X-Git-Url: http://ftp.safe.ca/?a=blobdiff_plain;f=net%2Ftipc%2Flink.c;h=bd206ebe4eea44cdf4b0363313e34e4950e3fac4;hb=6d4a6672c8263f98544d2b91690dc7074b144090;hp=ff40c9195fef23407673d2fc19612f39cd62d4f7;hpb=c33d53b23589d9133af85effefbaa619853eb7f0;p=safe%2Fjmp%2Flinux-2.6 diff --git a/net/tipc/link.c b/net/tipc/link.c index ff40c91..bd206eb 100644 --- a/net/tipc/link.c +++ b/net/tipc/link.c @@ -1,8 +1,8 @@ /* * net/tipc/link.c: TIPC link code - * - * Copyright (c) 1996-2006, Ericsson AB - * Copyright (c) 2004-2005, Wind River Systems + * + * Copyright (c) 1996-2007, Ericsson AB + * Copyright (c) 2004-2007, Wind River Systems * All rights reserved. * * Redistribution and use in source and binary forms, with or without @@ -50,29 +50,29 @@ #include "bcast.h" -/* - * Limit for deferred reception queue: +/* + * Limit for deferred reception queue: */ #define DEF_QUEUE_LIMIT 256u -/* - * Link state events: +/* + * Link state events: */ #define STARTING_EVT 856384768 /* link processing trigger */ #define TRAFFIC_MSG_EVT 560815u /* rx'd ??? */ #define TIMEOUT_EVT 560817u /* link timer expired */ -/* - * The following two 'message types' is really just implementation - * data conveniently stored in the message header. +/* + * The following two 'message types' is really just implementation + * data conveniently stored in the message header. * They must not be considered part of the protocol */ #define OPEN_MSG 0 #define CLOSED_MSG 1 -/* +/* * State value stored in 'exp_msg_count' */ @@ -97,7 +97,7 @@ struct link_name { /* LINK EVENT CODE IS NOT SUPPORTED AT PRESENT */ -/** +/** * struct link_event - link up/down event notification */ @@ -121,7 +121,7 @@ static int link_send_sections_long(struct port *sender, static void link_check_defragm_bufs(struct link *l_ptr); static void link_state_event(struct link *l_ptr, u32 event); static void link_reset_statistics(struct link *l_ptr); -static void link_print(struct link *l_ptr, struct print_buf *buf, +static void link_print(struct link *l_ptr, struct print_buf *buf, const char *str); /* @@ -132,24 +132,36 @@ static void link_print(struct link *l_ptr, struct print_buf *buf, * allow the output from multiple links to be intermixed. For this reason * routines of the form "dbg_link_XXX()" have been created that will capture * debug info into a link's personal print buffer, which can then be dumped - * into the TIPC system log (LOG) upon request. + * into the TIPC system log (TIPC_LOG) upon request. * * To enable per-link debugging, use LINK_LOG_BUF_SIZE to specify the size * of the print buffer used by each link. If LINK_LOG_BUF_SIZE is set to 0, - * the dbg_link_XXX() routines simply send their output to the standard + * the dbg_link_XXX() routines simply send their output to the standard * debug print buffer (DBG_OUTPUT), if it has been defined; this can be useful * when there is only a single link in the system being debugged. * * Notes: - * - When enabled, LINK_LOG_BUF_SIZE should be set to at least 1000 (bytes) - * - "l_ptr" must be valid when using dbg_link_XXX() macros + * - When enabled, LINK_LOG_BUF_SIZE should be set to at least TIPC_PB_MIN_SIZE + * - "l_ptr" must be valid when using dbg_link_XXX() macros */ #define LINK_LOG_BUF_SIZE 0 -#define dbg_link(fmt, arg...) do {if (LINK_LOG_BUF_SIZE) tipc_printf(&l_ptr->print_buf, fmt, ## arg); } while(0) -#define dbg_link_msg(msg, txt) do {if (LINK_LOG_BUF_SIZE) tipc_msg_print(&l_ptr->print_buf, msg, txt); } while(0) -#define dbg_link_state(txt) do {if (LINK_LOG_BUF_SIZE) link_print(l_ptr, &l_ptr->print_buf, txt); } while(0) +#define dbg_link(fmt, arg...) \ + do { \ + if (LINK_LOG_BUF_SIZE) \ + tipc_printf(&l_ptr->print_buf, fmt, ## arg); \ + } while (0) +#define dbg_link_msg(msg, txt) \ + do { \ + if (LINK_LOG_BUF_SIZE) \ + tipc_msg_dbg(&l_ptr->print_buf, msg, txt); \ + } while (0) +#define dbg_link_state(txt) \ + do { \ + if (LINK_LOG_BUF_SIZE) \ + link_print(l_ptr, &l_ptr->print_buf, txt); \ + } while (0) #define dbg_link_dump() do { \ if (LINK_LOG_BUF_SIZE) { \ tipc_printf(LOG, "\n\nDumping link <%s>:\n", l_ptr->name); \ @@ -159,13 +171,13 @@ static void link_print(struct link *l_ptr, struct print_buf *buf, static void dbg_print_link(struct link *l_ptr, const char *str) { - if (DBG_OUTPUT) + if (DBG_OUTPUT != TIPC_NULL) link_print(l_ptr, DBG_OUTPUT, str); } static void dbg_print_buf_chain(struct sk_buff *root_buf) { - if (DBG_OUTPUT) { + if (DBG_OUTPUT != TIPC_NULL) { struct sk_buff *buf = root_buf; while (buf) { @@ -222,18 +234,18 @@ static u32 link_max_pkt(struct link *l_ptr) static void link_init_max_pkt(struct link *l_ptr) { u32 max_pkt; - + max_pkt = (l_ptr->b_ptr->publ.mtu & ~3); if (max_pkt > MAX_MSG_SIZE) max_pkt = MAX_MSG_SIZE; - l_ptr->max_pkt_target = max_pkt; + l_ptr->max_pkt_target = max_pkt; if (l_ptr->max_pkt_target < MAX_PKT_DEFAULT) l_ptr->max_pkt = l_ptr->max_pkt_target; - else + else l_ptr->max_pkt = MAX_PKT_DEFAULT; - l_ptr->max_pkt_probes = 0; + l_ptr->max_pkt_probes = 0; } static u32 link_next_sent(struct link *l_ptr) @@ -269,7 +281,7 @@ int tipc_link_is_active(struct link *l_ptr) * link_name_validate - validate & (optionally) deconstruct link name * @name - ptr to link name string * @name_parts - ptr to area for link name components (or NULL if not needed) - * + * * Returns 1 if link name is valid, otherwise 0. */ @@ -317,8 +329,8 @@ static int link_name_validate(const char *name, struct link_name *name_parts) &z_peer, &c_peer, &n_peer, &dummy) != 3) || (z_local > 255) || (c_local > 4095) || (n_local > 4095) || (z_peer > 255) || (c_peer > 4095) || (n_peer > 4095) || - (if_local_len <= 1) || (if_local_len > TIPC_MAX_IF_NAME) || - (if_peer_len <= 1) || (if_peer_len > TIPC_MAX_IF_NAME) || + (if_local_len <= 1) || (if_local_len > TIPC_MAX_IF_NAME) || + (if_peer_len <= 1) || (if_peer_len > TIPC_MAX_IF_NAME) || (strspn(if_local, tipc_alphabet) != (if_local_len - 1)) || (strspn(if_peer, tipc_alphabet) != (if_peer_len - 1))) return 0; @@ -337,7 +349,7 @@ static int link_name_validate(const char *name, struct link_name *name_parts) /** * link_timeout - handle expiration of link timer * @l_ptr: pointer to link - * + * * This routine must not grab "tipc_net_lock" to avoid a potential deadlock conflict * with tipc_link_delete(). (There is no risk that the node will be deleted by * another thread because tipc_link_delete() always cancels the link timer before @@ -406,7 +418,7 @@ static void link_set_timer(struct link *l_ptr, u32 time) * @b_ptr: pointer to associated bearer * @peer: network address of node at other end of link * @media_addr: media address to use when sending messages over link - * + * * Returns pointer to link. */ @@ -417,24 +429,32 @@ struct link *tipc_link_create(struct bearer *b_ptr, const u32 peer, struct tipc_msg *msg; char *if_name; - l_ptr = (struct link *)kmalloc(sizeof(*l_ptr), GFP_ATOMIC); + l_ptr = kzalloc(sizeof(*l_ptr), GFP_ATOMIC); if (!l_ptr) { - warn("Memory squeeze; Failed to create link\n"); + warn("Link creation failed, no memory\n"); return NULL; } - memset(l_ptr, 0, sizeof(*l_ptr)); + + if (LINK_LOG_BUF_SIZE) { + char *pb = kmalloc(LINK_LOG_BUF_SIZE, GFP_ATOMIC); + + if (!pb) { + kfree(l_ptr); + warn("Link creation failed, no memory for print buffer\n"); + return NULL; + } + tipc_printbuf_init(&l_ptr->print_buf, pb, LINK_LOG_BUF_SIZE); + } l_ptr->addr = peer; if_name = strchr(b_ptr->publ.name, ':') + 1; sprintf(l_ptr->name, "%u.