xref: /linux/net/tipc/link.c (revision 26b0d14106954ae46d2f4f7eec3481828a210f7d)
1 /*
2  * net/tipc/link.c: TIPC link code
3  *
4  * Copyright (c) 1996-2007, Ericsson AB
5  * Copyright (c) 2004-2007, 2010-2011, Wind River Systems
6  * All rights reserved.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions are met:
10  *
11  * 1. Redistributions of source code must retain the above copyright
12  *    notice, this list of conditions and the following disclaimer.
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in the
15  *    documentation and/or other materials provided with the distribution.
16  * 3. Neither the names of the copyright holders nor the names of its
17  *    contributors may be used to endorse or promote products derived from
18  *    this software without specific prior written permission.
19  *
20  * Alternatively, this software may be distributed under the terms of the
21  * GNU General Public License ("GPL") version 2 as published by the Free
22  * Software Foundation.
23  *
24  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
25  * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
26  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
27  * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
28  * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
29  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
30  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
31  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
32  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
33  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
34  * POSSIBILITY OF SUCH DAMAGE.
35  */
36 
37 #include "core.h"
38 #include "link.h"
39 #include "port.h"
40 #include "name_distr.h"
41 #include "discover.h"
42 #include "config.h"
43 
44 
45 /*
46  * Out-of-range value for link session numbers
47  */
48 #define INVALID_SESSION 0x10000
49 
50 /*
51  * Link state events:
52  */
53 #define  STARTING_EVT    856384768	/* link processing trigger */
54 #define  TRAFFIC_MSG_EVT 560815u	/* rx'd ??? */
55 #define  TIMEOUT_EVT     560817u	/* link timer expired */
56 
57 /*
58  * The following two 'message types' is really just implementation
59  * data conveniently stored in the message header.
60  * They must not be considered part of the protocol
61  */
62 #define OPEN_MSG   0
63 #define CLOSED_MSG 1
64 
65 /*
66  * State value stored in 'exp_msg_count'
67  */
68 #define START_CHANGEOVER 100000u
69 
70 /**
71  * struct tipc_link_name - deconstructed link name
72  * @addr_local: network address of node at this end
73  * @if_local: name of interface at this end
74  * @addr_peer: network address of node at far end
75  * @if_peer: name of interface at far end
76  */
77 struct tipc_link_name {
78 	u32 addr_local;
79 	char if_local[TIPC_MAX_IF_NAME];
80 	u32 addr_peer;
81 	char if_peer[TIPC_MAX_IF_NAME];
82 };
83 
84 static void link_handle_out_of_seq_msg(struct tipc_link *l_ptr,
85 				       struct sk_buff *buf);
86 static void link_recv_proto_msg(struct tipc_link *l_ptr, struct sk_buff *buf);
87 static int  link_recv_changeover_msg(struct tipc_link **l_ptr,
88 				     struct sk_buff **buf);
89 static void link_set_supervision_props(struct tipc_link *l_ptr, u32 tolerance);
90 static int  link_send_sections_long(struct tipc_port *sender,
91 				    struct iovec const *msg_sect,
92 				    u32 num_sect, unsigned int total_len,
93 				    u32 destnode);
94 static void link_check_defragm_bufs(struct tipc_link *l_ptr);
95 static void link_state_event(struct tipc_link *l_ptr, u32 event);
96 static void link_reset_statistics(struct tipc_link *l_ptr);
97 static void link_print(struct tipc_link *l_ptr, const char *str);
98 static void link_start(struct tipc_link *l_ptr);
99 static int link_send_long_buf(struct tipc_link *l_ptr, struct sk_buff *buf);
100 
101 /*
102  *  Simple link routines
103  */
104 static unsigned int align(unsigned int i)
105 {
106 	return (i + 3) & ~3u;
107 }
108 
109 static void link_init_max_pkt(struct tipc_link *l_ptr)
110 {
111 	u32 max_pkt;
112 
113 	max_pkt = (l_ptr->b_ptr->mtu & ~3);
114 	if (max_pkt > MAX_MSG_SIZE)
115 		max_pkt = MAX_MSG_SIZE;
116 
117 	l_ptr->max_pkt_target = max_pkt;
118 	if (l_ptr->max_pkt_target < MAX_PKT_DEFAULT)
119 		l_ptr->max_pkt = l_ptr->max_pkt_target;
120 	else
121 		l_ptr->max_pkt = MAX_PKT_DEFAULT;
122 
123 	l_ptr->max_pkt_probes = 0;
124 }
125 
126 static u32 link_next_sent(struct tipc_link *l_ptr)
127 {
128 	if (l_ptr->next_out)
129 		return buf_seqno(l_ptr->next_out);
130 	return mod(l_ptr->next_out_no);
131 }
132 
133 static u32 link_last_sent(struct tipc_link *l_ptr)
134 {
135 	return mod(link_next_sent(l_ptr) - 1);
136 }
137 
138 /*
139  *  Simple non-static link routines (i.e. referenced outside this file)
140  */
141 int tipc_link_is_up(struct tipc_link *l_ptr)
142 {
143 	if (!l_ptr)
144 		return 0;
145 	return link_working_working(l_ptr) || link_working_unknown(l_ptr);
146 }
147 
148 int tipc_link_is_active(struct tipc_link *l_ptr)
149 {
150 	return	(l_ptr->owner->active_links[0] == l_ptr) ||
151 		(l_ptr->owner->active_links[1] == l_ptr);
152 }
153 
154 /**
155  * link_name_validate - validate & (optionally) deconstruct tipc_link name
156  * @name - ptr to link name string
157  * @name_parts - ptr to area for link name components (or NULL if not needed)
158  *
159  * Returns 1 if link name is valid, otherwise 0.
160  */
161 static int link_name_validate(const char *name,
162 				struct tipc_link_name *name_parts)
163 {
164 	char name_copy[TIPC_MAX_LINK_NAME];
165 	char *addr_local;
166 	char *if_local;
167 	char *addr_peer;
168 	char *if_peer;
169 	char dummy;
170 	u32 z_local, c_local, n_local;
171 	u32 z_peer, c_peer, n_peer;
172 	u32 if_local_len;
173 	u32 if_peer_len;
174 
175 	/* copy link name & ensure length is OK */
176 	name_copy[TIPC_MAX_LINK_NAME - 1] = 0;
177 	/* need above in case non-Posix strncpy() doesn't pad with nulls */
178 	strncpy(name_copy, name, TIPC_MAX_LINK_NAME);
179 	if (name_copy[TIPC_MAX_LINK_NAME - 1] != 0)
180 		return 0;
181 
182 	/* ensure all component parts of link name are present */
183 	addr_local = name_copy;
184 	if_local = strchr(addr_local, ':');
185 	if (if_local == NULL)
186 		return 0;
187 	*(if_local++) = 0;
188 	addr_peer = strchr(if_local, '-');
189 	if (addr_peer == NULL)
190 		return 0;
191 	*(addr_peer++) = 0;
192 	if_local_len = addr_peer - if_local;
193 	if_peer = strchr(addr_peer, ':');
194 	if (if_peer == NULL)
195 		return 0;
196 	*(if_peer++) = 0;
197 	if_peer_len = strlen(if_peer) + 1;
198 
199 	/* validate component parts of link name */
200 	if ((sscanf(addr_local, "%u.%u.%u%c",
201 		    &z_local, &c_local, &n_local, &dummy) != 3) ||
202 	    (sscanf(addr_peer, "%u.%u.%u%c",
203 		    &z_peer, &c_peer, &n_peer, &dummy) != 3) ||
204 	    (z_local > 255) || (c_local > 4095) || (n_local > 4095) ||
205 	    (z_peer  > 255) || (c_peer  > 4095) || (n_peer  > 4095) ||
206 	    (if_local_len <= 1) || (if_local_len > TIPC_MAX_IF_NAME) ||
207 	    (if_peer_len  <= 1) || (if_peer_len  > TIPC_MAX_IF_NAME) ||
208 	    (strspn(if_local, tipc_alphabet) != (if_local_len - 1)) ||
209 	    (strspn(if_peer, tipc_alphabet) != (if_peer_len - 1)))
210 		return 0;
211 
212 	/* return link name components, if necessary */
213 	if (name_parts) {
214 		name_parts->addr_local = tipc_addr(z_local, c_local, n_local);
215 		strcpy(name_parts->if_local, if_local);
216 		name_parts->addr_peer = tipc_addr(z_peer, c_peer, n_peer);
217 		strcpy(name_parts->if_peer, if_peer);
218 	}
219 	return 1;
220 }
221 
222 /**
223  * link_timeout - handle expiration of link timer
224  * @l_ptr: pointer to link
225  *
226  * This routine must not grab "tipc_net_lock" to avoid a potential deadlock conflict
227  * with tipc_link_delete().  (There is no risk that the node will be deleted by
228  * another thread because tipc_link_delete() always cancels the link timer before
229  * tipc_node_delete() is called.)
230  */
231 static void link_timeout(struct tipc_link *l_ptr)
232 {
233 	tipc_node_lock(l_ptr->owner);
234 
235 	/* update counters used in statistical profiling of send traffic */
236 	l_ptr->stats.accu_queue_sz += l_ptr->out_queue_size;
237 	l_ptr->stats.queue_sz_counts++;
238 
239 	if (l_ptr->first_out) {
240 		struct tipc_msg *msg = buf_msg(l_ptr->first_out);
241 		u32 length = msg_size(msg);
242 
243 		if ((msg_user(msg) == MSG_FRAGMENTER) &&
244 		    (msg_type(msg) == FIRST_FRAGMENT)) {
245 			length = msg_size(msg_get_wrapped(msg));
246 		}
247 		if (length) {
248 			l_ptr->stats.msg_lengths_total += length;
249 			l_ptr->stats.msg_length_counts++;
250 			if (length <= 64)
251 				l_ptr->stats.msg_length_profile[0]++;
252 			else if (length <= 256)
253 				l_ptr->stats.msg_length_profile[1]++;
254 			else if (length <= 1024)
255 				l_ptr->stats.msg_length_profile[2]++;
256 			else if (length <= 4096)
257 				l_ptr->stats.msg_length_profile[3]++;
258 			else if (length <= 16384)
259 				l_ptr->stats.msg_length_profile[4]++;
260 			else if (length <= 32768)
261 				l_ptr->stats.msg_length_profile[5]++;
262 			else
263 				l_ptr->stats.msg_length_profile[6]++;
264 		}
265 	}
266 
267 	/* do all other link processing performed on a periodic basis */
268 	link_check_defragm_bufs(l_ptr);
269 
270 	link_state_event(l_ptr, TIMEOUT_EVT);
271 
272 	if (l_ptr->next_out)
273 		tipc_link_push_queue(l_ptr);
274 
275 	tipc_node_unlock(l_ptr->owner);
276 }
277 
278 static void link_set_timer(struct tipc_link *l_ptr, u32 time)
279 {
280 	k_start_timer(&l_ptr->timer, time);
281 }
282 
283 /**
284  * tipc_link_create - create a new link
285  * @n_ptr: pointer to associated node
286  * @b_ptr: pointer to associated bearer
287  * @media_addr: media address to use when sending messages over link
288  *
289  * Returns pointer to link.
290  */
291 struct tipc_link *tipc_link_create(struct tipc_node *n_ptr,
292 			      struct tipc_bearer *b_ptr,
293 			      const struct tipc_media_addr *media_addr)
294 {
295 	struct tipc_link *l_ptr;
296 	struct tipc_msg *msg;
297 	char *if_name;
298 	char addr_string[16];
299 	u32 peer = n_ptr->addr;
300 
301 	if (n_ptr->link_cnt >= 2) {
302 		tipc_addr_string_fill(addr_string, n_ptr->addr);
303 		err("Attempt to establish third link to %s\n", addr_string);
304 		return NULL;
305 	}
306 
307 	if (n_ptr->links[b_ptr->identity]) {
308 		tipc_addr_string_fill(addr_string, n_ptr->addr);
309 		err("Attempt to establish second link on <%s> to %s\n",
310 		    b_ptr->name, addr_string);
311 		return NULL;
312 	}
313 
314 	l_ptr = kzalloc(sizeof(*l_ptr), GFP_ATOMIC);
315 	if (!l_ptr) {
316 		warn("Link creation failed, no memory\n");
317 		return NULL;
318 	}
319 
320 	l_ptr->addr = peer;
321 	if_name = strchr(b_ptr->name, ':') + 1;
322 	sprintf(l_ptr->name, "%u.%u.%u:%s-%u.%u.%u:unknown",
323 		tipc_zone(tipc_own_addr), tipc_cluster(tipc_own_addr),
324 		tipc_node(tipc_own_addr),
325 		if_name,
326 		tipc_zone(peer), tipc_cluster(peer), tipc_node(peer));
327 		/* note: peer i/f name is updated by reset/activate message */
328 	memcpy(&l_ptr->media_addr, media_addr, sizeof(*media_addr));
329 	l_ptr->owner = n_ptr;
330 	l_ptr->checkpoint = 1;
331 	l_ptr->peer_session = INVALID_SESSION;
332 	l_ptr->b_ptr = b_ptr;
333 	link_set_supervision_props(l_ptr, b_ptr->tolerance);
334 	l_ptr->state = RESET_UNKNOWN;
335 
336 	l_ptr->pmsg = (struct tipc_msg *)&l_ptr->proto_msg;
337 	msg = l_ptr->pmsg;
338 	tipc_msg_init(msg, LINK_PROTOCOL, RESET_MSG, INT_H_SIZE, l_ptr->addr);
339 	msg_set_size(msg, sizeof(l_ptr->proto_msg));
340 	msg_set_session(msg, (tipc_random & 0xffff));
341 	msg_set_bearer_id(msg, b_ptr->identity);
342 	strcpy((char *)msg_data(msg), if_name);
343 
344 	l_ptr->priority = b_ptr->priority;
345 	tipc_link_set_queue_limits(l_ptr, b_ptr->window);
346 
347 	link_init_max_pkt(l_ptr);
348 
349 	l_ptr->next_out_no = 1;
350 	INIT_LIST_HEAD(&l_ptr->waiting_ports);
351 
352 	link_reset_statistics(l_ptr);
353 
354 	tipc_node_attach_link(n_ptr, l_ptr);
355 
356 	k_init_timer(&l_ptr->timer, (Handler)link_timeout, (unsigned long)l_ptr);
357 	list_add_tail(&l_ptr->link_list, &b_ptr->links);
358 	tipc_k_signal((Handler)link_start, (unsigned long)l_ptr);
359 
360 	return l_ptr;
361 }
362 
363 /**
364  * tipc_link_delete - delete a link
365  * @l_ptr: pointer to link
366  *
367  * Note: 'tipc_net_lock' is write_locked, bearer is locked.
368  * This routine must not grab the node lock until after link timer cancellation
369  * to avoid a potential deadlock situation.
370  */
371 void tipc_link_delete(struct tipc_link *l_ptr)
372 {
373 	if (!l_ptr) {
374 		err("Attempt to delete non-existent link\n");
375 		return;
376 	}
377 
378 	k_cancel_timer(&l_ptr->timer);
379 
380 	tipc_node_lock(l_ptr->owner);
381 	tipc_link_reset(l_ptr);
382 	tipc_node_detach_link(l_ptr->owner, l_ptr);
383 	tipc_link_stop(l_ptr);
384 	list_del_init(&l_ptr->link_list);
385 	tipc_node_unlock(l_ptr->owner);
386 	k_term_timer(&l_ptr->timer);
387 	kfree(l_ptr);
388 }
389 
390 static void link_start(struct tipc_link *l_ptr)
391 {
392 	tipc_node_lock(l_ptr->owner);
393 	link_state_event(l_ptr, STARTING_EVT);
394 	tipc_node_unlock(l_ptr->owner);
395 }
396 
397 /**
398  * link_schedule_port - schedule port for deferred sending
399  * @l_ptr: pointer to link
400  * @origport: reference to sending port
401  * @sz: amount of data to be sent
402  *
403  * Schedules port for renewed sending of messages after link congestion
404  * has abated.
