xref: /linux/net/tipc/link.c (revision 0d456bad36d42d16022be045c8a53ddbb59ee478)
1 /*
2  * net/tipc/link.c: TIPC link code
3  *
4  * Copyright (c) 1996-2007, 2012, Ericsson AB
5  * Copyright (c) 2004-2007, 2010-2011, Wind River Systems
6  * All rights reserved.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions are met:
10  *
11  * 1. Redistributions of source code must retain the above copyright
12  *    notice, this list of conditions and the following disclaimer.
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in the
15  *    documentation and/or other materials provided with the distribution.
16  * 3. Neither the names of the copyright holders nor the names of its
17  *    contributors may be used to endorse or promote products derived from
18  *    this software without specific prior written permission.
19  *
20  * Alternatively, this software may be distributed under the terms of the
21  * GNU General Public License ("GPL") version 2 as published by the Free
22  * Software Foundation.
23  *
24  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
25  * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
26  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
27  * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
28  * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
29  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
30  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
31  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
32  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
33  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
34  * POSSIBILITY OF SUCH DAMAGE.
35  */
36 
37 #include "core.h"
38 #include "link.h"
39 #include "port.h"
40 #include "name_distr.h"
41 #include "discover.h"
42 #include "config.h"
43 
44 /*
45  * Error message prefixes
46  */
47 static const char *link_co_err = "Link changeover error, ";
48 static const char *link_rst_msg = "Resetting link ";
49 static const char *link_unk_evt = "Unknown link event ";
50 
51 /*
52  * Out-of-range value for link session numbers
53  */
54 #define INVALID_SESSION 0x10000
55 
56 /*
57  * Link state events:
58  */
59 #define  STARTING_EVT    856384768	/* link processing trigger */
60 #define  TRAFFIC_MSG_EVT 560815u	/* rx'd ??? */
61 #define  TIMEOUT_EVT     560817u	/* link timer expired */
62 
63 /*
64  * The following two 'message types' is really just implementation
65  * data conveniently stored in the message header.
66  * They must not be considered part of the protocol
67  */
68 #define OPEN_MSG   0
69 #define CLOSED_MSG 1
70 
71 /*
72  * State value stored in 'exp_msg_count'
73  */
74 #define START_CHANGEOVER 100000u
75 
76 /**
77  * struct tipc_link_name - deconstructed link name
78  * @addr_local: network address of node at this end
79  * @if_local: name of interface at this end
80  * @addr_peer: network address of node at far end
81  * @if_peer: name of interface at far end
82  */
83 struct tipc_link_name {
84 	u32 addr_local;
85 	char if_local[TIPC_MAX_IF_NAME];
86 	u32 addr_peer;
87 	char if_peer[TIPC_MAX_IF_NAME];
88 };
89 
90 static void link_handle_out_of_seq_msg(struct tipc_link *l_ptr,
91 				       struct sk_buff *buf);
92 static void link_recv_proto_msg(struct tipc_link *l_ptr, struct sk_buff *buf);
93 static int  link_recv_changeover_msg(struct tipc_link **l_ptr,
94 				     struct sk_buff **buf);
95 static void link_set_supervision_props(struct tipc_link *l_ptr, u32 tolerance);
96 static int  link_send_sections_long(struct tipc_port *sender,
97 				    struct iovec const *msg_sect,
98 				    u32 num_sect, unsigned int total_len,
99 				    u32 destnode);
100 static void link_state_event(struct tipc_link *l_ptr, u32 event);
101 static void link_reset_statistics(struct tipc_link *l_ptr);
102 static void link_print(struct tipc_link *l_ptr, const char *str);
103 static void link_start(struct tipc_link *l_ptr);
104 static int link_send_long_buf(struct tipc_link *l_ptr, struct sk_buff *buf);
105 static void tipc_link_send_sync(struct tipc_link *l);
106 static void tipc_link_recv_sync(struct tipc_node *n, struct sk_buff *buf);
107 
108 /*
109  *  Simple link routines
110  */
111 static unsigned int align(unsigned int i)
112 {
113 	return (i + 3) & ~3u;
114 }
115 
116 static void link_init_max_pkt(struct tipc_link *l_ptr)
117 {
118 	u32 max_pkt;
119 
120 	max_pkt = (l_ptr->b_ptr->mtu & ~3);
121 	if (max_pkt > MAX_MSG_SIZE)
122 		max_pkt = MAX_MSG_SIZE;
123 
124 	l_ptr->max_pkt_target = max_pkt;
125 	if (l_ptr->max_pkt_target < MAX_PKT_DEFAULT)
126 		l_ptr->max_pkt = l_ptr->max_pkt_target;
127 	else
128 		l_ptr->max_pkt = MAX_PKT_DEFAULT;
129 
130 	l_ptr->max_pkt_probes = 0;
131 }
132 
133 static u32 link_next_sent(struct tipc_link *l_ptr)
134 {
135 	if (l_ptr->next_out)
136 		return buf_seqno(l_ptr->next_out);
137 	return mod(l_ptr->next_out_no);
138 }
139 
140 static u32 link_last_sent(struct tipc_link *l_ptr)
141 {
142 	return mod(link_next_sent(l_ptr) - 1);
143 }
144 
145 /*
146  *  Simple non-static link routines (i.e. referenced outside this file)
147  */
148 int tipc_link_is_up(struct tipc_link *l_ptr)
149 {
150 	if (!l_ptr)
151 		return 0;
152 	return link_working_working(l_ptr) || link_working_unknown(l_ptr);
153 }
154 
155 int tipc_link_is_active(struct tipc_link *l_ptr)
156 {
157 	return	(l_ptr->owner->active_links[0] == l_ptr) ||
158 		(l_ptr->owner->active_links[1] == l_ptr);
159 }
160 
161 /**
162  * link_name_validate - validate & (optionally) deconstruct tipc_link name
163  * @name: ptr to link name string
164  * @name_parts: ptr to area for link name components (or NULL if not needed)
165  *
166  * Returns 1 if link name is valid, otherwise 0.
167  */
168 static int link_name_validate(const char *name,
169 				struct tipc_link_name *name_parts)
170 {
171 	char name_copy[TIPC_MAX_LINK_NAME];
172 	char *addr_local;
173 	char *if_local;
174 	char *addr_peer;
175 	char *if_peer;
176 	char dummy;
177 	u32 z_local, c_local, n_local;
178 	u32 z_peer, c_peer, n_peer;
179 	u32 if_local_len;
180 	u32 if_peer_len;
181 
182 	/* copy link name & ensure length is OK */
183 	name_copy[TIPC_MAX_LINK_NAME - 1] = 0;
184 	/* need above in case non-Posix strncpy() doesn't pad with nulls */
185 	strncpy(name_copy, name, TIPC_MAX_LINK_NAME);
186 	if (name_copy[TIPC_MAX_LINK_NAME - 1] != 0)
187 		return 0;
188 
189 	/* ensure all component parts of link name are present */
190 	addr_local = name_copy;
191 	if_local = strchr(addr_local, ':');
192 	if (if_local == NULL)
193 		return 0;
194 	*(if_local++) = 0;
195 	addr_peer = strchr(if_local, '-');
196 	if (addr_peer == NULL)
197 		return 0;
198 	*(addr_peer++) = 0;
199 	if_local_len = addr_peer - if_local;
200 	if_peer = strchr(addr_peer, ':');
201 	if (if_peer == NULL)
202 		return 0;
203 	*(if_peer++) = 0;
204 	if_peer_len = strlen(if_peer) + 1;
205 
206 	/* validate component parts of link name */
207 	if ((sscanf(addr_local, "%u.%u.%u%c",
208 		    &z_local, &c_local, &n_local, &dummy) != 3) ||
209 	    (sscanf(addr_peer, "%u.%u.%u%c",
210 		    &z_peer, &c_peer, &n_peer, &dummy) != 3) ||
211 	    (z_local > 255) || (c_local > 4095) || (n_local > 4095) ||
212 	    (z_peer  > 255) || (c_peer  > 4095) || (n_peer  > 4095) ||
213 	    (if_local_len <= 1) || (if_local_len > TIPC_MAX_IF_NAME) ||
214 	    (if_peer_len  <= 1) || (if_peer_len  > TIPC_MAX_IF_NAME))
215 		return 0;
216 
217 	/* return link name components, if necessary */
218 	if (name_parts) {
219 		name_parts->addr_local = tipc_addr(z_local, c_local, n_local);
220 		strcpy(name_parts->if_local, if_local);
221 		name_parts->addr_peer = tipc_addr(z_peer, c_peer, n_peer);
222 		strcpy(name_parts->if_peer, if_peer);
223 	}
224 	return 1;
225 }
226 
227 /**
228  * link_timeout - handle expiration of link timer
229  * @l_ptr: pointer to link
230  *
231  * This routine must not grab "tipc_net_lock" to avoid a potential deadlock conflict
232  * with tipc_link_delete().  (There is no risk that the node will be deleted by
233  * another thread because tipc_link_delete() always cancels the link timer before
234  * tipc_node_delete() is called.)
235  */
236 static void link_timeout(struct tipc_link *l_ptr)
237 {
238 	tipc_node_lock(l_ptr->owner);
239 
240 	/* update counters used in statistical profiling of send traffic */
241 	l_ptr->stats.accu_queue_sz += l_ptr->out_queue_size;
242 	l_ptr->stats.queue_sz_counts++;
243 
244 	if (l_ptr->first_out) {
245 		struct tipc_msg *msg = buf_msg(l_ptr->first_out);
246 		u32 length = msg_size(msg);
247 
248 		if ((msg_user(msg) == MSG_FRAGMENTER) &&
249 		    (msg_type(msg) == FIRST_FRAGMENT)) {
250 			length = msg_size(msg_get_wrapped(msg));
251 		}
252 		if (length) {
253 			l_ptr->stats.msg_lengths_total += length;
254 			l_ptr->stats.msg_length_counts++;
255 			if (length <= 64)
256 				l_ptr->stats.msg_length_profile[0]++;
257 			else if (length <= 256)
258 				l_ptr->stats.msg_length_profile[1]++;
259 			else if (length <= 1024)
260 				l_ptr->stats.msg_length_profile[2]++;
261 			else if (length <= 4096)
262 				l_ptr->stats.msg_length_profile[3]++;
263 			else if (length <= 16384)
264 				l_ptr->stats.msg_length_profile[4]++;
265 			else if (length <= 32768)
266 				l_ptr->stats.msg_length_profile[5]++;
267 			else
268 				l_ptr->stats.msg_length_profile[6]++;
269 		}
270 	}
271 
272 	/* do all other link processing performed on a periodic basis */
273 
274 	link_state_event(l_ptr, TIMEOUT_EVT);
275 
276 	if (l_ptr->next_out)
277 		tipc_link_push_queue(l_ptr);
278 
279 	tipc_node_unlock(l_ptr->owner);
280 }
281 
282 static void link_set_timer(struct tipc_link *l_ptr, u32 time)
283 {
284 	k_start_timer(&l_ptr->timer, time);
285 }
286 
287 /**
288  * tipc_link_create - create a new link
289  * @n_ptr: pointer to associated node
290  * @b_ptr: pointer to associated bearer
291  * @media_addr: media address to use when sending messages over link
292  *
293  * Returns pointer to link.
294  */
295 struct tipc_link *tipc_link_create(struct tipc_node *n_ptr,
296 			      struct tipc_bearer *b_ptr,
297 			      const struct tipc_media_addr *media_addr)
298 {
299 	struct tipc_link *l_ptr;
300 	struct tipc_msg *msg;
301 	char *if_name;
302 	char addr_string[16];
303 	u32 peer = n_ptr->addr;
304 
305 	if (n_ptr->link_cnt >= 2) {
306 		tipc_addr_string_fill(addr_string, n_ptr->addr);
307 		pr_err("Attempt to establish third link to %s\n", addr_string);
308 		return NULL;
309 	}
310 
311 	if (n_ptr->links[b_ptr->identity]) {
312 		tipc_addr_string_fill(addr_string, n_ptr->addr);
313 		pr_err("Attempt to establish second link on <%s> to %s\n",
314 		       b_ptr->name, addr_string);
315 		return NULL;
316 	}
317 
318 	l_ptr = kzalloc(sizeof(*l_ptr), GFP_ATOMIC);
319 	if (!l_ptr) {
320 		pr_warn("Link creation failed, no memory\n");
321 		return NULL;
322 	}
323 
324 	l_ptr->addr = peer;
325 	if_name = strchr(b_ptr->name, ':') + 1;
326 	sprintf(l_ptr->name, "%u.%u.%u:%s-%u.%u.%u:unknown",
327 		tipc_zone(tipc_own_addr), tipc_cluster(tipc_own_addr),
328 		tipc_node(tipc_own_addr),
329 		if_name,
330 		tipc_zone(peer), tipc_cluster(peer), tipc_node(peer));
331 		/* note: peer i/f name is updated by reset/activate message */
332 	memcpy(&l_ptr->media_addr, media_addr, sizeof(*media_addr));
333 	l_ptr->owner = n_ptr;
334 	l_ptr->checkpoint = 1;
335 	l_ptr->peer_session = INVALID_SESSION;
336 	l_ptr->b_ptr = b_ptr;
337 	link_set_supervision_props(l_ptr, b_ptr->tolerance);
338 	l_ptr->state = RESET_UNKNOWN;
339 
340 	l_ptr->pmsg = (struct tipc_msg *)&l_ptr->proto_msg;
341 	msg = l_ptr->pmsg;
342 	tipc_msg_init(msg, LINK_PROTOCOL, RESET_MSG, INT_H_SIZE, l_ptr->addr);
343 	msg_set_size(msg, sizeof(l_ptr->proto_msg));
344 	msg_set_session(msg, (tipc_random & 0xffff));
345 	msg_set_bearer_id(msg, b_ptr->identity);
346 	strcpy((char *)msg_data(msg), if_name);
347 
348 	l_ptr->priority = b_ptr->priority;
349 	tipc_link_set_queue_limits(l_ptr, b_ptr->window);
350 
351 	link_init_max_pkt(l_ptr);
352 
353 	l_ptr->next_out_no = 1;
354 	INIT_LIST_HEAD(&l_ptr->waiting_ports);
355 
356 	link_reset_statistics(l_ptr);
357 
358 	tipc_node_attach_link(n_ptr, l_ptr);
359 
360 	k_init_timer(&l_ptr->timer, (Handler)link_timeout, (unsigned long)l_ptr);
361 	list_add_tail(&l_ptr->link_list, &b_ptr->links);
362 	tipc_k_signal((Handler)link_start, (unsigned long)l_ptr);
363 
364 	return l_ptr;
365 }
366 
367 /**
368  * tipc_link_delete - delete a link
369  * @l_ptr: pointer to link
370  *
371  * Note: 'tipc_net_lock' is write_locked, bearer is locked.
372  * This routine must not grab the node lock until after link timer cancellation
373  * to avoid a potential deadlock situation.
374  */
375 void tipc_link_delete(struct tipc_link *l_ptr)
376 {
377 	if (!l_ptr) {
378 		pr_err("Attempt to delete non-existent link\n");
379 		return;
380 	}
381 
382 	k_cancel_timer(&l_ptr->timer);
383 
384 	tipc_node_lock(l_ptr->owner);
385 	tipc_link_reset(l_ptr);
386 	tipc_node_detach_link(l_ptr->owner, l_ptr);
387 	tipc_link_stop(l_ptr);
388 	list_del_init(&l_ptr->link_list);
389 	tipc_node_unlock(l_ptr->owner);
390 	k_term_timer(&l_ptr->timer);
391 	kfree(l_ptr);
392 }
393 
394 static void link_start(struct tipc_link *l_ptr)
395 {
396 	tipc_node_lock(l_ptr->owner);
397 	link_state_event(l_ptr, STARTING_EVT);
398 	tipc_node_unlock(l_ptr->owner);
399 }
400 
401 /**
402  * link_schedule_port - schedule port for deferred sending
403  * @l_ptr: pointer to link
404  * @origport: reference to sending port
405  * @sz: amount of data to be sent
406  *
407  * Schedules port for renewed sending of messages after link congestion
408  * has abated.
