(skb, len);
1424
1425	TCP_SKB_CB(skb)->seq += len;
1426	skb->ip_summed = CHECKSUM_PARTIAL;
1427
1428	if (delta_truesize) {
1429		skb->truesize	   -= delta_truesize;
1430		sk->sk_wmem_queued -= delta_truesize;
1431		sk_mem_uncharge(sk, delta_truesize);
1432		sock_set_flag(sk, SOCK_QUEUE_SHRUNK);
1433	}
1434
1435	/* Any change of skb->len requires recalculation of tso factor. */
1436	if (tcp_skb_pcount(skb) > 1)
1437		tcp_set_skb_tso_segs(skb, tcp_skb_mss(skb));
1438
1439	return 0;
1440}
1441
1442/* Calculate MSS not accounting any TCP options.  */
1443static inline int __tcp_mtu_to_mss(struct sock *sk, int pmtu)
1444{
1445	const struct tcp_sock *tp = tcp_sk(sk);
1446	const struct inet_connection_sock *icsk = inet_csk(sk);
1447	int mss_now;
1448
1449	/* Calculate base mss without TCP options:
1450	   It is MMS_S - sizeof(tcphdr) of rfc1122
1451	 */
1452	mss_now = pmtu - icsk->icsk_af_ops->net_header_len - sizeof(struct tcphdr);
1453
1454	/* IPv6 adds a frag_hdr in case RTAX_FEATURE_ALLFRAG is set */
1455	if (icsk->icsk_af_ops->net_frag_header_len) {
1456		const struct dst_entry *dst = __sk_dst_get(sk);
1457
1458		if (dst && dst_allfrag(dst))
1459			mss_now -= icsk->icsk_af_ops->net_frag_header_len;
1460	}
1461
1462	/* Clamp it (mss_clamp does not include tcp options) */
1463	if (mss_now > tp->rx_opt.mss_clamp)
1464		mss_now = tp->rx_opt.mss_clamp;
1465
1466	/* Now subtract optional transport overhead */
1467	mss_now -= icsk->icsk_ext_hdr_len;
1468
1469	/* Then reserve room for full set of TCP options and 8 bytes of data */
1470	if (mss_now < 48)
1471		mss_now = 48;
1472	return mss_now;
1473}
1474
1475/* Calculate MSS. Not accounting for SACKs here.  */
1476int tcp_mtu_to_mss(struct sock *sk, int pmtu)
1477{
1478	/* Subtract TCP options size, not including SACKs */
1479	return __tcp_mtu_to_mss(sk, pmtu) -
1480	       (tcp_sk(sk)->tcp_header_len - sizeof(struct tcphdr));
1481}
1482
1483/* Inverse of above */
1484int tcp_mss_to_mtu(struct sock *sk, int mss)
1485{
1486	const struct tcp_sock *tp = tcp_sk(sk);
1487	const struct inet_connection_sock *icsk = inet_csk(sk);
1488	int mtu;
1489
1490	mtu = mss +
1491	      tp->tcp_header_len +
1492	      icsk->icsk_ext_hdr_len +
1493	      icsk->icsk_af_ops->net_header_len;
1494
1495	/* IPv6 adds a frag_hdr in case RTAX_FEATURE_ALLFRAG is set */
1496	if (icsk->icsk_af_ops->net_frag_header_len) {
1497		const struct dst_entry *dst = __sk_dst_get(sk);
1498
1499		if (dst && dst_allfrag(dst))
1500			mtu += icsk->icsk_af_ops->net_frag_header_len;
1501	}
1502	return mtu;
1503}
1504EXPORT_SYMBOL(tcp_mss_to_mtu);
1505
1506/* MTU probing init per socket */
1507void tcp_mtup_init(struct sock *sk)
1508{
1509	struct tcp_sock *tp = tcp_sk(sk);
1510	struct inet_connection_sock *icsk = inet_csk(sk);
1511	struct net *net = sock_net(sk);
1512
1513	icsk->icsk_mtup.enabled = net->ipv4.sysctl_tcp_mtu_probing > 1;
1514	icsk->icsk_mtup.search_high = tp->rx_opt.mss_clamp + sizeof(struct tcphdr) +
1515			       icsk->icsk_af_ops->net_header_len;
1516	icsk->icsk_mtup.search_low = tcp_mss_to_mtu(sk, net->ipv4.sysctl_tcp_base_mss);
1517	icsk->icsk_mtup.probe_size = 0;
1518	if (icsk->icsk_mtup.enabled)
1519		icsk->icsk_mtup.probe_timestamp = tcp_jiffies32;
1520}
1521EXPORT_SYMBOL(tcp_mtup_init);
1522
1523/* This function synchronize snd mss to current pmtu/exthdr set.
1524
1525   tp->rx_opt.user_mss is mss set by user by TCP_MAXSEG. It does NOT counts
1526   for TCP options, but includes only bare TCP header.
1527
1528   tp->rx_opt.mss_clamp is mss negotiated at connection setup.
1529   It is minimum of user_mss and mss received with SYN.
1530   It also does not include TCP options.
1531
1532   inet_csk(sk)->icsk_pmtu_cookie is last pmtu, seen by this function.
1533
1534   tp->mss_cache is current effective sending mss, including
1535   all tcp options except for SACKs. It is evaluated,
1536   taking into account current pmtu, but never exceeds
1537   tp->rx_opt.mss_clamp.
1538
1539   NOTE1. rfc1122 clearly states that advertised MSS
1540   DOES NOT include either tcp or ip options.
1541
1542   NOTE2. inet_csk(sk)->icsk_pmtu_cookie and tp->mss_cache
1543   are READ ONLY outside this function.		--ANK (980731)
1544 */
1545unsigned int tcp_sync_mss(struct sock *sk, u32 pmtu)
1546{
1547	struct tcp_sock *tp = tcp_sk(sk);
1548	struct inet_connection_sock *icsk = inet_csk(sk);
1549	int mss_now;
1550
1551	if (icsk->icsk_mtup.search_high > pmtu)
1552		icsk->icsk_mtup.search_high = pmtu;
1553
1554	mss_now = tcp_mtu_to_mss(sk, pmtu);
1555	mss_now = tcp_bound_to_half_wnd(tp, mss_now);
1556
1557	/* And store cached results */
1558	icsk->icsk_pmtu_cookie = pmtu;
1559	if (icsk->icsk_mtup.enabled)
1560		mss_now = min(mss_now, tcp_mtu_to_mss(sk, icsk->icsk_mtup.search_low));
1561	tp->mss_cache = mss_now;
1562
1563	return mss_now;
1564}
1565EXPORT_SYMBOL(tcp_sync_mss);
1566
1567/* Compute the current effective MSS, taking SACKs and IP options,
1568 * and even PMTU discovery events into account.
1569 */
1570unsigned int tcp_current_mss(struct sock *sk)
1571{
1572	const struct tcp_sock *tp = tcp_sk(sk);
1573	const struct dst_entry *dst = __sk_dst_get(sk);
1574	u32 mss_now;
1575	unsigned int header_len;
1576	struct tcp_out_options opts;
1577	struct tcp_md5sig_key *md5;
1578
1579	mss_now = tp->mss_cache;
1580
1581	if (dst) {
1582		u32 mtu = dst_mtu(dst);
1583		if (mtu != inet_csk(sk)->icsk_pmtu_cookie)
1584			mss_now = tcp_sync_mss(sk, mtu);
1585	}
1586
1587	header_len = tcp_established_options(sk, NULL, &opts, &md5) +
1588		     sizeof(struct tcphdr);
1589	/* The mss_cache is sized based on tp->tcp_header_len, which assumes
1590	 * some common options. If this is an odd packet (because we have SACK
1591	 * blocks etc) then our calculated header_len will be different, and
1592	 * we have to adjust mss_now correspondingly */
1593	if (header_len != tp->tcp_header_len) {
1594		int delta = (int) header_len - tp->tcp_header_len;
1595		mss_now -= delta;
1596	}
1597
1598	return mss_now;
1599}
1600
1601/* RFC2861, slow part. Adjust cwnd, after it was not full during one rto.
1602 * As additional protections, we do not touch cwnd in retransmission phases,
1603 * and if application hit its sndbuf limit recently.
1604 */
1605static void tcp_cwnd_application_limited(struct sock *sk)
1606{
1607	struct tcp_sock *tp = tcp_sk(sk);
1608
1609	if (inet_csk(sk)->icsk_ca_state == TCP_CA_Open &&
1610	    sk->sk_socket && !test_bit(SOCK_NOSPACE, &sk->sk_socket->flags)) {
1611		/* Limited by application or receiver window. */
1612		u32 init_win = tcp_init_cwnd(tp, __sk_dst_get(sk));
1613		u32 win_used = max(tp->snd_cwnd_used, init_win);
1614		if (win_used < tp->snd_cwnd) {
1615			tp->snd_ssthresh = tcp_current_ssthresh(sk);
1616			tp->snd_cwnd = (tp->snd_cwnd + win_used) >> 1;
1617		}
1618		tp->snd_cwnd_used = 0;
1619	}
1620	tp->snd_cwnd_stamp = tcp_jiffies32;
1621}
1622
1623static void tcp_cwnd_validate(struct sock *sk, bool is_cwnd_limited)
1624{
1625	const struct tcp_congestion_ops *ca_ops = inet_csk(sk)->icsk_ca_ops;
1626	struct tcp_sock *tp = tcp_sk(sk);
1627
1628	/* Track the maximum number of outstanding packets in each
1629	 * window, and remember whether we were cwnd-limited then.
1630	 */
1631	if (!before(tp->snd_una, tp->max_packets_seq) ||
1632	    tp->packets_out > tp->max_packets_out) {
1633		tp->max_packets_out = tp->packets_out;
1634		tp->max_packets_seq = tp->snd_nxt;
1635		tp->is_cwnd_limited = is_cwnd_limited;
1636	}
1637
1638	if (tcp_is_cwnd_limited(sk)) {
1639		/* Network is feed fully. */
1640		tp->snd_cwnd_used = 0;
1641		tp->snd_cwnd_stamp = tcp_jiffies32;
1642	} else {
1643		/* Network starves. */
1644		if (tp->packets_out > tp->snd_cwnd_used)
1645			tp->snd_cwnd_used = tp->packets_out;
1646
1647		if (sock_net(sk)->ipv4.sysctl_tcp_slow_start_after_idle &&
1648		    (s32)(tcp_jiffies32 - tp->snd_cwnd_stamp) >= inet_csk(sk)->icsk_rto &&
1649		    !ca_ops->cong_control)
1650			tcp_cwnd_application_limited(sk);
1651
1652		/* The following conditions together indicate the starvation
1653		 * is caused by insufficient sender buffer:
1654		 * 1) just sent some data (see tcp_write_xmit)
1655		 * 2) not cwnd limited (this else condition)
1656		 * 3) no more data to send (tcp_write_queue_empty())
1657		 * 4) application is hitting buffer limit (SOCK_NOSPACE)
1658		 */
1659		if (tcp_write_queue_empty(sk) && sk->sk_socket &&
1660		    test_bit(SOCK_NOSPACE, &sk->sk_socket->flags) &&
1661		    (1 << sk->sk_state) & (TCPF_ESTABLISHED | TCPF_CLOSE_WAIT))
1662			tcp_chrono_start(sk, TCP_CHRONO_SNDBUF_LIMITED);
1663	}
1664}
1665
1666/* Minshall's variant of the Nagle send check. */
1667static bool tcp_minshall_check(const struct tcp_sock *tp)
1668{
1669	return after(tp->snd_sml, tp->snd_una) &&
1670		!after(tp->snd_sml, tp->snd_nxt);
1671}
1672
1673/* Update snd_sml if this skb is under mss
1674 * Note that a TSO packet might end with a sub-mss segment
1675 * The test is really :
1676 * if ((skb->len % mss) != 0)
1677 *        tp->snd_sml = TCP_SKB_CB(skb)->end_seq;
1678 * But we can avoid doing the divide again given we already have
1679 *  skb_pcount = skb->len / mss_now
1680 */
1681static void tcp_minshall_update(struct tcp_sock *tp, unsigned int mss_now,
1682				const struct sk_buff *skb)
1683{
1684	if (skb->len < tcp_skb_pcount(skb) * mss_now)
1685		tp->snd_sml = TCP_SKB_CB(skb)->end_seq;
1686}
1687
1688/* Return false, if packet can be sent now without violation Nagle's rules:
1689 * 1. It is full sized. (provided by caller in %partial bool)
1690 * 2. Or it contains FIN. (already checked by caller)
1691 * 3. Or TCP_CORK is not set, and TCP_NODELAY is set.
1692 * 4. Or TCP_CORK is not set, and all sent packets are ACKed.
1693 *    With Minshall's modification: all sent small packets are ACKed.
1694 */
1695static bool tcp_nagle_check(bool partial, const struct tcp_sock *tp,
1696			    int nonagle)
1697{
1698	return partial &&
1699		((nonagle & TCP_NAGLE_CORK) ||
1700		 (!nonagle && tp->packets_out && tcp_minshall_check(tp)));
1701}
1702
1703/* Return how many segs we'd like on a TSO packet,
1704 * to send one TSO packet per ms
1705 */
1706static u32 tcp_tso_autosize(const struct sock *sk, unsigned int mss_now,
1707			    int min_tso_segs)
1708{
1709	u32 bytes, segs;
1710
1711	bytes = min(sk->sk_pacing_rate >> sk->sk_pacing_shift,
1712		    sk->sk_gso_max_size - 1 - MAX_TCP_HEADER);
1713
1714	/* Goal is to send at least one packet per ms,
1715	 * not one big TSO packet every 100 ms.
1716	 * This preserves ACK clocking and is consistent
1717	 * with tcp_tso_should_defer() heuristic.
1718	 */
1719	segs = max_t(u32, bytes / mss_now, min_tso_segs);
1720
1721	return segs;
1722}
1723
1724/* Return the number of segments we want in the skb we are transmitting.
1725 * See if congestion control module wants to decide; otherwise, autosize.
1726 */
1727static u32 tcp_tso_segs(struct sock *sk, unsigned int mss_now)
1728{
1729	const struct tcp_congestion_ops *ca_ops = inet_csk(sk)->icsk_ca_ops;
1730	u32 min_tso, tso_segs;
1731
1732	min_tso = ca_ops->min_tso_segs ?
1733			ca_ops->min_tso_segs(sk) :
1734			sock_net(sk)->ipv4.sysctl_tcp_min_tso_segs;
1735
1736	tso_segs = tcp_tso_autosize(sk, mss_now, min_tso);
1737	return min_t(u32, tso_segs, sk->sk_gso_max_segs);
1738}
1739
1740/* Returns the portion of skb which can be sent right away */
1741static unsigned int tcp_mss_split_point(const struct sock *sk,
1742					const struct sk_buff *skb,
1743					unsigned int mss_now,
1744					unsigned int max_segs,
1745					int nonagle)
1746{
1747	const struct tcp_sock *tp = tcp_sk(sk);
1748	u32 partial, needed, window, max_len;
1749
1750	window = tcp_wnd_end(tp) - TCP_SKB_CB(skb)->seq;
1751	max_len = mss_now * max_segs;
1752
1753	if (likely(max_len <= window && skb != tcp_write_queue_tail(sk)))
1754		return max_len;
1755
1756	needed = min(skb->len, window);
1757
1758	if (max_len <= needed)
1759		return max_len;
1760
1761	partial = needed % mss_now;
1762	/* If last segment is not a full MSS, check if Nagle rules allow us
1763	 * to include this last segment in this skb.
1764	 * Otherwise, we'll split the skb at last MSS boundary
1765	 */
1766	if (tcp_nagle_check(partial != 0, tp, nonagle))
1767		return needed - partial;
1768
1769	return needed;
1770}
1771
1772/* Can at least one segment of SKB be sent right now, according to the
1773 * congestion window rules?  If so, return how many segments are allowed.
1774 */
1775static inline unsigned int tcp_cwnd_test(const struct tcp_sock *tp,
1776					 const struct sk_buff *skb)
1777{
1778	u32 in_flight, cwnd, halfcwnd;
1779
1780	/* Don't be strict about the congestion window for the final FIN.  */
1781	if ((TCP_SKB_CB(skb)->tcp_flags & TCPHDR_FIN) &&
1782	    tcp_skb_pcount(skb) == 1)
1783		return 1;
1784
1785	in_flight = tcp_packets_in_flight(tp);
1786	cwnd = tp->snd_cwnd;
1787	if (in_flight >= cwnd)
1788		return 0;
1789
1790	/* For better scheduling, ensure we have at least
1791	 * 2 GSO packets in flight.
1792	 */
1793	halfcwnd = max(cwnd >> 1, 1U);
1794	return min(halfcwnd, cwnd - in_flight);
1795}
1796
1797/* Initialize TSO state of a skb.
1798 * This must be invoked the first time we consider transmitting
1799 * SKB onto the wire.
1800 */
1801static int tcp_init_tso_segs(struct sk_buff *skb, unsigned int mss_now)
 
