net/tipc/link.c

   1 /*
   2  * net/tipc/link.c: TIPC link code
   3  *
   4  * Copyright (c) 1996-2007, 2012, Ericsson AB
   5  * Copyright (c) 2004-2007, 2010-2013, Wind River Systems
   6  * All rights reserved.
   7  *
   8  * Redistribution and use in source and binary forms, with or without
   9  * modification, are permitted provided that the following conditions are met:
  10  *
  11  * 1. Redistributions of source code must retain the above copyright
  12  *    notice, this list of conditions and the following disclaimer.
  13  * 2. Redistributions in binary form must reproduce the above copyright
  14  *    notice, this list of conditions and the following disclaimer in the
  15  *    documentation and/or other materials provided with the distribution.
  16  * 3. Neither the names of the copyright holders nor the names of its
  17  *    contributors may be used to endorse or promote products derived from
  18  *    this software without specific prior written permission.
  19  *
  20  * Alternatively, this software may be distributed under the terms of the
  21  * GNU General Public License ("GPL") version 2 as published by the Free
  22  * Software Foundation.
  23  *
  24  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
  25  * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  26  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  27  * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
  28  * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
  29  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
  30  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
  31  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
  32  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  33  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  34  * POSSIBILITY OF SUCH DAMAGE.
  35  */
  36
  37 #include "core.h"
  38 #include "link.h"
  39 #include "port.h"
  40 #include "name_distr.h"
  41 #include "discover.h"
  42 #include "config.h"
  43
  44 #include <linux/pkt_sched.h>
  45
  46 /*
  47  * Error message prefixes
  48  */
  49 static const char *link_co_err = "Link changeover error, ";
  50 static const char *link_rst_msg = "Resetting link ";
  51 static const char *link_unk_evt = "Unknown link event ";
  52
  53 /*
  54  * Out-of-range value for link session numbers
  55  */
  56 #define INVALID_SESSION 0x10000
  57
  58 /*
  59  * Link state events:
  60  */
  61 #define  STARTING_EVT    856384768      /* link processing trigger */
  62 #define  TRAFFIC_MSG_EVT 560815u        /* rx'd ??? */
  63 #define  TIMEOUT_EVT     560817u        /* link timer expired */
  64
  65 /*
  66  * The following two 'message types' is really just implementation
  67  * data conveniently stored in the message header.
  68  * They must not be considered part of the protocol
  69  */
  70 #define OPEN_MSG   0
  71 #define CLOSED_MSG 1
  72
  73 /*
  74  * State value stored in 'exp_msg_count'
  75  */
  76 #define START_CHANGEOVER 100000u
  77
  78 static void link_handle_out_of_seq_msg(struct tipc_link *l_ptr,
  79                                        struct sk_buff *buf);
  80 static void link_recv_proto_msg(struct tipc_link *l_ptr, struct sk_buff *buf);
  81 static int  link_recv_changeover_msg(struct tipc_link **l_ptr,
  82                                      struct sk_buff **buf);
  83 static void link_set_supervision_props(struct tipc_link *l_ptr, u32 tolerance);
  84 static int  link_send_sections_long(struct tipc_port *sender,
  85                                     struct iovec const *msg_sect,
  86                                     unsigned int len, u32 destnode);
  87 static void link_state_event(struct tipc_link *l_ptr, u32 event);
  88 static void link_reset_statistics(struct tipc_link *l_ptr);
  89 static void link_print(struct tipc_link *l_ptr, const char *str);
  90 static void link_start(struct tipc_link *l_ptr);
  91 static int link_send_long_buf(struct tipc_link *l_ptr, struct sk_buff *buf);
  92 static void tipc_link_send_sync(struct tipc_link *l);
  93 static void tipc_link_recv_sync(struct tipc_node *n, struct sk_buff *buf);
  94
  95 /*
  96  *  Simple link routines
  97  */
  98 static unsigned int align(unsigned int i)
  99 {
 100         return (i + 3) & ~3u;
 101 }
 102
 103 static void link_init_max_pkt(struct tipc_link *l_ptr)
 104 {
 105         u32 max_pkt;
 106
 107         max_pkt = (l_ptr->b_ptr->mtu & ~3);
 108         if (max_pkt > MAX_MSG_SIZE)
 109                 max_pkt = MAX_MSG_SIZE;
 110
 111         l_ptr->max_pkt_target = max_pkt;
 112         if (l_ptr->max_pkt_target < MAX_PKT_DEFAULT)
 113                 l_ptr->max_pkt = l_ptr->max_pkt_target;
 114         else
 115                 l_ptr->max_pkt = MAX_PKT_DEFAULT;
 116
 117         l_ptr->max_pkt_probes = 0;
 118 }
 119
 120 static u32 link_next_sent(struct tipc_link *l_ptr)
 121 {
 122         if (l_ptr->next_out)
 123                 return buf_seqno(l_ptr->next_out);
 124         return mod(l_ptr->next_out_no);
 125 }
 126
 127 static u32 link_last_sent(struct tipc_link *l_ptr)
 128 {
 129         return mod(link_next_sent(l_ptr) - 1);
 130 }
 131
 132 /*
 133  *  Simple non-static link routines (i.e. referenced outside this file)
 134  */
 135 int tipc_link_is_up(struct tipc_link *l_ptr)
 136 {
 137         if (!l_ptr)
 138                 return 0;
 139         return link_working_working(l_ptr) || link_working_unknown(l_ptr);
 140 }
 141
 142 int tipc_link_is_active(struct tipc_link *l_ptr)
 143 {
 144         return  (l_ptr->owner->active_links[0] == l_ptr) ||
 145                 (l_ptr->owner->active_links[1] == l_ptr);
 146 }
 147
 148 /**
 149  * link_timeout - handle expiration of link timer
 150  * @l_ptr: pointer to link
 151  *
 152  * This routine must not grab "tipc_net_lock" to avoid a potential deadlock conflict
 153  * with tipc_link_delete().  (There is no risk that the node will be deleted by
 154  * another thread because tipc_link_delete() always cancels the link timer before
 155  * tipc_node_delete() is called.)
 156  */
 157 static void link_timeout(struct tipc_link *l_ptr)
 158 {
 159         tipc_node_lock(l_ptr->owner);
 160
 161         /* update counters used in statistical profiling of send traffic */
 162         l_ptr->stats.accu_queue_sz += l_ptr->out_queue_size;
 163         l_ptr->stats.queue_sz_counts++;
 164
 165         if (l_ptr->first_out) {
 166                 struct tipc_msg *msg = buf_msg(l_ptr->first_out);
 167                 u32 length = msg_size(msg);
 168
 169                 if ((msg_user(msg) == MSG_FRAGMENTER) &&
 170                     (msg_type(msg) == FIRST_FRAGMENT)) {
 171                         length = msg_size(msg_get_wrapped(msg));
 172                 }
 173                 if (length) {
 174                         l_ptr->stats.msg_lengths_total += length;
 175                         l_ptr->stats.msg_length_counts++;
 176                         if (length <= 64)
 177                                 l_ptr->stats.msg_length_profile[0]++;
 178                         else if (length <= 256)
 179                                 l_ptr->stats.msg_length_profile[1]++;
 180                         else if (length <= 1024)
 181                                 l_ptr->stats.msg_length_profile[2]++;
 182                         else if (length <= 4096)
 183                                 l_ptr->stats.msg_length_profile[3]++;
 184                         else if (length <= 16384)
 185                                 l_ptr->stats.msg_length_profile[4]++;
 186                         else if (length <= 32768)
 187                                 l_ptr->stats.msg_length_profile[5]++;
 188                         else
 189                                 l_ptr->stats.msg_length_profile[6]++;
 190                 }
 191         }
 192
 193         /* do all other link processing performed on a periodic basis */
 194
 195         link_state_event(l_ptr, TIMEOUT_EVT);
 196
 197         if (l_ptr->next_out)
 198                 tipc_link_push_queue(l_ptr);
 199
 200         tipc_node_unlock(l_ptr->owner);
 201 }
 202
 203 static void link_set_timer(struct tipc_link *l_ptr, u32 time)
 204 {
 205         k_start_timer(&l_ptr->timer, time);
 206 }
 207
 208 /**
 209  * tipc_link_create - create a new link
 210  * @n_ptr: pointer to associated node
 211  * @b_ptr: pointer to associated bearer
 212  * @media_addr: media address to use when sending messages over link
 213  *
 214  * Returns pointer to link.
 215  */
 216 struct tipc_link *tipc_link_create(struct tipc_node *n_ptr,
 217                               struct tipc_bearer *b_ptr,
 218                               const struct tipc_media_addr *media_addr)
 219 {
 220         struct tipc_link *l_ptr;
 221         struct tipc_msg *msg;
 222         char *if_name;
 223         char addr_string[16];
 224         u32 peer = n_ptr->addr;
 225
 226         if (n_ptr->link_cnt >= 2) {
 227                 tipc_addr_string_fill(addr_string, n_ptr->addr);
 228                 pr_err("Attempt to establish third link to %s\n", addr_string);
 229                 return NULL;
 230         }
 231
 232         if (n_ptr->links[b_ptr->identity]) {
 233                 tipc_addr_string_fill(addr_string, n_ptr->addr);
 234                 pr_err("Attempt to establish second link on <%s> to %s\n",
 235                        b_ptr->name, addr_string);
 236                 return NULL;
 237         }
 238
 239         l_ptr = kzalloc(sizeof(*l_ptr), GFP_ATOMIC);
 240         if (!l_ptr) {
 241                 pr_warn("Link creation failed, no memory\n");
 242                 return NULL;
 243         }
 244
 245         l_ptr->addr = peer;
 246         if_name = strchr(b_ptr->name, ':') + 1;
 247         sprintf(l_ptr->name, "%u.%u.%u:%s-%u.%u.%u:unknown",
 248                 tipc_zone(tipc_own_addr), tipc_cluster(tipc_own_addr),
 249                 tipc_node(tipc_own_addr),
 250                 if_name,
 251                 tipc_zone(peer), tipc_cluster(peer), tipc_node(peer));
 252                 /* note: peer i/f name is updated by reset/activate message */
 253         memcpy(&l_ptr->media_addr, media_addr, sizeof(*media_addr));
 254         l_ptr->owner = n_ptr;
 255         l_ptr->checkpoint = 1;
 256         l_ptr->peer_session = INVALID_SESSION;
 257         l_ptr->b_ptr = b_ptr;
 258         link_set_supervision_props(l_ptr, b_ptr->tolerance);
 259         l_ptr->state = RESET_UNKNOWN;
 260
 261         l_ptr->pmsg = (struct tipc_msg *)&l_ptr->proto_msg;
 262         msg = l_ptr->pmsg;
 263         tipc_msg_init(msg, LINK_PROTOCOL, RESET_MSG, INT_H_SIZE, l_ptr->addr);
 264         msg_set_size(msg, sizeof(l_ptr->proto_msg));
 265         msg_set_session(msg, (tipc_random & 0xffff));
 266         msg_set_bearer_id(msg, b_ptr->identity);
 267         strcpy((char *)msg_data(msg), if_name);
 268
 269         l_ptr->priority = b_ptr->priority;
 270         tipc_link_set_queue_limits(l_ptr, b_ptr->window);
 271
 272         link_init_max_pkt(l_ptr);
 273
 274         l_ptr->next_out_no = 1;
 275         INIT_LIST_HEAD(&l_ptr->waiting_ports);
 276
 277         link_reset_statistics(l_ptr);
 278
 279         tipc_node_attach_link(n_ptr, l_ptr);
 280
 281         k_init_timer(&l_ptr->timer, (Handler)link_timeout, (unsigned long)l_ptr);
 282         list_add_tail(&l_ptr->link_list, &b_ptr->links);
 283         tipc_k_signal((Handler)link_start, (unsigned long)l_ptr);
 284
 285         return l_ptr;
 286 }
 287
 288 /**
 289  * tipc_link_delete - delete a link
 290  * @l_ptr: pointer to link
 291  *
 292  * Note: 'tipc_net_lock' is write_locked, bearer is locked.
 293  * This routine must not grab the node lock until after link timer cancellation
 294  * to avoid a potential deadlock situation.
 295  */
 296 void tipc_link_delete(struct tipc_link *l_ptr)
 297 {
 298         if (!l_ptr) {
 299                 pr_err("Attempt to delete non-existent link\n");
 300                 return;
 301         }
 302
 303         k_cancel_timer(&l_ptr->timer);
 304
 305         tipc_node_lock(l_ptr->owner);
 306         tipc_link_reset(l_ptr);
 307         tipc_node_detach_link(l_ptr->owner, l_ptr);
 308         tipc_link_stop(l_ptr);
 309         list_del_init(&l_ptr->link_list);
 310         tipc_node_unlock(l_ptr->owner);
 311         k_term_timer(&l_ptr->timer);
 312         kfree(l_ptr);
 313 }
 314
 315 static void link_start(struct tipc_link *l_ptr)
 316 {
 317         tipc_node_lock(l_ptr->owner);
 318         link_state_event(l_ptr, STARTING_EVT);
 319         tipc_node_unlock(l_ptr->owner);
 320 }
 321
 322 /**
 323  * link_schedule_port - schedule port for deferred sending
 324  * @l_ptr: pointer to link
 325  * @origport: reference to sending port
 326  * @sz: amount of data to be sent
 327  *
 328  * Schedules port for renewed sending of messages after link congestion
 329  * has abated.