409  */
410 static int link_schedule_port(struct tipc_link *l_ptr, u32 origport, u32 sz)
411 {
412 	struct tipc_port *p_ptr;
413 
414 	spin_lock_bh(&tipc_port_list_lock);
415 	p_ptr = tipc_port_lock(origport);
416 	if (p_ptr) {
417 		if (!p_ptr->wakeup)
418 			goto exit;
419 		if (!list_empty(&p_ptr->wait_list))
420 			goto exit;
421 		p_ptr->congested = 1;
422 		p_ptr->waiting_pkts = 1 + ((sz - 1) / l_ptr->max_pkt);
423 		list_add_tail(&p_ptr->wait_list, &l_ptr->waiting_ports);
424 		l_ptr->stats.link_congs++;
425 exit:
426 		tipc_port_unlock(p_ptr);
427 	}
428 	spin_unlock_bh(&tipc_port_list_lock);
429 	return -ELINKCONG;
430 }
431 
432 void tipc_link_wakeup_ports(struct tipc_link *l_ptr, int all)
433 {
434 	struct tipc_port *p_ptr;
435 	struct tipc_port *temp_p_ptr;
436 	int win = l_ptr->queue_limit[0] - l_ptr->out_queue_size;
437 
438 	if (all)
439 		win = 100000;
440 	if (win <= 0)
441 		return;
442 	if (!spin_trylock_bh(&tipc_port_list_lock))
443 		return;
444 	if (link_congested(l_ptr))
445 		goto exit;
446 	list_for_each_entry_safe(p_ptr, temp_p_ptr, &l_ptr->waiting_ports,
447 				 wait_list) {
448 		if (win <= 0)
449 			break;
450 		list_del_init(&p_ptr->wait_list);
451 		spin_lock_bh(p_ptr->lock);
452 		p_ptr->congested = 0;
453 		p_ptr->wakeup(p_ptr);
454 		win -= p_ptr->waiting_pkts;
455 		spin_unlock_bh(p_ptr->lock);
456 	}
457 
458 exit:
459 	spin_unlock_bh(&tipc_port_list_lock);
460 }
461 
462 /**
463  * link_release_outqueue - purge link's outbound message queue
464  * @l_ptr: pointer to link
465  */
466 static void link_release_outqueue(struct tipc_link *l_ptr)
467 {
468 	struct sk_buff *buf = l_ptr->first_out;
469 	struct sk_buff *next;
470 
471 	while (buf) {
472 		next = buf->next;
473 		kfree_skb(buf);
474 		buf = next;
475 	}
476 	l_ptr->first_out = NULL;
477 	l_ptr->out_queue_size = 0;
478 }
479 
480 /**
481  * tipc_link_reset_fragments - purge link's inbound message fragments queue
482  * @l_ptr: pointer to link
483  */
484 void tipc_link_reset_fragments(struct tipc_link *l_ptr)
485 {
486 	struct sk_buff *buf = l_ptr->defragm_buf;
487 	struct sk_buff *next;
488 
489 	while (buf) {
490 		next = buf->next;
491 		kfree_skb(buf);
492 		buf = next;
493 	}
494 	l_ptr->defragm_buf = NULL;
495 }
496 
497 /**
498  * tipc_link_stop - purge all inbound and outbound messages associated with link
499  * @l_ptr: pointer to link
500  */
501 void tipc_link_stop(struct tipc_link *l_ptr)
502 {
503 	struct sk_buff *buf;
504 	struct sk_buff *next;
505 
506 	buf = l_ptr->oldest_deferred_in;
507 	while (buf) {
508 		next = buf->next;
509 		kfree_skb(buf);
510 		buf = next;
511 	}
512 
513 	buf = l_ptr->first_out;
514 	while (buf) {
515 		next = buf->next;
516 		kfree_skb(buf);
517 		buf = next;
518 	}
519 
520 	tipc_link_reset_fragments(l_ptr);
521 
522 	kfree_skb(l_ptr->proto_msg_queue);
523 	l_ptr->proto_msg_queue = NULL;
524 }
525 
526 void tipc_link_reset(struct tipc_link *l_ptr)
527 {
528 	struct sk_buff *buf;
529 	u32 prev_state = l_ptr->state;
530 	u32 checkpoint = l_ptr->next_in_no;
531 	int was_active_link = tipc_link_is_active(l_ptr);
532 
533 	msg_set_session(l_ptr->pmsg, ((msg_session(l_ptr->pmsg) + 1) & 0xffff));
534 
535 	/* Link is down, accept any session */
536 	l_ptr->peer_session = INVALID_SESSION;
537 
538 	/* Prepare for max packet size negotiation */
539 	link_init_max_pkt(l_ptr);
540 
541 	l_ptr->state = RESET_UNKNOWN;
542 
543 	if ((prev_state == RESET_UNKNOWN) || (prev_state == RESET_RESET))
544 		return;
545 
546 	tipc_node_link_down(l_ptr->owner, l_ptr);
547 	tipc_bearer_remove_dest(l_ptr->b_ptr, l_ptr->addr);
548 
549 	if (was_active_link && tipc_node_active_links(l_ptr->owner) &&
550 	    l_ptr->owner->permit_changeover) {
551 		l_ptr->reset_checkpoint = checkpoint;
552 		l_ptr->exp_msg_count = START_CHANGEOVER;
553 	}
554 
555 	/* Clean up all queues: */
556 	link_release_outqueue(l_ptr);
557 	kfree_skb(l_ptr->proto_msg_queue);
558 	l_ptr->proto_msg_queue = NULL;
559 	buf = l_ptr->oldest_deferred_in;
560 	while (buf) {
561 		struct sk_buff *next = buf->next;
562 		kfree_skb(buf);
563 		buf = next;
564 	}
565 	if (!list_empty(&l_ptr->waiting_ports))
566 		tipc_link_wakeup_ports(l_ptr, 1);
567 
568 	l_ptr->retransm_queue_head = 0;
569 	l_ptr->retransm_queue_size = 0;
570 	l_ptr->last_out = NULL;
571 	l_ptr->first_out = NULL;
572 	l_ptr->next_out = NULL;
573 	l_ptr->unacked_window = 0;
574 	l_ptr->checkpoint = 1;
575 	l_ptr->next_out_no = 1;
576 	l_ptr->deferred_inqueue_sz = 0;
577 	l_ptr->oldest_deferred_in = NULL;
578 	l_ptr->newest_deferred_in = NULL;
579 	l_ptr->fsm_msg_cnt = 0;
580 	l_ptr->stale_count = 0;
581 	link_reset_statistics(l_ptr);
582 }
583 
584 
585 static void link_activate(struct tipc_link *l_ptr)
586 {
587 	l_ptr->next_in_no = l_ptr->stats.recv_info = 1;
588 	tipc_node_link_up(l_ptr->owner, l_ptr);
589 	tipc_bearer_add_dest(l_ptr->b_ptr, l_ptr->addr);
590 }
591 
592 /**
593  * link_state_event - link finite state machine
594  * @l_ptr: pointer to link
595  * @event: state machine event to process
596  */
597 static void link_state_event(struct tipc_link *l_ptr, unsigned int event)
598 {
599 	struct tipc_link *other;
600 	u32 cont_intv = l_ptr->continuity_interval;
601 
602 	if (!l_ptr->started && (event != STARTING_EVT))
603 		return;		/* Not yet. */
604 
605 	if (link_blocked(l_ptr)) {
606 		if (event == TIMEOUT_EVT)
607 			link_set_timer(l_ptr, cont_intv);
608 		return;	  /* Changeover going on */
609 	}
610 
611 	switch (l_ptr->state) {
612 	case WORKING_WORKING:
613 		switch (event) {
614 		case TRAFFIC_MSG_EVT:
615 		case ACTIVATE_MSG:
616 			break;
617 		case TIMEOUT_EVT:
618 			if (l_ptr->next_in_no != l_ptr->checkpoint) {
619 				l_ptr->checkpoint = l_ptr->next_in_no;
620 				if (tipc_bclink_acks_missing(l_ptr->owner)) {
621 					tipc_link_send_proto_msg(l_ptr, STATE_MSG,
622 								 0, 0, 0, 0, 0);
623 					l_ptr->fsm_msg_cnt++;
624 				} else if (l_ptr->max_pkt < l_ptr->max_pkt_target) {
625 					tipc_link_send_proto_msg(l_ptr, STATE_MSG,
626 								 1, 0, 0, 0, 0);
627 					l_ptr->fsm_msg_cnt++;
628 				}
629 				link_set_timer(l_ptr, cont_intv);
630 				break;
631 			}
632 			l_ptr->state = WORKING_UNKNOWN;
633 			l_ptr->fsm_msg_cnt = 0;
634 			tipc_link_send_proto_msg(l_ptr, STATE_MSG, 1, 0, 0, 0, 0);
635 			l_ptr->fsm_msg_cnt++;
636 			link_set_timer(l_ptr, cont_intv / 4);
637 			break;
638 		case RESET_MSG:
639 			pr_info("%s<%s>, requested by peer\n", link_rst_msg,
640 				l_ptr->name);
641 			tipc_link_reset(l_ptr);
642 			l_ptr->state = RESET_RESET;
643 			l_ptr->fsm_msg_cnt = 0;
644 			tipc_link_send_proto_msg(l_ptr, ACTIVATE_MSG, 0, 0, 0, 0, 0);
645 			l_ptr->fsm_msg_cnt++;
646 			link_set_timer(l_ptr, cont_intv);
647 			break;
648 		default:
649 			pr_err("%s%u in WW state\n", link_unk_evt, event);
650 		}
651 		break;
652 	case WORKING_UNKNOWN:
653 		switch (event) {
654 		case TRAFFIC_MSG_EVT:
655 		case ACTIVATE_MSG:
656 			l_ptr->state = WORKING_WORKING;
657 			l_ptr->fsm_msg_cnt = 0;
658 			link_set_timer(l_ptr, cont_intv);
659 			break;
660 		case RESET_MSG:
661 			pr_info("%s<%s>, requested by peer while probing\n",
662 				link_rst_msg, l_ptr->name);
663 			tipc_link_reset(l_ptr);
664 			l_ptr->state = RESET_RESET;
665 			l_ptr->fsm_msg_cnt = 0;
666 			tipc_link_send_proto_msg(l_ptr, ACTIVATE_MSG, 0, 0, 0, 0, 0);
667 			l_ptr->fsm_msg_cnt++;
668 			link_set_timer(l_ptr, cont_intv);
669 			break;
670 		case TIMEOUT_EVT:
671 			if (l_ptr->next_in_no != l_ptr->checkpoint) {
672 				l_ptr->state = WORKING_WORKING;
673 				l_ptr->fsm_msg_cnt = 0;
674 				l_ptr->checkpoint = l_ptr->next_in_no;
675 				if (tipc_bclink_acks_missing(l_ptr->owner)) {
676 					tipc_link_send_proto_msg(l_ptr, STATE_MSG,
677 								 0, 0, 0, 0, 0);
678 					l_ptr->fsm_msg_cnt++;
679 				}
680 				link_set_timer(l_ptr, cont_intv);
681 			} else if (l_ptr->fsm_msg_cnt < l_ptr->abort_limit) {
682 				tipc_link_send_proto_msg(l_ptr, STATE_MSG,
683 							 1, 0, 0, 0, 0);
684 				l_ptr->fsm_msg_cnt++;
685 				link_set_timer(l_ptr, cont_intv / 4);
686 			} else {	/* Link has failed */
687 				pr_warn("%s<%s>, peer not responding\n",
688 					link_rst_msg, l_ptr->name);
689 				tipc_link_reset(l_ptr);
690 				l_ptr->state = RESET_UNKNOWN;
691 				l_ptr->fsm_msg_cnt = 0;
692 				tipc_link_send_proto_msg(l_ptr, RESET_MSG,
693 							 0, 0, 0, 0, 0);
694 				l_ptr->fsm_msg_cnt++;
695 				link_set_timer(l_ptr, cont_intv);
696 			}
697 			break;
698 		default:
699 			pr_err("%s%u in WU state\n", link_unk_evt, event);
700 		}
701 		break;
702 	case RESET_UNKNOWN:
703 		switch (event) {
704 		case TRAFFIC_MSG_EVT:
705 			break;
706 		case ACTIVATE_MSG:
707 			other = l_ptr->owner->active_links[0];
708 			if (other && link_working_unknown(other))
709 				break;
710 			l_ptr->state = WORKING_WORKING;
711 			l_ptr->fsm_msg_cnt = 0;
712 			link_activate(l_ptr);
713 			tipc_link_send_proto_msg(l_ptr, STATE_MSG, 1, 0, 0, 0, 0);
714 			l_ptr->fsm_msg_cnt++;
715 			if (l_ptr->owner->working_links == 1)
716 				tipc_link_send_sync(l_ptr);
717 			link_set_timer(l_ptr, cont_intv);
718 			break;
719 		case RESET_MSG:
720 			l_ptr->state = RESET_RESET;
721 			l_ptr->fsm_msg_cnt = 0;
722 			tipc_link_send_proto_msg(l_ptr, ACTIVATE_MSG, 1, 0, 0, 0, 0);
723 			l_ptr->fsm_msg_cnt++;
724 			link_set_timer(l_ptr, cont_intv);
725 			break;
726 		case STARTING_EVT:
727 			l_ptr->started = 1;
728 			/* fall through */
729 		case TIMEOUT_EVT:
730 			tipc_link_send_proto_msg(l_ptr, RESET_MSG, 0, 0, 0, 0, 0);
731 			l_ptr->fsm_msg_cnt++;
732 			link_set_timer(l_ptr, cont_intv);
733 			break;
734 		default:
735 			pr_err("%s%u in RU state\n", link_unk_evt, event);
736 		}
737 		break;
738 	case RESET_RESET:
739 		switch (event) {
740 		case TRAFFIC_MSG_EVT:
741 		case ACTIVATE_MSG:
742 			other = l_ptr->owner->active_links[0];
743 			if (other && link_working_unknown(other))
744 				break;
745 			l_ptr->state = WORKING_WORKING;
746 			l_ptr->fsm_msg_cnt = 0;
747 			link_activate(l_ptr);
748 			tipc_link_send_proto_msg(l_ptr, STATE_MSG, 1, 0, 0, 0, 0);
749 			l_ptr->fsm_msg_cnt++;
750 			if (l_ptr->owner->working_links == 1)
751 				tipc_link_send_sync(l_ptr);
752 			link_set_timer(l_ptr, cont_intv);
753 			break;
754 		case RESET_MSG:
755 			break;
756 		case TIMEOUT_EVT:
757 			tipc_link_send_proto_msg(l_ptr, ACTIVATE_MSG, 0, 0, 0, 0, 0);
758 			l_ptr->fsm_msg_cnt++;
759 			link_set_timer(l_ptr, cont_intv);
760 			break;
761 		default:
762 			pr_err("%s%u in RR state\n", link_unk_evt, event);
763 		}
764 		break;
765 	default:
766 		pr_err("Unknown link state %u/%u\n", l_ptr->state, event);
767 	}
768 }
769 
770 /*
771  * link_bundle_buf(): Append contents of a buffer to
772  * the tail of an existing one.