1802{
1803	int tso_segs = tcp_skb_pcount(skb);
1804
1805	if (!tso_segs || (tso_segs > 1 && tcp_skb_mss(skb) != mss_now)) {
1806		tcp_set_skb_tso_segs(skb, mss_now);
1807		tso_segs = tcp_skb_pcount(skb);
1808	}
1809	return tso_segs;
1810}
1811
1812
1813/* Return true if the Nagle test allows this packet to be
1814 * sent now.
1815 */
1816static inline bool tcp_nagle_test(const struct tcp_sock *tp, const struct sk_buff *skb,
1817				  unsigned int cur_mss, int nonagle)
1818{
1819	/* Nagle rule does not apply to frames, which sit in the middle of the
1820	 * write_queue (they have no chances to get new data).
1821	 *
1822	 * This is implemented in the callers, where they modify the 'nonagle'
1823	 * argument based upon the location of SKB in the send queue.
1824	 */
1825	if (nonagle & TCP_NAGLE_PUSH)
1826		return true;
1827
1828	/* Don't use the nagle rule for urgent data (or for the final FIN). */
1829	if (tcp_urg_mode(tp) || (TCP_SKB_CB(skb)->tcp_flags & TCPHDR_FIN))
1830		return true;
1831
1832	if (!tcp_nagle_check(skb->len < cur_mss, tp, nonagle))
1833		return true;
1834
1835	return false;
1836}
1837
1838/* Does at least the first segment of SKB fit into the send window? */
1839static bool tcp_snd_wnd_test(const struct tcp_sock *tp,
1840			     const struct sk_buff *skb,
1841			     unsigned int cur_mss)
1842{
1843	u32 end_seq = TCP_SKB_CB(skb)->end_seq;
1844
1845	if (skb->len > cur_mss)
1846		end_seq = TCP_SKB_CB(skb)->seq + cur_mss;
1847
1848	return !after(end_seq, tcp_wnd_end(tp));
1849}
1850
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1851/* Trim TSO SKB to LEN bytes, put the remaining data into a new packet
1852 * which is put after SKB on the list.  It is very much like
1853 * tcp_fragment() except that it may make several kinds of assumptions
1854 * in order to speed up the splitting operation.  In particular, we
1855 * know that all the data is in scatter-gather pages, and that the
1856 * packet has never been sent out before (and thus is not cloned).
1857 */
1858static int tso_fragment(struct sock *sk, enum tcp_queue tcp_queue,
1859			struct sk_buff *skb, unsigned int len,
1860			unsigned int mss_now, gfp_t gfp)
1861{
1862	struct sk_buff *buff;
1863	int nlen = skb->len - len;
1864	u8 flags;
1865
1866	/* All of a TSO frame must be composed of paged data.  */
1867	if (skb->len != skb->data_len)
1868		return tcp_fragment(sk, tcp_queue, skb, len, mss_now, gfp);
1869
1870	buff = sk_stream_alloc_skb(sk, 0, gfp, true);
1871	if (unlikely(!buff))
1872		return -ENOMEM;
1873
1874	sk->sk_wmem_queued += buff->truesize;
1875	sk_mem_charge(sk, buff->truesize);
1876	buff->truesize += nlen;
1877	skb->truesize -= nlen;
1878
1879	/* Correct the sequence numbers. */
1880	TCP_SKB_CB(buff)->seq = TCP_SKB_CB(skb)->seq + len;
1881	TCP_SKB_CB(buff)->end_seq = TCP_SKB_CB(skb)->end_seq;
1882	TCP_SKB_CB(skb)->end_seq = TCP_SKB_CB(buff)->seq;
1883
1884	/* PSH and FIN should only be set in the second packet. */
1885	flags = TCP_SKB_CB(skb)->tcp_flags;
1886	TCP_SKB_CB(skb)->tcp_flags = flags & ~(TCPHDR_FIN | TCPHDR_PSH);
1887	TCP_SKB_CB(buff)->tcp_flags = flags;
1888
1889	/* This packet was never sent out yet, so no SACK bits. */
1890	TCP_SKB_CB(buff)->sacked = 0;
1891
1892	tcp_skb_fragment_eor(skb, buff);
1893
1894	buff->ip_summed = CHECKSUM_PARTIAL;
1895	skb_split(skb, buff, len);
1896	tcp_fragment_tstamp(skb, buff);
1897
1898	/* Fix up tso_factor for both original and new SKB.  */
1899	tcp_set_skb_tso_segs(skb, mss_now);
1900	tcp_set_skb_tso_segs(buff, mss_now);
1901
1902	/* Link BUFF into the send queue. */
1903	__skb_header_release(buff);
1904	tcp_insert_write_queue_after(skb, buff, sk, tcp_queue);
1905
1906	return 0;
1907}
1908
1909/* Try to defer sending, if possible, in order to minimize the amount
1910 * of TSO splitting we do.  View it as a kind of TSO Nagle test.
1911 *
1912 * This algorithm is from John Heffner.
1913 */
1914static bool tcp_tso_should_defer(struct sock *sk, struct sk_buff *skb,
1915				 bool *is_cwnd_limited, u32 max_segs)
1916{
 
1917	const struct inet_connection_sock *icsk = inet_csk(sk);
1918	u32 age, send_win, cong_win, limit, in_flight;
1919	struct tcp_sock *tp = tcp_sk(sk);
1920	struct sk_buff *head;
1921	int win_divisor;
1922
1923	if (TCP_SKB_CB(skb)->tcp_flags & TCPHDR_FIN)
1924		goto send_now;
1925
1926	if (icsk->icsk_ca_state >= TCP_CA_Recovery)
1927		goto send_now;
1928
1929	/* Avoid bursty behavior by allowing defer
1930	 * only if the last write was recent.
1931	 */
1932	if ((s32)(tcp_jiffies32 - tp->lsndtime) > 0)
1933		goto send_now;
1934
1935	in_flight = tcp_packets_in_flight(tp);
1936
1937	BUG_ON(tcp_skb_pcount(skb) <= 1);
1938	BUG_ON(tp->snd_cwnd <= in_flight);
1939
1940	send_win = tcp_wnd_end(tp) - TCP_SKB_CB(skb)->seq;
1941
1942	/* From in_flight test above, we know that cwnd > in_flight.  */
1943	cong_win = (tp->snd_cwnd - in_flight) * tp->mss_cache;
1944
1945	limit = min(send_win, cong_win);
1946
1947	/* If a full-sized TSO skb can be sent, do it. */
1948	if (limit >= max_segs * tp->mss_cache)
 
1949		goto send_now;
1950
1951	/* Middle in queue won't get any more data, full sendable already? */
1952	if ((skb != tcp_write_queue_tail(sk)) && (limit >= skb->len))
1953		goto send_now;
1954
1955	win_divisor = READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_tso_win_divisor);
1956	if (win_divisor) {
1957		u32 chunk = min(tp->snd_wnd, tp->snd_cwnd * tp->mss_cache);
1958
1959		/* If at least some fraction of a window is available,
1960		 * just use it.
1961		 */
1962		chunk /= win_divisor;
1963		if (limit >= chunk)
1964			goto send_now;
1965	} else {
1966		/* Different approach, try not to defer past a single
1967		 * ACK.  Receiver should ACK every other full sized
1968		 * frame, so if we have space for more than 3 frames
1969		 * then send now.
1970		 */
1971		if (limit > tcp_max_tso_deferred_mss(tp) * tp->mss_cache)
1972			goto send_now;
1973	}
1974
1975	/* TODO : use tsorted_sent_queue ? */
1976	head = tcp_rtx_queue_head(sk);
1977	if (!head)
1978		goto send_now;
1979	age = tcp_stamp_us_delta(tp->tcp_mstamp, head->skb_mstamp);
1980	/* If next ACK is likely to come too late (half srtt), do not defer */
1981	if (age < (tp->srtt_us >> 4))
1982		goto send_now;
1983
1984	/* Ok, it looks like it is advisable to defer. */
1985
1986	if (cong_win < send_win && cong_win <= skb->len)
1987		*is_cwnd_limited = true;
1988
1989	return true;
1990
1991send_now:
 
