linux/net/core/neighbour.c
<<
>>
Prefs
   1/*
   2 *      Generic address resolution entity
   3 *
   4 *      Authors:
   5 *      Pedro Roque             <roque@di.fc.ul.pt>
   6 *      Alexey Kuznetsov        <kuznet@ms2.inr.ac.ru>
   7 *
   8 *      This program is free software; you can redistribute it and/or
   9 *      modify it under the terms of the GNU General Public License
  10 *      as published by the Free Software Foundation; either version
  11 *      2 of the License, or (at your option) any later version.
  12 *
  13 *      Fixes:
  14 *      Vitaly E. Lavrov        releasing NULL neighbor in neigh_add.
  15 *      Harald Welte            Add neighbour cache statistics like rtstat
  16 */
  17
  18#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
  19
  20#include <linux/slab.h>
  21#include <linux/types.h>
  22#include <linux/kernel.h>
  23#include <linux/module.h>
  24#include <linux/socket.h>
  25#include <linux/netdevice.h>
  26#include <linux/proc_fs.h>
  27#ifdef CONFIG_SYSCTL
  28#include <linux/sysctl.h>
  29#endif
  30#include <linux/times.h>
  31#include <net/net_namespace.h>
  32#include <net/neighbour.h>
  33#include <net/dst.h>
  34#include <net/sock.h>
  35#include <net/netevent.h>
  36#include <net/netlink.h>
  37#include <linux/rtnetlink.h>
  38#include <linux/random.h>
  39#include <linux/string.h>
  40#include <linux/log2.h>
  41#include <linux/inetdevice.h>
  42#include <net/addrconf.h>
  43
  44#define DEBUG
  45#define NEIGH_DEBUG 1
  46#define neigh_dbg(level, fmt, ...)              \
  47do {                                            \
  48        if (level <= NEIGH_DEBUG)               \
  49                pr_debug(fmt, ##__VA_ARGS__);   \
  50} while (0)
  51
  52#define PNEIGH_HASHMASK         0xF
  53
  54static void neigh_timer_handler(unsigned long arg);
  55static void __neigh_notify(struct neighbour *n, int type, int flags,
  56                           u32 pid);
  57static void neigh_update_notify(struct neighbour *neigh, u32 nlmsg_pid);
  58static int pneigh_ifdown(struct neigh_table *tbl, struct net_device *dev);
  59
  60#ifdef CONFIG_PROC_FS
  61static const struct file_operations neigh_stat_seq_fops;
  62#endif
  63
  64/*
  65   Neighbour hash table buckets are protected with rwlock tbl->lock.
  66
  67   - All the scans/updates to hash buckets MUST be made under this lock.
  68   - NOTHING clever should be made under this lock: no callbacks
  69     to protocol backends, no attempts to send something to network.
  70     It will result in deadlocks, if backend/driver wants to use neighbour
  71     cache.
  72   - If the entry requires some non-trivial actions, increase
  73     its reference count and release table lock.
  74
  75   Neighbour entries are protected:
  76   - with reference count.
  77   - with rwlock neigh->lock
  78
  79   Reference count prevents destruction.
  80
  81   neigh->lock mainly serializes ll address data and its validity state.
  82   However, the same lock is used to protect another entry fields:
  83    - timer
  84    - resolution queue
  85
  86   Again, nothing clever shall be made under neigh->lock,
  87   the most complicated procedure, which we allow is dev->hard_header.
  88   It is supposed, that dev->hard_header is simplistic and does
  89   not make callbacks to neighbour tables.
  90 */
  91
  92static int neigh_blackhole(struct neighbour *neigh, struct sk_buff *skb)
  93{
  94        kfree_skb(skb);
  95        return -ENETDOWN;
  96}
  97
  98static void neigh_cleanup_and_release(struct neighbour *neigh)
  99{
 100        if (neigh->parms->neigh_cleanup)
 101                neigh->parms->neigh_cleanup(neigh);
 102
 103        __neigh_notify(neigh, RTM_DELNEIGH, 0, 0);
 104        call_netevent_notifiers(NETEVENT_NEIGH_UPDATE, neigh);
 105        neigh_release(neigh);
 106}
 107
 108/*
 109 * It is random distribution in the interval (1/2)*base...(3/2)*base.
 110 * It corresponds to default IPv6 settings and is not overridable,
 111 * because it is really reasonable choice.
 112 */
 113
 114unsigned long neigh_rand_reach_time(unsigned long base)
 115{
 116        return base ? (prandom_u32() % base) + (base >> 1) : 0;
 117}
 118EXPORT_SYMBOL(neigh_rand_reach_time);
 119
 120
 121static bool neigh_del(struct neighbour *n, __u8 state,
 122                      struct neighbour __rcu **np, struct neigh_table *tbl)
 123{
 124        bool retval = false;
 125
 126        write_lock(&n->lock);
 127        if (refcount_read(&n->refcnt) == 1 && !(n->nud_state & state)) {
 128                struct neighbour *neigh;
 129
 130                neigh = rcu_dereference_protected(n->next,
 131                                                  lockdep_is_held(&tbl->lock));
 132                rcu_assign_pointer(*np, neigh);
 133                n->dead = 1;
 134                retval = true;
 135        }
 136        write_unlock(&n->lock);
 137        if (retval)
 138                neigh_cleanup_and_release(n);
 139        return retval;
 140}
 141
 142bool neigh_remove_one(struct neighbour *ndel, struct neigh_table *tbl)
 143{
 144        struct neigh_hash_table *nht;
 145        void *pkey = ndel->primary_key;
 146        u32 hash_val;
 147        struct neighbour *n;
 148        struct neighbour __rcu **np;
 149
 150        nht = rcu_dereference_protected(tbl->nht,
 151                                        lockdep_is_held(&tbl->lock));
 152        hash_val = tbl->hash(pkey, ndel->dev, nht->hash_rnd);
 153        hash_val = hash_val >> (32 - nht->hash_shift);
 154
 155        np = &nht->hash_buckets[hash_val];
 156        while ((n = rcu_dereference_protected(*np,
 157                                              lockdep_is_held(&tbl->lock)))) {
 158                if (n == ndel)
 159                        return neigh_del(n, 0, np, tbl);
 160                np = &n->next;
 161        }
 162        return false;
 163}
 164
 165static int neigh_forced_gc(struct neigh_table *tbl)
 166{
 167        int shrunk = 0;
 168        int i;
 169        struct neigh_hash_table *nht;
 170
 171        NEIGH_CACHE_STAT_INC(tbl, forced_gc_runs);
 172
 173        write_lock_bh(&tbl->lock);
 174        nht = rcu_dereference_protected(tbl->nht,
 175                                        lockdep_is_held(&tbl->lock));
 176        for (i = 0; i < (1 << nht->hash_shift); i++) {
 177                struct neighbour *n;
 178                struct neighbour __rcu **np;
 179
 180                np = &nht->hash_buckets[i];
 181                while ((n = rcu_dereference_protected(*np,
 182                                        lockdep_is_held(&tbl->lock))) != NULL) {
 183                        /* Neighbour record may be discarded if:
 184                         * - nobody refers to it.
 185                         * - it is not permanent
 186                         */
 187                        if (neigh_del(n, NUD_PERMANENT, np, tbl)) {
 188                                shrunk = 1;
 189                                continue;
 190                        }
 191                        np = &n->next;
 192                }
 193        }
 194
 195        tbl->last_flush = jiffies;
 196
 197        write_unlock_bh(&tbl->lock);
 198
 199        return shrunk;
 200}
 201
 202static void neigh_add_timer(struct neighbour *n, unsigned long when)
 203{
 204        neigh_hold(n);
 205        if (unlikely(mod_timer(&n->timer, when))) {
 206                printk("NEIGH: BUG, double timer add, state is %x\n",
 207                       n->nud_state);
 208                dump_stack();
 209        }
 210}
 211
 212static int neigh_del_timer(struct neighbour *n)
 213{
 214        if ((n->nud_state & NUD_IN_TIMER) &&
 215            del_timer(&n->timer)) {
 216                neigh_release(n);
 217                return 1;
 218        }
 219        return 0;
 220}
 221
 222static void pneigh_queue_purge(struct sk_buff_head *list)
 223{
 224        struct sk_buff *skb;
 225
 226        while ((skb = skb_dequeue(list)) != NULL) {
 227                dev_put(skb->dev);
 228                kfree_skb(skb);
 229        }
 230}
 231
 232static void neigh_flush_dev(struct neigh_table *tbl, struct net_device *dev)
 233{
 234        int i;
 235        struct neigh_hash_table *nht;
 236
 237        nht = rcu_dereference_protected(tbl->nht,
 238                                        lockdep_is_held(&tbl->lock));
 239
 240        for (i = 0; i < (1 << nht->hash_shift); i++) {
 241                struct neighbour *n;
 242                struct neighbour __rcu **np = &nht->hash_buckets[i];
 243
 244                while ((n = rcu_dereference_protected(*np,
 245                                        lockdep_is_held(&tbl->lock))) != NULL) {
 246                        if (dev && n->dev != dev) {
 247                                np = &n->next;
 248                                continue;
 249                        }
 250                        rcu_assign_pointer(*np,
 251                                   rcu_dereference_protected(n->next,
 252                                                lockdep_is_held(&tbl->lock)));
 253                        write_lock(&n->lock);
 254                        neigh_del_timer(n);
 255                        n->dead = 1;
 256
 257                        if (refcount_read(&n->refcnt) != 1) {
 258                                /* The most unpleasant situation.
 259                                   We must destroy neighbour entry,
 260                                   but someone still uses it.
 261
 262                                   The destroy will be delayed until
 263                                   the last user releases us, but
 264                                   we must kill timers etc. and move
 265                                   it to safe state.
 266                                 */
 267                                __skb_queue_purge(&n->arp_queue);
 268                                n->arp_queue_len_bytes = 0;
 269                                n->output = neigh_blackhole;
 270                                if (n->nud_state & NUD_VALID)
 271                                        n->nud_state = NUD_NOARP;
 272                                else
 273                                        n->nud_state = NUD_NONE;
 274                                neigh_dbg(2, "neigh %p is stray\n", n);
 275                        }
 276                        write_unlock(&n->lock);
 277                        neigh_cleanup_and_release(n);
 278                }
 279        }
 280}
 281
 282void neigh_changeaddr(struct neigh_table *tbl, struct net_device *dev)
 283{
 284        write_lock_bh(&tbl->lock);
 285        neigh_flush_dev(tbl, dev);
 286        write_unlock_bh(&tbl->lock);
 287}
 288EXPORT_SYMBOL(neigh_changeaddr);
 289
 290int neigh_ifdown(struct neigh_table *tbl, struct net_device *dev)
 291{
 292        write_lock_bh(&tbl->lock);
 293        neigh_flush_dev(tbl, dev);
 294        pneigh_ifdown(tbl, dev);
 295        write_unlock_bh(&tbl->lock);
 296
 297        del_timer_sync(&tbl->proxy_timer);
 298        pneigh_queue_purge(&tbl->proxy_queue);
 299        return 0;
 300}
 301EXPORT_SYMBOL(neigh_ifdown);
 302
 303static struct neighbour *neigh_alloc(struct neigh_table *tbl, struct net_device *dev)
 304{
 305        struct neighbour *n = NULL;
 306        unsigned long now = jiffies;
 307        int entries;
 308
 309        entries = atomic_inc_return(&tbl->entries) - 1;
 310        if (entries >= tbl->gc_thresh3 ||
 311            (entries >= tbl->gc_thresh2 &&
 312             time_after(now, tbl->last_flush + 5 * HZ))) {
 313                if (!neigh_forced_gc(tbl) &&
 314                    entries >= tbl->gc_thresh3) {
 315                        net_info_ratelimited("%s: neighbor table overflow!\n",
 316                                             tbl->id);
 317                        NEIGH_CACHE_STAT_INC(tbl, table_fulls);
 318                        goto out_entries;
 319                }
 320        }
 321
 322        n = kzalloc(tbl->entry_size + dev->neigh_priv_len, GFP_ATOMIC);
 323        if (!n)
 324                goto out_entries;
 325
 326        __skb_queue_head_init(&n->arp_queue);
 327        rwlock_init(&n->lock);
 328        seqlock_init(&n->ha_lock);
 329        n->updated        = n->used = now;
 330        n->nud_state      = NUD_NONE;
 331        n->output         = neigh_blackhole;
 332        seqlock_init(&n->hh.hh_lock);
 333        n->parms          = neigh_parms_clone(&tbl->parms);
 334        setup_timer(&n->timer, neigh_timer_handler, (unsigned long)n);
 335
 336        NEIGH_CACHE_STAT_INC(tbl, allocs);
 337        n->tbl            = tbl;
 338        refcount_set(&n->refcnt, 1);
 339        n->dead           = 1;
 340out:
 341        return n;
 342
 343out_entries:
 344        atomic_dec(&tbl->entries);
 345        goto out;
 346}
 347
 348static void neigh_get_hash_rnd(u32 *x)
 349{
 350        *x = get_random_u32() | 1;
 351}
 352
 353static struct neigh_hash_table *neigh_hash_alloc(unsigned int shift)
 354{
 355        size_t size = (1 << shift) * sizeof(struct neighbour *);
 356        struct neigh_hash_table *ret;
 357        struct neighbour __rcu **buckets;
 358        int i;
 359
 360        ret = kmalloc(sizeof(*ret), GFP_ATOMIC);
 361        if (!ret)
 362                return NULL;
 363        if (size <= PAGE_SIZE)
 364                buckets = kzalloc(size, GFP_ATOMIC);
 365        else
 366                buckets = (struct neighbour __rcu **)
 367                          __get_free_pages(GFP_ATOMIC | __GFP_ZERO,
 368                                           get_order(size));
 369        if (!buckets) {
 370                kfree(ret);
 371                return NULL;
 372        }
 373        ret->hash_buckets = buckets;
 374        ret->hash_shift = shift;
 375        for (i = 0; i < NEIGH_NUM_HASH_RND; i++)
 376                neigh_get_hash_rnd(&ret->hash_rnd[i]);
 377        return ret;
 378}
 379
 380static void neigh_hash_free_rcu(struct rcu_head *head)
 381{
 382        struct neigh_hash_table *nht = container_of(head,
 383                                                    struct neigh_hash_table,
 384                                                    rcu);
 385        size_t size = (1 << nht->hash_shift) * sizeof(struct neighbour *);
 386        struct neighbour __rcu **buckets = nht->hash_buckets;
 387
 388        if (size <= PAGE_SIZE)
 389                kfree(buckets);
 390        else
 391                free_pages((unsigned long)buckets, get_order(size));
 392        kfree(nht);
 393}
 394
 395static struct neigh_hash_table *neigh_hash_grow(struct neigh_table *tbl,
 396                                                unsigned long new_shift)
 397{
 398        unsigned int i, hash;
 399        struct neigh_hash_table *new_nht, *old_nht;
 400
 401        NEIGH_CACHE_STAT_INC(tbl, hash_grows);
 402
 403        old_nht = rcu_dereference_protected(tbl->nht,
 404                                            lockdep_is_held(&tbl->lock));
 405        new_nht = neigh_hash_alloc(new_shift);
 406        if (!new_nht)
 407                return old_nht;
 408
 409        for (i = 0; i < (1 << old_nht->hash_shift); i++) {
 410                struct neighbour *n, *next;
 411
 412                for (n = rcu_dereference_protected(old_nht->hash_buckets[i],
 413                                                   lockdep_is_held(&tbl->lock));
 414                     n != NULL;
 415                     n = next) {
 416                        hash = tbl->hash(n->primary_key, n->dev,
 417                                         new_nht->hash_rnd);
 418
 419                        hash >>= (32 - new_nht->hash_shift);
 420                        next = rcu_dereference_protected(n->next,
 421                                                lockdep_is_held(&tbl->lock));
 422
 423                        rcu_assign_pointer(n->next,
 424                                           rcu_dereference_protected(
 425                                                new_nht->hash_buckets[hash],
 426                                                lockdep_is_held(&tbl->lock)));
 427                        rcu_assign_pointer(new_nht->hash_buckets[hash], n);
