xref: /linux/net/tipc/link.c (revision 7ad24ea4bf620a32631d7b3069c3e30c078b0c3e)
1 /*
2  * net/tipc/link.c: TIPC link code
3  *
4  * Copyright (c) 1996-2007, 2012-2014, Ericsson AB
5  * Copyright (c) 2004-2007, 2010-2013, Wind River Systems
6  * All rights reserved.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions are met:
10  *
11  * 1. Redistributions of source code must retain the above copyright
12  *    notice, this list of conditions and the following disclaimer.
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in the
15  *    documentation and/or other materials provided with the distribution.
16  * 3. Neither the names of the copyright holders nor the names of its
17  *    contributors may be used to endorse or promote products derived from
18  *    this software without specific prior written permission.
19  *
20  * Alternatively, this software may be distributed under the terms of the
21  * GNU General Public License ("GPL") version 2 as published by the Free
22  * Software Foundation.
23  *
24  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
25  * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
26  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
27  * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
28  * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
29  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
30  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
31  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
32  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
33  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
34  * POSSIBILITY OF SUCH DAMAGE.
35  */
36 
37 #include "core.h"
38 #include "link.h"
39 #include "port.h"
40 #include "name_distr.h"
41 #include "discover.h"
42 #include "config.h"
43 
44 #include <linux/pkt_sched.h>
45 
46 /*
47  * Error message prefixes
48  */
49 static const char *link_co_err = "Link changeover error, ";
50 static const char *link_rst_msg = "Resetting link ";
51 static const char *link_unk_evt = "Unknown link event ";
52 
53 /*
54  * Out-of-range value for link session numbers
55  */
56 #define INVALID_SESSION 0x10000
57 
58 /*
59  * Link state events:
60  */
61 #define  STARTING_EVT    856384768	/* link processing trigger */
62 #define  TRAFFIC_MSG_EVT 560815u	/* rx'd ??? */
63 #define  TIMEOUT_EVT     560817u	/* link timer expired */
64 
65 /*
66  * The following two 'message types' is really just implementation
67  * data conveniently stored in the message header.
68  * They must not be considered part of the protocol
69  */
70 #define OPEN_MSG   0
71 #define CLOSED_MSG 1
72 
73 /*
74  * State value stored in 'exp_msg_count'
75  */
76 #define START_CHANGEOVER 100000u
77 
78 static void link_handle_out_of_seq_msg(struct tipc_link *l_ptr,
79 				       struct sk_buff *buf);
80 static void tipc_link_proto_rcv(struct tipc_link *l_ptr, struct sk_buff *buf);
81 static int  tipc_link_tunnel_rcv(struct tipc_node *n_ptr,
82 				 struct sk_buff **buf);
83 static void link_set_supervision_props(struct tipc_link *l_ptr, u32 tolerance);
84 static int  tipc_link_iovec_long_xmit(struct tipc_port *sender,
85 				      struct iovec const *msg_sect,
86 				      unsigned int len, u32 destnode);
87 static void link_state_event(struct tipc_link *l_ptr, u32 event);
88 static void link_reset_statistics(struct tipc_link *l_ptr);
89 static void link_print(struct tipc_link *l_ptr, const char *str);
90 static int tipc_link_frag_xmit(struct tipc_link *l_ptr, struct sk_buff *buf);
91 static void tipc_link_sync_xmit(struct tipc_link *l);
92 static void tipc_link_sync_rcv(struct tipc_node *n, struct sk_buff *buf);
93 
94 /*
95  *  Simple link routines
96  */
97 static unsigned int align(unsigned int i)
98 {
99 	return (i + 3) & ~3u;
100 }
101 
102 static void link_init_max_pkt(struct tipc_link *l_ptr)
103 {
104 	struct tipc_bearer *b_ptr;
105 	u32 max_pkt;
106 
107 	rcu_read_lock();
108 	b_ptr = rcu_dereference_rtnl(bearer_list[l_ptr->bearer_id]);
109 	if (!b_ptr) {
110 		rcu_read_unlock();
111 		return;
112 	}
113 	max_pkt = (b_ptr->mtu & ~3);
114 	rcu_read_unlock();
115 
116 	if (max_pkt > MAX_MSG_SIZE)
117 		max_pkt = MAX_MSG_SIZE;
118 
119 	l_ptr->max_pkt_target = max_pkt;
120 	if (l_ptr->max_pkt_target < MAX_PKT_DEFAULT)
121 		l_ptr->max_pkt = l_ptr->max_pkt_target;
122 	else
123 		l_ptr->max_pkt = MAX_PKT_DEFAULT;
124 
125 	l_ptr->max_pkt_probes = 0;
126 }
127 
128 static u32 link_next_sent(struct tipc_link *l_ptr)
129 {
130 	if (l_ptr->next_out)
131 		return buf_seqno(l_ptr->next_out);
132 	return mod(l_ptr->next_out_no);
133 }
134 
135 static u32 link_last_sent(struct tipc_link *l_ptr)
136 {
137 	return mod(link_next_sent(l_ptr) - 1);
138 }
139 
140 /*
141  *  Simple non-static link routines (i.e. referenced outside this file)
142  */
143 int tipc_link_is_up(struct tipc_link *l_ptr)
144 {
145 	if (!l_ptr)
146 		return 0;
147 	return link_working_working(l_ptr) || link_working_unknown(l_ptr);
148 }
149 
150 int tipc_link_is_active(struct tipc_link *l_ptr)
151 {
152 	return	(l_ptr->owner->active_links[0] == l_ptr) ||
153 		(l_ptr->owner->active_links[1] == l_ptr);
154 }
155 
156 /**
157  * link_timeout - handle expiration of link timer
158  * @l_ptr: pointer to link
159  */
160 static void link_timeout(struct tipc_link *l_ptr)
161 {
162 	tipc_node_lock(l_ptr->owner);
163 
164 	/* update counters used in statistical profiling of send traffic */
165 	l_ptr->stats.accu_queue_sz += l_ptr->out_queue_size;
166 	l_ptr->stats.queue_sz_counts++;
167 
168 	if (l_ptr->first_out) {
169 		struct tipc_msg *msg = buf_msg(l_ptr->first_out);
170 		u32 length = msg_size(msg);
171 
172 		if ((msg_user(msg) == MSG_FRAGMENTER) &&
173 		    (msg_type(msg) == FIRST_FRAGMENT)) {
174 			length = msg_size(msg_get_wrapped(msg));
175 		}
176 		if (length) {
177 			l_ptr->stats.msg_lengths_total += length;
178 			l_ptr->stats.msg_length_counts++;
179 			if (length <= 64)
180 				l_ptr->stats.msg_length_profile[0]++;
181 			else if (length <= 256)
182 				l_ptr->stats.msg_length_profile[1]++;
183 			else if (length <= 1024)
184 				l_ptr->stats.msg_length_profile[2]++;
185 			else if (length <= 4096)
186 				l_ptr->stats.msg_length_profile[3]++;
187 			else if (length <= 16384)
188 				l_ptr->stats.msg_length_profile[4]++;
189 			else if (length <= 32768)
190 				l_ptr->stats.msg_length_profile[5]++;
191 			else
192 				l_ptr->stats.msg_length_profile[6]++;
193 		}
194 	}
195 
196 	/* do all other link processing performed on a periodic basis */
197 
198 	link_state_event(l_ptr, TIMEOUT_EVT);
199 
200 	if (l_ptr->next_out)
201 		tipc_link_push_queue(l_ptr);
202 
203 	tipc_node_unlock(l_ptr->owner);
204 }
205 
206 static void link_set_timer(struct tipc_link *l_ptr, u32 time)
207 {
208 	k_start_timer(&l_ptr->timer, time);
209 }
210 
211 /**
212  * tipc_link_create - create a new link
213  * @n_ptr: pointer to associated node
214  * @b_ptr: pointer to associated bearer
215  * @media_addr: media address to use when sending messages over link
216  *
217  * Returns pointer to link.
218  */
219 struct tipc_link *tipc_link_create(struct tipc_node *n_ptr,
220 				   struct tipc_bearer *b_ptr,
221 				   const struct tipc_media_addr *media_addr)
222 {
223 	struct tipc_link *l_ptr;
224 	struct tipc_msg *msg;
225 	char *if_name;
226 	char addr_string[16];
227 	u32 peer = n_ptr->addr;
228 
229 	if (n_ptr->link_cnt >= 2) {
230 		tipc_addr_string_fill(addr_string, n_ptr->addr);
231 		pr_err("Attempt to establish third link to %s\n", addr_string);
232 		return NULL;
233 	}
234 
235 	if (n_ptr->links[b_ptr->identity]) {
236 		tipc_addr_string_fill(addr_string, n_ptr->addr);
237 		pr_err("Attempt to establish second link on <%s> to %s\n",
238 		       b_ptr->name, addr_string);
239 		return NULL;
240 	}
241 
242 	l_ptr = kzalloc(sizeof(*l_ptr), GFP_ATOMIC);
243 	if (!l_ptr) {
244 		pr_warn("Link creation failed, no memory\n");
245 		return NULL;
246 	}
247 
248 	l_ptr->addr = peer;
249 	if_name = strchr(b_ptr->name, ':') + 1;
250 	sprintf(l_ptr->name, "%u.%u.%u:%s-%u.%u.%u:unknown",
251 		tipc_zone(tipc_own_addr), tipc_cluster(tipc_own_addr),
252 		tipc_node(tipc_own_addr),
253 		if_name,
254 		tipc_zone(peer), tipc_cluster(peer), tipc_node(peer));
255 		/* note: peer i/f name is updated by reset/activate message */
256 	memcpy(&l_ptr->media_addr, media_addr, sizeof(*media_addr));
257 	l_ptr->owner = n_ptr;
258 	l_ptr->checkpoint = 1;
259 	l_ptr->peer_session = INVALID_SESSION;
260 	l_ptr->bearer_id = b_ptr->identity;
261 	link_set_supervision_props(l_ptr, b_ptr->tolerance);
262 	l_ptr->state = RESET_UNKNOWN;
263 
264 	l_ptr->pmsg = (struct tipc_msg *)&l_ptr->proto_msg;
265 	msg = l_ptr->pmsg;
266 	tipc_msg_init(msg, LINK_PROTOCOL, RESET_MSG, INT_H_SIZE, l_ptr->addr);
267 	msg_set_size(msg, sizeof(l_ptr->proto_msg));
268 	msg_set_session(msg, (tipc_random & 0xffff));
269 	msg_set_bearer_id(msg, b_ptr->identity);
270 	strcpy((char *)msg_data(msg), if_name);
271 
272 	l_ptr->priority = b_ptr->priority;
273 	tipc_link_set_queue_limits(l_ptr, b_ptr->window);
274 
275 	l_ptr->net_plane = b_ptr->net_plane;
276 	link_init_max_pkt(l_ptr);
277 
278 	l_ptr->next_out_no = 1;
279 	INIT_LIST_HEAD(&l_ptr->waiting_ports);
280 
281 	link_reset_statistics(l_ptr);
282 
283 	tipc_node_attach_link(n_ptr, l_ptr);
284 
285 	k_init_timer(&l_ptr->timer, (Handler)link_timeout,
286 		     (unsigned long)l_ptr);
287 
288 	link_state_event(l_ptr, STARTING_EVT);
289 
290 	return l_ptr;
291 }
292 
293 void tipc_link_delete_list(unsigned int bearer_id, bool shutting_down)
294 {
295 	struct tipc_link *l_ptr;
296 	struct tipc_node *n_ptr;
297 
298 	rcu_read_lock();
299 	list_for_each_entry_rcu(n_ptr, &tipc_node_list, list) {
300 		tipc_node_lock(n_ptr);
301 		l_ptr = n_ptr->links[bearer_id];
302 		if (l_ptr) {
303 			tipc_link_reset(l_ptr);
304 			if (shutting_down || !tipc_node_is_up(n_ptr)) {
305 				tipc_node_detach_link(l_ptr->owner, l_ptr);
306 				tipc_link_reset_fragments(l_ptr);
307 				tipc_node_unlock(n_ptr);
308 
309 				/* Nobody else can access this link now: */
310 				del_timer_sync(&l_ptr->timer);
311 				kfree(l_ptr);
312 			} else {
313 				/* Detach/delete when failover is finished: */
314 				l_ptr->flags |= LINK_STOPPED;
315 				tipc_node_unlock(n_ptr);
316 				del_timer_sync(&l_ptr->timer);
317 			}
318 			continue;
319 		}
320 		tipc_node_unlock(n_ptr);
321 	}
322 	rcu_read_unlock();
323 }
324 
325 /**
326  * link_schedule_port - schedule port for deferred sending
327  * @l_ptr: pointer to link
328  * @origport: reference to sending port
329  * @sz: amount of data to be sent
330  *
331  * Schedules port for renewed sending of messages after link congestion
332  * has abated.
