Pileus Git - ~andy/linux/blob - net/tipc/link.c

   1 /*
   2  * net/tipc/link.c: TIPC link code
   3  *
   4  * Copyright (c) 1996-2007, 2012-2014, Ericsson AB
   5  * Copyright (c) 2004-2007, 2010-2013, Wind River Systems
   6  * All rights reserved.
   7  *
   8  * Redistribution and use in source and binary forms, with or without
   9  * modification, are permitted provided that the following conditions are met:
  10  *
  11  * 1. Redistributions of source code must retain the above copyright
  12  *    notice, this list of conditions and the following disclaimer.
  13  * 2. Redistributions in binary form must reproduce the above copyright
  14  *    notice, this list of conditions and the following disclaimer in the
  15  *    documentation and/or other materials provided with the distribution.
  16  * 3. Neither the names of the copyright holders nor the names of its
  17  *    contributors may be used to endorse or promote products derived from
  18  *    this software without specific prior written permission.
  19  *
  20  * Alternatively, this software may be distributed under the terms of the
  21  * GNU General Public License ("GPL") version 2 as published by the Free
  22  * Software Foundation.
  23  *
  24  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
  25  * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  26  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  27  * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
  28  * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
  29  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
  30  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
  31  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
  32  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  33  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  34  * POSSIBILITY OF SUCH DAMAGE.
  35  */
  36
  37 #include "core.h"
  38 #include "link.h"
  39 #include "port.h"
  40 #include "name_distr.h"
  41 #include "discover.h"
  42 #include "config.h"
  43
  44 #include <linux/pkt_sched.h>
  45
  46 /*
  47  * Error message prefixes
  48  */
  49 static const char *link_co_err = "Link changeover error, ";
  50 static const char *link_rst_msg = "Resetting link ";
  51 static const char *link_unk_evt = "Unknown link event ";
  52
  53 /*
  54  * Out-of-range value for link session numbers
  55  */
  56 #define INVALID_SESSION 0x10000
  57
  58 /*
  59  * Link state events:
  60  */
  61 #define  STARTING_EVT    856384768      /* link processing trigger */
  62 #define  TRAFFIC_MSG_EVT 560815u        /* rx'd ??? */
  63 #define  TIMEOUT_EVT     560817u        /* link timer expired */
  64
  65 /*
  66  * The following two 'message types' is really just implementation
  67  * data conveniently stored in the message header.
  68  * They must not be considered part of the protocol
  69  */
  70 #define OPEN_MSG   0
  71 #define CLOSED_MSG 1
  72
  73 /*
  74  * State value stored in 'exp_msg_count'
  75  */
  76 #define START_CHANGEOVER 100000u
  77
  78 static void link_handle_out_of_seq_msg(struct tipc_link *l_ptr,
  79                                        struct sk_buff *buf);
  80 static void link_recv_proto_msg(struct tipc_link *l_ptr, struct sk_buff *buf);
  81 static int  tipc_link_tunnel_rcv(struct tipc_link **l_ptr,
  82                                  struct sk_buff **buf);
  83 static void link_set_supervision_props(struct tipc_link *l_ptr, u32 tolerance);
  84 static int  link_send_sections_long(struct tipc_port *sender,
  85                                     struct iovec const *msg_sect,
  86                                     unsigned int len, u32 destnode);
  87 static void link_state_event(struct tipc_link *l_ptr, u32 event);
  88 static void link_reset_statistics(struct tipc_link *l_ptr);
  89 static void link_print(struct tipc_link *l_ptr, const char *str);
  90 static int link_send_long_buf(struct tipc_link *l_ptr, struct sk_buff *buf);
  91 static void tipc_link_send_sync(struct tipc_link *l);
  92 static void tipc_link_recv_sync(struct tipc_node *n, struct sk_buff *buf);
  93
  94 /*
  95  *  Simple link routines
  96  */
  97 static unsigned int align(unsigned int i)
  98 {
  99         return (i + 3) & ~3u;
 100 }
 101
 102 static void link_init_max_pkt(struct tipc_link *l_ptr)
 103 {
 104         u32 max_pkt;
 105
 106         max_pkt = (l_ptr->b_ptr->mtu & ~3);
 107         if (max_pkt > MAX_MSG_SIZE)
 108                 max_pkt = MAX_MSG_SIZE;
 109
 110         l_ptr->max_pkt_target = max_pkt;
 111         if (l_ptr->max_pkt_target < MAX_PKT_DEFAULT)
 112                 l_ptr->max_pkt = l_ptr->max_pkt_target;
 113         else
 114                 l_ptr->max_pkt = MAX_PKT_DEFAULT;
 115
 116         l_ptr->max_pkt_probes = 0;
 117 }
 118
 119 static u32 link_next_sent(struct tipc_link *l_ptr)
 120 {
 121         if (l_ptr->next_out)
 122                 return buf_seqno(l_ptr->next_out);
 123         return mod(l_ptr->next_out_no);
 124 }
 125
 126 static u32 link_last_sent(struct tipc_link *l_ptr)
 127 {
 128         return mod(link_next_sent(l_ptr) - 1);
 129 }
 130
 131 /*
 132  *  Simple non-static link routines (i.e. referenced outside this file)
 133  */
 134 int tipc_link_is_up(struct tipc_link *l_ptr)
 135 {
 136         if (!l_ptr)
 137                 return 0;
 138         return link_working_working(l_ptr) || link_working_unknown(l_ptr);
 139 }
 140
 141 int tipc_link_is_active(struct tipc_link *l_ptr)
 142 {
 143         return  (l_ptr->owner->active_links[0] == l_ptr) ||
 144                 (l_ptr->owner->active_links[1] == l_ptr);
 145 }
 146
 147 /**
 148  * link_timeout - handle expiration of link timer
 149  * @l_ptr: pointer to link
 150  *
 151  * This routine must not grab "tipc_net_lock" to avoid a potential deadlock conflict
 152  * with tipc_link_delete().  (There is no risk that the node will be deleted by
 153  * another thread because tipc_link_delete() always cancels the link timer before
 154  * tipc_node_delete() is called.)
 155  */
 156 static void link_timeout(struct tipc_link *l_ptr)
 157 {
 158         tipc_node_lock(l_ptr->owner);
 159
 160         /* update counters used in statistical profiling of send traffic */
 161         l_ptr->stats.accu_queue_sz += l_ptr->out_queue_size;
 162         l_ptr->stats.queue_sz_counts++;
 163
 164         if (l_ptr->first_out) {
 165                 struct tipc_msg *msg = buf_msg(l_ptr->first_out);
 166                 u32 length = msg_size(msg);
 167
 168                 if ((msg_user(msg) == MSG_FRAGMENTER) &&
 169                     (msg_type(msg) == FIRST_FRAGMENT)) {
 170                         length = msg_size(msg_get_wrapped(msg));
 171                 }
 172                 if (length) {
 173                         l_ptr->stats.msg_lengths_total += length;
 174                         l_ptr->stats.msg_length_counts++;
 175                         if (length <= 64)
 176                                 l_ptr->stats.msg_length_profile[0]++;
 177                         else if (length <= 256)
 178                                 l_ptr->stats.msg_length_profile[1]++;
 179                         else if (length <= 1024)
 180                                 l_ptr->stats.msg_length_profile[2]++;
 181                         else if (length <= 4096)
 182                                 l_ptr->stats.msg_length_profile[3]++;
 183                         else if (length <= 16384)
 184                                 l_ptr->stats.msg_length_profile[4]++;
 185                         else if (length <= 32768)
 186                                 l_ptr->stats.msg_length_profile[5]++;
 187                         else
 188                                 l_ptr->stats.msg_length_profile[6]++;
 189                 }
 190         }
 191
 192         /* do all other link processing performed on a periodic basis */
 193
 194         link_state_event(l_ptr, TIMEOUT_EVT);
 195
 196         if (l_ptr->next_out)
 197                 tipc_link_push_queue(l_ptr);
 198
 199         tipc_node_unlock(l_ptr->owner);
 200 }
 201
 202 static void link_set_timer(struct tipc_link *l_ptr, u32 time)
 203 {
 204         k_start_timer(&l_ptr->timer, time);
 205 }
 206
 207 /**
 208  * tipc_link_create - create a new link
 209  * @n_ptr: pointer to associated node
 210  * @b_ptr: pointer to associated bearer
 211  * @media_addr: media address to use when sending messages over link
 212  *
 213  * Returns pointer to link.
 214  */
 215 struct tipc_link *tipc_link_create(struct tipc_node *n_ptr,
 216                               struct tipc_bearer *b_ptr,
 217                               const struct tipc_media_addr *media_addr)
 218 {
 219         struct tipc_link *l_ptr;
 220         struct tipc_msg *msg;
 221         char *if_name;
 222         char addr_string[16];
 223         u32 peer = n_ptr->addr;
 224
 225         if (n_ptr->link_cnt >= 2) {
 226                 tipc_addr_string_fill(addr_string, n_ptr->addr);
 227                 pr_err("Attempt to establish third link to %s\n", addr_string);
 228                 return NULL;
 229         }
 230
 231         if (n_ptr->links[b_ptr->identity]) {
 232                 tipc_addr_string_fill(addr_string, n_ptr->addr);
 233                 pr_err("Attempt to establish second link on <%s> to %s\n",
 234                        b_ptr->name, addr_string);
 235                 return NULL;
 236         }
 237
 238         l_ptr = kzalloc(sizeof(*l_ptr), GFP_ATOMIC);
 239         if (!l_ptr) {
 240                 pr_warn("Link creation failed, no memory\n");
 241                 return NULL;
 242         }
 243
 244         l_ptr->addr = peer;
 245         if_name = strchr(b_ptr->name, ':') + 1;
 246         sprintf(l_ptr->name, "%u.%u.%u:%s-%u.%u.%u:unknown",
 247                 tipc_zone(tipc_own_addr), tipc_cluster(tipc_own_addr),
 248                 tipc_node(tipc_own_addr),
 249                 if_name,
 250                 tipc_zone(peer), tipc_cluster(peer), tipc_node(peer));
 251                 /* note: peer i/f name is updated by reset/activate message */
 252         memcpy(&l_ptr->media_addr, media_addr, sizeof(*media_addr));
 253         l_ptr->owner = n_ptr;
 254         l_ptr->checkpoint = 1;
 255         l_ptr->peer_session = INVALID_SESSION;
 256         l_ptr->b_ptr = b_ptr;
 257         link_set_supervision_props(l_ptr, b_ptr->tolerance);
 258         l_ptr->state = RESET_UNKNOWN;
 259
 260         l_ptr->pmsg = (struct tipc_msg *)&l_ptr->proto_msg;
 261         msg = l_ptr->pmsg;
 262         tipc_msg_init(msg, LINK_PROTOCOL, RESET_MSG, INT_H_SIZE, l_ptr->addr);
 263         msg_set_size(msg, sizeof(l_ptr->proto_msg));
 264         msg_set_session(msg, (tipc_random & 0xffff));
 265         msg_set_bearer_id(msg, b_ptr->identity);
 266         strcpy((char *)msg_data(msg), if_name);
 267
 268         l_ptr->priority = b_ptr->priority;
 269         tipc_link_set_queue_limits(l_ptr, b_ptr->window);
 270
 271         link_init_max_pkt(l_ptr);
 272
 273         l_ptr->next_out_no = 1;
 274         INIT_LIST_HEAD(&l_ptr->waiting_ports);
 275
 276         link_reset_statistics(l_ptr);
 277
 278         tipc_node_attach_link(n_ptr, l_ptr);
 279
 280         k_init_timer(&l_ptr->timer, (Handler)link_timeout,
 281                      (unsigned long)l_ptr);
 282         list_add_tail(&l_ptr->link_list, &b_ptr->links);
 283
 284         link_state_event(l_ptr, STARTING_EVT);
 285
 286         return l_ptr;
 287 }
 288
 289 /**
 290  * tipc_link_delete - delete a link
 291  * @l_ptr: pointer to link
 292  *
 293  * Note: 'tipc_net_lock' is write_locked, bearer is locked.
 294  * This routine must not grab the node lock until after link timer cancellation
 295  * to avoid a potential deadlock situation.
 296  */
 297 void tipc_link_delete(struct tipc_link *l_ptr)
 298 {
 299         if (!l_ptr) {
 300                 pr_err("Attempt to delete non-existent link\n");
 301                 return;
 302         }
 303
 304         k_cancel_timer(&l_ptr->timer);
 305
 306         tipc_node_lock(l_ptr->owner);
 307         tipc_link_reset(l_ptr);
 308         tipc_node_detach_link(l_ptr->owner, l_ptr);
 309         tipc_link_purge_queues(l_ptr);
 310         list_del_init(&l_ptr->link_list);
 311         tipc_node_unlock(l_ptr->owner);
 312         k_term_timer(&l_ptr->timer);
 313         kfree(l_ptr);
 314 }
 315
 316
 317 /**
 318  * link_schedule_port - schedule port for deferred sending
 319  * @l_ptr: pointer to link
 320  * @origport: reference to sending port
 321  * @sz: amount of data to be sent
 322  *
 323  * Schedules port for renewed sending of messages after link congestion
 324  * has abated.
