Pileus Git - ~andy/linux/blob - net/tipc/link.c

   1 /*
   2  * net/tipc/link.c: TIPC link code
   3  *
   4  * Copyright (c) 1996-2007, 2012-2014, Ericsson AB
   5  * Copyright (c) 2004-2007, 2010-2013, Wind River Systems
   6  * All rights reserved.
   7  *
   8  * Redistribution and use in source and binary forms, with or without
   9  * modification, are permitted provided that the following conditions are met:
  10  *
  11  * 1. Redistributions of source code must retain the above copyright
  12  *    notice, this list of conditions and the following disclaimer.
  13  * 2. Redistributions in binary form must reproduce the above copyright
  14  *    notice, this list of conditions and the following disclaimer in the
  15  *    documentation and/or other materials provided with the distribution.
  16  * 3. Neither the names of the copyright holders nor the names of its
  17  *    contributors may be used to endorse or promote products derived from
  18  *    this software without specific prior written permission.
  19  *
  20  * Alternatively, this software may be distributed under the terms of the
  21  * GNU General Public License ("GPL") version 2 as published by the Free
  22  * Software Foundation.
  23  *
  24  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
  25  * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  26  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  27  * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
  28  * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
  29  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
  30  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
  31  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
  32  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  33  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  34  * POSSIBILITY OF SUCH DAMAGE.
  35  */
  36
  37 #include "core.h"
  38 #include "link.h"
  39 #include "port.h"
  40 #include "name_distr.h"
  41 #include "discover.h"
  42 #include "config.h"
  43
  44 #include <linux/pkt_sched.h>
  45
  46 /*
  47  * Error message prefixes
  48  */
  49 static const char *link_co_err = "Link changeover error, ";
  50 static const char *link_rst_msg = "Resetting link ";
  51 static const char *link_unk_evt = "Unknown link event ";
  52
  53 /*
  54  * Out-of-range value for link session numbers
  55  */
  56 #define INVALID_SESSION 0x10000
  57
  58 /*
  59  * Link state events:
  60  */
  61 #define  STARTING_EVT    856384768      /* link processing trigger */
  62 #define  TRAFFIC_MSG_EVT 560815u        /* rx'd ??? */
  63 #define  TIMEOUT_EVT     560817u        /* link timer expired */
  64
  65 /*
  66  * The following two 'message types' is really just implementation
  67  * data conveniently stored in the message header.
  68  * They must not be considered part of the protocol
  69  */
  70 #define OPEN_MSG   0
  71 #define CLOSED_MSG 1
  72
  73 /*
  74  * State value stored in 'exp_msg_count'
  75  */
  76 #define START_CHANGEOVER 100000u
  77
  78 static void link_handle_out_of_seq_msg(struct tipc_link *l_ptr,
  79                                        struct sk_buff *buf);
  80 static void link_recv_proto_msg(struct tipc_link *l_ptr, struct sk_buff *buf);
  81 static int  tipc_link_tunnel_rcv(struct tipc_link **l_ptr,
  82                                  struct sk_buff **buf);
  83 static void link_set_supervision_props(struct tipc_link *l_ptr, u32 tolerance);
  84 static int  link_send_sections_long(struct tipc_port *sender,
  85                                     struct iovec const *msg_sect,
  86                                     unsigned int len, u32 destnode);
  87 static void link_state_event(struct tipc_link *l_ptr, u32 event);
  88 static void link_reset_statistics(struct tipc_link *l_ptr);
  89 static void link_print(struct tipc_link *l_ptr, const char *str);
  90 static int link_send_long_buf(struct tipc_link *l_ptr, struct sk_buff *buf);
  91 static void tipc_link_send_sync(struct tipc_link *l);
  92 static void tipc_link_recv_sync(struct tipc_node *n, struct sk_buff *buf);
  93
  94 /*
  95  *  Simple link routines
  96  */
  97 static unsigned int align(unsigned int i)
  98 {
  99         return (i + 3) & ~3u;
 100 }
 101
 102 static void link_init_max_pkt(struct tipc_link *l_ptr)
 103 {
 104         u32 max_pkt;
 105
 106         max_pkt = (l_ptr->b_ptr->mtu & ~3);
 107         if (max_pkt > MAX_MSG_SIZE)
 108                 max_pkt = MAX_MSG_SIZE;
 109
 110         l_ptr->max_pkt_target = max_pkt;
 111         if (l_ptr->max_pkt_target < MAX_PKT_DEFAULT)
 112                 l_ptr->max_pkt = l_ptr->max_pkt_target;
 113         else
 114                 l_ptr->max_pkt = MAX_PKT_DEFAULT;
 115
 116         l_ptr->max_pkt_probes = 0;
 117 }
 118
 119 static u32 link_next_sent(struct tipc_link *l_ptr)
 120 {
 121         if (l_ptr->next_out)
 122                 return buf_seqno(l_ptr->next_out);
 123         return mod(l_ptr->next_out_no);
 124 }
 125
 126 static u32 link_last_sent(struct tipc_link *l_ptr)
 127 {
 128         return mod(link_next_sent(l_ptr) - 1);
 129 }
 130
 131 /*
 132  *  Simple non-static link routines (i.e. referenced outside this file)
 133  */
 134 int tipc_link_is_up(struct tipc_link *l_ptr)
 135 {
 136         if (!l_ptr)
 137                 return 0;
 138         return link_working_working(l_ptr) || link_working_unknown(l_ptr);
 139 }
 140
 141 int tipc_link_is_active(struct tipc_link *l_ptr)
 142 {
 143         return  (l_ptr->owner->active_links[0] == l_ptr) ||
 144                 (l_ptr->owner->active_links[1] == l_ptr);
 145 }
 146
 147 /**
 148  * link_timeout - handle expiration of link timer
 149  * @l_ptr: pointer to link
 150  *
 151  * This routine must not grab "tipc_net_lock" to avoid a potential deadlock conflict
 152  * with tipc_link_delete().  (There is no risk that the node will be deleted by
 153  * another thread because tipc_link_delete() always cancels the link timer before
 154  * tipc_node_delete() is called.)
 155  */
 156 static void link_timeout(struct tipc_link *l_ptr)
 157 {
 158         tipc_node_lock(l_ptr->owner);
 159
 160         /* update counters used in statistical profiling of send traffic */
 161         l_ptr->stats.accu_queue_sz += l_ptr->out_queue_size;
 162         l_ptr->stats.queue_sz_counts++;
 163
 164         if (l_ptr->first_out) {
 165                 struct tipc_msg *msg = buf_msg(l_ptr->first_out);
 166                 u32 length = msg_size(msg);
 167
 168                 if ((msg_user(msg) == MSG_FRAGMENTER) &&
 169                     (msg_type(msg) == FIRST_FRAGMENT)) {
 170                         length = msg_size(msg_get_wrapped(msg));
 171                 }
 172                 if (length) {
 173                         l_ptr->stats.msg_lengths_total += length;
 174                         l_ptr->stats.msg_length_counts++;
 175                         if (length <= 64)
 176                                 l_ptr->stats.msg_length_profile[0]++;
 177                         else if (length <= 256)
 178                                 l_ptr->stats.msg_length_profile[1]++;
 179                         else if (length <= 1024)
 180                                 l_ptr->stats.msg_length_profile[2]++;
 181                         else if (length <= 4096)
 182                                 l_ptr->stats.msg_length_profile[3]++;
 183                         else if (length <= 16384)
 184                                 l_ptr->stats.msg_length_profile[4]++;
 185                         else if (length <= 32768)
 186                                 l_ptr->stats.msg_length_profile[5]++;
 187                         else
 188                                 l_ptr->stats.msg_length_profile[6]++;
 189                 }
 190         }
 191
 192         /* do all other link processing performed on a periodic basis */
 193
 194         link_state_event(l_ptr, TIMEOUT_EVT);
 195
 196         if (l_ptr->next_out)
 197                 tipc_link_push_queue(l_ptr);
 198
 199         tipc_node_unlock(l_ptr->owner);
 200 }
 201
 202 static void link_set_timer(struct tipc_link *l_ptr, u32 time)
 203 {
 204         k_start_timer(&l_ptr->timer, time);
 205 }
 206
 207 /**
 208  * tipc_link_create - create a new link
 209  * @n_ptr: pointer to associated node
 210  * @b_ptr: pointer to associated bearer
 211  * @media_addr: media address to use when sending messages over link
 212  *
 213  * Returns pointer to link.
 214  */
 215 struct tipc_link *tipc_link_create(struct tipc_node *n_ptr,
 216                               struct tipc_bearer *b_ptr,
 217                               const struct tipc_media_addr *media_addr)
 218 {
 219         struct tipc_link *l_ptr;
 220         struct tipc_msg *msg;
 221         char *if_name;
 222         char addr_string[16];
 223         u32 peer = n_ptr->addr;
 224
 225         if (n_ptr->link_cnt >= 2) {
 226                 tipc_addr_string_fill(addr_string, n_ptr->addr);
 227                 pr_err("Attempt to establish third link to %s\n", addr_string);
 228                 return NULL;
 229         }
 230
 231         if (n_ptr->links[b_ptr->identity]) {
 232                 tipc_addr_string_fill(addr_string, n_ptr->addr);
 233                 pr_err("Attempt to establish second link on <%s> to %s\n",
 234                        b_ptr->name, addr_string);
 235                 return NULL;
 236         }
 237
 238         l_ptr = kzalloc(sizeof(*l_ptr), GFP_ATOMIC);
 239         if (!l_ptr) {
 240                 pr_warn("Link creation failed, no memory\n");
 241                 return NULL;
 242         }
 243
 244         l_ptr->addr = peer;
 245         if_name = strchr(b_ptr->name, ':') + 1;
 246         sprintf(l_ptr->name, "%u.%u.%u:%s-%u.%u.%u:unknown",
 247                 tipc_zone(tipc_own_addr), tipc_cluster(tipc_own_addr),
 248                 tipc_node(tipc_own_addr),
 249                 if_name,
 250                 tipc_zone(peer), tipc_cluster(peer), tipc_node(peer));
 251                 /* note: peer i/f name is updated by reset/activate message */
 252         memcpy(&l_ptr->media_addr, media_addr, sizeof(*media_addr));
 253         l_ptr->owner = n_ptr;
 254         l_ptr->checkpoint = 1;
 255         l_ptr->peer_session = INVALID_SESSION;
 256         l_ptr->b_ptr = b_ptr;
 257         link_set_supervision_props(l_ptr, b_ptr->tolerance);
 258         l_ptr->state = RESET_UNKNOWN;
 259
 260         l_ptr->pmsg = (struct tipc_msg *)&l_ptr->proto_msg;
 261         msg = l_ptr->pmsg;
 262         tipc_msg_init(msg, LINK_PROTOCOL, RESET_MSG, INT_H_SIZE, l_ptr->addr);
 263         msg_set_size(msg, sizeof(l_ptr->proto_msg));
 264         msg_set_session(msg, (tipc_random & 0xffff));
 265         msg_set_bearer_id(msg, b_ptr->identity);
 266         strcpy((char *)msg_data(msg), if_name);
 267
 268         l_ptr->priority = b_ptr->priority;
 269         tipc_link_set_queue_limits(l_ptr, b_ptr->window);
 270
 271         link_init_max_pkt(l_ptr);
 272
 273         l_ptr->next_out_no = 1;
 274         INIT_LIST_HEAD(&l_ptr->waiting_ports);
 275
 276         link_reset_statistics(l_ptr);
 277
 278         tipc_node_attach_link(n_ptr, l_ptr);
 279
 280         k_init_timer(&l_ptr->timer, (Handler)link_timeout,
 281                      (unsigned long)l_ptr);
 282         list_add_tail(&l_ptr->link_list, &b_ptr->links);
 283
 284         link_state_event(l_ptr, STARTING_EVT);
 285
 286         return l_ptr;
 287 }
 288
 289 /**
 290  * tipc_link_delete - delete a link
 291  * @l_ptr: pointer to link
 292  *
 293  * Note: 'tipc_net_lock' is write_locked, bearer is locked.
 294  * This routine must not grab the node lock until after link timer cancellation
 295  * to avoid a potential deadlock situation.
 296  */
 297 void tipc_link_delete(struct tipc_link *l_ptr)
 298 {
 299         if (!l_ptr) {
 300                 pr_err("Attempt to delete non-existent link\n");
 301                 return;
 302         }
 303
 304         k_cancel_timer(&l_ptr->timer);
 305
 306         tipc_node_lock(l_ptr->owner);
 307         tipc_link_reset(l_ptr);
 308         tipc_node_detach_link(l_ptr->owner, l_ptr);
 309         tipc_link_purge_queues(l_ptr);
 310         list_del_init(&l_ptr->link_list);
 311         tipc_node_unlock(l_ptr->owner);
 312         k_term_timer(&l_ptr->timer);
 313         kfree(l_ptr);
 314 }
 315
 316
 317 /**
 318  * link_schedule_port - schedule port for deferred sending
 319  * @l_ptr: pointer to link
 320  * @origport: reference to sending port
 321  * @sz: amount of data to be sent
 322  *
 323  * Schedules port for renewed sending of messages after link congestion
 324  * has abated.
