net/core/neighbour.c

   1 /*
   2  *      Generic address resolution entity
   3  *
   4  *      Authors:
   5  *      Pedro Roque             <roque@di.fc.ul.pt>
   6  *      Alexey Kuznetsov        <kuznet@ms2.inr.ac.ru>
   7  *
   8  *      This program is free software; you can redistribute it and/or
   9  *      modify it under the terms of the GNU General Public License
  10  *      as published by the Free Software Foundation; either version
  11  *      2 of the License, or (at your option) any later version.
  12  *
  13  *      Fixes:
  14  *      Vitaly E. Lavrov        releasing NULL neighbor in neigh_add.
  15  *      Harald Welte            Add neighbour cache statistics like rtstat
  16  */
  17
  18 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
  19
  20 #include <linux/slab.h>
  21 #include <linux/types.h>
  22 #include <linux/kernel.h>
  23 #include <linux/module.h>
  24 #include <linux/socket.h>
  25 #include <linux/netdevice.h>
  26 #include <linux/proc_fs.h>
  27 #ifdef CONFIG_SYSCTL
  28 #include <linux/sysctl.h>
  29 #endif
  30 #include <linux/times.h>
  31 #include <net/net_namespace.h>
  32 #include <net/neighbour.h>
  33 #include <net/dst.h>
  34 #include <net/sock.h>
  35 #include <net/netevent.h>
  36 #include <net/netlink.h>
  37 #include <linux/rtnetlink.h>
  38 #include <linux/random.h>
  39 #include <linux/string.h>
  40 #include <linux/log2.h>
  41 #include <linux/inetdevice.h>
  42 #include <net/addrconf.h>
  43
  44 #define DEBUG
  45 #define NEIGH_DEBUG 1
  46 #define neigh_dbg(level, fmt, ...)              \
  47 do {                                            \
  48         if (level <= NEIGH_DEBUG)               \
  49                 pr_debug(fmt, ##__VA_ARGS__);   \
  50 } while (0)
  51
  52 #define PNEIGH_HASHMASK         0xF
  53
  54 static void neigh_timer_handler(unsigned long arg);
  55 static void __neigh_notify(struct neighbour *n, int type, int flags);
  56 static void neigh_update_notify(struct neighbour *neigh);
  57 static int pneigh_ifdown(struct neigh_table *tbl, struct net_device *dev);
  58
  59 #ifdef CONFIG_PROC_FS
  60 static const struct file_operations neigh_stat_seq_fops;
  61 #endif
  62
  63 /*
  64    Neighbour hash table buckets are protected with rwlock tbl->lock.
  65
  66    - All the scans/updates to hash buckets MUST be made under this lock.
  67    - NOTHING clever should be made under this lock: no callbacks
  68      to protocol backends, no attempts to send something to network.
  69      It will result in deadlocks, if backend/driver wants to use neighbour
  70      cache.
  71    - If the entry requires some non-trivial actions, increase
  72      its reference count and release table lock.
  73
  74    Neighbour entries are protected:
  75    - with reference count.
  76    - with rwlock neigh->lock
  77
  78    Reference count prevents destruction.
  79
  80    neigh->lock mainly serializes ll address data and its validity state.
  81    However, the same lock is used to protect another entry fields:
  82     - timer
  83     - resolution queue
  84
  85    Again, nothing clever shall be made under neigh->lock,
  86    the most complicated procedure, which we allow is dev->hard_header.
  87    It is supposed, that dev->hard_header is simplistic and does
  88    not make callbacks to neighbour tables.
  89  */
  90
  91 static int neigh_blackhole(struct neighbour *neigh, struct sk_buff *skb)
  92 {
  93         kfree_skb(skb);
  94         return -ENETDOWN;
  95 }
  96
  97 static void neigh_cleanup_and_release(struct neighbour *neigh)
  98 {
  99         if (neigh->parms->neigh_cleanup)
 100                 neigh->parms->neigh_cleanup(neigh);
 101
 102         __neigh_notify(neigh, RTM_DELNEIGH, 0);
 103         neigh_release(neigh);
 104 }
 105
 106 /*
 107  * It is random distribution in the interval (1/2)*base...(3/2)*base.
 108  * It corresponds to default IPv6 settings and is not overridable,
 109  * because it is really reasonable choice.
 110  */
 111
 112 unsigned long neigh_rand_reach_time(unsigned long base)
 113 {
 114         return base ? (prandom_u32() % base) + (base >> 1) : 0;
 115 }
 116 EXPORT_SYMBOL(neigh_rand_reach_time);
 117
 118
 119 static int neigh_forced_gc(struct neigh_table *tbl)
 120 {
 121         int shrunk = 0;
 122         int i;
 123         struct neigh_hash_table *nht;
 124
 125         NEIGH_CACHE_STAT_INC(tbl, forced_gc_runs);
 126
 127         write_lock_bh(&tbl->lock);
 128         nht = rcu_dereference_protected(tbl->nht,
 129                                         lockdep_is_held(&tbl->lock));
 130         for (i = 0; i < (1 << nht->hash_shift); i++) {
 131                 struct neighbour *n;
 132                 struct neighbour __rcu **np;
 133
 134                 np = &nht->hash_buckets[i];
 135                 while ((n = rcu_dereference_protected(*np,
 136                                         lockdep_is_held(&tbl->lock))) != NULL) {
 137                         /* Neighbour record may be discarded if:
 138                          * - nobody refers to it.
 139                          * - it is not permanent
 140                          */
 141                         write_lock(&n->lock);
 142                         if (atomic_read(&n->refcnt) == 1 &&
 143                             !(n->nud_state & NUD_PERMANENT)) {
 144                                 rcu_assign_pointer(*np,
 145                                         rcu_dereference_protected(n->next,
 146                                                   lockdep_is_held(&tbl->lock)));
 147                                 n->dead = 1;
 148                                 shrunk  = 1;
 149                                 write_unlock(&n->lock);
 150                                 neigh_cleanup_and_release(n);
 151                                 continue;
 152                         }
 153                         write_unlock(&n->lock);
 154                         np = &n->next;
 155                 }
 156         }
 157
 158         tbl->last_flush = jiffies;
 159
 160         write_unlock_bh(&tbl->lock);
 161
 162         return shrunk;
 163 }
 164
 165 static void neigh_add_timer(struct neighbour *n, unsigned long when)
 166 {
 167         neigh_hold(n);
 168         if (unlikely(mod_timer(&n->timer, when))) {
 169                 printk("NEIGH: BUG, double timer add, state is %x\n",
 170                        n->nud_state);
 171                 dump_stack();
 172         }
 173 }
 174
 175 static int neigh_del_timer(struct neighbour *n)
 176 {
 177         if ((n->nud_state & NUD_IN_TIMER) &&
 178             del_timer(&n->timer)) {
 179                 neigh_release(n);
 180                 return 1;
 181         }
 182         return 0;
 183 }
 184
 185 static void pneigh_queue_purge(struct sk_buff_head *list)
 186 {
 187         struct sk_buff *skb;
 188
 189         while ((skb = skb_dequeue(list)) != NULL) {
 190                 dev_put(skb->dev);
 191                 kfree_skb(skb);
 192         }
 193 }
 194
 195 static void neigh_flush_dev(struct neigh_table *tbl, struct net_device *dev)
 196 {
 197         int i;
 198         struct neigh_hash_table *nht;
 199
 200         nht = rcu_dereference_protected(tbl->nht,
 201                                         lockdep_is_held(&tbl->lock));
 202
 203         for (i = 0; i < (1 << nht->hash_shift); i++) {
 204                 struct neighbour *n;
 205                 struct neighbour __rcu **np = &nht->hash_buckets[i];
 206
 207                 while ((n = rcu_dereference_protected(*np,
 208                                         lockdep_is_held(&tbl->lock))) != NULL) {
 209                         if (dev && n->dev != dev) {
 210                                 np = &n->next;
 211                                 continue;
 212                         }
 213                         rcu_assign_pointer(*np,
 214                                    rcu_dereference_protected(n->next,
 215                                                 lockdep_is_held(&tbl->lock)));
 216                         write_lock(&n->lock);
 217                         neigh_del_timer(n);
 218                         n->dead = 1;
 219
 220                         if (atomic_read(&n->refcnt) != 1) {
 221                                 /* The most unpleasant situation.
 222                                    We must destroy neighbour entry,
 223                                    but someone still uses it.
 224
 225                                    The destroy will be delayed until
 226                                    the last user releases us, but
 227                                    we must kill timers etc. and move
 228                                    it to safe state.
 229                                  */
 230                                 __skb_queue_purge(&n->arp_queue);
 231                                 n->arp_queue_len_bytes = 0;
 232                                 n->output = neigh_blackhole;
 233                                 if (n->nud_state & NUD_VALID)
 234                                         n->nud_state = NUD_NOARP;
 235                                 else
 236                                         n->nud_state = NUD_NONE;
 237                                 neigh_dbg(2, "neigh %p is stray\n", n);
 238                         }
 239                         write_unlock(&n->lock);
 240                         neigh_cleanup_and_release(n);
 241                 }
 242         }
 243 }
 244
 245 void neigh_changeaddr(struct neigh_table *tbl, struct net_device *dev)
 246 {
 247         write_lock_bh(&tbl->lock);
 248         neigh_flush_dev(tbl, dev);
 249         write_unlock_bh(&tbl->lock);
 250 }
 251 EXPORT_SYMBOL(neigh_changeaddr);
 252
 253 int neigh_ifdown(struct neigh_table *tbl, struct net_device *dev)
 254 {
 255         write_lock_bh(&tbl->lock);
 256         neigh_flush_dev(tbl, dev);
 257         pneigh_ifdown(tbl, dev);
 258         write_unlock_bh(&tbl->lock);
 259
 260         del_timer_sync(&tbl->proxy_timer);
 261         pneigh_queue_purge(&tbl->proxy_queue);
 262         return 0;
 263 }
 264 EXPORT_SYMBOL(neigh_ifdown);
 265
 266 static struct neighbour *neigh_alloc(struct neigh_table *tbl, struct net_device *dev)
 267 {
 268         struct neighbour *n = NULL;
 269         unsigned long now = jiffies;
 270         int entries;
 271
 272         entries = atomic_inc_return(&tbl->entries) - 1;
 273         if (entries >= tbl->gc_thresh3 ||
 274             (entries >= tbl->gc_thresh2 &&
 275              time_after(now, tbl->last_flush + 5 * HZ))) {
 276                 if (!neigh_forced_gc(tbl) &&
 277                     entries >= tbl->gc_thresh3) {
 278                         net_info_ratelimited("%s: neighbor table overflow!\n",
 279                                              tbl->id);
 280                         NEIGH_CACHE_STAT_INC(tbl, table_fulls);
 281                         goto out_entries;
 282                 }
 283         }
 284
 285         n = kzalloc(tbl->entry_size + dev->neigh_priv_len, GFP_ATOMIC);
 286         if (!n)
 287                 goto out_entries;
 288
 289         __skb_queue_head_init(&n->arp_queue);
 290         rwlock_init(&n->lock);
 291         seqlock_init(&n->ha_lock);
 292         n->updated        = n->used = now;
 293         n->nud_state      = NUD_NONE;
 294         n->output         = neigh_blackhole;
 295         seqlock_init(&n->hh.hh_lock);
 296         n->parms          = neigh_parms_clone(&tbl->parms);
 297         setup_timer(&n->timer, neigh_timer_handler, (unsigned long)n);
 298
 299         NEIGH_CACHE_STAT_INC(tbl, allocs);
 300         n->tbl            = tbl;
 301         atomic_set(&n->refcnt, 1);
 302         n->dead           = 1;
 303 out:
 304         return n;
 305
 306 out_entries:
 307         atomic_dec(&tbl->entries);
 308         goto out;
 309 }
 310
 311 static void neigh_get_hash_rnd(u32 *x)
 312 {
 313         get_random_bytes(x, sizeof(*x));
 314         *x |= 1;
 315 }
 316
 317 static struct neigh_hash_table *neigh_hash_alloc(unsigned int shift)
 318 {
 319         size_t size = (1 << shift) * sizeof(struct neighbour *);
 320         struct neigh_hash_table *ret;
 321         struct neighbour __rcu **buckets;
 322         int i;
 323
 324         ret = kmalloc(sizeof(*ret), GFP_ATOMIC);
 325         if (!ret)
 326                 return NULL;
 327         if (size <= PAGE_SIZE)
 328                 buckets = kzalloc(size, GFP_ATOMIC);
 329         else
 330                 buckets = (struct neighbour __rcu **)
 331                           __get_free_pages(GFP_ATOMIC | __GFP_ZERO,
 332                                            get_order(size));
 333         if (!buckets) {
 334                 kfree(ret);
 335                 return NULL;
 336         }
 337         ret->hash_buckets = buckets;
 338         ret->hash_shift = shift;
 339         for (i = 0; i < NEIGH_NUM_HASH_RND; i++)
 340                 neigh_get_hash_rnd(&ret->hash_rnd[i]);
 341         return ret;
 342 }
 343
 344 static void neigh_hash_free_rcu(struct rcu_head *head)
 345 {
 346         struct neigh_hash_table *nht = container_of(head,
 347                                                     struct neigh_hash_table,
 348                                                     rcu);
 349         size_t size = (1 << nht->hash_shift) * sizeof(struct neighbour *);
 350         struct neighbour __rcu **buckets = nht->hash_buckets;
 351
 352         if (size <= PAGE_SIZE)
 353                 kfree(buckets);
 354         else
 355                 free_pages((unsigned long)buckets, get_order(size));
 356         kfree(nht);
 357 }
 358
 359 static struct neigh_hash_table *neigh_hash_grow(struct neigh_table *tbl,
 360                                                 unsigned long new_shift)
 361 {
 362         unsigned int i, hash;
 363         struct neigh_hash_table *new_nht, *old_nht;
 364
 365         NEIGH_CACHE_STAT_INC(tbl, hash_grows);
 366
 367         old_nht = rcu_dereference_protected(tbl->nht,
 368                                             lockdep_is_held(&tbl->lock));
 369         new_nht = neigh_hash_alloc(new_shift);
 370         if (!new_nht)
 371                 return old_nht;
 372
 373         for (i = 0; i < (1 << old_nht->hash_shift); i++) {
 374                 struct neighbour *n, *next;
 375
 376                 for (n = rcu_dereference_protected(old_nht->hash_buckets[i],
 377                                                    lockdep_is_held(&tbl->lock));
 378                      n != NULL;
 379                      n = next) {
 380                         hash = tbl->hash(n->primary_key, n->dev,
 381                                          new_nht->hash_rnd);
 382
 383                         hash >>= (32 - new_nht->hash_shift);
 384                         next = rcu_dereference_protected(n->next,
 385                                                 lockdep_is_held(&tbl->lock));
 386
 387                         rcu_assign_pointer(n->next,
 388                                            rcu_dereference_protected(
 389                                                 new_nht->hash_buckets[hash],
 390                                                 lockdep_is_held(&tbl->lock)));
 391                         rcu_assign_pointer(new_nht->hash_buckets[hash], n);
 392                 }
 393         }
 394
 395         rcu_assign_pointer(tbl->nht, new_nht);
 396         call_rcu(&old_nht->rcu, neigh_hash_free_rcu);
 397         return new_nht;
 398 }
 399
 400 struct neighbour *neigh_lookup(struct neigh_table *tbl, const void *pkey,
 401                                struct net_device *dev)
 402 {
 403         struct neighbour *n;
 404
 405         NEIGH_CACHE_STAT_INC(tbl, lookups);
 406
 407         rcu_read_lock_bh();
 408         n = __neigh_lookup_noref(tbl, pkey, dev);
 409         if (n) {
 410                 if (!atomic_inc_not_zero(&n->refcnt))