 325  */
 326 static int link_schedule_port(struct tipc_link *l_ptr, u32 origport, u32 sz)
 327 {
 328         struct tipc_port *p_ptr;
 329
 330         spin_lock_bh(&tipc_port_list_lock);
 331         p_ptr = tipc_port_lock(origport);
 332         if (p_ptr) {
 333                 if (!p_ptr->wakeup)
 334                         goto exit;
 335                 if (!list_empty(&p_ptr->wait_list))
 336                         goto exit;
 337                 p_ptr->congested = 1;
 338                 p_ptr->waiting_pkts = 1 + ((sz - 1) / l_ptr->max_pkt);
 339                 list_add_tail(&p_ptr->wait_list, &l_ptr->waiting_ports);
 340                 l_ptr->stats.link_congs++;
 341 exit:
 342                 tipc_port_unlock(p_ptr);
 343         }
 344         spin_unlock_bh(&tipc_port_list_lock);
 345         return -ELINKCONG;
 346 }
 347
 348 void tipc_link_wakeup_ports(struct tipc_link *l_ptr, int all)
 349 {
 350         struct tipc_port *p_ptr;
 351         struct tipc_port *temp_p_ptr;
 352         int win = l_ptr->queue_limit[0] - l_ptr->out_queue_size;
 353
 354         if (all)
 355                 win = 100000;
 356         if (win <= 0)
 357                 return;
 358         if (!spin_trylock_bh(&tipc_port_list_lock))
 359                 return;
 360         if (link_congested(l_ptr))
 361                 goto exit;
 362         list_for_each_entry_safe(p_ptr, temp_p_ptr, &l_ptr->waiting_ports,
 363                                  wait_list) {
 364                 if (win <= 0)
 365                         break;
 366                 list_del_init(&p_ptr->wait_list);
 367                 spin_lock_bh(p_ptr->lock);
 368                 p_ptr->congested = 0;
 369                 p_ptr->wakeup(p_ptr);
 370                 win -= p_ptr->waiting_pkts;
 371                 spin_unlock_bh(p_ptr->lock);
 372         }
 373
 374 exit:
 375         spin_unlock_bh(&tipc_port_list_lock);
 376 }
 377
 378 /**
 379  * link_release_outqueue - purge link's outbound message queue
 380  * @l_ptr: pointer to link
 381  */
 382 static void link_release_outqueue(struct tipc_link *l_ptr)
 383 {
 384         kfree_skb_list(l_ptr->first_out);
 385         l_ptr->first_out = NULL;
 386         l_ptr->out_queue_size = 0;
 387 }
 388
 389 /**
 390  * tipc_link_reset_fragments - purge link's inbound message fragments queue
 391  * @l_ptr: pointer to link
 392  */
 393 void tipc_link_reset_fragments(struct tipc_link *l_ptr)
 394 {
 395         kfree_skb(l_ptr->reasm_head);
 396         l_ptr->reasm_head = NULL;
 397         l_ptr->reasm_tail = NULL;
 398 }
 399
 400 /**
 401  * tipc_link_purge_queues - purge all pkt queues associated with link
 402  * @l_ptr: pointer to link
 403  */
 404 void tipc_link_purge_queues(struct tipc_link *l_ptr)
 405 {
 406         kfree_skb_list(l_ptr->oldest_deferred_in);
 407         kfree_skb_list(l_ptr->first_out);
 408         tipc_link_reset_fragments(l_ptr);
 409         kfree_skb(l_ptr->proto_msg_queue);
 410         l_ptr->proto_msg_queue = NULL;
 411 }
 412
 413 void tipc_link_reset(struct tipc_link *l_ptr)
 414 {
 415         u32 prev_state = l_ptr->state;
 416         u32 checkpoint = l_ptr->next_in_no;
 417         int was_active_link = tipc_link_is_active(l_ptr);
 418
 419         msg_set_session(l_ptr->pmsg, ((msg_session(l_ptr->pmsg) + 1) & 0xffff));
 420
 421         /* Link is down, accept any session */
 422         l_ptr->peer_session = INVALID_SESSION;
 423
 424         /* Prepare for max packet size negotiation */
 425         link_init_max_pkt(l_ptr);
 426
 427         l_ptr->state = RESET_UNKNOWN;
 428
 429         if ((prev_state == RESET_UNKNOWN) || (prev_state == RESET_RESET))
 430                 return;
 431
 432         tipc_node_link_down(l_ptr->owner, l_ptr);
 433         tipc_bearer_remove_dest(l_ptr->b_ptr, l_ptr->addr);
 434
 435         if (was_active_link && tipc_node_active_links(l_ptr->owner)) {
 436                 l_ptr->reset_checkpoint = checkpoint;
 437                 l_ptr->exp_msg_count = START_CHANGEOVER;
 438         }
 439
 440         /* Clean up all queues: */
 441         link_release_outqueue(l_ptr);
 442         kfree_skb(l_ptr->proto_msg_queue);
 443         l_ptr->proto_msg_queue = NULL;
 444         kfree_skb_list(l_ptr->oldest_deferred_in);
 445         if (!list_empty(&l_ptr->waiting_ports))
 446                 tipc_link_wakeup_ports(l_ptr, 1);
 447
 448         l_ptr->retransm_queue_head = 0;
 449         l_ptr->retransm_queue_size = 0;
 450         l_ptr->last_out = NULL;
 451         l_ptr->first_out = NULL;
 452         l_ptr->next_out = NULL;
 453         l_ptr->unacked_window = 0;
 454         l_ptr->checkpoint = 1;
 455         l_ptr->next_out_no = 1;
 456         l_ptr->deferred_inqueue_sz = 0;
 457         l_ptr->oldest_deferred_in = NULL;
 458         l_ptr->newest_deferred_in = NULL;
 459         l_ptr->fsm_msg_cnt = 0;
 460         l_ptr->stale_count = 0;
 461         link_reset_statistics(l_ptr);
 462 }
 463
 464
 465 static void link_activate(struct tipc_link *l_ptr)
 466 {
 467         l_ptr->next_in_no = l_ptr->stats.recv_info = 1;
 468         tipc_node_link_up(l_ptr->owner, l_ptr);
 469         tipc_bearer_add_dest(l_ptr->b_ptr, l_ptr->addr);
 470 }
 471
 472 /**
 473  * link_state_event - link finite state machine
 474  * @l_ptr: pointer to link
 475  * @event: state machine event to process
 476  */
 477 static void link_state_event(struct tipc_link *l_ptr, unsigned int event)
 478 {
 479         struct tipc_link *other;
 480         u32 cont_intv = l_ptr->continuity_interval;
 481
 482         if (!l_ptr->started && (event != STARTING_EVT))
 483                 return;         /* Not yet. */
 484
 485         /* Check whether changeover is going on */
 486         if (l_ptr->exp_msg_count) {
 487                 if (event == TIMEOUT_EVT)
 488                         link_set_timer(l_ptr, cont_intv);
 489                 return;
 490         }
 491
 492         switch (l_ptr->state) {
 493         case WORKING_WORKING:
 494                 switch (event) {
 495                 case TRAFFIC_MSG_EVT:
 496                 case ACTIVATE_MSG:
 497                         break;
 498                 case TIMEOUT_EVT:
 499                         if (l_ptr->next_in_no != l_ptr->checkpoint) {
 500                                 l_ptr->checkpoint = l_ptr->next_in_no;
 501                                 if (tipc_bclink_acks_missing(l_ptr->owner)) {
 502                                         tipc_link_send_proto_msg(l_ptr, STATE_MSG,
 503                                                                  0, 0, 0, 0, 0);
 504                                         l_ptr->fsm_msg_cnt++;
 505                                 } else if (l_ptr->max_pkt < l_ptr->max_pkt_target) {
 506                                         tipc_link_send_proto_msg(l_ptr, STATE_MSG,
 507                                                                  1, 0, 0, 0, 0);
 508                                         l_ptr->fsm_msg_cnt++;
 509                                 }
 510                                 link_set_timer(l_ptr, cont_intv);
 511                                 break;
 512                         }
 513                         l_ptr->state = WORKING_UNKNOWN;
 514                         l_ptr->fsm_msg_cnt = 0;
 515                         tipc_link_send_proto_msg(l_ptr, STATE_MSG, 1, 0, 0, 0, 0);
 516                         l_ptr->fsm_msg_cnt++;
 517                         link_set_timer(l_ptr, cont_intv / 4);
 518                         break;
 519                 case RESET_MSG:
 520                         pr_info("%s<%s>, requested by peer\n", link_rst_msg,
 521                                 l_ptr->name);
 522                         tipc_link_reset(l_ptr);
 523                         l_ptr->state = RESET_RESET;
 524                         l_ptr->fsm_msg_cnt = 0;
 525                         tipc_link_send_proto_msg(l_ptr, ACTIVATE_MSG, 0, 0, 0, 0, 0);
 526                         l_ptr->fsm_msg_cnt++;
 527                         link_set_timer(l_ptr, cont_intv);
 528                         break;
 529                 default:
 530                         pr_err("%s%u in WW state\n", link_unk_evt, event);
 531                 }
 532                 break;
 533         case WORKING_UNKNOWN:
 534                 switch (event) {
 535                 case TRAFFIC_MSG_EVT:
 536                 case ACTIVATE_MSG:
 537                         l_ptr->state = WORKING_WORKING;
 538                         l_ptr->fsm_msg_cnt = 0;
 539                         link_set_timer(l_ptr, cont_intv);
 540                         break;
 541                 case RESET_MSG:
 542                         pr_info("%s<%s>, requested by peer while probing\n",
 543                                 link_rst_msg, l_ptr->name);
 544                         tipc_link_reset(l_ptr);
 545                         l_ptr->state = RESET_RESET;
 546                         l_ptr->fsm_msg_cnt = 0;
 547                         tipc_link_send_proto_msg(l_ptr, ACTIVATE_MSG, 0, 0, 0, 0, 0);
 548                         l_ptr->fsm_msg_cnt++;
 549                         link_set_timer(l_ptr, cont_intv);
 550                         break;
 551                 case TIMEOUT_EVT:
 552                         if (l_ptr->next_in_no != l_ptr->checkpoint) {
 553                                 l_ptr->state = WORKING_WORKING;
 554                                 l_ptr->fsm_msg_cnt = 0;
 555                                 l_ptr->checkpoint = l_ptr->next_in_no;
 556                                 if (tipc_bclink_acks_missing(l_ptr->owner)) {
 557                                         tipc_link_send_proto_msg(l_ptr, STATE_MSG,
 558                                                                  0, 0, 0, 0, 0);
 559                                         l_ptr->fsm_msg_cnt++;
 560                                 }
 561                                 link_set_timer(l_ptr, cont_intv);
 562                         } else if (l_ptr->fsm_msg_cnt < l_ptr->abort_limit) {
 563                                 tipc_link_send_proto_msg(l_ptr, STATE_MSG,
 564                                                          1, 0, 0, 0, 0);
 565                                 l_ptr->fsm_msg_cnt++;
 566                                 link_set_timer(l_ptr, cont_intv / 4);
 567                         } else {        /* Link has failed */
 568                                 pr_warn("%s<%s>, peer not responding\n",
 569                                         link_rst_msg, l_ptr->name);
 570                                 tipc_link_reset(l_ptr);
 571                                 l_ptr->state = RESET_UNKNOWN;
 572                                 l_ptr->fsm_msg_cnt = 0;
 573                                 tipc_link_send_proto_msg(l_ptr, RESET_MSG,
 574                                                          0, 0, 0, 0, 0);
 575                                 l_ptr->fsm_msg_cnt++;
 576                                 link_set_timer(l_ptr, cont_intv);
 577                         }
 578                         break;
 579                 default:
 580                         pr_err("%s%u in WU state\n", link_unk_evt, event);
 581                 }
 582                 break;
 583         case RESET_UNKNOWN:
 584                 switch (event) {
 585                 case TRAFFIC_MSG_EVT:
 586                         break;
 587                 case ACTIVATE_MSG:
 588                         other = l_ptr->owner->active_links[0];
 589                         if (other && link_working_unknown(other))
 590                                 break;
 591                         l_ptr->state = WORKING_WORKING;
 592                         l_ptr->fsm_msg_cnt = 0;
 593                         link_activate(l_ptr);
 594                         tipc_link_send_proto_msg(l_ptr, STATE_MSG, 1, 0, 0, 0, 0);
 595                         l_ptr->fsm_msg_cnt++;
 596                         if (l_ptr->owner->working_links == 1)
 597                                 tipc_link_send_sync(l_ptr);
 598                         link_set_timer(l_ptr, cont_intv);
 599                         break;
 600                 case RESET_MSG:
 601                         l_ptr->state = RESET_RESET;
 602                         l_ptr->fsm_msg_cnt = 0;
 603                         tipc_link_send_proto_msg(l_ptr, ACTIVATE_MSG, 1, 0, 0, 0, 0);
 604                         l_ptr->fsm_msg_cnt++;
 605                         link_set_timer(l_ptr, cont_intv);
 606                         break;
 607                 case STARTING_EVT:
 608                         l_ptr->started = 1;
 609                         /* fall through */
 610                 case TIMEOUT_EVT:
 611                         tipc_link_send_proto_msg(l_ptr, RESET_MSG, 0, 0, 0, 0, 0);
 612                         l_ptr->fsm_msg_cnt++;
 613                         link_set_timer(l_ptr, cont_intv);
 614                         break;
 615                 default:
 616                         pr_err("%s%u in RU state\n", link_unk_evt, event);
 617                 }
 618                 break;
 619         case RESET_RESET:
 620                 switch (event) {
 621                 case TRAFFIC_MSG_EVT:
 622                 case ACTIVATE_MSG:
 623                         other = l_ptr->owner->active_links[0];
 624                         if (other && link_working_unknown(other))
 625                                 break;
 626                         l_ptr->state = WORKING_WORKING;
 627                         l_ptr->fsm_msg_cnt = 0;
 628                         link_activate(l_ptr);
 629                         tipc_link_send_proto_msg(l_ptr, STATE_MSG, 1, 0, 0, 0, 0);
 630                         l_ptr->fsm_msg_cnt++;
 631                         if (l_ptr->owner->working_links == 1)
 632                                 tipc_link_send_sync(l_ptr);
 633                         link_set_timer(l_ptr, cont_intv);
 634                         break;
 635                 case RESET_MSG:
 636                         break;
 637                 case TIMEOUT_EVT:
 638                         tipc_link_send_proto_msg(l_ptr, ACTIVATE_MSG, 0, 0, 0, 0, 0);
 639                         l_ptr->fsm_msg_cnt++;
 640                         link_set_timer(l_ptr, cont_intv);
 641                         break;
 642                 default:
 643                         pr_err("%s%u in RR state\n", link_unk_evt, event);
 644                 }
 645                 break;
 646         default:
 647                 pr_err("Unknown link state %u/%u\n", l_ptr->state, event);
 648         }
 649 }
 650
 651 /*
 652  * link_bundle_buf(): Append contents of a buffer to
 653  * the tail of an existing one.
