// SPDX-License-Identifier: GPL-2.0-or-later
/* RxRPC packet transmission
 *
 * Copyright (C) 2007 Red Hat, Inc. All Rights Reserved.
 * Written by David Howells (dhowells@redhat.com)
 */

#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt

#include <linux/net.h>
#include <linux/gfp.h>
#include <linux/skbuff.h>
#include <linux/export.h>
#include <net/sock.h>
#include <net/af_rxrpc.h>
#include <net/udp.h>
#include "ar-internal.h"

ssize_t do_udp_sendmsg(struct socket *socket, struct msghdr *msg, size_t len)
{
        struct sockaddr *sa = msg->msg_name;
        struct sock *sk = socket->sk;

        if (IS_ENABLED(CONFIG_AF_RXRPC_IPV6)) {
                if (sa->sa_family == AF_INET6) {
                        if (sk->sk_family != AF_INET6) {
                                pr_warn("AF_INET6 address on AF_INET socket\n");
                                return -ENOPROTOOPT;
                        }
                        return udpv6_sendmsg(sk, msg, len);
                }
        }
        return udp_sendmsg(sk, msg, len);
}

struct rxrpc_abort_buffer {
        struct rxrpc_wire_header whdr;
        __be32 abort_code;
};

static const char rxrpc_keepalive_string[] = "";

/*
 * Increase Tx backoff on transmission failure and clear it on success.
 */
static void rxrpc_tx_backoff(struct rxrpc_call *call, int ret)
{
        if (ret < 0) {
                if (call->tx_backoff < 1000)
                        call->tx_backoff += 100;
        } else {
                call->tx_backoff = 0;
        }
}

/*
 * Arrange for a keepalive ping a certain time after we last transmitted.  This
 * lets the far side know we're still interested in this call and helps keep
 * the route through any intervening firewall open.
 *
 * Receiving a response to the ping will prevent the ->expect_rx_by timer from
 * expiring.
 */
static void rxrpc_set_keepalive(struct rxrpc_call *call, ktime_t now)
{
        ktime_t delay = ms_to_ktime(READ_ONCE(call->next_rx_timo) / 6);

        call->keepalive_at = ktime_add(ktime_get_real(), delay);
        trace_rxrpc_timer_set(call, delay, rxrpc_timer_trace_keepalive);
}

/*
 * Allocate transmission buffers for an ACK and attach them to local->kv[].
 */
static int rxrpc_alloc_ack(struct rxrpc_call *call, size_t sack_size)
{
        struct rxrpc_wire_header *whdr;
        struct rxrpc_acktrailer *trailer;
        struct rxrpc_ackpacket *ack;
        struct kvec *kv = call->local->kvec;
        gfp_t gfp = rcu_read_lock_held() ? GFP_ATOMIC | __GFP_NOWARN : GFP_NOFS;
        void *buf, *buf2 = NULL;
        u8 *filler;

        buf = page_frag_alloc(&call->local->tx_alloc,
                              sizeof(*whdr) + sizeof(*ack) + 1 + 3 + sizeof(*trailer), gfp);
        if (!buf)
                return -ENOMEM;

        if (sack_size) {
                buf2 = page_frag_alloc(&call->local->tx_alloc, sack_size, gfp);
                if (!buf2) {
                        page_frag_free(buf);
                        return -ENOMEM;
                }
        }

        whdr    = buf;
        ack     = buf + sizeof(*whdr);
        filler  = buf + sizeof(*whdr) + sizeof(*ack) + 1;
        trailer = buf + sizeof(*whdr) + sizeof(*ack) + 1 + 3;

        kv[0].iov_base  = whdr;
        kv[0].iov_len   = sizeof(*whdr) + sizeof(*ack);
        kv[1].iov_base  = buf2;
        kv[1].iov_len   = sack_size;
        kv[2].iov_base  = filler;
        kv[2].iov_len   = 3 + sizeof(*trailer);
        return 3; /* Number of kvec[] used. */
}

static void rxrpc_free_ack(struct rxrpc_call *call)
{
        page_frag_free(call->local->kvec[0].iov_base);
        if (call->local->kvec[1].iov_base)
                page_frag_free(call->local->kvec[1].iov_base);
}

/*
 * Record the beginning of an RTT probe.
 */
static void rxrpc_begin_rtt_probe(struct rxrpc_call *call, rxrpc_serial_t serial,
                                  ktime_t now, enum rxrpc_rtt_tx_trace why)
{
        unsigned long avail = call->rtt_avail;
        int rtt_slot = 9;

        if (!(avail & RXRPC_CALL_RTT_AVAIL_MASK))
                goto no_slot;

        rtt_slot = __ffs(avail & RXRPC_CALL_RTT_AVAIL_MASK);
        if (!test_and_clear_bit(rtt_slot, &call->rtt_avail))
                goto no_slot;

        call->rtt_serial[rtt_slot] = serial;
        call->rtt_sent_at[rtt_slot] = now;
        smp_wmb(); /* Write data before avail bit */
        set_bit(rtt_slot + RXRPC_CALL_RTT_PEND_SHIFT, &call->rtt_avail);

        trace_rxrpc_rtt_tx(call, why, rtt_slot, serial);
        return;

no_slot:
        trace_rxrpc_rtt_tx(call, rxrpc_rtt_tx_no_slot, rtt_slot, serial);
}