773  */
774 static int link_bundle_buf(struct tipc_link *l_ptr,
775 			   struct sk_buff *bundler,
776 			   struct sk_buff *buf)
777 {
778 	struct tipc_msg *bundler_msg = buf_msg(bundler);
779 	struct tipc_msg *msg = buf_msg(buf);
780 	u32 size = msg_size(msg);
781 	u32 bundle_size = msg_size(bundler_msg);
782 	u32 to_pos = align(bundle_size);
783 	u32 pad = to_pos - bundle_size;
784 
785 	if (msg_user(bundler_msg) != MSG_BUNDLER)
786 		return 0;
787 	if (msg_type(bundler_msg) != OPEN_MSG)
788 		return 0;
789 	if (skb_tailroom(bundler) < (pad + size))
790 		return 0;
791 	if (l_ptr->max_pkt < (to_pos + size))
792 		return 0;
793 
794 	skb_put(bundler, pad + size);
795 	skb_copy_to_linear_data_offset(bundler, to_pos, buf->data, size);
796 	msg_set_size(bundler_msg, to_pos + size);
797 	msg_set_msgcnt(bundler_msg, msg_msgcnt(bundler_msg) + 1);
798 	kfree_skb(buf);
799 	l_ptr->stats.sent_bundled++;
800 	return 1;
801 }
802 
803 static void link_add_to_outqueue(struct tipc_link *l_ptr,
804 				 struct sk_buff *buf,
805 				 struct tipc_msg *msg)
806 {
807 	u32 ack = mod(l_ptr->next_in_no - 1);
808 	u32 seqno = mod(l_ptr->next_out_no++);
809 
810 	msg_set_word(msg, 2, ((ack << 16) | seqno));
811 	msg_set_bcast_ack(msg, l_ptr->owner->bclink.last_in);
812 	buf->next = NULL;
813 	if (l_ptr->first_out) {
814 		l_ptr->last_out->next = buf;
815 		l_ptr->last_out = buf;
816 	} else
817 		l_ptr->first_out = l_ptr->last_out = buf;
818 
819 	l_ptr->out_queue_size++;
820 	if (l_ptr->out_queue_size > l_ptr->stats.max_queue_sz)
821 		l_ptr->stats.max_queue_sz = l_ptr->out_queue_size;
822 }
823 
824 static void link_add_chain_to_outqueue(struct tipc_link *l_ptr,
825 				       struct sk_buff *buf_chain,
826 				       u32 long_msgno)
827 {
828 	struct sk_buff *buf;
829 	struct tipc_msg *msg;
830 
831 	if (!l_ptr->next_out)
832 		l_ptr->next_out = buf_chain;
833 	while (buf_chain) {
834 		buf = buf_chain;
835 		buf_chain = buf_chain->next;
836 
837 		msg = buf_msg(buf);
838 		msg_set_long_msgno(msg, long_msgno);
839 		link_add_to_outqueue(l_ptr, buf, msg);
840 	}
841 }
842 
843 /*
844  * tipc_link_send_buf() is the 'full path' for messages, called from
845  * inside TIPC when the 'fast path' in tipc_send_buf
846  * has failed, and from link_send()
847  */
848 int tipc_link_send_buf(struct tipc_link *l_ptr, struct sk_buff *buf)
849 {
850 	struct tipc_msg *msg = buf_msg(buf);
851 	u32 size = msg_size(msg);
852 	u32 dsz = msg_data_sz(msg);
853 	u32 queue_size = l_ptr->out_queue_size;
854 	u32 imp = tipc_msg_tot_importance(msg);
855 	u32 queue_limit = l_ptr->queue_limit[imp];
856 	u32 max_packet = l_ptr->max_pkt;
857 
858 	/* Match msg importance against queue limits: */
859 	if (unlikely(queue_size >= queue_limit)) {
860 		if (imp <= TIPC_CRITICAL_IMPORTANCE) {
861 			link_schedule_port(l_ptr, msg_origport(msg), size);
862 			kfree_skb(buf);
863 			return -ELINKCONG;
864 		}
865 		kfree_skb(buf);
866 		if (imp > CONN_MANAGER) {
867 			pr_warn("%s<%s>, send queue full", link_rst_msg,
868 				l_ptr->name);
869 			tipc_link_reset(l_ptr);
870 		}
871 		return dsz;
872 	}
873 
874 	/* Fragmentation needed ? */
875 	if (size > max_packet)
876 		return link_send_long_buf(l_ptr, buf);
877 
878 	/* Packet can be queued or sent. */
879 	if (likely(!tipc_bearer_blocked(l_ptr->b_ptr) &&
880 		   !link_congested(l_ptr))) {
881 		link_add_to_outqueue(l_ptr, buf, msg);
882 
883 		tipc_bearer_send(l_ptr->b_ptr, buf, &l_ptr->media_addr);
884 		l_ptr->unacked_window = 0;
885 		return dsz;
886 	}
887 	/* Congestion: can message be bundled ? */
888 	if ((msg_user(msg) != CHANGEOVER_PROTOCOL) &&
889 	    (msg_user(msg) != MSG_FRAGMENTER)) {
890 
891 		/* Try adding message to an existing bundle */
892 		if (l_ptr->next_out &&
893 		    link_bundle_buf(l_ptr, l_ptr->last_out, buf))
894 			return dsz;
895 
896 		/* Try creating a new bundle */
897 		if (size <= max_packet * 2 / 3) {
898 			struct sk_buff *bundler = tipc_buf_acquire(max_packet);
899 			struct tipc_msg bundler_hdr;
900 
901 			if (bundler) {
902 				tipc_msg_init(&bundler_hdr, MSG_BUNDLER, OPEN_MSG,
903 					 INT_H_SIZE, l_ptr->addr);
904 				skb_copy_to_linear_data(bundler, &bundler_hdr,
905 							INT_H_SIZE);
906 				skb_trim(bundler, INT_H_SIZE);
907 				link_bundle_buf(l_ptr, bundler, buf);
908 				buf = bundler;
909 				msg = buf_msg(buf);
910 				l_ptr->stats.sent_bundles++;
911 			}
912 		}
913 	}
914 	if (!l_ptr->next_out)
915 		l_ptr->next_out = buf;
916 	link_add_to_outqueue(l_ptr, buf, msg);
917 	return dsz;
918 }
919 
920 /*
921  * tipc_link_send(): same as tipc_link_send_buf(), but the link to use has
922  * not been selected yet, and the the owner node is not locked
923  * Called by TIPC internal users, e.g. the name distributor
924  */
925 int tipc_link_send(struct sk_buff *buf, u32 dest, u32 selector)
926 {
927 	struct tipc_link *l_ptr;
928 	struct tipc_node *n_ptr;
929 	int res = -ELINKCONG;
930 
931 	read_lock_bh(&tipc_net_lock);
932 	n_ptr = tipc_node_find(dest);
933 	if (n_ptr) {
934 		tipc_node_lock(n_ptr);
935 		l_ptr = n_ptr->active_links[selector & 1];
936 		if (l_ptr)
937 			res = tipc_link_send_buf(l_ptr, buf);
938 		else
939 			kfree_skb(buf);
940 		tipc_node_unlock(n_ptr);
941 	} else {
942 		kfree_skb(buf);
943 	}
944 	read_unlock_bh(&tipc_net_lock);
945 	return res;
946 }
947 
948 /*
949  * tipc_link_send_sync - synchronize broadcast link endpoints.
950  *
951  * Give a newly added peer node the sequence number where it should
952  * start receiving and acking broadcast packets.
953  *
954  * Called with node locked
955  */
956 static void tipc_link_send_sync(struct tipc_link *l)
957 {
958 	struct sk_buff *buf;
959 	struct tipc_msg *msg;
960 
961 	buf = tipc_buf_acquire(INT_H_SIZE);
962 	if (!buf)
963 		return;
964 
965 	msg = buf_msg(buf);
966 	tipc_msg_init(msg, BCAST_PROTOCOL, STATE_MSG, INT_H_SIZE, l->addr);
967 	msg_set_last_bcast(msg, l->owner->bclink.acked);
968 	link_add_chain_to_outqueue(l, buf, 0);
969 	tipc_link_push_queue(l);
970 }
971 
972 /*
973  * tipc_link_recv_sync - synchronize broadcast link endpoints.
974  * Receive the sequence number where we should start receiving and
975  * acking broadcast packets from a newly added peer node, and open
976  * up for reception of such packets.
977  *
978  * Called with node locked
979  */
980 static void tipc_link_recv_sync(struct tipc_node *n, struct sk_buff *buf)
981 {
982 	struct tipc_msg *msg = buf_msg(buf);
983 
984 	n->bclink.last_sent = n->bclink.last_in = msg_last_bcast(msg);
985 	n->bclink.recv_permitted = true;
986 	kfree_skb(buf);
987 }
988 
989 /*
990  * tipc_link_send_names - send name table entries to new neighbor
991  *
992  * Send routine for bulk delivery of name table messages when contact
993  * with a new neighbor occurs. No link congestion checking is performed
994  * because name table messages *must* be delivered. The messages must be
995  * small enough not to require fragmentation.
996  * Called without any locks held.
997  */
998 void tipc_link_send_names(struct list_head *message_list, u32 dest)
999 {
1000 	struct tipc_node *n_ptr;
1001 	struct tipc_link *l_ptr;
1002 	struct sk_buff *buf;
1003 	struct sk_buff *temp_buf;
1004 
1005 	if (list_empty(message_list))
1006 		return;
1007 
1008 	read_lock_bh(&tipc_net_lock);
1009 	n_ptr = tipc_node_find(dest);
1010 	if (n_ptr) {
1011 		tipc_node_lock(n_ptr);
1012 		l_ptr = n_ptr->active_links[0];
1013 		if (l_ptr) {
1014 			/* convert circular list to linear list */
1015 			((struct sk_buff *)message_list->prev)->next = NULL;
1016 			link_add_chain_to_outqueue(l_ptr,
1017 				(struct sk_buff *)message_list->next, 0);
1018 			tipc_link_push_queue(l_ptr);
1019 			INIT_LIST_HEAD(message_list);
1020 		}
1021 		tipc_node_unlock(n_ptr);
1022 	}
1023 	read_unlock_bh(&tipc_net_lock);
1024 
1025 	/* discard the messages if they couldn't be sent */
1026 	list_for_each_safe(buf, temp_buf, ((struct sk_buff *)message_list)) {
1027 		list_del((struct list_head *)buf);
1028 		kfree_skb(buf);
1029 	}
1030 }
1031 
1032 /*
1033  * link_send_buf_fast: Entry for data messages where the
1034  * destination link is known and the header is complete,
1035  * inclusive total message length. Very time critical.
1036  * Link is locked. Returns user data length.
1037  */
1038 static int link_send_buf_fast(struct tipc_link *l_ptr, struct sk_buff *buf,
1039 			      u32 *used_max_pkt)
1040 {
1041 	struct tipc_msg *msg = buf_msg(buf);
1042 	int res = msg_data_sz(msg);
1043 
1044 	if (likely(!link_congested(l_ptr))) {
1045 		if (likely(msg_size(msg) <= l_ptr->max_pkt)) {
1046 			if (likely(!tipc_bearer_blocked(l_ptr->b_ptr))) {
1047 				link_add_to_outqueue(l_ptr, buf, msg);
1048 				tipc_bearer_send(l_ptr->b_ptr, buf,
1049 						 &l_ptr->media_addr);
1050 				l_ptr->unacked_window = 0;
1051 				return res;
1052 			}
1053 		} else
1054 			*used_max_pkt = l_ptr->max_pkt;
1055 	}
1056 	return tipc_link_send_buf(l_ptr, buf);  /* All other cases */
1057 }
1058 
1059 /*
1060  * tipc_send_buf_fast: Entry for data messages where the
1061  * destination node is known and the header is complete,
1062  * inclusive total message length.
1063  * Returns user data length.
1064  */
1065 int tipc_send_buf_fast(struct sk_buff *buf, u32 destnode)
1066 {
1067 	struct tipc_link *l_ptr;
1068 	struct tipc_node *n_ptr;
1069 	int res;
1070 	u32 selector = msg_origport(buf_msg(buf)) & 1;
1071 	u32 dummy;
1072 
1073 	read_lock_bh(&tipc_net_lock);
1074 	n_ptr = tipc_node_find(destnode);
1075 	if (likely(n_ptr)) {
1076 		tipc_node_lock(n_ptr);
1077 		l_ptr = n_ptr->active_links[selector];
1078 		if (likely(l_ptr)) {
1079 			res = link_send_buf_fast(l_ptr, buf, &dummy);
1080 			tipc_node_unlock(n_ptr);
1081 			read_unlock_bh(&tipc_net_lock);
1082 			return res;
1083 		}
1084 		tipc_node_unlock(n_ptr);
1085 	}
1086 	read_unlock_bh(&tipc_net_lock);
1087 	res = msg_data_sz(buf_msg(buf));
1088 	tipc_reject_msg(buf, TIPC_ERR_NO_NODE);
1089 	return res;
1090 }
1091 
1092 
1093 /*
1094  * tipc_link_send_sections_fast: Entry for messages where the
1095  * destination processor is known and the header is complete,
1096  * except for total message length.
1097  * Returns user data length or errno.
1098  */
1099 int tipc_link_send_sections_fast(struct tipc_port *sender,
1100 				 struct iovec const *msg_sect,
1101 				 const u32 num_sect,
1102 				 unsigned int total_len,
1103 				 u32 destaddr)
1104 {
1105 	struct tipc_msg *hdr = &sender->phdr;
1106 	struct tipc_link *l_ptr;
1107 	struct sk_buff *buf;
1108 	struct tipc_node *node;
1109 	int res;
1110 	u32 selector = msg_origport(hdr) & 1;
1111 
1112 again:
1113 	/*
1114 	 * Try building message using port's max_pkt hint.
1115 	 * (Must not hold any locks while building message.)
1116 	 */
1117 	res = tipc_msg_build(hdr, msg_sect, num_sect, total_len,
1118 			     sender->max_pkt, !sender->user_port, &buf);
1119 
1120 	read_lock_bh(&tipc_net_lock);
1121 	node = tipc_node_find(destaddr);
1122 	if (likely(node)) {
1123 		tipc_node_lock(node);
1124 		l_ptr = node->active_links[selector];
1125 		if (likely(l_ptr)) {
1126 			if (likely(buf)) {
1127 				res = link_send_buf_fast(l_ptr, buf,
1128 							 &sender->max_pkt);
1129 exit:
1130 				tipc_node_unlock(node);
1131 				read_unlock_bh(&tipc_net_lock);
1132 				return res;
1133 			}
1134 
1135 			/* Exit if build request was invalid */
1136 			if (unlikely(res < 0))
1137 				goto exit;
1138 
1139 			/* Exit if link (or bearer) is congested */
1140 			if (link_congested(l_ptr) ||
1141 			    tipc_bearer_blocked(l_ptr->b_ptr)) {
1142 				res = link_schedule_port(l_ptr,
1143 							 sender->ref, res);
1144 				goto exit;
1145 			}
1146 
1147 			/*
1148 			 * Message size exceeds max_pkt hint; update hint,
1149 			 * then re-try fast path or fragment the message
1150 			 */
1151 			sender->max_pkt = l_ptr->max_pkt;
1152 			tipc_node_unlock(node);
1153 			read_unlock_bh(&tipc_net_lock);
1154 
1155 
1156 			if ((msg_hdr_sz(hdr) + res) <= sender->max_pkt)
1157 				goto again;
1158 
1159 			return link_send_sections_long(sender, msg_sect,
1160 						       num_sect, total_len,
1161 						       destaddr);
1162 		}
1163 		tipc_node_unlock(node);
1164 	}
1165 	read_unlock_bh(&tipc_net_lock);
1166 
1167 	/* Couldn't find a link to the destination node */
1168 	if (buf)
1169 		return tipc_reject_msg(buf, TIPC_ERR_NO_NODE);
1170 	if (res >= 0)
1171 		return tipc_port_reject_sections(sender, hdr, msg_sect, num_sect,
1172 						 total_len, TIPC_ERR_NO_NODE);
1173 	return res;
1174 }
1175 
1176 /*
1177  * link_send_sections_long(): Entry for long messages where the
1178  * destination node is known and the header is complete,
1179  * inclusive total message length.