333  */
334 static int link_schedule_port(struct tipc_link *l_ptr, u32 origport, u32 sz)
335 {
336 	struct tipc_port *p_ptr;
337 
338 	spin_lock_bh(&tipc_port_list_lock);
339 	p_ptr = tipc_port_lock(origport);
340 	if (p_ptr) {
341 		if (!list_empty(&p_ptr->wait_list))
342 			goto exit;
343 		p_ptr->congested = 1;
344 		p_ptr->waiting_pkts = 1 + ((sz - 1) / l_ptr->max_pkt);
345 		list_add_tail(&p_ptr->wait_list, &l_ptr->waiting_ports);
346 		l_ptr->stats.link_congs++;
347 exit:
348 		tipc_port_unlock(p_ptr);
349 	}
350 	spin_unlock_bh(&tipc_port_list_lock);
351 	return -ELINKCONG;
352 }
353 
354 void tipc_link_wakeup_ports(struct tipc_link *l_ptr, int all)
355 {
356 	struct tipc_port *p_ptr;
357 	struct tipc_port *temp_p_ptr;
358 	int win = l_ptr->queue_limit[0] - l_ptr->out_queue_size;
359 
360 	if (all)
361 		win = 100000;
362 	if (win <= 0)
363 		return;
364 	if (!spin_trylock_bh(&tipc_port_list_lock))
365 		return;
366 	if (link_congested(l_ptr))
367 		goto exit;
368 	list_for_each_entry_safe(p_ptr, temp_p_ptr, &l_ptr->waiting_ports,
369 				 wait_list) {
370 		if (win <= 0)
371 			break;
372 		list_del_init(&p_ptr->wait_list);
373 		spin_lock_bh(p_ptr->lock);
374 		p_ptr->congested = 0;
375 		tipc_port_wakeup(p_ptr);
376 		win -= p_ptr->waiting_pkts;
377 		spin_unlock_bh(p_ptr->lock);
378 	}
379 
380 exit:
381 	spin_unlock_bh(&tipc_port_list_lock);
382 }
383 
384 /**
385  * link_release_outqueue - purge link's outbound message queue
386  * @l_ptr: pointer to link
387  */
388 static void link_release_outqueue(struct tipc_link *l_ptr)
389 {
390 	kfree_skb_list(l_ptr->first_out);
391 	l_ptr->first_out = NULL;
392 	l_ptr->out_queue_size = 0;
393 }
394 
395 /**
396  * tipc_link_reset_fragments - purge link's inbound message fragments queue
397  * @l_ptr: pointer to link
398  */
399 void tipc_link_reset_fragments(struct tipc_link *l_ptr)
400 {
401 	kfree_skb(l_ptr->reasm_head);
402 	l_ptr->reasm_head = NULL;
403 	l_ptr->reasm_tail = NULL;
404 }
405 
406 /**
407  * tipc_link_purge_queues - purge all pkt queues associated with link
408  * @l_ptr: pointer to link
409  */
410 void tipc_link_purge_queues(struct tipc_link *l_ptr)
411 {
412 	kfree_skb_list(l_ptr->oldest_deferred_in);
413 	kfree_skb_list(l_ptr->first_out);
414 	tipc_link_reset_fragments(l_ptr);
415 	kfree_skb(l_ptr->proto_msg_queue);
416 	l_ptr->proto_msg_queue = NULL;
417 }
418 
419 void tipc_link_reset(struct tipc_link *l_ptr)
420 {
421 	u32 prev_state = l_ptr->state;
422 	u32 checkpoint = l_ptr->next_in_no;
423 	int was_active_link = tipc_link_is_active(l_ptr);
424 
425 	msg_set_session(l_ptr->pmsg, ((msg_session(l_ptr->pmsg) + 1) & 0xffff));
426 
427 	/* Link is down, accept any session */
428 	l_ptr->peer_session = INVALID_SESSION;
429 
430 	/* Prepare for max packet size negotiation */
431 	link_init_max_pkt(l_ptr);
432 
433 	l_ptr->state = RESET_UNKNOWN;
434 
435 	if ((prev_state == RESET_UNKNOWN) || (prev_state == RESET_RESET))
436 		return;
437 
438 	tipc_node_link_down(l_ptr->owner, l_ptr);
439 	tipc_bearer_remove_dest(l_ptr->bearer_id, l_ptr->addr);
440 
441 	if (was_active_link && tipc_node_active_links(l_ptr->owner)) {
442 		l_ptr->reset_checkpoint = checkpoint;
443 		l_ptr->exp_msg_count = START_CHANGEOVER;
444 	}
445 
446 	/* Clean up all queues: */
447 	link_release_outqueue(l_ptr);
448 	kfree_skb(l_ptr->proto_msg_queue);
449 	l_ptr->proto_msg_queue = NULL;
450 	kfree_skb_list(l_ptr->oldest_deferred_in);
451 	if (!list_empty(&l_ptr->waiting_ports))
452 		tipc_link_wakeup_ports(l_ptr, 1);
453 
454 	l_ptr->retransm_queue_head = 0;
455 	l_ptr->retransm_queue_size = 0;
456 	l_ptr->last_out = NULL;
457 	l_ptr->first_out = NULL;
458 	l_ptr->next_out = NULL;
459 	l_ptr->unacked_window = 0;
460 	l_ptr->checkpoint = 1;
461 	l_ptr->next_out_no = 1;
462 	l_ptr->deferred_inqueue_sz = 0;
463 	l_ptr->oldest_deferred_in = NULL;
464 	l_ptr->newest_deferred_in = NULL;
465 	l_ptr->fsm_msg_cnt = 0;
466 	l_ptr->stale_count = 0;
467 	link_reset_statistics(l_ptr);
468 }
469 
470 void tipc_link_reset_list(unsigned int bearer_id)
471 {
472 	struct tipc_link *l_ptr;
473 	struct tipc_node *n_ptr;
474 
475 	rcu_read_lock();
476 	list_for_each_entry_rcu(n_ptr, &tipc_node_list, list) {
477 		tipc_node_lock(n_ptr);
478 		l_ptr = n_ptr->links[bearer_id];
479 		if (l_ptr)
480 			tipc_link_reset(l_ptr);
481 		tipc_node_unlock(n_ptr);
482 	}
483 	rcu_read_unlock();
484 }
485 
486 static void link_activate(struct tipc_link *l_ptr)
487 {
488 	l_ptr->next_in_no = l_ptr->stats.recv_info = 1;
489 	tipc_node_link_up(l_ptr->owner, l_ptr);
490 	tipc_bearer_add_dest(l_ptr->bearer_id, l_ptr->addr);
491 }
492 
493 /**
494  * link_state_event - link finite state machine
495  * @l_ptr: pointer to link
496  * @event: state machine event to process
497  */
498 static void link_state_event(struct tipc_link *l_ptr, unsigned int event)
499 {
500 	struct tipc_link *other;
501 	u32 cont_intv = l_ptr->continuity_interval;
502 
503 	if (l_ptr->flags & LINK_STOPPED)
504 		return;
505 
506 	if (!(l_ptr->flags & LINK_STARTED) && (event != STARTING_EVT))
507 		return;		/* Not yet. */
508 
509 	/* Check whether changeover is going on */
510 	if (l_ptr->exp_msg_count) {
511 		if (event == TIMEOUT_EVT)
512 			link_set_timer(l_ptr, cont_intv);
513 		return;
514 	}
515 
516 	switch (l_ptr->state) {
517 	case WORKING_WORKING:
518 		switch (event) {
519 		case TRAFFIC_MSG_EVT:
520 		case ACTIVATE_MSG:
521 			break;
522 		case TIMEOUT_EVT:
523 			if (l_ptr->next_in_no != l_ptr->checkpoint) {
524 				l_ptr->checkpoint = l_ptr->next_in_no;
525 				if (tipc_bclink_acks_missing(l_ptr->owner)) {
526 					tipc_link_proto_xmit(l_ptr, STATE_MSG,
527 							     0, 0, 0, 0, 0);
528 					l_ptr->fsm_msg_cnt++;
529 				} else if (l_ptr->max_pkt < l_ptr->max_pkt_target) {
530 					tipc_link_proto_xmit(l_ptr, STATE_MSG,
531 							     1, 0, 0, 0, 0);
532 					l_ptr->fsm_msg_cnt++;
533 				}
534 				link_set_timer(l_ptr, cont_intv);
535 				break;
536 			}
537 			l_ptr->state = WORKING_UNKNOWN;
538 			l_ptr->fsm_msg_cnt = 0;
539 			tipc_link_proto_xmit(l_ptr, STATE_MSG, 1, 0, 0, 0, 0);
540 			l_ptr->fsm_msg_cnt++;
541 			link_set_timer(l_ptr, cont_intv / 4);
542 			break;
543 		case RESET_MSG:
544 			pr_info("%s<%s>, requested by peer\n", link_rst_msg,
545 				l_ptr->name);
546 			tipc_link_reset(l_ptr);
547 			l_ptr->state = RESET_RESET;
548 			l_ptr->fsm_msg_cnt = 0;
549 			tipc_link_proto_xmit(l_ptr, ACTIVATE_MSG,
550 					     0, 0, 0, 0, 0);
551 			l_ptr->fsm_msg_cnt++;
552 			link_set_timer(l_ptr, cont_intv);
553 			break;
554 		default:
555 			pr_err("%s%u in WW state\n", link_unk_evt, event);
556 		}
557 		break;
558 	case WORKING_UNKNOWN:
559 		switch (event) {
560 		case TRAFFIC_MSG_EVT:
561 		case ACTIVATE_MSG:
562 			l_ptr->state = WORKING_WORKING;
563 			l_ptr->fsm_msg_cnt = 0;
564 			link_set_timer(l_ptr, cont_intv);
565 			break;
566 		case RESET_MSG:
567 			pr_info("%s<%s>, requested by peer while probing\n",
568 				link_rst_msg, l_ptr->name);
569 			tipc_link_reset(l_ptr);
570 			l_ptr->state = RESET_RESET;
571 			l_ptr->fsm_msg_cnt = 0;
572 			tipc_link_proto_xmit(l_ptr, ACTIVATE_MSG,
573 					     0, 0, 0, 0, 0);
574 			l_ptr->fsm_msg_cnt++;
575 			link_set_timer(l_ptr, cont_intv);
576 			break;
577 		case TIMEOUT_EVT:
578 			if (l_ptr->next_in_no != l_ptr->checkpoint) {
579 				l_ptr->state = WORKING_WORKING;
580 				l_ptr->fsm_msg_cnt = 0;
581 				l_ptr->checkpoint = l_ptr->next_in_no;
582 				if (tipc_bclink_acks_missing(l_ptr->owner)) {
583 					tipc_link_proto_xmit(l_ptr, STATE_MSG,
584 							     0, 0, 0, 0, 0);
585 					l_ptr->fsm_msg_cnt++;
586 				}
587 				link_set_timer(l_ptr, cont_intv);
588 			} else if (l_ptr->fsm_msg_cnt < l_ptr->abort_limit) {
589 				tipc_link_proto_xmit(l_ptr, STATE_MSG,
590 						     1, 0, 0, 0, 0);
591 				l_ptr->fsm_msg_cnt++;
592 				link_set_timer(l_ptr, cont_intv / 4);
593 			} else {	/* Link has failed */
594 				pr_warn("%s<%s>, peer not responding\n",
595 					link_rst_msg, l_ptr->name);
596 				tipc_link_reset(l_ptr);
597 				l_ptr->state = RESET_UNKNOWN;
598 				l_ptr->fsm_msg_cnt = 0;
599 				tipc_link_proto_xmit(l_ptr, RESET_MSG,
600 						     0, 0, 0, 0, 0);
601 				l_ptr->fsm_msg_cnt++;
602 				link_set_timer(l_ptr, cont_intv);
603 			}
604 			break;
605 		default:
606 			pr_err("%s%u in WU state\n", link_unk_evt, event);
607 		}
608 		break;
609 	case RESET_UNKNOWN:
610 		switch (event) {
611 		case TRAFFIC_MSG_EVT:
612 			break;
613 		case ACTIVATE_MSG:
614 			other = l_ptr->owner->active_links[0];
615 			if (other && link_working_unknown(other))
616 				break;
617 			l_ptr->state = WORKING_WORKING;
618 			l_ptr->fsm_msg_cnt = 0;
619 			link_activate(l_ptr);
620 			tipc_link_proto_xmit(l_ptr, STATE_MSG, 1, 0, 0, 0, 0);
621 			l_ptr->fsm_msg_cnt++;
622 			if (l_ptr->owner->working_links == 1)
623 				tipc_link_sync_xmit(l_ptr);
624 			link_set_timer(l_ptr, cont_intv);
625 			break;
626 		case RESET_MSG:
627 			l_ptr->state = RESET_RESET;
628 			l_ptr->fsm_msg_cnt = 0;
629 			tipc_link_proto_xmit(l_ptr, ACTIVATE_MSG,
630 					     1, 0, 0, 0, 0);
631 			l_ptr->fsm_msg_cnt++;
632 			link_set_timer(l_ptr, cont_intv);
633 			break;
634 		case STARTING_EVT:
635 			l_ptr->flags |= LINK_STARTED;
636 			/* fall through */
637 		case TIMEOUT_EVT:
638 			tipc_link_proto_xmit(l_ptr, RESET_MSG, 0, 0, 0, 0, 0);
639 			l_ptr->fsm_msg_cnt++;
640 			link_set_timer(l_ptr, cont_intv);
641 			break;
642 		default:
643 			pr_err("%s%u in RU state\n", link_unk_evt, event);
644 		}
645 		break;
646 	case RESET_RESET:
647 		switch (event) {
648 		case TRAFFIC_MSG_EVT:
649 		case ACTIVATE_MSG:
650 			other = l_ptr->owner->active_links[0];
651 			if (other && link_working_unknown(other))
652 				break;
653 			l_ptr->state = WORKING_WORKING;
654 			l_ptr->fsm_msg_cnt = 0;
655 			link_activate(l_ptr);
656 			tipc_link_proto_xmit(l_ptr, STATE_MSG, 1, 0, 0, 0, 0);
657 			l_ptr->fsm_msg_cnt++;
658 			if (l_ptr->owner->working_links == 1)
659 				tipc_link_sync_xmit(l_ptr);
660 			link_set_timer(l_ptr, cont_intv);
661 			break;
662 		case RESET_MSG:
663 			break;
664 		case TIMEOUT_EVT:
665 			tipc_link_proto_xmit(l_ptr, ACTIVATE_MSG,
666 					     0, 0, 0, 0, 0);
667 			l_ptr->fsm_msg_cnt++;
668 			link_set_timer(l_ptr, cont_intv);
669 			break;
670 		default:
671 			pr_err("%s%u in RR state\n", link_unk_evt, event);
672 		}
673 		break;
674 	default:
675 		pr_err("Unknown link state %u/%u\n", l_ptr->state, event);
676 	}
677 }
678 
679 /*
680  * link_bundle_buf(): Append contents of a buffer to
681  * the tail of an existing one.