 428                }
 429        }
 430
 431        rcu_assign_pointer(tbl->nht, new_nht);
 432        call_rcu(&old_nht->rcu, neigh_hash_free_rcu);
 433        return new_nht;
 434}
 435
 436struct neighbour *neigh_lookup(struct neigh_table *tbl, const void *pkey,
 437                               struct net_device *dev)
 438{
 439        struct neighbour *n;
 440
 441        NEIGH_CACHE_STAT_INC(tbl, lookups);
 442
 443        rcu_read_lock_bh();
 444        n = __neigh_lookup_noref(tbl, pkey, dev);
 445        if (n) {
 446                if (!refcount_inc_not_zero(&n->refcnt))
 447                        n = NULL;
 448                NEIGH_CACHE_STAT_INC(tbl, hits);
 449        }
 450
 451        rcu_read_unlock_bh();
 452        return n;
 453}
 454EXPORT_SYMBOL(neigh_lookup);
 455
 456struct neighbour *neigh_lookup_nodev(struct neigh_table *tbl, struct net *net,
 457                                     const void *pkey)
 458{
 459        struct neighbour *n;
 460        int key_len = tbl->key_len;
 461        u32 hash_val;
 462        struct neigh_hash_table *nht;
 463
 464        NEIGH_CACHE_STAT_INC(tbl, lookups);
 465
 466        rcu_read_lock_bh();
 467        nht = rcu_dereference_bh(tbl->nht);
 468        hash_val = tbl->hash(pkey, NULL, nht->hash_rnd) >> (32 - nht->hash_shift);
 469
 470        for (n = rcu_dereference_bh(nht->hash_buckets[hash_val]);
 471             n != NULL;
 472             n = rcu_dereference_bh(n->next)) {
 473                if (!memcmp(n->primary_key, pkey, key_len) &&
 474                    net_eq(dev_net(n->dev), net)) {
 475                        if (!refcount_inc_not_zero(&n->refcnt))
 476                                n = NULL;
 477                        NEIGH_CACHE_STAT_INC(tbl, hits);
 478                        break;
 479                }
 480        }
 481
 482        rcu_read_unlock_bh();
 483        return n;
 484}
 485EXPORT_SYMBOL(neigh_lookup_nodev);
 486
 487struct neighbour *__neigh_create(struct neigh_table *tbl, const void *pkey,
 488                                 struct net_device *dev, bool want_ref)
 489{
 490        u32 hash_val;
 491        int key_len = tbl->key_len;
 492        int error;
 493        struct neighbour *n1, *rc, *n = neigh_alloc(tbl, dev);
 494        struct neigh_hash_table *nht;
 495
 496        if (!n) {
 497                rc = ERR_PTR(-ENOBUFS);
 498                goto out;
 499        }
 500
 501        memcpy(n->primary_key, pkey, key_len);
 502        n->dev = dev;
 503        dev_hold(dev);
 504
 505        /* Protocol specific setup. */
 506        if (tbl->constructor && (error = tbl->constructor(n)) < 0) {
 507                rc = ERR_PTR(error);
 508                goto out_neigh_release;
 509        }
 510
 511        if (dev->netdev_ops->ndo_neigh_construct) {
 512                error = dev->netdev_ops->ndo_neigh_construct(dev, n);
 513                if (error < 0) {
 514                        rc = ERR_PTR(error);
 515                        goto out_neigh_release;
 516                }
 517        }
 518
 519        /* Device specific setup. */
 520        if (n->parms->neigh_setup &&
 521            (error = n->parms->neigh_setup(n)) < 0) {
 522                rc = ERR_PTR(error);
 523                goto out_neigh_release;
 524        }
 525
 526        n->confirmed = jiffies - (NEIGH_VAR(n->parms, BASE_REACHABLE_TIME) << 1);
 527
 528        write_lock_bh(&tbl->lock);
 529        nht = rcu_dereference_protected(tbl->nht,
 530                                        lockdep_is_held(&tbl->lock));
 531
 532        if (atomic_read(&tbl->entries) > (1 << nht->hash_shift))
 533                nht = neigh_hash_grow(tbl, nht->hash_shift + 1);
 534
 535        hash_val = tbl->hash(pkey, dev, nht->hash_rnd) >> (32 - nht->hash_shift);
 536
 537        if (n->parms->dead) {
 538                rc = ERR_PTR(-EINVAL);
 539                goto out_tbl_unlock;
 540        }
 541
 542        for (n1 = rcu_dereference_protected(nht->hash_buckets[hash_val],
 543                                            lockdep_is_held(&tbl->lock));
 544             n1 != NULL;
 545             n1 = rcu_dereference_protected(n1->next,
 546                        lockdep_is_held(&tbl->lock))) {
 547                if (dev == n1->dev && !memcmp(n1->primary_key, pkey, key_len)) {
 548                        if (want_ref)
 549                                neigh_hold(n1);
 550                        rc = n1;
 551                        goto out_tbl_unlock;
 552                }
 553        }
 554
 555        n->dead = 0;
 556        if (want_ref)
 557                neigh_hold(n);
 558        rcu_assign_pointer(n->next,
 559                           rcu_dereference_protected(nht->hash_buckets[hash_val],
 560                                                     lockdep_is_held(&tbl->lock)));
 561        rcu_assign_pointer(nht->hash_buckets[hash_val], n);
 562        write_unlock_bh(&tbl->lock);
 563        neigh_dbg(2, "neigh %p is created\n", n);
 564        rc = n;
 565out:
 566        return rc;
 567out_tbl_unlock:
 568        write_unlock_bh(&tbl->lock);
 569out_neigh_release:
 570        neigh_release(n);
 571        goto out;
 572}
 573EXPORT_SYMBOL(__neigh_create);
 574
 575static u32 pneigh_hash(const void *pkey, int key_len)
 576{
 577        u32 hash_val = *(u32 *)(pkey + key_len - 4);
 578        hash_val ^= (hash_val >> 16);
 579        hash_val ^= hash_val >> 8;
 580        hash_val ^= hash_val >> 4;
 581        hash_val &= PNEIGH_HASHMASK;
 582        return hash_val;
 583}
 584
 585static struct pneigh_entry *__pneigh_lookup_1(struct pneigh_entry *n,
 586                                              struct net *net,
 587                                              const void *pkey,
 588                                              int key_len,
 589                                              struct net_device *dev)
 590{
 591        while (n) {
 592                if (!memcmp(n->key, pkey, key_len) &&
 593                    net_eq(pneigh_net(n), net) &&
 594                    (n->dev == dev || !n->dev))
 595                        return n;
 596                n = n->next;
 597        }
 598        return NULL;
 599}
 600
 601struct pneigh_entry *__pneigh_lookup(struct neigh_table *tbl,
 602                struct net *net, const void *pkey, struct net_device *dev)
 603{
 604        int key_len = tbl->key_len;
 605        u32 hash_val = pneigh_hash(pkey, key_len);
 606
 607        return __pneigh_lookup_1(tbl->phash_buckets[hash_val],
 608                                 net, pkey, key_len, dev);
 609}
 610EXPORT_SYMBOL_GPL(__pneigh_lookup);
 611
 612struct pneigh_entry * pneigh_lookup(struct neigh_table *tbl,
 613                                    struct net *net, const void *pkey,
 614                                    struct net_device *dev, int creat)
 615{
 616        struct pneigh_entry *n;
 617        int key_len = tbl->key_len;
 618        u32 hash_val = pneigh_hash(pkey, key_len);
 619
 620        read_lock_bh(&tbl->lock);
 621        n = __pneigh_lookup_1(tbl->phash_buckets[hash_val],
 622                              net, pkey, key_len, dev);
 623        read_unlock_bh(&tbl->lock);
 624
 625        if (n || !creat)
 626                goto out;
 627
 628        ASSERT_RTNL();
 629
 630        n = kmalloc(sizeof(*n) + key_len, GFP_KERNEL);
 631        if (!n)
 632                goto out;
 633
 634        write_pnet(&n->net, net);
 635        memcpy(n->key, pkey, key_len);
 636        n->dev = dev;
 637        if (dev)
 638                dev_hold(dev);
 639
 640        if (tbl->pconstructor && tbl->pconstructor(n)) {
 641                if (dev)
 642                        dev_put(dev);
 643                kfree(n);
 644                n = NULL;
 645                goto out;
 646        }
 647
 648        write_lock_bh(&tbl->lock);
 649        n->next = tbl->phash_buckets[hash_val];
 650        tbl->phash_buckets[hash_val] = n;
 651        write_unlock_bh(&tbl->lock);
 652out:
 653        return n;
 654}
 655EXPORT_SYMBOL(pneigh_lookup);
 656
 657
 658int pneigh_delete(struct neigh_table *tbl, struct net *net, const void *pkey,
 659                  struct net_device *dev)
 660{
 661        struct pneigh_entry *n, **np;
 662        int key_len = tbl->key_len;
 663        u32 hash_val = pneigh_hash(pkey, key_len);
 664
 665        write_lock_bh(&tbl->lock);
 666        for (np = &tbl->phash_buckets[hash_val]; (n = *np) != NULL;
 667             np = &n->next) {
 668                if (!memcmp(n->key, pkey, key_len) && n->dev == dev &&
 669                    net_eq(pneigh_net(n), net)) {
 670                        *np = n->next;
 671                        write_unlock_bh(&tbl->lock);
 672                        if (tbl->pdestructor)
 673                                tbl->pdestructor(n);
 674                        if (n->dev)
 675                                dev_put(n->dev);
 676                        kfree(n);
 677                        return 0;
 678                }
 679        }
 680        write_unlock_bh(&tbl->lock);
 681        return -ENOENT;
 682}
 683
 684static int pneigh_ifdown(struct neigh_table *tbl, struct net_device *dev)
 685{
 686        struct pneigh_entry *n, **np;
 687        u32 h;
 688
 689        for (h = 0; h <= PNEIGH_HASHMASK; h++) {
 690                np = &tbl->phash_buckets[h];
 691                while ((n = *np) != NULL) {
 692                        if (!dev || n->dev == dev) {
 693                                *np = n->next;
 694                                if (tbl->pdestructor)
 695                                        tbl->pdestructor(n);
 696                                if (n->dev)
 697                                        dev_put(n->dev);
 698                                kfree(n);
 699                                continue;
 700                        }
 701                        np = &n->next;
 702                }
 703        }
 704        return -ENOENT;
 705}
 706
 707static void neigh_parms_destroy(struct neigh_parms *parms);
 708
 709static inline void neigh_parms_put(struct neigh_parms *parms)
 710{
 711        if (refcount_dec_and_test(&parms->refcnt))
 712                neigh_parms_destroy(parms);
 713}
 714
 715/*
 716 *      neighbour must already be out of the table;
 717 *
 718 */
 719void neigh_destroy(struct neighbour *neigh)
 720{
 721        struct net_device *dev = neigh->dev;
 722
 723        NEIGH_CACHE_STAT_INC(neigh->tbl, destroys);
 724
 725        if (!neigh->dead) {
 726                pr_warn("Destroying alive neighbour %p\n", neigh);
 727                dump_stack();
 728                return;
 729        }
 730
 731        if (neigh_del_timer(neigh))
 732                pr_warn("Impossible event\n");
 733
 734        write_lock_bh(&neigh->lock);
 735        __skb_queue_purge(&neigh->arp_queue);
 736        write_unlock_bh(&neigh->lock);
 737        neigh->arp_queue_len_bytes = 0;
 738
 739        if (dev->netdev_ops->ndo_neigh_destroy)
 740                dev->netdev_ops->ndo_neigh_destroy(dev, neigh);
 741
 742        dev_put(dev);
 743        neigh_parms_put(neigh->parms);
 744
 745        neigh_dbg(2, "neigh %p is destroyed\n", neigh);
 746
 747        atomic_dec(&neigh->tbl->entries);
 748        kfree_rcu(neigh, rcu);
 749}
 750EXPORT_SYMBOL(neigh_destroy);
 751
 752/* Neighbour state is suspicious;
 753   disable fast path.
 754
 755   Called with write_locked neigh.
 756 */
 757static void neigh_suspect(struct neighbour *neigh)
 758{
 759        neigh_dbg(2, "neigh %p is suspected\n", neigh);
 760
 761        neigh->output = neigh->ops->output;
 762}
 763
 764/* Neighbour state is OK;
 765   enable fast path.
 766
 767   Called with write_locked neigh.
 768 */
 769static void neigh_connect(struct neighbour *neigh)
 770{
 771        neigh_dbg(2, "neigh %p is connected\n", neigh);
 772
 773        neigh->output = neigh->ops->connected_output;
 774}
 775
 776static void neigh_periodic_work(struct work_struct *work)
 777{
 778        struct neigh_table *tbl = container_of(work, struct neigh_table, gc_work.work);
 779        struct neighbour *n;
 780        struct neighbour __rcu **np;
 781        unsigned int i;
 782        struct neigh_hash_table *nht;
 783
 784        NEIGH_CACHE_STAT_INC(tbl, periodic_gc_runs);
 785
 786        write_lock_bh(&tbl->lock);
 787        nht = rcu_dereference_protected(tbl->nht,
 788                                        lockdep_is_held(&tbl->lock));
 789
 790        /*
 791         *      periodically recompute ReachableTime from random function
 792         */
 793
 794        if (time_after(jiffies, tbl->last_rand + 300 * HZ)) {
 795                struct neigh_parms *p;
 796                tbl->last_rand = jiffies;
 797                list_for_each_entry(p, &tbl->parms_list, list)
 798                        p->reachable_time =
 799                                neigh_rand_reach_time(NEIGH_VAR(p, BASE_REACHABLE_TIME));
 800        }
 801
 802        if (atomic_read(&tbl->entries) < tbl->gc_thresh1)
 803                goto out;
 804
 805        for (i = 0 ; i < (1 << nht->hash_shift); i++) {
 806                np = &nht->hash_buckets[i];
 807
 808                while ((n = rcu_dereference_protected(*np,
 809                                lockdep_is_held(&tbl->lock))) != NULL) {
 810                        unsigned int state;
 811
 812                        write_lock(&n->lock);
 813
 814                        state = n->nud_state;
 815                        if (state & (NUD_PERMANENT | NUD_IN_TIMER)) {
 816                                write_unlock(&n->lock);
 817                                goto next_elt;
 818                        }
 819
 820                        if (time_before(n->used, n->confirmed))
 821                                n->used = n->confirmed;
 822
 823                        if (refcount_read(&n->refcnt) == 1 &&
 824                            (state == NUD_FAILED ||
 825                             time_after(jiffies, n->used + NEIGH_VAR(n->parms, GC_STALETIME)))) {
 826                                *np = n->next;
 827                                n->dead = 1;
 828                                write_unlock(&n->lock);
 829                                neigh_cleanup_and_release(n);
 830                                continue;
 831                        }
 832                        write_unlock(&n->lock);
 833
 834next_elt:
 835                        np = &n->next;
 836                }
 837                /*
 838                 * It's fine to release lock here, even if hash table
 839                 * grows while we are preempted.
 840                 */
 841                write_unlock_bh(&tbl->lock);
 842                cond_resched();
 843                write_lock_bh(&tbl->lock);
 844                nht = rcu_dereference_protected(tbl->nht,
 845                                                lockdep_is_held(&tbl->lock));
 846        }
 847out:
 848        /* Cycle through all hash buckets every BASE_REACHABLE_TIME/2 ticks.
 849         * ARP entry timeouts range from 1/2 BASE_REACHABLE_TIME to 3/2
 850         * BASE_REACHABLE_TIME.
 851         */
 852        queue_delayed_work(system_power_efficient_wq, &tbl->gc_work,
 853                              NEIGH_VAR(&tbl->parms, BASE_REACHABLE_TIME) >> 1);
 854        write_unlock_bh(&tbl->lock);
 855}
 856
 857static __inline__ int neigh_max_probes(struct neighbour *n)
 858{
 859        struct neigh_parms *p = n->parms;
 860        return NEIGH_VAR(p, UCAST_PROBES) + NEIGH_VAR(p, APP_PROBES) +
 861               (n->nud_state & NUD_PROBE ? NEIGH_VAR(p, MCAST_REPROBES) :
 862                NEIGH_VAR(p, MCAST_PROBES));
 863}
 864
 865static void neigh_invalidate(struct neighbour *neigh)
 866        __releases(neigh->lock)
 867        __acquires(neigh->lock)
 868{
 869        struct sk_buff *skb;
 870
 871        NEIGH_CACHE_STAT_INC(neigh->tbl, res_failed);
 872        neigh_dbg(2, "neigh %p is failed\n", neigh);
 873        neigh->updated = jiffies;
 874
 875        /* It is very thin place. report_unreachable is very complicated
 876           routine. Particularly, it can hit the same neighbour entry!