 654  */
 655 static int link_bundle_buf(struct tipc_link *l_ptr, struct sk_buff *bundler,
 656                            struct sk_buff *buf)
 657 {
 658         struct tipc_msg *bundler_msg = buf_msg(bundler);
 659         struct tipc_msg *msg = buf_msg(buf);
 660         u32 size = msg_size(msg);
 661         u32 bundle_size = msg_size(bundler_msg);
 662         u32 to_pos = align(bundle_size);
 663         u32 pad = to_pos - bundle_size;
 664
 665         if (msg_user(bundler_msg) != MSG_BUNDLER)
 666                 return 0;
 667         if (msg_type(bundler_msg) != OPEN_MSG)
 668                 return 0;
 669         if (skb_tailroom(bundler) < (pad + size))
 670                 return 0;
 671         if (l_ptr->max_pkt < (to_pos + size))
 672                 return 0;
 673
 674         skb_put(bundler, pad + size);
 675         skb_copy_to_linear_data_offset(bundler, to_pos, buf->data, size);
 676         msg_set_size(bundler_msg, to_pos + size);
 677         msg_set_msgcnt(bundler_msg, msg_msgcnt(bundler_msg) + 1);
 678         kfree_skb(buf);
 679         l_ptr->stats.sent_bundled++;
 680         return 1;
 681 }
 682
 683 static void link_add_to_outqueue(struct tipc_link *l_ptr,
 684                                  struct sk_buff *buf,
 685                                  struct tipc_msg *msg)
 686 {
 687         u32 ack = mod(l_ptr->next_in_no - 1);
 688         u32 seqno = mod(l_ptr->next_out_no++);
 689
 690         msg_set_word(msg, 2, ((ack << 16) | seqno));
 691         msg_set_bcast_ack(msg, l_ptr->owner->bclink.last_in);
 692         buf->next = NULL;
 693         if (l_ptr->first_out) {
 694                 l_ptr->last_out->next = buf;
 695                 l_ptr->last_out = buf;
 696         } else
 697                 l_ptr->first_out = l_ptr->last_out = buf;
 698
 699         l_ptr->out_queue_size++;
 700         if (l_ptr->out_queue_size > l_ptr->stats.max_queue_sz)
 701                 l_ptr->stats.max_queue_sz = l_ptr->out_queue_size;
 702 }
 703
 704 static void link_add_chain_to_outqueue(struct tipc_link *l_ptr,
 705                                        struct sk_buff *buf_chain,
 706                                        u32 long_msgno)
 707 {
 708         struct sk_buff *buf;
 709         struct tipc_msg *msg;
 710
 711         if (!l_ptr->next_out)
 712                 l_ptr->next_out = buf_chain;
 713         while (buf_chain) {
 714                 buf = buf_chain;
 715                 buf_chain = buf_chain->next;
 716
 717                 msg = buf_msg(buf);
 718                 msg_set_long_msgno(msg, long_msgno);
 719                 link_add_to_outqueue(l_ptr, buf, msg);
 720         }
 721 }
 722
 723 /*
 724  * tipc_link_send_buf() is the 'full path' for messages, called from
 725  * inside TIPC when the 'fast path' in tipc_send_buf
 726  * has failed, and from link_send()
 727  */
 728 int tipc_link_send_buf(struct tipc_link *l_ptr, struct sk_buff *buf)
 729 {
 730         struct tipc_msg *msg = buf_msg(buf);
 731         u32 size = msg_size(msg);
 732         u32 dsz = msg_data_sz(msg);
 733         u32 queue_size = l_ptr->out_queue_size;
 734         u32 imp = tipc_msg_tot_importance(msg);
 735         u32 queue_limit = l_ptr->queue_limit[imp];
 736         u32 max_packet = l_ptr->max_pkt;
 737
 738         /* Match msg importance against queue limits: */
 739         if (unlikely(queue_size >= queue_limit)) {
 740                 if (imp <= TIPC_CRITICAL_IMPORTANCE) {
 741                         link_schedule_port(l_ptr, msg_origport(msg), size);
 742                         kfree_skb(buf);
 743                         return -ELINKCONG;
 744                 }
 745                 kfree_skb(buf);
 746                 if (imp > CONN_MANAGER) {
 747                         pr_warn("%s<%s>, send queue full", link_rst_msg,
 748                                 l_ptr->name);
 749                         tipc_link_reset(l_ptr);
 750                 }
 751                 return dsz;
 752         }
 753
 754         /* Fragmentation needed ? */
 755         if (size > max_packet)
 756                 return link_send_long_buf(l_ptr, buf);
 757
 758         /* Packet can be queued or sent. */
 759         if (likely(!link_congested(l_ptr))) {
 760                 link_add_to_outqueue(l_ptr, buf, msg);
 761
 762                 tipc_bearer_send(l_ptr->b_ptr, buf, &l_ptr->media_addr);
 763                 l_ptr->unacked_window = 0;
 764                 return dsz;
 765         }
 766         /* Congestion: can message be bundled ? */
 767         if ((msg_user(msg) != CHANGEOVER_PROTOCOL) &&
 768             (msg_user(msg) != MSG_FRAGMENTER)) {
 769
 770                 /* Try adding message to an existing bundle */
 771                 if (l_ptr->next_out &&
 772                     link_bundle_buf(l_ptr, l_ptr->last_out, buf))
 773                         return dsz;
 774
 775                 /* Try creating a new bundle */
 776                 if (size <= max_packet * 2 / 3) {
 777                         struct sk_buff *bundler = tipc_buf_acquire(max_packet);
 778                         struct tipc_msg bundler_hdr;
 779
 780                         if (bundler) {
 781                                 tipc_msg_init(&bundler_hdr, MSG_BUNDLER, OPEN_MSG,
 782                                          INT_H_SIZE, l_ptr->addr);
 783                                 skb_copy_to_linear_data(bundler, &bundler_hdr,
 784                                                         INT_H_SIZE);
 785                                 skb_trim(bundler, INT_H_SIZE);
 786                                 link_bundle_buf(l_ptr, bundler, buf);
 787                                 buf = bundler;
 788                                 msg = buf_msg(buf);
 789                                 l_ptr->stats.sent_bundles++;
 790                         }
 791                 }
 792         }
 793         if (!l_ptr->next_out)
 794                 l_ptr->next_out = buf;
 795         link_add_to_outqueue(l_ptr, buf, msg);
 796         return dsz;
 797 }
 798
 799 /*
 800  * tipc_link_send(): same as tipc_link_send_buf(), but the link to use has
 801  * not been selected yet, and the the owner node is not locked
 802  * Called by TIPC internal users, e.g. the name distributor
 803  */
 804 int tipc_link_send(struct sk_buff *buf, u32 dest, u32 selector)
 805 {
 806         struct tipc_link *l_ptr;
 807         struct tipc_node *n_ptr;
 808         int res = -ELINKCONG;
 809
 810         read_lock_bh(&tipc_net_lock);
 811         n_ptr = tipc_node_find(dest);
 812         if (n_ptr) {
 813                 tipc_node_lock(n_ptr);
 814                 l_ptr = n_ptr->active_links[selector & 1];
 815                 if (l_ptr)
 816                         res = tipc_link_send_buf(l_ptr, buf);
 817                 else
 818                         kfree_skb(buf);
 819                 tipc_node_unlock(n_ptr);
 820         } else {
 821                 kfree_skb(buf);
 822         }
 823         read_unlock_bh(&tipc_net_lock);
 824         return res;
 825 }
 826
 827 /*
 828  * tipc_link_send_sync - synchronize broadcast link endpoints.
 829  *
 830  * Give a newly added peer node the sequence number where it should
 831  * start receiving and acking broadcast packets.
 832  *
 833  * Called with node locked
 834  */
 835 static void tipc_link_send_sync(struct tipc_link *l)
 836 {
 837         struct sk_buff *buf;
 838         struct tipc_msg *msg;
 839
 840         buf = tipc_buf_acquire(INT_H_SIZE);
 841         if (!buf)
 842                 return;
 843
 844         msg = buf_msg(buf);
 845         tipc_msg_init(msg, BCAST_PROTOCOL, STATE_MSG, INT_H_SIZE, l->addr);
 846         msg_set_last_bcast(msg, l->owner->bclink.acked);
 847         link_add_chain_to_outqueue(l, buf, 0);
 848         tipc_link_push_queue(l);
 849 }
 850
 851 /*
 852  * tipc_link_recv_sync - synchronize broadcast link endpoints.
 853  * Receive the sequence number where we should start receiving and
 854  * acking broadcast packets from a newly added peer node, and open
 855  * up for reception of such packets.
 856  *
 857  * Called with node locked
 858  */
 859 static void tipc_link_recv_sync(struct tipc_node *n, struct sk_buff *buf)
 860 {
 861         struct tipc_msg *msg = buf_msg(buf);
 862
 863         n->bclink.last_sent = n->bclink.last_in = msg_last_bcast(msg);
 864         n->bclink.recv_permitted = true;
 865         kfree_skb(buf);
 866 }
 867
 868 /*
 869  * tipc_link_send_names - send name table entries to new neighbor
 870  *
 871  * Send routine for bulk delivery of name table messages when contact
 872  * with a new neighbor occurs. No link congestion checking is performed
 873  * because name table messages *must* be delivered. The messages must be
 874  * small enough not to require fragmentation.
 875  * Called without any locks held.
 876  */
 877 void tipc_link_send_names(struct list_head *message_list, u32 dest)
 878 {
 879         struct tipc_node *n_ptr;
 880         struct tipc_link *l_ptr;
 881         struct sk_buff *buf;
 882         struct sk_buff *temp_buf;
 883
 884         if (list_empty(message_list))
 885                 return;
 886
 887         read_lock_bh(&tipc_net_lock);
 888         n_ptr = tipc_node_find(dest);
 889         if (n_ptr) {
 890                 tipc_node_lock(n_ptr);
 891                 l_ptr = n_ptr->active_links[0];
 892                 if (l_ptr) {
 893                         /* convert circular list to linear list */
 894                         ((struct sk_buff *)message_list->prev)->next = NULL;
 895                         link_add_chain_to_outqueue(l_ptr,
 896                                 (struct sk_buff *)message_list->next, 0);
 897                         tipc_link_push_queue(l_ptr);
 898                         INIT_LIST_HEAD(message_list);
 899                 }
 900                 tipc_node_unlock(n_ptr);
 901         }
 902         read_unlock_bh(&tipc_net_lock);
 903
 904         /* discard the messages if they couldn't be sent */
 905         list_for_each_safe(buf, temp_buf, ((struct sk_buff *)message_list)) {
 906                 list_del((struct list_head *)buf);
 907                 kfree_skb(buf);
 908         }
 909 }
 910
 911 /*
 912  * link_send_buf_fast: Entry for data messages where the
 913  * destination link is known and the header is complete,
 914  * inclusive total message length. Very time critical.
 915  * Link is locked. Returns user data length.
 916  */
 917 static int link_send_buf_fast(struct tipc_link *l_ptr, struct sk_buff *buf,
 918                               u32 *used_max_pkt)
 919 {
 920         struct tipc_msg *msg = buf_msg(buf);
 921         int res = msg_data_sz(msg);
 922
 923         if (likely(!link_congested(l_ptr))) {
 924                 if (likely(msg_size(msg) <= l_ptr->max_pkt)) {
 925                         link_add_to_outqueue(l_ptr, buf, msg);
 926                         tipc_bearer_send(l_ptr->b_ptr, buf,
 927                                          &l_ptr->media_addr);
 928                         l_ptr->unacked_window = 0;
 929                         return res;
 930                 }
 931                 else
 932                         *used_max_pkt = l_ptr->max_pkt;
 933         }
 934         return tipc_link_send_buf(l_ptr, buf);  /* All other cases */
 935 }
 936
 937 /*
 938  * tipc_link_send_sections_fast: Entry for messages where the
 939  * destination processor is known and the header is complete,
 940  * except for total message length.
 941  * Returns user data length or errno.
 942  */
 943 int tipc_link_send_sections_fast(struct tipc_port *sender,
 944                                  struct iovec const *msg_sect,
 945                                  unsigned int len, u32 destaddr)
 946 {
 947         struct tipc_msg *hdr = &sender->phdr;
 948         struct tipc_link *l_ptr;
 949         struct sk_buff *buf;
 950         struct tipc_node *node;
 951         int res;
 952         u32 selector = msg_origport(hdr) & 1;
 953
 954 again:
 955         /*
 956          * Try building message using port's max_pkt hint.
 957          * (Must not hold any locks while building message.)
 958          */
 959         res = tipc_msg_build(hdr, msg_sect, len, sender->max_pkt, &buf);
 960         /* Exit if build request was invalid */
 961         if (unlikely(res < 0))
 962                 return res;
 963
 964         read_lock_bh(&tipc_net_lock);
 965         node = tipc_node_find(destaddr);
 966         if (likely(node)) {
 967                 tipc_node_lock(node);
 968                 l_ptr = node->active_links[selector];
 969                 if (likely(l_ptr)) {
 970                         if (likely(buf)) {
 971                                 res = link_send_buf_fast(l_ptr, buf,
 972                                                          &sender->max_pkt);
 973 exit:
 974                                 tipc_node_unlock(node);
 975                                 read_unlock_bh(&tipc_net_lock);
 976                                 return res;
 977                         }
 978
 979                         /* Exit if link (or bearer) is congested */
 980                         if (link_congested(l_ptr)) {
 981                                 res = link_schedule_port(l_ptr,
 982                                                          sender->ref, res);
 983                                 goto exit;
 984                         }
 985
 986                         /*
 987                          * Message size exceeds max_pkt hint; update hint,
 988                          * then re-try fast path or fragment the message
 989                          */
 990                         sender->max_pkt = l_ptr->max_pkt;
 991                         tipc_node_unlock(node);
 992                         read_unlock_bh(&tipc_net_lock);
 993
 994
 995                         if ((msg_hdr_sz(hdr) + res) <= sender->max_pkt)
 996                                 goto again;
 997
 998                         return link_send_sections_long(sender, msg_sect, len,
 999                                                        destaddr);
1000                 }
1001                 tipc_node_unlock(node);
1002         }
1003         read_unlock_bh(&tipc_net_lock);
1004
1005         /* Couldn't find a link to the destination node */
1006         if (buf)
1007                 return tipc_reject_msg(buf, TIPC_ERR_NO_NODE);
1008         if (res >= 0)
1009                 return tipc_port_reject_sections(sender, hdr, msg_sect,
1010                                                  len, TIPC_ERR_NO_NODE);
1011         return res;
1012 }
1013
1014 /*
1015  * link_send_sections_long(): Entry for long messages where the
1016  * destination node is known and the header is complete,
1017  * inclusive total message length.
1018  * Link and bearer congestion status have been checked to be ok,
1019  * and are ignored if they change.
1020  *
1021  * Note that fragments do not use the full link MTU so that they won't have
1022  * to undergo refragmentation if link changeover causes them to be sent
1023  * over another link with an additional tunnel header added as prefix.
1024  * (Refragmentation will still occur if the other link has a smaller MTU.)
1025  *
1026  * Returns user data length or errno.