682  */
683 static int link_bundle_buf(struct tipc_link *l_ptr, struct sk_buff *bundler,
684 			   struct sk_buff *buf)
685 {
686 	struct tipc_msg *bundler_msg = buf_msg(bundler);
687 	struct tipc_msg *msg = buf_msg(buf);
688 	u32 size = msg_size(msg);
689 	u32 bundle_size = msg_size(bundler_msg);
690 	u32 to_pos = align(bundle_size);
691 	u32 pad = to_pos - bundle_size;
692 
693 	if (msg_user(bundler_msg) != MSG_BUNDLER)
694 		return 0;
695 	if (msg_type(bundler_msg) != OPEN_MSG)
696 		return 0;
697 	if (skb_tailroom(bundler) < (pad + size))
698 		return 0;
699 	if (l_ptr->max_pkt < (to_pos + size))
700 		return 0;
701 
702 	skb_put(bundler, pad + size);
703 	skb_copy_to_linear_data_offset(bundler, to_pos, buf->data, size);
704 	msg_set_size(bundler_msg, to_pos + size);
705 	msg_set_msgcnt(bundler_msg, msg_msgcnt(bundler_msg) + 1);
706 	kfree_skb(buf);
707 	l_ptr->stats.sent_bundled++;
708 	return 1;
709 }
710 
711 static void link_add_to_outqueue(struct tipc_link *l_ptr,
712 				 struct sk_buff *buf,
713 				 struct tipc_msg *msg)
714 {
715 	u32 ack = mod(l_ptr->next_in_no - 1);
716 	u32 seqno = mod(l_ptr->next_out_no++);
717 
718 	msg_set_word(msg, 2, ((ack << 16) | seqno));
719 	msg_set_bcast_ack(msg, l_ptr->owner->bclink.last_in);
720 	buf->next = NULL;
721 	if (l_ptr->first_out) {
722 		l_ptr->last_out->next = buf;
723 		l_ptr->last_out = buf;
724 	} else
725 		l_ptr->first_out = l_ptr->last_out = buf;
726 
727 	l_ptr->out_queue_size++;
728 	if (l_ptr->out_queue_size > l_ptr->stats.max_queue_sz)
729 		l_ptr->stats.max_queue_sz = l_ptr->out_queue_size;
730 }
731 
732 static void link_add_chain_to_outqueue(struct tipc_link *l_ptr,
733 				       struct sk_buff *buf_chain,
734 				       u32 long_msgno)
735 {
736 	struct sk_buff *buf;
737 	struct tipc_msg *msg;
738 
739 	if (!l_ptr->next_out)
740 		l_ptr->next_out = buf_chain;
741 	while (buf_chain) {
742 		buf = buf_chain;
743 		buf_chain = buf_chain->next;
744 
745 		msg = buf_msg(buf);
746 		msg_set_long_msgno(msg, long_msgno);
747 		link_add_to_outqueue(l_ptr, buf, msg);
748 	}
749 }
750 
751 /*
752  * tipc_link_xmit() is the 'full path' for messages, called from
753  * inside TIPC when the 'fast path' in tipc_send_xmit
754  * has failed, and from link_send()
755  */
756 int __tipc_link_xmit(struct tipc_link *l_ptr, struct sk_buff *buf)
757 {
758 	struct tipc_msg *msg = buf_msg(buf);
759 	u32 size = msg_size(msg);
760 	u32 dsz = msg_data_sz(msg);
761 	u32 queue_size = l_ptr->out_queue_size;
762 	u32 imp = tipc_msg_tot_importance(msg);
763 	u32 queue_limit = l_ptr->queue_limit[imp];
764 	u32 max_packet = l_ptr->max_pkt;
765 
766 	/* Match msg importance against queue limits: */
767 	if (unlikely(queue_size >= queue_limit)) {
768 		if (imp <= TIPC_CRITICAL_IMPORTANCE) {
769 			link_schedule_port(l_ptr, msg_origport(msg), size);
770 			kfree_skb(buf);
771 			return -ELINKCONG;
772 		}
773 		kfree_skb(buf);
774 		if (imp > CONN_MANAGER) {
775 			pr_warn("%s<%s>, send queue full", link_rst_msg,
776 				l_ptr->name);
777 			tipc_link_reset(l_ptr);
778 		}
779 		return dsz;
780 	}
781 
782 	/* Fragmentation needed ? */
783 	if (size > max_packet)
784 		return tipc_link_frag_xmit(l_ptr, buf);
785 
786 	/* Packet can be queued or sent. */
787 	if (likely(!link_congested(l_ptr))) {
788 		link_add_to_outqueue(l_ptr, buf, msg);
789 
790 		tipc_bearer_send(l_ptr->bearer_id, buf, &l_ptr->media_addr);
791 		l_ptr->unacked_window = 0;
792 		return dsz;
793 	}
794 	/* Congestion: can message be bundled ? */
795 	if ((msg_user(msg) != CHANGEOVER_PROTOCOL) &&
796 	    (msg_user(msg) != MSG_FRAGMENTER)) {
797 
798 		/* Try adding message to an existing bundle */
799 		if (l_ptr->next_out &&
800 		    link_bundle_buf(l_ptr, l_ptr->last_out, buf))
801 			return dsz;
802 
803 		/* Try creating a new bundle */
804 		if (size <= max_packet * 2 / 3) {
805 			struct sk_buff *bundler = tipc_buf_acquire(max_packet);
806 			struct tipc_msg bundler_hdr;
807 
808 			if (bundler) {
809 				tipc_msg_init(&bundler_hdr, MSG_BUNDLER, OPEN_MSG,
810 					 INT_H_SIZE, l_ptr->addr);
811 				skb_copy_to_linear_data(bundler, &bundler_hdr,
812 							INT_H_SIZE);
813 				skb_trim(bundler, INT_H_SIZE);
814 				link_bundle_buf(l_ptr, bundler, buf);
815 				buf = bundler;
816 				msg = buf_msg(buf);
817 				l_ptr->stats.sent_bundles++;
818 			}
819 		}
820 	}
821 	if (!l_ptr->next_out)
822 		l_ptr->next_out = buf;
823 	link_add_to_outqueue(l_ptr, buf, msg);
824 	return dsz;
825 }
826 
827 /*
828  * tipc_link_xmit(): same as __tipc_link_xmit(), but the link to use
829  * has not been selected yet, and the the owner node is not locked
830  * Called by TIPC internal users, e.g. the name distributor
831  */
832 int tipc_link_xmit(struct sk_buff *buf, u32 dest, u32 selector)
833 {
834 	struct tipc_link *l_ptr;
835 	struct tipc_node *n_ptr;
836 	int res = -ELINKCONG;
837 
838 	n_ptr = tipc_node_find(dest);
839 	if (n_ptr) {
840 		tipc_node_lock(n_ptr);
841 		l_ptr = n_ptr->active_links[selector & 1];
842 		if (l_ptr)
843 			res = __tipc_link_xmit(l_ptr, buf);
844 		else
845 			kfree_skb(buf);
846 		tipc_node_unlock(n_ptr);
847 	} else {
848 		kfree_skb(buf);
849 	}
850 	return res;
851 }
852 
853 /*
854  * tipc_link_sync_xmit - synchronize broadcast link endpoints.
855  *
856  * Give a newly added peer node the sequence number where it should
857  * start receiving and acking broadcast packets.
858  *
859  * Called with node locked
860  */
861 static void tipc_link_sync_xmit(struct tipc_link *l)
862 {
863 	struct sk_buff *buf;
864 	struct tipc_msg *msg;
865 
866 	buf = tipc_buf_acquire(INT_H_SIZE);
867 	if (!buf)
868 		return;
869 
870 	msg = buf_msg(buf);
871 	tipc_msg_init(msg, BCAST_PROTOCOL, STATE_MSG, INT_H_SIZE, l->addr);
872 	msg_set_last_bcast(msg, l->owner->bclink.acked);
873 	link_add_chain_to_outqueue(l, buf, 0);
874 	tipc_link_push_queue(l);
875 }
876 
877 /*
878  * tipc_link_sync_rcv - synchronize broadcast link endpoints.
879  * Receive the sequence number where we should start receiving and
880  * acking broadcast packets from a newly added peer node, and open
881  * up for reception of such packets.
882  *
883  * Called with node locked
884  */
885 static void tipc_link_sync_rcv(struct tipc_node *n, struct sk_buff *buf)
886 {
887 	struct tipc_msg *msg = buf_msg(buf);
888 
889 	n->bclink.last_sent = n->bclink.last_in = msg_last_bcast(msg);
890 	n->bclink.recv_permitted = true;
891 	kfree_skb(buf);
892 }
893 
894 /*
895  * tipc_link_names_xmit - send name table entries to new neighbor
896  *
897  * Send routine for bulk delivery of name table messages when contact
898  * with a new neighbor occurs. No link congestion checking is performed
899  * because name table messages *must* be delivered. The messages must be
900  * small enough not to require fragmentation.
901  * Called without any locks held.
902  */
903 void tipc_link_names_xmit(struct list_head *message_list, u32 dest)
904 {
905 	struct tipc_node *n_ptr;
906 	struct tipc_link *l_ptr;
907 	struct sk_buff *buf;
908 	struct sk_buff *temp_buf;
909 
910 	if (list_empty(message_list))
911 		return;
912 
913 	n_ptr = tipc_node_find(dest);
914 	if (n_ptr) {
915 		tipc_node_lock(n_ptr);
916 		l_ptr = n_ptr->active_links[0];
917 		if (l_ptr) {
918 			/* convert circular list to linear list */
919 			((struct sk_buff *)message_list->prev)->next = NULL;
920 			link_add_chain_to_outqueue(l_ptr,
921 				(struct sk_buff *)message_list->next, 0);
922 			tipc_link_push_queue(l_ptr);
923 			INIT_LIST_HEAD(message_list);
924 		}
925 		tipc_node_unlock(n_ptr);
926 	}
927 
928 	/* discard the messages if they couldn't be sent */
929 	list_for_each_safe(buf, temp_buf, ((struct sk_buff *)message_list)) {
930 		list_del((struct list_head *)buf);
931 		kfree_skb(buf);
932 	}
933 }
934 
935 /*
936  * tipc_link_xmit_fast: Entry for data messages where the
937  * destination link is known and the header is complete,
938  * inclusive total message length. Very time critical.
939  * Link is locked. Returns user data length.
940  */
941 static int tipc_link_xmit_fast(struct tipc_link *l_ptr, struct sk_buff *buf,
942 			       u32 *used_max_pkt)
943 {
944 	struct tipc_msg *msg = buf_msg(buf);
945 	int res = msg_data_sz(msg);
946 
947 	if (likely(!link_congested(l_ptr))) {
948 		if (likely(msg_size(msg) <= l_ptr->max_pkt)) {
949 			link_add_to_outqueue(l_ptr, buf, msg);
950 			tipc_bearer_send(l_ptr->bearer_id, buf,
951 					 &l_ptr->media_addr);
952 			l_ptr->unacked_window = 0;
953 			return res;
954 		}
955 		else
956 			*used_max_pkt = l_ptr->max_pkt;
957 	}
958 	return __tipc_link_xmit(l_ptr, buf);  /* All other cases */
959 }
960 
961 /*
962  * tipc_link_iovec_xmit_fast: Entry for messages where the
963  * destination processor is known and the header is complete,
964  * except for total message length.
965  * Returns user data length or errno.
966  */
967 int tipc_link_iovec_xmit_fast(struct tipc_port *sender,
968 			      struct iovec const *msg_sect,
969 			      unsigned int len, u32 destaddr)
970 {
971 	struct tipc_msg *hdr = &sender->phdr;
972 	struct tipc_link *l_ptr;
973 	struct sk_buff *buf;
974 	struct tipc_node *node;
975 	int res;
976 	u32 selector = msg_origport(hdr) & 1;
977 
978 again:
979 	/*
980 	 * Try building message using port's max_pkt hint.
981 	 * (Must not hold any locks while building message.)
982 	 */
983 	res = tipc_msg_build(hdr, msg_sect, len, sender->max_pkt, &buf);
984 	/* Exit if build request was invalid */
985 	if (unlikely(res < 0))
986 		return res;
987 
988 	node = tipc_node_find(destaddr);
989 	if (likely(node)) {
990 		tipc_node_lock(node);
991 		l_ptr = node->active_links[selector];
992 		if (likely(l_ptr)) {
993 			if (likely(buf)) {
994 				res = tipc_link_xmit_fast(l_ptr, buf,
995 							  &sender->max_pkt);
996 exit:
997 				tipc_node_unlock(node);
998 				return res;
999 			}
1000 
1001 			/* Exit if link (or bearer) is congested */
1002 			if (link_congested(l_ptr)) {
1003 				res = link_schedule_port(l_ptr,
1004 							 sender->ref, res);
1005 				goto exit;
1006 			}
1007 
1008 			/*
1009 			 * Message size exceeds max_pkt hint; update hint,
1010 			 * then re-try fast path or fragment the message
1011 			 */
1012 			sender->max_pkt = l_ptr->max_pkt;
1013 			tipc_node_unlock(node);
1014 
1015 
1016 			if ((msg_hdr_sz(hdr) + res) <= sender->max_pkt)
1017 				goto again;
1018 
1019 			return tipc_link_iovec_long_xmit(sender, msg_sect,
1020 							 len, destaddr);
1021 		}
1022 		tipc_node_unlock(node);
1023 	}
1024 
1025 	/* Couldn't find a link to the destination node */
1026 	kfree_skb(buf);
1027 	tipc_port_iovec_reject(sender, hdr, msg_sect, len, TIPC_ERR_NO_NODE);
1028 	return -ENETUNREACH;
1029 }
1030 
1031 /*
1032  * tipc_link_iovec_long_xmit(): Entry for long messages where the
1033  * destination node is known and the header is complete,
1034  * inclusive total message length.
1035  * Link and bearer congestion status have been checked to be ok,
1036  * and are ignored if they change.
1037  *
1038  * Note that fragments do not use the full link MTU so that they won't have
1039  * to undergo refragmentation if link changeover causes them to be sent
1040  * over another link with an additional tunnel header added as prefix.
1041  * (Refragmentation will still occur if the other link has a smaller MTU.)
1042  *
1043  * Returns user data length or errno.
