227 	struct l2tp_session *session;  in l2tp_session_find_2()  local
230 	hlist_for_each_entry_rcu(session, session_list, global_hlist) {  in l2tp_session_find_2()
231 		if (session->session_id == session_id) {  in l2tp_session_find_2()
233 			return session;  in l2tp_session_find_2()
258 	struct l2tp_session *session;  in l2tp_session_find()  local
269 	hlist_for_each_entry(session, session_list, hlist) {  in l2tp_session_find()
270 		if (session->session_id == session_id) {  in l2tp_session_find()
272 			return session;  in l2tp_session_find()
284 	struct l2tp_session *session;  in l2tp_session_find_nth()  local
289 		hlist_for_each_entry(session, &tunnel->session_hlist[hash], hlist) {  in l2tp_session_find_nth()
292 				return session;  in l2tp_session_find_nth()
310 	struct l2tp_session *session;  in l2tp_session_find_by_ifname()  local
314 		hlist_for_each_entry_rcu(session, &pn->l2tp_session_hlist[hash], global_hlist) {  in l2tp_session_find_by_ifname()
315 			if (!strcmp(session->ifname, ifname)) {  in l2tp_session_find_by_ifname()
317 				return session;  in l2tp_session_find_by_ifname()
375 static void l2tp_recv_queue_skb(struct l2tp_session *session, struct sk_buff *skb)  in l2tp_recv_queue_skb()  argument
381 	spin_lock_bh(&session->reorder_q.lock);  in l2tp_recv_queue_skb()
382 	skb_queue_walk_safe(&session->reorder_q, skbp, tmp) {  in l2tp_recv_queue_skb()
384 			__skb_queue_before(&session->reorder_q, skbp, skb);  in l2tp_recv_queue_skb()
385 			l2tp_dbg(session, L2TP_MSG_SEQ,  in l2tp_recv_queue_skb()
387 				 session->name, ns, L2TP_SKB_CB(skbp)->ns,  in l2tp_recv_queue_skb()
388 				 skb_queue_len(&session->reorder_q));  in l2tp_recv_queue_skb()
389 			atomic_long_inc(&session->stats.rx_oos_packets);  in l2tp_recv_queue_skb()
394 	__skb_queue_tail(&session->reorder_q, skb);  in l2tp_recv_queue_skb()
397 	spin_unlock_bh(&session->reorder_q.lock);  in l2tp_recv_queue_skb()
402 static void l2tp_recv_dequeue_skb(struct l2tp_session *session, struct sk_buff *skb)  in l2tp_recv_dequeue_skb()  argument
404 	struct l2tp_tunnel *tunnel = session->tunnel;  in l2tp_recv_dequeue_skb()
414 	atomic_long_inc(&session->stats.rx_packets);  in l2tp_recv_dequeue_skb()
415 	atomic_long_add(length, &session->stats.rx_bytes);  in l2tp_recv_dequeue_skb()
419 		session->nr++;  in l2tp_recv_dequeue_skb()
420 		session->nr &= session->nr_max;  in l2tp_recv_dequeue_skb()
422 		l2tp_dbg(session, L2TP_MSG_SEQ, "%s: updated nr to %hu\n",  in l2tp_recv_dequeue_skb()
423 			 session->name, session->nr);  in l2tp_recv_dequeue_skb()
427 	if (session->recv_skb != NULL)  in l2tp_recv_dequeue_skb()
428 		(*session->recv_skb)(session, skb, L2TP_SKB_CB(skb)->length);  in l2tp_recv_dequeue_skb()
432 	if (session->deref)  in l2tp_recv_dequeue_skb()
433 		(*session->deref)(session);  in l2tp_recv_dequeue_skb()
439 static void l2tp_recv_dequeue(struct l2tp_session *session)  in l2tp_recv_dequeue()  argument
449 	spin_lock_bh(&session->reorder_q.lock);  in l2tp_recv_dequeue()
450 	skb_queue_walk_safe(&session->reorder_q, skb, tmp) {  in l2tp_recv_dequeue()
452 			atomic_long_inc(&session->stats.rx_seq_discards);  in l2tp_recv_dequeue()
453 			atomic_long_inc(&session->stats.rx_errors);  in l2tp_recv_dequeue()
454 			l2tp_dbg(session, L2TP_MSG_SEQ,  in l2tp_recv_dequeue()