 330  */
 331 static int link_schedule_port(struct tipc_link *l_ptr, u32 origport, u32 sz)
 332 {
 333         struct tipc_port *p_ptr;
 334
 335         spin_lock_bh(&tipc_port_list_lock);
 336         p_ptr = tipc_port_lock(origport);
 337         if (p_ptr) {
 338                 if (!p_ptr->wakeup)
 339                         goto exit;
 340                 if (!list_empty(&p_ptr->wait_list))
 341                         goto exit;
 342                 p_ptr->congested = 1;
 343                 p_ptr->waiting_pkts = 1 + ((sz - 1) / l_ptr->max_pkt);
 344                 list_add_tail(&p_ptr->wait_list, &l_ptr->waiting_ports);
 345                 l_ptr->stats.link_congs++;
 346 exit:
 347                 tipc_port_unlock(p_ptr);
 348         }
 349         spin_unlock_bh(&tipc_port_list_lock);
 350         return -ELINKCONG;
 351 }
 352
 353 void tipc_link_wakeup_ports(struct tipc_link *l_ptr, int all)
 354 {
 355         struct tipc_port *p_ptr;
 356         struct tipc_port *temp_p_ptr;
 357         int win = l_ptr->queue_limit[0] - l_ptr->out_queue_size;
 358
 359         if (all)
 360                 win = 100000;
 361         if (win <= 0)
 362                 return;
 363         if (!spin_trylock_bh(&tipc_port_list_lock))
 364                 return;
 365         if (link_congested(l_ptr))
 366                 goto exit;
 367         list_for_each_entry_safe(p_ptr, temp_p_ptr, &l_ptr->waiting_ports,
 368                                  wait_list) {
 369                 if (win <= 0)
 370                         break;
 371                 list_del_init(&p_ptr->wait_list);
 372                 spin_lock_bh(p_ptr->lock);
 373                 p_ptr->congested = 0;
 374                 p_ptr->wakeup(p_ptr);
 375                 win -= p_ptr->waiting_pkts;
 376                 spin_unlock_bh(p_ptr->lock);
 377         }
 378
 379 exit:
 380         spin_unlock_bh(&tipc_port_list_lock);
 381 }
 382
 383 /**
 384  * link_release_outqueue - purge link's outbound message queue
 385  * @l_ptr: pointer to link
 386  */
 387 static void link_release_outqueue(struct tipc_link *l_ptr)
 388 {
 389         struct sk_buff *buf = l_ptr->first_out;
 390         struct sk_buff *next;
 391
 392         while (buf) {
 393                 next = buf->next;
 394                 kfree_skb(buf);
 395                 buf = next;
 396         }
 397         l_ptr->first_out = NULL;
 398         l_ptr->out_queue_size = 0;
 399 }
 400
 401 /**
 402  * tipc_link_reset_fragments - purge link's inbound message fragments queue
 403  * @l_ptr: pointer to link
 404  */
 405 void tipc_link_reset_fragments(struct tipc_link *l_ptr)
 406 {
 407         kfree_skb(l_ptr->reasm_head);
 408         l_ptr->reasm_head = NULL;
 409         l_ptr->reasm_tail = NULL;
 410 }
 411
 412 /**
 413  * tipc_link_stop - purge all inbound and outbound messages associated with link
 414  * @l_ptr: pointer to link
 415  */
 416 void tipc_link_stop(struct tipc_link *l_ptr)
 417 {
 418         struct sk_buff *buf;
 419         struct sk_buff *next;
 420
 421         buf = l_ptr->oldest_deferred_in;
 422         while (buf) {
 423                 next = buf->next;
 424                 kfree_skb(buf);
 425                 buf = next;
 426         }
 427
 428         buf = l_ptr->first_out;
 429         while (buf) {
 430                 next = buf->next;
 431                 kfree_skb(buf);
 432                 buf = next;
 433         }
 434
 435         tipc_link_reset_fragments(l_ptr);
 436
 437         kfree_skb(l_ptr->proto_msg_queue);
 438         l_ptr->proto_msg_queue = NULL;
 439 }
 440
 441 void tipc_link_reset(struct tipc_link *l_ptr)
 442 {
 443         struct sk_buff *buf;
 444         u32 prev_state = l_ptr->state;
 445         u32 checkpoint = l_ptr->next_in_no;
 446         int was_active_link = tipc_link_is_active(l_ptr);
 447
 448         msg_set_session(l_ptr->pmsg, ((msg_session(l_ptr->pmsg) + 1) & 0xffff));
 449
 450         /* Link is down, accept any session */
 451         l_ptr->peer_session = INVALID_SESSION;
 452
 453         /* Prepare for max packet size negotiation */
 454         link_init_max_pkt(l_ptr);
 455
 456         l_ptr->state = RESET_UNKNOWN;
 457
 458         if ((prev_state == RESET_UNKNOWN) || (prev_state == RESET_RESET))
 459                 return;
 460
 461         tipc_node_link_down(l_ptr->owner, l_ptr);
 462         tipc_bearer_remove_dest(l_ptr->b_ptr, l_ptr->addr);
 463
 464         if (was_active_link && tipc_node_active_links(l_ptr->owner) &&
 465             l_ptr->owner->permit_changeover) {
 466                 l_ptr->reset_checkpoint = checkpoint;
 467                 l_ptr->exp_msg_count = START_CHANGEOVER;
 468         }
 469
 470         /* Clean up all queues: */
 471         link_release_outqueue(l_ptr);
 472         kfree_skb(l_ptr->proto_msg_queue);
 473         l_ptr->proto_msg_queue = NULL;
 474         buf = l_ptr->oldest_deferred_in;
 475         while (buf) {
 476                 struct sk_buff *next = buf->next;
 477                 kfree_skb(buf);
 478                 buf = next;
 479         }
 480         if (!list_empty(&l_ptr->waiting_ports))
 481                 tipc_link_wakeup_ports(l_ptr, 1);
 482
 483         l_ptr->retransm_queue_head = 0;
 484         l_ptr->retransm_queue_size = 0;
 485         l_ptr->last_out = NULL;
 486         l_ptr->first_out = NULL;
 487         l_ptr->next_out = NULL;
 488         l_ptr->unacked_window = 0;
 489         l_ptr->checkpoint = 1;
 490         l_ptr->next_out_no = 1;
 491         l_ptr->deferred_inqueue_sz = 0;
 492         l_ptr->oldest_deferred_in = NULL;
 493         l_ptr->newest_deferred_in = NULL;
 494         l_ptr->fsm_msg_cnt = 0;
 495         l_ptr->stale_count = 0;
 496         link_reset_statistics(l_ptr);
 497 }
 498
 499
 500 static void link_activate(struct tipc_link *l_ptr)
 501 {
 502         l_ptr->next_in_no = l_ptr->stats.recv_info = 1;
 503         tipc_node_link_up(l_ptr->owner, l_ptr);
 504         tipc_bearer_add_dest(l_ptr->b_ptr, l_ptr->addr);
 505 }
 506
 507 /**
 508  * link_state_event - link finite state machine
 509  * @l_ptr: pointer to link
 510  * @event: state machine event to process
 511  */
 512 static void link_state_event(struct tipc_link *l_ptr, unsigned int event)
 513 {
 514         struct tipc_link *other;
 515         u32 cont_intv = l_ptr->continuity_interval;
 516
 517         if (!l_ptr->started && (event != STARTING_EVT))
 518                 return;         /* Not yet. */
 519
 520         if (link_blocked(l_ptr)) {
 521                 if (event == TIMEOUT_EVT)
 522                         link_set_timer(l_ptr, cont_intv);
 523                 return;   /* Changeover going on */
 524         }
 525
 526         switch (l_ptr->state) {
 527         case WORKING_WORKING:
 528                 switch (event) {
 529                 case TRAFFIC_MSG_EVT:
 530                 case ACTIVATE_MSG:
 531                         break;
 532                 case TIMEOUT_EVT:
 533                         if (l_ptr->next_in_no != l_ptr->checkpoint) {
 534                                 l_ptr->checkpoint = l_ptr->next_in_no;
 535                                 if (tipc_bclink_acks_missing(l_ptr->owner)) {
 536                                         tipc_link_send_proto_msg(l_ptr, STATE_MSG,
 537                                                                  0, 0, 0, 0, 0);
 538                                         l_ptr->fsm_msg_cnt++;
 539                                 } else if (l_ptr->max_pkt < l_ptr->max_pkt_target) {
 540                                         tipc_link_send_proto_msg(l_ptr, STATE_MSG,
 541                                                                  1, 0, 0, 0, 0);
 542                                         l_ptr->fsm_msg_cnt++;
 543                                 }
 544                                 link_set_timer(l_ptr, cont_intv);
 545                                 break;
 546                         }
 547                         l_ptr->state = WORKING_UNKNOWN;
 548                         l_ptr->fsm_msg_cnt = 0;
 549                         tipc_link_send_proto_msg(l_ptr, STATE_MSG, 1, 0, 0, 0, 0);
 550                         l_ptr->fsm_msg_cnt++;
 551                         link_set_timer(l_ptr, cont_intv / 4);
 552                         break;
 553                 case RESET_MSG:
 554                         pr_info("%s<%s>, requested by peer\n", link_rst_msg,
 555                                 l_ptr->name);
 556                         tipc_link_reset(l_ptr);
 557                         l_ptr->state = RESET_RESET;
 558                         l_ptr->fsm_msg_cnt = 0;
 559                         tipc_link_send_proto_msg(l_ptr, ACTIVATE_MSG, 0, 0, 0, 0, 0);
 560                         l_ptr->fsm_msg_cnt++;
 561                         link_set_timer(l_ptr, cont_intv);
 562                         break;
 563                 default:
 564                         pr_err("%s%u in WW state\n", link_unk_evt, event);
 565                 }
 566                 break;
 567         case WORKING_UNKNOWN:
 568                 switch (event) {
 569                 case TRAFFIC_MSG_EVT:
 570                 case ACTIVATE_MSG:
 571                         l_ptr->state = WORKING_WORKING;
 572                         l_ptr->fsm_msg_cnt = 0;
 573                         link_set_timer(l_ptr, cont_intv);
 574                         break;
 575                 case RESET_MSG:
 576                         pr_info("%s<%s>, requested by peer while probing\n",
 577                                 link_rst_msg, l_ptr->name);
 578                         tipc_link_reset(l_ptr);
 579                         l_ptr->state = RESET_RESET;
 580                         l_ptr->fsm_msg_cnt = 0;
 581                         tipc_link_send_proto_msg(l_ptr, ACTIVATE_MSG, 0, 0, 0, 0, 0);
 582                         l_ptr->fsm_msg_cnt++;
 583                         link_set_timer(l_ptr, cont_intv);
 584                         break;
 585                 case TIMEOUT_EVT:
 586                         if (l_ptr->next_in_no != l_ptr->checkpoint) {
 587                                 l_ptr->state = WORKING_WORKING;
 588                                 l_ptr->fsm_msg_cnt = 0;
 589                                 l_ptr->checkpoint = l_ptr->next_in_no;
 590                                 if (tipc_bclink_acks_missing(l_ptr->owner)) {
 591                                         tipc_link_send_proto_msg(l_ptr, STATE_MSG,
 592                                                                  0, 0, 0, 0, 0);
 593                                         l_ptr->fsm_msg_cnt++;
 594                                 }
 595                                 link_set_timer(l_ptr, cont_intv);
 596                         } else if (l_ptr->fsm_msg_cnt < l_ptr->abort_limit) {
 597                                 tipc_link_send_proto_msg(l_ptr, STATE_MSG,
 598                                                          1, 0, 0, 0, 0);
 599                                 l_ptr->fsm_msg_cnt++;
 600                                 link_set_timer(l_ptr, cont_intv / 4);
 601                         } else {        /* Link has failed */
 602                                 pr_warn("%s<%s>, peer not responding\n",
 603                                         link_rst_msg, l_ptr->name);
 604                                 tipc_link_reset(l_ptr);
 605                                 l_ptr->state = RESET_UNKNOWN;
 606                                 l_ptr->fsm_msg_cnt = 0;
 607                                 tipc_link_send_proto_msg(l_ptr, RESET_MSG,
 608                                                          0, 0, 0, 0, 0);
 609                                 l_ptr->fsm_msg_cnt++;
 610                                 link_set_timer(l_ptr, cont_intv);
 611                         }
 612                         break;
 613                 default:
 614                         pr_err("%s%u in WU state\n", link_unk_evt, event);
 615                 }
 616                 break;
 617         case RESET_UNKNOWN:
 618                 switch (event) {
 619                 case TRAFFIC_MSG_EVT:
 620                         break;
 621                 case ACTIVATE_MSG:
 622                         other = l_ptr->owner->active_links[0];
 623                         if (other && link_working_unknown(other))
 624                                 break;
 625                         l_ptr->state = WORKING_WORKING;
 626                         l_ptr->fsm_msg_cnt = 0;
 627                         link_activate(l_ptr);
 628                         tipc_link_send_proto_msg(l_ptr, STATE_MSG, 1, 0, 0, 0, 0);
 629                         l_ptr->fsm_msg_cnt++;
 630                         if (l_ptr->owner->working_links == 1)
 631                                 tipc_link_send_sync(l_ptr);
 632                         link_set_timer(l_ptr, cont_intv);
 633                         break;
 634                 case RESET_MSG:
 635                         l_ptr->state = RESET_RESET;
 636                         l_ptr->fsm_msg_cnt = 0;
 637                         tipc_link_send_proto_msg(l_ptr, ACTIVATE_MSG, 1, 0, 0, 0, 0);
 638                         l_ptr->fsm_msg_cnt++;
 639                         link_set_timer(l_ptr, cont_intv);
 640                         break;
 641                 case STARTING_EVT:
 642                         l_ptr->started = 1;
 643                         /* fall through */
 644                 case TIMEOUT_EVT:
 645                         tipc_link_send_proto_msg(l_ptr, RESET_MSG, 0, 0, 0, 0, 0);
 646                         l_ptr->fsm_msg_cnt++;
 647                         link_set_timer(l_ptr, cont_intv);
 648                         break;
 649                 default:
 650                         pr_err("%s%u in RU state\n", link_unk_evt, event);
 651                 }
 652                 break;
 653         case RESET_RESET:
 654                 switch (event) {
 655                 case TRAFFIC_MSG_EVT:
 656                 case ACTIVATE_MSG:
 657                         other = l_ptr->owner->active_links[0];
 658                         if (other && link_working_unknown(other))
 659                                 break;
 660                         l_ptr->state = WORKING_WORKING;
 661                         l_ptr->fsm_msg_cnt = 0;
 662                         link_activate(l_ptr);
 663                         tipc_link_send_proto_msg(l_ptr, STATE_MSG, 1, 0, 0, 0, 0);
 664                         l_ptr->fsm_msg_cnt++;
 665                         if (l_ptr->owner->working_links == 1)
 666                                 tipc_link_send_sync(l_ptr);
 667                         link_set_timer(l_ptr, cont_intv);
 668                         break;
 669                 case RESET_MSG:
 670                         break;
 671                 case TIMEOUT_EVT:
 672                         tipc_link_send_proto_msg(l_ptr, ACTIVATE_MSG, 0, 0, 0, 0, 0);
 673                         l_ptr->fsm_msg_cnt++;
 674                         link_set_timer(l_ptr, cont_intv);
 675                         break;
 676                 default:
 677                         pr_err("%s%u in RR state\n", link_unk_evt, event);
 678                 }
 679                 break;
 680         default:
 681                 pr_err("Unknown link state %u/%u\n", l_ptr->state, event);
 682         }
 683 }
 684
 685 /*
 686  * link_bundle_buf(): Append contents of a buffer to
 687  * the tail of an existing one.