 325  */
 326 static int link_schedule_port(struct tipc_link *l_ptr, u32 origport, u32 sz)
 327 {
 328         struct tipc_port *p_ptr;
 329
 330         spin_lock_bh(&tipc_port_list_lock);
 331         p_ptr = tipc_port_lock(origport);
 332         if (p_ptr) {
 333                 if (!p_ptr->wakeup)
 334                         goto exit;
 335                 if (!list_empty(&p_ptr->wait_list))
 336                         goto exit;
 337                 p_ptr->congested = 1;
 338                 p_ptr->waiting_pkts = 1 + ((sz - 1) / l_ptr->max_pkt);
 339                 list_add_tail(&p_ptr->wait_list, &l_ptr->waiting_ports);
 340                 l_ptr->stats.link_congs++;
 341 exit:
 342                 tipc_port_unlock(p_ptr);
 343         }
 344         spin_unlock_bh(&tipc_port_list_lock);
 345         return -ELINKCONG;
 346 }
 347
 348 void tipc_link_wakeup_ports(struct tipc_link *l_ptr, int all)
 349 {
 350         struct tipc_port *p_ptr;
 351         struct tipc_port *temp_p_ptr;
 352         int win = l_ptr->queue_limit[0] - l_ptr->out_queue_size;
 353
 354         if (all)
 355                 win = 100000;
 356         if (win <= 0)
 357                 return;
 358         if (!spin_trylock_bh(&tipc_port_list_lock))
 359                 return;
 360         if (link_congested(l_ptr))
 361                 goto exit;
 362         list_for_each_entry_safe(p_ptr, temp_p_ptr, &l_ptr->waiting_ports,
 363                                  wait_list) {
 364                 if (win <= 0)
 365                         break;
 366                 list_del_init(&p_ptr->wait_list);
 367                 spin_lock_bh(p_ptr->lock);
 368                 p_ptr->congested = 0;
 369                 p_ptr->wakeup(p_ptr);
 370                 win -= p_ptr->waiting_pkts;
 371                 spin_unlock_bh(p_ptr->lock);
 372         }
 373
 374 exit:
 375         spin_unlock_bh(&tipc_port_list_lock);
 376 }
 377
 378 /**
 379  * link_release_outqueue - purge link's outbound message queue
 380  * @l_ptr: pointer to link
 381  */
 382 static void link_release_outqueue(struct tipc_link *l_ptr)
 383 {
 384         kfree_skb_list(l_ptr->first_out);
 385         l_ptr->first_out = NULL;
 386         l_ptr->out_queue_size = 0;
 387 }
 388
 389 /**
 390  * tipc_link_reset_fragments - purge link's inbound message fragments queue
 391  * @l_ptr: pointer to link
 392  */
 393 void tipc_link_reset_fragments(struct tipc_link *l_ptr)
 394 {
 395         kfree_skb(l_ptr->reasm_head);
 396         l_ptr->reasm_head = NULL;
 397         l_ptr->reasm_tail = NULL;
 398 }
 399
 400 /**
 401  * tipc_link_purge_queues - purge all pkt queues associated with link
 402  * @l_ptr: pointer to link
 403  */
 404 void tipc_link_purge_queues(struct tipc_link *l_ptr)
 405 {
 406         kfree_skb_list(l_ptr->oldest_deferred_in);
 407         kfree_skb_list(l_ptr->first_out);
 408         tipc_link_reset_fragments(l_ptr);
 409         kfree_skb(l_ptr->proto_msg_queue);
 410         l_ptr->proto_msg_queue = NULL;
 411 }
 412
 413 void tipc_link_reset(struct tipc_link *l_ptr)
 414 {
 415         u32 prev_state = l_ptr->state;
 416         u32 checkpoint = l_ptr->next_in_no;
 417         int was_active_link = tipc_link_is_active(l_ptr);
 418
 419         msg_set_session(l_ptr->pmsg, ((msg_session(l_ptr->pmsg) + 1) & 0xffff));
 420
 421         /* Link is down, accept any session */
 422         l_ptr->peer_session = INVALID_SESSION;
 423
 424         /* Prepare for max packet size negotiation */
 425         link_init_max_pkt(l_ptr);
 426
 427         l_ptr->state = RESET_UNKNOWN;
 428
 429         if ((prev_state == RESET_UNKNOWN) || (prev_state == RESET_RESET))
 430                 return;
 431
 432         tipc_node_link_down(l_ptr->owner, l_ptr);
 433         tipc_bearer_remove_dest(l_ptr->b_ptr, l_ptr->addr);
 434
 435         if (was_active_link && tipc_node_active_links(l_ptr->owner)) {
 436                 l_ptr->reset_checkpoint = checkpoint;
 437                 l_ptr->exp_msg_count = START_CHANGEOVER;
 438         }
 439
 440         /* Clean up all queues: */
 441         link_release_outqueue(l_ptr);
 442         kfree_skb(l_ptr->proto_msg_queue);
 443         l_ptr->proto_msg_queue = NULL;
 444         kfree_skb_list(l_ptr->oldest_deferred_in);
 445         if (!list_empty(&l_ptr->waiting_ports))
 446                 tipc_link_wakeup_ports(l_ptr, 1);
 447
 448         l_ptr->retransm_queue_head = 0;
 449         l_ptr->retransm_queue_size = 0;
 450         l_ptr->last_out = NULL;
 451         l_ptr->first_out = NULL;
 452         l_ptr->next_out = NULL;
 453         l_ptr->unacked_window = 0;
 454         l_ptr->checkpoint = 1;
 455         l_ptr->next_out_no = 1;
 456         l_ptr->deferred_inqueue_sz = 0;
 457         l_ptr->oldest_deferred_in = NULL;
 458         l_ptr->newest_deferred_in = NULL;
 459         l_ptr->fsm_msg_cnt = 0;
 460         l_ptr->stale_count = 0;
 461         link_reset_statistics(l_ptr);
 462 }
 463
 464
 465 static void link_activate(struct tipc_link *l_ptr)
 466 {
 467         l_ptr->next_in_no = l_ptr->stats.recv_info = 1;
 468         tipc_node_link_up(l_ptr->owner, l_ptr);
 469         tipc_bearer_add_dest(l_ptr->b_ptr, l_ptr->addr);
 470 }
 471
 472 /**
 473  * link_state_event - link finite state machine
 474  * @l_ptr: pointer to link
 475  * @event: state machine event to process
 476  */
 477 static void link_state_event(struct tipc_link *l_ptr, unsigned int event)
 478 {
 479         struct tipc_link *other;
 480         u32 cont_intv = l_ptr->continuity_interval;
 481
 482         if (!l_ptr->started && (event != STARTING_EVT))
 483                 return;         /* Not yet. */
 484
 485         /* Check whether changeover is going on */
 486         if (l_ptr->exp_msg_count) {
 487                 if (event == TIMEOUT_EVT)
 488                         link_set_timer(l_ptr, cont_intv);
 489                 return;
 490         }
 491
 492         switch (l_ptr->state) {
 493         case WORKING_WORKING:
 494                 switch (event) {
 495                 case TRAFFIC_MSG_EVT:
 496                 case ACTIVATE_MSG:
 497                         break;
 498                 case TIMEOUT_EVT:
 499                         if (l_ptr->next_in_no != l_ptr->checkpoint) {
 500                                 l_ptr->checkpoint = l_ptr->next_in_no;
 501                                 if (tipc_bclink_acks_missing(l_ptr->owner)) {
 502                                         tipc_link_send_proto_msg(l_ptr, STATE_MSG,
 503                                                                  0, 0, 0, 0, 0);
 504                                         l_ptr->fsm_msg_cnt++;
 505                                 } else if (l_ptr->max_pkt < l_ptr->max_pkt_target) {
 506                                         tipc_link_send_proto_msg(l_ptr, STATE_MSG,
 507                                                                  1, 0, 0, 0, 0);
 508                                         l_ptr->fsm_msg_cnt++;
 509                                 }
 510                                 link_set_timer(l_ptr, cont_intv);
 511                                 break;
 512                         }
 513                         l_ptr->state = WORKING_UNKNOWN;
 514                         l_ptr->fsm_msg_cnt = 0;
 515                         tipc_link_send_proto_msg(l_ptr, STATE_MSG, 1, 0, 0, 0, 0);
 516                         l_ptr->fsm_msg_cnt++;
 517                         link_set_timer(l_ptr, cont_intv / 4);
 518                         break;
 519                 case RESET_MSG:
 520                         pr_info("%s<%s>, requested by peer\n", link_rst_msg,
 521                                 l_ptr->name);
 522                         tipc_link_reset(l_ptr);
 523                         l_ptr->state = RESET_RESET;
 524                         l_ptr->fsm_msg_cnt = 0;
 525                         tipc_link_send_proto_msg(l_ptr, ACTIVATE_MSG, 0, 0, 0, 0, 0);
 526                         l_ptr->fsm_msg_cnt++;
 527                         link_set_timer(l_ptr, cont_intv);
 528                         break;
 529                 default:
 530                         pr_err("%s%u in WW state\n", link_unk_evt, event);
 531                 }
 532                 break;
 533         case WORKING_UNKNOWN:
 534                 switch (event) {
 535                 case TRAFFIC_MSG_EVT:
 536                 case ACTIVATE_MSG:
 537                         l_ptr->state = WORKING_WORKING;
 538                         l_ptr->fsm_msg_cnt = 0;
 539                         link_set_timer(l_ptr, cont_intv);
 540                         break;
 541                 case RESET_MSG:
 542                         pr_info("%s<%s>, requested by peer while probing\n",
 543                                 link_rst_msg, l_ptr->name);
 544                         tipc_link_reset(l_ptr);
 545                         l_ptr->state = RESET_RESET;
 546                         l_ptr->fsm_msg_cnt = 0;
 547                         tipc_link_send_proto_msg(l_ptr, ACTIVATE_MSG, 0, 0, 0, 0, 0);
 548                         l_ptr->fsm_msg_cnt++;
 549                         link_set_timer(l_ptr, cont_intv);
 550                         break;
 551                 case TIMEOUT_EVT:
 552                         if (l_ptr->next_in_no != l_ptr->checkpoint) {
 553                                 l_ptr->state = WORKING_WORKING;
 554                                 l_ptr->fsm_msg_cnt = 0;
 555                                 l_ptr->checkpoint = l_ptr->next_in_no;
 556                                 if (tipc_bclink_acks_missing(l_ptr->owner)) {
 557                                         tipc_link_send_proto_msg(l_ptr, STATE_MSG,
 558                                                                  0, 0, 0, 0, 0);
 559                                         l_ptr->fsm_msg_cnt++;
 560                                 }
 561                                 link_set_timer(l_ptr, cont_intv);
 562                         } else if (l_ptr->fsm_msg_cnt < l_ptr->abort_limit) {
 563                                 tipc_link_send_proto_msg(l_ptr, STATE_MSG,
 564                                                          1, 0, 0, 0, 0);
 565                                 l_ptr->fsm_msg_cnt++;
 566                                 link_set_timer(l_ptr, cont_intv / 4);
 567                         } else {        /* Link has failed */
 568                                 pr_warn("%s<%s>, peer not responding\n",
 569                                         link_rst_msg, l_ptr->name);
 570                                 tipc_link_reset(l_ptr);
 571                                 l_ptr->state = RESET_UNKNOWN;
 572                                 l_ptr->fsm_msg_cnt = 0;
 573                                 tipc_link_send_proto_msg(l_ptr, RESET_MSG,
 574                                                          0, 0, 0, 0, 0);
 575                                 l_ptr->fsm_msg_cnt++;
 576                                 link_set_timer(l_ptr, cont_intv);
 577                         }
 578                         break;
 579                 default:
 580                         pr_err("%s%u in WU state\n", link_unk_evt, event);
 581                 }
 582                 break;
 583         case RESET_UNKNOWN:
 584                 switch (event) {
 585                 case TRAFFIC_MSG_EVT:
 586                         break;
 587                 case ACTIVATE_MSG:
 588                         other = l_ptr->owner->active_links[0];
 589                         if (other && link_working_unknown(other))
 590                                 break;
 591                         l_ptr->state = WORKING_WORKING;
 592                         l_ptr->fsm_msg_cnt = 0;
 593                         link_activate(l_ptr);
 594                         tipc_link_send_proto_msg(l_ptr, STATE_MSG, 1, 0, 0, 0, 0);
 595                         l_ptr->fsm_msg_cnt++;
 596                         if (l_ptr->owner->working_links == 1)
 597                                 tipc_link_send_sync(l_ptr);
 598                         link_set_timer(l_ptr, cont_intv);
 599                         break;
 600                 case RESET_MSG:
 601                         l_ptr->state = RESET_RESET;
 602                         l_ptr->fsm_msg_cnt = 0;
 603                         tipc_link_send_proto_msg(l_ptr, ACTIVATE_MSG, 1, 0, 0, 0, 0);
 604                         l_ptr->fsm_msg_cnt++;
 605                         link_set_timer(l_ptr, cont_intv);
 606                         break;
 607                 case STARTING_EVT:
 608                         l_ptr->started = 1;
 609                         /* fall through */
 610                 case TIMEOUT_EVT:
 611                         tipc_link_send_proto_msg(l_ptr, RESET_MSG, 0, 0, 0, 0, 0);
 612                         l_ptr->fsm_msg_cnt++;
 613                         link_set_timer(l_ptr, cont_intv);
 614                         break;
 615                 default:
 616                         pr_err("%s%u in RU state\n", link_unk_evt, event);
 617                 }
 618                 break;
 619         case RESET_RESET:
 620                 switch (event) {
 621                 case TRAFFIC_MSG_EVT:
 622                 case ACTIVATE_MSG:
 623                         other = l_ptr->owner->active_links[0];
 624                         if (other && link_working_unknown(other))
 625                                 break;
 626                         l_ptr->state = WORKING_WORKING;
 627                         l_ptr->fsm_msg_cnt = 0;
 628                         link_activate(l_ptr);
 629                         tipc_link_send_proto_msg(l_ptr, STATE_MSG, 1, 0, 0, 0, 0);
 630                         l_ptr->fsm_msg_cnt++;
 631                         if (l_ptr->owner->working_links == 1)
 632                                 tipc_link_send_sync(l_ptr);
 633                         link_set_timer(l_ptr, cont_intv);
 634                         break;
 635                 case RESET_MSG:
 636                         break;
 637                 case TIMEOUT_EVT:
 638                         tipc_link_send_proto_msg(l_ptr, ACTIVATE_MSG, 0, 0, 0, 0, 0);
 639                         l_ptr->fsm_msg_cnt++;
 640                         link_set_timer(l_ptr, cont_intv);
 641                         break;
 642                 default:
 643                         pr_err("%s%u in RR state\n", link_unk_evt, event);
 644                 }
 645                 break;
 646         default:
 647                 pr_err("Unknown link state %u/%u\n", l_ptr->state, event);
 648         }
 649 }
 650
 651 /*
 652  * link_bundle_buf(): Append contents of a buffer to
 653  * the tail of an existing one.