1992	return false;
1993}
1994
1995static inline void tcp_mtu_check_reprobe(struct sock *sk)
1996{
1997	struct inet_connection_sock *icsk = inet_csk(sk);
1998	struct tcp_sock *tp = tcp_sk(sk);
1999	struct net *net = sock_net(sk);
2000	u32 interval;
2001	s32 delta;
2002
2003	interval = net->ipv4.sysctl_tcp_probe_interval;
2004	delta = tcp_jiffies32 - icsk->icsk_mtup.probe_timestamp;
2005	if (unlikely(delta >= interval * HZ)) {
2006		int mss = tcp_current_mss(sk);
2007
2008		/* Update current search range */
2009		icsk->icsk_mtup.probe_size = 0;
2010		icsk->icsk_mtup.search_high = tp->rx_opt.mss_clamp +
2011			sizeof(struct tcphdr) +
2012			icsk->icsk_af_ops->net_header_len;
2013		icsk->icsk_mtup.search_low = tcp_mss_to_mtu(sk, mss);
2014
2015		/* Update probe time stamp */
2016		icsk->icsk_mtup.probe_timestamp = tcp_jiffies32;
2017	}
2018}
2019
2020static bool tcp_can_coalesce_send_queue_head(struct sock *sk, int len)
2021{
2022	struct sk_buff *skb, *next;
2023
2024	skb = tcp_send_head(sk);
2025	tcp_for_write_queue_from_safe(skb, next, sk) {
2026		if (len <= skb->len)
2027			break;
2028
2029		if (unlikely(TCP_SKB_CB(skb)->eor))
2030			return false;
2031
2032		len -= skb->len;
2033	}
2034
2035	return true;
2036}
2037
2038/* Create a new MTU probe if we are ready.
2039 * MTU probe is regularly attempting to increase the path MTU by
2040 * deliberately sending larger packets.  This discovers routing
2041 * changes resulting in larger path MTUs.
2042 *
2043 * Returns 0 if we should wait to probe (no cwnd available),
2044 *         1 if a probe was sent,
2045 *         -1 otherwise
2046 */
2047static int tcp_mtu_probe(struct sock *sk)
2048{
 
2049	struct inet_connection_sock *icsk = inet_csk(sk);
2050	struct tcp_sock *tp = tcp_sk(sk);
2051	struct sk_buff *skb, *nskb, *next;
2052	struct net *net = sock_net(sk);
2053	int probe_size;
2054	int size_needed;
2055	int copy, len;
2056	int mss_now;
2057	int interval;
2058
2059	/* Not currently probing/verifying,
2060	 * not in recovery,
2061	 * have enough cwnd, and
2062	 * not SACKing (the variable headers throw things off)
2063	 */
2064	if (likely(!icsk->icsk_mtup.enabled ||
2065		   icsk->icsk_mtup.probe_size ||
2066		   inet_csk(sk)->icsk_ca_state != TCP_CA_Open ||
2067		   tp->snd_cwnd < 11 ||
2068		   tp->rx_opt.num_sacks || tp->rx_opt.dsack))
2069		return -1;
2070
2071	/* Use binary search for probe_size between tcp_mss_base,
2072	 * and current mss_clamp. if (search_high - search_low)
2073	 * smaller than a threshold, backoff from probing.
2074	 */
2075	mss_now = tcp_current_mss(sk);
2076	probe_size = tcp_mtu_to_mss(sk, (icsk->icsk_mtup.search_high +
2077				    icsk->icsk_mtup.search_low) >> 1);
2078	size_needed = probe_size + (tp->reordering + 1) * tp->mss_cache;
2079	interval = icsk->icsk_mtup.search_high - icsk->icsk_mtup.search_low;
2080	/* When misfortune happens, we are reprobing actively,
2081	 * and then reprobe timer has expired. We stick with current
2082	 * probing process by not resetting search range to its orignal.
2083	 */
2084	if (probe_size > tcp_mtu_to_mss(sk, icsk->icsk_mtup.search_high) ||
2085		interval < net->ipv4.sysctl_tcp_probe_threshold) {
2086		/* Check whether enough time has elaplased for
2087		 * another round of probing.
2088		 */
2089		tcp_mtu_check_reprobe(sk);
2090		return -1;
2091	}
2092
2093	/* Have enough data in the send queue to probe? */
2094	if (tp->write_seq - tp->snd_nxt < size_needed)
2095		return -1;
2096
2097	if (tp->snd_wnd < size_needed)
2098		return -1;
2099	if (after(tp->snd_nxt + size_needed, tcp_wnd_end(tp)))
2100		return 0;
2101
2102	/* Do we need to wait to drain cwnd? With none in flight, don't stall */
2103	if (tcp_packets_in_flight(tp) + 2 > tp->snd_cwnd) {
2104		if (!tcp_packets_in_flight(tp))
2105			return -1;
2106		else
2107			return 0;
2108	}
2109
2110	if (!tcp_can_coalesce_send_queue_head(sk, probe_size))
2111		return -1;
2112
2113	/* We're allowed to probe.  Build it now. */
2114	nskb = sk_stream_alloc_skb(sk, probe_size, GFP_ATOMIC, false);
2115	if (!nskb)
2116		return -1;
2117	sk->sk_wmem_queued += nskb->truesize;
2118	sk_mem_charge(sk, nskb->truesize);
2119
2120	skb = tcp_send_head(sk);
2121
2122	TCP_SKB_CB(nskb)->seq = TCP_SKB_CB(skb)->seq;
2123	TCP_SKB_CB(nskb)->end_seq = TCP_SKB_CB(skb)->seq + probe_size;
2124	TCP_SKB_CB(nskb)->tcp_flags = TCPHDR_ACK;
2125	TCP_SKB_CB(nskb)->sacked = 0;
2126	nskb->csum = 0;
2127	nskb->ip_summed = CHECKSUM_PARTIAL;
2128
2129	tcp_insert_write_queue_before(nskb, skb, sk);
2130	tcp_highest_sack_replace(sk, skb, nskb);
2131
2132	len = 0;
2133	tcp_for_write_queue_from_safe(skb, next, sk) {
2134		copy = min_t(int, skb->len, probe_size - len);
2135		skb_copy_bits(skb, 0, skb_put(nskb, copy), copy);
 
 
 
 
 
2136
2137		if (skb->len <= copy) {
2138			/* We've eaten all the data from this skb.
2139			 * Throw it away. */
2140			TCP_SKB_CB(nskb)->tcp_flags |= TCP_SKB_CB(skb)->tcp_flags;
2141			/* If this is the last SKB we copy and eor is set
2142			 * we need to propagate it to the new skb.
2143			 */
2144			TCP_SKB_CB(nskb)->eor = TCP_SKB_CB(skb)->eor;
2145			tcp_unlink_write_queue(skb, sk);
2146			sk_wmem_free_skb(sk, skb);
2147		} else {
2148			TCP_SKB_CB(nskb)->tcp_flags |= TCP_SKB_CB(skb)->tcp_flags &
2149						   ~(TCPHDR_FIN|TCPHDR_PSH);
2150			if (!skb_shinfo(skb)->nr_frags) {
2151				skb_pull(skb, copy);
 
 
 
2152			} else {
2153				__pskb_trim_head(skb, copy);
2154				tcp_set_skb_tso_segs(skb, mss_now);
2155			}
2156			TCP_SKB_CB(skb)->seq += copy;
2157		}
2158
2159		len += copy;
2160
2161		if (len >= probe_size)
2162			break;
2163	}
2164	tcp_init_tso_segs(nskb, nskb->len);
2165
2166	/* We're ready to send.  If this fails, the probe will
2167	 * be resegmented into mss-sized pieces by tcp_write_xmit().
2168	 */
2169	if (!tcp_transmit_skb(sk, nskb, 1, GFP_ATOMIC)) {
2170		/* Decrement cwnd here because we are sending
2171		 * effectively two packets. */
2172		tp->snd_cwnd--;
2173		tcp_event_new_data_sent(sk, nskb);
2174
2175		icsk->icsk_mtup.probe_size = tcp_mss_to_mtu(sk, nskb->len);
2176		tp->mtu_probe.probe_seq_start = TCP_SKB_CB(nskb)->seq;
2177		tp->mtu_probe.probe_seq_end = TCP_SKB_CB(nskb)->end_seq;
2178
2179		return 1;
2180	}
2181
2182	return -1;
2183}
2184
2185static bool tcp_pacing_check(const struct sock *sk)
2186{
2187	return tcp_needs_internal_pacing(sk) &&
2188	       hrtimer_active(&tcp_sk(sk)->pacing_timer);
2189}
2190
2191/* TCP Small Queues :
2192 * Control number of packets in qdisc/devices to two packets / or ~1 ms.
2193 * (These limits are doubled for retransmits)
2194 * This allows for :
2195 *  - better RTT estimation and ACK scheduling
2196 *  - faster recovery
2197 *  - high rates
2198 * Alas, some drivers / subsystems require a fair amount
2199 * of queued bytes to ensure line rate.
2200 * One example is wifi aggregation (802.11 AMPDU)
2201 */
2202static bool tcp_small_queue_check(struct sock *sk, const struct sk_buff *skb,
2203				  unsigned int factor)
2204{
2205	unsigned int limit;
2206
2207	limit = max(2 * skb->truesize, sk->sk_pacing_rate >> sk->sk_pacing_shift);
2208	limit = min_t(u32, limit,
2209		      sock_net(sk)->ipv4.sysctl_tcp_limit_output_bytes);
2210	limit <<= factor;
2211
2212	if (refcount_read(&sk->sk_wmem_alloc) > limit) {
2213		/* Always send skb if rtx queue is empty.
2214		 * No need to wait for TX completion to call us back,
2215		 * after softirq/tasklet schedule.
2216		 * This helps when TX completions are delayed too much.
2217		 */
2218		if (tcp_rtx_queue_empty(sk))
2219			return false;
2220
2221		set_bit(TSQ_THROTTLED, &sk->sk_tsq_flags);
2222		/* It is possible TX completion already happened
2223		 * before we set TSQ_THROTTLED, so we must
2224		 * test again the condition.
2225		 */
2226		smp_mb__after_atomic();
2227		if (refcount_read(&sk->sk_wmem_alloc) > limit)
2228			return true;
2229	}
2230	return false;
2231}
2232
2233static void tcp_chrono_set(struct tcp_sock *tp, const enum tcp_chrono new)
2234{
2235	const u32 now = tcp_jiffies32;
2236	enum tcp_chrono old = tp->chrono_type;
2237
2238	if (old > TCP_CHRONO_UNSPEC)
2239		tp->chrono_stat[old - 1] += now - tp->chrono_start;
2240	tp->chrono_start = now;
2241	tp->chrono_type = new;
2242}
2243
2244void tcp_chrono_start(struct sock *sk, const enum tcp_chrono type)
2245{
2246	struct tcp_sock *tp = tcp_sk(sk);
2247
2248	/* If there are multiple conditions worthy of tracking in a
2249	 * chronograph then the highest priority enum takes precedence
2250	 * over the other conditions. So that if something "more interesting"
2251	 * starts happening, stop the previous chrono and start a new one.
2252	 */
2253	if (type > tp->chrono_type)
2254		tcp_chrono_set(tp, type);
2255}
2256
2257void tcp_chrono_stop(struct sock *sk, const enum tcp_chrono type)
2258{
2259	struct tcp_sock *tp = tcp_sk(sk);
2260
2261
2262	/* There are multiple conditions worthy of tracking in a
2263	 * chronograph, so that the highest priority enum takes
2264	 * precedence over the other conditions (see tcp_chrono_start).
2265	 * If a condition stops, we only stop chrono tracking if
2266	 * it's the "most interesting" or current chrono we are
2267	 * tracking and starts busy chrono if we have pending data.
2268	 */
2269	if (tcp_rtx_and_write_queues_empty(sk))
2270		tcp_chrono_set(tp, TCP_CHRONO_UNSPEC);
2271	else if (type == tp->chrono_type)
2272		tcp_chrono_set(tp, TCP_CHRONO_BUSY);
2273}
2274
2275/* This routine writes packets to the network.  It advances the
2276 * send_head.  This happens as incoming acks open up the remote
2277 * window for us.
2278 *
2279 * LARGESEND note: !tcp_urg_mode is overkill, only frames between
2280 * snd_up-64k-mss .. snd_up cannot be large. However, taking into
2281 * account rare use of URG, this is not a big flaw.
2282 *
2283 * Send at most one packet when push_one > 0. Temporarily ignore
2284 * cwnd limit to force at most one packet out when push_one == 2.
2285
2286 * Returns true, if no segments are in flight and we have queued segments,
2287 * but cannot send anything now because of SWS or another problem.
2288 */
2289static bool tcp_write_xmit(struct sock *sk, unsigned int mss_now, int nonagle,
2290			   int push_one, gfp_t gfp)
2291{
2292	struct tcp_sock *tp = tcp_sk(sk);
2293	struct sk_buff *skb;
2294	unsigned int tso_segs, sent_pkts;
2295	int cwnd_quota;
2296	int result;
2297	bool is_cwnd_limited = false, is_rwnd_limited = false;
2298	u32 max_segs;
2299
2300	sent_pkts = 0;
2301
2302	tcp_mstamp_refresh(tp);
2303	if (!push_one) {
2304		/* Do MTU probing. */
2305		result = tcp_mtu_probe(sk);
2306		if (!result) {
2307			return false;
2308		} else if (result > 0) {
2309			sent_pkts = 1;
2310		}
2311	}
2312
2313	max_segs = tcp_tso_segs(sk, mss_now);
2314	while ((skb = tcp_send_head(sk))) {
2315		unsigned int limit;
2316
2317		if (tcp_pacing_check(sk))
2318			break;
2319
2320		tso_segs = tcp_init_tso_segs(skb, mss_now);
2321		BUG_ON(!tso_segs);
2322
2323		if (unlikely(tp->repair) && tp->repair_queue == TCP_SEND_QUEUE) {
2324			/* "skb_mstamp" is used as a start point for the retransmit timer */
2325			tcp_update_skb_after_send(tp, skb);
2326			goto repair; /* Skip network transmission */
2327		}
2328
2329		cwnd_quota = tcp_cwnd_test(tp, skb);
2330		if (!cwnd_quota) {
2331			if (push_one == 2)
2332				/* Force out a loss probe pkt. */
2333				cwnd_quota = 1;
2334			else
2335				break;
2336		}
2337
2338		if (unlikely(!tcp_snd_wnd_test(tp, skb, mss_now))) {
2339			is_rwnd_limited = true;
2340			break;
2341		}
2342
2343		if (tso_segs == 1) {
2344			if (unlikely(!tcp_nagle_test(tp, skb, mss_now,
2345						     (tcp_skb_is_last(sk, skb) ?
2346						      nonagle : TCP_NAGLE_PUSH))))
2347				break;
2348		} else {
2349			if (!push_one &&
2350			    tcp_tso_should_defer(sk, skb, &is_cwnd_limited,
2351						 max_segs))
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
2352				break;
2353		}
2354
2355		limit = mss_now;
2356		if (tso_segs > 1 && !tcp_urg_mode(tp))
2357			limit = tcp_mss_split_point(sk, skb, mss_now,
2358						    min_t(unsigned int,
2359							  cwnd_quota,
2360							  max_segs),
2361						    nonagle);
2362
2363		if (skb->len > limit &&
2364		    unlikely(tso_fragment(sk, TCP_FRAG_IN_WRITE_QUEUE,
2365					  skb, limit, mss_now, gfp)))
2366			break;
2367
2368		if (test_bit(TCP_TSQ_DEFERRED, &sk->sk_tsq_flags))
2369			clear_bit(TCP_TSQ_DEFERRED, &sk->sk_tsq_flags);
2370		if (tcp_small_queue_check(sk, skb, 0))
2371			break;
2372
2373		if (unlikely(tcp_transmit_skb(sk, skb, 1, gfp)))
2374			break;
2375
2376repair:
2377		/* Advance the send_head.  This one is sent out.
2378		 * This call will increment packets_out.
2379		 */
2380		tcp_event_new_data_sent(sk, skb);
2381
2382		tcp_minshall_update(tp, mss_now, skb);
2383		sent_pkts += tcp_skb_pcount(skb);
2384
2385		if (push_one)
2386			break;
2387	}
2388
2389	if (is_rwnd_limited)
2390		tcp_chrono_start(sk, TCP_CHRONO_RWND_LIMITED);
2391	else
2392		tcp_chrono_stop(sk, TCP_CHRONO_RWND_LIMITED);
2393
2394	if (likely(sent_pkts)) {
2395		if (tcp_in_cwnd_reduction(sk))
2396			tp->prr_out += sent_pkts;
2397
2398		/* Send one loss probe per tail loss episode. */
2399		if (push_one != 2)
2400			tcp_schedule_loss_probe(sk, false);
2401		is_cwnd_limited |= (tcp_packets_in_flight(tp) >= tp->snd_cwnd);
2402		tcp_cwnd_validate(sk, is_cwnd_limited);
2403		return false;
2404	}
2405	return !tp->packets_out && !tcp_write_queue_empty(sk);
2406}
2407
2408bool tcp_schedule_loss_probe(struct sock *sk, bool advancing_rto)
2409{
2410	struct inet_connection_sock *icsk = inet_csk(sk);
2411	struct tcp_sock *tp = tcp_sk(sk);
2412	u32 timeout, rto_delta_us;
2413	int early_retrans;
2414
 