 688  */
 689 static int link_bundle_buf(struct tipc_link *l_ptr, struct sk_buff *bundler,
 690                            struct sk_buff *buf)
 691 {
 692         struct tipc_msg *bundler_msg = buf_msg(bundler);
 693         struct tipc_msg *msg = buf_msg(buf);
 694         u32 size = msg_size(msg);
 695         u32 bundle_size = msg_size(bundler_msg);
 696         u32 to_pos = align(bundle_size);
 697         u32 pad = to_pos - bundle_size;
 698
 699         if (msg_user(bundler_msg) != MSG_BUNDLER)
 700                 return 0;
 701         if (msg_type(bundler_msg) != OPEN_MSG)
 702                 return 0;
 703         if (skb_tailroom(bundler) < (pad + size))
 704                 return 0;
 705         if (l_ptr->max_pkt < (to_pos + size))
 706                 return 0;
 707
 708         skb_put(bundler, pad + size);
 709         skb_copy_to_linear_data_offset(bundler, to_pos, buf->data, size);
 710         msg_set_size(bundler_msg, to_pos + size);
 711         msg_set_msgcnt(bundler_msg, msg_msgcnt(bundler_msg) + 1);
 712         kfree_skb(buf);
 713         l_ptr->stats.sent_bundled++;
 714         return 1;
 715 }
 716
 717 static void link_add_to_outqueue(struct tipc_link *l_ptr,
 718                                  struct sk_buff *buf,
 719                                  struct tipc_msg *msg)
 720 {
 721         u32 ack = mod(l_ptr->next_in_no - 1);
 722         u32 seqno = mod(l_ptr->next_out_no++);
 723
 724         msg_set_word(msg, 2, ((ack << 16) | seqno));
 725         msg_set_bcast_ack(msg, l_ptr->owner->bclink.last_in);
 726         buf->next = NULL;
 727         if (l_ptr->first_out) {
 728                 l_ptr->last_out->next = buf;
 729                 l_ptr->last_out = buf;
 730         } else
 731                 l_ptr->first_out = l_ptr->last_out = buf;
 732
 733         l_ptr->out_queue_size++;
 734         if (l_ptr->out_queue_size > l_ptr->stats.max_queue_sz)
 735                 l_ptr->stats.max_queue_sz = l_ptr->out_queue_size;
 736 }
 737
 738 static void link_add_chain_to_outqueue(struct tipc_link *l_ptr,
 739                                        struct sk_buff *buf_chain,
 740                                        u32 long_msgno)
 741 {
 742         struct sk_buff *buf;
 743         struct tipc_msg *msg;
 744
 745         if (!l_ptr->next_out)
 746                 l_ptr->next_out = buf_chain;
 747         while (buf_chain) {
 748                 buf = buf_chain;
 749                 buf_chain = buf_chain->next;
 750
 751                 msg = buf_msg(buf);
 752                 msg_set_long_msgno(msg, long_msgno);
 753                 link_add_to_outqueue(l_ptr, buf, msg);
 754         }
 755 }
 756
 757 /*
 758  * tipc_link_send_buf() is the 'full path' for messages, called from
 759  * inside TIPC when the 'fast path' in tipc_send_buf
 760  * has failed, and from link_send()
 761  */
 762 int tipc_link_send_buf(struct tipc_link *l_ptr, struct sk_buff *buf)
 763 {
 764         struct tipc_msg *msg = buf_msg(buf);
 765         u32 size = msg_size(msg);
 766         u32 dsz = msg_data_sz(msg);
 767         u32 queue_size = l_ptr->out_queue_size;
 768         u32 imp = tipc_msg_tot_importance(msg);
 769         u32 queue_limit = l_ptr->queue_limit[imp];
 770         u32 max_packet = l_ptr->max_pkt;
 771
 772         /* Match msg importance against queue limits: */
 773         if (unlikely(queue_size >= queue_limit)) {
 774                 if (imp <= TIPC_CRITICAL_IMPORTANCE) {
 775                         link_schedule_port(l_ptr, msg_origport(msg), size);
 776                         kfree_skb(buf);
 777                         return -ELINKCONG;
 778                 }
 779                 kfree_skb(buf);
 780                 if (imp > CONN_MANAGER) {
 781                         pr_warn("%s<%s>, send queue full", link_rst_msg,
 782                                 l_ptr->name);
 783                         tipc_link_reset(l_ptr);
 784                 }
 785                 return dsz;
 786         }
 787
 788         /* Fragmentation needed ? */
 789         if (size > max_packet)
 790                 return link_send_long_buf(l_ptr, buf);
 791
 792         /* Packet can be queued or sent. */
 793         if (likely(!link_congested(l_ptr))) {
 794                 link_add_to_outqueue(l_ptr, buf, msg);
 795
 796                 tipc_bearer_send(l_ptr->b_ptr, buf, &l_ptr->media_addr);
 797                 l_ptr->unacked_window = 0;
 798                 return dsz;
 799         }
 800         /* Congestion: can message be bundled ? */
 801         if ((msg_user(msg) != CHANGEOVER_PROTOCOL) &&
 802             (msg_user(msg) != MSG_FRAGMENTER)) {
 803
 804                 /* Try adding message to an existing bundle */
 805                 if (l_ptr->next_out &&
 806                     link_bundle_buf(l_ptr, l_ptr->last_out, buf))
 807                         return dsz;
 808
 809                 /* Try creating a new bundle */
 810                 if (size <= max_packet * 2 / 3) {
 811                         struct sk_buff *bundler = tipc_buf_acquire(max_packet);
 812                         struct tipc_msg bundler_hdr;
 813
 814                         if (bundler) {
 815                                 tipc_msg_init(&bundler_hdr, MSG_BUNDLER, OPEN_MSG,
 816                                          INT_H_SIZE, l_ptr->addr);
 817                                 skb_copy_to_linear_data(bundler, &bundler_hdr,
 818                                                         INT_H_SIZE);
 819                                 skb_trim(bundler, INT_H_SIZE);
 820                                 link_bundle_buf(l_ptr, bundler, buf);
 821                                 buf = bundler;
 822                                 msg = buf_msg(buf);
 823                                 l_ptr->stats.sent_bundles++;
 824                         }
 825                 }
 826         }
 827         if (!l_ptr->next_out)
 828                 l_ptr->next_out = buf;
 829         link_add_to_outqueue(l_ptr, buf, msg);
 830         return dsz;
 831 }
 832
 833 /*
 834  * tipc_link_send(): same as tipc_link_send_buf(), but the link to use has
 835  * not been selected yet, and the the owner node is not locked
 836  * Called by TIPC internal users, e.g. the name distributor
 837  */
 838 int tipc_link_send(struct sk_buff *buf, u32 dest, u32 selector)
 839 {
 840         struct tipc_link *l_ptr;
 841         struct tipc_node *n_ptr;
 842         int res = -ELINKCONG;
 843
 844         read_lock_bh(&tipc_net_lock);
 845         n_ptr = tipc_node_find(dest);
 846         if (n_ptr) {
 847                 tipc_node_lock(n_ptr);
 848                 l_ptr = n_ptr->active_links[selector & 1];
 849                 if (l_ptr)
 850                         res = tipc_link_send_buf(l_ptr, buf);
 851                 else
 852                         kfree_skb(buf);
 853                 tipc_node_unlock(n_ptr);
 854         } else {
 855                 kfree_skb(buf);
 856         }
 857         read_unlock_bh(&tipc_net_lock);
 858         return res;
 859 }
 860
 861 /*
 862  * tipc_link_send_sync - synchronize broadcast link endpoints.
 863  *
 864  * Give a newly added peer node the sequence number where it should
 865  * start receiving and acking broadcast packets.
 866  *
 867  * Called with node locked
 868  */
 869 static void tipc_link_send_sync(struct tipc_link *l)
 870 {
 871         struct sk_buff *buf;
 872         struct tipc_msg *msg;
 873
 874         buf = tipc_buf_acquire(INT_H_SIZE);
 875         if (!buf)
 876                 return;
 877
 878         msg = buf_msg(buf);
 879         tipc_msg_init(msg, BCAST_PROTOCOL, STATE_MSG, INT_H_SIZE, l->addr);
 880         msg_set_last_bcast(msg, l->owner->bclink.acked);
 881         link_add_chain_to_outqueue(l, buf, 0);
 882         tipc_link_push_queue(l);
 883 }
 884
 885 /*
 886  * tipc_link_recv_sync - synchronize broadcast link endpoints.
 887  * Receive the sequence number where we should start receiving and
 888  * acking broadcast packets from a newly added peer node, and open
 889  * up for reception of such packets.
 890  *
 891  * Called with node locked
 892  */
 893 static void tipc_link_recv_sync(struct tipc_node *n, struct sk_buff *buf)
 894 {
 895         struct tipc_msg *msg = buf_msg(buf);
 896
 897         n->bclink.last_sent = n->bclink.last_in = msg_last_bcast(msg);
 898         n->bclink.recv_permitted = true;
 899         kfree_skb(buf);
 900 }
 901
 902 /*
 903  * tipc_link_send_names - send name table entries to new neighbor
 904  *
 905  * Send routine for bulk delivery of name table messages when contact
 906  * with a new neighbor occurs. No link congestion checking is performed
 907  * because name table messages *must* be delivered. The messages must be
 908  * small enough not to require fragmentation.
 909  * Called without any locks held.
 910  */
 911 void tipc_link_send_names(struct list_head *message_list, u32 dest)
 912 {
 913         struct tipc_node *n_ptr;
 914         struct tipc_link *l_ptr;
 915         struct sk_buff *buf;
 916         struct sk_buff *temp_buf;
 917
 918         if (list_empty(message_list))
 919                 return;
 920
 921         read_lock_bh(&tipc_net_lock);
 922         n_ptr = tipc_node_find(dest);
 923         if (n_ptr) {
 924                 tipc_node_lock(n_ptr);
 925                 l_ptr = n_ptr->active_links[0];
 926                 if (l_ptr) {
 927                         /* convert circular list to linear list */
 928                         ((struct sk_buff *)message_list->prev)->next = NULL;
 929                         link_add_chain_to_outqueue(l_ptr,
 930                                 (struct sk_buff *)message_list->next, 0);
 931                         tipc_link_push_queue(l_ptr);
 932                         INIT_LIST_HEAD(message_list);
 933                 }
 934                 tipc_node_unlock(n_ptr);
 935         }
 936         read_unlock_bh(&tipc_net_lock);
 937
 938         /* discard the messages if they couldn't be sent */
 939         list_for_each_safe(buf, temp_buf, ((struct sk_buff *)message_list)) {
 940                 list_del((struct list_head *)buf);
 941                 kfree_skb(buf);
 942         }
 943 }
 944
 945 /*
 946  * link_send_buf_fast: Entry for data messages where the
 947  * destination link is known and the header is complete,
 948  * inclusive total message length. Very time critical.
 949  * Link is locked. Returns user data length.
 950  */
 951 static int link_send_buf_fast(struct tipc_link *l_ptr, struct sk_buff *buf,
 952                               u32 *used_max_pkt)
 953 {
 954         struct tipc_msg *msg = buf_msg(buf);
 955         int res = msg_data_sz(msg);
 956
 957         if (likely(!link_congested(l_ptr))) {
 958                 if (likely(msg_size(msg) <= l_ptr->max_pkt)) {
 959                         link_add_to_outqueue(l_ptr, buf, msg);
 960                         tipc_bearer_send(l_ptr->b_ptr, buf,
 961                                          &l_ptr->media_addr);
 962                         l_ptr->unacked_window = 0;
 963                         return res;
 964                 }
 965                 else
 966                         *used_max_pkt = l_ptr->max_pkt;
 967         }
 968         return tipc_link_send_buf(l_ptr, buf);  /* All other cases */
 969 }
 970
 971 /*
 972  * tipc_link_send_sections_fast: Entry for messages where the
 973  * destination processor is known and the header is complete,
 974  * except for total message length.
 975  * Returns user data length or errno.
 976  */
 977 int tipc_link_send_sections_fast(struct tipc_port *sender,
 978                                  struct iovec const *msg_sect,
 979                                  unsigned int len, u32 destaddr)
 980 {
 981         struct tipc_msg *hdr = &sender->phdr;
 982         struct tipc_link *l_ptr;
 983         struct sk_buff *buf;
 984         struct tipc_node *node;
 985         int res;
 986         u32 selector = msg_origport(hdr) & 1;
 987
 988 again:
 989         /*
 990          * Try building message using port's max_pkt hint.
 991          * (Must not hold any locks while building message.)
 992          */
 993         res = tipc_msg_build(hdr, msg_sect, len, sender->max_pkt, &buf);
 994         /* Exit if build request was invalid */
 995         if (unlikely(res < 0))
 996                 return res;
 997
 998         read_lock_bh(&tipc_net_lock);
 999         node = tipc_node_find(destaddr);
1000         if (likely(node)) {
1001                 tipc_node_lock(node);
1002                 l_ptr = node->active_links[selector];
1003                 if (likely(l_ptr)) {
1004                         if (likely(buf)) {
1005                                 res = link_send_buf_fast(l_ptr, buf,
1006                                                          &sender->max_pkt);
1007 exit:
1008                                 tipc_node_unlock(node);
1009                                 read_unlock_bh(&tipc_net_lock);
1010                                 return res;
1011                         }
1012
1013                         /* Exit if link (or bearer) is congested */
1014                         if (link_congested(l_ptr)) {
1015                                 res = link_schedule_port(l_ptr,
1016                                                          sender->ref, res);
1017                                 goto exit;
1018                         }
1019
1020                         /*
1021                          * Message size exceeds max_pkt hint; update hint,
1022                          * then re-try fast path or fragment the message
1023                          */
1024                         sender->max_pkt = l_ptr->max_pkt;
1025                         tipc_node_unlock(node);
1026                         read_unlock_bh(&tipc_net_lock);
1027
1028
1029                         if ((msg_hdr_sz(hdr) + res) <= sender->max_pkt)
1030                                 goto again;
1031
1032                         return link_send_sections_long(sender, msg_sect, len,
1033                                                        destaddr);
1034                 }
1035                 tipc_node_unlock(node);
1036         }
1037         read_unlock_bh(&tipc_net_lock);
1038
1039         /* Couldn't find a link to the destination node */
1040         if (buf)
1041                 return tipc_reject_msg(buf, TIPC_ERR_NO_NODE);
1042         if (res >= 0)
1043                 return tipc_port_reject_sections(sender, hdr, msg_sect,
1044                                                  len, TIPC_ERR_NO_NODE);
1045         return res;
1046 }
1047
1048 /*
1049  * link_send_sections_long(): Entry for long messages where the
1050  * destination node is known and the header is complete,
1051  * inclusive total message length.