 877
 878           So that, we try to be accurate and avoid dead loop. --ANK
 879         */
 880        while (neigh->nud_state == NUD_FAILED &&
 881               (skb = __skb_dequeue(&neigh->arp_queue)) != NULL) {
 882                write_unlock(&neigh->lock);
 883                neigh->ops->error_report(neigh, skb);
 884                write_lock(&neigh->lock);
 885        }
 886        __skb_queue_purge(&neigh->arp_queue);
 887        neigh->arp_queue_len_bytes = 0;
 888}
 889
 890static void neigh_probe(struct neighbour *neigh)
 891        __releases(neigh->lock)
 892{
 893        struct sk_buff *skb = skb_peek_tail(&neigh->arp_queue);
 894        /* keep skb alive even if arp_queue overflows */
 895        if (skb)
 896                skb = skb_clone(skb, GFP_ATOMIC);
 897        write_unlock(&neigh->lock);
 898        if (neigh->ops->solicit)
 899                neigh->ops->solicit(neigh, skb);
 900        atomic_inc(&neigh->probes);
 901        kfree_skb(skb);
 902}
 903
 904/* Called when a timer expires for a neighbour entry. */
 905
 906static void neigh_timer_handler(unsigned long arg)
 907{
 908        unsigned long now, next;
 909        struct neighbour *neigh = (struct neighbour *)arg;
 910        unsigned int state;
 911        int notify = 0;
 912
 913        write_lock(&neigh->lock);
 914
 915        state = neigh->nud_state;
 916        now = jiffies;
 917        next = now + HZ;
 918
 919        if (!(state & NUD_IN_TIMER))
 920                goto out;
 921
 922        if (state & NUD_REACHABLE) {
 923                if (time_before_eq(now,
 924                                   neigh->confirmed + neigh->parms->reachable_time)) {
 925                        neigh_dbg(2, "neigh %p is still alive\n", neigh);
 926                        next = neigh->confirmed + neigh->parms->reachable_time;
 927                } else if (time_before_eq(now,
 928                                          neigh->used +
 929                                          NEIGH_VAR(neigh->parms, DELAY_PROBE_TIME))) {
 930                        neigh_dbg(2, "neigh %p is delayed\n", neigh);
 931                        neigh->nud_state = NUD_DELAY;
 932                        neigh->updated = jiffies;
 933                        neigh_suspect(neigh);
 934                        next = now + NEIGH_VAR(neigh->parms, DELAY_PROBE_TIME);
 935                } else {
 936                        neigh_dbg(2, "neigh %p is suspected\n", neigh);
 937                        neigh->nud_state = NUD_STALE;
 938                        neigh->updated = jiffies;
 939                        neigh_suspect(neigh);
 940                        notify = 1;
 941                }
 942        } else if (state & NUD_DELAY) {
 943                if (time_before_eq(now,
 944                                   neigh->confirmed +
 945                                   NEIGH_VAR(neigh->parms, DELAY_PROBE_TIME))) {
 946                        neigh_dbg(2, "neigh %p is now reachable\n", neigh);
 947                        neigh->nud_state = NUD_REACHABLE;
 948                        neigh->updated = jiffies;
 949                        neigh_connect(neigh);
 950                        notify = 1;
 951                        next = neigh->confirmed + neigh->parms->reachable_time;
 952                } else {
 953                        neigh_dbg(2, "neigh %p is probed\n", neigh);
 954                        neigh->nud_state = NUD_PROBE;
 955                        neigh->updated = jiffies;
 956                        atomic_set(&neigh->probes, 0);
 957                        notify = 1;
 958                        next = now + NEIGH_VAR(neigh->parms, RETRANS_TIME);
 959                }
 960        } else {
 961                /* NUD_PROBE|NUD_INCOMPLETE */
 962                next = now + NEIGH_VAR(neigh->parms, RETRANS_TIME);
 963        }
 964
 965        if ((neigh->nud_state & (NUD_INCOMPLETE | NUD_PROBE)) &&
 966            atomic_read(&neigh->probes) >= neigh_max_probes(neigh)) {
 967                neigh->nud_state = NUD_FAILED;
 968                notify = 1;
 969                neigh_invalidate(neigh);
 970                goto out;
 971        }
 972
 973        if (neigh->nud_state & NUD_IN_TIMER) {
 974                if (time_before(next, jiffies + HZ/2))
 975                        next = jiffies + HZ/2;
 976                if (!mod_timer(&neigh->timer, next))
 977                        neigh_hold(neigh);
 978        }
 979        if (neigh->nud_state & (NUD_INCOMPLETE | NUD_PROBE)) {
 980                neigh_probe(neigh);
 981        } else {
 982out:
 983                write_unlock(&neigh->lock);
 984        }
 985
 986        if (notify)
 987                neigh_update_notify(neigh, 0);
 988
 989        neigh_release(neigh);
 990}
 991
 992int __neigh_event_send(struct neighbour *neigh, struct sk_buff *skb)
 993{
 994        int rc;
 995        bool immediate_probe = false;
 996
 997        write_lock_bh(&neigh->lock);
 998
 999        rc = 0;
1000        if (neigh->nud_state & (NUD_CONNECTED | NUD_DELAY | NUD_PROBE))
1001                goto out_unlock_bh;
1002        if (neigh->dead)
1003                goto out_dead;
1004
1005        if (!(neigh->nud_state & (NUD_STALE | NUD_INCOMPLETE))) {
1006                if (NEIGH_VAR(neigh->parms, MCAST_PROBES) +
1007                    NEIGH_VAR(neigh->parms, APP_PROBES)) {
1008                        unsigned long next, now = jiffies;
1009
1010                        atomic_set(&neigh->probes,
1011                                   NEIGH_VAR(neigh->parms, UCAST_PROBES));
1012                        neigh->nud_state     = NUD_INCOMPLETE;
1013                        neigh->updated = now;
1014                        next = now + max(NEIGH_VAR(neigh->parms, RETRANS_TIME),
1015                                         HZ/2);
1016                        neigh_add_timer(neigh, next);
1017                        immediate_probe = true;
1018                } else {
1019                        neigh->nud_state = NUD_FAILED;
1020                        neigh->updated = jiffies;
1021                        write_unlock_bh(&neigh->lock);
1022
1023                        kfree_skb(skb);
1024                        return 1;
1025                }
1026        } else if (neigh->nud_state & NUD_STALE) {
1027                neigh_dbg(2, "neigh %p is delayed\n", neigh);
1028                neigh->nud_state = NUD_DELAY;
1029                neigh->updated = jiffies;
1030                neigh_add_timer(neigh, jiffies +
1031                                NEIGH_VAR(neigh->parms, DELAY_PROBE_TIME));
1032        }
1033
1034        if (neigh->nud_state == NUD_INCOMPLETE) {
1035                if (skb) {
1036                        while (neigh->arp_queue_len_bytes + skb->truesize >
1037                               NEIGH_VAR(neigh->parms, QUEUE_LEN_BYTES)) {
1038                                struct sk_buff *buff;
1039
1040                                buff = __skb_dequeue(&neigh->arp_queue);
1041                                if (!buff)
1042                                        break;
1043                                neigh->arp_queue_len_bytes -= buff->truesize;
1044                                kfree_skb(buff);
1045                                NEIGH_CACHE_STAT_INC(neigh->tbl, unres_discards);
1046                        }
1047                        skb_dst_force(skb);
1048                        __skb_queue_tail(&neigh->arp_queue, skb);
1049                        neigh->arp_queue_len_bytes += skb->truesize;
1050                }
1051                rc = 1;
1052        }
1053out_unlock_bh:
1054        if (immediate_probe)
1055                neigh_probe(neigh);
1056        else
1057                write_unlock(&neigh->lock);
1058        local_bh_enable();
1059        return rc;
1060
1061out_dead:
1062        if (neigh->nud_state & NUD_STALE)
1063                goto out_unlock_bh;
1064        write_unlock_bh(&neigh->lock);
1065        kfree_skb(skb);
1066        return 1;
1067}
1068EXPORT_SYMBOL(__neigh_event_send);
1069
1070static void neigh_update_hhs(struct neighbour *neigh)
1071{
1072        struct hh_cache *hh;
1073        void (*update)(struct hh_cache*, const struct net_device*, const unsigned char *)
1074                = NULL;
1075
1076        if (neigh->dev->header_ops)
1077                update = neigh->dev->header_ops->cache_update;
1078
1079        if (update) {
1080                hh = &neigh->hh;
1081                if (hh->hh_len) {
1082                        write_seqlock_bh(&hh->hh_lock);
1083                        update(hh, neigh->dev, neigh->ha);
1084                        write_sequnlock_bh(&hh->hh_lock);
1085                }
1086        }
1087}
1088
1089
1090
1091/* Generic update routine.
1092   -- lladdr is new lladdr or NULL, if it is not supplied.
1093   -- new    is new state.
1094   -- flags
1095        NEIGH_UPDATE_F_OVERRIDE allows to override existing lladdr,
1096                                if it is different.
1097        NEIGH_UPDATE_F_WEAK_OVERRIDE will suspect existing "connected"
1098                                lladdr instead of overriding it
1099                                if it is different.
1100        NEIGH_UPDATE_F_ADMIN    means that the change is administrative.
1101
1102        NEIGH_UPDATE_F_OVERRIDE_ISROUTER allows to override existing
1103                                NTF_ROUTER flag.
1104        NEIGH_UPDATE_F_ISROUTER indicates if the neighbour is known as
1105                                a router.
1106
1107   Caller MUST hold reference count on the entry.
1108 */
1109
1110int neigh_update(struct neighbour *neigh, const u8 *lladdr, u8 new,
1111                 u32 flags, u32 nlmsg_pid)
1112{
1113        u8 old;
1114        int err;
1115        int notify = 0;
1116        struct net_device *dev;
1117        int update_isrouter = 0;
1118
1119        write_lock_bh(&neigh->lock);
1120
1121        dev    = neigh->dev;
1122        old    = neigh->nud_state;
1123        err    = -EPERM;
1124
1125        if (!(flags & NEIGH_UPDATE_F_ADMIN) &&
1126            (old & (NUD_NOARP | NUD_PERMANENT)))
1127                goto out;
1128        if (neigh->dead)
1129                goto out;
1130
1131        if (!(new & NUD_VALID)) {
1132                neigh_del_timer(neigh);
1133                if (old & NUD_CONNECTED)
1134                        neigh_suspect(neigh);
1135                neigh->nud_state = new;
1136                err = 0;
1137                notify = old & NUD_VALID;
1138                if ((old & (NUD_INCOMPLETE | NUD_PROBE)) &&
1139                    (new & NUD_FAILED)) {
1140                        neigh_invalidate(neigh);
1141                        notify = 1;
1142                }
1143                goto out;
1144        }
1145
1146        /* Compare new lladdr with cached one */
1147        if (!dev->addr_len) {
1148                /* First case: device needs no address. */
1149                lladdr = neigh->ha;
1150        } else if (lladdr) {
1151                /* The second case: if something is already cached
1152                   and a new address is proposed:
1153                   - compare new & old
1154                   - if they are different, check override flag
1155                 */
1156                if ((old & NUD_VALID) &&
1157                    !memcmp(lladdr, neigh->ha, dev->addr_len))
1158                        lladdr = neigh->ha;
1159        } else {
1160                /* No address is supplied; if we know something,
1161                   use it, otherwise discard the request.
1162                 */
1163                err = -EINVAL;
1164                if (!(old & NUD_VALID))
1165                        goto out;
1166                lladdr = neigh->ha;
1167        }
1168
1169        /* If entry was valid and address is not changed,
1170           do not change entry state, if new one is STALE.
1171         */
1172        err = 0;
1173        update_isrouter = flags & NEIGH_UPDATE_F_OVERRIDE_ISROUTER;
1174        if (old & NUD_VALID) {
1175                if (lladdr != neigh->ha && !(flags & NEIGH_UPDATE_F_OVERRIDE)) {
1176                        update_isrouter = 0;
1177                        if ((flags & NEIGH_UPDATE_F_WEAK_OVERRIDE) &&
1178                            (old & NUD_CONNECTED)) {
1179                                lladdr = neigh->ha;
1180                                new = NUD_STALE;
1181                        } else
1182                                goto out;
1183                } else {
1184                        if (lladdr == neigh->ha && new == NUD_STALE &&
1185                            !(flags & NEIGH_UPDATE_F_ADMIN))
1186                                new = old;
1187                }
1188        }
1189
1190        /* Update timestamps only once we know we will make a change to the
1191         * neighbour entry. Otherwise we risk to move the locktime window with
1192         * noop updates and ignore relevant ARP updates.
1193         */
1194        if (new != old || lladdr != neigh->ha) {
1195                if (new & NUD_CONNECTED)
1196                        neigh->confirmed = jiffies;
1197                neigh->updated = jiffies;
1198        }
1199
1200        if (new != old) {
1201                neigh_del_timer(neigh);
1202                if (new & NUD_PROBE)
1203                        atomic_set(&neigh->probes, 0);
1204                if (new & NUD_IN_TIMER)
1205                        neigh_add_timer(neigh, (jiffies +
1206                                                ((new & NUD_REACHABLE) ?
1207                                                 neigh->parms->reachable_time :
1208                                                 0)));
1209                neigh->nud_state = new;
1210                notify = 1;
1211        }
1212
1213        if (lladdr != neigh->ha) {
1214                write_seqlock(&neigh->ha_lock);
1215                memcpy(&neigh->ha, lladdr, dev->addr_len);
1216                write_sequnlock(&neigh->ha_lock);
1217                neigh_update_hhs(neigh);
1218                if (!(new & NUD_CONNECTED))
1219                        neigh->confirmed = jiffies -
1220                                      (NEIGH_VAR(neigh->parms, BASE_REACHABLE_TIME) << 1);
1221                notify = 1;
1222        }
1223        if (new == old)
1224                goto out;
1225        if (new & NUD_CONNECTED)
1226                neigh_connect(neigh);
1227        else
1228                neigh_suspect(neigh);
1229        if (!(old & NUD_VALID)) {
1230                struct sk_buff *skb;
1231
1232                /* Again: avoid dead loop if something went wrong */
1233
1234                while (neigh->nud_state & NUD_VALID &&
1235                       (skb = __skb_dequeue(&neigh->arp_queue)) != NULL) {
1236                        struct dst_entry *dst = skb_dst(skb);
1237                        struct neighbour *n2, *n1 = neigh;
1238                        write_unlock_bh(&neigh->lock);
1239
1240                        rcu_read_lock();
1241
1242                        /* Why not just use 'neigh' as-is?  The problem is that
1243                         * things such as shaper, eql, and sch_teql can end up
1244                         * using alternative, different, neigh objects to output
1245                         * the packet in the output path.  So what we need to do
1246                         * here is re-lookup the top-level neigh in the path so
1247                         * we can reinject the packet there.
1248                         */
1249                        n2 = NULL;
1250                        if (dst) {
1251                                n2 = dst_neigh_lookup_skb(dst, skb);
1252                                if (n2)
1253                                        n1 = n2;
1254                        }
1255                        n1->output(n1, skb);
1256                        if (n2)
1257                                neigh_release(n2);
1258                        rcu_read_unlock();
1259
1260                        write_lock_bh(&neigh->lock);
1261                }
1262                __skb_queue_purge(&neigh->arp_queue);
1263                neigh->arp_queue_len_bytes = 0;
1264        }
1265out:
1266        if (update_isrouter) {
1267                neigh->flags = (flags & NEIGH_UPDATE_F_ISROUTER) ?
1268                        (neigh->flags | NTF_ROUTER) :
1269                        (neigh->flags & ~NTF_ROUTER);
1270        }
1271        write_unlock_bh(&neigh->lock);
1272
1273        if (notify)
1274                neigh_update_notify(neigh, nlmsg_pid);
1275
1276        return err;
1277}
1278EXPORT_SYMBOL(neigh_update);
1279
1280/* Update the neigh to listen temporarily for probe responses, even if it is
1281 * in a NUD_FAILED state. The caller has to hold neigh->lock for writing.
