1 files changed, 244 insertions, 3 deletions

diff --git a/net/tipc/socket.c b/net/tipc/socket.c
index 70eaceae1f8c..6a699671245b 100644
--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@ -35,7 +35,6 @@
  */
 
 #include "core.h"
-#include "ref.h"
 #include "name_table.h"
 #include "node.h"
 #include "link.h"
@@ -61,6 +60,11 @@ static int tipc_sk_publish(struct tipc_port *port, uint scope,
                            struct tipc_name_seq const *seq);
 static int tipc_sk_withdraw(struct tipc_port *port, uint scope,
                             struct tipc_name_seq const *seq);
+static u32 tipc_sk_ref_acquire(struct tipc_sock *tsk);
+static void tipc_sk_ref_discard(u32 ref);
+static struct tipc_sock *tipc_sk_get(u32 ref);
+static struct tipc_sock *tipc_sk_get_next(u32 *ref);
+static void tipc_sk_put(struct tipc_sock *tsk);
 
 static const struct proto_ops packet_ops;
 static const struct proto_ops stream_ops;
@@ -271,7 +275,7 @@ static int tipc_sk_create(struct net *net, struct socket *sock,
 
         tsk = tipc_sk(sk);
         port = &tsk->port;
-        ref = tipc_ref_acquire(tsk);
+        ref = tipc_sk_ref_acquire(tsk);
         if (!ref) {
                 pr_warn("Socket create failed; reference table exhausted\n");
                 return -ENOMEM;
@@ -434,7 +438,7 @@ static int tipc_release(struct socket *sock)
         }
 
         tipc_sk_withdraw(port, 0, NULL);
-        tipc_ref_discard(port->ref);
+        tipc_sk_ref_discard(port->ref);
         k_cancel_timer(&port->timer);
         if (port->connected) {
                 buf = tipc_msg_create(TIPC_CRITICAL_IMPORTANCE, TIPC_CONN_MSG,
@@ -2254,6 +2258,243 @@ void tipc_sk_reinit(void)
 }
 