1052  * Link and bearer congestion status have been checked to be ok,
1053  * and are ignored if they change.
1054  *
1055  * Note that fragments do not use the full link MTU so that they won't have
1056  * to undergo refragmentation if link changeover causes them to be sent
1057  * over another link with an additional tunnel header added as prefix.
1058  * (Refragmentation will still occur if the other link has a smaller MTU.)
1059  *
1060  * Returns user data length or errno.
1061  */
1062 static int link_send_sections_long(struct tipc_port *sender,
1063                                    struct iovec const *msg_sect,
1064                                    unsigned int len, u32 destaddr)
1065 {
1066         struct tipc_link *l_ptr;
1067         struct tipc_node *node;
1068         struct tipc_msg *hdr = &sender->phdr;
1069         u32 dsz = len;
1070         u32 max_pkt, fragm_sz, rest;
1071         struct tipc_msg fragm_hdr;
1072         struct sk_buff *buf, *buf_chain, *prev;
1073         u32 fragm_crs, fragm_rest, hsz, sect_rest;
1074         const unchar __user *sect_crs;
1075         int curr_sect;
1076         u32 fragm_no;
1077         int res = 0;
1078
1079 again:
1080         fragm_no = 1;
1081         max_pkt = sender->max_pkt - INT_H_SIZE;
1082                 /* leave room for tunnel header in case of link changeover */
1083         fragm_sz = max_pkt - INT_H_SIZE;
1084                 /* leave room for fragmentation header in each fragment */
1085         rest = dsz;
1086         fragm_crs = 0;
1087         fragm_rest = 0;
1088         sect_rest = 0;
1089         sect_crs = NULL;
1090         curr_sect = -1;
1091
1092         /* Prepare reusable fragment header */
1093         tipc_msg_init(&fragm_hdr, MSG_FRAGMENTER, FIRST_FRAGMENT,
1094                  INT_H_SIZE, msg_destnode(hdr));
1095         msg_set_size(&fragm_hdr, max_pkt);
1096         msg_set_fragm_no(&fragm_hdr, 1);
1097
1098         /* Prepare header of first fragment */
1099         buf_chain = buf = tipc_buf_acquire(max_pkt);
1100         if (!buf)
1101                 return -ENOMEM;
1102         buf->next = NULL;
1103         skb_copy_to_linear_data(buf, &fragm_hdr, INT_H_SIZE);
1104         hsz = msg_hdr_sz(hdr);
1105         skb_copy_to_linear_data_offset(buf, INT_H_SIZE, hdr, hsz);
1106
1107         /* Chop up message */
1108         fragm_crs = INT_H_SIZE + hsz;
1109         fragm_rest = fragm_sz - hsz;
1110
1111         do {            /* For all sections */
1112                 u32 sz;
1113
1114                 if (!sect_rest) {
1115                         sect_rest = msg_sect[++curr_sect].iov_len;
1116                         sect_crs = msg_sect[curr_sect].iov_base;
1117                 }
1118
1119                 if (sect_rest < fragm_rest)
1120                         sz = sect_rest;
1121                 else
1122                         sz = fragm_rest;
1123
1124                 if (copy_from_user(buf->data + fragm_crs, sect_crs, sz)) {
1125                         res = -EFAULT;
1126 error:
1127                         for (; buf_chain; buf_chain = buf) {
1128                                 buf = buf_chain->next;
1129                                 kfree_skb(buf_chain);
1130                         }
1131                         return res;
1132                 }
1133                 sect_crs += sz;
1134                 sect_rest -= sz;
1135                 fragm_crs += sz;
1136                 fragm_rest -= sz;
1137                 rest -= sz;
1138
1139                 if (!fragm_rest && rest) {
1140
1141                         /* Initiate new fragment: */
1142                         if (rest <= fragm_sz) {
1143                                 fragm_sz = rest;
1144                                 msg_set_type(&fragm_hdr, LAST_FRAGMENT);
1145                         } else {
1146                                 msg_set_type(&fragm_hdr, FRAGMENT);
1147                         }
1148                         msg_set_size(&fragm_hdr, fragm_sz + INT_H_SIZE);
1149                         msg_set_fragm_no(&fragm_hdr, ++fragm_no);
1150                         prev = buf;
1151                         buf = tipc_buf_acquire(fragm_sz + INT_H_SIZE);
1152                         if (!buf) {
1153                                 res = -ENOMEM;
1154                                 goto error;
1155                         }
1156
1157                         buf->next = NULL;
1158                         prev->next = buf;
1159                         skb_copy_to_linear_data(buf, &fragm_hdr, INT_H_SIZE);
1160                         fragm_crs = INT_H_SIZE;
1161                         fragm_rest = fragm_sz;
1162                 }
1163         } while (rest > 0);
1164
1165         /*
1166          * Now we have a buffer chain. Select a link and check
1167          * that packet size is still OK
1168          */
1169         node = tipc_node_find(destaddr);
1170         if (likely(node)) {
1171                 tipc_node_lock(node);
1172                 l_ptr = node->active_links[sender->ref & 1];
1173                 if (!l_ptr) {
1174                         tipc_node_unlock(node);
1175                         goto reject;
1176                 }
1177                 if (l_ptr->max_pkt < max_pkt) {
1178                         sender->max_pkt = l_ptr->max_pkt;
1179                         tipc_node_unlock(node);
1180                         for (; buf_chain; buf_chain = buf) {
1181                                 buf = buf_chain->next;
1182                                 kfree_skb(buf_chain);
1183                         }
1184                         goto again;
1185                 }
1186         } else {
1187 reject:
1188                 for (; buf_chain; buf_chain = buf) {
1189                         buf = buf_chain->next;
1190                         kfree_skb(buf_chain);
1191                 }
1192                 return tipc_port_reject_sections(sender, hdr, msg_sect,
1193                                                  len, TIPC_ERR_NO_NODE);
1194         }
1195
1196         /* Append chain of fragments to send queue & send them */
1197         l_ptr->long_msg_seq_no++;
1198         link_add_chain_to_outqueue(l_ptr, buf_chain, l_ptr->long_msg_seq_no);
1199         l_ptr->stats.sent_fragments += fragm_no;
1200         l_ptr->stats.sent_fragmented++;
1201         tipc_link_push_queue(l_ptr);
1202         tipc_node_unlock(node);
1203         return dsz;
1204 }
1205
1206 /*
1207  * tipc_link_push_packet: Push one unsent packet to the media
1208  */
1209 u32 tipc_link_push_packet(struct tipc_link *l_ptr)
1210 {
1211         struct sk_buff *buf = l_ptr->first_out;
1212         u32 r_q_size = l_ptr->retransm_queue_size;
1213         u32 r_q_head = l_ptr->retransm_queue_head;
1214
1215         /* Step to position where retransmission failed, if any,    */
1216         /* consider that buffers may have been released in meantime */
1217         if (r_q_size && buf) {
1218                 u32 last = lesser(mod(r_q_head + r_q_size),
1219                                   link_last_sent(l_ptr));
1220                 u32 first = buf_seqno(buf);
1221
1222                 while (buf && less(first, r_q_head)) {
1223                         first = mod(first + 1);
1224                         buf = buf->next;
1225                 }
1226                 l_ptr->retransm_queue_head = r_q_head = first;
1227                 l_ptr->retransm_queue_size = r_q_size = mod(last - first);
1228         }
1229
1230         /* Continue retransmission now, if there is anything: */
1231         if (r_q_size && buf) {
1232                 msg_set_ack(buf_msg(buf), mod(l_ptr->next_in_no - 1));
1233                 msg_set_bcast_ack(buf_msg(buf), l_ptr->owner->bclink.last_in);
1234                 tipc_bearer_send(l_ptr->b_ptr, buf, &l_ptr->media_addr);
1235                 l_ptr->retransm_queue_head = mod(++r_q_head);
1236                 l_ptr->retransm_queue_size = --r_q_size;
1237                 l_ptr->stats.retransmitted++;
1238                 return 0;
1239         }
1240
1241         /* Send deferred protocol message, if any: */
1242         buf = l_ptr->proto_msg_queue;
1243         if (buf) {
1244                 msg_set_ack(buf_msg(buf), mod(l_ptr->next_in_no - 1));
1245                 msg_set_bcast_ack(buf_msg(buf), l_ptr->owner->bclink.last_in);
1246                 tipc_bearer_send(l_ptr->b_ptr, buf, &l_ptr->media_addr);
1247                 l_ptr->unacked_window = 0;
1248                 kfree_skb(buf);
1249                 l_ptr->proto_msg_queue = NULL;
1250                 return 0;
1251         }
1252
1253         /* Send one deferred data message, if send window not full: */
1254         buf = l_ptr->next_out;
1255         if (buf) {
1256                 struct tipc_msg *msg = buf_msg(buf);
1257                 u32 next = msg_seqno(msg);
1258                 u32 first = buf_seqno(l_ptr->first_out);
1259
1260                 if (mod(next - first) < l_ptr->queue_limit[0]) {
1261                         msg_set_ack(msg, mod(l_ptr->next_in_no - 1));
1262                         msg_set_bcast_ack(msg, l_ptr->owner->bclink.last_in);
1263                         tipc_bearer_send(l_ptr->b_ptr, buf, &l_ptr->media_addr);
1264                         if (msg_user(msg) == MSG_BUNDLER)
1265                                 msg_set_type(msg, CLOSED_MSG);
1266                         l_ptr->next_out = buf->next;
1267                         return 0;
1268                 }
1269         }
1270         return 1;
1271 }
1272
1273 /*
1274  * push_queue(): push out the unsent messages of a link where
1275  *               congestion has abated. Node is locked
1276  */
1277 void tipc_link_push_queue(struct tipc_link *l_ptr)
1278 {
1279         u32 res;
1280
1281         do {
1282                 res = tipc_link_push_packet(l_ptr);
1283         } while (!res);
1284 }
1285
1286 static void link_reset_all(unsigned long addr)
1287 {
1288         struct tipc_node *n_ptr;
1289         char addr_string[16];
1290         u32 i;
1291
1292         read_lock_bh(&tipc_net_lock);
1293         n_ptr = tipc_node_find((u32)addr);
1294         if (!n_ptr) {
1295                 read_unlock_bh(&tipc_net_lock);
1296                 return; /* node no longer exists */
1297         }
1298
1299         tipc_node_lock(n_ptr);
1300
1301         pr_warn("Resetting all links to %s\n",
1302                 tipc_addr_string_fill(addr_string, n_ptr->addr));
1303
1304         for (i = 0; i < MAX_BEARERS; i++) {
1305                 if (n_ptr->links[i]) {
1306                         link_print(n_ptr->links[i], "Resetting link\n");
1307                         tipc_link_reset(n_ptr->links[i]);
1308                 }
1309         }
1310
1311         tipc_node_unlock(n_ptr);
1312         read_unlock_bh(&tipc_net_lock);
1313 }
1314
1315 static void link_retransmit_failure(struct tipc_link *l_ptr,
1316                                     struct sk_buff *buf)
1317 {
1318         struct tipc_msg *msg = buf_msg(buf);
1319
1320         pr_warn("Retransmission failure on link <%s>\n", l_ptr->name);
1321
1322         if (l_ptr->addr) {
1323                 /* Handle failure on standard link */
1324                 link_print(l_ptr, "Resetting link\n");
1325                 tipc_link_reset(l_ptr);
1326
1327         } else {
1328                 /* Handle failure on broadcast link */
1329                 struct tipc_node *n_ptr;
1330                 char addr_string[16];
1331
1332                 pr_info("Msg seq number: %u,  ", msg_seqno(msg));
1333                 pr_cont("Outstanding acks: %lu\n",
1334                         (unsigned long) TIPC_SKB_CB(buf)->handle);
1335
1336                 n_ptr = tipc_bclink_retransmit_to();
1337                 tipc_node_lock(n_ptr);
1338
1339                 tipc_addr_string_fill(addr_string, n_ptr->addr);
1340                 pr_info("Broadcast link info for %s\n", addr_string);
1341                 pr_info("Reception permitted: %d,  Acked: %u\n",
1342                         n_ptr->bclink.recv_permitted,
1343                         n_ptr->bclink.acked);
1344                 pr_info("Last in: %u,  Oos state: %u,  Last sent: %u\n",
1345                         n_ptr->bclink.last_in,
1346                         n_ptr->bclink.oos_state,
1347                         n_ptr->bclink.last_sent);
1348
1349                 tipc_k_signal((Handler)link_reset_all, (unsigned long)n_ptr->addr);
1350
1351                 tipc_node_unlock(n_ptr);
1352
1353                 l_ptr->stale_count = 0;
1354         }
1355 }
1356
1357 void tipc_link_retransmit(struct tipc_link *l_ptr, struct sk_buff *buf,
1358                           u32 retransmits)
1359 {
1360         struct tipc_msg *msg;
1361
1362         if (!buf)
1363                 return;
1364
1365         msg = buf_msg(buf);
1366
1367         /* Detect repeated retransmit failures */
1368         if (l_ptr->last_retransmitted == msg_seqno(msg)) {
1369                 if (++l_ptr->stale_count > 100) {
1370                         link_retransmit_failure(l_ptr, buf);
1371                         return;
1372                 }
1373         } else {
1374                 l_ptr->last_retransmitted = msg_seqno(msg);
1375                 l_ptr->stale_count = 1;
1376         }
1377
1378         while (retransmits && (buf != l_ptr->next_out) && buf) {
1379                 msg = buf_msg(buf);
1380                 msg_set_ack(msg, mod(l_ptr->next_in_no - 1));
1381                 msg_set_bcast_ack(msg, l_ptr->owner->bclink.last_in);
1382                 tipc_bearer_send(l_ptr->b_ptr, buf, &l_ptr->media_addr);
1383                 buf = buf->next;
1384                 retransmits--;
1385                 l_ptr->stats.retransmitted++;
1386         }
1387
1388         l_ptr->retransm_queue_head = l_ptr->retransm_queue_size = 0;
1389 }
1390
1391 /**
1392  * link_insert_deferred_queue - insert deferred messages back into receive chain
1393  */
1394 static struct sk_buff *link_insert_deferred_queue(struct tipc_link *l_ptr,
1395                                                   struct sk_buff *buf)
1396 {
1397         u32 seq_no;
1398
1399         if (l_ptr->oldest_deferred_in == NULL)
1400                 return buf;
1401
1402         seq_no = buf_seqno(l_ptr->oldest_deferred_in);
1403         if (seq_no == mod(l_ptr->next_in_no)) {
1404                 l_ptr->newest_deferred_in->next = buf;
1405                 buf = l_ptr->oldest_deferred_in;
1406                 l_ptr->oldest_deferred_in = NULL;
1407                 l_ptr->deferred_inqueue_sz = 0;
1408         }
1409         return buf;
1410 }
1411
1412 /**
1413  * link_recv_buf_validate - validate basic format of received message
1414  *
1415  * This routine ensures a TIPC message has an acceptable header, and at least
1416  * as much data as the header indicates it should.  The routine also ensures
1417  * that the entire message header is stored in the main fragment of the message
1418  * buffer, to simplify future access to message header fields.