 654  */
 655 static int link_bundle_buf(struct tipc_link *l_ptr, struct sk_buff *bundler,
 656                            struct sk_buff *buf)
 657 {
 658         struct tipc_msg *bundler_msg = buf_msg(bundler);
 659         struct tipc_msg *msg = buf_msg(buf);
 660         u32 size = msg_size(msg);
 661         u32 bundle_size = msg_size(bundler_msg);
 662         u32 to_pos = align(bundle_size);
 663         u32 pad = to_pos - bundle_size;
 664
 665         if (msg_user(bundler_msg) != MSG_BUNDLER)
 666                 return 0;
 667         if (msg_type(bundler_msg) != OPEN_MSG)
 668                 return 0;
 669         if (skb_tailroom(bundler) < (pad + size))
 670                 return 0;
 671         if (l_ptr->max_pkt < (to_pos + size))
 672                 return 0;
 673
 674         skb_put(bundler, pad + size);
 675         skb_copy_to_linear_data_offset(bundler, to_pos, buf->data, size);
 676         msg_set_size(bundler_msg, to_pos + size);
 677         msg_set_msgcnt(bundler_msg, msg_msgcnt(bundler_msg) + 1);
 678         kfree_skb(buf);
 679         l_ptr->stats.sent_bundled++;
 680         return 1;
 681 }
 682
 683 static void link_add_to_outqueue(struct tipc_link *l_ptr,
 684                                  struct sk_buff *buf,
 685                                  struct tipc_msg *msg)
 686 {
 687         u32 ack = mod(l_ptr->next_in_no - 1);
 688         u32 seqno = mod(l_ptr->next_out_no++);
 689
 690         msg_set_word(msg, 2, ((ack << 16) | seqno));
 691         msg_set_bcast_ack(msg, l_ptr->owner->bclink.last_in);
 692         buf->next = NULL;
 693         if (l_ptr->first_out) {
 694                 l_ptr->last_out->next = buf;
 695                 l_ptr->last_out = buf;
 696         } else
 697                 l_ptr->first_out = l_ptr->last_out = buf;
 698
 699         l_ptr->out_queue_size++;
 700         if (l_ptr->out_queue_size > l_ptr->stats.max_queue_sz)
 701                 l_ptr->stats.max_queue_sz = l_ptr->out_queue_size;
 702 }
 703
 704 static void link_add_chain_to_outqueue(struct tipc_link *l_ptr,
 705                                        struct sk_buff *buf_chain,
 706                                        u32 long_msgno)
 707 {
 708         struct sk_buff *buf;
 709         struct tipc_msg *msg;
 710
 711         if (!l_ptr->next_out)
 712                 l_ptr->next_out = buf_chain;
 713         while (buf_chain) {
 714                 buf = buf_chain;
 715                 buf_chain = buf_chain->next;
 716
 717                 msg = buf_msg(buf);
 718                 msg_set_long_msgno(msg, long_msgno);
 719                 link_add_to_outqueue(l_ptr, buf, msg);
 720         }
 721 }
 722
 723 /*
 724  * tipc_link_send_buf() is the 'full path' for messages, called from
 725  * inside TIPC when the 'fast path' in tipc_send_buf
 726  * has failed, and from link_send()
 727  */
 728 int tipc_link_send_buf(struct tipc_link *l_ptr, struct sk_buff *buf)
 729 {
 730         struct tipc_msg *msg = buf_msg(buf);
 731         u32 size = msg_size(msg);
 732         u32 dsz = msg_data_sz(msg);
 733         u32 queue_size = l_ptr->out_queue_size;
 734         u32 imp = tipc_msg_tot_importance(msg);
 735         u32 queue_limit = l_ptr->queue_limit[imp];
 736         u32 max_packet = l_ptr->max_pkt;
 737
 738         /* Match msg importance against queue limits: */
 739         if (unlikely(queue_size >= queue_limit)) {
 740                 if (imp <= TIPC_CRITICAL_IMPORTANCE) {
 741                         link_schedule_port(l_ptr, msg_origport(msg), size);
 742                         kfree_skb(buf);
 743                         return -ELINKCONG;
 744                 }
 745                 kfree_skb(buf);
 746                 if (imp > CONN_MANAGER) {
 747                         pr_warn("%s<%s>, send queue full", link_rst_msg,
 748                                 l_ptr->name);
 749                         tipc_link_reset(l_ptr);
 750                 }
 751                 return dsz;
 752         }
 753
 754         /* Fragmentation needed ? */
 755         if (size > max_packet)
 756                 return link_send_long_buf(l_ptr, buf);
 757
 758         /* Packet can be queued or sent. */
 759         if (likely(!link_congested(l_ptr))) {
 760                 link_add_to_outqueue(l_ptr, buf, msg);
 761
 762                 tipc_bearer_send(l_ptr->b_ptr, buf, &l_ptr->media_addr);
 763                 l_ptr->unacked_window = 0;
 764                 return dsz;
 765         }
 766         /* Congestion: can message be bundled ? */
 767         if ((msg_user(msg) != CHANGEOVER_PROTOCOL) &&
 768             (msg_user(msg) != MSG_FRAGMENTER)) {
 769
 770                 /* Try adding message to an existing bundle */
 771                 if (l_ptr->next_out &&
 772                     link_bundle_buf(l_ptr, l_ptr->last_out, buf))
 773                         return dsz;
 774
 775                 /* Try creating a new bundle */
 776                 if (size <= max_packet * 2 / 3) {
 777                         struct sk_buff *bundler = tipc_buf_acquire(max_packet);
 778                         struct tipc_msg bundler_hdr;
 779
 780                         if (bundler) {
 781                                 tipc_msg_init(&bundler_hdr, MSG_BUNDLER, OPEN_MSG,
 782                                          INT_H_SIZE, l_ptr->addr);
 783                                 skb_copy_to_linear_data(bundler, &bundler_hdr,
 784                                                         INT_H_SIZE);
 785                                 skb_trim(bundler, INT_H_SIZE);
 786                                 link_bundle_buf(l_ptr, bundler, buf);
 787                                 buf = bundler;
 788                                 msg = buf_msg(buf);
 789                                 l_ptr->stats.sent_bundles++;
 790                         }
 791                 }
 792         }
 793         if (!l_ptr->next_out)
 794                 l_ptr->next_out = buf;
 795         link_add_to_outqueue(l_ptr, buf, msg);
 796         return dsz;
 797 }
 798
 799 /*
 800  * tipc_link_send(): same as tipc_link_send_buf(), but the link to use has
 801  * not been selected yet, and the the owner node is not locked
 802  * Called by TIPC internal users, e.g. the name distributor
 803  */
 804 int tipc_link_send(struct sk_buff *buf, u32 dest, u32 selector)
 805 {
 806         struct tipc_link *l_ptr;
 807         struct tipc_node *n_ptr;
 808         int res = -ELINKCONG;
 809
 810         read_lock_bh(&tipc_net_lock);
 811         n_ptr = tipc_node_find(dest);
 812         if (n_ptr) {
 813                 tipc_node_lock(n_ptr);
 814                 l_ptr = n_ptr->active_links[selector & 1];
 815                 if (l_ptr)
 816                         res = tipc_link_send_buf(l_ptr, buf);
 817                 else
 818                         kfree_skb(buf);
 819                 tipc_node_unlock(n_ptr);
 820         } else {
 821                 kfree_skb(buf);
 822         }
 823         read_unlock_bh(&tipc_net_lock);
 824         return res;
 825 }
 826
 827 /*
 828  * tipc_link_send_sync - synchronize broadcast link endpoints.
 829  *
 830  * Give a newly added peer node the sequence number where it should
 831  * start receiving and acking broadcast packets.
 832  *
 833  * Called with node locked
 834  */
 835 static void tipc_link_send_sync(struct tipc_link *l)
 836 {
 837         struct sk_buff *buf;
 838         struct tipc_msg *msg;
 839
 840         buf = tipc_buf_acquire(INT_H_SIZE);
 841         if (!buf)
 842                 return;
 843
 844         msg = buf_msg(buf);
 845         tipc_msg_init(msg, BCAST_PROTOCOL, STATE_MSG, INT_H_SIZE, l->addr);
 846         msg_set_last_bcast(msg, l->owner->bclink.acked);
 847         link_add_chain_to_outqueue(l, buf, 0);
 848         tipc_link_push_queue(l);
 849 }
 850
 851 /*
 852  * tipc_link_recv_sync - synchronize broadcast link endpoints.
 853  * Receive the sequence number where we should start receiving and
 854  * acking broadcast packets from a newly added peer node, and open
 855  * up for reception of such packets.
 856  *
 857  * Called with node locked
 858  */
 859 static void tipc_link_recv_sync(struct tipc_node *n, struct sk_buff *buf)
 860 {
 861         struct tipc_msg *msg = buf_msg(buf);
 862
 863         n->bclink.last_sent = n->bclink.last_in = msg_last_bcast(msg);
 864         n->bclink.recv_permitted = true;
 865         kfree_skb(buf);
 866 }
 867
 868 /*
 869  * tipc_link_send_names - send name table entries to new neighbor
 870  *
 871  * Send routine for bulk delivery of name table messages when contact
 872  * with a new neighbor occurs. No link congestion checking is performed
 873  * because name table messages *must* be delivered. The messages must be
 874  * small enough not to require fragmentation.
 875  * Called without any locks held.
 876  */
 877 void tipc_link_send_names(struct list_head *message_list, u32 dest)
 878 {
 879         struct tipc_node *n_ptr;
 880         struct tipc_link *l_ptr;
 881         struct sk_buff *buf;
 882         struct sk_buff *temp_buf;
 883
 884         if (list_empty(message_list))
 885                 return;
 886
 887         read_lock_bh(&tipc_net_lock);
 888         n_ptr = tipc_node_find(dest);
 889         if (n_ptr) {
 890                 tipc_node_lock(n_ptr);
 891                 l_ptr = n_ptr->active_links[0];
 892                 if (l_ptr) {
 893                         /* convert circular list to linear list */
 894                         ((struct sk_buff *)message_list->prev)->next = NULL;
 895                         link_add_chain_to_outqueue(l_ptr,
 896                                 (struct sk_buff *)message_list->next, 0);
 897                         tipc_link_push_queue(l_ptr);
 898                         INIT_LIST_HEAD(message_list);
 899                 }
 900                 tipc_node_unlock(n_ptr);
 901         }
 902         read_unlock_bh(&tipc_net_lock);
 903
 904         /* discard the messages if they couldn't be sent */
 905         list_for_each_safe(buf, temp_buf, ((struct sk_buff *)message_list)) {
 906                 list_del((struct list_head *)buf);
 907                 kfree_skb(buf);
 908         }
 909 }
 910
 911 /*
 912  * link_send_buf_fast: Entry for data messages where the
 913  * destination link is known and the header is complete,
 914  * inclusive total message length. Very time critical.
 915  * Link is locked. Returns user data length.
 916  */
 917 static int link_send_buf_fast(struct tipc_link *l_ptr, struct sk_buff *buf,
 918                               u32 *used_max_pkt)
 919 {
 920         struct tipc_msg *msg = buf_msg(buf);
 921         int res = msg_data_sz(msg);
 922
 923         if (likely(!link_congested(l_ptr))) {
 924                 if (likely(msg_size(msg) <= l_ptr->max_pkt)) {
 925                         link_add_to_outqueue(l_ptr, buf, msg);
 926                         tipc_bearer_send(l_ptr->b_ptr, buf,
 927                                          &l_ptr->media_addr);
 928                         l_ptr->unacked_window = 0;
 929                         return res;
 930                 }
 931                 else
 932                         *used_max_pkt = l_ptr->max_pkt;
 933         }
 934         return tipc_link_send_buf(l_ptr, buf);  /* All other cases */
 935 }
 936
 937 /*
 938  * tipc_link_send_sections_fast: Entry for messages where the
 939  * destination processor is known and the header is complete,
 940  * except for total message length.
 941  * Returns user data length or errno.
 942  */
 943 int tipc_link_send_sections_fast(struct tipc_port *sender,
 944                                  struct iovec const *msg_sect,
 945                                  unsigned int len, u32 destaddr)
 946 {
 947         struct tipc_msg *hdr = &sender->phdr;
 948         struct tipc_link *l_ptr;
 949         struct sk_buff *buf;
 950         struct tipc_node *node;
 951         int res;
 952         u32 selector = msg_origport(hdr) & 1;
 953
 954 again:
 955         /*
 956          * Try building message using port's max_pkt hint.
 957          * (Must not hold any locks while building message.)
 958          */
 959         res = tipc_msg_build(hdr, msg_sect, len, sender->max_pkt, &buf);
 960         /* Exit if build request was invalid */
 961         if (unlikely(res < 0))
 962                 return res;
 963
 964         read_lock_bh(&tipc_net_lock);
 965         node = tipc_node_find(destaddr);
 966         if (likely(node)) {
 967                 tipc_node_lock(node);
 968                 l_ptr = node->active_links[selector];
 969                 if (likely(l_ptr)) {
 970                         if (likely(buf)) {
 971                                 res = link_send_buf_fast(l_ptr, buf,
 972                                                          &sender->max_pkt);
 973 exit:
 974                                 tipc_node_unlock(node);
 975                                 read_unlock_bh(&tipc_net_lock);
 976                                 return res;
 977                         }
 978
 979                         /* Exit if link (or bearer) is congested */
 980                         if (link_congested(l_ptr)) {
 981                                 res = link_schedule_port(l_ptr,
 982                                                          sender->ref, res);
 983                                 goto exit;
 984                         }
 985
 986                         /*
 987                          * Message size exceeds max_pkt hint; update hint,
 988                          * then re-try fast path or fragment the message
 989                          */
 990                         sender->max_pkt = l_ptr->max_pkt;
 991                         tipc_node_unlock(node);
 992                         read_unlock_bh(&tipc_net_lock);
 993
 994
 995                         if ((msg_hdr_sz(hdr) + res) <= sender->max_pkt)
 996                                 goto again;
 997
 998                         return link_send_sections_long(sender, msg_sect, len,
 999                                                        destaddr);
1000                 }
1001                 tipc_node_unlock(node);
1002         }
1003         read_unlock_bh(&tipc_net_lock);
1004
1005         /* Couldn't find a link to the destination node */
1006         if (buf)
1007                 return tipc_reject_msg(buf, TIPC_ERR_NO_NODE);
1008         if (res >= 0)
1009                 return tipc_port_reject_sections(sender, hdr, msg_sect,
1010                                                  len, TIPC_ERR_NO_NODE);
1011         return res;
1012 }
1013
1014 /*
1015  * link_send_sections_long(): Entry for long messages where the
1016  * destination node is known and the header is complete,
1017  * inclusive total message length.
1018  * Link and bearer congestion status have been checked to be ok,
1019  * and are ignored if they change.
1020  *
1021  * Note that fragments do not use the full link MTU so that they won't have
1022  * to undergo refragmentation if link changeover causes them to be sent
1023  * over another link with an additional tunnel header added as prefix.
1024  * (Refragmentation will still occur if the other link has a smaller MTU.)
1025  *
1026  * Returns user data length or errno.