 
 
 
 
 
 
2415	/* Don't do any loss probe on a Fast Open connection before 3WHS
2416	 * finishes.
2417	 */
2418	if (tp->fastopen_rsk)
 
 
 
 
2419		return false;
2420
2421	early_retrans = sock_net(sk)->ipv4.sysctl_tcp_early_retrans;
2422	/* Schedule a loss probe in 2*RTT for SACK capable connections
2423	 * not in loss recovery, that are either limited by cwnd or application.
2424	 */
2425	if ((early_retrans != 3 && early_retrans != 4) ||
2426	    !tp->packets_out || !tcp_is_sack(tp) ||
2427	    (icsk->icsk_ca_state != TCP_CA_Open &&
2428	     icsk->icsk_ca_state != TCP_CA_CWR))
 
 
2429		return false;
2430
2431	/* Probe timeout is 2*rtt. Add minimum RTO to account
2432	 * for delayed ack when there's one outstanding packet. If no RTT
2433	 * sample is available then probe after TCP_TIMEOUT_INIT.
2434	 */
2435	if (tp->srtt_us) {
2436		timeout = usecs_to_jiffies(tp->srtt_us >> 2);
2437		if (tp->packets_out == 1)
2438			timeout += TCP_RTO_MIN;
2439		else
2440			timeout += TCP_TIMEOUT_MIN;
2441	} else {
2442		timeout = TCP_TIMEOUT_INIT;
 
 
 
 
2443	}
2444
2445	/* If the RTO formula yields an earlier time, then use that time. */
2446	rto_delta_us = advancing_rto ?
2447			jiffies_to_usecs(inet_csk(sk)->icsk_rto) :
2448			tcp_rto_delta_us(sk);  /* How far in future is RTO? */
2449	if (rto_delta_us > 0)
2450		timeout = min_t(u32, timeout, usecs_to_jiffies(rto_delta_us));
2451
2452	inet_csk_reset_xmit_timer(sk, ICSK_TIME_LOSS_PROBE, timeout,
2453				  TCP_RTO_MAX);
2454	return true;
2455}
2456
2457/* Thanks to skb fast clones, we can detect if a prior transmit of
2458 * a packet is still in a qdisc or driver queue.
2459 * In this case, there is very little point doing a retransmit !
2460 */
2461static bool skb_still_in_host_queue(const struct sock *sk,
2462				    const struct sk_buff *skb)
2463{
2464	if (unlikely(skb_fclone_busy(sk, skb))) {
2465		NET_INC_STATS(sock_net(sk),
2466			      LINUX_MIB_TCPSPURIOUS_RTX_HOSTQUEUES);
2467		return true;
2468	}
2469	return false;
2470}
2471
2472/* When probe timeout (PTO) fires, try send a new segment if possible, else
2473 * retransmit the last segment.
2474 */
2475void tcp_send_loss_probe(struct sock *sk)
2476{
2477	struct tcp_sock *tp = tcp_sk(sk);
2478	struct sk_buff *skb;
2479	int pcount;
2480	int mss = tcp_current_mss(sk);
 
2481
2482	skb = tcp_send_head(sk);
2483	if (skb && tcp_snd_wnd_test(tp, skb, mss)) {
2484		pcount = tp->packets_out;
2485		tcp_write_xmit(sk, mss, TCP_NAGLE_OFF, 2, GFP_ATOMIC);
2486		if (tp->packets_out > pcount)
2487			goto probe_sent;
2488		goto rearm_timer;
2489	}
2490	skb = skb_rb_last(&sk->tcp_rtx_queue);
2491
2492	/* At most one outstanding TLP retransmission. */
2493	if (tp->tlp_high_seq)
2494		goto rearm_timer;
2495
2496	/* Retransmit last segment. */
 
2497	if (WARN_ON(!skb))
2498		goto rearm_timer;
2499
2500	if (skb_still_in_host_queue(sk, skb))
2501		goto rearm_timer;
2502
2503	pcount = tcp_skb_pcount(skb);
2504	if (WARN_ON(!pcount))
2505		goto rearm_timer;
2506
2507	if ((pcount > 1) && (skb->len > (pcount - 1) * mss)) {
2508		if (unlikely(tcp_fragment(sk, TCP_FRAG_IN_RTX_QUEUE, skb,
2509					  (pcount - 1) * mss, mss,
2510					  GFP_ATOMIC)))
2511			goto rearm_timer;
2512		skb = skb_rb_next(skb);
2513	}
2514
2515	if (WARN_ON(!skb || !tcp_skb_pcount(skb)))
2516		goto rearm_timer;
2517
2518	if (__tcp_retransmit_skb(sk, skb, 1))
2519		goto rearm_timer;
 
2520
2521	/* Record snd_nxt for loss detection. */
2522	tp->tlp_high_seq = tp->snd_nxt;
 
2523
2524probe_sent:
2525	NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPLOSSPROBES);
2526	/* Reset s.t. tcp_rearm_rto will restart timer from now */
2527	inet_csk(sk)->icsk_pending = 0;
2528rearm_timer:
2529	tcp_rearm_rto(sk);
 
 
 
 
 
 
2530}
2531
2532/* Push out any pending frames which were held back due to
2533 * TCP_CORK or attempt at coalescing tiny packets.
2534 * The socket must be locked by the caller.
2535 */
2536void __tcp_push_pending_frames(struct sock *sk, unsigned int cur_mss,
2537			       int nonagle)
2538{
2539	/* If we are closed, the bytes will have to remain here.
2540	 * In time closedown will finish, we empty the write queue and
2541	 * all will be happy.
2542	 */
2543	if (unlikely(sk->sk_state == TCP_CLOSE))
2544		return;
2545
2546	if (tcp_write_xmit(sk, cur_mss, nonagle, 0,
2547			   sk_gfp_mask(sk, GFP_ATOMIC)))
2548		tcp_check_probe_timer(sk);
2549}
2550
2551/* Send _single_ skb sitting at the send head. This function requires
2552 * true push pending frames to setup probe timer etc.
2553 */
2554void tcp_push_one(struct sock *sk, unsigned int mss_now)
2555{
2556	struct sk_buff *skb = tcp_send_head(sk);
2557
2558	BUG_ON(!skb || skb->len < mss_now);
2559
2560	tcp_write_xmit(sk, mss_now, TCP_NAGLE_PUSH, 1, sk->sk_allocation);
2561}
2562
2563/* This function returns the amount that we can raise the
2564 * usable window based on the following constraints
2565 *
2566 * 1. The window can never be shrunk once it is offered (RFC 793)
2567 * 2. We limit memory per socket
2568 *
2569 * RFC 1122:
2570 * "the suggested [SWS] avoidance algorithm for the receiver is to keep
2571 *  RECV.NEXT + RCV.WIN fixed until:
2572 *  RCV.BUFF - RCV.USER - RCV.WINDOW >= min(1/2 RCV.BUFF, MSS)"
2573 *
2574 * i.e. don't raise the right edge of the window until you can raise
2575 * it at least MSS bytes.
2576 *
2577 * Unfortunately, the recommended algorithm breaks header prediction,
2578 * since header prediction assumes th->window stays fixed.
2579 *
2580 * Strictly speaking, keeping th->window fixed violates the receiver
2581 * side SWS prevention criteria. The problem is that under this rule
2582 * a stream of single byte packets will cause the right side of the
2583 * window to always advance by a single byte.
2584 *
2585 * Of course, if the sender implements sender side SWS prevention
2586 * then this will not be a problem.
2587 *
2588 * BSD seems to make the following compromise:
2589 *
2590 *	If the free space is less than the 1/4 of the maximum
2591 *	space available and the free space is less than 1/2 mss,
2592 *	then set the window to 0.
2593 *	[ Actually, bsd uses MSS and 1/4 of maximal _window_ ]
2594 *	Otherwise, just prevent the window from shrinking
2595 *	and from being larger than the largest representable value.
2596 *
2597 * This prevents incremental opening of the window in the regime
2598 * where TCP is limited by the speed of the reader side taking
2599 * data out of the TCP receive queue. It does nothing about
2600 * those cases where the window is constrained on the sender side
2601 * because the pipeline is full.
2602 *
2603 * BSD also seems to "accidentally" limit itself to windows that are a
2604 * multiple of MSS, at least until the free space gets quite small.
2605 * This would appear to be a side effect of the mbuf implementation.
2606 * Combining these two algorithms results in the observed behavior
2607 * of having a fixed window size at almost all times.
2608 *
2609 * Below we obtain similar behavior by forcing the offered window to
2610 * a multiple of the mss when it is feasible to do so.
2611 *
2612 * Note, we don't "adjust" for TIMESTAMP or SACK option bytes.
2613 * Regular options like TIMESTAMP are taken into account.
2614 */
2615u32 __tcp_select_window(struct sock *sk)
2616{
2617	struct inet_connection_sock *icsk = inet_csk(sk);
2618	struct tcp_sock *tp = tcp_sk(sk);
2619	/* MSS for the peer's data.  Previous versions used mss_clamp
2620	 * here.  I don't know if the value based on our guesses
2621	 * of peer's MSS is better for the performance.  It's more correct
2622	 * but may be worse for the performance because of rcv_mss
2623	 * fluctuations.  --SAW  1998/11/1
2624	 */
2625	int mss = icsk->icsk_ack.rcv_mss;
2626	int free_space = tcp_space(sk);
2627	int allowed_space = tcp_full_space(sk);
2628	int full_space = min_t(int, tp->window_clamp, allowed_space);
2629	int window;
2630
2631	if (unlikely(mss > full_space)) {
2632		mss = full_space;
2633		if (mss <= 0)
2634			return 0;
2635	}
2636	if (free_space < (full_space >> 1)) {
2637		icsk->icsk_ack.quick = 0;
2638
2639		if (tcp_under_memory_pressure(sk))
2640			tp->rcv_ssthresh = min(tp->rcv_ssthresh,
2641					       4U * tp->advmss);
2642
2643		/* free_space might become our new window, make sure we don't
2644		 * increase it due to wscale.
2645		 */
2646		free_space = round_down(free_space, 1 << tp->rx_opt.rcv_wscale);
2647
2648		/* if free space is less than mss estimate, or is below 1/16th
2649		 * of the maximum allowed, try to move to zero-window, else
2650		 * tcp_clamp_window() will grow rcv buf up to tcp_rmem[2], and
2651		 * new incoming data is dropped due to memory limits.
2652		 * With large window, mss test triggers way too late in order
2653		 * to announce zero window in time before rmem limit kicks in.
2654		 */
2655		if (free_space < (allowed_space >> 4) || free_space < mss)
2656			return 0;
2657	}
2658
2659	if (free_space > tp->rcv_ssthresh)
2660		free_space = tp->rcv_ssthresh;
2661
2662	/* Don't do rounding if we are using window scaling, since the
2663	 * scaled window will not line up with the MSS boundary anyway.
2664	 */
 
