net/core/neighbour.c

   1 /*
   2  *      Generic address resolution entity
   3  *
   4  *      Authors:
   5  *      Pedro Roque             <roque@di.fc.ul.pt>
   6  *      Alexey Kuznetsov        <kuznet@ms2.inr.ac.ru>
   7  *
   8  *      This program is free software; you can redistribute it and/or
   9  *      modify it under the terms of the GNU General Public License
  10  *      as published by the Free Software Foundation; either version
  11  *      2 of the License, or (at your option) any later version.
  12  *
  13  *      Fixes:
  14  *      Vitaly E. Lavrov        releasing NULL neighbor in neigh_add.
  15  *      Harald Welte            Add neighbour cache statistics like rtstat
  16  */
  17
  18 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
  19
  20 #include <linux/slab.h>
  21 #include <linux/types.h>
  22 #include <linux/kernel.h>
  23 #include <linux/module.h>
  24 #include <linux/socket.h>
  25 #include <linux/netdevice.h>
  26 #include <linux/proc_fs.h>
  27 #ifdef CONFIG_SYSCTL
  28 #include <linux/sysctl.h>
  29 #endif
  30 #include <linux/times.h>
  31 #include <net/net_namespace.h>
  32 #include <net/neighbour.h>
  33 #include <net/dst.h>
  34 #include <net/sock.h>
  35 #include <net/netevent.h>
  36 #include <net/netlink.h>
  37 #include <linux/rtnetlink.h>
  38 #include <linux/random.h>
  39 #include <linux/string.h>
  40 #include <linux/log2.h>
  41 #include <linux/inetdevice.h>
  42 #include <net/addrconf.h>
  43
  44 #define DEBUG
  45 #define NEIGH_DEBUG 1
  46 #define neigh_dbg(level, fmt, ...)              \
  47 do {                                            \
  48         if (level <= NEIGH_DEBUG)               \
  49                 pr_debug(fmt, ##__VA_ARGS__);   \
  50 } while (0)
  51
  52 #define PNEIGH_HASHMASK         0xF
  53
  54 static void neigh_timer_handler(unsigned long arg);
  55 static void __neigh_notify(struct neighbour *n, int type, int flags,
  56                            u32 pid);
  57 static void neigh_update_notify(struct neighbour *neigh, u32 nlmsg_pid);
  58 static int pneigh_ifdown(struct neigh_table *tbl, struct net_device *dev);
  59
  60 #ifdef CONFIG_PROC_FS
  61 static const struct file_operations neigh_stat_seq_fops;
  62 #endif
  63
  64 /*
  65    Neighbour hash table buckets are protected with rwlock tbl->lock.
  66
  67    - All the scans/updates to hash buckets MUST be made under this lock.
  68    - NOTHING clever should be made under this lock: no callbacks
  69      to protocol backends, no attempts to send something to network.
  70      It will result in deadlocks, if backend/driver wants to use neighbour
  71      cache.
  72    - If the entry requires some non-trivial actions, increase
  73      its reference count and release table lock.
  74
  75    Neighbour entries are protected:
  76    - with reference count.
  77    - with rwlock neigh->lock
  78
  79    Reference count prevents destruction.
  80
  81    neigh->lock mainly serializes ll address data and its validity state.
  82    However, the same lock is used to protect another entry fields:
  83     - timer
  84     - resolution queue
  85
  86    Again, nothing clever shall be made under neigh->lock,
  87    the most complicated procedure, which we allow is dev->hard_header.
  88    It is supposed, that dev->hard_header is simplistic and does
  89    not make callbacks to neighbour tables.
  90  */
  91
  92 static int neigh_blackhole(struct neighbour *neigh, struct sk_buff *skb)
  93 {
  94         kfree_skb(skb);
  95         return -ENETDOWN;
  96 }
  97
  98 static void neigh_cleanup_and_release(struct neighbour *neigh)
  99 {
 100         if (neigh->parms->neigh_cleanup)
 101                 neigh->parms->neigh_cleanup(neigh);
 102
 103         __neigh_notify(neigh, RTM_DELNEIGH, 0, 0);
 104         call_netevent_notifiers(NETEVENT_NEIGH_UPDATE, neigh);
 105         neigh_release(neigh);
 106 }
 107
 108 /*
 109  * It is random distribution in the interval (1/2)*base...(3/2)*base.
 110  * It corresponds to default IPv6 settings and is not overridable,
 111  * because it is really reasonable choice.
 112  */
 113
 114 unsigned long neigh_rand_reach_time(unsigned long base)
 115 {
 116         return base ? (prandom_u32() % base) + (base >> 1) : 0;
 117 }
 118 EXPORT_SYMBOL(neigh_rand_reach_time);
 119
 120
 121 static int neigh_forced_gc(struct neigh_table *tbl)
 122 {
 123         int shrunk = 0;
 124         int i;
 125         struct neigh_hash_table *nht;
 126
 127         NEIGH_CACHE_STAT_INC(tbl, forced_gc_runs);
 128
 129         write_lock_bh(&tbl->lock);
 130         nht = rcu_dereference_protected(tbl->nht,
 131                                         lockdep_is_held(&tbl->lock));
 132         for (i = 0; i < (1 << nht->hash_shift); i++) {
 133                 struct neighbour *n;
 134                 struct neighbour __rcu **np;
 135
 136                 np = &nht->hash_buckets[i];
 137                 while ((n = rcu_dereference_protected(*np,
 138                                         lockdep_is_held(&tbl->lock))) != NULL) {
 139                         /* Neighbour record may be discarded if:
 140                          * - nobody refers to it.
 141                          * - it is not permanent
 142                          */
 143                         write_lock(&n->lock);
 144                         if (atomic_read(&n->refcnt) == 1 &&
 145                             !(n->nud_state & NUD_PERMANENT)) {
 146                                 rcu_assign_pointer(*np,
 147                                         rcu_dereference_protected(n->next,
 148                                                   lockdep_is_held(&tbl->lock)));
 149                                 n->dead = 1;
 150                                 shrunk  = 1;
 151                                 write_unlock(&n->lock);
 152                                 neigh_cleanup_and_release(n);
 153                                 continue;
 154                         }
 155                         write_unlock(&n->lock);
 156                         np = &n->next;
 157                 }
 158         }
 159
 160         tbl->last_flush = jiffies;
 161
 162         write_unlock_bh(&tbl->lock);
 163
 164         return shrunk;
 165 }
 166
 167 static void neigh_add_timer(struct neighbour *n, unsigned long when)
 168 {
 169         neigh_hold(n);
 170         if (unlikely(mod_timer(&n->timer, when))) {
 171                 printk("NEIGH: BUG, double timer add, state is %x\n",
 172                        n->nud_state);
 173                 dump_stack();
 174         }
 175 }
 176
 177 static int neigh_del_timer(struct neighbour *n)
 178 {
 179         if ((n->nud_state & NUD_IN_TIMER) &&
 180             del_timer(&n->timer)) {
 181                 neigh_release(n);
 182                 return 1;
 183         }
 184         return 0;
 185 }
 186
 187 static void pneigh_queue_purge(struct sk_buff_head *list)
 188 {
 189         struct sk_buff *skb;
 190
 191         while ((skb = skb_dequeue(list)) != NULL) {
 192                 dev_put(skb->dev);
 193                 kfree_skb(skb);
 194         }
 195 }
 196
 197 static void neigh_flush_dev(struct neigh_table *tbl, struct net_device *dev)
 198 {
 199         int i;
 200         struct neigh_hash_table *nht;
 201
 202         nht = rcu_dereference_protected(tbl->nht,
 203                                         lockdep_is_held(&tbl->lock));
 204
 205         for (i = 0; i < (1 << nht->hash_shift); i++) {
 206                 struct neighbour *n;
 207                 struct neighbour __rcu **np = &nht->hash_buckets[i];
 208
 209                 while ((n = rcu_dereference_protected(*np,
 210                                         lockdep_is_held(&tbl->lock))) != NULL) {
 211                         if (dev && n->dev != dev) {
 212                                 np = &n->next;
 213                                 continue;
 214                         }
 215                         rcu_assign_pointer(*np,
 216                                    rcu_dereference_protected(n->next,
 217                                                 lockdep_is_held(&tbl->lock)));
 218                         write_lock(&n->lock);
 219                         neigh_del_timer(n);
 220                         n->dead = 1;
 221
 222                         if (atomic_read(&n->refcnt) != 1) {
 223                                 /* The most unpleasant situation.
 224                                    We must destroy neighbour entry,
 225                                    but someone still uses it.
 226
 227                                    The destroy will be delayed until
 228                                    the last user releases us, but
 229                                    we must kill timers etc. and move
 230                                    it to safe state.
 231                                  */
 232                                 __skb_queue_purge(&n->arp_queue);
 233                                 n->arp_queue_len_bytes = 0;
 234                                 n->output = neigh_blackhole;
 235                                 if (n->nud_state & NUD_VALID)
 236                                         n->nud_state = NUD_NOARP;
 237                                 else
 238                                         n->nud_state = NUD_NONE;
 239                                 neigh_dbg(2, "neigh %p is stray\n", n);
 240                         }
 241                         write_unlock(&n->lock);
 242                         neigh_cleanup_and_release(n);
 243                 }
 244         }
 245 }
 246
 247 void neigh_changeaddr(struct neigh_table *tbl, struct net_device *dev)
 248 {
 249         write_lock_bh(&tbl->lock);
 250         neigh_flush_dev(tbl, dev);
 251         write_unlock_bh(&tbl->lock);
 252 }
 253 EXPORT_SYMBOL(neigh_changeaddr);
 254
 255 int neigh_ifdown(struct neigh_table *tbl, struct net_device *dev)
 256 {
 257         write_lock_bh(&tbl->lock);
 258         neigh_flush_dev(tbl, dev);
 259         pneigh_ifdown(tbl, dev);
 260         write_unlock_bh(&tbl->lock);
 261
 262         del_timer_sync(&tbl->proxy_timer);
 263         pneigh_queue_purge(&tbl->proxy_queue);
 264         return 0;
 265 }
 266 EXPORT_SYMBOL(neigh_ifdown);
 267
 268 static struct neighbour *neigh_alloc(struct neigh_table *tbl, struct net_device *dev)
 269 {
 270         struct neighbour *n = NULL;
 271         unsigned long now = jiffies;
 272         int entries;
 273
 274         entries = atomic_inc_return(&tbl->entries) - 1;
 275         if (entries >= tbl->gc_thresh3 ||
 276             (entries >= tbl->gc_thresh2 &&
 277              time_after(now, tbl->last_flush + 5 * HZ))) {
 278                 if (!neigh_forced_gc(tbl) &&
 279                     entries >= tbl->gc_thresh3) {
 280                         net_info_ratelimited("%s: neighbor table overflow!\n",
 281                                              tbl->id);
 282                         NEIGH_CACHE_STAT_INC(tbl, table_fulls);
 283                         goto out_entries;
 284                 }
 285         }
 286
 287         n = kzalloc(tbl->entry_size + dev->neigh_priv_len, GFP_ATOMIC);
 288         if (!n)
 289                 goto out_entries;
 290
 291         __skb_queue_head_init(&n->arp_queue);
 292         rwlock_init(&n->lock);
 293         seqlock_init(&n->ha_lock);
 294         n->updated        = n->used = now;
 295         n->nud_state      = NUD_NONE;
 296         n->output         = neigh_blackhole;
 297         seqlock_init(&n->hh.hh_lock);
 298         n->parms          = neigh_parms_clone(&tbl->parms);
 299         setup_timer(&n->timer, neigh_timer_handler, (unsigned long)n);
 300
 301         NEIGH_CACHE_STAT_INC(tbl, allocs);
 302         n->tbl            = tbl;
 303         atomic_set(&n->refcnt, 1);
 304         n->dead           = 1;
 305 out:
 306         return n;
 307
 308 out_entries:
 309         atomic_dec(&tbl->entries);
 310         goto out;
 311 }
 312
 313 static void neigh_get_hash_rnd(u32 *x)
 314 {
 315         get_random_bytes(x, sizeof(*x));
 316         *x |= 1;
 317 }
 318
 319 static struct neigh_hash_table *neigh_hash_alloc(unsigned int shift)
 320 {
 321         size_t size = (1 << shift) * sizeof(struct neighbour *);
 322         struct neigh_hash_table *ret;
 323         struct neighbour __rcu **buckets;
 324         int i;
 325
 326         ret = kmalloc(sizeof(*ret), GFP_ATOMIC);
 327         if (!ret)
 328                 return NULL;
 329         if (size <= PAGE_SIZE)
 330                 buckets = kzalloc(size, GFP_ATOMIC);
 331         else
 332                 buckets = (struct neighbour __rcu **)
 333                           __get_free_pages(GFP_ATOMIC | __GFP_ZERO,
 334                                            get_order(size));
 335         if (!buckets) {
 336                 kfree(ret);
 337                 return NULL;
 338         }
 339         ret->hash_buckets = buckets;
 340         ret->hash_shift = shift;
 341         for (i = 0; i < NEIGH_NUM_HASH_RND; i++)
 342                 neigh_get_hash_rnd(&ret->hash_rnd[i]);
 343         return ret;
 344 }
 345
 346 static void neigh_hash_free_rcu(struct rcu_head *head)
 347 {
 348         struct neigh_hash_table *nht = container_of(head,
 349                                                     struct neigh_hash_table,
 350                                                     rcu);
 351         size_t size = (1 << nht->hash_shift) * sizeof(struct neighbour *);
 352         struct neighbour __rcu **buckets = nht->hash_buckets;
 353
 354         if (size <= PAGE_SIZE)
 355                 kfree(buckets);
 356         else
 357                 free_pages((unsigned long)buckets, get_order(size));
 358         kfree(nht);
 359 }
 360
 361 static struct neigh_hash_table *neigh_hash_grow(struct neigh_table *tbl,
 362                                                 unsigned long new_shift)
 363 {
 364         unsigned int i, hash;
 365         struct neigh_hash_table *new_nht, *old_nht;
 366
 367         NEIGH_CACHE_STAT_INC(tbl, hash_grows);
 368
 369         old_nht = rcu_dereference_protected(tbl->nht,
 370                                             lockdep_is_held(&tbl->lock));
 371         new_nht = neigh_hash_alloc(new_shift);
 372         if (!new_nht)
 373                 return old_nht;
 374
 375         for (i = 0; i < (1 << old_nht->hash_shift); i++) {
 376                 struct neighbour *n, *next;
 377
 378                 for (n = rcu_dereference_protected(old_nht->hash_buckets[i],
 379                                                    lockdep_is_held(&tbl->lock));
 380                      n != NULL;
 381                      n = next) {
 382                         hash = tbl->hash(n->primary_key, n->dev,
 383                                          new_nht->hash_rnd);
 384
 385                         hash >>= (32 - new_nht->hash_shift);
 386                         next = rcu_dereference_protected(n->next,
 387                                                 lockdep_is_held(&tbl->lock));
 388
 389                         rcu_assign_pointer(n->next,
 390                                            rcu_dereference_protected(
 391                                                 new_nht->hash_buckets[hash],
 392                                                 lockdep_is_held(&tbl->lock)));
 393                         rcu_assign_pointer(new_nht->hash_buckets[hash], n);
 394                 }
 395         }
 396
 397         rcu_assign_pointer(tbl->nht, new_nht);
 398         call_rcu(&old_nht->rcu, neigh_hash_free_rcu);
 399         return new_nht;
 400 }
 401
 402 struct neighbour *neigh_lookup(struct neigh_table *tbl, const void *pkey,
 403                                struct net_device *dev)
 404 {
 405         struct neighbour *n;
 406
 407         NEIGH_CACHE_STAT_INC(tbl, lookups);
 408
 409         rcu_read_lock_bh();
 410         n = __neigh_lookup_noref(tbl, pkey, dev);
 411         if (n) {