%u.%u:%s-%u.%u.%u:", tipc_zone(tipc_own_addr), tipc_cluster(tipc_own_addr), - tipc_node(tipc_own_addr), + tipc_node(tipc_own_addr), if_name, tipc_zone(peer), tipc_cluster(peer), tipc_node(peer)); /* note: peer i/f is appended to link name by reset/activate */ memcpy(&l_ptr->media_addr, media_addr, sizeof(*media_addr)); - k_init_timer(&l_ptr->timer, (Handler)link_timeout, (unsigned long)l_ptr); - list_add_tail(&l_ptr->link_list, &b_ptr->links); l_ptr->checkpoint = 1; l_ptr->b_ptr = b_ptr; link_set_supervision_props(l_ptr, b_ptr->media->tolerance); @@ -460,36 +480,29 @@ struct link *tipc_link_create(struct bearer *b_ptr, const u32 peer, l_ptr->owner = tipc_node_attach_link(l_ptr); if (!l_ptr->owner) { + if (LINK_LOG_BUF_SIZE) + kfree(l_ptr->print_buf.buf); kfree(l_ptr); return NULL; } - if (LINK_LOG_BUF_SIZE) { - char *pb = kmalloc(LINK_LOG_BUF_SIZE, GFP_ATOMIC); - - if (!pb) { - kfree(l_ptr); - warn("Memory squeeze; Failed to create link\n"); - return NULL; - } - tipc_printbuf_init(&l_ptr->print_buf, pb, LINK_LOG_BUF_SIZE); - } - + k_init_timer(&l_ptr->timer, (Handler)link_timeout, (unsigned long)l_ptr); + list_add_tail(&l_ptr->link_list, &b_ptr->links); tipc_k_signal((Handler)tipc_link_start, (unsigned long)l_ptr); dbg("tipc_link_create(): tolerance = %u,cont intv = %u, abort_limit = %u\n", l_ptr->tolerance, l_ptr->continuity_interval, l_ptr->abort_limit); - + return l_ptr; } -/** +/** * tipc_link_delete - delete a link * @l_ptr: pointer to link - * + * * Note: 'tipc_net_lock' is write_locked, bearer is locked. * This routine must not grab the node lock until after link timer cancellation - * to avoid a potential deadlock situation. + * to avoid a potential deadlock situation. */ void tipc_link_delete(struct link *l_ptr) @@ -502,7 +515,7 @@ void tipc_link_delete(struct link *l_ptr) dbg("tipc_link_delete()\n"); k_cancel_timer(&l_ptr->timer); - + tipc_node_lock(l_ptr->owner); tipc_link_reset(l_ptr); tipc_node_detach_link(l_ptr->owner, l_ptr); @@ -522,12 +535,12 @@ void tipc_link_start(struct link *l_ptr) } /** - * link_schedule_port - schedule port for deferred sending + * link_schedule_port - schedule port for deferred sending * @l_ptr: pointer to link * @origport: reference to sending port * @sz: amount of data to be sent - * - * Schedules port for renewed sending of messages after link congestion + * + * Schedules port for renewed sending of messages after link congestion * has abated. */ @@ -568,13 +581,12 @@ void tipc_link_wakeup_ports(struct link *l_ptr, int all) return; if (link_congested(l_ptr)) goto exit; - list_for_each_entry_safe(p_ptr, temp_p_ptr, &l_ptr->waiting_ports, + list_for_each_entry_safe(p_ptr, temp_p_ptr, &l_ptr->waiting_ports, wait_list) { if (win <= 0) break; list_del_init(&p_ptr->wait_list); p_ptr->congested_link = NULL; - assert(p_ptr->wakeup); spin_lock_bh(p_ptr->publ.lock); p_ptr->publ.congested = 0; p_ptr->wakeup(&p_ptr->publ); @@ -586,7 +598,7 @@ exit: spin_unlock_bh(&tipc_port_list_lock); } -/** +/** * link_release_outqueue - purge link's outbound message queue * @l_ptr: pointer to link */ @@ -623,7 +635,7 @@ void tipc_link_reset_fragments(struct link *l_ptr) l_ptr->defragm_buf = NULL; } -/** +/** * tipc_link_stop - purge all inbound and outbound messages associated with link * @l_ptr: pointer to link */ @@ -667,7 +679,7 @@ static void link_send_event(void (*fcn)(u32 a, char *n, int up), struct link *l_ptr, int up) { struct link_event *ev; - + ev = kmalloc(sizeof(*ev), GFP_ATOMIC); if (!ev) { warn("Link event allocation failure\n"); @@ -691,15 +703,16 @@ void tipc_link_reset(struct link *l_ptr) struct sk_buff *buf; u32 prev_state = l_ptr->state; u32 checkpoint = l_ptr->next_in_no; - + int was_active_link = tipc_link_is_active(l_ptr); + msg_set_session(l_ptr->pmsg, msg_session(l_ptr->pmsg) + 1); - /* Link is down, accept any session: */ + /* Link is down, accept any session: */ l_ptr->peer_session = 0; - /* Prepare for max packet size negotiation */ + /* Prepare for max packet size negotiation */ link_init_max_pkt(l_ptr); - + l_ptr->state = RESET_UNKNOWN; dbg_link_state("Resetting Link\n"); @@ -712,7 +725,7 @@ void tipc_link_reset(struct link *l_ptr) tipc_printf(TIPC_CONS, "\nReset link <%s>\n", l_ptr->name); dbg_link_dump(); #endif - if (tipc_node_has_active_links(l_ptr->owner) && + if (was_active_link && tipc_node_has_active_links(l_ptr->owner) && l_ptr->owner->permit_changeover) { l_ptr->reset_checkpoint = checkpoint; l_ptr->exp_msg_count = START_CHANGEOVER; @@ -755,7 +768,7 @@ void tipc_link_reset(struct link *l_ptr) static void link_activate(struct link *l_ptr) { - l_ptr->next_in_no = 1; + l_ptr->next_in_no = l_ptr->stats.recv_info = 1; tipc_node_link_up(l_ptr->owner, l_ptr); tipc_bearer_add_dest(l_ptr->b_ptr, l_ptr->addr); link_send_event(tipc_cfg_link_event, l_ptr, 1); @@ -771,7 +784,7 @@ static void link_activate(struct link *l_ptr) static void link_state_event(struct link *l_ptr, unsigned event) { - struct link *other; + struct link *other; u32 cont_intv = l_ptr->continuity_interval; if (!l_ptr->started && (event != STARTING_EVT)) @@ -800,11 +813,11 @@ static void link_state_event(struct link *l_ptr, unsigned event) if (l_ptr->next_in_no != l_ptr->checkpoint) { l_ptr->checkpoint = l_ptr->next_in_no; if (tipc_bclink_acks_missing(l_ptr->owner)) { - tipc_link_send_proto_msg(l_ptr, STATE_MSG, + tipc_link_send_proto_msg(l_ptr, STATE_MSG, 0, 0, 0, 0, 0); l_ptr->fsm_msg_cnt++; } else if (l_ptr->max_pkt < l_ptr->max_pkt_target) { - tipc_link_send_proto_msg(l_ptr, STATE_MSG, + tipc_link_send_proto_msg(l_ptr, STATE_MSG, 1, 0, 0, 0, 0); l_ptr->fsm_msg_cnt++; } @@ -820,6 +833,8 @@ static void link_state_event(struct link *l_ptr, unsigned event) break; case RESET_MSG: dbg_link("RES -> RR\n"); + info("Resetting link <%s>, requested by peer\n", + l_ptr->name); tipc_link_reset(l_ptr); l_ptr->state = RESET_RESET; l_ptr->fsm_msg_cnt = 0; @@ -844,6 +859,8 @@ static void link_state_event(struct link *l_ptr, unsigned event) break; case RESET_MSG: dbg_link("RES -> RR\n"); + info("Resetting link <%s>, requested by peer " + "while probing\n", l_ptr->name); tipc_link_reset(l_ptr); l_ptr->state = RESET_RESET; l_ptr->fsm_msg_cnt = 0; @@ -868,13 +885,15 @@ static void link_state_event(struct link *l_ptr, unsigned event) dbg_link("Probing %u/%u,timer = %u ms)\n", l_ptr->fsm_msg_cnt, l_ptr->abort_limit, cont_intv / 4); - tipc_link_send_proto_msg(l_ptr, STATE_MSG, + tipc_link_send_proto_msg(l_ptr, STATE_MSG, 1, 0, 0, 0, 0); l_ptr->fsm_msg_cnt++; link_set_timer(l_ptr, cont_intv / 4); } else { /* Link has failed */ dbg_link("-> RU (%u probes unanswered)\n", l_ptr->fsm_msg_cnt); + warn("Resetting link <%s>, peer not responding\n", + l_ptr->name); tipc_link_reset(l_ptr); l_ptr->state = RESET_UNKNOWN; l_ptr->fsm_msg_cnt = 0; @@ -972,28 +991,31 @@ static void link_state_event(struct link *l_ptr, unsigned event) /* * link_bundle_buf(): Append