456 				 session->name, L2TP_SKB_CB(skb)->ns,  in l2tp_recv_dequeue()
457 				 L2TP_SKB_CB(skb)->length, session->nr,  in l2tp_recv_dequeue()
458 				 skb_queue_len(&session->reorder_q));  in l2tp_recv_dequeue()
459 			session->reorder_skip = 1;  in l2tp_recv_dequeue()
460 			__skb_unlink(skb, &session->reorder_q);  in l2tp_recv_dequeue()
462 			if (session->deref)  in l2tp_recv_dequeue()
463 				(*session->deref)(session);  in l2tp_recv_dequeue()
468 			if (session->reorder_skip) {  in l2tp_recv_dequeue()
469 				l2tp_dbg(session, L2TP_MSG_SEQ,  in l2tp_recv_dequeue()
471 					 session->name, session->nr,  in l2tp_recv_dequeue()
473 				session->reorder_skip = 0;  in l2tp_recv_dequeue()
474 				session->nr = L2TP_SKB_CB(skb)->ns;  in l2tp_recv_dequeue()
476 			if (L2TP_SKB_CB(skb)->ns != session->nr) {  in l2tp_recv_dequeue()
477 				l2tp_dbg(session, L2TP_MSG_SEQ,  in l2tp_recv_dequeue()
479 					 session->name, L2TP_SKB_CB(skb)->ns,  in l2tp_recv_dequeue()
480 					 L2TP_SKB_CB(skb)->length, session->nr,  in l2tp_recv_dequeue()
481 					 skb_queue_len(&session->reorder_q));  in l2tp_recv_dequeue()
485 		__skb_unlink(skb, &session->reorder_q);  in l2tp_recv_dequeue()
490 		spin_unlock_bh(&session->reorder_q.lock);  in l2tp_recv_dequeue()
491 		l2tp_recv_dequeue_skb(session, skb);  in l2tp_recv_dequeue()
496 	spin_unlock_bh(&session->reorder_q.lock);  in l2tp_recv_dequeue()
499 static int l2tp_seq_check_rx_window(struct l2tp_session *session, u32 nr)  in l2tp_seq_check_rx_window()  argument
503 	if (nr >= session->nr)  in l2tp_seq_check_rx_window()
504 		nws = nr - session->nr;  in l2tp_seq_check_rx_window()
506 		nws = (session->nr_max + 1) - (session->nr - nr);  in l2tp_seq_check_rx_window()
508 	return nws < session->nr_window_size;  in l2tp_seq_check_rx_window()
514 static int l2tp_recv_data_seq(struct l2tp_session *session, struct sk_buff *skb)  in l2tp_recv_data_seq()  argument
516 	if (!l2tp_seq_check_rx_window(session, L2TP_SKB_CB(skb)->ns)) {  in l2tp_recv_data_seq()
520 		l2tp_dbg(session, L2TP_MSG_SEQ,  in l2tp_recv_data_seq()
522 			 session->name, L2TP_SKB_CB(skb)->ns,  in l2tp_recv_data_seq()
523 			 L2TP_SKB_CB(skb)->length, session->nr);  in l2tp_recv_data_seq()
527 	if (session->reorder_timeout != 0) {  in l2tp_recv_data_seq()
531 		l2tp_recv_queue_skb(session, skb);  in l2tp_recv_data_seq()
540 	if (L2TP_SKB_CB(skb)->ns == session->nr) {  in l2tp_recv_data_seq()
541 		skb_queue_tail(&session->reorder_q, skb);  in l2tp_recv_data_seq()
544 		u32 nr_next = (session->nr_oos + 1) & session->nr_max;  in l2tp_recv_data_seq()
547 			session->nr_oos_count++;  in l2tp_recv_data_seq()
549 			session->nr_oos_count = 0;  in l2tp_recv_data_seq()
551 		session->nr_oos = nr_oos;  in l2tp_recv_data_seq()
552 		if (session->nr_oos_count > session->nr_oos_count_max) {  in l2tp_recv_data_seq()
553 			session->reorder_skip = 1;  in l2tp_recv_data_seq()
554 			l2tp_dbg(session, L2TP_MSG_SEQ,  in l2tp_recv_data_seq()
556 				 session->name, session->nr_oos_count);  in l2tp_recv_data_seq()
558 		if (!session->reorder_skip) {  in l2tp_recv_data_seq()
559 			atomic_long_inc(&session->stats.rx_seq_discards);  in l2tp_recv_data_seq()
560 			l2tp_dbg(session, L2TP_MSG_SEQ,  in l2tp_recv_data_seq()
562 				 session->name, L2TP_SKB_CB(skb)->ns,  in l2tp_recv_data_seq()