405  */
406 static int link_schedule_port(struct tipc_link *l_ptr, u32 origport, u32 sz)
407 {
408 	struct tipc_port *p_ptr;
409 
410 	spin_lock_bh(&tipc_port_list_lock);
411 	p_ptr = tipc_port_lock(origport);
412 	if (p_ptr) {
413 		if (!p_ptr->wakeup)
414 			goto exit;
415 		if (!list_empty(&p_ptr->wait_list))
416 			goto exit;
417 		p_ptr->congested = 1;
418 		p_ptr->waiting_pkts = 1 + ((sz - 1) / l_ptr->max_pkt);
419 		list_add_tail(&p_ptr->wait_list, &l_ptr->waiting_ports);
420 		l_ptr->stats.link_congs++;
421 exit:
422 		tipc_port_unlock(p_ptr);
423 	}
424 	spin_unlock_bh(&tipc_port_list_lock);
425 	return -ELINKCONG;
426 }
427 
428 void tipc_link_wakeup_ports(struct tipc_link *l_ptr, int all)
429 {
430 	struct tipc_port *p_ptr;
431 	struct tipc_port *temp_p_ptr;
432 	int win = l_ptr->queue_limit[0] - l_ptr->out_queue_size;
433 
434 	if (all)
435 		win = 100000;
436 	if (win <= 0)
437 		return;
438 	if (!spin_trylock_bh(&tipc_port_list_lock))
439 		return;
440 	if (link_congested(l_ptr))
441 		goto exit;
442 	list_for_each_entry_safe(p_ptr, temp_p_ptr, &l_ptr->waiting_ports,
443 				 wait_list) {
444 		if (win <= 0)
445 			break;
446 		list_del_init(&p_ptr->wait_list);
447 		spin_lock_bh(p_ptr->lock);
448 		p_ptr->congested = 0;
449 		p_ptr->wakeup(p_ptr);
450 		win -= p_ptr->waiting_pkts;
451 		spin_unlock_bh(p_ptr->lock);
452 	}
453 
454 exit:
455 	spin_unlock_bh(&tipc_port_list_lock);
456 }
457 
458 /**
459  * link_release_outqueue - purge link's outbound message queue
460  * @l_ptr: pointer to link
461  */
462 static void link_release_outqueue(struct tipc_link *l_ptr)
463 {
464 	struct sk_buff *buf = l_ptr->first_out;
465 	struct sk_buff *next;
466 
467 	while (buf) {
468 		next = buf->next;
469 		kfree_skb(buf);
470 		buf = next;
471 	}
472 	l_ptr->first_out = NULL;
473 	l_ptr->out_queue_size = 0;
474 }
475 
476 /**
477  * tipc_link_reset_fragments - purge link's inbound message fragments queue
478  * @l_ptr: pointer to link
479  */
480 void tipc_link_reset_fragments(struct tipc_link *l_ptr)
481 {
482 	struct sk_buff *buf = l_ptr->defragm_buf;
483 	struct sk_buff *next;
484 
485 	while (buf) {
486 		next = buf->next;
487 		kfree_skb(buf);
488 		buf = next;
489 	}
490 	l_ptr->defragm_buf = NULL;
491 }
492 
493 /**
494  * tipc_link_stop - purge all inbound and outbound messages associated with link
495  * @l_ptr: pointer to link
496  */
497 void tipc_link_stop(struct tipc_link *l_ptr)
498 {
499 	struct sk_buff *buf;
500 	struct sk_buff *next;
501 
502 	buf = l_ptr->oldest_deferred_in;
503 	while (buf) {
504 		next = buf->next;
505 		kfree_skb(buf);
506 		buf = next;
507 	}
508 
509 	buf = l_ptr->first_out;
510 	while (buf) {
511 		next = buf->next;
512 		kfree_skb(buf);
513 		buf = next;
514 	}
515 
516 	tipc_link_reset_fragments(l_ptr);
517 
518 	kfree_skb(l_ptr->proto_msg_queue);
519 	l_ptr->proto_msg_queue = NULL;
520 }
521 
522 void tipc_link_reset(struct tipc_link *l_ptr)
523 {
524 	struct sk_buff *buf;
525 	u32 prev_state = l_ptr->state;
526 	u32 checkpoint = l_ptr->next_in_no;
527 	int was_active_link = tipc_link_is_active(l_ptr);
528 
529 	msg_set_session(l_ptr->pmsg, ((msg_session(l_ptr->pmsg) + 1) & 0xffff));
530 
531 	/* Link is down, accept any session */
532 	l_ptr->peer_session = INVALID_SESSION;
533 
534 	/* Prepare for max packet size negotiation */
535 	link_init_max_pkt(l_ptr);
536 
537 	l_ptr->state = RESET_UNKNOWN;
538 
539 	if ((prev_state == RESET_UNKNOWN) || (prev_state == RESET_RESET))
540 		return;
541 
542 	tipc_node_link_down(l_ptr->owner, l_ptr);
543 	tipc_bearer_remove_dest(l_ptr->b_ptr, l_ptr->addr);
544 
545 	if (was_active_link && tipc_node_active_links(l_ptr->owner) &&
546 	    l_ptr->owner->permit_changeover) {
547 		l_ptr->reset_checkpoint = checkpoint;
548 		l_ptr->exp_msg_count = START_CHANGEOVER;
549 	}
550 
551 	/* Clean up all queues: */
552 	link_release_outqueue(l_ptr);
553 	kfree_skb(l_ptr->proto_msg_queue);
554 	l_ptr->proto_msg_queue = NULL;
555 	buf = l_ptr->oldest_deferred_in;
556 	while (buf) {
557 		struct sk_buff *next = buf->next;
558 		kfree_skb(buf);
559 		buf = next;
560 	}
561 	if (!list_empty(&l_ptr->waiting_ports))
562 		tipc_link_wakeup_ports(l_ptr, 1);
563 
564 	l_ptr->retransm_queue_head = 0;
565 	l_ptr->retransm_queue_size = 0;
566 	l_ptr->last_out = NULL;
567 	l_ptr->first_out = NULL;
568 	l_ptr->next_out = NULL;
569 	l_ptr->unacked_window = 0;
570 	l_ptr->checkpoint = 1;
571 	l_ptr->next_out_no = 1;
572 	l_ptr->deferred_inqueue_sz = 0;
573 	l_ptr->oldest_deferred_in = NULL;
574 	l_ptr->newest_deferred_in = NULL;
575 	l_ptr->fsm_msg_cnt = 0;
576 	l_ptr->stale_count = 0;
577 	link_reset_statistics(l_ptr);
578 }
579 
580 
581 static void link_activate(struct tipc_link *l_ptr)
582 {
583 	l_ptr->next_in_no = l_ptr->stats.recv_info = 1;
584 	tipc_node_link_up(l_ptr->owner, l_ptr);
585 	tipc_bearer_add_dest(l_ptr->b_ptr, l_ptr->addr);
586 }
587 
588 /**
589  * link_state_event - link finite state machine
590  * @l_ptr: pointer to link
591  * @event: state machine event to process
592  */
593 static void link_state_event(struct tipc_link *l_ptr, unsigned int event)
594 {
595 	struct tipc_link *other;
596 	u32 cont_intv = l_ptr->continuity_interval;
597 
598 	if (!l_ptr->started && (event != STARTING_EVT))
599 		return;		/* Not yet. */
600 
601 	if (link_blocked(l_ptr)) {
602 		if (event == TIMEOUT_EVT)
603 			link_set_timer(l_ptr, cont_intv);
604 		return;	  /* Changeover going on */
605 	}
606 
607 	switch (l_ptr->state) {
608 	case WORKING_WORKING:
609 		switch (event) {
610 		case TRAFFIC_MSG_EVT:
611 		case ACTIVATE_MSG:
612 			break;
613 		case TIMEOUT_EVT:
614 			if (l_ptr->next_in_no != l_ptr->checkpoint) {
615 				l_ptr->checkpoint = l_ptr->next_in_no;
616 				if (tipc_bclink_acks_missing(l_ptr->owner)) {
617 					tipc_link_send_proto_msg(l_ptr, STATE_MSG,
618 								 0, 0, 0, 0, 0);
619 					l_ptr->fsm_msg_cnt++;
620 				} else if (l_ptr->max_pkt < l_ptr->max_pkt_target) {
621 					tipc_link_send_proto_msg(l_ptr, STATE_MSG,
622 								 1, 0, 0, 0, 0);
623 					l_ptr->fsm_msg_cnt++;
624 				}
625 				link_set_timer(l_ptr, cont_intv);
626 				break;
627 			}
628 			l_ptr->state = WORKING_UNKNOWN;
629 			l_ptr->fsm_msg_cnt = 0;
630 			tipc_link_send_proto_msg(l_ptr, STATE_MSG, 1, 0, 0, 0, 0);
631 			l_ptr->fsm_msg_cnt++;
632 			link_set_timer(l_ptr, cont_intv / 4);
633 			break;
634 		case RESET_MSG:
635 			info("Resetting link <%s>, requested by peer\n",
636 			     l_ptr->name);
637 			tipc_link_reset(l_ptr);
638 			l_ptr->state = RESET_RESET;
639 			l_ptr->fsm_msg_cnt = 0;
640 			tipc_link_send_proto_msg(l_ptr, ACTIVATE_MSG, 0, 0, 0, 0, 0);
641 			l_ptr->fsm_msg_cnt++;
642 			link_set_timer(l_ptr, cont_intv);
643 			break;
644 		default:
645 			err("Unknown link event %u in WW state\n", event);
646 		}
647 		break;
648 	case WORKING_UNKNOWN:
649 		switch (event) {
650 		case TRAFFIC_MSG_EVT:
651 		case ACTIVATE_MSG:
652 			l_ptr->state = WORKING_WORKING;
653 			l_ptr->fsm_msg_cnt = 0;
654 			link_set_timer(l_ptr, cont_intv);
655 			break;
656 		case RESET_MSG:
657 			info("Resetting link <%s>, requested by peer "
658 			     "while probing\n", l_ptr->name);
659 			tipc_link_reset(l_ptr);
660 			l_ptr->state = RESET_RESET;
661 			l_ptr->fsm_msg_cnt = 0;
662 			tipc_link_send_proto_msg(l_ptr, ACTIVATE_MSG, 0, 0, 0, 0, 0);
663 			l_ptr->fsm_msg_cnt++;
664 			link_set_timer(l_ptr, cont_intv);
665 			break;
666 		case TIMEOUT_EVT:
667 			if (l_ptr->next_in_no != l_ptr->checkpoint) {
668 				l_ptr->state = WORKING_WORKING;
669 				l_ptr->fsm_msg_cnt = 0;
670 				l_ptr->checkpoint = l_ptr->next_in_no;
671 				if (tipc_bclink_acks_missing(l_ptr->owner)) {
672 					tipc_link_send_proto_msg(l_ptr, STATE_MSG,
673 								 0, 0, 0, 0, 0);
674 					l_ptr->fsm_msg_cnt++;
675 				}
676 				link_set_timer(l_ptr, cont_intv);
677 			} else if (l_ptr->fsm_msg_cnt < l_ptr->abort_limit) {
678 				tipc_link_send_proto_msg(l_ptr, STATE_MSG,
679 							 1, 0, 0, 0, 0);
680 				l_ptr->fsm_msg_cnt++;
681 				link_set_timer(l_ptr, cont_intv / 4);
682 			} else {	/* Link has failed */
683 				warn("Resetting link <%s>, peer not responding\n",
684 				     l_ptr->name);
685 				tipc_link_reset(l_ptr);
686 				l_ptr->state = RESET_UNKNOWN;
687 				l_ptr->fsm_msg_cnt = 0;
688 				tipc_link_send_proto_msg(l_ptr, RESET_MSG,
689 							 0, 0, 0, 0, 0);
690 				l_ptr->fsm_msg_cnt++;
691 				link_set_timer(l_ptr, cont_intv);
692 			}
693 			break;
694 		default:
695 			err("Unknown link event %u in WU state\n", event);
696 		}
697 		break;
698 	case RESET_UNKNOWN:
699 		switch (event) {
700 		case TRAFFIC_MSG_EVT:
701 			break;
702 		case ACTIVATE_MSG:
703 			other = l_ptr->owner->active_links[0];
704 			if (other && link_working_unknown(other))
705 				break;
706 			l_ptr->state = WORKING_WORKING;
707 			l_ptr->fsm_msg_cnt = 0;
708 			link_activate(l_ptr);
709 			tipc_link_send_proto_msg(l_ptr, STATE_MSG, 1, 0, 0, 0, 0);
710 			l_ptr->fsm_msg_cnt++;
711 			link_set_timer(l_ptr, cont_intv);
712 			break;
713 		case RESET_MSG:
714 			l_ptr->state = RESET_RESET;
715 			l_ptr->fsm_msg_cnt = 0;
716 			tipc_link_send_proto_msg(l_ptr, ACTIVATE_MSG, 1, 0, 0, 0, 0);
717 			l_ptr->fsm_msg_cnt++;
718 			link_set_timer(l_ptr, cont_intv);
719 			break;
720 		case STARTING_EVT:
721 			l_ptr->started = 1;
722 			/* fall through */
723 		case TIMEOUT_EVT:
724 			tipc_link_send_proto_msg(l_ptr, RESET_MSG, 0, 0, 0, 0, 0);
725 			l_ptr->fsm_msg_cnt++;
726 			link_set_timer(l_ptr, cont_intv);
727 			break;
728 		default:
729 			err("Unknown link event %u in RU state\n", event);
730 		}
731 		break;
732 	case RESET_RESET:
733 		switch (event) {
734 		case TRAFFIC_MSG_EVT:
735 		case ACTIVATE_MSG:
736 			other = l_ptr->owner->active_links[0];
737 			if (other && link_working_unknown(other))
738 				break;
739 			l_ptr->state = WORKING_WORKING;
740 			l_ptr->fsm_msg_cnt = 0;
741 			link_activate(l_ptr);
742 			tipc_link_send_proto_msg(l_ptr, STATE_MSG, 1, 0, 0, 0, 0);
743 			l_ptr->fsm_msg_cnt++;
744 			link_set_timer(l_ptr, cont_intv);
745 			break;
746 		case RESET_MSG:
747 			break;
748 		case TIMEOUT_EVT:
749 			tipc_link_send_proto_msg(l_ptr, ACTIVATE_MSG, 0, 0, 0, 0, 0);
750 			l_ptr->fsm_msg_cnt++;
751 			link_set_timer(l_ptr, cont_intv);
752 			break;
753 		default:
754 			err("Unknown link event %u in RR state\n", event);
755 		}
756 		break;
757 	default:
758 		err("Unknown link state %u/%u\n", l_ptr->state, event);
759 	}
760 }
761 
762 /*
763  * link_bundle_buf(): Append contents of a buffer to
764  * the tail of an existing one.