 412                 if (!atomic_inc_not_zero(&n->refcnt))
 413                         n = NULL;
 414                 NEIGH_CACHE_STAT_INC(tbl, hits);
 415         }
 416
 417         rcu_read_unlock_bh();
 418         return n;
 419 }
 420 EXPORT_SYMBOL(neigh_lookup);
 421
 422 struct neighbour *neigh_lookup_nodev(struct neigh_table *tbl, struct net *net,
 423                                      const void *pkey)
 424 {
 425         struct neighbour *n;
 426         int key_len = tbl->key_len;
 427         u32 hash_val;
 428         struct neigh_hash_table *nht;
 429
 430         NEIGH_CACHE_STAT_INC(tbl, lookups);
 431
 432         rcu_read_lock_bh();
 433         nht = rcu_dereference_bh(tbl->nht);
 434         hash_val = tbl->hash(pkey, NULL, nht->hash_rnd) >> (32 - nht->hash_shift);
 435
 436         for (n = rcu_dereference_bh(nht->hash_buckets[hash_val]);
 437              n != NULL;
 438              n = rcu_dereference_bh(n->next)) {
 439                 if (!memcmp(n->primary_key, pkey, key_len) &&
 440                     net_eq(dev_net(n->dev), net)) {
 441                         if (!atomic_inc_not_zero(&n->refcnt))
 442                                 n = NULL;
 443                         NEIGH_CACHE_STAT_INC(tbl, hits);
 444                         break;
 445                 }
 446         }
 447
 448         rcu_read_unlock_bh();
 449         return n;
 450 }
 451 EXPORT_SYMBOL(neigh_lookup_nodev);
 452
 453 struct neighbour *__neigh_create(struct neigh_table *tbl, const void *pkey,
 454                                  struct net_device *dev, bool want_ref)
 455 {
 456         u32 hash_val;
 457         int key_len = tbl->key_len;
 458         int error;
 459         struct neighbour *n1, *rc, *n = neigh_alloc(tbl, dev);
 460         struct neigh_hash_table *nht;
 461
 462         if (!n) {
 463                 rc = ERR_PTR(-ENOBUFS);
 464                 goto out;
 465         }
 466
 467         memcpy(n->primary_key, pkey, key_len);
 468         n->dev = dev;
 469         dev_hold(dev);
 470
 471         /* Protocol specific setup. */
 472         if (tbl->constructor && (error = tbl->constructor(n)) < 0) {
 473                 rc = ERR_PTR(error);
 474                 goto out_neigh_release;
 475         }
 476
 477         if (dev->netdev_ops->ndo_neigh_construct) {
 478                 error = dev->netdev_ops->ndo_neigh_construct(dev, n);
 479                 if (error < 0) {
 480                         rc = ERR_PTR(error);
 481                         goto out_neigh_release;
 482                 }
 483         }
 484
 485         /* Device specific setup. */
 486         if (n->parms->neigh_setup &&
 487             (error = n->parms->neigh_setup(n)) < 0) {
 488                 rc = ERR_PTR(error);
 489                 goto out_neigh_release;
 490         }
 491
 492         n->confirmed = jiffies - (NEIGH_VAR(n->parms, BASE_REACHABLE_TIME) << 1);
 493
 494         write_lock_bh(&tbl->lock);
 495         nht = rcu_dereference_protected(tbl->nht,
 496                                         lockdep_is_held(&tbl->lock));
 497
 498         if (atomic_read(&tbl->entries) > (1 << nht->hash_shift))
 499                 nht = neigh_hash_grow(tbl, nht->hash_shift + 1);
 500
 501         hash_val = tbl->hash(pkey, dev, nht->hash_rnd) >> (32 - nht->hash_shift);
 502
 503         if (n->parms->dead) {
 504                 rc = ERR_PTR(-EINVAL);
 505                 goto out_tbl_unlock;
 506         }
 507
 508         for (n1 = rcu_dereference_protected(nht->hash_buckets[hash_val],
 509                                             lockdep_is_held(&tbl->lock));
 510              n1 != NULL;
 511              n1 = rcu_dereference_protected(n1->next,
 512                         lockdep_is_held(&tbl->lock))) {
 513                 if (dev == n1->dev && !memcmp(n1->primary_key, pkey, key_len)) {
 514                         if (want_ref)
 515                                 neigh_hold(n1);
 516                         rc = n1;
 517                         goto out_tbl_unlock;
 518                 }
 519         }
 520
 521         n->dead = 0;
 522         if (want_ref)
 523                 neigh_hold(n);
 524         rcu_assign_pointer(n->next,
 525                            rcu_dereference_protected(nht->hash_buckets[hash_val],
 526                                                      lockdep_is_held(&tbl->lock)));
 527         rcu_assign_pointer(nht->hash_buckets[hash_val], n);
 528         write_unlock_bh(&tbl->lock);
 529         neigh_dbg(2, "neigh %p is created\n", n);
 530         rc = n;
 531 out:
 532         return rc;
 533 out_tbl_unlock:
 534         write_unlock_bh(&tbl->lock);
 535 out_neigh_release:
 536         neigh_release(n);
 537         goto out;
 538 }
 539 EXPORT_SYMBOL(__neigh_create);
 540
 541 static u32 pneigh_hash(const void *pkey, int key_len)
 542 {
 543         u32 hash_val = *(u32 *)(pkey + key_len - 4);
 544         hash_val ^= (hash_val >> 16);
 545         hash_val ^= hash_val >> 8;
 546         hash_val ^= hash_val >> 4;
 547         hash_val &= PNEIGH_HASHMASK;
 548         return hash_val;
 549 }
 550
 551 static struct pneigh_entry *__pneigh_lookup_1(struct pneigh_entry *n,
 552                                               struct net *net,
 553                                               const void *pkey,
 554                                               int key_len,
 555                                               struct net_device *dev)
 556 {
 557         while (n) {
 558                 if (!memcmp(n->key, pkey, key_len) &&
 559                     net_eq(pneigh_net(n), net) &&
 560                     (n->dev == dev || !n->dev))
 561                         return n;
 562                 n = n->next;
 563         }
 564         return NULL;
 565 }
 566
 567 struct pneigh_entry *__pneigh_lookup(struct neigh_table *tbl,
 568                 struct net *net, const void *pkey, struct net_device *dev)
 569 {
 570         int key_len = tbl->key_len;
 571         u32 hash_val = pneigh_hash(pkey, key_len);
 572
 573         return __pneigh_lookup_1(tbl->phash_buckets[hash_val],
 574                                  net, pkey, key_len, dev);
 575 }
 576 EXPORT_SYMBOL_GPL(__pneigh_lookup);
 577
 578 struct pneigh_entry * pneigh_lookup(struct neigh_table *tbl,
 579                                     struct net *net, const void *pkey,
 580                                     struct net_device *dev, int creat)
 581 {
 582         struct pneigh_entry *n;
 583         int key_len = tbl->key_len;
 584         u32 hash_val = pneigh_hash(pkey, key_len);
 585
 586         read_lock_bh(&tbl->lock);
 587         n = __pneigh_lookup_1(tbl->phash_buckets[hash_val],
 588                               net, pkey, key_len, dev);
 589         read_unlock_bh(&tbl->lock);
 590
 591         if (n || !creat)
 592                 goto out;
 593
 594         ASSERT_RTNL();
 595
 596         n = kmalloc(sizeof(*n) + key_len, GFP_KERNEL);
 597         if (!n)
 598                 goto out;
 599
 600         write_pnet(&n->net, net);
 601         memcpy(n->key, pkey, key_len);
 602         n->dev = dev;
 603         if (dev)
 604                 dev_hold(dev);
 605
 606         if (tbl->pconstructor && tbl->pconstructor(n)) {
 607                 if (dev)
 608                         dev_put(dev);
 609                 kfree(n);
 610                 n = NULL;
 611                 goto out;
 612         }
 613
 614         write_lock_bh(&tbl->lock);
 615         n->next = tbl->phash_buckets[hash_val];
 616         tbl->phash_buckets[hash_val] = n;
 617         write_unlock_bh(&tbl->lock);
 618 out:
 619         return n;
 620 }
 621 EXPORT_SYMBOL(pneigh_lookup);
 622
 623
 624 int pneigh_delete(struct neigh_table *tbl, struct net *net, const void *pkey,
 625                   struct net_device *dev)
 626 {
 627         struct pneigh_entry *n, **np;
 628         int key_len = tbl->key_len;
 629         u32 hash_val = pneigh_hash(pkey, key_len);
 630
 631         write_lock_bh(&tbl->lock);
 632         for (np = &tbl->phash_buckets[hash_val]; (n = *np) != NULL;
 633              np = &n->next) {
 634                 if (!memcmp(n->key, pkey, key_len) && n->dev == dev &&
 635                     net_eq(pneigh_net(n), net)) {
 636                         *np = n->next;
 637                         write_unlock_bh(&tbl->lock);
 638                         if (tbl->pdestructor)
 639                                 tbl->pdestructor(n);
 640                         if (n->dev)
 641                                 dev_put(n->dev);
 642                         kfree(n);
 643                         return 0;
 644                 }
 645         }
 646         write_unlock_bh(&tbl->lock);
 647         return -ENOENT;
 648 }
 649
 650 static int pneigh_ifdown(struct neigh_table *tbl, struct net_device *dev)
 651 {
 652         struct pneigh_entry *n, **np;
 653         u32 h;
 654
 655         for (h = 0; h <= PNEIGH_HASHMASK; h++) {
 656                 np = &tbl->phash_buckets[h];
 657                 while ((n = *np) != NULL) {
 658                         if (!dev || n->dev == dev) {
 659                                 *np = n->next;
 660                                 if (tbl->pdestructor)
 661                                         tbl->pdestructor(n);
 662                                 if (n->dev)
 663                                         dev_put(n->dev);
 664                                 kfree(n);
 665                                 continue;
 666                         }
 667                         np = &n->next;
 668                 }
 669         }
 670         return -ENOENT;
 671 }
 672
 673 static void neigh_parms_destroy(struct neigh_parms *parms);
 674
 675 static inline void neigh_parms_put(struct neigh_parms *parms)
 676 {
 677         if (atomic_dec_and_test(&parms->refcnt))
 678                 neigh_parms_destroy(parms);
 679 }
 680
 681 /*
 682  *      neighbour must already be out of the table;
 683  *
 684  */
 685 void neigh_destroy(struct neighbour *neigh)
 686 {
 687         struct net_device *dev = neigh->dev;
 688
 689         NEIGH_CACHE_STAT_INC(neigh->tbl, destroys);
 690
 691         if (!neigh->dead) {
 692                 pr_warn("Destroying alive neighbour %p\n", neigh);
 693                 dump_stack();
 694                 return;
 695         }
 696
 697         if (neigh_del_timer(neigh))
 698                 pr_warn("Impossible event\n");
 699
 700         write_lock_bh(&neigh->lock);
 701         __skb_queue_purge(&neigh->arp_queue);
 702         write_unlock_bh(&neigh->lock);
 703         neigh->arp_queue_len_bytes = 0;
 704
 705         if (dev->netdev_ops->ndo_neigh_destroy)
 706                 dev->netdev_ops->ndo_neigh_destroy(dev, neigh);
 707
 708         dev_put(dev);
 709         neigh_parms_put(neigh->parms);
 710
 711         neigh_dbg(2, "neigh %p is destroyed\n", neigh);
 712
 713         atomic_dec(&neigh->tbl->entries);
 714         kfree_rcu(neigh, rcu);
 715 }
 716 EXPORT_SYMBOL(neigh_destroy);
 717
 718 /* Neighbour state is suspicious;
 719    disable fast path.
 720
 721    Called with write_locked neigh.
 722  */
 723 static void neigh_suspect(struct neighbour *neigh)
 724 {
 725         neigh_dbg(2, "neigh %p is suspected\n", neigh);
 726
 727         neigh->output = neigh->ops->output;
 728 }
 729
 730 /* Neighbour state is OK;
 731    enable fast path.
 732
 733    Called with write_locked neigh.
 734  */
 735 static void neigh_connect(struct neighbour *neigh)
 736 {
 737         neigh_dbg(2, "neigh %p is connected\n", neigh);
 738
 739         neigh->output = neigh->ops->connected_output;
 740 }
 741
 742 static void neigh_periodic_work(struct work_struct *work)
 743 {
 744         struct neigh_table *tbl = container_of(work, struct neigh_table, gc_work.work);
 745         struct neighbour *n;
 746         struct neighbour __rcu **np;
 747         unsigned int i;
 748         struct neigh_hash_table *nht;
 749
 750         NEIGH_CACHE_STAT_INC(tbl, periodic_gc_runs);
 751
 752         write_lock_bh(&tbl->lock);
 753         nht = rcu_dereference_protected(tbl->nht,
 754                                         lockdep_is_held(&tbl->lock));
 755
 756         /*
 757          *      periodically recompute ReachableTime from random function
 758          */
 759
 760         if (time_after(jiffies, tbl->last_rand + 300 * HZ)) {
 761                 struct neigh_parms *p;
 762                 tbl->last_rand = jiffies;
 763                 list_for_each_entry(p, &tbl->parms_list, list)
 764                         p->reachable_time =
 765                                 neigh_rand_reach_time(NEIGH_VAR(p, BASE_REACHABLE_TIME));
 766         }
 767
 768         if (atomic_read(&tbl->entries) < tbl->gc_thresh1)
 769                 goto out;
 770
 771         for (i = 0 ; i < (1 << nht->hash_shift); i++) {
 772                 np = &nht->hash_buckets[i];
 773
 774                 while ((n = rcu_dereference_protected(*np,
 775                                 lockdep_is_held(&tbl->lock))) != NULL) {
 776                         unsigned int state;
 777
 778                         write_lock(&n->lock);
 779
 780                         state = n->nud_state;
 781                         if (state & (NUD_PERMANENT | NUD_IN_TIMER)) {
 782                                 write_unlock(&n->lock);
 783                                 goto next_elt;
 784                         }
 785
 786                         if (time_before(n->used, n->confirmed))
 787                                 n->used = n->confirmed;
 788
 789                         if (atomic_read(&n->refcnt) == 1 &&
 790                             (state == NUD_FAILED ||
 791                              time_after(jiffies, n->used + NEIGH_VAR(n->parms, GC_STALETIME)))) {
 792                                 *np = n->next;
 793                                 n->dead = 1;
 794                                 write_unlock(&n->lock);
 795                                 neigh_cleanup_and_release(n);
 796                                 continue;
 797                         }
 798                         write_unlock(&n->lock);
 799
 800 next_elt:
 801                         np = &n->next;
 802                 }
 803                 /*
 804                  * It's fine to release lock here, even if hash table
 805                  * grows while we are preempted.
 806                  */
 807                 write_unlock_bh(&tbl->lock);
 808                 cond_resched();
 809                 write_lock_bh(&tbl->lock);
 810                 nht = rcu_dereference_protected(tbl->nht,
 811                                                 lockdep_is_held(&tbl->lock));
 812         }
 813 out:
 814         /* Cycle through all hash buckets every BASE_REACHABLE_TIME/2 ticks.
 815          * ARP entry timeouts range from 1/2 BASE_REACHABLE_TIME to 3/2
 816          * BASE_REACHABLE_TIME.
 817          */
 818         queue_delayed_work(system_power_efficient_wq, &tbl->gc_work,
 819                               NEIGH_VAR(&tbl->parms, BASE_REACHABLE_TIME) >> 1);
 820         write_unlock_bh(&tbl->lock);
 821 }
 822
 823 static __inline__ int neigh_max_probes(struct neighbour *n)
 824 {
 825         struct neigh_parms *p = n->parms;
 826         return NEIGH_VAR(p, UCAST_PROBES) + NEIGH_VAR(p, APP_PROBES) +
 827                (n->nud_state & NUD_PROBE ? NEIGH_VAR(p, MCAST_REPROBES) :
 828                 NEIGH_VAR(p, MCAST_PROBES));
 829 }
 830
 831 static void neigh_invalidate(struct neighbour *neigh)
 832         __releases(neigh->lock)
 833         __acquires(neigh->lock)
 834 {
 835         struct sk_buff *skb;
 836
 837         NEIGH_CACHE_STAT_INC(neigh->tbl, res_failed);
 838         neigh_dbg(2, "neigh %p is failed\n", neigh);
 839         neigh->updated = jiffies;
 840
 841         /* It is very thin place. report_unreachable is very complicated
 842            routine. Particularly, it can hit the same neighbour entry!