2665	if (tp->rx_opt.rcv_wscale) {
2666		window = free_space;
2667
2668		/* Advertise enough space so that it won't get scaled away.
2669		 * Import case: prevent zero window announcement if
2670		 * 1<<rcv_wscale > mss.
2671		 */
2672		window = ALIGN(window, (1 << tp->rx_opt.rcv_wscale));
 
 
2673	} else {
2674		window = tp->rcv_wnd;
2675		/* Get the largest window that is a nice multiple of mss.
2676		 * Window clamp already applied above.
2677		 * If our current window offering is within 1 mss of the
2678		 * free space we just keep it. This prevents the divide
2679		 * and multiply from happening most of the time.
2680		 * We also don't do any window rounding when the free space
2681		 * is too small.
2682		 */
2683		if (window <= free_space - mss || window > free_space)
2684			window = rounddown(free_space, mss);
2685		else if (mss == full_space &&
2686			 free_space > window + (full_space >> 1))
2687			window = free_space;
2688	}
2689
2690	return window;
2691}
2692
2693void tcp_skb_collapse_tstamp(struct sk_buff *skb,
2694			     const struct sk_buff *next_skb)
2695{
2696	if (unlikely(tcp_has_tx_tstamp(next_skb))) {
2697		const struct skb_shared_info *next_shinfo =
2698			skb_shinfo(next_skb);
2699		struct skb_shared_info *shinfo = skb_shinfo(skb);
2700
2701		shinfo->tx_flags |= next_shinfo->tx_flags & SKBTX_ANY_TSTAMP;
2702		shinfo->tskey = next_shinfo->tskey;
2703		TCP_SKB_CB(skb)->txstamp_ack |=
2704			TCP_SKB_CB(next_skb)->txstamp_ack;
2705	}
2706}
2707
2708/* Collapses two adjacent SKB's during retransmission. */
2709static bool tcp_collapse_retrans(struct sock *sk, struct sk_buff *skb)
2710{
2711	struct tcp_sock *tp = tcp_sk(sk);
2712	struct sk_buff *next_skb = skb_rb_next(skb);
2713	int skb_size, next_skb_size;
2714
2715	skb_size = skb->len;
2716	next_skb_size = next_skb->len;
2717
2718	BUG_ON(tcp_skb_pcount(skb) != 1 || tcp_skb_pcount(next_skb) != 1);
2719
2720	if (next_skb_size) {
2721		if (next_skb_size <= skb_availroom(skb))
2722			skb_copy_bits(next_skb, 0, skb_put(skb, next_skb_size),
2723				      next_skb_size);
2724		else if (!skb_shift(skb, next_skb, next_skb_size))
2725			return false;
2726	}
2727	tcp_highest_sack_replace(sk, next_skb, skb);
 
 
 
 
2728
2729	/* Update sequence range on original skb. */
2730	TCP_SKB_CB(skb)->end_seq = TCP_SKB_CB(next_skb)->end_seq;
2731
2732	/* Merge over control information. This moves PSH/FIN etc. over */
2733	TCP_SKB_CB(skb)->tcp_flags |= TCP_SKB_CB(next_skb)->tcp_flags;
2734
2735	/* All done, get rid of second SKB and account for it so
2736	 * packet counting does not break.
2737	 */
2738	TCP_SKB_CB(skb)->sacked |= TCP_SKB_CB(next_skb)->sacked & TCPCB_EVER_RETRANS;
2739	TCP_SKB_CB(skb)->eor = TCP_SKB_CB(next_skb)->eor;
2740
2741	/* changed transmit queue under us so clear hints */
2742	tcp_clear_retrans_hints_partial(tp);
2743	if (next_skb == tp->retransmit_skb_hint)
2744		tp->retransmit_skb_hint = skb;
2745
2746	tcp_adjust_pcount(sk, next_skb, tcp_skb_pcount(next_skb));
2747
2748	tcp_skb_collapse_tstamp(skb, next_skb);
2749
2750	tcp_rtx_queue_unlink_and_free(next_skb, sk);
2751	return true;
2752}
2753
2754/* Check if coalescing SKBs is legal. */
2755static bool tcp_can_collapse(const struct sock *sk, const struct sk_buff *skb)
2756{
2757	if (tcp_skb_pcount(skb) > 1)
2758		return false;
 
 
 
2759	if (skb_cloned(skb))
2760		return false;
2761	/* Some heuristics for collapsing over SACK'd could be invented */
 
 
2762	if (TCP_SKB_CB(skb)->sacked & TCPCB_SACKED_ACKED)
2763		return false;
2764
2765	return true;
2766}
2767
2768/* Collapse packets in the retransmit queue to make to create
2769 * less packets on the wire. This is only done on retransmission.
2770 */
2771static void tcp_retrans_try_collapse(struct sock *sk, struct sk_buff *to,
2772				     int space)
2773{
2774	struct tcp_sock *tp = tcp_sk(sk);
2775	struct sk_buff *skb = to, *tmp;
2776	bool first = true;
2777
2778	if (!sock_net(sk)->ipv4.sysctl_tcp_retrans_collapse)
2779		return;
2780	if (TCP_SKB_CB(skb)->tcp_flags & TCPHDR_SYN)
2781		return;
2782
2783	skb_rbtree_walk_from_safe(skb, tmp) {
2784		if (!tcp_can_collapse(sk, skb))
2785			break;
2786
2787		if (!tcp_skb_can_collapse_to(to))
2788			break;
2789
2790		space -= skb->len;
2791
2792		if (first) {
2793			first = false;
2794			continue;
2795		}
2796
2797		if (space < 0)
2798			break;
 
 
 
 
 
2799
2800		if (after(TCP_SKB_CB(skb)->end_seq, tcp_wnd_end(tp)))
2801			break;
2802
2803		if (!tcp_collapse_retrans(sk, to))
2804			break;
2805	}
2806}
2807
2808/* This retransmits one SKB.  Policy decisions and retransmit queue
2809 * state updates are done by the caller.  Returns non-zero if an
2810 * error occurred which prevented the send.
2811 */
2812int __tcp_retransmit_skb(struct sock *sk, struct sk_buff *skb, int segs)
2813{
 
2814	struct inet_connection_sock *icsk = inet_csk(sk);
2815	struct tcp_sock *tp = tcp_sk(sk);
2816	unsigned int cur_mss;
2817	int diff, len, err;
2818
2819
2820	/* Inconclusive MTU probe */
2821	if (icsk->icsk_mtup.probe_size)
2822		icsk->icsk_mtup.probe_size = 0;
 
2823
2824	/* Do not sent more than we queued. 1/4 is reserved for possible
2825	 * copying overhead: fragmentation, tunneling, mangling etc.
2826	 */
2827	if (refcount_read(&sk->sk_wmem_alloc) >
2828	    min_t(u32, sk->sk_wmem_queued + (sk->sk_wmem_queued >> 2),
2829		  sk->sk_sndbuf))
2830		return -EAGAIN;
2831
2832	if (skb_still_in_host_queue(sk, skb))
2833		return -EBUSY;
2834
2835	if (before(TCP_SKB_CB(skb)->seq, tp->snd_una)) {
2836		if (unlikely(before(TCP_SKB_CB(skb)->end_seq, tp->snd_una))) {
2837			WARN_ON_ONCE(1);
2838			return -EINVAL;
2839		}
2840		if (tcp_trim_head(sk, skb, tp->snd_una - TCP_SKB_CB(skb)->seq))
2841			return -ENOMEM;
2842	}
2843
2844	if (inet_csk(sk)->icsk_af_ops->rebuild_header(sk))
2845		return -EHOSTUNREACH; /* Routing failure or similar. */
2846
2847	cur_mss = tcp_current_mss(sk);
2848
2849	/* If receiver has shrunk his window, and skb is out of
2850	 * new window, do not retransmit it. The exception is the
2851	 * case, when window is shrunk to zero. In this case
2852	 * our retransmit serves as a zero window probe.
2853	 */
2854	if (!before(TCP_SKB_CB(skb)->seq, tcp_wnd_end(tp)) &&
2855	    TCP_SKB_CB(skb)->seq != tp->snd_una)
2856		return -EAGAIN;
2857
2858	len = cur_mss * segs;
2859	if (skb->len > len) {
2860		if (tcp_fragment(sk, TCP_FRAG_IN_RTX_QUEUE, skb, len,
2861				 cur_mss, GFP_ATOMIC))
2862			return -ENOMEM; /* We'll try again later. */
2863	} else {
2864		if (skb_unclone(skb, GFP_ATOMIC))
2865			return -ENOMEM;
2866
2867		diff = tcp_skb_pcount(skb);
2868		tcp_set_skb_tso_segs(skb, cur_mss);
2869		diff -= tcp_skb_pcount(skb);
2870		if (diff)
2871			tcp_adjust_pcount(sk, skb, diff);
2872		if (skb->len < cur_mss)
2873			tcp_retrans_try_collapse(sk, skb, cur_mss);
2874	}
2875
2876	/* RFC3168, section 6.1.1.1. ECN fallback */
2877	if ((TCP_SKB_CB(skb)->tcp_flags & TCPHDR_SYN_ECN) == TCPHDR_SYN_ECN)
2878		tcp_ecn_clear_syn(sk, skb);
2879
2880	/* Update global and local TCP statistics. */
2881	segs = tcp_skb_pcount(skb);
2882	TCP_ADD_STATS(sock_net(sk), TCP_MIB_RETRANSSEGS, segs);
2883	if (TCP_SKB_CB(skb)->tcp_flags & TCPHDR_SYN)
2884		__NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPSYNRETRANS);
2885	tp->total_retrans += segs;
2886
2887	/* make sure skb->data is aligned on arches that require it
2888	 * and check if ack-trimming & collapsing extended the headroom
2889	 * beyond what csum_start can cover.
2890	 */
2891	if (unlikely((NET_IP_ALIGN && ((unsigned long)skb->data & 3)) ||
2892		     skb_headroom(skb) >= 0xFFFF)) {
2893		struct sk_buff *nskb;
2894
2895		tcp_skb_tsorted_save(skb) {
2896			nskb = __pskb_copy(skb, MAX_TCP_HEADER, GFP_ATOMIC);
2897			err = nskb ? tcp_transmit_skb(sk, nskb, 0, GFP_ATOMIC) :
2898				     -ENOBUFS;
2899		} tcp_skb_tsorted_restore(skb);
2900
2901		if (!err) {
2902			tcp_update_skb_after_send(tp, skb);
2903			tcp_rate_skb_sent(sk, skb);
2904		}
2905	} else {
2906		err = tcp_transmit_skb(sk, skb, 1, GFP_ATOMIC);
2907	}
2908
2909	if (BPF_SOCK_OPS_TEST_FLAG(tp, BPF_SOCK_OPS_RETRANS_CB_FLAG))
2910		tcp_call_bpf_3arg(sk, BPF_SOCK_OPS_RETRANS_CB,
2911				  TCP_SKB_CB(skb)->seq, segs, err);
2912
2913	if (likely(!err)) {
2914		TCP_SKB_CB(skb)->sacked |= TCPCB_EVER_RETRANS;
2915		trace_tcp_retransmit_skb(sk, skb);
2916	} else if (err != -EBUSY) {
2917		NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPRETRANSFAIL);
 
 
2918	}
2919	return err;
2920}
2921
2922int tcp_retransmit_skb(struct sock *sk, struct sk_buff *skb, int segs)
2923{
2924	struct tcp_sock *tp = tcp_sk(sk);
2925	int err = __tcp_retransmit_skb(sk, skb, segs);
2926
2927	if (err == 0) {
2928#if FASTRETRANS_DEBUG > 0
2929		if (TCP_SKB_CB(skb)->sacked & TCPCB_SACKED_RETRANS) {
2930			net_dbg_ratelimited("retrans_out leaked\n");
2931		}
2932#endif
 
 
2933		TCP_SKB_CB(skb)->sacked |= TCPCB_RETRANS;
2934		tp->retrans_out += tcp_skb_pcount(skb);
2935
2936		/* Save stamp of the first retransmit. */
2937		if (!tp->retrans_stamp)
2938			tp->retrans_stamp = tcp_skb_timestamp(skb);
 
 
2939
 
 
 
 
 
 
2940	}
 
 
2941
2942	if (tp->undo_retrans < 0)
2943		tp->undo_retrans = 0;
2944	tp->undo_retrans += tcp_skb_pcount(skb);
2945	return err;
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
2946}
2947
2948/* This gets called after a retransmit timeout, and the initially
2949 * retransmitted data is acknowledged.  It tries to continue
2950 * resending the rest of the retransmit queue, until either
2951 * we've sent it all or the congestion window limit is reached.
 
