net/core/neighbour.c

   1 /*
   2  *      Generic address resolution entity
   3  *
   4  *      Authors:
   5  *      Pedro Roque             <roque@di.fc.ul.pt>
   6  *      Alexey Kuznetsov        <kuznet@ms2.inr.ac.ru>
   7  *
   8  *      This program is free software; you can redistribute it and/or
   9  *      modify it under the terms of the GNU General Public License
  10  *      as published by the Free Software Foundation; either version
  11  *      2 of the License, or (at your option) any later version.
  12  *
  13  *      Fixes:
  14  *      Vitaly E. Lavrov        releasing NULL neighbor in neigh_add.
  15  *      Harald Welte            Add neighbour cache statistics like rtstat
  16  */
  17
  18 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
  19
  20 #include <linux/slab.h>
  21 #include <linux/types.h>
  22 #include <linux/kernel.h>
  23 #include <linux/module.h>
  24 #include <linux/socket.h>
  25 #include <linux/netdevice.h>
  26 #include <linux/proc_fs.h>
  27 #ifdef CONFIG_SYSCTL
  28 #include <linux/sysctl.h>
  29 #endif
  30 #include <linux/times.h>
  31 #include <net/net_namespace.h>
  32 #include <net/neighbour.h>
  33 #include <net/dst.h>
  34 #include <net/sock.h>
  35 #include <net/netevent.h>
  36 #include <net/netlink.h>
  37 #include <linux/rtnetlink.h>
  38 #include <linux/random.h>
  39 #include <linux/string.h>
  40 #include <linux/log2.h>
  41 #include <linux/inetdevice.h>
  42 #include <net/addrconf.h>
  43
  44 #define DEBUG
  45 #define NEIGH_DEBUG 1
  46 #define neigh_dbg(level, fmt, ...)              \
  47 do {                                            \
  48         if (level <= NEIGH_DEBUG)               \
  49                 pr_debug(fmt, ##__VA_ARGS__);   \
  50 } while (0)
  51
  52 #define PNEIGH_HASHMASK         0xF
  53
  54 static void neigh_timer_handler(unsigned long arg);
  55 static void __neigh_notify(struct neighbour *n, int type, int flags);
  56 static void neigh_update_notify(struct neighbour *neigh);
  57 static int pneigh_ifdown(struct neigh_table *tbl, struct net_device *dev);
  58
  59 #ifdef CONFIG_PROC_FS
  60 static const struct file_operations neigh_stat_seq_fops;
  61 #endif
  62
  63 /*
  64    Neighbour hash table buckets are protected with rwlock tbl->lock.
  65
  66    - All the scans/updates to hash buckets MUST be made under this lock.
  67    - NOTHING clever should be made under this lock: no callbacks
  68      to protocol backends, no attempts to send something to network.
  69      It will result in deadlocks, if backend/driver wants to use neighbour
  70      cache.
  71    - If the entry requires some non-trivial actions, increase
  72      its reference count and release table lock.
  73
  74    Neighbour entries are protected:
  75    - with reference count.
  76    - with rwlock neigh->lock
  77
  78    Reference count prevents destruction.
  79
  80    neigh->lock mainly serializes ll address data and its validity state.
  81    However, the same lock is used to protect another entry fields:
  82     - timer
  83     - resolution queue
  84
  85    Again, nothing clever shall be made under neigh->lock,
  86    the most complicated procedure, which we allow is dev->hard_header.
  87    It is supposed, that dev->hard_header is simplistic and does
  88    not make callbacks to neighbour tables.
  89  */
  90
  91 static int neigh_blackhole(struct neighbour *neigh, struct sk_buff *skb)
  92 {
  93         kfree_skb(skb);
  94         return -ENETDOWN;
  95 }
  96
  97 static void neigh_cleanup_and_release(struct neighbour *neigh)
  98 {
  99         if (neigh->parms->neigh_cleanup)
 100                 neigh->parms->neigh_cleanup(neigh);
 101
 102         __neigh_notify(neigh, RTM_DELNEIGH, 0);
 103         neigh_release(neigh);
 104 }
 105
 106 /*
 107  * It is random distribution in the interval (1/2)*base...(3/2)*base.
 108  * It corresponds to default IPv6 settings and is not overridable,
 109  * because it is really reasonable choice.
 110  */
 111
 112 unsigned long neigh_rand_reach_time(unsigned long base)
 113 {
 114         return base ? (prandom_u32() % base) + (base >> 1) : 0;
 115 }
 116 EXPORT_SYMBOL(neigh_rand_reach_time);
 117
 118
 119 static int neigh_forced_gc(struct neigh_table *tbl)
 120 {
 121         int shrunk = 0;
 122         int i;
 123         struct neigh_hash_table *nht;
 124
 125         NEIGH_CACHE_STAT_INC(tbl, forced_gc_runs);
 126
 127         write_lock_bh(&tbl->lock);
 128         nht = rcu_dereference_protected(tbl->nht,
 129                                         lockdep_is_held(&tbl->lock));
 130         for (i = 0; i < (1 << nht->hash_shift); i++) {
 131                 struct neighbour *n;
 132                 struct neighbour __rcu **np;
 133
 134                 np = &nht->hash_buckets[i];
 135                 while ((n = rcu_dereference_protected(*np,
 136                                         lockdep_is_held(&tbl->lock))) != NULL) {
 137                         /* Neighbour record may be discarded if:
 138                          * - nobody refers to it.