 411                         n = NULL;
 412                 NEIGH_CACHE_STAT_INC(tbl, hits);
 413         }
 414
 415         rcu_read_unlock_bh();
 416         return n;
 417 }
 418 EXPORT_SYMBOL(neigh_lookup);
 419
 420 struct neighbour *neigh_lookup_nodev(struct neigh_table *tbl, struct net *net,
 421                                      const void *pkey)
 422 {
 423         struct neighbour *n;
 424         int key_len = tbl->key_len;
 425         u32 hash_val;
 426         struct neigh_hash_table *nht;
 427
 428         NEIGH_CACHE_STAT_INC(tbl, lookups);
 429
 430         rcu_read_lock_bh();
 431         nht = rcu_dereference_bh(tbl->nht);
 432         hash_val = tbl->hash(pkey, NULL, nht->hash_rnd) >> (32 - nht->hash_shift);
 433
 434         for (n = rcu_dereference_bh(nht->hash_buckets[hash_val]);
 435              n != NULL;
 436              n = rcu_dereference_bh(n->next)) {
 437                 if (!memcmp(n->primary_key, pkey, key_len) &&
 438                     net_eq(dev_net(n->dev), net)) {
 439                         if (!atomic_inc_not_zero(&n->refcnt))
 440                                 n = NULL;
 441                         NEIGH_CACHE_STAT_INC(tbl, hits);
 442                         break;
 443                 }
 444         }
 445
 446         rcu_read_unlock_bh();
 447         return n;
 448 }
 449 EXPORT_SYMBOL(neigh_lookup_nodev);
 450
 451 struct neighbour *__neigh_create(struct neigh_table *tbl, const void *pkey,
 452                                  struct net_device *dev, bool want_ref)
 453 {
 454         u32 hash_val;
 455         int key_len = tbl->key_len;
 456         int error;
 457         struct neighbour *n1, *rc, *n = neigh_alloc(tbl, dev);
 458         struct neigh_hash_table *nht;
 459
 460         if (!n) {
 461                 rc = ERR_PTR(-ENOBUFS);
 462                 goto out;
 463         }
 464
 465         memcpy(n->primary_key, pkey, key_len);
 466         n->dev = dev;
 467         dev_hold(dev);
 468
 469         /* Protocol specific setup. */
 470         if (tbl->constructor && (error = tbl->constructor(n)) < 0) {
 471                 rc = ERR_PTR(error);
 472                 goto out_neigh_release;
 473         }
 474
 475         if (dev->netdev_ops->ndo_neigh_construct) {
 476                 error = dev->netdev_ops->ndo_neigh_construct(n);
 477                 if (error < 0) {
 478                         rc = ERR_PTR(error);
 479                         goto out_neigh_release;
 480                 }
 481         }
 482
 483         /* Device specific setup. */
 484         if (n->parms->neigh_setup &&
 485             (error = n->parms->neigh_setup(n)) < 0) {
 486                 rc = ERR_PTR(error);
 487                 goto out_neigh_release;
 488         }
 489
 490         n->confirmed = jiffies - (NEIGH_VAR(n->parms, BASE_REACHABLE_TIME) << 1);
 491
 492         write_lock_bh(&tbl->lock);
 493         nht = rcu_dereference_protected(tbl->nht,
 494                                         lockdep_is_held(&tbl->lock));
 495
 496         if (atomic_read(&tbl->entries) > (1 << nht->hash_shift))
 497                 nht = neigh_hash_grow(tbl, nht->hash_shift + 1);
 498
 499         hash_val = tbl->hash(pkey, dev, nht->hash_rnd) >> (32 - nht->hash_shift);
 500
 501         if (n->parms->dead) {
 502                 rc = ERR_PTR(-EINVAL);
 503                 goto out_tbl_unlock;
 504         }
 505
 506         for (n1 = rcu_dereference_protected(nht->hash_buckets[hash_val],
 507                                             lockdep_is_held(&tbl->lock));
 508              n1 != NULL;
 509              n1 = rcu_dereference_protected(n1->next,
 510                         lockdep_is_held(&tbl->lock))) {
 511                 if (dev == n1->dev && !memcmp(n1->primary_key, pkey, key_len)) {
 512                         if (want_ref)
 513                                 neigh_hold(n1);
 514                         rc = n1;
 515                         goto out_tbl_unlock;
 516                 }
 517         }
 518
 519         n->dead = 0;
 520         if (want_ref)
 521                 neigh_hold(n);
 522         rcu_assign_pointer(n->next,
 523                            rcu_dereference_protected(nht->hash_buckets[hash_val],
 524                                                      lockdep_is_held(&tbl->lock)));
 525         rcu_assign_pointer(nht->hash_buckets[hash_val], n);
 526         write_unlock_bh(&tbl->lock);
 527         neigh_dbg(2, "neigh %p is created\n", n);
 528         rc = n;
 529 out:
 530         return rc;
 531 out_tbl_unlock:
 532         write_unlock_bh(&tbl->lock);
 533 out_neigh_release:
 534         neigh_release(n);
 535         goto out;
 536 }
 537 EXPORT_SYMBOL(__neigh_create);
 538
 539 static u32 pneigh_hash(const void *pkey, int key_len)
 540 {
 541         u32 hash_val = *(u32 *)(pkey + key_len - 4);
 542         hash_val ^= (hash_val >> 16);
 543         hash_val ^= hash_val >> 8;
 544         hash_val ^= hash_val >> 4;
 545         hash_val &= PNEIGH_HASHMASK;
 546         return hash_val;
 547 }
 548
 549 static struct pneigh_entry *__pneigh_lookup_1(struct pneigh_entry *n,
 550                                               struct net *net,
 551                                               const void *pkey,
 552                                               int key_len,
 553                                               struct net_device *dev)
 554 {
 555         while (n) {
 556                 if (!memcmp(n->key, pkey, key_len) &&
 557                     net_eq(pneigh_net(n), net) &&
 558                     (n->dev == dev || !n->dev))
 559                         return n;
 560                 n = n->next;
 561         }
 562         return NULL;
 563 }
 564
 565 struct pneigh_entry *__pneigh_lookup(struct neigh_table *tbl,
 566                 struct net *net, const void *pkey, struct net_device *dev)
 567 {
 568         int key_len = tbl->key_len;
 569         u32 hash_val = pneigh_hash(pkey, key_len);
 570
 571         return __pneigh_lookup_1(tbl->phash_buckets[hash_val],
 572                                  net, pkey, key_len, dev);
 573 }
 574 EXPORT_SYMBOL_GPL(__pneigh_lookup);
 575
 576 struct pneigh_entry * pneigh_lookup(struct neigh_table *tbl,
 577                                     struct net *net, const void *pkey,
 578                                     struct net_device *dev, int creat)
 579 {
 580         struct pneigh_entry *n;
 581         int key_len = tbl->key_len;
 582         u32 hash_val = pneigh_hash(pkey, key_len);
 583
 584         read_lock_bh(&tbl->lock);
 585         n = __pneigh_lookup_1(tbl->phash_buckets[hash_val],
 586                               net, pkey, key_len, dev);
 587         read_unlock_bh(&tbl->lock);
 588
 589         if (n || !creat)
 590                 goto out;
 591
 592         ASSERT_RTNL();
 593
 594         n = kmalloc(sizeof(*n) + key_len, GFP_KERNEL);
 595         if (!n)
 596                 goto out;
 597
 598         write_pnet(&n->net, net);
 599         memcpy(n->key, pkey, key_len);
 600         n->dev = dev;
 601         if (dev)
 602                 dev_hold(dev);
 603
 604         if (tbl->pconstructor && tbl->pconstructor(n)) {
 605                 if (dev)
 606                         dev_put(dev);
 607                 kfree(n);
 608                 n = NULL;
 609                 goto out;
 610         }
 611
 612         write_lock_bh(&tbl->lock);
 613         n->next = tbl->phash_buckets[hash_val];
 614         tbl->phash_buckets[hash_val] = n;
 615         write_unlock_bh(&tbl->lock);
 616 out:
 617         return n;
 618 }
 619 EXPORT_SYMBOL(pneigh_lookup);
 620
 621
 622 int pneigh_delete(struct neigh_table *tbl, struct net *net, const void *pkey,
 623                   struct net_device *dev)
 624 {
 625         struct pneigh_entry *n, **np;
 626         int key_len = tbl->key_len;
 627         u32 hash_val = pneigh_hash(pkey, key_len);
 628
 629         write_lock_bh(&tbl->lock);
 630         for (np = &tbl->phash_buckets[hash_val]; (n = *np) != NULL;
 631              np = &n->next) {
 632                 if (!memcmp(n->key, pkey, key_len) && n->dev == dev &&
 633                     net_eq(pneigh_net(n), net)) {
 634                         *np = n->next;
 635                         write_unlock_bh(&tbl->lock);
 636                         if (tbl->pdestructor)
 637                                 tbl->pdestructor(n);
 638                         if (n->dev)
 639                                 dev_put(n->dev);
 640                         kfree(n);
 641                         return 0;
 642                 }
 643         }
 644         write_unlock_bh(&tbl->lock);
 645         return -ENOENT;
 646 }
 647
 648 static int pneigh_ifdown(struct neigh_table *tbl, struct net_device *dev)
 649 {
 650         struct pneigh_entry *n, **np;
 651         u32 h;
 652
 653         for (h = 0; h <= PNEIGH_HASHMASK; h++) {
 654                 np = &tbl->phash_buckets[h];
 655                 while ((n = *np) != NULL) {
 656                         if (!dev || n->dev == dev) {
 657                                 *np = n->next;
 658                                 if (tbl->pdestructor)
 659                                         tbl->pdestructor(n);
 660                                 if (n->dev)
 661                                         dev_put(n->dev);
 662                                 kfree(n);
 663                                 continue;
 664                         }
 665                         np = &n->next;
 666                 }
 667         }
 668         return -ENOENT;
 669 }
 670
 671 static void neigh_parms_destroy(struct neigh_parms *parms);
 672
 673 static inline void neigh_parms_put(struct neigh_parms *parms)
 674 {
 675         if (atomic_dec_and_test(&parms->refcnt))
 676                 neigh_parms_destroy(parms);
 677 }
 678
 679 /*
 680  *      neighbour must already be out of the table;
 681  *
 682  */
 683 void neigh_destroy(struct neighbour *neigh)
 684 {
 685         struct net_device *dev = neigh->dev;
 686
 687         NEIGH_CACHE_STAT_INC(neigh->tbl, destroys);
 688
 689         if (!neigh->dead) {
 690                 pr_warn("Destroying alive neighbour %p\n", neigh);
 691                 dump_stack();
 692                 return;
 693         }
 694
 695         if (neigh_del_timer(neigh))
 696                 pr_warn("Impossible event\n");
 697
 698         write_lock_bh(&neigh->lock);
 699         __skb_queue_purge(&neigh->arp_queue);
 700         write_unlock_bh(&neigh->lock);
 701         neigh->arp_queue_len_bytes = 0;
 702
 703         if (dev->netdev_ops->ndo_neigh_destroy)
 704                 dev->netdev_ops->ndo_neigh_destroy(neigh);
 705
 706         dev_put(dev);
 707         neigh_parms_put(neigh->parms);
 708
 709         neigh_dbg(2, "neigh %p is destroyed\n", neigh);
 710
 711         atomic_dec(&neigh->tbl->entries);
 712         kfree_rcu(neigh, rcu);
 713 }
 714 EXPORT_SYMBOL(neigh_destroy);
 715
 716 /* Neighbour state is suspicious;
 717    disable fast path.
 718
 719    Called with write_locked neigh.
 720  */
 721 static void neigh_suspect(struct neighbour *neigh)
 722 {
 723         neigh_dbg(2, "neigh %p is suspected\n", neigh);
 724
 725         neigh->output = neigh->ops->output;
 726 }
 727
 728 /* Neighbour state is OK;
 729    enable fast path.
 730
 731    Called with write_locked neigh.
 732  */
 733 static void neigh_connect(struct neighbour *neigh)
 734 {
 735         neigh_dbg(2, "neigh %p is connected\n", neigh);
 736
 737         neigh->output = neigh->ops->connected_output;
 738 }
 739
 740 static void neigh_periodic_work(struct work_struct *work)
 741 {
 742         struct neigh_table *tbl = container_of(work, struct neigh_table, gc_work.work);
 743         struct neighbour *n;
 744         struct neighbour __rcu **np;
 745         unsigned int i;
 746         struct neigh_hash_table *nht;
 747
 748         NEIGH_CACHE_STAT_INC(tbl, periodic_gc_runs);
 749
 750         write_lock_bh(&tbl->lock);
 751         nht = rcu_dereference_protected(tbl->nht,
 752                                         lockdep_is_held(&tbl->lock));
 753
 754         /*
 755          *      periodically recompute ReachableTime from random function
 756          */
 757
 758         if (time_after(jiffies, tbl->last_rand + 300 * HZ)) {
 759                 struct neigh_parms *p;
 760                 tbl->last_rand = jiffies;
 761                 list_for_each_entry(p, &tbl->parms_list, list)
 762                         p->reachable_time =
 763                                 neigh_rand_reach_time(NEIGH_VAR(p, BASE_REACHABLE_TIME));
 764         }
 765
 766         if (atomic_read(&tbl->entries) < tbl->gc_thresh1)
 767                 goto out;
 768
 769         for (i = 0 ; i < (1 << nht->hash_shift); i++) {
 770                 np = &nht->hash_buckets[i];
 771
 772                 while ((n = rcu_dereference_protected(*np,
 773                                 lockdep_is_held(&tbl->lock))) != NULL) {
 774                         unsigned int state;
 775
 776                         write_lock(&n->lock);
 777
 778                         state = n->nud_state;
 779                         if (state & (NUD_PERMANENT | NUD_IN_TIMER)) {
 780                                 write_unlock(&n->lock);
 781                                 goto next_elt;
 782                         }
 783
 784                         if (time_before(n->used, n->confirmed))
 785                                 n->used = n->confirmed;
 786
 787                         if (atomic_read(&n->refcnt) == 1 &&
 788                             (state == NUD_FAILED ||
 789                              time_after(jiffies, n->used + NEIGH_VAR(n->parms, GC_STALETIME)))) {
 790                                 *np = n->next;
 791                                 n->dead = 1;
 792                                 write_unlock(&n->lock);
 793                                 neigh_cleanup_and_release(n);
 794                                 continue;
 795                         }
 796                         write_unlock(&n->lock);
 797
 798 next_elt:
 799                         np = &n->next;
 800                 }
 801                 /*
 802                  * It's fine to release lock here, even if hash table
 803                  * grows while we are preempted.
 804                  */
 805                 write_unlock_bh(&tbl->lock);
 806                 cond_resched();
 807                 write_lock_bh(&tbl->lock);
 808                 nht = rcu_dereference_protected(tbl->nht,
 809                                                 lockdep_is_held(&tbl->lock));
 810         }
 811 out:
 812         /* Cycle through all hash buckets every BASE_REACHABLE_TIME/2 ticks.
 813          * ARP entry timeouts range from 1/2 BASE_REACHABLE_TIME to 3/2
 814          * BASE_REACHABLE_TIME.
 815          */
 816         queue_delayed_work(system_power_efficient_wq, &tbl->gc_work,
 817                               NEIGH_VAR(&tbl->parms, BASE_REACHABLE_TIME) >> 1);
 818         write_unlock_bh(&tbl->lock);
 819 }
 820
 821 static __inline__ int neigh_max_probes(struct neighbour *n)
 822 {
 823         struct neigh_parms *p = n->parms;
 824         return NEIGH_VAR(p, UCAST_PROBES) + NEIGH_VAR(p, APP_PROBES) +
 825                (n->nud_state & NUD_PROBE ? NEIGH_VAR(p, MCAST_REPROBES) :
 826                 NEIGH_VAR(p, MCAST_PROBES));
 827 }
 828
 829 static void neigh_invalidate(struct neighbour *neigh)
 830         __releases(neigh->lock)
 831         __acquires(neigh->lock)
 832 {
 833         struct sk_buff *skb;
 834
 835         NEIGH_CACHE_STAT_INC(neigh->tbl, res_failed);
 836         neigh_dbg(2, "neigh %p is failed\n", neigh);
 837         neigh->updated = jiffies;
 838
 839         /* It is very thin place. report_unreachable is very complicated
 840            routine. Particularly, it can hit the same neighbour entry!