 
 
2952 */
2953void tcp_xmit_retransmit_queue(struct sock *sk)
2954{
2955	const struct inet_connection_sock *icsk = inet_csk(sk);
2956	struct sk_buff *skb, *rtx_head, *hole = NULL;
2957	struct tcp_sock *tp = tcp_sk(sk);
2958	u32 max_segs;
 
 
2959	int mib_idx;
 
2960
2961	if (!tp->packets_out)
2962		return;
2963
2964	rtx_head = tcp_rtx_queue_head(sk);
2965	skb = tp->retransmit_skb_hint ?: rtx_head;
2966	max_segs = tcp_tso_segs(sk, tcp_current_mss(sk));
2967	skb_rbtree_walk_from(skb) {
2968		__u8 sacked;
2969		int segs;
 
 
 
 
 
 
2970
2971		if (tcp_pacing_check(sk))
 
 
 
2972			break;
2973
2974		/* we could do better than to assign each time */
2975		if (!hole)
2976			tp->retransmit_skb_hint = skb;
2977
2978		segs = tp->snd_cwnd - tcp_packets_in_flight(tp);
2979		if (segs <= 0)
 
 
 
 
 
 
2980			return;
2981		sacked = TCP_SKB_CB(skb)->sacked;
2982		/* In case tcp_shift_skb_data() have aggregated large skbs,
2983		 * we need to make sure not sending too bigs TSO packets
2984		 */
2985		segs = min_t(int, segs, max_segs);
2986
2987		if (tp->retrans_out >= tp->lost_out) {
2988			break;
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
2989		} else if (!(sacked & TCPCB_LOST)) {
2990			if (!hole && !(sacked & (TCPCB_SACKED_RETRANS|TCPCB_SACKED_ACKED)))
2991				hole = skb;
2992			continue;
2993
2994		} else {
 
2995			if (icsk->icsk_ca_state != TCP_CA_Loss)
2996				mib_idx = LINUX_MIB_TCPFASTRETRANS;
2997			else
2998				mib_idx = LINUX_MIB_TCPSLOWSTARTRETRANS;
2999		}
3000
3001		if (sacked & (TCPCB_SACKED_ACKED|TCPCB_SACKED_RETRANS))
3002			continue;
3003
3004		if (tcp_small_queue_check(sk, skb, 1))
3005			return;
3006
3007		if (tcp_retransmit_skb(sk, skb, segs))
3008			return;
3009
3010		NET_ADD_STATS(sock_net(sk), mib_idx, tcp_skb_pcount(skb));
3011
3012		if (tcp_in_cwnd_reduction(sk))
3013			tp->prr_out += tcp_skb_pcount(skb);
3014
3015		if (skb == rtx_head &&
3016		    icsk->icsk_pending != ICSK_TIME_REO_TIMEOUT)
3017			inet_csk_reset_xmit_timer(sk, ICSK_TIME_RETRANS,
3018						  inet_csk(sk)->icsk_rto,
3019						  TCP_RTO_MAX);
3020	}
3021}
3022
3023/* We allow to exceed memory limits for FIN packets to expedite
3024 * connection tear down and (memory) recovery.
3025 * Otherwise tcp_send_fin() could be tempted to either delay FIN
3026 * or even be forced to close flow without any FIN.
3027 * In general, we want to allow one skb per socket to avoid hangs
3028 * with edge trigger epoll()
3029 */
3030void sk_forced_mem_schedule(struct sock *sk, int size)
3031{
3032	int amt;
3033
3034	if (size <= sk->sk_forward_alloc)
3035		return;
3036	amt = sk_mem_pages(size);
3037	sk->sk_forward_alloc += amt * SK_MEM_QUANTUM;
3038	sk_memory_allocated_add(sk, amt);
3039
3040	if (mem_cgroup_sockets_enabled && sk->sk_memcg)
3041		mem_cgroup_charge_skmem(sk->sk_memcg, amt);
3042}
3043
3044/* Send a FIN. The caller locks the socket for us.
3045 * We should try to send a FIN packet really hard, but eventually give up.
3046 */
3047void tcp_send_fin(struct sock *sk)
3048{
3049	struct sk_buff *skb, *tskb = tcp_write_queue_tail(sk);
3050	struct tcp_sock *tp = tcp_sk(sk);
 
 
3051
3052	/* Optimization, tack on the FIN if we have one skb in write queue and
3053	 * this skb was not yet sent, or we are under memory pressure.
3054	 * Note: in the latter case, FIN packet will be sent after a timeout,
3055	 * as TCP stack thinks it has already been transmitted.
3056	 */
3057	if (!tskb && tcp_under_memory_pressure(sk))
3058		tskb = skb_rb_last(&sk->tcp_rtx_queue);
3059
3060	if (tskb) {
3061coalesce:
3062		TCP_SKB_CB(tskb)->tcp_flags |= TCPHDR_FIN;
3063		TCP_SKB_CB(tskb)->end_seq++;
3064		tp->write_seq++;
3065		if (tcp_write_queue_empty(sk)) {
3066			/* This means tskb was already sent.
3067			 * Pretend we included the FIN on previous transmit.
3068			 * We need to set tp->snd_nxt to the value it would have
3069			 * if FIN had been sent. This is because retransmit path
3070			 * does not change tp->snd_nxt.
3071			 */
3072			tp->snd_nxt++;
3073			return;
3074		}
3075	} else {
3076		skb = alloc_skb_fclone(MAX_TCP_HEADER, sk->sk_allocation);
3077		if (unlikely(!skb)) {
3078			if (tskb)
3079				goto coalesce;
3080			return;
 
 
3081		}
3082		INIT_LIST_HEAD(&skb->tcp_tsorted_anchor);
 
3083		skb_reserve(skb, MAX_TCP_HEADER);
3084		sk_forced_mem_schedule(sk, skb->truesize);
3085		/* FIN eats a sequence byte, write_seq advanced by tcp_queue_skb(). */
3086		tcp_init_nondata_skb(skb, tp->write_seq,
3087				     TCPHDR_ACK | TCPHDR_FIN);
3088		tcp_queue_skb(sk, skb);
3089	}
3090	__tcp_push_pending_frames(sk, tcp_current_mss(sk), TCP_NAGLE_OFF);
3091}
3092
3093/* We get here when a process closes a file descriptor (either due to
3094 * an explicit close() or as a byproduct of exit()'ing) and there
3095 * was unread data in the receive queue.  This behavior is recommended
3096 * by RFC 2525, section 2.17.  -DaveM
3097 */
3098void tcp_send_active_reset(struct sock *sk, gfp_t priority)
3099{
3100	struct sk_buff *skb;
3101
3102	TCP_INC_STATS(sock_net(sk), TCP_MIB_OUTRSTS);
3103
3104	/* NOTE: No TCP options attached and we never retransmit this. */
3105	skb = alloc_skb(MAX_TCP_HEADER, priority);
3106	if (!skb) {
3107		NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPABORTFAILED);
3108		return;
3109	}
3110
3111	/* Reserve space for headers and prepare control bits. */
3112	skb_reserve(skb, MAX_TCP_HEADER);
3113	tcp_init_nondata_skb(skb, tcp_acceptable_seq(sk),
3114			     TCPHDR_ACK | TCPHDR_RST);
3115	tcp_mstamp_refresh(tcp_sk(sk));
3116	/* Send it off. */
 
3117	if (tcp_transmit_skb(sk, skb, 0, priority))
3118		NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPABORTFAILED);
3119
3120	/* skb of trace_tcp_send_reset() keeps the skb that caused RST,
3121	 * skb here is different to the troublesome skb, so use NULL
3122	 */
3123	trace_tcp_send_reset(sk, NULL);
3124}
3125
3126/* Send a crossed SYN-ACK during socket establishment.
3127 * WARNING: This routine must only be called when we have already sent
3128 * a SYN packet that crossed the incoming SYN that caused this routine
3129 * to get called. If this assumption fails then the initial rcv_wnd
3130 * and rcv_wscale values will not be correct.
3131 */
3132int tcp_send_synack(struct sock *sk)
3133{
3134	struct sk_buff *skb;
3135
3136	skb = tcp_rtx_queue_head(sk);
3137	if (!skb || !(TCP_SKB_CB(skb)->tcp_flags & TCPHDR_SYN)) {
3138		pr_err("%s: wrong queue state\n", __func__);
3139		return -EFAULT;
3140	}
3141	if (!(TCP_SKB_CB(skb)->tcp_flags & TCPHDR_ACK)) {
3142		if (skb_cloned(skb)) {
3143			struct sk_buff *nskb;
3144
3145			tcp_skb_tsorted_save(skb) {
3146				nskb = skb_copy(skb, GFP_ATOMIC);
3147			} tcp_skb_tsorted_restore(skb);
3148			if (!nskb)
3149				return -ENOMEM;
3150			INIT_LIST_HEAD(&nskb->tcp_tsorted_anchor);
3151			tcp_rtx_queue_unlink_and_free(skb, sk);
3152			__skb_header_release(nskb);
3153			tcp_rbtree_insert(&sk->tcp_rtx_queue, nskb);
3154			sk->sk_wmem_queued += nskb->truesize;
3155			sk_mem_charge(sk, nskb->truesize);
3156			skb = nskb;
3157		}
3158
3159		TCP_SKB_CB(skb)->tcp_flags |= TCPHDR_ACK;
3160		tcp_ecn_send_synack(sk, skb);
3161	}
 
3162	return tcp_transmit_skb(sk, skb, 1, GFP_ATOMIC);
3163}
3164
3165/**
3166 * tcp_make_synack - Prepare a SYN-ACK.
3167 * sk: listener socket
3168 * dst: dst entry attached to the SYNACK
3169 * req: request_sock pointer
3170 *
3171 * Allocate one skb and build a SYNACK packet.
3172 * @dst is consumed : Caller should not use it again.
3173 */
3174struct sk_buff *tcp_make_synack(const struct sock *sk, struct dst_entry *dst,
3175				struct request_sock *req,
3176				struct tcp_fastopen_cookie *foc,
3177				enum tcp_synack_type synack_type)
3178{
 
3179	struct inet_request_sock *ireq = inet_rsk(req);
3180	const struct tcp_sock *tp = tcp_sk(sk);
3181	struct tcp_md5sig_key *md5 = NULL;
3182	struct tcp_out_options opts;
3183	struct sk_buff *skb;
 
3184	int tcp_header_size;
3185	struct tcphdr *th;
3186	int mss;
3187
3188	skb = alloc_skb(MAX_TCP_HEADER, GFP_ATOMIC);
3189	if (unlikely(!skb)) {
3190		dst_release(dst);
3191		return NULL;
3192	}
3193	/* Reserve space for headers. */
3194	skb_reserve(skb, MAX_TCP_HEADER);
3195
3196	switch (synack_type) {
3197	case TCP_SYNACK_NORMAL:
3198		skb_set_owner_w(skb, req_to_sk(req));
3199		break;
3200	case TCP_SYNACK_COOKIE:
3201		/* Under synflood, we do not attach skb to a socket,
3202		 * to avoid false sharing.
3203		 */
3204		break;
3205	case TCP_SYNACK_FASTOPEN:
3206		/* sk is a const pointer, because we want to express multiple
3207		 * cpu might call us concurrently.
3208		 * sk->sk_wmem_alloc in an atomic, we can promote to rw.
3209		 */
3210		skb_set_owner_w(skb, (struct sock *)sk);
3211		break;
3212	}
3213	skb_dst_set(skb, dst);
 