563 				 L2TP_SKB_CB(skb)->length, session->nr,  in l2tp_recv_data_seq()
564 				 skb_queue_len(&session->reorder_q));  in l2tp_recv_data_seq()
567 		skb_queue_tail(&session->reorder_q, skb);  in l2tp_recv_data_seq()
637 void l2tp_recv_common(struct l2tp_session *session, struct sk_buff *skb,  in l2tp_recv_common()  argument
641 	struct l2tp_tunnel *tunnel = session->tunnel;  in l2tp_recv_common()
649 	l2tp_session_inc_refcount(session);  in l2tp_recv_common()
650 	if (session->ref)  in l2tp_recv_common()
651 		(*session->ref)(session);  in l2tp_recv_common()
654 	if (session->peer_cookie_len > 0) {  in l2tp_recv_common()
655 		if (memcmp(ptr, &session->peer_cookie[0], session->peer_cookie_len)) {  in l2tp_recv_common()
659 				  session->session_id);  in l2tp_recv_common()
660 			atomic_long_inc(&session->stats.rx_cookie_discards);  in l2tp_recv_common()
663 		ptr += session->peer_cookie_len;  in l2tp_recv_common()
686 			l2tp_dbg(session, L2TP_MSG_SEQ,  in l2tp_recv_common()
688 				 session->name, ns, nr, session->nr);  in l2tp_recv_common()
690 	} else if (session->l2specific_type == L2TP_L2SPECTYPE_DEFAULT) {  in l2tp_recv_common()
700 			l2tp_dbg(session, L2TP_MSG_SEQ,  in l2tp_recv_common()
702 				 session->name, ns, session->nr);  in l2tp_recv_common()
707 	ptr += session->l2specific_len;  in l2tp_recv_common()
714 		if ((!session->lns_mode) && (!session->send_seq)) {  in l2tp_recv_common()
715 			l2tp_info(session, L2TP_MSG_SEQ,  in l2tp_recv_common()
717 				  session->name);  in l2tp_recv_common()
718 			session->send_seq = -1;  in l2tp_recv_common()
719 			l2tp_session_set_header_len(session, tunnel->version);  in l2tp_recv_common()
725 		if (session->recv_seq) {  in l2tp_recv_common()
726 			l2tp_warn(session, L2TP_MSG_SEQ,  in l2tp_recv_common()
728 				  session->name);  in l2tp_recv_common()
729 			atomic_long_inc(&session->stats.rx_seq_discards);  in l2tp_recv_common()
738 		if ((!session->lns_mode) && (session->send_seq)) {  in l2tp_recv_common()
739 			l2tp_info(session, L2TP_MSG_SEQ,  in l2tp_recv_common()
741 				  session->name);  in l2tp_recv_common()
742 			session->send_seq = 0;  in l2tp_recv_common()
743 			l2tp_session_set_header_len(session, tunnel->version);  in l2tp_recv_common()
744 		} else if (session->send_seq) {  in l2tp_recv_common()
745 			l2tp_warn(session, L2TP_MSG_SEQ,  in l2tp_recv_common()
747 				  session->name);  in l2tp_recv_common()
748 			atomic_long_inc(&session->stats.rx_seq_discards);  in l2tp_recv_common()
765 		ptr += session->offset;  in l2tp_recv_common()
786 		(session->reorder_timeout ? session->reorder_timeout : HZ);  in l2tp_recv_common()
792 		if (l2tp_recv_data_seq(session, skb))  in l2tp_recv_common()
799 		skb_queue_tail(&session->reorder_q, skb);  in l2tp_recv_common()
803 	l2tp_recv_dequeue(session);  in l2tp_recv_common()
805 	l2tp_session_dec_refcount(session);  in l2tp_recv_common()
810 	atomic_long_inc(&session->stats.rx_errors);  in l2tp_recv_common()
813 	if (session->deref)  in l2tp_recv_common()
814 		(*session->deref)(session);  in l2tp_recv_common()
816 	l2tp_session_dec_refcount(session);  in l2tp_recv_common()
822 int l2tp_session_queue_purge(struct l2tp_session *session)  in l2tp_session_queue_purge()  argument
825 	BUG_ON(!session);  in l2tp_session_queue_purge()