1180  * Link and bearer congestion status have been checked to be ok,
1181  * and are ignored if they change.
1182  *
1183  * Note that fragments do not use the full link MTU so that they won't have
1184  * to undergo refragmentation if link changeover causes them to be sent
1185  * over another link with an additional tunnel header added as prefix.
1186  * (Refragmentation will still occur if the other link has a smaller MTU.)
1187  *
1188  * Returns user data length or errno.
1189  */
1190 static int link_send_sections_long(struct tipc_port *sender,
1191 				   struct iovec const *msg_sect,
1192 				   u32 num_sect,
1193 				   unsigned int total_len,
1194 				   u32 destaddr)
1195 {
1196 	struct tipc_link *l_ptr;
1197 	struct tipc_node *node;
1198 	struct tipc_msg *hdr = &sender->phdr;
1199 	u32 dsz = total_len;
1200 	u32 max_pkt, fragm_sz, rest;
1201 	struct tipc_msg fragm_hdr;
1202 	struct sk_buff *buf, *buf_chain, *prev;
1203 	u32 fragm_crs, fragm_rest, hsz, sect_rest;
1204 	const unchar *sect_crs;
1205 	int curr_sect;
1206 	u32 fragm_no;
1207 
1208 again:
1209 	fragm_no = 1;
1210 	max_pkt = sender->max_pkt - INT_H_SIZE;
1211 		/* leave room for tunnel header in case of link changeover */
1212 	fragm_sz = max_pkt - INT_H_SIZE;
1213 		/* leave room for fragmentation header in each fragment */
1214 	rest = dsz;
1215 	fragm_crs = 0;
1216 	fragm_rest = 0;
1217 	sect_rest = 0;
1218 	sect_crs = NULL;
1219 	curr_sect = -1;
1220 
1221 	/* Prepare reusable fragment header */
1222 	tipc_msg_init(&fragm_hdr, MSG_FRAGMENTER, FIRST_FRAGMENT,
1223 		 INT_H_SIZE, msg_destnode(hdr));
1224 	msg_set_size(&fragm_hdr, max_pkt);
1225 	msg_set_fragm_no(&fragm_hdr, 1);
1226 
1227 	/* Prepare header of first fragment */
1228 	buf_chain = buf = tipc_buf_acquire(max_pkt);
1229 	if (!buf)
1230 		return -ENOMEM;
1231 	buf->next = NULL;
1232 	skb_copy_to_linear_data(buf, &fragm_hdr, INT_H_SIZE);
1233 	hsz = msg_hdr_sz(hdr);
1234 	skb_copy_to_linear_data_offset(buf, INT_H_SIZE, hdr, hsz);
1235 
1236 	/* Chop up message */
1237 	fragm_crs = INT_H_SIZE + hsz;
1238 	fragm_rest = fragm_sz - hsz;
1239 
1240 	do {		/* For all sections */
1241 		u32 sz;
1242 
1243 		if (!sect_rest) {
1244 			sect_rest = msg_sect[++curr_sect].iov_len;
1245 			sect_crs = (const unchar *)msg_sect[curr_sect].iov_base;
1246 		}
1247 
1248 		if (sect_rest < fragm_rest)
1249 			sz = sect_rest;
1250 		else
1251 			sz = fragm_rest;
1252 
1253 		if (likely(!sender->user_port)) {
1254 			if (copy_from_user(buf->data + fragm_crs, sect_crs, sz)) {
1255 error:
1256 				for (; buf_chain; buf_chain = buf) {
1257 					buf = buf_chain->next;
1258 					kfree_skb(buf_chain);
1259 				}
1260 				return -EFAULT;
1261 			}
1262 		} else
1263 			skb_copy_to_linear_data_offset(buf, fragm_crs,
1264 						       sect_crs, sz);
1265 		sect_crs += sz;
1266 		sect_rest -= sz;
1267 		fragm_crs += sz;
1268 		fragm_rest -= sz;
1269 		rest -= sz;
1270 
1271 		if (!fragm_rest && rest) {
1272 
1273 			/* Initiate new fragment: */
1274 			if (rest <= fragm_sz) {
1275 				fragm_sz = rest;
1276 				msg_set_type(&fragm_hdr, LAST_FRAGMENT);
1277 			} else {
1278 				msg_set_type(&fragm_hdr, FRAGMENT);
1279 			}
1280 			msg_set_size(&fragm_hdr, fragm_sz + INT_H_SIZE);
1281 			msg_set_fragm_no(&fragm_hdr, ++fragm_no);
1282 			prev = buf;
1283 			buf = tipc_buf_acquire(fragm_sz + INT_H_SIZE);
1284 			if (!buf)
1285 				goto error;
1286 
1287 			buf->next = NULL;
1288 			prev->next = buf;
1289 			skb_copy_to_linear_data(buf, &fragm_hdr, INT_H_SIZE);
1290 			fragm_crs = INT_H_SIZE;
1291 			fragm_rest = fragm_sz;
1292 		}
1293 	} while (rest > 0);
1294 
1295 	/*
1296 	 * Now we have a buffer chain. Select a link and check
1297 	 * that packet size is still OK
1298 	 */
1299 	node = tipc_node_find(destaddr);
1300 	if (likely(node)) {
1301 		tipc_node_lock(node);
1302 		l_ptr = node->active_links[sender->ref & 1];
1303 		if (!l_ptr) {
1304 			tipc_node_unlock(node);
1305 			goto reject;
1306 		}
1307 		if (l_ptr->max_pkt < max_pkt) {
1308 			sender->max_pkt = l_ptr->max_pkt;
1309 			tipc_node_unlock(node);
1310 			for (; buf_chain; buf_chain = buf) {
1311 				buf = buf_chain->next;
1312 				kfree_skb(buf_chain);
1313 			}
1314 			goto again;
1315 		}
1316 	} else {
1317 reject:
1318 		for (; buf_chain; buf_chain = buf) {
1319 			buf = buf_chain->next;
1320 			kfree_skb(buf_chain);
1321 		}
1322 		return tipc_port_reject_sections(sender, hdr, msg_sect, num_sect,
1323 						 total_len, TIPC_ERR_NO_NODE);
1324 	}
1325 
1326 	/* Append chain of fragments to send queue & send them */
1327 	l_ptr->long_msg_seq_no++;
1328 	link_add_chain_to_outqueue(l_ptr, buf_chain, l_ptr->long_msg_seq_no);
1329 	l_ptr->stats.sent_fragments += fragm_no;
1330 	l_ptr->stats.sent_fragmented++;
1331 	tipc_link_push_queue(l_ptr);
1332 	tipc_node_unlock(node);
1333 	return dsz;
1334 }
1335 
1336 /*
1337  * tipc_link_push_packet: Push one unsent packet to the media
1338  */
1339 u32 tipc_link_push_packet(struct tipc_link *l_ptr)
1340 {
1341 	struct sk_buff *buf = l_ptr->first_out;
1342 	u32 r_q_size = l_ptr->retransm_queue_size;
1343 	u32 r_q_head = l_ptr->retransm_queue_head;
1344 
1345 	/* Step to position where retransmission failed, if any,    */
1346 	/* consider that buffers may have been released in meantime */
1347 	if (r_q_size && buf) {
1348 		u32 last = lesser(mod(r_q_head + r_q_size),
1349 				  link_last_sent(l_ptr));
1350 		u32 first = buf_seqno(buf);
1351 
1352 		while (buf && less(first, r_q_head)) {
1353 			first = mod(first + 1);
1354 			buf = buf->next;
1355 		}
1356 		l_ptr->retransm_queue_head = r_q_head = first;
1357 		l_ptr->retransm_queue_size = r_q_size = mod(last - first);
1358 	}
1359 
1360 	/* Continue retransmission now, if there is anything: */
1361 	if (r_q_size && buf) {
1362 		msg_set_ack(buf_msg(buf), mod(l_ptr->next_in_no - 1));
1363 		msg_set_bcast_ack(buf_msg(buf), l_ptr->owner->bclink.last_in);
1364 		tipc_bearer_send(l_ptr->b_ptr, buf, &l_ptr->media_addr);
1365 		l_ptr->retransm_queue_head = mod(++r_q_head);
1366 		l_ptr->retransm_queue_size = --r_q_size;
1367 		l_ptr->stats.retransmitted++;
1368 		return 0;
1369 	}
1370 
1371 	/* Send deferred protocol message, if any: */
1372 	buf = l_ptr->proto_msg_queue;
1373 	if (buf) {
1374 		msg_set_ack(buf_msg(buf), mod(l_ptr->next_in_no - 1));
1375 		msg_set_bcast_ack(buf_msg(buf), l_ptr->owner->bclink.last_in);
1376 		tipc_bearer_send(l_ptr->b_ptr, buf, &l_ptr->media_addr);
1377 		l_ptr->unacked_window = 0;
1378 		kfree_skb(buf);
1379 		l_ptr->proto_msg_queue = NULL;
1380 		return 0;
1381 	}
1382 
1383 	/* Send one deferred data message, if send window not full: */
1384 	buf = l_ptr->next_out;
1385 	if (buf) {
1386 		struct tipc_msg *msg = buf_msg(buf);
1387 		u32 next = msg_seqno(msg);
1388 		u32 first = buf_seqno(l_ptr->first_out);
1389 
1390 		if (mod(next - first) < l_ptr->queue_limit[0]) {
1391 			msg_set_ack(msg, mod(l_ptr->next_in_no - 1));
1392 			msg_set_bcast_ack(msg, l_ptr->owner->bclink.last_in);
1393 			tipc_bearer_send(l_ptr->b_ptr, buf, &l_ptr->media_addr);
1394 			if (msg_user(msg) == MSG_BUNDLER)
1395 				msg_set_type(msg, CLOSED_MSG);
1396 			l_ptr->next_out = buf->next;
1397 			return 0;
1398 		}
1399 	}
1400 	return 1;
1401 }
1402 
1403 /*
1404  * push_queue(): push out the unsent messages of a link where
1405  *               congestion has abated. Node is locked
1406  */
1407 void tipc_link_push_queue(struct tipc_link *l_ptr)
1408 {
1409 	u32 res;
1410 
1411 	if (tipc_bearer_blocked(l_ptr->b_ptr))
1412 		return;
1413 
1414 	do {
1415 		res = tipc_link_push_packet(l_ptr);
1416 	} while (!res);
1417 }
1418 
1419 static void link_reset_all(unsigned long addr)
1420 {
1421 	struct tipc_node *n_ptr;
1422 	char addr_string[16];
1423 	u32 i;
1424 
1425 	read_lock_bh(&tipc_net_lock);
1426 	n_ptr = tipc_node_find((u32)addr);
1427 	if (!n_ptr) {
1428 		read_unlock_bh(&tipc_net_lock);
1429 		return;	/* node no longer exists */
1430 	}
1431 
1432 	tipc_node_lock(n_ptr);
1433 
1434 	pr_warn("Resetting all links to %s\n",
1435 		tipc_addr_string_fill(addr_string, n_ptr->addr));
1436 
1437 	for (i = 0; i < MAX_BEARERS; i++) {
1438 		if (n_ptr->links[i]) {
1439 			link_print(n_ptr->links[i], "Resetting link\n");
1440 			tipc_link_reset(n_ptr->links[i]);
1441 		}
1442 	}
1443 
1444 	tipc_node_unlock(n_ptr);
1445 	read_unlock_bh(&tipc_net_lock);
1446 }
1447 
1448 static void link_retransmit_failure(struct tipc_link *l_ptr,
1449 					struct sk_buff *buf)
1450 {
1451 	struct tipc_msg *msg = buf_msg(buf);
1452 
1453 	pr_warn("Retransmission failure on link <%s>\n", l_ptr->name);
1454 
1455 	if (l_ptr->addr) {
1456 		/* Handle failure on standard link */
1457 		link_print(l_ptr, "Resetting link\n");
1458 		tipc_link_reset(l_ptr);
1459 
1460 	} else {
1461 		/* Handle failure on broadcast link */
1462 		struct tipc_node *n_ptr;
1463 		char addr_string[16];
1464 
1465 		pr_info("Msg seq number: %u,  ", msg_seqno(msg));
1466 		pr_cont("Outstanding acks: %lu\n",
1467 			(unsigned long) TIPC_SKB_CB(buf)->handle);
1468 
1469 		n_ptr = tipc_bclink_retransmit_to();
1470 		tipc_node_lock(n_ptr);
1471 
1472 		tipc_addr_string_fill(addr_string, n_ptr->addr);
1473 		pr_info("Broadcast link info for %s\n", addr_string);
1474 		pr_info("Reception permitted: %d,  Acked: %u\n",
1475 			n_ptr->bclink.recv_permitted,
1476 			n_ptr->bclink.acked);
1477 		pr_info("Last in: %u,  Oos state: %u,  Last sent: %u\n",
1478 			n_ptr->bclink.last_in,
1479 			n_ptr->bclink.oos_state,
1480 			n_ptr->bclink.last_sent);
1481 
1482 		tipc_k_signal((Handler)link_reset_all, (unsigned long)n_ptr->addr);
1483 
1484 		tipc_node_unlock(n_ptr);
1485 
1486 		l_ptr->stale_count = 0;
1487 	}
1488 }
1489 
1490 void tipc_link_retransmit(struct tipc_link *l_ptr, struct sk_buff *buf,
1491 			  u32 retransmits)
1492 {
1493 	struct tipc_msg *msg;
1494 
1495 	if (!buf)
1496 		return;
1497 
1498 	msg = buf_msg(buf);
1499 
1500 	if (tipc_bearer_blocked(l_ptr->b_ptr)) {
1501 		if (l_ptr->retransm_queue_size == 0) {
1502 			l_ptr->retransm_queue_head = msg_seqno(msg);
1503 			l_ptr->retransm_queue_size = retransmits;
1504 		} else {
1505 			pr_err("Unexpected retransmit on link %s (qsize=%d)\n",
1506 			       l_ptr->name, l_ptr->retransm_queue_size);
1507 		}
1508 		return;
1509 	} else {
1510 		/* Detect repeated retransmit failures on unblocked bearer */
1511 		if (l_ptr->last_retransmitted == msg_seqno(msg)) {
1512 			if (++l_ptr->stale_count > 100) {
1513 				link_retransmit_failure(l_ptr, buf);
1514 				return;
1515 			}
1516 		} else {
1517 			l_ptr->last_retransmitted = msg_seqno(msg);
1518 			l_ptr->stale_count = 1;
1519 		}
1520 	}
1521 
1522 	while (retransmits && (buf != l_ptr->next_out) && buf) {
1523 		msg = buf_msg(buf);
1524 		msg_set_ack(msg, mod(l_ptr->next_in_no - 1));
1525 		msg_set_bcast_ack(msg, l_ptr->owner->bclink.last_in);
1526 		tipc_bearer_send(l_ptr->b_ptr, buf, &l_ptr->media_addr);
1527 		buf = buf->next;
1528 		retransmits--;
1529 		l_ptr->stats.retransmitted++;
1530 	}
1531 
1532 	l_ptr->retransm_queue_head = l_ptr->retransm_queue_size = 0;
1533 }
1534 
1535 /**
1536  * link_insert_deferred_queue - insert deferred messages back into receive chain
1537  */
1538 static struct sk_buff *link_insert_deferred_queue(struct tipc_link *l_ptr,
1539 						  struct sk_buff *buf)
1540 {
1541 	u32 seq_no;
1542 
1543 	if (l_ptr->oldest_deferred_in == NULL)
1544 		return buf;
1545 
1546 	seq_no = buf_seqno(l_ptr->oldest_deferred_in);
1547 	if (seq_no == mod(l_ptr->next_in_no)) {
1548 		l_ptr->newest_deferred_in->next = buf;
1549 		buf = l_ptr->oldest_deferred_in;
1550 		l_ptr->oldest_deferred_in = NULL;
1551 		l_ptr->deferred_inqueue_sz = 0;
1552 	}
1553 	return buf;
1554 }
1555 
1556 /**
1557  * link_recv_buf_validate - validate basic format of received message
1558  *
1559  * This routine ensures a TIPC message has an acceptable header, and at least
1560  * as much data as the header indicates it should.  The routine also ensures
1561  * that the entire message header is stored in the main fragment of the message
1562  * buffer, to simplify future access to message header fields.