765  */
766 static int link_bundle_buf(struct tipc_link *l_ptr,
767 			   struct sk_buff *bundler,
768 			   struct sk_buff *buf)
769 {
770 	struct tipc_msg *bundler_msg = buf_msg(bundler);
771 	struct tipc_msg *msg = buf_msg(buf);
772 	u32 size = msg_size(msg);
773 	u32 bundle_size = msg_size(bundler_msg);
774 	u32 to_pos = align(bundle_size);
775 	u32 pad = to_pos - bundle_size;
776 
777 	if (msg_user(bundler_msg) != MSG_BUNDLER)
778 		return 0;
779 	if (msg_type(bundler_msg) != OPEN_MSG)
780 		return 0;
781 	if (skb_tailroom(bundler) < (pad + size))
782 		return 0;
783 	if (l_ptr->max_pkt < (to_pos + size))
784 		return 0;
785 
786 	skb_put(bundler, pad + size);
787 	skb_copy_to_linear_data_offset(bundler, to_pos, buf->data, size);
788 	msg_set_size(bundler_msg, to_pos + size);
789 	msg_set_msgcnt(bundler_msg, msg_msgcnt(bundler_msg) + 1);
790 	kfree_skb(buf);
791 	l_ptr->stats.sent_bundled++;
792 	return 1;
793 }
794 
795 static void link_add_to_outqueue(struct tipc_link *l_ptr,
796 				 struct sk_buff *buf,
797 				 struct tipc_msg *msg)
798 {
799 	u32 ack = mod(l_ptr->next_in_no - 1);
800 	u32 seqno = mod(l_ptr->next_out_no++);
801 
802 	msg_set_word(msg, 2, ((ack << 16) | seqno));
803 	msg_set_bcast_ack(msg, l_ptr->owner->bclink.last_in);
804 	buf->next = NULL;
805 	if (l_ptr->first_out) {
806 		l_ptr->last_out->next = buf;
807 		l_ptr->last_out = buf;
808 	} else
809 		l_ptr->first_out = l_ptr->last_out = buf;
810 
811 	l_ptr->out_queue_size++;
812 	if (l_ptr->out_queue_size > l_ptr->stats.max_queue_sz)
813 		l_ptr->stats.max_queue_sz = l_ptr->out_queue_size;
814 }
815 
816 static void link_add_chain_to_outqueue(struct tipc_link *l_ptr,
817 				       struct sk_buff *buf_chain,
818 				       u32 long_msgno)
819 {
820 	struct sk_buff *buf;
821 	struct tipc_msg *msg;
822 
823 	if (!l_ptr->next_out)
824 		l_ptr->next_out = buf_chain;
825 	while (buf_chain) {
826 		buf = buf_chain;
827 		buf_chain = buf_chain->next;
828 
829 		msg = buf_msg(buf);
830 		msg_set_long_msgno(msg, long_msgno);
831 		link_add_to_outqueue(l_ptr, buf, msg);
832 	}
833 }
834 
835 /*
836  * tipc_link_send_buf() is the 'full path' for messages, called from
837  * inside TIPC when the 'fast path' in tipc_send_buf
838  * has failed, and from link_send()
839  */
840 int tipc_link_send_buf(struct tipc_link *l_ptr, struct sk_buff *buf)
841 {
842 	struct tipc_msg *msg = buf_msg(buf);
843 	u32 size = msg_size(msg);
844 	u32 dsz = msg_data_sz(msg);
845 	u32 queue_size = l_ptr->out_queue_size;
846 	u32 imp = tipc_msg_tot_importance(msg);
847 	u32 queue_limit = l_ptr->queue_limit[imp];
848 	u32 max_packet = l_ptr->max_pkt;
849 
850 	/* Match msg importance against queue limits: */
851 	if (unlikely(queue_size >= queue_limit)) {
852 		if (imp <= TIPC_CRITICAL_IMPORTANCE) {
853 			link_schedule_port(l_ptr, msg_origport(msg), size);
854 			kfree_skb(buf);
855 			return -ELINKCONG;
856 		}
857 		kfree_skb(buf);
858 		if (imp > CONN_MANAGER) {
859 			warn("Resetting link <%s>, send queue full", l_ptr->name);
860 			tipc_link_reset(l_ptr);
861 		}
862 		return dsz;
863 	}
864 
865 	/* Fragmentation needed ? */
866 	if (size > max_packet)
867 		return link_send_long_buf(l_ptr, buf);
868 
869 	/* Packet can be queued or sent. */
870 	if (likely(!tipc_bearer_congested(l_ptr->b_ptr, l_ptr) &&
871 		   !link_congested(l_ptr))) {
872 		link_add_to_outqueue(l_ptr, buf, msg);
873 
874 		if (likely(tipc_bearer_send(l_ptr->b_ptr, buf, &l_ptr->media_addr))) {
875 			l_ptr->unacked_window = 0;
876 		} else {
877 			tipc_bearer_schedule(l_ptr->b_ptr, l_ptr);
878 			l_ptr->stats.bearer_congs++;
879 			l_ptr->next_out = buf;
880 		}
881 		return dsz;
882 	}
883 	/* Congestion: can message be bundled ? */
884 	if ((msg_user(msg) != CHANGEOVER_PROTOCOL) &&
885 	    (msg_user(msg) != MSG_FRAGMENTER)) {
886 
887 		/* Try adding message to an existing bundle */
888 		if (l_ptr->next_out &&
889 		    link_bundle_buf(l_ptr, l_ptr->last_out, buf)) {
890 			tipc_bearer_resolve_congestion(l_ptr->b_ptr, l_ptr);
891 			return dsz;
892 		}
893 
894 		/* Try creating a new bundle */
895 		if (size <= max_packet * 2 / 3) {
896 			struct sk_buff *bundler = tipc_buf_acquire(max_packet);
897 			struct tipc_msg bundler_hdr;
898 
899 			if (bundler) {
900 				tipc_msg_init(&bundler_hdr, MSG_BUNDLER, OPEN_MSG,
901 					 INT_H_SIZE, l_ptr->addr);
902 				skb_copy_to_linear_data(bundler, &bundler_hdr,
903 							INT_H_SIZE);
904 				skb_trim(bundler, INT_H_SIZE);
905 				link_bundle_buf(l_ptr, bundler, buf);
906 				buf = bundler;
907 				msg = buf_msg(buf);
908 				l_ptr->stats.sent_bundles++;
909 			}
910 		}
911 	}
912 	if (!l_ptr->next_out)
913 		l_ptr->next_out = buf;
914 	link_add_to_outqueue(l_ptr, buf, msg);
915 	tipc_bearer_resolve_congestion(l_ptr->b_ptr, l_ptr);
916 	return dsz;
917 }
918 
919 /*
920  * tipc_link_send(): same as tipc_link_send_buf(), but the link to use has
921  * not been selected yet, and the the owner node is not locked
922  * Called by TIPC internal users, e.g. the name distributor
923  */
924 int tipc_link_send(struct sk_buff *buf, u32 dest, u32 selector)
925 {
926 	struct tipc_link *l_ptr;
927 	struct tipc_node *n_ptr;
928 	int res = -ELINKCONG;
929 
930 	read_lock_bh(&tipc_net_lock);
931 	n_ptr = tipc_node_find(dest);
932 	if (n_ptr) {
933 		tipc_node_lock(n_ptr);
934 		l_ptr = n_ptr->active_links[selector & 1];
935 		if (l_ptr)
936 			res = tipc_link_send_buf(l_ptr, buf);
937 		else
938 			kfree_skb(buf);
939 		tipc_node_unlock(n_ptr);
940 	} else {
941 		kfree_skb(buf);
942 	}
943 	read_unlock_bh(&tipc_net_lock);
944 	return res;
945 }
946 
947 /*
948  * tipc_link_send_names - send name table entries to new neighbor
949  *
950  * Send routine for bulk delivery of name table messages when contact
951  * with a new neighbor occurs. No link congestion checking is performed
952  * because name table messages *must* be delivered. The messages must be
953  * small enough not to require fragmentation.
954  * Called without any locks held.
955  */
956 void tipc_link_send_names(struct list_head *message_list, u32 dest)
957 {
958 	struct tipc_node *n_ptr;
959 	struct tipc_link *l_ptr;
960 	struct sk_buff *buf;
961 	struct sk_buff *temp_buf;
962 
963 	if (list_empty(message_list))
964 		return;
965 
966 	read_lock_bh(&tipc_net_lock);
967 	n_ptr = tipc_node_find(dest);
968 	if (n_ptr) {
969 		tipc_node_lock(n_ptr);
970 		l_ptr = n_ptr->active_links[0];
971 		if (l_ptr) {
972 			/* convert circular list to linear list */
973 			((struct sk_buff *)message_list->prev)->next = NULL;
974 			link_add_chain_to_outqueue(l_ptr,
975 				(struct sk_buff *)message_list->next, 0);
976 			tipc_link_push_queue(l_ptr);
977 			INIT_LIST_HEAD(message_list);
978 		}
979 		tipc_node_unlock(n_ptr);
980 	}
981 	read_unlock_bh(&tipc_net_lock);
982 
983 	/* discard the messages if they couldn't be sent */
984 	list_for_each_safe(buf, temp_buf, ((struct sk_buff *)message_list)) {
985 		list_del((struct list_head *)buf);
986 		kfree_skb(buf);
987 	}
988 }
989 
990 /*
991  * link_send_buf_fast: Entry for data messages where the
992  * destination link is known and the header is complete,
993  * inclusive total message length. Very time critical.
994  * Link is locked. Returns user data length.
995  */
996 static int link_send_buf_fast(struct tipc_link *l_ptr, struct sk_buff *buf,
997 			      u32 *used_max_pkt)
998 {
999 	struct tipc_msg *msg = buf_msg(buf);
1000 	int res = msg_data_sz(msg);
1001 
1002 	if (likely(!link_congested(l_ptr))) {
1003 		if (likely(msg_size(msg) <= l_ptr->max_pkt)) {
1004 			if (likely(list_empty(&l_ptr->b_ptr->cong_links))) {
1005 				link_add_to_outqueue(l_ptr, buf, msg);
1006 				if (likely(tipc_bearer_send(l_ptr->b_ptr, buf,
1007 							    &l_ptr->media_addr))) {
1008 					l_ptr->unacked_window = 0;
1009 					return res;
1010 				}
1011 				tipc_bearer_schedule(l_ptr->b_ptr, l_ptr);
1012 				l_ptr->stats.bearer_congs++;
1013 				l_ptr->next_out = buf;
1014 				return res;
1015 			}
1016 		} else
1017 			*used_max_pkt = l_ptr->max_pkt;
1018 	}
1019 	return tipc_link_send_buf(l_ptr, buf);  /* All other cases */
1020 }
1021 
1022 /*
1023  * tipc_send_buf_fast: Entry for data messages where the
1024  * destination node is known and the header is complete,
1025  * inclusive total message length.
1026  * Returns user data length.
1027  */
1028 int tipc_send_buf_fast(struct sk_buff *buf, u32 destnode)
1029 {
1030 	struct tipc_link *l_ptr;
1031 	struct tipc_node *n_ptr;
1032 	int res;
1033 	u32 selector = msg_origport(buf_msg(buf)) & 1;
1034 	u32 dummy;
1035 
1036 	read_lock_bh(&tipc_net_lock);
1037 	n_ptr = tipc_node_find(destnode);
1038 	if (likely(n_ptr)) {
1039 		tipc_node_lock(n_ptr);
1040 		l_ptr = n_ptr->active_links[selector];
1041 		if (likely(l_ptr)) {
1042 			res = link_send_buf_fast(l_ptr, buf, &dummy);
1043 			tipc_node_unlock(n_ptr);
1044 			read_unlock_bh(&tipc_net_lock);
1045 			return res;
1046 		}
1047 		tipc_node_unlock(n_ptr);
1048 	}
1049 	read_unlock_bh(&tipc_net_lock);
1050 	res = msg_data_sz(buf_msg(buf));
1051 	tipc_reject_msg(buf, TIPC_ERR_NO_NODE);
1052 	return res;
1053 }
1054 
1055 
1056 /*
1057  * tipc_link_send_sections_fast: Entry for messages where the
1058  * destination processor is known and the header is complete,
1059  * except for total message length.
1060  * Returns user data length or errno.
1061  */
1062 int tipc_link_send_sections_fast(struct tipc_port *sender,
1063 				 struct iovec const *msg_sect,
1064 				 const u32 num_sect,
1065 				 unsigned int total_len,
1066 				 u32 destaddr)
1067 {
1068 	struct tipc_msg *hdr = &sender->phdr;
1069 	struct tipc_link *l_ptr;
1070 	struct sk_buff *buf;
1071 	struct tipc_node *node;
1072 	int res;
1073 	u32 selector = msg_origport(hdr) & 1;
1074 
1075 again:
1076 	/*
1077 	 * Try building message using port's max_pkt hint.
1078 	 * (Must not hold any locks while building message.)
1079 	 */
1080 	res = tipc_msg_build(hdr, msg_sect, num_sect, total_len,
1081 			     sender->max_pkt, !sender->user_port, &buf);
1082 
1083 	read_lock_bh(&tipc_net_lock);
1084 	node = tipc_node_find(destaddr);
1085 	if (likely(node)) {
1086 		tipc_node_lock(node);
1087 		l_ptr = node->active_links[selector];
1088 		if (likely(l_ptr)) {
1089 			if (likely(buf)) {
1090 				res = link_send_buf_fast(l_ptr, buf,
1091 							 &sender->max_pkt);
1092 exit:
1093 				tipc_node_unlock(node);
1094 				read_unlock_bh(&tipc_net_lock);
1095 				return res;
1096 			}
1097 
1098 			/* Exit if build request was invalid */
1099 			if (unlikely(res < 0))
1100 				goto exit;
1101 
1102 			/* Exit if link (or bearer) is congested */
1103 			if (link_congested(l_ptr) ||
1104 			    !list_empty(&l_ptr->b_ptr->cong_links)) {
1105 				res = link_schedule_port(l_ptr,
1106 							 sender->ref, res);
1107 				goto exit;
1108 			}
1109 
1110 			/*
1111 			 * Message size exceeds max_pkt hint; update hint,
1112 			 * then re-try fast path or fragment the message
1113 			 */
1114 			sender->max_pkt = l_ptr->max_pkt;
1115 			tipc_node_unlock(node);
1116 			read_unlock_bh(&tipc_net_lock);
1117 
1118 
1119 			if ((msg_hdr_sz(hdr) + res) <= sender->max_pkt)
1120 				goto again;
1121 
1122 			return link_send_sections_long(sender, msg_sect,
1123 						       num_sect, total_len,
1124 						       destaddr);
1125 		}
1126 		tipc_node_unlock(node);
1127 	}
1128 	read_unlock_bh(&tipc_net_lock);
1129 
1130 	/* Couldn't find a link to the destination node */
1131 	if (buf)
1132 		return tipc_reject_msg(buf, TIPC_ERR_NO_NODE);
1133 	if (res >= 0)
1134 		return tipc_port_reject_sections(sender, hdr, msg_sect, num_sect,
1135 						 total_len, TIPC_ERR_NO_NODE);
1136 	return res;
1137 }
1138 
1139 /*
1140  * link_send_sections_long(): Entry for long messages where the
1141  * destination node is known and the header is complete,
1142  * inclusive total message length.
1143  * Link and bearer congestion status have been checked to be ok,
1144  * and are ignored if they change.
1145  *
1146  * Note that fragments do not use the full link MTU so that they won't have
1147  * to undergo refragmentation if link changeover causes them to be sent
1148  * over another link with an additional tunnel header added as prefix.
1149  * (Refragmentation will still occur if the other link has a smaller MTU.)
1150  *
1151  * Returns user data length or errno.