1027  */
1028 static int link_send_sections_long(struct tipc_port *sender,
1029                                    struct iovec const *msg_sect,
1030                                    unsigned int len, u32 destaddr)
1031 {
1032         struct tipc_link *l_ptr;
1033         struct tipc_node *node;
1034         struct tipc_msg *hdr = &sender->phdr;
1035         u32 dsz = len;
1036         u32 max_pkt, fragm_sz, rest;
1037         struct tipc_msg fragm_hdr;
1038         struct sk_buff *buf, *buf_chain, *prev;
1039         u32 fragm_crs, fragm_rest, hsz, sect_rest;
1040         const unchar __user *sect_crs;
1041         int curr_sect;
1042         u32 fragm_no;
1043         int res = 0;
1044
1045 again:
1046         fragm_no = 1;
1047         max_pkt = sender->max_pkt - INT_H_SIZE;
1048                 /* leave room for tunnel header in case of link changeover */
1049         fragm_sz = max_pkt - INT_H_SIZE;
1050                 /* leave room for fragmentation header in each fragment */
1051         rest = dsz;
1052         fragm_crs = 0;
1053         fragm_rest = 0;
1054         sect_rest = 0;
1055         sect_crs = NULL;
1056         curr_sect = -1;
1057
1058         /* Prepare reusable fragment header */
1059         tipc_msg_init(&fragm_hdr, MSG_FRAGMENTER, FIRST_FRAGMENT,
1060                  INT_H_SIZE, msg_destnode(hdr));
1061         msg_set_size(&fragm_hdr, max_pkt);
1062         msg_set_fragm_no(&fragm_hdr, 1);
1063
1064         /* Prepare header of first fragment */
1065         buf_chain = buf = tipc_buf_acquire(max_pkt);
1066         if (!buf)
1067                 return -ENOMEM;
1068         buf->next = NULL;
1069         skb_copy_to_linear_data(buf, &fragm_hdr, INT_H_SIZE);
1070         hsz = msg_hdr_sz(hdr);
1071         skb_copy_to_linear_data_offset(buf, INT_H_SIZE, hdr, hsz);
1072
1073         /* Chop up message */
1074         fragm_crs = INT_H_SIZE + hsz;
1075         fragm_rest = fragm_sz - hsz;
1076
1077         do {            /* For all sections */
1078                 u32 sz;
1079
1080                 if (!sect_rest) {
1081                         sect_rest = msg_sect[++curr_sect].iov_len;
1082                         sect_crs = msg_sect[curr_sect].iov_base;
1083                 }
1084
1085                 if (sect_rest < fragm_rest)
1086                         sz = sect_rest;
1087                 else
1088                         sz = fragm_rest;
1089
1090                 if (copy_from_user(buf->data + fragm_crs, sect_crs, sz)) {
1091                         res = -EFAULT;
1092 error:
1093                         kfree_skb_list(buf_chain);
1094                         return res;
1095                 }
1096                 sect_crs += sz;
1097                 sect_rest -= sz;
1098                 fragm_crs += sz;
1099                 fragm_rest -= sz;
1100                 rest -= sz;
1101
1102                 if (!fragm_rest && rest) {
1103
1104                         /* Initiate new fragment: */
1105                         if (rest <= fragm_sz) {
1106                                 fragm_sz = rest;
1107                                 msg_set_type(&fragm_hdr, LAST_FRAGMENT);
1108                         } else {
1109                                 msg_set_type(&fragm_hdr, FRAGMENT);
1110                         }
1111                         msg_set_size(&fragm_hdr, fragm_sz + INT_H_SIZE);
1112                         msg_set_fragm_no(&fragm_hdr, ++fragm_no);
1113                         prev = buf;
1114                         buf = tipc_buf_acquire(fragm_sz + INT_H_SIZE);
1115                         if (!buf) {
1116                                 res = -ENOMEM;
1117                                 goto error;
1118                         }
1119
1120                         buf->next = NULL;
1121                         prev->next = buf;
1122                         skb_copy_to_linear_data(buf, &fragm_hdr, INT_H_SIZE);
1123                         fragm_crs = INT_H_SIZE;
1124                         fragm_rest = fragm_sz;
1125                 }
1126         } while (rest > 0);
1127
1128         /*
1129          * Now we have a buffer chain. Select a link and check
1130          * that packet size is still OK
1131          */
1132         node = tipc_node_find(destaddr);
1133         if (likely(node)) {
1134                 tipc_node_lock(node);
1135                 l_ptr = node->active_links[sender->ref & 1];
1136                 if (!l_ptr) {
1137                         tipc_node_unlock(node);
1138                         goto reject;
1139                 }
1140                 if (l_ptr->max_pkt < max_pkt) {
1141                         sender->max_pkt = l_ptr->max_pkt;
1142                         tipc_node_unlock(node);
1143                         kfree_skb_list(buf_chain);
1144                         goto again;
1145                 }
1146         } else {
1147 reject:
1148                 kfree_skb_list(buf_chain);
1149                 return tipc_port_reject_sections(sender, hdr, msg_sect,
1150                                                  len, TIPC_ERR_NO_NODE);
1151         }
1152
1153         /* Append chain of fragments to send queue & send them */
1154         l_ptr->long_msg_seq_no++;
1155         link_add_chain_to_outqueue(l_ptr, buf_chain, l_ptr->long_msg_seq_no);
1156         l_ptr->stats.sent_fragments += fragm_no;
1157         l_ptr->stats.sent_fragmented++;
1158         tipc_link_push_queue(l_ptr);
1159         tipc_node_unlock(node);
1160         return dsz;
1161 }
1162
1163 /*
1164  * tipc_link_push_packet: Push one unsent packet to the media
1165  */
1166 static u32 tipc_link_push_packet(struct tipc_link *l_ptr)
1167 {
1168         struct sk_buff *buf = l_ptr->first_out;
1169         u32 r_q_size = l_ptr->retransm_queue_size;
1170         u32 r_q_head = l_ptr->retransm_queue_head;
1171
1172         /* Step to position where retransmission failed, if any,    */
1173         /* consider that buffers may have been released in meantime */
1174         if (r_q_size && buf) {
1175                 u32 last = lesser(mod(r_q_head + r_q_size),
1176                                   link_last_sent(l_ptr));
1177                 u32 first = buf_seqno(buf);
1178
1179                 while (buf && less(first, r_q_head)) {
1180                         first = mod(first + 1);
1181                         buf = buf->next;
1182                 }
1183                 l_ptr->retransm_queue_head = r_q_head = first;
1184                 l_ptr->retransm_queue_size = r_q_size = mod(last - first);
1185         }
1186
1187         /* Continue retransmission now, if there is anything: */
1188         if (r_q_size && buf) {
1189                 msg_set_ack(buf_msg(buf), mod(l_ptr->next_in_no - 1));
1190                 msg_set_bcast_ack(buf_msg(buf), l_ptr->owner->bclink.last_in);
1191                 tipc_bearer_send(l_ptr->b_ptr, buf, &l_ptr->media_addr);
1192                 l_ptr->retransm_queue_head = mod(++r_q_head);
1193                 l_ptr->retransm_queue_size = --r_q_size;
1194                 l_ptr->stats.retransmitted++;
1195                 return 0;
1196         }
1197
1198         /* Send deferred protocol message, if any: */
1199         buf = l_ptr->proto_msg_queue;
1200         if (buf) {
1201                 msg_set_ack(buf_msg(buf), mod(l_ptr->next_in_no - 1));
1202                 msg_set_bcast_ack(buf_msg(buf), l_ptr->owner->bclink.last_in);
1203                 tipc_bearer_send(l_ptr->b_ptr, buf, &l_ptr->media_addr);
1204                 l_ptr->unacked_window = 0;
1205                 kfree_skb(buf);
1206                 l_ptr->proto_msg_queue = NULL;
1207                 return 0;
1208         }
1209
1210         /* Send one deferred data message, if send window not full: */
1211         buf = l_ptr->next_out;
1212         if (buf) {
1213                 struct tipc_msg *msg = buf_msg(buf);
1214                 u32 next = msg_seqno(msg);
1215                 u32 first = buf_seqno(l_ptr->first_out);
1216
1217                 if (mod(next - first) < l_ptr->queue_limit[0]) {
1218                         msg_set_ack(msg, mod(l_ptr->next_in_no - 1));
1219                         msg_set_bcast_ack(msg, l_ptr->owner->bclink.last_in);
1220                         tipc_bearer_send(l_ptr->b_ptr, buf, &l_ptr->media_addr);
1221                         if (msg_user(msg) == MSG_BUNDLER)
1222                                 msg_set_type(msg, CLOSED_MSG);
1223                         l_ptr->next_out = buf->next;
1224                         return 0;
1225                 }
1226         }
1227         return 1;
1228 }
1229
1230 /*
1231  * push_queue(): push out the unsent messages of a link where
1232  *               congestion has abated. Node is locked
1233  */
1234 void tipc_link_push_queue(struct tipc_link *l_ptr)
1235 {
1236         u32 res;
1237
1238         do {
1239                 res = tipc_link_push_packet(l_ptr);
1240         } while (!res);
1241 }
1242
1243 static void link_reset_all(unsigned long addr)
1244 {
1245         struct tipc_node *n_ptr;
1246         char addr_string[16];
1247         u32 i;
1248
1249         read_lock_bh(&tipc_net_lock);
1250         n_ptr = tipc_node_find((u32)addr);
1251         if (!n_ptr) {
1252                 read_unlock_bh(&tipc_net_lock);
1253                 return; /* node no longer exists */
1254         }
1255
1256         tipc_node_lock(n_ptr);
1257
1258         pr_warn("Resetting all links to %s\n",
1259                 tipc_addr_string_fill(addr_string, n_ptr->addr));
1260
1261         for (i = 0; i < MAX_BEARERS; i++) {
1262                 if (n_ptr->links[i]) {
1263                         link_print(n_ptr->links[i], "Resetting link\n");
1264                         tipc_link_reset(n_ptr->links[i]);
1265                 }
1266         }
1267
1268         tipc_node_unlock(n_ptr);
1269         read_unlock_bh(&tipc_net_lock);
1270 }
1271
1272 static void link_retransmit_failure(struct tipc_link *l_ptr,
1273                                     struct sk_buff *buf)
1274 {
1275         struct tipc_msg *msg = buf_msg(buf);
1276
1277         pr_warn("Retransmission failure on link <%s>\n", l_ptr->name);
1278
1279         if (l_ptr->addr) {
1280                 /* Handle failure on standard link */
1281                 link_print(l_ptr, "Resetting link\n");
1282                 tipc_link_reset(l_ptr);
1283
1284         } else {
1285                 /* Handle failure on broadcast link */
1286                 struct tipc_node *n_ptr;
1287                 char addr_string[16];
1288
1289                 pr_info("Msg seq number: %u,  ", msg_seqno(msg));
1290                 pr_cont("Outstanding acks: %lu\n",
1291                         (unsigned long) TIPC_SKB_CB(buf)->handle);
1292
1293                 n_ptr = tipc_bclink_retransmit_to();
1294                 tipc_node_lock(n_ptr);
1295
1296                 tipc_addr_string_fill(addr_string, n_ptr->addr);
1297                 pr_info("Broadcast link info for %s\n", addr_string);
1298                 pr_info("Reception permitted: %d,  Acked: %u\n",
1299                         n_ptr->bclink.recv_permitted,
1300                         n_ptr->bclink.acked);
1301                 pr_info("Last in: %u,  Oos state: %u,  Last sent: %u\n",
1302                         n_ptr->bclink.last_in,
1303                         n_ptr->bclink.oos_state,
1304                         n_ptr->bclink.last_sent);
1305
1306                 tipc_k_signal((Handler)link_reset_all, (unsigned long)n_ptr->addr);
1307
1308                 tipc_node_unlock(n_ptr);
1309
1310                 l_ptr->stale_count = 0;
1311         }
1312 }
1313
1314 void tipc_link_retransmit(struct tipc_link *l_ptr, struct sk_buff *buf,
1315                           u32 retransmits)
1316 {
1317         struct tipc_msg *msg;
1318
1319         if (!buf)
1320                 return;
1321
1322         msg = buf_msg(buf);
1323
1324         /* Detect repeated retransmit failures */
1325         if (l_ptr->last_retransmitted == msg_seqno(msg)) {
1326                 if (++l_ptr->stale_count > 100) {
1327                         link_retransmit_failure(l_ptr, buf);
1328                         return;
1329                 }
1330         } else {
1331                 l_ptr->last_retransmitted = msg_seqno(msg);
1332                 l_ptr->stale_count = 1;
1333         }
1334
1335         while (retransmits && (buf != l_ptr->next_out) && buf) {
1336                 msg = buf_msg(buf);
1337                 msg_set_ack(msg, mod(l_ptr->next_in_no - 1));
1338                 msg_set_bcast_ack(msg, l_ptr->owner->bclink.last_in);
1339                 tipc_bearer_send(l_ptr->b_ptr, buf, &l_ptr->media_addr);
1340                 buf = buf->next;
1341                 retransmits--;
1342                 l_ptr->stats.retransmitted++;
1343         }
1344
1345         l_ptr->retransm_queue_head = l_ptr->retransm_queue_size = 0;
1346 }
1347
1348 /**
1349  * link_insert_deferred_queue - insert deferred messages back into receive chain
1350  */
1351 static struct sk_buff *link_insert_deferred_queue(struct tipc_link *l_ptr,
1352                                                   struct sk_buff *buf)
1353 {
1354         u32 seq_no;
1355
1356         if (l_ptr->oldest_deferred_in == NULL)
1357                 return buf;
1358
1359         seq_no = buf_seqno(l_ptr->oldest_deferred_in);
1360         if (seq_no == mod(l_ptr->next_in_no)) {
1361                 l_ptr->newest_deferred_in->next = buf;
1362                 buf = l_ptr->oldest_deferred_in;
1363                 l_ptr->oldest_deferred_in = NULL;
1364                 l_ptr->deferred_inqueue_sz = 0;
1365         }
1366         return buf;
1367 }
1368
1369 /**
1370  * link_recv_buf_validate - validate basic format of received message
1371  *
1372  * This routine ensures a TIPC message has an acceptable header, and at least
1373  * as much data as the header indicates it should.  The routine also ensures
1374  * that the entire message header is stored in the main fragment of the message
1375  * buffer, to simplify future access to message header fields.
1376  *
1377  * Note: Having extra info present in the message header or data areas is OK.
1378  * TIPC will ignore the excess, under the assumption that it is optional info
1379  * introduced by a later release of the protocol.