1282 */
1283void __neigh_set_probe_once(struct neighbour *neigh)
1284{
1285        if (neigh->dead)
1286                return;
1287        neigh->updated = jiffies;
1288        if (!(neigh->nud_state & NUD_FAILED))
1289                return;
1290        neigh->nud_state = NUD_INCOMPLETE;
1291        atomic_set(&neigh->probes, neigh_max_probes(neigh));
1292        neigh_add_timer(neigh,
1293                        jiffies + NEIGH_VAR(neigh->parms, RETRANS_TIME));
1294}
1295EXPORT_SYMBOL(__neigh_set_probe_once);
1296
1297struct neighbour *neigh_event_ns(struct neigh_table *tbl,
1298                                 u8 *lladdr, void *saddr,
1299                                 struct net_device *dev)
1300{
1301        struct neighbour *neigh = __neigh_lookup(tbl, saddr, dev,
1302                                                 lladdr || !dev->addr_len);
1303        if (neigh)
1304                neigh_update(neigh, lladdr, NUD_STALE,
1305                             NEIGH_UPDATE_F_OVERRIDE, 0);
1306        return neigh;
1307}
1308EXPORT_SYMBOL(neigh_event_ns);
1309
1310/* called with read_lock_bh(&n->lock); */
1311static void neigh_hh_init(struct neighbour *n)
1312{
1313        struct net_device *dev = n->dev;
1314        __be16 prot = n->tbl->protocol;
1315        struct hh_cache *hh = &n->hh;
1316
1317        write_lock_bh(&n->lock);
1318
1319        /* Only one thread can come in here and initialize the
1320         * hh_cache entry.
1321         */
1322        if (!hh->hh_len)
1323                dev->header_ops->cache(n, hh, prot);
1324
1325        write_unlock_bh(&n->lock);
1326}
1327
1328/* Slow and careful. */
1329
1330int neigh_resolve_output(struct neighbour *neigh, struct sk_buff *skb)
1331{
1332        int rc = 0;
1333
1334        if (!neigh_event_send(neigh, skb)) {
1335                int err;
1336                struct net_device *dev = neigh->dev;
1337                unsigned int seq;
1338
1339                if (dev->header_ops->cache && !neigh->hh.hh_len)
1340                        neigh_hh_init(neigh);
1341
1342                do {
1343                        __skb_pull(skb, skb_network_offset(skb));
1344                        seq = read_seqbegin(&neigh->ha_lock);
1345                        err = dev_hard_header(skb, dev, ntohs(skb->protocol),
1346                                              neigh->ha, NULL, skb->len);
1347                } while (read_seqretry(&neigh->ha_lock, seq));
1348
1349                if (err >= 0)
1350                        rc = dev_queue_xmit(skb);
1351                else
1352                        goto out_kfree_skb;
1353        }
1354out:
1355        return rc;
1356out_kfree_skb:
1357        rc = -EINVAL;
1358        kfree_skb(skb);
1359        goto out;
1360}
1361EXPORT_SYMBOL(neigh_resolve_output);
1362
1363/* As fast as possible without hh cache */
1364
1365int neigh_connected_output(struct neighbour *neigh, struct sk_buff *skb)
1366{
1367        struct net_device *dev = neigh->dev;
1368        unsigned int seq;
1369        int err;
1370
1371        do {
1372                __skb_pull(skb, skb_network_offset(skb));
1373                seq = read_seqbegin(&neigh->ha_lock);
1374                err = dev_hard_header(skb, dev, ntohs(skb->protocol),
1375                                      neigh->ha, NULL, skb->len);
1376        } while (read_seqretry(&neigh->ha_lock, seq));
1377
1378        if (err >= 0)
1379                err = dev_queue_xmit(skb);
1380        else {
1381                err = -EINVAL;
1382                kfree_skb(skb);
1383        }
1384        return err;
1385}
1386EXPORT_SYMBOL(neigh_connected_output);
1387
1388int neigh_direct_output(struct neighbour *neigh, struct sk_buff *skb)
1389{
1390        return dev_queue_xmit(skb);
1391}
1392EXPORT_SYMBOL(neigh_direct_output);
1393
1394static void neigh_proxy_process(unsigned long arg)
1395{
1396        struct neigh_table *tbl = (struct neigh_table *)arg;
1397        long sched_next = 0;
1398        unsigned long now = jiffies;
1399        struct sk_buff *skb, *n;
1400
1401        spin_lock(&tbl->proxy_queue.lock);
1402
1403        skb_queue_walk_safe(&tbl->proxy_queue, skb, n) {
1404                long tdif = NEIGH_CB(skb)->sched_next - now;
1405
1406                if (tdif <= 0) {
1407                        struct net_device *dev = skb->dev;
1408
1409                        __skb_unlink(skb, &tbl->proxy_queue);
1410                        if (tbl->proxy_redo && netif_running(dev)) {
1411                                rcu_read_lock();
1412                                tbl->proxy_redo(skb);
1413                                rcu_read_unlock();
1414                        } else {
1415                                kfree_skb(skb);
1416                        }
1417
1418                        dev_put(dev);
1419                } else if (!sched_next || tdif < sched_next)
1420                        sched_next = tdif;
1421        }
1422        del_timer(&tbl->proxy_timer);
1423        if (sched_next)
1424                mod_timer(&tbl->proxy_timer, jiffies + sched_next);
1425        spin_unlock(&tbl->proxy_queue.lock);
1426}
1427
1428void pneigh_enqueue(struct neigh_table *tbl, struct neigh_parms *p,
1429                    struct sk_buff *skb)
1430{
1431        unsigned long now = jiffies;
1432
1433        unsigned long sched_next = now + (prandom_u32() %
1434                                          NEIGH_VAR(p, PROXY_DELAY));
1435
1436        if (tbl->proxy_queue.qlen > NEIGH_VAR(p, PROXY_QLEN)) {
1437                kfree_skb(skb);
1438                return;
1439        }
1440
1441        NEIGH_CB(skb)->sched_next = sched_next;
1442        NEIGH_CB(skb)->flags |= LOCALLY_ENQUEUED;
1443
1444        spin_lock(&tbl->proxy_queue.lock);
1445        if (del_timer(&tbl->proxy_timer)) {
1446                if (time_before(tbl->proxy_timer.expires, sched_next))
1447                        sched_next = tbl->proxy_timer.expires;
1448        }
1449        skb_dst_drop(skb);
1450        dev_hold(skb->dev);
1451        __skb_queue_tail(&tbl->proxy_queue, skb);
1452        mod_timer(&tbl->proxy_timer, sched_next);
1453        spin_unlock(&tbl->proxy_queue.lock);
1454}
1455EXPORT_SYMBOL(pneigh_enqueue);
1456
1457static inline struct neigh_parms *lookup_neigh_parms(struct neigh_table *tbl,
1458                                                      struct net *net, int ifindex)
1459{
1460        struct neigh_parms *p;
1461
1462        list_for_each_entry(p, &tbl->parms_list, list) {
1463                if ((p->dev && p->dev->ifindex == ifindex && net_eq(neigh_parms_net(p), net)) ||
1464                    (!p->dev && !ifindex && net_eq(net, &init_net)))
1465                        return p;
1466        }
1467
1468        return NULL;
1469}
1470
1471struct neigh_parms *neigh_parms_alloc(struct net_device *dev,
1472                                      struct neigh_table *tbl)
1473{
1474        struct neigh_parms *p;
1475        struct net *net = dev_net(dev);
1476        const struct net_device_ops *ops = dev->netdev_ops;
1477
1478        p = kmemdup(&tbl->parms, sizeof(*p), GFP_KERNEL);
1479        if (p) {
1480                p->tbl            = tbl;
1481                refcount_set(&p->refcnt, 1);
1482                p->reachable_time =
1483                                neigh_rand_reach_time(NEIGH_VAR(p, BASE_REACHABLE_TIME));
1484                dev_hold(dev);
1485                p->dev = dev;
1486                write_pnet(&p->net, net);
1487                p->sysctl_table = NULL;
1488
1489                if (ops->ndo_neigh_setup && ops->ndo_neigh_setup(dev, p)) {
1490                        dev_put(dev);
1491                        kfree(p);
1492                        return NULL;
1493                }
1494
1495                write_lock_bh(&tbl->lock);
1496                list_add(&p->list, &tbl->parms.list);
1497                write_unlock_bh(&tbl->lock);
1498
1499                neigh_parms_data_state_cleanall(p);
1500        }
1501        return p;
1502}
1503EXPORT_SYMBOL(neigh_parms_alloc);
1504
1505static void neigh_rcu_free_parms(struct rcu_head *head)
1506{
1507        struct neigh_parms *parms =
1508                container_of(head, struct neigh_parms, rcu_head);
1509
1510        neigh_parms_put(parms);
1511}
1512
1513void neigh_parms_release(struct neigh_table *tbl, struct neigh_parms *parms)
1514{
1515        if (!parms || parms == &tbl->parms)
1516                return;
1517        write_lock_bh(&tbl->lock);
1518        list_del(&parms->list);
1519        parms->dead = 1;
1520        write_unlock_bh(&tbl->lock);
1521        if (parms->dev)
1522                dev_put(parms->dev);
1523        call_rcu(&parms->rcu_head, neigh_rcu_free_parms);
1524}
1525EXPORT_SYMBOL(neigh_parms_release);
1526
1527static void neigh_parms_destroy(struct neigh_parms *parms)
1528{
1529        kfree(parms);
1530}
1531
1532static struct lock_class_key neigh_table_proxy_queue_class;
1533
1534static struct neigh_table *neigh_tables[NEIGH_NR_TABLES] __read_mostly;
1535
1536void neigh_table_init(int index, struct neigh_table *tbl)
1537{
1538        unsigned long now = jiffies;
1539        unsigned long phsize;
1540
1541        INIT_LIST_HEAD(&tbl->parms_list);
1542        list_add(&tbl->parms.list, &tbl->parms_list);
1543        write_pnet(&tbl->parms.net, &init_net);
1544        refcount_set(&tbl->parms.refcnt, 1);
1545        tbl->parms.reachable_time =
1546                          neigh_rand_reach_time(NEIGH_VAR(&tbl->parms, BASE_REACHABLE_TIME));
1547
1548        tbl->stats = alloc_percpu(struct neigh_statistics);
1549        if (!tbl->stats)
1550                panic("cannot create neighbour cache statistics");
1551
1552#ifdef CONFIG_PROC_FS
1553        if (!proc_create_data(tbl->id, 0, init_net.proc_net_stat,
1554                              &neigh_stat_seq_fops, tbl))
1555                panic("cannot create neighbour proc dir entry");
1556#endif
1557
1558        RCU_INIT_POINTER(tbl->nht, neigh_hash_alloc(3));
1559
1560        phsize = (PNEIGH_HASHMASK + 1) * sizeof(struct pneigh_entry *);
1561        tbl->phash_buckets = kzalloc(phsize, GFP_KERNEL);
1562
1563        if (!tbl->nht || !tbl->phash_buckets)
1564                panic("cannot allocate neighbour cache hashes");
1565
1566        if (!tbl->entry_size)
1567                tbl->entry_size = ALIGN(offsetof(struct neighbour, primary_key) +
1568                                        tbl->key_len, NEIGH_PRIV_ALIGN);
1569        else
1570                WARN_ON(tbl->entry_size % NEIGH_PRIV_ALIGN);
1571
1572        rwlock_init(&tbl->lock);
1573        INIT_DEFERRABLE_WORK(&tbl->gc_work, neigh_periodic_work);
1574        queue_delayed_work(system_power_efficient_wq, &tbl->gc_work,
1575                        tbl->parms.reachable_time);
1576        setup_timer(&tbl->proxy_timer, neigh_proxy_process, (unsigned long)tbl);
1577        skb_queue_head_init_class(&tbl->proxy_queue,
1578                        &neigh_table_proxy_queue_class);
1579
1580        tbl->last_flush = now;
1581        tbl->last_rand  = now + tbl->parms.reachable_time * 20;
1582
1583        neigh_tables[index] = tbl;
1584}
1585EXPORT_SYMBOL(neigh_table_init);
1586
1587int neigh_table_clear(int index, struct neigh_table *tbl)
1588{
1589        neigh_tables[index] = NULL;
1590        /* It is not clean... Fix it to unload IPv6 module safely */
1591        cancel_delayed_work_sync(&tbl->gc_work);
1592        del_timer_sync(&tbl->proxy_timer);
1593        pneigh_queue_purge(&tbl->proxy_queue);
1594        neigh_ifdown(tbl, NULL);
1595        if (atomic_read(&tbl->entries))
1596                pr_crit("neighbour leakage\n");
1597
1598        call_rcu(&rcu_dereference_protected(tbl->nht, 1)->rcu,
1599                 neigh_hash_free_rcu);
1600        tbl->nht = NULL;
1601
1602        kfree(tbl->phash_buckets);
1603        tbl->phash_buckets = NULL;
1604
1605        remove_proc_entry(tbl->id, init_net.proc_net_stat);
1606
1607        free_percpu(tbl->stats);
1608        tbl->stats = NULL;
1609
1610        return 0;
1611}
1612EXPORT_SYMBOL(neigh_table_clear);
1613
1614static struct neigh_table *neigh_find_table(int family)
1615{
1616        struct neigh_table *tbl = NULL;
1617
1618        switch (family) {
1619        case AF_INET:
1620                tbl = neigh_tables[NEIGH_ARP_TABLE];
1621                break;
1622        case AF_INET6:
1623                tbl = neigh_tables[NEIGH_ND_TABLE];
1624                break;
1625        case AF_DECnet:
1626                tbl = neigh_tables[NEIGH_DN_TABLE];
1627                break;
1628        }
1629
1630        return tbl;
1631}
1632
1633static int neigh_delete(struct sk_buff *skb, struct nlmsghdr *nlh,
1634                        struct netlink_ext_ack *extack)
1635{
1636        struct net *net = sock_net(skb->sk);
1637        struct ndmsg *ndm;
1638        struct nlattr *dst_attr;
1639        struct neigh_table *tbl;
1640        struct neighbour *neigh;
1641        struct net_device *dev = NULL;
1642        int err = -EINVAL;
1643
1644        ASSERT_RTNL();
1645        if (nlmsg_len(nlh) < sizeof(*ndm))
1646                goto out;
1647
1648        dst_attr = nlmsg_find_attr(nlh, sizeof(*ndm), NDA_DST);
1649        if (dst_attr == NULL)
1650                goto out;
1651
1652        ndm = nlmsg_data(nlh);
1653        if (ndm->ndm_ifindex) {
1654                dev = __dev_get_by_index(net, ndm->ndm_ifindex);
1655                if (dev == NULL) {
1656                        err = -ENODEV;
1657                        goto out;
1658                }
1659        }
1660
1661        tbl = neigh_find_table(ndm->ndm_family);
1662        if (tbl == NULL)
1663                return -EAFNOSUPPORT;
1664
1665        if (nla_len(dst_attr) < tbl->key_len)
1666                goto out;
1667
1668        if (ndm->ndm_flags & NTF_PROXY) {
1669                err = pneigh_delete(tbl, net, nla_data(dst_attr), dev);
1670                goto out;
1671        }
1672
1673        if (dev == NULL)
1674                goto out;
1675
1676        neigh = neigh_lookup(tbl, nla_data(dst_attr), dev);
1677        if (neigh == NULL) {
1678                err = -ENOENT;