3214
3215	mss = tcp_mss_clamp(tp, dst_metric_advmss(dst));
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
3216
3217	memset(&opts, 0, sizeof(opts));
3218#ifdef CONFIG_SYN_COOKIES
3219	if (unlikely(req->cookie_ts))
3220		skb->skb_mstamp = cookie_init_timestamp(req);
3221	else
3222#endif
3223		skb->skb_mstamp = tcp_clock_us();
3224
3225#ifdef CONFIG_TCP_MD5SIG
3226	rcu_read_lock();
3227	md5 = tcp_rsk(req)->af_specific->req_md5_lookup(sk, req_to_sk(req));
3228#endif
3229	skb_set_hash(skb, tcp_rsk(req)->txhash, PKT_HASH_TYPE_L4);
3230	tcp_header_size = tcp_synack_options(sk, req, mss, skb, &opts, md5,
3231					     foc) + sizeof(*th);
3232
3233	skb_push(skb, tcp_header_size);
3234	skb_reset_transport_header(skb);
3235
3236	th = (struct tcphdr *)skb->data;
3237	memset(th, 0, sizeof(struct tcphdr));
3238	th->syn = 1;
3239	th->ack = 1;
3240	tcp_ecn_make_synack(req, th);
3241	th->source = htons(ireq->ir_num);
3242	th->dest = ireq->ir_rmt_port;
3243	skb->mark = ireq->ir_mark;
3244	skb->ip_summed = CHECKSUM_PARTIAL;
3245	th->seq = htonl(tcp_rsk(req)->snt_isn);
 
 
 
 
3246	/* XXX data is queued and acked as is. No buffer/window check */
3247	th->ack_seq = htonl(tcp_rsk(req)->rcv_nxt);
3248
3249	/* RFC1323: The window in SYN & SYN/ACK segments is never scaled. */
3250	th->window = htons(min(req->rsk_rcv_wnd, 65535U));
3251	tcp_options_write((__be32 *)(th + 1), NULL, &opts);
3252	th->doff = (tcp_header_size >> 2);
3253	__TCP_INC_STATS(sock_net(sk), TCP_MIB_OUTSEGS);
3254
3255#ifdef CONFIG_TCP_MD5SIG
3256	/* Okay, we have all we need - do the md5 hash if needed */
3257	if (md5)
3258		tcp_rsk(req)->af_specific->calc_md5_hash(opts.hash_location,
3259					       md5, req_to_sk(req), skb);
3260	rcu_read_unlock();
3261#endif
3262
3263	/* Do not fool tcpdump (if any), clean our debris */
3264	skb->tstamp = 0;
3265	return skb;
3266}
3267EXPORT_SYMBOL(tcp_make_synack);
3268
3269static void tcp_ca_dst_init(struct sock *sk, const struct dst_entry *dst)
3270{
3271	struct inet_connection_sock *icsk = inet_csk(sk);
3272	const struct tcp_congestion_ops *ca;
3273	u32 ca_key = dst_metric(dst, RTAX_CC_ALGO);
3274
3275	if (ca_key == TCP_CA_UNSPEC)
3276		return;
3277
3278	rcu_read_lock();
3279	ca = tcp_ca_find_key(ca_key);
3280	if (likely(ca && try_module_get(ca->owner))) {
3281		module_put(icsk->icsk_ca_ops->owner);
3282		icsk->icsk_ca_dst_locked = tcp_ca_dst_locked(dst);
3283		icsk->icsk_ca_ops = ca;
3284	}
3285	rcu_read_unlock();
3286}
3287
3288/* Do all connect socket setups that can be done AF independent. */
3289static void tcp_connect_init(struct sock *sk)
3290{
3291	const struct dst_entry *dst = __sk_dst_get(sk);
3292	struct tcp_sock *tp = tcp_sk(sk);
3293	__u8 rcv_wscale;
3294	u32 rcv_wnd;
3295
3296	/* We'll fix this up when we get a response from the other end.
3297	 * See tcp_input.c:tcp_rcv_state_process case TCP_SYN_SENT.
3298	 */
3299	tp->tcp_header_len = sizeof(struct tcphdr);
3300	if (sock_net(sk)->ipv4.sysctl_tcp_timestamps)
3301		tp->tcp_header_len += TCPOLEN_TSTAMP_ALIGNED;
3302
3303#ifdef CONFIG_TCP_MD5SIG
3304	if (tp->af_specific->md5_lookup(sk, sk))
3305		tp->tcp_header_len += TCPOLEN_MD5SIG_ALIGNED;
3306#endif
3307
3308	/* If user gave his TCP_MAXSEG, record it to clamp */
3309	if (tp->rx_opt.user_mss)
3310		tp->rx_opt.mss_clamp = tp->rx_opt.user_mss;
3311	tp->max_window = 0;
3312	tcp_mtup_init(sk);
3313	tcp_sync_mss(sk, dst_mtu(dst));
3314
3315	tcp_ca_dst_init(sk, dst);
3316
3317	if (!tp->window_clamp)
3318		tp->window_clamp = dst_metric(dst, RTAX_WINDOW);
3319	tp->advmss = tcp_mss_clamp(tp, dst_metric_advmss(dst));
 
 
3320
3321	tcp_initialize_rcv_mss(sk);
3322
3323	/* limit the window selection if the user enforce a smaller rx buffer */
3324	if (sk->sk_userlocks & SOCK_RCVBUF_LOCK &&
3325	    (tp->window_clamp > tcp_full_space(sk) || tp->window_clamp == 0))
3326		tp->window_clamp = tcp_full_space(sk);
3327
3328	rcv_wnd = tcp_rwnd_init_bpf(sk);
3329	if (rcv_wnd == 0)
3330		rcv_wnd = dst_metric(dst, RTAX_INITRWND);
3331
3332	tcp_select_initial_window(sk, tcp_full_space(sk),
3333				  tp->advmss - (tp->rx_opt.ts_recent_stamp ? tp->tcp_header_len - sizeof(struct tcphdr) : 0),
3334				  &tp->rcv_wnd,
3335				  &tp->window_clamp,
3336				  sock_net(sk)->ipv4.sysctl_tcp_window_scaling,
3337				  &rcv_wscale,
3338				  rcv_wnd);
3339
3340	tp->rx_opt.rcv_wscale = rcv_wscale;
3341	tp->rcv_ssthresh = tp->rcv_wnd;
3342
3343	sk->sk_err = 0;
3344	sock_reset_flag(sk, SOCK_DONE);
3345	tp->snd_wnd = 0;
3346	tcp_init_wl(tp, 0);
3347	tcp_write_queue_purge(sk);
3348	tp->snd_una = tp->write_seq;
3349	tp->snd_sml = tp->write_seq;
3350	tp->snd_up = tp->write_seq;
3351	tp->snd_nxt = tp->write_seq;
3352
3353	if (likely(!tp->repair))
3354		tp->rcv_nxt = 0;
3355	else
3356		tp->rcv_tstamp = tcp_jiffies32;
3357	tp->rcv_wup = tp->rcv_nxt;
3358	tp->copied_seq = tp->rcv_nxt;
3359
3360	inet_csk(sk)->icsk_rto = tcp_timeout_init(sk);
3361	inet_csk(sk)->icsk_retransmits = 0;
3362	tcp_clear_retrans(tp);
3363}
3364
3365static void tcp_connect_queue_skb(struct sock *sk, struct sk_buff *skb)
3366{
3367	struct tcp_sock *tp = tcp_sk(sk);
3368	struct tcp_skb_cb *tcb = TCP_SKB_CB(skb);
3369
3370	tcb->end_seq += skb->len;
3371	__skb_header_release(skb);
 
3372	sk->sk_wmem_queued += skb->truesize;
3373	sk_mem_charge(sk, skb->truesize);
3374	tp->write_seq = tcb->end_seq;
3375	tp->packets_out += tcp_skb_pcount(skb);
3376}
3377
3378/* Build and send a SYN with data and (cached) Fast Open cookie. However,
3379 * queue a data-only packet after the regular SYN, such that regular SYNs
3380 * are retransmitted on timeouts. Also if the remote SYN-ACK acknowledges
3381 * only the SYN sequence, the data are retransmitted in the first ACK.
3382 * If cookie is not cached or other error occurs, falls back to send a
3383 * regular SYN with Fast Open cookie request option.
3384 */
3385static int tcp_send_syn_data(struct sock *sk, struct sk_buff *syn)
3386{
3387	struct tcp_sock *tp = tcp_sk(sk);
3388	struct tcp_fastopen_request *fo = tp->fastopen_req;
3389	int space, err = 0;
3390	struct sk_buff *syn_data;
 
3391
3392	tp->rx_opt.mss_clamp = tp->advmss;  /* If MSS is not cached */
3393	if (!tcp_fastopen_cookie_check(sk, &tp->rx_opt.mss_clamp, &fo->cookie))
 
 
 
 
 
 
 
 
 
 
 
3394		goto fallback;
3395
3396	/* MSS for SYN-data is based on cached MSS and bounded by PMTU and
3397	 * user-MSS. Reserve maximum option space for middleboxes that add
3398	 * private TCP options. The cost is reduced data space in SYN :(
3399	 */
3400	tp->rx_opt.mss_clamp = tcp_mss_clamp(tp, tp->rx_opt.mss_clamp);
3401
3402	space = __tcp_mtu_to_mss(sk, inet_csk(sk)->icsk_pmtu_cookie) -
3403		MAX_TCP_OPTION_SPACE;
3404
3405	space = min_t(size_t, space, fo->size);
3406
3407	/* limit to order-0 allocations */
3408	space = min_t(size_t, space, SKB_MAX_HEAD(MAX_TCP_HEADER));
3409
3410	syn_data = sk_stream_alloc_skb(sk, space, sk->sk_allocation, false);
3411	if (!syn_data)
 
3412		goto fallback;
3413	syn_data->ip_summed = CHECKSUM_PARTIAL;
3414	memcpy(syn_data->cb, syn->cb, sizeof(syn->cb));
3415	if (space) {
3416		int copied = copy_from_iter(skb_put(syn_data, space), space,
3417					    &fo->data->msg_iter);
3418		if (unlikely(!copied)) {
3419			tcp_skb_tsorted_anchor_cleanup(syn_data);
3420			kfree_skb(syn_data);
 
 
 
 
 
3421			goto fallback;
3422		}
3423		if (copied != space) {
3424			skb_trim(syn_data, copied);
3425			space = copied;
3426		}
3427	}
3428	/* No more data pending in inet_wait_for_connect() */
3429	if (space == fo->size)
3430		fo->data = NULL;
3431	fo->copied = space;
3432
3433	tcp_connect_queue_skb(sk, syn_data);
3434	if (syn_data->len)
3435		tcp_chrono_start(sk, TCP_CHRONO_BUSY);
 
 
 
 
 
 
3436
3437	err = tcp_transmit_skb(sk, syn_data, 1, sk->sk_allocation);
3438
3439	syn->skb_mstamp = syn_data->skb_mstamp;
 
 
3440
3441	/* Now full SYN+DATA was cloned and sent (or not),
3442	 * remove the SYN from the original skb (syn_data)
3443	 * we keep in write queue in case of a retransmit, as we
3444	 * also have the SYN packet (with no data) in the same queue.
3445	 */
3446	TCP_SKB_CB(syn_data)->seq++;
3447	TCP_SKB_CB(syn_data)->tcp_flags = TCPHDR_ACK | TCPHDR_PSH;
3448	if (!err) {
3449		tp->syn_data = (fo->copied > 0);
3450		tcp_rbtree_insert(&sk->tcp_rtx_queue, syn_data);
3451		NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPORIGDATASENT);
3452		goto done;
3453	}
3454
3455	/* data was not sent, put it in write_queue */
3456	__skb_queue_tail(&sk->sk_write_queue, syn_data);
3457	tp->packets_out -= tcp_skb_pcount(syn_data);
3458
3459fallback:
3460	/* Send a regular SYN with Fast Open cookie request option */
3461	if (fo->cookie.len > 0)
3462		fo->cookie.len = 0;
3463	err = tcp_transmit_skb(sk, syn, 1, sk->sk_allocation);
3464	if (err)
3465		tp->syn_fastopen = 0;
 
3466done:
3467	fo->cookie.len = -1;  /* Exclude Fast Open option for SYN retries */
3468	return err;
3469}
3470
3471/* Build a SYN and send it off. */
3472int tcp_connect(struct sock *sk)
3473{
3474	struct tcp_sock *tp = tcp_sk(sk);
3475	struct sk_buff *buff;
3476	int err;
3477
3478	tcp_call_bpf(sk, BPF_SOCK_OPS_TCP_CONNECT_CB, 0, NULL);
3479
3480	if (inet_csk(sk)->icsk_af_ops->rebuild_header(sk))
3481		return -EHOSTUNREACH; /* Routing failure or similar. */
3482
3483	tcp_connect_init(sk);
3484
3485	if (unlikely(tp->repair)) {
3486		tcp_finish_connect(sk, NULL);
3487		return 0;
3488	}
3489
3490	buff = sk_stream_alloc_skb(sk, 0, sk->sk_allocation, true);
3491	if (unlikely(!buff))
3492		return -ENOBUFS;
3493
 