1380  */
1381 static int link_recv_buf_validate(struct sk_buff *buf)
1382 {
1383         static u32 min_data_hdr_size[8] = {
1384                 SHORT_H_SIZE, MCAST_H_SIZE, NAMED_H_SIZE, BASIC_H_SIZE,
1385                 MAX_H_SIZE, MAX_H_SIZE, MAX_H_SIZE, MAX_H_SIZE
1386                 };
1387
1388         struct tipc_msg *msg;
1389         u32 tipc_hdr[2];
1390         u32 size;
1391         u32 hdr_size;
1392         u32 min_hdr_size;
1393
1394         /* If this packet comes from the defer queue, the skb has already
1395          * been validated
1396          */
1397         if (unlikely(TIPC_SKB_CB(buf)->deferred))
1398                 return 1;
1399
1400         if (unlikely(buf->len < MIN_H_SIZE))
1401                 return 0;
1402
1403         msg = skb_header_pointer(buf, 0, sizeof(tipc_hdr), tipc_hdr);
1404         if (msg == NULL)
1405                 return 0;
1406
1407         if (unlikely(msg_version(msg) != TIPC_VERSION))
1408                 return 0;
1409
1410         size = msg_size(msg);
1411         hdr_size = msg_hdr_sz(msg);
1412         min_hdr_size = msg_isdata(msg) ?
1413                 min_data_hdr_size[msg_type(msg)] : INT_H_SIZE;
1414
1415         if (unlikely((hdr_size < min_hdr_size) ||
1416                      (size < hdr_size) ||
1417                      (buf->len < size) ||
1418                      (size - hdr_size > TIPC_MAX_USER_MSG_SIZE)))
1419                 return 0;
1420
1421         return pskb_may_pull(buf, hdr_size);
1422 }
1423
1424 /**
1425  * tipc_rcv - process TIPC packets/messages arriving from off-node
1426  * @head: pointer to message buffer chain
1427  * @tb_ptr: pointer to bearer message arrived on
1428  *
1429  * Invoked with no locks held.  Bearer pointer must point to a valid bearer
1430  * structure (i.e. cannot be NULL), but bearer can be inactive.
1431  */
1432 void tipc_rcv(struct sk_buff *head, struct tipc_bearer *b_ptr)
1433 {
1434         read_lock_bh(&tipc_net_lock);
1435         while (head) {
1436                 struct tipc_node *n_ptr;
1437                 struct tipc_link *l_ptr;
1438                 struct sk_buff *crs;
1439                 struct sk_buff *buf = head;
1440                 struct tipc_msg *msg;
1441                 u32 seq_no;
1442                 u32 ackd;
1443                 u32 released = 0;
1444                 int type;
1445
1446                 head = head->next;
1447                 buf->next = NULL;
1448
1449                 /* Ensure bearer is still enabled */
1450                 if (unlikely(!b_ptr->active))
1451                         goto discard;
1452
1453                 /* Ensure message is well-formed */
1454                 if (unlikely(!link_recv_buf_validate(buf)))
1455                         goto discard;
1456
1457                 /* Ensure message data is a single contiguous unit */
1458                 if (unlikely(skb_linearize(buf)))
1459                         goto discard;
1460
1461                 /* Handle arrival of a non-unicast link message */
1462                 msg = buf_msg(buf);
1463
1464                 if (unlikely(msg_non_seq(msg))) {
1465                         if (msg_user(msg) ==  LINK_CONFIG)
1466                                 tipc_disc_recv_msg(buf, b_ptr);
1467                         else
1468                                 tipc_bclink_recv_pkt(buf);
1469                         continue;
1470                 }
1471
1472                 /* Discard unicast link messages destined for another node */
1473                 if (unlikely(!msg_short(msg) &&
1474                              (msg_destnode(msg) != tipc_own_addr)))
1475                         goto discard;
1476
1477                 /* Locate neighboring node that sent message */
1478                 n_ptr = tipc_node_find(msg_prevnode(msg));
1479                 if (unlikely(!n_ptr))
1480                         goto discard;
1481                 tipc_node_lock(n_ptr);
1482
1483                 /* Locate unicast link endpoint that should handle message */
1484                 l_ptr = n_ptr->links[b_ptr->identity];
1485                 if (unlikely(!l_ptr))
1486                         goto unlock_discard;
1487
1488                 /* Verify that communication with node is currently allowed */
1489                 if ((n_ptr->block_setup & WAIT_PEER_DOWN) &&
1490                         msg_user(msg) == LINK_PROTOCOL &&
1491                         (msg_type(msg) == RESET_MSG ||
1492                                         msg_type(msg) == ACTIVATE_MSG) &&
1493                         !msg_redundant_link(msg))
1494                         n_ptr->block_setup &= ~WAIT_PEER_DOWN;
1495
1496                 if (n_ptr->block_setup)
1497                         goto unlock_discard;
1498
1499                 /* Validate message sequence number info */
1500                 seq_no = msg_seqno(msg);
1501                 ackd = msg_ack(msg);
1502
1503                 /* Release acked messages */
1504                 if (n_ptr->bclink.recv_permitted)
1505                         tipc_bclink_acknowledge(n_ptr, msg_bcast_ack(msg));
1506
1507                 crs = l_ptr->first_out;
1508                 while ((crs != l_ptr->next_out) &&
1509                        less_eq(buf_seqno(crs), ackd)) {
1510                         struct sk_buff *next = crs->next;
1511
1512                         kfree_skb(crs);
1513                         crs = next;
1514                         released++;
1515                 }
1516                 if (released) {
1517                         l_ptr->first_out = crs;
1518                         l_ptr->out_queue_size -= released;
1519                 }
1520
1521                 /* Try sending any messages link endpoint has pending */
1522                 if (unlikely(l_ptr->next_out))
1523                         tipc_link_push_queue(l_ptr);
1524                 if (unlikely(!list_empty(&l_ptr->waiting_ports)))
1525                         tipc_link_wakeup_ports(l_ptr, 0);
1526                 if (unlikely(++l_ptr->unacked_window >= TIPC_MIN_LINK_WIN)) {
1527                         l_ptr->stats.sent_acks++;
1528                         tipc_link_send_proto_msg(l_ptr, STATE_MSG, 0, 0, 0, 0, 0);
1529                 }
1530
1531                 /* Now (finally!) process the incoming message */
1532 protocol_check:
1533                 if (unlikely(!link_working_working(l_ptr))) {
1534                         if (msg_user(msg) == LINK_PROTOCOL) {
1535                                 link_recv_proto_msg(l_ptr, buf);
1536                                 head = link_insert_deferred_queue(l_ptr, head);
1537                                 tipc_node_unlock(n_ptr);
1538                                 continue;
1539                         }
1540
1541                         /* Traffic message. Conditionally activate link */
1542                         link_state_event(l_ptr, TRAFFIC_MSG_EVT);
1543
1544                         if (link_working_working(l_ptr)) {
1545                                 /* Re-insert buffer in front of queue */
1546                                 buf->next = head;
1547                                 head = buf;
1548                                 tipc_node_unlock(n_ptr);
1549                                 continue;
1550                         }
1551                         goto unlock_discard;
1552                 }
1553
1554                 /* Link is now in state WORKING_WORKING */
1555                 if (unlikely(seq_no != mod(l_ptr->next_in_no))) {
1556                         link_handle_out_of_seq_msg(l_ptr, buf);
1557                         head = link_insert_deferred_queue(l_ptr, head);
1558                         tipc_node_unlock(n_ptr);
1559                         continue;
1560                 }
1561                 l_ptr->next_in_no++;
1562                 if (unlikely(l_ptr->oldest_deferred_in))
1563                         head = link_insert_deferred_queue(l_ptr, head);
1564 deliver:
1565                 if (likely(msg_isdata(msg))) {
1566                         tipc_node_unlock(n_ptr);
1567                         tipc_port_recv_msg(buf);
1568                         continue;
1569                 }
1570                 switch (msg_user(msg)) {
1571                         int ret;
1572                 case MSG_BUNDLER:
1573                         l_ptr->stats.recv_bundles++;
1574                         l_ptr->stats.recv_bundled += msg_msgcnt(msg);
1575                         tipc_node_unlock(n_ptr);
1576                         tipc_link_recv_bundle(buf);
1577                         continue;
1578                 case NAME_DISTRIBUTOR:
1579                         n_ptr->bclink.recv_permitted = true;
1580                         tipc_node_unlock(n_ptr);
1581                         tipc_named_recv(buf);
1582                         continue;
1583                 case BCAST_PROTOCOL:
1584                         tipc_link_recv_sync(n_ptr, buf);
1585                         tipc_node_unlock(n_ptr);
1586                         continue;
1587                 case CONN_MANAGER:
1588                         tipc_node_unlock(n_ptr);
1589                         tipc_port_recv_proto_msg(buf);
1590                         continue;
1591                 case MSG_FRAGMENTER:
1592                         l_ptr->stats.recv_fragments++;
1593                         ret = tipc_link_recv_fragment(&l_ptr->reasm_head,
1594                                                       &l_ptr->reasm_tail,
1595                                                       &buf);
1596                         if (ret == LINK_REASM_COMPLETE) {
1597                                 l_ptr->stats.recv_fragmented++;
1598                                 msg = buf_msg(buf);
1599                                 goto deliver;
1600                         }
1601                         if (ret == LINK_REASM_ERROR)
1602                                 tipc_link_reset(l_ptr);
1603                         tipc_node_unlock(n_ptr);
1604                         continue;
1605                 case CHANGEOVER_PROTOCOL:
1606                         type = msg_type(msg);
1607                         if (tipc_link_tunnel_rcv(&l_ptr, &buf)) {
1608                                 msg = buf_msg(buf);
1609                                 seq_no = msg_seqno(msg);
1610                                 if (type == ORIGINAL_MSG)
1611                                         goto deliver;
1612                                 goto protocol_check;
1613                         }
1614                         break;
1615                 default:
1616                         kfree_skb(buf);
1617                         buf = NULL;
1618                         break;
1619                 }
1620                 tipc_node_unlock(n_ptr);
1621                 tipc_net_route_msg(buf);
1622                 continue;
1623 unlock_discard:
1624
1625                 tipc_node_unlock(n_ptr);
1626 discard:
1627                 kfree_skb(buf);
1628         }
1629         read_unlock_bh(&tipc_net_lock);
1630 }
1631
1632 /**
1633  * tipc_link_defer_pkt - Add out-of-sequence message to deferred reception queue
1634  *
1635  * Returns increase in queue length (i.e. 0 or 1)
1636  */
1637 u32 tipc_link_defer_pkt(struct sk_buff **head, struct sk_buff **tail,
1638                         struct sk_buff *buf)
1639 {
1640         struct sk_buff *queue_buf;
1641         struct sk_buff **prev;
1642         u32 seq_no = buf_seqno(buf);
1643
1644         buf->next = NULL;
1645
1646         /* Empty queue ? */
1647         if (*head == NULL) {
1648                 *head = *tail = buf;
1649                 return 1;
1650         }
1651
1652         /* Last ? */
1653         if (less(buf_seqno(*tail), seq_no)) {
1654                 (*tail)->next = buf;
1655                 *tail = buf;
1656                 return 1;
1657         }
1658
1659         /* Locate insertion point in queue, then insert; discard if duplicate */
1660         prev = head;
1661         queue_buf = *head;
1662         for (;;) {
1663                 u32 curr_seqno = buf_seqno(queue_buf);
1664
1665                 if (seq_no == curr_seqno) {
1666                         kfree_skb(buf);
1667                         return 0;
1668                 }
1669
1670                 if (less(seq_no, curr_seqno))
1671                         break;
1672
1673                 prev = &queue_buf->next;
1674                 queue_buf = queue_buf->next;
1675         }
1676
1677         buf->next = queue_buf;
1678         *prev = buf;
1679         return 1;
1680 }
1681
1682 /*
1683  * link_handle_out_of_seq_msg - handle arrival of out-of-sequence packet
1684  */
1685 static void link_handle_out_of_seq_msg(struct tipc_link *l_ptr,
1686                                        struct sk_buff *buf)
1687 {
1688         u32 seq_no = buf_seqno(buf);
1689
1690         if (likely(msg_user(buf_msg(buf)) == LINK_PROTOCOL)) {
1691                 link_recv_proto_msg(l_ptr, buf);
1692                 return;
1693         }
1694
1695         /* Record OOS packet arrival (force mismatch on next timeout) */
1696         l_ptr->checkpoint--;
1697
1698         /*
1699          * Discard packet if a duplicate; otherwise add it to deferred queue
1700          * and notify peer of gap as per protocol specification
1701          */
1702         if (less(seq_no, mod(l_ptr->next_in_no))) {
1703                 l_ptr->stats.duplicates++;
1704                 kfree_skb(buf);
1705                 return;
1706         }
1707
1708         if (tipc_link_defer_pkt(&l_ptr->oldest_deferred_in,
1709                                 &l_ptr->newest_deferred_in, buf)) {
1710                 l_ptr->deferred_inqueue_sz++;
1711                 l_ptr->stats.deferred_recv++;
1712                 TIPC_SKB_CB(buf)->deferred = true;
1713                 if ((l_ptr->deferred_inqueue_sz % 16) == 1)
1714                         tipc_link_send_proto_msg(l_ptr, STATE_MSG, 0, 0, 0, 0, 0);
1715         } else
1716                 l_ptr->stats.duplicates++;
1717 }
1718
1719 /*
1720  * Send protocol message to the other endpoint.