1679                goto out;
1680        }
1681
1682        err = neigh_update(neigh, NULL, NUD_FAILED,
1683                           NEIGH_UPDATE_F_OVERRIDE |
1684                           NEIGH_UPDATE_F_ADMIN,
1685                           NETLINK_CB(skb).portid);
1686        write_lock_bh(&tbl->lock);
1687        neigh_release(neigh);
1688        neigh_remove_one(neigh, tbl);
1689        write_unlock_bh(&tbl->lock);
1690
1691out:
1692        return err;
1693}
1694
1695static int neigh_add(struct sk_buff *skb, struct nlmsghdr *nlh,
1696                     struct netlink_ext_ack *extack)
1697{
1698        int flags = NEIGH_UPDATE_F_ADMIN | NEIGH_UPDATE_F_OVERRIDE;
1699        struct net *net = sock_net(skb->sk);
1700        struct ndmsg *ndm;
1701        struct nlattr *tb[NDA_MAX+1];
1702        struct neigh_table *tbl;
1703        struct net_device *dev = NULL;
1704        struct neighbour *neigh;
1705        void *dst, *lladdr;
1706        int err;
1707
1708        ASSERT_RTNL();
1709        err = nlmsg_parse(nlh, sizeof(*ndm), tb, NDA_MAX, NULL, extack);
1710        if (err < 0)
1711                goto out;
1712
1713        err = -EINVAL;
1714        if (tb[NDA_DST] == NULL)
1715                goto out;
1716
1717        ndm = nlmsg_data(nlh);
1718        if (ndm->ndm_ifindex) {
1719                dev = __dev_get_by_index(net, ndm->ndm_ifindex);
1720                if (dev == NULL) {
1721                        err = -ENODEV;
1722                        goto out;
1723                }
1724
1725                if (tb[NDA_LLADDR] && nla_len(tb[NDA_LLADDR]) < dev->addr_len)
1726                        goto out;
1727        }
1728
1729        tbl = neigh_find_table(ndm->ndm_family);
1730        if (tbl == NULL)
1731                return -EAFNOSUPPORT;
1732
1733        if (nla_len(tb[NDA_DST]) < tbl->key_len)
1734                goto out;
1735        dst = nla_data(tb[NDA_DST]);
1736        lladdr = tb[NDA_LLADDR] ? nla_data(tb[NDA_LLADDR]) : NULL;
1737
1738        if (ndm->ndm_flags & NTF_PROXY) {
1739                struct pneigh_entry *pn;
1740
1741                err = -ENOBUFS;
1742                pn = pneigh_lookup(tbl, net, dst, dev, 1);
1743                if (pn) {
1744                        pn->flags = ndm->ndm_flags;
1745                        err = 0;
1746                }
1747                goto out;
1748        }
1749
1750        if (dev == NULL)
1751                goto out;
1752
1753        neigh = neigh_lookup(tbl, dst, dev);
1754        if (neigh == NULL) {
1755                if (!(nlh->nlmsg_flags & NLM_F_CREATE)) {
1756                        err = -ENOENT;
1757                        goto out;
1758                }
1759
1760                neigh = __neigh_lookup_errno(tbl, dst, dev);
1761                if (IS_ERR(neigh)) {
1762                        err = PTR_ERR(neigh);
1763                        goto out;
1764                }
1765        } else {
1766                if (nlh->nlmsg_flags & NLM_F_EXCL) {
1767                        err = -EEXIST;
1768                        neigh_release(neigh);
1769                        goto out;
1770                }
1771
1772                if (!(nlh->nlmsg_flags & NLM_F_REPLACE))
1773                        flags &= ~NEIGH_UPDATE_F_OVERRIDE;
1774        }
1775
1776        if (ndm->ndm_flags & NTF_USE) {
1777                neigh_event_send(neigh, NULL);
1778                err = 0;
1779        } else
1780                err = neigh_update(neigh, lladdr, ndm->ndm_state, flags,
1781                                   NETLINK_CB(skb).portid);
1782        neigh_release(neigh);
1783
1784out:
1785        return err;
1786}
1787
1788static int neightbl_fill_parms(struct sk_buff *skb, struct neigh_parms *parms)
1789{
1790        struct nlattr *nest;
1791
1792        nest = nla_nest_start(skb, NDTA_PARMS);
1793        if (nest == NULL)
1794                return -ENOBUFS;
1795
1796        if ((parms->dev &&
1797             nla_put_u32(skb, NDTPA_IFINDEX, parms->dev->ifindex)) ||
1798            nla_put_u32(skb, NDTPA_REFCNT, refcount_read(&parms->refcnt)) ||
1799            nla_put_u32(skb, NDTPA_QUEUE_LENBYTES,
1800                        NEIGH_VAR(parms, QUEUE_LEN_BYTES)) ||
1801            /* approximative value for deprecated QUEUE_LEN (in packets) */
1802            nla_put_u32(skb, NDTPA_QUEUE_LEN,
1803                        NEIGH_VAR(parms, QUEUE_LEN_BYTES) / SKB_TRUESIZE(ETH_FRAME_LEN)) ||
1804            nla_put_u32(skb, NDTPA_PROXY_QLEN, NEIGH_VAR(parms, PROXY_QLEN)) ||
1805            nla_put_u32(skb, NDTPA_APP_PROBES, NEIGH_VAR(parms, APP_PROBES)) ||
1806            nla_put_u32(skb, NDTPA_UCAST_PROBES,
1807                        NEIGH_VAR(parms, UCAST_PROBES)) ||
1808            nla_put_u32(skb, NDTPA_MCAST_PROBES,
1809                        NEIGH_VAR(parms, MCAST_PROBES)) ||
1810            nla_put_u32(skb, NDTPA_MCAST_REPROBES,
1811                        NEIGH_VAR(parms, MCAST_REPROBES)) ||
1812            nla_put_msecs(skb, NDTPA_REACHABLE_TIME, parms->reachable_time,
1813                          NDTPA_PAD) ||
1814            nla_put_msecs(skb, NDTPA_BASE_REACHABLE_TIME,
1815                          NEIGH_VAR(parms, BASE_REACHABLE_TIME), NDTPA_PAD) ||
1816            nla_put_msecs(skb, NDTPA_GC_STALETIME,
1817                          NEIGH_VAR(parms, GC_STALETIME), NDTPA_PAD) ||
1818            nla_put_msecs(skb, NDTPA_DELAY_PROBE_TIME,
1819                          NEIGH_VAR(parms, DELAY_PROBE_TIME), NDTPA_PAD) ||
1820            nla_put_msecs(skb, NDTPA_RETRANS_TIME,
1821                          NEIGH_VAR(parms, RETRANS_TIME), NDTPA_PAD) ||
1822            nla_put_msecs(skb, NDTPA_ANYCAST_DELAY,
1823                          NEIGH_VAR(parms, ANYCAST_DELAY), NDTPA_PAD) ||
1824            nla_put_msecs(skb, NDTPA_PROXY_DELAY,
1825                          NEIGH_VAR(parms, PROXY_DELAY), NDTPA_PAD) ||
1826            nla_put_msecs(skb, NDTPA_LOCKTIME,
1827                          NEIGH_VAR(parms, LOCKTIME), NDTPA_PAD))
1828                goto nla_put_failure;
1829        return nla_nest_end(skb, nest);
1830
1831nla_put_failure:
1832        nla_nest_cancel(skb, nest);
1833        return -EMSGSIZE;
1834}
1835
1836static int neightbl_fill_info(struct sk_buff *skb, struct neigh_table *tbl,
1837                              u32 pid, u32 seq, int type, int flags)
1838{
1839        struct nlmsghdr *nlh;
1840        struct ndtmsg *ndtmsg;
1841
1842        nlh = nlmsg_put(skb, pid, seq, type, sizeof(*ndtmsg), flags);
1843        if (nlh == NULL)
1844                return -EMSGSIZE;
1845
1846        ndtmsg = nlmsg_data(nlh);
1847
1848        read_lock_bh(&tbl->lock);
1849        ndtmsg->ndtm_family = tbl->family;
1850        ndtmsg->ndtm_pad1   = 0;
1851        ndtmsg->ndtm_pad2   = 0;
1852
1853        if (nla_put_string(skb, NDTA_NAME, tbl->id) ||
1854            nla_put_msecs(skb, NDTA_GC_INTERVAL, tbl->gc_interval, NDTA_PAD) ||
1855            nla_put_u32(skb, NDTA_THRESH1, tbl->gc_thresh1) ||
1856            nla_put_u32(skb, NDTA_THRESH2, tbl->gc_thresh2) ||
1857            nla_put_u32(skb, NDTA_THRESH3, tbl->gc_thresh3))
1858                goto nla_put_failure;
1859        {
1860                unsigned long now = jiffies;
1861                unsigned int flush_delta = now - tbl->last_flush;
1862                unsigned int rand_delta = now - tbl->last_rand;
1863                struct neigh_hash_table *nht;
1864                struct ndt_config ndc = {
1865                        .ndtc_key_len           = tbl->key_len,
1866                        .ndtc_entry_size        = tbl->entry_size,
1867                        .ndtc_entries           = atomic_read(&tbl->entries),
1868                        .ndtc_last_flush        = jiffies_to_msecs(flush_delta),
1869                        .ndtc_last_rand         = jiffies_to_msecs(rand_delta),
1870                        .ndtc_proxy_qlen        = tbl->proxy_queue.qlen,
1871                };
1872
1873                rcu_read_lock_bh();
1874                nht = rcu_dereference_bh(tbl->nht);
1875                ndc.ndtc_hash_rnd = nht->hash_rnd[0];
1876                ndc.ndtc_hash_mask = ((1 << nht->hash_shift) - 1);
1877                rcu_read_unlock_bh();
1878
1879                if (nla_put(skb, NDTA_CONFIG, sizeof(ndc), &ndc))
1880                        goto nla_put_failure;
1881        }
1882
1883        {
1884                int cpu;
1885                struct ndt_stats ndst;
1886
1887                memset(&ndst, 0, sizeof(ndst));
1888
1889                for_each_possible_cpu(cpu) {
1890                        struct neigh_statistics *st;
1891
1892                        st = per_cpu_ptr(tbl->stats, cpu);
1893                        ndst.ndts_allocs                += st->allocs;
1894                        ndst.ndts_destroys              += st->destroys;
1895                        ndst.ndts_hash_grows            += st->hash_grows;
1896                        ndst.ndts_res_failed            += st->res_failed;
1897                        ndst.ndts_lookups               += st->lookups;
1898                        ndst.ndts_hits                  += st->hits;
1899                        ndst.ndts_rcv_probes_mcast      += st->rcv_probes_mcast;
1900                        ndst.ndts_rcv_probes_ucast      += st->rcv_probes_ucast;
1901                        ndst.ndts_periodic_gc_runs      += st->periodic_gc_runs;
1902                        ndst.ndts_forced_gc_runs        += st->forced_gc_runs;
1903                        ndst.ndts_table_fulls           += st->table_fulls;
1904                }
1905
1906                if (nla_put_64bit(skb, NDTA_STATS, sizeof(ndst), &ndst,
1907                                  NDTA_PAD))
1908                        goto nla_put_failure;
1909        }
1910
1911        BUG_ON(tbl->parms.dev);
1912        if (neightbl_fill_parms(skb, &tbl->parms) < 0)
1913                goto nla_put_failure;
1914
1915        read_unlock_bh(&tbl->lock);
1916        nlmsg_end(skb, nlh);
1917        return 0;
1918
1919nla_put_failure:
1920        read_unlock_bh(&tbl->lock);
1921        nlmsg_cancel(skb, nlh);
1922        return -EMSGSIZE;
1923}
1924
1925static int neightbl_fill_param_info(struct sk_buff *skb,
1926                                    struct neigh_table *tbl,
1927                                    struct neigh_parms *parms,
1928                                    u32 pid, u32 seq, int type,
1929                                    unsigned int flags)
1930{
1931        struct ndtmsg *ndtmsg;
1932        struct nlmsghdr *nlh;
1933
1934        nlh = nlmsg_put(skb, pid, seq, type, sizeof(*ndtmsg), flags);
1935        if (nlh == NULL)
1936                return -EMSGSIZE;
1937
1938        ndtmsg = nlmsg_data(nlh);
1939
1940        read_lock_bh(&tbl->lock);
1941        ndtmsg->ndtm_family = tbl->family;
1942        ndtmsg->ndtm_pad1   = 0;
1943        ndtmsg->ndtm_pad2   = 0;
1944
1945        if (nla_put_string(skb, NDTA_NAME, tbl->id) < 0 ||
1946            neightbl_fill_parms(skb, parms) < 0)
1947                goto errout;
1948
1949        read_unlock_bh(&tbl->lock);
1950        nlmsg_end(skb, nlh);
1951        return 0;
1952errout:
1953        read_unlock_bh(&tbl->lock);
1954        nlmsg_cancel(skb, nlh);
1955        return -EMSGSIZE;
1956}
1957
1958static const struct nla_policy nl_neightbl_policy[NDTA_MAX+1] = {
1959        [NDTA_NAME]             = { .type = NLA_STRING },
1960        [NDTA_THRESH1]          = { .type = NLA_U32 },
1961        [NDTA_THRESH2]          = { .type = NLA_U32 },
1962        [NDTA_THRESH3]          = { .type = NLA_U32 },
1963        [NDTA_GC_INTERVAL]      = { .type = NLA_U64 },
1964        [NDTA_PARMS]            = { .type = NLA_NESTED },
1965};
1966
1967static const struct nla_policy nl_ntbl_parm_policy[NDTPA_MAX+1] = {
1968        [NDTPA_IFINDEX]                 = { .type = NLA_U32 },
1969        [NDTPA_QUEUE_LEN]               = { .type = NLA_U32 },
1970        [NDTPA_PROXY_QLEN]              = { .type = NLA_U32 },
1971        [NDTPA_APP_PROBES]              = { .type = NLA_U32 },
1972        [NDTPA_UCAST_PROBES]            = { .type = NLA_U32 },
1973        [NDTPA_MCAST_PROBES]            = { .type = NLA_U32 },
1974        [NDTPA_MCAST_REPROBES]          = { .type = NLA_U32 },
1975        [NDTPA_BASE_REACHABLE_TIME]     = { .type = NLA_U64 },
1976        [NDTPA_GC_STALETIME]            = { .type = NLA_U64 },
1977        [NDTPA_DELAY_PROBE_TIME]        = { .type = NLA_U64 },
1978        [NDTPA_RETRANS_TIME]            = { .type = NLA_U64 },
1979        [NDTPA_ANYCAST_DELAY]           = { .type = NLA_U64 },
1980        [NDTPA_PROXY_DELAY]             = { .type = NLA_U64 },
1981        [NDTPA_LOCKTIME]                = { .type = NLA_U64 },
1982};
1983
1984static int neightbl_set(struct sk_buff *skb, struct nlmsghdr *nlh,
1985                        struct netlink_ext_ack *extack)
1986{
1987        struct net *net = sock_net(skb->sk);
1988        struct neigh_table *tbl;
1989        struct ndtmsg *ndtmsg;
1990        struct nlattr *tb[NDTA_MAX+1];
1991        bool found = false;
1992        int err, tidx;
1993
1994        err = nlmsg_parse(nlh, sizeof(*ndtmsg), tb, NDTA_MAX,
1995                          nl_neightbl_policy, extack);
1996        if (err < 0)
1997                goto errout;
1998
1999        if (tb[NDTA_NAME] == NULL) {
2000                err = -EINVAL;
2001                goto errout;
2002        }
2003
2004        ndtmsg = nlmsg_data(nlh);
2005
2006        for (tidx = 0; tidx < NEIGH_NR_TABLES; tidx++) {
2007                tbl = neigh_tables[tidx];
2008                if (!tbl)
2009                        continue;
2010                if (ndtmsg->ndtm_family && tbl->family != ndtmsg->ndtm_family)
2011                        continue;
2012                if (nla_strcmp(tb[NDTA_NAME], tbl->id) == 0) {
2013                        found = true;
2014                        break;
2015                }
2016        }
2017
2018        if (!found)
2019                return -ENOENT;
2020
2021        /*
2022         * We acquire tbl->lock to be nice to the periodic timers and
2023         * make sure they always see a consistent set of values.