1152  */
1153 static int link_send_sections_long(struct tipc_port *sender,
1154 				   struct iovec const *msg_sect,
1155 				   u32 num_sect,
1156 				   unsigned int total_len,
1157 				   u32 destaddr)
1158 {
1159 	struct tipc_link *l_ptr;
1160 	struct tipc_node *node;
1161 	struct tipc_msg *hdr = &sender->phdr;
1162 	u32 dsz = total_len;
1163 	u32 max_pkt, fragm_sz, rest;
1164 	struct tipc_msg fragm_hdr;
1165 	struct sk_buff *buf, *buf_chain, *prev;
1166 	u32 fragm_crs, fragm_rest, hsz, sect_rest;
1167 	const unchar *sect_crs;
1168 	int curr_sect;
1169 	u32 fragm_no;
1170 
1171 again:
1172 	fragm_no = 1;
1173 	max_pkt = sender->max_pkt - INT_H_SIZE;
1174 		/* leave room for tunnel header in case of link changeover */
1175 	fragm_sz = max_pkt - INT_H_SIZE;
1176 		/* leave room for fragmentation header in each fragment */
1177 	rest = dsz;
1178 	fragm_crs = 0;
1179 	fragm_rest = 0;
1180 	sect_rest = 0;
1181 	sect_crs = NULL;
1182 	curr_sect = -1;
1183 
1184 	/* Prepare reusable fragment header */
1185 	tipc_msg_init(&fragm_hdr, MSG_FRAGMENTER, FIRST_FRAGMENT,
1186 		 INT_H_SIZE, msg_destnode(hdr));
1187 	msg_set_size(&fragm_hdr, max_pkt);
1188 	msg_set_fragm_no(&fragm_hdr, 1);
1189 
1190 	/* Prepare header of first fragment */
1191 	buf_chain = buf = tipc_buf_acquire(max_pkt);
1192 	if (!buf)
1193 		return -ENOMEM;
1194 	buf->next = NULL;
1195 	skb_copy_to_linear_data(buf, &fragm_hdr, INT_H_SIZE);
1196 	hsz = msg_hdr_sz(hdr);
1197 	skb_copy_to_linear_data_offset(buf, INT_H_SIZE, hdr, hsz);
1198 
1199 	/* Chop up message */
1200 	fragm_crs = INT_H_SIZE + hsz;
1201 	fragm_rest = fragm_sz - hsz;
1202 
1203 	do {		/* For all sections */
1204 		u32 sz;
1205 
1206 		if (!sect_rest) {
1207 			sect_rest = msg_sect[++curr_sect].iov_len;
1208 			sect_crs = (const unchar *)msg_sect[curr_sect].iov_base;
1209 		}
1210 
1211 		if (sect_rest < fragm_rest)
1212 			sz = sect_rest;
1213 		else
1214 			sz = fragm_rest;
1215 
1216 		if (likely(!sender->user_port)) {
1217 			if (copy_from_user(buf->data + fragm_crs, sect_crs, sz)) {
1218 error:
1219 				for (; buf_chain; buf_chain = buf) {
1220 					buf = buf_chain->next;
1221 					kfree_skb(buf_chain);
1222 				}
1223 				return -EFAULT;
1224 			}
1225 		} else
1226 			skb_copy_to_linear_data_offset(buf, fragm_crs,
1227 						       sect_crs, sz);
1228 		sect_crs += sz;
1229 		sect_rest -= sz;
1230 		fragm_crs += sz;
1231 		fragm_rest -= sz;
1232 		rest -= sz;
1233 
1234 		if (!fragm_rest && rest) {
1235 
1236 			/* Initiate new fragment: */
1237 			if (rest <= fragm_sz) {
1238 				fragm_sz = rest;
1239 				msg_set_type(&fragm_hdr, LAST_FRAGMENT);
1240 			} else {
1241 				msg_set_type(&fragm_hdr, FRAGMENT);
1242 			}
1243 			msg_set_size(&fragm_hdr, fragm_sz + INT_H_SIZE);
1244 			msg_set_fragm_no(&fragm_hdr, ++fragm_no);
1245 			prev = buf;
1246 			buf = tipc_buf_acquire(fragm_sz + INT_H_SIZE);
1247 			if (!buf)
1248 				goto error;
1249 
1250 			buf->next = NULL;
1251 			prev->next = buf;
1252 			skb_copy_to_linear_data(buf, &fragm_hdr, INT_H_SIZE);
1253 			fragm_crs = INT_H_SIZE;
1254 			fragm_rest = fragm_sz;
1255 		}
1256 	} while (rest > 0);
1257 
1258 	/*
1259 	 * Now we have a buffer chain. Select a link and check
1260 	 * that packet size is still OK
1261 	 */
1262 	node = tipc_node_find(destaddr);
1263 	if (likely(node)) {
1264 		tipc_node_lock(node);
1265 		l_ptr = node->active_links[sender->ref & 1];
1266 		if (!l_ptr) {
1267 			tipc_node_unlock(node);
1268 			goto reject;
1269 		}
1270 		if (l_ptr->max_pkt < max_pkt) {
1271 			sender->max_pkt = l_ptr->max_pkt;
1272 			tipc_node_unlock(node);
1273 			for (; buf_chain; buf_chain = buf) {
1274 				buf = buf_chain->next;
1275 				kfree_skb(buf_chain);
1276 			}
1277 			goto again;
1278 		}
1279 	} else {
1280 reject:
1281 		for (; buf_chain; buf_chain = buf) {
1282 			buf = buf_chain->next;
1283 			kfree_skb(buf_chain);
1284 		}
1285 		return tipc_port_reject_sections(sender, hdr, msg_sect, num_sect,
1286 						 total_len, TIPC_ERR_NO_NODE);
1287 	}
1288 
1289 	/* Append chain of fragments to send queue & send them */
1290 	l_ptr->long_msg_seq_no++;
1291 	link_add_chain_to_outqueue(l_ptr, buf_chain, l_ptr->long_msg_seq_no);
1292 	l_ptr->stats.sent_fragments += fragm_no;
1293 	l_ptr->stats.sent_fragmented++;
1294 	tipc_link_push_queue(l_ptr);
1295 	tipc_node_unlock(node);
1296 	return dsz;
1297 }
1298 
1299 /*
1300  * tipc_link_push_packet: Push one unsent packet to the media
1301  */
1302 u32 tipc_link_push_packet(struct tipc_link *l_ptr)
1303 {
1304 	struct sk_buff *buf = l_ptr->first_out;
1305 	u32 r_q_size = l_ptr->retransm_queue_size;
1306 	u32 r_q_head = l_ptr->retransm_queue_head;
1307 
1308 	/* Step to position where retransmission failed, if any,    */
1309 	/* consider that buffers may have been released in meantime */
1310 	if (r_q_size && buf) {
1311 		u32 last = lesser(mod(r_q_head + r_q_size),
1312 				  link_last_sent(l_ptr));
1313 		u32 first = buf_seqno(buf);
1314 
1315 		while (buf && less(first, r_q_head)) {
1316 			first = mod(first + 1);
1317 			buf = buf->next;
1318 		}
1319 		l_ptr->retransm_queue_head = r_q_head = first;
1320 		l_ptr->retransm_queue_size = r_q_size = mod(last - first);
1321 	}
1322 
1323 	/* Continue retransmission now, if there is anything: */
1324 	if (r_q_size && buf) {
1325 		msg_set_ack(buf_msg(buf), mod(l_ptr->next_in_no - 1));
1326 		msg_set_bcast_ack(buf_msg(buf), l_ptr->owner->bclink.last_in);
1327 		if (tipc_bearer_send(l_ptr->b_ptr, buf, &l_ptr->media_addr)) {
1328 			l_ptr->retransm_queue_head = mod(++r_q_head);
1329 			l_ptr->retransm_queue_size = --r_q_size;
1330 			l_ptr->stats.retransmitted++;
1331 			return 0;
1332 		} else {
1333 			l_ptr->stats.bearer_congs++;
1334 			return PUSH_FAILED;
1335 		}
1336 	}
1337 
1338 	/* Send deferred protocol message, if any: */
1339 	buf = l_ptr->proto_msg_queue;
1340 	if (buf) {
1341 		msg_set_ack(buf_msg(buf), mod(l_ptr->next_in_no - 1));
1342 		msg_set_bcast_ack(buf_msg(buf), l_ptr->owner->bclink.last_in);
1343 		if (tipc_bearer_send(l_ptr->b_ptr, buf, &l_ptr->media_addr)) {
1344 			l_ptr->unacked_window = 0;
1345 			kfree_skb(buf);
1346 			l_ptr->proto_msg_queue = NULL;
1347 			return 0;
1348 		} else {
1349 			l_ptr->stats.bearer_congs++;
1350 			return PUSH_FAILED;
1351 		}
1352 	}
1353 
1354 	/* Send one deferred data message, if send window not full: */
1355 	buf = l_ptr->next_out;
1356 	if (buf) {
1357 		struct tipc_msg *msg = buf_msg(buf);
1358 		u32 next = msg_seqno(msg);
1359 		u32 first = buf_seqno(l_ptr->first_out);
1360 
1361 		if (mod(next - first) < l_ptr->queue_limit[0]) {
1362 			msg_set_ack(msg, mod(l_ptr->next_in_no - 1));
1363 			msg_set_bcast_ack(msg, l_ptr->owner->bclink.last_in);
1364 			if (tipc_bearer_send(l_ptr->b_ptr, buf, &l_ptr->media_addr)) {
1365 				if (msg_user(msg) == MSG_BUNDLER)
1366 					msg_set_type(msg, CLOSED_MSG);
1367 				l_ptr->next_out = buf->next;
1368 				return 0;
1369 			} else {
1370 				l_ptr->stats.bearer_congs++;
1371 				return PUSH_FAILED;
1372 			}
1373 		}
1374 	}
1375 	return PUSH_FINISHED;
1376 }
1377 
1378 /*
1379  * push_queue(): push out the unsent messages of a link where
1380  *               congestion has abated. Node is locked
1381  */
1382 void tipc_link_push_queue(struct tipc_link *l_ptr)
1383 {
1384 	u32 res;
1385 
1386 	if (tipc_bearer_congested(l_ptr->b_ptr, l_ptr))
1387 		return;
1388 
1389 	do {
1390 		res = tipc_link_push_packet(l_ptr);
1391 	} while (!res);
1392 
1393 	if (res == PUSH_FAILED)
1394 		tipc_bearer_schedule(l_ptr->b_ptr, l_ptr);
1395 }
1396 
1397 static void link_reset_all(unsigned long addr)
1398 {
1399 	struct tipc_node *n_ptr;
1400 	char addr_string[16];
1401 	u32 i;
1402 
1403 	read_lock_bh(&tipc_net_lock);
1404 	n_ptr = tipc_node_find((u32)addr);
1405 	if (!n_ptr) {
1406 		read_unlock_bh(&tipc_net_lock);
1407 		return;	/* node no longer exists */
1408 	}
1409 
1410 	tipc_node_lock(n_ptr);
1411 
1412 	warn("Resetting all links to %s\n",
1413 	     tipc_addr_string_fill(addr_string, n_ptr->addr));
1414 
1415 	for (i = 0; i < MAX_BEARERS; i++) {
1416 		if (n_ptr->links[i]) {
1417 			link_print(n_ptr->links[i], "Resetting link\n");
1418 			tipc_link_reset(n_ptr->links[i]);
1419 		}
1420 	}
1421 
1422 	tipc_node_unlock(n_ptr);
1423 	read_unlock_bh(&tipc_net_lock);
1424 }
1425 
1426 static void link_retransmit_failure(struct tipc_link *l_ptr,
1427 					struct sk_buff *buf)
1428 {
1429 	struct tipc_msg *msg = buf_msg(buf);
1430 
1431 	warn("Retransmission failure on link <%s>\n", l_ptr->name);
1432 
1433 	if (l_ptr->addr) {
1434 		/* Handle failure on standard link */
1435 		link_print(l_ptr, "Resetting link\n");
1436 		tipc_link_reset(l_ptr);
1437 
1438 	} else {
1439 		/* Handle failure on broadcast link */
1440 		struct tipc_node *n_ptr;
1441 		char addr_string[16];
1442 
1443 		info("Msg seq number: %u,  ", msg_seqno(msg));
1444 		info("Outstanding acks: %lu\n",
1445 		     (unsigned long) TIPC_SKB_CB(buf)->handle);
1446 
1447 		n_ptr = tipc_bclink_retransmit_to();
1448 		tipc_node_lock(n_ptr);
1449 
1450 		tipc_addr_string_fill(addr_string, n_ptr->addr);
1451 		info("Broadcast link info for %s\n", addr_string);
1452 		info("Supportable: %d,  ", n_ptr->bclink.supportable);
1453 		info("Supported: %d,  ", n_ptr->bclink.supported);
1454 		info("Acked: %u\n", n_ptr->bclink.acked);
1455 		info("Last in: %u,  ", n_ptr->bclink.last_in);
1456 		info("Oos state: %u,  ", n_ptr->bclink.oos_state);
1457 		info("Last sent: %u\n", n_ptr->bclink.last_sent);
1458 
1459 		tipc_k_signal((Handler)link_reset_all, (unsigned long)n_ptr->addr);
1460 
1461 		tipc_node_unlock(n_ptr);
1462 
1463 		l_ptr->stale_count = 0;
1464 	}
1465 }
1466 
1467 void tipc_link_retransmit(struct tipc_link *l_ptr, struct sk_buff *buf,
1468 			  u32 retransmits)
1469 {
1470 	struct tipc_msg *msg;
1471 
1472 	if (!buf)
1473 		return;
1474 
1475 	msg = buf_msg(buf);
1476 
1477 	if (tipc_bearer_congested(l_ptr->b_ptr, l_ptr)) {
1478 		if (l_ptr->retransm_queue_size == 0) {
1479 			l_ptr->retransm_queue_head = msg_seqno(msg);
1480 			l_ptr->retransm_queue_size = retransmits;
1481 		} else {
1482 			err("Unexpected retransmit on link %s (qsize=%d)\n",
1483 			    l_ptr->name, l_ptr->retransm_queue_size);
1484 		}
1485 		return;
1486 	} else {
1487 		/* Detect repeated retransmit failures on uncongested bearer */
1488 		if (l_ptr->last_retransmitted == msg_seqno(msg)) {
1489 			if (++l_ptr->stale_count > 100) {
1490 				link_retransmit_failure(l_ptr, buf);
1491 				return;
1492 			}
1493 		} else {
1494 			l_ptr->last_retransmitted = msg_seqno(msg);
1495 			l_ptr->stale_count = 1;
1496 		}
1497 	}
1498 
1499 	while (retransmits && (buf != l_ptr->next_out) && buf) {
1500 		msg = buf_msg(buf);
1501 		msg_set_ack(msg, mod(l_ptr->next_in_no - 1));
1502 		msg_set_bcast_ack(msg, l_ptr->owner->bclink.last_in);
1503 		if (tipc_bearer_send(l_ptr->b_ptr, buf, &l_ptr->media_addr)) {
1504 			buf = buf->next;
1505 			retransmits--;
1506 			l_ptr->stats.retransmitted++;
1507 		} else {
1508 			tipc_bearer_schedule(l_ptr->b_ptr, l_ptr);
1509 			l_ptr->stats.bearer_congs++;
1510 			l_ptr->retransm_queue_head = buf_seqno(buf);
1511 			l_ptr->retransm_queue_size = retransmits;
1512 			return;
1513 		}
1514 	}
1515 
1516 	l_ptr->retransm_queue_head = l_ptr->retransm_queue_size = 0;
1517 }
1518 
1519 /**
1520  * link_insert_deferred_queue - insert deferred messages back into receive chain
1521  */
1522 static struct sk_buff *link_insert_deferred_queue(struct tipc_link *l_ptr,
1523 						  struct sk_buff *buf)
1524 {
1525 	u32 seq_no;
1526 
1527 	if (l_ptr->oldest_deferred_in == NULL)
1528 		return buf;
1529 
1530 	seq_no = buf_seqno(l_ptr->oldest_deferred_in);
1531 	if (seq_no == mod(l_ptr->next_in_no)) {
1532 		l_ptr->newest_deferred_in->next = buf;
1533 		buf = l_ptr->oldest_deferred_in;
1534 		l_ptr->oldest_deferred_in = NULL;
1535 		l_ptr->deferred_inqueue_sz = 0;
1536 	}
1537 	return buf;
1538 }
1539 
1540 /**
1541  * link_recv_buf_validate - validate basic format of received message
1542  *
1543  * This routine ensures a TIPC message has an acceptable header, and at least
1544  * as much data as the header indicates it should.  The routine also ensures
1545  * that the entire message header is stored in the main fragment of the message
1546  * buffer, to simplify future access to message header fields.
1547  *
1548  * Note: Having extra info present in the message header or data areas is OK.
1549  * TIPC will ignore the excess, under the assumption that it is optional info
1550  * introduced by a later release of the protocol.
1551  */
1552 static int link_recv_buf_validate(struct sk_buff *buf)
1553 {
1554 	static u32 min_data_hdr_size[8] = {
1555 		SHORT_H_SIZE, MCAST_H_SIZE, NAMED_H_SIZE, BASIC_H_SIZE,
1556 		MAX_H_SIZE, MAX_H_SIZE, MAX_H_SIZE, MAX_H_SIZE
1557 		};
1558 
1559 	struct tipc_msg *msg;
1560 	u32 tipc_hdr[2];
1561 	u32 size;
1562 	u32 hdr_size;
1563 	u32 min_hdr_size;
1564 
1565 	if (unlikely(buf->len < MIN_H_SIZE))
1566 		return 0;
1567 
1568 	msg = skb_header_pointer(buf, 0, sizeof(tipc_hdr), tipc_hdr);
1569 	if (msg == NULL)
1570 		return 0;
1571 
1572 	if (unlikely(msg_version(msg) != TIPC_VERSION))
1573 		return 0;
1574 
1575 	size = msg_size(msg);
1576 	hdr_size = msg_hdr_sz(msg);
1577 	min_hdr_size = msg_isdata(msg) ?