1721  */
1722 void tipc_link_send_proto_msg(struct tipc_link *l_ptr, u32 msg_typ,
1723                               int probe_msg, u32 gap, u32 tolerance,
1724                               u32 priority, u32 ack_mtu)
1725 {
1726         struct sk_buff *buf = NULL;
1727         struct tipc_msg *msg = l_ptr->pmsg;
1728         u32 msg_size = sizeof(l_ptr->proto_msg);
1729         int r_flag;
1730
1731         /* Discard any previous message that was deferred due to congestion */
1732         if (l_ptr->proto_msg_queue) {
1733                 kfree_skb(l_ptr->proto_msg_queue);
1734                 l_ptr->proto_msg_queue = NULL;
1735         }
1736
1737         /* Don't send protocol message during link changeover */
1738         if (l_ptr->exp_msg_count)
1739                 return;
1740
1741         /* Abort non-RESET send if communication with node is prohibited */
1742         if ((l_ptr->owner->block_setup) && (msg_typ != RESET_MSG))
1743                 return;
1744
1745         /* Create protocol message with "out-of-sequence" sequence number */
1746         msg_set_type(msg, msg_typ);
1747         msg_set_net_plane(msg, l_ptr->b_ptr->net_plane);
1748         msg_set_bcast_ack(msg, l_ptr->owner->bclink.last_in);
1749         msg_set_last_bcast(msg, tipc_bclink_get_last_sent());
1750
1751         if (msg_typ == STATE_MSG) {
1752                 u32 next_sent = mod(l_ptr->next_out_no);
1753
1754                 if (!tipc_link_is_up(l_ptr))
1755                         return;
1756                 if (l_ptr->next_out)
1757                         next_sent = buf_seqno(l_ptr->next_out);
1758                 msg_set_next_sent(msg, next_sent);
1759                 if (l_ptr->oldest_deferred_in) {
1760                         u32 rec = buf_seqno(l_ptr->oldest_deferred_in);
1761                         gap = mod(rec - mod(l_ptr->next_in_no));
1762                 }
1763                 msg_set_seq_gap(msg, gap);
1764                 if (gap)
1765                         l_ptr->stats.sent_nacks++;
1766                 msg_set_link_tolerance(msg, tolerance);
1767                 msg_set_linkprio(msg, priority);
1768                 msg_set_max_pkt(msg, ack_mtu);
1769                 msg_set_ack(msg, mod(l_ptr->next_in_no - 1));
1770                 msg_set_probe(msg, probe_msg != 0);
1771                 if (probe_msg) {
1772                         u32 mtu = l_ptr->max_pkt;
1773
1774                         if ((mtu < l_ptr->max_pkt_target) &&
1775                             link_working_working(l_ptr) &&
1776                             l_ptr->fsm_msg_cnt) {
1777                                 msg_size = (mtu + (l_ptr->max_pkt_target - mtu)/2 + 2) & ~3;
1778                                 if (l_ptr->max_pkt_probes == 10) {
1779                                         l_ptr->max_pkt_target = (msg_size - 4);
1780                                         l_ptr->max_pkt_probes = 0;
1781                                         msg_size = (mtu + (l_ptr->max_pkt_target - mtu)/2 + 2) & ~3;
1782                                 }
1783                                 l_ptr->max_pkt_probes++;
1784                         }
1785
1786                         l_ptr->stats.sent_probes++;
1787                 }
1788                 l_ptr->stats.sent_states++;
1789         } else {                /* RESET_MSG or ACTIVATE_MSG */
1790                 msg_set_ack(msg, mod(l_ptr->reset_checkpoint - 1));
1791                 msg_set_seq_gap(msg, 0);
1792                 msg_set_next_sent(msg, 1);
1793                 msg_set_probe(msg, 0);
1794                 msg_set_link_tolerance(msg, l_ptr->tolerance);
1795                 msg_set_linkprio(msg, l_ptr->priority);
1796                 msg_set_max_pkt(msg, l_ptr->max_pkt_target);
1797         }
1798
1799         r_flag = (l_ptr->owner->working_links > tipc_link_is_up(l_ptr));
1800         msg_set_redundant_link(msg, r_flag);
1801         msg_set_linkprio(msg, l_ptr->priority);
1802         msg_set_size(msg, msg_size);
1803
1804         msg_set_seqno(msg, mod(l_ptr->next_out_no + (0xffff/2)));
1805
1806         buf = tipc_buf_acquire(msg_size);
1807         if (!buf)
1808                 return;
1809
1810         skb_copy_to_linear_data(buf, msg, sizeof(l_ptr->proto_msg));
1811         buf->priority = TC_PRIO_CONTROL;
1812
1813         tipc_bearer_send(l_ptr->b_ptr, buf, &l_ptr->media_addr);
1814         l_ptr->unacked_window = 0;
1815         kfree_skb(buf);
1816 }
1817
1818 /*
1819  * Receive protocol message :
1820  * Note that network plane id propagates through the network, and may
1821  * change at any time. The node with lowest address rules
1822  */
1823 static void link_recv_proto_msg(struct tipc_link *l_ptr, struct sk_buff *buf)
1824 {
1825         u32 rec_gap = 0;
1826         u32 max_pkt_info;
1827         u32 max_pkt_ack;
1828         u32 msg_tol;
1829         struct tipc_msg *msg = buf_msg(buf);
1830
1831         /* Discard protocol message during link changeover */
1832         if (l_ptr->exp_msg_count)
1833                 goto exit;
1834
1835         /* record unnumbered packet arrival (force mismatch on next timeout) */
1836         l_ptr->checkpoint--;
1837
1838         if (l_ptr->b_ptr->net_plane != msg_net_plane(msg))
1839                 if (tipc_own_addr > msg_prevnode(msg))
1840                         l_ptr->b_ptr->net_plane = msg_net_plane(msg);
1841
1842         switch (msg_type(msg)) {
1843
1844         case RESET_MSG:
1845                 if (!link_working_unknown(l_ptr) &&
1846                     (l_ptr->peer_session != INVALID_SESSION)) {
1847                         if (less_eq(msg_session(msg), l_ptr->peer_session))
1848                                 break; /* duplicate or old reset: ignore */
1849                 }
1850
1851                 if (!msg_redundant_link(msg) && (link_working_working(l_ptr) ||
1852                                 link_working_unknown(l_ptr))) {
1853                         /*
1854                          * peer has lost contact -- don't allow peer's links
1855                          * to reactivate before we recognize loss & clean up
1856                          */
1857                         l_ptr->owner->block_setup = WAIT_NODE_DOWN;
1858                 }
1859
1860                 link_state_event(l_ptr, RESET_MSG);
1861
1862                 /* fall thru' */
1863         case ACTIVATE_MSG:
1864                 /* Update link settings according other endpoint's values */
1865                 strcpy((strrchr(l_ptr->name, ':') + 1), (char *)msg_data(msg));
1866
1867                 msg_tol = msg_link_tolerance(msg);
1868                 if (msg_tol > l_ptr->tolerance)
1869                         link_set_supervision_props(l_ptr, msg_tol);
1870
1871                 if (msg_linkprio(msg) > l_ptr->priority)
1872                         l_ptr->priority = msg_linkprio(msg);
1873
1874                 max_pkt_info = msg_max_pkt(msg);
1875                 if (max_pkt_info) {
1876                         if (max_pkt_info < l_ptr->max_pkt_target)
1877                                 l_ptr->max_pkt_target = max_pkt_info;
1878                         if (l_ptr->max_pkt > l_ptr->max_pkt_target)
1879                                 l_ptr->max_pkt = l_ptr->max_pkt_target;
1880                 } else {
1881                         l_ptr->max_pkt = l_ptr->max_pkt_target;
1882                 }
1883
1884                 /* Synchronize broadcast link info, if not done previously */
1885                 if (!tipc_node_is_up(l_ptr->owner)) {
1886                         l_ptr->owner->bclink.last_sent =
1887                                 l_ptr->owner->bclink.last_in =
1888                                 msg_last_bcast(msg);
1889                         l_ptr->owner->bclink.oos_state = 0;
1890                 }
1891
1892                 l_ptr->peer_session = msg_session(msg);
1893                 l_ptr->peer_bearer_id = msg_bearer_id(msg);
1894
1895                 if (msg_type(msg) == ACTIVATE_MSG)
1896                         link_state_event(l_ptr, ACTIVATE_MSG);
1897                 break;
1898         case STATE_MSG:
1899
1900                 msg_tol = msg_link_tolerance(msg);
1901                 if (msg_tol)
1902                         link_set_supervision_props(l_ptr, msg_tol);
1903
1904                 if (msg_linkprio(msg) &&
1905                     (msg_linkprio(msg) != l_ptr->priority)) {
1906                         pr_warn("%s<%s>, priority change %u->%u\n",
1907                                 link_rst_msg, l_ptr->name, l_ptr->priority,
1908                                 msg_linkprio(msg));
1909                         l_ptr->priority = msg_linkprio(msg);
1910                         tipc_link_reset(l_ptr); /* Enforce change to take effect */
1911                         break;
1912                 }
1913                 link_state_event(l_ptr, TRAFFIC_MSG_EVT);
1914                 l_ptr->stats.recv_states++;
1915                 if (link_reset_unknown(l_ptr))
1916                         break;
1917
1918                 if (less_eq(mod(l_ptr->next_in_no), msg_next_sent(msg))) {
1919                         rec_gap = mod(msg_next_sent(msg) -
1920                                       mod(l_ptr->next_in_no));
1921                 }
1922
1923                 max_pkt_ack = msg_max_pkt(msg);
1924                 if (max_pkt_ack > l_ptr->max_pkt) {
1925                         l_ptr->max_pkt = max_pkt_ack;
1926                         l_ptr->max_pkt_probes = 0;
1927                 }
1928
1929                 max_pkt_ack = 0;
1930                 if (msg_probe(msg)) {
1931                         l_ptr->stats.recv_probes++;
1932                         if (msg_size(msg) > sizeof(l_ptr->proto_msg))
1933                                 max_pkt_ack = msg_size(msg);
1934                 }
1935
1936                 /* Protocol message before retransmits, reduce loss risk */
1937                 if (l_ptr->owner->bclink.recv_permitted)
1938                         tipc_bclink_update_link_state(l_ptr->owner,
1939                                                       msg_last_bcast(msg));
1940
1941                 if (rec_gap || (msg_probe(msg))) {
1942                         tipc_link_send_proto_msg(l_ptr, STATE_MSG,
1943                                                  0, rec_gap, 0, 0, max_pkt_ack);
1944                 }
1945                 if (msg_seq_gap(msg)) {
1946                         l_ptr->stats.recv_nacks++;
1947                         tipc_link_retransmit(l_ptr, l_ptr->first_out,
1948                                              msg_seq_gap(msg));
1949                 }
1950                 break;
1951         }
1952 exit:
1953         kfree_skb(buf);
1954 }
1955
1956
1957 /* tipc_link_tunnel_xmit(): Tunnel one packet via a link belonging to
1958  * a different bearer. Owner node is locked.
1959  */
1960 static void tipc_link_tunnel_xmit(struct tipc_link *l_ptr,
1961                                   struct tipc_msg *tunnel_hdr,
1962                                   struct tipc_msg *msg,
1963                                   u32 selector)
1964 {
1965         struct tipc_link *tunnel;
1966         struct sk_buff *buf;
1967         u32 length = msg_size(msg);
1968
1969         tunnel = l_ptr->owner->active_links[selector & 1];
1970         if (!tipc_link_is_up(tunnel)) {
1971                 pr_warn("%stunnel link no longer available\n", link_co_err);
1972                 return;
1973         }
1974         msg_set_size(tunnel_hdr, length + INT_H_SIZE);
1975         buf = tipc_buf_acquire(length + INT_H_SIZE);
1976         if (!buf) {
1977                 pr_warn("%sunable to send tunnel msg\n", link_co_err);
1978                 return;
1979         }
1980         skb_copy_to_linear_data(buf, tunnel_hdr, INT_H_SIZE);
1981         skb_copy_to_linear_data_offset(buf, INT_H_SIZE, msg, length);
1982         tipc_link_send_buf(tunnel, buf);
1983 }
1984
1985
1986 /* tipc_link_failover_send_queue(): A link has gone down, but a second
1987  * link is still active. We can do failover. Tunnel the failing link's
1988  * whole send queue via the remaining link. This way, we don't lose
1989  * any packets, and sequence order is preserved for subsequent traffic
1990  * sent over the remaining link. Owner node is locked.
1991  */
1992 void tipc_link_failover_send_queue(struct tipc_link *l_ptr)
1993 {
1994         u32 msgcount = l_ptr->out_queue_size;
1995         struct sk_buff *crs = l_ptr->first_out;
1996         struct tipc_link *tunnel = l_ptr->owner->active_links[0];
1997         struct tipc_msg tunnel_hdr;
1998         int split_bundles;
1999
2000         if (!tunnel)
2001                 return;
2002
2003         tipc_msg_init(&tunnel_hdr, CHANGEOVER_PROTOCOL,
2004                  ORIGINAL_MSG, INT_H_SIZE, l_ptr->addr);
2005         msg_set_bearer_id(&tunnel_hdr, l_ptr->peer_bearer_id);
2006         msg_set_msgcnt(&tunnel_hdr, msgcount);
2007
2008         if (!l_ptr->first_out) {
2009                 struct sk_buff *buf;
2010
2011                 buf = tipc_buf_acquire(INT_H_SIZE);
2012                 if (buf) {
2013                         skb_copy_to_linear_data(buf, &tunnel_hdr, INT_H_SIZE);
2014                         msg_set_size(&tunnel_hdr, INT_H_SIZE);
2015                         tipc_link_send_buf(tunnel, buf);
2016                 } else {
2017                         pr_warn("%sunable to send changeover msg\n",
2018                                 link_co_err);
2019                 }
2020                 return;
2021         }
2022
2023         split_bundles = (l_ptr->owner->active_links[0] !=
2024                          l_ptr->owner->active_links[1]);
2025
2026         while (crs) {
2027                 struct tipc_msg *msg = buf_msg(crs);
2028
2029                 if ((msg_user(msg) == MSG_BUNDLER) && split_bundles) {
2030                         struct tipc_msg *m = msg_get_wrapped(msg);
2031                         unchar *pos = (unchar *)m;
2032
2033                         msgcount = msg_msgcnt(msg);
2034                         while (msgcount--) {
2035                                 msg_set_seqno(m, msg_seqno(msg));
2036                                 tipc_link_tunnel_xmit(l_ptr, &tunnel_hdr, m,
2037                                                       msg_link_selector(m));
2038                                 pos += align(msg_size(m));
2039                                 m = (struct tipc_msg *)pos;
2040                         }
2041                 } else {
2042                         tipc_link_tunnel_xmit(l_ptr, &tunnel_hdr, msg,
2043                                               msg_link_selector(msg));
2044                 }
2045                 crs = crs->next;
2046         }
2047 }
2048
2049 /* tipc_link_dup_send_queue(): A second link has become active. Tunnel a
2050  * duplicate of the first link's send queue via the new link. This way, we
2051  * are guaranteed that currently queued packets from a socket are delivered
2052  * before future traffic from the same socket, even if this is using the
2053  * new link. The last arriving copy of each duplicate packet is dropped at
2054  * the receiving end by the regular protocol check, so packet cardinality
2055  * and sequence order is preserved per sender/receiver socket pair.
2056  * Owner node is locked.