/*
 * Fill out an ACK packet.
 */
static int rxrpc_fill_out_ack(struct rxrpc_call *call, int nr_kv, u8 ack_reason,
                              rxrpc_serial_t serial_to_ack, rxrpc_serial_t *_ack_serial)
{
        struct kvec *kv = call->local->kvec;
        struct rxrpc_wire_header *whdr = kv[0].iov_base;
        struct rxrpc_acktrailer *trailer = kv[2].iov_base + 3;
        struct rxrpc_ackpacket *ack = (struct rxrpc_ackpacket *)(whdr + 1);
        unsigned int qsize, sack, wrap, to, max_mtu, if_mtu;
        rxrpc_seq_t window, wtop;
        ktime_t now = ktime_get_real();
        int rsize;
        u8 *filler = kv[2].iov_base;
        u8 *sackp = kv[1].iov_base;

        rxrpc_inc_stat(call->rxnet, stat_tx_ack_fill);

        window = call->ackr_window;
        wtop   = call->ackr_wtop;
        sack   = call->ackr_sack_base % RXRPC_SACK_SIZE;

        *_ack_serial = rxrpc_get_next_serial(call->conn);

        whdr->epoch             = htonl(call->conn->proto.epoch);
        whdr->cid               = htonl(call->cid);
        whdr->callNumber        = htonl(call->call_id);
        whdr->serial            = htonl(*_ack_serial);
        whdr->seq               = 0;
        whdr->type              = RXRPC_PACKET_TYPE_ACK;
        whdr->flags             = call->conn->out_clientflag | RXRPC_SLOW_START_OK;
        whdr->userStatus        = 0;
        whdr->securityIndex     = call->security_ix;
        whdr->_rsvd             = 0;
        whdr->serviceId         = htons(call->dest_srx.srx_service);

        ack->bufferSpace        = 0;
        ack->maxSkew            = 0;
        ack->firstPacket        = htonl(window);
        ack->previousPacket     = htonl(call->rx_highest_seq);
        ack->serial             = htonl(serial_to_ack);
        ack->reason             = ack_reason;
        ack->nAcks              = wtop - window;
        filler[0]               = 0;
        filler[1]               = 0;
        filler[2]               = 0;

        if (ack_reason == RXRPC_ACK_PING)
                whdr->flags |= RXRPC_REQUEST_ACK;

        if (after(wtop, window)) {
                kv[1].iov_len = ack->nAcks;

                wrap = RXRPC_SACK_SIZE - sack;
                to = umin(ack->nAcks, RXRPC_SACK_SIZE);

                if (sack + ack->nAcks <= RXRPC_SACK_SIZE) {
                        memcpy(sackp, call->ackr_sack_table + sack, ack->nAcks);
                } else {
                        memcpy(sackp, call->ackr_sack_table + sack, wrap);
                        memcpy(sackp + wrap, call->ackr_sack_table, to - wrap);
                }
        } else if (before(wtop, window)) {
                pr_warn("ack window backward %x %x", window, wtop);
        } else if (ack->reason == RXRPC_ACK_DELAY) {
                ack->reason = RXRPC_ACK_IDLE;
        }

        qsize = (window - 1) - call->rx_consumed;
        rsize = max_t(int, call->rx_winsize - qsize, 0);

        if_mtu = call->peer->if_mtu - call->peer->hdrsize;
        if (call->peer->ackr_adv_pmtud) {
                max_mtu = umax(call->peer->max_data, rxrpc_rx_mtu);
        } else {
                if_mtu = umin(if_mtu, 1444);
                max_mtu = if_mtu;
        }

        trailer->maxMTU         = htonl(max_mtu);
        trailer->ifMTU          = htonl(if_mtu);
        trailer->rwind          = htonl(rsize);
        trailer->jumbo_max      = 0; /* Advertise pmtu discovery */

        if (ack_reason == RXRPC_ACK_PING)
                rxrpc_begin_rtt_probe(call, *_ack_serial, now, rxrpc_rtt_tx_ping);
        if (whdr->flags & RXRPC_REQUEST_ACK)
                call->rtt_last_req = now;
        rxrpc_set_keepalive(call, now);
        return nr_kv;
}