 843
 844            So that, we try to be accurate and avoid dead loop. --ANK
 845          */
 846         while (neigh->nud_state == NUD_FAILED &&
 847                (skb = __skb_dequeue(&neigh->arp_queue)) != NULL) {
 848                 write_unlock(&neigh->lock);
 849                 neigh->ops->error_report(neigh, skb);
 850                 write_lock(&neigh->lock);
 851         }
 852         __skb_queue_purge(&neigh->arp_queue);
 853         neigh->arp_queue_len_bytes = 0;
 854 }
 855
 856 static void neigh_probe(struct neighbour *neigh)
 857         __releases(neigh->lock)
 858 {
 859         struct sk_buff *skb = skb_peek_tail(&neigh->arp_queue);
 860         /* keep skb alive even if arp_queue overflows */
 861         if (skb)
 862                 skb = skb_clone(skb, GFP_ATOMIC);
 863         write_unlock(&neigh->lock);
 864         if (neigh->ops->solicit)
 865                 neigh->ops->solicit(neigh, skb);
 866         atomic_inc(&neigh->probes);
 867         kfree_skb(skb);
 868 }
 869
 870 /* Called when a timer expires for a neighbour entry. */
 871
 872 static void neigh_timer_handler(unsigned long arg)
 873 {
 874         unsigned long now, next;
 875         struct neighbour *neigh = (struct neighbour *)arg;
 876         unsigned int state;
 877         int notify = 0;
 878
 879         write_lock(&neigh->lock);
 880
 881         state = neigh->nud_state;
 882         now = jiffies;
 883         next = now + HZ;
 884
 885         if (!(state & NUD_IN_TIMER))
 886                 goto out;
 887
 888         if (state & NUD_REACHABLE) {
 889                 if (time_before_eq(now,
 890                                    neigh->confirmed + neigh->parms->reachable_time)) {
 891                         neigh_dbg(2, "neigh %p is still alive\n", neigh);
 892                         next = neigh->confirmed + neigh->parms->reachable_time;
 893                 } else if (time_before_eq(now,
 894                                           neigh->used +
 895                                           NEIGH_VAR(neigh->parms, DELAY_PROBE_TIME))) {
 896                         neigh_dbg(2, "neigh %p is delayed\n", neigh);
 897                         neigh->nud_state = NUD_DELAY;
 898                         neigh->updated = jiffies;
 899                         neigh_suspect(neigh);
 900                         next = now + NEIGH_VAR(neigh->parms, DELAY_PROBE_TIME);
 901                 } else {
 902                         neigh_dbg(2, "neigh %p is suspected\n", neigh);
 903                         neigh->nud_state = NUD_STALE;
 904                         neigh->updated = jiffies;
 905                         neigh_suspect(neigh);
 906                         notify = 1;
 907                 }
 908         } else if (state & NUD_DELAY) {
 909                 if (time_before_eq(now,
 910                                    neigh->confirmed +
 911                                    NEIGH_VAR(neigh->parms, DELAY_PROBE_TIME))) {
 912                         neigh_dbg(2, "neigh %p is now reachable\n", neigh);
 913                         neigh->nud_state = NUD_REACHABLE;
 914                         neigh->updated = jiffies;
 915                         neigh_connect(neigh);
 916                         notify = 1;
 917                         next = neigh->confirmed + neigh->parms->reachable_time;
 918                 } else {
 919                         neigh_dbg(2, "neigh %p is probed\n", neigh);
 920                         neigh->nud_state = NUD_PROBE;
 921                         neigh->updated = jiffies;
 922                         atomic_set(&neigh->probes, 0);
 923                         notify = 1;
 924                         next = now + NEIGH_VAR(neigh->parms, RETRANS_TIME);
 925                 }
 926         } else {
 927                 /* NUD_PROBE|NUD_INCOMPLETE */
 928                 next = now + NEIGH_VAR(neigh->parms, RETRANS_TIME);
 929         }
 930
 931         if ((neigh->nud_state & (NUD_INCOMPLETE | NUD_PROBE)) &&
 932             atomic_read(&neigh->probes) >= neigh_max_probes(neigh)) {
 933                 neigh->nud_state = NUD_FAILED;
 934                 notify = 1;
 935                 neigh_invalidate(neigh);
 936                 goto out;
 937         }
 938
 939         if (neigh->nud_state & NUD_IN_TIMER) {
 940                 if (time_before(next, jiffies + HZ/2))
 941                         next = jiffies + HZ/2;
 942                 if (!mod_timer(&neigh->timer, next))
 943                         neigh_hold(neigh);
 944         }
 945         if (neigh->nud_state & (NUD_INCOMPLETE | NUD_PROBE)) {
 946                 neigh_probe(neigh);
 947         } else {
 948 out:
 949                 write_unlock(&neigh->lock);
 950         }
 951
 952         if (notify)
 953                 neigh_update_notify(neigh, 0);
 954
 955         neigh_release(neigh);
 956 }
 957
 958 int __neigh_event_send(struct neighbour *neigh, struct sk_buff *skb)
 959 {
 960         int rc;
 961         bool immediate_probe = false;
 962
 963         write_lock_bh(&neigh->lock);
 964
 965         rc = 0;
 966         if (neigh->nud_state & (NUD_CONNECTED | NUD_DELAY | NUD_PROBE))
 967                 goto out_unlock_bh;
 968         if (neigh->dead)
 969                 goto out_dead;
 970
 971         if (!(neigh->nud_state & (NUD_STALE | NUD_INCOMPLETE))) {
 972                 if (NEIGH_VAR(neigh->parms, MCAST_PROBES) +
 973                     NEIGH_VAR(neigh->parms, APP_PROBES)) {
 974                         unsigned long next, now = jiffies;
 975
 976                         atomic_set(&neigh->probes,
 977                                    NEIGH_VAR(neigh->parms, UCAST_PROBES));
 978                         neigh->nud_state     = NUD_INCOMPLETE;
 979                         neigh->updated = now;
 980                         next = now + max(NEIGH_VAR(neigh->parms, RETRANS_TIME),
 981                                          HZ/2);
 982                         neigh_add_timer(neigh, next);
 983                         immediate_probe = true;
 984                 } else {
 985                         neigh->nud_state = NUD_FAILED;
 986                         neigh->updated = jiffies;
 987                         write_unlock_bh(&neigh->lock);
 988
 989                         kfree_skb(skb);
 990                         return 1;
 991                 }
 992         } else if (neigh->nud_state & NUD_STALE) {
 993                 neigh_dbg(2, "neigh %p is delayed\n", neigh);
 994                 neigh->nud_state = NUD_DELAY;
 995                 neigh->updated = jiffies;
 996                 neigh_add_timer(neigh, jiffies +
 997                                 NEIGH_VAR(neigh->parms, DELAY_PROBE_TIME));
 998         }
 999
1000         if (neigh->nud_state == NUD_INCOMPLETE) {
1001                 if (skb) {
1002                         while (neigh->arp_queue_len_bytes + skb->truesize >
1003                                NEIGH_VAR(neigh->parms, QUEUE_LEN_BYTES)) {
1004                                 struct sk_buff *buff;
1005
1006                                 buff = __skb_dequeue(&neigh->arp_queue);
1007                                 if (!buff)
1008                                         break;
1009                                 neigh->arp_queue_len_bytes -= buff->truesize;
1010                                 kfree_skb(buff);
1011                                 NEIGH_CACHE_STAT_INC(neigh->tbl, unres_discards);
1012                         }
1013                         skb_dst_force(skb);
1014                         __skb_queue_tail(&neigh->arp_queue, skb);
1015                         neigh->arp_queue_len_bytes += skb->truesize;
1016                 }
1017                 rc = 1;
1018         }
1019 out_unlock_bh:
1020         if (immediate_probe)
1021                 neigh_probe(neigh);
1022         else
1023                 write_unlock(&neigh->lock);
1024         local_bh_enable();
1025         return rc;
1026
1027 out_dead:
1028         if (neigh->nud_state & NUD_STALE)
1029                 goto out_unlock_bh;
1030         write_unlock_bh(&neigh->lock);
1031         kfree_skb(skb);
1032         return 1;
1033 }
1034 EXPORT_SYMBOL(__neigh_event_send);
1035
1036 static void neigh_update_hhs(struct neighbour *neigh)
1037 {
1038         struct hh_cache *hh;
1039         void (*update)(struct hh_cache*, const struct net_device*, const unsigned char *)
1040                 = NULL;
1041
1042         if (neigh->dev->header_ops)
1043                 update = neigh->dev->header_ops->cache_update;
1044
1045         if (update) {
1046                 hh = &neigh->hh;
1047                 if (hh->hh_len) {
1048                         write_seqlock_bh(&hh->hh_lock);
1049                         update(hh, neigh->dev, neigh->ha);
1050                         write_sequnlock_bh(&hh->hh_lock);
1051                 }
1052         }
1053 }
1054
1055
1056
1057 /* Generic update routine.
1058    -- lladdr is new lladdr or NULL, if it is not supplied.
1059    -- new    is new state.
1060    -- flags
1061         NEIGH_UPDATE_F_OVERRIDE allows to override existing lladdr,
1062                                 if it is different.
1063         NEIGH_UPDATE_F_WEAK_OVERRIDE will suspect existing "connected"
1064                                 lladdr instead of overriding it
1065                                 if it is different.
1066         NEIGH_UPDATE_F_ADMIN    means that the change is administrative.
1067
1068         NEIGH_UPDATE_F_OVERRIDE_ISROUTER allows to override existing
1069                                 NTF_ROUTER flag.
1070         NEIGH_UPDATE_F_ISROUTER indicates if the neighbour is known as
1071                                 a router.
1072
1073    Caller MUST hold reference count on the entry.
1074  */
1075
1076 int neigh_update(struct neighbour *neigh, const u8 *lladdr, u8 new,
1077                  u32 flags, u32 nlmsg_pid)
1078 {
1079         u8 old;
1080         int err;
1081         int notify = 0;
1082         struct net_device *dev;
1083         int update_isrouter = 0;
1084
1085         write_lock_bh(&neigh->lock);
1086
1087         dev    = neigh->dev;
1088         old    = neigh->nud_state;
1089         err    = -EPERM;
1090
1091         if (!(flags & NEIGH_UPDATE_F_ADMIN) &&
1092             (old & (NUD_NOARP | NUD_PERMANENT)))
1093                 goto out;
1094         if (neigh->dead)
1095                 goto out;
1096
1097         if (!(new & NUD_VALID)) {
1098                 neigh_del_timer(neigh);
1099                 if (old & NUD_CONNECTED)
1100                         neigh_suspect(neigh);
1101                 neigh->nud_state = new;
1102                 err = 0;
1103                 notify = old & NUD_VALID;
1104                 if ((old & (NUD_INCOMPLETE | NUD_PROBE)) &&
1105                     (new & NUD_FAILED)) {
1106                         neigh_invalidate(neigh);
1107                         notify = 1;
1108                 }
1109                 goto out;
1110         }
1111
1112         /* Compare new lladdr with cached one */
1113         if (!dev->addr_len) {
1114                 /* First case: device needs no address. */
1115                 lladdr = neigh->ha;
1116         } else if (lladdr) {
1117                 /* The second case: if something is already cached
1118                    and a new address is proposed:
1119                    - compare new & old
1120                    - if they are different, check override flag
1121                  */
1122                 if ((old & NUD_VALID) &&
1123                     !memcmp(lladdr, neigh->ha, dev->addr_len))
1124                         lladdr = neigh->ha;
1125         } else {
1126                 /* No address is supplied; if we know something,
1127                    use it, otherwise discard the request.
1128                  */
1129                 err = -EINVAL;
1130                 if (!(old & NUD_VALID))
1131                         goto out;
1132                 lladdr = neigh->ha;
1133         }
1134
1135         /* If entry was valid and address is not changed,
1136            do not change entry state, if new one is STALE.
1137          */
1138         err = 0;
1139         update_isrouter = flags & NEIGH_UPDATE_F_OVERRIDE_ISROUTER;
1140         if (old & NUD_VALID) {
1141                 if (lladdr != neigh->ha && !(flags & NEIGH_UPDATE_F_OVERRIDE)) {
1142                         update_isrouter = 0;
1143                         if ((flags & NEIGH_UPDATE_F_WEAK_OVERRIDE) &&
1144                             (old & NUD_CONNECTED)) {
1145                                 lladdr = neigh->ha;
1146                                 new = NUD_STALE;
1147                         } else
1148                                 goto out;
1149                 } else {
1150                         if (lladdr == neigh->ha && new == NUD_STALE &&
1151                             !(flags & NEIGH_UPDATE_F_ADMIN))
1152                                 new = old;
1153                 }
1154         }
1155
1156         /* Update timestamps only once we know we will make a change to the
1157          * neighbour entry. Otherwise we risk to move the locktime window with
1158          * noop updates and ignore relevant ARP updates.
1159          */
1160         if (new != old || lladdr != neigh->ha) {
1161                 if (new & NUD_CONNECTED)
1162                         neigh->confirmed = jiffies;
1163                 neigh->updated = jiffies;
1164         }
1165
1166         if (new != old) {
1167                 neigh_del_timer(neigh);
1168                 if (new & NUD_PROBE)
1169                         atomic_set(&neigh->probes, 0);
1170                 if (new & NUD_IN_TIMER)
1171                         neigh_add_timer(neigh, (jiffies +
1172                                                 ((new & NUD_REACHABLE) ?
1173                                                  neigh->parms->reachable_time :
1174                                                  0)));
1175                 neigh->nud_state = new;
1176                 notify = 1;
1177         }
1178
1179         if (lladdr != neigh->ha) {
1180                 write_seqlock(&neigh->ha_lock);
1181                 memcpy(&neigh->ha, lladdr, dev->addr_len);
1182                 write_sequnlock(&neigh->ha_lock);
1183                 neigh_update_hhs(neigh);
1184                 if (!(new & NUD_CONNECTED))
1185                         neigh->confirmed = jiffies -
1186                                       (NEIGH_VAR(neigh->parms, BASE_REACHABLE_TIME) << 1);
1187                 notify = 1;
1188         }
1189         if (new == old)
1190                 goto out;
1191         if (new & NUD_CONNECTED)
1192                 neigh_connect(neigh);
1193         else
1194                 neigh_suspect(neigh);
1195         if (!(old & NUD_VALID)) {
1196                 struct sk_buff *skb;
1197
1198                 /* Again: avoid dead loop if something went wrong */
1199
1200                 while (neigh->nud_state & NUD_VALID &&
1201                        (skb = __skb_dequeue(&neigh->arp_queue)) != NULL) {
1202                         struct dst_entry *dst = skb_dst(skb);
1203                         struct neighbour *n2, *n1 = neigh;
1204                         write_unlock_bh(&neigh->lock);
1205
1206                         rcu_read_lock();
1207
1208                         /* Why not just use 'neigh' as-is?  The problem is that
1209                          * things such as shaper, eql, and sch_teql can end up
1210                          * using alternative, different, neigh objects to output
1211                          * the packet in the output path.  So what we need to do
1212                          * here is re-lookup the top-level neigh in the path so
1213                          * we can reinject the packet there.
1214                          */
1215                         n2 = NULL;
1216                         if (dst) {
1217                                 n2 = dst_neigh_lookup_skb(dst, skb);
1218                                 if (n2)
1219                                         n1 = n2;
1220                         }
1221                         n1->output(n1, skb);
1222                         if (n2)
1223                                 neigh_release(n2);
1224                         rcu_read_unlock();
1225
1226                         write_lock_bh(&neigh->lock);
1227                 }
1228                 __skb_queue_purge(&neigh->arp_queue);
1229                 neigh->arp_queue_len_bytes = 0;
1230         }
1231 out:
1232         if (update_isrouter) {
1233                 neigh->flags = (flags & NEIGH_UPDATE_F_ISROUTER) ?
1234                         (neigh->flags | NTF_ROUTER) :
1235                         (neigh->flags & ~NTF_ROUTER);
1236         }
1237         write_unlock_bh(&neigh->lock);
1238
1239         if (notify)
1240                 neigh_update_notify(neigh, nlmsg_pid);
1241
1242         return err;
1243 }
1244 EXPORT_SYMBOL(neigh_update);
1245
1246 /* Update the neigh to listen temporarily for probe responses, even if it is
1247  * in a NUD_FAILED state. The caller has to hold neigh->lock for writing.
1248  */
1249 void __neigh_set_probe_once(struct neighbour *neigh)
1250 {
1251         if (neigh->dead)
1252                 return;
1253         neigh->updated = jiffies;
1254         if (!(neigh->nud_state & NUD_FAILED))
1255                 return;
1256         neigh->nud_state = NUD_INCOMPLETE;
1257         atomic_set(&neigh->probes, neigh_max_probes(neigh));
1258         neigh_add_timer(neigh,
1259                         jiffies + NEIGH_VAR(neigh->parms, RETRANS_TIME));
1260 }
1261 EXPORT_SYMBOL(__neigh_set_probe_once);
1262
1263 struct neighbour *neigh_event_ns(struct neigh_table *tbl,
1264                                  u8 *lladdr, void *saddr,
1265                                  struct net_device *dev)
1266 {
1267         struct neighbour *neigh = __neigh_lookup(tbl, saddr, dev,
1268                                                  lladdr || !dev->addr_len);
1269         if (neigh)
1270                 neigh_update(neigh, lladdr, NUD_STALE,
1271                              NEIGH_UPDATE_F_OVERRIDE, 0);
1272         return neigh;
1273 }
1274 EXPORT_SYMBOL(neigh_event_ns);
1275
1276 /* called with read_lock_bh(&n->lock); */
1277 static void neigh_hh_init(struct neighbour *n)
1278 {
1279         struct net_device *dev = n->dev;
1280         __be16 prot = n->tbl->protocol;
1281         struct hh_cache *hh = &n->hh;
1282
1283         write_lock_bh(&n->lock);
1284
1285         /* Only one thread can come in here and initialize the
1286          * hh_cache entry.