 841
 842            So that, we try to be accurate and avoid dead loop. --ANK
 843          */
 844         while (neigh->nud_state == NUD_FAILED &&
 845                (skb = __skb_dequeue(&neigh->arp_queue)) != NULL) {
 846                 write_unlock(&neigh->lock);
 847                 neigh->ops->error_report(neigh, skb);
 848                 write_lock(&neigh->lock);
 849         }
 850         __skb_queue_purge(&neigh->arp_queue);
 851         neigh->arp_queue_len_bytes = 0;
 852 }
 853
 854 static void neigh_probe(struct neighbour *neigh)
 855         __releases(neigh->lock)
 856 {
 857         struct sk_buff *skb = skb_peek_tail(&neigh->arp_queue);
 858         /* keep skb alive even if arp_queue overflows */
 859         if (skb)
 860                 skb = skb_clone(skb, GFP_ATOMIC);
 861         write_unlock(&neigh->lock);
 862         if (neigh->ops->solicit)
 863                 neigh->ops->solicit(neigh, skb);
 864         atomic_inc(&neigh->probes);
 865         kfree_skb(skb);
 866 }
 867
 868 /* Called when a timer expires for a neighbour entry. */
 869
 870 static void neigh_timer_handler(unsigned long arg)
 871 {
 872         unsigned long now, next;
 873         struct neighbour *neigh = (struct neighbour *)arg;
 874         unsigned int state;
 875         int notify = 0;
 876
 877         write_lock(&neigh->lock);
 878
 879         state = neigh->nud_state;
 880         now = jiffies;
 881         next = now + HZ;
 882
 883         if (!(state & NUD_IN_TIMER))
 884                 goto out;
 885
 886         if (state & NUD_REACHABLE) {
 887                 if (time_before_eq(now,
 888                                    neigh->confirmed + neigh->parms->reachable_time)) {
 889                         neigh_dbg(2, "neigh %p is still alive\n", neigh);
 890                         next = neigh->confirmed + neigh->parms->reachable_time;
 891                 } else if (time_before_eq(now,
 892                                           neigh->used +
 893                                           NEIGH_VAR(neigh->parms, DELAY_PROBE_TIME))) {
 894                         neigh_dbg(2, "neigh %p is delayed\n", neigh);
 895                         neigh->nud_state = NUD_DELAY;
 896                         neigh->updated = jiffies;
 897                         neigh_suspect(neigh);
 898                         next = now + NEIGH_VAR(neigh->parms, DELAY_PROBE_TIME);
 899                 } else {
 900                         neigh_dbg(2, "neigh %p is suspected\n", neigh);
 901                         neigh->nud_state = NUD_STALE;
 902                         neigh->updated = jiffies;
 903                         neigh_suspect(neigh);
 904                         notify = 1;
 905                 }
 906         } else if (state & NUD_DELAY) {
 907                 if (time_before_eq(now,
 908                                    neigh->confirmed +
 909                                    NEIGH_VAR(neigh->parms, DELAY_PROBE_TIME))) {
 910                         neigh_dbg(2, "neigh %p is now reachable\n", neigh);
 911                         neigh->nud_state = NUD_REACHABLE;
 912                         neigh->updated = jiffies;
 913                         neigh_connect(neigh);
 914                         notify = 1;
 915                         next = neigh->confirmed + neigh->parms->reachable_time;
 916                 } else {
 917                         neigh_dbg(2, "neigh %p is probed\n", neigh);
 918                         neigh->nud_state = NUD_PROBE;
 919                         neigh->updated = jiffies;
 920                         atomic_set(&neigh->probes, 0);
 921                         notify = 1;
 922                         next = now + NEIGH_VAR(neigh->parms, RETRANS_TIME);
 923                 }
 924         } else {
 925                 /* NUD_PROBE|NUD_INCOMPLETE */
 926                 next = now + NEIGH_VAR(neigh->parms, RETRANS_TIME);
 927         }
 928
 929         if ((neigh->nud_state & (NUD_INCOMPLETE | NUD_PROBE)) &&
 930             atomic_read(&neigh->probes) >= neigh_max_probes(neigh)) {
 931                 neigh->nud_state = NUD_FAILED;
 932                 notify = 1;
 933                 neigh_invalidate(neigh);
 934                 goto out;
 935         }
 936
 937         if (neigh->nud_state & NUD_IN_TIMER) {
 938                 if (time_before(next, jiffies + HZ/2))
 939                         next = jiffies + HZ/2;
 940                 if (!mod_timer(&neigh->timer, next))
 941                         neigh_hold(neigh);
 942         }
 943         if (neigh->nud_state & (NUD_INCOMPLETE | NUD_PROBE)) {
 944                 neigh_probe(neigh);
 945         } else {
 946 out:
 947                 write_unlock(&neigh->lock);
 948         }
 949
 950         if (notify)
 951                 neigh_update_notify(neigh);
 952
 953         neigh_release(neigh);
 954 }
 955
 956 int __neigh_event_send(struct neighbour *neigh, struct sk_buff *skb)
 957 {
 958         int rc;
 959         bool immediate_probe = false;
 960
 961         write_lock_bh(&neigh->lock);
 962
 963         rc = 0;
 964         if (neigh->nud_state & (NUD_CONNECTED | NUD_DELAY | NUD_PROBE))
 965                 goto out_unlock_bh;
 966         if (neigh->dead)
 967                 goto out_dead;
 968
 969         if (!(neigh->nud_state & (NUD_STALE | NUD_INCOMPLETE))) {
 970                 if (NEIGH_VAR(neigh->parms, MCAST_PROBES) +
 971                     NEIGH_VAR(neigh->parms, APP_PROBES)) {
 972                         unsigned long next, now = jiffies;
 973
 974                         atomic_set(&neigh->probes,
 975                                    NEIGH_VAR(neigh->parms, UCAST_PROBES));
 976                         neigh->nud_state     = NUD_INCOMPLETE;
 977                         neigh->updated = now;
 978                         next = now + max(NEIGH_VAR(neigh->parms, RETRANS_TIME),
 979                                          HZ/2);
 980                         neigh_add_timer(neigh, next);
 981                         immediate_probe = true;
 982                 } else {
 983                         neigh->nud_state = NUD_FAILED;
 984                         neigh->updated = jiffies;
 985                         write_unlock_bh(&neigh->lock);
 986
 987                         kfree_skb(skb);
 988                         return 1;
 989                 }
 990         } else if (neigh->nud_state & NUD_STALE) {
 991                 neigh_dbg(2, "neigh %p is delayed\n", neigh);
 992                 neigh->nud_state = NUD_DELAY;
 993                 neigh->updated = jiffies;
 994                 neigh_add_timer(neigh, jiffies +
 995                                 NEIGH_VAR(neigh->parms, DELAY_PROBE_TIME));
 996         }
 997
 998         if (neigh->nud_state == NUD_INCOMPLETE) {
 999                 if (skb) {
1000                         while (neigh->arp_queue_len_bytes + skb->truesize >
1001                                NEIGH_VAR(neigh->parms, QUEUE_LEN_BYTES)) {
1002                                 struct sk_buff *buff;
1003
1004                                 buff = __skb_dequeue(&neigh->arp_queue);
1005                                 if (!buff)
1006                                         break;
1007                                 neigh->arp_queue_len_bytes -= buff->truesize;
1008                                 kfree_skb(buff);
1009                                 NEIGH_CACHE_STAT_INC(neigh->tbl, unres_discards);
1010                         }
1011                         skb_dst_force(skb);
1012                         __skb_queue_tail(&neigh->arp_queue, skb);
1013                         neigh->arp_queue_len_bytes += skb->truesize;
1014                 }
1015                 rc = 1;
1016         }
1017 out_unlock_bh:
1018         if (immediate_probe)
1019                 neigh_probe(neigh);
1020         else
1021                 write_unlock(&neigh->lock);
1022         local_bh_enable();
1023         return rc;
1024
1025 out_dead:
1026         if (neigh->nud_state & NUD_STALE)
1027                 goto out_unlock_bh;
1028         write_unlock_bh(&neigh->lock);
1029         kfree_skb(skb);
1030         return 1;
1031 }
1032 EXPORT_SYMBOL(__neigh_event_send);
1033
1034 static void neigh_update_hhs(struct neighbour *neigh)
1035 {
1036         struct hh_cache *hh;
1037         void (*update)(struct hh_cache*, const struct net_device*, const unsigned char *)
1038                 = NULL;
1039
1040         if (neigh->dev->header_ops)
1041                 update = neigh->dev->header_ops->cache_update;
1042
1043         if (update) {
1044                 hh = &neigh->hh;
1045                 if (hh->hh_len) {
1046                         write_seqlock_bh(&hh->hh_lock);
1047                         update(hh, neigh->dev, neigh->ha);
1048                         write_sequnlock_bh(&hh->hh_lock);
1049                 }
1050         }
1051 }
1052
1053
1054
1055 /* Generic update routine.
1056    -- lladdr is new lladdr or NULL, if it is not supplied.
1057    -- new    is new state.
1058    -- flags
1059         NEIGH_UPDATE_F_OVERRIDE allows to override existing lladdr,
1060                                 if it is different.
1061         NEIGH_UPDATE_F_WEAK_OVERRIDE will suspect existing "connected"
1062                                 lladdr instead of overriding it
1063                                 if it is different.
1064                                 It also allows to retain current state
1065                                 if lladdr is unchanged.
1066         NEIGH_UPDATE_F_ADMIN    means that the change is administrative.
1067
1068         NEIGH_UPDATE_F_OVERRIDE_ISROUTER allows to override existing
1069                                 NTF_ROUTER flag.
1070         NEIGH_UPDATE_F_ISROUTER indicates if the neighbour is known as
1071                                 a router.
1072
1073    Caller MUST hold reference count on the entry.
1074  */
1075
1076 int neigh_update(struct neighbour *neigh, const u8 *lladdr, u8 new,
1077                  u32 flags)
1078 {
1079         u8 old;
1080         int err;
1081         int notify = 0;
1082         struct net_device *dev;
1083         int update_isrouter = 0;
1084
1085         write_lock_bh(&neigh->lock);
1086
1087         dev    = neigh->dev;
1088         old    = neigh->nud_state;
1089         err    = -EPERM;
1090
1091         if (!(flags & NEIGH_UPDATE_F_ADMIN) &&
1092             (old & (NUD_NOARP | NUD_PERMANENT)))
1093                 goto out;
1094         if (neigh->dead)
1095                 goto out;
1096
1097         if (!(new & NUD_VALID)) {
1098                 neigh_del_timer(neigh);
1099                 if (old & NUD_CONNECTED)
1100                         neigh_suspect(neigh);
1101                 neigh->nud_state = new;
1102                 err = 0;
1103                 notify = old & NUD_VALID;
1104                 if ((old & (NUD_INCOMPLETE | NUD_PROBE)) &&
1105                     (new & NUD_FAILED)) {
1106                         neigh_invalidate(neigh);
1107                         notify = 1;
1108                 }
1109                 goto out;
1110         }
1111
1112         /* Compare new lladdr with cached one */
1113         if (!dev->addr_len) {
1114                 /* First case: device needs no address. */
1115                 lladdr = neigh->ha;
1116         } else if (lladdr) {
1117                 /* The second case: if something is already cached
1118                    and a new address is proposed:
1119                    - compare new & old
1120                    - if they are different, check override flag
1121                  */
1122                 if ((old & NUD_VALID) &&
1123                     !memcmp(lladdr, neigh->ha, dev->addr_len))
1124                         lladdr = neigh->ha;
1125         } else {
1126                 /* No address is supplied; if we know something,
1127                    use it, otherwise discard the request.
1128                  */
1129                 err = -EINVAL;
1130                 if (!(old & NUD_VALID))
1131                         goto out;
1132                 lladdr = neigh->ha;
1133         }
1134
1135         if (new & NUD_CONNECTED)
1136                 neigh->confirmed = jiffies;
1137         neigh->updated = jiffies;
1138
1139         /* If entry was valid and address is not changed,
1140            do not change entry state, if new one is STALE.
1141          */
1142         err = 0;
1143         update_isrouter = flags & NEIGH_UPDATE_F_OVERRIDE_ISROUTER;
1144         if (old & NUD_VALID) {
1145                 if (lladdr != neigh->ha && !(flags & NEIGH_UPDATE_F_OVERRIDE)) {
1146                         update_isrouter = 0;
1147                         if ((flags & NEIGH_UPDATE_F_WEAK_OVERRIDE) &&
1148                             (old & NUD_CONNECTED)) {
1149                                 lladdr = neigh->ha;
1150                                 new = NUD_STALE;
1151                         } else
1152                                 goto out;
1153                 } else {
1154                         if (lladdr == neigh->ha && new == NUD_STALE &&
1155                             ((flags & NEIGH_UPDATE_F_WEAK_OVERRIDE) ||
1156                              (old & NUD_CONNECTED))
1157                             )
1158                                 new = old;
1159                 }
1160         }
1161
1162         if (new != old) {
1163                 neigh_del_timer(neigh);
1164                 if (new & NUD_PROBE)
1165                         atomic_set(&neigh->probes, 0);
1166                 if (new & NUD_IN_TIMER)
1167                         neigh_add_timer(neigh, (jiffies +
1168                                                 ((new & NUD_REACHABLE) ?
1169                                                  neigh->parms->reachable_time :
1170                                                  0)));
1171                 neigh->nud_state = new;
1172                 notify = 1;
1173         }
1174
1175         if (lladdr != neigh->ha) {
1176                 write_seqlock(&neigh->ha_lock);
1177                 memcpy(&neigh->ha, lladdr, dev->addr_len);
1178                 write_sequnlock(&neigh->ha_lock);
1179                 neigh_update_hhs(neigh);
1180                 if (!(new & NUD_CONNECTED))
1181                         neigh->confirmed = jiffies -
1182                                       (NEIGH_VAR(neigh->parms, BASE_REACHABLE_TIME) << 1);
1183                 notify = 1;
1184         }
1185         if (new == old)
1186                 goto out;
1187         if (new & NUD_CONNECTED)
1188                 neigh_connect(neigh);
1189         else
1190                 neigh_suspect(neigh);
1191         if (!(old & NUD_VALID)) {
1192                 struct sk_buff *skb;
1193
1194                 /* Again: avoid dead loop if something went wrong */
1195
1196                 while (neigh->nud_state & NUD_VALID &&
1197                        (skb = __skb_dequeue(&neigh->arp_queue)) != NULL) {
1198                         struct dst_entry *dst = skb_dst(skb);
1199                         struct neighbour *n2, *n1 = neigh;
1200                         write_unlock_bh(&neigh->lock);
1201
1202                         rcu_read_lock();
1203
1204                         /* Why not just use 'neigh' as-is?  The problem is that
1205                          * things such as shaper, eql, and sch_teql can end up
1206                          * using alternative, different, neigh objects to output
1207                          * the packet in the output path.  So what we need to do
1208                          * here is re-lookup the top-level neigh in the path so
1209                          * we can reinject the packet there.
1210                          */
1211                         n2 = NULL;
1212                         if (dst) {
1213                                 n2 = dst_neigh_lookup_skb(dst, skb);
1214                                 if (n2)
1215                                         n1 = n2;
1216                         }
1217                         n1->output(n1, skb);
1218                         if (n2)
1219                                 neigh_release(n2);
1220                         rcu_read_unlock();
1221
1222                         write_lock_bh(&neigh->lock);
1223                 }
1224                 __skb_queue_purge(&neigh->arp_queue);
1225                 neigh->arp_queue_len_bytes = 0;
1226         }
1227 out:
1228         if (update_isrouter) {
1229                 neigh->flags = (flags & NEIGH_UPDATE_F_ISROUTER) ?
1230                         (neigh->flags | NTF_ROUTER) :
1231                         (neigh->flags & ~NTF_ROUTER);
1232         }
1233         write_unlock_bh(&neigh->lock);
1234
1235         if (notify)
1236                 neigh_update_notify(neigh);
1237
1238         return err;
1239 }
1240 EXPORT_SYMBOL(neigh_update);
1241
1242 /* Update the neigh to listen temporarily for probe responses, even if it is
1243  * in a NUD_FAILED state. The caller has to hold neigh->lock for writing.
1244  */
1245 void __neigh_set_probe_once(struct neighbour *neigh)
1246 {
1247         if (neigh->dead)
1248                 return;
1249         neigh->updated = jiffies;
1250         if (!(neigh->nud_state & NUD_FAILED))
1251                 return;
1252         neigh->nud_state = NUD_INCOMPLETE;
1253         atomic_set(&neigh->probes, neigh_max_probes(neigh));
1254         neigh_add_timer(neigh,
1255                         jiffies + NEIGH_VAR(neigh->parms, RETRANS_TIME));
1256 }
1257 EXPORT_SYMBOL(__neigh_set_probe_once);
1258
1259 struct neighbour *neigh_event_ns(struct neigh_table *tbl,
1260                                  u8 *lladdr, void *saddr,
1261                                  struct net_device *dev)
1262 {
1263         struct neighbour *neigh = __neigh_lookup(tbl, saddr, dev,
1264                                                  lladdr || !dev->addr_len);
1265         if (neigh)
1266                 neigh_update(neigh, lladdr, NUD_STALE,
1267                              NEIGH_UPDATE_F_OVERRIDE);
1268         return neigh;
1269 }
1270 EXPORT_SYMBOL(neigh_event_ns);
1271
1272 /* called with read_lock_bh(&n->lock); */
1273 static void neigh_hh_init(struct neighbour *n)
1274 {
1275         struct net_device *dev = n->dev;
1276         __be16 prot = n->tbl->protocol;
1277         struct hh_cache *hh = &n->hh;
1278
1279         write_lock_bh(&n->lock);
1280
1281         /* Only one thread can come in here and initialize the
1282          * hh_cache entry.