/*
 * Transmit an ACK packet.
 */
static void rxrpc_send_ack_packet(struct rxrpc_call *call, int nr_kv, size_t len,
                                  rxrpc_serial_t serial, enum rxrpc_propose_ack_trace why)
{
        struct kvec *kv = call->local->kvec;
        struct rxrpc_wire_header *whdr = kv[0].iov_base;
        struct rxrpc_acktrailer *trailer = kv[2].iov_base + 3;
        struct rxrpc_connection *conn;
        struct rxrpc_ackpacket *ack = (struct rxrpc_ackpacket *)(whdr + 1);
        struct msghdr msg;
        int ret;

        if (test_bit(RXRPC_CALL_DISCONNECTED, &call->flags))
                return;

        conn = call->conn;

        msg.msg_name    = &call->peer->srx.transport;
        msg.msg_namelen = call->peer->srx.transport_len;
        msg.msg_control = NULL;
        msg.msg_controllen = 0;
        msg.msg_flags   = MSG_SPLICE_PAGES;

        trace_rxrpc_tx_ack(call->debug_id, serial,
                           ntohl(ack->firstPacket),
                           ntohl(ack->serial), ack->reason, ack->nAcks,
                           ntohl(trailer->rwind), why);

        rxrpc_inc_stat(call->rxnet, stat_tx_ack_send);

        iov_iter_kvec(&msg.msg_iter, WRITE, kv, nr_kv, len);
        rxrpc_local_dont_fragment(conn->local, why == rxrpc_propose_ack_ping_for_mtu_probe);

        ret = do_udp_sendmsg(conn->local->socket, &msg, len);
        rxrpc_peer_mark_tx(call->peer);
        if (ret < 0) {
                trace_rxrpc_tx_fail(call->debug_id, serial, ret,
                                    rxrpc_tx_point_call_ack);
                if (why == rxrpc_propose_ack_ping_for_mtu_probe &&
                    ret == -EMSGSIZE)
                        rxrpc_input_probe_for_pmtud(conn, serial, true);
        } else {
                trace_rxrpc_tx_packet(call->debug_id, whdr,
                                      rxrpc_tx_point_call_ack);
                if (why == rxrpc_propose_ack_ping_for_mtu_probe) {
                        call->peer->pmtud_pending = false;
                        call->peer->pmtud_probing = true;
                        call->conn->pmtud_probe = serial;
                        call->conn->pmtud_call = call->debug_id;
                        trace_rxrpc_pmtud_tx(call);
                }
        }
        rxrpc_tx_backoff(call, ret);
}

/*
 * Queue an ACK for immediate transmission.
 */
void rxrpc_send_ACK(struct rxrpc_call *call, u8 ack_reason,
                    rxrpc_serial_t serial_to_ack, enum rxrpc_propose_ack_trace why)
{
        struct kvec *kv = call->local->kvec;
        rxrpc_serial_t ack_serial;
        size_t len;
        int nr_kv;

        if (test_bit(RXRPC_CALL_DISCONNECTED, &call->flags))
                return;

        rxrpc_inc_stat(call->rxnet, stat_tx_acks[ack_reason]);

        nr_kv = rxrpc_alloc_ack(call, call->ackr_wtop - call->ackr_window);
        if (nr_kv < 0) {
                kleave(" = -ENOMEM");
                return;
        }

        nr_kv = rxrpc_fill_out_ack(call, nr_kv, ack_reason, serial_to_ack, &ack_serial);
        len  = kv[0].iov_len;
        len += kv[1].iov_len;
        len += kv[2].iov_len;

        /* Extend a path MTU probe ACK. */
        if (why == rxrpc_propose_ack_ping_for_mtu_probe) {
                size_t probe_mtu = call->peer->pmtud_trial + sizeof(struct rxrpc_wire_header);

                if (len > probe_mtu)
                        goto skip;
                while (len < probe_mtu) {
                        size_t part = umin(probe_mtu - len, PAGE_SIZE);

                        kv[nr_kv].iov_base = page_address(ZERO_PAGE(0));
                        kv[nr_kv].iov_len = part;
                        len += part;
                        nr_kv++;
                }
        }

        call->ackr_nr_unacked = 0;
        atomic_set(&call->ackr_nr_consumed, 0);
        clear_bit(RXRPC_CALL_RX_IS_IDLE, &call->flags);

        trace_rxrpc_send_ack(call, why, ack_reason, ack_serial);
        rxrpc_send_ack_packet(call, nr_kv, len, ack_serial, why);
skip:
        rxrpc_free_ack(call);
}

/*
 * Send an ACK probe for path MTU discovery.
 */
void rxrpc_send_probe_for_pmtud(struct rxrpc_call *call)
{
        rxrpc_send_ACK(call, RXRPC_ACK_PING, 0,
                       rxrpc_propose_ack_ping_for_mtu_probe);
}

/*
 * Send an ABORT call packet.
 */
int rxrpc_send_abort_packet(struct rxrpc_call *call)
{
        struct rxrpc_connection *conn;
        struct rxrpc_abort_buffer pkt;
        struct msghdr msg;
        struct kvec iov[1];
        rxrpc_serial_t serial;
        int ret;