1578 		min_data_hdr_size[msg_type(msg)] : INT_H_SIZE;
1579 
1580 	if (unlikely((hdr_size < min_hdr_size) ||
1581 		     (size < hdr_size) ||
1582 		     (buf->len < size) ||
1583 		     (size - hdr_size > TIPC_MAX_USER_MSG_SIZE)))
1584 		return 0;
1585 
1586 	return pskb_may_pull(buf, hdr_size);
1587 }
1588 
1589 /**
1590  * tipc_recv_msg - process TIPC messages arriving from off-node
1591  * @head: pointer to message buffer chain
1592  * @tb_ptr: pointer to bearer message arrived on
1593  *
1594  * Invoked with no locks held.  Bearer pointer must point to a valid bearer
1595  * structure (i.e. cannot be NULL), but bearer can be inactive.
1596  */
1597 void tipc_recv_msg(struct sk_buff *head, struct tipc_bearer *b_ptr)
1598 {
1599 	read_lock_bh(&tipc_net_lock);
1600 	while (head) {
1601 		struct tipc_node *n_ptr;
1602 		struct tipc_link *l_ptr;
1603 		struct sk_buff *crs;
1604 		struct sk_buff *buf = head;
1605 		struct tipc_msg *msg;
1606 		u32 seq_no;
1607 		u32 ackd;
1608 		u32 released = 0;
1609 		int type;
1610 
1611 		head = head->next;
1612 
1613 		/* Ensure bearer is still enabled */
1614 		if (unlikely(!b_ptr->active))
1615 			goto cont;
1616 
1617 		/* Ensure message is well-formed */
1618 		if (unlikely(!link_recv_buf_validate(buf)))
1619 			goto cont;
1620 
1621 		/* Ensure message data is a single contiguous unit */
1622 		if (unlikely(skb_linearize(buf)))
1623 			goto cont;
1624 
1625 		/* Handle arrival of a non-unicast link message */
1626 		msg = buf_msg(buf);
1627 
1628 		if (unlikely(msg_non_seq(msg))) {
1629 			if (msg_user(msg) ==  LINK_CONFIG)
1630 				tipc_disc_recv_msg(buf, b_ptr);
1631 			else
1632 				tipc_bclink_recv_pkt(buf);
1633 			continue;
1634 		}
1635 
1636 		/* Discard unicast link messages destined for another node */
1637 		if (unlikely(!msg_short(msg) &&
1638 			     (msg_destnode(msg) != tipc_own_addr)))
1639 			goto cont;
1640 
1641 		/* Locate neighboring node that sent message */
1642 		n_ptr = tipc_node_find(msg_prevnode(msg));
1643 		if (unlikely(!n_ptr))
1644 			goto cont;
1645 		tipc_node_lock(n_ptr);
1646 
1647 		/* Locate unicast link endpoint that should handle message */
1648 		l_ptr = n_ptr->links[b_ptr->identity];
1649 		if (unlikely(!l_ptr)) {
1650 			tipc_node_unlock(n_ptr);
1651 			goto cont;
1652 		}
1653 
1654 		/* Verify that communication with node is currently allowed */
1655 		if ((n_ptr->block_setup & WAIT_PEER_DOWN) &&
1656 			msg_user(msg) == LINK_PROTOCOL &&
1657 			(msg_type(msg) == RESET_MSG ||
1658 					msg_type(msg) == ACTIVATE_MSG) &&
1659 			!msg_redundant_link(msg))
1660 			n_ptr->block_setup &= ~WAIT_PEER_DOWN;
1661 
1662 		if (n_ptr->block_setup) {
1663 			tipc_node_unlock(n_ptr);
1664 			goto cont;
1665 		}
1666 
1667 		/* Validate message sequence number info */
1668 		seq_no = msg_seqno(msg);
1669 		ackd = msg_ack(msg);
1670 
1671 		/* Release acked messages */
1672 		if (n_ptr->bclink.supported)
1673 			tipc_bclink_acknowledge(n_ptr, msg_bcast_ack(msg));
1674 
1675 		crs = l_ptr->first_out;
1676 		while ((crs != l_ptr->next_out) &&
1677 		       less_eq(buf_seqno(crs), ackd)) {
1678 			struct sk_buff *next = crs->next;
1679 
1680 			kfree_skb(crs);
1681 			crs = next;
1682 			released++;
1683 		}
1684 		if (released) {
1685 			l_ptr->first_out = crs;
1686 			l_ptr->out_queue_size -= released;
1687 		}
1688 
1689 		/* Try sending any messages link endpoint has pending */
1690 		if (unlikely(l_ptr->next_out))
1691 			tipc_link_push_queue(l_ptr);
1692 		if (unlikely(!list_empty(&l_ptr->waiting_ports)))
1693 			tipc_link_wakeup_ports(l_ptr, 0);
1694 		if (unlikely(++l_ptr->unacked_window >= TIPC_MIN_LINK_WIN)) {
1695 			l_ptr->stats.sent_acks++;
1696 			tipc_link_send_proto_msg(l_ptr, STATE_MSG, 0, 0, 0, 0, 0);
1697 		}
1698 
1699 		/* Now (finally!) process the incoming message */
1700 protocol_check:
1701 		if (likely(link_working_working(l_ptr))) {
1702 			if (likely(seq_no == mod(l_ptr->next_in_no))) {
1703 				l_ptr->next_in_no++;
1704 				if (unlikely(l_ptr->oldest_deferred_in))
1705 					head = link_insert_deferred_queue(l_ptr,
1706 									  head);
1707 deliver:
1708 				if (likely(msg_isdata(msg))) {
1709 					tipc_node_unlock(n_ptr);
1710 					tipc_port_recv_msg(buf);
1711 					continue;
1712 				}
1713 				switch (msg_user(msg)) {
1714 					int ret;
1715 				case MSG_BUNDLER:
1716 					l_ptr->stats.recv_bundles++;
1717 					l_ptr->stats.recv_bundled +=
1718 						msg_msgcnt(msg);
1719 					tipc_node_unlock(n_ptr);
1720 					tipc_link_recv_bundle(buf);
1721 					continue;
1722 				case NAME_DISTRIBUTOR:
1723 					tipc_node_unlock(n_ptr);
1724 					tipc_named_recv(buf);
1725 					continue;
1726 				case CONN_MANAGER:
1727 					tipc_node_unlock(n_ptr);
1728 					tipc_port_recv_proto_msg(buf);
1729 					continue;
1730 				case MSG_FRAGMENTER:
1731 					l_ptr->stats.recv_fragments++;
1732 					ret = tipc_link_recv_fragment(
1733 						&l_ptr->defragm_buf,
1734 						&buf, &msg);
1735 					if (ret == 1) {
1736 						l_ptr->stats.recv_fragmented++;
1737 						goto deliver;
1738 					}
1739 					if (ret == -1)
1740 						l_ptr->next_in_no--;
1741 					break;
1742 				case CHANGEOVER_PROTOCOL:
1743 					type = msg_type(msg);
1744 					if (link_recv_changeover_msg(&l_ptr,
1745 								     &buf)) {
1746 						msg = buf_msg(buf);
1747 						seq_no = msg_seqno(msg);
1748 						if (type == ORIGINAL_MSG)
1749 							goto deliver;
1750 						goto protocol_check;
1751 					}
1752 					break;
1753 				default:
1754 					kfree_skb(buf);
1755 					buf = NULL;
1756 					break;
1757 				}
1758 				tipc_node_unlock(n_ptr);
1759 				tipc_net_route_msg(buf);
1760 				continue;
1761 			}
1762 			link_handle_out_of_seq_msg(l_ptr, buf);
1763 			head = link_insert_deferred_queue(l_ptr, head);
1764 			tipc_node_unlock(n_ptr);
1765 			continue;
1766 		}
1767 
1768 		if (msg_user(msg) == LINK_PROTOCOL) {
1769 			link_recv_proto_msg(l_ptr, buf);
1770 			head = link_insert_deferred_queue(l_ptr, head);
1771 			tipc_node_unlock(n_ptr);
1772 			continue;
1773 		}
1774 		link_state_event(l_ptr, TRAFFIC_MSG_EVT);
1775 
1776 		if (link_working_working(l_ptr)) {
1777 			/* Re-insert in front of queue */
1778 			buf->next = head;
1779 			head = buf;
1780 			tipc_node_unlock(n_ptr);
1781 			continue;
1782 		}
1783 		tipc_node_unlock(n_ptr);
1784 cont:
1785 		kfree_skb(buf);
1786 	}
1787 	read_unlock_bh(&tipc_net_lock);
1788 }
1789 
1790 /*
1791  * tipc_link_defer_pkt - Add out-of-sequence message to deferred reception queue
1792  *
1793  * Returns increase in queue length (i.e. 0 or 1)
1794  */
1795 u32 tipc_link_defer_pkt(struct sk_buff **head, struct sk_buff **tail,
1796 			struct sk_buff *buf)
1797 {
1798 	struct sk_buff *queue_buf;
1799 	struct sk_buff **prev;
1800 	u32 seq_no = buf_seqno(buf);
1801 
1802 	buf->next = NULL;
1803 
1804 	/* Empty queue ? */
1805 	if (*head == NULL) {
1806 		*head = *tail = buf;
1807 		return 1;
1808 	}
1809 
1810 	/* Last ? */
1811 	if (less(buf_seqno(*tail), seq_no)) {
1812 		(*tail)->next = buf;
1813 		*tail = buf;
1814 		return 1;
1815 	}
1816 
1817 	/* Locate insertion point in queue, then insert; discard if duplicate */
1818 	prev = head;
1819 	queue_buf = *head;
1820 	for (;;) {
1821 		u32 curr_seqno = buf_seqno(queue_buf);
1822 
1823 		if (seq_no == curr_seqno) {
1824 			kfree_skb(buf);
1825 			return 0;
1826 		}
1827 
1828 		if (less(seq_no, curr_seqno))
1829 			break;
1830 
1831 		prev = &queue_buf->next;
1832 		queue_buf = queue_buf->next;
1833 	}
1834 
1835 	buf->next = queue_buf;
1836 	*prev = buf;
1837 	return 1;
1838 }
1839 
1840 /*
1841  * link_handle_out_of_seq_msg - handle arrival of out-of-sequence packet
1842  */
1843 static void link_handle_out_of_seq_msg(struct tipc_link *l_ptr,
1844 				       struct sk_buff *buf)
1845 {
1846 	u32 seq_no = buf_seqno(buf);
1847 
1848 	if (likely(msg_user(buf_msg(buf)) == LINK_PROTOCOL)) {
1849 		link_recv_proto_msg(l_ptr, buf);
1850 		return;
1851 	}
1852 
1853 	/* Record OOS packet arrival (force mismatch on next timeout) */
1854 	l_ptr->checkpoint--;
1855 
1856 	/*
1857 	 * Discard packet if a duplicate; otherwise add it to deferred queue
1858 	 * and notify peer of gap as per protocol specification
1859 	 */
1860 	if (less(seq_no, mod(l_ptr->next_in_no))) {
1861 		l_ptr->stats.duplicates++;
1862 		kfree_skb(buf);
1863 		return;
1864 	}
1865 
1866 	if (tipc_link_defer_pkt(&l_ptr->oldest_deferred_in,
1867 				&l_ptr->newest_deferred_in, buf)) {
1868 		l_ptr->deferred_inqueue_sz++;
1869 		l_ptr->stats.deferred_recv++;
1870 		if ((l_ptr->deferred_inqueue_sz % 16) == 1)
1871 			tipc_link_send_proto_msg(l_ptr, STATE_MSG, 0, 0, 0, 0, 0);
1872 	} else
1873 		l_ptr->stats.duplicates++;
1874 }
1875 
1876 /*
1877  * Send protocol message to the other endpoint.