 139                          * - it is not permanent
 140                          */
 141                         write_lock(&n->lock);
 142                         if (atomic_read(&n->refcnt) == 1 &&
 143                             !(n->nud_state & NUD_PERMANENT)) {
 144                                 rcu_assign_pointer(*np,
 145                                         rcu_dereference_protected(n->next,
 146                                                   lockdep_is_held(&tbl->lock)));
 147                                 n->dead = 1;
 148                                 shrunk  = 1;
 149                                 write_unlock(&n->lock);
 150                                 neigh_cleanup_and_release(n);
 151                                 continue;
 152                         }
 153                         write_unlock(&n->lock);
 154                         np = &n->next;
 155                 }
 156         }
 157
 158         tbl->last_flush = jiffies;
 159
 160         write_unlock_bh(&tbl->lock);
 161
 162         return shrunk;
 163 }
 164
 165 static void neigh_add_timer(struct neighbour *n, unsigned long when)
 166 {
 167         neigh_hold(n);
 168         if (unlikely(mod_timer(&n->timer, when))) {
 169                 printk("NEIGH: BUG, double timer add, state is %x\n",
 170                        n->nud_state);
 171                 dump_stack();
 172         }
 173 }
 174
 175 static int neigh_del_timer(struct neighbour *n)
 176 {
 177         if ((n->nud_state & NUD_IN_TIMER) &&
 178             del_timer(&n->timer)) {
 179                 neigh_release(n);
 180                 return 1;
 181         }
 182         return 0;
 183 }
 184
 185 static void pneigh_queue_purge(struct sk_buff_head *list)
 186 {
 187         struct sk_buff *skb;
 188
 189         while ((skb = skb_dequeue(list)) != NULL) {
 190                 dev_put(skb->dev);
 191                 kfree_skb(skb);
 192         }
 193 }
 194
 195 static void neigh_flush_dev(struct neigh_table *tbl, struct net_device *dev)
 196 {
 197         int i;
 198         struct neigh_hash_table *nht;
 199
 200         nht = rcu_dereference_protected(tbl->nht,
 201                                         lockdep_is_held(&tbl->lock));
 202
 203         for (i = 0; i < (1 << nht->hash_shift); i++) {
 204                 struct neighbour *n;
 205                 struct neighbour __rcu **np = &nht->hash_buckets[i];
 206
 207                 while ((n = rcu_dereference_protected(*np,
 208                                         lockdep_is_held(&tbl->lock))) != NULL) {
 209                         if (dev && n->dev != dev) {
 210                                 np = &n->next;
 211                                 continue;
 212                         }
 213                         rcu_assign_pointer(*np,
 214                                    rcu_dereference_protected(n->next,
 215                                                 lockdep_is_held(&tbl->lock)));
 216                         write_lock(&n->lock);
 217                         neigh_del_timer(n);
 218                         n->dead = 1;
 219
 220                         if (atomic_read(&n->refcnt) != 1) {
 221                                 /* The most unpleasant situation.
 222                                    We must destroy neighbour entry,
 223                                    but someone still uses it.
 224
 225                                    The destroy will be delayed until
 226                                    the last user releases us, but
 227                                    we must kill timers etc. and move
 228                                    it to safe state.
 229                                  */
 230                                 __skb_queue_purge(&n->arp_queue);
 231                                 n->arp_queue_len_bytes = 0;
 232                                 n->output = neigh_blackhole;
 233                                 if (n->nud_state & NUD_VALID)
 234                                         n->nud_state = NUD_NOARP;
 235                                 else
 236                                         n->nud_state = NUD_NONE;
 237                                 neigh_dbg(2, "neigh %p is stray\n", n);
 238                         }
 239                         write_unlock(&n->lock);
 240                         neigh_cleanup_and_release(n);
 241                 }
 242         }
 243 }
 244
 245 void neigh_changeaddr(struct neigh_table *tbl, struct net_device *dev)
 246 {
 247         write_lock_bh(&tbl->lock);
 248         neigh_flush_dev(tbl, dev);
 249         write_unlock_bh(&tbl->lock);
 250 }
 251 EXPORT_SYMBOL(neigh_changeaddr);
 252
 253 int neigh_ifdown(struct neigh_table *tbl, struct net_device *dev)
 254 {
 255         write_lock_bh(&tbl->lock);
 256         neigh_flush_dev(tbl, dev);
 257         pneigh_ifdown(tbl, dev);
 258         write_unlock_bh(&tbl->lock);
 259
 260         del_timer_sync(&tbl->proxy_timer);