        /* Don't bother sending aborts for a client call once the server has
         * hard-ACK'd all of its request data.  After that point, we're not
         * going to stop the operation proceeding, and whilst we might limit
         * the reply, it's not worth it if we can send a new call on the same
         * channel instead, thereby closing off this call.
         */
        if (rxrpc_is_client_call(call) &&
            test_bit(RXRPC_CALL_TX_ALL_ACKED, &call->flags))
                return 0;

        if (test_bit(RXRPC_CALL_DISCONNECTED, &call->flags))
                return -ECONNRESET;

        conn = call->conn;

        msg.msg_name    = &call->peer->srx.transport;
        msg.msg_namelen = call->peer->srx.transport_len;
        msg.msg_control = NULL;
        msg.msg_controllen = 0;
        msg.msg_flags   = 0;

        pkt.whdr.epoch          = htonl(conn->proto.epoch);
        pkt.whdr.cid            = htonl(call->cid);
        pkt.whdr.callNumber     = htonl(call->call_id);
        pkt.whdr.seq            = 0;
        pkt.whdr.type           = RXRPC_PACKET_TYPE_ABORT;
        pkt.whdr.flags          = conn->out_clientflag;
        pkt.whdr.userStatus     = 0;
        pkt.whdr.securityIndex  = call->security_ix;
        pkt.whdr._rsvd          = 0;
        pkt.whdr.serviceId      = htons(call->dest_srx.srx_service);
        pkt.abort_code          = htonl(call->abort_code);

        iov[0].iov_base = &pkt;
        iov[0].iov_len  = sizeof(pkt);

        serial = rxrpc_get_next_serial(conn);
        pkt.whdr.serial = htonl(serial);

        iov_iter_kvec(&msg.msg_iter, WRITE, iov, 1, sizeof(pkt));
        ret = do_udp_sendmsg(conn->local->socket, &msg, sizeof(pkt));
        rxrpc_peer_mark_tx(conn->peer);
        if (ret < 0)
                trace_rxrpc_tx_fail(call->debug_id, serial, ret,
                                    rxrpc_tx_point_call_abort);
        else
                trace_rxrpc_tx_packet(call->debug_id, &pkt.whdr,
                                      rxrpc_tx_point_call_abort);
        rxrpc_tx_backoff(call, ret);
        return ret;
}

/*
 * Prepare a (sub)packet for transmission.
 */
static size_t rxrpc_prepare_data_subpacket(struct rxrpc_call *call,
                                           struct rxrpc_send_data_req *req,
                                           struct rxrpc_txbuf *txb,
                                           struct rxrpc_wire_header *whdr,
                                           rxrpc_serial_t serial, int subpkt)
{
        struct rxrpc_jumbo_header *jumbo = txb->data - sizeof(*jumbo);
        enum rxrpc_req_ack_trace why;
        struct rxrpc_connection *conn = call->conn;
        struct kvec *kv = &call->local->kvec[1 + subpkt];
        size_t len = txb->pkt_len;
        bool last;
        u8 flags;

        _enter("%x,%zd", txb->seq, len);

        txb->serial = serial;

        if (test_bit(RXRPC_CONN_PROBING_FOR_UPGRADE, &conn->flags) &&
            txb->seq == 1)
                whdr->userStatus = RXRPC_USERSTATUS_SERVICE_UPGRADE;

        txb->flags &= ~RXRPC_REQUEST_ACK;
        flags = txb->flags & RXRPC_TXBUF_WIRE_FLAGS;
        last = txb->flags & RXRPC_LAST_PACKET;

        if (subpkt < req->n - 1) {
                len = RXRPC_JUMBO_DATALEN;
                goto dont_set_request_ack;
        }

        /* If our RTT cache needs working on, request an ACK.  Also request
         * ACKs if a DATA packet appears to have been lost.
         *
         * However, we mustn't request an ACK on the last reply packet of a
         * service call, lest OpenAFS incorrectly send us an ACK with some
         * soft-ACKs in it and then never follow up with a proper hard ACK.
         */
        if (last && rxrpc_sending_to_client(txb))
                why = rxrpc_reqack_no_srv_last;
        else if (test_and_clear_bit(RXRPC_CALL_EV_ACK_LOST, &call->events))
                why = rxrpc_reqack_ack_lost;
        else if (txb->flags & RXRPC_TXBUF_RESENT)
                why = rxrpc_reqack_retrans;
        else if (call->cong_ca_state == RXRPC_CA_SLOW_START && call->cong_cwnd <= RXRPC_MIN_CWND)
                why = rxrpc_reqack_slow_start;
        else if (call->tx_winsize <= 2)
                why = rxrpc_reqack_small_txwin;
        else if (call->rtt_count < 3)
                why = rxrpc_reqack_more_rtt;
        else if (ktime_before(ktime_add_ms(call->rtt_last_req, 1000), ktime_get_real()))
                why = rxrpc_reqack_old_rtt;
        else if (!last && !after(READ_ONCE(call->send_top), txb->seq))
                why = rxrpc_reqack_app_stall;
        else if (call->tx_winsize <= (2 * req->n) || call->cong_cwnd <= (2 * req->n))
                why = rxrpc_reqack_jumbo_win;
        else
                goto dont_set_request_ack;