1283          */
1284         if (!hh->hh_len)
1285                 dev->header_ops->cache(n, hh, prot);
1286
1287         write_unlock_bh(&n->lock);
1288 }
1289
1290 /* Slow and careful. */
1291
1292 int neigh_resolve_output(struct neighbour *neigh, struct sk_buff *skb)
1293 {
1294         int rc = 0;
1295
1296         if (!neigh_event_send(neigh, skb)) {
1297                 int err;
1298                 struct net_device *dev = neigh->dev;
1299                 unsigned int seq;
1300
1301                 if (dev->header_ops->cache && !neigh->hh.hh_len)
1302                         neigh_hh_init(neigh);
1303
1304                 do {
1305                         __skb_pull(skb, skb_network_offset(skb));
1306                         seq = read_seqbegin(&neigh->ha_lock);
1307                         err = dev_hard_header(skb, dev, ntohs(skb->protocol),
1308                                               neigh->ha, NULL, skb->len);
1309                 } while (read_seqretry(&neigh->ha_lock, seq));
1310
1311                 if (err >= 0)
1312                         rc = dev_queue_xmit(skb);
1313                 else
1314                         goto out_kfree_skb;
1315         }
1316 out:
1317         return rc;
1318 out_kfree_skb:
1319         rc = -EINVAL;
1320         kfree_skb(skb);
1321         goto out;
1322 }
1323 EXPORT_SYMBOL(neigh_resolve_output);
1324
1325 /* As fast as possible without hh cache */
1326
1327 int neigh_connected_output(struct neighbour *neigh, struct sk_buff *skb)
1328 {
1329         struct net_device *dev = neigh->dev;
1330         unsigned int seq;
1331         int err;
1332
1333         do {
1334                 __skb_pull(skb, skb_network_offset(skb));
1335                 seq = read_seqbegin(&neigh->ha_lock);
1336                 err = dev_hard_header(skb, dev, ntohs(skb->protocol),
1337                                       neigh->ha, NULL, skb->len);
1338         } while (read_seqretry(&neigh->ha_lock, seq));
1339
1340         if (err >= 0)
1341                 err = dev_queue_xmit(skb);
1342         else {
1343                 err = -EINVAL;
1344                 kfree_skb(skb);
1345         }
1346         return err;
1347 }
1348 EXPORT_SYMBOL(neigh_connected_output);
1349
1350 int neigh_direct_output(struct neighbour *neigh, struct sk_buff *skb)
1351 {
1352         return dev_queue_xmit(skb);
1353 }
1354 EXPORT_SYMBOL(neigh_direct_output);
1355
1356 static void neigh_proxy_process(unsigned long arg)
1357 {
1358         struct neigh_table *tbl = (struct neigh_table *)arg;
1359         long sched_next = 0;
1360         unsigned long now = jiffies;
1361         struct sk_buff *skb, *n;
1362
1363         spin_lock(&tbl->proxy_queue.lock);
1364
1365         skb_queue_walk_safe(&tbl->proxy_queue, skb, n) {
1366                 long tdif = NEIGH_CB(skb)->sched_next - now;
1367
1368                 if (tdif <= 0) {
1369                         struct net_device *dev = skb->dev;
1370
1371                         __skb_unlink(skb, &tbl->proxy_queue);
1372                         if (tbl->proxy_redo && netif_running(dev)) {
1373                                 rcu_read_lock();
1374                                 tbl->proxy_redo(skb);
1375                                 rcu_read_unlock();
1376                         } else {
1377                                 kfree_skb(skb);
1378                         }
1379
1380                         dev_put(dev);
1381                 } else if (!sched_next || tdif < sched_next)
1382                         sched_next = tdif;
1383         }
1384         del_timer(&tbl->proxy_timer);
1385         if (sched_next)
1386                 mod_timer(&tbl->proxy_timer, jiffies + sched_next);
1387         spin_unlock(&tbl->proxy_queue.lock);
1388 }
1389
1390 void pneigh_enqueue(struct neigh_table *tbl, struct neigh_parms *p,
1391                     struct sk_buff *skb)
1392 {
1393         unsigned long now = jiffies;
1394
1395         unsigned long sched_next = now + (prandom_u32() %
1396                                           NEIGH_VAR(p, PROXY_DELAY));
1397
1398         if (tbl->proxy_queue.qlen > NEIGH_VAR(p, PROXY_QLEN)) {
1399                 kfree_skb(skb);
1400                 return;
1401         }
1402
1403         NEIGH_CB(skb)->sched_next = sched_next;
1404         NEIGH_CB(skb)->flags |= LOCALLY_ENQUEUED;
1405
1406         spin_lock(&tbl->proxy_queue.lock);
1407         if (del_timer(&tbl->proxy_timer)) {
1408                 if (time_before(tbl->proxy_timer.expires, sched_next))
1409                         sched_next = tbl->proxy_timer.expires;
1410         }
1411         skb_dst_drop(skb);
1412         dev_hold(skb->dev);
1413         __skb_queue_tail(&tbl->proxy_queue, skb);
1414         mod_timer(&tbl->proxy_timer, sched_next);
1415         spin_unlock(&tbl->proxy_queue.lock);
1416 }
1417 EXPORT_SYMBOL(pneigh_enqueue);
1418
1419 static inline struct neigh_parms *lookup_neigh_parms(struct neigh_table *tbl,
1420                                                       struct net *net, int ifindex)
1421 {
1422         struct neigh_parms *p;
1423
1424         list_for_each_entry(p, &tbl->parms_list, list) {
1425                 if ((p->dev && p->dev->ifindex == ifindex && net_eq(neigh_parms_net(p), net)) ||
1426                     (!p->dev && !ifindex && net_eq(net, &init_net)))
1427                         return p;
1428         }
1429
1430         return NULL;
1431 }
1432
1433 struct neigh_parms *neigh_parms_alloc(struct net_device *dev,
1434                                       struct neigh_table *tbl)
1435 {
1436         struct neigh_parms *p;
1437         struct net *net = dev_net(dev);
1438         const struct net_device_ops *ops = dev->netdev_ops;
1439
1440         p = kmemdup(&tbl->parms, sizeof(*p), GFP_KERNEL);
1441         if (p) {
1442                 p->tbl            = tbl;
1443                 atomic_set(&p->refcnt, 1);
1444                 p->reachable_time =
1445                                 neigh_rand_reach_time(NEIGH_VAR(p, BASE_REACHABLE_TIME));
1446                 dev_hold(dev);
1447                 p->dev = dev;
1448                 write_pnet(&p->net, net);
1449                 p->sysctl_table = NULL;
1450
1451                 if (ops->ndo_neigh_setup && ops->ndo_neigh_setup(dev, p)) {
1452                         dev_put(dev);
1453                         kfree(p);
1454                         return NULL;
1455                 }
1456
1457                 write_lock_bh(&tbl->lock);
1458                 list_add(&p->list, &tbl->parms.list);
1459                 write_unlock_bh(&tbl->lock);
1460
1461                 neigh_parms_data_state_cleanall(p);
1462         }
1463         return p;
1464 }
1465 EXPORT_SYMBOL(neigh_parms_alloc);
1466
1467 static void neigh_rcu_free_parms(struct rcu_head *head)
1468 {
1469         struct neigh_parms *parms =
1470                 container_of(head, struct neigh_parms, rcu_head);
1471
1472         neigh_parms_put(parms);
1473 }
1474
1475 void neigh_parms_release(struct neigh_table *tbl, struct neigh_parms *parms)
1476 {
1477         if (!parms || parms == &tbl->parms)
1478                 return;
1479         write_lock_bh(&tbl->lock);
1480         list_del(&parms->list);
1481         parms->dead = 1;
1482         write_unlock_bh(&tbl->lock);
1483         if (parms->dev)
1484                 dev_put(parms->dev);
1485         call_rcu(&parms->rcu_head, neigh_rcu_free_parms);
1486 }
1487 EXPORT_SYMBOL(neigh_parms_release);
1488
1489 static void neigh_parms_destroy(struct neigh_parms *parms)
1490 {
1491         kfree(parms);
1492 }
1493
1494 static struct lock_class_key neigh_table_proxy_queue_class;
1495
1496 static struct neigh_table *neigh_tables[NEIGH_NR_TABLES] __read_mostly;
1497
1498 void neigh_table_init(int index, struct neigh_table *tbl)
1499 {
1500         unsigned long now = jiffies;
1501         unsigned long phsize;
1502
1503         INIT_LIST_HEAD(&tbl->parms_list);
1504         list_add(&tbl->parms.list, &tbl->parms_list);
1505         write_pnet(&tbl->parms.net, &init_net);
1506         atomic_set(&tbl->parms.refcnt, 1);
1507         tbl->parms.reachable_time =
1508                           neigh_rand_reach_time(NEIGH_VAR(&tbl->parms, BASE_REACHABLE_TIME));
1509
1510         tbl->stats = alloc_percpu(struct neigh_statistics);
1511         if (!tbl->stats)
1512                 panic("cannot create neighbour cache statistics");
1513
1514 #ifdef CONFIG_PROC_FS
1515         if (!proc_create_data(tbl->id, 0, init_net.proc_net_stat,
1516                               &neigh_stat_seq_fops, tbl))
1517                 panic("cannot create neighbour proc dir entry");
1518 #endif
1519
1520         RCU_INIT_POINTER(tbl->nht, neigh_hash_alloc(3));
1521
1522         phsize = (PNEIGH_HASHMASK + 1) * sizeof(struct pneigh_entry *);
1523         tbl->phash_buckets = kzalloc(phsize, GFP_KERNEL);
1524
1525         if (!tbl->nht || !tbl->phash_buckets)
1526                 panic("cannot allocate neighbour cache hashes");
1527
1528         if (!tbl->entry_size)
1529                 tbl->entry_size = ALIGN(offsetof(struct neighbour, primary_key) +
1530                                         tbl->key_len, NEIGH_PRIV_ALIGN);
1531         else
1532                 WARN_ON(tbl->entry_size % NEIGH_PRIV_ALIGN);
1533
1534         rwlock_init(&tbl->lock);
1535         INIT_DEFERRABLE_WORK(&tbl->gc_work, neigh_periodic_work);
1536         queue_delayed_work(system_power_efficient_wq, &tbl->gc_work,
1537                         tbl->parms.reachable_time);
1538         setup_timer(&tbl->proxy_timer, neigh_proxy_process, (unsigned long)tbl);
1539         skb_queue_head_init_class(&tbl->proxy_queue,
1540                         &neigh_table_proxy_queue_class);
1541
1542         tbl->last_flush = now;
1543         tbl->last_rand  = now + tbl->parms.reachable_time * 20;
1544
1545         neigh_tables[index] = tbl;
1546 }
1547 EXPORT_SYMBOL(neigh_table_init);
1548
1549 int neigh_table_clear(int index, struct neigh_table *tbl)
1550 {
1551         neigh_tables[index] = NULL;
1552         /* It is not clean... Fix it to unload IPv6 module safely */
1553         cancel_delayed_work_sync(&tbl->gc_work);
1554         del_timer_sync(&tbl->proxy_timer);
1555         pneigh_queue_purge(&tbl->proxy_queue);
1556         neigh_ifdown(tbl, NULL);
1557         if (atomic_read(&tbl->entries))
1558                 pr_crit("neighbour leakage\n");
1559
1560         call_rcu(&rcu_dereference_protected(tbl->nht, 1)->rcu,
1561                  neigh_hash_free_rcu);
1562         tbl->nht = NULL;
1563
1564         kfree(tbl->phash_buckets);
1565         tbl->phash_buckets = NULL;
1566
1567         remove_proc_entry(tbl->id, init_net.proc_net_stat);
1568
1569         free_percpu(tbl->stats);
1570         tbl->stats = NULL;
1571
1572         return 0;
1573 }
1574 EXPORT_SYMBOL(neigh_table_clear);
1575
1576 static struct neigh_table *neigh_find_table(int family)
1577 {
1578         struct neigh_table *tbl = NULL;
1579
1580         switch (family) {
1581         case AF_INET:
1582                 tbl = neigh_tables[NEIGH_ARP_TABLE];
1583                 break;
1584         case AF_INET6:
1585                 tbl = neigh_tables[NEIGH_ND_TABLE];
1586                 break;
1587         case AF_DECnet:
1588                 tbl = neigh_tables[NEIGH_DN_TABLE];
1589                 break;
1590         }
1591
1592         return tbl;
1593 }
1594
1595 static int neigh_delete(struct sk_buff *skb, struct nlmsghdr *nlh)
1596 {
1597         struct net *net = sock_net(skb->sk);
1598         struct ndmsg *ndm;
1599         struct nlattr *dst_attr;
1600         struct neigh_table *tbl;
1601         struct neighbour *neigh;
1602         struct net_device *dev = NULL;
1603         int err = -EINVAL;
1604
1605         ASSERT_RTNL();
1606         if (nlmsg_len(nlh) < sizeof(*ndm))
1607                 goto out;
1608
1609         dst_attr = nlmsg_find_attr(nlh, sizeof(*ndm), NDA_DST);
1610         if (dst_attr == NULL)
1611                 goto out;
1612
1613         ndm = nlmsg_data(nlh);
1614         if (ndm->ndm_ifindex) {
1615                 dev = __dev_get_by_index(net, ndm->ndm_ifindex);
1616                 if (dev == NULL) {
1617                         err = -ENODEV;
1618                         goto out;
1619                 }
1620         }
1621
1622         tbl = neigh_find_table(ndm->ndm_family);
1623         if (tbl == NULL)
1624                 return -EAFNOSUPPORT;
1625
1626         if (nla_len(dst_attr) < tbl->key_len)
1627                 goto out;
1628
1629         if (ndm->ndm_flags & NTF_PROXY) {
1630                 err = pneigh_delete(tbl, net, nla_data(dst_attr), dev);
1631                 goto out;
1632         }
1633
1634         if (dev == NULL)
1635                 goto out;
1636
1637         neigh = neigh_lookup(tbl, nla_data(dst_attr), dev);
1638         if (neigh == NULL) {
1639                 err = -ENOENT;
1640                 goto out;
1641         }
1642
1643         err = neigh_update(neigh, NULL, NUD_FAILED,
1644                            NEIGH_UPDATE_F_OVERRIDE |
1645                            NEIGH_UPDATE_F_ADMIN);
1646         neigh_release(neigh);
1647
1648 out:
1649         return err;
1650 }
1651
1652 static int neigh_add(struct sk_buff *skb, struct nlmsghdr *nlh)
1653 {
1654         int flags = NEIGH_UPDATE_F_ADMIN | NEIGH_UPDATE_F_OVERRIDE;
1655         struct net *net = sock_net(skb->sk);