 261         pneigh_queue_purge(&tbl->proxy_queue);
 262         return 0;
 263 }
 264 EXPORT_SYMBOL(neigh_ifdown);
 265
 266 static struct neighbour *neigh_alloc(struct neigh_table *tbl, struct net_device *dev)
 267 {
 268         struct neighbour *n = NULL;
 269         unsigned long now = jiffies;
 270         int entries;
 271
 272         entries = atomic_inc_return(&tbl->entries) - 1;
 273         if (entries >= tbl->gc_thresh3 ||
 274             (entries >= tbl->gc_thresh2 &&
 275              time_after(now, tbl->last_flush + 5 * HZ))) {
 276                 if (!neigh_forced_gc(tbl) &&
 277                     entries >= tbl->gc_thresh3)
 278                         goto out_entries;
 279         }
 280
 281         n = kzalloc(tbl->entry_size + dev->neigh_priv_len, GFP_ATOMIC);
 282         if (!n)
 283                 goto out_entries;
 284
 285         __skb_queue_head_init(&n->arp_queue);
 286         rwlock_init(&n->lock);
 287         seqlock_init(&n->ha_lock);
 288         n->updated        = n->used = now;
 289         n->nud_state      = NUD_NONE;
 290         n->output         = neigh_blackhole;
 291         seqlock_init(&n->hh.hh_lock);
 292         n->parms          = neigh_parms_clone(&tbl->parms);
 293         setup_timer(&n->timer, neigh_timer_handler, (unsigned long)n);
 294
 295         NEIGH_CACHE_STAT_INC(tbl, allocs);
 296         n->tbl            = tbl;
 297         atomic_set(&n->refcnt, 1);
 298         n->dead           = 1;
 299 out:
 300         return n;
 301
 302 out_entries:
 303         atomic_dec(&tbl->entries);
 304         goto out;
 305 }
 306
 307 static void neigh_get_hash_rnd(u32 *x)
 308 {
 309         get_random_bytes(x, sizeof(*x));
 310         *x |= 1;
 311 }
 312
 313 static struct neigh_hash_table *neigh_hash_alloc(unsigned int shift)
 314 {
 315         size_t size = (1 << shift) * sizeof(struct neighbour *);
 316         struct neigh_hash_table *ret;
 317         struct neighbour __rcu **buckets;
 318         int i;
 319
 320         ret = kmalloc(sizeof(*ret), GFP_ATOMIC);
 321         if (!ret)
 322                 return NULL;
 323         if (size <= PAGE_SIZE)
 324                 buckets = kzalloc(size, GFP_ATOMIC);
 325         else
 326                 buckets = (struct neighbour __rcu **)
 327                           __get_free_pages(GFP_ATOMIC | __GFP_ZERO,
 328                                            get_order(size));
 329         if (!buckets) {
 330                 kfree(ret);
 331                 return NULL;
 332         }
 333         ret->hash_buckets = buckets;
 334         ret->hash_shift = shift;
 335         for (i = 0; i < NEIGH_NUM_HASH_RND; i++)
 336                 neigh_get_hash_rnd(&ret->hash_rnd[i]);
 337         return ret;
 338 }
 339
 340 static void neigh_hash_free_rcu(struct rcu_head *head)
 341 {
 342         struct neigh_hash_table *nht = container_of(head,
 343                                                     struct neigh_hash_table,
 344                                                     rcu);
 345         size_t size = (1 << nht->hash_shift) * sizeof(struct neighbour *);
 346         struct neighbour __rcu **buckets = nht->hash_buckets;
 347
 348         if (size <= PAGE_SIZE)
 349                 kfree(buckets);
 350         else
 351                 free_pages((unsigned long)buckets, get_order(size));
 352         kfree(nht);
 353 }
 354
 355 static struct neigh_hash_table *neigh_hash_grow(struct neigh_table *tbl,
 356                                                 unsigned long new_shift)
 357 {
 358         unsigned int i, hash;
 359         struct neigh_hash_table *new_nht, *old_nht;
 360
 361         NEIGH_CACHE_STAT_INC(tbl, hash_grows);
 362
 363         old_nht = rcu_dereference_protected(tbl->nht,
 364                                             lockdep_is_held(&tbl->lock));
 365         new_nht = neigh_hash_alloc(new_shift);
 366         if (!new_nht)
 367                 return old_nht;
 368
 369         for (i = 0; i < (1 << old_nht->hash_shift); i++) {
 370                 struct neighbour *n, *next;
 371
 372                 for (n = rcu_dereference_protected(old_nht->hash_buckets[i],
 373                                                    lockdep_is_held(&tbl->lock));
 374                      n != NULL;
 375                      n = next) {
 376                         hash = tbl->hash(n->primary_key, n->dev,
 377                                          new_nht->hash_rnd);
 378
 379                         hash >>= (32 - new_nht->hash_shift);
 380                         next = rcu_dereference_protected(n->next,
 381                                                 lockdep_is_held(&tbl->lock));
 382
 383                         rcu_assign_pointer(n->next,
 384                                            rcu_dereference_protected(
 385                                                 new_nht->hash_buckets[hash],
 386                                                 lockdep_is_held(&tbl->lock)));