        rxrpc_inc_stat(call->rxnet, stat_why_req_ack[why]);
        trace_rxrpc_req_ack(call->debug_id, txb->seq, why);
        if (why != rxrpc_reqack_no_srv_last) {
                flags |= RXRPC_REQUEST_ACK;
                trace_rxrpc_rtt_tx(call, rxrpc_rtt_tx_data, -1, serial);
                call->rtt_last_req = req->now;
        }
dont_set_request_ack:

        /* There's a jumbo header prepended to the data if we need it. */
        if (subpkt < req->n - 1)
                flags |= RXRPC_JUMBO_PACKET;
        else
                flags &= ~RXRPC_JUMBO_PACKET;
        if (subpkt == 0) {
                whdr->flags     = flags;
                whdr->cksum     = txb->cksum;
                kv->iov_base    = txb->data;
        } else {
                jumbo->flags    = flags;
                jumbo->pad      = 0;
                jumbo->cksum    = txb->cksum;
                kv->iov_base    = jumbo;
                len += sizeof(*jumbo);
        }

        trace_rxrpc_tx_data(call, txb->seq, txb->serial, flags, req->trace);
        kv->iov_len = len;
        return len;
}

/*
 * Prepare a transmission queue object for initial transmission.  Returns the
 * number of microseconds since the transmission queue base timestamp.
 */
static unsigned int rxrpc_prepare_txqueue(struct rxrpc_txqueue *tq,
                                          struct rxrpc_send_data_req *req)
{
        if (!tq)
                return 0;
        if (tq->xmit_ts_base == KTIME_MIN) {
                tq->xmit_ts_base = req->now;
                return 0;
        }
        return ktime_to_us(ktime_sub(req->now, tq->xmit_ts_base));
}

/*
 * Prepare a (jumbo) packet for transmission.
 */
static size_t rxrpc_prepare_data_packet(struct rxrpc_call *call,
                                        struct rxrpc_send_data_req *req,
                                        struct rxrpc_wire_header *whdr)
{
        struct rxrpc_txqueue *tq = req->tq;
        rxrpc_serial_t serial;
        unsigned int xmit_ts;
        rxrpc_seq_t seq = req->seq;
        size_t len = 0;
        bool start_tlp = false;

        trace_rxrpc_tq(call, tq, seq, rxrpc_tq_transmit);

        /* Each transmission of a Tx packet needs a new serial number */
        serial = rxrpc_get_next_serials(call->conn, req->n);

        whdr->epoch             = htonl(call->conn->proto.epoch);
        whdr->cid               = htonl(call->cid);
        whdr->callNumber        = htonl(call->call_id);
        whdr->seq               = htonl(seq);
        whdr->serial            = htonl(serial);
        whdr->type              = RXRPC_PACKET_TYPE_DATA;
        whdr->flags             = 0;
        whdr->userStatus        = 0;
        whdr->securityIndex     = call->security_ix;
        whdr->_rsvd             = 0;
        whdr->serviceId         = htons(call->conn->service_id);

        call->tx_last_serial = serial + req->n - 1;
        call->tx_last_sent = req->now;
        xmit_ts = rxrpc_prepare_txqueue(tq, req);
        prefetch(tq->next);

        for (int i = 0;;) {
                int ix = seq & RXRPC_TXQ_MASK;
                struct rxrpc_txbuf *txb = tq->bufs[seq & RXRPC_TXQ_MASK];

                _debug("prep[%u] tq=%x q=%x", i, tq->qbase, seq);

                /* Record (re-)transmission for RACK [RFC8985 6.1]. */
                if (__test_and_clear_bit(ix, &tq->segment_lost))
                        call->tx_nr_lost--;
                if (req->retrans) {
                        __set_bit(ix, &tq->ever_retransmitted);
                        __set_bit(ix, &tq->segment_retransmitted);
                        call->tx_nr_resent++;
                } else {
                        call->tx_nr_sent++;
                        start_tlp = true;
                }
                tq->segment_xmit_ts[ix] = xmit_ts;
                tq->segment_serial[ix] = serial;
                if (i + 1 == req->n)
                        /* Only sample the last subpacket in a jumbo. */
                        __set_bit(ix, &tq->rtt_samples);
                len += rxrpc_prepare_data_subpacket(call, req, txb, whdr, serial, i);
                serial++;
                seq++;
                i++;
                if (i >= req->n)
                        break;
                if (!(seq & RXRPC_TXQ_MASK)) {
                        tq = tq->next;
                        trace_rxrpc_tq(call, tq, seq, rxrpc_tq_transmit_advance);
                        xmit_ts = rxrpc_prepare_txqueue(tq, req);
                }
        }