2024         */
2025        write_lock_bh(&tbl->lock);
2026
2027        if (tb[NDTA_PARMS]) {
2028                struct nlattr *tbp[NDTPA_MAX+1];
2029                struct neigh_parms *p;
2030                int i, ifindex = 0;
2031
2032                err = nla_parse_nested(tbp, NDTPA_MAX, tb[NDTA_PARMS],
2033                                       nl_ntbl_parm_policy, extack);
2034                if (err < 0)
2035                        goto errout_tbl_lock;
2036
2037                if (tbp[NDTPA_IFINDEX])
2038                        ifindex = nla_get_u32(tbp[NDTPA_IFINDEX]);
2039
2040                p = lookup_neigh_parms(tbl, net, ifindex);
2041                if (p == NULL) {
2042                        err = -ENOENT;
2043                        goto errout_tbl_lock;
2044                }
2045
2046                for (i = 1; i <= NDTPA_MAX; i++) {
2047                        if (tbp[i] == NULL)
2048                                continue;
2049
2050                        switch (i) {
2051                        case NDTPA_QUEUE_LEN:
2052                                NEIGH_VAR_SET(p, QUEUE_LEN_BYTES,
2053                                              nla_get_u32(tbp[i]) *
2054                                              SKB_TRUESIZE(ETH_FRAME_LEN));
2055                                break;
2056                        case NDTPA_QUEUE_LENBYTES:
2057                                NEIGH_VAR_SET(p, QUEUE_LEN_BYTES,
2058                                              nla_get_u32(tbp[i]));
2059                                break;
2060                        case NDTPA_PROXY_QLEN:
2061                                NEIGH_VAR_SET(p, PROXY_QLEN,
2062                                              nla_get_u32(tbp[i]));
2063                                break;
2064                        case NDTPA_APP_PROBES:
2065                                NEIGH_VAR_SET(p, APP_PROBES,
2066                                              nla_get_u32(tbp[i]));
2067                                break;
2068                        case NDTPA_UCAST_PROBES:
2069                                NEIGH_VAR_SET(p, UCAST_PROBES,
2070                                              nla_get_u32(tbp[i]));
2071                                break;
2072                        case NDTPA_MCAST_PROBES:
2073                                NEIGH_VAR_SET(p, MCAST_PROBES,
2074                                              nla_get_u32(tbp[i]));
2075                                break;
2076                        case NDTPA_MCAST_REPROBES:
2077                                NEIGH_VAR_SET(p, MCAST_REPROBES,
2078                                              nla_get_u32(tbp[i]));
2079                                break;
2080                        case NDTPA_BASE_REACHABLE_TIME:
2081                                NEIGH_VAR_SET(p, BASE_REACHABLE_TIME,
2082                                              nla_get_msecs(tbp[i]));
2083                                /* update reachable_time as well, otherwise, the change will
2084                                 * only be effective after the next time neigh_periodic_work
2085                                 * decides to recompute it (can be multiple minutes)
2086                                 */
2087                                p->reachable_time =
2088                                        neigh_rand_reach_time(NEIGH_VAR(p, BASE_REACHABLE_TIME));
2089                                break;
2090                        case NDTPA_GC_STALETIME:
2091                                NEIGH_VAR_SET(p, GC_STALETIME,
2092                                              nla_get_msecs(tbp[i]));
2093                                break;
2094                        case NDTPA_DELAY_PROBE_TIME:
2095                                NEIGH_VAR_SET(p, DELAY_PROBE_TIME,
2096                                              nla_get_msecs(tbp[i]));
2097                                call_netevent_notifiers(NETEVENT_DELAY_PROBE_TIME_UPDATE, p);
2098                                break;
2099                        case NDTPA_RETRANS_TIME:
2100                                NEIGH_VAR_SET(p, RETRANS_TIME,
2101                                              nla_get_msecs(tbp[i]));
2102                                break;
2103                        case NDTPA_ANYCAST_DELAY:
2104                                NEIGH_VAR_SET(p, ANYCAST_DELAY,
2105                                              nla_get_msecs(tbp[i]));
2106                                break;
2107                        case NDTPA_PROXY_DELAY:
2108                                NEIGH_VAR_SET(p, PROXY_DELAY,
2109                                              nla_get_msecs(tbp[i]));
2110                                break;
2111                        case NDTPA_LOCKTIME:
2112                                NEIGH_VAR_SET(p, LOCKTIME,
2113                                              nla_get_msecs(tbp[i]));
2114                                break;
2115                        }
2116                }
2117        }
2118
2119        err = -ENOENT;
2120        if ((tb[NDTA_THRESH1] || tb[NDTA_THRESH2] ||
2121             tb[NDTA_THRESH3] || tb[NDTA_GC_INTERVAL]) &&
2122            !net_eq(net, &init_net))
2123                goto errout_tbl_lock;
2124
2125        if (tb[NDTA_THRESH1])
2126                tbl->gc_thresh1 = nla_get_u32(tb[NDTA_THRESH1]);
2127
2128        if (tb[NDTA_THRESH2])
2129                tbl->gc_thresh2 = nla_get_u32(tb[NDTA_THRESH2]);
2130
2131        if (tb[NDTA_THRESH3])
2132                tbl->gc_thresh3 = nla_get_u32(tb[NDTA_THRESH3]);
2133
2134        if (tb[NDTA_GC_INTERVAL])
2135                tbl->gc_interval = nla_get_msecs(tb[NDTA_GC_INTERVAL]);
2136
2137        err = 0;
2138
2139errout_tbl_lock:
2140        write_unlock_bh(&tbl->lock);
2141errout:
2142        return err;
2143}
2144
2145static int neightbl_dump_info(struct sk_buff *skb, struct netlink_callback *cb)
2146{
2147        struct net *net = sock_net(skb->sk);
2148        int family, tidx, nidx = 0;
2149        int tbl_skip = cb->args[0];
2150        int neigh_skip = cb->args[1];
2151        struct neigh_table *tbl;
2152
2153        family = ((struct rtgenmsg *) nlmsg_data(cb->nlh))->rtgen_family;
2154
2155        for (tidx = 0; tidx < NEIGH_NR_TABLES; tidx++) {
2156                struct neigh_parms *p;
2157
2158                tbl = neigh_tables[tidx];
2159                if (!tbl)
2160                        continue;
2161
2162                if (tidx < tbl_skip || (family && tbl->family != family))
2163                        continue;
2164
2165                if (neightbl_fill_info(skb, tbl, NETLINK_CB(cb->skb).portid,
2166                                       cb->nlh->nlmsg_seq, RTM_NEWNEIGHTBL,
2167                                       NLM_F_MULTI) < 0)
2168                        break;
2169
2170                nidx = 0;
2171                p = list_next_entry(&tbl->parms, list);
2172                list_for_each_entry_from(p, &tbl->parms_list, list) {
2173                        if (!net_eq(neigh_parms_net(p), net))
2174                                continue;
2175
2176                        if (nidx < neigh_skip)
2177                                goto next;
2178
2179                        if (neightbl_fill_param_info(skb, tbl, p,
2180                                                     NETLINK_CB(cb->skb).portid,
2181                                                     cb->nlh->nlmsg_seq,
2182                                                     RTM_NEWNEIGHTBL,
2183                                                     NLM_F_MULTI) < 0)
2184                                goto out;
2185                next:
2186                        nidx++;
2187                }
2188
2189                neigh_skip = 0;
2190        }
2191out:
2192        cb->args[0] = tidx;
2193        cb->args[1] = nidx;
2194
2195        return skb->len;
2196}
2197
2198static int neigh_fill_info(struct sk_buff *skb, struct neighbour *neigh,
2199                           u32 pid, u32 seq, int type, unsigned int flags)
2200{
2201        unsigned long now = jiffies;
2202        struct nda_cacheinfo ci;
2203        struct nlmsghdr *nlh;
2204        struct ndmsg *ndm;
2205
2206        nlh = nlmsg_put(skb, pid, seq, type, sizeof(*ndm), flags);
2207        if (nlh == NULL)
2208                return -EMSGSIZE;
2209
2210        ndm = nlmsg_data(nlh);
2211        ndm->ndm_family  = neigh->ops->family;
2212        ndm->ndm_pad1    = 0;
2213        ndm->ndm_pad2    = 0;
2214        ndm->ndm_flags   = neigh->flags;
2215        ndm->ndm_type    = neigh->type;
2216        ndm->ndm_ifindex = neigh->dev->ifindex;
2217
2218        if (nla_put(skb, NDA_DST, neigh->tbl->key_len, neigh->primary_key))
2219                goto nla_put_failure;
2220
2221        read_lock_bh(&neigh->lock);
2222        ndm->ndm_state   = neigh->nud_state;
2223        if (neigh->nud_state & NUD_VALID) {
2224                char haddr[MAX_ADDR_LEN];
2225
2226                neigh_ha_snapshot(haddr, neigh, neigh->dev);
2227                if (nla_put(skb, NDA_LLADDR, neigh->dev->addr_len, haddr) < 0) {
2228                        read_unlock_bh(&neigh->lock);
2229                        goto nla_put_failure;
2230                }
2231        }
2232
2233        ci.ndm_used      = jiffies_to_clock_t(now - neigh->used);
2234        ci.ndm_confirmed = jiffies_to_clock_t(now - neigh->confirmed);
2235        ci.ndm_updated   = jiffies_to_clock_t(now - neigh->updated);
2236        ci.ndm_refcnt    = refcount_read(&neigh->refcnt) - 1;
2237        read_unlock_bh(&neigh->lock);
2238
2239        if (nla_put_u32(skb, NDA_PROBES, atomic_read(&neigh->probes)) ||
2240            nla_put(skb, NDA_CACHEINFO, sizeof(ci), &ci))
2241                goto nla_put_failure;
2242
2243        nlmsg_end(skb, nlh);
2244        return 0;
2245
2246nla_put_failure:
2247        nlmsg_cancel(skb, nlh);
2248        return -EMSGSIZE;
2249}
2250
2251static int pneigh_fill_info(struct sk_buff *skb, struct pneigh_entry *pn,
2252                            u32 pid, u32 seq, int type, unsigned int flags,
2253                            struct neigh_table *tbl)
2254{
2255        struct nlmsghdr *nlh;
2256        struct ndmsg *ndm;
2257
2258        nlh = nlmsg_put(skb, pid, seq, type, sizeof(*ndm), flags);
2259        if (nlh == NULL)
2260                return -EMSGSIZE;
2261
2262        ndm = nlmsg_data(nlh);
2263        ndm->ndm_family  = tbl->family;
2264        ndm->ndm_pad1    = 0;
2265        ndm->ndm_pad2    = 0;
2266        ndm->ndm_flags   = pn->flags | NTF_PROXY;
2267        ndm->ndm_type    = RTN_UNICAST;
2268        ndm->ndm_ifindex = pn->dev ? pn->dev->ifindex : 0;
2269        ndm->ndm_state   = NUD_NONE;
2270
2271        if (nla_put(skb, NDA_DST, tbl->key_len, pn->key))
2272                goto nla_put_failure;
2273
2274        nlmsg_end(skb, nlh);
2275        return 0;
2276
2277nla_put_failure:
2278        nlmsg_cancel(skb, nlh);
2279        return -EMSGSIZE;
2280}
2281
2282static void neigh_update_notify(struct neighbour *neigh, u32 nlmsg_pid)
2283{
2284        call_netevent_notifiers(NETEVENT_NEIGH_UPDATE, neigh);
2285        __neigh_notify(neigh, RTM_NEWNEIGH, 0, nlmsg_pid);
2286}
2287
2288static bool neigh_master_filtered(struct net_device *dev, int master_idx)
2289{
2290        struct net_device *master;
2291
2292        if (!master_idx)
2293                return false;
2294
2295        master = netdev_master_upper_dev_get(dev);
2296        if (!master || master->ifindex != master_idx)
2297                return true;
2298
2299        return false;
2300}
2301
2302static bool neigh_ifindex_filtered(struct net_device *dev, int filter_idx)
2303{
2304        if (filter_idx && dev->ifindex != filter_idx)
2305                return true;
2306
2307        return false;
2308}
2309
2310static int neigh_dump_table(struct neigh_table *tbl, struct sk_buff *skb,
2311                            struct netlink_callback *cb)
2312{
2313        struct net *net = sock_net(skb->sk);
2314        const struct nlmsghdr *nlh = cb->nlh;
2315        struct nlattr *tb[NDA_MAX + 1];
2316        struct neighbour *n;
2317        int rc, h, s_h = cb->args[1];
2318        int idx, s_idx = idx = cb->args[2];
2319        struct neigh_hash_table *nht;
2320        int filter_master_idx = 0, filter_idx = 0;
2321        unsigned int flags = NLM_F_MULTI;
2322        int err;
2323
2324        err = nlmsg_parse(nlh, sizeof(struct ndmsg), tb, NDA_MAX, NULL, NULL);
2325        if (!err) {
2326                if (tb[NDA_IFINDEX])
2327                        filter_idx = nla_get_u32(tb[NDA_IFINDEX]);
2328
2329                if (tb[NDA_MASTER])
2330                        filter_master_idx = nla_get_u32(tb[NDA_MASTER]);
2331
2332                if (filter_idx || filter_master_idx)
2333                        flags |= NLM_F_DUMP_FILTERED;
2334        }
2335
2336        rcu_read_lock_bh();
2337        nht = rcu_dereference_bh(tbl->nht);
2338
2339        for (h = s_h; h < (1 << nht->hash_shift); h++) {
2340                if (h > s_h)
2341                        s_idx = 0;
2342                for (n = rcu_dereference_bh(nht->hash_buckets[h]), idx = 0;
2343                     n != NULL;
2344                     n = rcu_dereference_bh(n->next)) {
2345                        if (idx < s_idx || !net_eq(dev_net(n->dev), net))
2346                                goto next;
2347                        if (neigh_ifindex_filtered(n->dev, filter_idx) ||
2348                            neigh_master_filtered(n->dev, filter_master_idx))
2349                                goto next;
2350                        if (neigh_fill_info(skb, n, NETLINK_CB(cb->skb).portid,
2351                                            cb->nlh->nlmsg_seq,
2352                                            RTM_NEWNEIGH,
2353                                            flags) < 0) {
2354                                rc = -1;
2355                                goto out;
2356                        }
2357next:
2358                        idx++;
2359                }
2360        }
2361        rc = skb->len;
2362out:
2363        rcu_read_unlock_bh();
2364        cb->args[1] = h;
2365        cb->args[2] = idx;
2366        return rc;
2367}
2368
2369static int pneigh_dump_table(struct neigh_table *tbl, struct sk_buff *skb,
2370                             struct netlink_callback *cb)
2371{
2372        struct pneigh_entry *n;
2373        struct net *net = sock_net(skb->sk);
2374        int rc, h, s_h = cb->args[3];
2375        int idx, s_idx = idx = cb->args[4];
2376
2377        read_lock_bh(&tbl->lock);
2378
2379        for (h = s_h; h <= PNEIGH_HASHMASK; h++) {
2380                if (h > s_h)
2381                        s_idx = 0;
2382                for (n = tbl->phash_buckets[h], idx = 0; n; n = n->next) {
2383                        if (idx < s_idx || pneigh_net(n) != net)
2384                                goto next;
2385                        if (pneigh_fill_info(skb, n, NETLINK_CB(cb->skb).portid,
2386                                            cb->nlh->nlmsg_seq,
2387                                            RTM_NEWNEIGH,
2388                                            NLM_F_MULTI, tbl) < 0) {
2389                                read_unlock_bh(&tbl->lock);
2390                                rc = -1;
2391                                goto out;
2392                        }
2393                next:
2394                        idx++;
2395                }
2396        }
2397
2398        read_unlock_bh(&tbl->lock);
2399        rc = skb->len;
2400out:
2401        cb->args[3] = h;
2402        cb->args[4] = idx;
2403        return rc;
2404
2405}
2406
2407static int neigh_dump_info(struct sk_buff *skb, struct netlink_callback *cb)
2408{
2409        struct neigh_table *tbl;
2410        int t, family, s_t;
2411        int proxy = 0;
2412        int err;
2413
2414        family = ((struct rtgenmsg *) nlmsg_data(cb->nlh))->rtgen_family;
2415
2416        /* check for full ndmsg structure presence, family member is
2417         * the same for both structures
2418         */
2419        if (nlmsg_len(cb->nlh) >= sizeof(struct ndmsg) &&
2420            ((struct ndmsg *) nlmsg_data(cb->nlh))->ndm_flags == NTF_PROXY)
2421                proxy = 1;