1563  *
1564  * Note: Having extra info present in the message header or data areas is OK.
1565  * TIPC will ignore the excess, under the assumption that it is optional info
1566  * introduced by a later release of the protocol.
1567  */
1568 static int link_recv_buf_validate(struct sk_buff *buf)
1569 {
1570 	static u32 min_data_hdr_size[8] = {
1571 		SHORT_H_SIZE, MCAST_H_SIZE, NAMED_H_SIZE, BASIC_H_SIZE,
1572 		MAX_H_SIZE, MAX_H_SIZE, MAX_H_SIZE, MAX_H_SIZE
1573 		};
1574 
1575 	struct tipc_msg *msg;
1576 	u32 tipc_hdr[2];
1577 	u32 size;
1578 	u32 hdr_size;
1579 	u32 min_hdr_size;
1580 
1581 	if (unlikely(buf->len < MIN_H_SIZE))
1582 		return 0;
1583 
1584 	msg = skb_header_pointer(buf, 0, sizeof(tipc_hdr), tipc_hdr);
1585 	if (msg == NULL)
1586 		return 0;
1587 
1588 	if (unlikely(msg_version(msg) != TIPC_VERSION))
1589 		return 0;
1590 
1591 	size = msg_size(msg);
1592 	hdr_size = msg_hdr_sz(msg);
1593 	min_hdr_size = msg_isdata(msg) ?
1594 		min_data_hdr_size[msg_type(msg)] : INT_H_SIZE;
1595 
1596 	if (unlikely((hdr_size < min_hdr_size) ||
1597 		     (size < hdr_size) ||
1598 		     (buf->len < size) ||
1599 		     (size - hdr_size > TIPC_MAX_USER_MSG_SIZE)))
1600 		return 0;
1601 
1602 	return pskb_may_pull(buf, hdr_size);
1603 }
1604 
1605 /**
1606  * tipc_recv_msg - process TIPC messages arriving from off-node
1607  * @head: pointer to message buffer chain
1608  * @tb_ptr: pointer to bearer message arrived on
1609  *
1610  * Invoked with no locks held.  Bearer pointer must point to a valid bearer
1611  * structure (i.e. cannot be NULL), but bearer can be inactive.
1612  */
1613 void tipc_recv_msg(struct sk_buff *head, struct tipc_bearer *b_ptr)
1614 {
1615 	read_lock_bh(&tipc_net_lock);
1616 	while (head) {
1617 		struct tipc_node *n_ptr;
1618 		struct tipc_link *l_ptr;
1619 		struct sk_buff *crs;
1620 		struct sk_buff *buf = head;
1621 		struct tipc_msg *msg;
1622 		u32 seq_no;
1623 		u32 ackd;
1624 		u32 released = 0;
1625 		int type;
1626 
1627 		head = head->next;
1628 
1629 		/* Ensure bearer is still enabled */
1630 		if (unlikely(!b_ptr->active))
1631 			goto cont;
1632 
1633 		/* Ensure message is well-formed */
1634 		if (unlikely(!link_recv_buf_validate(buf)))
1635 			goto cont;
1636 
1637 		/* Ensure message data is a single contiguous unit */
1638 		if (unlikely(skb_linearize(buf)))
1639 			goto cont;
1640 
1641 		/* Handle arrival of a non-unicast link message */
1642 		msg = buf_msg(buf);
1643 
1644 		if (unlikely(msg_non_seq(msg))) {
1645 			if (msg_user(msg) ==  LINK_CONFIG)
1646 				tipc_disc_recv_msg(buf, b_ptr);
1647 			else
1648 				tipc_bclink_recv_pkt(buf);
1649 			continue;
1650 		}
1651 
1652 		/* Discard unicast link messages destined for another node */
1653 		if (unlikely(!msg_short(msg) &&
1654 			     (msg_destnode(msg) != tipc_own_addr)))
1655 			goto cont;
1656 
1657 		/* Locate neighboring node that sent message */
1658 		n_ptr = tipc_node_find(msg_prevnode(msg));
1659 		if (unlikely(!n_ptr))
1660 			goto cont;
1661 		tipc_node_lock(n_ptr);
1662 
1663 		/* Locate unicast link endpoint that should handle message */
1664 		l_ptr = n_ptr->links[b_ptr->identity];
1665 		if (unlikely(!l_ptr)) {
1666 			tipc_node_unlock(n_ptr);
1667 			goto cont;
1668 		}
1669 
1670 		/* Verify that communication with node is currently allowed */
1671 		if ((n_ptr->block_setup & WAIT_PEER_DOWN) &&
1672 			msg_user(msg) == LINK_PROTOCOL &&
1673 			(msg_type(msg) == RESET_MSG ||
1674 					msg_type(msg) == ACTIVATE_MSG) &&
1675 			!msg_redundant_link(msg))
1676 			n_ptr->block_setup &= ~WAIT_PEER_DOWN;
1677 
1678 		if (n_ptr->block_setup) {
1679 			tipc_node_unlock(n_ptr);
1680 			goto cont;
1681 		}
1682 
1683 		/* Validate message sequence number info */
1684 		seq_no = msg_seqno(msg);
1685 		ackd = msg_ack(msg);
1686 
1687 		/* Release acked messages */
1688 		if (n_ptr->bclink.recv_permitted)
1689 			tipc_bclink_acknowledge(n_ptr, msg_bcast_ack(msg));
1690 
1691 		crs = l_ptr->first_out;
1692 		while ((crs != l_ptr->next_out) &&
1693 		       less_eq(buf_seqno(crs), ackd)) {
1694 			struct sk_buff *next = crs->next;
1695 
1696 			kfree_skb(crs);
1697 			crs = next;
1698 			released++;
1699 		}
1700 		if (released) {
1701 			l_ptr->first_out = crs;
1702 			l_ptr->out_queue_size -= released;
1703 		}
1704 
1705 		/* Try sending any messages link endpoint has pending */
1706 		if (unlikely(l_ptr->next_out))
1707 			tipc_link_push_queue(l_ptr);
1708 		if (unlikely(!list_empty(&l_ptr->waiting_ports)))
1709 			tipc_link_wakeup_ports(l_ptr, 0);
1710 		if (unlikely(++l_ptr->unacked_window >= TIPC_MIN_LINK_WIN)) {
1711 			l_ptr->stats.sent_acks++;
1712 			tipc_link_send_proto_msg(l_ptr, STATE_MSG, 0, 0, 0, 0, 0);
1713 		}
1714 
1715 		/* Now (finally!) process the incoming message */
1716 protocol_check:
1717 		if (likely(link_working_working(l_ptr))) {
1718 			if (likely(seq_no == mod(l_ptr->next_in_no))) {
1719 				l_ptr->next_in_no++;
1720 				if (unlikely(l_ptr->oldest_deferred_in))
1721 					head = link_insert_deferred_queue(l_ptr,
1722 									  head);
1723 deliver:
1724 				if (likely(msg_isdata(msg))) {
1725 					tipc_node_unlock(n_ptr);
1726 					tipc_port_recv_msg(buf);
1727 					continue;
1728 				}
1729 				switch (msg_user(msg)) {
1730 					int ret;
1731 				case MSG_BUNDLER:
1732 					l_ptr->stats.recv_bundles++;
1733 					l_ptr->stats.recv_bundled +=
1734 						msg_msgcnt(msg);
1735 					tipc_node_unlock(n_ptr);
1736 					tipc_link_recv_bundle(buf);
1737 					continue;
1738 				case NAME_DISTRIBUTOR:
1739 					n_ptr->bclink.recv_permitted = true;
1740 					tipc_node_unlock(n_ptr);
1741 					tipc_named_recv(buf);
1742 					continue;
1743 				case BCAST_PROTOCOL:
1744 					tipc_link_recv_sync(n_ptr, buf);
1745 					tipc_node_unlock(n_ptr);
1746 					continue;
1747 				case CONN_MANAGER:
1748 					tipc_node_unlock(n_ptr);
1749 					tipc_port_recv_proto_msg(buf);
1750 					continue;
1751 				case MSG_FRAGMENTER:
1752 					l_ptr->stats.recv_fragments++;
1753 					ret = tipc_link_recv_fragment(
1754 						&l_ptr->defragm_buf,
1755 						&buf, &msg);
1756 					if (ret == 1) {
1757 						l_ptr->stats.recv_fragmented++;
1758 						goto deliver;
1759 					}
1760 					if (ret == -1)
1761 						l_ptr->next_in_no--;
1762 					break;
1763 				case CHANGEOVER_PROTOCOL:
1764 					type = msg_type(msg);
1765 					if (link_recv_changeover_msg(&l_ptr,
1766 								     &buf)) {
1767 						msg = buf_msg(buf);
1768 						seq_no = msg_seqno(msg);
1769 						if (type == ORIGINAL_MSG)
1770 							goto deliver;
1771 						goto protocol_check;
1772 					}
1773 					break;
1774 				default:
1775 					kfree_skb(buf);
1776 					buf = NULL;
1777 					break;
1778 				}
1779 				tipc_node_unlock(n_ptr);
1780 				tipc_net_route_msg(buf);
1781 				continue;
1782 			}
1783 			link_handle_out_of_seq_msg(l_ptr, buf);
1784 			head = link_insert_deferred_queue(l_ptr, head);
1785 			tipc_node_unlock(n_ptr);
1786 			continue;
1787 		}
1788 
1789 		/* Link is not in state WORKING_WORKING */
1790 		if (msg_user(msg) == LINK_PROTOCOL) {
1791 			link_recv_proto_msg(l_ptr, buf);
1792 			head = link_insert_deferred_queue(l_ptr, head);
1793 			tipc_node_unlock(n_ptr);
1794 			continue;
1795 		}
1796 
1797 		/* Traffic message. Conditionally activate link */
1798 		link_state_event(l_ptr, TRAFFIC_MSG_EVT);
1799 
1800 		if (link_working_working(l_ptr)) {
1801 			/* Re-insert buffer in front of queue */
1802 			buf->next = head;
1803 			head = buf;
1804 			tipc_node_unlock(n_ptr);
1805 			continue;
1806 		}
1807 		tipc_node_unlock(n_ptr);
1808 cont:
1809 		kfree_skb(buf);
1810 	}
1811 	read_unlock_bh(&tipc_net_lock);
1812 }
1813 
1814 /**
1815  * tipc_link_defer_pkt - Add out-of-sequence message to deferred reception queue
1816  *
1817  * Returns increase in queue length (i.e. 0 or 1)
1818  */
1819 u32 tipc_link_defer_pkt(struct sk_buff **head, struct sk_buff **tail,
1820 			struct sk_buff *buf)
1821 {
1822 	struct sk_buff *queue_buf;
1823 	struct sk_buff **prev;
1824 	u32 seq_no = buf_seqno(buf);
1825 
1826 	buf->next = NULL;
1827 
1828 	/* Empty queue ? */
1829 	if (*head == NULL) {
1830 		*head = *tail = buf;
1831 		return 1;
1832 	}
1833 
1834 	/* Last ? */
1835 	if (less(buf_seqno(*tail), seq_no)) {
1836 		(*tail)->next = buf;
1837 		*tail = buf;
1838 		return 1;
1839 	}
1840 
1841 	/* Locate insertion point in queue, then insert; discard if duplicate */
1842 	prev = head;
1843 	queue_buf = *head;
1844 	for (;;) {
1845 		u32 curr_seqno = buf_seqno(queue_buf);
1846 
1847 		if (seq_no == curr_seqno) {
1848 			kfree_skb(buf);
1849 			return 0;
1850 		}
1851 
1852 		if (less(seq_no, curr_seqno))
1853 			break;
1854 
1855 		prev = &queue_buf->next;
1856 		queue_buf = queue_buf->next;
1857 	}
1858 
1859 	buf->next = queue_buf;
1860 	*prev = buf;
1861 	return 1;
1862 }
1863 
1864 /*
1865  * link_handle_out_of_seq_msg - handle arrival of out-of-sequence packet
1866  */
1867 static void link_handle_out_of_seq_msg(struct tipc_link *l_ptr,
1868 				       struct sk_buff *buf)
1869 {
1870 	u32 seq_no = buf_seqno(buf);
1871 
1872 	if (likely(msg_user(buf_msg(buf)) == LINK_PROTOCOL)) {
1873 		link_recv_proto_msg(l_ptr, buf);
1874 		return;
1875 	}
1876 
1877 	/* Record OOS packet arrival (force mismatch on next timeout) */
1878 	l_ptr->checkpoint--;
1879 
1880 	/*
1881 	 * Discard packet if a duplicate; otherwise add it to deferred queue
1882 	 * and notify peer of gap as per protocol specification
1883 	 */
1884 	if (less(seq_no, mod(l_ptr->next_in_no))) {
1885 		l_ptr->stats.duplicates++;
1886 		kfree_skb(buf);
1887 		return;
1888 	}
1889 
1890 	if (tipc_link_defer_pkt(&l_ptr->oldest_deferred_in,
1891 				&l_ptr->newest_deferred_in, buf)) {
1892 		l_ptr->deferred_inqueue_sz++;
1893 		l_ptr->stats.deferred_recv++;
1894 		if ((l_ptr->deferred_inqueue_sz % 16) == 1)
1895 			tipc_link_send_proto_msg(l_ptr, STATE_MSG, 0, 0, 0, 0, 0);
1896 	} else
1897 		l_ptr->stats.duplicates++;
1898 }
1899 
1900 /*
1901  * Send protocol message to the other endpoint.