1287          */
1288         if (!hh->hh_len)
1289                 dev->header_ops->cache(n, hh, prot);
1290
1291         write_unlock_bh(&n->lock);
1292 }
1293
1294 /* Slow and careful. */
1295
1296 int neigh_resolve_output(struct neighbour *neigh, struct sk_buff *skb)
1297 {
1298         int rc = 0;
1299
1300         if (!neigh_event_send(neigh, skb)) {
1301                 int err;
1302                 struct net_device *dev = neigh->dev;
1303                 unsigned int seq;
1304
1305                 if (dev->header_ops->cache && !neigh->hh.hh_len)
1306                         neigh_hh_init(neigh);
1307
1308                 do {
1309                         __skb_pull(skb, skb_network_offset(skb));
1310                         seq = read_seqbegin(&neigh->ha_lock);
1311                         err = dev_hard_header(skb, dev, ntohs(skb->protocol),
1312                                               neigh->ha, NULL, skb->len);
1313                 } while (read_seqretry(&neigh->ha_lock, seq));
1314
1315                 if (err >= 0)
1316                         rc = dev_queue_xmit(skb);
1317                 else
1318                         goto out_kfree_skb;
1319         }
1320 out:
1321         return rc;
1322 out_kfree_skb:
1323         rc = -EINVAL;
1324         kfree_skb(skb);
1325         goto out;
1326 }
1327 EXPORT_SYMBOL(neigh_resolve_output);
1328
1329 /* As fast as possible without hh cache */
1330
1331 int neigh_connected_output(struct neighbour *neigh, struct sk_buff *skb)
1332 {
1333         struct net_device *dev = neigh->dev;
1334         unsigned int seq;
1335         int err;
1336
1337         do {
1338                 __skb_pull(skb, skb_network_offset(skb));
1339                 seq = read_seqbegin(&neigh->ha_lock);
1340                 err = dev_hard_header(skb, dev, ntohs(skb->protocol),
1341                                       neigh->ha, NULL, skb->len);
1342         } while (read_seqretry(&neigh->ha_lock, seq));
1343
1344         if (err >= 0)
1345                 err = dev_queue_xmit(skb);
1346         else {
1347                 err = -EINVAL;
1348                 kfree_skb(skb);
1349         }
1350         return err;
1351 }
1352 EXPORT_SYMBOL(neigh_connected_output);
1353
1354 int neigh_direct_output(struct neighbour *neigh, struct sk_buff *skb)
1355 {
1356         return dev_queue_xmit(skb);
1357 }
1358 EXPORT_SYMBOL(neigh_direct_output);
1359
1360 static void neigh_proxy_process(unsigned long arg)
1361 {
1362         struct neigh_table *tbl = (struct neigh_table *)arg;
1363         long sched_next = 0;
1364         unsigned long now = jiffies;
1365         struct sk_buff *skb, *n;
1366
1367         spin_lock(&tbl->proxy_queue.lock);
1368
1369         skb_queue_walk_safe(&tbl->proxy_queue, skb, n) {
1370                 long tdif = NEIGH_CB(skb)->sched_next - now;
1371
1372                 if (tdif <= 0) {
1373                         struct net_device *dev = skb->dev;
1374
1375                         __skb_unlink(skb, &tbl->proxy_queue);
1376                         if (tbl->proxy_redo && netif_running(dev)) {
1377                                 rcu_read_lock();
1378                                 tbl->proxy_redo(skb);
1379                                 rcu_read_unlock();
1380                         } else {
1381                                 kfree_skb(skb);
1382                         }
1383
1384                         dev_put(dev);
1385                 } else if (!sched_next || tdif < sched_next)
1386                         sched_next = tdif;
1387         }
1388         del_timer(&tbl->proxy_timer);
1389         if (sched_next)
1390                 mod_timer(&tbl->proxy_timer, jiffies + sched_next);
1391         spin_unlock(&tbl->proxy_queue.lock);
1392 }
1393
1394 void pneigh_enqueue(struct neigh_table *tbl, struct neigh_parms *p,
1395                     struct sk_buff *skb)
1396 {
1397         unsigned long now = jiffies;
1398
1399         unsigned long sched_next = now + (prandom_u32() %
1400                                           NEIGH_VAR(p, PROXY_DELAY));
1401
1402         if (tbl->proxy_queue.qlen > NEIGH_VAR(p, PROXY_QLEN)) {
1403                 kfree_skb(skb);
1404                 return;
1405         }
1406
1407         NEIGH_CB(skb)->sched_next = sched_next;
1408         NEIGH_CB(skb)->flags |= LOCALLY_ENQUEUED;
1409
1410         spin_lock(&tbl->proxy_queue.lock);
1411         if (del_timer(&tbl->proxy_timer)) {
1412                 if (time_before(tbl->proxy_timer.expires, sched_next))
1413                         sched_next = tbl->proxy_timer.expires;
1414         }
1415         skb_dst_drop(skb);
1416         dev_hold(skb->dev);
1417         __skb_queue_tail(&tbl->proxy_queue, skb);
1418         mod_timer(&tbl->proxy_timer, sched_next);
1419         spin_unlock(&tbl->proxy_queue.lock);
1420 }
1421 EXPORT_SYMBOL(pneigh_enqueue);
1422
1423 static inline struct neigh_parms *lookup_neigh_parms(struct neigh_table *tbl,
1424                                                       struct net *net, int ifindex)
1425 {
1426         struct neigh_parms *p;
1427
1428         list_for_each_entry(p, &tbl->parms_list, list) {
1429                 if ((p->dev && p->dev->ifindex == ifindex && net_eq(neigh_parms_net(p), net)) ||
1430                     (!p->dev && !ifindex && net_eq(net, &init_net)))
1431                         return p;
1432         }
1433
1434         return NULL;
1435 }
1436
1437 struct neigh_parms *neigh_parms_alloc(struct net_device *dev,
1438                                       struct neigh_table *tbl)
1439 {
1440         struct neigh_parms *p;
1441         struct net *net = dev_net(dev);
1442         const struct net_device_ops *ops = dev->netdev_ops;
1443
1444         p = kmemdup(&tbl->parms, sizeof(*p), GFP_KERNEL);
1445         if (p) {
1446                 p->tbl            = tbl;
1447                 atomic_set(&p->refcnt, 1);
1448                 p->reachable_time =
1449                                 neigh_rand_reach_time(NEIGH_VAR(p, BASE_REACHABLE_TIME));
1450                 dev_hold(dev);
1451                 p->dev = dev;
1452                 write_pnet(&p->net, net);
1453                 p->sysctl_table = NULL;
1454
1455                 if (ops->ndo_neigh_setup && ops->ndo_neigh_setup(dev, p)) {
1456                         dev_put(dev);
1457                         kfree(p);
1458                         return NULL;
1459                 }
1460
1461                 write_lock_bh(&tbl->lock);
1462                 list_add(&p->list, &tbl->parms.list);
1463                 write_unlock_bh(&tbl->lock);
1464
1465                 neigh_parms_data_state_cleanall(p);
1466         }
1467         return p;
1468 }
1469 EXPORT_SYMBOL(neigh_parms_alloc);
1470
1471 static void neigh_rcu_free_parms(struct rcu_head *head)
1472 {
1473         struct neigh_parms *parms =
1474                 container_of(head, struct neigh_parms, rcu_head);
1475
1476         neigh_parms_put(parms);
1477 }
1478
1479 void neigh_parms_release(struct neigh_table *tbl, struct neigh_parms *parms)
1480 {
1481         if (!parms || parms == &tbl->parms)
1482                 return;
1483         write_lock_bh(&tbl->lock);
1484         list_del(&parms->list);
1485         parms->dead = 1;
1486         write_unlock_bh(&tbl->lock);
1487         if (parms->dev)
1488                 dev_put(parms->dev);
1489         call_rcu(&parms->rcu_head, neigh_rcu_free_parms);
1490 }
1491 EXPORT_SYMBOL(neigh_parms_release);
1492
1493 static void neigh_parms_destroy(struct neigh_parms *parms)
1494 {
1495         kfree(parms);
1496 }
1497
1498 static struct lock_class_key neigh_table_proxy_queue_class;
1499
1500 static struct neigh_table *neigh_tables[NEIGH_NR_TABLES] __read_mostly;
1501
1502 void neigh_table_init(int index, struct neigh_table *tbl)
1503 {
1504         unsigned long now = jiffies;
1505         unsigned long phsize;
1506
1507         INIT_LIST_HEAD(&tbl->parms_list);
1508         list_add(&tbl->parms.list, &tbl->parms_list);
1509         write_pnet(&tbl->parms.net, &init_net);
1510         atomic_set(&tbl->parms.refcnt, 1);
1511         tbl->parms.reachable_time =
1512                           neigh_rand_reach_time(NEIGH_VAR(&tbl->parms, BASE_REACHABLE_TIME));
1513
1514         tbl->stats = alloc_percpu(struct neigh_statistics);
1515         if (!tbl->stats)
1516                 panic("cannot create neighbour cache statistics");
1517
1518 #ifdef CONFIG_PROC_FS
1519         if (!proc_create_data(tbl->id, 0, init_net.proc_net_stat,
1520                               &neigh_stat_seq_fops, tbl))
1521                 panic("cannot create neighbour proc dir entry");
1522 #endif
1523
1524         RCU_INIT_POINTER(tbl->nht, neigh_hash_alloc(3));
1525
1526         phsize = (PNEIGH_HASHMASK + 1) * sizeof(struct pneigh_entry *);
1527         tbl->phash_buckets = kzalloc(phsize, GFP_KERNEL);
1528
1529         if (!tbl->nht || !tbl->phash_buckets)
1530                 panic("cannot allocate neighbour cache hashes");
1531
1532         if (!tbl->entry_size)
1533                 tbl->entry_size = ALIGN(offsetof(struct neighbour, primary_key) +
1534                                         tbl->key_len, NEIGH_PRIV_ALIGN);
1535         else
1536                 WARN_ON(tbl->entry_size % NEIGH_PRIV_ALIGN);
1537
1538         rwlock_init(&tbl->lock);
1539         INIT_DEFERRABLE_WORK(&tbl->gc_work, neigh_periodic_work);
1540         queue_delayed_work(system_power_efficient_wq, &tbl->gc_work,
1541                         tbl->parms.reachable_time);
1542         setup_timer(&tbl->proxy_timer, neigh_proxy_process, (unsigned long)tbl);
1543         skb_queue_head_init_class(&tbl->proxy_queue,
1544                         &neigh_table_proxy_queue_class);
1545
1546         tbl->last_flush = now;
1547         tbl->last_rand  = now + tbl->parms.reachable_time * 20;
1548
1549         neigh_tables[index] = tbl;
1550 }
1551 EXPORT_SYMBOL(neigh_table_init);
1552
1553 int neigh_table_clear(int index, struct neigh_table *tbl)
1554 {
1555         neigh_tables[index] = NULL;
1556         /* It is not clean... Fix it to unload IPv6 module safely */
1557         cancel_delayed_work_sync(&tbl->gc_work);
1558         del_timer_sync(&tbl->proxy_timer);
1559         pneigh_queue_purge(&tbl->proxy_queue);
1560         neigh_ifdown(tbl, NULL);
1561         if (atomic_read(&tbl->entries))
1562                 pr_crit("neighbour leakage\n");
1563
1564         call_rcu(&rcu_dereference_protected(tbl->nht, 1)->rcu,
1565                  neigh_hash_free_rcu);
1566         tbl->nht = NULL;
1567
1568         kfree(tbl->phash_buckets);
1569         tbl->phash_buckets = NULL;
1570
1571         remove_proc_entry(tbl->id, init_net.proc_net_stat);
1572
1573         free_percpu(tbl->stats);
1574         tbl->stats = NULL;
1575
1576         return 0;
1577 }
1578 EXPORT_SYMBOL(neigh_table_clear);
1579
1580 static struct neigh_table *neigh_find_table(int family)
1581 {
1582         struct neigh_table *tbl = NULL;
1583
1584         switch (family) {
1585         case AF_INET:
1586                 tbl = neigh_tables[NEIGH_ARP_TABLE];
1587                 break;
1588         case AF_INET6:
1589                 tbl = neigh_tables[NEIGH_ND_TABLE];
1590                 break;
1591         case AF_DECnet:
1592                 tbl = neigh_tables[NEIGH_DN_TABLE];
1593                 break;
1594         }
1595
1596         return tbl;
1597 }
1598
1599 static int neigh_delete(struct sk_buff *skb, struct nlmsghdr *nlh,
1600                         struct netlink_ext_ack *extack)
1601 {
1602         struct net *net = sock_net(skb->sk);
1603         struct ndmsg *ndm;
1604         struct nlattr *dst_attr;
1605         struct neigh_table *tbl;
1606         struct neighbour *neigh;
1607         struct net_device *dev = NULL;
1608         int err = -EINVAL;
1609
1610         ASSERT_RTNL();
1611         if (nlmsg_len(nlh) < sizeof(*ndm))
1612                 goto out;
1613
1614         dst_attr = nlmsg_find_attr(nlh, sizeof(*ndm), NDA_DST);
1615         if (dst_attr == NULL)
1616                 goto out;
1617
1618         ndm = nlmsg_data(nlh);
1619         if (ndm->ndm_ifindex) {
1620                 dev = __dev_get_by_index(net, ndm->ndm_ifindex);
1621                 if (dev == NULL) {
1622                         err = -ENODEV;
1623                         goto out;
1624                 }
1625         }
1626
1627         tbl = neigh_find_table(ndm->ndm_family);
1628         if (tbl == NULL)
1629                 return -EAFNOSUPPORT;
1630
1631         if (nla_len(dst_attr) < tbl->key_len)
1632                 goto out;
1633
1634         if (ndm->ndm_flags & NTF_PROXY) {
1635                 err = pneigh_delete(tbl, net, nla_data(dst_attr), dev);
1636                 goto out;
1637         }
1638
1639         if (dev == NULL)
1640                 goto out;
1641
1642         neigh = neigh_lookup(tbl, nla_data(dst_attr), dev);
1643         if (neigh == NULL) {
1644                 err = -ENOENT;
1645                 goto out;
1646         }
1647
1648         err = neigh_update(neigh, NULL, NUD_FAILED,
1649                            NEIGH_UPDATE_F_OVERRIDE |
1650                            NEIGH_UPDATE_F_ADMIN,
1651                            NETLINK_CB(skb).portid);
1652         neigh_release(neigh);
1653
1654 out:
1655         return err;
1656 }
1657
1658 static int neigh_add(struct sk_buff *skb, struct nlmsghdr *nlh,
1659                      struct netlink_ext_ack *extack)
1660 {
1661         int flags = NEIGH_UPDATE_F_ADMIN | NEIGH_UPDATE_F_OVERRIDE;
1662         struct net *net = sock_net(skb->sk);
1663         struct ndmsg *ndm;
1664         struct nlattr *tb[NDA_MAX+1];