 387                         rcu_assign_pointer(new_nht->hash_buckets[hash], n);
 388                 }
 389         }
 390
 391         rcu_assign_pointer(tbl->nht, new_nht);
 392         call_rcu(&old_nht->rcu, neigh_hash_free_rcu);
 393         return new_nht;
 394 }
 395
 396 struct neighbour *neigh_lookup(struct neigh_table *tbl, const void *pkey,
 397                                struct net_device *dev)
 398 {
 399         struct neighbour *n;
 400
 401         NEIGH_CACHE_STAT_INC(tbl, lookups);
 402
 403         rcu_read_lock_bh();
 404         n = __neigh_lookup_noref(tbl, pkey, dev);
 405         if (n) {
 406                 if (!atomic_inc_not_zero(&n->refcnt))
 407                         n = NULL;
 408                 NEIGH_CACHE_STAT_INC(tbl, hits);
 409         }
 410
 411         rcu_read_unlock_bh();
 412         return n;
 413 }
 414 EXPORT_SYMBOL(neigh_lookup);
 415
 416 struct neighbour *neigh_lookup_nodev(struct neigh_table *tbl, struct net *net,
 417                                      const void *pkey)
 418 {
 419         struct neighbour *n;
 420         int key_len = tbl->key_len;
 421         u32 hash_val;
 422         struct neigh_hash_table *nht;
 423
 424         NEIGH_CACHE_STAT_INC(tbl, lookups);
 425
 426         rcu_read_lock_bh();
 427         nht = rcu_dereference_bh(tbl->nht);
 428         hash_val = tbl->hash(pkey, NULL, nht->hash_rnd) >> (32 - nht->hash_shift);
 429
 430         for (n = rcu_dereference_bh(nht->hash_buckets[hash_val]);
 431              n != NULL;
 432              n = rcu_dereference_bh(n->next)) {
 433                 if (!memcmp(n->primary_key, pkey, key_len) &&
 434                     net_eq(dev_net(n->dev), net)) {
 435                         if (!atomic_inc_not_zero(&n->refcnt))
 436                                 n = NULL;
 437                         NEIGH_CACHE_STAT_INC(tbl, hits);
 438                         break;
 439                 }
 440         }
 441
 442         rcu_read_unlock_bh();
 443         return n;
 444 }
 445 EXPORT_SYMBOL(neigh_lookup_nodev);
 446
 447 struct neighbour *__neigh_create(struct neigh_table *tbl, const void *pkey,
 448                                  struct net_device *dev, bool want_ref)
 449 {
 450         u32 hash_val;
 451         int key_len = tbl->key_len;
 452         int error;
 453         struct neighbour *n1, *rc, *n = neigh_alloc(tbl, dev);
 454         struct neigh_hash_table *nht;
 455
 456         if (!n) {
 457                 rc = ERR_PTR(-ENOBUFS);
 458                 goto out;
 459         }
 460
 461         memcpy(n->primary_key, pkey, key_len);
 462         n->dev = dev;
 463         dev_hold(dev);
 464
 465         /* Protocol specific setup. */
 466         if (tbl->constructor && (error = tbl->constructor(n)) < 0) {
 467                 rc = ERR_PTR(error);
 468                 goto out_neigh_release;
 469         }
 470
 471         if (dev->netdev_ops->ndo_neigh_construct) {
 472                 error = dev->netdev_ops->ndo_neigh_construct(n);
 473                 if (error < 0) {
 474                         rc = ERR_PTR(error);
 475                         goto out_neigh_release;
 476                 }
 477         }
 478
 479         /* Device specific setup. */
 480         if (n->parms->neigh_setup &&
 481             (error = n->parms->neigh_setup(n)) < 0) {
 482                 rc = ERR_PTR(error);
 483                 goto out_neigh_release;
 484         }
 485
 486         n->confirmed = jiffies - (NEIGH_VAR(n->parms, BASE_REACHABLE_TIME) << 1);
 487
 488         write_lock_bh(&tbl->lock);
 489         nht = rcu_dereference_protected(tbl->nht,
 490                                         lockdep_is_held(&tbl->lock));
 491
 492         if (atomic_read(&tbl->entries) > (1 << nht->hash_shift))
 493                 nht = neigh_hash_grow(tbl, nht->hash_shift + 1);
 494
 495         hash_val = tbl->hash(pkey, dev, nht->hash_rnd) >> (32 - nht->hash_shift);
 496
 497         if (n->parms->dead) {
 498                 rc = ERR_PTR(-EINVAL);
 499                 goto out_tbl_unlock;
 500         }
 501
 502         for (n1 = rcu_dereference_protected(nht->hash_buckets[hash_val],
 503                                             lockdep_is_held(&tbl->lock));
 504              n1 != NULL;
 505              n1 = rcu_dereference_protected(n1->next,
 506                         lockdep_is_held(&tbl->lock))) {
 507                 if (dev == n1->dev && !memcmp(n1->primary_key, pkey, key_len)) {
 508                         if (want_ref)
 509                                 neigh_hold(n1);
 510                         rc = n1;
 511                         goto out_tbl_unlock;
 512                 }
 513         }
 514
 515         n->dead = 0;
 516         if (want_ref)
 517                 neigh_hold(n);
 518         rcu_assign_pointer(n->next,
 519                            rcu_dereference_protected(nht->hash_buckets[hash_val],
 520                                                      lockdep_is_held(&tbl->lock)));