        /* Set timeouts */
        if (req->tlp_probe) {
                /* Sending TLP loss probe [RFC8985 7.3]. */
                call->tlp_serial = serial - 1;
                call->tlp_seq = seq - 1;
        } else if (start_tlp) {
                /* Schedule TLP loss probe [RFC8985 7.2]. */
                ktime_t pto;

                if (!test_bit(RXRPC_CALL_BEGAN_RX_TIMER, &call->flags))
                         /* The first packet may take longer to elicit a response. */
                        pto = NSEC_PER_SEC;
                else
                        pto = rxrpc_tlp_calc_pto(call, req->now);

                call->rack_timer_mode = RXRPC_CALL_RACKTIMER_TLP_PTO;
                call->rack_timo_at = ktime_add(req->now, pto);
                trace_rxrpc_rack_timer(call, pto, false);
                trace_rxrpc_timer_set(call, pto, rxrpc_timer_trace_rack_tlp_pto);
        }

        if (!test_and_set_bit(RXRPC_CALL_BEGAN_RX_TIMER, &call->flags)) {
                ktime_t delay = ms_to_ktime(READ_ONCE(call->next_rx_timo));

                call->expect_rx_by = ktime_add(req->now, delay);
                trace_rxrpc_timer_set(call, delay, rxrpc_timer_trace_expect_rx);
        }

        rxrpc_set_keepalive(call, req->now);
        page_frag_free(whdr);
        return len;
}

/*
 * Send one or more packets through the transport endpoint
 */
void rxrpc_send_data_packet(struct rxrpc_call *call, struct rxrpc_send_data_req *req)
{
        struct rxrpc_wire_header *whdr;
        struct rxrpc_connection *conn = call->conn;
        enum rxrpc_tx_point frag;
        struct rxrpc_txqueue *tq = req->tq;
        struct rxrpc_txbuf *txb;
        struct msghdr msg;
        rxrpc_seq_t seq = req->seq;
        size_t len = sizeof(*whdr);
        bool new_call = test_bit(RXRPC_CALL_BEGAN_RX_TIMER, &call->flags);
        int ret, stat_ix;

        _enter("%x,%x-%x", tq->qbase, seq, seq + req->n - 1);

        whdr = page_frag_alloc(&call->local->tx_alloc, sizeof(*whdr), GFP_NOFS);
        if (!whdr)
                return; /* Drop the packet if no memory. */

        call->local->kvec[0].iov_base = whdr;
        call->local->kvec[0].iov_len = sizeof(*whdr);

        stat_ix = umin(req->n, ARRAY_SIZE(call->rxnet->stat_tx_jumbo)) - 1;
        atomic_inc(&call->rxnet->stat_tx_jumbo[stat_ix]);

        len += rxrpc_prepare_data_packet(call, req, whdr);
        txb = tq->bufs[seq & RXRPC_TXQ_MASK];

        iov_iter_kvec(&msg.msg_iter, WRITE, call->local->kvec, 1 + req->n, len);

        msg.msg_name    = &call->peer->srx.transport;
        msg.msg_namelen = call->peer->srx.transport_len;
        msg.msg_control = NULL;
        msg.msg_controllen = 0;
        msg.msg_flags   = MSG_SPLICE_PAGES;

        /* Send the packet with the don't fragment bit set unless we think it's
         * too big or if this is a retransmission.
         */
        if (seq == call->tx_transmitted + 1 &&
            len >= sizeof(struct rxrpc_wire_header) + call->peer->max_data) {
                rxrpc_local_dont_fragment(conn->local, false);
                frag = rxrpc_tx_point_call_data_frag;
        } else {
                rxrpc_local_dont_fragment(conn->local, true);
                frag = rxrpc_tx_point_call_data_nofrag;
        }

        /* Track what we've attempted to transmit at least once so that the
         * retransmission algorithm doesn't try to resend what we haven't sent
         * yet.
         */
        if (seq == call->tx_transmitted + 1)
                call->tx_transmitted = seq + req->n - 1;

        if (IS_ENABLED(CONFIG_AF_RXRPC_INJECT_LOSS)) {
                static int lose;

                if ((lose++ & 7) == 7) {
                        ret = 0;
                        trace_rxrpc_tx_data(call, txb->seq, txb->serial, txb->flags,
                                            rxrpc_txdata_inject_loss);
                        rxrpc_peer_mark_tx(conn->peer);
                        goto done;
                }
        }