1665         struct neigh_table *tbl;
1666         struct net_device *dev = NULL;
1667         struct neighbour *neigh;
1668         void *dst, *lladdr;
1669         int err;
1670
1671         ASSERT_RTNL();
1672         err = nlmsg_parse(nlh, sizeof(*ndm), tb, NDA_MAX, NULL, extack);
1673         if (err < 0)
1674                 goto out;
1675
1676         err = -EINVAL;
1677         if (tb[NDA_DST] == NULL)
1678                 goto out;
1679
1680         ndm = nlmsg_data(nlh);
1681         if (ndm->ndm_ifindex) {
1682                 dev = __dev_get_by_index(net, ndm->ndm_ifindex);
1683                 if (dev == NULL) {
1684                         err = -ENODEV;
1685                         goto out;
1686                 }
1687
1688                 if (tb[NDA_LLADDR] && nla_len(tb[NDA_LLADDR]) < dev->addr_len)
1689                         goto out;
1690         }
1691
1692         tbl = neigh_find_table(ndm->ndm_family);
1693         if (tbl == NULL)
1694                 return -EAFNOSUPPORT;
1695
1696         if (nla_len(tb[NDA_DST]) < tbl->key_len)
1697                 goto out;
1698         dst = nla_data(tb[NDA_DST]);
1699         lladdr = tb[NDA_LLADDR] ? nla_data(tb[NDA_LLADDR]) : NULL;
1700
1701         if (ndm->ndm_flags & NTF_PROXY) {
1702                 struct pneigh_entry *pn;
1703
1704                 err = -ENOBUFS;
1705                 pn = pneigh_lookup(tbl, net, dst, dev, 1);
1706                 if (pn) {
1707                         pn->flags = ndm->ndm_flags;
1708                         err = 0;
1709                 }
1710                 goto out;
1711         }
1712
1713         if (dev == NULL)
1714                 goto out;
1715
1716         neigh = neigh_lookup(tbl, dst, dev);
1717         if (neigh == NULL) {
1718                 if (!(nlh->nlmsg_flags & NLM_F_CREATE)) {
1719                         err = -ENOENT;
1720                         goto out;
1721                 }
1722
1723                 neigh = __neigh_lookup_errno(tbl, dst, dev);
1724                 if (IS_ERR(neigh)) {
1725                         err = PTR_ERR(neigh);
1726                         goto out;
1727                 }
1728         } else {
1729                 if (nlh->nlmsg_flags & NLM_F_EXCL) {
1730                         err = -EEXIST;
1731                         neigh_release(neigh);
1732                         goto out;
1733                 }
1734
1735                 if (!(nlh->nlmsg_flags & NLM_F_REPLACE))
1736                         flags &= ~NEIGH_UPDATE_F_OVERRIDE;
1737         }
1738
1739         if (ndm->ndm_flags & NTF_USE) {
1740                 neigh_event_send(neigh, NULL);
1741                 err = 0;
1742         } else
1743                 err = neigh_update(neigh, lladdr, ndm->ndm_state, flags,
1744                                    NETLINK_CB(skb).portid);
1745         neigh_release(neigh);
1746
1747 out:
1748         return err;
1749 }
1750
1751 static int neightbl_fill_parms(struct sk_buff *skb, struct neigh_parms *parms)
1752 {
1753         struct nlattr *nest;
1754
1755         nest = nla_nest_start(skb, NDTA_PARMS);
1756         if (nest == NULL)
1757                 return -ENOBUFS;
1758
1759         if ((parms->dev &&
1760              nla_put_u32(skb, NDTPA_IFINDEX, parms->dev->ifindex)) ||
1761             nla_put_u32(skb, NDTPA_REFCNT, atomic_read(&parms->refcnt)) ||
1762             nla_put_u32(skb, NDTPA_QUEUE_LENBYTES,
1763                         NEIGH_VAR(parms, QUEUE_LEN_BYTES)) ||
1764             /* approximative value for deprecated QUEUE_LEN (in packets) */
1765             nla_put_u32(skb, NDTPA_QUEUE_LEN,
1766                         NEIGH_VAR(parms, QUEUE_LEN_BYTES) / SKB_TRUESIZE(ETH_FRAME_LEN)) ||
1767             nla_put_u32(skb, NDTPA_PROXY_QLEN, NEIGH_VAR(parms, PROXY_QLEN)) ||
1768             nla_put_u32(skb, NDTPA_APP_PROBES, NEIGH_VAR(parms, APP_PROBES)) ||
1769             nla_put_u32(skb, NDTPA_UCAST_PROBES,
1770                         NEIGH_VAR(parms, UCAST_PROBES)) ||
1771             nla_put_u32(skb, NDTPA_MCAST_PROBES,
1772                         NEIGH_VAR(parms, MCAST_PROBES)) ||
1773             nla_put_u32(skb, NDTPA_MCAST_REPROBES,
1774                         NEIGH_VAR(parms, MCAST_REPROBES)) ||
1775             nla_put_msecs(skb, NDTPA_REACHABLE_TIME, parms->reachable_time,
1776                           NDTPA_PAD) ||
1777             nla_put_msecs(skb, NDTPA_BASE_REACHABLE_TIME,
1778                           NEIGH_VAR(parms, BASE_REACHABLE_TIME), NDTPA_PAD) ||
1779             nla_put_msecs(skb, NDTPA_GC_STALETIME,
1780                           NEIGH_VAR(parms, GC_STALETIME), NDTPA_PAD) ||
1781             nla_put_msecs(skb, NDTPA_DELAY_PROBE_TIME,
1782                           NEIGH_VAR(parms, DELAY_PROBE_TIME), NDTPA_PAD) ||
1783             nla_put_msecs(skb, NDTPA_RETRANS_TIME,
1784                           NEIGH_VAR(parms, RETRANS_TIME), NDTPA_PAD) ||
1785             nla_put_msecs(skb, NDTPA_ANYCAST_DELAY,
1786                           NEIGH_VAR(parms, ANYCAST_DELAY), NDTPA_PAD) ||
1787             nla_put_msecs(skb, NDTPA_PROXY_DELAY,
1788                           NEIGH_VAR(parms, PROXY_DELAY), NDTPA_PAD) ||
1789             nla_put_msecs(skb, NDTPA_LOCKTIME,
1790                           NEIGH_VAR(parms, LOCKTIME), NDTPA_PAD))
1791                 goto nla_put_failure;
1792         return nla_nest_end(skb, nest);
1793
1794 nla_put_failure:
1795         nla_nest_cancel(skb, nest);
1796         return -EMSGSIZE;
1797 }
1798
1799 static int neightbl_fill_info(struct sk_buff *skb, struct neigh_table *tbl,
1800                               u32 pid, u32 seq, int type, int flags)
1801 {
1802         struct nlmsghdr *nlh;
1803         struct ndtmsg *ndtmsg;
1804
1805         nlh = nlmsg_put(skb, pid, seq, type, sizeof(*ndtmsg), flags);
1806         if (nlh == NULL)
1807                 return -EMSGSIZE;
1808
1809         ndtmsg = nlmsg_data(nlh);
1810
1811         read_lock_bh(&tbl->lock);
1812         ndtmsg->ndtm_family = tbl->family;
1813         ndtmsg->ndtm_pad1   = 0;
1814         ndtmsg->ndtm_pad2   = 0;
1815
1816         if (nla_put_string(skb, NDTA_NAME, tbl->id) ||
1817             nla_put_msecs(skb, NDTA_GC_INTERVAL, tbl->gc_interval, NDTA_PAD) ||
1818             nla_put_u32(skb, NDTA_THRESH1, tbl->gc_thresh1) ||
1819             nla_put_u32(skb, NDTA_THRESH2, tbl->gc_thresh2) ||
1820             nla_put_u32(skb, NDTA_THRESH3, tbl->gc_thresh3))
1821                 goto nla_put_failure;
1822         {
1823                 unsigned long now = jiffies;
1824                 unsigned int flush_delta = now - tbl->last_flush;
1825                 unsigned int rand_delta = now - tbl->last_rand;
1826                 struct neigh_hash_table *nht;
1827                 struct ndt_config ndc = {
1828                         .ndtc_key_len           = tbl->key_len,
1829                         .ndtc_entry_size        = tbl->entry_size,
1830                         .ndtc_entries           = atomic_read(&tbl->entries),
1831                         .ndtc_last_flush        = jiffies_to_msecs(flush_delta),
1832                         .ndtc_last_rand         = jiffies_to_msecs(rand_delta),
1833                         .ndtc_proxy_qlen        = tbl->proxy_queue.qlen,
1834                 };
1835
1836                 rcu_read_lock_bh();
1837                 nht = rcu_dereference_bh(tbl->nht);
1838                 ndc.ndtc_hash_rnd = nht->hash_rnd[0];
1839                 ndc.ndtc_hash_mask = ((1 << nht->hash_shift) - 1);
1840                 rcu_read_unlock_bh();
1841
1842                 if (nla_put(skb, NDTA_CONFIG, sizeof(ndc), &ndc))
1843                         goto nla_put_failure;
1844         }
1845
1846         {
1847                 int cpu;
1848                 struct ndt_stats ndst;
1849
1850                 memset(&ndst, 0, sizeof(ndst));
1851
1852                 for_each_possible_cpu(cpu) {
1853                         struct neigh_statistics *st;
1854
1855                         st = per_cpu_ptr(tbl->stats, cpu);
1856                         ndst.ndts_allocs                += st->allocs;
1857                         ndst.ndts_destroys              += st->destroys;
1858                         ndst.ndts_hash_grows            += st->hash_grows;
1859                         ndst.ndts_res_failed            += st->res_failed;
1860                         ndst.ndts_lookups               += st->lookups;
1861                         ndst.ndts_hits                  += st->hits;
1862                         ndst.ndts_rcv_probes_mcast      += st->rcv_probes_mcast;
1863                         ndst.ndts_rcv_probes_ucast      += st->rcv_probes_ucast;
1864                         ndst.ndts_periodic_gc_runs      += st->periodic_gc_runs;
1865                         ndst.ndts_forced_gc_runs        += st->forced_gc_runs;
1866                         ndst.ndts_table_fulls           += st->table_fulls;
1867                 }
1868
1869                 if (nla_put_64bit(skb, NDTA_STATS, sizeof(ndst), &ndst,
1870                                   NDTA_PAD))
1871                         goto nla_put_failure;
1872         }
1873
1874         BUG_ON(tbl->parms.dev);
1875         if (neightbl_fill_parms(skb, &tbl->parms) < 0)
1876                 goto nla_put_failure;
1877
1878         read_unlock_bh(&tbl->lock);
1879         nlmsg_end(skb, nlh);
1880         return 0;
1881
1882 nla_put_failure:
1883         read_unlock_bh(&tbl->lock);
1884         nlmsg_cancel(skb, nlh);
1885         return -EMSGSIZE;
1886 }
1887
1888 static int neightbl_fill_param_info(struct sk_buff *skb,
1889                                     struct neigh_table *tbl,
1890                                     struct neigh_parms *parms,
1891                                     u32 pid, u32 seq, int type,
1892                                     unsigned int flags)
1893 {
1894         struct ndtmsg *ndtmsg;
1895         struct nlmsghdr *nlh;
1896
1897         nlh = nlmsg_put(skb, pid, seq, type, sizeof(*ndtmsg), flags);
1898         if (nlh == NULL)
1899                 return -EMSGSIZE;
1900
1901         ndtmsg = nlmsg_data(nlh);
1902
1903         read_lock_bh(&tbl->lock);
1904         ndtmsg->ndtm_family = tbl->family;
1905         ndtmsg->ndtm_pad1   = 0;
1906         ndtmsg->ndtm_pad2   = 0;
1907
1908         if (nla_put_string(skb, NDTA_NAME, tbl->id) < 0 ||
1909             neightbl_fill_parms(skb, parms) < 0)
1910                 goto errout;
1911
1912         read_unlock_bh(&tbl->lock);
1913         nlmsg_end(skb, nlh);
1914         return 0;
1915 errout:
1916         read_unlock_bh(&tbl->lock);
1917         nlmsg_cancel(skb, nlh);
1918         return -EMSGSIZE;
1919 }
1920
1921 static const struct nla_policy nl_neightbl_policy[NDTA_MAX+1] = {
1922         [NDTA_NAME]             = { .type = NLA_STRING },
1923         [NDTA_THRESH1]          = { .type = NLA_U32 },
1924         [NDTA_THRESH2]          = { .type = NLA_U32 },
1925         [NDTA_THRESH3]          = { .type = NLA_U32 },
1926         [NDTA_GC_INTERVAL]      = { .type = NLA_U64 },
1927         [NDTA_PARMS]            = { .type = NLA_NESTED },
1928 };
1929
1930 static const struct nla_policy nl_ntbl_parm_policy[NDTPA_MAX+1] = {
1931         [NDTPA_IFINDEX]                 = { .type = NLA_U32 },
1932         [NDTPA_QUEUE_LEN]               = { .type = NLA_U32 },
1933         [NDTPA_PROXY_QLEN]              = { .type = NLA_U32 },
1934         [NDTPA_APP_PROBES]              = { .type = NLA_U32 },
1935         [NDTPA_UCAST_PROBES]            = { .type = NLA_U32 },
1936         [NDTPA_MCAST_PROBES]            = { .type = NLA_U32 },
1937         [NDTPA_MCAST_REPROBES]          = { .type = NLA_U32 },
1938         [NDTPA_BASE_REACHABLE_TIME]     = { .type = NLA_U64 },
1939         [NDTPA_GC_STALETIME]            = { .type = NLA_U64 },
1940         [NDTPA_DELAY_PROBE_TIME]        = { .type = NLA_U64 },
1941         [NDTPA_RETRANS_TIME]            = { .type = NLA_U64 },
1942         [NDTPA_ANYCAST_DELAY]           = { .type = NLA_U64 },
1943         [NDTPA_PROXY_DELAY]             = { .type = NLA_U64 },
1944         [NDTPA_LOCKTIME]                = { .type = NLA_U64 },
1945 };
1946
1947 static int neightbl_set(struct sk_buff *skb, struct nlmsghdr *nlh,
1948                         struct netlink_ext_ack *extack)
1949 {
1950         struct net *net = sock_net(skb->sk);
1951         struct neigh_table *tbl;
1952         struct ndtmsg *ndtmsg;
1953         struct nlattr *tb[NDTA_MAX+1];
1954         bool found = false;
1955         int err, tidx;
1956
1957         err = nlmsg_parse(nlh, sizeof(*ndtmsg), tb, NDTA_MAX,
1958                           nl_neightbl_policy, extack);
1959         if (err < 0)
1960                 goto errout;
1961
1962         if (tb[NDTA_NAME] == NULL) {
1963                 err = -EINVAL;
1964                 goto errout;
1965         }
1966
1967         ndtmsg = nlmsg_data(nlh);
1968
1969         for (tidx = 0; tidx < NEIGH_NR_TABLES; tidx++) {
1970                 tbl = neigh_tables[tidx];
1971                 if (!tbl)
1972                         continue;
1973                 if (ndtmsg->ndtm_family && tbl->family != ndtmsg->ndtm_family)
1974                         continue;
1975                 if (nla_strcmp(tb[NDTA_NAME], tbl->id) == 0) {
1976                         found = true;
1977                         break;
1978                 }
1979         }
1980
1981         if (!found)
1982                 return -ENOENT;
1983
1984         /*
1985          * We acquire tbl->lock to be nice to the periodic timers and
1986          * make sure they always see a consistent set of values.