1027  */
1028 static int link_send_sections_long(struct tipc_port *sender,
1029                                    struct iovec const *msg_sect,
1030                                    unsigned int len, u32 destaddr)
1031 {
1032         struct tipc_link *l_ptr;
1033         struct tipc_node *node;
1034         struct tipc_msg *hdr = &sender->phdr;
1035         u32 dsz = len;
1036         u32 max_pkt, fragm_sz, rest;
1037         struct tipc_msg fragm_hdr;
1038         struct sk_buff *buf, *buf_chain, *prev;
1039         u32 fragm_crs, fragm_rest, hsz, sect_rest;
1040         const unchar __user *sect_crs;
1041         int curr_sect;
1042         u32 fragm_no;
1043         int res = 0;
1044
1045 again:
1046         fragm_no = 1;
1047         max_pkt = sender->max_pkt - INT_H_SIZE;
1048                 /* leave room for tunnel header in case of link changeover */
1049         fragm_sz = max_pkt - INT_H_SIZE;
1050                 /* leave room for fragmentation header in each fragment */
1051         rest = dsz;
1052         fragm_crs = 0;
1053         fragm_rest = 0;
1054         sect_rest = 0;
1055         sect_crs = NULL;
1056         curr_sect = -1;
1057
1058         /* Prepare reusable fragment header */
1059         tipc_msg_init(&fragm_hdr, MSG_FRAGMENTER, FIRST_FRAGMENT,
1060                  INT_H_SIZE, msg_destnode(hdr));
1061         msg_set_size(&fragm_hdr, max_pkt);
1062         msg_set_fragm_no(&fragm_hdr, 1);
1063
1064         /* Prepare header of first fragment */
1065         buf_chain = buf = tipc_buf_acquire(max_pkt);
1066         if (!buf)
1067                 return -ENOMEM;
1068         buf->next = NULL;
1069         skb_copy_to_linear_data(buf, &fragm_hdr, INT_H_SIZE);
1070         hsz = msg_hdr_sz(hdr);
1071         skb_copy_to_linear_data_offset(buf, INT_H_SIZE, hdr, hsz);
1072
1073         /* Chop up message */
1074         fragm_crs = INT_H_SIZE + hsz;
1075         fragm_rest = fragm_sz - hsz;
1076
1077         do {            /* For all sections */
1078                 u32 sz;
1079
1080                 if (!sect_rest) {
1081                         sect_rest = msg_sect[++curr_sect].iov_len;
1082                         sect_crs = msg_sect[curr_sect].iov_base;
1083                 }
1084
1085                 if (sect_rest < fragm_rest)
1086                         sz = sect_rest;
1087                 else
1088                         sz = fragm_rest;
1089
1090                 if (copy_from_user(buf->data + fragm_crs, sect_crs, sz)) {
1091                         res = -EFAULT;
1092 error:
1093                         kfree_skb_list(buf_chain);
1094                         return res;
1095                 }
1096                 sect_crs += sz;
1097                 sect_rest -= sz;
1098                 fragm_crs += sz;
1099                 fragm_rest -= sz;
1100                 rest -= sz;
1101
1102                 if (!fragm_rest && rest) {
1103
1104                         /* Initiate new fragment: */
1105                         if (rest <= fragm_sz) {
1106                                 fragm_sz = rest;
1107                                 msg_set_type(&fragm_hdr, LAST_FRAGMENT);
1108                         } else {
1109                                 msg_set_type(&fragm_hdr, FRAGMENT);
1110                         }
1111                         msg_set_size(&fragm_hdr, fragm_sz + INT_H_SIZE);
1112                         msg_set_fragm_no(&fragm_hdr, ++fragm_no);
1113                         prev = buf;
1114                         buf = tipc_buf_acquire(fragm_sz + INT_H_SIZE);
1115                         if (!buf) {
1116                                 res = -ENOMEM;
1117                                 goto error;
1118                         }
1119
1120                         buf->next = NULL;
1121                         prev->next = buf;
1122                         skb_copy_to_linear_data(buf, &fragm_hdr, INT_H_SIZE);
1123                         fragm_crs = INT_H_SIZE;
1124                         fragm_rest = fragm_sz;
1125                 }
1126         } while (rest > 0);
1127
1128         /*
1129          * Now we have a buffer chain. Select a link and check
1130          * that packet size is still OK
1131          */
1132         node = tipc_node_find(destaddr);
1133         if (likely(node)) {
1134                 tipc_node_lock(node);
1135                 l_ptr = node->active_links[sender->ref & 1];
1136                 if (!l_ptr) {
1137                         tipc_node_unlock(node);
1138                         goto reject;
1139                 }
1140                 if (l_ptr->max_pkt < max_pkt) {
1141                         sender->max_pkt = l_ptr->max_pkt;
1142                         tipc_node_unlock(node);
1143                         kfree_skb_list(buf_chain);
1144                         goto again;
1145                 }
1146         } else {
1147 reject:
1148                 kfree_skb_list(buf_chain);
1149                 return tipc_port_reject_sections(sender, hdr, msg_sect,
1150                                                  len, TIPC_ERR_NO_NODE);
1151         }
1152
1153         /* Append chain of fragments to send queue & send them */
1154         l_ptr->long_msg_seq_no++;
1155         link_add_chain_to_outqueue(l_ptr, buf_chain, l_ptr->long_msg_seq_no);
1156         l_ptr->stats.sent_fragments += fragm_no;
1157         l_ptr->stats.sent_fragmented++;
1158         tipc_link_push_queue(l_ptr);
1159         tipc_node_unlock(node);
1160         return dsz;
1161 }
1162
1163 /*
1164  * tipc_link_push_packet: Push one unsent packet to the media
1165  */
1166 static u32 tipc_link_push_packet(struct tipc_link *l_ptr)
1167 {
1168         struct sk_buff *buf = l_ptr->first_out;
1169         u32 r_q_size = l_ptr->retransm_queue_size;
1170         u32 r_q_head = l_ptr->retransm_queue_head;
1171
1172         /* Step to position where retransmission failed, if any,    */
1173         /* consider that buffers may have been released in meantime */
1174         if (r_q_size && buf) {
1175                 u32 last = lesser(mod(r_q_head + r_q_size),
1176                                   link_last_sent(l_ptr));
1177                 u32 first = buf_seqno(buf);
1178
1179                 while (buf && less(first, r_q_head)) {
1180                         first = mod(first + 1);
1181                         buf = buf->next;
1182                 }
1183                 l_ptr->retransm_queue_head = r_q_head = first;
1184                 l_ptr->retransm_queue_size = r_q_size = mod(last - first);
1185         }
1186
1187         /* Continue retransmission now, if there is anything: */
1188         if (r_q_size && buf) {
1189                 msg_set_ack(buf_msg(buf), mod(l_ptr->next_in_no - 1));
1190                 msg_set_bcast_ack(buf_msg(buf), l_ptr->owner->bclink.last_in);
1191                 tipc_bearer_send(l_ptr->b_ptr, buf, &l_ptr->media_addr);
1192                 l_ptr->retransm_queue_head = mod(++r_q_head);
1193                 l_ptr->retransm_queue_size = --r_q_size;
1194                 l_ptr->stats.retransmitted++;
1195                 return 0;
1196         }
1197
1198         /* Send deferred protocol message, if any: */
1199         buf = l_ptr->proto_msg_queue;
1200         if (buf) {
1201                 msg_set_ack(buf_msg(buf), mod(l_ptr->next_in_no - 1));
1202                 msg_set_bcast_ack(buf_msg(buf), l_ptr->owner->bclink.last_in);
1203                 tipc_bearer_send(l_ptr->b_ptr, buf, &l_ptr->media_addr);
1204                 l_ptr->unacked_window = 0;
1205                 kfree_skb(buf);
1206                 l_ptr->proto_msg_queue = NULL;
1207                 return 0;
1208         }
1209
1210         /* Send one deferred data message, if send window not full: */
1211         buf = l_ptr->next_out;
1212         if (buf) {
1213                 struct tipc_msg *msg = buf_msg(buf);
1214                 u32 next = msg_seqno(msg);
1215                 u32 first = buf_seqno(l_ptr->first_out);
1216
1217                 if (mod(next - first) < l_ptr->queue_limit[0]) {
1218                         msg_set_ack(msg, mod(l_ptr->next_in_no - 1));
1219                         msg_set_bcast_ack(msg, l_ptr->owner->bclink.last_in);
1220                         tipc_bearer_send(l_ptr->b_ptr, buf, &l_ptr->media_addr);
1221                         if (msg_user(msg) == MSG_BUNDLER)
1222                                 msg_set_type(msg, CLOSED_MSG);
1223                         l_ptr->next_out = buf->next;
1224                         return 0;
1225                 }
1226         }
1227         return 1;
1228 }
1229
1230 /*
1231  * push_queue(): push out the unsent messages of a link where
1232  *               congestion has abated. Node is locked
1233  */
1234 void tipc_link_push_queue(struct tipc_link *l_ptr)
1235 {
1236         u32 res;
1237
1238         do {
1239                 res = tipc_link_push_packet(l_ptr);
1240         } while (!res);
1241 }
1242
1243 static void link_reset_all(unsigned long addr)
1244 {
1245         struct tipc_node *n_ptr;
1246         char addr_string[16];
1247         u32 i;
1248
1249         read_lock_bh(&tipc_net_lock);
1250         n_ptr = tipc_node_find((u32)addr);
1251         if (!n_ptr) {
1252                 read_unlock_bh(&tipc_net_lock);
1253                 return; /* node no longer exists */
1254         }
1255
1256         tipc_node_lock(n_ptr);
1257
1258         pr_warn("Resetting all links to %s\n",
1259                 tipc_addr_string_fill(addr_string, n_ptr->addr));
1260
1261         for (i = 0; i < MAX_BEARERS; i++) {
1262                 if (n_ptr->links[i]) {
1263                         link_print(n_ptr->links[i], "Resetting link\n");
1264                         tipc_link_reset(n_ptr->links[i]);
1265                 }
1266         }
1267
1268         tipc_node_unlock(n_ptr);
1269         read_unlock_bh(&tipc_net_lock);
1270 }
1271
1272 static void link_retransmit_failure(struct tipc_link *l_ptr,
1273                                     struct sk_buff *buf)
1274 {
1275         struct tipc_msg *msg = buf_msg(buf);
1276
1277         pr_warn("Retransmission failure on link <%s>\n", l_ptr->name);
1278
1279         if (l_ptr->addr) {
1280                 /* Handle failure on standard link */
1281                 link_print(l_ptr, "Resetting link\n");
1282                 tipc_link_reset(l_ptr);
1283
1284         } else {
1285                 /* Handle failure on broadcast link */
1286                 struct tipc_node *n_ptr;
1287                 char addr_string[16];
1288
1289                 pr_info("Msg seq number: %u,  ", msg_seqno(msg));
1290                 pr_cont("Outstanding acks: %lu\n",
1291                         (unsigned long) TIPC_SKB_CB(buf)->handle);
1292
1293                 n_ptr = tipc_bclink_retransmit_to();
1294                 tipc_node_lock(n_ptr);
1295
1296                 tipc_addr_string_fill(addr_string, n_ptr->addr);
1297                 pr_info("Broadcast link info for %s\n", addr_string);
1298                 pr_info("Reception permitted: %d,  Acked: %u\n",
1299                         n_ptr->bclink.recv_permitted,
1300                         n_ptr->bclink.acked);
1301                 pr_info("Last in: %u,  Oos state: %u,  Last sent: %u\n",
1302                         n_ptr->bclink.last_in,
1303                         n_ptr->bclink.oos_state,
1304                         n_ptr->bclink.last_sent);
1305
1306                 tipc_k_signal((Handler)link_reset_all, (unsigned long)n_ptr->addr);
1307
1308                 tipc_node_unlock(n_ptr);
1309
1310                 l_ptr->stale_count = 0;
1311         }
1312 }
1313
1314 void tipc_link_retransmit(struct tipc_link *l_ptr, struct sk_buff *buf,
1315                           u32 retransmits)
1316 {
1317         struct tipc_msg *msg;
1318
1319         if (!buf)
1320                 return;
1321
1322         msg = buf_msg(buf);
1323
1324         /* Detect repeated retransmit failures */
1325         if (l_ptr->last_retransmitted == msg_seqno(msg)) {
1326                 if (++l_ptr->stale_count > 100) {
1327                         link_retransmit_failure(l_ptr, buf);
1328                         return;
1329                 }
1330         } else {
1331                 l_ptr->last_retransmitted = msg_seqno(msg);
1332                 l_ptr->stale_count = 1;
1333         }
1334
1335         while (retransmits && (buf != l_ptr->next_out) && buf) {
1336                 msg = buf_msg(buf);
1337                 msg_set_ack(msg, mod(l_ptr->next_in_no - 1));
1338                 msg_set_bcast_ack(msg, l_ptr->owner->bclink.last_in);
1339                 tipc_bearer_send(l_ptr->b_ptr, buf, &l_ptr->media_addr);
1340                 buf = buf->next;
1341                 retransmits--;
1342                 l_ptr->stats.retransmitted++;
1343         }
1344
1345         l_ptr->retransm_queue_head = l_ptr->retransm_queue_size = 0;
1346 }
1347
1348 /**
1349  * link_insert_deferred_queue - insert deferred messages back into receive chain
1350  */
1351 static struct sk_buff *link_insert_deferred_queue(struct tipc_link *l_ptr,
1352                                                   struct sk_buff *buf)
1353 {
1354         u32 seq_no;
1355
1356         if (l_ptr->oldest_deferred_in == NULL)
1357                 return buf;
1358
1359         seq_no = buf_seqno(l_ptr->oldest_deferred_in);
1360         if (seq_no == mod(l_ptr->next_in_no)) {
1361                 l_ptr->newest_deferred_in->next = buf;
1362                 buf = l_ptr->oldest_deferred_in;
1363                 l_ptr->oldest_deferred_in = NULL;
1364                 l_ptr->deferred_inqueue_sz = 0;
1365         }
1366         return buf;
1367 }
1368
1369 /**
1370  * link_recv_buf_validate - validate basic format of received message
1371  *
1372  * This routine ensures a TIPC message has an acceptable header, and at least
1373  * as much data as the header indicates it should.  The routine also ensures
1374  * that the entire message header is stored in the main fragment of the message
1375  * buffer, to simplify future access to message header fields.
1376  *
1377  * Note: Having extra info present in the message header or data areas is OK.
1378  * TIPC will ignore the excess, under the assumption that it is optional info
1379  * introduced by a later release of the protocol.