 
 
3494	tcp_init_nondata_skb(buff, tp->write_seq++, TCPHDR_SYN);
3495	tcp_mstamp_refresh(tp);
3496	tp->retrans_stamp = tcp_time_stamp(tp);
3497	tcp_connect_queue_skb(sk, buff);
3498	tcp_ecn_send_syn(sk, buff);
3499	tcp_rbtree_insert(&sk->tcp_rtx_queue, buff);
3500
3501	/* Send off SYN; include data in Fast Open. */
3502	err = tp->fastopen_req ? tcp_send_syn_data(sk, buff) :
3503	      tcp_transmit_skb(sk, buff, 1, sk->sk_allocation);
3504	if (err == -ECONNREFUSED)
3505		return err;
3506
3507	/* We change tp->snd_nxt after the tcp_transmit_skb() call
3508	 * in order to make this packet get counted in tcpOutSegs.
3509	 */
3510	tp->snd_nxt = tp->write_seq;
3511	tp->pushed_seq = tp->write_seq;
3512	buff = tcp_send_head(sk);
3513	if (unlikely(buff)) {
3514		tp->snd_nxt	= TCP_SKB_CB(buff)->seq;
3515		tp->pushed_seq	= TCP_SKB_CB(buff)->seq;
3516	}
3517	TCP_INC_STATS(sock_net(sk), TCP_MIB_ACTIVEOPENS);
3518
3519	/* Timer for repeating the SYN until an answer. */
3520	inet_csk_reset_xmit_timer(sk, ICSK_TIME_RETRANS,
3521				  inet_csk(sk)->icsk_rto, TCP_RTO_MAX);
3522	return 0;
3523}
3524EXPORT_SYMBOL(tcp_connect);
3525
3526/* Send out a delayed ack, the caller does the policy checking
3527 * to see if we should even be here.  See tcp_input.c:tcp_ack_snd_check()
3528 * for details.
3529 */
3530void tcp_send_delayed_ack(struct sock *sk)
3531{
3532	struct inet_connection_sock *icsk = inet_csk(sk);
3533	int ato = icsk->icsk_ack.ato;
3534	unsigned long timeout;
3535
3536	tcp_ca_event(sk, CA_EVENT_DELAYED_ACK);
3537
3538	if (ato > TCP_DELACK_MIN) {
3539		const struct tcp_sock *tp = tcp_sk(sk);
3540		int max_ato = HZ / 2;
3541
3542		if (icsk->icsk_ack.pingpong ||
3543		    (icsk->icsk_ack.pending & ICSK_ACK_PUSHED))
3544			max_ato = TCP_DELACK_MAX;
3545
3546		/* Slow path, intersegment interval is "high". */
3547
3548		/* If some rtt estimate is known, use it to bound delayed ack.
3549		 * Do not use inet_csk(sk)->icsk_rto here, use results of rtt measurements
3550		 * directly.
3551		 */
3552		if (tp->srtt_us) {
3553			int rtt = max_t(int, usecs_to_jiffies(tp->srtt_us >> 3),
3554					TCP_DELACK_MIN);
3555
3556			if (rtt < max_ato)
3557				max_ato = rtt;
3558		}
3559
3560		ato = min(ato, max_ato);
3561	}
3562
3563	/* Stay within the limit we were given */
3564	timeout = jiffies + ato;
3565
3566	/* Use new timeout only if there wasn't a older one earlier. */
3567	if (icsk->icsk_ack.pending & ICSK_ACK_TIMER) {
3568		/* If delack timer was blocked or is about to expire,
3569		 * send ACK now.
3570		 */
3571		if (icsk->icsk_ack.blocked ||
3572		    time_before_eq(icsk->icsk_ack.timeout, jiffies + (ato >> 2))) {
3573			tcp_send_ack(sk);
3574			return;
3575		}
3576
3577		if (!time_before(timeout, icsk->icsk_ack.timeout))
3578			timeout = icsk->icsk_ack.timeout;
3579	}
3580	icsk->icsk_ack.pending |= ICSK_ACK_SCHED | ICSK_ACK_TIMER;
3581	icsk->icsk_ack.timeout = timeout;
3582	sk_reset_timer(sk, &icsk->icsk_delack_timer, timeout);
3583}
3584
3585/* This routine sends an ack and also updates the window. */
3586void tcp_send_ack(struct sock *sk)
3587{
3588	struct sk_buff *buff;
3589
3590	/* If we have been reset, we may not send again. */
3591	if (sk->sk_state == TCP_CLOSE)
3592		return;
3593
3594	tcp_ca_event(sk, CA_EVENT_NON_DELAYED_ACK);
3595
3596	/* We are not putting this on the write queue, so
3597	 * tcp_transmit_skb() will set the ownership to this
3598	 * sock.
3599	 */
3600	buff = alloc_skb(MAX_TCP_HEADER,
3601			 sk_gfp_mask(sk, GFP_ATOMIC | __GFP_NOWARN));
3602	if (unlikely(!buff)) {
3603		inet_csk_schedule_ack(sk);
3604		inet_csk(sk)->icsk_ack.ato = TCP_ATO_MIN;
3605		inet_csk_reset_xmit_timer(sk, ICSK_TIME_DACK,
3606					  TCP_DELACK_MAX, TCP_RTO_MAX);
3607		return;
3608	}
3609
3610	/* Reserve space for headers and prepare control bits. */
3611	skb_reserve(buff, MAX_TCP_HEADER);
3612	tcp_init_nondata_skb(buff, tcp_acceptable_seq(sk), TCPHDR_ACK);
3613
3614	/* We do not want pure acks influencing TCP Small Queues or fq/pacing
3615	 * too much.
3616	 * SKB_TRUESIZE(max(1 .. 66, MAX_TCP_HEADER)) is unfortunately ~784
3617	 */
3618	skb_set_tcp_pure_ack(buff);
3619
3620	/* Send it off, this clears delayed acks for us. */
3621	tcp_transmit_skb(sk, buff, 0, (__force gfp_t)0);
 
3622}
3623EXPORT_SYMBOL_GPL(tcp_send_ack);
3624
3625/* This routine sends a packet with an out of date sequence
3626 * number. It assumes the other end will try to ack it.
3627 *
3628 * Question: what should we make while urgent mode?
3629 * 4.4BSD forces sending single byte of data. We cannot send
3630 * out of window data, because we have SND.NXT==SND.MAX...
3631 *
3632 * Current solution: to send TWO zero-length segments in urgent mode:
3633 * one is with SEG.SEQ=SND.UNA to deliver urgent pointer, another is
3634 * out-of-date with SND.UNA-1 to probe window.
3635 */
3636static int tcp_xmit_probe_skb(struct sock *sk, int urgent, int mib)
3637{
3638	struct tcp_sock *tp = tcp_sk(sk);
3639	struct sk_buff *skb;
3640
3641	/* We don't queue it, tcp_transmit_skb() sets ownership. */
3642	skb = alloc_skb(MAX_TCP_HEADER,
3643			sk_gfp_mask(sk, GFP_ATOMIC | __GFP_NOWARN));
3644	if (!skb)
3645		return -1;
3646
3647	/* Reserve space for headers and set control bits. */
3648	skb_reserve(skb, MAX_TCP_HEADER);
3649	/* Use a previous sequence.  This should cause the other
3650	 * end to send an ack.  Don't queue or clone SKB, just
3651	 * send it.
3652	 */
3653	tcp_init_nondata_skb(skb, tp->snd_una - !urgent, TCPHDR_ACK);
3654	NET_INC_STATS(sock_net(sk), mib);
3655	return tcp_transmit_skb(sk, skb, 0, (__force gfp_t)0);
3656}
3657
3658/* Called from setsockopt( ... TCP_REPAIR ) */
3659void tcp_send_window_probe(struct sock *sk)
3660{
3661	if (sk->sk_state == TCP_ESTABLISHED) {
3662		tcp_sk(sk)->snd_wl1 = tcp_sk(sk)->rcv_nxt - 1;
3663		tcp_mstamp_refresh(tcp_sk(sk));
3664		tcp_xmit_probe_skb(sk, 0, LINUX_MIB_TCPWINPROBE);
3665	}
3666}
3667
3668/* Initiate keepalive or window probe from timer. */
3669int tcp_write_wakeup(struct sock *sk, int mib)
3670{
3671	struct tcp_sock *tp = tcp_sk(sk);
3672	struct sk_buff *skb;
3673
3674	if (sk->sk_state == TCP_CLOSE)
3675		return -1;
3676
3677	skb = tcp_send_head(sk);
3678	if (skb && before(TCP_SKB_CB(skb)->seq, tcp_wnd_end(tp))) {
3679		int err;
3680		unsigned int mss = tcp_current_mss(sk);
3681		unsigned int seg_size = tcp_wnd_end(tp) - TCP_SKB_CB(skb)->seq;
3682
3683		if (before(tp->pushed_seq, TCP_SKB_CB(skb)->end_seq))
3684			tp->pushed_seq = TCP_SKB_CB(skb)->end_seq;
3685
3686		/* We are probing the opening of a window
3687		 * but the window size is != 0
3688		 * must have been a result SWS avoidance ( sender )
3689		 */
3690		if (seg_size < TCP_SKB_CB(skb)->end_seq - TCP_SKB_CB(skb)->seq ||
3691		    skb->len > mss) {
3692			seg_size = min(seg_size, mss);
3693			TCP_SKB_CB(skb)->tcp_flags |= TCPHDR_PSH;
3694			if (tcp_fragment(sk, TCP_FRAG_IN_WRITE_QUEUE,
3695					 skb, seg_size, mss, GFP_ATOMIC))
3696				return -1;
3697		} else if (!tcp_skb_pcount(skb))
3698			tcp_set_skb_tso_segs(skb, mss);
3699
3700		TCP_SKB_CB(skb)->tcp_flags |= TCPHDR_PSH;
 
3701		err = tcp_transmit_skb(sk, skb, 1, GFP_ATOMIC);
3702		if (!err)
3703			tcp_event_new_data_sent(sk, skb);
3704		return err;
3705	} else {
3706		if (between(tp->snd_up, tp->snd_una + 1, tp->snd_una + 0xFFFF))
3707			tcp_xmit_probe_skb(sk, 1, mib);
3708		return tcp_xmit_probe_skb(sk, 0, mib);
3709	}
3710}
3711
3712/* A window probe timeout has occurred.  If window is not closed send
3713 * a partial packet else a zero probe.
3714 */
3715void tcp_send_probe0(struct sock *sk)
3716{
3717	struct inet_connection_sock *icsk = inet_csk(sk);
3718	struct tcp_sock *tp = tcp_sk(sk);
3719	struct net *net = sock_net(sk);
3720	unsigned long probe_max;
3721	int err;
3722
3723	err = tcp_write_wakeup(sk, LINUX_MIB_TCPWINPROBE);
3724
3725	if (tp->packets_out || tcp_write_queue_empty(sk)) {
3726		/* Cancel probe timer, if it is not required. */
3727		icsk->icsk_probes_out = 0;
3728		icsk->icsk_backoff = 0;
3729		return;
3730	}
3731
3732	if (err <= 0) {
3733		if (icsk->icsk_backoff < net->ipv4.sysctl_tcp_retries2)
3734			icsk->icsk_backoff++;
3735		icsk->icsk_probes_out++;
3736		probe_max = TCP_RTO_MAX;
 
 
3737	} else {
3738		/* If packet was not sent due to local congestion,
3739		 * do not backoff and do not remember icsk_probes_out.
3740		 * Let local senders to fight for local resources.
3741		 *
3742		 * Use accumulated backoff yet.
3743		 */
3744		if (!icsk->icsk_probes_out)
3745			icsk->icsk_probes_out = 1;
3746		probe_max = TCP_RESOURCE_PROBE_INTERVAL;
3747	}
3748	inet_csk_reset_xmit_timer(sk, ICSK_TIME_PROBE0,
3749				  tcp_probe0_when(sk, probe_max),
3750				  TCP_RTO_MAX);
3751}
3752
3753int tcp_rtx_synack(const struct sock *sk, struct request_sock *req)
3754{
3755	const struct tcp_request_sock_ops *af_ops = tcp_rsk(req)->af_specific;
3756	struct flowi fl;
3757	int res;
3758
3759	tcp_rsk(req)->txhash = net_tx_rndhash();
3760	res = af_ops->send_synack(sk, NULL, &fl, req, NULL, TCP_SYNACK_NORMAL);
3761	if (!res) {
3762		__TCP_INC_STATS(sock_net(sk), TCP_MIB_RETRANSSEGS);
3763		__NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPSYNRETRANS);
3764		if (unlikely(tcp_passive_fastopen(sk)))
3765			tcp_sk(sk)->total_retrans++;
3766		trace_tcp_retransmit_synack(sk, req);
3767	}
3768	return res;
3769}
3770EXPORT_SYMBOL(tcp_rtx_synack);