1987          */
1988         write_lock_bh(&tbl->lock);
1989
1990         if (tb[NDTA_PARMS]) {
1991                 struct nlattr *tbp[NDTPA_MAX+1];
1992                 struct neigh_parms *p;
1993                 int i, ifindex = 0;
1994
1995                 err = nla_parse_nested(tbp, NDTPA_MAX, tb[NDTA_PARMS],
1996                                        nl_ntbl_parm_policy, extack);
1997                 if (err < 0)
1998                         goto errout_tbl_lock;
1999
2000                 if (tbp[NDTPA_IFINDEX])
2001                         ifindex = nla_get_u32(tbp[NDTPA_IFINDEX]);
2002
2003                 p = lookup_neigh_parms(tbl, net, ifindex);
2004                 if (p == NULL) {
2005                         err = -ENOENT;
2006                         goto errout_tbl_lock;
2007                 }
2008
2009                 for (i = 1; i <= NDTPA_MAX; i++) {
2010                         if (tbp[i] == NULL)
2011                                 continue;
2012
2013                         switch (i) {
2014                         case NDTPA_QUEUE_LEN:
2015                                 NEIGH_VAR_SET(p, QUEUE_LEN_BYTES,
2016                                               nla_get_u32(tbp[i]) *
2017                                               SKB_TRUESIZE(ETH_FRAME_LEN));
2018                                 break;
2019                         case NDTPA_QUEUE_LENBYTES:
2020                                 NEIGH_VAR_SET(p, QUEUE_LEN_BYTES,
2021                                               nla_get_u32(tbp[i]));
2022                                 break;
2023                         case NDTPA_PROXY_QLEN:
2024                                 NEIGH_VAR_SET(p, PROXY_QLEN,
2025                                               nla_get_u32(tbp[i]));
2026                                 break;
2027                         case NDTPA_APP_PROBES:
2028                                 NEIGH_VAR_SET(p, APP_PROBES,
2029                                               nla_get_u32(tbp[i]));
2030                                 break;
2031                         case NDTPA_UCAST_PROBES:
2032                                 NEIGH_VAR_SET(p, UCAST_PROBES,
2033                                               nla_get_u32(tbp[i]));
2034                                 break;
2035                         case NDTPA_MCAST_PROBES:
2036                                 NEIGH_VAR_SET(p, MCAST_PROBES,
2037                                               nla_get_u32(tbp[i]));
2038                                 break;
2039                         case NDTPA_MCAST_REPROBES:
2040                                 NEIGH_VAR_SET(p, MCAST_REPROBES,
2041                                               nla_get_u32(tbp[i]));
2042                                 break;
2043                         case NDTPA_BASE_REACHABLE_TIME:
2044                                 NEIGH_VAR_SET(p, BASE_REACHABLE_TIME,
2045                                               nla_get_msecs(tbp[i]));
2046                                 /* update reachable_time as well, otherwise, the change will
2047                                  * only be effective after the next time neigh_periodic_work
2048                                  * decides to recompute it (can be multiple minutes)
2049                                  */
2050                                 p->reachable_time =
2051                                         neigh_rand_reach_time(NEIGH_VAR(p, BASE_REACHABLE_TIME));
2052                                 break;
2053                         case NDTPA_GC_STALETIME:
2054                                 NEIGH_VAR_SET(p, GC_STALETIME,
2055                                               nla_get_msecs(tbp[i]));
2056                                 break;
2057                         case NDTPA_DELAY_PROBE_TIME:
2058                                 NEIGH_VAR_SET(p, DELAY_PROBE_TIME,
2059                                               nla_get_msecs(tbp[i]));
2060                                 call_netevent_notifiers(NETEVENT_DELAY_PROBE_TIME_UPDATE, p);
2061                                 break;
2062                         case NDTPA_RETRANS_TIME:
2063                                 NEIGH_VAR_SET(p, RETRANS_TIME,
2064                                               nla_get_msecs(tbp[i]));
2065                                 break;
2066                         case NDTPA_ANYCAST_DELAY:
2067                                 NEIGH_VAR_SET(p, ANYCAST_DELAY,
2068                                               nla_get_msecs(tbp[i]));
2069                                 break;
2070                         case NDTPA_PROXY_DELAY:
2071                                 NEIGH_VAR_SET(p, PROXY_DELAY,
2072                                               nla_get_msecs(tbp[i]));
2073                                 break;
2074                         case NDTPA_LOCKTIME:
2075                                 NEIGH_VAR_SET(p, LOCKTIME,
2076                                               nla_get_msecs(tbp[i]));
2077                                 break;
2078                         }
2079                 }
2080         }
2081
2082         err = -ENOENT;
2083         if ((tb[NDTA_THRESH1] || tb[NDTA_THRESH2] ||
2084              tb[NDTA_THRESH3] || tb[NDTA_GC_INTERVAL]) &&
2085             !net_eq(net, &init_net))
2086                 goto errout_tbl_lock;
2087
2088         if (tb[NDTA_THRESH1])
2089                 tbl->gc_thresh1 = nla_get_u32(tb[NDTA_THRESH1]);
2090
2091         if (tb[NDTA_THRESH2])
2092                 tbl->gc_thresh2 = nla_get_u32(tb[NDTA_THRESH2]);
2093
2094         if (tb[NDTA_THRESH3])
2095                 tbl->gc_thresh3 = nla_get_u32(tb[NDTA_THRESH3]);
2096
2097         if (tb[NDTA_GC_INTERVAL])
2098                 tbl->gc_interval = nla_get_msecs(tb[NDTA_GC_INTERVAL]);
2099
2100         err = 0;
2101
2102 errout_tbl_lock:
2103         write_unlock_bh(&tbl->lock);
2104 errout:
2105         return err;
2106 }
2107
2108 static int neightbl_dump_info(struct sk_buff *skb, struct netlink_callback *cb)
2109 {
2110         struct net *net = sock_net(skb->sk);
2111         int family, tidx, nidx = 0;
2112         int tbl_skip = cb->args[0];
2113         int neigh_skip = cb->args[1];
2114         struct neigh_table *tbl;
2115
2116         family = ((struct rtgenmsg *) nlmsg_data(cb->nlh))->rtgen_family;
2117
2118         for (tidx = 0; tidx < NEIGH_NR_TABLES; tidx++) {
2119                 struct neigh_parms *p;
2120
2121                 tbl = neigh_tables[tidx];
2122                 if (!tbl)
2123                         continue;
2124
2125                 if (tidx < tbl_skip || (family && tbl->family != family))
2126                         continue;
2127
2128                 if (neightbl_fill_info(skb, tbl, NETLINK_CB(cb->skb).portid,
2129                                        cb->nlh->nlmsg_seq, RTM_NEWNEIGHTBL,
2130                                        NLM_F_MULTI) < 0)
2131                         break;
2132
2133                 nidx = 0;
2134                 p = list_next_entry(&tbl->parms, list);
2135                 list_for_each_entry_from(p, &tbl->parms_list, list) {
2136                         if (!net_eq(neigh_parms_net(p), net))
2137                                 continue;
2138
2139                         if (nidx < neigh_skip)
2140                                 goto next;
2141
2142                         if (neightbl_fill_param_info(skb, tbl, p,
2143                                                      NETLINK_CB(cb->skb).portid,
2144                                                      cb->nlh->nlmsg_seq,
2145                                                      RTM_NEWNEIGHTBL,
2146                                                      NLM_F_MULTI) < 0)
2147                                 goto out;
2148                 next:
2149                         nidx++;
2150                 }
2151
2152                 neigh_skip = 0;
2153         }
2154 out:
2155         cb->args[0] = tidx;
2156         cb->args[1] = nidx;
2157
2158         return skb->len;
2159 }
2160
2161 static int neigh_fill_info(struct sk_buff *skb, struct neighbour *neigh,
2162                            u32 pid, u32 seq, int type, unsigned int flags)
2163 {
2164         unsigned long now = jiffies;
2165         struct nda_cacheinfo ci;
2166         struct nlmsghdr *nlh;
2167         struct ndmsg *ndm;
2168
2169         nlh = nlmsg_put(skb, pid, seq, type, sizeof(*ndm), flags);
2170         if (nlh == NULL)
2171                 return -EMSGSIZE;
2172
2173         ndm = nlmsg_data(nlh);
2174         ndm->ndm_family  = neigh->ops->family;
2175         ndm->ndm_pad1    = 0;
2176         ndm->ndm_pad2    = 0;
2177         ndm->ndm_flags   = neigh->flags;
2178         ndm->ndm_type    = neigh->type;
2179         ndm->ndm_ifindex = neigh->dev->ifindex;
2180
2181         if (nla_put(skb, NDA_DST, neigh->tbl->key_len, neigh->primary_key))
2182                 goto nla_put_failure;
2183
2184         read_lock_bh(&neigh->lock);
2185         ndm->ndm_state   = neigh->nud_state;
2186         if (neigh->nud_state & NUD_VALID) {
2187                 char haddr[MAX_ADDR_LEN];
2188
2189                 neigh_ha_snapshot(haddr, neigh, neigh->dev);
2190                 if (nla_put(skb, NDA_LLADDR, neigh->dev->addr_len, haddr) < 0) {
2191                         read_unlock_bh(&neigh->lock);
2192                         goto nla_put_failure;
2193                 }
2194         }
2195
2196         ci.ndm_used      = jiffies_to_clock_t(now - neigh->used);
2197         ci.ndm_confirmed = jiffies_to_clock_t(now - neigh->confirmed);
2198         ci.ndm_updated   = jiffies_to_clock_t(now - neigh->updated);
2199         ci.ndm_refcnt    = atomic_read(&neigh->refcnt) - 1;
2200         read_unlock_bh(&neigh->lock);
2201
2202         if (nla_put_u32(skb, NDA_PROBES, atomic_read(&neigh->probes)) ||
2203             nla_put(skb, NDA_CACHEINFO, sizeof(ci), &ci))
2204                 goto nla_put_failure;
2205
2206         nlmsg_end(skb, nlh);
2207         return 0;
2208
2209 nla_put_failure:
2210         nlmsg_cancel(skb, nlh);
2211         return -EMSGSIZE;
2212 }
2213
2214 static int pneigh_fill_info(struct sk_buff *skb, struct pneigh_entry *pn,
2215                             u32 pid, u32 seq, int type, unsigned int flags,
2216                             struct neigh_table *tbl)
2217 {
2218         struct nlmsghdr *nlh;
2219         struct ndmsg *ndm;
2220
2221         nlh = nlmsg_put(skb, pid, seq, type, sizeof(*ndm), flags);
2222         if (nlh == NULL)
2223                 return -EMSGSIZE;
2224
2225         ndm = nlmsg_data(nlh);
2226         ndm->ndm_family  = tbl->family;
2227         ndm->ndm_pad1    = 0;
2228         ndm->ndm_pad2    = 0;
2229         ndm->ndm_flags   = pn->flags | NTF_PROXY;
2230         ndm->ndm_type    = RTN_UNICAST;
2231         ndm->ndm_ifindex = pn->dev ? pn->dev->ifindex : 0;
2232         ndm->ndm_state   = NUD_NONE;
2233
2234         if (nla_put(skb, NDA_DST, tbl->key_len, pn->key))
2235                 goto nla_put_failure;
2236
2237         nlmsg_end(skb, nlh);
2238         return 0;
2239
2240 nla_put_failure:
2241         nlmsg_cancel(skb, nlh);
2242         return -EMSGSIZE;
2243 }
2244
2245 static void neigh_update_notify(struct neighbour *neigh, u32 nlmsg_pid)
2246 {
2247         call_netevent_notifiers(NETEVENT_NEIGH_UPDATE, neigh);
2248         __neigh_notify(neigh, RTM_NEWNEIGH, 0, nlmsg_pid);
2249 }
2250
2251 static bool neigh_master_filtered(struct net_device *dev, int master_idx)
2252 {
2253         struct net_device *master;
2254
2255         if (!master_idx)
2256                 return false;
2257
2258         master = netdev_master_upper_dev_get(dev);
2259         if (!master || master->ifindex != master_idx)
2260                 return true;
2261
2262         return false;
2263 }
2264
2265 static bool neigh_ifindex_filtered(struct net_device *dev, int filter_idx)
2266 {
2267         if (filter_idx && dev->ifindex != filter_idx)
2268                 return true;
2269
2270         return false;
2271 }
2272
2273 static int neigh_dump_table(struct neigh_table *tbl, struct sk_buff *skb,
2274                             struct netlink_callback *cb)
2275 {
2276         struct net *net = sock_net(skb->sk);
2277         const struct nlmsghdr *nlh = cb->nlh;
2278         struct nlattr *tb[NDA_MAX + 1];
2279         struct neighbour *n;
2280         int rc, h, s_h = cb->args[1];
2281         int idx, s_idx = idx = cb->args[2];
2282         struct neigh_hash_table *nht;
2283         int filter_master_idx = 0, filter_idx = 0;
2284         unsigned int flags = NLM_F_MULTI;
2285         int err;
2286
2287         err = nlmsg_parse(nlh, sizeof(struct ndmsg), tb, NDA_MAX, NULL, NULL);
2288         if (!err) {
2289                 if (tb[NDA_IFINDEX])
2290                         filter_idx = nla_get_u32(tb[NDA_IFINDEX]);
2291
2292                 if (tb[NDA_MASTER])
2293                         filter_master_idx = nla_get_u32(tb[NDA_MASTER]);
2294
2295                 if (filter_idx || filter_master_idx)
2296                         flags |= NLM_F_DUMP_FILTERED;
2297         }
2298
2299         rcu_read_lock_bh();
2300         nht = rcu_dereference_bh(tbl->nht);
2301
2302         for (h = s_h; h < (1 << nht->hash_shift); h++) {
2303                 if (h > s_h)
2304                         s_idx = 0;
2305                 for (n = rcu_dereference_bh(nht->hash_buckets[h]), idx = 0;
2306                      n != NULL;
2307                      n = rcu_dereference_bh(n->next)) {
2308                         if (idx < s_idx || !net_eq(dev_net(n->dev), net))
2309                                 goto next;
2310                         if (neigh_ifindex_filtered(n->dev, filter_idx) ||
2311                             neigh_master_filtered(n->dev, filter_master_idx))
2312                                 goto next;
2313                         if (neigh_fill_info(skb, n, NETLINK_CB(cb->skb).portid,
2314                                             cb->nlh->nlmsg_seq,
2315                                             RTM_NEWNEIGH,
2316                                             flags) < 0) {
2317                                 rc = -1;
2318                                 goto out;
2319                         }
2320 next:
2321                         idx++;
2322                 }
2323         }
2324         rc = skb->len;
2325 out:
2326         rcu_read_unlock_bh();
2327         cb->args[1] = h;
2328         cb->args[2] = idx;
2329         return rc;
2330 }
2331
2332 static int pneigh_dump_table(struct neigh_table *tbl, struct sk_buff *skb,
2333                              struct netlink_callback *cb)
2334 {
2335         struct pneigh_entry *n;
2336         struct net *net = sock_net(skb->sk);
2337         int rc, h, s_h = cb->args[3];
2338         int idx, s_idx = idx = cb->args[4];
2339
2340         read_lock_bh(&tbl->lock);
2341
2342         for (h = s_h; h <= PNEIGH_HASHMASK; h++) {
2343                 if (h > s_h)
2344                         s_idx = 0;
2345                 for (n = tbl->phash_buckets[h], idx = 0; n; n = n->next) {
2346                         if (idx < s_idx || pneigh_net(n) != net)
2347                                 goto next;
2348                         if (pneigh_fill_info(skb, n, NETLINK_CB(cb->skb).portid,
2349                                             cb->nlh->nlmsg_seq,
2350                                             RTM_NEWNEIGH,
2351                                             NLM_F_MULTI, tbl) < 0) {
2352                                 read_unlock_bh(&tbl->lock);
2353                                 rc = -1;
2354                                 goto out;
2355                         }
2356                 next:
2357                         idx++;
2358                 }
2359         }
2360
2361         read_unlock_bh(&tbl->lock);
2362         rc = skb->len;
2363 out:
2364         cb->args[3] = h;
2365         cb->args[4] = idx;
2366         return rc;
2367
2368 }
2369
2370 static int neigh_dump_info(struct sk_buff *skb, struct netlink_callback *cb)
2371 {
2372         struct neigh_table *tbl;
2373         int t, family, s_t;
2374         int proxy = 0;
2375         int err;
2376
2377         family = ((struct rtgenmsg *) nlmsg_data(cb->nlh))->rtgen_family;
2378
2379         /* check for full ndmsg structure presence, family member is
2380          * the same for both structures
2381          */
2382         if (nlmsg_len(cb->nlh) >= sizeof(struct ndmsg) &&
2383             ((struct ndmsg *) nlmsg_data(cb->nlh))->ndm_flags == NTF_PROXY)
2384                 proxy = 1;
2385