contents of a buffer to - * the tail of an existing one. + * the tail of an existing one. */ static int link_bundle_buf(struct link *l_ptr, - struct sk_buff *bundler, + struct sk_buff *bundler, struct sk_buff *buf) { struct tipc_msg *bundler_msg = buf_msg(bundler); struct tipc_msg *msg = buf_msg(buf); u32 size = msg_size(msg); - u32 to_pos = align(msg_size(bundler_msg)); - u32 rest = link_max_pkt(l_ptr) - to_pos; + u32 bundle_size = msg_size(bundler_msg); + u32 to_pos = align(bundle_size); + u32 pad = to_pos - bundle_size; if (msg_user(bundler_msg) != MSG_BUNDLER) return 0; if (msg_type(bundler_msg) != OPEN_MSG) return 0; - if (rest < align(size)) + if (skb_tailroom(bundler) < (pad + size)) + return 0; + if (link_max_pkt(l_ptr) < (to_pos + size)) return 0; - skb_put(bundler, (to_pos - msg_size(bundler_msg)) + size); - memcpy(bundler->data + to_pos, buf->data, size); + skb_put(bundler, pad + size); + skb_copy_to_linear_data_offset(bundler, to_pos, buf->data, size); msg_set_size(bundler_msg, to_pos + size); msg_set_msgcnt(bundler_msg, msg_msgcnt(bundler_msg) + 1); dbg("Packed msg # %u(%u octets) into pos %u in buf(#%u)\n", @@ -1022,8 +1044,8 @@ static void link_add_to_outqueue(struct link *l_ptr, l_ptr->out_queue_size++; } -/* - * tipc_link_send_buf() is the 'full path' for messages, called from +/* + * tipc_link_send_buf() is the 'full path' for messages, called from * inside TIPC when the 'fast path' in tipc_send_buf * has failed, and from link_send() */ @@ -1050,7 +1072,7 @@ int tipc_link_send_buf(struct link *l_ptr, struct sk_buff *buf) msg_dbg(msg, "TIPC: Congestion, throwing away\n"); buf_discard(buf); if (imp > CONN_MANAGER) { - warn("Resetting <%s>, send queue full", l_ptr->name); + warn("Resetting link <%s>, send queue full", l_ptr->name); tipc_link_reset(l_ptr); } return dsz; @@ -1066,7 +1088,7 @@ int tipc_link_send_buf(struct link *l_ptr, struct sk_buff *buf) if (queue_size > l_ptr->stats.max_queue_sz) l_ptr->stats.max_queue_sz = queue_size; - if (likely(!tipc_bearer_congested(l_ptr->b_ptr, l_ptr) && + if (likely(!tipc_bearer_congested(l_ptr->b_ptr, l_ptr) && !link_congested(l_ptr))) { link_add_to_outqueue(l_ptr, buf, msg); @@ -1086,7 +1108,7 @@ int tipc_link_send_buf(struct link *l_ptr, struct sk_buff *buf) /* Try adding message to an existing bundle */ - if (l_ptr->next_out && + if (l_ptr->next_out && link_bundle_buf(l_ptr, l_ptr->last_out, buf)) { tipc_bearer_resolve_congestion(l_ptr->b_ptr, l_ptr); return dsz; @@ -1101,8 +1123,8 @@ int tipc_link_send_buf(struct link *l_ptr, struct sk_buff *buf) if (bundler) { msg_init(&bundler_hdr, MSG_BUNDLER, OPEN_MSG, TIPC_OK, INT_H_SIZE, l_ptr->addr); - memcpy(bundler->data, (unchar *)&bundler_hdr, - INT_H_SIZE); + skb_copy_to_linear_data(bundler, &bundler_hdr, + INT_H_SIZE); skb_trim(bundler, INT_H_SIZE); link_bundle_buf(l_ptr, bundler, buf); buf = bundler; @@ -1118,8 +1140,8 @@ int tipc_link_send_buf(struct link *l_ptr, struct sk_buff *buf) return dsz; } -/* - * tipc_link_send(): same as tipc_link_send_buf(), but the link to use has +/* + * tipc_link_send(): same as tipc_link_send_buf(), but the link to use has * not been selected yet, and the the owner node is not locked * Called by TIPC internal users, e.g. the name distributor */ @@ -1153,8 +1175,8 @@ int tipc_link_send(struct sk_buff *buf, u32 dest, u32 selector) return res; } -/* - * link_send_buf_fast: Entry for data messages where the +/* + * link_send_buf_fast: Entry for data messages where the * destination link is known and the header is complete, * inclusive total message length. Very time critical. * Link is locked. Returns user data length. @@ -1189,8 +1211,8 @@ static int link_send_buf_fast(struct link *l_ptr, struct sk_buff *buf, return tipc_link_send_buf(l_ptr, buf); /* All other cases */ } -/* - * tipc_send_buf_fast: Entry for data messages where the +/* + * tipc_send_buf_fast: Entry for data messages where the * destination node is known and the header is complete, * inclusive total message length. * Returns user data length. @@ -1228,15 +1250,15 @@ int tipc_send_buf_fast(struct sk_buff *buf, u32 destnode) } -/* - * tipc_link_send_sections_fast: Entry for messages where the +/* + * tipc_link_send_sections_fast: Entry for messages where the * destination processor is known and the header is complete, - * except for total message length. + * except for total message length. * Returns user data length or errno. */ -int tipc_link_send_sections_fast(struct port *sender, +int tipc_link_send_sections_fast(struct port *sender, struct iovec const *msg_sect, - const u32 num_sect, + const u32 num_sect, u32 destaddr) { struct tipc_msg *hdr = &sender->publ.phdr; @@ -1246,15 +1268,13 @@ int tipc_link_send_sections_fast(struct port *sender, int res; u32 selector = msg_origport(hdr) & 1; - assert(destaddr != tipc_own_addr); - again: /* * Try building message using port's max_pkt hint. * (Must not hold any locks while building message.) */ - res = msg_build(hdr, msg_sect, num_sect, sender->max_pkt, + res = msg_build(hdr, msg_sect, num_sect, sender->publ.max_pkt, !sender->user_port, &buf); read_lock_bh(&tipc_net_lock); @@ -1265,7 +1285,7 @@ again: if (likely(l_ptr)) { if (likely(buf)) { res = link_send_buf_fast(l_ptr, buf, - &sender->max_pkt); + &sender->publ.max_pkt); if (unlikely(res < 0)) buf_discard(buf); exit: @@ -1281,24 +1301,24 @@ exit: /* Exit if link (or bearer) is congested */ - if (link_congested(l_ptr) || + if (link_congested(l_ptr) || !list_empty(&l_ptr->b_ptr->cong_links)) { res = link_schedule_port(l_ptr, sender->publ.ref, res); goto exit; } - /* + /* * Message size exceeds max_pkt hint; update hint, * then re-try fast path or fragment the message */ - sender->max_pkt = link_max_pkt(l_ptr); + sender->publ.max_pkt = link_max_pkt(l_ptr); tipc_node_unlock(node); read_unlock_bh(&tipc_net_lock); - if ((msg_hdr_sz(hdr) + res) <= sender->max_pkt) + if ((msg_hdr_sz(hdr) + res) <= sender->publ.max_pkt) goto again; return link_send_sections_long(sender, msg_sect, @@ -1318,10 +1338,10 @@ exit: return res; } -/* - * link_send_sections_long(): Entry for long messages where the +/* + * link_send_sections_long(): Entry for long messages where the * destination node is known and the header is complete, - * inclusive total message length. + * inclusive total message length. * Link and bearer congestion status have been checked to be ok, * and are ignored if they change. * @@ -1351,9 +1371,9 @@ static int link_send_sections_long(struct port *sender, again: fragm_no = 1; - max_pkt = sender->max_pkt - INT_H_SIZE; + max_pkt = sender->publ.max_pkt - INT_H_SIZE; /* leave room for tunnel header in case of link changeover */ - fragm_sz = max_pkt - INT_H_SIZE; + fragm_sz = max_pkt - INT_H_SIZE; /* leave room for fragmentation header in each fragment */ rest = dsz; fragm_crs = 0; @@ -1377,9 +1397,9 @@ again: if (!buf) return -ENOMEM; buf->next = NULL; - memcpy(buf->data, (unchar *)&fragm_hdr, INT_H_SIZE); + skb_copy_to_linear_data(buf, &fragm_hdr, INT_H_SIZE); hsz = msg_hdr_sz(hdr); - memcpy(buf->data + INT_H_SIZE, (unchar *)hdr, hsz); + skb_copy_to_linear_data_offset(buf, INT_H_SIZE, hdr, hsz); msg_dbg(buf_msg(buf), ">BUILD>"); /* Chop