        /* send the packet by UDP
         * - returns -EMSGSIZE if UDP would have to fragment the packet
         *   to go out of the interface
         *   - in which case, we'll have processed the ICMP error
         *     message and update the peer record
         */
        rxrpc_inc_stat(call->rxnet, stat_tx_data_send);
        ret = do_udp_sendmsg(conn->local->socket, &msg, len);
        rxrpc_peer_mark_tx(conn->peer);

        if (ret == -EMSGSIZE) {
                rxrpc_inc_stat(call->rxnet, stat_tx_data_send_msgsize);
                trace_rxrpc_tx_packet(call->debug_id, whdr, frag);
                ret = 0;
        } else if (ret < 0) {
                rxrpc_inc_stat(call->rxnet, stat_tx_data_send_fail);
                trace_rxrpc_tx_fail(call->debug_id, txb->serial, ret, frag);
        } else {
                trace_rxrpc_tx_packet(call->debug_id, whdr, frag);
        }

        rxrpc_tx_backoff(call, ret);

        if (ret < 0) {
                /* Cancel the call if the initial transmission fails or if we
                 * hit due to network routing issues that aren't going away
                 * anytime soon.  The layer above can arrange the
                 * retransmission.
                 */
                if (new_call ||
                    ret == -ENETUNREACH ||
                    ret == -EHOSTUNREACH ||
                    ret == -ECONNREFUSED)
                        rxrpc_set_call_completion(call, RXRPC_CALL_LOCAL_ERROR,
                                                  RX_USER_ABORT, ret);
        }

done:
        _leave(" = %d [%u]", ret, call->peer->max_data);
}

/*
 * Transmit a connection-level abort.
 */
void rxrpc_send_conn_abort(struct rxrpc_connection *conn)
{
        struct rxrpc_wire_header whdr;
        struct msghdr msg;
        struct kvec iov[2];
        __be32 word;
        size_t len;
        u32 serial;
        int ret;

        msg.msg_name    = &conn->peer->srx.transport;
        msg.msg_namelen = conn->peer->srx.transport_len;
        msg.msg_control = NULL;
        msg.msg_controllen = 0;
        msg.msg_flags   = 0;

        whdr.epoch      = htonl(conn->proto.epoch);
        whdr.cid        = htonl(conn->proto.cid);
        whdr.callNumber = 0;
        whdr.seq        = 0;
        whdr.type       = RXRPC_PACKET_TYPE_ABORT;
        whdr.flags      = conn->out_clientflag;
        whdr.userStatus = 0;
        whdr.securityIndex = conn->security_ix;
        whdr._rsvd      = 0;
        whdr.serviceId  = htons(conn->service_id);

        word            = htonl(conn->abort_code);

        iov[0].iov_base = &whdr;
        iov[0].iov_len  = sizeof(whdr);
        iov[1].iov_base = &word;
        iov[1].iov_len  = sizeof(word);

        len = iov[0].iov_len + iov[1].iov_len;

        serial = rxrpc_get_next_serial(conn);
        whdr.serial = htonl(serial);

        iov_iter_kvec(&msg.msg_iter, WRITE, iov, 2, len);
        ret = do_udp_sendmsg(conn->local->socket, &msg, len);
        if (ret < 0) {
                trace_rxrpc_tx_fail(conn->debug_id, serial, ret,
                                    rxrpc_tx_point_conn_abort);
                _debug("sendmsg failed: %d", ret);
                return;
        }

        trace_rxrpc_tx_packet(conn->debug_id, &whdr, rxrpc_tx_point_conn_abort);

        rxrpc_peer_mark_tx(conn->peer);
}

/*
 * Reject a packet through the local endpoint.
 */
void rxrpc_reject_packet(struct rxrpc_local *local, struct sk_buff *skb)
{
        struct rxrpc_wire_header whdr;
        struct sockaddr_rxrpc srx;
        struct rxrpc_skb_priv *sp = rxrpc_skb(skb);
        struct msghdr msg;
        struct kvec iov[2];
        size_t size;
        __be32 code;
        int ret, ioc;

        if (sp->hdr.type == RXRPC_PACKET_TYPE_ABORT)
                return; /* Never abort an abort. */

        rxrpc_see_skb(skb, rxrpc_skb_see_reject);

        iov[0].iov_base = &whdr;
        iov[0].iov_len = sizeof(whdr);
        iov[1].iov_base = &code;
        iov[1].iov_len = sizeof(code);

        msg.msg_name = &srx.transport;
        msg.msg_control = NULL;
        msg.msg_controllen = 0;
        msg.msg_flags = 0;

        whdr = (struct rxrpc_wire_header) {
                .epoch          = htonl(sp->hdr.epoch),
                .cid            = htonl(sp->hdr.cid),
                .callNumber     = htonl(sp->hdr.callNumber),
                .serviceId      = htons(sp->hdr.serviceId),
                .flags          = ~sp->hdr.flags & RXRPC_CLIENT_INITIATED,
        };

        switch (skb->mark) {
        case RXRPC_SKB_MARK_REJECT_BUSY:
                whdr.type = RXRPC_PACKET_TYPE_BUSY;
                size = sizeof(whdr);
                ioc = 1;
                break;
        case RXRPC_SKB_MARK_REJECT_CONN_ABORT:
                whdr.callNumber = 0;
                fallthrough;
        case RXRPC_SKB_MARK_REJECT_ABORT:
                whdr.type = RXRPC_PACKET_TYPE_ABORT;
                code = htonl(skb->priority);
                size = sizeof(whdr) + sizeof(code);
                ioc = 2;
                break;
        default:
                return;
        }