2386         s_t = cb->args[0];
2387
2388         for (t = 0; t < NEIGH_NR_TABLES; t++) {
2389                 tbl = neigh_tables[t];
2390
2391                 if (!tbl)
2392                         continue;
2393                 if (t < s_t || (family && tbl->family != family))
2394                         continue;
2395                 if (t > s_t)
2396                         memset(&cb->args[1], 0, sizeof(cb->args) -
2397                                                 sizeof(cb->args[0]));
2398                 if (proxy)
2399                         err = pneigh_dump_table(tbl, skb, cb);
2400                 else
2401                         err = neigh_dump_table(tbl, skb, cb);
2402                 if (err < 0)
2403                         break;
2404         }
2405
2406         cb->args[0] = t;
2407         return skb->len;
2408 }
2409
2410 void neigh_for_each(struct neigh_table *tbl, void (*cb)(struct neighbour *, void *), void *cookie)
2411 {
2412         int chain;
2413         struct neigh_hash_table *nht;
2414
2415         rcu_read_lock_bh();
2416         nht = rcu_dereference_bh(tbl->nht);
2417
2418         read_lock(&tbl->lock); /* avoid resizes */
2419         for (chain = 0; chain < (1 << nht->hash_shift); chain++) {
2420                 struct neighbour *n;
2421
2422                 for (n = rcu_dereference_bh(nht->hash_buckets[chain]);
2423                      n != NULL;
2424                      n = rcu_dereference_bh(n->next))
2425                         cb(n, cookie);
2426         }
2427         read_unlock(&tbl->lock);
2428         rcu_read_unlock_bh();
2429 }
2430 EXPORT_SYMBOL(neigh_for_each);
2431
2432 /* The tbl->lock must be held as a writer and BH disabled. */
2433 void __neigh_for_each_release(struct neigh_table *tbl,
2434                               int (*cb)(struct neighbour *))
2435 {
2436         int chain;
2437         struct neigh_hash_table *nht;
2438
2439         nht = rcu_dereference_protected(tbl->nht,
2440                                         lockdep_is_held(&tbl->lock));
2441         for (chain = 0; chain < (1 << nht->hash_shift); chain++) {
2442                 struct neighbour *n;
2443                 struct neighbour __rcu **np;
2444
2445                 np = &nht->hash_buckets[chain];
2446                 while ((n = rcu_dereference_protected(*np,
2447                                         lockdep_is_held(&tbl->lock))) != NULL) {
2448                         int release;
2449
2450                         write_lock(&n->lock);
2451                         release = cb(n);
2452                         if (release) {
2453                                 rcu_assign_pointer(*np,
2454                                         rcu_dereference_protected(n->next,
2455                                                 lockdep_is_held(&tbl->lock)));
2456                                 n->dead = 1;
2457                         } else
2458                                 np = &n->next;
2459                         write_unlock(&n->lock);
2460                         if (release)
2461                                 neigh_cleanup_and_release(n);
2462                 }
2463         }
2464 }
2465 EXPORT_SYMBOL(__neigh_for_each_release);
2466
2467 int neigh_xmit(int index, struct net_device *dev,
2468                const void *addr, struct sk_buff *skb)
2469 {
2470         int err = -EAFNOSUPPORT;
2471         if (likely(index < NEIGH_NR_TABLES)) {
2472                 struct neigh_table *tbl;
2473                 struct neighbour *neigh;
2474
2475                 tbl = neigh_tables[index];
2476                 if (!tbl)
2477                         goto out;
2478                 rcu_read_lock_bh();
2479                 neigh = __neigh_lookup_noref(tbl, addr, dev);
2480                 if (!neigh)
2481                         neigh = __neigh_create(tbl, addr, dev, false);
2482                 err = PTR_ERR(neigh);
2483                 if (IS_ERR(neigh)) {
2484                         rcu_read_unlock_bh();
2485                         goto out_kfree_skb;
2486                 }
2487                 err = neigh->output(neigh, skb);
2488                 rcu_read_unlock_bh();
2489         }
2490         else if (index == NEIGH_LINK_TABLE) {
2491                 err = dev_hard_header(skb, dev, ntohs(skb->protocol),
2492                                       addr, NULL, skb->len);
2493                 if (err < 0)
2494                         goto out_kfree_skb;
2495                 err = dev_queue_xmit(skb);
2496         }
2497 out:
2498         return err;
2499 out_kfree_skb:
2500         kfree_skb(skb);
2501         goto out;
2502 }
2503 EXPORT_SYMBOL(neigh_xmit);
2504
2505 #ifdef CONFIG_PROC_FS
2506
2507 static struct neighbour *neigh_get_first(struct seq_file *seq)
2508 {
2509         struct neigh_seq_state *state = seq->private;
2510         struct net *net = seq_file_net(seq);
2511         struct neigh_hash_table *nht = state->nht;
2512         struct neighbour *n = NULL;
2513         int bucket = state->bucket;
2514
2515         state->flags &= ~NEIGH_SEQ_IS_PNEIGH;
2516         for (bucket = 0; bucket < (1 << nht->hash_shift); bucket++) {
2517                 n = rcu_dereference_bh(nht->hash_buckets[bucket]);
2518
2519                 while (n) {
2520                         if (!net_eq(dev_net(n->dev), net))
2521                                 goto next;
2522                         if (state->neigh_sub_iter) {
2523                                 loff_t fakep = 0;
2524                                 void *v;
2525
2526                                 v = state->neigh_sub_iter(state, n, &fakep);
2527                                 if (!v)
2528                                         goto next;
2529                         }
2530                         if (!(state->flags & NEIGH_SEQ_SKIP_NOARP))
2531                                 break;
2532                         if (n->nud_state & ~NUD_NOARP)
2533                                 break;
2534 next:
2535                         n = rcu_dereference_bh(n->next);
2536                 }
2537
2538                 if (n)
2539                         break;
2540         }
2541         state->bucket = bucket;
2542
2543         return n;
2544 }
2545
2546 static struct neighbour *neigh_get_next(struct seq_file *seq,
2547                                         struct neighbour *n,
2548                                         loff_t *pos)
2549 {
2550         struct neigh_seq_state *state = seq->private;
2551         struct net *net = seq_file_net(seq);
2552         struct neigh_hash_table *nht = state->nht;
2553
2554         if (state->neigh_sub_iter) {
2555                 void *v = state->neigh_sub_iter(state, n, pos);
2556                 if (v)
2557                         return n;
2558         }
2559         n = rcu_dereference_bh(n->next);
2560
2561         while (1) {
2562                 while (n) {
2563                         if (!net_eq(dev_net(n->dev), net))
2564                                 goto next;
2565                         if (state->neigh_sub_iter) {
2566                                 void *v = state->neigh_sub_iter(state, n, pos);
2567                                 if (v)
2568                                         return n;
2569                                 goto next;
2570                         }
2571                         if (!(state->flags & NEIGH_SEQ_SKIP_NOARP))
2572                                 break;
2573
2574                         if (n->nud_state & ~NUD_NOARP)
2575                                 break;
2576 next:
2577                         n = rcu_dereference_bh(n->next);
2578                 }
2579
2580                 if (n)
2581                         break;
2582
2583                 if (++state->bucket >= (1 << nht->hash_shift))
2584                         break;
2585
2586                 n = rcu_dereference_bh(nht->hash_buckets[state->bucket]);
2587         }
2588
2589         if (n && pos)
2590                 --(*pos);
2591         return n;
2592 }
2593
2594 static struct neighbour *neigh_get_idx(struct seq_file *seq, loff_t *pos)
2595 {
2596         struct neighbour *n = neigh_get_first(seq);
2597
2598         if (n) {
2599                 --(*pos);
2600                 while (*pos) {
2601                         n = neigh_get_next(seq, n, pos);
2602                         if (!n)
2603                                 break;
2604                 }
2605         }
2606         return *pos ? NULL : n;
2607 }
2608
2609 static struct pneigh_entry *pneigh_get_first(struct seq_file *seq)
2610 {
2611         struct neigh_seq_state *state = seq->private;
2612         struct net *net = seq_file_net(seq);
2613         struct neigh_table *tbl = state->tbl;
2614         struct pneigh_entry *pn = NULL;
2615         int bucket = state->bucket;
2616
2617         state->flags |= NEIGH_SEQ_IS_PNEIGH;
2618         for (bucket = 0; bucket <= PNEIGH_HASHMASK; bucket++) {
2619                 pn = tbl->phash_buckets[bucket];
2620                 while (pn && !net_eq(pneigh_net(pn), net))
2621                         pn = pn->next;
2622                 if (pn)
2623                         break;
2624         }
2625         state->bucket = bucket;
2626
2627         return pn;
2628 }
2629
2630 static struct pneigh_entry *pneigh_get_next(struct seq_file *seq,
2631                                             struct pneigh_entry *pn,
2632                                             loff_t *pos)
2633 {
2634         struct neigh_seq_state *state = seq->private;
2635         struct net *net = seq_file_net(seq);
2636         struct neigh_table *tbl = state->tbl;
2637
2638         do {
2639                 pn = pn->next;
2640         } while (pn && !net_eq(pneigh_net(pn), net));
2641
2642         while (!pn) {
2643                 if (++state->bucket > PNEIGH_HASHMASK)
2644                         break;
2645                 pn = tbl->phash_buckets[state->bucket];
2646                 while (pn && !net_eq(pneigh_net(pn), net))
2647                         pn = pn->next;
2648                 if (pn)
2649                         break;
2650         }
2651
2652         if (pn && pos)
2653                 --(*pos);
2654
2655         return pn;
2656 }
2657
2658 static struct pneigh_entry *pneigh_get_idx(struct seq_file *seq, loff_t *pos)
2659 {
2660         struct pneigh_entry *pn = pneigh_get_first(seq);
2661
2662         if (pn) {
2663                 --(*pos);
2664                 while (*pos) {
2665                         pn = pneigh_get_next(seq, pn, pos);
2666                         if (!pn)
2667                                 break;
2668                 }
2669         }
2670         return *pos ? NULL : pn;
2671 }
2672
2673 static void *neigh_get_idx_any(struct seq_file *seq, loff_t *pos)
2674 {
2675         struct neigh_seq_state *state = seq->private;
2676         void *rc;
2677         loff_t idxpos = *pos;
2678
2679         rc = neigh_get_idx(seq, &idxpos);
2680         if (!rc && !(state->flags & NEIGH_SEQ_NEIGH_ONLY))
2681                 rc = pneigh_get_idx(seq, &idxpos);
2682
2683         return rc;
2684 }
2685
2686 void *neigh_seq_start(struct seq_file *seq, loff_t *pos, struct neigh_table *tbl, unsigned int neigh_seq_flags)
2687         __acquires(rcu_bh)
2688 {
2689         struct neigh_seq_state *state = seq->private;
2690
2691         state->tbl = tbl;
2692         state->bucket = 0;
2693         state->flags = (neigh_seq_flags & ~NEIGH_SEQ_IS_PNEIGH);
2694
2695         rcu_read_lock_bh();
2696         state->nht = rcu_dereference_bh(tbl->nht);
2697
2698         return *pos ? neigh_get_idx_any(seq, pos) : SEQ_START_TOKEN;
2699 }
2700 EXPORT_SYMBOL(neigh_seq_start);
2701
2702 void *neigh_seq_next(struct seq_file *seq, void *v, loff_t *pos)
2703 {
2704         struct neigh_seq_state *state;
2705         void *rc;
2706
2707         if (v == SEQ_START_TOKEN) {
2708                 rc = neigh_get_first(seq);
2709                 goto out;
2710         }
2711
2712         state = seq->private;
2713         if (!(state->flags & NEIGH_SEQ_IS_PNEIGH)) {
2714                 rc = neigh_get_next(seq, v, NULL);
2715                 if (rc)
2716                         goto out;
2717                 if (!(state->flags & NEIGH_SEQ_NEIGH_ONLY))
2718                         rc = pneigh_get_first(seq);
2719         } else {
2720                 BUG_ON(state->flags & NEIGH_SEQ_NEIGH_ONLY);
2721                 rc = pneigh_get_next(seq, v, NULL);
2722         }
2723 out:
2724         ++(*pos);
2725         return rc;
2726 }
2727 EXPORT_SYMBOL(neigh_seq_next);
2728
2729 void neigh_seq_stop(struct seq_file *seq, void *v)
2730         __releases(rcu_bh)
2731 {
2732         rcu_read_unlock_bh();
2733 }
2734 EXPORT_SYMBOL(neigh_seq_stop);
2735
2736 /* statistics via seq_file */
2737
2738 static void *neigh_stat_seq_start(struct seq_file *seq, loff_t *pos)
2739 {
2740         struct neigh_table *tbl = seq->private;
2741         int cpu;
2742
2743         if (*pos == 0)
2744                 return SEQ_START_TOKEN;
2745
2746         for (cpu = *pos-1; cpu < nr_cpu_ids; ++cpu) {
2747                 if (!cpu_possible(cpu))
2748                         continue;
2749                 *pos = cpu+1;
2750                 return per_cpu_ptr(tbl->stats, cpu);
2751         }
2752         return NULL;
2753 }
2754
2755 static void *neigh_stat_seq_next(struct seq_file *seq, void *v, loff_t *pos)
2756 {
2757         struct neigh_table *tbl = seq->private;
2758         int cpu;
2759
2760         for (cpu = *pos; cpu < nr_cpu_ids; ++cpu) {
2761                 if (!cpu_possible(cpu))
2762                         continue;
2763                 *pos = cpu+1;
2764                 return per_cpu_ptr(tbl->stats, cpu);
2765         }
2766         return NULL;
2767 }
2768
2769 static void neigh_stat_seq_stop(struct seq_file *seq, void *v)
2770 {
2771
2772 }
2773
2774 static int neigh_stat_seq_show(struct seq_file *seq, void *v)
2775 {
2776         struct neigh_table *tbl = seq->private;
2777         struct neigh_statistics *st = v;
2778
2779         if (v == SEQ_START_TOKEN) {
2780                 seq_printf(seq, "entries  allocs destroys hash_grows  lookups hits  res_failed  rcv_probes_mcast rcv_probes_ucast  periodic_gc_runs forced_gc_runs unresolved_discards table_fulls\n");
2781                 return 0;
2782         }
2783
2784         seq_printf(seq, "%08x  %08lx %08lx %08lx  %08lx %08lx  %08lx  "
2785                         "%08lx %08lx  %08lx %08lx %08lx %08lx\n",
2786                    atomic_read(&tbl->entries),
2787
2788                    st->allocs,
2789                    st->destroys,
2790                    st->hash_grows,
2791
2792                    st->lookups,
2793                    st->hits,
2794
2795                    st->res_failed,
2796
2797                    st->rcv_probes_mcast,
2798                    st->rcv_probes_ucast,
2799
2800                    st->periodic_gc_runs,
2801                    st->forced_gc_runs,
2802                    st->unres_discards,
2803                    st->table_fulls
2804                    );
2805
2806         return 0;
2807 }
2808
2809 static const struct seq_operations neigh_stat_seq_ops = {
2810         .start  = neigh_stat_seq_start,
2811         .next   = neigh_stat_seq_next,
2812         .stop   = neigh_stat_seq_stop,
2813         .show   = neigh_stat_seq_show,
2814 };
2815
2816 static int neigh_stat_seq_open(struct inode *inode, struct file *file)
2817 {
2818         int ret = seq_open(file, &neigh_stat_seq_ops);
2819
2820         if (!ret) {
2821                 struct seq_file *sf = file->private_data;
2822                 sf->private = PDE_DATA(inode);
2823         }
2824         return ret;
2825 };
2826
2827 static const struct file_operations neigh_stat_seq_fops = {
2828         .owner   = THIS_MODULE,
2829         .open    = neigh_stat_seq_open,
2830         .read    = seq_read,
2831         .llseek  = seq_lseek,
2832         .release = seq_release,
2833 };
2834
2835 #endif /* CONFIG_PROC_FS */
2836
2837 static inline size_t neigh_nlmsg_size(void)
2838 {
2839         return NLMSG_ALIGN(sizeof(struct ndmsg))
2840                + nla_total_size(MAX_ADDR_LEN) /* NDA_DST */
2841                + nla_total_size(MAX_ADDR_LEN) /* NDA_LLADDR */
2842                + nla_total_size(sizeof(struct nda_cacheinfo))
2843                + nla_total_size(4); /* NDA_PROBES */
2844 }
2845
2846 static void __neigh_notify(struct neighbour *n, int type, int flags,
2847                            u32 pid)
2848 {
2849         struct net *net = dev_net(n->dev);
2850         struct sk_buff *skb;
2851         int err = -ENOBUFS;