1878  */
1879 void tipc_link_send_proto_msg(struct tipc_link *l_ptr, u32 msg_typ,
1880 				int probe_msg, u32 gap, u32 tolerance,
1881 				u32 priority, u32 ack_mtu)
1882 {
1883 	struct sk_buff *buf = NULL;
1884 	struct tipc_msg *msg = l_ptr->pmsg;
1885 	u32 msg_size = sizeof(l_ptr->proto_msg);
1886 	int r_flag;
1887 
1888 	/* Discard any previous message that was deferred due to congestion */
1889 	if (l_ptr->proto_msg_queue) {
1890 		kfree_skb(l_ptr->proto_msg_queue);
1891 		l_ptr->proto_msg_queue = NULL;
1892 	}
1893 
1894 	if (link_blocked(l_ptr))
1895 		return;
1896 
1897 	/* Abort non-RESET send if communication with node is prohibited */
1898 	if ((l_ptr->owner->block_setup) && (msg_typ != RESET_MSG))
1899 		return;
1900 
1901 	/* Create protocol message with "out-of-sequence" sequence number */
1902 	msg_set_type(msg, msg_typ);
1903 	msg_set_net_plane(msg, l_ptr->b_ptr->net_plane);
1904 	msg_set_bcast_ack(msg, l_ptr->owner->bclink.last_in);
1905 	msg_set_last_bcast(msg, tipc_bclink_get_last_sent());
1906 
1907 	if (msg_typ == STATE_MSG) {
1908 		u32 next_sent = mod(l_ptr->next_out_no);
1909 
1910 		if (!tipc_link_is_up(l_ptr))
1911 			return;
1912 		if (l_ptr->next_out)
1913 			next_sent = buf_seqno(l_ptr->next_out);
1914 		msg_set_next_sent(msg, next_sent);
1915 		if (l_ptr->oldest_deferred_in) {
1916 			u32 rec = buf_seqno(l_ptr->oldest_deferred_in);
1917 			gap = mod(rec - mod(l_ptr->next_in_no));
1918 		}
1919 		msg_set_seq_gap(msg, gap);
1920 		if (gap)
1921 			l_ptr->stats.sent_nacks++;
1922 		msg_set_link_tolerance(msg, tolerance);
1923 		msg_set_linkprio(msg, priority);
1924 		msg_set_max_pkt(msg, ack_mtu);
1925 		msg_set_ack(msg, mod(l_ptr->next_in_no - 1));
1926 		msg_set_probe(msg, probe_msg != 0);
1927 		if (probe_msg) {
1928 			u32 mtu = l_ptr->max_pkt;
1929 
1930 			if ((mtu < l_ptr->max_pkt_target) &&
1931 			    link_working_working(l_ptr) &&
1932 			    l_ptr->fsm_msg_cnt) {
1933 				msg_size = (mtu + (l_ptr->max_pkt_target - mtu)/2 + 2) & ~3;
1934 				if (l_ptr->max_pkt_probes == 10) {
1935 					l_ptr->max_pkt_target = (msg_size - 4);
1936 					l_ptr->max_pkt_probes = 0;
1937 					msg_size = (mtu + (l_ptr->max_pkt_target - mtu)/2 + 2) & ~3;
1938 				}
1939 				l_ptr->max_pkt_probes++;
1940 			}
1941 
1942 			l_ptr->stats.sent_probes++;
1943 		}
1944 		l_ptr->stats.sent_states++;
1945 	} else {		/* RESET_MSG or ACTIVATE_MSG */
1946 		msg_set_ack(msg, mod(l_ptr->reset_checkpoint - 1));
1947 		msg_set_seq_gap(msg, 0);
1948 		msg_set_next_sent(msg, 1);
1949 		msg_set_probe(msg, 0);
1950 		msg_set_link_tolerance(msg, l_ptr->tolerance);
1951 		msg_set_linkprio(msg, l_ptr->priority);
1952 		msg_set_max_pkt(msg, l_ptr->max_pkt_target);
1953 	}
1954 
1955 	r_flag = (l_ptr->owner->working_links > tipc_link_is_up(l_ptr));
1956 	msg_set_redundant_link(msg, r_flag);
1957 	msg_set_linkprio(msg, l_ptr->priority);
1958 	msg_set_size(msg, msg_size);
1959 
1960 	msg_set_seqno(msg, mod(l_ptr->next_out_no + (0xffff/2)));
1961 
1962 	buf = tipc_buf_acquire(msg_size);
1963 	if (!buf)
1964 		return;
1965 
1966 	skb_copy_to_linear_data(buf, msg, sizeof(l_ptr->proto_msg));
1967 
1968 	/* Defer message if bearer is already congested */
1969 	if (tipc_bearer_congested(l_ptr->b_ptr, l_ptr)) {
1970 		l_ptr->proto_msg_queue = buf;
1971 		return;
1972 	}
1973 
1974 	/* Defer message if attempting to send results in bearer congestion */
1975 	if (!tipc_bearer_send(l_ptr->b_ptr, buf, &l_ptr->media_addr)) {
1976 		tipc_bearer_schedule(l_ptr->b_ptr, l_ptr);
1977 		l_ptr->proto_msg_queue = buf;
1978 		l_ptr->stats.bearer_congs++;
1979 		return;
1980 	}
1981 
1982 	/* Discard message if it was sent successfully */
1983 	l_ptr->unacked_window = 0;
1984 	kfree_skb(buf);
1985 }
1986 
1987 /*
1988  * Receive protocol message :
1989  * Note that network plane id propagates through the network, and may
1990  * change at any time. The node with lowest address rules
1991  */
1992 static void link_recv_proto_msg(struct tipc_link *l_ptr, struct sk_buff *buf)
1993 {
1994 	u32 rec_gap = 0;
1995 	u32 max_pkt_info;
1996 	u32 max_pkt_ack;
1997 	u32 msg_tol;
1998 	struct tipc_msg *msg = buf_msg(buf);
1999 
2000 	if (link_blocked(l_ptr))
2001 		goto exit;
2002 
2003 	/* record unnumbered packet arrival (force mismatch on next timeout) */
2004 	l_ptr->checkpoint--;
2005 
2006 	if (l_ptr->b_ptr->net_plane != msg_net_plane(msg))
2007 		if (tipc_own_addr > msg_prevnode(msg))
2008 			l_ptr->b_ptr->net_plane = msg_net_plane(msg);
2009 
2010 	l_ptr->owner->permit_changeover = msg_redundant_link(msg);
2011 
2012 	switch (msg_type(msg)) {
2013 
2014 	case RESET_MSG:
2015 		if (!link_working_unknown(l_ptr) &&
2016 		    (l_ptr->peer_session != INVALID_SESSION)) {
2017 			if (less_eq(msg_session(msg), l_ptr->peer_session))
2018 				break; /* duplicate or old reset: ignore */
2019 		}
2020 
2021 		if (!msg_redundant_link(msg) && (link_working_working(l_ptr) ||
2022 				link_working_unknown(l_ptr))) {
2023 			/*
2024 			 * peer has lost contact -- don't allow peer's links
2025 			 * to reactivate before we recognize loss & clean up
2026 			 */
2027 			l_ptr->owner->block_setup = WAIT_NODE_DOWN;
2028 		}
2029 
2030 		link_state_event(l_ptr, RESET_MSG);
2031 
2032 		/* fall thru' */
2033 	case ACTIVATE_MSG:
2034 		/* Update link settings according other endpoint's values */
2035 		strcpy((strrchr(l_ptr->name, ':') + 1), (char *)msg_data(msg));
2036 
2037 		msg_tol = msg_link_tolerance(msg);
2038 		if (msg_tol > l_ptr->tolerance)
2039 			link_set_supervision_props(l_ptr, msg_tol);
2040 
2041 		if (msg_linkprio(msg) > l_ptr->priority)
2042 			l_ptr->priority = msg_linkprio(msg);
2043 
2044 		max_pkt_info = msg_max_pkt(msg);
2045 		if (max_pkt_info) {
2046 			if (max_pkt_info < l_ptr->max_pkt_target)
2047 				l_ptr->max_pkt_target = max_pkt_info;
2048 			if (l_ptr->max_pkt > l_ptr->max_pkt_target)
2049 				l_ptr->max_pkt = l_ptr->max_pkt_target;
2050 		} else {
2051 			l_ptr->max_pkt = l_ptr->max_pkt_target;
2052 		}
2053 		l_ptr->owner->bclink.supportable = (max_pkt_info != 0);
2054 
2055 		/* Synchronize broadcast link info, if not done previously */
2056 		if (!tipc_node_is_up(l_ptr->owner)) {
2057 			l_ptr->owner->bclink.last_sent =
2058 				l_ptr->owner->bclink.last_in =
2059 				msg_last_bcast(msg);
2060 			l_ptr->owner->bclink.oos_state = 0;
2061 		}
2062 
2063 		l_ptr->peer_session = msg_session(msg);
2064 		l_ptr->peer_bearer_id = msg_bearer_id(msg);
2065 
2066 		if (msg_type(msg) == ACTIVATE_MSG)
2067 			link_state_event(l_ptr, ACTIVATE_MSG);
2068 		break;
2069 	case STATE_MSG:
2070 
2071 		msg_tol = msg_link_tolerance(msg);
2072 		if (msg_tol)
2073 			link_set_supervision_props(l_ptr, msg_tol);
2074 
2075 		if (msg_linkprio(msg) &&
2076 		    (msg_linkprio(msg) != l_ptr->priority)) {
2077 			warn("Resetting link <%s>, priority change %u->%u\n",
2078 			     l_ptr->name, l_ptr->priority, msg_linkprio(msg));
2079 			l_ptr->priority = msg_linkprio(msg);
2080 			tipc_link_reset(l_ptr); /* Enforce change to take effect */
2081 			break;
2082 		}
2083 		link_state_event(l_ptr, TRAFFIC_MSG_EVT);
2084 		l_ptr->stats.recv_states++;
2085 		if (link_reset_unknown(l_ptr))
2086 			break;
2087 
2088 		if (less_eq(mod(l_ptr->next_in_no), msg_next_sent(msg))) {
2089 			rec_gap = mod(msg_next_sent(msg) -
2090 				      mod(l_ptr->next_in_no));
2091 		}
2092 
2093 		max_pkt_ack = msg_max_pkt(msg);
2094 		if (max_pkt_ack > l_ptr->max_pkt) {
2095 			l_ptr->max_pkt = max_pkt_ack;
2096 			l_ptr->max_pkt_probes = 0;
2097 		}
2098 
2099 		max_pkt_ack = 0;
2100 		if (msg_probe(msg)) {
2101 			l_ptr->stats.recv_probes++;
2102 			if (msg_size(msg) > sizeof(l_ptr->proto_msg))
2103 				max_pkt_ack = msg_size(msg);
2104 		}
2105 
2106 		/* Protocol message before retransmits, reduce loss risk */
2107 		if (l_ptr->owner->bclink.supported)
2108 			tipc_bclink_update_link_state(l_ptr->owner,
2109 						      msg_last_bcast(msg));
2110 
2111 		if (rec_gap || (msg_probe(msg))) {
2112 			tipc_link_send_proto_msg(l_ptr, STATE_MSG,
2113 						 0, rec_gap, 0, 0, max_pkt_ack);
2114 		}
2115 		if (msg_seq_gap(msg)) {
2116 			l_ptr->stats.recv_nacks++;
2117 			tipc_link_retransmit(l_ptr, l_ptr->first_out,
2118 					     msg_seq_gap(msg));
2119 		}
2120 		break;
2121 	}
2122 exit:
2123 	kfree_skb(buf);
2124 }
2125 
2126 
2127 /*
2128  * tipc_link_tunnel(): Send one message via a link belonging to
2129  * another bearer. Owner node is locked.
2130  */
2131 static void tipc_link_tunnel(struct tipc_link *l_ptr,
2132 			     struct tipc_msg *tunnel_hdr,
2133 			     struct tipc_msg  *msg,
2134 			     u32 selector)
2135 {
2136 	struct tipc_link *tunnel;
2137 	struct sk_buff *buf;
2138 	u32 length = msg_size(msg);
2139 
2140 	tunnel = l_ptr->owner->active_links[selector & 1];
2141 	if (!tipc_link_is_up(tunnel)) {
2142 		warn("Link changeover error, "
2143 		     "tunnel link no longer available\n");
2144 		return;
2145 	}
2146 	msg_set_size(tunnel_hdr, length + INT_H_SIZE);
2147 	buf = tipc_buf_acquire(length + INT_H_SIZE);
2148 	if (!buf) {
2149 		warn("Link changeover error, "
2150 		     "unable to send tunnel msg\n");
2151 		return;
2152 	}
2153 	skb_copy_to_linear_data(buf, tunnel_hdr, INT_H_SIZE);
2154 	skb_copy_to_linear_data_offset(buf, INT_H_SIZE, msg, length);
2155 	tipc_link_send_buf(tunnel, buf);
2156 }
2157 
2158 
2159 
2160 /*
2161  * changeover(): Send whole message queue via the remaining link
2162  *               Owner node is locked.
2163  */
2164 void tipc_link_changeover(struct tipc_link *l_ptr)
2165 {
2166 	u32 msgcount = l_ptr->out_queue_size;
2167 	struct sk_buff *crs = l_ptr->first_out;
2168 	struct tipc_link *tunnel = l_ptr->owner->active_links[0];
2169 	struct tipc_msg tunnel_hdr;
2170 	int split_bundles;
2171 
2172 	if (!tunnel)
2173 		return;
2174 
2175 	if (!l_ptr->owner->permit_changeover) {
2176 		warn("Link changeover error, "
2177 		     "peer did not permit changeover\n");
2178 		return;
2179 	}
2180 
2181 	tipc_msg_init(&tunnel_hdr, CHANGEOVER_PROTOCOL,
2182 		 ORIGINAL_MSG, INT_H_SIZE, l_ptr->addr);
2183 	msg_set_bearer_id(&tunnel_hdr, l_ptr->peer_bearer_id);
2184 	msg_set_msgcnt(&tunnel_hdr, msgcount);
2185 
2186 	if (!l_ptr->first_out) {
2187 		struct sk_buff *buf;
2188 
2189 		buf = tipc_buf_acquire(INT_H_SIZE);
2190 		if (buf) {
2191 			skb_copy_to_linear_data(buf, &tunnel_hdr, INT_H_SIZE);
2192 			msg_set_size(&tunnel_hdr, INT_H_SIZE);
2193 			tipc_link_send_buf(tunnel, buf);
2194 		} else {
2195 			warn("Link changeover error, "
2196 			     "unable to send changeover msg\n");
2197 		}
2198 		return;
2199 	}
2200 
2201 	split_bundles = (l_ptr->owner->active_links[0] !=
2202 			 l_ptr->owner->active_links[1]);
2203 
2204 	while (crs) {
2205 		struct tipc_msg *msg = buf_msg(crs);
2206 
2207 		if ((msg_user(msg) == MSG_BUNDLER) && split_bundles) {
2208 			struct tipc_msg *m = msg_get_wrapped(msg);
2209 			unchar *pos = (unchar *)m;
2210 
2211 			msgcount = msg_msgcnt(msg);
2212 			while (msgcount--) {
2213 				msg_set_seqno(m, msg_seqno(msg));
2214 				tipc_link_tunnel(l_ptr, &tunnel_hdr, m,
2215 						 msg_link_selector(m));
2216 				pos += align(msg_size(m));
2217 				m = (struct tipc_msg *)pos;
2218 			}
2219 		} else {
2220 			tipc_link_tunnel(l_ptr, &tunnel_hdr, msg,
2221 					 msg_link_selector(msg));
2222 		}
2223 		crs = crs->next;
2224 	}
2225 }
2226 
2227 void tipc_link_send_duplicate(struct tipc_link *l_ptr, struct tipc_link *tunnel)
2228 {
2229 	struct sk_buff *iter;
2230 	struct tipc_msg tunnel_hdr;
2231 
2232 	tipc_msg_init(&tunnel_hdr, CHANGEOVER_PROTOCOL,
2233 		 DUPLICATE_MSG, INT_H_SIZE, l_ptr->addr);
2234 	msg_set_msgcnt(&tunnel_hdr, l_ptr->out_queue_size);
2235 	msg_set_bearer_id(&tunnel_hdr, l_ptr->peer_bearer_id);
2236 	iter = l_ptr->first_out;
2237 	while (iter) {
2238 		struct sk_buff *outbuf;
2239 		struct tipc_msg *msg = buf_msg(iter);
2240 		u32 length = msg_size(msg);
2241 
2242 		if (msg_user(msg) == MSG_BUNDLER)
2243 			msg_set_type(msg, CLOSED_MSG);
2244 		msg_set_ack(msg, mod(l_ptr->next_in_no - 1));	/* Update */
2245 		msg_set_bcast_ack(msg, l_ptr->owner->bclink.last_in);
2246 		msg_set_size(&tunnel_hdr, length + INT_H_SIZE);
2247 		outbuf = tipc_buf_acquire(length + INT_H_SIZE);
2248 		if (outbuf == NULL) {
2249 			warn("Link changeover error, "
2250 			     "unable to send duplicate msg\n");
2251 			return;
2252 		}
2253 		skb_copy_to_linear_data(outbuf, &tunnel_hdr, INT_H_SIZE);
2254 		skb_copy_to_linear_data_offset(outbuf, INT_H_SIZE, iter->data,
2255 					       length);
2256 		tipc_link_send_buf(tunnel, outbuf);
2257 		if (!tipc_link_is_up(l_ptr))
2258 			return;
2259 		iter = iter->next;
2260 	}
2261 }
2262 
2263 /**
2264  * buf_extract - extracts embedded TIPC message from another message
2265  * @skb: encapsulating message buffer
2266  * @from_pos: offset to extract from
2267  *
2268  * Returns a new message buffer containing an embedded message.  The
2269  * encapsulating message itself is left unchanged.
2270  */
2271 static struct sk_buff *buf_extract(struct sk_buff *skb, u32 from_pos)
2272 {
2273 	struct tipc_msg *msg = (struct tipc_msg *)(skb->data + from_pos);
2274 	u32 size = msg_size(msg);
2275 	struct sk_buff *eb;
2276 
2277 	eb = tipc_buf_acquire(size);
2278 	if (eb)
2279 		skb_copy_to_linear_data(eb, msg, size);
2280 	return eb;
2281 }
2282 
2283 /*
2284  *  link_recv_changeover_msg(): Receive tunneled packet sent
2285  *  via other link. Node is locked. Return extracted buffer.
2286  */
2287 static int link_recv_changeover_msg(struct tipc_link **l_ptr,
2288 				    struct sk_buff **buf)
2289 {
2290 	struct sk_buff *tunnel_buf = *buf;
2291 	struct tipc_link *dest_link;
2292 	struct tipc_msg *msg;
2293 	struct tipc_msg *tunnel_msg = buf_msg(tunnel_buf);
2294 	u32 msg_typ = msg_type(tunnel_msg);
2295 	u32 msg_count = msg_msgcnt(tunnel_msg);
2296 
2297 	dest_link = (*l_ptr)->owner->links[msg_bearer_id(tunnel_msg)];
2298 	if (!dest_link)
2299 		goto exit;
2300 	if (dest_link == *l_ptr) {
2301 		err("Unexpected changeover message on link <%s>\n",
2302 		    (*l_ptr)->name);
2303 		goto exit;
2304 	}
2305 	*l_ptr = dest_link;
2306 	msg = msg_get_wrapped(tunnel_msg);
2307 
2308 	if (msg_typ == DUPLICATE_MSG) {
2309 		if (less(msg_seqno(msg), mod(dest_link->next_in_no)))
2310 			goto exit;
2311 		*buf = buf_extract(tunnel_buf, INT_H_SIZE);
2312 		if (*buf == NULL) {
2313 			warn("Link changeover error, duplicate msg dropped\n");
2314 			goto exit;
2315 		}
2316 		kfree_skb(tunnel_buf);
2317 		return 1;
2318 	}
2319 
2320 	/* First original message ?: */
2321 	if (tipc_link_is_up(dest_link)) {
2322 		info("Resetting link <%s>, changeover initiated by peer\n",
2323 		     dest_link->name);
2324 		tipc_link_reset(dest_link);
2325 		dest_link->exp_msg_count = msg_count;
2326 		if (!msg_count)
2327 			goto exit;
2328 	} else if (dest_link->exp_msg_count == START_CHANGEOVER) {
2329 		dest_link->exp_msg_count = msg_count;
2330 		if (!msg_count)
2331 			goto exit;
2332 	}
2333 
2334 	/* Receive original message */
2335 	if (dest_link->exp_msg_count == 0) {
2336 		warn("Link switchover error, "
2337 		     "got too many tunnelled messages\n");
2338 		goto exit;
2339 	}
2340 	dest_link->exp_msg_count--;
2341 	if (less(msg_seqno(msg), dest_link->reset_checkpoint)) {
2342 		goto exit;
2343 	} else {
2344 		*buf = buf_extract(tunnel_buf, INT_H_SIZE);
2345 		if (*buf != NULL) {
2346 			kfree_skb(tunnel_buf);
2347 			return 1;
2348 		} else {
2349 			warn("Link changeover error, original msg dropped\n");
2350 		}
2351 	}
2352 exit:
2353 	*buf = NULL;
2354 	kfree_skb(tunnel_buf);
2355 	return 0;
2356 }
2357 
2358 /*
2359  *  Bundler functionality:
2360  */
2361 void tipc_link_recv_bundle(struct sk_buff *buf)
2362 {
2363 	u32 msgcount = msg_msgcnt(buf_msg(buf));
2364 	u32 pos = INT_H_SIZE;
2365 	struct sk_buff *obuf;
2366 
2367 	while (msgcount--) {
2368 		obuf = buf_extract(buf, pos);
2369 		if (obuf == NULL) {
2370 			warn("Link unable to unbundle message(s)\n");
2371 			break;
2372 		}
2373 		pos += align(msg_size(buf_msg(obuf)));
2374 		tipc_net_route_msg(obuf);
2375 	}
2376 	kfree_skb(buf);
2377 }
2378 
2379 /*
2380  *  Fragmentation/defragmentation:
2381  */
2382 
2383 /*
2384  * link_send_long_buf: Entry for buffers needing fragmentation.