1419  *
1420  * Note: Having extra info present in the message header or data areas is OK.
1421  * TIPC will ignore the excess, under the assumption that it is optional info
1422  * introduced by a later release of the protocol.
1423  */
1424 static int link_recv_buf_validate(struct sk_buff *buf)
1425 {
1426         static u32 min_data_hdr_size[8] = {
1427                 SHORT_H_SIZE, MCAST_H_SIZE, NAMED_H_SIZE, BASIC_H_SIZE,
1428                 MAX_H_SIZE, MAX_H_SIZE, MAX_H_SIZE, MAX_H_SIZE
1429                 };
1430
1431         struct tipc_msg *msg;
1432         u32 tipc_hdr[2];
1433         u32 size;
1434         u32 hdr_size;
1435         u32 min_hdr_size;
1436
1437         if (unlikely(buf->len < MIN_H_SIZE))
1438                 return 0;
1439
1440         msg = skb_header_pointer(buf, 0, sizeof(tipc_hdr), tipc_hdr);
1441         if (msg == NULL)
1442                 return 0;
1443
1444         if (unlikely(msg_version(msg) != TIPC_VERSION))
1445                 return 0;
1446
1447         size = msg_size(msg);
1448         hdr_size = msg_hdr_sz(msg);
1449         min_hdr_size = msg_isdata(msg) ?
1450                 min_data_hdr_size[msg_type(msg)] : INT_H_SIZE;
1451
1452         if (unlikely((hdr_size < min_hdr_size) ||
1453                      (size < hdr_size) ||
1454                      (buf->len < size) ||
1455                      (size - hdr_size > TIPC_MAX_USER_MSG_SIZE)))
1456                 return 0;
1457
1458         return pskb_may_pull(buf, hdr_size);
1459 }
1460
1461 /**
1462  * tipc_recv_msg - process TIPC messages arriving from off-node
1463  * @head: pointer to message buffer chain
1464  * @tb_ptr: pointer to bearer message arrived on
1465  *
1466  * Invoked with no locks held.  Bearer pointer must point to a valid bearer
1467  * structure (i.e. cannot be NULL), but bearer can be inactive.
1468  */
1469 void tipc_recv_msg(struct sk_buff *head, struct tipc_bearer *b_ptr)
1470 {
1471         read_lock_bh(&tipc_net_lock);
1472         while (head) {
1473                 struct tipc_node *n_ptr;
1474                 struct tipc_link *l_ptr;
1475                 struct sk_buff *crs;
1476                 struct sk_buff *buf = head;
1477                 struct tipc_msg *msg;
1478                 u32 seq_no;
1479                 u32 ackd;
1480                 u32 released = 0;
1481                 int type;
1482
1483                 head = head->next;
1484
1485                 /* Ensure bearer is still enabled */
1486                 if (unlikely(!b_ptr->active))
1487                         goto discard;
1488
1489                 /* Ensure message is well-formed */
1490                 if (unlikely(!link_recv_buf_validate(buf)))
1491                         goto discard;
1492
1493                 /* Ensure message data is a single contiguous unit */
1494                 if (unlikely(skb_linearize(buf)))
1495                         goto discard;
1496
1497                 /* Handle arrival of a non-unicast link message */
1498                 msg = buf_msg(buf);
1499
1500                 if (unlikely(msg_non_seq(msg))) {
1501                         if (msg_user(msg) ==  LINK_CONFIG)
1502                                 tipc_disc_recv_msg(buf, b_ptr);
1503                         else
1504                                 tipc_bclink_recv_pkt(buf);
1505                         continue;
1506                 }
1507
1508                 /* Discard unicast link messages destined for another node */
1509                 if (unlikely(!msg_short(msg) &&
1510                              (msg_destnode(msg) != tipc_own_addr)))
1511                         goto discard;
1512
1513                 /* Locate neighboring node that sent message */
1514                 n_ptr = tipc_node_find(msg_prevnode(msg));
1515                 if (unlikely(!n_ptr))
1516                         goto discard;
1517                 tipc_node_lock(n_ptr);
1518
1519                 /* Locate unicast link endpoint that should handle message */
1520                 l_ptr = n_ptr->links[b_ptr->identity];
1521                 if (unlikely(!l_ptr))
1522                         goto unlock_discard;
1523
1524                 /* Verify that communication with node is currently allowed */
1525                 if ((n_ptr->block_setup & WAIT_PEER_DOWN) &&
1526                         msg_user(msg) == LINK_PROTOCOL &&
1527                         (msg_type(msg) == RESET_MSG ||
1528                                         msg_type(msg) == ACTIVATE_MSG) &&
1529                         !msg_redundant_link(msg))
1530                         n_ptr->block_setup &= ~WAIT_PEER_DOWN;
1531
1532                 if (n_ptr->block_setup)
1533                         goto unlock_discard;
1534
1535                 /* Validate message sequence number info */
1536                 seq_no = msg_seqno(msg);
1537                 ackd = msg_ack(msg);
1538
1539                 /* Release acked messages */
1540                 if (n_ptr->bclink.recv_permitted)
1541                         tipc_bclink_acknowledge(n_ptr, msg_bcast_ack(msg));
1542
1543                 crs = l_ptr->first_out;
1544                 while ((crs != l_ptr->next_out) &&
1545                        less_eq(buf_seqno(crs), ackd)) {
1546                         struct sk_buff *next = crs->next;
1547
1548                         kfree_skb(crs);
1549                         crs = next;
1550                         released++;
1551                 }
1552                 if (released) {
1553                         l_ptr->first_out = crs;
1554                         l_ptr->out_queue_size -= released;
1555                 }
1556
1557                 /* Try sending any messages link endpoint has pending */
1558                 if (unlikely(l_ptr->next_out))
1559                         tipc_link_push_queue(l_ptr);
1560                 if (unlikely(!list_empty(&l_ptr->waiting_ports)))
1561                         tipc_link_wakeup_ports(l_ptr, 0);
1562                 if (unlikely(++l_ptr->unacked_window >= TIPC_MIN_LINK_WIN)) {
1563                         l_ptr->stats.sent_acks++;
1564                         tipc_link_send_proto_msg(l_ptr, STATE_MSG, 0, 0, 0, 0, 0);
1565                 }
1566
1567                 /* Now (finally!) process the incoming message */
1568 protocol_check:
1569                 if (unlikely(!link_working_working(l_ptr))) {
1570                         if (msg_user(msg) == LINK_PROTOCOL) {
1571                                 link_recv_proto_msg(l_ptr, buf);
1572                                 head = link_insert_deferred_queue(l_ptr, head);
1573                                 tipc_node_unlock(n_ptr);
1574                                 continue;
1575                         }
1576
1577                         /* Traffic message. Conditionally activate link */
1578                         link_state_event(l_ptr, TRAFFIC_MSG_EVT);
1579
1580                         if (link_working_working(l_ptr)) {
1581                                 /* Re-insert buffer in front of queue */
1582                                 buf->next = head;
1583                                 head = buf;
1584                                 tipc_node_unlock(n_ptr);
1585                                 continue;
1586                         }
1587                         goto unlock_discard;
1588                 }
1589
1590                 /* Link is now in state WORKING_WORKING */
1591                 if (unlikely(seq_no != mod(l_ptr->next_in_no))) {
1592                         link_handle_out_of_seq_msg(l_ptr, buf);
1593                         head = link_insert_deferred_queue(l_ptr, head);
1594                         tipc_node_unlock(n_ptr);
1595                         continue;
1596                 }
1597                 l_ptr->next_in_no++;
1598                 if (unlikely(l_ptr->oldest_deferred_in))
1599                         head = link_insert_deferred_queue(l_ptr, head);
1600 deliver:
1601                 if (likely(msg_isdata(msg))) {
1602                         tipc_node_unlock(n_ptr);
1603                         tipc_port_recv_msg(buf);
1604                         continue;
1605                 }
1606                 switch (msg_user(msg)) {
1607                         int ret;
1608                 case MSG_BUNDLER:
1609                         l_ptr->stats.recv_bundles++;
1610                         l_ptr->stats.recv_bundled += msg_msgcnt(msg);
1611                         tipc_node_unlock(n_ptr);
1612                         tipc_link_recv_bundle(buf);
1613                         continue;
1614                 case NAME_DISTRIBUTOR:
1615                         n_ptr->bclink.recv_permitted = true;
1616                         tipc_node_unlock(n_ptr);
1617                         tipc_named_recv(buf);
1618                         continue;
1619                 case BCAST_PROTOCOL:
1620                         tipc_link_recv_sync(n_ptr, buf);
1621                         tipc_node_unlock(n_ptr);
1622                         continue;
1623                 case CONN_MANAGER:
1624                         tipc_node_unlock(n_ptr);
1625                         tipc_port_recv_proto_msg(buf);
1626                         continue;
1627                 case MSG_FRAGMENTER:
1628                         l_ptr->stats.recv_fragments++;
1629                         ret = tipc_link_recv_fragment(&l_ptr->reasm_head,
1630                                                       &l_ptr->reasm_tail,
1631                                                       &buf);
1632                         if (ret == LINK_REASM_COMPLETE) {
1633                                 l_ptr->stats.recv_fragmented++;
1634                                 msg = buf_msg(buf);
1635                                 goto deliver;
1636                         }
1637                         if (ret == LINK_REASM_ERROR)
1638                                 tipc_link_reset(l_ptr);
1639                         tipc_node_unlock(n_ptr);
1640                         continue;
1641                 case CHANGEOVER_PROTOCOL:
1642                         type = msg_type(msg);
1643                         if (link_recv_changeover_msg(&l_ptr, &buf)) {
1644                                 msg = buf_msg(buf);
1645                                 seq_no = msg_seqno(msg);
1646                                 if (type == ORIGINAL_MSG)
1647                                         goto deliver;
1648                                 goto protocol_check;
1649                         }
1650                         break;
1651                 default:
1652                         kfree_skb(buf);
1653                         buf = NULL;
1654                         break;
1655                 }
1656                 tipc_node_unlock(n_ptr);
1657                 tipc_net_route_msg(buf);
1658                 continue;
1659 unlock_discard:
1660
1661                 tipc_node_unlock(n_ptr);
1662 discard:
1663                 kfree_skb(buf);
1664         }
1665         read_unlock_bh(&tipc_net_lock);
1666 }
1667
1668 /**
1669  * tipc_link_defer_pkt - Add out-of-sequence message to deferred reception queue
1670  *
1671  * Returns increase in queue length (i.e. 0 or 1)
1672  */
1673 u32 tipc_link_defer_pkt(struct sk_buff **head, struct sk_buff **tail,
1674                         struct sk_buff *buf)
1675 {
1676         struct sk_buff *queue_buf;
1677         struct sk_buff **prev;
1678         u32 seq_no = buf_seqno(buf);
1679
1680         buf->next = NULL;
1681
1682         /* Empty queue ? */
1683         if (*head == NULL) {
1684                 *head = *tail = buf;
1685                 return 1;
1686         }
1687
1688         /* Last ? */
1689         if (less(buf_seqno(*tail), seq_no)) {
1690                 (*tail)->next = buf;
1691                 *tail = buf;
1692                 return 1;
1693         }
1694
1695         /* Locate insertion point in queue, then insert; discard if duplicate */
1696         prev = head;
1697         queue_buf = *head;
1698         for (;;) {
1699                 u32 curr_seqno = buf_seqno(queue_buf);
1700
1701                 if (seq_no == curr_seqno) {
1702                         kfree_skb(buf);
1703                         return 0;
1704                 }
1705
1706                 if (less(seq_no, curr_seqno))
1707                         break;
1708
1709                 prev = &queue_buf->next;
1710                 queue_buf = queue_buf->next;
1711         }
1712
1713         buf->next = queue_buf;
1714         *prev = buf;
1715         return 1;
1716 }
1717
1718 /*
1719  * link_handle_out_of_seq_msg - handle arrival of out-of-sequence packet
1720  */
1721 static void link_handle_out_of_seq_msg(struct tipc_link *l_ptr,
1722                                        struct sk_buff *buf)
1723 {
1724         u32 seq_no = buf_seqno(buf);
1725
1726         if (likely(msg_user(buf_msg(buf)) == LINK_PROTOCOL)) {
1727                 link_recv_proto_msg(l_ptr, buf);
1728                 return;
1729         }
1730
1731         /* Record OOS packet arrival (force mismatch on next timeout) */
1732         l_ptr->checkpoint--;
1733
1734         /*
1735          * Discard packet if a duplicate; otherwise add it to deferred queue
1736          * and notify peer of gap as per protocol specification
1737          */
1738         if (less(seq_no, mod(l_ptr->next_in_no))) {
1739                 l_ptr->stats.duplicates++;
1740                 kfree_skb(buf);
1741                 return;
1742         }
1743
1744         if (tipc_link_defer_pkt(&l_ptr->oldest_deferred_in,
1745                                 &l_ptr->newest_deferred_in, buf)) {
1746                 l_ptr->deferred_inqueue_sz++;
1747                 l_ptr->stats.deferred_recv++;
1748                 if ((l_ptr->deferred_inqueue_sz % 16) == 1)
1749                         tipc_link_send_proto_msg(l_ptr, STATE_MSG, 0, 0, 0, 0, 0);
1750         } else
1751                 l_ptr->stats.duplicates++;
1752 }
1753
1754 /*
1755  * Send protocol message to the other endpoint.