        if (rxrpc_extract_addr_from_skb(&srx, skb) == 0) {
                msg.msg_namelen = srx.transport_len;

                iov_iter_kvec(&msg.msg_iter, WRITE, iov, ioc, size);
                ret = do_udp_sendmsg(local->socket, &msg, size);
                if (ret < 0)
                        trace_rxrpc_tx_fail(local->debug_id, 0, ret,
                                            rxrpc_tx_point_reject);
                else
                        trace_rxrpc_tx_packet(local->debug_id, &whdr,
                                              rxrpc_tx_point_reject);
        }
}

/*
 * Send a VERSION reply to a peer as a keepalive.
 */
void rxrpc_send_keepalive(struct rxrpc_peer *peer)
{
        struct rxrpc_wire_header whdr;
        struct msghdr msg;
        struct kvec iov[2];
        size_t len;
        int ret;

        _enter("");

        msg.msg_name    = &peer->srx.transport;
        msg.msg_namelen = peer->srx.transport_len;
        msg.msg_control = NULL;
        msg.msg_controllen = 0;
        msg.msg_flags   = 0;

        whdr.epoch      = htonl(peer->local->rxnet->epoch);
        whdr.cid        = 0;
        whdr.callNumber = 0;
        whdr.seq        = 0;
        whdr.serial     = 0;
        whdr.type       = RXRPC_PACKET_TYPE_VERSION; /* Not client-initiated */
        whdr.flags      = RXRPC_LAST_PACKET;
        whdr.userStatus = 0;
        whdr.securityIndex = 0;
        whdr._rsvd      = 0;
        whdr.serviceId  = 0;

        iov[0].iov_base = &whdr;
        iov[0].iov_len  = sizeof(whdr);
        iov[1].iov_base = (char *)rxrpc_keepalive_string;
        iov[1].iov_len  = sizeof(rxrpc_keepalive_string);

        len = iov[0].iov_len + iov[1].iov_len;

        iov_iter_kvec(&msg.msg_iter, WRITE, iov, 2, len);
        ret = do_udp_sendmsg(peer->local->socket, &msg, len);
        if (ret < 0)
                trace_rxrpc_tx_fail(peer->debug_id, 0, ret,
                                    rxrpc_tx_point_version_keepalive);
        else
                trace_rxrpc_tx_packet(peer->debug_id, &whdr,
                                      rxrpc_tx_point_version_keepalive);

        rxrpc_peer_mark_tx(peer);
        _leave("");
}

/*
 * Send a RESPONSE message.
 */
void rxrpc_send_response(struct rxrpc_connection *conn, struct sk_buff *response)
{
        struct rxrpc_skb_priv *sp = rxrpc_skb(response);
        struct scatterlist sg[16];
        struct bio_vec *bvec = conn->local->bvec;
        struct msghdr msg;
        size_t len = sp->resp.len;
        __be32 wserial;
        u32 serial = 0;
        int ret, nr_sg;

        _enter("C=%x,%x", conn->debug_id, sp->resp.challenge_serial);

        sg_init_table(sg, ARRAY_SIZE(sg));
        ret = skb_to_sgvec(response, sg, 0, len);
        if (ret < 0)
                goto fail;
        nr_sg = ret;
        ret = -EIO;
        if (WARN_ON_ONCE(nr_sg > ARRAY_SIZE(conn->local->bvec)))
                goto fail;

        for (int i = 0; i < nr_sg; i++)
                bvec_set_page(&bvec[i], sg_page(&sg[i]), sg[i].length, sg[i].offset);

        iov_iter_bvec(&msg.msg_iter, WRITE, bvec, nr_sg, len);

        msg.msg_name    = &conn->peer->srx.transport;
        msg.msg_namelen = conn->peer->srx.transport_len;
        msg.msg_control = NULL;
        msg.msg_controllen = 0;
        msg.msg_flags   = MSG_SPLICE_PAGES;

        serial = rxrpc_get_next_serials(conn, 1);
        wserial = htonl(serial);

        trace_rxrpc_tx_response(conn, serial, sp);

        ret = skb_store_bits(response, offsetof(struct rxrpc_wire_header, serial),
                             &wserial, sizeof(wserial));
        if (ret < 0)
                goto fail;

        rxrpc_local_dont_fragment(conn->local, false);

        ret = do_udp_sendmsg(conn->local->socket, &msg, len);
        if (ret < 0)
                goto fail;

        rxrpc_peer_mark_tx(conn->peer);
        return;

fail:
        trace_rxrpc_tx_fail(conn->debug_id, serial, ret,
                            rxrpc_tx_point_response);
        kleave(" = %d", ret);
}