up message: */ @@ -1410,8 +1430,8 @@ error: return -EFAULT; } } else - memcpy(buf->data + fragm_crs, sect_crs, sz); - + skb_copy_to_linear_data_offset(buf, fragm_crs, + sect_crs, sz); sect_crs += sz; sect_rest -= sz; fragm_crs += sz; @@ -1434,9 +1454,9 @@ error: if (!buf) goto error; - buf->next = NULL; + buf->next = NULL; prev->next = buf; - memcpy(buf->data, (unchar *)&fragm_hdr, INT_H_SIZE); + skb_copy_to_linear_data(buf, &fragm_hdr, INT_H_SIZE); fragm_crs = INT_H_SIZE; fragm_rest = fragm_sz; msg_dbg(buf_msg(buf)," >BUILD>"); @@ -1444,7 +1464,7 @@ error: } while (rest > 0); - /* + /* * Now we have a buffer chain. Select a link and check * that packet size is still OK */ @@ -1457,7 +1477,7 @@ error: goto reject; } if (link_max_pkt(l_ptr) < max_pkt) { - sender->max_pkt = link_max_pkt(l_ptr); + sender->publ.max_pkt = link_max_pkt(l_ptr); tipc_node_unlock(node); for (; buf_chain; buf_chain = buf) { buf = buf_chain->next; @@ -1500,7 +1520,7 @@ reject: return dsz; } -/* +/* * tipc_link_push_packet: Push one unsent packet to the media */ u32 tipc_link_push_packet(struct link *l_ptr) @@ -1513,7 +1533,7 @@ u32 tipc_link_push_packet(struct link *l_ptr) /* consider that buffers may have been released in meantime */ if (r_q_size && buf) { - u32 last = lesser(mod(r_q_head + r_q_size), + u32 last = lesser(mod(r_q_head + r_q_size), link_last_sent(l_ptr)); u32 first = msg_seqno(buf_msg(buf)); @@ -1529,7 +1549,7 @@ u32 tipc_link_push_packet(struct link *l_ptr) if (r_q_size && buf && !skb_cloned(buf)) { msg_set_ack(buf_msg(buf), mod(l_ptr->next_in_no - 1)); - msg_set_bcast_ack(buf_msg(buf), l_ptr->owner->bclink.last_in); + msg_set_bcast_ack(buf_msg(buf), l_ptr->owner->bclink.last_in); if (tipc_bearer_send(l_ptr->b_ptr, buf, &l_ptr->media_addr)) { msg_dbg(buf_msg(buf), ">DEF-RETR>"); l_ptr->retransm_queue_head = mod(++r_q_head); @@ -1548,7 +1568,7 @@ u32 tipc_link_push_packet(struct link *l_ptr) buf = l_ptr->proto_msg_queue; if (buf) { msg_set_ack(buf_msg(buf), mod(l_ptr->next_in_no - 1)); - msg_set_bcast_ack(buf_msg(buf),l_ptr->owner->bclink.last_in); + msg_set_bcast_ack(buf_msg(buf),l_ptr->owner->bclink.last_in); if (tipc_bearer_send(l_ptr->b_ptr, buf, &l_ptr->media_addr)) { msg_dbg(buf_msg(buf), ">DEF-PROT>"); l_ptr->unacked_window = 0; @@ -1572,7 +1592,7 @@ u32 tipc_link_push_packet(struct link *l_ptr) if (mod(next - first) < l_ptr->queue_limit[0]) { msg_set_ack(msg, mod(l_ptr->next_in_no - 1)); - msg_set_bcast_ack(msg, l_ptr->owner->bclink.last_in); + msg_set_bcast_ack(msg, l_ptr->owner->bclink.last_in); if (tipc_bearer_send(l_ptr->b_ptr, buf, &l_ptr->media_addr)) { if (msg_user(msg) == MSG_BUNDLER) msg_set_type(msg, CLOSED_MSG); @@ -1623,12 +1643,12 @@ static void link_reset_all(unsigned long addr) tipc_node_lock(n_ptr); - warn("Resetting all links to %s\n", + warn("Resetting all links to %s\n", addr_string_fill(addr_string, n_ptr->addr)); for (i = 0; i < MAX_BEARERS; i++) { if (n_ptr->links[i]) { - link_print(n_ptr->links[i], TIPC_OUTPUT, + link_print(n_ptr->links[i], TIPC_OUTPUT, "Resetting link\n"); tipc_link_reset(n_ptr->links[i]); } @@ -1643,7 +1663,7 @@ static void link_retransmit_failure(struct link *l_ptr, struct sk_buff *buf) struct tipc_msg *msg = buf_msg(buf); warn("Retransmission failure on link <%s>\n", l_ptr->name); - tipc_msg_print(TIPC_OUTPUT, msg, ">RETR-FAIL>"); + tipc_msg_dbg(TIPC_OUTPUT, msg, ">RETR-FAIL>"); if (l_ptr->addr) { @@ -1660,8 +1680,9 @@ static void link_retransmit_failure(struct link *l_ptr, struct sk_buff *buf) char addr_string[16]; tipc_printf(TIPC_OUTPUT, "Msg seq number: %u, ", msg_seqno(msg)); - tipc_printf(TIPC_OUTPUT, "Outstanding acks: %u\n", (u32)TIPC_SKB_CB(buf)->handle); - + tipc_printf(TIPC_OUTPUT, "Outstanding acks: %lu\n", + (unsigned long) TIPC_SKB_CB(buf)->handle); + n_ptr = l_ptr->owner->next; tipc_node_lock(n_ptr); @@ -1682,7 +1703,7 @@ static void link_retransmit_failure(struct link *l_ptr, struct sk_buff *buf) } } -void tipc_link_retransmit(struct link *l_ptr, struct sk_buff *buf, +void tipc_link_retransmit(struct link *l_ptr, struct sk_buff *buf, u32 retransmits) { struct tipc_msg *msg; @@ -1691,7 +1712,7 @@ void tipc_link_retransmit(struct link *l_ptr, struct sk_buff *buf, return; msg = buf_msg(buf); - + dbg("Retransmitting %u in link %x\n", retransmits, l_ptr); if (tipc_bearer_congested(l_ptr->b_ptr, l_ptr)) { @@ -1721,7 +1742,7 @@ void tipc_link_retransmit(struct link *l_ptr, struct sk_buff *buf, while (retransmits && (buf != l_ptr->next_out) && buf && !skb_cloned(buf)) { msg = buf_msg(buf); msg_set_ack(msg, mod(l_ptr->next_in_no - 1)); - msg_set_bcast_ack(msg, l_ptr->owner->bclink.last_in); + msg_set_bcast_ack(msg, l_ptr->owner->bclink.last_in); if (tipc_bearer_send(l_ptr->b_ptr, buf, &l_ptr->media_addr)) { msg_dbg(buf_msg(buf), ">RETR>"); buf = buf->next; @@ -1739,7 +1760,7 @@ void tipc_link_retransmit(struct link *l_ptr, struct sk_buff *buf, l_ptr->retransm_queue_head = l_ptr->retransm_queue_size = 0; } -/* +/* * link_recv_non_seq: Receive packets which are outside * the link sequence flow */ @@ -1754,11 +1775,11 @@ static void link_recv_non_seq(struct sk_buff *buf) tipc_bclink_recv_pkt(buf); } -/** +/** * link_insert_deferred_queue - insert deferred messages back into receive chain */ -static struct sk_buff *link_insert_deferred_queue(struct link *l_ptr, +static struct sk_buff *link_insert_deferred_queue(struct link *l_ptr, struct sk_buff *buf) { u32 seq_no; @@ -1776,6 +1797,56 @@ static struct sk_buff *link_insert_deferred_queue(struct link *l_ptr, return buf; } +/** + * link_recv_buf_validate - validate basic format of received message + * + * This routine ensures a TIPC message has an acceptable header, and at least + * as much data as the header indicates it should. The routine also ensures + * that the entire message header is stored in the main fragment of the message + * buffer, to simplify future access to message header fields. + * + * Note: Having extra info present in the message header or data areas is OK. + * TIPC will ignore the excess, under the assumption that it is optional info + * introduced by a later release of the protocol. + */ + +static int link_recv_buf_validate(struct sk_buff *buf) +{ + static u32 min_data_hdr_size[8] = { + SHORT_H_SIZE, MCAST_H_SIZE, LONG_H_SIZE, DIR_MSG_H_SIZE, + MAX_H_SIZE, MAX_H_SIZE, MAX_H_SIZE, MAX_H_SIZE + }; + + struct tipc_msg *msg; + u32 tipc_hdr[2]; + u32 size; + u32 hdr_size; + u32 min_hdr_size; + + if (unlikely(buf->len < MIN_H_SIZE)) + return 0; + + msg = skb_header_pointer(buf, 0, sizeof(tipc_hdr), tipc_hdr); + if (msg == NULL) + return 0; + + if (unlikely(msg_version(msg) != TIPC_VERSION)) + return 0; + + size = msg_size(msg); + hdr_size = msg_hdr_sz(msg); + min_hdr_size = msg_isdata(msg) ? + min_data_hdr_size[msg_type(msg)] : INT_H_SIZE; + + if (unlikely((hdr_size < min_hdr_size) || + (size < hdr_size) || + (buf->len < size) || + (size - hdr_size > TIPC_MAX_USER_MSG_SIZE))) + return 0; + + return pskb_may_pull(buf, hdr_size); +} + void tipc_recv_msg(struct sk_buff *head, struct tipc_bearer *tb_ptr) { read_lock_bh(&tipc_net_lock); @@ -1785,9 +1856,9 @@ void