1380  */
1381 static int link_recv_buf_validate(struct sk_buff *buf)
1382 {
1383         static u32 min_data_hdr_size[8] = {
1384                 SHORT_H_SIZE, MCAST_H_SIZE, NAMED_H_SIZE, BASIC_H_SIZE,
1385                 MAX_H_SIZE, MAX_H_SIZE, MAX_H_SIZE, MAX_H_SIZE
1386                 };
1387
1388         struct tipc_msg *msg;
1389         u32 tipc_hdr[2];
1390         u32 size;
1391         u32 hdr_size;
1392         u32 min_hdr_size;
1393
1394         if (unlikely(buf->len < MIN_H_SIZE))
1395                 return 0;
1396
1397         msg = skb_header_pointer(buf, 0, sizeof(tipc_hdr), tipc_hdr);
1398         if (msg == NULL)
1399                 return 0;
1400
1401         if (unlikely(msg_version(msg) != TIPC_VERSION))
1402                 return 0;
1403
1404         size = msg_size(msg);
1405         hdr_size = msg_hdr_sz(msg);
1406         min_hdr_size = msg_isdata(msg) ?
1407                 min_data_hdr_size[msg_type(msg)] : INT_H_SIZE;
1408
1409         if (unlikely((hdr_size < min_hdr_size) ||
1410                      (size < hdr_size) ||
1411                      (buf->len < size) ||
1412                      (size - hdr_size > TIPC_MAX_USER_MSG_SIZE)))
1413                 return 0;
1414
1415         return pskb_may_pull(buf, hdr_size);
1416 }
1417
1418 /**
1419  * tipc_rcv - process TIPC packets/messages arriving from off-node
1420  * @head: pointer to message buffer chain
1421  * @tb_ptr: pointer to bearer message arrived on
1422  *
1423  * Invoked with no locks held.  Bearer pointer must point to a valid bearer
1424  * structure (i.e. cannot be NULL), but bearer can be inactive.
1425  */
1426 void tipc_rcv(struct sk_buff *head, struct tipc_bearer *b_ptr)
1427 {
1428         read_lock_bh(&tipc_net_lock);
1429         while (head) {
1430                 struct tipc_node *n_ptr;
1431                 struct tipc_link *l_ptr;
1432                 struct sk_buff *crs;
1433                 struct sk_buff *buf = head;
1434                 struct tipc_msg *msg;
1435                 u32 seq_no;
1436                 u32 ackd;
1437                 u32 released = 0;
1438                 int type;
1439
1440                 head = head->next;
1441
1442                 /* Ensure bearer is still enabled */
1443                 if (unlikely(!b_ptr->active))
1444                         goto discard;
1445
1446                 /* Ensure message is well-formed */
1447                 if (unlikely(!link_recv_buf_validate(buf)))
1448                         goto discard;
1449
1450                 /* Ensure message data is a single contiguous unit */
1451                 if (unlikely(skb_linearize(buf)))
1452                         goto discard;
1453
1454                 /* Handle arrival of a non-unicast link message */
1455                 msg = buf_msg(buf);
1456
1457                 if (unlikely(msg_non_seq(msg))) {
1458                         if (msg_user(msg) ==  LINK_CONFIG)
1459                                 tipc_disc_recv_msg(buf, b_ptr);
1460                         else
1461                                 tipc_bclink_recv_pkt(buf);
1462                         continue;
1463                 }
1464
1465                 /* Discard unicast link messages destined for another node */
1466                 if (unlikely(!msg_short(msg) &&
1467                              (msg_destnode(msg) != tipc_own_addr)))
1468                         goto discard;
1469
1470                 /* Locate neighboring node that sent message */
1471                 n_ptr = tipc_node_find(msg_prevnode(msg));
1472                 if (unlikely(!n_ptr))
1473                         goto discard;
1474                 tipc_node_lock(n_ptr);
1475
1476                 /* Locate unicast link endpoint that should handle message */
1477                 l_ptr = n_ptr->links[b_ptr->identity];
1478                 if (unlikely(!l_ptr))
1479                         goto unlock_discard;
1480
1481                 /* Verify that communication with node is currently allowed */
1482                 if ((n_ptr->block_setup & WAIT_PEER_DOWN) &&
1483                         msg_user(msg) == LINK_PROTOCOL &&
1484                         (msg_type(msg) == RESET_MSG ||
1485                                         msg_type(msg) == ACTIVATE_MSG) &&
1486                         !msg_redundant_link(msg))
1487                         n_ptr->block_setup &= ~WAIT_PEER_DOWN;
1488
1489                 if (n_ptr->block_setup)
1490                         goto unlock_discard;
1491
1492                 /* Validate message sequence number info */
1493                 seq_no = msg_seqno(msg);
1494                 ackd = msg_ack(msg);
1495
1496                 /* Release acked messages */
1497                 if (n_ptr->bclink.recv_permitted)
1498                         tipc_bclink_acknowledge(n_ptr, msg_bcast_ack(msg));
1499
1500                 crs = l_ptr->first_out;
1501                 while ((crs != l_ptr->next_out) &&
1502                        less_eq(buf_seqno(crs), ackd)) {
1503                         struct sk_buff *next = crs->next;
1504
1505                         kfree_skb(crs);
1506                         crs = next;
1507                         released++;
1508                 }
1509                 if (released) {
1510                         l_ptr->first_out = crs;
1511                         l_ptr->out_queue_size -= released;
1512                 }
1513
1514                 /* Try sending any messages link endpoint has pending */
1515                 if (unlikely(l_ptr->next_out))
1516                         tipc_link_push_queue(l_ptr);
1517                 if (unlikely(!list_empty(&l_ptr->waiting_ports)))
1518                         tipc_link_wakeup_ports(l_ptr, 0);
1519                 if (unlikely(++l_ptr->unacked_window >= TIPC_MIN_LINK_WIN)) {
1520                         l_ptr->stats.sent_acks++;
1521                         tipc_link_send_proto_msg(l_ptr, STATE_MSG, 0, 0, 0, 0, 0);
1522                 }
1523
1524                 /* Now (finally!) process the incoming message */
1525 protocol_check:
1526                 if (unlikely(!link_working_working(l_ptr))) {
1527                         if (msg_user(msg) == LINK_PROTOCOL) {
1528                                 link_recv_proto_msg(l_ptr, buf);
1529                                 head = link_insert_deferred_queue(l_ptr, head);
1530                                 tipc_node_unlock(n_ptr);
1531                                 continue;
1532                         }
1533
1534                         /* Traffic message. Conditionally activate link */
1535                         link_state_event(l_ptr, TRAFFIC_MSG_EVT);
1536
1537                         if (link_working_working(l_ptr)) {
1538                                 /* Re-insert buffer in front of queue */
1539                                 buf->next = head;
1540                                 head = buf;
1541                                 tipc_node_unlock(n_ptr);
1542                                 continue;
1543                         }
1544                         goto unlock_discard;
1545                 }
1546
1547                 /* Link is now in state WORKING_WORKING */
1548                 if (unlikely(seq_no != mod(l_ptr->next_in_no))) {
1549                         link_handle_out_of_seq_msg(l_ptr, buf);
1550                         head = link_insert_deferred_queue(l_ptr, head);
1551                         tipc_node_unlock(n_ptr);
1552                         continue;
1553                 }
1554                 l_ptr->next_in_no++;
1555                 if (unlikely(l_ptr->oldest_deferred_in))
1556                         head = link_insert_deferred_queue(l_ptr, head);
1557 deliver:
1558                 if (likely(msg_isdata(msg))) {
1559                         tipc_node_unlock(n_ptr);
1560                         tipc_port_recv_msg(buf);
1561                         continue;
1562                 }
1563                 switch (msg_user(msg)) {
1564                         int ret;
1565                 case MSG_BUNDLER:
1566                         l_ptr->stats.recv_bundles++;
1567                         l_ptr->stats.recv_bundled += msg_msgcnt(msg);
1568                         tipc_node_unlock(n_ptr);
1569                         tipc_link_recv_bundle(buf);
1570                         continue;
1571                 case NAME_DISTRIBUTOR:
1572                         n_ptr->bclink.recv_permitted = true;
1573                         tipc_node_unlock(n_ptr);
1574                         tipc_named_recv(buf);
1575                         continue;
1576                 case BCAST_PROTOCOL:
1577                         tipc_link_recv_sync(n_ptr, buf);
1578                         tipc_node_unlock(n_ptr);
1579                         continue;
1580                 case CONN_MANAGER:
1581                         tipc_node_unlock(n_ptr);
1582                         tipc_port_recv_proto_msg(buf);
1583                         continue;
1584                 case MSG_FRAGMENTER:
1585                         l_ptr->stats.recv_fragments++;
1586                         ret = tipc_link_recv_fragment(&l_ptr->reasm_head,
1587                                                       &l_ptr->reasm_tail,
1588                                                       &buf);
1589                         if (ret == LINK_REASM_COMPLETE) {
1590                                 l_ptr->stats.recv_fragmented++;
1591                                 msg = buf_msg(buf);
1592                                 goto deliver;
1593                         }
1594                         if (ret == LINK_REASM_ERROR)
1595                                 tipc_link_reset(l_ptr);
1596                         tipc_node_unlock(n_ptr);
1597                         continue;
1598                 case CHANGEOVER_PROTOCOL:
1599                         type = msg_type(msg);
1600                         if (tipc_link_tunnel_rcv(&l_ptr, &buf)) {
1601                                 msg = buf_msg(buf);
1602                                 seq_no = msg_seqno(msg);
1603                                 if (type == ORIGINAL_MSG)
1604                                         goto deliver;
1605                                 goto protocol_check;
1606                         }
1607                         break;
1608                 default:
1609                         kfree_skb(buf);
1610                         buf = NULL;
1611                         break;
1612                 }
1613                 tipc_node_unlock(n_ptr);
1614                 tipc_net_route_msg(buf);
1615                 continue;
1616 unlock_discard:
1617
1618                 tipc_node_unlock(n_ptr);
1619 discard:
1620                 kfree_skb(buf);
1621         }
1622         read_unlock_bh(&tipc_net_lock);
1623 }
1624
1625 /**
1626  * tipc_link_defer_pkt - Add out-of-sequence message to deferred reception queue
1627  *
1628  * Returns increase in queue length (i.e. 0 or 1)
1629  */
1630 u32 tipc_link_defer_pkt(struct sk_buff **head, struct sk_buff **tail,
1631                         struct sk_buff *buf)
1632 {
1633         struct sk_buff *queue_buf;
1634         struct sk_buff **prev;
1635         u32 seq_no = buf_seqno(buf);
1636
1637         buf->next = NULL;
1638
1639         /* Empty queue ? */
1640         if (*head == NULL) {
1641                 *head = *tail = buf;
1642                 return 1;
1643         }
1644
1645         /* Last ? */
1646         if (less(buf_seqno(*tail), seq_no)) {
1647                 (*tail)->next = buf;
1648                 *tail = buf;
1649                 return 1;
1650         }
1651
1652         /* Locate insertion point in queue, then insert; discard if duplicate */
1653         prev = head;
1654         queue_buf = *head;
1655         for (;;) {
1656                 u32 curr_seqno = buf_seqno(queue_buf);
1657
1658                 if (seq_no == curr_seqno) {
1659                         kfree_skb(buf);
1660                         return 0;
1661                 }
1662
1663                 if (less(seq_no, curr_seqno))
1664                         break;
1665
1666                 prev = &queue_buf->next;
1667                 queue_buf = queue_buf->next;
1668         }
1669
1670         buf->next = queue_buf;
1671         *prev = buf;
1672         return 1;
1673 }
1674
1675 /*
1676  * link_handle_out_of_seq_msg - handle arrival of out-of-sequence packet
1677  */
1678 static void link_handle_out_of_seq_msg(struct tipc_link *l_ptr,
1679                                        struct sk_buff *buf)
1680 {
1681         u32 seq_no = buf_seqno(buf);
1682
1683         if (likely(msg_user(buf_msg(buf)) == LINK_PROTOCOL)) {
1684                 link_recv_proto_msg(l_ptr, buf);
1685                 return;
1686         }
1687
1688         /* Record OOS packet arrival (force mismatch on next timeout) */
1689         l_ptr->checkpoint--;
1690
1691         /*
1692          * Discard packet if a duplicate; otherwise add it to deferred queue
1693          * and notify peer of gap as per protocol specification
1694          */
1695         if (less(seq_no, mod(l_ptr->next_in_no))) {
1696                 l_ptr->stats.duplicates++;
1697                 kfree_skb(buf);
1698                 return;
1699         }
1700
1701         if (tipc_link_defer_pkt(&l_ptr->oldest_deferred_in,
1702                                 &l_ptr->newest_deferred_in, buf)) {
1703                 l_ptr->deferred_inqueue_sz++;
1704                 l_ptr->stats.deferred_recv++;
1705                 if ((l_ptr->deferred_inqueue_sz % 16) == 1)
1706                         tipc_link_send_proto_msg(l_ptr, STATE_MSG, 0, 0, 0, 0, 0);
1707         } else
1708                 l_ptr->stats.duplicates++;
1709 }
1710
1711 /*
1712  * Send protocol message to the other endpoint.