 /**
+ * struct reference - TIPC socket reference entry
+ * @tsk: pointer to socket associated with reference entry
+ * @ref: reference value for socket (combines instance & array index info)
+ */
+struct reference {
+        struct tipc_sock *tsk;
+        u32 ref;
+};
+
+/**
+ * struct tipc_ref_table - table of TIPC socket reference entries
+ * @entries: pointer to array of reference entries
+ * @capacity: array index of first unusable entry
+ * @init_point: array index of first uninitialized entry
+ * @first_free: array index of first unused socket reference entry
+ * @last_free: array index of last unused socket reference entry
+ * @index_mask: bitmask for array index portion of reference values
+ * @start_mask: initial value for instance value portion of reference values
+ */
+struct ref_table {
+        struct reference *entries;
+        u32 capacity;
+        u32 init_point;
+        u32 first_free;
+        u32 last_free;
+        u32 index_mask;
+        u32 start_mask;
+};
+
+/* Socket reference table consists of 2**N entries.
+ *
+ * State        Socket ptr      Reference
+ * -----        ----------      ---------
+ * In use        non-NULL       XXXX|own index
+ *                              (XXXX changes each time entry is acquired)
+ * Free            NULL         YYYY|next free index
+ *                              (YYYY is one more than last used XXXX)
+ * Uninitialized   NULL         0
+ *
+ * Entry 0 is not used; this allows index 0 to denote the end of the free list.
+ *
+ * Note that a reference value of 0 does not necessarily indicate that an
+ * entry is uninitialized, since the last entry in the free list could also
+ * have a reference value of 0 (although this is unlikely).
+ */
+
+static struct ref_table tipc_ref_table;
+
+static DEFINE_RWLOCK(ref_table_lock);
+
+/**
+ * tipc_ref_table_init - create reference table for sockets
+ */
+int tipc_sk_ref_table_init(u32 req_sz, u32 start)
+{
+        struct reference *table;
+        u32 actual_sz;
+
+        /* account for unused entry, then round up size to a power of 2 */
+
+        req_sz++;
+        for (actual_sz = 16; actual_sz < req_sz; actual_sz <<= 1) {
+                /* do nothing */
+        };
+
+        /* allocate table & mark all entries as uninitialized */
+        table = vzalloc(actual_sz * sizeof(struct reference));
+        if (table == NULL)
+                return -ENOMEM;
+
+        tipc_ref_table.entries = table;
+        tipc_ref_table.capacity = req_sz;
+        tipc_ref_table.init_point = 1;
+        tipc_ref_table.first_free = 0;
+        tipc_ref_table.last_free = 0;
+        tipc_ref_table.index_mask = actual_sz - 1;
+        tipc_ref_table.start_mask = start & ~tipc_ref_table.index_mask;
+
+        return 0;
+}
+
+/**
+ * tipc_ref_table_stop - destroy reference table for sockets
+ */
+void tipc_sk_ref_table_stop(void)
+{
+        if (!tipc_ref_table.entries)
+                return;
+        vfree(tipc_ref_table.entries);
+        tipc_ref_table.entries = NULL;
+}
+
+/* tipc_ref_acquire - create reference to a socket
+ *
+ * Register an socket pointer in the reference table.
+ * Returns a unique reference value that is used from then on to retrieve the
+ * socket pointer, or to determine if the socket has been deregistered.
+ */
+u32 tipc_sk_ref_acquire(struct tipc_sock *tsk)
+{
+        u32 index;
+        u32 index_mask;
+        u32 next_plus_upper;
+        u32 ref = 0;
+        struct reference *entry;
+
+        if (unlikely(!tsk)) {
+                pr_err("Attempt to acquire ref. to non-existent obj\n");
+                return 0;
+        }
+        if (unlikely(!tipc_ref_table.entries)) {
+                pr_err("Ref. table not found in acquisition attempt\n");
+                return 0;
+        }
+
+        /* Take a free entry, if available; otherwise initialize a new one */
+        write_lock_bh(&ref_table_lock);
+        index = tipc_ref_table.first_free;
+        entry = &tipc_ref_table.entries[index];
+
+        if (likely(index)) {
+                index = tipc_ref_table.first_free;
+                entry = &tipc_ref_table.entries[index];
+                index_mask = tipc_ref_table.index_mask;
+                next_plus_upper = entry->ref;
+                tipc_ref_table.first_free = next_plus_upper & index_mask;
+                ref = (next_plus_upper & ~index_mask) + index;
+                entry->tsk = tsk;
+        } else if (tipc_ref_table.init_point < tipc_ref_table.capacity) {
+                index = tipc_ref_table.init_point++;
+                entry = &tipc_ref_table.entries[index];
+                ref = tipc_ref_table.start_mask + index;
+        }
+
+        if (ref) {
+                entry->ref = ref;
+                entry->tsk = tsk;
+        }
+        write_unlock_bh(&ref_table_lock);
+        return ref;
+}
+
+/* tipc_sk_ref_discard - invalidate reference to an socket
+ *
+ * Disallow future references to an socket and free up the entry for re-use.
+ */
+void tipc_sk_ref_discard(u32 ref)
+{
+        struct reference *entry;
+        u32 index;
+        u32 index_mask;
+
+        if (unlikely(!tipc_ref_table.entries)) {
+                pr_err("Ref. table not found during discard attempt\n");
+                return;
+        }
+
+        index_mask = tipc_ref_table.index_mask;
+        index = ref & index_mask;
+        entry = &tipc_ref_table.entries[index];
+
+        write_lock_bh(&ref_table_lock);
+
+        if (unlikely(!entry->tsk)) {
+                pr_err("Attempt to discard ref. to non-existent socket\n");
+                goto exit;
+        }
+        if (unlikely(entry->ref != ref)) {
+                pr_err("Attempt to discard non-existent reference\n");
+                goto exit;
+        }
+
+        /* Mark entry as unused; increment instance part of entry's
+         *   reference to invalidate any subsequent references
+         */
+
+        entry->tsk = NULL;
+        entry->ref = (ref & ~index_mask) + (index_mask + 1);
+
+        /* Append entry to free entry list */
+        if (unlikely(tipc_ref_table.first_free == 0))
+                tipc_ref_table.first_free = index;
+        else
+                tipc_ref_table.entries[tipc_ref_table.last_free].ref |= index;
+        tipc_ref_table.last_free = index;
+exit:
+        write_unlock_bh(&ref_table_lock);
+}
+
+/* tipc_sk_get - find referenced socket and return pointer to it
+ */
+struct tipc_sock *tipc_sk_get(u32 ref)
+{
+        struct reference *entry;
+        struct tipc_sock *tsk;
+
+        if (unlikely(!tipc_ref_table.entries))
+                return NULL;
+        read_lock_bh(&ref_table_lock);
+        entry = &tipc_ref_table.entries[ref & tipc_ref_table.index_mask];
+        tsk = entry->tsk;
+        if (likely(tsk && (entry->ref == ref)))
+                sock_hold(&tsk->sk);
+        else
+                tsk = NULL;
+        read_unlock_bh(&ref_table_lock);
+        return tsk;
+}
+
+/* tipc_sk_get_next - lock & return next socket after referenced one
+*/
+struct tipc_sock *tipc_sk_get_next(u32 *ref)
+{
+        struct reference *entry;
+        struct tipc_sock *tsk = NULL;
+        uint index = *ref & tipc_ref_table.index_mask;
+
+        read_lock_bh(&ref_table_lock);
+        while (++index < tipc_ref_table.capacity) {
+                entry = &tipc_ref_table.entries[index];
+                if (!entry->tsk)
+                        continue;
+                tsk = entry->tsk;
+                sock_hold(&tsk->sk);
+                *ref = entry->ref;
+                break;
+        }
+        read_unlock_bh(&ref_table_lock);
+        return tsk;
+}
+
+static void tipc_sk_put(struct tipc_sock *tsk)
+{
+        sock_put(&tsk->sk);
+}
+
+/**
  * tipc_setsockopt - set socket option
  * @sock: socket structure
  * @lvl: option level