826 	BUG_ON(session->magic != L2TP_SESSION_MAGIC);  in l2tp_session_queue_purge()
827 	while ((skb = skb_dequeue(&session->reorder_q))) {  in l2tp_session_queue_purge()
828 		atomic_long_inc(&session->stats.rx_errors);  in l2tp_session_queue_purge()
830 		if (session->deref)  in l2tp_session_queue_purge()
831 			(*session->deref)(session);  in l2tp_session_queue_purge()
846 	struct l2tp_session *session = NULL;  in l2tp_udp_recv_core()  local
923 	session = l2tp_session_find(tunnel->l2tp_net, tunnel, session_id);  in l2tp_udp_recv_core()
924 	if (!session || !session->recv_skb) {  in l2tp_udp_recv_core()
932 	l2tp_recv_common(session, skb, ptr, optr, hdrflags, length, payload_hook);  in l2tp_udp_recv_core()
979 static int l2tp_build_l2tpv2_header(struct l2tp_session *session, void *buf)  in l2tp_build_l2tpv2_header()  argument
981 	struct l2tp_tunnel *tunnel = session->tunnel;  in l2tp_build_l2tpv2_header()
986 	u32 session_id = session->peer_session_id;  in l2tp_build_l2tpv2_header()
988 	if (session->send_seq)  in l2tp_build_l2tpv2_header()
995 	if (session->send_seq) {  in l2tp_build_l2tpv2_header()
996 		*bufp++ = htons(session->ns);  in l2tp_build_l2tpv2_header()
998 		session->ns++;  in l2tp_build_l2tpv2_header()
999 		session->ns &= 0xffff;  in l2tp_build_l2tpv2_header()
1000 		l2tp_dbg(session, L2TP_MSG_SEQ, "%s: updated ns to %u\n",  in l2tp_build_l2tpv2_header()
1001 			 session->name, session->ns);  in l2tp_build_l2tpv2_header()
1007 static int l2tp_build_l2tpv3_header(struct l2tp_session *session, void *buf)  in l2tp_build_l2tpv3_header()  argument
1009 	struct l2tp_tunnel *tunnel = session->tunnel;  in l2tp_build_l2tpv3_header()
1024 	*((__be32 *) bufp) = htonl(session->peer_session_id);  in l2tp_build_l2tpv3_header()
1026 	if (session->cookie_len) {  in l2tp_build_l2tpv3_header()
1027 		memcpy(bufp, &session->cookie[0], session->cookie_len);  in l2tp_build_l2tpv3_header()
1028 		bufp += session->cookie_len;  in l2tp_build_l2tpv3_header()
1030 	if (session->l2specific_len) {  in l2tp_build_l2tpv3_header()
1031 		if (session->l2specific_type == L2TP_L2SPECTYPE_DEFAULT) {  in l2tp_build_l2tpv3_header()
1033 			if (session->send_seq) {  in l2tp_build_l2tpv3_header()
1034 				l2h = 0x40000000 | session->ns;  in l2tp_build_l2tpv3_header()
1035 				session->ns++;  in l2tp_build_l2tpv3_header()
1036 				session->ns &= 0xffffff;  in l2tp_build_l2tpv3_header()
1037 				l2tp_dbg(session, L2TP_MSG_SEQ,  in l2tp_build_l2tpv3_header()
1039 					 session->name, session->ns);  in l2tp_build_l2tpv3_header()
1044 		bufp += session->l2specific_len;  in l2tp_build_l2tpv3_header()
1046 	if (session->offset)  in l2tp_build_l2tpv3_header()
1047 		bufp += session->offset;  in l2tp_build_l2tpv3_header()
1052 static int l2tp_xmit_core(struct l2tp_session *session, struct sk_buff *skb,  in l2tp_xmit_core()  argument
1055 	struct l2tp_tunnel *tunnel = session->tunnel;  in l2tp_xmit_core()
1060 	if (session->send_seq)  in l2tp_xmit_core()
1061 		l2tp_dbg(session, L2TP_MSG_DATA, "%s: send %Zd bytes, ns=%u\n",  in l2tp_xmit_core()
1062 			 session->name, data_len, session->ns - 1);  in l2tp_xmit_core()
1064 		l2tp_dbg(session, L2TP_MSG_DATA, "%s: send %Zd bytes\n",  in l2tp_xmit_core()
1065 			 session->name, data_len);  in l2tp_xmit_core()
1067 	if (session->debug & L2TP_MSG_DATA) {  in l2tp_xmit_core()