1902  */
1903 void tipc_link_send_proto_msg(struct tipc_link *l_ptr, u32 msg_typ,
1904 				int probe_msg, u32 gap, u32 tolerance,
1905 				u32 priority, u32 ack_mtu)
1906 {
1907 	struct sk_buff *buf = NULL;
1908 	struct tipc_msg *msg = l_ptr->pmsg;
1909 	u32 msg_size = sizeof(l_ptr->proto_msg);
1910 	int r_flag;
1911 
1912 	/* Discard any previous message that was deferred due to congestion */
1913 	if (l_ptr->proto_msg_queue) {
1914 		kfree_skb(l_ptr->proto_msg_queue);
1915 		l_ptr->proto_msg_queue = NULL;
1916 	}
1917 
1918 	if (link_blocked(l_ptr))
1919 		return;
1920 
1921 	/* Abort non-RESET send if communication with node is prohibited */
1922 	if ((l_ptr->owner->block_setup) && (msg_typ != RESET_MSG))
1923 		return;
1924 
1925 	/* Create protocol message with "out-of-sequence" sequence number */
1926 	msg_set_type(msg, msg_typ);
1927 	msg_set_net_plane(msg, l_ptr->b_ptr->net_plane);
1928 	msg_set_bcast_ack(msg, l_ptr->owner->bclink.last_in);
1929 	msg_set_last_bcast(msg, tipc_bclink_get_last_sent());
1930 
1931 	if (msg_typ == STATE_MSG) {
1932 		u32 next_sent = mod(l_ptr->next_out_no);
1933 
1934 		if (!tipc_link_is_up(l_ptr))
1935 			return;
1936 		if (l_ptr->next_out)
1937 			next_sent = buf_seqno(l_ptr->next_out);
1938 		msg_set_next_sent(msg, next_sent);
1939 		if (l_ptr->oldest_deferred_in) {
1940 			u32 rec = buf_seqno(l_ptr->oldest_deferred_in);
1941 			gap = mod(rec - mod(l_ptr->next_in_no));
1942 		}
1943 		msg_set_seq_gap(msg, gap);
1944 		if (gap)
1945 			l_ptr->stats.sent_nacks++;
1946 		msg_set_link_tolerance(msg, tolerance);
1947 		msg_set_linkprio(msg, priority);
1948 		msg_set_max_pkt(msg, ack_mtu);
1949 		msg_set_ack(msg, mod(l_ptr->next_in_no - 1));
1950 		msg_set_probe(msg, probe_msg != 0);
1951 		if (probe_msg) {
1952 			u32 mtu = l_ptr->max_pkt;
1953 
1954 			if ((mtu < l_ptr->max_pkt_target) &&
1955 			    link_working_working(l_ptr) &&
1956 			    l_ptr->fsm_msg_cnt) {
1957 				msg_size = (mtu + (l_ptr->max_pkt_target - mtu)/2 + 2) & ~3;
1958 				if (l_ptr->max_pkt_probes == 10) {
1959 					l_ptr->max_pkt_target = (msg_size - 4);
1960 					l_ptr->max_pkt_probes = 0;
1961 					msg_size = (mtu + (l_ptr->max_pkt_target - mtu)/2 + 2) & ~3;
1962 				}
1963 				l_ptr->max_pkt_probes++;
1964 			}
1965 
1966 			l_ptr->stats.sent_probes++;
1967 		}
1968 		l_ptr->stats.sent_states++;
1969 	} else {		/* RESET_MSG or ACTIVATE_MSG */
1970 		msg_set_ack(msg, mod(l_ptr->reset_checkpoint - 1));
1971 		msg_set_seq_gap(msg, 0);
1972 		msg_set_next_sent(msg, 1);
1973 		msg_set_probe(msg, 0);
1974 		msg_set_link_tolerance(msg, l_ptr->tolerance);
1975 		msg_set_linkprio(msg, l_ptr->priority);
1976 		msg_set_max_pkt(msg, l_ptr->max_pkt_target);
1977 	}
1978 
1979 	r_flag = (l_ptr->owner->working_links > tipc_link_is_up(l_ptr));
1980 	msg_set_redundant_link(msg, r_flag);
1981 	msg_set_linkprio(msg, l_ptr->priority);
1982 	msg_set_size(msg, msg_size);
1983 
1984 	msg_set_seqno(msg, mod(l_ptr->next_out_no + (0xffff/2)));
1985 
1986 	buf = tipc_buf_acquire(msg_size);
1987 	if (!buf)
1988 		return;
1989 
1990 	skb_copy_to_linear_data(buf, msg, sizeof(l_ptr->proto_msg));
1991 
1992 	/* Defer message if bearer is already blocked */
1993 	if (tipc_bearer_blocked(l_ptr->b_ptr)) {
1994 		l_ptr->proto_msg_queue = buf;
1995 		return;
1996 	}
1997 
1998 	tipc_bearer_send(l_ptr->b_ptr, buf, &l_ptr->media_addr);
1999 	l_ptr->unacked_window = 0;
2000 	kfree_skb(buf);
2001 }
2002 
2003 /*
2004  * Receive protocol message :
2005  * Note that network plane id propagates through the network, and may
2006  * change at any time. The node with lowest address rules
2007  */
2008 static void link_recv_proto_msg(struct tipc_link *l_ptr, struct sk_buff *buf)
2009 {
2010 	u32 rec_gap = 0;
2011 	u32 max_pkt_info;
2012 	u32 max_pkt_ack;
2013 	u32 msg_tol;
2014 	struct tipc_msg *msg = buf_msg(buf);
2015 
2016 	if (link_blocked(l_ptr))
2017 		goto exit;
2018 
2019 	/* record unnumbered packet arrival (force mismatch on next timeout) */
2020 	l_ptr->checkpoint--;
2021 
2022 	if (l_ptr->b_ptr->net_plane != msg_net_plane(msg))
2023 		if (tipc_own_addr > msg_prevnode(msg))
2024 			l_ptr->b_ptr->net_plane = msg_net_plane(msg);
2025 
2026 	l_ptr->owner->permit_changeover = msg_redundant_link(msg);
2027 
2028 	switch (msg_type(msg)) {
2029 
2030 	case RESET_MSG:
2031 		if (!link_working_unknown(l_ptr) &&
2032 		    (l_ptr->peer_session != INVALID_SESSION)) {
2033 			if (less_eq(msg_session(msg), l_ptr->peer_session))
2034 				break; /* duplicate or old reset: ignore */
2035 		}
2036 
2037 		if (!msg_redundant_link(msg) && (link_working_working(l_ptr) ||
2038 				link_working_unknown(l_ptr))) {
2039 			/*
2040 			 * peer has lost contact -- don't allow peer's links
2041 			 * to reactivate before we recognize loss & clean up
2042 			 */
2043 			l_ptr->owner->block_setup = WAIT_NODE_DOWN;
2044 		}
2045 
2046 		link_state_event(l_ptr, RESET_MSG);
2047 
2048 		/* fall thru' */
2049 	case ACTIVATE_MSG:
2050 		/* Update link settings according other endpoint's values */
2051 		strcpy((strrchr(l_ptr->name, ':') + 1), (char *)msg_data(msg));
2052 
2053 		msg_tol = msg_link_tolerance(msg);
2054 		if (msg_tol > l_ptr->tolerance)
2055 			link_set_supervision_props(l_ptr, msg_tol);
2056 
2057 		if (msg_linkprio(msg) > l_ptr->priority)
2058 			l_ptr->priority = msg_linkprio(msg);
2059 
2060 		max_pkt_info = msg_max_pkt(msg);
2061 		if (max_pkt_info) {
2062 			if (max_pkt_info < l_ptr->max_pkt_target)
2063 				l_ptr->max_pkt_target = max_pkt_info;
2064 			if (l_ptr->max_pkt > l_ptr->max_pkt_target)
2065 				l_ptr->max_pkt = l_ptr->max_pkt_target;
2066 		} else {
2067 			l_ptr->max_pkt = l_ptr->max_pkt_target;
2068 		}
2069 
2070 		/* Synchronize broadcast link info, if not done previously */
2071 		if (!tipc_node_is_up(l_ptr->owner)) {
2072 			l_ptr->owner->bclink.last_sent =
2073 				l_ptr->owner->bclink.last_in =
2074 				msg_last_bcast(msg);
2075 			l_ptr->owner->bclink.oos_state = 0;
2076 		}
2077 
2078 		l_ptr->peer_session = msg_session(msg);
2079 		l_ptr->peer_bearer_id = msg_bearer_id(msg);
2080 
2081 		if (msg_type(msg) == ACTIVATE_MSG)
2082 			link_state_event(l_ptr, ACTIVATE_MSG);
2083 		break;
2084 	case STATE_MSG:
2085 
2086 		msg_tol = msg_link_tolerance(msg);
2087 		if (msg_tol)
2088 			link_set_supervision_props(l_ptr, msg_tol);
2089 
2090 		if (msg_linkprio(msg) &&
2091 		    (msg_linkprio(msg) != l_ptr->priority)) {
2092 			pr_warn("%s<%s>, priority change %u->%u\n",
2093 				link_rst_msg, l_ptr->name, l_ptr->priority,
2094 				msg_linkprio(msg));
2095 			l_ptr->priority = msg_linkprio(msg);
2096 			tipc_link_reset(l_ptr); /* Enforce change to take effect */
2097 			break;
2098 		}
2099 		link_state_event(l_ptr, TRAFFIC_MSG_EVT);
2100 		l_ptr->stats.recv_states++;
2101 		if (link_reset_unknown(l_ptr))
2102 			break;
2103 
2104 		if (less_eq(mod(l_ptr->next_in_no), msg_next_sent(msg))) {
2105 			rec_gap = mod(msg_next_sent(msg) -
2106 				      mod(l_ptr->next_in_no));
2107 		}
2108 
2109 		max_pkt_ack = msg_max_pkt(msg);
2110 		if (max_pkt_ack > l_ptr->max_pkt) {
2111 			l_ptr->max_pkt = max_pkt_ack;
2112 			l_ptr->max_pkt_probes = 0;
2113 		}
2114 
2115 		max_pkt_ack = 0;
2116 		if (msg_probe(msg)) {
2117 			l_ptr->stats.recv_probes++;
2118 			if (msg_size(msg) > sizeof(l_ptr->proto_msg))
2119 				max_pkt_ack = msg_size(msg);
2120 		}
2121 
2122 		/* Protocol message before retransmits, reduce loss risk */
2123 		if (l_ptr->owner->bclink.recv_permitted)
2124 			tipc_bclink_update_link_state(l_ptr->owner,
2125 						      msg_last_bcast(msg));
2126 
2127 		if (rec_gap || (msg_probe(msg))) {
2128 			tipc_link_send_proto_msg(l_ptr, STATE_MSG,
2129 						 0, rec_gap, 0, 0, max_pkt_ack);
2130 		}
2131 		if (msg_seq_gap(msg)) {
2132 			l_ptr->stats.recv_nacks++;
2133 			tipc_link_retransmit(l_ptr, l_ptr->first_out,
2134 					     msg_seq_gap(msg));
2135 		}
2136 		break;
2137 	}
2138 exit:
2139 	kfree_skb(buf);
2140 }
2141 
2142 
2143 /*
2144  * tipc_link_tunnel(): Send one message via a link belonging to
2145  * another bearer. Owner node is locked.
2146  */
2147 static void tipc_link_tunnel(struct tipc_link *l_ptr,
2148 			     struct tipc_msg *tunnel_hdr,
2149 			     struct tipc_msg  *msg,
2150 			     u32 selector)
2151 {
2152 	struct tipc_link *tunnel;
2153 	struct sk_buff *buf;
2154 	u32 length = msg_size(msg);
2155 
2156 	tunnel = l_ptr->owner->active_links[selector & 1];
2157 	if (!tipc_link_is_up(tunnel)) {
2158 		pr_warn("%stunnel link no longer available\n", link_co_err);
2159 		return;
2160 	}
2161 	msg_set_size(tunnel_hdr, length + INT_H_SIZE);
2162 	buf = tipc_buf_acquire(length + INT_H_SIZE);
2163 	if (!buf) {
2164 		pr_warn("%sunable to send tunnel msg\n", link_co_err);
2165 		return;
2166 	}
2167 	skb_copy_to_linear_data(buf, tunnel_hdr, INT_H_SIZE);
2168 	skb_copy_to_linear_data_offset(buf, INT_H_SIZE, msg, length);
2169 	tipc_link_send_buf(tunnel, buf);
2170 }
2171 
2172 
2173 
2174 /*
2175  * changeover(): Send whole message queue via the remaining link
2176  *               Owner node is locked.
2177  */
2178 void tipc_link_changeover(struct tipc_link *l_ptr)
2179 {
2180 	u32 msgcount = l_ptr->out_queue_size;
2181 	struct sk_buff *crs = l_ptr->first_out;
2182 	struct tipc_link *tunnel = l_ptr->owner->active_links[0];
2183 	struct tipc_msg tunnel_hdr;
2184 	int split_bundles;
2185 
2186 	if (!tunnel)
2187 		return;
2188 
2189 	if (!l_ptr->owner->permit_changeover) {
2190 		pr_warn("%speer did not permit changeover\n", link_co_err);
2191 		return;
2192 	}
2193 
2194 	tipc_msg_init(&tunnel_hdr, CHANGEOVER_PROTOCOL,
2195 		 ORIGINAL_MSG, INT_H_SIZE, l_ptr->addr);
2196 	msg_set_bearer_id(&tunnel_hdr, l_ptr->peer_bearer_id);
2197 	msg_set_msgcnt(&tunnel_hdr, msgcount);
2198 
2199 	if (!l_ptr->first_out) {
2200 		struct sk_buff *buf;
2201 
2202 		buf = tipc_buf_acquire(INT_H_SIZE);
2203 		if (buf) {
2204 			skb_copy_to_linear_data(buf, &tunnel_hdr, INT_H_SIZE);
2205 			msg_set_size(&tunnel_hdr, INT_H_SIZE);
2206 			tipc_link_send_buf(tunnel, buf);
2207 		} else {
2208 			pr_warn("%sunable to send changeover msg\n",
2209 				link_co_err);
2210 		}
2211 		return;
2212 	}
2213 
2214 	split_bundles = (l_ptr->owner->active_links[0] !=
2215 			 l_ptr->owner->active_links[1]);
2216 
2217 	while (crs) {
2218 		struct tipc_msg *msg = buf_msg(crs);
2219 
2220 		if ((msg_user(msg) == MSG_BUNDLER) && split_bundles) {
2221 			struct tipc_msg *m = msg_get_wrapped(msg);
2222 			unchar *pos = (unchar *)m;
2223 
2224 			msgcount = msg_msgcnt(msg);
2225 			while (msgcount--) {
2226 				msg_set_seqno(m, msg_seqno(msg));
2227 				tipc_link_tunnel(l_ptr, &tunnel_hdr, m,
2228 						 msg_link_selector(m));
2229 				pos += align(msg_size(m));
2230 				m = (struct tipc_msg *)pos;
2231 			}
2232 		} else {
2233 			tipc_link_tunnel(l_ptr, &tunnel_hdr, msg,
2234 					 msg_link_selector(msg));
2235 		}
2236 		crs = crs->next;
2237 	}
2238 }
2239 
2240 void tipc_link_send_duplicate(struct tipc_link *l_ptr, struct tipc_link *tunnel)
2241 {
2242 	struct sk_buff *iter;
2243 	struct tipc_msg tunnel_hdr;
2244 
2245 	tipc_msg_init(&tunnel_hdr, CHANGEOVER_PROTOCOL,
2246 		 DUPLICATE_MSG, INT_H_SIZE, l_ptr->addr);
2247 	msg_set_msgcnt(&tunnel_hdr, l_ptr->out_queue_size);
2248 	msg_set_bearer_id(&tunnel_hdr, l_ptr->peer_bearer_id);
2249 	iter = l_ptr->first_out;
2250 	while (iter) {
2251 		struct sk_buff *outbuf;
2252 		struct tipc_msg *msg = buf_msg(iter);
2253 		u32 length = msg_size(msg);
2254 
2255 		if (msg_user(msg) == MSG_BUNDLER)
2256 			msg_set_type(msg, CLOSED_MSG);
2257 		msg_set_ack(msg, mod(l_ptr->next_in_no - 1));	/* Update */
2258 		msg_set_bcast_ack(msg, l_ptr->owner->bclink.last_in);
2259 		msg_set_size(&tunnel_hdr, length + INT_H_SIZE);
2260 		outbuf = tipc_buf_acquire(length + INT_H_SIZE);
2261 		if (outbuf == NULL) {
2262 			pr_warn("%sunable to send duplicate msg\n",
2263 				link_co_err);
2264 			return;
2265 		}
2266 		skb_copy_to_linear_data(outbuf, &tunnel_hdr, INT_H_SIZE);
2267 		skb_copy_to_linear_data_offset(outbuf, INT_H_SIZE, iter->data,
2268 					       length);
2269 		tipc_link_send_buf(tunnel, outbuf);
2270 		if (!tipc_link_is_up(l_ptr))
2271 			return;
2272 		iter = iter->next;
2273 	}
2274 }
2275 
2276 /**
2277  * buf_extract - extracts embedded TIPC message from another message
2278  * @skb: encapsulating message buffer
2279  * @from_pos: offset to extract from
2280  *
2281  * Returns a new message buffer containing an embedded message.  The
2282  * encapsulating message itself is left unchanged.