1656         struct ndmsg *ndm;
1657         struct nlattr *tb[NDA_MAX+1];
1658         struct neigh_table *tbl;
1659         struct net_device *dev = NULL;
1660         struct neighbour *neigh;
1661         void *dst, *lladdr;
1662         int err;
1663
1664         ASSERT_RTNL();
1665         err = nlmsg_parse(nlh, sizeof(*ndm), tb, NDA_MAX, NULL);
1666         if (err < 0)
1667                 goto out;
1668
1669         err = -EINVAL;
1670         if (tb[NDA_DST] == NULL)
1671                 goto out;
1672
1673         ndm = nlmsg_data(nlh);
1674         if (ndm->ndm_ifindex) {
1675                 dev = __dev_get_by_index(net, ndm->ndm_ifindex);
1676                 if (dev == NULL) {
1677                         err = -ENODEV;
1678                         goto out;
1679                 }
1680
1681                 if (tb[NDA_LLADDR] && nla_len(tb[NDA_LLADDR]) < dev->addr_len)
1682                         goto out;
1683         }
1684
1685         tbl = neigh_find_table(ndm->ndm_family);
1686         if (tbl == NULL)
1687                 return -EAFNOSUPPORT;
1688
1689         if (nla_len(tb[NDA_DST]) < tbl->key_len)
1690                 goto out;
1691         dst = nla_data(tb[NDA_DST]);
1692         lladdr = tb[NDA_LLADDR] ? nla_data(tb[NDA_LLADDR]) : NULL;
1693
1694         if (ndm->ndm_flags & NTF_PROXY) {
1695                 struct pneigh_entry *pn;
1696
1697                 err = -ENOBUFS;
1698                 pn = pneigh_lookup(tbl, net, dst, dev, 1);
1699                 if (pn) {
1700                         pn->flags = ndm->ndm_flags;
1701                         err = 0;
1702                 }
1703                 goto out;
1704         }
1705
1706         if (dev == NULL)
1707                 goto out;
1708
1709         neigh = neigh_lookup(tbl, dst, dev);
1710         if (neigh == NULL) {
1711                 if (!(nlh->nlmsg_flags & NLM_F_CREATE)) {
1712                         err = -ENOENT;
1713                         goto out;
1714                 }
1715
1716                 neigh = __neigh_lookup_errno(tbl, dst, dev);
1717                 if (IS_ERR(neigh)) {
1718                         err = PTR_ERR(neigh);
1719                         goto out;
1720                 }
1721         } else {
1722                 if (nlh->nlmsg_flags & NLM_F_EXCL) {
1723                         err = -EEXIST;
1724                         neigh_release(neigh);
1725                         goto out;
1726                 }
1727
1728                 if (!(nlh->nlmsg_flags & NLM_F_REPLACE))
1729                         flags &= ~NEIGH_UPDATE_F_OVERRIDE;
1730         }
1731
1732         if (ndm->ndm_flags & NTF_USE) {
1733                 neigh_event_send(neigh, NULL);
1734                 err = 0;
1735         } else
1736                 err = neigh_update(neigh, lladdr, ndm->ndm_state, flags);
1737         neigh_release(neigh);
1738
1739 out:
1740         return err;
1741 }
1742
1743 static int neightbl_fill_parms(struct sk_buff *skb, struct neigh_parms *parms)
1744 {
1745         struct nlattr *nest;
1746
1747         nest = nla_nest_start(skb, NDTA_PARMS);
1748         if (nest == NULL)
1749                 return -ENOBUFS;
1750
1751         if ((parms->dev &&
1752              nla_put_u32(skb, NDTPA_IFINDEX, parms->dev->ifindex)) ||
1753             nla_put_u32(skb, NDTPA_REFCNT, atomic_read(&parms->refcnt)) ||
1754             nla_put_u32(skb, NDTPA_QUEUE_LENBYTES,
1755                         NEIGH_VAR(parms, QUEUE_LEN_BYTES)) ||
1756             /* approximative value for deprecated QUEUE_LEN (in packets) */
1757             nla_put_u32(skb, NDTPA_QUEUE_LEN,
1758                         NEIGH_VAR(parms, QUEUE_LEN_BYTES) / SKB_TRUESIZE(ETH_FRAME_LEN)) ||
1759             nla_put_u32(skb, NDTPA_PROXY_QLEN, NEIGH_VAR(parms, PROXY_QLEN)) ||
1760             nla_put_u32(skb, NDTPA_APP_PROBES, NEIGH_VAR(parms, APP_PROBES)) ||
1761             nla_put_u32(skb, NDTPA_UCAST_PROBES,
1762                         NEIGH_VAR(parms, UCAST_PROBES)) ||
1763             nla_put_u32(skb, NDTPA_MCAST_PROBES,
1764                         NEIGH_VAR(parms, MCAST_PROBES)) ||
1765             nla_put_u32(skb, NDTPA_MCAST_REPROBES,
1766                         NEIGH_VAR(parms, MCAST_REPROBES)) ||
1767             nla_put_msecs(skb, NDTPA_REACHABLE_TIME, parms->reachable_time) ||
1768             nla_put_msecs(skb, NDTPA_BASE_REACHABLE_TIME,
1769                           NEIGH_VAR(parms, BASE_REACHABLE_TIME)) ||
1770             nla_put_msecs(skb, NDTPA_GC_STALETIME,
1771                           NEIGH_VAR(parms, GC_STALETIME)) ||
1772             nla_put_msecs(skb, NDTPA_DELAY_PROBE_TIME,
1773                           NEIGH_VAR(parms, DELAY_PROBE_TIME)) ||
1774             nla_put_msecs(skb, NDTPA_RETRANS_TIME,
1775                           NEIGH_VAR(parms, RETRANS_TIME)) ||
1776             nla_put_msecs(skb, NDTPA_ANYCAST_DELAY,
1777                           NEIGH_VAR(parms, ANYCAST_DELAY)) ||
1778             nla_put_msecs(skb, NDTPA_PROXY_DELAY,
1779                           NEIGH_VAR(parms, PROXY_DELAY)) ||
1780             nla_put_msecs(skb, NDTPA_LOCKTIME,
1781                           NEIGH_VAR(parms, LOCKTIME)))
1782                 goto nla_put_failure;
1783         return nla_nest_end(skb, nest);
1784
1785 nla_put_failure:
1786         nla_nest_cancel(skb, nest);
1787         return -EMSGSIZE;
1788 }
1789
1790 static int neightbl_fill_info(struct sk_buff *skb, struct neigh_table *tbl,
1791                               u32 pid, u32 seq, int type, int flags)
1792 {
1793         struct nlmsghdr *nlh;
1794         struct ndtmsg *ndtmsg;
1795
1796         nlh = nlmsg_put(skb, pid, seq, type, sizeof(*ndtmsg), flags);
1797         if (nlh == NULL)
1798                 return -EMSGSIZE;
1799
1800         ndtmsg = nlmsg_data(nlh);
1801
1802         read_lock_bh(&tbl->lock);
1803         ndtmsg->ndtm_family = tbl->family;
1804         ndtmsg->ndtm_pad1   = 0;
1805         ndtmsg->ndtm_pad2   = 0;
1806
1807         if (nla_put_string(skb, NDTA_NAME, tbl->id) ||
1808             nla_put_msecs(skb, NDTA_GC_INTERVAL, tbl->gc_interval) ||
1809             nla_put_u32(skb, NDTA_THRESH1, tbl->gc_thresh1) ||
1810             nla_put_u32(skb, NDTA_THRESH2, tbl->gc_thresh2) ||
1811             nla_put_u32(skb, NDTA_THRESH3, tbl->gc_thresh3))
1812                 goto nla_put_failure;
1813         {
1814                 unsigned long now = jiffies;
1815                 unsigned int flush_delta = now - tbl->last_flush;
1816                 unsigned int rand_delta = now - tbl->last_rand;
1817                 struct neigh_hash_table *nht;
1818                 struct ndt_config ndc = {
1819                         .ndtc_key_len           = tbl->key_len,
1820                         .ndtc_entry_size        = tbl->entry_size,
1821                         .ndtc_entries           = atomic_read(&tbl->entries),
1822                         .ndtc_last_flush        = jiffies_to_msecs(flush_delta),
1823                         .ndtc_last_rand         = jiffies_to_msecs(rand_delta),
1824                         .ndtc_proxy_qlen        = tbl->proxy_queue.qlen,
1825                 };
1826
1827                 rcu_read_lock_bh();
1828                 nht = rcu_dereference_bh(tbl->nht);
1829                 ndc.ndtc_hash_rnd = nht->hash_rnd[0];
1830                 ndc.ndtc_hash_mask = ((1 << nht->hash_shift) - 1);
1831                 rcu_read_unlock_bh();
1832
1833                 if (nla_put(skb, NDTA_CONFIG, sizeof(ndc), &ndc))
1834                         goto nla_put_failure;
1835         }
1836
1837         {
1838                 int cpu;
1839                 struct ndt_stats ndst;
1840
1841                 memset(&ndst, 0, sizeof(ndst));
1842
1843                 for_each_possible_cpu(cpu) {
1844                         struct neigh_statistics *st;
1845
1846                         st = per_cpu_ptr(tbl->stats, cpu);
1847                         ndst.ndts_allocs                += st->allocs;
1848                         ndst.ndts_destroys              += st->destroys;
1849                         ndst.ndts_hash_grows            += st->hash_grows;
1850                         ndst.ndts_res_failed            += st->res_failed;
1851                         ndst.ndts_lookups               += st->lookups;
1852                         ndst.ndts_hits                  += st->hits;
1853                         ndst.ndts_rcv_probes_mcast      += st->rcv_probes_mcast;
1854                         ndst.ndts_rcv_probes_ucast      += st->rcv_probes_ucast;
1855                         ndst.ndts_periodic_gc_runs      += st->periodic_gc_runs;
1856                         ndst.ndts_forced_gc_runs        += st->forced_gc_runs;
1857                         ndst.ndts_table_fulls           += st->table_fulls;
1858                 }
1859
1860                 if (nla_put(skb, NDTA_STATS, sizeof(ndst), &ndst))
1861                         goto nla_put_failure;
1862         }
1863
1864         BUG_ON(tbl->parms.dev);
1865         if (neightbl_fill_parms(skb, &tbl->parms) < 0)
1866                 goto nla_put_failure;
1867
1868         read_unlock_bh(&tbl->lock);
1869         nlmsg_end(skb, nlh);
1870         return 0;
1871
1872 nla_put_failure:
1873         read_unlock_bh(&tbl->lock);
1874         nlmsg_cancel(skb, nlh);
1875         return -EMSGSIZE;
1876 }
1877
1878 static int neightbl_fill_param_info(struct sk_buff *skb,
1879                                     struct neigh_table *tbl,
1880                                     struct neigh_parms *parms,
1881                                     u32 pid, u32 seq, int type,
1882                                     unsigned int flags)
1883 {
1884         struct ndtmsg *ndtmsg;
1885         struct nlmsghdr *nlh;
1886
1887         nlh = nlmsg_put(skb, pid, seq, type, sizeof(*ndtmsg), flags);
1888         if (nlh == NULL)
1889                 return -EMSGSIZE;
1890
1891         ndtmsg = nlmsg_data(nlh);
1892
1893         read_lock_bh(&tbl->lock);
1894         ndtmsg->ndtm_family = tbl->family;
1895         ndtmsg->ndtm_pad1   = 0;
1896         ndtmsg->ndtm_pad2   = 0;
1897
1898         if (nla_put_string(skb, NDTA_NAME, tbl->id) < 0 ||
1899             neightbl_fill_parms(skb, parms) < 0)
1900                 goto errout;
1901
1902         read_unlock_bh(&tbl->lock);
1903         nlmsg_end(skb, nlh);
1904         return 0;
1905 errout:
1906         read_unlock_bh(&tbl->lock);
1907         nlmsg_cancel(skb, nlh);
1908         return -EMSGSIZE;
1909 }
1910
1911 static const struct nla_policy nl_neightbl_policy[NDTA_MAX+1] = {
1912         [NDTA_NAME]             = { .type = NLA_STRING },
1913         [NDTA_THRESH1]          = { .type = NLA_U32 },
1914         [NDTA_THRESH2]          = { .type = NLA_U32 },
1915         [NDTA_THRESH3]          = { .type = NLA_U32 },
1916         [NDTA_GC_INTERVAL]      = { .type = NLA_U64 },
1917         [NDTA_PARMS]            = { .type = NLA_NESTED },
1918 };
1919
1920 static const struct nla_policy nl_ntbl_parm_policy[NDTPA_MAX+1] = {
1921         [NDTPA_IFINDEX]                 = { .type = NLA_U32 },
1922         [NDTPA_QUEUE_LEN]               = { .type = NLA_U32 },
1923         [NDTPA_PROXY_QLEN]              = { .type = NLA_U32 },
1924         [NDTPA_APP_PROBES]              = { .type = NLA_U32 },
1925         [NDTPA_UCAST_PROBES]            = { .type = NLA_U32 },
1926         [NDTPA_MCAST_PROBES]            = { .type = NLA_U32 },
1927         [NDTPA_MCAST_REPROBES]          = { .type = NLA_U32 },
1928         [NDTPA_BASE_REACHABLE_TIME]     = { .type = NLA_U64 },
1929         [NDTPA_GC_STALETIME]            = { .type = NLA_U64 },
1930         [NDTPA_DELAY_PROBE_TIME]        = { .type = NLA_U64 },
1931         [NDTPA_RETRANS_TIME]            = { .type = NLA_U64 },
1932         [NDTPA_ANYCAST_DELAY]           = { .type = NLA_U64 },
1933         [NDTPA_PROXY_DELAY]             = { .type = NLA_U64 },
1934         [NDTPA_LOCKTIME]                = { .type = NLA_U64 },
1935 };
1936
1937 static int neightbl_set(struct sk_buff *skb, struct nlmsghdr *nlh)
1938 {
1939         struct net *net = sock_net(skb->sk);
1940         struct neigh_table *tbl;
1941         struct ndtmsg *ndtmsg;
1942         struct nlattr *tb[NDTA_MAX+1];
1943         bool found = false;
1944         int err, tidx;
1945
1946         err = nlmsg_parse(nlh, sizeof(*ndtmsg), tb, NDTA_MAX,
1947                           nl_neightbl_policy);
1948         if (err < 0)
1949                 goto errout;
1950
1951         if (tb[NDTA_NAME] == NULL) {
1952                 err = -EINVAL;
1953                 goto errout;
1954         }
1955
1956         ndtmsg = nlmsg_data(nlh);
1957
1958         for (tidx = 0; tidx < NEIGH_NR_TABLES; tidx++) {
1959                 tbl = neigh_tables[tidx];
1960                 if (!tbl)
1961                         continue;
1962                 if (ndtmsg->ndtm_family && tbl->family != ndtmsg->ndtm_family)
1963                         continue;
1964                 if (nla_strcmp(tb[NDTA_NAME], tbl->id) == 0) {
1965                         found = true;
1966                         break;
1967                 }
1968         }
1969
1970         if (!found)
1971                 return -ENOENT;
1972
1973         /*
1974          * We acquire tbl->lock to be nice to the periodic timers and
1975          * make sure they always see a consistent set of values.