1071 		pr_debug("%s: xmit\n", session->name);  in l2tp_xmit_core()
1089 		atomic_long_inc(&session->stats.tx_packets);  in l2tp_xmit_core()
1090 		atomic_long_add(len, &session->stats.tx_bytes);  in l2tp_xmit_core()
1093 		atomic_long_inc(&session->stats.tx_errors);  in l2tp_xmit_core()
1102 int l2tp_xmit_skb(struct l2tp_session *session, struct sk_buff *skb, int hdr_len)  in l2tp_xmit_skb()  argument
1105 	struct l2tp_tunnel *tunnel = session->tunnel;  in l2tp_xmit_skb()
1127 	session->build_header(session, __skb_push(skb, hdr_len));  in l2tp_xmit_skb()
1175 	l2tp_xmit_core(session, skb, fl, data_len);  in l2tp_xmit_skb()
1243 	struct l2tp_session *session;  in l2tp_tunnel_closeall()  local
1254 			session = hlist_entry(walk, struct l2tp_session, hlist);  in l2tp_tunnel_closeall()
1256 			l2tp_info(session, L2TP_MSG_CONTROL,  in l2tp_tunnel_closeall()
1257 				  "%s: closing session\n", session->name);  in l2tp_tunnel_closeall()
1259 			hlist_del_init(&session->hlist);  in l2tp_tunnel_closeall()
1261 			if (session->ref != NULL)  in l2tp_tunnel_closeall()
1262 				(*session->ref)(session);  in l2tp_tunnel_closeall()
1266 			__l2tp_session_unhash(session);  in l2tp_tunnel_closeall()
1267 			l2tp_session_queue_purge(session);  in l2tp_tunnel_closeall()
1269 			if (session->session_close != NULL)  in l2tp_tunnel_closeall()
1270 				(*session->session_close)(session);  in l2tp_tunnel_closeall()
1272 			if (session->deref != NULL)  in l2tp_tunnel_closeall()
1273 				(*session->deref)(session);  in l2tp_tunnel_closeall()
1275 			l2tp_session_dec_refcount(session);  in l2tp_tunnel_closeall()
1653 void l2tp_session_free(struct l2tp_session *session)  in l2tp_session_free()  argument
1655 	struct l2tp_tunnel *tunnel = session->tunnel;  in l2tp_session_free()
1657 	BUG_ON(atomic_read(&session->ref_count) != 0);  in l2tp_session_free()
1661 		if (session->session_id != 0)  in l2tp_session_free()
1664 		session->tunnel = NULL;  in l2tp_session_free()
1668 	kfree(session);  in l2tp_session_free()
1677 void __l2tp_session_unhash(struct l2tp_session *session)  in __l2tp_session_unhash()  argument
1679 	struct l2tp_tunnel *tunnel = session->tunnel;  in __l2tp_session_unhash()
1685 		hlist_del_init(&session->hlist);  in __l2tp_session_unhash()
1692 			hlist_del_init_rcu(&session->global_hlist);  in __l2tp_session_unhash()
1703 int l2tp_session_delete(struct l2tp_session *session)  in l2tp_session_delete()  argument
1705 	if (session->ref)  in l2tp_session_delete()
1706 		(*session->ref)(session);  in l2tp_session_delete()
1707 	__l2tp_session_unhash(session);  in l2tp_session_delete()
1708 	l2tp_session_queue_purge(session);  in l2tp_session_delete()
1709 	if (session->session_close != NULL)  in l2tp_session_delete()
1710 		(*session->session_close)(session);  in l2tp_session_delete()
1711 	if (session->deref)  in l2tp_session_delete()
1712 		(*session->deref)(session);  in l2tp_session_delete()
1713 	l2tp_session_dec_refcount(session);  in l2tp_session_delete()
1721 void l2tp_session_set_header_len(struct l2tp_session *session, int version)  in l2tp_session_set_header_len()  argument
1724 		session->hdr_len = 6;  in l2tp_session_set_header_len()
1725 		if (session->send_seq)  in l2tp_session_set_header_len()
1726 			session->hdr_len += 4;  in l2tp_session_set_header_len()