2283  */
2284 static struct sk_buff *buf_extract(struct sk_buff *skb, u32 from_pos)
2285 {
2286 	struct tipc_msg *msg = (struct tipc_msg *)(skb->data + from_pos);
2287 	u32 size = msg_size(msg);
2288 	struct sk_buff *eb;
2289 
2290 	eb = tipc_buf_acquire(size);
2291 	if (eb)
2292 		skb_copy_to_linear_data(eb, msg, size);
2293 	return eb;
2294 }
2295 
2296 /*
2297  *  link_recv_changeover_msg(): Receive tunneled packet sent
2298  *  via other link. Node is locked. Return extracted buffer.
2299  */
2300 static int link_recv_changeover_msg(struct tipc_link **l_ptr,
2301 				    struct sk_buff **buf)
2302 {
2303 	struct sk_buff *tunnel_buf = *buf;
2304 	struct tipc_link *dest_link;
2305 	struct tipc_msg *msg;
2306 	struct tipc_msg *tunnel_msg = buf_msg(tunnel_buf);
2307 	u32 msg_typ = msg_type(tunnel_msg);
2308 	u32 msg_count = msg_msgcnt(tunnel_msg);
2309 
2310 	dest_link = (*l_ptr)->owner->links[msg_bearer_id(tunnel_msg)];
2311 	if (!dest_link)
2312 		goto exit;
2313 	if (dest_link == *l_ptr) {
2314 		pr_err("Unexpected changeover message on link <%s>\n",
2315 		       (*l_ptr)->name);
2316 		goto exit;
2317 	}
2318 	*l_ptr = dest_link;
2319 	msg = msg_get_wrapped(tunnel_msg);
2320 
2321 	if (msg_typ == DUPLICATE_MSG) {
2322 		if (less(msg_seqno(msg), mod(dest_link->next_in_no)))
2323 			goto exit;
2324 		*buf = buf_extract(tunnel_buf, INT_H_SIZE);
2325 		if (*buf == NULL) {
2326 			pr_warn("%sduplicate msg dropped\n", link_co_err);
2327 			goto exit;
2328 		}
2329 		kfree_skb(tunnel_buf);
2330 		return 1;
2331 	}
2332 
2333 	/* First original message ?: */
2334 	if (tipc_link_is_up(dest_link)) {
2335 		pr_info("%s<%s>, changeover initiated by peer\n", link_rst_msg,
2336 			dest_link->name);
2337 		tipc_link_reset(dest_link);
2338 		dest_link->exp_msg_count = msg_count;
2339 		if (!msg_count)
2340 			goto exit;
2341 	} else if (dest_link->exp_msg_count == START_CHANGEOVER) {
2342 		dest_link->exp_msg_count = msg_count;
2343 		if (!msg_count)
2344 			goto exit;
2345 	}
2346 
2347 	/* Receive original message */
2348 	if (dest_link->exp_msg_count == 0) {
2349 		pr_warn("%sgot too many tunnelled messages\n", link_co_err);
2350 		goto exit;
2351 	}
2352 	dest_link->exp_msg_count--;
2353 	if (less(msg_seqno(msg), dest_link->reset_checkpoint)) {
2354 		goto exit;
2355 	} else {
2356 		*buf = buf_extract(tunnel_buf, INT_H_SIZE);
2357 		if (*buf != NULL) {
2358 			kfree_skb(tunnel_buf);
2359 			return 1;
2360 		} else {
2361 			pr_warn("%soriginal msg dropped\n", link_co_err);
2362 		}
2363 	}
2364 exit:
2365 	*buf = NULL;
2366 	kfree_skb(tunnel_buf);
2367 	return 0;
2368 }
2369 
2370 /*
2371  *  Bundler functionality:
2372  */
2373 void tipc_link_recv_bundle(struct sk_buff *buf)
2374 {
2375 	u32 msgcount = msg_msgcnt(buf_msg(buf));
2376 	u32 pos = INT_H_SIZE;
2377 	struct sk_buff *obuf;
2378 
2379 	while (msgcount--) {
2380 		obuf = buf_extract(buf, pos);
2381 		if (obuf == NULL) {
2382 			pr_warn("Link unable to unbundle message(s)\n");
2383 			break;
2384 		}
2385 		pos += align(msg_size(buf_msg(obuf)));
2386 		tipc_net_route_msg(obuf);
2387 	}
2388 	kfree_skb(buf);
2389 }
2390 
2391 /*
2392  *  Fragmentation/defragmentation:
2393  */
2394 
2395 /*
2396  * link_send_long_buf: Entry for buffers needing fragmentation.
2397  * The buffer is complete, inclusive total message length.
2398  * Returns user data length.
2399  */
2400 static int link_send_long_buf(struct tipc_link *l_ptr, struct sk_buff *buf)
2401 {
2402 	struct sk_buff *buf_chain = NULL;
2403 	struct sk_buff *buf_chain_tail = (struct sk_buff *)&buf_chain;
2404 	struct tipc_msg *inmsg = buf_msg(buf);
2405 	struct tipc_msg fragm_hdr;
2406 	u32 insize = msg_size(inmsg);
2407 	u32 dsz = msg_data_sz(inmsg);
2408 	unchar *crs = buf->data;
2409 	u32 rest = insize;
2410 	u32 pack_sz = l_ptr->max_pkt;
2411 	u32 fragm_sz = pack_sz - INT_H_SIZE;
2412 	u32 fragm_no = 0;
2413 	u32 destaddr;
2414 
2415 	if (msg_short(inmsg))
2416 		destaddr = l_ptr->addr;
2417 	else
2418 		destaddr = msg_destnode(inmsg);
2419 
2420 	/* Prepare reusable fragment header: */
2421 	tipc_msg_init(&fragm_hdr, MSG_FRAGMENTER, FIRST_FRAGMENT,
2422 		 INT_H_SIZE, destaddr);
2423 
2424 	/* Chop up message: */
2425 	while (rest > 0) {
2426 		struct sk_buff *fragm;
2427 
2428 		if (rest <= fragm_sz) {
2429 			fragm_sz = rest;
2430 			msg_set_type(&fragm_hdr, LAST_FRAGMENT);
2431 		}
2432 		fragm = tipc_buf_acquire(fragm_sz + INT_H_SIZE);
2433 		if (fragm == NULL) {
2434 			kfree_skb(buf);
2435 			while (buf_chain) {
2436 				buf = buf_chain;
2437 				buf_chain = buf_chain->next;
2438 				kfree_skb(buf);
2439 			}
2440 			return -ENOMEM;
2441 		}
2442 		msg_set_size(&fragm_hdr, fragm_sz + INT_H_SIZE);
2443 		fragm_no++;
2444 		msg_set_fragm_no(&fragm_hdr, fragm_no);
2445 		skb_copy_to_linear_data(fragm, &fragm_hdr, INT_H_SIZE);
2446 		skb_copy_to_linear_data_offset(fragm, INT_H_SIZE, crs,
2447 					       fragm_sz);
2448 		buf_chain_tail->next = fragm;
2449 		buf_chain_tail = fragm;
2450 
2451 		rest -= fragm_sz;
2452 		crs += fragm_sz;
2453 		msg_set_type(&fragm_hdr, FRAGMENT);
2454 	}
2455 	kfree_skb(buf);
2456 
2457 	/* Append chain of fragments to send queue & send them */
2458 	l_ptr->long_msg_seq_no++;
2459 	link_add_chain_to_outqueue(l_ptr, buf_chain, l_ptr->long_msg_seq_no);
2460 	l_ptr->stats.sent_fragments += fragm_no;
2461 	l_ptr->stats.sent_fragmented++;
2462 	tipc_link_push_queue(l_ptr);
2463 
2464 	return dsz;
2465 }
2466 
2467 /*
2468  * A pending message being re-assembled must store certain values
2469  * to handle subsequent fragments correctly. The following functions
2470  * help storing these values in unused, available fields in the
2471  * pending message. This makes dynamic memory allocation unnecessary.
2472  */
2473 static void set_long_msg_seqno(struct sk_buff *buf, u32 seqno)
2474 {
2475 	msg_set_seqno(buf_msg(buf), seqno);
2476 }
2477 
2478 static u32 get_fragm_size(struct sk_buff *buf)
2479 {
2480 	return msg_ack(buf_msg(buf));
2481 }
2482 
2483 static void set_fragm_size(struct sk_buff *buf, u32 sz)
2484 {
2485 	msg_set_ack(buf_msg(buf), sz);
2486 }
2487 
2488 static u32 get_expected_frags(struct sk_buff *buf)
2489 {
2490 	return msg_bcast_ack(buf_msg(buf));
2491 }
2492 
2493 static void set_expected_frags(struct sk_buff *buf, u32 exp)
2494 {
2495 	msg_set_bcast_ack(buf_msg(buf), exp);
2496 }
2497 
2498 /*
2499  * tipc_link_recv_fragment(): Called with node lock on. Returns
2500  * the reassembled buffer if message is complete.
2501  */
2502 int tipc_link_recv_fragment(struct sk_buff **pending, struct sk_buff **fb,
2503 			    struct tipc_msg **m)
2504 {
2505 	struct sk_buff *prev = NULL;
2506 	struct sk_buff *fbuf = *fb;
2507 	struct tipc_msg *fragm = buf_msg(fbuf);
2508 	struct sk_buff *pbuf = *pending;
2509 	u32 long_msg_seq_no = msg_long_msgno(fragm);
2510 
2511 	*fb = NULL;
2512 
2513 	/* Is there an incomplete message waiting for this fragment? */
2514 	while (pbuf && ((buf_seqno(pbuf) != long_msg_seq_no) ||
2515 			(msg_orignode(fragm) != msg_orignode(buf_msg(pbuf))))) {
2516 		prev = pbuf;
2517 		pbuf = pbuf->next;
2518 	}
2519 
2520 	if (!pbuf && (msg_type(fragm) == FIRST_FRAGMENT)) {
2521 		struct tipc_msg *imsg = (struct tipc_msg *)msg_data(fragm);
2522 		u32 msg_sz = msg_size(imsg);
2523 		u32 fragm_sz = msg_data_sz(fragm);
2524 		u32 exp_fragm_cnt = msg_sz/fragm_sz + !!(msg_sz % fragm_sz);
2525 		u32 max =  TIPC_MAX_USER_MSG_SIZE + NAMED_H_SIZE;
2526 		if (msg_type(imsg) == TIPC_MCAST_MSG)
2527 			max = TIPC_MAX_USER_MSG_SIZE + MCAST_H_SIZE;
2528 		if (msg_size(imsg) > max) {
2529 			kfree_skb(fbuf);
2530 			return 0;
2531 		}
2532 		pbuf = tipc_buf_acquire(msg_size(imsg));
2533 		if (pbuf != NULL) {
2534 			pbuf->next = *pending;
2535 			*pending = pbuf;
2536 			skb_copy_to_linear_data(pbuf, imsg,
2537 						msg_data_sz(fragm));
2538 			/*  Prepare buffer for subsequent fragments. */
2539 			set_long_msg_seqno(pbuf, long_msg_seq_no);
2540 			set_fragm_size(pbuf, fragm_sz);
2541 			set_expected_frags(pbuf, exp_fragm_cnt - 1);
2542 		} else {
2543 			pr_debug("Link unable to reassemble fragmented message\n");
2544 			kfree_skb(fbuf);
2545 			return -1;
2546 		}
2547 		kfree_skb(fbuf);
2548 		return 0;
2549 	} else if (pbuf && (msg_type(fragm) != FIRST_FRAGMENT)) {
2550 		u32 dsz = msg_data_sz(fragm);
2551 		u32 fsz = get_fragm_size(pbuf);
2552 		u32 crs = ((msg_fragm_no(fragm) - 1) * fsz);
2553 		u32 exp_frags = get_expected_frags(pbuf) - 1;
2554 		skb_copy_to_linear_data_offset(pbuf, crs,
2555 					       msg_data(fragm), dsz);
2556 		kfree_skb(fbuf);
2557 
2558 		/* Is message complete? */
2559 		if (exp_frags == 0) {
2560 			if (prev)
2561 				prev->next = pbuf->next;
2562 			else
2563 				*pending = pbuf->next;
2564 			msg_reset_reroute_cnt(buf_msg(pbuf));
2565 			*fb = pbuf;
2566 			*m = buf_msg(pbuf);
2567 			return 1;
2568 		}
2569 		set_expected_frags(pbuf, exp_frags);
2570 		return 0;
2571 	}
2572 	kfree_skb(fbuf);
2573 	return 0;
2574 }
2575 
2576 static void link_set_supervision_props(struct tipc_link *l_ptr, u32 tolerance)
2577 {
2578 	if ((tolerance < TIPC_MIN_LINK_TOL) || (tolerance > TIPC_MAX_LINK_TOL))
2579 		return;
2580 
2581 	l_ptr->tolerance = tolerance;
2582 	l_ptr->continuity_interval =
2583 		((tolerance / 4) > 500) ? 500 : tolerance / 4;
2584 	l_ptr->abort_limit = tolerance / (l_ptr->continuity_interval / 4);
2585 }
2586 
2587 void tipc_link_set_queue_limits(struct tipc_link *l_ptr, u32 window)
2588 {
2589 	/* Data messages from this node, inclusive FIRST_FRAGM */
2590 	l_ptr->queue_limit[TIPC_LOW_IMPORTANCE] = window;
2591 	l_ptr->queue_limit[TIPC_MEDIUM_IMPORTANCE] = (window / 3) * 4;
2592 	l_ptr->queue_limit[TIPC_HIGH_IMPORTANCE] = (window / 3) * 5;
2593 	l_ptr->queue_limit[TIPC_CRITICAL_IMPORTANCE] = (window / 3) * 6;
2594 	/* Transiting data messages,inclusive FIRST_FRAGM */
2595 	l_ptr->queue_limit[TIPC_LOW_IMPORTANCE + 4] = 300;
2596 	l_ptr->queue_limit[TIPC_MEDIUM_IMPORTANCE + 4] = 600;
2597 	l_ptr->queue_limit[TIPC_HIGH_IMPORTANCE + 4] = 900;
2598 	l_ptr->queue_limit[TIPC_CRITICAL_IMPORTANCE + 4] = 1200;
2599 	l_ptr->queue_limit[CONN_MANAGER] = 1200;
2600 	l_ptr->queue_limit[CHANGEOVER_PROTOCOL] = 2500;
2601 	l_ptr->queue_limit[NAME_DISTRIBUTOR] = 3000;
2602 	/* FRAGMENT and LAST_FRAGMENT packets */
2603 	l_ptr->queue_limit[MSG_FRAGMENTER] = 4000;
2604 }
2605 
2606 /**
2607  * link_find_link - locate link by name
2608  * @name: ptr to link name string
2609  * @node: ptr to area to be filled with ptr to associated node
2610  *
2611  * Caller must hold 'tipc_net_lock' to ensure node and bearer are not deleted;
2612  * this also prevents link deletion.
2613  *
2614  * Returns pointer to link (or 0 if invalid link name).