1976          */
1977         write_lock_bh(&tbl->lock);
1978
1979         if (tb[NDTA_PARMS]) {
1980                 struct nlattr *tbp[NDTPA_MAX+1];
1981                 struct neigh_parms *p;
1982                 int i, ifindex = 0;
1983
1984                 err = nla_parse_nested(tbp, NDTPA_MAX, tb[NDTA_PARMS],
1985                                        nl_ntbl_parm_policy);
1986                 if (err < 0)
1987                         goto errout_tbl_lock;
1988
1989                 if (tbp[NDTPA_IFINDEX])
1990                         ifindex = nla_get_u32(tbp[NDTPA_IFINDEX]);
1991
1992                 p = lookup_neigh_parms(tbl, net, ifindex);
1993                 if (p == NULL) {
1994                         err = -ENOENT;
1995                         goto errout_tbl_lock;
1996                 }
1997
1998                 for (i = 1; i <= NDTPA_MAX; i++) {
1999                         if (tbp[i] == NULL)
2000                                 continue;
2001
2002                         switch (i) {
2003                         case NDTPA_QUEUE_LEN:
2004                                 NEIGH_VAR_SET(p, QUEUE_LEN_BYTES,
2005                                               nla_get_u32(tbp[i]) *
2006                                               SKB_TRUESIZE(ETH_FRAME_LEN));
2007                                 break;
2008                         case NDTPA_QUEUE_LENBYTES:
2009                                 NEIGH_VAR_SET(p, QUEUE_LEN_BYTES,
2010                                               nla_get_u32(tbp[i]));
2011                                 break;
2012                         case NDTPA_PROXY_QLEN:
2013                                 NEIGH_VAR_SET(p, PROXY_QLEN,
2014                                               nla_get_u32(tbp[i]));
2015                                 break;
2016                         case NDTPA_APP_PROBES:
2017                                 NEIGH_VAR_SET(p, APP_PROBES,
2018                                               nla_get_u32(tbp[i]));
2019                                 break;
2020                         case NDTPA_UCAST_PROBES:
2021                                 NEIGH_VAR_SET(p, UCAST_PROBES,
2022                                               nla_get_u32(tbp[i]));
2023                                 break;
2024                         case NDTPA_MCAST_PROBES:
2025                                 NEIGH_VAR_SET(p, MCAST_PROBES,
2026                                               nla_get_u32(tbp[i]));
2027                                 break;
2028                         case NDTPA_MCAST_REPROBES:
2029                                 NEIGH_VAR_SET(p, MCAST_REPROBES,
2030                                               nla_get_u32(tbp[i]));
2031                                 break;
2032                         case NDTPA_BASE_REACHABLE_TIME:
2033                                 NEIGH_VAR_SET(p, BASE_REACHABLE_TIME,
2034                                               nla_get_msecs(tbp[i]));
2035                                 /* update reachable_time as well, otherwise, the change will
2036                                  * only be effective after the next time neigh_periodic_work
2037                                  * decides to recompute it (can be multiple minutes)
2038                                  */
2039                                 p->reachable_time =
2040                                         neigh_rand_reach_time(NEIGH_VAR(p, BASE_REACHABLE_TIME));
2041                                 break;
2042                         case NDTPA_GC_STALETIME:
2043                                 NEIGH_VAR_SET(p, GC_STALETIME,
2044                                               nla_get_msecs(tbp[i]));
2045                                 break;
2046                         case NDTPA_DELAY_PROBE_TIME:
2047                                 NEIGH_VAR_SET(p, DELAY_PROBE_TIME,
2048                                               nla_get_msecs(tbp[i]));
2049                                 break;
2050                         case NDTPA_RETRANS_TIME:
2051                                 NEIGH_VAR_SET(p, RETRANS_TIME,
2052                                               nla_get_msecs(tbp[i]));
2053                                 break;
2054                         case NDTPA_ANYCAST_DELAY:
2055                                 NEIGH_VAR_SET(p, ANYCAST_DELAY,
2056                                               nla_get_msecs(tbp[i]));
2057                                 break;
2058                         case NDTPA_PROXY_DELAY:
2059                                 NEIGH_VAR_SET(p, PROXY_DELAY,
2060                                               nla_get_msecs(tbp[i]));
2061                                 break;
2062                         case NDTPA_LOCKTIME:
2063                                 NEIGH_VAR_SET(p, LOCKTIME,
2064                                               nla_get_msecs(tbp[i]));
2065                                 break;
2066                         }
2067                 }
2068         }
2069
2070         err = -ENOENT;
2071         if ((tb[NDTA_THRESH1] || tb[NDTA_THRESH2] ||
2072              tb[NDTA_THRESH3] || tb[NDTA_GC_INTERVAL]) &&
2073             !net_eq(net, &init_net))
2074                 goto errout_tbl_lock;
2075
2076         if (tb[NDTA_THRESH1])
2077                 tbl->gc_thresh1 = nla_get_u32(tb[NDTA_THRESH1]);
2078
2079         if (tb[NDTA_THRESH2])
2080                 tbl->gc_thresh2 = nla_get_u32(tb[NDTA_THRESH2]);
2081
2082         if (tb[NDTA_THRESH3])
2083                 tbl->gc_thresh3 = nla_get_u32(tb[NDTA_THRESH3]);
2084
2085         if (tb[NDTA_GC_INTERVAL])
2086                 tbl->gc_interval = nla_get_msecs(tb[NDTA_GC_INTERVAL]);
2087
2088         err = 0;
2089
2090 errout_tbl_lock:
2091         write_unlock_bh(&tbl->lock);
2092 errout:
2093         return err;
2094 }
2095
2096 static int neightbl_dump_info(struct sk_buff *skb, struct netlink_callback *cb)
2097 {
2098         struct net *net = sock_net(skb->sk);
2099         int family, tidx, nidx = 0;
2100         int tbl_skip = cb->args[0];
2101         int neigh_skip = cb->args[1];
2102         struct neigh_table *tbl;
2103
2104         family = ((struct rtgenmsg *) nlmsg_data(cb->nlh))->rtgen_family;
2105
2106         for (tidx = 0; tidx < NEIGH_NR_TABLES; tidx++) {
2107                 struct neigh_parms *p;
2108
2109                 tbl = neigh_tables[tidx];
2110                 if (!tbl)
2111                         continue;
2112
2113                 if (tidx < tbl_skip || (family && tbl->family != family))
2114                         continue;
2115
2116                 if (neightbl_fill_info(skb, tbl, NETLINK_CB(cb->skb).portid,
2117                                        cb->nlh->nlmsg_seq, RTM_NEWNEIGHTBL,
2118                                        NLM_F_MULTI) < 0)
2119                         break;
2120
2121                 nidx = 0;
2122                 p = list_next_entry(&tbl->parms, list);
2123                 list_for_each_entry_from(p, &tbl->parms_list, list) {
2124                         if (!net_eq(neigh_parms_net(p), net))
2125                                 continue;
2126
2127                         if (nidx < neigh_skip)
2128                                 goto next;
2129
2130                         if (neightbl_fill_param_info(skb, tbl, p,
2131                                                      NETLINK_CB(cb->skb).portid,
2132                                                      cb->nlh->nlmsg_seq,
2133                                                      RTM_NEWNEIGHTBL,
2134                                                      NLM_F_MULTI) < 0)
2135                                 goto out;
2136                 next:
2137                         nidx++;
2138                 }
2139
2140                 neigh_skip = 0;
2141         }
2142 out:
2143         cb->args[0] = tidx;
2144         cb->args[1] = nidx;
2145
2146         return skb->len;
2147 }
2148
2149 static int neigh_fill_info(struct sk_buff *skb, struct neighbour *neigh,
2150                            u32 pid, u32 seq, int type, unsigned int flags)
2151 {
2152         unsigned long now = jiffies;
2153         struct nda_cacheinfo ci;
2154         struct nlmsghdr *nlh;
2155         struct ndmsg *ndm;
2156
2157         nlh = nlmsg_put(skb, pid, seq, type, sizeof(*ndm), flags);
2158         if (nlh == NULL)
2159                 return -EMSGSIZE;
2160
2161         ndm = nlmsg_data(nlh);
2162         ndm->ndm_family  = neigh->ops->family;
2163         ndm->ndm_pad1    = 0;
2164         ndm->ndm_pad2    = 0;
2165         ndm->ndm_flags   = neigh->flags;
2166         ndm->ndm_type    = neigh->type;
2167         ndm->ndm_ifindex = neigh->dev->ifindex;
2168
2169         if (nla_put(skb, NDA_DST, neigh->tbl->key_len, neigh->primary_key))
2170                 goto nla_put_failure;
2171
2172         read_lock_bh(&neigh->lock);
2173         ndm->ndm_state   = neigh->nud_state;
2174         if (neigh->nud_state & NUD_VALID) {
2175                 char haddr[MAX_ADDR_LEN];
2176
2177                 neigh_ha_snapshot(haddr, neigh, neigh->dev);
2178                 if (nla_put(skb, NDA_LLADDR, neigh->dev->addr_len, haddr) < 0) {
2179                         read_unlock_bh(&neigh->lock);
2180                         goto nla_put_failure;
2181                 }
2182         }
2183
2184         ci.ndm_used      = jiffies_to_clock_t(now - neigh->used);
2185         ci.ndm_confirmed = jiffies_to_clock_t(now - neigh->confirmed);
2186         ci.ndm_updated   = jiffies_to_clock_t(now - neigh->updated);
2187         ci.ndm_refcnt    = atomic_read(&neigh->refcnt) - 1;
2188         read_unlock_bh(&neigh->lock);
2189
2190         if (nla_put_u32(skb, NDA_PROBES, atomic_read(&neigh->probes)) ||
2191             nla_put(skb, NDA_CACHEINFO, sizeof(ci), &ci))
2192                 goto nla_put_failure;
2193
2194         nlmsg_end(skb, nlh);
2195         return 0;
2196
2197 nla_put_failure:
2198         nlmsg_cancel(skb, nlh);
2199         return -EMSGSIZE;
2200 }
2201
2202 static int pneigh_fill_info(struct sk_buff *skb, struct pneigh_entry *pn,
2203                             u32 pid, u32 seq, int type, unsigned int flags,
2204                             struct neigh_table *tbl)
2205 {
2206         struct nlmsghdr *nlh;
2207         struct ndmsg *ndm;
2208
2209         nlh = nlmsg_put(skb, pid, seq, type, sizeof(*ndm), flags);
2210         if (nlh == NULL)
2211                 return -EMSGSIZE;
2212
2213         ndm = nlmsg_data(nlh);
2214         ndm->ndm_family  = tbl->family;
2215         ndm->ndm_pad1    = 0;
2216         ndm->ndm_pad2    = 0;
2217         ndm->ndm_flags   = pn->flags | NTF_PROXY;
2218         ndm->ndm_type    = RTN_UNICAST;
2219         ndm->ndm_ifindex = pn->dev ? pn->dev->ifindex : 0;
2220         ndm->ndm_state   = NUD_NONE;
2221
2222         if (nla_put(skb, NDA_DST, tbl->key_len, pn->key))
2223                 goto nla_put_failure;
2224
2225         nlmsg_end(skb, nlh);
2226         return 0;
2227
2228 nla_put_failure:
2229         nlmsg_cancel(skb, nlh);
2230         return -EMSGSIZE;
2231 }
2232
2233 static void neigh_update_notify(struct neighbour *neigh)
2234 {
2235         call_netevent_notifiers(NETEVENT_NEIGH_UPDATE, neigh);
2236         __neigh_notify(neigh, RTM_NEWNEIGH, 0);
2237 }
2238
2239 static bool neigh_master_filtered(struct net_device *dev, int master_idx)
2240 {
2241         struct net_device *master;
2242
2243         if (!master_idx)
2244                 return false;
2245
2246         master = netdev_master_upper_dev_get(dev);
2247         if (!master || master->ifindex != master_idx)
2248                 return true;
2249
2250         return false;
2251 }
2252
2253 static bool neigh_ifindex_filtered(struct net_device *dev, int filter_idx)
2254 {
2255         if (filter_idx && dev->ifindex != filter_idx)
2256                 return true;
2257
2258         return false;
2259 }
2260
2261 static int neigh_dump_table(struct neigh_table *tbl, struct sk_buff *skb,
2262                             struct netlink_callback *cb)
2263 {
2264         struct net *net = sock_net(skb->sk);
2265         const struct nlmsghdr *nlh = cb->nlh;
2266         struct nlattr *tb[NDA_MAX + 1];
2267         struct neighbour *n;
2268         int rc, h, s_h = cb->args[1];
2269         int idx, s_idx = idx = cb->args[2];
2270         struct neigh_hash_table *nht;
2271         int filter_master_idx = 0, filter_idx = 0;
2272         unsigned int flags = NLM_F_MULTI;
2273         int err;
2274
2275         err = nlmsg_parse(nlh, sizeof(struct ndmsg), tb, NDA_MAX, NULL);
2276         if (!err) {
2277                 if (tb[NDA_IFINDEX])
2278                         filter_idx = nla_get_u32(tb[NDA_IFINDEX]);
2279
2280                 if (tb[NDA_MASTER])
2281                         filter_master_idx = nla_get_u32(tb[NDA_MASTER]);
2282
2283                 if (filter_idx || filter_master_idx)
2284                         flags |= NLM_F_DUMP_FILTERED;
2285         }
2286
2287         rcu_read_lock_bh();
2288         nht = rcu_dereference_bh(tbl->nht);
2289
2290         for (h = s_h; h < (1 << nht->hash_shift); h++) {
2291                 if (h > s_h)
2292                         s_idx = 0;
2293                 for (n = rcu_dereference_bh(nht->hash_buckets[h]), idx = 0;
2294                      n != NULL;
2295                      n = rcu_dereference_bh(n->next)) {
2296                         if (!net_eq(dev_net(n->dev), net))
2297                                 continue;
2298                         if (neigh_ifindex_filtered(n->dev, filter_idx))
2299                                 continue;
2300                         if (neigh_master_filtered(n->dev, filter_master_idx))
2301                                 continue;
2302                         if (idx < s_idx)
2303                                 goto next;
2304                         if (neigh_fill_info(skb, n, NETLINK_CB(cb->skb).portid,
2305                                             cb->nlh->nlmsg_seq,
2306                                             RTM_NEWNEIGH,
2307                                             flags) < 0) {
2308                                 rc = -1;
2309                                 goto out;
2310                         }
2311 next:
2312                         idx++;
2313                 }
2314         }
2315         rc = skb->len;
2316 out:
2317         rcu_read_unlock_bh();
2318         cb->args[1] = h;
2319         cb->args[2] = idx;
2320         return rc;
2321 }
2322
2323 static int pneigh_dump_table(struct neigh_table *tbl, struct sk_buff *skb,
2324                              struct netlink_callback *cb)
2325 {
2326         struct pneigh_entry *n;
2327         struct net *net = sock_net(skb->sk);
2328         int rc, h, s_h = cb->args[3];
2329         int idx, s_idx = idx = cb->args[4];
2330
2331         read_lock_bh(&tbl->lock);
2332
2333         for (h = s_h; h <= PNEIGH_HASHMASK; h++) {
2334                 if (h > s_h)
2335                         s_idx = 0;
2336                 for (n = tbl->phash_buckets[h], idx = 0; n; n = n->next) {
2337                         if (pneigh_net(n) != net)
2338                                 continue;
2339                         if (idx < s_idx)
2340                                 goto next;
2341                         if (pneigh_fill_info(skb, n, NETLINK_CB(cb->skb).portid,
2342                                             cb->nlh->nlmsg_seq,
2343                                             RTM_NEWNEIGH,
2344                                             NLM_F_MULTI, tbl) < 0) {
2345                                 read_unlock_bh(&tbl->lock);
2346                                 rc = -1;
2347                                 goto out;
2348                         }
2349                 next:
2350                         idx++;
2351                 }
2352         }
2353
2354         read_unlock_bh(&tbl->lock);
2355         rc = skb->len;
2356 out:
2357         cb->args[3] = h;
2358         cb->args[4] = idx;
2359         return rc;
2360
2361 }
2362
2363 static int neigh_dump_info(struct sk_buff *skb, struct netlink_callback *cb)
2364 {
2365         struct neigh_table *tbl;
2366         int t, family, s_t;
2367         int proxy = 0;
2368         int err;
2369
2370         family = ((struct rtgenmsg *) nlmsg_data(cb->nlh))->rtgen_family;
2371
2372         /* check for full ndmsg structure presence, family member is
2373          * the same for both structures
2374          */
2375         if (nlmsg_len(cb->nlh) >= sizeof(struct ndmsg) &&