1044  */
1045 static int tipc_link_iovec_long_xmit(struct tipc_port *sender,
1046 				     struct iovec const *msg_sect,
1047 				     unsigned int len, u32 destaddr)
1048 {
1049 	struct tipc_link *l_ptr;
1050 	struct tipc_node *node;
1051 	struct tipc_msg *hdr = &sender->phdr;
1052 	u32 dsz = len;
1053 	u32 max_pkt, fragm_sz, rest;
1054 	struct tipc_msg fragm_hdr;
1055 	struct sk_buff *buf, *buf_chain, *prev;
1056 	u32 fragm_crs, fragm_rest, hsz, sect_rest;
1057 	const unchar __user *sect_crs;
1058 	int curr_sect;
1059 	u32 fragm_no;
1060 	int res = 0;
1061 
1062 again:
1063 	fragm_no = 1;
1064 	max_pkt = sender->max_pkt - INT_H_SIZE;
1065 		/* leave room for tunnel header in case of link changeover */
1066 	fragm_sz = max_pkt - INT_H_SIZE;
1067 		/* leave room for fragmentation header in each fragment */
1068 	rest = dsz;
1069 	fragm_crs = 0;
1070 	fragm_rest = 0;
1071 	sect_rest = 0;
1072 	sect_crs = NULL;
1073 	curr_sect = -1;
1074 
1075 	/* Prepare reusable fragment header */
1076 	tipc_msg_init(&fragm_hdr, MSG_FRAGMENTER, FIRST_FRAGMENT,
1077 		 INT_H_SIZE, msg_destnode(hdr));
1078 	msg_set_size(&fragm_hdr, max_pkt);
1079 	msg_set_fragm_no(&fragm_hdr, 1);
1080 
1081 	/* Prepare header of first fragment */
1082 	buf_chain = buf = tipc_buf_acquire(max_pkt);
1083 	if (!buf)
1084 		return -ENOMEM;
1085 	buf->next = NULL;
1086 	skb_copy_to_linear_data(buf, &fragm_hdr, INT_H_SIZE);
1087 	hsz = msg_hdr_sz(hdr);
1088 	skb_copy_to_linear_data_offset(buf, INT_H_SIZE, hdr, hsz);
1089 
1090 	/* Chop up message */
1091 	fragm_crs = INT_H_SIZE + hsz;
1092 	fragm_rest = fragm_sz - hsz;
1093 
1094 	do {		/* For all sections */
1095 		u32 sz;
1096 
1097 		if (!sect_rest) {
1098 			sect_rest = msg_sect[++curr_sect].iov_len;
1099 			sect_crs = msg_sect[curr_sect].iov_base;
1100 		}
1101 
1102 		if (sect_rest < fragm_rest)
1103 			sz = sect_rest;
1104 		else
1105 			sz = fragm_rest;
1106 
1107 		if (copy_from_user(buf->data + fragm_crs, sect_crs, sz)) {
1108 			res = -EFAULT;
1109 error:
1110 			kfree_skb_list(buf_chain);
1111 			return res;
1112 		}
1113 		sect_crs += sz;
1114 		sect_rest -= sz;
1115 		fragm_crs += sz;
1116 		fragm_rest -= sz;
1117 		rest -= sz;
1118 
1119 		if (!fragm_rest && rest) {
1120 
1121 			/* Initiate new fragment: */
1122 			if (rest <= fragm_sz) {
1123 				fragm_sz = rest;
1124 				msg_set_type(&fragm_hdr, LAST_FRAGMENT);
1125 			} else {
1126 				msg_set_type(&fragm_hdr, FRAGMENT);
1127 			}
1128 			msg_set_size(&fragm_hdr, fragm_sz + INT_H_SIZE);
1129 			msg_set_fragm_no(&fragm_hdr, ++fragm_no);
1130 			prev = buf;
1131 			buf = tipc_buf_acquire(fragm_sz + INT_H_SIZE);
1132 			if (!buf) {
1133 				res = -ENOMEM;
1134 				goto error;
1135 			}
1136 
1137 			buf->next = NULL;
1138 			prev->next = buf;
1139 			skb_copy_to_linear_data(buf, &fragm_hdr, INT_H_SIZE);
1140 			fragm_crs = INT_H_SIZE;
1141 			fragm_rest = fragm_sz;
1142 		}
1143 	} while (rest > 0);
1144 
1145 	/*
1146 	 * Now we have a buffer chain. Select a link and check
1147 	 * that packet size is still OK
1148 	 */
1149 	node = tipc_node_find(destaddr);
1150 	if (likely(node)) {
1151 		tipc_node_lock(node);
1152 		l_ptr = node->active_links[sender->ref & 1];
1153 		if (!l_ptr) {
1154 			tipc_node_unlock(node);
1155 			goto reject;
1156 		}
1157 		if (l_ptr->max_pkt < max_pkt) {
1158 			sender->max_pkt = l_ptr->max_pkt;
1159 			tipc_node_unlock(node);
1160 			kfree_skb_list(buf_chain);
1161 			goto again;
1162 		}
1163 	} else {
1164 reject:
1165 		kfree_skb_list(buf_chain);
1166 		tipc_port_iovec_reject(sender, hdr, msg_sect, len,
1167 				       TIPC_ERR_NO_NODE);
1168 		return -ENETUNREACH;
1169 	}
1170 
1171 	/* Append chain of fragments to send queue & send them */
1172 	l_ptr->long_msg_seq_no++;
1173 	link_add_chain_to_outqueue(l_ptr, buf_chain, l_ptr->long_msg_seq_no);
1174 	l_ptr->stats.sent_fragments += fragm_no;
1175 	l_ptr->stats.sent_fragmented++;
1176 	tipc_link_push_queue(l_ptr);
1177 	tipc_node_unlock(node);
1178 	return dsz;
1179 }
1180 
1181 /*
1182  * tipc_link_push_packet: Push one unsent packet to the media
1183  */
1184 static u32 tipc_link_push_packet(struct tipc_link *l_ptr)
1185 {
1186 	struct sk_buff *buf = l_ptr->first_out;
1187 	u32 r_q_size = l_ptr->retransm_queue_size;
1188 	u32 r_q_head = l_ptr->retransm_queue_head;
1189 
1190 	/* Step to position where retransmission failed, if any,    */
1191 	/* consider that buffers may have been released in meantime */
1192 	if (r_q_size && buf) {
1193 		u32 last = lesser(mod(r_q_head + r_q_size),
1194 				  link_last_sent(l_ptr));
1195 		u32 first = buf_seqno(buf);
1196 
1197 		while (buf && less(first, r_q_head)) {
1198 			first = mod(first + 1);
1199 			buf = buf->next;
1200 		}
1201 		l_ptr->retransm_queue_head = r_q_head = first;
1202 		l_ptr->retransm_queue_size = r_q_size = mod(last - first);
1203 	}
1204 
1205 	/* Continue retransmission now, if there is anything: */
1206 	if (r_q_size && buf) {
1207 		msg_set_ack(buf_msg(buf), mod(l_ptr->next_in_no - 1));
1208 		msg_set_bcast_ack(buf_msg(buf), l_ptr->owner->bclink.last_in);
1209 		tipc_bearer_send(l_ptr->bearer_id, buf, &l_ptr->media_addr);
1210 		l_ptr->retransm_queue_head = mod(++r_q_head);
1211 		l_ptr->retransm_queue_size = --r_q_size;
1212 		l_ptr->stats.retransmitted++;
1213 		return 0;
1214 	}
1215 
1216 	/* Send deferred protocol message, if any: */
1217 	buf = l_ptr->proto_msg_queue;
1218 	if (buf) {
1219 		msg_set_ack(buf_msg(buf), mod(l_ptr->next_in_no - 1));
1220 		msg_set_bcast_ack(buf_msg(buf), l_ptr->owner->bclink.last_in);
1221 		tipc_bearer_send(l_ptr->bearer_id, buf, &l_ptr->media_addr);
1222 		l_ptr->unacked_window = 0;
1223 		kfree_skb(buf);
1224 		l_ptr->proto_msg_queue = NULL;
1225 		return 0;
1226 	}
1227 
1228 	/* Send one deferred data message, if send window not full: */
1229 	buf = l_ptr->next_out;
1230 	if (buf) {
1231 		struct tipc_msg *msg = buf_msg(buf);
1232 		u32 next = msg_seqno(msg);
1233 		u32 first = buf_seqno(l_ptr->first_out);
1234 
1235 		if (mod(next - first) < l_ptr->queue_limit[0]) {
1236 			msg_set_ack(msg, mod(l_ptr->next_in_no - 1));
1237 			msg_set_bcast_ack(msg, l_ptr->owner->bclink.last_in);
1238 			tipc_bearer_send(l_ptr->bearer_id, buf,
1239 					 &l_ptr->media_addr);
1240 			if (msg_user(msg) == MSG_BUNDLER)
1241 				msg_set_type(msg, CLOSED_MSG);
1242 			l_ptr->next_out = buf->next;
1243 			return 0;
1244 		}
1245 	}
1246 	return 1;
1247 }
1248 
1249 /*
1250  * push_queue(): push out the unsent messages of a link where
1251  *               congestion has abated. Node is locked
1252  */
1253 void tipc_link_push_queue(struct tipc_link *l_ptr)
1254 {
1255 	u32 res;
1256 
1257 	do {
1258 		res = tipc_link_push_packet(l_ptr);
1259 	} while (!res);
1260 }
1261 
1262 void tipc_link_reset_all(struct tipc_node *node)
1263 {
1264 	char addr_string[16];
1265 	u32 i;
1266 
1267 	tipc_node_lock(node);
1268 
1269 	pr_warn("Resetting all links to %s\n",
1270 		tipc_addr_string_fill(addr_string, node->addr));
1271 
1272 	for (i = 0; i < MAX_BEARERS; i++) {
1273 		if (node->links[i]) {
1274 			link_print(node->links[i], "Resetting link\n");
1275 			tipc_link_reset(node->links[i]);
1276 		}
1277 	}
1278 
1279 	tipc_node_unlock(node);
1280 }
1281 
1282 static void link_retransmit_failure(struct tipc_link *l_ptr,
1283 				    struct sk_buff *buf)
1284 {
1285 	struct tipc_msg *msg = buf_msg(buf);
1286 
1287 	pr_warn("Retransmission failure on link <%s>\n", l_ptr->name);
1288 
1289 	if (l_ptr->addr) {
1290 		/* Handle failure on standard link */
1291 		link_print(l_ptr, "Resetting link\n");
1292 		tipc_link_reset(l_ptr);
1293 
1294 	} else {
1295 		/* Handle failure on broadcast link */
1296 		struct tipc_node *n_ptr;
1297 		char addr_string[16];
1298 
1299 		pr_info("Msg seq number: %u,  ", msg_seqno(msg));
1300 		pr_cont("Outstanding acks: %lu\n",
1301 			(unsigned long) TIPC_SKB_CB(buf)->handle);
1302 
1303 		n_ptr = tipc_bclink_retransmit_to();
1304 		tipc_node_lock(n_ptr);
1305 
1306 		tipc_addr_string_fill(addr_string, n_ptr->addr);
1307 		pr_info("Broadcast link info for %s\n", addr_string);
1308 		pr_info("Reception permitted: %d,  Acked: %u\n",
1309 			n_ptr->bclink.recv_permitted,
1310 			n_ptr->bclink.acked);
1311 		pr_info("Last in: %u,  Oos state: %u,  Last sent: %u\n",
1312 			n_ptr->bclink.last_in,
1313 			n_ptr->bclink.oos_state,
1314 			n_ptr->bclink.last_sent);
1315 
1316 		tipc_node_unlock(n_ptr);
1317 
1318 		tipc_bclink_set_flags(TIPC_BCLINK_RESET);
1319 		l_ptr->stale_count = 0;
1320 	}
1321 }
1322 
1323 void tipc_link_retransmit(struct tipc_link *l_ptr, struct sk_buff *buf,
1324 			  u32 retransmits)
1325 {
1326 	struct tipc_msg *msg;
1327 
1328 	if (!buf)
1329 		return;
1330 
1331 	msg = buf_msg(buf);
1332 
1333 	/* Detect repeated retransmit failures */
1334 	if (l_ptr->last_retransmitted == msg_seqno(msg)) {
1335 		if (++l_ptr->stale_count > 100) {
1336 			link_retransmit_failure(l_ptr, buf);
1337 			return;
1338 		}
1339 	} else {
1340 		l_ptr->last_retransmitted = msg_seqno(msg);
1341 		l_ptr->stale_count = 1;
1342 	}
1343 
1344 	while (retransmits && (buf != l_ptr->next_out) && buf) {
1345 		msg = buf_msg(buf);
1346 		msg_set_ack(msg, mod(l_ptr->next_in_no - 1));
1347 		msg_set_bcast_ack(msg, l_ptr->owner->bclink.last_in);
1348 		tipc_bearer_send(l_ptr->bearer_id, buf, &l_ptr->media_addr);
1349 		buf = buf->next;
1350 		retransmits--;
1351 		l_ptr->stats.retransmitted++;
1352 	}
1353 
1354 	l_ptr->retransm_queue_head = l_ptr->retransm_queue_size = 0;
1355 }
1356 
1357 /**
1358  * link_insert_deferred_queue - insert deferred messages back into receive chain
1359  */
1360 static struct sk_buff *link_insert_deferred_queue(struct tipc_link *l_ptr,
1361 						  struct sk_buff *buf)
1362 {
1363 	u32 seq_no;
1364 
1365 	if (l_ptr->oldest_deferred_in == NULL)
1366 		return buf;
1367 
1368 	seq_no = buf_seqno(l_ptr->oldest_deferred_in);
1369 	if (seq_no == mod(l_ptr->next_in_no)) {
1370 		l_ptr->newest_deferred_in->next = buf;
1371 		buf = l_ptr->oldest_deferred_in;
1372 		l_ptr->oldest_deferred_in = NULL;
1373 		l_ptr->deferred_inqueue_sz = 0;
1374 	}
1375 	return buf;
1376 }
1377 
1378 /**
1379  * link_recv_buf_validate - validate basic format of received message
1380  *
1381  * This routine ensures a TIPC message has an acceptable header, and at least
1382  * as much data as the header indicates it should.  The routine also ensures
1383  * that the entire message header is stored in the main fragment of the message
1384  * buffer, to simplify future access to message header fields.
1385  *
1386  * Note: Having extra info present in the message header or data areas is OK.
1387  * TIPC will ignore the excess, under the assumption that it is optional info
1388  * introduced by a later release of the protocol.
1389  */
1390 static int link_recv_buf_validate(struct sk_buff *buf)
1391 {
1392 	static u32 min_data_hdr_size[8] = {
1393 		SHORT_H_SIZE, MCAST_H_SIZE, NAMED_H_SIZE, BASIC_H_SIZE,
1394 		MAX_H_SIZE, MAX_H_SIZE, MAX_H_SIZE, MAX_H_SIZE
1395 		};
1396 
1397 	struct tipc_msg *msg;
1398 	u32 tipc_hdr[2];
1399 	u32 size;
1400 	u32 hdr_size;
1401 	u32 min_hdr_size;
1402 
1403 	/* If this packet comes from the defer queue, the skb has already
1404 	 * been validated
1405 	 */
1406 	if (unlikely(TIPC_SKB_CB(buf)->deferred))
1407 		return 1;
1408 
1409 	if (unlikely(buf->len < MIN_H_SIZE))
1410 		return 0;
1411 
1412 	msg = skb_header_pointer(buf, 0, sizeof(tipc_hdr), tipc_hdr);
1413 	if (msg == NULL)
1414 		return 0;
1415 
1416 	if (unlikely(msg_version(msg) != TIPC_VERSION))
1417 		return 0;
1418 
1419 	size = msg_size(msg);
1420 	hdr_size = msg_hdr_sz(msg);
1421 	min_hdr_size = msg_isdata(msg) ?
1422 		min_data_hdr_size[msg_type(msg)] : INT_H_SIZE;
1423 
1424 	if (unlikely((hdr_size < min_hdr_size) ||
1425 		     (size < hdr_size) ||
1426 		     (buf->len < size) ||
1427 		     (size - hdr_size > TIPC_MAX_USER_MSG_SIZE)))
1428 		return 0;
1429 
1430 	return pskb_may_pull(buf, hdr_size);
1431 }
1432 
1433 /**
1434  * tipc_rcv - process TIPC packets/messages arriving from off-node
1435  * @head: pointer to message buffer chain
1436  * @b_ptr: pointer to bearer message arrived on
1437  *
1438  * Invoked with no locks held.  Bearer pointer must point to a valid bearer
1439  * structure (i.e. cannot be NULL), but bearer can be inactive.