 521         rcu_assign_pointer(nht->hash_buckets[hash_val], n);
 522         write_unlock_bh(&tbl->lock);
 523         neigh_dbg(2, "neigh %p is created\n", n);
 524         rc = n;
 525 out:
 526         return rc;
 527 out_tbl_unlock:
 528         write_unlock_bh(&tbl->lock);
 529 out_neigh_release:
 530         neigh_release(n);
 531         goto out;
 532 }
 533 EXPORT_SYMBOL(__neigh_create);
 534
 535 static u32 pneigh_hash(const void *pkey, int key_len)
 536 {
 537         u32 hash_val = *(u32 *)(pkey + key_len - 4);
 538         hash_val ^= (hash_val >> 16);
 539         hash_val ^= hash_val >> 8;
 540         hash_val ^= hash_val >> 4;
 541         hash_val &= PNEIGH_HASHMASK;
 542         return hash_val;
 543 }
 544
 545 static struct pneigh_entry *__pneigh_lookup_1(struct pneigh_entry *n,
 546                                               struct net *net,
 547                                               const void *pkey,
 548                                               int key_len,
 549                                               struct net_device *dev)
 550 {
 551         while (n) {
 552                 if (!memcmp(n->key, pkey, key_len) &&
 553                     net_eq(pneigh_net(n), net) &&
 554                     (n->dev == dev || !n->dev))
 555                         return n;
 556                 n = n->next;
 557         }
 558         return NULL;
 559 }
 560
 561 struct pneigh_entry *__pneigh_lookup(struct neigh_table *tbl,
 562                 struct net *net, const void *pkey, struct net_device *dev)
 563 {
 564         int key_len = tbl->key_len;
 565         u32 hash_val = pneigh_hash(pkey, key_len);
 566
 567         return __pneigh_lookup_1(tbl->phash_buckets[hash_val],
 568                                  net, pkey, key_len, dev);
 569 }
 570 EXPORT_SYMBOL_GPL(__pneigh_lookup);
 571
 572 struct pneigh_entry * pneigh_lookup(struct neigh_table *tbl,
 573                                     struct net *net, const void *pkey,
 574                                     struct net_device *dev, int creat)
 575 {
 576         struct pneigh_entry *n;
 577         int key_len = tbl->key_len;
 578         u32 hash_val = pneigh_hash(pkey, key_len);
 579
 580         read_lock_bh(&tbl->lock);
 581         n = __pneigh_lookup_1(tbl->phash_buckets[hash_val],
 582                               net, pkey, key_len, dev);
 583         read_unlock_bh(&tbl->lock);
 584
 585         if (n || !creat)
 586                 goto out;
 587
 588         ASSERT_RTNL();
 589
 590         n = kmalloc(sizeof(*n) + key_len, GFP_KERNEL);
 591         if (!n)
 592                 goto out;
 593
 594         write_pnet(&n->net, net);
 595         memcpy(n->key, pkey, key_len);
 596         n->dev = dev;
 597         if (dev)
 598                 dev_hold(dev);
 599
 600         if (tbl->pconstructor && tbl->pconstructor(n)) {
 601                 if (dev)
 602                         dev_put(dev);
 603                 kfree(n);
 604                 n = NULL;
 605                 goto out;
 606         }
 607
 608         write_lock_bh(&tbl->lock);
 609         n->next = tbl->phash_buckets[hash_val];
 610         tbl->phash_buckets[hash_val] = n;
 611         write_unlock_bh(&tbl->lock);
 612 out:
 613         return n;
 614 }
 615 EXPORT_SYMBOL(pneigh_lookup);
 616
 617
 618 int pneigh_delete(struct neigh_table *tbl, struct net *net, const void *pkey,
 619                   struct net_device *dev)
 620 {
 621         struct pneigh_entry *n, **np;
 622         int key_len = tbl->key_len;
 623         u32 hash_val = pneigh_hash(pkey, key_len);
 624
 625         write_lock_bh(&tbl->lock);
 626         for (np = &tbl->phash_buckets[hash_val]; (n = *np) != NULL;
 627              np = &n->next) {
 628                 if (!memcmp(n->key, pkey, key_len) && n->dev == dev &&
 629                     net_eq(pneigh_net(n), net)) {
 630                         *np = n->next;
 631                         write_unlock_bh(&tbl->lock);
 632                         if (tbl->pdestructor)
 633                                 tbl->pdestructor(n);
 634                         if (n->dev)
 635                                 dev_put(n->dev);
 636                         kfree(n);
 637                         return 0;
 638                 }
 639         }
 640         write_unlock_bh(&tbl->lock);
 641         return -ENOENT;
 642 }
 643
 644 static int pneigh_ifdown(struct neigh_table *tbl, struct net_device *dev)
 645 {
 646         struct pneigh_entry *n, **np;
 647         u32 h;
 648
 649         for (h = 0; h <= PNEIGH_HASHMASK; h++) {
 650                 np = &tbl->phash_buckets[h];
 651                 while ((n = *np) != NULL) {
 652                         if (!dev || n->dev == dev) {
 653                                 *np = n->next;
 654                                 if (tbl->pdestructor)
 655                                         tbl->pdestructor(n);
 656                                 if (n->dev)
 657                                         dev_put(n->dev);