2376             ((struct ndmsg *) nlmsg_data(cb->nlh))->ndm_flags == NTF_PROXY)
2377                 proxy = 1;
2378
2379         s_t = cb->args[0];
2380
2381         for (t = 0; t < NEIGH_NR_TABLES; t++) {
2382                 tbl = neigh_tables[t];
2383
2384                 if (!tbl)
2385                         continue;
2386                 if (t < s_t || (family && tbl->family != family))
2387                         continue;
2388                 if (t > s_t)
2389                         memset(&cb->args[1], 0, sizeof(cb->args) -
2390                                                 sizeof(cb->args[0]));
2391                 if (proxy)
2392                         err = pneigh_dump_table(tbl, skb, cb);
2393                 else
2394                         err = neigh_dump_table(tbl, skb, cb);
2395                 if (err < 0)
2396                         break;
2397         }
2398
2399         cb->args[0] = t;
2400         return skb->len;
2401 }
2402
2403 void neigh_for_each(struct neigh_table *tbl, void (*cb)(struct neighbour *, void *), void *cookie)
2404 {
2405         int chain;
2406         struct neigh_hash_table *nht;
2407
2408         rcu_read_lock_bh();
2409         nht = rcu_dereference_bh(tbl->nht);
2410
2411         read_lock(&tbl->lock); /* avoid resizes */
2412         for (chain = 0; chain < (1 << nht->hash_shift); chain++) {
2413                 struct neighbour *n;
2414
2415                 for (n = rcu_dereference_bh(nht->hash_buckets[chain]);
2416                      n != NULL;
2417                      n = rcu_dereference_bh(n->next))
2418                         cb(n, cookie);
2419         }
2420         read_unlock(&tbl->lock);
2421         rcu_read_unlock_bh();
2422 }
2423 EXPORT_SYMBOL(neigh_for_each);
2424
2425 /* The tbl->lock must be held as a writer and BH disabled. */
2426 void __neigh_for_each_release(struct neigh_table *tbl,
2427                               int (*cb)(struct neighbour *))
2428 {
2429         int chain;
2430         struct neigh_hash_table *nht;
2431
2432         nht = rcu_dereference_protected(tbl->nht,
2433                                         lockdep_is_held(&tbl->lock));
2434         for (chain = 0; chain < (1 << nht->hash_shift); chain++) {
2435                 struct neighbour *n;
2436                 struct neighbour __rcu **np;
2437
2438                 np = &nht->hash_buckets[chain];
2439                 while ((n = rcu_dereference_protected(*np,
2440                                         lockdep_is_held(&tbl->lock))) != NULL) {
2441                         int release;
2442
2443                         write_lock(&n->lock);
2444                         release = cb(n);
2445                         if (release) {
2446                                 rcu_assign_pointer(*np,
2447                                         rcu_dereference_protected(n->next,
2448                                                 lockdep_is_held(&tbl->lock)));
2449                                 n->dead = 1;
2450                         } else
2451                                 np = &n->next;
2452                         write_unlock(&n->lock);
2453                         if (release)
2454                                 neigh_cleanup_and_release(n);
2455                 }
2456         }
2457 }
2458 EXPORT_SYMBOL(__neigh_for_each_release);
2459
2460 int neigh_xmit(int index, struct net_device *dev,
2461                const void *addr, struct sk_buff *skb)
2462 {
2463         int err = -EAFNOSUPPORT;
2464         if (likely(index < NEIGH_NR_TABLES)) {
2465                 struct neigh_table *tbl;
2466                 struct neighbour *neigh;
2467
2468                 tbl = neigh_tables[index];
2469                 if (!tbl)
2470                         goto out;
2471                 rcu_read_lock_bh();
2472                 neigh = __neigh_lookup_noref(tbl, addr, dev);
2473                 if (!neigh)
2474                         neigh = __neigh_create(tbl, addr, dev, false);
2475                 err = PTR_ERR(neigh);
2476                 if (IS_ERR(neigh)) {
2477                         rcu_read_unlock_bh();
2478                         goto out_kfree_skb;
2479                 }
2480                 err = neigh->output(neigh, skb);
2481                 rcu_read_unlock_bh();
2482         }
2483         else if (index == NEIGH_LINK_TABLE) {
2484                 err = dev_hard_header(skb, dev, ntohs(skb->protocol),
2485                                       addr, NULL, skb->len);
2486                 if (err < 0)
2487                         goto out_kfree_skb;
2488                 err = dev_queue_xmit(skb);
2489         }
2490 out:
2491         return err;
2492 out_kfree_skb:
2493         kfree_skb(skb);
2494         goto out;
2495 }
2496 EXPORT_SYMBOL(neigh_xmit);
2497
2498 #ifdef CONFIG_PROC_FS
2499
2500 static struct neighbour *neigh_get_first(struct seq_file *seq)
2501 {
2502         struct neigh_seq_state *state = seq->private;
2503         struct net *net = seq_file_net(seq);
2504         struct neigh_hash_table *nht = state->nht;
2505         struct neighbour *n = NULL;
2506         int bucket = state->bucket;
2507
2508         state->flags &= ~NEIGH_SEQ_IS_PNEIGH;
2509         for (bucket = 0; bucket < (1 << nht->hash_shift); bucket++) {
2510                 n = rcu_dereference_bh(nht->hash_buckets[bucket]);
2511
2512                 while (n) {
2513                         if (!net_eq(dev_net(n->dev), net))
2514                                 goto next;
2515                         if (state->neigh_sub_iter) {
2516                                 loff_t fakep = 0;
2517                                 void *v;
2518
2519                                 v = state->neigh_sub_iter(state, n, &fakep);
2520                                 if (!v)
2521                                         goto next;
2522                         }
2523                         if (!(state->flags & NEIGH_SEQ_SKIP_NOARP))
2524                                 break;
2525                         if (n->nud_state & ~NUD_NOARP)
2526                                 break;
2527 next:
2528                         n = rcu_dereference_bh(n->next);
2529                 }
2530
2531                 if (n)
2532                         break;
2533         }
2534         state->bucket = bucket;
2535
2536         return n;
2537 }
2538
2539 static struct neighbour *neigh_get_next(struct seq_file *seq,
2540                                         struct neighbour *n,
2541                                         loff_t *pos)
2542 {
2543         struct neigh_seq_state *state = seq->private;
2544         struct net *net = seq_file_net(seq);
2545         struct neigh_hash_table *nht = state->nht;
2546
2547         if (state->neigh_sub_iter) {
2548                 void *v = state->neigh_sub_iter(state, n, pos);
2549                 if (v)
2550                         return n;
2551         }
2552         n = rcu_dereference_bh(n->next);
2553
2554         while (1) {
2555                 while (n) {
2556                         if (!net_eq(dev_net(n->dev), net))
2557                                 goto next;
2558                         if (state->neigh_sub_iter) {
2559                                 void *v = state->neigh_sub_iter(state, n, pos);
2560                                 if (v)
2561                                         return n;
2562                                 goto next;
2563                         }
2564                         if (!(state->flags & NEIGH_SEQ_SKIP_NOARP))
2565                                 break;
2566
2567                         if (n->nud_state & ~NUD_NOARP)
2568                                 break;
2569 next:
2570                         n = rcu_dereference_bh(n->next);
2571                 }
2572
2573                 if (n)
2574                         break;
2575
2576                 if (++state->bucket >= (1 << nht->hash_shift))
2577                         break;
2578
2579                 n = rcu_dereference_bh(nht->hash_buckets[state->bucket]);
2580         }
2581
2582         if (n && pos)
2583                 --(*pos);
2584         return n;
2585 }
2586
2587 static struct neighbour *neigh_get_idx(struct seq_file *seq, loff_t *pos)
2588 {
2589         struct neighbour *n = neigh_get_first(seq);
2590
2591         if (n) {
2592                 --(*pos);
2593                 while (*pos) {
2594                         n = neigh_get_next(seq, n, pos);
2595                         if (!n)
2596                                 break;
2597                 }
2598         }
2599         return *pos ? NULL : n;
2600 }
2601
2602 static struct pneigh_entry *pneigh_get_first(struct seq_file *seq)
2603 {
2604         struct neigh_seq_state *state = seq->private;
2605         struct net *net = seq_file_net(seq);
2606         struct neigh_table *tbl = state->tbl;
2607         struct pneigh_entry *pn = NULL;
2608         int bucket = state->bucket;
2609
2610         state->flags |= NEIGH_SEQ_IS_PNEIGH;
2611         for (bucket = 0; bucket <= PNEIGH_HASHMASK; bucket++) {
2612                 pn = tbl->phash_buckets[bucket];
2613                 while (pn && !net_eq(pneigh_net(pn), net))
2614                         pn = pn->next;
2615                 if (pn)
2616                         break;
2617         }
2618         state->bucket = bucket;
2619
2620         return pn;
2621 }
2622
2623 static struct pneigh_entry *pneigh_get_next(struct seq_file *seq,
2624                                             struct pneigh_entry *pn,
2625                                             loff_t *pos)
2626 {
2627         struct neigh_seq_state *state = seq->private;
2628         struct net *net = seq_file_net(seq);
2629         struct neigh_table *tbl = state->tbl;
2630
2631         do {
2632                 pn = pn->next;
2633         } while (pn && !net_eq(pneigh_net(pn), net));
2634
2635         while (!pn) {
2636                 if (++state->bucket > PNEIGH_HASHMASK)
2637                         break;
2638                 pn = tbl->phash_buckets[state->bucket];
2639                 while (pn && !net_eq(pneigh_net(pn), net))
2640                         pn = pn->next;
2641                 if (pn)
2642                         break;
2643         }
2644
2645         if (pn && pos)
2646                 --(*pos);
2647
2648         return pn;
2649 }
2650
2651 static struct pneigh_entry *pneigh_get_idx(struct seq_file *seq, loff_t *pos)
2652 {
2653         struct pneigh_entry *pn = pneigh_get_first(seq);
2654
2655         if (pn) {
2656                 --(*pos);
2657                 while (*pos) {
2658                         pn = pneigh_get_next(seq, pn, pos);
2659                         if (!pn)
2660                                 break;
2661                 }
2662         }
2663         return *pos ? NULL : pn;
2664 }
2665
2666 static void *neigh_get_idx_any(struct seq_file *seq, loff_t *pos)
2667 {
2668         struct neigh_seq_state *state = seq->private;
2669         void *rc;
2670         loff_t idxpos = *pos;
2671
2672         rc = neigh_get_idx(seq, &idxpos);
2673         if (!rc && !(state->flags & NEIGH_SEQ_NEIGH_ONLY))
2674                 rc = pneigh_get_idx(seq, &idxpos);
2675
2676         return rc;
2677 }
2678
2679 void *neigh_seq_start(struct seq_file *seq, loff_t *pos, struct neigh_table *tbl, unsigned int neigh_seq_flags)
2680         __acquires(rcu_bh)
2681 {
2682         struct neigh_seq_state *state = seq->private;
2683
2684         state->tbl = tbl;
2685         state->bucket = 0;
2686         state->flags = (neigh_seq_flags & ~NEIGH_SEQ_IS_PNEIGH);
2687
2688         rcu_read_lock_bh();
2689         state->nht = rcu_dereference_bh(tbl->nht);
2690
2691         return *pos ? neigh_get_idx_any(seq, pos) : SEQ_START_TOKEN;
2692 }
2693 EXPORT_SYMBOL(neigh_seq_start);
2694
2695 void *neigh_seq_next(struct seq_file *seq, void *v, loff_t *pos)
2696 {
2697         struct neigh_seq_state *state;
2698         void *rc;
2699
2700         if (v == SEQ_START_TOKEN) {
2701                 rc = neigh_get_first(seq);
2702                 goto out;
2703         }
2704
2705         state = seq->private;
2706         if (!(state->flags & NEIGH_SEQ_IS_PNEIGH)) {
2707                 rc = neigh_get_next(seq, v, NULL);
2708                 if (rc)
2709                         goto out;
2710                 if (!(state->flags & NEIGH_SEQ_NEIGH_ONLY))
2711                         rc = pneigh_get_first(seq);
2712         } else {
2713                 BUG_ON(state->flags & NEIGH_SEQ_NEIGH_ONLY);
2714                 rc = pneigh_get_next(seq, v, NULL);
2715         }
2716 out:
2717         ++(*pos);
2718         return rc;
2719 }
2720 EXPORT_SYMBOL(neigh_seq_next);
2721
2722 void neigh_seq_stop(struct seq_file *seq, void *v)
2723         __releases(rcu_bh)
2724 {
2725         rcu_read_unlock_bh();
2726 }
2727 EXPORT_SYMBOL(neigh_seq_stop);
2728
2729 /* statistics via seq_file */
2730
2731 static void *neigh_stat_seq_start(struct seq_file *seq, loff_t *pos)
2732 {
2733         struct neigh_table *tbl = seq->private;
2734         int cpu;
2735
2736         if (*pos == 0)
2737                 return SEQ_START_TOKEN;
2738
2739         for (cpu = *pos-1; cpu < nr_cpu_ids; ++cpu) {
2740                 if (!cpu_possible(cpu))
2741                         continue;
2742                 *pos = cpu+1;
2743                 return per_cpu_ptr(tbl->stats, cpu);
2744         }
2745         return NULL;
2746 }
2747
2748 static void *neigh_stat_seq_next(struct seq_file *seq, void *v, loff_t *pos)
2749 {
2750         struct neigh_table *tbl = seq->private;
2751         int cpu;
2752
2753         for (cpu = *pos; cpu < nr_cpu_ids; ++cpu) {
2754                 if (!cpu_possible(cpu))
2755                         continue;
2756                 *pos = cpu+1;
2757                 return per_cpu_ptr(tbl->stats, cpu);
2758         }
2759         return NULL;
2760 }
2761
2762 static void neigh_stat_seq_stop(struct seq_file *seq, void *v)
2763 {
2764
2765 }
2766
2767 static int neigh_stat_seq_show(struct seq_file *seq, void *v)
2768 {
2769         struct neigh_table *tbl = seq->private;
2770         struct neigh_statistics *st = v;
2771
2772         if (v == SEQ_START_TOKEN) {
2773                 seq_printf(seq, "entries  allocs destroys hash_grows  lookups hits  res_failed  rcv_probes_mcast rcv_probes_ucast  periodic_gc_runs forced_gc_runs unresolved_discards table_fulls\n");
2774                 return 0;
2775         }
2776
2777         seq_printf(seq, "%08x  %08lx %08lx %08lx  %08lx %08lx  %08lx  "
2778                         "%08lx %08lx  %08lx %08lx %08lx %08lx\n",
2779                    atomic_read(&tbl->entries),
2780
2781                    st->allocs,
2782                    st->destroys,
2783                    st->hash_grows,
2784
2785                    st->lookups,
2786                    st->hits,
2787
2788                    st->res_failed,
2789
2790                    st->rcv_probes_mcast,
2791                    st->rcv_probes_ucast,
2792
2793                    st->periodic_gc_runs,
2794                    st->forced_gc_runs,
2795                    st->unres_discards,
2796                    st->table_fulls
2797                    );
2798
2799         return 0;
2800 }
2801
2802 static const struct seq_operations neigh_stat_seq_ops = {
2803         .start  = neigh_stat_seq_start,
2804         .next   = neigh_stat_seq_next,
2805         .stop   = neigh_stat_seq_stop,
2806         .show   = neigh_stat_seq_show,
2807 };
2808
2809 static int neigh_stat_seq_open(struct inode *inode, struct file *file)
2810 {
2811         int ret = seq_open(file, &neigh_stat_seq_ops);
2812
2813         if (!ret) {
2814                 struct seq_file *sf = file->private_data;
2815                 sf->private = PDE_DATA(inode);
2816         }
2817         return ret;
2818 };
2819
2820 static const struct file_operations neigh_stat_seq_fops = {
2821         .owner   = THIS_MODULE,
2822         .open    = neigh_stat_seq_open,
2823         .read    = seq_read,
2824         .llseek  = seq_lseek,
2825         .release = seq_release,
2826 };
2827
2828 #endif /* CONFIG_PROC_FS */
2829
2830 static inline size_t neigh_nlmsg_size(void)
2831 {
2832         return NLMSG_ALIGN(sizeof(struct ndmsg))
2833                + nla_total_size(MAX_ADDR_LEN) /* NDA_DST */
2834                + nla_total_size(MAX_ADDR_LEN) /* NDA_LLADDR */
2835                + nla_total_size(sizeof(struct nda_cacheinfo))
2836                + nla_total_size(4); /* NDA_PROBES */
2837 }
2838
2839 static void __neigh_notify(struct neighbour *n, int type, int flags)
2840 {