2422
2423        s_t = cb->args[0];
2424
2425        for (t = 0; t < NEIGH_NR_TABLES; t++) {
2426                tbl = neigh_tables[t];
2427
2428                if (!tbl)
2429                        continue;
2430                if (t < s_t || (family && tbl->family != family))
2431                        continue;
2432                if (t > s_t)
2433                        memset(&cb->args[1], 0, sizeof(cb->args) -
2434                                                sizeof(cb->args[0]));
2435                if (proxy)
2436                        err = pneigh_dump_table(tbl, skb, cb);
2437                else
2438                        err = neigh_dump_table(tbl, skb, cb);
2439                if (err < 0)
2440                        break;
2441        }
2442
2443        cb->args[0] = t;
2444        return skb->len;
2445}
2446
2447void neigh_for_each(struct neigh_table *tbl, void (*cb)(struct neighbour *, void *), void *cookie)
2448{
2449        int chain;
2450        struct neigh_hash_table *nht;
2451
2452        rcu_read_lock_bh();
2453        nht = rcu_dereference_bh(tbl->nht);
2454
2455        read_lock(&tbl->lock); /* avoid resizes */
2456        for (chain = 0; chain < (1 << nht->hash_shift); chain++) {
2457                struct neighbour *n;
2458
2459                for (n = rcu_dereference_bh(nht->hash_buckets[chain]);
2460                     n != NULL;
2461                     n = rcu_dereference_bh(n->next))
2462                        cb(n, cookie);
2463        }
2464        read_unlock(&tbl->lock);
2465        rcu_read_unlock_bh();
2466}
2467EXPORT_SYMBOL(neigh_for_each);
2468
2469/* The tbl->lock must be held as a writer and BH disabled. */
2470void __neigh_for_each_release(struct neigh_table *tbl,
2471                              int (*cb)(struct neighbour *))
2472{
2473        int chain;
2474        struct neigh_hash_table *nht;
2475
2476        nht = rcu_dereference_protected(tbl->nht,
2477                                        lockdep_is_held(&tbl->lock));
2478        for (chain = 0; chain < (1 << nht->hash_shift); chain++) {
2479                struct neighbour *n;
2480                struct neighbour __rcu **np;
2481
2482                np = &nht->hash_buckets[chain];
2483                while ((n = rcu_dereference_protected(*np,
2484                                        lockdep_is_held(&tbl->lock))) != NULL) {
2485                        int release;
2486
2487                        write_lock(&n->lock);
2488                        release = cb(n);
2489                        if (release) {
2490                                rcu_assign_pointer(*np,
2491                                        rcu_dereference_protected(n->next,
2492                                                lockdep_is_held(&tbl->lock)));
2493                                n->dead = 1;
2494                        } else
2495                                np = &n->next;
2496                        write_unlock(&n->lock);
2497                        if (release)
2498                                neigh_cleanup_and_release(n);
2499                }
2500        }
2501}
2502EXPORT_SYMBOL(__neigh_for_each_release);
2503
2504int neigh_xmit(int index, struct net_device *dev,
2505               const void *addr, struct sk_buff *skb)
2506{
2507        int err = -EAFNOSUPPORT;
2508        if (likely(index < NEIGH_NR_TABLES)) {
2509                struct neigh_table *tbl;
2510                struct neighbour *neigh;
2511
2512                tbl = neigh_tables[index];
2513                if (!tbl)
2514                        goto out;
2515                rcu_read_lock_bh();
2516                neigh = __neigh_lookup_noref(tbl, addr, dev);
2517                if (!neigh)
2518                        neigh = __neigh_create(tbl, addr, dev, false);
2519                err = PTR_ERR(neigh);
2520                if (IS_ERR(neigh)) {
2521                        rcu_read_unlock_bh();
2522                        goto out_kfree_skb;
2523                }
2524                err = neigh->output(neigh, skb);
2525                rcu_read_unlock_bh();
2526        }
2527        else if (index == NEIGH_LINK_TABLE) {
2528                err = dev_hard_header(skb, dev, ntohs(skb->protocol),
2529                                      addr, NULL, skb->len);
2530                if (err < 0)
2531                        goto out_kfree_skb;
2532                err = dev_queue_xmit(skb);
2533        }
2534out:
2535        return err;
2536out_kfree_skb:
2537        kfree_skb(skb);
2538        goto out;
2539}
2540EXPORT_SYMBOL(neigh_xmit);
2541
2542#ifdef CONFIG_PROC_FS
2543
2544static struct neighbour *neigh_get_first(struct seq_file *seq)
2545{
2546        struct neigh_seq_state *state = seq->private;
2547        struct net *net = seq_file_net(seq);
2548        struct neigh_hash_table *nht = state->nht;
2549        struct neighbour *n = NULL;
2550        int bucket = state->bucket;
2551
2552        state->flags &= ~NEIGH_SEQ_IS_PNEIGH;
2553        for (bucket = 0; bucket < (1 << nht->hash_shift); bucket++) {
2554                n = rcu_dereference_bh(nht->hash_buckets[bucket]);
2555
2556                while (n) {
2557                        if (!net_eq(dev_net(n->dev), net))
2558                                goto next;
2559                        if (state->neigh_sub_iter) {
2560                                loff_t fakep = 0;
2561                                void *v;
2562
2563                                v = state->neigh_sub_iter(state, n, &fakep);
2564                                if (!v)
2565                                        goto next;
2566                        }
2567                        if (!(state->flags & NEIGH_SEQ_SKIP_NOARP))
2568                                break;
2569                        if (n->nud_state & ~NUD_NOARP)
2570                                break;
2571next:
2572                        n = rcu_dereference_bh(n->next);
2573                }
2574
2575                if (n)
2576                        break;
2577        }
2578        state->bucket = bucket;
2579
2580        return n;
2581}
2582
2583static struct neighbour *neigh_get_next(struct seq_file *seq,
2584                                        struct neighbour *n,
2585                                        loff_t *pos)
2586{
2587        struct neigh_seq_state *state = seq->private;
2588        struct net *net = seq_file_net(seq);
2589        struct neigh_hash_table *nht = state->nht;
2590
2591        if (state->neigh_sub_iter) {
2592                void *v = state->neigh_sub_iter(state, n, pos);
2593                if (v)
2594                        return n;
2595        }
2596        n = rcu_dereference_bh(n->next);
2597
2598        while (1) {
2599                while (n) {
2600                        if (!net_eq(dev_net(n->dev), net))
2601                                goto next;
2602                        if (state->neigh_sub_iter) {
2603                                void *v = state->neigh_sub_iter(state, n, pos);
2604                                if (v)
2605                                        return n;
2606                                goto next;
2607                        }
2608                        if (!(state->flags & NEIGH_SEQ_SKIP_NOARP))
2609                                break;
2610
2611                        if (n->nud_state & ~NUD_NOARP)
2612                                break;
2613next:
2614                        n = rcu_dereference_bh(n->next);
2615                }
2616
2617                if (n)
2618                        break;
2619
2620                if (++state->bucket >= (1 << nht->hash_shift))
2621                        break;
2622
2623                n = rcu_dereference_bh(nht->hash_buckets[state->bucket]);
2624        }
2625
2626        if (n && pos)
2627                --(*pos);
2628        return n;
2629}
2630
2631static struct neighbour *neigh_get_idx(struct seq_file *seq, loff_t *pos)
2632{
2633        struct neighbour *n = neigh_get_first(seq);
2634
2635        if (n) {
2636                --(*pos);
2637                while (*pos) {
2638                        n = neigh_get_next(seq, n, pos);
2639                        if (!n)
2640                                break;
2641                }
2642        }
2643        return *pos ? NULL : n;
2644}
2645
2646static struct pneigh_entry *pneigh_get_first(struct seq_file *seq)
2647{
2648        struct neigh_seq_state *state = seq->private;
2649        struct net *net = seq_file_net(seq);
2650        struct neigh_table *tbl = state->tbl;
2651        struct pneigh_entry *pn = NULL;
2652        int bucket = state->bucket;
2653
2654        state->flags |= NEIGH_SEQ_IS_PNEIGH;
2655        for (bucket = 0; bucket <= PNEIGH_HASHMASK; bucket++) {
2656                pn = tbl->phash_buckets[bucket];
2657                while (pn && !net_eq(pneigh_net(pn), net))
2658                        pn = pn->next;
2659                if (pn)
2660                        break;
2661        }
2662        state->bucket = bucket;
2663
2664        return pn;
2665}
2666
2667static struct pneigh_entry *pneigh_get_next(struct seq_file *seq,
2668                                            struct pneigh_entry *pn,
2669                                            loff_t *pos)
2670{
2671        struct neigh_seq_state *state = seq->private;
2672        struct net *net = seq_file_net(seq);
2673        struct neigh_table *tbl = state->tbl;
2674
2675        do {
2676                pn = pn->next;
2677        } while (pn && !net_eq(pneigh_net(pn), net));
2678
2679        while (!pn) {
2680                if (++state->bucket > PNEIGH_HASHMASK)
2681                        break;
2682                pn = tbl->phash_buckets[state->bucket];
2683                while (pn && !net_eq(pneigh_net(pn), net))
2684                        pn = pn->next;
2685                if (pn)
2686                        break;
2687        }
2688
2689        if (pn && pos)
2690                --(*pos);
2691
2692        return pn;
2693}
2694
2695static struct pneigh_entry *pneigh_get_idx(struct seq_file *seq, loff_t *pos)
2696{
2697        struct pneigh_entry *pn = pneigh_get_first(seq);
2698
2699        if (pn) {
2700                --(*pos);
2701                while (*pos) {
2702                        pn = pneigh_get_next(seq, pn, pos);
2703                        if (!pn)
2704                                break;
2705                }
2706        }
2707        return *pos ? NULL : pn;
2708}
2709
2710static void *neigh_get_idx_any(struct seq_file *seq, loff_t *pos)
2711{
2712        struct neigh_seq_state *state = seq->private;
2713        void *rc;
2714        loff_t idxpos = *pos;
2715
2716        rc = neigh_get_idx(seq, &idxpos);
2717        if (!rc && !(state->flags & NEIGH_SEQ_NEIGH_ONLY))
2718                rc = pneigh_get_idx(seq, &idxpos);
2719
2720        return rc;
2721}
2722
2723void *neigh_seq_start(struct seq_file *seq, loff_t *pos, struct neigh_table *tbl, unsigned int neigh_seq_flags)
2724        __acquires(rcu_bh)
2725{
2726        struct neigh_seq_state *state = seq->private;
2727
2728        state->tbl = tbl;
2729        state->bucket = 0;
2730        state->flags = (neigh_seq_flags & ~NEIGH_SEQ_IS_PNEIGH);
2731
2732        rcu_read_lock_bh();
2733        state->nht = rcu_dereference_bh(tbl->nht);
2734
2735        return *pos ? neigh_get_idx_any(seq, pos) : SEQ_START_TOKEN;
2736}
2737EXPORT_SYMBOL(neigh_seq_start);
2738
2739void *neigh_seq_next(struct seq_file *seq, void *v, loff_t *pos)
2740{
2741        struct neigh_seq_state *state;
2742        void *rc;
2743
2744        if (v == SEQ_START_TOKEN) {
2745                rc = neigh_get_first(seq);
2746                goto out;
2747        }
2748
2749        state = seq->private;
2750        if (!(state->flags & NEIGH_SEQ_IS_PNEIGH)) {
2751                rc = neigh_get_next(seq, v, NULL);
2752                if (rc)
2753                        goto out;
2754                if (!(state->flags & NEIGH_SEQ_NEIGH_ONLY))
2755                        rc = pneigh_get_first(seq);
2756        } else {
2757                BUG_ON(state->flags & NEIGH_SEQ_NEIGH_ONLY);
2758                rc = pneigh_get_next(seq, v, NULL);
2759        }
2760out:
2761        ++(*pos);
2762        return rc;
2763}
2764EXPORT_SYMBOL(neigh_seq_next);
2765
2766void neigh_seq_stop(struct seq_file *seq, void *v)
2767        __releases(rcu_bh)
2768{
2769        rcu_read_unlock_bh();
2770}
2771EXPORT_SYMBOL(neigh_seq_stop);
2772
2773/* statistics via seq_file */
2774
2775static void *neigh_stat_seq_start(struct seq_file *seq, loff_t *pos)
2776{
2777        struct neigh_table *tbl = seq->private;
2778        int cpu;
2779
2780        if (*pos == 0)
2781                return SEQ_START_TOKEN;
2782
2783        for (cpu = *pos-1; cpu < nr_cpu_ids; ++cpu) {
2784                if (!cpu_possible(cpu))
2785                        continue;
2786                *pos = cpu+1;
2787                return per_cpu_ptr(tbl->stats, cpu);
2788        }
2789        return NULL;
2790}
2791
2792static void *neigh_stat_seq_next(struct seq_file *seq, void *v, loff_t *pos)
2793{
2794        struct neigh_table *tbl = seq->private;
2795        int cpu;
2796
2797        for (cpu = *pos; cpu < nr_cpu_ids; ++cpu) {
2798                if (!cpu_possible(cpu))
2799                        continue;
2800                *pos = cpu+1;
2801                return per_cpu_ptr(tbl->stats, cpu);
2802        }
2803        return NULL;
2804}
2805
2806static void neigh_stat_seq_stop(struct seq_file *seq, void *v)
2807{
2808
2809}
2810
2811static int neigh_stat_seq_show(struct seq_file *seq, void *v)
2812{
2813        struct neigh_table *tbl = seq->private;
2814        struct neigh_statistics *st = v;
2815
2816        if (v == SEQ_START_TOKEN) {
2817                seq_printf(seq, "entries  allocs destroys hash_grows  lookups hits  res_failed  rcv_probes_mcast rcv_probes_ucast  periodic_gc_runs forced_gc_runs unresolved_discards table_fulls\n");
2818                return 0;
2819        }
2820
2821        seq_printf(seq, "%08x  %08lx %08lx %08lx  %08lx %08lx  %08lx  "
2822                        "%08lx %08lx  %08lx %08lx %08lx %08lx\n",
2823                   atomic_read(&tbl->entries),
2824
2825                   st->allocs,
2826                   st->destroys,
2827                   st->hash_grows,
2828
2829                   st->lookups,
2830                   st->hits,
2831
2832                   st->res_failed,
2833
2834                   st->rcv_probes_mcast,
2835                   st->rcv_probes_ucast,
2836
2837                   st->periodic_gc_runs,
2838                   st->forced_gc_runs,
2839                   st->unres_discards,
2840                   st->table_fulls
2841                   );
2842
2843        return 0;
2844}
2845
2846static const struct seq_operations neigh_stat_seq_ops = {
2847        .start  = neigh_stat_seq_start,
2848        .next   = neigh_stat_seq_next,
2849        .stop   = neigh_stat_seq_stop,
2850        .show   = neigh_stat_seq_show,
2851};
2852
2853static int neigh_stat_seq_open(struct inode *inode, struct file *file)
2854{
2855        int ret = seq_open(file, &neigh_stat_seq_ops);
2856
2857        if (!ret) {
2858                struct seq_file *sf = file->private_data;
2859                sf->private = PDE_DATA(inode);
2860        }
2861        return ret;
2862};
2863
2864static const struct file_operations neigh_stat_seq_fops = {
2865        .owner   = THIS_MODULE,
2866        .open    = neigh_stat_seq_open,
2867        .read    = seq_read,
2868        .llseek  = seq_lseek,
2869        .release = seq_release,
2870};
2871
2872#endif /* CONFIG_PROC_FS */
2873
2874static inline size_t neigh_nlmsg_size(void)
2875{
2876        return NLMSG_ALIGN(sizeof(struct ndmsg))
2877               + nla_total_size(MAX_ADDR_LEN) /* NDA_DST */
2878               + nla_total_size(MAX_ADDR_LEN) /* NDA_LLADDR */
2879               + nla_total_size(sizeof(struct nda_cacheinfo))
2880               + nla_total_size(4); /* NDA_PROBES */
2881}
2882
2883static void __neigh_notify(struct neighbour *n, int type, int flags,
2884                           u32 pid)
2885{
2886        struct net *net = dev_net(n->dev);
2887        struct sk_buff *skb;
2888        int err = -ENOBUFS;
2889