1440  */
1441 void tipc_rcv(struct sk_buff *head, struct tipc_bearer *b_ptr)
1442 {
1443 	while (head) {
1444 		struct tipc_node *n_ptr;
1445 		struct tipc_link *l_ptr;
1446 		struct sk_buff *crs;
1447 		struct sk_buff *buf = head;
1448 		struct tipc_msg *msg;
1449 		u32 seq_no;
1450 		u32 ackd;
1451 		u32 released = 0;
1452 
1453 		head = head->next;
1454 		buf->next = NULL;
1455 
1456 		/* Ensure message is well-formed */
1457 		if (unlikely(!link_recv_buf_validate(buf)))
1458 			goto discard;
1459 
1460 		/* Ensure message data is a single contiguous unit */
1461 		if (unlikely(skb_linearize(buf)))
1462 			goto discard;
1463 
1464 		/* Handle arrival of a non-unicast link message */
1465 		msg = buf_msg(buf);
1466 
1467 		if (unlikely(msg_non_seq(msg))) {
1468 			if (msg_user(msg) ==  LINK_CONFIG)
1469 				tipc_disc_rcv(buf, b_ptr);
1470 			else
1471 				tipc_bclink_rcv(buf);
1472 			continue;
1473 		}
1474 
1475 		/* Discard unicast link messages destined for another node */
1476 		if (unlikely(!msg_short(msg) &&
1477 			     (msg_destnode(msg) != tipc_own_addr)))
1478 			goto discard;
1479 
1480 		/* Locate neighboring node that sent message */
1481 		n_ptr = tipc_node_find(msg_prevnode(msg));
1482 		if (unlikely(!n_ptr))
1483 			goto discard;
1484 		tipc_node_lock(n_ptr);
1485 
1486 		/* Locate unicast link endpoint that should handle message */
1487 		l_ptr = n_ptr->links[b_ptr->identity];
1488 		if (unlikely(!l_ptr))
1489 			goto unlock_discard;
1490 
1491 		/* Verify that communication with node is currently allowed */
1492 		if ((n_ptr->action_flags & TIPC_WAIT_PEER_LINKS_DOWN) &&
1493 		    msg_user(msg) == LINK_PROTOCOL &&
1494 		    (msg_type(msg) == RESET_MSG ||
1495 		    msg_type(msg) == ACTIVATE_MSG) &&
1496 		    !msg_redundant_link(msg))
1497 			n_ptr->action_flags &= ~TIPC_WAIT_PEER_LINKS_DOWN;
1498 
1499 		if (tipc_node_blocked(n_ptr))
1500 			goto unlock_discard;
1501 
1502 		/* Validate message sequence number info */
1503 		seq_no = msg_seqno(msg);
1504 		ackd = msg_ack(msg);
1505 
1506 		/* Release acked messages */
1507 		if (n_ptr->bclink.recv_permitted)
1508 			tipc_bclink_acknowledge(n_ptr, msg_bcast_ack(msg));
1509 
1510 		crs = l_ptr->first_out;
1511 		while ((crs != l_ptr->next_out) &&
1512 		       less_eq(buf_seqno(crs), ackd)) {
1513 			struct sk_buff *next = crs->next;
1514 			kfree_skb(crs);
1515 			crs = next;
1516 			released++;
1517 		}
1518 		if (released) {
1519 			l_ptr->first_out = crs;
1520 			l_ptr->out_queue_size -= released;
1521 		}
1522 
1523 		/* Try sending any messages link endpoint has pending */
1524 		if (unlikely(l_ptr->next_out))
1525 			tipc_link_push_queue(l_ptr);
1526 
1527 		if (unlikely(!list_empty(&l_ptr->waiting_ports)))
1528 			tipc_link_wakeup_ports(l_ptr, 0);
1529 
1530 		if (unlikely(++l_ptr->unacked_window >= TIPC_MIN_LINK_WIN)) {
1531 			l_ptr->stats.sent_acks++;
1532 			tipc_link_proto_xmit(l_ptr, STATE_MSG, 0, 0, 0, 0, 0);
1533 		}
1534 
1535 		/* Process the incoming packet */
1536 		if (unlikely(!link_working_working(l_ptr))) {
1537 			if (msg_user(msg) == LINK_PROTOCOL) {
1538 				tipc_link_proto_rcv(l_ptr, buf);
1539 				head = link_insert_deferred_queue(l_ptr, head);
1540 				tipc_node_unlock(n_ptr);
1541 				continue;
1542 			}
1543 
1544 			/* Traffic message. Conditionally activate link */
1545 			link_state_event(l_ptr, TRAFFIC_MSG_EVT);
1546 
1547 			if (link_working_working(l_ptr)) {
1548 				/* Re-insert buffer in front of queue */
1549 				buf->next = head;
1550 				head = buf;
1551 				tipc_node_unlock(n_ptr);
1552 				continue;
1553 			}
1554 			goto unlock_discard;
1555 		}
1556 
1557 		/* Link is now in state WORKING_WORKING */
1558 		if (unlikely(seq_no != mod(l_ptr->next_in_no))) {
1559 			link_handle_out_of_seq_msg(l_ptr, buf);
1560 			head = link_insert_deferred_queue(l_ptr, head);
1561 			tipc_node_unlock(n_ptr);
1562 			continue;
1563 		}
1564 		l_ptr->next_in_no++;
1565 		if (unlikely(l_ptr->oldest_deferred_in))
1566 			head = link_insert_deferred_queue(l_ptr, head);
1567 
1568 		/* Deliver packet/message to correct user: */
1569 		if (unlikely(msg_user(msg) ==  CHANGEOVER_PROTOCOL)) {
1570 			if (!tipc_link_tunnel_rcv(n_ptr, &buf)) {
1571 				tipc_node_unlock(n_ptr);
1572 				continue;
1573 			}
1574 			msg = buf_msg(buf);
1575 		} else if (msg_user(msg) == MSG_FRAGMENTER) {
1576 			int rc;
1577 
1578 			l_ptr->stats.recv_fragments++;
1579 			rc = tipc_link_frag_rcv(&l_ptr->reasm_head,
1580 						&l_ptr->reasm_tail,
1581 						&buf);
1582 			if (rc == LINK_REASM_COMPLETE) {
1583 				l_ptr->stats.recv_fragmented++;
1584 				msg = buf_msg(buf);
1585 			} else {
1586 				if (rc == LINK_REASM_ERROR)
1587 					tipc_link_reset(l_ptr);
1588 				tipc_node_unlock(n_ptr);
1589 				continue;
1590 			}
1591 		}
1592 
1593 		switch (msg_user(msg)) {
1594 		case TIPC_LOW_IMPORTANCE:
1595 		case TIPC_MEDIUM_IMPORTANCE:
1596 		case TIPC_HIGH_IMPORTANCE:
1597 		case TIPC_CRITICAL_IMPORTANCE:
1598 			tipc_node_unlock(n_ptr);
1599 			tipc_port_rcv(buf);
1600 			continue;
1601 		case MSG_BUNDLER:
1602 			l_ptr->stats.recv_bundles++;
1603 			l_ptr->stats.recv_bundled += msg_msgcnt(msg);
1604 			tipc_node_unlock(n_ptr);
1605 			tipc_link_bundle_rcv(buf);
1606 			continue;
1607 		case NAME_DISTRIBUTOR:
1608 			n_ptr->bclink.recv_permitted = true;
1609 			tipc_node_unlock(n_ptr);
1610 			tipc_named_rcv(buf);
1611 			continue;
1612 		case CONN_MANAGER:
1613 			tipc_node_unlock(n_ptr);
1614 			tipc_port_proto_rcv(buf);
1615 			continue;
1616 		case BCAST_PROTOCOL:
1617 			tipc_link_sync_rcv(n_ptr, buf);
1618 			break;
1619 		default:
1620 			kfree_skb(buf);
1621 			break;
1622 		}
1623 		tipc_node_unlock(n_ptr);
1624 		continue;
1625 unlock_discard:
1626 		tipc_node_unlock(n_ptr);
1627 discard:
1628 		kfree_skb(buf);
1629 	}
1630 }
1631 
1632 /**
1633  * tipc_link_defer_pkt - Add out-of-sequence message to deferred reception queue
1634  *
1635  * Returns increase in queue length (i.e. 0 or 1)
1636  */
1637 u32 tipc_link_defer_pkt(struct sk_buff **head, struct sk_buff **tail,
1638 			struct sk_buff *buf)
1639 {
1640 	struct sk_buff *queue_buf;
1641 	struct sk_buff **prev;
1642 	u32 seq_no = buf_seqno(buf);
1643 
1644 	buf->next = NULL;
1645 
1646 	/* Empty queue ? */
1647 	if (*head == NULL) {
1648 		*head = *tail = buf;
1649 		return 1;
1650 	}
1651 
1652 	/* Last ? */
1653 	if (less(buf_seqno(*tail), seq_no)) {
1654 		(*tail)->next = buf;
1655 		*tail = buf;
1656 		return 1;
1657 	}
1658 
1659 	/* Locate insertion point in queue, then insert; discard if duplicate */
1660 	prev = head;
1661 	queue_buf = *head;
1662 	for (;;) {
1663 		u32 curr_seqno = buf_seqno(queue_buf);
1664 
1665 		if (seq_no == curr_seqno) {
1666 			kfree_skb(buf);
1667 			return 0;
1668 		}
1669 
1670 		if (less(seq_no, curr_seqno))
1671 			break;
1672 
1673 		prev = &queue_buf->next;
1674 		queue_buf = queue_buf->next;
1675 	}
1676 
1677 	buf->next = queue_buf;
1678 	*prev = buf;
1679 	return 1;
1680 }
1681 
1682 /*
1683  * link_handle_out_of_seq_msg - handle arrival of out-of-sequence packet
1684  */
1685 static void link_handle_out_of_seq_msg(struct tipc_link *l_ptr,
1686 				       struct sk_buff *buf)
1687 {
1688 	u32 seq_no = buf_seqno(buf);
1689 
1690 	if (likely(msg_user(buf_msg(buf)) == LINK_PROTOCOL)) {
1691 		tipc_link_proto_rcv(l_ptr, buf);
1692 		return;
1693 	}
1694 
1695 	/* Record OOS packet arrival (force mismatch on next timeout) */
1696 	l_ptr->checkpoint--;
1697 
1698 	/*
1699 	 * Discard packet if a duplicate; otherwise add it to deferred queue
1700 	 * and notify peer of gap as per protocol specification
1701 	 */
1702 	if (less(seq_no, mod(l_ptr->next_in_no))) {
1703 		l_ptr->stats.duplicates++;
1704 		kfree_skb(buf);
1705 		return;
1706 	}
1707 
1708 	if (tipc_link_defer_pkt(&l_ptr->oldest_deferred_in,
1709 				&l_ptr->newest_deferred_in, buf)) {
1710 		l_ptr->deferred_inqueue_sz++;
1711 		l_ptr->stats.deferred_recv++;
1712 		TIPC_SKB_CB(buf)->deferred = true;
1713 		if ((l_ptr->deferred_inqueue_sz % 16) == 1)
1714 			tipc_link_proto_xmit(l_ptr, STATE_MSG, 0, 0, 0, 0, 0);
1715 	} else
1716 		l_ptr->stats.duplicates++;
1717 }
1718 
1719 /*
1720  * Send protocol message to the other endpoint.