 658                                 kfree(n);
 659                                 continue;
 660                         }
 661                         np = &n->next;
 662                 }
 663         }
 664         return -ENOENT;
 665 }
 666
 667 static void neigh_parms_destroy(struct neigh_parms *parms);
 668
 669 static inline void neigh_parms_put(struct neigh_parms *parms)
 670 {
 671         if (atomic_dec_and_test(&parms->refcnt))
 672                 neigh_parms_destroy(parms);
 673 }
 674
 675 /*
 676  *      neighbour must already be out of the table;
 677  *
 678  */
 679 void neigh_destroy(struct neighbour *neigh)
 680 {
 681         struct net_device *dev = neigh->dev;
 682
 683         NEIGH_CACHE_STAT_INC(neigh->tbl, destroys);
 684
 685         if (!neigh->dead) {
 686                 pr_warn("Destroying alive neighbour %p\n", neigh);
 687                 dump_stack();
 688                 return;
 689         }
 690
 691         if (neigh_del_timer(neigh))
 692                 pr_warn("Impossible event\n");
 693
 694         write_lock_bh(&neigh->lock);
 695         __skb_queue_purge(&neigh->arp_queue);
 696         write_unlock_bh(&neigh->lock);
 697         neigh->arp_queue_len_bytes = 0;
 698
 699         if (dev->netdev_ops->ndo_neigh_destroy)
 700                 dev->netdev_ops->ndo_neigh_destroy(neigh);
 701
 702         dev_put(dev);
 703         neigh_parms_put(neigh->parms);
 704
 705         neigh_dbg(2, "neigh %p is destroyed\n", neigh);
 706
 707         atomic_dec(&neigh->tbl->entries);
 708         kfree_rcu(neigh, rcu);
 709 }
 710 EXPORT_SYMBOL(neigh_destroy);
 711
 712 /* Neighbour state is suspicious;
 713    disable fast path.
 714
 715    Called with write_locked neigh.
 716  */
 717 static void neigh_suspect(struct neighbour *neigh)
 718 {
 719         neigh_dbg(2, "neigh %p is suspected\n", neigh);
 720
 721         neigh->output = neigh->ops->output;
 722 }
 723
 724 /* Neighbour state is OK;
 725    enable fast path.
 726
 727    Called with write_locked neigh.
 728  */
 729 static void neigh_connect(struct neighbour *neigh)
 730 {
 731         neigh_dbg(2, "neigh %p is connected\n", neigh);
 732
 733         neigh->output = neigh->ops->connected_output;
 734 }
 735
 736 static void neigh_periodic_work(struct work_struct *work)
 737 {
 738         struct neigh_table *tbl = container_of(work, struct neigh_table, gc_work.work);
 739         struct neighbour *n;
 740         struct neighbour __rcu **np;
 741         unsigned int i;
 742         struct neigh_hash_table *nht;
 743
 744         NEIGH_CACHE_STAT_INC(tbl, periodic_gc_runs);
 745
 746         write_lock_bh(&tbl->lock);
 747         nht = rcu_dereference_protected(tbl->nht,
 748                                         lockdep_is_held(&tbl->lock));
 749
 750         /*
 751          *      periodically recompute ReachableTime from random function
 752          */
 753
 754         if (time_after(jiffies, tbl->last_rand + 300 * HZ)) {
 755                 struct neigh_parms *p;
 756                 tbl->last_rand = jiffies;
 757                 list_for_each_entry(p, &tbl->parms_list, list)
 758                         p->reachable_time =
 759                                 neigh_rand_reach_time(NEIGH_VAR(p, BASE_REACHABLE_TIME));
 760         }
 761
 762         if (atomic_read(&tbl->entries) < tbl->gc_thresh1)
 763                 goto out;
 764
 765         for (i = 0 ; i < (1 << nht->hash_shift); i++) {
 766                 np = &nht->hash_buckets[i];
 767
 768                 while ((n = rcu_dereference_protected(*np,
 769                                 lockdep_is_held(&tbl->lock))) != NULL) {
 770                         unsigned int state;
 771
 772                         write_lock(&n->lock);
 773
 774                         state = n->nud_state;
 775                         if (state & (NUD_PERMANENT | NUD_IN_TIMER)) {
 776                                 write_unlock(&n->lock);
 777                                 goto next_elt;
 778                         }
 779
 780                         if (time_before(n->used, n->confirmed))
 781                                 n->used = n->confirmed;
 782
 783                         if (atomic_read(&n->refcnt) == 1 &&
 784                             (state == NUD_FAILED ||
 785                              time_after(jiffies, n->used + NEIGH_VAR(n->parms, GC_STALETIME)))) {
 786                                 *np = n->next;
 787                                 n->dead = 1;
 788                                 write_unlock(&n->lock);
 789                                 neigh_cleanup_and_release(n);
 790                                 continue;
 791                         }
 792                         write_unlock(&n->lock);
 793
 794 next_elt:
 795                         np = &n->next;
 796                 }
 797                 /*
 798                  * It's fine to release lock here, even if hash table
 799                  * grows while we are preempted.