1756  */
1757 void tipc_link_send_proto_msg(struct tipc_link *l_ptr, u32 msg_typ,
1758                               int probe_msg, u32 gap, u32 tolerance,
1759                               u32 priority, u32 ack_mtu)
1760 {
1761         struct sk_buff *buf = NULL;
1762         struct tipc_msg *msg = l_ptr->pmsg;
1763         u32 msg_size = sizeof(l_ptr->proto_msg);
1764         int r_flag;
1765
1766         /* Discard any previous message that was deferred due to congestion */
1767         if (l_ptr->proto_msg_queue) {
1768                 kfree_skb(l_ptr->proto_msg_queue);
1769                 l_ptr->proto_msg_queue = NULL;
1770         }
1771
1772         if (link_blocked(l_ptr))
1773                 return;
1774
1775         /* Abort non-RESET send if communication with node is prohibited */
1776         if ((l_ptr->owner->block_setup) && (msg_typ != RESET_MSG))
1777                 return;
1778
1779         /* Create protocol message with "out-of-sequence" sequence number */
1780         msg_set_type(msg, msg_typ);
1781         msg_set_net_plane(msg, l_ptr->b_ptr->net_plane);
1782         msg_set_bcast_ack(msg, l_ptr->owner->bclink.last_in);
1783         msg_set_last_bcast(msg, tipc_bclink_get_last_sent());
1784
1785         if (msg_typ == STATE_MSG) {
1786                 u32 next_sent = mod(l_ptr->next_out_no);
1787
1788                 if (!tipc_link_is_up(l_ptr))
1789                         return;
1790                 if (l_ptr->next_out)
1791                         next_sent = buf_seqno(l_ptr->next_out);
1792                 msg_set_next_sent(msg, next_sent);
1793                 if (l_ptr->oldest_deferred_in) {
1794                         u32 rec = buf_seqno(l_ptr->oldest_deferred_in);
1795                         gap = mod(rec - mod(l_ptr->next_in_no));
1796                 }
1797                 msg_set_seq_gap(msg, gap);
1798                 if (gap)
1799                         l_ptr->stats.sent_nacks++;
1800                 msg_set_link_tolerance(msg, tolerance);
1801                 msg_set_linkprio(msg, priority);
1802                 msg_set_max_pkt(msg, ack_mtu);
1803                 msg_set_ack(msg, mod(l_ptr->next_in_no - 1));
1804                 msg_set_probe(msg, probe_msg != 0);
1805                 if (probe_msg) {
1806                         u32 mtu = l_ptr->max_pkt;
1807
1808                         if ((mtu < l_ptr->max_pkt_target) &&
1809                             link_working_working(l_ptr) &&
1810                             l_ptr->fsm_msg_cnt) {
1811                                 msg_size = (mtu + (l_ptr->max_pkt_target - mtu)/2 + 2) & ~3;
1812                                 if (l_ptr->max_pkt_probes == 10) {
1813                                         l_ptr->max_pkt_target = (msg_size - 4);
1814                                         l_ptr->max_pkt_probes = 0;
1815                                         msg_size = (mtu + (l_ptr->max_pkt_target - mtu)/2 + 2) & ~3;
1816                                 }
1817                                 l_ptr->max_pkt_probes++;
1818                         }
1819
1820                         l_ptr->stats.sent_probes++;
1821                 }
1822                 l_ptr->stats.sent_states++;
1823         } else {                /* RESET_MSG or ACTIVATE_MSG */
1824                 msg_set_ack(msg, mod(l_ptr->reset_checkpoint - 1));
1825                 msg_set_seq_gap(msg, 0);
1826                 msg_set_next_sent(msg, 1);
1827                 msg_set_probe(msg, 0);
1828                 msg_set_link_tolerance(msg, l_ptr->tolerance);
1829                 msg_set_linkprio(msg, l_ptr->priority);
1830                 msg_set_max_pkt(msg, l_ptr->max_pkt_target);
1831         }
1832
1833         r_flag = (l_ptr->owner->working_links > tipc_link_is_up(l_ptr));
1834         msg_set_redundant_link(msg, r_flag);
1835         msg_set_linkprio(msg, l_ptr->priority);
1836         msg_set_size(msg, msg_size);
1837
1838         msg_set_seqno(msg, mod(l_ptr->next_out_no + (0xffff/2)));
1839
1840         buf = tipc_buf_acquire(msg_size);
1841         if (!buf)
1842                 return;
1843
1844         skb_copy_to_linear_data(buf, msg, sizeof(l_ptr->proto_msg));
1845         buf->priority = TC_PRIO_CONTROL;
1846
1847         tipc_bearer_send(l_ptr->b_ptr, buf, &l_ptr->media_addr);
1848         l_ptr->unacked_window = 0;
1849         kfree_skb(buf);
1850 }
1851
1852 /*
1853  * Receive protocol message :
1854  * Note that network plane id propagates through the network, and may
1855  * change at any time. The node with lowest address rules
1856  */
1857 static void link_recv_proto_msg(struct tipc_link *l_ptr, struct sk_buff *buf)
1858 {
1859         u32 rec_gap = 0;
1860         u32 max_pkt_info;
1861         u32 max_pkt_ack;
1862         u32 msg_tol;
1863         struct tipc_msg *msg = buf_msg(buf);
1864
1865         if (link_blocked(l_ptr))
1866                 goto exit;
1867
1868         /* record unnumbered packet arrival (force mismatch on next timeout) */
1869         l_ptr->checkpoint--;
1870
1871         if (l_ptr->b_ptr->net_plane != msg_net_plane(msg))
1872                 if (tipc_own_addr > msg_prevnode(msg))
1873                         l_ptr->b_ptr->net_plane = msg_net_plane(msg);
1874
1875         l_ptr->owner->permit_changeover = msg_redundant_link(msg);
1876
1877         switch (msg_type(msg)) {
1878
1879         case RESET_MSG:
1880                 if (!link_working_unknown(l_ptr) &&
1881                     (l_ptr->peer_session != INVALID_SESSION)) {
1882                         if (less_eq(msg_session(msg), l_ptr->peer_session))
1883                                 break; /* duplicate or old reset: ignore */
1884                 }
1885
1886                 if (!msg_redundant_link(msg) && (link_working_working(l_ptr) ||
1887                                 link_working_unknown(l_ptr))) {
1888                         /*
1889                          * peer has lost contact -- don't allow peer's links
1890                          * to reactivate before we recognize loss & clean up
1891                          */
1892                         l_ptr->owner->block_setup = WAIT_NODE_DOWN;
1893                 }
1894
1895                 link_state_event(l_ptr, RESET_MSG);
1896
1897                 /* fall thru' */
1898         case ACTIVATE_MSG:
1899                 /* Update link settings according other endpoint's values */
1900                 strcpy((strrchr(l_ptr->name, ':') + 1), (char *)msg_data(msg));
1901
1902                 msg_tol = msg_link_tolerance(msg);
1903                 if (msg_tol > l_ptr->tolerance)
1904                         link_set_supervision_props(l_ptr, msg_tol);
1905
1906                 if (msg_linkprio(msg) > l_ptr->priority)
1907                         l_ptr->priority = msg_linkprio(msg);
1908
1909                 max_pkt_info = msg_max_pkt(msg);
1910                 if (max_pkt_info) {
1911                         if (max_pkt_info < l_ptr->max_pkt_target)
1912                                 l_ptr->max_pkt_target = max_pkt_info;
1913                         if (l_ptr->max_pkt > l_ptr->max_pkt_target)
1914                                 l_ptr->max_pkt = l_ptr->max_pkt_target;
1915                 } else {
1916                         l_ptr->max_pkt = l_ptr->max_pkt_target;
1917                 }
1918
1919                 /* Synchronize broadcast link info, if not done previously */
1920                 if (!tipc_node_is_up(l_ptr->owner)) {
1921                         l_ptr->owner->bclink.last_sent =
1922                                 l_ptr->owner->bclink.last_in =
1923                                 msg_last_bcast(msg);
1924                         l_ptr->owner->bclink.oos_state = 0;
1925                 }
1926
1927                 l_ptr->peer_session = msg_session(msg);
1928                 l_ptr->peer_bearer_id = msg_bearer_id(msg);
1929
1930                 if (msg_type(msg) == ACTIVATE_MSG)
1931                         link_state_event(l_ptr, ACTIVATE_MSG);
1932                 break;
1933         case STATE_MSG:
1934
1935                 msg_tol = msg_link_tolerance(msg);
1936                 if (msg_tol)
1937                         link_set_supervision_props(l_ptr, msg_tol);
1938
1939                 if (msg_linkprio(msg) &&
1940                     (msg_linkprio(msg) != l_ptr->priority)) {
1941                         pr_warn("%s<%s>, priority change %u->%u\n",
1942                                 link_rst_msg, l_ptr->name, l_ptr->priority,
1943                                 msg_linkprio(msg));
1944                         l_ptr->priority = msg_linkprio(msg);
1945                         tipc_link_reset(l_ptr); /* Enforce change to take effect */
1946                         break;
1947                 }
1948                 link_state_event(l_ptr, TRAFFIC_MSG_EVT);
1949                 l_ptr->stats.recv_states++;
1950                 if (link_reset_unknown(l_ptr))
1951                         break;
1952
1953                 if (less_eq(mod(l_ptr->next_in_no), msg_next_sent(msg))) {
1954                         rec_gap = mod(msg_next_sent(msg) -
1955                                       mod(l_ptr->next_in_no));
1956                 }
1957
1958                 max_pkt_ack = msg_max_pkt(msg);
1959                 if (max_pkt_ack > l_ptr->max_pkt) {
1960                         l_ptr->max_pkt = max_pkt_ack;
1961                         l_ptr->max_pkt_probes = 0;
1962                 }
1963
1964                 max_pkt_ack = 0;
1965                 if (msg_probe(msg)) {
1966                         l_ptr->stats.recv_probes++;
1967                         if (msg_size(msg) > sizeof(l_ptr->proto_msg))
1968                                 max_pkt_ack = msg_size(msg);
1969                 }
1970
1971                 /* Protocol message before retransmits, reduce loss risk */
1972                 if (l_ptr->owner->bclink.recv_permitted)
1973                         tipc_bclink_update_link_state(l_ptr->owner,
1974                                                       msg_last_bcast(msg));
1975
1976                 if (rec_gap || (msg_probe(msg))) {
1977                         tipc_link_send_proto_msg(l_ptr, STATE_MSG,
1978                                                  0, rec_gap, 0, 0, max_pkt_ack);
1979                 }
1980                 if (msg_seq_gap(msg)) {
1981                         l_ptr->stats.recv_nacks++;
1982                         tipc_link_retransmit(l_ptr, l_ptr->first_out,
1983                                              msg_seq_gap(msg));
1984                 }
1985                 break;
1986         }
1987 exit:
1988         kfree_skb(buf);
1989 }
1990
1991
1992 /*
1993  * tipc_link_tunnel(): Send one message via a link belonging to
1994  * another bearer. Owner node is locked.
1995  */
1996 static void tipc_link_tunnel(struct tipc_link *l_ptr,
1997                              struct tipc_msg *tunnel_hdr, struct tipc_msg *msg,
1998                              u32 selector)
1999 {
2000         struct tipc_link *tunnel;
2001         struct sk_buff *buf;
2002         u32 length = msg_size(msg);
2003
2004         tunnel = l_ptr->owner->active_links[selector & 1];
2005         if (!tipc_link_is_up(tunnel)) {
2006                 pr_warn("%stunnel link no longer available\n", link_co_err);
2007                 return;
2008         }
2009         msg_set_size(tunnel_hdr, length + INT_H_SIZE);
2010         buf = tipc_buf_acquire(length + INT_H_SIZE);
2011         if (!buf) {
2012                 pr_warn("%sunable to send tunnel msg\n", link_co_err);
2013                 return;
2014         }
2015         skb_copy_to_linear_data(buf, tunnel_hdr, INT_H_SIZE);
2016         skb_copy_to_linear_data_offset(buf, INT_H_SIZE, msg, length);
2017         tipc_link_send_buf(tunnel, buf);
2018 }
2019
2020
2021
2022 /*
2023  * changeover(): Send whole message queue via the remaining link
2024  *               Owner node is locked.
2025  */
2026 void tipc_link_changeover(struct tipc_link *l_ptr)
2027 {
2028         u32 msgcount = l_ptr->out_queue_size;
2029         struct sk_buff *crs = l_ptr->first_out;
2030         struct tipc_link *tunnel = l_ptr->owner->active_links[0];
2031         struct tipc_msg tunnel_hdr;
2032         int split_bundles;
2033
2034         if (!tunnel)
2035                 return;
2036
2037         if (!l_ptr->owner->permit_changeover) {
2038                 pr_warn("%speer did not permit changeover\n", link_co_err);
2039                 return;
2040         }
2041
2042         tipc_msg_init(&tunnel_hdr, CHANGEOVER_PROTOCOL,
2043                  ORIGINAL_MSG, INT_H_SIZE, l_ptr->addr);
2044         msg_set_bearer_id(&tunnel_hdr, l_ptr->peer_bearer_id);
2045         msg_set_msgcnt(&tunnel_hdr, msgcount);
2046
2047         if (!l_ptr->first_out) {
2048                 struct sk_buff *buf;
2049
2050                 buf = tipc_buf_acquire(INT_H_SIZE);
2051                 if (buf) {
2052                         skb_copy_to_linear_data(buf, &tunnel_hdr, INT_H_SIZE);
2053                         msg_set_size(&tunnel_hdr, INT_H_SIZE);
2054                         tipc_link_send_buf(tunnel, buf);
2055                 } else {
2056                         pr_warn("%sunable to send changeover msg\n",
2057                                 link_co_err);
2058                 }
2059                 return;
2060         }
2061
2062         split_bundles = (l_ptr->owner->active_links[0] !=
2063                          l_ptr->owner->active_links[1]);
2064
2065         while (crs) {
2066                 struct tipc_msg *msg = buf_msg(crs);
2067
2068                 if ((msg_user(msg) == MSG_BUNDLER) && split_bundles) {
2069                         struct tipc_msg *m = msg_get_wrapped(msg);
2070                         unchar *pos = (unchar *)m;
2071
2072                         msgcount = msg_msgcnt(msg);
2073                         while (msgcount--) {
2074                                 msg_set_seqno(m, msg_seqno(msg));
2075                                 tipc_link_tunnel(l_ptr, &tunnel_hdr, m,
2076                                                  msg_link_selector(m));
2077                                 pos += align(msg_size(m));
2078                                 m = (struct tipc_msg *)pos;
2079                         }
2080                 } else {
2081                         tipc_link_tunnel(l_ptr, &tunnel_hdr, msg,
2082                                          msg_link_selector(msg));
2083                 }
2084                 crs = crs->next;
2085         }
2086 }
2087
2088 void tipc_link_send_duplicate(struct tipc_link *l_ptr, struct tipc_link *tunnel)
2089 {
2090         struct sk_buff *iter;
2091         struct tipc_msg tunnel_hdr;
2092
2093         tipc_msg_init(&tunnel_hdr, CHANGEOVER_PROTOCOL,
2094                  DUPLICATE_MSG, INT_H_SIZE, l_ptr->addr);
2095         msg_set_msgcnt(&tunnel_hdr, l_ptr->out_queue_size);
2096         msg_set_bearer_id(&tunnel_hdr, l_ptr->peer_bearer_id);
2097         iter = l_ptr->first_out;
2098         while (iter) {
2099                 struct sk_buff *outbuf;
2100                 struct tipc_msg *msg = buf_msg(iter);
2101                 u32 length = msg_size(msg);
2102
2103                 if (msg_user(msg) == MSG_BUNDLER)
2104                         msg_set_type(msg, CLOSED_MSG);
2105                 msg_set_ack(msg, mod(l_ptr->next_in_no - 1));   /* Update */
2106                 msg_set_bcast_ack(msg, l_ptr->owner->bclink.last_in);
2107                 msg_set_size(&tunnel_hdr, length + INT_H_SIZE);
2108                 outbuf = tipc_buf_acquire(length + INT_H_SIZE);
2109                 if (outbuf == NULL) {
2110                         pr_warn("%sunable to send duplicate msg\n",
2111                                 link_co_err);
2112                         return;
2113                 }
2114                 skb_copy_to_linear_data(outbuf, &tunnel_hdr, INT_H_SIZE);
2115                 skb_copy_to_linear_data_offset(outbuf, INT_H_SIZE, iter->data,
2116                                                length);
2117                 tipc_link_send_buf(tunnel, outbuf);
2118                 if (!tipc_link_is_up(l_ptr))
2119                         return;
2120                 iter = iter->next;
2121         }
2122 }
2123
2124 /**
2125  * buf_extract - extracts embedded TIPC message from another message
2126  * @skb: encapsulating message buffer
2127  * @from_pos: offset to extract from
2128  *
2129  * Returns a new message buffer containing an embedded message.  The
2130  * encapsulating message itself is left unchanged.