2385  * The buffer is complete, inclusive total message length.
2386  * Returns user data length.
2387  */
2388 static int link_send_long_buf(struct tipc_link *l_ptr, struct sk_buff *buf)
2389 {
2390 	struct sk_buff *buf_chain = NULL;
2391 	struct sk_buff *buf_chain_tail = (struct sk_buff *)&buf_chain;
2392 	struct tipc_msg *inmsg = buf_msg(buf);
2393 	struct tipc_msg fragm_hdr;
2394 	u32 insize = msg_size(inmsg);
2395 	u32 dsz = msg_data_sz(inmsg);
2396 	unchar *crs = buf->data;
2397 	u32 rest = insize;
2398 	u32 pack_sz = l_ptr->max_pkt;
2399 	u32 fragm_sz = pack_sz - INT_H_SIZE;
2400 	u32 fragm_no = 0;
2401 	u32 destaddr;
2402 
2403 	if (msg_short(inmsg))
2404 		destaddr = l_ptr->addr;
2405 	else
2406 		destaddr = msg_destnode(inmsg);
2407 
2408 	/* Prepare reusable fragment header: */
2409 	tipc_msg_init(&fragm_hdr, MSG_FRAGMENTER, FIRST_FRAGMENT,
2410 		 INT_H_SIZE, destaddr);
2411 
2412 	/* Chop up message: */
2413 	while (rest > 0) {
2414 		struct sk_buff *fragm;
2415 
2416 		if (rest <= fragm_sz) {
2417 			fragm_sz = rest;
2418 			msg_set_type(&fragm_hdr, LAST_FRAGMENT);
2419 		}
2420 		fragm = tipc_buf_acquire(fragm_sz + INT_H_SIZE);
2421 		if (fragm == NULL) {
2422 			kfree_skb(buf);
2423 			while (buf_chain) {
2424 				buf = buf_chain;
2425 				buf_chain = buf_chain->next;
2426 				kfree_skb(buf);
2427 			}
2428 			return -ENOMEM;
2429 		}
2430 		msg_set_size(&fragm_hdr, fragm_sz + INT_H_SIZE);
2431 		fragm_no++;
2432 		msg_set_fragm_no(&fragm_hdr, fragm_no);
2433 		skb_copy_to_linear_data(fragm, &fragm_hdr, INT_H_SIZE);
2434 		skb_copy_to_linear_data_offset(fragm, INT_H_SIZE, crs,
2435 					       fragm_sz);
2436 		buf_chain_tail->next = fragm;
2437 		buf_chain_tail = fragm;
2438 
2439 		rest -= fragm_sz;
2440 		crs += fragm_sz;
2441 		msg_set_type(&fragm_hdr, FRAGMENT);
2442 	}
2443 	kfree_skb(buf);
2444 
2445 	/* Append chain of fragments to send queue & send them */
2446 	l_ptr->long_msg_seq_no++;
2447 	link_add_chain_to_outqueue(l_ptr, buf_chain, l_ptr->long_msg_seq_no);
2448 	l_ptr->stats.sent_fragments += fragm_no;
2449 	l_ptr->stats.sent_fragmented++;
2450 	tipc_link_push_queue(l_ptr);
2451 
2452 	return dsz;
2453 }
2454 
2455 /*
2456  * A pending message being re-assembled must store certain values
2457  * to handle subsequent fragments correctly. The following functions
2458  * help storing these values in unused, available fields in the
2459  * pending message. This makes dynamic memory allocation unnecessary.
2460  */
2461 static void set_long_msg_seqno(struct sk_buff *buf, u32 seqno)
2462 {
2463 	msg_set_seqno(buf_msg(buf), seqno);
2464 }
2465 
2466 static u32 get_fragm_size(struct sk_buff *buf)
2467 {
2468 	return msg_ack(buf_msg(buf));
2469 }
2470 
2471 static void set_fragm_size(struct sk_buff *buf, u32 sz)
2472 {
2473 	msg_set_ack(buf_msg(buf), sz);
2474 }
2475 
2476 static u32 get_expected_frags(struct sk_buff *buf)
2477 {
2478 	return msg_bcast_ack(buf_msg(buf));
2479 }
2480 
2481 static void set_expected_frags(struct sk_buff *buf, u32 exp)
2482 {
2483 	msg_set_bcast_ack(buf_msg(buf), exp);
2484 }
2485 
2486 static u32 get_timer_cnt(struct sk_buff *buf)
2487 {
2488 	return msg_reroute_cnt(buf_msg(buf));
2489 }
2490 
2491 static void incr_timer_cnt(struct sk_buff *buf)
2492 {
2493 	msg_incr_reroute_cnt(buf_msg(buf));
2494 }
2495 
2496 /*
2497  * tipc_link_recv_fragment(): Called with node lock on. Returns
2498  * the reassembled buffer if message is complete.
2499  */
2500 int tipc_link_recv_fragment(struct sk_buff **pending, struct sk_buff **fb,
2501 			    struct tipc_msg **m)
2502 {
2503 	struct sk_buff *prev = NULL;
2504 	struct sk_buff *fbuf = *fb;
2505 	struct tipc_msg *fragm = buf_msg(fbuf);
2506 	struct sk_buff *pbuf = *pending;
2507 	u32 long_msg_seq_no = msg_long_msgno(fragm);
2508 
2509 	*fb = NULL;
2510 
2511 	/* Is there an incomplete message waiting for this fragment? */
2512 	while (pbuf && ((buf_seqno(pbuf) != long_msg_seq_no) ||
2513 			(msg_orignode(fragm) != msg_orignode(buf_msg(pbuf))))) {
2514 		prev = pbuf;
2515 		pbuf = pbuf->next;
2516 	}
2517 
2518 	if (!pbuf && (msg_type(fragm) == FIRST_FRAGMENT)) {
2519 		struct tipc_msg *imsg = (struct tipc_msg *)msg_data(fragm);
2520 		u32 msg_sz = msg_size(imsg);
2521 		u32 fragm_sz = msg_data_sz(fragm);
2522 		u32 exp_fragm_cnt = msg_sz/fragm_sz + !!(msg_sz % fragm_sz);
2523 		u32 max =  TIPC_MAX_USER_MSG_SIZE + NAMED_H_SIZE;
2524 		if (msg_type(imsg) == TIPC_MCAST_MSG)
2525 			max = TIPC_MAX_USER_MSG_SIZE + MCAST_H_SIZE;
2526 		if (msg_size(imsg) > max) {
2527 			kfree_skb(fbuf);
2528 			return 0;
2529 		}
2530 		pbuf = tipc_buf_acquire(msg_size(imsg));
2531 		if (pbuf != NULL) {
2532 			pbuf->next = *pending;
2533 			*pending = pbuf;
2534 			skb_copy_to_linear_data(pbuf, imsg,
2535 						msg_data_sz(fragm));
2536 			/*  Prepare buffer for subsequent fragments. */
2537 			set_long_msg_seqno(pbuf, long_msg_seq_no);
2538 			set_fragm_size(pbuf, fragm_sz);
2539 			set_expected_frags(pbuf, exp_fragm_cnt - 1);
2540 		} else {
2541 			dbg("Link unable to reassemble fragmented message\n");
2542 			kfree_skb(fbuf);
2543 			return -1;
2544 		}
2545 		kfree_skb(fbuf);
2546 		return 0;
2547 	} else if (pbuf && (msg_type(fragm) != FIRST_FRAGMENT)) {
2548 		u32 dsz = msg_data_sz(fragm);
2549 		u32 fsz = get_fragm_size(pbuf);
2550 		u32 crs = ((msg_fragm_no(fragm) - 1) * fsz);
2551 		u32 exp_frags = get_expected_frags(pbuf) - 1;
2552 		skb_copy_to_linear_data_offset(pbuf, crs,
2553 					       msg_data(fragm), dsz);
2554 		kfree_skb(fbuf);
2555 
2556 		/* Is message complete? */
2557 		if (exp_frags == 0) {
2558 			if (prev)
2559 				prev->next = pbuf->next;
2560 			else
2561 				*pending = pbuf->next;
2562 			msg_reset_reroute_cnt(buf_msg(pbuf));
2563 			*fb = pbuf;
2564 			*m = buf_msg(pbuf);
2565 			return 1;
2566 		}
2567 		set_expected_frags(pbuf, exp_frags);
2568 		return 0;
2569 	}
2570 	kfree_skb(fbuf);
2571 	return 0;
2572 }
2573 
2574 /**
2575  * link_check_defragm_bufs - flush stale incoming message fragments
2576  * @l_ptr: pointer to link
2577  */
2578 static void link_check_defragm_bufs(struct tipc_link *l_ptr)
2579 {
2580 	struct sk_buff *prev = NULL;
2581 	struct sk_buff *next = NULL;
2582 	struct sk_buff *buf = l_ptr->defragm_buf;
2583 
2584 	if (!buf)
2585 		return;
2586 	if (!link_working_working(l_ptr))
2587 		return;
2588 	while (buf) {
2589 		u32 cnt = get_timer_cnt(buf);
2590 
2591 		next = buf->next;
2592 		if (cnt < 4) {
2593 			incr_timer_cnt(buf);
2594 			prev = buf;
2595 		} else {
2596 			if (prev)
2597 				prev->next = buf->next;
2598 			else
2599 				l_ptr->defragm_buf = buf->next;
2600 			kfree_skb(buf);
2601 		}
2602 		buf = next;
2603 	}
2604 }
2605 
2606 static void link_set_supervision_props(struct tipc_link *l_ptr, u32 tolerance)
2607 {
2608 	if ((tolerance < TIPC_MIN_LINK_TOL) || (tolerance > TIPC_MAX_LINK_TOL))
2609 		return;
2610 
2611 	l_ptr->tolerance = tolerance;
2612 	l_ptr->continuity_interval =
2613 		((tolerance / 4) > 500) ? 500 : tolerance / 4;
2614 	l_ptr->abort_limit = tolerance / (l_ptr->continuity_interval / 4);
2615 }
2616 
2617 void tipc_link_set_queue_limits(struct tipc_link *l_ptr, u32 window)
2618 {
2619 	/* Data messages from this node, inclusive FIRST_FRAGM */
2620 	l_ptr->queue_limit[TIPC_LOW_IMPORTANCE] = window;
2621 	l_ptr->queue_limit[TIPC_MEDIUM_IMPORTANCE] = (window / 3) * 4;
2622 	l_ptr->queue_limit[TIPC_HIGH_IMPORTANCE] = (window / 3) * 5;
2623 	l_ptr->queue_limit[TIPC_CRITICAL_IMPORTANCE] = (window / 3) * 6;
2624 	/* Transiting data messages,inclusive FIRST_FRAGM */
2625 	l_ptr->queue_limit[TIPC_LOW_IMPORTANCE + 4] = 300;
2626 	l_ptr->queue_limit[TIPC_MEDIUM_IMPORTANCE + 4] = 600;
2627 	l_ptr->queue_limit[TIPC_HIGH_IMPORTANCE + 4] = 900;
2628 	l_ptr->queue_limit[TIPC_CRITICAL_IMPORTANCE + 4] = 1200;
2629 	l_ptr->queue_limit[CONN_MANAGER] = 1200;
2630 	l_ptr->queue_limit[CHANGEOVER_PROTOCOL] = 2500;
2631 	l_ptr->queue_limit[NAME_DISTRIBUTOR] = 3000;
2632 	/* FRAGMENT and LAST_FRAGMENT packets */
2633 	l_ptr->queue_limit[MSG_FRAGMENTER] = 4000;
2634 }
2635 
2636 /**
2637  * link_find_link - locate link by name
2638  * @name - ptr to link name string
2639  * @node - ptr to area to be filled with ptr to associated node
2640  *
2641  * Caller must hold 'tipc_net_lock' to ensure node and bearer are not deleted;
2642  * this also prevents link deletion.
2643  *
2644  * Returns pointer to link (or 0 if invalid link name).
2645  */
2646 static struct tipc_link *link_find_link(const char *name,
2647 					struct tipc_node **node)
2648 {
2649 	struct tipc_link_name link_name_parts;
2650 	struct tipc_bearer *b_ptr;
2651 	struct tipc_link *l_ptr;
2652 
2653 	if (!link_name_validate(name, &link_name_parts))
2654 		return NULL;
2655 
2656 	b_ptr = tipc_bearer_find_interface(link_name_parts.if_local);
2657 	if (!b_ptr)
2658 		return NULL;
2659 
2660 	*node = tipc_node_find(link_name_parts.addr_peer);
2661 	if (!*node)
2662 		return NULL;
2663 
2664 	l_ptr = (*node)->links[b_ptr->identity];
2665 	if (!l_ptr || strcmp(l_ptr->name, name))
2666 		return NULL;
2667 
2668 	return l_ptr;
2669 }
2670 
2671 /**
2672  * link_value_is_valid -- validate proposed link tolerance/priority/window
2673  *
2674  * @cmd - value type (TIPC_CMD_SET_LINK_*)
2675  * @new_value - the new value
2676  *
2677  * Returns 1 if value is within range, 0 if not.
2678  */
2679 static int link_value_is_valid(u16 cmd, u32 new_value)
2680 {
2681 	switch (cmd) {
2682 	case TIPC_CMD_SET_LINK_TOL:
2683 		return (new_value >= TIPC_MIN_LINK_TOL) &&
2684 			(new_value <= TIPC_MAX_LINK_TOL);
2685 	case TIPC_CMD_SET_LINK_PRI:
2686 		return (new_value <= TIPC_MAX_LINK_PRI);
2687 	case TIPC_CMD_SET_LINK_WINDOW:
2688 		return (new_value >= TIPC_MIN_LINK_WIN) &&
2689 			(new_value <= TIPC_MAX_LINK_WIN);
2690 	}
2691 	return 0;
2692 }
2693 
2694 /**
2695  * link_cmd_set_value - change priority/tolerance/window for link/bearer/media
2696  * @name - ptr to link, bearer, or media name
2697  * @new_value - new value of link, bearer, or media setting
2698  * @cmd - which link, bearer, or media attribute to set (TIPC_CMD_SET_LINK_*)
2699  *
2700  * Caller must hold 'tipc_net_lock' to ensure link/bearer/media is not deleted.
2701  *
2702  * Returns 0 if value updated and negative value on error.
2703  */
2704 static int link_cmd_set_value(const char *name, u32 new_value, u16 cmd)
2705 {
2706 	struct tipc_node *node;
2707 	struct tipc_link *l_ptr;
2708 	struct tipc_bearer *b_ptr;
2709 	struct tipc_media *m_ptr;
2710 
2711 	l_ptr = link_find_link(name, &node);
2712 	if (l_ptr) {
2713 		/*
2714 		 * acquire node lock for tipc_link_send_proto_msg().
2715 		 * see "TIPC locking policy" in net.c.