 800                  */
 801                 write_unlock_bh(&tbl->lock);
 802                 cond_resched();
 803                 write_lock_bh(&tbl->lock);
 804                 nht = rcu_dereference_protected(tbl->nht,
 805                                                 lockdep_is_held(&tbl->lock));
 806         }
 807 out:
 808         /* Cycle through all hash buckets every BASE_REACHABLE_TIME/2 ticks.
 809          * ARP entry timeouts range from 1/2 BASE_REACHABLE_TIME to 3/2
 810          * BASE_REACHABLE_TIME.
 811          */
 812         queue_delayed_work(system_power_efficient_wq, &tbl->gc_work,
 813                               NEIGH_VAR(&tbl->parms, BASE_REACHABLE_TIME) >> 1);
 814         write_unlock_bh(&tbl->lock);
 815 }
 816
 817 static __inline__ int neigh_max_probes(struct neighbour *n)
 818 {
 819         struct neigh_parms *p = n->parms;
 820         return NEIGH_VAR(p, UCAST_PROBES) + NEIGH_VAR(p, APP_PROBES) +
 821                (n->nud_state & NUD_PROBE ? NEIGH_VAR(p, MCAST_REPROBES) :
 822                 NEIGH_VAR(p, MCAST_PROBES));
 823 }
 824
 825 static void neigh_invalidate(struct neighbour *neigh)
 826         __releases(neigh->lock)
 827         __acquires(neigh->lock)
 828 {
 829         struct sk_buff *skb;
 830
 831         NEIGH_CACHE_STAT_INC(neigh->tbl, res_failed);
 832         neigh_dbg(2, "neigh %p is failed\n", neigh);
 833         neigh->updated = jiffies;
 834
 835         /* It is very thin place. report_unreachable is very complicated
 836            routine. Particularly, it can hit the same neighbour entry!
 837
 838            So that, we try to be accurate and avoid dead loop. --ANK
 839          */
 840         while (neigh->nud_state == NUD_FAILED &&
 841                (skb = __skb_dequeue(&neigh->arp_queue)) != NULL) {
 842                 write_unlock(&neigh->lock);
 843                 neigh->ops->error_report(neigh, skb);
 844                 write_lock(&neigh->lock);
 845         }
 846         __skb_queue_purge(&neigh->arp_queue);
 847         neigh->arp_queue_len_bytes = 0;
 848 }
 849
 850 static void neigh_probe(struct neighbour *neigh)
 851         __releases(neigh->lock)
 852 {
 853         struct sk_buff *skb = skb_peek_tail(&neigh->arp_queue);
 854         /* keep skb alive even if arp_queue overflows */
 855         if (skb)
 856                 skb = skb_copy(skb, GFP_ATOMIC);
 857         write_unlock(&neigh->lock);
 858         neigh->ops->solicit(neigh, skb);
 859         atomic_inc(&neigh->probes);
 860         kfree_skb(skb);
 861 }
 862
 863 /* Called when a timer expires for a neighbour entry. */
 864
 865 static void neigh_timer_handler(unsigned long arg)
 866 {
 867         unsigned long now, next;
 868         struct neighbour *neigh = (struct neighbour *)arg;
 869         unsigned int state;
 870         int notify = 0;
 871
 872         write_lock(&neigh->lock);
 873
 874         state = neigh->nud_state;
 875         now = jiffies;
 876         next = now + HZ;
 877
 878         if (!(state & NUD_IN_TIMER))
 879                 goto out;
 880
 881         if (state & NUD_REACHABLE) {
 882                 if (time_before_eq(now,
 883                                    neigh->confirmed + neigh->parms->reachable_time)) {
 884                         neigh_dbg(2, "neigh %p is still alive\n", neigh);
 885                         next = neigh->confirmed + neigh->parms->reachable_time;
 886                 } else if (time_before_eq(now,
 887                                           neigh->used +
 888                                           NEIGH_VAR(neigh->parms, DELAY_PROBE_TIME))) {
 889                         neigh_dbg(2, "neigh %p is delayed\n", neigh);
 890                         neigh->nud_state = NUD_DELAY;
 891                         neigh->updated = jiffies;
 892                         neigh_suspect(neigh);
 893                         next = now + NEIGH_VAR(neigh->parms, DELAY_PROBE_TIME);
 894                 } else {
 895                         neigh_dbg(2, "neigh %p is suspected\n", neigh);
 896                         neigh->nud_state = NUD_STALE;
 897                         neigh->updated = jiffies;
 898                         neigh_suspect(neigh);
 899                         notify = 1;
 900                 }
 901         } else if (state & NUD_DELAY) {
 902                 if (time_before_eq(now,
 903                                    neigh->confirmed +
 904                                    NEIGH_VAR(neigh->parms, DELAY_PROBE_TIME))) {
 905                         neigh_dbg(2, "neigh %p is now reachable\n", neigh);
 906                         neigh->nud_state = NUD_REACHABLE;
 907                         neigh->updated = jiffies;
 908                         neigh_connect(neigh);
 909                         notify = 1;
 910                         next = neigh->confirmed + neigh->parms->reachable_time;
 911                 } else {
 912                         neigh_dbg(2, "neigh %p is probed\n", neigh);
 913                         neigh->nud_state = NUD_PROBE;
 914                         neigh->updated = jiffies;