2131  */
2132 static struct sk_buff *buf_extract(struct sk_buff *skb, u32 from_pos)
2133 {
2134         struct tipc_msg *msg = (struct tipc_msg *)(skb->data + from_pos);
2135         u32 size = msg_size(msg);
2136         struct sk_buff *eb;
2137
2138         eb = tipc_buf_acquire(size);
2139         if (eb)
2140                 skb_copy_to_linear_data(eb, msg, size);
2141         return eb;
2142 }
2143
2144 /*
2145  *  link_recv_changeover_msg(): Receive tunneled packet sent
2146  *  via other link. Node is locked. Return extracted buffer.
2147  */
2148 static int link_recv_changeover_msg(struct tipc_link **l_ptr,
2149                                     struct sk_buff **buf)
2150 {
2151         struct sk_buff *tunnel_buf = *buf;
2152         struct tipc_link *dest_link;
2153         struct tipc_msg *msg;
2154         struct tipc_msg *tunnel_msg = buf_msg(tunnel_buf);
2155         u32 msg_typ = msg_type(tunnel_msg);
2156         u32 msg_count = msg_msgcnt(tunnel_msg);
2157         u32 bearer_id = msg_bearer_id(tunnel_msg);
2158
2159         if (bearer_id >= MAX_BEARERS)
2160                 goto exit;
2161         dest_link = (*l_ptr)->owner->links[bearer_id];
2162         if (!dest_link)
2163                 goto exit;
2164         if (dest_link == *l_ptr) {
2165                 pr_err("Unexpected changeover message on link <%s>\n",
2166                        (*l_ptr)->name);
2167                 goto exit;
2168         }
2169         *l_ptr = dest_link;
2170         msg = msg_get_wrapped(tunnel_msg);
2171
2172         if (msg_typ == DUPLICATE_MSG) {
2173                 if (less(msg_seqno(msg), mod(dest_link->next_in_no)))
2174                         goto exit;
2175                 *buf = buf_extract(tunnel_buf, INT_H_SIZE);
2176                 if (*buf == NULL) {
2177                         pr_warn("%sduplicate msg dropped\n", link_co_err);
2178                         goto exit;
2179                 }
2180                 kfree_skb(tunnel_buf);
2181                 return 1;
2182         }
2183
2184         /* First original message ?: */
2185         if (tipc_link_is_up(dest_link)) {
2186                 pr_info("%s<%s>, changeover initiated by peer\n", link_rst_msg,
2187                         dest_link->name);
2188                 tipc_link_reset(dest_link);
2189                 dest_link->exp_msg_count = msg_count;
2190                 if (!msg_count)
2191                         goto exit;
2192         } else if (dest_link->exp_msg_count == START_CHANGEOVER) {
2193                 dest_link->exp_msg_count = msg_count;
2194                 if (!msg_count)
2195                         goto exit;
2196         }
2197
2198         /* Receive original message */
2199         if (dest_link->exp_msg_count == 0) {
2200                 pr_warn("%sgot too many tunnelled messages\n", link_co_err);
2201                 goto exit;
2202         }
2203         dest_link->exp_msg_count--;
2204         if (less(msg_seqno(msg), dest_link->reset_checkpoint)) {
2205                 goto exit;
2206         } else {
2207                 *buf = buf_extract(tunnel_buf, INT_H_SIZE);
2208                 if (*buf != NULL) {
2209                         kfree_skb(tunnel_buf);
2210                         return 1;
2211                 } else {
2212                         pr_warn("%soriginal msg dropped\n", link_co_err);
2213                 }
2214         }
2215 exit:
2216         *buf = NULL;
2217         kfree_skb(tunnel_buf);
2218         return 0;
2219 }
2220
2221 /*
2222  *  Bundler functionality:
2223  */
2224 void tipc_link_recv_bundle(struct sk_buff *buf)
2225 {
2226         u32 msgcount = msg_msgcnt(buf_msg(buf));
2227         u32 pos = INT_H_SIZE;
2228         struct sk_buff *obuf;
2229
2230         while (msgcount--) {
2231                 obuf = buf_extract(buf, pos);
2232                 if (obuf == NULL) {
2233                         pr_warn("Link unable to unbundle message(s)\n");
2234                         break;
2235                 }
2236                 pos += align(msg_size(buf_msg(obuf)));
2237                 tipc_net_route_msg(obuf);
2238         }
2239         kfree_skb(buf);
2240 }
2241
2242 /*
2243  *  Fragmentation/defragmentation:
2244  */
2245
2246 /*
2247  * link_send_long_buf: Entry for buffers needing fragmentation.
2248  * The buffer is complete, inclusive total message length.
2249  * Returns user data length.
2250  */
2251 static int link_send_long_buf(struct tipc_link *l_ptr, struct sk_buff *buf)
2252 {
2253         struct sk_buff *buf_chain = NULL;
2254         struct sk_buff *buf_chain_tail = (struct sk_buff *)&buf_chain;
2255         struct tipc_msg *inmsg = buf_msg(buf);
2256         struct tipc_msg fragm_hdr;
2257         u32 insize = msg_size(inmsg);
2258         u32 dsz = msg_data_sz(inmsg);
2259         unchar *crs = buf->data;
2260         u32 rest = insize;
2261         u32 pack_sz = l_ptr->max_pkt;
2262         u32 fragm_sz = pack_sz - INT_H_SIZE;
2263         u32 fragm_no = 0;
2264         u32 destaddr;
2265
2266         if (msg_short(inmsg))
2267                 destaddr = l_ptr->addr;
2268         else
2269                 destaddr = msg_destnode(inmsg);
2270
2271         /* Prepare reusable fragment header: */
2272         tipc_msg_init(&fragm_hdr, MSG_FRAGMENTER, FIRST_FRAGMENT,
2273                  INT_H_SIZE, destaddr);
2274
2275         /* Chop up message: */
2276         while (rest > 0) {
2277                 struct sk_buff *fragm;
2278
2279                 if (rest <= fragm_sz) {
2280                         fragm_sz = rest;
2281                         msg_set_type(&fragm_hdr, LAST_FRAGMENT);
2282                 }
2283                 fragm = tipc_buf_acquire(fragm_sz + INT_H_SIZE);
2284                 if (fragm == NULL) {
2285                         kfree_skb(buf);
2286                         while (buf_chain) {
2287                                 buf = buf_chain;
2288                                 buf_chain = buf_chain->next;
2289                                 kfree_skb(buf);
2290                         }
2291                         return -ENOMEM;
2292                 }
2293                 msg_set_size(&fragm_hdr, fragm_sz + INT_H_SIZE);
2294                 fragm_no++;
2295                 msg_set_fragm_no(&fragm_hdr, fragm_no);
2296                 skb_copy_to_linear_data(fragm, &fragm_hdr, INT_H_SIZE);
2297                 skb_copy_to_linear_data_offset(fragm, INT_H_SIZE, crs,
2298                                                fragm_sz);
2299                 buf_chain_tail->next = fragm;
2300                 buf_chain_tail = fragm;
2301
2302                 rest -= fragm_sz;
2303                 crs += fragm_sz;
2304                 msg_set_type(&fragm_hdr, FRAGMENT);
2305         }
2306         kfree_skb(buf);
2307
2308         /* Append chain of fragments to send queue & send them */
2309         l_ptr->long_msg_seq_no++;
2310         link_add_chain_to_outqueue(l_ptr, buf_chain, l_ptr->long_msg_seq_no);
2311         l_ptr->stats.sent_fragments += fragm_no;
2312         l_ptr->stats.sent_fragmented++;
2313         tipc_link_push_queue(l_ptr);
2314
2315         return dsz;
2316 }
2317
2318 /*
2319  * tipc_link_recv_fragment(): Called with node lock on. Returns
2320  * the reassembled buffer if message is complete.
2321  */
2322 int tipc_link_recv_fragment(struct sk_buff **head, struct sk_buff **tail,
2323                             struct sk_buff **fbuf)
2324 {
2325         struct sk_buff *frag = *fbuf;
2326         struct tipc_msg *msg = buf_msg(frag);
2327         u32 fragid = msg_type(msg);
2328         bool headstolen;
2329         int delta;
2330
2331         skb_pull(frag, msg_hdr_sz(msg));
2332         if (fragid == FIRST_FRAGMENT) {
2333                 if (*head || skb_unclone(frag, GFP_ATOMIC))
2334                         goto out_free;
2335                 *head = frag;
2336                 skb_frag_list_init(*head);
2337                 return 0;
2338         } else if (*head &&
2339                    skb_try_coalesce(*head, frag, &headstolen, &delta)) {
2340                 kfree_skb_partial(frag, headstolen);
2341         } else {
2342                 if (!*head)
2343                         goto out_free;
2344                 if (!skb_has_frag_list(*head))
2345                         skb_shinfo(*head)->frag_list = frag;
2346                 else
2347                         (*tail)->next = frag;
2348                 *tail = frag;
2349                 (*head)->truesize += frag->truesize;
2350         }
2351         if (fragid == LAST_FRAGMENT) {
2352                 *fbuf = *head;
2353                 *tail = *head = NULL;
2354                 return LINK_REASM_COMPLETE;
2355         }
2356         return 0;
2357 out_free:
2358         pr_warn_ratelimited("Link unable to reassemble fragmented message\n");
2359         kfree_skb(*fbuf);
2360         return LINK_REASM_ERROR;
2361 }
2362
2363 static void link_set_supervision_props(struct tipc_link *l_ptr, u32 tolerance)
2364 {
2365         if ((tolerance < TIPC_MIN_LINK_TOL) || (tolerance > TIPC_MAX_LINK_TOL))
2366                 return;
2367
2368         l_ptr->tolerance = tolerance;
2369         l_ptr->continuity_interval =
2370                 ((tolerance / 4) > 500) ? 500 : tolerance / 4;
2371         l_ptr->abort_limit = tolerance / (l_ptr->continuity_interval / 4);
2372 }
2373
2374 void tipc_link_set_queue_limits(struct tipc_link *l_ptr, u32 window)
2375 {
2376         /* Data messages from this node, inclusive FIRST_FRAGM */
2377         l_ptr->queue_limit[TIPC_LOW_IMPORTANCE] = window;
2378         l_ptr->queue_limit[TIPC_MEDIUM_IMPORTANCE] = (window / 3) * 4;
2379         l_ptr->queue_limit[TIPC_HIGH_IMPORTANCE] = (window / 3) * 5;
2380         l_ptr->queue_limit[TIPC_CRITICAL_IMPORTANCE] = (window / 3) * 6;
2381         /* Transiting data messages,inclusive FIRST_FRAGM */
2382         l_ptr->queue_limit[TIPC_LOW_IMPORTANCE + 4] = 300;
2383         l_ptr->queue_limit[TIPC_MEDIUM_IMPORTANCE + 4] = 600;
2384         l_ptr->queue_limit[TIPC_HIGH_IMPORTANCE + 4] = 900;
2385         l_ptr->queue_limit[TIPC_CRITICAL_IMPORTANCE + 4] = 1200;
2386         l_ptr->queue_limit[CONN_MANAGER] = 1200;
2387         l_ptr->queue_limit[CHANGEOVER_PROTOCOL] = 2500;
2388         l_ptr->queue_limit[NAME_DISTRIBUTOR] = 3000;
2389         /* FRAGMENT and LAST_FRAGMENT packets */
2390         l_ptr->queue_limit[MSG_FRAGMENTER] = 4000;
2391 }
2392
2393 /**
2394  * link_find_link - locate link by name
2395  * @name: ptr to link name string
2396  * @node: ptr to area to be filled with ptr to associated node
2397  *
2398  * Caller must hold 'tipc_net_lock' to ensure node and bearer are not deleted;
2399  * this also prevents link deletion.
2400  *
2401  * Returns pointer to link (or 0 if invalid link name).
2402  */
2403 static struct tipc_link *link_find_link(const char *name,
2404                                         struct tipc_node **node)
2405 {
2406         struct tipc_link *l_ptr;
2407         struct tipc_node *n_ptr;
2408         int i;
2409
2410         list_for_each_entry(n_ptr, &tipc_node_list, list) {
2411                 for (i = 0; i < MAX_BEARERS; i++) {
2412                         l_ptr = n_ptr->links[i];
2413                         if (l_ptr && !strcmp(l_ptr->name, name))
2414                                 goto found;
2415                 }
2416         }
2417         l_ptr = NULL;
2418         n_ptr = NULL;
2419 found:
2420         *node = n_ptr;
2421         return l_ptr;
2422 }
2423
2424 /**
2425  * link_value_is_valid -- validate proposed link tolerance/priority/window
2426  *
2427  * @cmd: value type (TIPC_CMD_SET_LINK_*)
2428  * @new_value: the new value
2429  *
2430  * Returns 1 if value is within range, 0 if not.