2057  */
2058 void tipc_link_dup_send_queue(struct tipc_link *l_ptr,
2059                               struct tipc_link *tunnel)
2060 {
2061         struct sk_buff *iter;
2062         struct tipc_msg tunnel_hdr;
2063
2064         tipc_msg_init(&tunnel_hdr, CHANGEOVER_PROTOCOL,
2065                  DUPLICATE_MSG, INT_H_SIZE, l_ptr->addr);
2066         msg_set_msgcnt(&tunnel_hdr, l_ptr->out_queue_size);
2067         msg_set_bearer_id(&tunnel_hdr, l_ptr->peer_bearer_id);
2068         iter = l_ptr->first_out;
2069         while (iter) {
2070                 struct sk_buff *outbuf;
2071                 struct tipc_msg *msg = buf_msg(iter);
2072                 u32 length = msg_size(msg);
2073
2074                 if (msg_user(msg) == MSG_BUNDLER)
2075                         msg_set_type(msg, CLOSED_MSG);
2076                 msg_set_ack(msg, mod(l_ptr->next_in_no - 1));   /* Update */
2077                 msg_set_bcast_ack(msg, l_ptr->owner->bclink.last_in);
2078                 msg_set_size(&tunnel_hdr, length + INT_H_SIZE);
2079                 outbuf = tipc_buf_acquire(length + INT_H_SIZE);
2080                 if (outbuf == NULL) {
2081                         pr_warn("%sunable to send duplicate msg\n",
2082                                 link_co_err);
2083                         return;
2084                 }
2085                 skb_copy_to_linear_data(outbuf, &tunnel_hdr, INT_H_SIZE);
2086                 skb_copy_to_linear_data_offset(outbuf, INT_H_SIZE, iter->data,
2087                                                length);
2088                 tipc_link_send_buf(tunnel, outbuf);
2089                 if (!tipc_link_is_up(l_ptr))
2090                         return;
2091                 iter = iter->next;
2092         }
2093 }
2094
2095 /**
2096  * buf_extract - extracts embedded TIPC message from another message
2097  * @skb: encapsulating message buffer
2098  * @from_pos: offset to extract from
2099  *
2100  * Returns a new message buffer containing an embedded message.  The
2101  * encapsulating message itself is left unchanged.
2102  */
2103 static struct sk_buff *buf_extract(struct sk_buff *skb, u32 from_pos)
2104 {
2105         struct tipc_msg *msg = (struct tipc_msg *)(skb->data + from_pos);
2106         u32 size = msg_size(msg);
2107         struct sk_buff *eb;
2108
2109         eb = tipc_buf_acquire(size);
2110         if (eb)
2111                 skb_copy_to_linear_data(eb, msg, size);
2112         return eb;
2113 }
2114
2115 /*  tipc_link_tunnel_rcv(): Receive a tunneled packet, sent
2116  *  via other link as result of a failover (ORIGINAL_MSG) or
2117  *  a new active link (DUPLICATE_MSG). Failover packets are
2118  *  returned to the active link for delivery upwards.
2119  *  Owner node is locked.
2120  */
2121 static int tipc_link_tunnel_rcv(struct tipc_link **l_ptr,
2122                                 struct sk_buff **buf)
2123 {
2124         struct sk_buff *tunnel_buf = *buf;
2125         struct tipc_link *dest_link;
2126         struct tipc_msg *msg;
2127         struct tipc_msg *tunnel_msg = buf_msg(tunnel_buf);
2128         u32 msg_typ = msg_type(tunnel_msg);
2129         u32 msg_count = msg_msgcnt(tunnel_msg);
2130         u32 bearer_id = msg_bearer_id(tunnel_msg);
2131
2132         if (bearer_id >= MAX_BEARERS)
2133                 goto exit;
2134         dest_link = (*l_ptr)->owner->links[bearer_id];
2135         if (!dest_link)
2136                 goto exit;
2137         if (dest_link == *l_ptr) {
2138                 pr_err("Unexpected changeover message on link <%s>\n",
2139                        (*l_ptr)->name);
2140                 goto exit;
2141         }
2142         *l_ptr = dest_link;
2143         msg = msg_get_wrapped(tunnel_msg);
2144
2145         if (msg_typ == DUPLICATE_MSG) {
2146                 if (less(msg_seqno(msg), mod(dest_link->next_in_no)))
2147                         goto exit;
2148                 *buf = buf_extract(tunnel_buf, INT_H_SIZE);
2149                 if (*buf == NULL) {
2150                         pr_warn("%sduplicate msg dropped\n", link_co_err);
2151                         goto exit;
2152                 }
2153                 kfree_skb(tunnel_buf);
2154                 return 1;
2155         }
2156
2157         /* First original message ?: */
2158         if (tipc_link_is_up(dest_link)) {
2159                 pr_info("%s<%s>, changeover initiated by peer\n", link_rst_msg,
2160                         dest_link->name);
2161                 tipc_link_reset(dest_link);
2162                 dest_link->exp_msg_count = msg_count;
2163                 if (!msg_count)
2164                         goto exit;
2165         } else if (dest_link->exp_msg_count == START_CHANGEOVER) {
2166                 dest_link->exp_msg_count = msg_count;
2167                 if (!msg_count)
2168                         goto exit;
2169         }
2170
2171         /* Receive original message */
2172         if (dest_link->exp_msg_count == 0) {
2173                 pr_warn("%sgot too many tunnelled messages\n", link_co_err);
2174                 goto exit;
2175         }
2176         dest_link->exp_msg_count--;
2177         if (less(msg_seqno(msg), dest_link->reset_checkpoint)) {
2178                 goto exit;
2179         } else {
2180                 *buf = buf_extract(tunnel_buf, INT_H_SIZE);
2181                 if (*buf != NULL) {
2182                         kfree_skb(tunnel_buf);
2183                         return 1;
2184                 } else {
2185                         pr_warn("%soriginal msg dropped\n", link_co_err);
2186                 }
2187         }
2188 exit:
2189         *buf = NULL;
2190         kfree_skb(tunnel_buf);
2191         return 0;
2192 }
2193
2194 /*
2195  *  Bundler functionality:
2196  */
2197 void tipc_link_recv_bundle(struct sk_buff *buf)
2198 {
2199         u32 msgcount = msg_msgcnt(buf_msg(buf));
2200         u32 pos = INT_H_SIZE;
2201         struct sk_buff *obuf;
2202
2203         while (msgcount--) {
2204                 obuf = buf_extract(buf, pos);
2205                 if (obuf == NULL) {
2206                         pr_warn("Link unable to unbundle message(s)\n");
2207                         break;
2208                 }
2209                 pos += align(msg_size(buf_msg(obuf)));
2210                 tipc_net_route_msg(obuf);
2211         }
2212         kfree_skb(buf);
2213 }
2214
2215 /*
2216  *  Fragmentation/defragmentation:
2217  */
2218
2219 /*
2220  * link_send_long_buf: Entry for buffers needing fragmentation.
2221  * The buffer is complete, inclusive total message length.
2222  * Returns user data length.
2223  */
2224 static int link_send_long_buf(struct tipc_link *l_ptr, struct sk_buff *buf)
2225 {
2226         struct sk_buff *buf_chain = NULL;
2227         struct sk_buff *buf_chain_tail = (struct sk_buff *)&buf_chain;
2228         struct tipc_msg *inmsg = buf_msg(buf);
2229         struct tipc_msg fragm_hdr;
2230         u32 insize = msg_size(inmsg);
2231         u32 dsz = msg_data_sz(inmsg);
2232         unchar *crs = buf->data;
2233         u32 rest = insize;
2234         u32 pack_sz = l_ptr->max_pkt;
2235         u32 fragm_sz = pack_sz - INT_H_SIZE;
2236         u32 fragm_no = 0;
2237         u32 destaddr;
2238
2239         if (msg_short(inmsg))
2240                 destaddr = l_ptr->addr;
2241         else
2242                 destaddr = msg_destnode(inmsg);
2243
2244         /* Prepare reusable fragment header: */
2245         tipc_msg_init(&fragm_hdr, MSG_FRAGMENTER, FIRST_FRAGMENT,
2246                  INT_H_SIZE, destaddr);
2247
2248         /* Chop up message: */
2249         while (rest > 0) {
2250                 struct sk_buff *fragm;
2251
2252                 if (rest <= fragm_sz) {
2253                         fragm_sz = rest;
2254                         msg_set_type(&fragm_hdr, LAST_FRAGMENT);
2255                 }
2256                 fragm = tipc_buf_acquire(fragm_sz + INT_H_SIZE);
2257                 if (fragm == NULL) {
2258                         kfree_skb(buf);
2259                         kfree_skb_list(buf_chain);
2260                         return -ENOMEM;
2261                 }
2262                 msg_set_size(&fragm_hdr, fragm_sz + INT_H_SIZE);
2263                 fragm_no++;
2264                 msg_set_fragm_no(&fragm_hdr, fragm_no);
2265                 skb_copy_to_linear_data(fragm, &fragm_hdr, INT_H_SIZE);
2266                 skb_copy_to_linear_data_offset(fragm, INT_H_SIZE, crs,
2267                                                fragm_sz);
2268                 buf_chain_tail->next = fragm;
2269                 buf_chain_tail = fragm;
2270
2271                 rest -= fragm_sz;
2272                 crs += fragm_sz;
2273                 msg_set_type(&fragm_hdr, FRAGMENT);
2274         }
2275         kfree_skb(buf);
2276
2277         /* Append chain of fragments to send queue & send them */
2278         l_ptr->long_msg_seq_no++;
2279         link_add_chain_to_outqueue(l_ptr, buf_chain, l_ptr->long_msg_seq_no);
2280         l_ptr->stats.sent_fragments += fragm_no;
2281         l_ptr->stats.sent_fragmented++;
2282         tipc_link_push_queue(l_ptr);
2283
2284         return dsz;
2285 }
2286
2287 /*
2288  * tipc_link_recv_fragment(): Called with node lock on. Returns
2289  * the reassembled buffer if message is complete.
2290  */
2291 int tipc_link_recv_fragment(struct sk_buff **head, struct sk_buff **tail,
2292                             struct sk_buff **fbuf)
2293 {
2294         struct sk_buff *frag = *fbuf;
2295         struct tipc_msg *msg = buf_msg(frag);
2296         u32 fragid = msg_type(msg);
2297         bool headstolen;
2298         int delta;
2299
2300         skb_pull(frag, msg_hdr_sz(msg));
2301         if (fragid == FIRST_FRAGMENT) {
2302                 if (*head || skb_unclone(frag, GFP_ATOMIC))
2303                         goto out_free;
2304                 *head = frag;
2305                 skb_frag_list_init(*head);
2306                 return 0;
2307         } else if (*head &&
2308                    skb_try_coalesce(*head, frag, &headstolen, &delta)) {
2309                 kfree_skb_partial(frag, headstolen);
2310         } else {
2311                 if (!*head)
2312                         goto out_free;
2313                 if (!skb_has_frag_list(*head))
2314                         skb_shinfo(*head)->frag_list = frag;
2315                 else
2316                         (*tail)->next = frag;
2317                 *tail = frag;
2318                 (*head)->truesize += frag->truesize;
2319         }
2320         if (fragid == LAST_FRAGMENT) {
2321                 *fbuf = *head;
2322                 *tail = *head = NULL;
2323                 return LINK_REASM_COMPLETE;
2324         }
2325         return 0;
2326 out_free:
2327         pr_warn_ratelimited("Link unable to reassemble fragmented message\n");
2328         kfree_skb(*fbuf);
2329         return LINK_REASM_ERROR;
2330 }
2331
2332 static void link_set_supervision_props(struct tipc_link *l_ptr, u32 tolerance)
2333 {
2334         if ((tolerance < TIPC_MIN_LINK_TOL) || (tolerance > TIPC_MAX_LINK_TOL))
2335                 return;
2336
2337         l_ptr->tolerance = tolerance;
2338         l_ptr->continuity_interval =
2339                 ((tolerance / 4) > 500) ? 500 : tolerance / 4;
2340         l_ptr->abort_limit = tolerance / (l_ptr->continuity_interval / 4);
2341 }
2342
2343 void tipc_link_set_queue_limits(struct tipc_link *l_ptr, u32 window)
2344 {
2345         /* Data messages from this node, inclusive FIRST_FRAGM */
2346         l_ptr->queue_limit[TIPC_LOW_IMPORTANCE] = window;
2347         l_ptr->queue_limit[TIPC_MEDIUM_IMPORTANCE] = (window / 3) * 4;
2348         l_ptr->queue_limit[TIPC_HIGH_IMPORTANCE] = (window / 3) * 5;
2349         l_ptr->queue_limit[TIPC_CRITICAL_IMPORTANCE] = (window / 3) * 6;
2350         /* Transiting data messages,inclusive FIRST_FRAGM */
2351         l_ptr->queue_limit[TIPC_LOW_IMPORTANCE + 4] = 300;
2352         l_ptr->queue_limit[TIPC_MEDIUM_IMPORTANCE + 4] = 600;
2353         l_ptr->queue_limit[TIPC_HIGH_IMPORTANCE + 4] = 900;
2354         l_ptr->queue_limit[TIPC_CRITICAL_IMPORTANCE + 4] = 1200;
2355         l_ptr->queue_limit[CONN_MANAGER] = 1200;
2356         l_ptr->queue_limit[CHANGEOVER_PROTOCOL] = 2500;
2357         l_ptr->queue_limit[NAME_DISTRIBUTOR] = 3000;
2358         /* FRAGMENT and LAST_FRAGMENT packets */
2359         l_ptr->queue_limit[MSG_FRAGMENTER] = 4000;
2360 }
2361
2362 /**
2363  * link_find_link - locate link by name
2364  * @name: ptr to link name string
2365  * @node: ptr to area to be filled with ptr to associated node
2366  *
2367  * Caller must hold 'tipc_net_lock' to ensure node and bearer are not deleted;
2368  * this also prevents link deletion.
2369  *
2370  * Returns pointer to link (or 0 if invalid link name).
2371  */
2372 static struct tipc_link *link_find_link(const char *name,
2373                                         struct tipc_node **node)
2374 {
2375         struct tipc_link *l_ptr;
2376         struct tipc_node *n_ptr;
2377         int i;
2378
2379         list_for_each_entry(n_ptr, &tipc_node_list, list) {
2380                 for (i = 0; i < MAX_BEARERS; i++) {
2381                         l_ptr = n_ptr->links[i];
2382                         if (l_ptr && !strcmp(l_ptr->name, name))
2383                                 goto found;
2384                 }
2385         }
2386         l_ptr = NULL;
2387         n_ptr = NULL;
2388 found:
2389         *node = n_ptr;
2390         return l_ptr;
2391 }
2392
2393 /**
2394  * link_value_is_valid -- validate proposed link tolerance/priority/window
2395  *
2396  * @cmd: value type (TIPC_CMD_SET_LINK_*)
2397  * @new_value: the new value
2398  *
2399  * Returns 1 if value is within range, 0 if not.