1713  */
1714 void tipc_link_send_proto_msg(struct tipc_link *l_ptr, u32 msg_typ,
1715                               int probe_msg, u32 gap, u32 tolerance,
1716                               u32 priority, u32 ack_mtu)
1717 {
1718         struct sk_buff *buf = NULL;
1719         struct tipc_msg *msg = l_ptr->pmsg;
1720         u32 msg_size = sizeof(l_ptr->proto_msg);
1721         int r_flag;
1722
1723         /* Discard any previous message that was deferred due to congestion */
1724         if (l_ptr->proto_msg_queue) {
1725                 kfree_skb(l_ptr->proto_msg_queue);
1726                 l_ptr->proto_msg_queue = NULL;
1727         }
1728
1729         /* Don't send protocol message during link changeover */
1730         if (l_ptr->exp_msg_count)
1731                 return;
1732
1733         /* Abort non-RESET send if communication with node is prohibited */
1734         if ((l_ptr->owner->block_setup) && (msg_typ != RESET_MSG))
1735                 return;
1736
1737         /* Create protocol message with "out-of-sequence" sequence number */
1738         msg_set_type(msg, msg_typ);
1739         msg_set_net_plane(msg, l_ptr->b_ptr->net_plane);
1740         msg_set_bcast_ack(msg, l_ptr->owner->bclink.last_in);
1741         msg_set_last_bcast(msg, tipc_bclink_get_last_sent());
1742
1743         if (msg_typ == STATE_MSG) {
1744                 u32 next_sent = mod(l_ptr->next_out_no);
1745
1746                 if (!tipc_link_is_up(l_ptr))
1747                         return;
1748                 if (l_ptr->next_out)
1749                         next_sent = buf_seqno(l_ptr->next_out);
1750                 msg_set_next_sent(msg, next_sent);
1751                 if (l_ptr->oldest_deferred_in) {
1752                         u32 rec = buf_seqno(l_ptr->oldest_deferred_in);
1753                         gap = mod(rec - mod(l_ptr->next_in_no));
1754                 }
1755                 msg_set_seq_gap(msg, gap);
1756                 if (gap)
1757                         l_ptr->stats.sent_nacks++;
1758                 msg_set_link_tolerance(msg, tolerance);
1759                 msg_set_linkprio(msg, priority);
1760                 msg_set_max_pkt(msg, ack_mtu);
1761                 msg_set_ack(msg, mod(l_ptr->next_in_no - 1));
1762                 msg_set_probe(msg, probe_msg != 0);
1763                 if (probe_msg) {
1764                         u32 mtu = l_ptr->max_pkt;
1765
1766                         if ((mtu < l_ptr->max_pkt_target) &&
1767                             link_working_working(l_ptr) &&
1768                             l_ptr->fsm_msg_cnt) {
1769                                 msg_size = (mtu + (l_ptr->max_pkt_target - mtu)/2 + 2) & ~3;
1770                                 if (l_ptr->max_pkt_probes == 10) {
1771                                         l_ptr->max_pkt_target = (msg_size - 4);
1772                                         l_ptr->max_pkt_probes = 0;
1773                                         msg_size = (mtu + (l_ptr->max_pkt_target - mtu)/2 + 2) & ~3;
1774                                 }
1775                                 l_ptr->max_pkt_probes++;
1776                         }
1777
1778                         l_ptr->stats.sent_probes++;
1779                 }
1780                 l_ptr->stats.sent_states++;
1781         } else {                /* RESET_MSG or ACTIVATE_MSG */
1782                 msg_set_ack(msg, mod(l_ptr->reset_checkpoint - 1));
1783                 msg_set_seq_gap(msg, 0);
1784                 msg_set_next_sent(msg, 1);
1785                 msg_set_probe(msg, 0);
1786                 msg_set_link_tolerance(msg, l_ptr->tolerance);
1787                 msg_set_linkprio(msg, l_ptr->priority);
1788                 msg_set_max_pkt(msg, l_ptr->max_pkt_target);
1789         }
1790
1791         r_flag = (l_ptr->owner->working_links > tipc_link_is_up(l_ptr));
1792         msg_set_redundant_link(msg, r_flag);
1793         msg_set_linkprio(msg, l_ptr->priority);
1794         msg_set_size(msg, msg_size);
1795
1796         msg_set_seqno(msg, mod(l_ptr->next_out_no + (0xffff/2)));
1797
1798         buf = tipc_buf_acquire(msg_size);
1799         if (!buf)
1800                 return;
1801
1802         skb_copy_to_linear_data(buf, msg, sizeof(l_ptr->proto_msg));
1803         buf->priority = TC_PRIO_CONTROL;
1804
1805         tipc_bearer_send(l_ptr->b_ptr, buf, &l_ptr->media_addr);
1806         l_ptr->unacked_window = 0;
1807         kfree_skb(buf);
1808 }
1809
1810 /*
1811  * Receive protocol message :
1812  * Note that network plane id propagates through the network, and may
1813  * change at any time. The node with lowest address rules
1814  */
1815 static void link_recv_proto_msg(struct tipc_link *l_ptr, struct sk_buff *buf)
1816 {
1817         u32 rec_gap = 0;
1818         u32 max_pkt_info;
1819         u32 max_pkt_ack;
1820         u32 msg_tol;
1821         struct tipc_msg *msg = buf_msg(buf);
1822
1823         /* Discard protocol message during link changeover */
1824         if (l_ptr->exp_msg_count)
1825                 goto exit;
1826
1827         /* record unnumbered packet arrival (force mismatch on next timeout) */
1828         l_ptr->checkpoint--;
1829
1830         if (l_ptr->b_ptr->net_plane != msg_net_plane(msg))
1831                 if (tipc_own_addr > msg_prevnode(msg))
1832                         l_ptr->b_ptr->net_plane = msg_net_plane(msg);
1833
1834         switch (msg_type(msg)) {
1835
1836         case RESET_MSG:
1837                 if (!link_working_unknown(l_ptr) &&
1838                     (l_ptr->peer_session != INVALID_SESSION)) {
1839                         if (less_eq(msg_session(msg), l_ptr->peer_session))
1840                                 break; /* duplicate or old reset: ignore */
1841                 }
1842
1843                 if (!msg_redundant_link(msg) && (link_working_working(l_ptr) ||
1844                                 link_working_unknown(l_ptr))) {
1845                         /*
1846                          * peer has lost contact -- don't allow peer's links
1847                          * to reactivate before we recognize loss & clean up
1848                          */
1849                         l_ptr->owner->block_setup = WAIT_NODE_DOWN;
1850                 }
1851
1852                 link_state_event(l_ptr, RESET_MSG);
1853
1854                 /* fall thru' */
1855         case ACTIVATE_MSG:
1856                 /* Update link settings according other endpoint's values */
1857                 strcpy((strrchr(l_ptr->name, ':') + 1), (char *)msg_data(msg));
1858
1859                 msg_tol = msg_link_tolerance(msg);
1860                 if (msg_tol > l_ptr->tolerance)
1861                         link_set_supervision_props(l_ptr, msg_tol);
1862
1863                 if (msg_linkprio(msg) > l_ptr->priority)
1864                         l_ptr->priority = msg_linkprio(msg);
1865
1866                 max_pkt_info = msg_max_pkt(msg);
1867                 if (max_pkt_info) {
1868                         if (max_pkt_info < l_ptr->max_pkt_target)
1869                                 l_ptr->max_pkt_target = max_pkt_info;
1870                         if (l_ptr->max_pkt > l_ptr->max_pkt_target)
1871                                 l_ptr->max_pkt = l_ptr->max_pkt_target;
1872                 } else {
1873                         l_ptr->max_pkt = l_ptr->max_pkt_target;
1874                 }
1875
1876                 /* Synchronize broadcast link info, if not done previously */
1877                 if (!tipc_node_is_up(l_ptr->owner)) {
1878                         l_ptr->owner->bclink.last_sent =
1879                                 l_ptr->owner->bclink.last_in =
1880                                 msg_last_bcast(msg);
1881                         l_ptr->owner->bclink.oos_state = 0;
1882                 }
1883
1884                 l_ptr->peer_session = msg_session(msg);
1885                 l_ptr->peer_bearer_id = msg_bearer_id(msg);
1886
1887                 if (msg_type(msg) == ACTIVATE_MSG)
1888                         link_state_event(l_ptr, ACTIVATE_MSG);
1889                 break;
1890         case STATE_MSG:
1891
1892                 msg_tol = msg_link_tolerance(msg);
1893                 if (msg_tol)
1894                         link_set_supervision_props(l_ptr, msg_tol);
1895
1896                 if (msg_linkprio(msg) &&
1897                     (msg_linkprio(msg) != l_ptr->priority)) {
1898                         pr_warn("%s<%s>, priority change %u->%u\n",
1899                                 link_rst_msg, l_ptr->name, l_ptr->priority,
1900                                 msg_linkprio(msg));
1901                         l_ptr->priority = msg_linkprio(msg);
1902                         tipc_link_reset(l_ptr); /* Enforce change to take effect */
1903                         break;
1904                 }
1905                 link_state_event(l_ptr, TRAFFIC_MSG_EVT);
1906                 l_ptr->stats.recv_states++;
1907                 if (link_reset_unknown(l_ptr))
1908                         break;
1909
1910                 if (less_eq(mod(l_ptr->next_in_no), msg_next_sent(msg))) {
1911                         rec_gap = mod(msg_next_sent(msg) -
1912                                       mod(l_ptr->next_in_no));
1913                 }
1914
1915                 max_pkt_ack = msg_max_pkt(msg);
1916                 if (max_pkt_ack > l_ptr->max_pkt) {
1917                         l_ptr->max_pkt = max_pkt_ack;
1918                         l_ptr->max_pkt_probes = 0;
1919                 }
1920
1921                 max_pkt_ack = 0;
1922                 if (msg_probe(msg)) {
1923                         l_ptr->stats.recv_probes++;
1924                         if (msg_size(msg) > sizeof(l_ptr->proto_msg))
1925                                 max_pkt_ack = msg_size(msg);
1926                 }
1927
1928                 /* Protocol message before retransmits, reduce loss risk */
1929                 if (l_ptr->owner->bclink.recv_permitted)
1930                         tipc_bclink_update_link_state(l_ptr->owner,
1931                                                       msg_last_bcast(msg));
1932
1933                 if (rec_gap || (msg_probe(msg))) {
1934                         tipc_link_send_proto_msg(l_ptr, STATE_MSG,
1935                                                  0, rec_gap, 0, 0, max_pkt_ack);
1936                 }
1937                 if (msg_seq_gap(msg)) {
1938                         l_ptr->stats.recv_nacks++;
1939                         tipc_link_retransmit(l_ptr, l_ptr->first_out,
1940                                              msg_seq_gap(msg));
1941                 }
1942                 break;
1943         }
1944 exit:
1945         kfree_skb(buf);
1946 }
1947
1948
1949 /* tipc_link_tunnel_xmit(): Tunnel one packet via a link belonging to
1950  * a different bearer. Owner node is locked.
1951  */
1952 static void tipc_link_tunnel_xmit(struct tipc_link *l_ptr,
1953                                   struct tipc_msg *tunnel_hdr,
1954                                   struct tipc_msg *msg,
1955                                   u32 selector)
1956 {
1957         struct tipc_link *tunnel;
1958         struct sk_buff *buf;
1959         u32 length = msg_size(msg);
1960
1961         tunnel = l_ptr->owner->active_links[selector & 1];
1962         if (!tipc_link_is_up(tunnel)) {
1963                 pr_warn("%stunnel link no longer available\n", link_co_err);
1964                 return;
1965         }
1966         msg_set_size(tunnel_hdr, length + INT_H_SIZE);
1967         buf = tipc_buf_acquire(length + INT_H_SIZE);
1968         if (!buf) {
1969                 pr_warn("%sunable to send tunnel msg\n", link_co_err);
1970                 return;
1971         }
1972         skb_copy_to_linear_data(buf, tunnel_hdr, INT_H_SIZE);
1973         skb_copy_to_linear_data_offset(buf, INT_H_SIZE, msg, length);
1974         tipc_link_send_buf(tunnel, buf);
1975 }
1976
1977
1978 /* tipc_link_failover_send_queue(): A link has gone down, but a second
1979  * link is still active. We can do failover. Tunnel the failing link's
1980  * whole send queue via the remaining link. This way, we don't lose
1981  * any packets, and sequence order is preserved for subsequent traffic
1982  * sent over the remaining link. Owner node is locked.
1983  */
1984 void tipc_link_failover_send_queue(struct tipc_link *l_ptr)
1985 {
1986         u32 msgcount = l_ptr->out_queue_size;
1987         struct sk_buff *crs = l_ptr->first_out;
1988         struct tipc_link *tunnel = l_ptr->owner->active_links[0];
1989         struct tipc_msg tunnel_hdr;
1990         int split_bundles;
1991
1992         if (!tunnel)
1993                 return;
1994
1995         tipc_msg_init(&tunnel_hdr, CHANGEOVER_PROTOCOL,
1996                  ORIGINAL_MSG, INT_H_SIZE, l_ptr->addr);
1997         msg_set_bearer_id(&tunnel_hdr, l_ptr->peer_bearer_id);
1998         msg_set_msgcnt(&tunnel_hdr, msgcount);
1999
2000         if (!l_ptr->first_out) {
2001                 struct sk_buff *buf;
2002
2003                 buf = tipc_buf_acquire(INT_H_SIZE);
2004                 if (buf) {
2005                         skb_copy_to_linear_data(buf, &tunnel_hdr, INT_H_SIZE);
2006                         msg_set_size(&tunnel_hdr, INT_H_SIZE);
2007                         tipc_link_send_buf(tunnel, buf);
2008                 } else {
2009                         pr_warn("%sunable to send changeover msg\n",
2010                                 link_co_err);
2011                 }
2012                 return;
2013         }
2014
2015         split_bundles = (l_ptr->owner->active_links[0] !=
2016                          l_ptr->owner->active_links[1]);
2017
2018         while (crs) {
2019                 struct tipc_msg *msg = buf_msg(crs);
2020
2021                 if ((msg_user(msg) == MSG_BUNDLER) && split_bundles) {
2022                         struct tipc_msg *m = msg_get_wrapped(msg);
2023                         unchar *pos = (unchar *)m;
2024
2025                         msgcount = msg_msgcnt(msg);
2026                         while (msgcount--) {
2027                                 msg_set_seqno(m, msg_seqno(msg));
2028                                 tipc_link_tunnel_xmit(l_ptr, &tunnel_hdr, m,
2029                                                       msg_link_selector(m));
2030                                 pos += align(msg_size(m));
2031                                 m = (struct tipc_msg *)pos;
2032                         }
2033                 } else {
2034                         tipc_link_tunnel_xmit(l_ptr, &tunnel_hdr, msg,
2035                                               msg_link_selector(msg));
2036                 }
2037                 crs = crs->next;
2038         }
2039 }
2040
2041 /* tipc_link_dup_send_queue(): A second link has become active. Tunnel a
2042  * duplicate of the first link's send queue via the new link. This way, we
2043  * are guaranteed that currently queued packets from a socket are delivered
2044  * before future traffic from the same socket, even if this is using the
2045  * new link. The last arriving copy of each duplicate packet is dropped at
2046  * the receiving end by the regular protocol check, so packet cardinality
2047  * and sequence order is preserved per sender/receiver socket pair.
2048  * Owner node is locked.