1721  */
1722 void tipc_link_proto_xmit(struct tipc_link *l_ptr, u32 msg_typ, int probe_msg,
1723 			  u32 gap, u32 tolerance, u32 priority, u32 ack_mtu)
1724 {
1725 	struct sk_buff *buf = NULL;
1726 	struct tipc_msg *msg = l_ptr->pmsg;
1727 	u32 msg_size = sizeof(l_ptr->proto_msg);
1728 	int r_flag;
1729 
1730 	/* Discard any previous message that was deferred due to congestion */
1731 	if (l_ptr->proto_msg_queue) {
1732 		kfree_skb(l_ptr->proto_msg_queue);
1733 		l_ptr->proto_msg_queue = NULL;
1734 	}
1735 
1736 	/* Don't send protocol message during link changeover */
1737 	if (l_ptr->exp_msg_count)
1738 		return;
1739 
1740 	/* Abort non-RESET send if communication with node is prohibited */
1741 	if ((tipc_node_blocked(l_ptr->owner)) && (msg_typ != RESET_MSG))
1742 		return;
1743 
1744 	/* Create protocol message with "out-of-sequence" sequence number */
1745 	msg_set_type(msg, msg_typ);
1746 	msg_set_net_plane(msg, l_ptr->net_plane);
1747 	msg_set_bcast_ack(msg, l_ptr->owner->bclink.last_in);
1748 	msg_set_last_bcast(msg, tipc_bclink_get_last_sent());
1749 
1750 	if (msg_typ == STATE_MSG) {
1751 		u32 next_sent = mod(l_ptr->next_out_no);
1752 
1753 		if (!tipc_link_is_up(l_ptr))
1754 			return;
1755 		if (l_ptr->next_out)
1756 			next_sent = buf_seqno(l_ptr->next_out);
1757 		msg_set_next_sent(msg, next_sent);
1758 		if (l_ptr->oldest_deferred_in) {
1759 			u32 rec = buf_seqno(l_ptr->oldest_deferred_in);
1760 			gap = mod(rec - mod(l_ptr->next_in_no));
1761 		}
1762 		msg_set_seq_gap(msg, gap);
1763 		if (gap)
1764 			l_ptr->stats.sent_nacks++;
1765 		msg_set_link_tolerance(msg, tolerance);
1766 		msg_set_linkprio(msg, priority);
1767 		msg_set_max_pkt(msg, ack_mtu);
1768 		msg_set_ack(msg, mod(l_ptr->next_in_no - 1));
1769 		msg_set_probe(msg, probe_msg != 0);
1770 		if (probe_msg) {
1771 			u32 mtu = l_ptr->max_pkt;
1772 
1773 			if ((mtu < l_ptr->max_pkt_target) &&
1774 			    link_working_working(l_ptr) &&
1775 			    l_ptr->fsm_msg_cnt) {
1776 				msg_size = (mtu + (l_ptr->max_pkt_target - mtu)/2 + 2) & ~3;
1777 				if (l_ptr->max_pkt_probes == 10) {
1778 					l_ptr->max_pkt_target = (msg_size - 4);
1779 					l_ptr->max_pkt_probes = 0;
1780 					msg_size = (mtu + (l_ptr->max_pkt_target - mtu)/2 + 2) & ~3;
1781 				}
1782 				l_ptr->max_pkt_probes++;
1783 			}
1784 
1785 			l_ptr->stats.sent_probes++;
1786 		}
1787 		l_ptr->stats.sent_states++;
1788 	} else {		/* RESET_MSG or ACTIVATE_MSG */
1789 		msg_set_ack(msg, mod(l_ptr->reset_checkpoint - 1));
1790 		msg_set_seq_gap(msg, 0);
1791 		msg_set_next_sent(msg, 1);
1792 		msg_set_probe(msg, 0);
1793 		msg_set_link_tolerance(msg, l_ptr->tolerance);
1794 		msg_set_linkprio(msg, l_ptr->priority);
1795 		msg_set_max_pkt(msg, l_ptr->max_pkt_target);
1796 	}
1797 
1798 	r_flag = (l_ptr->owner->working_links > tipc_link_is_up(l_ptr));
1799 	msg_set_redundant_link(msg, r_flag);
1800 	msg_set_linkprio(msg, l_ptr->priority);
1801 	msg_set_size(msg, msg_size);
1802 
1803 	msg_set_seqno(msg, mod(l_ptr->next_out_no + (0xffff/2)));
1804 
1805 	buf = tipc_buf_acquire(msg_size);
1806 	if (!buf)
1807 		return;
1808 
1809 	skb_copy_to_linear_data(buf, msg, sizeof(l_ptr->proto_msg));
1810 	buf->priority = TC_PRIO_CONTROL;
1811 
1812 	tipc_bearer_send(l_ptr->bearer_id, buf, &l_ptr->media_addr);
1813 	l_ptr->unacked_window = 0;
1814 	kfree_skb(buf);
1815 }
1816 
1817 /*
1818  * Receive protocol message :
1819  * Note that network plane id propagates through the network, and may
1820  * change at any time. The node with lowest address rules
1821  */
1822 static void tipc_link_proto_rcv(struct tipc_link *l_ptr, struct sk_buff *buf)
1823 {
1824 	u32 rec_gap = 0;
1825 	u32 max_pkt_info;
1826 	u32 max_pkt_ack;
1827 	u32 msg_tol;
1828 	struct tipc_msg *msg = buf_msg(buf);
1829 
1830 	/* Discard protocol message during link changeover */
1831 	if (l_ptr->exp_msg_count)
1832 		goto exit;
1833 
1834 	/* record unnumbered packet arrival (force mismatch on next timeout) */
1835 	l_ptr->checkpoint--;
1836 
1837 	if (l_ptr->net_plane != msg_net_plane(msg))
1838 		if (tipc_own_addr > msg_prevnode(msg))
1839 			l_ptr->net_plane = msg_net_plane(msg);
1840 
1841 	switch (msg_type(msg)) {
1842 
1843 	case RESET_MSG:
1844 		if (!link_working_unknown(l_ptr) &&
1845 		    (l_ptr->peer_session != INVALID_SESSION)) {
1846 			if (less_eq(msg_session(msg), l_ptr->peer_session))
1847 				break; /* duplicate or old reset: ignore */
1848 		}
1849 
1850 		if (!msg_redundant_link(msg) && (link_working_working(l_ptr) ||
1851 				link_working_unknown(l_ptr))) {
1852 			/*
1853 			 * peer has lost contact -- don't allow peer's links
1854 			 * to reactivate before we recognize loss & clean up
1855 			 */
1856 			l_ptr->owner->action_flags |= TIPC_WAIT_OWN_LINKS_DOWN;
1857 		}
1858 
1859 		link_state_event(l_ptr, RESET_MSG);
1860 
1861 		/* fall thru' */
1862 	case ACTIVATE_MSG:
1863 		/* Update link settings according other endpoint's values */
1864 		strcpy((strrchr(l_ptr->name, ':') + 1), (char *)msg_data(msg));
1865 
1866 		msg_tol = msg_link_tolerance(msg);
1867 		if (msg_tol > l_ptr->tolerance)
1868 			link_set_supervision_props(l_ptr, msg_tol);
1869 
1870 		if (msg_linkprio(msg) > l_ptr->priority)
1871 			l_ptr->priority = msg_linkprio(msg);
1872 
1873 		max_pkt_info = msg_max_pkt(msg);
1874 		if (max_pkt_info) {
1875 			if (max_pkt_info < l_ptr->max_pkt_target)
1876 				l_ptr->max_pkt_target = max_pkt_info;
1877 			if (l_ptr->max_pkt > l_ptr->max_pkt_target)
1878 				l_ptr->max_pkt = l_ptr->max_pkt_target;
1879 		} else {
1880 			l_ptr->max_pkt = l_ptr->max_pkt_target;
1881 		}
1882 
1883 		/* Synchronize broadcast link info, if not done previously */
1884 		if (!tipc_node_is_up(l_ptr->owner)) {
1885 			l_ptr->owner->bclink.last_sent =
1886 				l_ptr->owner->bclink.last_in =
1887 				msg_last_bcast(msg);
1888 			l_ptr->owner->bclink.oos_state = 0;
1889 		}
1890 
1891 		l_ptr->peer_session = msg_session(msg);
1892 		l_ptr->peer_bearer_id = msg_bearer_id(msg);
1893 
1894 		if (msg_type(msg) == ACTIVATE_MSG)
1895 			link_state_event(l_ptr, ACTIVATE_MSG);
1896 		break;
1897 	case STATE_MSG:
1898 
1899 		msg_tol = msg_link_tolerance(msg);
1900 		if (msg_tol)
1901 			link_set_supervision_props(l_ptr, msg_tol);
1902 
1903 		if (msg_linkprio(msg) &&
1904 		    (msg_linkprio(msg) != l_ptr->priority)) {
1905 			pr_warn("%s<%s>, priority change %u->%u\n",
1906 				link_rst_msg, l_ptr->name, l_ptr->priority,
1907 				msg_linkprio(msg));
1908 			l_ptr->priority = msg_linkprio(msg);
1909 			tipc_link_reset(l_ptr); /* Enforce change to take effect */
1910 			break;
1911 		}
1912 		link_state_event(l_ptr, TRAFFIC_MSG_EVT);
1913 		l_ptr->stats.recv_states++;
1914 		if (link_reset_unknown(l_ptr))
1915 			break;
1916 
1917 		if (less_eq(mod(l_ptr->next_in_no), msg_next_sent(msg))) {
1918 			rec_gap = mod(msg_next_sent(msg) -
1919 				      mod(l_ptr->next_in_no));
1920 		}
1921 
1922 		max_pkt_ack = msg_max_pkt(msg);
1923 		if (max_pkt_ack > l_ptr->max_pkt) {
1924 			l_ptr->max_pkt = max_pkt_ack;
1925 			l_ptr->max_pkt_probes = 0;
1926 		}
1927 
1928 		max_pkt_ack = 0;
1929 		if (msg_probe(msg)) {
1930 			l_ptr->stats.recv_probes++;
1931 			if (msg_size(msg) > sizeof(l_ptr->proto_msg))
1932 				max_pkt_ack = msg_size(msg);
1933 		}
1934 
1935 		/* Protocol message before retransmits, reduce loss risk */
1936 		if (l_ptr->owner->bclink.recv_permitted)
1937 			tipc_bclink_update_link_state(l_ptr->owner,
1938 						      msg_last_bcast(msg));
1939 
1940 		if (rec_gap || (msg_probe(msg))) {
1941 			tipc_link_proto_xmit(l_ptr, STATE_MSG, 0, rec_gap, 0,
1942 					     0, max_pkt_ack);
1943 		}
1944 		if (msg_seq_gap(msg)) {
1945 			l_ptr->stats.recv_nacks++;
1946 			tipc_link_retransmit(l_ptr, l_ptr->first_out,
1947 					     msg_seq_gap(msg));
1948 		}
1949 		break;
1950 	}
1951 exit:
1952 	kfree_skb(buf);
1953 }
1954 
1955 
1956 /* tipc_link_tunnel_xmit(): Tunnel one packet via a link belonging to
1957  * a different bearer. Owner node is locked.
1958  */
1959 static void tipc_link_tunnel_xmit(struct tipc_link *l_ptr,
1960 				  struct tipc_msg *tunnel_hdr,
1961 				  struct tipc_msg *msg,
1962 				  u32 selector)
1963 {
1964 	struct tipc_link *tunnel;
1965 	struct sk_buff *buf;
1966 	u32 length = msg_size(msg);
1967 
1968 	tunnel = l_ptr->owner->active_links[selector & 1];
1969 	if (!tipc_link_is_up(tunnel)) {
1970 		pr_warn("%stunnel link no longer available\n", link_co_err);
1971 		return;
1972 	}
1973 	msg_set_size(tunnel_hdr, length + INT_H_SIZE);
1974 	buf = tipc_buf_acquire(length + INT_H_SIZE);
1975 	if (!buf) {
1976 		pr_warn("%sunable to send tunnel msg\n", link_co_err);
1977 		return;
1978 	}
1979 	skb_copy_to_linear_data(buf, tunnel_hdr, INT_H_SIZE);
1980 	skb_copy_to_linear_data_offset(buf, INT_H_SIZE, msg, length);
1981 	__tipc_link_xmit(tunnel, buf);
1982 }
1983 
1984 
1985 /* tipc_link_failover_send_queue(): A link has gone down, but a second
1986  * link is still active. We can do failover. Tunnel the failing link's
1987  * whole send queue via the remaining link. This way, we don't lose
1988  * any packets, and sequence order is preserved for subsequent traffic
1989  * sent over the remaining link. Owner node is locked.
1990  */
1991 void tipc_link_failover_send_queue(struct tipc_link *l_ptr)
1992 {
1993 	u32 msgcount = l_ptr->out_queue_size;
1994 	struct sk_buff *crs = l_ptr->first_out;
1995 	struct tipc_link *tunnel = l_ptr->owner->active_links[0];
1996 	struct tipc_msg tunnel_hdr;
1997 	int split_bundles;
1998 
1999 	if (!tunnel)
2000 		return;
2001 
2002 	tipc_msg_init(&tunnel_hdr, CHANGEOVER_PROTOCOL,
2003 		 ORIGINAL_MSG, INT_H_SIZE, l_ptr->addr);
2004 	msg_set_bearer_id(&tunnel_hdr, l_ptr->peer_bearer_id);
2005 	msg_set_msgcnt(&tunnel_hdr, msgcount);
2006 
2007 	if (!l_ptr->first_out) {
2008 		struct sk_buff *buf;
2009 
2010 		buf = tipc_buf_acquire(INT_H_SIZE);
2011 		if (buf) {
2012 			skb_copy_to_linear_data(buf, &tunnel_hdr, INT_H_SIZE);
2013 			msg_set_size(&tunnel_hdr, INT_H_SIZE);
2014 			__tipc_link_xmit(tunnel, buf);
2015 		} else {
2016 			pr_warn("%sunable to send changeover msg\n",
2017 				link_co_err);
2018 		}
2019 		return;
2020 	}
2021 
2022 	split_bundles = (l_ptr->owner->active_links[0] !=
2023 			 l_ptr->owner->active_links[1]);
2024 
2025 	while (crs) {
2026 		struct tipc_msg *msg = buf_msg(crs);
2027 
2028 		if ((msg_user(msg) == MSG_BUNDLER) && split_bundles) {
2029 			struct tipc_msg *m = msg_get_wrapped(msg);
2030 			unchar *pos = (unchar *)m;
2031 
2032 			msgcount = msg_msgcnt(msg);
2033 			while (msgcount--) {
2034 				msg_set_seqno(m, msg_seqno(msg));
2035 				tipc_link_tunnel_xmit(l_ptr, &tunnel_hdr, m,
2036 						      msg_link_selector(m));
2037 				pos += align(msg_size(m));
2038 				m = (struct tipc_msg *)pos;
2039 			}
2040 		} else {
2041 			tipc_link_tunnel_xmit(l_ptr, &tunnel_hdr, msg,
2042 					      msg_link_selector(msg));
2043 		}
2044 		crs = crs->next;
2045 	}
2046 }
2047 
2048 /* tipc_link_dup_queue_xmit(): A second link has become active. Tunnel a
2049  * duplicate of the first link's send queue via the new link. This way, we
2050  * are guaranteed that currently queued packets from a socket are delivered
2051  * before future traffic from the same socket, even if this is using the
2052  * new link. The last arriving copy of each duplicate packet is dropped at
2053  * the receiving end by the regular protocol check, so packet cardinality
2054  * and sequence order is preserved per sender/receiver socket pair.
2055  * Owner node is locked.
2056  */
2057 void tipc_link_dup_queue_xmit(struct tipc_link *l_ptr,
2058 			      struct tipc_link *tunnel)
2059 {
2060 	struct sk_buff *iter;
2061 	struct tipc_msg tunnel_hdr;
2062 
2063 	tipc_msg_init(&tunnel_hdr, CHANGEOVER_PROTOCOL,
2064 		 DUPLICATE_MSG, INT_H_SIZE, l_ptr->addr);
2065 	msg_set_msgcnt(&tunnel_hdr, l_ptr->out_queue_size);
2066 	msg_set_bearer_id(&tunnel_hdr, l_ptr->peer_bearer_id);
2067 	iter = l_ptr->first_out;
2068 	while (iter) {
2069 		struct sk_buff *outbuf;
2070 		struct tipc_msg *msg = buf_msg(iter);
2071 		u32 length = msg_size(msg);
2072 
2073 		if (msg_user(msg) == MSG_BUNDLER)
2074 			msg_set_type(msg, CLOSED_MSG);
2075 		msg_set_ack(msg, mod(l_ptr->next_in_no - 1));	/* Update */
2076 		msg_set_bcast_ack(msg, l_ptr->owner->bclink.last_in);
2077 		msg_set_size(&tunnel_hdr, length + INT_H_SIZE);
2078 		outbuf = tipc_buf_acquire(length + INT_H_SIZE);
2079 		if (outbuf == NULL) {
2080 			pr_warn("%sunable to send duplicate msg\n",
2081 				link_co_err);
2082 			return;
2083 		}
2084 		skb_copy_to_linear_data(outbuf, &tunnel_hdr, INT_H_SIZE);
2085 		skb_copy_to_linear_data_offset(outbuf, INT_H_SIZE, iter->data,
2086 					       length);
2087 		__tipc_link_xmit(tunnel, outbuf);
2088 		if (!tipc_link_is_up(l_ptr))
2089 			return;
2090 		iter = iter->next;
2091 	}
2092 }
2093 
2094 /**
2095  * buf_extract - extracts embedded TIPC message from another message
2096  * @skb: encapsulating message buffer
2097  * @from_pos: offset to extract from
2098  *
2099  * Returns a new message buffer containing an embedded message.  The
2100  * encapsulating message itself is left unchanged.
2101  */
2102 static struct sk_buff *buf_extract(struct sk_buff *skb, u32 from_pos)
2103 {
2104 	struct tipc_msg *msg = (struct tipc_msg *)(skb->data + from_pos);
2105 	u32 size = msg_size(msg);
2106 	struct sk_buff *eb;
2107 
2108 	eb = tipc_buf_acquire(size);
2109 	if (eb)
2110 		skb_copy_to_linear_data(eb, msg, size);
2111 	return eb;
2112 }
2113 
2114 
2115 
2116 /* tipc_link_dup_rcv(): Receive a tunnelled DUPLICATE_MSG packet.