2615  */
2616 static struct tipc_link *link_find_link(const char *name,
2617 					struct tipc_node **node)
2618 {
2619 	struct tipc_link_name link_name_parts;
2620 	struct tipc_bearer *b_ptr;
2621 	struct tipc_link *l_ptr;
2622 
2623 	if (!link_name_validate(name, &link_name_parts))
2624 		return NULL;
2625 
2626 	b_ptr = tipc_bearer_find_interface(link_name_parts.if_local);
2627 	if (!b_ptr)
2628 		return NULL;
2629 
2630 	*node = tipc_node_find(link_name_parts.addr_peer);
2631 	if (!*node)
2632 		return NULL;
2633 
2634 	l_ptr = (*node)->links[b_ptr->identity];
2635 	if (!l_ptr || strcmp(l_ptr->name, name))
2636 		return NULL;
2637 
2638 	return l_ptr;
2639 }
2640 
2641 /**
2642  * link_value_is_valid -- validate proposed link tolerance/priority/window
2643  *
2644  * @cmd: value type (TIPC_CMD_SET_LINK_*)
2645  * @new_value: the new value
2646  *
2647  * Returns 1 if value is within range, 0 if not.
2648  */
2649 static int link_value_is_valid(u16 cmd, u32 new_value)
2650 {
2651 	switch (cmd) {
2652 	case TIPC_CMD_SET_LINK_TOL:
2653 		return (new_value >= TIPC_MIN_LINK_TOL) &&
2654 			(new_value <= TIPC_MAX_LINK_TOL);
2655 	case TIPC_CMD_SET_LINK_PRI:
2656 		return (new_value <= TIPC_MAX_LINK_PRI);
2657 	case TIPC_CMD_SET_LINK_WINDOW:
2658 		return (new_value >= TIPC_MIN_LINK_WIN) &&
2659 			(new_value <= TIPC_MAX_LINK_WIN);
2660 	}
2661 	return 0;
2662 }
2663 
2664 /**
2665  * link_cmd_set_value - change priority/tolerance/window for link/bearer/media
2666  * @name: ptr to link, bearer, or media name
2667  * @new_value: new value of link, bearer, or media setting
2668  * @cmd: which link, bearer, or media attribute to set (TIPC_CMD_SET_LINK_*)
2669  *
2670  * Caller must hold 'tipc_net_lock' to ensure link/bearer/media is not deleted.
2671  *
2672  * Returns 0 if value updated and negative value on error.
2673  */
2674 static int link_cmd_set_value(const char *name, u32 new_value, u16 cmd)
2675 {
2676 	struct tipc_node *node;
2677 	struct tipc_link *l_ptr;
2678 	struct tipc_bearer *b_ptr;
2679 	struct tipc_media *m_ptr;
2680 
2681 	l_ptr = link_find_link(name, &node);
2682 	if (l_ptr) {
2683 		/*
2684 		 * acquire node lock for tipc_link_send_proto_msg().
2685 		 * see "TIPC locking policy" in net.c.
2686 		 */
2687 		tipc_node_lock(node);
2688 		switch (cmd) {
2689 		case TIPC_CMD_SET_LINK_TOL:
2690 			link_set_supervision_props(l_ptr, new_value);
2691 			tipc_link_send_proto_msg(l_ptr,
2692 				STATE_MSG, 0, 0, new_value, 0, 0);
2693 			break;
2694 		case TIPC_CMD_SET_LINK_PRI:
2695 			l_ptr->priority = new_value;
2696 			tipc_link_send_proto_msg(l_ptr,
2697 				STATE_MSG, 0, 0, 0, new_value, 0);
2698 			break;
2699 		case TIPC_CMD_SET_LINK_WINDOW:
2700 			tipc_link_set_queue_limits(l_ptr, new_value);
2701 			break;
2702 		}
2703 		tipc_node_unlock(node);
2704 		return 0;
2705 	}
2706 
2707 	b_ptr = tipc_bearer_find(name);
2708 	if (b_ptr) {
2709 		switch (cmd) {
2710 		case TIPC_CMD_SET_LINK_TOL:
2711 			b_ptr->tolerance = new_value;
2712 			return 0;
2713 		case TIPC_CMD_SET_LINK_PRI:
2714 			b_ptr->priority = new_value;
2715 			return 0;
2716 		case TIPC_CMD_SET_LINK_WINDOW:
2717 			b_ptr->window = new_value;
2718 			return 0;
2719 		}
2720 		return -EINVAL;
2721 	}
2722 
2723 	m_ptr = tipc_media_find(name);
2724 	if (!m_ptr)
2725 		return -ENODEV;
2726 	switch (cmd) {
2727 	case TIPC_CMD_SET_LINK_TOL:
2728 		m_ptr->tolerance = new_value;
2729 		return 0;
2730 	case TIPC_CMD_SET_LINK_PRI:
2731 		m_ptr->priority = new_value;
2732 		return 0;
2733 	case TIPC_CMD_SET_LINK_WINDOW:
2734 		m_ptr->window = new_value;
2735 		return 0;
2736 	}
2737 	return -EINVAL;
2738 }
2739 
2740 struct sk_buff *tipc_link_cmd_config(const void *req_tlv_area, int req_tlv_space,
2741 				     u16 cmd)
2742 {
2743 	struct tipc_link_config *args;
2744 	u32 new_value;
2745 	int res;
2746 
2747 	if (!TLV_CHECK(req_tlv_area, req_tlv_space, TIPC_TLV_LINK_CONFIG))
2748 		return tipc_cfg_reply_error_string(TIPC_CFG_TLV_ERROR);
2749 
2750 	args = (struct tipc_link_config *)TLV_DATA(req_tlv_area);
2751 	new_value = ntohl(args->value);
2752 
2753 	if (!link_value_is_valid(cmd, new_value))
2754 		return tipc_cfg_reply_error_string(
2755 			"cannot change, value invalid");
2756 
2757 	if (!strcmp(args->name, tipc_bclink_name)) {
2758 		if ((cmd == TIPC_CMD_SET_LINK_WINDOW) &&
2759 		    (tipc_bclink_set_queue_limits(new_value) == 0))
2760 			return tipc_cfg_reply_none();
2761 		return tipc_cfg_reply_error_string(TIPC_CFG_NOT_SUPPORTED
2762 						   " (cannot change setting on broadcast link)");
2763 	}
2764 
2765 	read_lock_bh(&tipc_net_lock);
2766 	res = link_cmd_set_value(args->name, new_value, cmd);
2767 	read_unlock_bh(&tipc_net_lock);
2768 	if (res)
2769 		return tipc_cfg_reply_error_string("cannot change link setting");
2770 
2771 	return tipc_cfg_reply_none();
2772 }
2773 
2774 /**
2775  * link_reset_statistics - reset link statistics
2776  * @l_ptr: pointer to link
2777  */
2778 static void link_reset_statistics(struct tipc_link *l_ptr)
2779 {
2780 	memset(&l_ptr->stats, 0, sizeof(l_ptr->stats));
2781 	l_ptr->stats.sent_info = l_ptr->next_out_no;
2782 	l_ptr->stats.recv_info = l_ptr->next_in_no;
2783 }
2784 
2785 struct sk_buff *tipc_link_cmd_reset_stats(const void *req_tlv_area, int req_tlv_space)
2786 {
2787 	char *link_name;
2788 	struct tipc_link *l_ptr;
2789 	struct tipc_node *node;
2790 
2791 	if (!TLV_CHECK(req_tlv_area, req_tlv_space, TIPC_TLV_LINK_NAME))
2792 		return tipc_cfg_reply_error_string(TIPC_CFG_TLV_ERROR);
2793 
2794 	link_name = (char *)TLV_DATA(req_tlv_area);
2795 	if (!strcmp(link_name, tipc_bclink_name)) {
2796 		if (tipc_bclink_reset_stats())
2797 			return tipc_cfg_reply_error_string("link not found");
2798 		return tipc_cfg_reply_none();
2799 	}
2800 
2801 	read_lock_bh(&tipc_net_lock);
2802 	l_ptr = link_find_link(link_name, &node);
2803 	if (!l_ptr) {
2804 		read_unlock_bh(&tipc_net_lock);
2805 		return tipc_cfg_reply_error_string("link not found");
2806 	}
2807 
2808 	tipc_node_lock(node);
2809 	link_reset_statistics(l_ptr);
2810 	tipc_node_unlock(node);
2811 	read_unlock_bh(&tipc_net_lock);
2812 	return tipc_cfg_reply_none();
2813 }
2814 
2815 /**
2816  * percent - convert count to a percentage of total (rounding up or down)
2817  */
2818 static u32 percent(u32 count, u32 total)
2819 {
2820 	return (count * 100 + (total / 2)) / total;
2821 }
2822 
2823 /**
2824  * tipc_link_stats - print link statistics
2825  * @name: link name
2826  * @buf: print buffer area
2827  * @buf_size: size of print buffer area
2828  *
2829  * Returns length of print buffer data string (or 0 if error)
2830  */
2831 static int tipc_link_stats(const char *name, char *buf, const u32 buf_size)
2832 {
2833 	struct tipc_link *l;
2834 	struct tipc_stats *s;
2835 	struct tipc_node *node;
2836 	char *status;
2837 	u32 profile_total = 0;
2838 	int ret;
2839 
2840 	if (!strcmp(name, tipc_bclink_name))
2841 		return tipc_bclink_stats(buf, buf_size);
2842 
2843 	read_lock_bh(&tipc_net_lock);
2844 	l = link_find_link(name, &node);
2845 	if (!l) {
2846 		read_unlock_bh(&tipc_net_lock);
2847 		return 0;
2848 	}
2849 	tipc_node_lock(node);
2850 	s = &l->stats;
2851 
2852 	if (tipc_link_is_active(l))
2853 		status = "ACTIVE";
2854 	else if (tipc_link_is_up(l))
2855 		status = "STANDBY";
2856 	else
2857 		status = "DEFUNCT";
2858 
2859 	ret = tipc_snprintf(buf, buf_size, "Link <%s>\n"
2860 			    "  %s  MTU:%u  Priority:%u  Tolerance:%u ms"
2861 			    "  Window:%u packets\n",
2862 			    l->name, status, l->max_pkt, l->priority,
2863 			    l->tolerance, l->queue_limit[0]);
2864 
2865 	ret += tipc_snprintf(buf + ret, buf_size - ret,
2866 			     "  RX packets:%u fragments:%u/%u bundles:%u/%u\n",
2867 			     l->next_in_no - s->recv_info, s->recv_fragments,
2868 			     s->recv_fragmented, s->recv_bundles,
2869 			     s->recv_bundled);
2870 
2871 	ret += tipc_snprintf(buf + ret, buf_size - ret,
2872 			     "  TX packets:%u fragments:%u/%u bundles:%u/%u\n",
2873 			     l->next_out_no - s->sent_info, s->sent_fragments,
2874 			     s->sent_fragmented, s->sent_bundles,
2875 			     s->sent_bundled);
2876 
2877 	profile_total = s->msg_length_counts;
2878 	if (!profile_total)
2879 		profile_total = 1;
2880 
2881 	ret += tipc_snprintf(buf + ret, buf_size - ret,
2882 			     "  TX profile sample:%u packets  average:%u octets\n"
2883 			     "  0-64:%u%% -256:%u%% -1024:%u%% -4096:%u%% "
2884 			     "-16384:%u%% -32768:%u%% -66000:%u%%\n",
2885 			     s->msg_length_counts,
2886 			     s->msg_lengths_total / profile_total,
2887 			     percent(s->msg_length_profile[0], profile_total),
2888 			     percent(s->msg_length_profile[1], profile_total),
2889 			     percent(s->msg_length_profile[2], profile_total),
2890 			     percent(s->msg_length_profile[3], profile_total),
2891 			     percent(s->msg_length_profile[4], profile_total),
2892 			     percent(s->msg_length_profile[5], profile_total),
2893 			     percent(s->msg_length_profile[6], profile_total));
2894 
2895 	ret += tipc_snprintf(buf + ret, buf_size - ret,
2896 			     "  RX states:%u probes:%u naks:%u defs:%u"
2897 			     " dups:%u\n", s->recv_states, s->recv_probes,
2898 			     s->recv_nacks, s->deferred_recv, s->duplicates);
2899 
2900 	ret += tipc_snprintf(buf + ret, buf_size - ret,
2901 			     "  TX states:%u probes:%u naks:%u acks:%u"
2902 			     " dups:%u\n", s->sent_states, s->sent_probes,
2903 			     s->sent_nacks, s->sent_acks, s->retransmitted);
2904 
2905 	ret += tipc_snprintf(buf + ret, buf_size - ret,
2906 			     "  Congestion link:%u  Send queue"
2907 			     " max:%u avg:%u\n", s->link_congs,
2908 			     s->max_queue_sz, s->queue_sz_counts ?
2909 			     (s->accu_queue_sz / s->queue_sz_counts) : 0);
2910 
2911 	tipc_node_unlock(node);
2912 	read_unlock_bh(&tipc_net_lock);
2913 	return ret;
2914 }
2915 
2916 struct sk_buff *tipc_link_cmd_show_stats(const void *req_tlv_area, int req_tlv_space)
2917 {
2918 	struct sk_buff *buf;
2919 	struct tlv_desc *rep_tlv;
2920 	int str_len;
2921 	int pb_len;
2922 	char *pb;
2923 
2924 	if (!TLV_CHECK(req_tlv_area, req_tlv_space, TIPC_TLV_LINK_NAME))
2925 		return tipc_cfg_reply_error_string(TIPC_CFG_TLV_ERROR);
2926 
2927 	buf = tipc_cfg_reply_alloc(TLV_SPACE(ULTRA_STRING_MAX_LEN));
2928 	if (!buf)
2929 		return NULL;
2930 
2931 	rep_tlv = (struct tlv_desc *)buf->data;
2932 	pb = TLV_DATA(rep_tlv);
2933 	pb_len = ULTRA_STRING_MAX_LEN;
2934 	str_len = tipc_link_stats((char *)TLV_DATA(req_tlv_area),
2935 				  pb, pb_len);
2936 	if (!str_len) {
2937 		kfree_skb(buf);
2938 		return tipc_cfg_reply_error_string("link not found");
2939 	}
2940 	str_len += 1;	/* for "\0" */
2941 	skb_put(buf, TLV_SPACE(str_len));
2942 	TLV_SET(rep_tlv, TIPC_TLV_ULTRA_STRING, NULL, str_len);
2943 
2944 	return buf;
2945 }
2946 
2947 /**
2948  * tipc_link_get_max_pkt - get maximum packet size to use when sending to destination
2949  * @dest: network address of destination node
2950  * @selector: used to select from set of active links
2951  *
2952  * If no active link can be found, uses default maximum packet size.
2953  */
2954 u32 tipc_link_get_max_pkt(u32 dest, u32 selector)
2955 {
2956 	struct tipc_node *n_ptr;
2957 	struct tipc_link *l_ptr;
2958 	u32 res = MAX_PKT_DEFAULT;
2959 
2960 	if (dest == tipc_own_addr)
2961 		return MAX_MSG_SIZE;
2962 
2963 	read_lock_bh(&tipc_net_lock);
2964 	n_ptr = tipc_node_find(dest);
2965 	if (n_ptr) {
2966 		tipc_node_lock(n_ptr);
2967 		l_ptr = n_ptr->active_links[selector & 1];
2968 		if (l_ptr)
2969 			res = l_ptr->max_pkt;
2970 		tipc_node_unlock(n_ptr);
2971 	}
2972 	read_unlock_bh(&tipc_net_lock);
2973 	return res;
2974 }
2975 
2976 static void link_print(struct tipc_link *l_ptr, const char *str)
2977 {
2978 	pr_info("%s Link %x<%s>:", str, l_ptr->addr, l_ptr->b_ptr->name);
2979 
2980 	if (link_working_unknown(l_ptr))
2981 		pr_cont(":WU\n");
2982 	else if (link_reset_reset(l_ptr))
2983 		pr_cont(":RR\n");
2984 	else if (link_reset_unknown(l_ptr))
2985 		pr_cont(":RU\n");
2986 	else if (link_working_working(l_ptr))
2987 		pr_cont(":WW\n");
2988 	else
2989 		pr_cont("\n");
2990 }
2991