tipc_recv_msg(struct sk_buff *head, struct tipc_bearer *tb_ptr) struct link *l_ptr; struct sk_buff *crs; struct sk_buff *buf = head; - struct tipc_msg *msg = buf_msg(buf); - u32 seq_no = msg_seqno(msg); - u32 ackd = msg_ack(msg); + struct tipc_msg *msg; + u32 seq_no; + u32 ackd; u32 released = 0; int type; @@ -1795,42 +1866,58 @@ void tipc_recv_msg(struct sk_buff *head, struct tipc_bearer *tb_ptr) TIPC_SKB_CB(buf)->handle = b_ptr; head = head->next; - if (unlikely(msg_version(msg) != TIPC_VERSION)) + + /* Ensure message is well-formed */ + + if (unlikely(!link_recv_buf_validate(buf))) goto cont; -#if 0 - if (msg_user(msg) != LINK_PROTOCOL) -#endif - msg_dbg(msg,"links[b_ptr->identity]; if (unlikely(!l_ptr)) { tipc_node_unlock(n_ptr); goto cont; } - /* - * Release acked messages - */ + + /* Validate message sequence number info */ + + seq_no = msg_seqno(msg); + ackd = msg_ack(msg); + + /* Release acked messages */ + if (less(n_ptr->bclink.acked, msg_bcast_ack(msg))) { if (tipc_node_is_up(n_ptr) && n_ptr->bclink.supported) tipc_bclink_acknowledge(n_ptr, msg_bcast_ack(msg)); } crs = l_ptr->first_out; - while ((crs != l_ptr->next_out) && + while ((crs != l_ptr->next_out) && less_eq(msg_seqno(buf_msg(crs)), ackd)) { struct sk_buff *next = crs->next; @@ -1842,6 +1929,9 @@ void tipc_recv_msg(struct sk_buff *head, struct tipc_bearer *tb_ptr) l_ptr->first_out = crs; l_ptr->out_queue_size -= released; } + + /* Try sending any messages link endpoint has pending */ + if (unlikely(l_ptr->next_out)) tipc_link_push_queue(l_ptr); if (unlikely(!list_empty(&l_ptr->waiting_ports))) @@ -1851,6 +1941,8 @@ void tipc_recv_msg(struct sk_buff *head, struct tipc_bearer *tb_ptr) tipc_link_send_proto_msg(l_ptr, STATE_MSG, 0, 0, 0, 0, 0); } + /* Now (finally!) process the incoming message */ + protocol_check: if (likely(link_working_working(l_ptr))) { if (likely(seq_no == mod(l_ptr->next_in_no))) { @@ -1868,7 +1960,7 @@ deliver: switch (msg_user(msg)) { case MSG_BUNDLER: l_ptr->stats.recv_bundles++; - l_ptr->stats.recv_bundled += + l_ptr->stats.recv_bundled += msg_msgcnt(msg); tipc_node_unlock(n_ptr); tipc_link_recv_bundle(buf); @@ -1887,7 +1979,7 @@ deliver: continue; case MSG_FRAGMENTER: l_ptr->stats.recv_fragments++; - if (tipc_link_recv_fragment(&l_ptr->defragm_buf, + if (tipc_link_recv_fragment(&l_ptr->defragm_buf, &buf, &msg)) { l_ptr->stats.recv_fragmented++; goto deliver; @@ -1898,7 +1990,7 @@ deliver: if (link_recv_changeover_msg(&l_ptr, &buf)) { msg = buf_msg(buf); seq_no = msg_seqno(msg); - TIPC_SKB_CB(buf)->handle + TIPC_SKB_CB(buf)->handle = b_ptr; if (type == ORIGINAL_MSG) goto deliver; @@ -1941,8 +2033,8 @@ cont: read_unlock_bh(&tipc_net_lock); } -/* - * link_defer_buf(): Sort a received out-of-sequence packet +/* + * link_defer_buf(): Sort a received out-of-sequence packet * into the deferred reception queue. * Returns the increase of the queue length,i.e. 0 or 1 */ @@ -1979,7 +2071,7 @@ u32 tipc_link_defer_pkt(struct sk_buff **head, if (prev) prev->next = buf; else - *head = buf; + *head = buf; return 1; } if (seq_no == msg_seqno(msg)) { @@ -1996,11 +2088,11 @@ u32 tipc_link_defer_pkt(struct sk_buff **head, return 0; } -/** +/** * link_handle_out_of_seq_msg - handle arrival of out-of-sequence packet */ -static void link_handle_out_of_seq_msg(struct link *l_ptr, +static void link_handle_out_of_seq_msg(struct link *l_ptr, struct sk_buff *buf) { u32 seq_no = msg_seqno(buf_msg(buf)); @@ -2010,14 +2102,14 @@ static void link_handle_out_of_seq_msg(struct link *l_ptr, return; } - dbg("rx OOS msg: seq_no %u, expecting %u (%u)\n", + dbg("rx OOS msg: seq_no %u, expecting %u (%u)\n", seq_no, mod(l_ptr->next_in_no), l_ptr->next_in_no); /* Record OOS packet arrival (force mismatch on next timeout) */ l_ptr->checkpoint--; - /* + /* * Discard packet if a duplicate; otherwise add it to deferred queue * and notify peer of gap as per protocol specification */ @@ -2046,13 +2138,13 @@ void tipc_link_send_proto_msg(struct link *l_ptr, u32 msg_typ, int probe_msg, { struct sk_buff *buf = NULL; struct tipc_msg *msg = l_ptr->pmsg; - u32 msg_size = sizeof(l_ptr->proto_msg); + u32 msg_size = sizeof(l_ptr->proto_msg); if (link_blocked(l_ptr)) return; msg_set_type(msg, msg_typ); msg_set_net_plane(msg, l_ptr->b_ptr->net_plane); - msg_set_bcast_ack(msg, mod(l_ptr->owner->bclink.last_in)); + msg_set_bcast_ack(msg, mod(l_ptr->owner->bclink.last_in)); msg_set_last_bcast(msg, tipc_bclink_get_last_sent()); if (msg_typ == STATE_MSG) { @@ -2075,23 +2167,23 @@ void tipc_link_send_proto_msg(struct link *l_ptr, u32 msg_typ, int probe_msg, msg_set_max_pkt(msg, ack_mtu); msg_set_ack(msg, mod(l_ptr->next_in_no - 1)); msg_set_probe(msg, probe_msg != 0); - if (probe_msg) { + if (probe_msg) { u32 mtu = l_ptr->max_pkt; - if ((mtu < l_ptr->max_pkt_target) && + if ((mtu < l_ptr->max_pkt_target) && link_working_working(l_ptr) && l_ptr->fsm_msg_cnt) { msg_size = (mtu + (l_ptr->max_pkt_target - mtu)/2 + 2) & ~3; - if (l_ptr->max_pkt_probes == 10) { - l_ptr->max_pkt_target = (msg_size - 4); - l_ptr->max_pkt_probes = 0; + if (l_ptr->max_pkt_probes == 10) { + l_ptr->max_pkt_target = (msg_size - 4); + l_ptr->max_pkt_probes = 0; msg_size = (mtu + (l_ptr->max_pkt_target - mtu)/2 + 2) & ~3; - } + } l_ptr->max_pkt_probes++; - } + } l_ptr->stats.sent_probes++; - } + } l_ptr->stats.sent_states++; } else { /* RESET_MSG or ACTIVATE_MSG */ msg_set_ack(msg, mod(l_ptr->reset_checkpoint - 1)); @@ -2123,7 +2215,7 @@ void tipc_link_send_proto_msg(struct link *l_ptr, u32 msg_typ, int probe_msg, buf = l_ptr->proto_msg_queue; if (!buf) return; - memcpy(buf->data, (unchar *)msg, sizeof(l_ptr->proto_msg)); + skb_copy_to_linear_data(buf, msg, sizeof(l_ptr->proto_msg)); return; } msg_set_timestamp(msg, jiffies_to_msecs(jiffies)); @@ -2136,8 +2228,8 @@ void tipc_link_send_proto_msg(struct link *l_ptr, u32 msg_typ, int probe_msg, if (!buf) return; - memcpy(buf->data, (unchar *)msg, sizeof(l_ptr->proto_msg)); - msg_set_size(buf_msg(buf), msg_size); + skb_copy_to_linear_data(buf, msg, sizeof(l_ptr->proto_msg)); + msg_set_size(buf_msg(buf), msg_size); if (tipc_bearer_send(l_ptr->b_ptr, buf, &l_ptr->media_addr)) { l_ptr->unacked_window = 0; @@ -2153,15 +2245,15 @@ void tipc_link_send_proto_msg(struct link *l_ptr, u32 msg_typ, int probe_msg, /* * Receive protocol message : - * Note that network plane id propagates through the network, and may - * change at any time. The node with lowest address rules + * Note that network plane id propagates through the network, and may + * change at any time. The node with lowest address rules */ static void link_recv_proto_msg(struct link *l_ptr, struct sk_buff *buf) { u32 rec_gap = 0; u32 max_pkt_info; - u32 max_pkt_ack; + u32 max_pkt_ack; u32 msg_tol; struct tipc_msg *msg = buf_msg(buf); @@ -2181,12 +2273,12 @@ static void link_recv_proto_msg(struct link *l_ptr, struct sk_buff *buf) l_ptr->owner->permit_changeover = msg_redundant_link(msg); switch (msg_type(msg)) { - + case RESET_MSG: if (!link_working_unknown(l_ptr) && l_ptr->peer_session) { if (msg_session(msg) == l_ptr->peer_session) { dbg("Duplicate RESET: %u<->%u\n", - msg_session(msg), l_ptr->peer_session); + msg_session(msg), l_ptr->peer_session); break; /* duplicate: ignore */ } } @@ -2204,13 +2296,13 @@ static void link_recv_proto_msg(struct link *l_ptr, struct sk_buff *buf) l_ptr->priority = msg_linkprio(msg); max_pkt_info = msg_max_pkt(msg); - if (max_pkt_info) { + if (max_pkt_info) { if (max_pkt_info < l_ptr->max_pkt_target) l_ptr->max_pkt_target = max_pkt_info; if (l_ptr->max_pkt > l_ptr->max_pkt_target) l_ptr->max_pkt = l_ptr->max_pkt_target; } else { - l_ptr->max_pkt = l_ptr->max_pkt_target; + l_ptr->max_pkt = l_ptr->max_pkt_target; } l_ptr->owner->bclink.supported = (max_pkt_info != 0); @@ -2228,10 +2320,10 @@ static void link_recv_proto_msg(struct link *l_ptr, struct sk_buff *buf) if ((msg_tol = msg_link_tolerance(msg))) link_set_supervision_props(l_ptr, msg_tol); - - if (msg_linkprio(msg) && + + if (msg_linkprio(msg) && (msg_linkprio(msg) != l_ptr->priority)) { - warn("Changing prio <%s>: %u->%u\n", + warn("Resetting link <%s>, priority change %u->%u\n", l_ptr->name, l_ptr->priority, msg_linkprio(msg)); l_ptr->priority = msg_linkprio(msg); tipc_link_reset(l_ptr); /* Enforce change to take effect */ @@ -2243,25 +2335,25 @@ static void link_recv_proto_msg(struct link *l_ptr, struct sk_buff *buf) break; if (less_eq(mod(l_ptr->next_in_no), msg_next_sent(msg))) { - rec_gap = mod(msg_next_sent(msg) - + rec_gap = mod(msg_next_sent(msg) - mod(l_ptr->next_in_no)); } max_pkt_ack = msg_max_pkt(msg); - if (max_pkt_ack > l_ptr->max_pkt) { - dbg("Link <%s> updated MTU %u -> %u\n", - l_ptr->name, l_ptr->max_pkt, max_pkt_ack); - l_ptr->max_pkt = max_pkt_ack; - l_ptr->max_pkt_probes = 0; - } + if (max_pkt_ack > l_ptr->max_pkt) { + dbg("Link <%s> updated MTU %u -> %u\n", + l_ptr->name, l_ptr->max_pkt, max_pkt_ack); + l_ptr->max_pkt = max_pkt_ack; + l_ptr->max_pkt_probes = 0; + } max_pkt_ack = 0; - if (msg_probe(msg)) { + if (msg_probe(msg)) { l_ptr->stats.recv_probes++; - if (msg_size(msg) > sizeof(l_ptr->proto_msg)) { - max_pkt_ack = msg_size(msg); - } - } + if (msg_size(msg) > sizeof(l_ptr->proto_msg)) { + max_pkt_ack = msg_size(msg); + } + } /* Protocol message before retransmits, reduce loss risk */ @@ -2287,11 +2379,11 @@ exit: /* - * tipc_link_tunnel(): Send one message via a link belonging to + * tipc_link_tunnel(): Send one message via a link belonging to * another bearer. Owner node is locked. */ -void tipc_link_tunnel(struct link *l_ptr, - struct tipc_msg *tunnel_hdr, +void tipc_link_tunnel(struct link *l_ptr, + struct tipc_msg *tunnel_hdr, struct tipc_msg *msg, u32 selector) { @@ -2300,17 +2392,22 @@ void tipc_link_tunnel(struct link *l_ptr, u32 length = msg_size(msg); tunnel = l_ptr->owner->active_links[selector & 1]; - if (!tipc_link_is_up(tunnel)) + if (!tipc_link_is_up(tunnel)) { + warn("Link changeover error, " + "tunnel link no longer available\n"); return; + } msg_set_size(tunnel_hdr, length + INT_H_SIZE); buf = buf_acquire(length + INT_H_SIZE); - if (!buf) + if (!buf) { + warn("Link changeover error, " + "unable to send tunnel msg\n"); return; - memcpy(buf->data, (unchar *)tunnel_hdr, INT_H_SIZE); - memcpy(buf->data + INT_H_SIZE, (unchar *)msg, length); + } + skb_copy_to_linear_data(buf, tunnel_hdr, INT_H_SIZE); + skb_copy_to_linear_data_offset(buf, INT_H_SIZE, msg, length); dbg("%c->%c:", l_ptr->b_ptr->net_plane, tunnel->b_ptr->net_plane); msg_dbg(buf_msg(buf), ">SEND>"); - assert(tunnel); tipc_link_send_buf(tunnel, buf); } @@ -2326,44 +2423,53 @@ void tipc_link_changeover(struct link *l_ptr) u32 msgcount = l_ptr->out_queue_size; struct sk_buff *crs = l_ptr->first_out; struct link *tunnel = l_ptr->owner->active_links[0]; - int split_bundles = tipc_node_has_redundant_links(l_ptr->owner); struct tipc_msg tunnel_hdr; + int split_bundles; if (!tunnel) return; - if (!l_ptr->owner->permit_changeover) + if (!l_ptr->owner->permit_changeover) { + warn("Link changeover error, " + "peer did not permit changeover\n"); return; + } msg_init(&tunnel_hdr, CHANGEOVER_PROTOCOL, ORIGINAL_MSG, TIPC_OK, INT_H_SIZE, l_ptr->addr); msg_set_bearer_id(&tunnel_hdr, l_ptr->peer_bearer_id); msg_set_msgcnt(&tunnel_hdr, msgcount); + dbg("Link changeover requires %u tunnel messages\n", msgcount); + if (!l_ptr->first_out) { struct sk_buff *buf; - assert(!msgcount); buf = buf_acquire(INT_H_SIZE); if (buf) { - memcpy(buf->data, (unchar *)&tunnel_hdr, INT_H_SIZE); + skb_copy_to_linear_data(buf, &tunnel_hdr, INT_H_SIZE); msg_set_size(&tunnel_hdr, INT_H_SIZE); dbg("%c->%c:", l_ptr->b_ptr->net_plane, tunnel->b_ptr->net_plane); msg_dbg(&tunnel_hdr, "EMPTY>SEND>"); tipc_link_send_buf(tunnel, buf); } else { - warn("Memory squeeze; link changeover failed\n"); + warn("Link changeover error, " + "unable to send changeover msg\n"); } return; } + + split_bundles = (l_ptr->owner->active_links[0] != + l_ptr->owner->active_links[1]); + while (crs) { struct tipc_msg *msg = buf_msg(crs); if ((msg_user(msg) == MSG_BUNDLER) && split_bundles) { - u32 msgcount = msg_msgcnt(msg); struct tipc_msg *m = msg_get_wrapped(msg); unchar* pos = (unchar*)m; + msgcount = msg_msgcnt(msg); while (msgcount--) { msg_set_seqno(m,msg_seqno(msg)); tipc_link_tunnel(l_ptr, &tunnel_hdr, m, @@ -2397,15 +2503,17 @@ void tipc_link_send_duplicate(struct link *l_ptr, struct link *tunnel) if (msg_user(msg) == MSG_BUNDLER) msg_set_type(msg, CLOSED_MSG); msg_set_ack(msg, mod(l_ptr->next_in_no - 1)); /* Update */ - msg_set_bcast_ack(msg, l_ptr->owner->bclink.last_in); + msg_set_bcast_ack(msg, l_ptr->owner->bclink.last_in); msg_set_size(&tunnel_hdr, length + INT_H_SIZE); outbuf = buf_acquire(length + INT_H_SIZE); if (outbuf == NULL) { - warn("Memory squeeze; buffer duplication failed\n"); + warn("Link changeover error, " + "unable to send duplicate msg\n"); return; } - memcpy(outbuf->data, (unchar *)&tunnel_hdr, INT_H_SIZE); - memcpy(outbuf->data + INT_H_SIZE, iter->data, length); + skb_copy_to_linear_data(outbuf, &tunnel_hdr, INT_H_SIZE); + skb_copy_to_linear_data_offset(outbuf, INT_H_SIZE, iter->data, + length); dbg("%c->%c:", l_ptr->b_ptr->net_plane, tunnel->b_ptr->net_plane); msg_dbg(buf_msg(outbuf), ">SEND>"); @@ -2423,7 +2531,7 @@ void tipc_link_send_duplicate(struct link *l_ptr, struct link *tunnel) * @skb: encapsulating message buffer * @from_pos: offset to extract from * - * Returns a new message buffer containing an embedded message. The + * Returns a new message buffer containing an embedded message. The * encapsulating message itself is left unchanged. */ @@ -2435,11 +2543,11 @@ static struct sk_buff *buf_extract(struct sk_buff *skb, u32 from_pos) eb = buf_acquire(size); if (eb) - memcpy(eb->data, (unchar *)msg, size); + skb_copy_to_linear_data(eb, msg, size); return eb; } -/* +/* * link_recv_changeover_msg(): Receive tunneled packet sent * via other link. Node is locked. Return extracted buffer. */ @@ -2455,11 +2563,15 @@ static int link_recv_changeover_msg(struct link **l_ptr, u32 msg_count = msg_msgcnt(tunnel_msg); dest_link = (*l_ptr)->owner->links[msg_bearer_id(tunnel_msg)]; - assert(dest_link != *l_ptr); if (!dest_link) { msg_dbg(tunnel_msg, "NOLINK/\n", + (*l_ptr)->name); + goto exit; + } dbg("%c<-%c:", dest_link->b_ptr->net_plane, (*l_ptr)->b_ptr->net_plane); *l_ptr = dest_link; @@ -2472,7 +2584,7 @@ static int link_recv_changeover_msg(struct link **l_ptr, } *buf = buf_extract(tunnel_buf,INT_H_SIZE); if (*buf == NULL) { - warn("Memory squeeze; failed to extract msg\n"); + warn("Link changeover error, duplicate msg dropped\n"); goto exit; } msg_dbg(tunnel_msg, "TNL, changeover initiated by peer\n", + dest_link->name); tipc_link_reset(dest_link); dest_link->exp_msg_count = msg_count; + dbg("Expecting %u tunnelled messages\n", msg_count); if (!msg_count) goto exit; } else if (dest_link->exp_msg_count == START_CHANGEOVER) { msg_dbg(tunnel_msg, "BLK/FIRST/exp_msg_count = msg_count; + dbg("Expecting %u tunnelled messages\n", msg_count); if (!msg_count) goto exit; } @@ -2498,6 +2614,8 @@ static int link_recv_changeover_msg(struct link **l_ptr, /* Receive original message */ if (dest_link->exp_msg_count == 0) { + warn("Link switchover error, " + "got too many tunnelled messages\n"); msg_dbg(tunnel_msg, "OVERDUE/DROP/data, (unchar *)&fragm_hdr, INT_H_SIZE); - memcpy(fragm->data + INT_H_SIZE, crs, fragm_sz); - + skb_copy_to_linear_data(fragm, &fragm_hdr, INT_H_SIZE); + skb_copy_to_linear_data_offset(fragm, INT_H_SIZE, crs, + fragm_sz); /* Send queued messages first, if any: */ l_ptr->stats.sent_fragments++; @@ -2623,9 +2736,9 @@ exit: return dsz; } -/* - * A pending message being re-assembled must store certain values - * to handle subsequent fragments correctly. The following functions +/* + * A pending message being re-assembled must store certain values + * to handle subsequent fragments correctly. The following functions * help storing these values in unused, available fields in the * pending message. This makes dynamic memory allocation unecessary. */ @@ -2665,11 +2778,11 @@ static void incr_timer_cnt(struct sk_buff *buf) msg_incr_reroute_cnt(buf_msg(buf)); } -/* - * tipc_link_recv_fragment(): Called with node lock on. Returns +/* + * tipc_link_recv_fragment(): Called with node lock on. Returns * the reassembled buffer if message is complete. */ -int tipc_link_recv_fragment(struct sk_buff **pending, struct sk_buff **fb, +int tipc_link_recv_fragment(struct sk_buff **pending, struct sk_buff **fb, struct tipc_msg **m) { struct sk_buff *prev = NULL; @@ -2706,15 +2819,15 @@ int tipc_link_recv_fragment(struct sk_buff **pending, struct sk_buff **fb, if (pbuf != NULL) { pbuf->next = *pending; *pending = pbuf; - memcpy(pbuf->data, (unchar *)imsg, msg_data_sz(fragm)); - + skb_copy_to_linear_data(pbuf, imsg, + msg_data_sz(fragm)); /* Prepare buffer for subsequent fragments. */ - set_long_msg_seqno(pbuf, long_msg_seq_no); - set_fragm_size(pbuf,fragm_sz); - set_expected_frags(pbuf,exp_fragm_cnt - 1); + set_long_msg_seqno(pbuf, long_msg_seq_no); + set_fragm_size(pbuf,fragm_sz); + set_expected_frags(pbuf,exp_fragm_cnt - 1); } else { - warn("Memory squeeze; got no defragmenting buffer\n"); + warn("Link unable to reassemble fragmented message\n"); } buf_discard(fbuf); return 0; @@ -2723,7 +2836,8 @@ int tipc_link_recv_fragment(struct sk_buff **pending, struct sk_buff **fb, u32 fsz = get_fragm_size(pbuf); u32 crs = ((msg_fragm_no(fragm) - 1) * fsz); u32 exp_frags = get_expected_frags(pbuf) - 1; - memcpy(pbuf->data + crs, msg_data(fragm), dsz); + skb_copy_to_linear_data_offset(pbuf, crs, + msg_data(fragm), dsz); buf_discard(fbuf); /* Is message complete? */ @@ -2738,7 +2852,7 @@ int tipc_link_recv_fragment(struct sk_buff **pending, struct sk_buff **fb, *m = buf_msg(pbuf); return 1; } - set_expected_frags(pbuf,exp_frags); + set_expected_frags(pbuf,exp_frags); return 0; } dbg(" Discarding orphan fragment %x\n",fbuf); @@ -2801,15 +2915,15 @@ static void link_set_supervision_props(struct link *l_ptr, u32 tolerance) void tipc_link_set_queue_limits(struct link *l_ptr, u32 window) { /* Data messages from this node, inclusive FIRST_FRAGM */ - l_ptr->queue_limit[DATA_LOW] = window; - l_ptr->queue_limit[DATA_MEDIUM] = (window / 3) * 4; - l_ptr->queue_limit[DATA_HIGH] = (window / 3) * 5; - l_ptr->queue_limit[DATA_CRITICAL] = (window / 3) * 6; + l_ptr->queue_limit[TIPC_LOW_IMPORTANCE] = window; + l_ptr->queue_limit[TIPC_MEDIUM_IMPORTANCE] = (window / 3) * 4; + l_ptr->queue_limit[TIPC_HIGH_IMPORTANCE] = (window / 3) * 5; + l_ptr->queue_limit[TIPC_CRITICAL_IMPORTANCE] = (window / 3) * 6; /* Transiting data messages,inclusive FIRST_FRAGM */ - l_ptr->queue_limit[DATA_LOW + 4] = 300; - l_ptr->queue_limit[DATA_MEDIUM + 4] = 600; - l_ptr->queue_limit[DATA_HIGH + 4] = 900; - l_ptr->queue_limit[DATA_CRITICAL + 4] = 1200; + l_ptr->queue_limit[TIPC_LOW_IMPORTANCE + 4] = 300; + l_ptr->queue_limit[TIPC_MEDIUM_IMPORTANCE + 4] = 600; + l_ptr->queue_limit[TIPC_HIGH_IMPORTANCE + 4] = 900; + l_ptr->queue_limit[TIPC_CRITICAL_IMPORTANCE + 4] = 1200; l_ptr->queue_limit[CONN_MANAGER] = 1200; l_ptr->queue_limit[ROUTE_DISTRIBUTOR] = 1200; l_ptr->queue_limit[CHANGEOVER_PROTOCOL] = 2500; @@ -2822,10 +2936,10 @@ void tipc_link_set_queue_limits(struct link *l_ptr, u32 window) * link_find_link - locate link by name * @name - ptr to link name string * @node - ptr to area to be filled with ptr to associated node - * + * * Caller must hold 'tipc_net_lock' to ensure node and bearer are not deleted; * this also prevents link deletion. - * + * * Returns pointer to link (or 0 if invalid link name). */ @@ -2833,7 +2947,7 @@ static struct link *link_find_link(const char *name, struct node **node) { struct link_name link_name_parts; struct bearer *b_ptr; - struct link *l_ptr; + struct link *l_ptr; if (!link_name_validate(name, &link_name_parts)) return NULL; @@ -2842,7 +2956,7 @@ static struct link *link_find_link(const char *name, struct node **node) if (!b_ptr) return NULL; - *node = tipc_node_find(link_name_parts.addr_peer); + *node = tipc_node_find(link_name_parts.addr_peer); if (!*node) return NULL; @@ -2853,14 +2967,14 @@ static struct link *link_find_link(const char *name, struct node **node) return l_ptr; } -struct sk_buff *tipc_link_cmd_config(const void *req_tlv_area, int req_tlv_space, +struct sk_buff *tipc_link_cmd_config(const void *req_tlv_area, int req_tlv_space, u16 cmd) { struct tipc_link_config *args; - u32 new_value; + u32 new_value; struct link *l_ptr; struct node *node; - int res; + int res; if (!TLV_CHECK(req_tlv_area, req_tlv_space, TIPC_TLV_LINK_CONFIG)) return tipc_cfg_reply_error_string(TIPC_CFG_TLV_ERROR); @@ -2872,40 +2986,40 @@ struct sk_buff *tipc_link_cmd_config(const void *req_tlv_area, int req_tlv_space if ((cmd == TIPC_CMD_SET_LINK_WINDOW) && (tipc_bclink_set_queue_limits(new_value) == 0)) return tipc_cfg_reply_none(); - return tipc_cfg_reply_error_string(TIPC_CFG_NOT_SUPPORTED + return tipc_cfg_reply_error_string(TIPC_CFG_NOT_SUPPORTED " (cannot change setting on broadcast link)"); } read_lock_bh(&tipc_net_lock); - l_ptr = link_find_link(args->name, &node); + l_ptr = link_find_link(args->name, &node); if (!l_ptr) { read_unlock_bh(&tipc_net_lock); - return tipc_cfg_reply_error_string("link not found"); + return tipc_cfg_reply_error_string("link not found"); } tipc_node_lock(node); res = -EINVAL; switch (cmd) { - case TIPC_CMD_SET_LINK_TOL: - if ((new_value >= TIPC_MIN_LINK_TOL) && + case