1728 		session->hdr_len = 4 + session->cookie_len + session->l2specific_len + session->offset;  in l2tp_session_set_header_len()
1729 		if (session->tunnel->encap == L2TP_ENCAPTYPE_UDP)  in l2tp_session_set_header_len()
1730 			session->hdr_len += 4;  in l2tp_session_set_header_len()
1738 	struct l2tp_session *session;  in l2tp_session_create()  local
1740 	session = kzalloc(sizeof(struct l2tp_session) + priv_size, GFP_KERNEL);  in l2tp_session_create()
1741 	if (session != NULL) {  in l2tp_session_create()
1742 		session->magic = L2TP_SESSION_MAGIC;  in l2tp_session_create()
1743 		session->tunnel = tunnel;  in l2tp_session_create()
1745 		session->session_id = session_id;  in l2tp_session_create()
1746 		session->peer_session_id = peer_session_id;  in l2tp_session_create()
1747 		session->nr = 0;  in l2tp_session_create()
1749 			session->nr_max = 0xffff;  in l2tp_session_create()
1751 			session->nr_max = 0xffffff;  in l2tp_session_create()
1752 		session->nr_window_size = session->nr_max / 2;  in l2tp_session_create()
1753 		session->nr_oos_count_max = 4;  in l2tp_session_create()
1756 		session->reorder_skip = 1;  in l2tp_session_create()
1758 		sprintf(&session->name[0], "sess %u/%u",  in l2tp_session_create()
1759 			tunnel->tunnel_id, session->session_id);  in l2tp_session_create()
1761 		skb_queue_head_init(&session->reorder_q);  in l2tp_session_create()
1763 		INIT_HLIST_NODE(&session->hlist);  in l2tp_session_create()
1764 		INIT_HLIST_NODE(&session->global_hlist);  in l2tp_session_create()
1767 		session->debug = tunnel->debug;  in l2tp_session_create()
1770 			session->pwtype = cfg->pw_type;  in l2tp_session_create()
1771 			session->debug = cfg->debug;  in l2tp_session_create()
1772 			session->mtu = cfg->mtu;  in l2tp_session_create()
1773 			session->mru = cfg->mru;  in l2tp_session_create()
1774 			session->send_seq = cfg->send_seq;  in l2tp_session_create()
1775 			session->recv_seq = cfg->recv_seq;  in l2tp_session_create()
1776 			session->lns_mode = cfg->lns_mode;  in l2tp_session_create()
1777 			session->reorder_timeout = cfg->reorder_timeout;  in l2tp_session_create()
1778 			session->offset = cfg->offset;  in l2tp_session_create()
1779 			session->l2specific_type = cfg->l2specific_type;  in l2tp_session_create()
1780 			session->l2specific_len = cfg->l2specific_len;  in l2tp_session_create()
1781 			session->cookie_len = cfg->cookie_len;  in l2tp_session_create()
1782 			memcpy(&session->cookie[0], &cfg->cookie[0], cfg->cookie_len);  in l2tp_session_create()
1783 			session->peer_cookie_len = cfg->peer_cookie_len;  in l2tp_session_create()
1784 			memcpy(&session->peer_cookie[0], &cfg->peer_cookie[0], cfg->peer_cookie_len);  in l2tp_session_create()
1788 			session->build_header = l2tp_build_l2tpv2_header;  in l2tp_session_create()
1790 			session->build_header = l2tp_build_l2tpv3_header;  in l2tp_session_create()
1792 		l2tp_session_set_header_len(session, tunnel->version);  in l2tp_session_create()
1797 		l2tp_session_inc_refcount(session);  in l2tp_session_create()
1805 		hlist_add_head(&session->hlist,  in l2tp_session_create()
1814 			hlist_add_head_rcu(&session->global_hlist,  in l2tp_session_create()
1820 		if (session->session_id != 0)  in l2tp_session_create()
1824 	return session;  in l2tp_session_create()