2716 		 */
2717 		tipc_node_lock(node);
2718 		switch (cmd) {
2719 		case TIPC_CMD_SET_LINK_TOL:
2720 			link_set_supervision_props(l_ptr, new_value);
2721 			tipc_link_send_proto_msg(l_ptr,
2722 				STATE_MSG, 0, 0, new_value, 0, 0);
2723 			break;
2724 		case TIPC_CMD_SET_LINK_PRI:
2725 			l_ptr->priority = new_value;
2726 			tipc_link_send_proto_msg(l_ptr,
2727 				STATE_MSG, 0, 0, 0, new_value, 0);
2728 			break;
2729 		case TIPC_CMD_SET_LINK_WINDOW:
2730 			tipc_link_set_queue_limits(l_ptr, new_value);
2731 			break;
2732 		}
2733 		tipc_node_unlock(node);
2734 		return 0;
2735 	}
2736 
2737 	b_ptr = tipc_bearer_find(name);
2738 	if (b_ptr) {
2739 		switch (cmd) {
2740 		case TIPC_CMD_SET_LINK_TOL:
2741 			b_ptr->tolerance = new_value;
2742 			return 0;
2743 		case TIPC_CMD_SET_LINK_PRI:
2744 			b_ptr->priority = new_value;
2745 			return 0;
2746 		case TIPC_CMD_SET_LINK_WINDOW:
2747 			b_ptr->window = new_value;
2748 			return 0;
2749 		}
2750 		return -EINVAL;
2751 	}
2752 
2753 	m_ptr = tipc_media_find(name);
2754 	if (!m_ptr)
2755 		return -ENODEV;
2756 	switch (cmd) {
2757 	case TIPC_CMD_SET_LINK_TOL:
2758 		m_ptr->tolerance = new_value;
2759 		return 0;
2760 	case TIPC_CMD_SET_LINK_PRI:
2761 		m_ptr->priority = new_value;
2762 		return 0;
2763 	case TIPC_CMD_SET_LINK_WINDOW:
2764 		m_ptr->window = new_value;
2765 		return 0;
2766 	}
2767 	return -EINVAL;
2768 }
2769 
2770 struct sk_buff *tipc_link_cmd_config(const void *req_tlv_area, int req_tlv_space,
2771 				     u16 cmd)
2772 {
2773 	struct tipc_link_config *args;
2774 	u32 new_value;
2775 	int res;
2776 
2777 	if (!TLV_CHECK(req_tlv_area, req_tlv_space, TIPC_TLV_LINK_CONFIG))
2778 		return tipc_cfg_reply_error_string(TIPC_CFG_TLV_ERROR);
2779 
2780 	args = (struct tipc_link_config *)TLV_DATA(req_tlv_area);
2781 	new_value = ntohl(args->value);
2782 
2783 	if (!link_value_is_valid(cmd, new_value))
2784 		return tipc_cfg_reply_error_string(
2785 			"cannot change, value invalid");
2786 
2787 	if (!strcmp(args->name, tipc_bclink_name)) {
2788 		if ((cmd == TIPC_CMD_SET_LINK_WINDOW) &&
2789 		    (tipc_bclink_set_queue_limits(new_value) == 0))
2790 			return tipc_cfg_reply_none();
2791 		return tipc_cfg_reply_error_string(TIPC_CFG_NOT_SUPPORTED
2792 						   " (cannot change setting on broadcast link)");
2793 	}
2794 
2795 	read_lock_bh(&tipc_net_lock);
2796 	res = link_cmd_set_value(args->name, new_value, cmd);
2797 	read_unlock_bh(&tipc_net_lock);
2798 	if (res)
2799 		return tipc_cfg_reply_error_string("cannot change link setting");
2800 
2801 	return tipc_cfg_reply_none();
2802 }
2803 
2804 /**
2805  * link_reset_statistics - reset link statistics
2806  * @l_ptr: pointer to link
2807  */
2808 static void link_reset_statistics(struct tipc_link *l_ptr)
2809 {
2810 	memset(&l_ptr->stats, 0, sizeof(l_ptr->stats));
2811 	l_ptr->stats.sent_info = l_ptr->next_out_no;
2812 	l_ptr->stats.recv_info = l_ptr->next_in_no;
2813 }
2814 
2815 struct sk_buff *tipc_link_cmd_reset_stats(const void *req_tlv_area, int req_tlv_space)
2816 {
2817 	char *link_name;
2818 	struct tipc_link *l_ptr;
2819 	struct tipc_node *node;
2820 
2821 	if (!TLV_CHECK(req_tlv_area, req_tlv_space, TIPC_TLV_LINK_NAME))
2822 		return tipc_cfg_reply_error_string(TIPC_CFG_TLV_ERROR);
2823 
2824 	link_name = (char *)TLV_DATA(req_tlv_area);
2825 	if (!strcmp(link_name, tipc_bclink_name)) {
2826 		if (tipc_bclink_reset_stats())
2827 			return tipc_cfg_reply_error_string("link not found");
2828 		return tipc_cfg_reply_none();
2829 	}
2830 
2831 	read_lock_bh(&tipc_net_lock);
2832 	l_ptr = link_find_link(link_name, &node);
2833 	if (!l_ptr) {
2834 		read_unlock_bh(&tipc_net_lock);
2835 		return tipc_cfg_reply_error_string("link not found");
2836 	}
2837 
2838 	tipc_node_lock(node);
2839 	link_reset_statistics(l_ptr);
2840 	tipc_node_unlock(node);
2841 	read_unlock_bh(&tipc_net_lock);
2842 	return tipc_cfg_reply_none();
2843 }
2844 
2845 /**
2846  * percent - convert count to a percentage of total (rounding up or down)
2847  */
2848 static u32 percent(u32 count, u32 total)
2849 {
2850 	return (count * 100 + (total / 2)) / total;
2851 }
2852 
2853 /**
2854  * tipc_link_stats - print link statistics
2855  * @name: link name
2856  * @buf: print buffer area
2857  * @buf_size: size of print buffer area
2858  *
2859  * Returns length of print buffer data string (or 0 if error)
2860  */
2861 static int tipc_link_stats(const char *name, char *buf, const u32 buf_size)
2862 {
2863 	struct print_buf pb;
2864 	struct tipc_link *l_ptr;
2865 	struct tipc_node *node;
2866 	char *status;
2867 	u32 profile_total = 0;
2868 
2869 	if (!strcmp(name, tipc_bclink_name))
2870 		return tipc_bclink_stats(buf, buf_size);
2871 
2872 	tipc_printbuf_init(&pb, buf, buf_size);
2873 
2874 	read_lock_bh(&tipc_net_lock);
2875 	l_ptr = link_find_link(name, &node);
2876 	if (!l_ptr) {
2877 		read_unlock_bh(&tipc_net_lock);
2878 		return 0;
2879 	}
2880 	tipc_node_lock(node);
2881 
2882 	if (tipc_link_is_active(l_ptr))
2883 		status = "ACTIVE";
2884 	else if (tipc_link_is_up(l_ptr))
2885 		status = "STANDBY";
2886 	else
2887 		status = "DEFUNCT";
2888 	tipc_printf(&pb, "Link <%s>\n"
2889 			 "  %s  MTU:%u  Priority:%u  Tolerance:%u ms"
2890 			 "  Window:%u packets\n",
2891 		    l_ptr->name, status, l_ptr->max_pkt,
2892 		    l_ptr->priority, l_ptr->tolerance, l_ptr->queue_limit[0]);
2893 	tipc_printf(&pb, "  RX packets:%u fragments:%u/%u bundles:%u/%u\n",
2894 		    l_ptr->next_in_no - l_ptr->stats.recv_info,
2895 		    l_ptr->stats.recv_fragments,
2896 		    l_ptr->stats.recv_fragmented,
2897 		    l_ptr->stats.recv_bundles,
2898 		    l_ptr->stats.recv_bundled);
2899 	tipc_printf(&pb, "  TX packets:%u fragments:%u/%u bundles:%u/%u\n",
2900 		    l_ptr->next_out_no - l_ptr->stats.sent_info,
2901 		    l_ptr->stats.sent_fragments,
2902 		    l_ptr->stats.sent_fragmented,
2903 		    l_ptr->stats.sent_bundles,
2904 		    l_ptr->stats.sent_bundled);
2905 	profile_total = l_ptr->stats.msg_length_counts;
2906 	if (!profile_total)
2907 		profile_total = 1;
2908 	tipc_printf(&pb, "  TX profile sample:%u packets  average:%u octets\n"
2909 			 "  0-64:%u%% -256:%u%% -1024:%u%% -4096:%u%% "
2910 			 "-16384:%u%% -32768:%u%% -66000:%u%%\n",
2911 		    l_ptr->stats.msg_length_counts,
2912 		    l_ptr->stats.msg_lengths_total / profile_total,
2913 		    percent(l_ptr->stats.msg_length_profile[0], profile_total),
2914 		    percent(l_ptr->stats.msg_length_profile[1], profile_total),
2915 		    percent(l_ptr->stats.msg_length_profile[2], profile_total),
2916 		    percent(l_ptr->stats.msg_length_profile[3], profile_total),
2917 		    percent(l_ptr->stats.msg_length_profile[4], profile_total),
2918 		    percent(l_ptr->stats.msg_length_profile[5], profile_total),
2919 		    percent(l_ptr->stats.msg_length_profile[6], profile_total));
2920 	tipc_printf(&pb, "  RX states:%u probes:%u naks:%u defs:%u dups:%u\n",
2921 		    l_ptr->stats.recv_states,
2922 		    l_ptr->stats.recv_probes,
2923 		    l_ptr->stats.recv_nacks,
2924 		    l_ptr->stats.deferred_recv,
2925 		    l_ptr->stats.duplicates);
2926 	tipc_printf(&pb, "  TX states:%u probes:%u naks:%u acks:%u dups:%u\n",
2927 		    l_ptr->stats.sent_states,
2928 		    l_ptr->stats.sent_probes,
2929 		    l_ptr->stats.sent_nacks,
2930 		    l_ptr->stats.sent_acks,
2931 		    l_ptr->stats.retransmitted);
2932 	tipc_printf(&pb, "  Congestion bearer:%u link:%u  Send queue max:%u avg:%u\n",
2933 		    l_ptr->stats.bearer_congs,
2934 		    l_ptr->stats.link_congs,
2935 		    l_ptr->stats.max_queue_sz,
2936 		    l_ptr->stats.queue_sz_counts
2937 		    ? (l_ptr->stats.accu_queue_sz / l_ptr->stats.queue_sz_counts)
2938 		    : 0);
2939 
2940 	tipc_node_unlock(node);
2941 	read_unlock_bh(&tipc_net_lock);
2942 	return tipc_printbuf_validate(&pb);
2943 }
2944 
2945 #define MAX_LINK_STATS_INFO 2000
2946 
2947 struct sk_buff *tipc_link_cmd_show_stats(const void *req_tlv_area, int req_tlv_space)
2948 {
2949 	struct sk_buff *buf;
2950 	struct tlv_desc *rep_tlv;
2951 	int str_len;
2952 
2953 	if (!TLV_CHECK(req_tlv_area, req_tlv_space, TIPC_TLV_LINK_NAME))
2954 		return tipc_cfg_reply_error_string(TIPC_CFG_TLV_ERROR);
2955 
2956 	buf = tipc_cfg_reply_alloc(TLV_SPACE(MAX_LINK_STATS_INFO));
2957 	if (!buf)
2958 		return NULL;
2959 
2960 	rep_tlv = (struct tlv_desc *)buf->data;
2961 
2962 	str_len = tipc_link_stats((char *)TLV_DATA(req_tlv_area),
2963 				  (char *)TLV_DATA(rep_tlv), MAX_LINK_STATS_INFO);
2964 	if (!str_len) {
2965 		kfree_skb(buf);
2966 		return tipc_cfg_reply_error_string("link not found");
2967 	}
2968 
2969 	skb_put(buf, TLV_SPACE(str_len));
2970 	TLV_SET(rep_tlv, TIPC_TLV_ULTRA_STRING, NULL, str_len);
2971 
2972 	return buf;
2973 }
2974 
2975 /**
2976  * tipc_link_get_max_pkt - get maximum packet size to use when sending to destination
2977  * @dest: network address of destination node
2978  * @selector: used to select from set of active links
2979  *
2980  * If no active link can be found, uses default maximum packet size.
2981  */
2982 u32 tipc_link_get_max_pkt(u32 dest, u32 selector)
2983 {
2984 	struct tipc_node *n_ptr;
2985 	struct tipc_link *l_ptr;
2986 	u32 res = MAX_PKT_DEFAULT;
2987 
2988 	if (dest == tipc_own_addr)
2989 		return MAX_MSG_SIZE;
2990 
2991 	read_lock_bh(&tipc_net_lock);
2992 	n_ptr = tipc_node_find(dest);
2993 	if (n_ptr) {
2994 		tipc_node_lock(n_ptr);
2995 		l_ptr = n_ptr->active_links[selector & 1];
2996 		if (l_ptr)
2997 			res = l_ptr->max_pkt;
2998 		tipc_node_unlock(n_ptr);
2999 	}
3000 	read_unlock_bh(&tipc_net_lock);
3001 	return res;
3002 }
3003 
3004 static void link_print(struct tipc_link *l_ptr, const char *str)
3005 {
3006 	char print_area[256];
3007 	struct print_buf pb;
3008 	struct print_buf *buf = &pb;
3009 
3010 	tipc_printbuf_init(buf, print_area, sizeof(print_area));
3011 
3012 	tipc_printf(buf, str);
3013 	tipc_printf(buf, "Link %x<%s>:",
3014 		    l_ptr->addr, l_ptr->b_ptr->name);
3015 
3016 #ifdef CONFIG_TIPC_DEBUG
3017 	if (link_reset_reset(l_ptr) || link_reset_unknown(l_ptr))
3018 		goto print_state;
3019 
3020 	tipc_printf(buf, ": NXO(%u):", mod(l_ptr->next_out_no));
3021 	tipc_printf(buf, "NXI(%u):", mod(l_ptr->next_in_no));
3022 	tipc_printf(buf, "SQUE");
3023 	if (l_ptr->first_out) {
3024 		tipc_printf(buf, "[%u..", buf_seqno(l_ptr->first_out));
3025 		if (l_ptr->next_out)
3026 			tipc_printf(buf, "%u..", buf_seqno(l_ptr->next_out));
3027 		tipc_printf(buf, "%u]", buf_seqno(l_ptr->last_out));
3028 		if ((mod(buf_seqno(l_ptr->last_out) -
3029 			 buf_seqno(l_ptr->first_out))
3030 		     != (l_ptr->out_queue_size - 1)) ||
3031 		    (l_ptr->last_out->next != NULL)) {
3032 			tipc_printf(buf, "\nSend queue inconsistency\n");
3033 			tipc_printf(buf, "first_out= %p ", l_ptr->first_out);
3034 			tipc_printf(buf, "next_out= %p ", l_ptr->next_out);
3035 			tipc_printf(buf, "last_out= %p ", l_ptr->last_out);
3036 		}
3037 	} else
3038 		tipc_printf(buf, "[]");
3039 	tipc_printf(buf, "SQSIZ(%u)", l_ptr->out_queue_size);
3040 	if (l_ptr->oldest_deferred_in) {
3041 		u32 o = buf_seqno(l_ptr->oldest_deferred_in);
3042 		u32 n = buf_seqno(l_ptr->newest_deferred_in);
3043 		tipc_printf(buf, ":RQUE[%u..%u]", o, n);
3044 		if (l_ptr->deferred_inqueue_sz != mod((n + 1) - o)) {
3045 			tipc_printf(buf, ":RQSIZ(%u)",
3046 				    l_ptr->deferred_inqueue_sz);
3047 		}
3048 	}
3049 print_state:
3050 #endif
3051 
3052 	if (link_working_unknown(l_ptr))
3053 		tipc_printf(buf, ":WU");
3054 	else if (link_reset_reset(l_ptr))
3055 		tipc_printf(buf, ":RR");
3056 	else if (link_reset_unknown(l_ptr))
3057 		tipc_printf(buf, ":RU");
3058 	else if (link_working_working(l_ptr))
3059 		tipc_printf(buf, ":WW");
3060 	tipc_printf(buf, "\n");
3061 
3062 	tipc_printbuf_validate(buf);
3063 	info("%s", print_area);
3064 }
3065