2852
2853         skb = nlmsg_new(neigh_nlmsg_size(), GFP_ATOMIC);
2854         if (skb == NULL)
2855                 goto errout;
2856
2857         err = neigh_fill_info(skb, n, pid, 0, type, flags);
2858         if (err < 0) {
2859                 /* -EMSGSIZE implies BUG in neigh_nlmsg_size() */
2860                 WARN_ON(err == -EMSGSIZE);
2861                 kfree_skb(skb);
2862                 goto errout;
2863         }
2864         rtnl_notify(skb, net, 0, RTNLGRP_NEIGH, NULL, GFP_ATOMIC);
2865         return;
2866 errout:
2867         if (err < 0)
2868                 rtnl_set_sk_err(net, RTNLGRP_NEIGH, err);
2869 }
2870
2871 void neigh_app_ns(struct neighbour *n)
2872 {
2873         __neigh_notify(n, RTM_GETNEIGH, NLM_F_REQUEST, 0);
2874 }
2875 EXPORT_SYMBOL(neigh_app_ns);
2876
2877 #ifdef CONFIG_SYSCTL
2878 static int zero;
2879 static int int_max = INT_MAX;
2880 static int unres_qlen_max = INT_MAX / SKB_TRUESIZE(ETH_FRAME_LEN);
2881
2882 static int proc_unres_qlen(struct ctl_table *ctl, int write,
2883                            void __user *buffer, size_t *lenp, loff_t *ppos)
2884 {
2885         int size, ret;
2886         struct ctl_table tmp = *ctl;
2887
2888         tmp.extra1 = &zero;
2889         tmp.extra2 = &unres_qlen_max;
2890         tmp.data = &size;
2891
2892         size = *(int *)ctl->data / SKB_TRUESIZE(ETH_FRAME_LEN);
2893         ret = proc_dointvec_minmax(&tmp, write, buffer, lenp, ppos);
2894
2895         if (write && !ret)
2896                 *(int *)ctl->data = size * SKB_TRUESIZE(ETH_FRAME_LEN);
2897         return ret;
2898 }
2899
2900 static struct neigh_parms *neigh_get_dev_parms_rcu(struct net_device *dev,
2901                                                    int family)
2902 {
2903         switch (family) {
2904         case AF_INET:
2905                 return __in_dev_arp_parms_get_rcu(dev);
2906         case AF_INET6:
2907                 return __in6_dev_nd_parms_get_rcu(dev);
2908         }
2909         return NULL;
2910 }
2911
2912 static void neigh_copy_dflt_parms(struct net *net, struct neigh_parms *p,
2913                                   int index)
2914 {
2915         struct net_device *dev;
2916         int family = neigh_parms_family(p);
2917
2918         rcu_read_lock();
2919         for_each_netdev_rcu(net, dev) {
2920                 struct neigh_parms *dst_p =
2921                                 neigh_get_dev_parms_rcu(dev, family);
2922
2923                 if (dst_p && !test_bit(index, dst_p->data_state))
2924                         dst_p->data[index] = p->data[index];
2925         }
2926         rcu_read_unlock();
2927 }
2928
2929 static void neigh_proc_update(struct ctl_table *ctl, int write)
2930 {
2931         struct net_device *dev = ctl->extra1;
2932         struct neigh_parms *p = ctl->extra2;
2933         struct net *net = neigh_parms_net(p);
2934         int index = (int *) ctl->data - p->data;
2935
2936         if (!write)
2937                 return;
2938
2939         set_bit(index, p->data_state);
2940         if (index == NEIGH_VAR_DELAY_PROBE_TIME)
2941                 call_netevent_notifiers(NETEVENT_DELAY_PROBE_TIME_UPDATE, p);
2942         if (!dev) /* NULL dev means this is default value */
2943                 neigh_copy_dflt_parms(net, p, index);
2944 }
2945
2946 static int neigh_proc_dointvec_zero_intmax(struct ctl_table *ctl, int write,
2947                                            void __user *buffer,
2948                                            size_t *lenp, loff_t *ppos)
2949 {
2950         struct ctl_table tmp = *ctl;
2951         int ret;
2952
2953         tmp.extra1 = &zero;
2954         tmp.extra2 = &int_max;
2955
2956         ret = proc_dointvec_minmax(&tmp, write, buffer, lenp, ppos);
2957         neigh_proc_update(ctl, write);
2958         return ret;
2959 }
2960
2961 int neigh_proc_dointvec(struct ctl_table *ctl, int write,
2962                         void __user *buffer, size_t *lenp, loff_t *ppos)
2963 {
2964         int ret = proc_dointvec(ctl, write, buffer, lenp, ppos);
2965
2966         neigh_proc_update(ctl, write);
2967         return ret;
2968 }
2969 EXPORT_SYMBOL(neigh_proc_dointvec);
2970
2971 int neigh_proc_dointvec_jiffies(struct ctl_table *ctl, int write,
2972                                 void __user *buffer,
2973                                 size_t *lenp, loff_t *ppos)
2974 {
2975         int ret = proc_dointvec_jiffies(ctl, write, buffer, lenp, ppos);
2976
2977         neigh_proc_update(ctl, write);
2978         return ret;
2979 }
2980 EXPORT_SYMBOL(neigh_proc_dointvec_jiffies);
2981
2982 static int neigh_proc_dointvec_userhz_jiffies(struct ctl_table *ctl, int write,
2983                                               void __user *buffer,
2984                                               size_t *lenp, loff_t *ppos)
2985 {
2986         int ret = proc_dointvec_userhz_jiffies(ctl, write, buffer, lenp, ppos);
2987
2988         neigh_proc_update(ctl, write);
2989         return ret;
2990 }
2991
2992 int neigh_proc_dointvec_ms_jiffies(struct ctl_table *ctl, int write,
2993                                    void __user *buffer,
2994                                    size_t *lenp, loff_t *ppos)
2995 {
2996         int ret = proc_dointvec_ms_jiffies(ctl, write, buffer, lenp, ppos);
2997
2998         neigh_proc_update(ctl, write);
2999         return ret;
3000 }
3001 EXPORT_SYMBOL(neigh_proc_dointvec_ms_jiffies);
3002
3003 static int neigh_proc_dointvec_unres_qlen(struct ctl_table *ctl, int write,
3004                                           void __user *buffer,
3005                                           size_t *lenp, loff_t *ppos)
3006 {
3007         int ret = proc_unres_qlen(ctl, write, buffer, lenp, ppos);
3008
3009         neigh_proc_update(ctl, write);
3010         return ret;
3011 }
3012
3013 static int neigh_proc_base_reachable_time(struct ctl_table *ctl, int write,
3014                                           void __user *buffer,
3015                                           size_t *lenp, loff_t *ppos)
3016 {
3017         struct neigh_parms *p = ctl->extra2;
3018         int ret;
3019
3020         if (strcmp(ctl->procname, "base_reachable_time") == 0)
3021                 ret = neigh_proc_dointvec_jiffies(ctl, write, buffer, lenp, ppos);
3022         else if (strcmp(ctl->procname, "base_reachable_time_ms") == 0)
3023                 ret = neigh_proc_dointvec_ms_jiffies(ctl, write, buffer, lenp, ppos);
3024         else
3025                 ret = -1;
3026
3027         if (write && ret == 0) {
3028                 /* update reachable_time as well, otherwise, the change will
3029                  * only be effective after the next time neigh_periodic_work
3030                  * decides to recompute it
3031                  */
3032                 p->reachable_time =
3033                         neigh_rand_reach_time(NEIGH_VAR(p, BASE_REACHABLE_TIME));
3034         }
3035         return ret;
3036 }
3037
3038 #define NEIGH_PARMS_DATA_OFFSET(index)  \
3039         (&((struct neigh_parms *) 0)->data[index])
3040
3041 #define NEIGH_SYSCTL_ENTRY(attr, data_attr, name, mval, proc) \
3042         [NEIGH_VAR_ ## attr] = { \
3043                 .procname       = name, \
3044                 .data           = NEIGH_PARMS_DATA_OFFSET(NEIGH_VAR_ ## data_attr), \
3045                 .maxlen         = sizeof(int), \
3046                 .mode           = mval, \
3047                 .proc_handler   = proc, \
3048         }
3049
3050 #define NEIGH_SYSCTL_ZERO_INTMAX_ENTRY(attr, name) \
3051         NEIGH_SYSCTL_ENTRY(attr, attr, name, 0644, neigh_proc_dointvec_zero_intmax)
3052
3053 #define NEIGH_SYSCTL_JIFFIES_ENTRY(attr, name) \
3054         NEIGH_SYSCTL_ENTRY(attr, attr, name, 0644, neigh_proc_dointvec_jiffies)
3055
3056 #define NEIGH_SYSCTL_USERHZ_JIFFIES_ENTRY(attr, name) \
3057         NEIGH_SYSCTL_ENTRY(attr, attr, name, 0644, neigh_proc_dointvec_userhz_jiffies)
3058
3059 #define NEIGH_SYSCTL_MS_JIFFIES_ENTRY(attr, name) \
3060         NEIGH_SYSCTL_ENTRY(attr, attr, name, 0644, neigh_proc_dointvec_ms_jiffies)
3061
3062 #define NEIGH_SYSCTL_MS_JIFFIES_REUSED_ENTRY(attr, data_attr, name) \
3063         NEIGH_SYSCTL_ENTRY(attr, data_attr, name, 0644, neigh_proc_dointvec_ms_jiffies)
3064
3065 #define NEIGH_SYSCTL_UNRES_QLEN_REUSED_ENTRY(attr, data_attr, name) \
3066         NEIGH_SYSCTL_ENTRY(attr, data_attr, name, 0644, neigh_proc_dointvec_unres_qlen)
3067
3068 static struct neigh_sysctl_table {
3069         struct ctl_table_header *sysctl_header;
3070         struct ctl_table neigh_vars[NEIGH_VAR_MAX + 1];
3071 } neigh_sysctl_template __read_mostly = {
3072         .neigh_vars = {
3073                 NEIGH_SYSCTL_ZERO_INTMAX_ENTRY(MCAST_PROBES, "mcast_solicit"),
3074                 NEIGH_SYSCTL_ZERO_INTMAX_ENTRY(UCAST_PROBES, "ucast_solicit"),
3075                 NEIGH_SYSCTL_ZERO_INTMAX_ENTRY(APP_PROBES, "app_solicit"),
3076                 NEIGH_SYSCTL_ZERO_INTMAX_ENTRY(MCAST_REPROBES, "mcast_resolicit"),
3077                 NEIGH_SYSCTL_USERHZ_JIFFIES_ENTRY(RETRANS_TIME, "retrans_time"),
3078                 NEIGH_SYSCTL_JIFFIES_ENTRY(BASE_REACHABLE_TIME, "base_reachable_time"),
3079                 NEIGH_SYSCTL_JIFFIES_ENTRY(DELAY_PROBE_TIME, "delay_first_probe_time"),
3080                 NEIGH_SYSCTL_JIFFIES_ENTRY(GC_STALETIME, "gc_stale_time"),
3081                 NEIGH_SYSCTL_ZERO_INTMAX_ENTRY(QUEUE_LEN_BYTES, "unres_qlen_bytes"),
3082                 NEIGH_SYSCTL_ZERO_INTMAX_ENTRY(PROXY_QLEN, "proxy_qlen"),
3083                 NEIGH_SYSCTL_USERHZ_JIFFIES_ENTRY(ANYCAST_DELAY, "anycast_delay"),
3084                 NEIGH_SYSCTL_USERHZ_JIFFIES_ENTRY(PROXY_DELAY, "proxy_delay"),
3085                 NEIGH_SYSCTL_USERHZ_JIFFIES_ENTRY(LOCKTIME, "locktime"),
3086                 NEIGH_SYSCTL_UNRES_QLEN_REUSED_ENTRY(QUEUE_LEN, QUEUE_LEN_BYTES, "unres_qlen"),
3087                 NEIGH_SYSCTL_MS_JIFFIES_REUSED_ENTRY(RETRANS_TIME_MS, RETRANS_TIME, "retrans_time_ms"),
3088                 NEIGH_SYSCTL_MS_JIFFIES_REUSED_ENTRY(BASE_REACHABLE_TIME_MS, BASE_REACHABLE_TIME, "base_reachable_time_ms"),
3089                 [NEIGH_VAR_GC_INTERVAL] = {
3090                         .procname       = "gc_interval",
3091                         .maxlen         = sizeof(int),
3092                         .mode           = 0644,
3093                         .proc_handler   = proc_dointvec_jiffies,
3094                 },
3095                 [NEIGH_VAR_GC_THRESH1] = {
3096                         .procname       = "gc_thresh1",
3097                         .maxlen         = sizeof(int),
3098                         .mode           = 0644,
3099                         .extra1         = &zero,
3100                         .extra2         = &int_max,
3101                         .proc_handler   = proc_dointvec_minmax,
3102                 },
3103                 [NEIGH_VAR_GC_THRESH2] = {
3104                         .procname       = "gc_thresh2",
3105                         .maxlen         = sizeof(int),
3106                         .mode           = 0644,
3107                         .extra1         = &zero,
3108                         .extra2         = &int_max,
3109                         .proc_handler   = proc_dointvec_minmax,
3110                 },
3111                 [NEIGH_VAR_GC_THRESH3] = {
3112                         .procname       = "gc_thresh3",
3113                         .maxlen         = sizeof(int),
3114                         .mode           = 0644,
3115                         .extra1         = &zero,
3116                         .extra2         = &int_max,
3117                         .proc_handler   = proc_dointvec_minmax,
3118                 },
3119                 {},
3120         },
3121 };
3122
3123 int neigh_sysctl_register(struct net_device *dev, struct neigh_parms *p,
3124                           proc_handler *handler)
3125 {
3126         int i;
3127         struct neigh_sysctl_table *t;
3128         const char *dev_name_source;
3129         char neigh_path[ sizeof("net//neigh/") + IFNAMSIZ + IFNAMSIZ ];
3130         char *p_name;
3131
3132         t = kmemdup(&neigh_sysctl_template, sizeof(*t), GFP_KERNEL);
3133         if (!t)
3134                 goto err;
3135
3136         for (i = 0; i < NEIGH_VAR_GC_INTERVAL; i++) {
3137                 t->neigh_vars[i].data += (long) p;
3138                 t->neigh_vars[i].extra1 = dev;
3139                 t->neigh_vars[i].extra2 = p;
3140         }
3141
3142         if (dev) {
3143                 dev_name_source = dev->name;
3144                 /* Terminate the table early */
3145                 memset(&t->neigh_vars[NEIGH_VAR_GC_INTERVAL], 0,
3146                        sizeof(t->neigh_vars[NEIGH_VAR_GC_INTERVAL]));
3147         } else {
3148                 struct neigh_table *tbl = p->tbl;
3149                 dev_name_source = "default";
3150                 t->neigh_vars[NEIGH_VAR_GC_INTERVAL].data = &tbl->gc_interval;
3151                 t->neigh_vars[NEIGH_VAR_GC_THRESH1].data = &tbl->gc_thresh1;
3152                 t->neigh_vars[NEIGH_VAR_GC_THRESH2].data = &tbl->gc_thresh2;
3153                 t->neigh_vars[NEIGH_VAR_GC_THRESH3].data = &tbl->gc_thresh3;
3154         }
3155
3156         if (handler) {
3157                 /* RetransTime */
3158                 t->neigh_vars[NEIGH_VAR_RETRANS_TIME].proc_handler = handler;
3159                 /* ReachableTime */
3160                 t->neigh_vars[NEIGH_VAR_BASE_REACHABLE_TIME].proc_handler = handler;
3161                 /* RetransTime (in milliseconds)*/
3162                 t->neigh_vars[NEIGH_VAR_RETRANS_TIME_MS].proc_handler = handler;
3163                 /* ReachableTime (in milliseconds) */
3164                 t->neigh_vars[NEIGH_VAR_BASE_REACHABLE_TIME_MS].proc_handler = handler;
3165         } else {
3166                 /* Those handlers will update p->reachable_time after
3167                  * base_reachable_time(_ms) is set to ensure the new timer starts being
3168                  * applied after the next neighbour update instead of waiting for
3169                  * neigh_periodic_work to update its value (can be multiple minutes)
3170                  * So any handler that replaces them should do this as well
3171                  */
3172                 /* ReachableTime */
3173                 t->neigh_vars[NEIGH_VAR_BASE_REACHABLE_TIME].proc_handler =
3174                         neigh_proc_base_reachable_time;
3175                 /* ReachableTime (in milliseconds) */
3176                 t->neigh_vars[NEIGH_VAR_BASE_REACHABLE_TIME_MS].proc_handler =
3177                         neigh_proc_base_reachable_time;
3178         }
3179
3180         /* Don't export sysctls to unprivileged users */
3181         if (neigh_parms_net(p)->user_ns != &init_user_ns)
3182                 t->neigh_vars[0].procname = NULL;
3183
3184         switch (neigh_parms_family(p)) {
3185         case AF_INET:
3186               p_name = "ipv4";
3187               break;
3188         case AF_INET6:
3189               p_name = "ipv6";
3190               break;
3191         default:
3192               BUG();
3193         }
3194
3195         snprintf(neigh_path, sizeof(neigh_path), "net/%s/neigh/%s",
3196                 p_name, dev_name_source);
3197         t->sysctl_header =
3198                 register_net_sysctl(neigh_parms_net(p), neigh_path, t->neigh_vars);
3199         if (!t->sysctl_header)
3200                 goto free;
3201
3202         p->sysctl_table = t;
3203         return 0;
3204
3205 free:
3206         kfree(t);
3207 err:
3208         return -ENOBUFS;
3209 }
3210 EXPORT_SYMBOL(neigh_sysctl_register);
3211
3212 void neigh_sysctl_unregister(struct neigh_parms *p)
3213 {
3214         if (p->sysctl_table) {
3215                 struct neigh_sysctl_table *t = p->sysctl_table;
3216                 p->sysctl_table = NULL;
3217                 unregister_net_sysctl_table(t->sysctl_header);
3218                 kfree(t);
3219         }
3220 }
3221 EXPORT_SYMBOL(neigh_sysctl_unregister);
3222
3223 #endif  /* CONFIG_SYSCTL */
3224
3225 static int __init neigh_init(void)
3226 {
3227         rtnl_register(PF_UNSPEC, RTM_NEWNEIGH, neigh_add, NULL, NULL);
3228         rtnl_register(PF_UNSPEC, RTM_DELNEIGH, neigh_delete, NULL, NULL);
3229         rtnl_register(PF_UNSPEC, RTM_GETNEIGH, NULL, neigh_dump_info, NULL);
3230
3231         rtnl_register(PF_UNSPEC, RTM_GETNEIGHTBL, NULL, neightbl_dump_info,
3232                       NULL);
3233         rtnl_register(PF_UNSPEC, RTM_SETNEIGHTBL, neightbl_set, NULL, NULL);
3234
3235         return 0;
3236 }
3237
3238 subsys_initcall(neigh_init);
3239