TIPC_CMD_SET_LINK_TOL: + if ((new_value >= TIPC_MIN_LINK_TOL) && (new_value <= TIPC_MAX_LINK_TOL)) { link_set_supervision_props(l_ptr, new_value); - tipc_link_send_proto_msg(l_ptr, STATE_MSG, + tipc_link_send_proto_msg(l_ptr, STATE_MSG, 0, 0, new_value, 0, 0); res = TIPC_OK; } break; - case TIPC_CMD_SET_LINK_PRI: + case TIPC_CMD_SET_LINK_PRI: if ((new_value >= TIPC_MIN_LINK_PRI) && (new_value <= TIPC_MAX_LINK_PRI)) { l_ptr->priority = new_value; - tipc_link_send_proto_msg(l_ptr, STATE_MSG, + tipc_link_send_proto_msg(l_ptr, STATE_MSG, 0, 0, 0, new_value, 0); res = TIPC_OK; } break; - case TIPC_CMD_SET_LINK_WINDOW: - if ((new_value >= TIPC_MIN_LINK_WIN) && + case TIPC_CMD_SET_LINK_WINDOW: + if ((new_value >= TIPC_MIN_LINK_WIN) && (new_value <= TIPC_MAX_LINK_WIN)) { tipc_link_set_queue_limits(l_ptr, new_value); res = TIPC_OK; @@ -2916,7 +3030,7 @@ struct sk_buff *tipc_link_cmd_config(const void *req_tlv_area, int req_tlv_space read_unlock_bh(&tipc_net_lock); if (res) - return tipc_cfg_reply_error_string("cannot change link setting"); + return tipc_cfg_reply_error_string("cannot change link setting"); return tipc_cfg_reply_none(); } @@ -2936,7 +3050,7 @@ static void link_reset_statistics(struct link *l_ptr) struct sk_buff *tipc_link_cmd_reset_stats(const void *req_tlv_area, int req_tlv_space) { char *link_name; - struct link *l_ptr; + struct link *l_ptr; struct node *node; if (!TLV_CHECK(req_tlv_area, req_tlv_space, TIPC_TLV_LINK_NAME)) @@ -2950,7 +3064,7 @@ struct sk_buff *tipc_link_cmd_reset_stats(const void *req_tlv_area, int req_tlv_ } read_lock_bh(&tipc_net_lock); - l_ptr = link_find_link(link_name, &node); + l_ptr = link_find_link(link_name, &node); if (!l_ptr) { read_unlock_bh(&tipc_net_lock); return tipc_cfg_reply_error_string("link not found"); @@ -2977,14 +3091,14 @@ static u32 percent(u32 count, u32 total) * @name: link name * @buf: print buffer area * @buf_size: size of print buffer area - * + * * Returns length of print buffer data string (or 0 if error) */ static int tipc_link_stats(const char *name, char *buf, const u32 buf_size) { struct print_buf pb; - struct link *l_ptr; + struct link *l_ptr; struct node *node; char *status; u32 profile_total = 0; @@ -2995,7 +3109,7 @@ static int tipc_link_stats(const char *name, char *buf, const u32 buf_size) tipc_printbuf_init(&pb, buf, buf_size); read_lock_bh(&tipc_net_lock); - l_ptr = link_find_link(name, &node); + l_ptr = link_find_link(name, &node); if (!l_ptr) { read_unlock_bh(&tipc_net_lock); return 0; @@ -3009,28 +3123,28 @@ static int tipc_link_stats(const char *name, char *buf, const u32 buf_size) else status = "DEFUNCT"; tipc_printf(&pb, "Link <%s>\n" - " %s MTU:%u Priority:%u Tolerance:%u ms" - " Window:%u packets\n", - l_ptr->name, status, link_max_pkt(l_ptr), + " %s MTU:%u Priority:%u Tolerance:%u ms" + " Window:%u packets\n", + l_ptr->name, status, link_max_pkt(l_ptr), l_ptr->priority, l_ptr->tolerance, l_ptr->queue_limit[0]); - tipc_printf(&pb, " RX packets:%u fragments:%u/%u bundles:%u/%u\n", + tipc_printf(&pb, " RX packets:%u fragments:%u/%u bundles:%u/%u\n", l_ptr->next_in_no - l_ptr->stats.recv_info, l_ptr->stats.recv_fragments, l_ptr->stats.recv_fragmented, l_ptr->stats.recv_bundles, l_ptr->stats.recv_bundled); - tipc_printf(&pb, " TX packets:%u fragments:%u/%u bundles:%u/%u\n", + tipc_printf(&pb, " TX packets:%u fragments:%u/%u bundles:%u/%u\n", l_ptr->next_out_no - l_ptr->stats.sent_info, l_ptr->stats.sent_fragments, - l_ptr->stats.sent_fragmented, + l_ptr->stats.sent_fragmented, l_ptr->stats.sent_bundles, l_ptr->stats.sent_bundled); profile_total = l_ptr->stats.msg_length_counts; if (!profile_total) profile_total = 1; tipc_printf(&pb, " TX profile sample:%u packets average:%u octets\n" - " 0-64:%u%% -256:%u%% -1024:%u%% -4096:%u%% " - "-16354:%u%% -32768:%u%% -66000:%u%%\n", + " 0-64:%u%% -256:%u%% -1024:%u%% -4096:%u%% " + "-16354:%u%% -32768:%u%% -66000:%u%%\n", l_ptr->stats.msg_length_counts, l_ptr->stats.msg_lengths_total / profile_total, percent(l_ptr->stats.msg_length_profile[0], profile_total), @@ -3040,21 +3154,21 @@ static int tipc_link_stats(const char *name, char *buf, const u32 buf_size) percent(l_ptr->stats.msg_length_profile[4], profile_total), percent(l_ptr->stats.msg_length_profile[5], profile_total), percent(l_ptr->stats.msg_length_profile[6], profile_total)); - tipc_printf(&pb, " RX states:%u probes:%u naks:%u defs:%u dups:%u\n", + tipc_printf(&pb, " RX states:%u probes:%u naks:%u defs:%u dups:%u\n", l_ptr->stats.recv_states, l_ptr->stats.recv_probes, l_ptr->stats.recv_nacks, - l_ptr->stats.deferred_recv, + l_ptr->stats.deferred_recv, l_ptr->stats.duplicates); - tipc_printf(&pb, " TX states:%u probes:%u naks:%u acks:%u dups:%u\n", - l_ptr->stats.sent_states, - l_ptr->stats.sent_probes, - l_ptr->stats.sent_nacks, - l_ptr->stats.sent_acks, + tipc_printf(&pb, " TX states:%u probes:%u naks:%u acks:%u dups:%u\n", + l_ptr->stats.sent_states, + l_ptr->stats.sent_probes, + l_ptr->stats.sent_nacks, + l_ptr->stats.sent_acks, l_ptr->stats.retransmitted); tipc_printf(&pb, " Congestion bearer:%u link:%u Send queue max:%u avg:%u\n", l_ptr->stats.bearer_congs, - l_ptr->stats.link_congs, + l_ptr->stats.link_congs, l_ptr->stats.max_queue_sz, l_ptr->stats.queue_sz_counts ? (l_ptr->stats.accu_queue_sz / l_ptr->stats.queue_sz_counts) @@ -3086,7 +3200,7 @@ struct sk_buff *tipc_link_cmd_show_stats(const void *req_tlv_area, int req_tlv_s (char *)TLV_DATA(rep_tlv), MAX_LINK_STATS_INFO); if (!str_len) { buf_discard(buf); - return tipc_cfg_reply_error_string("link not found"); + return tipc_cfg_reply_error_string("link not found"); } skb_put(buf, TLV_SPACE(str_len)); @@ -3137,7 +3251,7 @@ int link_control(const char *name, u32 op, u32 val) * tipc_link_get_max_pkt - get maximum packet size to use when sending to destination * @dest: network address of destination node * @selector: used to select from set of active links - * + * * If no active link can be found, uses default maximum packet size. */ @@ -3146,11 +3260,11 @@ u32 tipc_link_get_max_pkt(u32 dest, u32 selector) struct node *n_ptr; struct link *l_ptr; u32 res = MAX_PKT_DEFAULT; - + if (dest == tipc_own_addr) return MAX_MSG_SIZE; - read_lock_bh(&tipc_net_lock); + read_lock_bh(&tipc_net_lock); n_ptr = tipc_node_select(dest, selector); if (n_ptr) { tipc_node_lock(n_ptr); @@ -3159,7 +3273,7 @@ u32 tipc_link_get_max_pkt(u32 dest, u32 selector) res = link_max_pkt(l_ptr); tipc_node_unlock(n_ptr); } - read_unlock_bh(&tipc_net_lock); + read_unlock_bh(&tipc_net_lock); return res; } @@ -3217,10 +3331,10 @@ static void link_print(struct link *l_ptr, struct print_buf *buf, tipc_printf(buf, "%u]", msg_seqno(buf_msg (l_ptr->last_out)), l_ptr->out_queue_size); - if ((mod(msg_seqno(buf_msg(l_ptr->last_out)) - - msg_seqno(buf_msg(l_ptr->first_out))) + if ((mod(msg_seqno(buf_msg(l_ptr->last_out)) - + msg_seqno(buf_msg(l_ptr->first_out))) != (l_ptr->out_queue_size - 1)) - || (l_ptr->last_out->next != 0)) { + || (l_ptr->last_out->next != NULL)) { tipc_printf(buf, "\nSend queue inconsistency\n"); tipc_printf(buf, "first_out= %x ", l_ptr->first_out); tipc_printf(buf, "next_out= %x ", l_ptr->next_out);