2117  * Owner node is locked.
2118  */
2119 static void tipc_link_dup_rcv(struct tipc_link *l_ptr,
2120 			      struct sk_buff *t_buf)
2121 {
2122 	struct sk_buff *buf;
2123 
2124 	if (!tipc_link_is_up(l_ptr))
2125 		return;
2126 
2127 	buf = buf_extract(t_buf, INT_H_SIZE);
2128 	if (buf == NULL) {
2129 		pr_warn("%sfailed to extract inner dup pkt\n", link_co_err);
2130 		return;
2131 	}
2132 
2133 	/* Add buffer to deferred queue, if applicable: */
2134 	link_handle_out_of_seq_msg(l_ptr, buf);
2135 }
2136 
2137 /*  tipc_link_failover_rcv(): Receive a tunnelled ORIGINAL_MSG packet
2138  *  Owner node is locked.
2139  */
2140 static struct sk_buff *tipc_link_failover_rcv(struct tipc_link *l_ptr,
2141 					      struct sk_buff *t_buf)
2142 {
2143 	struct tipc_msg *t_msg = buf_msg(t_buf);
2144 	struct sk_buff *buf = NULL;
2145 	struct tipc_msg *msg;
2146 
2147 	if (tipc_link_is_up(l_ptr))
2148 		tipc_link_reset(l_ptr);
2149 
2150 	/* First failover packet? */
2151 	if (l_ptr->exp_msg_count == START_CHANGEOVER)
2152 		l_ptr->exp_msg_count = msg_msgcnt(t_msg);
2153 
2154 	/* Should there be an inner packet? */
2155 	if (l_ptr->exp_msg_count) {
2156 		l_ptr->exp_msg_count--;
2157 		buf = buf_extract(t_buf, INT_H_SIZE);
2158 		if (buf == NULL) {
2159 			pr_warn("%sno inner failover pkt\n", link_co_err);
2160 			goto exit;
2161 		}
2162 		msg = buf_msg(buf);
2163 
2164 		if (less(msg_seqno(msg), l_ptr->reset_checkpoint)) {
2165 			kfree_skb(buf);
2166 			buf = NULL;
2167 			goto exit;
2168 		}
2169 		if (msg_user(msg) == MSG_FRAGMENTER) {
2170 			l_ptr->stats.recv_fragments++;
2171 			tipc_link_frag_rcv(&l_ptr->reasm_head,
2172 					   &l_ptr->reasm_tail,
2173 					   &buf);
2174 		}
2175 	}
2176 exit:
2177 	if ((l_ptr->exp_msg_count == 0) && (l_ptr->flags & LINK_STOPPED)) {
2178 		tipc_node_detach_link(l_ptr->owner, l_ptr);
2179 		kfree(l_ptr);
2180 	}
2181 	return buf;
2182 }
2183 
2184 /*  tipc_link_tunnel_rcv(): Receive a tunnelled packet, sent
2185  *  via other link as result of a failover (ORIGINAL_MSG) or
2186  *  a new active link (DUPLICATE_MSG). Failover packets are
2187  *  returned to the active link for delivery upwards.
2188  *  Owner node is locked.
2189  */
2190 static int tipc_link_tunnel_rcv(struct tipc_node *n_ptr,
2191 				struct sk_buff **buf)
2192 {
2193 	struct sk_buff *t_buf = *buf;
2194 	struct tipc_link *l_ptr;
2195 	struct tipc_msg *t_msg = buf_msg(t_buf);
2196 	u32 bearer_id = msg_bearer_id(t_msg);
2197 
2198 	*buf = NULL;
2199 
2200 	if (bearer_id >= MAX_BEARERS)
2201 		goto exit;
2202 
2203 	l_ptr = n_ptr->links[bearer_id];
2204 	if (!l_ptr)
2205 		goto exit;
2206 
2207 	if (msg_type(t_msg) == DUPLICATE_MSG)
2208 		tipc_link_dup_rcv(l_ptr, t_buf);
2209 	else if (msg_type(t_msg) == ORIGINAL_MSG)
2210 		*buf = tipc_link_failover_rcv(l_ptr, t_buf);
2211 	else
2212 		pr_warn("%sunknown tunnel pkt received\n", link_co_err);
2213 exit:
2214 	kfree_skb(t_buf);
2215 	return *buf != NULL;
2216 }
2217 
2218 /*
2219  *  Bundler functionality:
2220  */
2221 void tipc_link_bundle_rcv(struct sk_buff *buf)
2222 {
2223 	u32 msgcount = msg_msgcnt(buf_msg(buf));
2224 	u32 pos = INT_H_SIZE;
2225 	struct sk_buff *obuf;
2226 
2227 	while (msgcount--) {
2228 		obuf = buf_extract(buf, pos);
2229 		if (obuf == NULL) {
2230 			pr_warn("Link unable to unbundle message(s)\n");
2231 			break;
2232 		}
2233 		pos += align(msg_size(buf_msg(obuf)));
2234 		tipc_net_route_msg(obuf);
2235 	}
2236 	kfree_skb(buf);
2237 }
2238 
2239 /*
2240  *  Fragmentation/defragmentation:
2241  */
2242 
2243 /*
2244  * tipc_link_frag_xmit: Entry for buffers needing fragmentation.
2245  * The buffer is complete, inclusive total message length.
2246  * Returns user data length.
2247  */
2248 static int tipc_link_frag_xmit(struct tipc_link *l_ptr, struct sk_buff *buf)
2249 {
2250 	struct sk_buff *buf_chain = NULL;
2251 	struct sk_buff *buf_chain_tail = (struct sk_buff *)&buf_chain;
2252 	struct tipc_msg *inmsg = buf_msg(buf);
2253 	struct tipc_msg fragm_hdr;
2254 	u32 insize = msg_size(inmsg);
2255 	u32 dsz = msg_data_sz(inmsg);
2256 	unchar *crs = buf->data;
2257 	u32 rest = insize;
2258 	u32 pack_sz = l_ptr->max_pkt;
2259 	u32 fragm_sz = pack_sz - INT_H_SIZE;
2260 	u32 fragm_no = 0;
2261 	u32 destaddr;
2262 
2263 	if (msg_short(inmsg))
2264 		destaddr = l_ptr->addr;
2265 	else
2266 		destaddr = msg_destnode(inmsg);
2267 
2268 	/* Prepare reusable fragment header: */
2269 	tipc_msg_init(&fragm_hdr, MSG_FRAGMENTER, FIRST_FRAGMENT,
2270 		 INT_H_SIZE, destaddr);
2271 
2272 	/* Chop up message: */
2273 	while (rest > 0) {
2274 		struct sk_buff *fragm;
2275 
2276 		if (rest <= fragm_sz) {
2277 			fragm_sz = rest;
2278 			msg_set_type(&fragm_hdr, LAST_FRAGMENT);
2279 		}
2280 		fragm = tipc_buf_acquire(fragm_sz + INT_H_SIZE);
2281 		if (fragm == NULL) {
2282 			kfree_skb(buf);
2283 			kfree_skb_list(buf_chain);
2284 			return -ENOMEM;
2285 		}
2286 		msg_set_size(&fragm_hdr, fragm_sz + INT_H_SIZE);
2287 		fragm_no++;
2288 		msg_set_fragm_no(&fragm_hdr, fragm_no);
2289 		skb_copy_to_linear_data(fragm, &fragm_hdr, INT_H_SIZE);
2290 		skb_copy_to_linear_data_offset(fragm, INT_H_SIZE, crs,
2291 					       fragm_sz);
2292 		buf_chain_tail->next = fragm;
2293 		buf_chain_tail = fragm;
2294 
2295 		rest -= fragm_sz;
2296 		crs += fragm_sz;
2297 		msg_set_type(&fragm_hdr, FRAGMENT);
2298 	}
2299 	kfree_skb(buf);
2300 
2301 	/* Append chain of fragments to send queue & send them */
2302 	l_ptr->long_msg_seq_no++;
2303 	link_add_chain_to_outqueue(l_ptr, buf_chain, l_ptr->long_msg_seq_no);
2304 	l_ptr->stats.sent_fragments += fragm_no;
2305 	l_ptr->stats.sent_fragmented++;
2306 	tipc_link_push_queue(l_ptr);
2307 
2308 	return dsz;
2309 }
2310 
2311 /* tipc_link_frag_rcv(): Called with node lock on. Returns
2312  * the reassembled buffer if message is complete.
2313  */
2314 int tipc_link_frag_rcv(struct sk_buff **head, struct sk_buff **tail,
2315 		       struct sk_buff **fbuf)
2316 {
2317 	struct sk_buff *frag = *fbuf;
2318 	struct tipc_msg *msg = buf_msg(frag);
2319 	u32 fragid = msg_type(msg);
2320 	bool headstolen;
2321 	int delta;
2322 
2323 	skb_pull(frag, msg_hdr_sz(msg));
2324 	if (fragid == FIRST_FRAGMENT) {
2325 		if (*head || skb_unclone(frag, GFP_ATOMIC))
2326 			goto out_free;
2327 		*head = frag;
2328 		skb_frag_list_init(*head);
2329 		*fbuf = NULL;
2330 		return 0;
2331 	} else if (*head &&
2332 		   skb_try_coalesce(*head, frag, &headstolen, &delta)) {
2333 		kfree_skb_partial(frag, headstolen);
2334 	} else {
2335 		if (!*head)
2336 			goto out_free;
2337 		if (!skb_has_frag_list(*head))
2338 			skb_shinfo(*head)->frag_list = frag;
2339 		else
2340 			(*tail)->next = frag;
2341 		*tail = frag;
2342 		(*head)->truesize += frag->truesize;
2343 	}
2344 	if (fragid == LAST_FRAGMENT) {
2345 		*fbuf = *head;
2346 		*tail = *head = NULL;
2347 		return LINK_REASM_COMPLETE;
2348 	}
2349 	*fbuf = NULL;
2350 	return 0;
2351 out_free:
2352 	pr_warn_ratelimited("Link unable to reassemble fragmented message\n");
2353 	kfree_skb(*fbuf);
2354 	*fbuf = NULL;
2355 	return LINK_REASM_ERROR;
2356 }
2357 
2358 static void link_set_supervision_props(struct tipc_link *l_ptr, u32 tolerance)
2359 {
2360 	if ((tolerance < TIPC_MIN_LINK_TOL) || (tolerance > TIPC_MAX_LINK_TOL))
2361 		return;
2362 
2363 	l_ptr->tolerance = tolerance;
2364 	l_ptr->continuity_interval =
2365 		((tolerance / 4) > 500) ? 500 : tolerance / 4;
2366 	l_ptr->abort_limit = tolerance / (l_ptr->continuity_interval / 4);
2367 }
2368 
2369 void tipc_link_set_queue_limits(struct tipc_link *l_ptr, u32 window)
2370 {
2371 	/* Data messages from this node, inclusive FIRST_FRAGM */
2372 	l_ptr->queue_limit[TIPC_LOW_IMPORTANCE] = window;
2373 	l_ptr->queue_limit[TIPC_MEDIUM_IMPORTANCE] = (window / 3) * 4;
2374 	l_ptr->queue_limit[TIPC_HIGH_IMPORTANCE] = (window / 3) * 5;
2375 	l_ptr->queue_limit[TIPC_CRITICAL_IMPORTANCE] = (window / 3) * 6;
2376 	/* Transiting data messages,inclusive FIRST_FRAGM */
2377 	l_ptr->queue_limit[TIPC_LOW_IMPORTANCE + 4] = 300;
2378 	l_ptr->queue_limit[TIPC_MEDIUM_IMPORTANCE + 4] = 600;
2379 	l_ptr->queue_limit[TIPC_HIGH_IMPORTANCE + 4] = 900;
2380 	l_ptr->queue_limit[TIPC_CRITICAL_IMPORTANCE + 4] = 1200;
2381 	l_ptr->queue_limit[CONN_MANAGER] = 1200;
2382 	l_ptr->queue_limit[CHANGEOVER_PROTOCOL] = 2500;
2383 	l_ptr->queue_limit[NAME_DISTRIBUTOR] = 3000;
2384 	/* FRAGMENT and LAST_FRAGMENT packets */
2385 	l_ptr->queue_limit[MSG_FRAGMENTER] = 4000;
2386 }
2387 
2388 /* tipc_link_find_owner - locate owner node of link by link's name
2389  * @name: pointer to link name string
2390  * @bearer_id: pointer to index in 'node->links' array where the link was found.
2391  *
2392  * Returns pointer to node owning the link, or 0 if no matching link is found.
2393  */
2394 static struct tipc_node *tipc_link_find_owner(const char *link_name,
2395 					      unsigned int *bearer_id)
2396 {
2397 	struct tipc_link *l_ptr;
2398 	struct tipc_node *n_ptr;
2399 	struct tipc_node *found_node = 0;
2400 	int i;
2401 
2402 	*bearer_id = 0;
2403 	rcu_read_lock();
2404 	list_for_each_entry_rcu(n_ptr, &tipc_node_list, list) {
2405 		tipc_node_lock(n_ptr);
2406 		for (i = 0; i < MAX_BEARERS; i++) {
2407 			l_ptr = n_ptr->links[i];
2408 			if (l_ptr && !strcmp(l_ptr->name, link_name)) {
2409 				*bearer_id = i;
2410 				found_node = n_ptr;
2411 				break;
2412 			}
2413 		}
2414 		tipc_node_unlock(n_ptr);
2415 		if (found_node)
2416 			break;
2417 	}
2418 	rcu_read_unlock();
2419 
2420 	return found_node;
2421 }
2422 
2423 /**
2424  * link_value_is_valid -- validate proposed link tolerance/priority/window
2425  *
2426  * @cmd: value type (TIPC_CMD_SET_LINK_*)
2427  * @new_value: the new value
2428  *
2429  * Returns 1 if value is within range, 0 if not.
2430  */
2431 static int link_value_is_valid(u16 cmd, u32 new_value)
2432 {
2433 	switch (cmd) {
2434 	case TIPC_CMD_SET_LINK_TOL:
2435 		return (new_value >= TIPC_MIN_LINK_TOL) &&
2436 			(new_value <= TIPC_MAX_LINK_TOL);
2437 	case TIPC_CMD_SET_LINK_PRI:
2438 		return (new_value <= TIPC_MAX_LINK_PRI);
2439 	case TIPC_CMD_SET_LINK_WINDOW:
2440 		return (new_value >= TIPC_MIN_LINK_WIN) &&
2441 			(new_value <= TIPC_MAX_LINK_WIN);
2442 	}
2443 	return 0;
2444 }
2445 
2446 /**
2447  * link_cmd_set_value - change priority/tolerance/window for link/bearer/media
2448  * @name: ptr to link, bearer, or media name
2449  * @new_value: new value of link, bearer, or media setting
2450  * @cmd: which link, bearer, or media attribute to set (TIPC_CMD_SET_LINK_*)
2451  *
2452  * Caller must hold RTNL lock to ensure link/bearer/media is not deleted.