2841         struct net *net = dev_net(n->dev);
2842         struct sk_buff *skb;
2843         int err = -ENOBUFS;
2844
2845         skb = nlmsg_new(neigh_nlmsg_size(), GFP_ATOMIC);
2846         if (skb == NULL)
2847                 goto errout;
2848
2849         err = neigh_fill_info(skb, n, 0, 0, type, flags);
2850         if (err < 0) {
2851                 /* -EMSGSIZE implies BUG in neigh_nlmsg_size() */
2852                 WARN_ON(err == -EMSGSIZE);
2853                 kfree_skb(skb);
2854                 goto errout;
2855         }
2856         rtnl_notify(skb, net, 0, RTNLGRP_NEIGH, NULL, GFP_ATOMIC);
2857         return;
2858 errout:
2859         if (err < 0)
2860                 rtnl_set_sk_err(net, RTNLGRP_NEIGH, err);
2861 }
2862
2863 void neigh_app_ns(struct neighbour *n)
2864 {
2865         __neigh_notify(n, RTM_GETNEIGH, NLM_F_REQUEST);
2866 }
2867 EXPORT_SYMBOL(neigh_app_ns);
2868
2869 #ifdef CONFIG_SYSCTL
2870 static int zero;
2871 static int int_max = INT_MAX;
2872 static int unres_qlen_max = INT_MAX / SKB_TRUESIZE(ETH_FRAME_LEN);
2873
2874 static int proc_unres_qlen(struct ctl_table *ctl, int write,
2875                            void __user *buffer, size_t *lenp, loff_t *ppos)
2876 {
2877         int size, ret;
2878         struct ctl_table tmp = *ctl;
2879
2880         tmp.extra1 = &zero;
2881         tmp.extra2 = &unres_qlen_max;
2882         tmp.data = &size;
2883
2884         size = *(int *)ctl->data / SKB_TRUESIZE(ETH_FRAME_LEN);
2885         ret = proc_dointvec_minmax(&tmp, write, buffer, lenp, ppos);
2886
2887         if (write && !ret)
2888                 *(int *)ctl->data = size * SKB_TRUESIZE(ETH_FRAME_LEN);
2889         return ret;
2890 }
2891
2892 static struct neigh_parms *neigh_get_dev_parms_rcu(struct net_device *dev,
2893                                                    int family)
2894 {
2895         switch (family) {
2896         case AF_INET:
2897                 return __in_dev_arp_parms_get_rcu(dev);
2898         case AF_INET6:
2899                 return __in6_dev_nd_parms_get_rcu(dev);
2900         }
2901         return NULL;
2902 }
2903
2904 static void neigh_copy_dflt_parms(struct net *net, struct neigh_parms *p,
2905                                   int index)
2906 {
2907         struct net_device *dev;
2908         int family = neigh_parms_family(p);
2909
2910         rcu_read_lock();
2911         for_each_netdev_rcu(net, dev) {
2912                 struct neigh_parms *dst_p =
2913                                 neigh_get_dev_parms_rcu(dev, family);
2914
2915                 if (dst_p && !test_bit(index, dst_p->data_state))
2916                         dst_p->data[index] = p->data[index];
2917         }
2918         rcu_read_unlock();
2919 }
2920
2921 static void neigh_proc_update(struct ctl_table *ctl, int write)
2922 {
2923         struct net_device *dev = ctl->extra1;
2924         struct neigh_parms *p = ctl->extra2;
2925         struct net *net = neigh_parms_net(p);
2926         int index = (int *) ctl->data - p->data;
2927
2928         if (!write)
2929                 return;
2930
2931         set_bit(index, p->data_state);
2932         if (!dev) /* NULL dev means this is default value */
2933                 neigh_copy_dflt_parms(net, p, index);
2934 }
2935
2936 static int neigh_proc_dointvec_zero_intmax(struct ctl_table *ctl, int write,
2937                                            void __user *buffer,
2938                                            size_t *lenp, loff_t *ppos)
2939 {
2940         struct ctl_table tmp = *ctl;
2941         int ret;
2942
2943         tmp.extra1 = &zero;
2944         tmp.extra2 = &int_max;
2945
2946         ret = proc_dointvec_minmax(&tmp, write, buffer, lenp, ppos);
2947         neigh_proc_update(ctl, write);
2948         return ret;
2949 }
2950
2951 int neigh_proc_dointvec(struct ctl_table *ctl, int write,
2952                         void __user *buffer, size_t *lenp, loff_t *ppos)
2953 {
2954         int ret = proc_dointvec(ctl, write, buffer, lenp, ppos);
2955
2956         neigh_proc_update(ctl, write);
2957         return ret;
2958 }
2959 EXPORT_SYMBOL(neigh_proc_dointvec);
2960
2961 int neigh_proc_dointvec_jiffies(struct ctl_table *ctl, int write,
2962                                 void __user *buffer,
2963                                 size_t *lenp, loff_t *ppos)
2964 {
2965         int ret = proc_dointvec_jiffies(ctl, write, buffer, lenp, ppos);
2966
2967         neigh_proc_update(ctl, write);
2968         return ret;
2969 }
2970 EXPORT_SYMBOL(neigh_proc_dointvec_jiffies);
2971
2972 static int neigh_proc_dointvec_userhz_jiffies(struct ctl_table *ctl, int write,
2973                                               void __user *buffer,
2974                                               size_t *lenp, loff_t *ppos)
2975 {
2976         int ret = proc_dointvec_userhz_jiffies(ctl, write, buffer, lenp, ppos);
2977
2978         neigh_proc_update(ctl, write);
2979         return ret;
2980 }
2981
2982 int neigh_proc_dointvec_ms_jiffies(struct ctl_table *ctl, int write,
2983                                    void __user *buffer,
2984                                    size_t *lenp, loff_t *ppos)
2985 {
2986         int ret = proc_dointvec_ms_jiffies(ctl, write, buffer, lenp, ppos);
2987
2988         neigh_proc_update(ctl, write);
2989         return ret;
2990 }
2991 EXPORT_SYMBOL(neigh_proc_dointvec_ms_jiffies);
2992
2993 static int neigh_proc_dointvec_unres_qlen(struct ctl_table *ctl, int write,
2994                                           void __user *buffer,
2995                                           size_t *lenp, loff_t *ppos)
2996 {
2997         int ret = proc_unres_qlen(ctl, write, buffer, lenp, ppos);
2998
2999         neigh_proc_update(ctl, write);
3000         return ret;
3001 }
3002
3003 static int neigh_proc_base_reachable_time(struct ctl_table *ctl, int write,
3004                                           void __user *buffer,
3005                                           size_t *lenp, loff_t *ppos)
3006 {
3007         struct neigh_parms *p = ctl->extra2;
3008         int ret;
3009
3010         if (strcmp(ctl->procname, "base_reachable_time") == 0)
3011                 ret = neigh_proc_dointvec_jiffies(ctl, write, buffer, lenp, ppos);
3012         else if (strcmp(ctl->procname, "base_reachable_time_ms") == 0)
3013                 ret = neigh_proc_dointvec_ms_jiffies(ctl, write, buffer, lenp, ppos);
3014         else
3015                 ret = -1;
3016
3017         if (write && ret == 0) {
3018                 /* update reachable_time as well, otherwise, the change will
3019                  * only be effective after the next time neigh_periodic_work
3020                  * decides to recompute it
3021                  */
3022                 p->reachable_time =
3023                         neigh_rand_reach_time(NEIGH_VAR(p, BASE_REACHABLE_TIME));
3024         }
3025         return ret;
3026 }
3027
3028 #define NEIGH_PARMS_DATA_OFFSET(index)  \
3029         (&((struct neigh_parms *) 0)->data[index])
3030
3031 #define NEIGH_SYSCTL_ENTRY(attr, data_attr, name, mval, proc) \
3032         [NEIGH_VAR_ ## attr] = { \
3033                 .procname       = name, \
3034                 .data           = NEIGH_PARMS_DATA_OFFSET(NEIGH_VAR_ ## data_attr), \
3035                 .maxlen         = sizeof(int), \
3036                 .mode           = mval, \
3037                 .proc_handler   = proc, \
3038         }
3039
3040 #define NEIGH_SYSCTL_ZERO_INTMAX_ENTRY(attr, name) \
3041         NEIGH_SYSCTL_ENTRY(attr, attr, name, 0644, neigh_proc_dointvec_zero_intmax)
3042
3043 #define NEIGH_SYSCTL_JIFFIES_ENTRY(attr, name) \
3044         NEIGH_SYSCTL_ENTRY(attr, attr, name, 0644, neigh_proc_dointvec_jiffies)
3045
3046 #define NEIGH_SYSCTL_USERHZ_JIFFIES_ENTRY(attr, name) \
3047         NEIGH_SYSCTL_ENTRY(attr, attr, name, 0644, neigh_proc_dointvec_userhz_jiffies)
3048
3049 #define NEIGH_SYSCTL_MS_JIFFIES_ENTRY(attr, name) \
3050         NEIGH_SYSCTL_ENTRY(attr, attr, name, 0644, neigh_proc_dointvec_ms_jiffies)
3051
3052 #define NEIGH_SYSCTL_MS_JIFFIES_REUSED_ENTRY(attr, data_attr, name) \
3053         NEIGH_SYSCTL_ENTRY(attr, data_attr, name, 0644, neigh_proc_dointvec_ms_jiffies)
3054
3055 #define NEIGH_SYSCTL_UNRES_QLEN_REUSED_ENTRY(attr, data_attr, name) \
3056         NEIGH_SYSCTL_ENTRY(attr, data_attr, name, 0644, neigh_proc_dointvec_unres_qlen)
3057
3058 static struct neigh_sysctl_table {
3059         struct ctl_table_header *sysctl_header;
3060         struct ctl_table neigh_vars[NEIGH_VAR_MAX + 1];
3061 } neigh_sysctl_template __read_mostly = {
3062         .neigh_vars = {
3063                 NEIGH_SYSCTL_ZERO_INTMAX_ENTRY(MCAST_PROBES, "mcast_solicit"),
3064                 NEIGH_SYSCTL_ZERO_INTMAX_ENTRY(UCAST_PROBES, "ucast_solicit"),
3065                 NEIGH_SYSCTL_ZERO_INTMAX_ENTRY(APP_PROBES, "app_solicit"),
3066                 NEIGH_SYSCTL_ZERO_INTMAX_ENTRY(MCAST_REPROBES, "mcast_resolicit"),
3067                 NEIGH_SYSCTL_USERHZ_JIFFIES_ENTRY(RETRANS_TIME, "retrans_time"),
3068                 NEIGH_SYSCTL_JIFFIES_ENTRY(BASE_REACHABLE_TIME, "base_reachable_time"),
3069                 NEIGH_SYSCTL_JIFFIES_ENTRY(DELAY_PROBE_TIME, "delay_first_probe_time"),
3070                 NEIGH_SYSCTL_JIFFIES_ENTRY(GC_STALETIME, "gc_stale_time"),
3071                 NEIGH_SYSCTL_ZERO_INTMAX_ENTRY(QUEUE_LEN_BYTES, "unres_qlen_bytes"),
3072                 NEIGH_SYSCTL_ZERO_INTMAX_ENTRY(PROXY_QLEN, "proxy_qlen"),
3073                 NEIGH_SYSCTL_USERHZ_JIFFIES_ENTRY(ANYCAST_DELAY, "anycast_delay"),
3074                 NEIGH_SYSCTL_USERHZ_JIFFIES_ENTRY(PROXY_DELAY, "proxy_delay"),
3075                 NEIGH_SYSCTL_USERHZ_JIFFIES_ENTRY(LOCKTIME, "locktime"),
3076                 NEIGH_SYSCTL_UNRES_QLEN_REUSED_ENTRY(QUEUE_LEN, QUEUE_LEN_BYTES, "unres_qlen"),
3077                 NEIGH_SYSCTL_MS_JIFFIES_REUSED_ENTRY(RETRANS_TIME_MS, RETRANS_TIME, "retrans_time_ms"),
3078                 NEIGH_SYSCTL_MS_JIFFIES_REUSED_ENTRY(BASE_REACHABLE_TIME_MS, BASE_REACHABLE_TIME, "base_reachable_time_ms"),
3079                 [NEIGH_VAR_GC_INTERVAL] = {
3080                         .procname       = "gc_interval",
3081                         .maxlen         = sizeof(int),
3082                         .mode           = 0644,
3083                         .proc_handler   = proc_dointvec_jiffies,
3084                 },
3085                 [NEIGH_VAR_GC_THRESH1] = {
3086                         .procname       = "gc_thresh1",
3087                         .maxlen         = sizeof(int),
3088                         .mode           = 0644,
3089                         .extra1         = &zero,
3090                         .extra2         = &int_max,
3091                         .proc_handler   = proc_dointvec_minmax,
3092                 },
3093                 [NEIGH_VAR_GC_THRESH2] = {
3094                         .procname       = "gc_thresh2",
3095                         .maxlen         = sizeof(int),
3096                         .mode           = 0644,
3097                         .extra1         = &zero,
3098                         .extra2         = &int_max,
3099                         .proc_handler   = proc_dointvec_minmax,
3100                 },
3101                 [NEIGH_VAR_GC_THRESH3] = {
3102                         .procname       = "gc_thresh3",
3103                         .maxlen         = sizeof(int),
3104                         .mode           = 0644,
3105                         .extra1         = &zero,
3106                         .extra2         = &int_max,
3107                         .proc_handler   = proc_dointvec_minmax,
3108                 },
3109                 {},
3110         },
3111 };
3112
3113 int neigh_sysctl_register(struct net_device *dev, struct neigh_parms *p,
3114                           proc_handler *handler)
3115 {
3116         int i;
3117         struct neigh_sysctl_table *t;
3118         const char *dev_name_source;
3119         char neigh_path[ sizeof("net//neigh/") + IFNAMSIZ + IFNAMSIZ ];
3120         char *p_name;
3121
3122         t = kmemdup(&neigh_sysctl_template, sizeof(*t), GFP_KERNEL);
3123         if (!t)
3124                 goto err;
3125
3126         for (i = 0; i < NEIGH_VAR_GC_INTERVAL; i++) {
3127                 t->neigh_vars[i].data += (long) p;
3128                 t->neigh_vars[i].extra1 = dev;
3129                 t->neigh_vars[i].extra2 = p;
3130         }
3131
3132         if (dev) {
3133                 dev_name_source = dev->name;
3134                 /* Terminate the table early */
3135                 memset(&t->neigh_vars[NEIGH_VAR_GC_INTERVAL], 0,
3136                        sizeof(t->neigh_vars[NEIGH_VAR_GC_INTERVAL]));
3137         } else {
3138                 struct neigh_table *tbl = p->tbl;
3139                 dev_name_source = "default";
3140                 t->neigh_vars[NEIGH_VAR_GC_INTERVAL].data = &tbl->gc_interval;
3141                 t->neigh_vars[NEIGH_VAR_GC_THRESH1].data = &tbl->gc_thresh1;
3142                 t->neigh_vars[NEIGH_VAR_GC_THRESH2].data = &tbl->gc_thresh2;
3143                 t->neigh_vars[NEIGH_VAR_GC_THRESH3].data = &tbl->gc_thresh3;
3144         }
3145
3146         if (handler) {
3147                 /* RetransTime */
3148                 t->neigh_vars[NEIGH_VAR_RETRANS_TIME].proc_handler = handler;
3149                 /* ReachableTime */
3150                 t->neigh_vars[NEIGH_VAR_BASE_REACHABLE_TIME].proc_handler = handler;
3151                 /* RetransTime (in milliseconds)*/
3152                 t->neigh_vars[NEIGH_VAR_RETRANS_TIME_MS].proc_handler = handler;
3153                 /* ReachableTime (in milliseconds) */
3154                 t->neigh_vars[NEIGH_VAR_BASE_REACHABLE_TIME_MS].proc_handler = handler;
3155         } else {
3156                 /* Those handlers will update p->reachable_time after
3157                  * base_reachable_time(_ms) is set to ensure the new timer starts being
3158                  * applied after the next neighbour update instead of waiting for
3159                  * neigh_periodic_work to update its value (can be multiple minutes)
3160                  * So any handler that replaces them should do this as well
3161                  */
3162                 /* ReachableTime */
3163                 t->neigh_vars[NEIGH_VAR_BASE_REACHABLE_TIME].proc_handler =
3164                         neigh_proc_base_reachable_time;
3165                 /* ReachableTime (in milliseconds) */
3166                 t->neigh_vars[NEIGH_VAR_BASE_REACHABLE_TIME_MS].proc_handler =
3167                         neigh_proc_base_reachable_time;
3168         }
3169
3170         /* Don't export sysctls to unprivileged users */
3171         if (neigh_parms_net(p)->user_ns != &init_user_ns)
3172                 t->neigh_vars[0].procname = NULL;
3173
3174         switch (neigh_parms_family(p)) {
3175         case AF_INET:
3176               p_name = "ipv4";
3177               break;
3178         case AF_INET6:
3179               p_name = "ipv6";
3180               break;
3181         default:
3182               BUG();
3183         }
3184
3185         snprintf(neigh_path, sizeof(neigh_path), "net/%s/neigh/%s",
3186                 p_name, dev_name_source);
3187         t->sysctl_header =
3188                 register_net_sysctl(neigh_parms_net(p), neigh_path, t->neigh_vars);
3189         if (!t->sysctl_header)
3190                 goto free;
3191
3192         p->sysctl_table = t;
3193         return 0;
3194
3195 free:
3196         kfree(t);
3197 err:
3198         return -ENOBUFS;
3199 }
3200 EXPORT_SYMBOL(neigh_sysctl_register);
3201
3202 void neigh_sysctl_unregister(struct neigh_parms *p)
3203 {
3204         if (p->sysctl_table) {
3205                 struct neigh_sysctl_table *t = p->sysctl_table;
3206                 p->sysctl_table = NULL;
3207                 unregister_net_sysctl_table(t->sysctl_header);
3208                 kfree(t);
3209         }
3210 }
3211 EXPORT_SYMBOL(neigh_sysctl_unregister);
3212
3213 #endif  /* CONFIG_SYSCTL */
3214
3215 static int __init neigh_init(void)
3216 {
3217         rtnl_register(PF_UNSPEC, RTM_NEWNEIGH, neigh_add, NULL, NULL);
3218         rtnl_register(PF_UNSPEC, RTM_DELNEIGH, neigh_delete, NULL, NULL);
3219         rtnl_register(PF_UNSPEC, RTM_GETNEIGH, NULL, neigh_dump_info, NULL);
3220
3221         rtnl_register(PF_UNSPEC, RTM_GETNEIGHTBL, NULL, neightbl_dump_info,
3222                       NULL);
3223         rtnl_register(PF_UNSPEC, RTM_SETNEIGHTBL, neightbl_set, NULL, NULL);
3224
3225         return 0;
3226 }
3227
3228 subsys_initcall(neigh_init);
3229