2431  */
2432 static int link_value_is_valid(u16 cmd, u32 new_value)
2433 {
2434         switch (cmd) {
2435         case TIPC_CMD_SET_LINK_TOL:
2436                 return (new_value >= TIPC_MIN_LINK_TOL) &&
2437                         (new_value <= TIPC_MAX_LINK_TOL);
2438         case TIPC_CMD_SET_LINK_PRI:
2439                 return (new_value <= TIPC_MAX_LINK_PRI);
2440         case TIPC_CMD_SET_LINK_WINDOW:
2441                 return (new_value >= TIPC_MIN_LINK_WIN) &&
2442                         (new_value <= TIPC_MAX_LINK_WIN);
2443         }
2444         return 0;
2445 }
2446
2447 /**
2448  * link_cmd_set_value - change priority/tolerance/window for link/bearer/media
2449  * @name: ptr to link, bearer, or media name
2450  * @new_value: new value of link, bearer, or media setting
2451  * @cmd: which link, bearer, or media attribute to set (TIPC_CMD_SET_LINK_*)
2452  *
2453  * Caller must hold 'tipc_net_lock' to ensure link/bearer/media is not deleted.
2454  *
2455  * Returns 0 if value updated and negative value on error.
2456  */
2457 static int link_cmd_set_value(const char *name, u32 new_value, u16 cmd)
2458 {
2459         struct tipc_node *node;
2460         struct tipc_link *l_ptr;
2461         struct tipc_bearer *b_ptr;
2462         struct tipc_media *m_ptr;
2463         int res = 0;
2464
2465         l_ptr = link_find_link(name, &node);
2466         if (l_ptr) {
2467                 /*
2468                  * acquire node lock for tipc_link_send_proto_msg().
2469                  * see "TIPC locking policy" in net.c.
2470                  */
2471                 tipc_node_lock(node);
2472                 switch (cmd) {
2473                 case TIPC_CMD_SET_LINK_TOL:
2474                         link_set_supervision_props(l_ptr, new_value);
2475                         tipc_link_send_proto_msg(l_ptr,
2476                                 STATE_MSG, 0, 0, new_value, 0, 0);
2477                         break;
2478                 case TIPC_CMD_SET_LINK_PRI:
2479                         l_ptr->priority = new_value;
2480                         tipc_link_send_proto_msg(l_ptr,
2481                                 STATE_MSG, 0, 0, 0, new_value, 0);
2482                         break;
2483                 case TIPC_CMD_SET_LINK_WINDOW:
2484                         tipc_link_set_queue_limits(l_ptr, new_value);
2485                         break;
2486                 default:
2487                         res = -EINVAL;
2488                         break;
2489                 }
2490                 tipc_node_unlock(node);
2491                 return res;
2492         }
2493
2494         b_ptr = tipc_bearer_find(name);
2495         if (b_ptr) {
2496                 switch (cmd) {
2497                 case TIPC_CMD_SET_LINK_TOL:
2498                         b_ptr->tolerance = new_value;
2499                         break;
2500                 case TIPC_CMD_SET_LINK_PRI:
2501                         b_ptr->priority = new_value;
2502                         break;
2503                 case TIPC_CMD_SET_LINK_WINDOW:
2504                         b_ptr->window = new_value;
2505                         break;
2506                 default:
2507                         res = -EINVAL;
2508                         break;
2509                 }
2510                 return res;
2511         }
2512
2513         m_ptr = tipc_media_find(name);
2514         if (!m_ptr)
2515                 return -ENODEV;
2516         switch (cmd) {
2517         case TIPC_CMD_SET_LINK_TOL:
2518                 m_ptr->tolerance = new_value;
2519                 break;
2520         case TIPC_CMD_SET_LINK_PRI:
2521                 m_ptr->priority = new_value;
2522                 break;
2523         case TIPC_CMD_SET_LINK_WINDOW:
2524                 m_ptr->window = new_value;
2525                 break;
2526         default:
2527                 res = -EINVAL;
2528                 break;
2529         }
2530         return res;
2531 }
2532
2533 struct sk_buff *tipc_link_cmd_config(const void *req_tlv_area, int req_tlv_space,
2534                                      u16 cmd)
2535 {
2536         struct tipc_link_config *args;
2537         u32 new_value;
2538         int res;
2539
2540         if (!TLV_CHECK(req_tlv_area, req_tlv_space, TIPC_TLV_LINK_CONFIG))
2541                 return tipc_cfg_reply_error_string(TIPC_CFG_TLV_ERROR);
2542
2543         args = (struct tipc_link_config *)TLV_DATA(req_tlv_area);
2544         new_value = ntohl(args->value);
2545
2546         if (!link_value_is_valid(cmd, new_value))
2547                 return tipc_cfg_reply_error_string(
2548                         "cannot change, value invalid");
2549
2550         if (!strcmp(args->name, tipc_bclink_name)) {
2551                 if ((cmd == TIPC_CMD_SET_LINK_WINDOW) &&
2552                     (tipc_bclink_set_queue_limits(new_value) == 0))
2553                         return tipc_cfg_reply_none();
2554                 return tipc_cfg_reply_error_string(TIPC_CFG_NOT_SUPPORTED
2555                                                    " (cannot change setting on broadcast link)");
2556         }
2557
2558         read_lock_bh(&tipc_net_lock);
2559         res = link_cmd_set_value(args->name, new_value, cmd);
2560         read_unlock_bh(&tipc_net_lock);
2561         if (res)
2562                 return tipc_cfg_reply_error_string("cannot change link setting");
2563
2564         return tipc_cfg_reply_none();
2565 }
2566
2567 /**
2568  * link_reset_statistics - reset link statistics
2569  * @l_ptr: pointer to link
2570  */
2571 static void link_reset_statistics(struct tipc_link *l_ptr)
2572 {
2573         memset(&l_ptr->stats, 0, sizeof(l_ptr->stats));
2574         l_ptr->stats.sent_info = l_ptr->next_out_no;
2575         l_ptr->stats.recv_info = l_ptr->next_in_no;
2576 }
2577
2578 struct sk_buff *tipc_link_cmd_reset_stats(const void *req_tlv_area, int req_tlv_space)
2579 {
2580         char *link_name;
2581         struct tipc_link *l_ptr;
2582         struct tipc_node *node;
2583
2584         if (!TLV_CHECK(req_tlv_area, req_tlv_space, TIPC_TLV_LINK_NAME))
2585                 return tipc_cfg_reply_error_string(TIPC_CFG_TLV_ERROR);
2586
2587         link_name = (char *)TLV_DATA(req_tlv_area);
2588         if (!strcmp(link_name, tipc_bclink_name)) {
2589                 if (tipc_bclink_reset_stats())
2590                         return tipc_cfg_reply_error_string("link not found");
2591                 return tipc_cfg_reply_none();
2592         }
2593
2594         read_lock_bh(&tipc_net_lock);
2595         l_ptr = link_find_link(link_name, &node);
2596         if (!l_ptr) {
2597                 read_unlock_bh(&tipc_net_lock);
2598                 return tipc_cfg_reply_error_string("link not found");
2599         }
2600
2601         tipc_node_lock(node);
2602         link_reset_statistics(l_ptr);
2603         tipc_node_unlock(node);
2604         read_unlock_bh(&tipc_net_lock);
2605         return tipc_cfg_reply_none();
2606 }
2607
2608 /**
2609  * percent - convert count to a percentage of total (rounding up or down)
2610  */
2611 static u32 percent(u32 count, u32 total)
2612 {
2613         return (count * 100 + (total / 2)) / total;
2614 }
2615
2616 /**
2617  * tipc_link_stats - print link statistics
2618  * @name: link name
2619  * @buf: print buffer area
2620  * @buf_size: size of print buffer area
2621  *
2622  * Returns length of print buffer data string (or 0 if error)
2623  */
2624 static int tipc_link_stats(const char *name, char *buf, const u32 buf_size)
2625 {
2626         struct tipc_link *l;
2627         struct tipc_stats *s;
2628         struct tipc_node *node;
2629         char *status;
2630         u32 profile_total = 0;
2631         int ret;
2632
2633         if (!strcmp(name, tipc_bclink_name))
2634                 return tipc_bclink_stats(buf, buf_size);
2635
2636         read_lock_bh(&tipc_net_lock);
2637         l = link_find_link(name, &node);
2638         if (!l) {
2639                 read_unlock_bh(&tipc_net_lock);
2640                 return 0;
2641         }
2642         tipc_node_lock(node);
2643         s = &l->stats;
2644
2645         if (tipc_link_is_active(l))
2646                 status = "ACTIVE";
2647         else if (tipc_link_is_up(l))
2648                 status = "STANDBY";
2649         else
2650                 status = "DEFUNCT";
2651
2652         ret = tipc_snprintf(buf, buf_size, "Link <%s>\n"
2653                             "  %s  MTU:%u  Priority:%u  Tolerance:%u ms"
2654                             "  Window:%u packets\n",
2655                             l->name, status, l->max_pkt, l->priority,
2656                             l->tolerance, l->queue_limit[0]);
2657
2658         ret += tipc_snprintf(buf + ret, buf_size - ret,
2659                              "  RX packets:%u fragments:%u/%u bundles:%u/%u\n",
2660                              l->next_in_no - s->recv_info, s->recv_fragments,
2661                              s->recv_fragmented, s->recv_bundles,
2662                              s->recv_bundled);
2663
2664         ret += tipc_snprintf(buf + ret, buf_size - ret,
2665                              "  TX packets:%u fragments:%u/%u bundles:%u/%u\n",
2666                              l->next_out_no - s->sent_info, s->sent_fragments,
2667                              s->sent_fragmented, s->sent_bundles,
2668                              s->sent_bundled);
2669
2670         profile_total = s->msg_length_counts;
2671         if (!profile_total)
2672                 profile_total = 1;
2673
2674         ret += tipc_snprintf(buf + ret, buf_size - ret,
2675                              "  TX profile sample:%u packets  average:%u octets\n"
2676                              "  0-64:%u%% -256:%u%% -1024:%u%% -4096:%u%% "
2677                              "-16384:%u%% -32768:%u%% -66000:%u%%\n",
2678                              s->msg_length_counts,
2679                              s->msg_lengths_total / profile_total,
2680                              percent(s->msg_length_profile[0], profile_total),
2681                              percent(s->msg_length_profile[1], profile_total),
2682                              percent(s->msg_length_profile[2], profile_total),
2683                              percent(s->msg_length_profile[3], profile_total),
2684                              percent(s->msg_length_profile[4], profile_total),
2685                              percent(s->msg_length_profile[5], profile_total),
2686                              percent(s->msg_length_profile[6], profile_total));
2687
2688         ret += tipc_snprintf(buf + ret, buf_size - ret,
2689                              "  RX states:%u probes:%u naks:%u defs:%u"
2690                              " dups:%u\n", s->recv_states, s->recv_probes,
2691                              s->recv_nacks, s->deferred_recv, s->duplicates);
2692
2693         ret += tipc_snprintf(buf + ret, buf_size - ret,
2694                              "  TX states:%u probes:%u naks:%u acks:%u"
2695                              " dups:%u\n", s->sent_states, s->sent_probes,
2696                              s->sent_nacks, s->sent_acks, s->retransmitted);
2697
2698         ret += tipc_snprintf(buf + ret, buf_size - ret,
2699                              "  Congestion link:%u  Send queue"
2700                              " max:%u avg:%u\n", s->link_congs,
2701                              s->max_queue_sz, s->queue_sz_counts ?
2702                              (s->accu_queue_sz / s->queue_sz_counts) : 0);
2703
2704         tipc_node_unlock(node);
2705         read_unlock_bh(&tipc_net_lock);
2706         return ret;
2707 }
2708
2709 struct sk_buff *tipc_link_cmd_show_stats(const void *req_tlv_area, int req_tlv_space)
2710 {
2711         struct sk_buff *buf;
2712         struct tlv_desc *rep_tlv;
2713         int str_len;
2714         int pb_len;
2715         char *pb;
2716
2717         if (!TLV_CHECK(req_tlv_area, req_tlv_space, TIPC_TLV_LINK_NAME))
2718                 return tipc_cfg_reply_error_string(TIPC_CFG_TLV_ERROR);
2719
2720         buf = tipc_cfg_reply_alloc(TLV_SPACE(ULTRA_STRING_MAX_LEN));
2721         if (!buf)
2722                 return NULL;
2723
2724         rep_tlv = (struct tlv_desc *)buf->data;
2725         pb = TLV_DATA(rep_tlv);
2726         pb_len = ULTRA_STRING_MAX_LEN;
2727         str_len = tipc_link_stats((char *)TLV_DATA(req_tlv_area),
2728                                   pb, pb_len);
2729         if (!str_len) {
2730                 kfree_skb(buf);
2731                 return tipc_cfg_reply_error_string("link not found");
2732         }
2733         str_len += 1;   /* for "\0" */
2734         skb_put(buf, TLV_SPACE(str_len));
2735         TLV_SET(rep_tlv, TIPC_TLV_ULTRA_STRING, NULL, str_len);
2736
2737         return buf;
2738 }
2739
2740 /**
2741  * tipc_link_get_max_pkt - get maximum packet size to use when sending to destination
2742  * @dest: network address of destination node
2743  * @selector: used to select from set of active links
2744  *
2745  * If no active link can be found, uses default maximum packet size.
2746  */
2747 u32 tipc_link_get_max_pkt(u32 dest, u32 selector)
2748 {
2749         struct tipc_node *n_ptr;
2750         struct tipc_link *l_ptr;
2751         u32 res = MAX_PKT_DEFAULT;
2752
2753         if (dest == tipc_own_addr)
2754                 return MAX_MSG_SIZE;
2755
2756         read_lock_bh(&tipc_net_lock);
2757         n_ptr = tipc_node_find(dest);
2758         if (n_ptr) {
2759                 tipc_node_lock(n_ptr);
2760                 l_ptr = n_ptr->active_links[selector & 1];
2761                 if (l_ptr)
2762                         res = l_ptr->max_pkt;
2763                 tipc_node_unlock(n_ptr);
2764         }
2765         read_unlock_bh(&tipc_net_lock);
2766         return res;
2767 }
2768
2769 static void link_print(struct tipc_link *l_ptr, const char *str)
2770 {
2771         pr_info("%s Link %x<%s>:", str, l_ptr->addr, l_ptr->b_ptr->name);
2772
2773         if (link_working_unknown(l_ptr))
2774                 pr_cont(":WU\n");
2775         else if (link_reset_reset(l_ptr))
2776                 pr_cont(":RR\n");
2777         else if (link_reset_unknown(l_ptr))
2778                 pr_cont(":RU\n");
2779         else if (link_working_working(l_ptr))
2780                 pr_cont(":WW\n");
2781         else
2782                 pr_cont("\n");
2783 }