2400  */
2401 static int link_value_is_valid(u16 cmd, u32 new_value)
2402 {
2403         switch (cmd) {
2404         case TIPC_CMD_SET_LINK_TOL:
2405                 return (new_value >= TIPC_MIN_LINK_TOL) &&
2406                         (new_value <= TIPC_MAX_LINK_TOL);
2407         case TIPC_CMD_SET_LINK_PRI:
2408                 return (new_value <= TIPC_MAX_LINK_PRI);
2409         case TIPC_CMD_SET_LINK_WINDOW:
2410                 return (new_value >= TIPC_MIN_LINK_WIN) &&
2411                         (new_value <= TIPC_MAX_LINK_WIN);
2412         }
2413         return 0;
2414 }
2415
2416 /**
2417  * link_cmd_set_value - change priority/tolerance/window for link/bearer/media
2418  * @name: ptr to link, bearer, or media name
2419  * @new_value: new value of link, bearer, or media setting
2420  * @cmd: which link, bearer, or media attribute to set (TIPC_CMD_SET_LINK_*)
2421  *
2422  * Caller must hold 'tipc_net_lock' to ensure link/bearer/media is not deleted.
2423  *
2424  * Returns 0 if value updated and negative value on error.
2425  */
2426 static int link_cmd_set_value(const char *name, u32 new_value, u16 cmd)
2427 {
2428         struct tipc_node *node;
2429         struct tipc_link *l_ptr;
2430         struct tipc_bearer *b_ptr;
2431         struct tipc_media *m_ptr;
2432         int res = 0;
2433
2434         l_ptr = link_find_link(name, &node);
2435         if (l_ptr) {
2436                 /*
2437                  * acquire node lock for tipc_link_send_proto_msg().
2438                  * see "TIPC locking policy" in net.c.
2439                  */
2440                 tipc_node_lock(node);
2441                 switch (cmd) {
2442                 case TIPC_CMD_SET_LINK_TOL:
2443                         link_set_supervision_props(l_ptr, new_value);
2444                         tipc_link_send_proto_msg(l_ptr,
2445                                 STATE_MSG, 0, 0, new_value, 0, 0);
2446                         break;
2447                 case TIPC_CMD_SET_LINK_PRI:
2448                         l_ptr->priority = new_value;
2449                         tipc_link_send_proto_msg(l_ptr,
2450                                 STATE_MSG, 0, 0, 0, new_value, 0);
2451                         break;
2452                 case TIPC_CMD_SET_LINK_WINDOW:
2453                         tipc_link_set_queue_limits(l_ptr, new_value);
2454                         break;
2455                 default:
2456                         res = -EINVAL;
2457                         break;
2458                 }
2459                 tipc_node_unlock(node);
2460                 return res;
2461         }
2462
2463         b_ptr = tipc_bearer_find(name);
2464         if (b_ptr) {
2465                 switch (cmd) {
2466                 case TIPC_CMD_SET_LINK_TOL:
2467                         b_ptr->tolerance = new_value;
2468                         break;
2469                 case TIPC_CMD_SET_LINK_PRI:
2470                         b_ptr->priority = new_value;
2471                         break;
2472                 case TIPC_CMD_SET_LINK_WINDOW:
2473                         b_ptr->window = new_value;
2474                         break;
2475                 default:
2476                         res = -EINVAL;
2477                         break;
2478                 }
2479                 return res;
2480         }
2481
2482         m_ptr = tipc_media_find(name);
2483         if (!m_ptr)
2484                 return -ENODEV;
2485         switch (cmd) {
2486         case TIPC_CMD_SET_LINK_TOL:
2487                 m_ptr->tolerance = new_value;
2488                 break;
2489         case TIPC_CMD_SET_LINK_PRI:
2490                 m_ptr->priority = new_value;
2491                 break;
2492         case TIPC_CMD_SET_LINK_WINDOW:
2493                 m_ptr->window = new_value;
2494                 break;
2495         default:
2496                 res = -EINVAL;
2497                 break;
2498         }
2499         return res;
2500 }
2501
2502 struct sk_buff *tipc_link_cmd_config(const void *req_tlv_area, int req_tlv_space,
2503                                      u16 cmd)
2504 {
2505         struct tipc_link_config *args;
2506         u32 new_value;
2507         int res;
2508
2509         if (!TLV_CHECK(req_tlv_area, req_tlv_space, TIPC_TLV_LINK_CONFIG))
2510                 return tipc_cfg_reply_error_string(TIPC_CFG_TLV_ERROR);
2511
2512         args = (struct tipc_link_config *)TLV_DATA(req_tlv_area);
2513         new_value = ntohl(args->value);
2514
2515         if (!link_value_is_valid(cmd, new_value))
2516                 return tipc_cfg_reply_error_string(
2517                         "cannot change, value invalid");
2518
2519         if (!strcmp(args->name, tipc_bclink_name)) {
2520                 if ((cmd == TIPC_CMD_SET_LINK_WINDOW) &&
2521                     (tipc_bclink_set_queue_limits(new_value) == 0))
2522                         return tipc_cfg_reply_none();
2523                 return tipc_cfg_reply_error_string(TIPC_CFG_NOT_SUPPORTED
2524                                                    " (cannot change setting on broadcast link)");
2525         }
2526
2527         read_lock_bh(&tipc_net_lock);
2528         res = link_cmd_set_value(args->name, new_value, cmd);
2529         read_unlock_bh(&tipc_net_lock);
2530         if (res)
2531                 return tipc_cfg_reply_error_string("cannot change link setting");
2532
2533         return tipc_cfg_reply_none();
2534 }
2535
2536 /**
2537  * link_reset_statistics - reset link statistics
2538  * @l_ptr: pointer to link
2539  */
2540 static void link_reset_statistics(struct tipc_link *l_ptr)
2541 {
2542         memset(&l_ptr->stats, 0, sizeof(l_ptr->stats));
2543         l_ptr->stats.sent_info = l_ptr->next_out_no;
2544         l_ptr->stats.recv_info = l_ptr->next_in_no;
2545 }
2546
2547 struct sk_buff *tipc_link_cmd_reset_stats(const void *req_tlv_area, int req_tlv_space)
2548 {
2549         char *link_name;
2550         struct tipc_link *l_ptr;
2551         struct tipc_node *node;
2552
2553         if (!TLV_CHECK(req_tlv_area, req_tlv_space, TIPC_TLV_LINK_NAME))
2554                 return tipc_cfg_reply_error_string(TIPC_CFG_TLV_ERROR);
2555
2556         link_name = (char *)TLV_DATA(req_tlv_area);
2557         if (!strcmp(link_name, tipc_bclink_name)) {
2558                 if (tipc_bclink_reset_stats())
2559                         return tipc_cfg_reply_error_string("link not found");
2560                 return tipc_cfg_reply_none();
2561         }
2562
2563         read_lock_bh(&tipc_net_lock);
2564         l_ptr = link_find_link(link_name, &node);
2565         if (!l_ptr) {
2566                 read_unlock_bh(&tipc_net_lock);
2567                 return tipc_cfg_reply_error_string("link not found");
2568         }
2569
2570         tipc_node_lock(node);
2571         link_reset_statistics(l_ptr);
2572         tipc_node_unlock(node);
2573         read_unlock_bh(&tipc_net_lock);
2574         return tipc_cfg_reply_none();
2575 }
2576
2577 /**
2578  * percent - convert count to a percentage of total (rounding up or down)
2579  */
2580 static u32 percent(u32 count, u32 total)
2581 {
2582         return (count * 100 + (total / 2)) / total;
2583 }
2584
2585 /**
2586  * tipc_link_stats - print link statistics
2587  * @name: link name
2588  * @buf: print buffer area
2589  * @buf_size: size of print buffer area
2590  *
2591  * Returns length of print buffer data string (or 0 if error)
2592  */
2593 static int tipc_link_stats(const char *name, char *buf, const u32 buf_size)
2594 {
2595         struct tipc_link *l;
2596         struct tipc_stats *s;
2597         struct tipc_node *node;
2598         char *status;
2599         u32 profile_total = 0;
2600         int ret;
2601
2602         if (!strcmp(name, tipc_bclink_name))
2603                 return tipc_bclink_stats(buf, buf_size);
2604
2605         read_lock_bh(&tipc_net_lock);
2606         l = link_find_link(name, &node);
2607         if (!l) {
2608                 read_unlock_bh(&tipc_net_lock);
2609                 return 0;
2610         }
2611         tipc_node_lock(node);
2612         s = &l->stats;
2613
2614         if (tipc_link_is_active(l))
2615                 status = "ACTIVE";
2616         else if (tipc_link_is_up(l))
2617                 status = "STANDBY";
2618         else
2619                 status = "DEFUNCT";
2620
2621         ret = tipc_snprintf(buf, buf_size, "Link <%s>\n"
2622                             "  %s  MTU:%u  Priority:%u  Tolerance:%u ms"
2623                             "  Window:%u packets\n",
2624                             l->name, status, l->max_pkt, l->priority,
2625                             l->tolerance, l->queue_limit[0]);
2626
2627         ret += tipc_snprintf(buf + ret, buf_size - ret,
2628                              "  RX packets:%u fragments:%u/%u bundles:%u/%u\n",
2629                              l->next_in_no - s->recv_info, s->recv_fragments,
2630                              s->recv_fragmented, s->recv_bundles,
2631                              s->recv_bundled);
2632
2633         ret += tipc_snprintf(buf + ret, buf_size - ret,
2634                              "  TX packets:%u fragments:%u/%u bundles:%u/%u\n",
2635                              l->next_out_no - s->sent_info, s->sent_fragments,
2636                              s->sent_fragmented, s->sent_bundles,
2637                              s->sent_bundled);
2638
2639         profile_total = s->msg_length_counts;
2640         if (!profile_total)
2641                 profile_total = 1;
2642
2643         ret += tipc_snprintf(buf + ret, buf_size - ret,
2644                              "  TX profile sample:%u packets  average:%u octets\n"
2645                              "  0-64:%u%% -256:%u%% -1024:%u%% -4096:%u%% "
2646                              "-16384:%u%% -32768:%u%% -66000:%u%%\n",
2647                              s->msg_length_counts,
2648                              s->msg_lengths_total / profile_total,
2649                              percent(s->msg_length_profile[0], profile_total),
2650                              percent(s->msg_length_profile[1], profile_total),
2651                              percent(s->msg_length_profile[2], profile_total),
2652                              percent(s->msg_length_profile[3], profile_total),
2653                              percent(s->msg_length_profile[4], profile_total),
2654                              percent(s->msg_length_profile[5], profile_total),
2655                              percent(s->msg_length_profile[6], profile_total));
2656
2657         ret += tipc_snprintf(buf + ret, buf_size - ret,
2658                              "  RX states:%u probes:%u naks:%u defs:%u"
2659                              " dups:%u\n", s->recv_states, s->recv_probes,
2660                              s->recv_nacks, s->deferred_recv, s->duplicates);
2661
2662         ret += tipc_snprintf(buf + ret, buf_size - ret,
2663                              "  TX states:%u probes:%u naks:%u acks:%u"
2664                              " dups:%u\n", s->sent_states, s->sent_probes,
2665                              s->sent_nacks, s->sent_acks, s->retransmitted);
2666
2667         ret += tipc_snprintf(buf + ret, buf_size - ret,
2668                              "  Congestion link:%u  Send queue"
2669                              " max:%u avg:%u\n", s->link_congs,
2670                              s->max_queue_sz, s->queue_sz_counts ?
2671                              (s->accu_queue_sz / s->queue_sz_counts) : 0);
2672
2673         tipc_node_unlock(node);
2674         read_unlock_bh(&tipc_net_lock);
2675         return ret;
2676 }
2677
2678 struct sk_buff *tipc_link_cmd_show_stats(const void *req_tlv_area, int req_tlv_space)
2679 {
2680         struct sk_buff *buf;
2681         struct tlv_desc *rep_tlv;
2682         int str_len;
2683         int pb_len;
2684         char *pb;
2685
2686         if (!TLV_CHECK(req_tlv_area, req_tlv_space, TIPC_TLV_LINK_NAME))
2687                 return tipc_cfg_reply_error_string(TIPC_CFG_TLV_ERROR);
2688
2689         buf = tipc_cfg_reply_alloc(TLV_SPACE(ULTRA_STRING_MAX_LEN));
2690         if (!buf)
2691                 return NULL;
2692
2693         rep_tlv = (struct tlv_desc *)buf->data;
2694         pb = TLV_DATA(rep_tlv);
2695         pb_len = ULTRA_STRING_MAX_LEN;
2696         str_len = tipc_link_stats((char *)TLV_DATA(req_tlv_area),
2697                                   pb, pb_len);
2698         if (!str_len) {
2699                 kfree_skb(buf);
2700                 return tipc_cfg_reply_error_string("link not found");
2701         }
2702         str_len += 1;   /* for "\0" */
2703         skb_put(buf, TLV_SPACE(str_len));
2704         TLV_SET(rep_tlv, TIPC_TLV_ULTRA_STRING, NULL, str_len);
2705
2706         return buf;
2707 }
2708
2709 /**
2710  * tipc_link_get_max_pkt - get maximum packet size to use when sending to destination
2711  * @dest: network address of destination node
2712  * @selector: used to select from set of active links
2713  *
2714  * If no active link can be found, uses default maximum packet size.
2715  */
2716 u32 tipc_link_get_max_pkt(u32 dest, u32 selector)
2717 {
2718         struct tipc_node *n_ptr;
2719         struct tipc_link *l_ptr;
2720         u32 res = MAX_PKT_DEFAULT;
2721
2722         if (dest == tipc_own_addr)
2723                 return MAX_MSG_SIZE;
2724
2725         read_lock_bh(&tipc_net_lock);
2726         n_ptr = tipc_node_find(dest);
2727         if (n_ptr) {
2728                 tipc_node_lock(n_ptr);
2729                 l_ptr = n_ptr->active_links[selector & 1];
2730                 if (l_ptr)
2731                         res = l_ptr->max_pkt;
2732                 tipc_node_unlock(n_ptr);
2733         }
2734         read_unlock_bh(&tipc_net_lock);
2735         return res;
2736 }
2737
2738 static void link_print(struct tipc_link *l_ptr, const char *str)
2739 {
2740         pr_info("%s Link %x<%s>:", str, l_ptr->addr, l_ptr->b_ptr->name);
2741
2742         if (link_working_unknown(l_ptr))
2743                 pr_cont(":WU\n");
2744         else if (link_reset_reset(l_ptr))
2745                 pr_cont(":RR\n");
2746         else if (link_reset_unknown(l_ptr))
2747                 pr_cont(":RU\n");
2748         else if (link_working_working(l_ptr))
2749                 pr_cont(":WW\n");
2750         else
2751                 pr_cont("\n");
2752 }