2049  */
2050 void tipc_link_dup_send_queue(struct tipc_link *l_ptr,
2051                               struct tipc_link *tunnel)
2052 {
2053         struct sk_buff *iter;
2054         struct tipc_msg tunnel_hdr;
2055
2056         tipc_msg_init(&tunnel_hdr, CHANGEOVER_PROTOCOL,
2057                  DUPLICATE_MSG, INT_H_SIZE, l_ptr->addr);
2058         msg_set_msgcnt(&tunnel_hdr, l_ptr->out_queue_size);
2059         msg_set_bearer_id(&tunnel_hdr, l_ptr->peer_bearer_id);
2060         iter = l_ptr->first_out;
2061         while (iter) {
2062                 struct sk_buff *outbuf;
2063                 struct tipc_msg *msg = buf_msg(iter);
2064                 u32 length = msg_size(msg);
2065
2066                 if (msg_user(msg) == MSG_BUNDLER)
2067                         msg_set_type(msg, CLOSED_MSG);
2068                 msg_set_ack(msg, mod(l_ptr->next_in_no - 1));   /* Update */
2069                 msg_set_bcast_ack(msg, l_ptr->owner->bclink.last_in);
2070                 msg_set_size(&tunnel_hdr, length + INT_H_SIZE);
2071                 outbuf = tipc_buf_acquire(length + INT_H_SIZE);
2072                 if (outbuf == NULL) {
2073                         pr_warn("%sunable to send duplicate msg\n",
2074                                 link_co_err);
2075                         return;
2076                 }
2077                 skb_copy_to_linear_data(outbuf, &tunnel_hdr, INT_H_SIZE);
2078                 skb_copy_to_linear_data_offset(outbuf, INT_H_SIZE, iter->data,
2079                                                length);
2080                 tipc_link_send_buf(tunnel, outbuf);
2081                 if (!tipc_link_is_up(l_ptr))
2082                         return;
2083                 iter = iter->next;
2084         }
2085 }
2086
2087 /**
2088  * buf_extract - extracts embedded TIPC message from another message
2089  * @skb: encapsulating message buffer
2090  * @from_pos: offset to extract from
2091  *
2092  * Returns a new message buffer containing an embedded message.  The
2093  * encapsulating message itself is left unchanged.
2094  */
2095 static struct sk_buff *buf_extract(struct sk_buff *skb, u32 from_pos)
2096 {
2097         struct tipc_msg *msg = (struct tipc_msg *)(skb->data + from_pos);
2098         u32 size = msg_size(msg);
2099         struct sk_buff *eb;
2100
2101         eb = tipc_buf_acquire(size);
2102         if (eb)
2103                 skb_copy_to_linear_data(eb, msg, size);
2104         return eb;
2105 }
2106
2107 /*  tipc_link_tunnel_rcv(): Receive a tunneled packet, sent
2108  *  via other link as result of a failover (ORIGINAL_MSG) or
2109  *  a new active link (DUPLICATE_MSG). Failover packets are
2110  *  returned to the active link for delivery upwards.
2111  *  Owner node is locked.
2112  */
2113 static int tipc_link_tunnel_rcv(struct tipc_link **l_ptr,
2114                                 struct sk_buff **buf)
2115 {
2116         struct sk_buff *tunnel_buf = *buf;
2117         struct tipc_link *dest_link;
2118         struct tipc_msg *msg;
2119         struct tipc_msg *tunnel_msg = buf_msg(tunnel_buf);
2120         u32 msg_typ = msg_type(tunnel_msg);
2121         u32 msg_count = msg_msgcnt(tunnel_msg);
2122         u32 bearer_id = msg_bearer_id(tunnel_msg);
2123
2124         if (bearer_id >= MAX_BEARERS)
2125                 goto exit;
2126         dest_link = (*l_ptr)->owner->links[bearer_id];
2127         if (!dest_link)
2128                 goto exit;
2129         if (dest_link == *l_ptr) {
2130                 pr_err("Unexpected changeover message on link <%s>\n",
2131                        (*l_ptr)->name);
2132                 goto exit;
2133         }
2134         *l_ptr = dest_link;
2135         msg = msg_get_wrapped(tunnel_msg);
2136
2137         if (msg_typ == DUPLICATE_MSG) {
2138                 if (less(msg_seqno(msg), mod(dest_link->next_in_no)))
2139                         goto exit;
2140                 *buf = buf_extract(tunnel_buf, INT_H_SIZE);
2141                 if (*buf == NULL) {
2142                         pr_warn("%sduplicate msg dropped\n", link_co_err);
2143                         goto exit;
2144                 }
2145                 kfree_skb(tunnel_buf);
2146                 return 1;
2147         }
2148
2149         /* First original message ?: */
2150         if (tipc_link_is_up(dest_link)) {
2151                 pr_info("%s<%s>, changeover initiated by peer\n", link_rst_msg,
2152                         dest_link->name);
2153                 tipc_link_reset(dest_link);
2154                 dest_link->exp_msg_count = msg_count;
2155                 if (!msg_count)
2156                         goto exit;
2157         } else if (dest_link->exp_msg_count == START_CHANGEOVER) {
2158                 dest_link->exp_msg_count = msg_count;
2159                 if (!msg_count)
2160                         goto exit;
2161         }
2162
2163         /* Receive original message */
2164         if (dest_link->exp_msg_count == 0) {
2165                 pr_warn("%sgot too many tunnelled messages\n", link_co_err);
2166                 goto exit;
2167         }
2168         dest_link->exp_msg_count--;
2169         if (less(msg_seqno(msg), dest_link->reset_checkpoint)) {
2170                 goto exit;
2171         } else {
2172                 *buf = buf_extract(tunnel_buf, INT_H_SIZE);
2173                 if (*buf != NULL) {
2174                         kfree_skb(tunnel_buf);
2175                         return 1;
2176                 } else {
2177                         pr_warn("%soriginal msg dropped\n", link_co_err);
2178                 }
2179         }
2180 exit:
2181         *buf = NULL;
2182         kfree_skb(tunnel_buf);
2183         return 0;
2184 }
2185
2186 /*
2187  *  Bundler functionality:
2188  */
2189 void tipc_link_recv_bundle(struct sk_buff *buf)
2190 {
2191         u32 msgcount = msg_msgcnt(buf_msg(buf));
2192         u32 pos = INT_H_SIZE;
2193         struct sk_buff *obuf;
2194
2195         while (msgcount--) {
2196                 obuf = buf_extract(buf, pos);
2197                 if (obuf == NULL) {
2198                         pr_warn("Link unable to unbundle message(s)\n");
2199                         break;
2200                 }
2201                 pos += align(msg_size(buf_msg(obuf)));
2202                 tipc_net_route_msg(obuf);
2203         }
2204         kfree_skb(buf);
2205 }
2206
2207 /*
2208  *  Fragmentation/defragmentation:
2209  */
2210
2211 /*
2212  * link_send_long_buf: Entry for buffers needing fragmentation.
2213  * The buffer is complete, inclusive total message length.
2214  * Returns user data length.
2215  */
2216 static int link_send_long_buf(struct tipc_link *l_ptr, struct sk_buff *buf)
2217 {
2218         struct sk_buff *buf_chain = NULL;
2219         struct sk_buff *buf_chain_tail = (struct sk_buff *)&buf_chain;
2220         struct tipc_msg *inmsg = buf_msg(buf);
2221         struct tipc_msg fragm_hdr;
2222         u32 insize = msg_size(inmsg);
2223         u32 dsz = msg_data_sz(inmsg);
2224         unchar *crs = buf->data;
2225         u32 rest = insize;
2226         u32 pack_sz = l_ptr->max_pkt;
2227         u32 fragm_sz = pack_sz - INT_H_SIZE;
2228         u32 fragm_no = 0;
2229         u32 destaddr;
2230
2231         if (msg_short(inmsg))
2232                 destaddr = l_ptr->addr;
2233         else
2234                 destaddr = msg_destnode(inmsg);
2235
2236         /* Prepare reusable fragment header: */
2237         tipc_msg_init(&fragm_hdr, MSG_FRAGMENTER, FIRST_FRAGMENT,
2238                  INT_H_SIZE, destaddr);
2239
2240         /* Chop up message: */
2241         while (rest > 0) {
2242                 struct sk_buff *fragm;
2243
2244                 if (rest <= fragm_sz) {
2245                         fragm_sz = rest;
2246                         msg_set_type(&fragm_hdr, LAST_FRAGMENT);
2247                 }
2248                 fragm = tipc_buf_acquire(fragm_sz + INT_H_SIZE);
2249                 if (fragm == NULL) {
2250                         kfree_skb(buf);
2251                         kfree_skb_list(buf_chain);
2252                         return -ENOMEM;
2253                 }
2254                 msg_set_size(&fragm_hdr, fragm_sz + INT_H_SIZE);
2255                 fragm_no++;
2256                 msg_set_fragm_no(&fragm_hdr, fragm_no);
2257                 skb_copy_to_linear_data(fragm, &fragm_hdr, INT_H_SIZE);
2258                 skb_copy_to_linear_data_offset(fragm, INT_H_SIZE, crs,
2259                                                fragm_sz);
2260                 buf_chain_tail->next = fragm;
2261                 buf_chain_tail = fragm;
2262
2263                 rest -= fragm_sz;
2264                 crs += fragm_sz;
2265                 msg_set_type(&fragm_hdr, FRAGMENT);
2266         }
2267         kfree_skb(buf);
2268
2269         /* Append chain of fragments to send queue & send them */
2270         l_ptr->long_msg_seq_no++;
2271         link_add_chain_to_outqueue(l_ptr, buf_chain, l_ptr->long_msg_seq_no);
2272         l_ptr->stats.sent_fragments += fragm_no;
2273         l_ptr->stats.sent_fragmented++;
2274         tipc_link_push_queue(l_ptr);
2275
2276         return dsz;
2277 }
2278
2279 /*
2280  * tipc_link_recv_fragment(): Called with node lock on. Returns
2281  * the reassembled buffer if message is complete.
2282  */
2283 int tipc_link_recv_fragment(struct sk_buff **head, struct sk_buff **tail,
2284                             struct sk_buff **fbuf)
2285 {
2286         struct sk_buff *frag = *fbuf;
2287         struct tipc_msg *msg = buf_msg(frag);
2288         u32 fragid = msg_type(msg);
2289         bool headstolen;
2290         int delta;
2291
2292         skb_pull(frag, msg_hdr_sz(msg));
2293         if (fragid == FIRST_FRAGMENT) {
2294                 if (*head || skb_unclone(frag, GFP_ATOMIC))
2295                         goto out_free;
2296                 *head = frag;
2297                 skb_frag_list_init(*head);
2298                 return 0;
2299         } else if (*head &&
2300                    skb_try_coalesce(*head, frag, &headstolen, &delta)) {
2301                 kfree_skb_partial(frag, headstolen);
2302         } else {
2303                 if (!*head)
2304                         goto out_free;
2305                 if (!skb_has_frag_list(*head))
2306                         skb_shinfo(*head)->frag_list = frag;
2307                 else
2308                         (*tail)->next = frag;
2309                 *tail = frag;
2310                 (*head)->truesize += frag->truesize;
2311         }
2312         if (fragid == LAST_FRAGMENT) {
2313                 *fbuf = *head;
2314                 *tail = *head = NULL;
2315                 return LINK_REASM_COMPLETE;
2316         }
2317         return 0;
2318 out_free:
2319         pr_warn_ratelimited("Link unable to reassemble fragmented message\n");
2320         kfree_skb(*fbuf);
2321         return LINK_REASM_ERROR;
2322 }
2323
2324 static void link_set_supervision_props(struct tipc_link *l_ptr, u32 tolerance)
2325 {
2326         if ((tolerance < TIPC_MIN_LINK_TOL) || (tolerance > TIPC_MAX_LINK_TOL))
2327                 return;
2328
2329         l_ptr->tolerance = tolerance;
2330         l_ptr->continuity_interval =
2331                 ((tolerance / 4) > 500) ? 500 : tolerance / 4;
2332         l_ptr->abort_limit = tolerance / (l_ptr->continuity_interval / 4);
2333 }
2334
2335 void tipc_link_set_queue_limits(struct tipc_link *l_ptr, u32 window)
2336 {
2337         /* Data messages from this node, inclusive FIRST_FRAGM */
2338         l_ptr->queue_limit[TIPC_LOW_IMPORTANCE] = window;
2339         l_ptr->queue_limit[TIPC_MEDIUM_IMPORTANCE] = (window / 3) * 4;
2340         l_ptr->queue_limit[TIPC_HIGH_IMPORTANCE] = (window / 3) * 5;
2341         l_ptr->queue_limit[TIPC_CRITICAL_IMPORTANCE] = (window / 3) * 6;
2342         /* Transiting data messages,inclusive FIRST_FRAGM */
2343         l_ptr->queue_limit[TIPC_LOW_IMPORTANCE + 4] = 300;
2344         l_ptr->queue_limit[TIPC_MEDIUM_IMPORTANCE + 4] = 600;
2345         l_ptr->queue_limit[TIPC_HIGH_IMPORTANCE + 4] = 900;
2346         l_ptr->queue_limit[TIPC_CRITICAL_IMPORTANCE + 4] = 1200;
2347         l_ptr->queue_limit[CONN_MANAGER] = 1200;
2348         l_ptr->queue_limit[CHANGEOVER_PROTOCOL] = 2500;
2349         l_ptr->queue_limit[NAME_DISTRIBUTOR] = 3000;
2350         /* FRAGMENT and LAST_FRAGMENT packets */
2351         l_ptr->queue_limit[MSG_FRAGMENTER] = 4000;
2352 }
2353
2354 /**
2355  * link_find_link - locate link by name
2356  * @name: ptr to link name string
2357  * @node: ptr to area to be filled with ptr to associated node
2358  *
2359  * Caller must hold 'tipc_net_lock' to ensure node and bearer are not deleted;
2360  * this also prevents link deletion.
2361  *
2362  * Returns pointer to link (or 0 if invalid link name).
2363  */
2364 static struct tipc_link *link_find_link(const char *name,
2365                                         struct tipc_node **node)
2366 {
2367         struct tipc_link *l_ptr;
2368         struct tipc_node *n_ptr;
2369         int i;
2370
2371         list_for_each_entry(n_ptr, &tipc_node_list, list) {
2372                 for (i = 0; i < MAX_BEARERS; i++) {
2373                         l_ptr = n_ptr->links[i];
2374                         if (l_ptr && !strcmp(l_ptr->name, name))
2375                                 goto found;
2376                 }
2377         }
2378         l_ptr = NULL;
2379         n_ptr = NULL;
2380 found:
2381         *node = n_ptr;
2382         return l_ptr;
2383 }
2384
2385 /**
2386  * link_value_is_valid -- validate proposed link tolerance/priority/window
2387  *
2388  * @cmd: value type (TIPC_CMD_SET_LINK_*)
2389  * @new_value: the new value
2390  *
2391  * Returns 1 if value is within range, 0 if not.