2453  *
2454  * Returns 0 if value updated and negative value on error.
2455  */
2456 static int link_cmd_set_value(const char *name, u32 new_value, u16 cmd)
2457 {
2458 	struct tipc_node *node;
2459 	struct tipc_link *l_ptr;
2460 	struct tipc_bearer *b_ptr;
2461 	struct tipc_media *m_ptr;
2462 	int bearer_id;
2463 	int res = 0;
2464 
2465 	node = tipc_link_find_owner(name, &bearer_id);
2466 	if (node) {
2467 		tipc_node_lock(node);
2468 		l_ptr = node->links[bearer_id];
2469 
2470 		if (l_ptr) {
2471 			switch (cmd) {
2472 			case TIPC_CMD_SET_LINK_TOL:
2473 				link_set_supervision_props(l_ptr, new_value);
2474 				tipc_link_proto_xmit(l_ptr, STATE_MSG, 0, 0,
2475 						     new_value, 0, 0);
2476 				break;
2477 			case TIPC_CMD_SET_LINK_PRI:
2478 				l_ptr->priority = new_value;
2479 				tipc_link_proto_xmit(l_ptr, STATE_MSG, 0, 0,
2480 						     0, new_value, 0);
2481 				break;
2482 			case TIPC_CMD_SET_LINK_WINDOW:
2483 				tipc_link_set_queue_limits(l_ptr, new_value);
2484 				break;
2485 			default:
2486 				res = -EINVAL;
2487 				break;
2488 			}
2489 		}
2490 		tipc_node_unlock(node);
2491 		return res;
2492 	}
2493 
2494 	b_ptr = tipc_bearer_find(name);
2495 	if (b_ptr) {
2496 		switch (cmd) {
2497 		case TIPC_CMD_SET_LINK_TOL:
2498 			b_ptr->tolerance = new_value;
2499 			break;
2500 		case TIPC_CMD_SET_LINK_PRI:
2501 			b_ptr->priority = new_value;
2502 			break;
2503 		case TIPC_CMD_SET_LINK_WINDOW:
2504 			b_ptr->window = new_value;
2505 			break;
2506 		default:
2507 			res = -EINVAL;
2508 			break;
2509 		}
2510 		return res;
2511 	}
2512 
2513 	m_ptr = tipc_media_find(name);
2514 	if (!m_ptr)
2515 		return -ENODEV;
2516 	switch (cmd) {
2517 	case TIPC_CMD_SET_LINK_TOL:
2518 		m_ptr->tolerance = new_value;
2519 		break;
2520 	case TIPC_CMD_SET_LINK_PRI:
2521 		m_ptr->priority = new_value;
2522 		break;
2523 	case TIPC_CMD_SET_LINK_WINDOW:
2524 		m_ptr->window = new_value;
2525 		break;
2526 	default:
2527 		res = -EINVAL;
2528 		break;
2529 	}
2530 	return res;
2531 }
2532 
2533 struct sk_buff *tipc_link_cmd_config(const void *req_tlv_area, int req_tlv_space,
2534 				     u16 cmd)
2535 {
2536 	struct tipc_link_config *args;
2537 	u32 new_value;
2538 	int res;
2539 
2540 	if (!TLV_CHECK(req_tlv_area, req_tlv_space, TIPC_TLV_LINK_CONFIG))
2541 		return tipc_cfg_reply_error_string(TIPC_CFG_TLV_ERROR);
2542 
2543 	args = (struct tipc_link_config *)TLV_DATA(req_tlv_area);
2544 	new_value = ntohl(args->value);
2545 
2546 	if (!link_value_is_valid(cmd, new_value))
2547 		return tipc_cfg_reply_error_string(
2548 			"cannot change, value invalid");
2549 
2550 	if (!strcmp(args->name, tipc_bclink_name)) {
2551 		if ((cmd == TIPC_CMD_SET_LINK_WINDOW) &&
2552 		    (tipc_bclink_set_queue_limits(new_value) == 0))
2553 			return tipc_cfg_reply_none();
2554 		return tipc_cfg_reply_error_string(TIPC_CFG_NOT_SUPPORTED
2555 						   " (cannot change setting on broadcast link)");
2556 	}
2557 
2558 	res = link_cmd_set_value(args->name, new_value, cmd);
2559 	if (res)
2560 		return tipc_cfg_reply_error_string("cannot change link setting");
2561 
2562 	return tipc_cfg_reply_none();
2563 }
2564 
2565 /**
2566  * link_reset_statistics - reset link statistics
2567  * @l_ptr: pointer to link
2568  */
2569 static void link_reset_statistics(struct tipc_link *l_ptr)
2570 {
2571 	memset(&l_ptr->stats, 0, sizeof(l_ptr->stats));
2572 	l_ptr->stats.sent_info = l_ptr->next_out_no;
2573 	l_ptr->stats.recv_info = l_ptr->next_in_no;
2574 }
2575 
2576 struct sk_buff *tipc_link_cmd_reset_stats(const void *req_tlv_area, int req_tlv_space)
2577 {
2578 	char *link_name;
2579 	struct tipc_link *l_ptr;
2580 	struct tipc_node *node;
2581 	unsigned int bearer_id;
2582 
2583 	if (!TLV_CHECK(req_tlv_area, req_tlv_space, TIPC_TLV_LINK_NAME))
2584 		return tipc_cfg_reply_error_string(TIPC_CFG_TLV_ERROR);
2585 
2586 	link_name = (char *)TLV_DATA(req_tlv_area);
2587 	if (!strcmp(link_name, tipc_bclink_name)) {
2588 		if (tipc_bclink_reset_stats())
2589 			return tipc_cfg_reply_error_string("link not found");
2590 		return tipc_cfg_reply_none();
2591 	}
2592 	node = tipc_link_find_owner(link_name, &bearer_id);
2593 	if (!node)
2594 		return tipc_cfg_reply_error_string("link not found");
2595 
2596 	tipc_node_lock(node);
2597 	l_ptr = node->links[bearer_id];
2598 	if (!l_ptr) {
2599 		tipc_node_unlock(node);
2600 		return tipc_cfg_reply_error_string("link not found");
2601 	}
2602 	link_reset_statistics(l_ptr);
2603 	tipc_node_unlock(node);
2604 	return tipc_cfg_reply_none();
2605 }
2606 
2607 /**
2608  * percent - convert count to a percentage of total (rounding up or down)
2609  */
2610 static u32 percent(u32 count, u32 total)
2611 {
2612 	return (count * 100 + (total / 2)) / total;
2613 }
2614 
2615 /**
2616  * tipc_link_stats - print link statistics
2617  * @name: link name
2618  * @buf: print buffer area
2619  * @buf_size: size of print buffer area
2620  *
2621  * Returns length of print buffer data string (or 0 if error)
2622  */
2623 static int tipc_link_stats(const char *name, char *buf, const u32 buf_size)
2624 {
2625 	struct tipc_link *l;
2626 	struct tipc_stats *s;
2627 	struct tipc_node *node;
2628 	char *status;
2629 	u32 profile_total = 0;
2630 	unsigned int bearer_id;
2631 	int ret;
2632 
2633 	if (!strcmp(name, tipc_bclink_name))
2634 		return tipc_bclink_stats(buf, buf_size);
2635 
2636 	node = tipc_link_find_owner(name, &bearer_id);
2637 	if (!node)
2638 		return 0;
2639 
2640 	tipc_node_lock(node);
2641 
2642 	l = node->links[bearer_id];
2643 	if (!l) {
2644 		tipc_node_unlock(node);
2645 		return 0;
2646 	}
2647 
2648 	s = &l->stats;
2649 
2650 	if (tipc_link_is_active(l))
2651 		status = "ACTIVE";
2652 	else if (tipc_link_is_up(l))
2653 		status = "STANDBY";
2654 	else
2655 		status = "DEFUNCT";
2656 
2657 	ret = tipc_snprintf(buf, buf_size, "Link <%s>\n"
2658 			    "  %s  MTU:%u  Priority:%u  Tolerance:%u ms"
2659 			    "  Window:%u packets\n",
2660 			    l->name, status, l->max_pkt, l->priority,
2661 			    l->tolerance, l->queue_limit[0]);
2662 
2663 	ret += tipc_snprintf(buf + ret, buf_size - ret,
2664 			     "  RX packets:%u fragments:%u/%u bundles:%u/%u\n",
2665 			     l->next_in_no - s->recv_info, s->recv_fragments,
2666 			     s->recv_fragmented, s->recv_bundles,
2667 			     s->recv_bundled);
2668 
2669 	ret += tipc_snprintf(buf + ret, buf_size - ret,
2670 			     "  TX packets:%u fragments:%u/%u bundles:%u/%u\n",
2671 			     l->next_out_no - s->sent_info, s->sent_fragments,
2672 			     s->sent_fragmented, s->sent_bundles,
2673 			     s->sent_bundled);
2674 
2675 	profile_total = s->msg_length_counts;
2676 	if (!profile_total)
2677 		profile_total = 1;
2678 
2679 	ret += tipc_snprintf(buf + ret, buf_size - ret,
2680 			     "  TX profile sample:%u packets  average:%u octets\n"
2681 			     "  0-64:%u%% -256:%u%% -1024:%u%% -4096:%u%% "
2682 			     "-16384:%u%% -32768:%u%% -66000:%u%%\n",
2683 			     s->msg_length_counts,
2684 			     s->msg_lengths_total / profile_total,
2685 			     percent(s->msg_length_profile[0], profile_total),
2686 			     percent(s->msg_length_profile[1], profile_total),
2687 			     percent(s->msg_length_profile[2], profile_total),
2688 			     percent(s->msg_length_profile[3], profile_total),
2689 			     percent(s->msg_length_profile[4], profile_total),
2690 			     percent(s->msg_length_profile[5], profile_total),
2691 			     percent(s->msg_length_profile[6], profile_total));
2692 
2693 	ret += tipc_snprintf(buf + ret, buf_size - ret,
2694 			     "  RX states:%u probes:%u naks:%u defs:%u"
2695 			     " dups:%u\n", s->recv_states, s->recv_probes,
2696 			     s->recv_nacks, s->deferred_recv, s->duplicates);
2697 
2698 	ret += tipc_snprintf(buf + ret, buf_size - ret,
2699 			     "  TX states:%u probes:%u naks:%u acks:%u"
2700 			     " dups:%u\n", s->sent_states, s->sent_probes,
2701 			     s->sent_nacks, s->sent_acks, s->retransmitted);
2702 
2703 	ret += tipc_snprintf(buf + ret, buf_size - ret,
2704 			     "  Congestion link:%u  Send queue"
2705 			     " max:%u avg:%u\n", s->link_congs,
2706 			     s->max_queue_sz, s->queue_sz_counts ?
2707 			     (s->accu_queue_sz / s->queue_sz_counts) : 0);
2708 
2709 	tipc_node_unlock(node);
2710 	return ret;
2711 }
2712 
2713 struct sk_buff *tipc_link_cmd_show_stats(const void *req_tlv_area, int req_tlv_space)
2714 {
2715 	struct sk_buff *buf;
2716 	struct tlv_desc *rep_tlv;
2717 	int str_len;
2718 	int pb_len;
2719 	char *pb;
2720 
2721 	if (!TLV_CHECK(req_tlv_area, req_tlv_space, TIPC_TLV_LINK_NAME))
2722 		return tipc_cfg_reply_error_string(TIPC_CFG_TLV_ERROR);
2723 
2724 	buf = tipc_cfg_reply_alloc(TLV_SPACE(ULTRA_STRING_MAX_LEN));
2725 	if (!buf)
2726 		return NULL;
2727 
2728 	rep_tlv = (struct tlv_desc *)buf->data;
2729 	pb = TLV_DATA(rep_tlv);
2730 	pb_len = ULTRA_STRING_MAX_LEN;
2731 	str_len = tipc_link_stats((char *)TLV_DATA(req_tlv_area),
2732 				  pb, pb_len);
2733 	if (!str_len) {
2734 		kfree_skb(buf);
2735 		return tipc_cfg_reply_error_string("link not found");
2736 	}
2737 	str_len += 1;	/* for "\0" */
2738 	skb_put(buf, TLV_SPACE(str_len));
2739 	TLV_SET(rep_tlv, TIPC_TLV_ULTRA_STRING, NULL, str_len);
2740 
2741 	return buf;
2742 }
2743 
2744 /**
2745  * tipc_link_get_max_pkt - get maximum packet size to use when sending to destination
2746  * @dest: network address of destination node
2747  * @selector: used to select from set of active links
2748  *
2749  * If no active link can be found, uses default maximum packet size.
2750  */
2751 u32 tipc_link_get_max_pkt(u32 dest, u32 selector)
2752 {
2753 	struct tipc_node *n_ptr;
2754 	struct tipc_link *l_ptr;
2755 	u32 res = MAX_PKT_DEFAULT;
2756 
2757 	if (dest == tipc_own_addr)
2758 		return MAX_MSG_SIZE;
2759 
2760 	n_ptr = tipc_node_find(dest);
2761 	if (n_ptr) {
2762 		tipc_node_lock(n_ptr);
2763 		l_ptr = n_ptr->active_links[selector & 1];
2764 		if (l_ptr)
2765 			res = l_ptr->max_pkt;
2766 		tipc_node_unlock(n_ptr);
2767 	}
2768 	return res;
2769 }
2770 
2771 static void link_print(struct tipc_link *l_ptr, const char *str)
2772 {
2773 	struct tipc_bearer *b_ptr;
2774 
2775 	rcu_read_lock();
2776 	b_ptr = rcu_dereference_rtnl(bearer_list[l_ptr->bearer_id]);
2777 	if (b_ptr)
2778 		pr_info("%s Link %x<%s>:", str, l_ptr->addr, b_ptr->name);
2779 	rcu_read_unlock();
2780 
2781 	if (link_working_unknown(l_ptr))
2782 		pr_cont(":WU\n");
2783 	else if (link_reset_reset(l_ptr))
2784 		pr_cont(":RR\n");
2785 	else if (link_reset_unknown(l_ptr))
2786 		pr_cont(":RU\n");
2787 	else if (link_working_working(l_ptr))
2788 		pr_cont(":WW\n");
2789 	else
2790 		pr_cont("\n");
2791 }
2792