2890        skb = nlmsg_new(neigh_nlmsg_size(), GFP_ATOMIC);
2891        if (skb == NULL)
2892                goto errout;
2893
2894        err = neigh_fill_info(skb, n, pid, 0, type, flags);
2895        if (err < 0) {
2896                /* -EMSGSIZE implies BUG in neigh_nlmsg_size() */
2897                WARN_ON(err == -EMSGSIZE);
2898                kfree_skb(skb);
2899                goto errout;
2900        }
2901        rtnl_notify(skb, net, 0, RTNLGRP_NEIGH, NULL, GFP_ATOMIC);
2902        return;
2903errout:
2904        if (err < 0)
2905                rtnl_set_sk_err(net, RTNLGRP_NEIGH, err);
2906}
2907
2908void neigh_app_ns(struct neighbour *n)
2909{
2910        __neigh_notify(n, RTM_GETNEIGH, NLM_F_REQUEST, 0);
2911}
2912EXPORT_SYMBOL(neigh_app_ns);
2913
2914#ifdef CONFIG_SYSCTL
2915static int zero;
2916static int int_max = INT_MAX;
2917static int unres_qlen_max = INT_MAX / SKB_TRUESIZE(ETH_FRAME_LEN);
2918
2919static int proc_unres_qlen(struct ctl_table *ctl, int write,
2920                           void __user *buffer, size_t *lenp, loff_t *ppos)
2921{
2922        int size, ret;
2923        struct ctl_table tmp = *ctl;
2924
2925        tmp.extra1 = &zero;
2926        tmp.extra2 = &unres_qlen_max;
2927        tmp.data = &size;
2928
2929        size = *(int *)ctl->data / SKB_TRUESIZE(ETH_FRAME_LEN);
2930        ret = proc_dointvec_minmax(&tmp, write, buffer, lenp, ppos);
2931
2932        if (write && !ret)
2933                *(int *)ctl->data = size * SKB_TRUESIZE(ETH_FRAME_LEN);
2934        return ret;
2935}
2936
2937static struct neigh_parms *neigh_get_dev_parms_rcu(struct net_device *dev,
2938                                                   int family)
2939{
2940        switch (family) {
2941        case AF_INET:
2942                return __in_dev_arp_parms_get_rcu(dev);
2943        case AF_INET6:
2944                return __in6_dev_nd_parms_get_rcu(dev);
2945        }
2946        return NULL;
2947}
2948
2949static void neigh_copy_dflt_parms(struct net *net, struct neigh_parms *p,
2950                                  int index)
2951{
2952        struct net_device *dev;
2953        int family = neigh_parms_family(p);
2954
2955        rcu_read_lock();
2956        for_each_netdev_rcu(net, dev) {
2957                struct neigh_parms *dst_p =
2958                                neigh_get_dev_parms_rcu(dev, family);
2959
2960                if (dst_p && !test_bit(index, dst_p->data_state))
2961                        dst_p->data[index] = p->data[index];
2962        }
2963        rcu_read_unlock();
2964}
2965
2966static void neigh_proc_update(struct ctl_table *ctl, int write)
2967{
2968        struct net_device *dev = ctl->extra1;
2969        struct neigh_parms *p = ctl->extra2;
2970        struct net *net = neigh_parms_net(p);
2971        int index = (int *) ctl->data - p->data;
2972
2973        if (!write)
2974                return;
2975
2976        set_bit(index, p->data_state);
2977        if (index == NEIGH_VAR_DELAY_PROBE_TIME)
2978                call_netevent_notifiers(NETEVENT_DELAY_PROBE_TIME_UPDATE, p);
2979        if (!dev) /* NULL dev means this is default value */
2980                neigh_copy_dflt_parms(net, p, index);
2981}
2982
2983static int neigh_proc_dointvec_zero_intmax(struct ctl_table *ctl, int write,
2984                                           void __user *buffer,
2985                                           size_t *lenp, loff_t *ppos)
2986{
2987        struct ctl_table tmp = *ctl;
2988        int ret;
2989
2990        tmp.extra1 = &zero;
2991        tmp.extra2 = &int_max;
2992
2993        ret = proc_dointvec_minmax(&tmp, write, buffer, lenp, ppos);
2994        neigh_proc_update(ctl, write);
2995        return ret;
2996}
2997
2998int neigh_proc_dointvec(struct ctl_table *ctl, int write,
2999                        void __user *buffer, size_t *lenp, loff_t *ppos)
3000{
3001        int ret = proc_dointvec(ctl, write, buffer, lenp, ppos);
3002
3003        neigh_proc_update(ctl, write);
3004        return ret;
3005}
3006EXPORT_SYMBOL(neigh_proc_dointvec);
3007
3008int neigh_proc_dointvec_jiffies(struct ctl_table *ctl, int write,
3009                                void __user *buffer,
3010                                size_t *lenp, loff_t *ppos)
3011{
3012        int ret = proc_dointvec_jiffies(ctl, write, buffer, lenp, ppos);
3013
3014        neigh_proc_update(ctl, write);
3015        return ret;
3016}
3017EXPORT_SYMBOL(neigh_proc_dointvec_jiffies);
3018
3019static int neigh_proc_dointvec_userhz_jiffies(struct ctl_table *ctl, int write,
3020                                              void __user *buffer,
3021                                              size_t *lenp, loff_t *ppos)
3022{
3023        int ret = proc_dointvec_userhz_jiffies(ctl, write, buffer, lenp, ppos);
3024
3025        neigh_proc_update(ctl, write);
3026        return ret;
3027}
3028
3029int neigh_proc_dointvec_ms_jiffies(struct ctl_table *ctl, int write,
3030                                   void __user *buffer,
3031                                   size_t *lenp, loff_t *ppos)
3032{
3033        int ret = proc_dointvec_ms_jiffies(ctl, write, buffer, lenp, ppos);
3034
3035        neigh_proc_update(ctl, write);
3036        return ret;
3037}
3038EXPORT_SYMBOL(neigh_proc_dointvec_ms_jiffies);
3039
3040static int neigh_proc_dointvec_unres_qlen(struct ctl_table *ctl, int write,
3041                                          void __user *buffer,
3042                                          size_t *lenp, loff_t *ppos)
3043{
3044        int ret = proc_unres_qlen(ctl, write, buffer, lenp, ppos);
3045
3046        neigh_proc_update(ctl, write);
3047        return ret;
3048}
3049
3050static int neigh_proc_base_reachable_time(struct ctl_table *ctl, int write,
3051                                          void __user *buffer,
3052                                          size_t *lenp, loff_t *ppos)
3053{
3054        struct neigh_parms *p = ctl->extra2;
3055        int ret;
3056
3057        if (strcmp(ctl->procname, "base_reachable_time") == 0)
3058                ret = neigh_proc_dointvec_jiffies(ctl, write, buffer, lenp, ppos);
3059        else if (strcmp(ctl->procname, "base_reachable_time_ms") == 0)
3060                ret = neigh_proc_dointvec_ms_jiffies(ctl, write, buffer, lenp, ppos);
3061        else
3062                ret = -1;
3063
3064        if (write && ret == 0) {
3065                /* update reachable_time as well, otherwise, the change will
3066                 * only be effective after the next time neigh_periodic_work
3067                 * decides to recompute it
3068                 */
3069                p->reachable_time =
3070                        neigh_rand_reach_time(NEIGH_VAR(p, BASE_REACHABLE_TIME));
3071        }
3072        return ret;
3073}
3074
3075#define NEIGH_PARMS_DATA_OFFSET(index)  \
3076        (&((struct neigh_parms *) 0)->data[index])
3077
3078#define NEIGH_SYSCTL_ENTRY(attr, data_attr, name, mval, proc) \
3079        [NEIGH_VAR_ ## attr] = { \
3080                .procname       = name, \
3081                .data           = NEIGH_PARMS_DATA_OFFSET(NEIGH_VAR_ ## data_attr), \
3082                .maxlen         = sizeof(int), \
3083                .mode           = mval, \
3084                .proc_handler   = proc, \
3085        }
3086
3087#define NEIGH_SYSCTL_ZERO_INTMAX_ENTRY(attr, name) \
3088        NEIGH_SYSCTL_ENTRY(attr, attr, name, 0644, neigh_proc_dointvec_zero_intmax)
3089
3090#define NEIGH_SYSCTL_JIFFIES_ENTRY(attr, name) \
3091        NEIGH_SYSCTL_ENTRY(attr, attr, name, 0644, neigh_proc_dointvec_jiffies)
3092
3093#define NEIGH_SYSCTL_USERHZ_JIFFIES_ENTRY(attr, name) \
3094        NEIGH_SYSCTL_ENTRY(attr, attr, name, 0644, neigh_proc_dointvec_userhz_jiffies)
3095
3096#define NEIGH_SYSCTL_MS_JIFFIES_ENTRY(attr, name) \
3097        NEIGH_SYSCTL_ENTRY(attr, attr, name, 0644, neigh_proc_dointvec_ms_jiffies)
3098
3099#define NEIGH_SYSCTL_MS_JIFFIES_REUSED_ENTRY(attr, data_attr, name) \
3100        NEIGH_SYSCTL_ENTRY(attr, data_attr, name, 0644, neigh_proc_dointvec_ms_jiffies)
3101
3102#define NEIGH_SYSCTL_UNRES_QLEN_REUSED_ENTRY(attr, data_attr, name) \
3103        NEIGH_SYSCTL_ENTRY(attr, data_attr, name, 0644, neigh_proc_dointvec_unres_qlen)
3104
3105static struct neigh_sysctl_table {
3106        struct ctl_table_header *sysctl_header;
3107        struct ctl_table neigh_vars[NEIGH_VAR_MAX + 1];
3108} neigh_sysctl_template __read_mostly = {
3109        .neigh_vars = {
3110                NEIGH_SYSCTL_ZERO_INTMAX_ENTRY(MCAST_PROBES, "mcast_solicit"),
3111                NEIGH_SYSCTL_ZERO_INTMAX_ENTRY(UCAST_PROBES, "ucast_solicit"),
3112                NEIGH_SYSCTL_ZERO_INTMAX_ENTRY(APP_PROBES, "app_solicit"),
3113                NEIGH_SYSCTL_ZERO_INTMAX_ENTRY(MCAST_REPROBES, "mcast_resolicit"),
3114                NEIGH_SYSCTL_USERHZ_JIFFIES_ENTRY(RETRANS_TIME, "retrans_time"),
3115                NEIGH_SYSCTL_JIFFIES_ENTRY(BASE_REACHABLE_TIME, "base_reachable_time"),
3116                NEIGH_SYSCTL_JIFFIES_ENTRY(DELAY_PROBE_TIME, "delay_first_probe_time"),
3117                NEIGH_SYSCTL_JIFFIES_ENTRY(GC_STALETIME, "gc_stale_time"),
3118                NEIGH_SYSCTL_ZERO_INTMAX_ENTRY(QUEUE_LEN_BYTES, "unres_qlen_bytes"),
3119                NEIGH_SYSCTL_ZERO_INTMAX_ENTRY(PROXY_QLEN, "proxy_qlen"),
3120                NEIGH_SYSCTL_USERHZ_JIFFIES_ENTRY(ANYCAST_DELAY, "anycast_delay"),
3121                NEIGH_SYSCTL_USERHZ_JIFFIES_ENTRY(PROXY_DELAY, "proxy_delay"),
3122                NEIGH_SYSCTL_USERHZ_JIFFIES_ENTRY(LOCKTIME, "locktime"),
3123                NEIGH_SYSCTL_UNRES_QLEN_REUSED_ENTRY(QUEUE_LEN, QUEUE_LEN_BYTES, "unres_qlen"),
3124                NEIGH_SYSCTL_MS_JIFFIES_REUSED_ENTRY(RETRANS_TIME_MS, RETRANS_TIME, "retrans_time_ms"),
3125                NEIGH_SYSCTL_MS_JIFFIES_REUSED_ENTRY(BASE_REACHABLE_TIME_MS, BASE_REACHABLE_TIME, "base_reachable_time_ms"),
3126                [NEIGH_VAR_GC_INTERVAL] = {
3127                        .procname       = "gc_interval",
3128                        .maxlen         = sizeof(int),
3129                        .mode           = 0644,
3130                        .proc_handler   = proc_dointvec_jiffies,
3131                },
3132                [NEIGH_VAR_GC_THRESH1] = {
3133                        .procname       = "gc_thresh1",
3134                        .maxlen         = sizeof(int),
3135                        .mode           = 0644,
3136                        .extra1         = &zero,
3137                        .extra2         = &int_max,
3138                        .proc_handler   = proc_dointvec_minmax,
3139                },
3140                [NEIGH_VAR_GC_THRESH2] = {
3141                        .procname       = "gc_thresh2",
3142                        .maxlen         = sizeof(int),
3143                        .mode           = 0644,
3144                        .extra1         = &zero,
3145                        .extra2         = &int_max,
3146                        .proc_handler   = proc_dointvec_minmax,
3147                },
3148                [NEIGH_VAR_GC_THRESH3] = {
3149                        .procname       = "gc_thresh3",
3150                        .maxlen         = sizeof(int),
3151                        .mode           = 0644,
3152                        .extra1         = &zero,
3153                        .extra2         = &int_max,
3154                        .proc_handler   = proc_dointvec_minmax,
3155                },
3156                {},
3157        },
3158};
3159
3160int neigh_sysctl_register(struct net_device *dev, struct neigh_parms *p,
3161                          proc_handler *handler)
3162{
3163        int i;
3164        struct neigh_sysctl_table *t;
3165        const char *dev_name_source;
3166        char neigh_path[ sizeof("net//neigh/") + IFNAMSIZ + IFNAMSIZ ];
3167        char *p_name;
3168
3169        t = kmemdup(&neigh_sysctl_template, sizeof(*t), GFP_KERNEL);
3170        if (!t)
3171                goto err;
3172
3173        for (i = 0; i < NEIGH_VAR_GC_INTERVAL; i++) {
3174                t->neigh_vars[i].data += (long) p;
3175                t->neigh_vars[i].extra1 = dev;
3176                t->neigh_vars[i].extra2 = p;
3177        }
3178
3179        if (dev) {
3180                dev_name_source = dev->name;
3181                /* Terminate the table early */
3182                memset(&t->neigh_vars[NEIGH_VAR_GC_INTERVAL], 0,
3183                       sizeof(t->neigh_vars[NEIGH_VAR_GC_INTERVAL]));
3184        } else {
3185                struct neigh_table *tbl = p->tbl;
3186                dev_name_source = "default";
3187                t->neigh_vars[NEIGH_VAR_GC_INTERVAL].data = &tbl->gc_interval;
3188                t->neigh_vars[NEIGH_VAR_GC_THRESH1].data = &tbl->gc_thresh1;
3189                t->neigh_vars[NEIGH_VAR_GC_THRESH2].data = &tbl->gc_thresh2;
3190                t->neigh_vars[NEIGH_VAR_GC_THRESH3].data = &tbl->gc_thresh3;
3191        }
3192
3193        if (handler) {
3194                /* RetransTime */
3195                t->neigh_vars[NEIGH_VAR_RETRANS_TIME].proc_handler = handler;
3196                /* ReachableTime */
3197                t->neigh_vars[NEIGH_VAR_BASE_REACHABLE_TIME].proc_handler = handler;
3198                /* RetransTime (in milliseconds)*/
3199                t->neigh_vars[NEIGH_VAR_RETRANS_TIME_MS].proc_handler = handler;
3200                /* ReachableTime (in milliseconds) */
3201                t->neigh_vars[NEIGH_VAR_BASE_REACHABLE_TIME_MS].proc_handler = handler;
3202        } else {
3203                /* Those handlers will update p->reachable_time after
3204                 * base_reachable_time(_ms) is set to ensure the new timer starts being
3205                 * applied after the next neighbour update instead of waiting for
3206                 * neigh_periodic_work to update its value (can be multiple minutes)
3207                 * So any handler that replaces them should do this as well
3208                 */
3209                /* ReachableTime */
3210                t->neigh_vars[NEIGH_VAR_BASE_REACHABLE_TIME].proc_handler =
3211                        neigh_proc_base_reachable_time;
3212                /* ReachableTime (in milliseconds) */
3213                t->neigh_vars[NEIGH_VAR_BASE_REACHABLE_TIME_MS].proc_handler =
3214                        neigh_proc_base_reachable_time;
3215        }
3216
3217        /* Don't export sysctls to unprivileged users */
3218        if (neigh_parms_net(p)->user_ns != &init_user_ns)
3219                t->neigh_vars[0].procname = NULL;
3220
3221        switch (neigh_parms_family(p)) {
3222        case AF_INET:
3223              p_name = "ipv4";
3224              break;
3225        case AF_INET6:
3226              p_name = "ipv6";
3227              break;
3228        default:
3229              BUG();
3230        }
3231
3232        snprintf(neigh_path, sizeof(neigh_path), "net/%s/neigh/%s",
3233                p_name, dev_name_source);
3234        t->sysctl_header =
3235                register_net_sysctl(neigh_parms_net(p), neigh_path, t->neigh_vars);
3236        if (!t->sysctl_header)
3237                goto free;
3238
3239        p->sysctl_table = t;
3240        return 0;
3241
3242free:
3243        kfree(t);
3244err:
3245        return -ENOBUFS;
3246}
3247EXPORT_SYMBOL(neigh_sysctl_register);
3248
3249void neigh_sysctl_unregister(struct neigh_parms *p)
3250{
3251        if (p->sysctl_table) {
3252                struct neigh_sysctl_table *t = p->sysctl_table;
3253                p->sysctl_table = NULL;
3254                unregister_net_sysctl_table(t->sysctl_header);
3255                kfree(t);
3256        }
3257}
3258EXPORT_SYMBOL(neigh_sysctl_unregister);
3259
3260#endif  /* CONFIG_SYSCTL */
3261
3262static int __init neigh_init(void)
3263{
3264        rtnl_register(PF_UNSPEC, RTM_NEWNEIGH, neigh_add, NULL, 0);
3265        rtnl_register(PF_UNSPEC, RTM_DELNEIGH, neigh_delete, NULL, 0);
3266        rtnl_register(PF_UNSPEC, RTM_GETNEIGH, NULL, neigh_dump_info, 0);
3267
3268        rtnl_register(PF_UNSPEC, RTM_GETNEIGHTBL, NULL, neightbl_dump_info,
3269                      0);
3270        rtnl_register(PF_UNSPEC, RTM_SETNEIGHTBL, neightbl_set, NULL, 0);
3271
3272        return 0;
3273}
3274
3275subsys_initcall(neigh_init);
3276
3277