2392  */
2393 static int link_value_is_valid(u16 cmd, u32 new_value)
2394 {
2395         switch (cmd) {
2396         case TIPC_CMD_SET_LINK_TOL:
2397                 return (new_value >= TIPC_MIN_LINK_TOL) &&
2398                         (new_value <= TIPC_MAX_LINK_TOL);
2399         case TIPC_CMD_SET_LINK_PRI:
2400                 return (new_value <= TIPC_MAX_LINK_PRI);
2401         case TIPC_CMD_SET_LINK_WINDOW:
2402                 return (new_value >= TIPC_MIN_LINK_WIN) &&
2403                         (new_value <= TIPC_MAX_LINK_WIN);
2404         }
2405         return 0;
2406 }
2407
2408 /**
2409  * link_cmd_set_value - change priority/tolerance/window for link/bearer/media
2410  * @name: ptr to link, bearer, or media name
2411  * @new_value: new value of link, bearer, or media setting
2412  * @cmd: which link, bearer, or media attribute to set (TIPC_CMD_SET_LINK_*)
2413  *
2414  * Caller must hold 'tipc_net_lock' to ensure link/bearer/media is not deleted.
2415  *
2416  * Returns 0 if value updated and negative value on error.
2417  */
2418 static int link_cmd_set_value(const char *name, u32 new_value, u16 cmd)
2419 {
2420         struct tipc_node *node;
2421         struct tipc_link *l_ptr;
2422         struct tipc_bearer *b_ptr;
2423         struct tipc_media *m_ptr;
2424         int res = 0;
2425
2426         l_ptr = link_find_link(name, &node);
2427         if (l_ptr) {
2428                 /*
2429                  * acquire node lock for tipc_link_send_proto_msg().
2430                  * see "TIPC locking policy" in net.c.
2431                  */
2432                 tipc_node_lock(node);
2433                 switch (cmd) {
2434                 case TIPC_CMD_SET_LINK_TOL:
2435                         link_set_supervision_props(l_ptr, new_value);
2436                         tipc_link_send_proto_msg(l_ptr,
2437                                 STATE_MSG, 0, 0, new_value, 0, 0);
2438                         break;
2439                 case TIPC_CMD_SET_LINK_PRI:
2440                         l_ptr->priority = new_value;
2441                         tipc_link_send_proto_msg(l_ptr,
2442                                 STATE_MSG, 0, 0, 0, new_value, 0);
2443                         break;
2444                 case TIPC_CMD_SET_LINK_WINDOW:
2445                         tipc_link_set_queue_limits(l_ptr, new_value);
2446                         break;
2447                 default:
2448                         res = -EINVAL;
2449                         break;
2450                 }
2451                 tipc_node_unlock(node);
2452                 return res;
2453         }
2454
2455         b_ptr = tipc_bearer_find(name);
2456         if (b_ptr) {
2457                 switch (cmd) {
2458                 case TIPC_CMD_SET_LINK_TOL:
2459                         b_ptr->tolerance = new_value;
2460                         break;
2461                 case TIPC_CMD_SET_LINK_PRI:
2462                         b_ptr->priority = new_value;
2463                         break;
2464                 case TIPC_CMD_SET_LINK_WINDOW:
2465                         b_ptr->window = new_value;
2466                         break;
2467                 default:
2468                         res = -EINVAL;
2469                         break;
2470                 }
2471                 return res;
2472         }
2473
2474         m_ptr = tipc_media_find(name);
2475         if (!m_ptr)
2476                 return -ENODEV;
2477         switch (cmd) {
2478         case TIPC_CMD_SET_LINK_TOL:
2479                 m_ptr->tolerance = new_value;
2480                 break;
2481         case TIPC_CMD_SET_LINK_PRI:
2482                 m_ptr->priority = new_value;
2483                 break;
2484         case TIPC_CMD_SET_LINK_WINDOW:
2485                 m_ptr->window = new_value;
2486                 break;
2487         default:
2488                 res = -EINVAL;
2489                 break;
2490         }
2491         return res;
2492 }
2493
2494 struct sk_buff *tipc_link_cmd_config(const void *req_tlv_area, int req_tlv_space,
2495                                      u16 cmd)
2496 {
2497         struct tipc_link_config *args;
2498         u32 new_value;
2499         int res;
2500
2501         if (!TLV_CHECK(req_tlv_area, req_tlv_space, TIPC_TLV_LINK_CONFIG))
2502                 return tipc_cfg_reply_error_string(TIPC_CFG_TLV_ERROR);
2503
2504         args = (struct tipc_link_config *)TLV_DATA(req_tlv_area);
2505         new_value = ntohl(args->value);
2506
2507         if (!link_value_is_valid(cmd, new_value))
2508                 return tipc_cfg_reply_error_string(
2509                         "cannot change, value invalid");
2510
2511         if (!strcmp(args->name, tipc_bclink_name)) {
2512                 if ((cmd == TIPC_CMD_SET_LINK_WINDOW) &&
2513                     (tipc_bclink_set_queue_limits(new_value) == 0))
2514                         return tipc_cfg_reply_none();
2515                 return tipc_cfg_reply_error_string(TIPC_CFG_NOT_SUPPORTED
2516                                                    " (cannot change setting on broadcast link)");
2517         }
2518
2519         read_lock_bh(&tipc_net_lock);
2520         res = link_cmd_set_value(args->name, new_value, cmd);
2521         read_unlock_bh(&tipc_net_lock);
2522         if (res)
2523                 return tipc_cfg_reply_error_string("cannot change link setting");
2524
2525         return tipc_cfg_reply_none();
2526 }
2527
2528 /**
2529  * link_reset_statistics - reset link statistics
2530  * @l_ptr: pointer to link
2531  */
2532 static void link_reset_statistics(struct tipc_link *l_ptr)
2533 {
2534         memset(&l_ptr->stats, 0, sizeof(l_ptr->stats));
2535         l_ptr->stats.sent_info = l_ptr->next_out_no;
2536         l_ptr->stats.recv_info = l_ptr->next_in_no;
2537 }
2538
2539 struct sk_buff *tipc_link_cmd_reset_stats(const void *req_tlv_area, int req_tlv_space)
2540 {
2541         char *link_name;
2542         struct tipc_link *l_ptr;
2543         struct tipc_node *node;
2544
2545         if (!TLV_CHECK(req_tlv_area, req_tlv_space, TIPC_TLV_LINK_NAME))
2546                 return tipc_cfg_reply_error_string(TIPC_CFG_TLV_ERROR);
2547
2548         link_name = (char *)TLV_DATA(req_tlv_area);
2549         if (!strcmp(link_name, tipc_bclink_name)) {
2550                 if (tipc_bclink_reset_stats())
2551                         return tipc_cfg_reply_error_string("link not found");
2552                 return tipc_cfg_reply_none();
2553         }
2554
2555         read_lock_bh(&tipc_net_lock);
2556         l_ptr = link_find_link(link_name, &node);
2557         if (!l_ptr) {
2558                 read_unlock_bh(&tipc_net_lock);
2559                 return tipc_cfg_reply_error_string("link not found");
2560         }
2561
2562         tipc_node_lock(node);
2563         link_reset_statistics(l_ptr);
2564         tipc_node_unlock(node);
2565         read_unlock_bh(&tipc_net_lock);
2566         return tipc_cfg_reply_none();
2567 }
2568
2569 /**
2570  * percent - convert count to a percentage of total (rounding up or down)
2571  */
2572 static u32 percent(u32 count, u32 total)
2573 {
2574         return (count * 100 + (total / 2)) / total;
2575 }
2576
2577 /**
2578  * tipc_link_stats - print link statistics
2579  * @name: link name
2580  * @buf: print buffer area
2581  * @buf_size: size of print buffer area
2582  *
2583  * Returns length of print buffer data string (or 0 if error)
2584  */
2585 static int tipc_link_stats(const char *name, char *buf, const u32 buf_size)
2586 {
2587         struct tipc_link *l;
2588         struct tipc_stats *s;
2589         struct tipc_node *node;
2590         char *status;
2591         u32 profile_total = 0;
2592         int ret;
2593
2594         if (!strcmp(name, tipc_bclink_name))
2595                 return tipc_bclink_stats(buf, buf_size);
2596
2597         read_lock_bh(&tipc_net_lock);
2598         l = link_find_link(name, &node);
2599         if (!l) {
2600                 read_unlock_bh(&tipc_net_lock);
2601                 return 0;
2602         }
2603         tipc_node_lock(node);
2604         s = &l->stats;
2605
2606         if (tipc_link_is_active(l))
2607                 status = "ACTIVE";
2608         else if (tipc_link_is_up(l))
2609                 status = "STANDBY";
2610         else
2611                 status = "DEFUNCT";
2612
2613         ret = tipc_snprintf(buf, buf_size, "Link <%s>\n"
2614                             "  %s  MTU:%u  Priority:%u  Tolerance:%u ms"
2615                             "  Window:%u packets\n",
2616                             l->name, status, l->max_pkt, l->priority,
2617                             l->tolerance, l->queue_limit[0]);
2618
2619         ret += tipc_snprintf(buf + ret, buf_size - ret,
2620                              "  RX packets:%u fragments:%u/%u bundles:%u/%u\n",
2621                              l->next_in_no - s->recv_info, s->recv_fragments,
2622                              s->recv_fragmented, s->recv_bundles,
2623                              s->recv_bundled);
2624
2625         ret += tipc_snprintf(buf + ret, buf_size - ret,
2626                              "  TX packets:%u fragments:%u/%u bundles:%u/%u\n",
2627                              l->next_out_no - s->sent_info, s->sent_fragments,
2628                              s->sent_fragmented, s->sent_bundles,
2629                              s->sent_bundled);
2630
2631         profile_total = s->msg_length_counts;
2632         if (!profile_total)
2633                 profile_total = 1;
2634
2635         ret += tipc_snprintf(buf + ret, buf_size - ret,
2636                              "  TX profile sample:%u packets  average:%u octets\n"
2637                              "  0-64:%u%% -256:%u%% -1024:%u%% -4096:%u%% "
2638                              "-16384:%u%% -32768:%u%% -66000:%u%%\n",
2639                              s->msg_length_counts,
2640                              s->msg_lengths_total / profile_total,
2641                              percent(s->msg_length_profile[0], profile_total),
2642                              percent(s->msg_length_profile[1], profile_total),
2643                              percent(s->msg_length_profile[2], profile_total),
2644                              percent(s->msg_length_profile[3], profile_total),
2645                              percent(s->msg_length_profile[4], profile_total),
2646                              percent(s->msg_length_profile[5], profile_total),
2647                              percent(s->msg_length_profile[6], profile_total));
2648
2649         ret += tipc_snprintf(buf + ret, buf_size - ret,
2650                              "  RX states:%u probes:%u naks:%u defs:%u"
2651                              " dups:%u\n", s->recv_states, s->recv_probes,
2652                              s->recv_nacks, s->deferred_recv, s->duplicates);
2653
2654         ret += tipc_snprintf(buf + ret, buf_size - ret,
2655                              "  TX states:%u probes:%u naks:%u acks:%u"
2656                              " dups:%u\n", s->sent_states, s->sent_probes,
2657                              s->sent_nacks, s->sent_acks, s->retransmitted);
2658
2659         ret += tipc_snprintf(buf + ret, buf_size - ret,
2660                              "  Congestion link:%u  Send queue"
2661                              " max:%u avg:%u\n", s->link_congs,
2662                              s->max_queue_sz, s->queue_sz_counts ?
2663                              (s->accu_queue_sz / s->queue_sz_counts) : 0);
2664
2665         tipc_node_unlock(node);
2666         read_unlock_bh(&tipc_net_lock);
2667         return ret;
2668 }
2669
2670 struct sk_buff *tipc_link_cmd_show_stats(const void *req_tlv_area, int req_tlv_space)
2671 {
2672         struct sk_buff *buf;
2673         struct tlv_desc *rep_tlv;
2674         int str_len;
2675         int pb_len;
2676         char *pb;
2677
2678         if (!TLV_CHECK(req_tlv_area, req_tlv_space, TIPC_TLV_LINK_NAME))
2679                 return tipc_cfg_reply_error_string(TIPC_CFG_TLV_ERROR);
2680
2681         buf = tipc_cfg_reply_alloc(TLV_SPACE(ULTRA_STRING_MAX_LEN));
2682         if (!buf)
2683                 return NULL;
2684
2685         rep_tlv = (struct tlv_desc *)buf->data;
2686         pb = TLV_DATA(rep_tlv);
2687         pb_len = ULTRA_STRING_MAX_LEN;
2688         str_len = tipc_link_stats((char *)TLV_DATA(req_tlv_area),
2689                                   pb, pb_len);
2690         if (!str_len) {
2691                 kfree_skb(buf);
2692                 return tipc_cfg_reply_error_string("link not found");
2693         }
2694         str_len += 1;   /* for "\0" */
2695         skb_put(buf, TLV_SPACE(str_len));
2696         TLV_SET(rep_tlv, TIPC_TLV_ULTRA_STRING, NULL, str_len);
2697
2698         return buf;
2699 }
2700
2701 /**
2702  * tipc_link_get_max_pkt - get maximum packet size to use when sending to destination
2703  * @dest: network address of destination node
2704  * @selector: used to select from set of active links
2705  *
2706  * If no active link can be found, uses default maximum packet size.
2707  */
2708 u32 tipc_link_get_max_pkt(u32 dest, u32 selector)
2709 {
2710         struct tipc_node *n_ptr;
2711         struct tipc_link *l_ptr;
2712         u32 res = MAX_PKT_DEFAULT;
2713
2714         if (dest == tipc_own_addr)
2715                 return MAX_MSG_SIZE;
2716
2717         read_lock_bh(&tipc_net_lock);
2718         n_ptr = tipc_node_find(dest);
2719         if (n_ptr) {
2720                 tipc_node_lock(n_ptr);
2721                 l_ptr = n_ptr->active_links[selector & 1];
2722                 if (l_ptr)
2723                         res = l_ptr->max_pkt;
2724                 tipc_node_unlock(n_ptr);
2725         }
2726         read_unlock_bh(&tipc_net_lock);
2727         return res;
2728 }
2729
2730 static void link_print(struct tipc_link *l_ptr, const char *str)
2731 {
2732         pr_info("%s Link %x<%s>:", str, l_ptr->addr, l_ptr->b_ptr->name);
2733
2734         if (link_working_unknown(l_ptr))
2735                 pr_cont(":WU\n");
2736         else if (link_reset_reset(l_ptr))
2737                 pr_cont(":RR\n");
2738         else if (link_reset_unknown(l_ptr))
2739                 pr_cont(":RU\n");
2740         else if (link_working_working(l_ptr))
2741                 pr_cont(":WW\n");
2742         else
2743                 pr_cont("\n");
2744 }