 915                         atomic_set(&neigh->probes, 0);
 916                         notify = 1;
 917                         next = now + NEIGH_VAR(neigh->parms, RETRANS_TIME);
 918                 }
 919         } else {
 920                 /* NUD_PROBE|NUD_INCOMPLETE */
 921                 next = now + NEIGH_VAR(neigh->parms, RETRANS_TIME);
 922         }
 923
 924         if ((neigh->nud_state & (NUD_INCOMPLETE | NUD_PROBE)) &&
 925             atomic_read(&neigh->probes) >= neigh_max_probes(neigh)) {
 926                 neigh->nud_state = NUD_FAILED;
 927                 notify = 1;
 928                 neigh_invalidate(neigh);
 929                 goto out;
 930         }
 931
 932         if (neigh->nud_state & NUD_IN_TIMER) {
 933                 if (time_before(next, jiffies + HZ/2))
 934                         next = jiffies + HZ/2;
 935                 if (!mod_timer(&neigh->timer, next))
 936                         neigh_hold(neigh);
 937         }
 938         if (neigh->nud_state & (NUD_INCOMPLETE | NUD_PROBE)) {
 939                 neigh_probe(neigh);
 940         } else {
 941 out:
 942                 write_unlock(&neigh->lock);
 943         }
 944
 945         if (notify)
 946                 neigh_update_notify(neigh);
 947
 948         neigh_release(neigh);
 949 }
 950
 951 int __neigh_event_send(struct neighbour *neigh, struct sk_buff *skb)
 952 {
 953         int rc;
 954         bool immediate_probe = false;
 955
 956         write_lock_bh(&neigh->lock);
 957
 958         rc = 0;
 959         if (neigh->nud_state & (NUD_CONNECTED | NUD_DELAY | NUD_PROBE))
 960                 goto out_unlock_bh;
 961
 962         if (!(neigh->nud_state & (NUD_STALE | NUD_INCOMPLETE))) {
 963                 if (NEIGH_VAR(neigh->parms, MCAST_PROBES) +
 964                     NEIGH_VAR(neigh->parms, APP_PROBES)) {
 965                         unsigned long next, now = jiffies;
 966
 967                         atomic_set(&neigh->probes,
 968                                    NEIGH_VAR(neigh->parms, UCAST_PROBES));
 969                         neigh->nud_state     = NUD_INCOMPLETE;
 970                         neigh->updated = now;
 971                         next = now + max(NEIGH_VAR(neigh->parms, RETRANS_TIME),
 972                                          HZ/2);
 973                         neigh_add_timer(neigh, next);
 974                         immediate_probe = true;
 975                 } else {
 976                         neigh->nud_state = NUD_FAILED;
 977                         neigh->updated = jiffies;
 978                         write_unlock_bh(&neigh->lock);
 979
 980                         kfree_skb(skb);
 981                         return 1;
 982                 }
 983         } else if (neigh->nud_state & NUD_STALE) {
 984                 neigh_dbg(2, "neigh %p is delayed\n", neigh);
 985                 neigh->nud_state = NUD_DELAY;
 986                 neigh->updated = jiffies;
 987                 neigh_add_timer(neigh, jiffies +
 988                                 NEIGH_VAR(neigh->parms, DELAY_PROBE_TIME));
 989         }
 990
 991         if (neigh->nud_state == NUD_INCOMPLETE) {
 992                 if (skb) {
 993                         while (neigh->arp_queue_len_bytes + skb->truesize >
 994                                NEIGH_VAR(neigh->parms, QUEUE_LEN_BYTES)) {
 995                                 struct sk_buff *buff;
 996
 997                                 buff = __skb_dequeue(&neigh->arp_queue);
 998                                 if (!buff)
 999                                         break;
1000                                 neigh->arp_queue_len_bytes -= buff->truesize;
1001                                 kfree_skb(buff);
1002                                 NEIGH_CACHE_STAT_INC(neigh->tbl, unres_discards);
1003                         }
1004                         skb_dst_force(skb);
1005                         __skb_queue_tail(&neigh->arp_queue, skb);
1006                         neigh->arp_queue_len_bytes += skb->truesize;
1007                 }
1008                 rc = 1;
1009         }
1010 out_unlock_bh:
1011         if (immediate_probe)
1012                 neigh_probe(neigh);
1013         else
1014                 write_unlock(&neigh->lock);
1015         local_bh_enable();
1016         return rc;
1017 }
1018 EXPORT_SYMBOL(__neigh_event_send);
1019
1020 static void neigh_update_hhs(struct neighbour *neigh)
1021 {
1022         struct hh_cache *hh;
1023         void (*update)(struct hh_cache*, const struct net_device*, const unsigned char *)
1024                 = NULL;
1025
1026         if (neigh->dev->header_ops)
1027                 update = neigh->dev->header_ops->cache_update;
1028
1029         if (update) {
1030                 hh = &neigh->hh;
1031                 if (hh->hh_len) {
1032                         write_seqlock_bh(&hh->hh_lock);
1033                         update(hh, neigh->dev, neigh->ha);
1034                         write_sequnlock_bh(&hh->hh_lock);
1035                 }
1036         }
1037 }
1038
1039
1040
1041 /* Generic update routine.
1042    -- lladdr is new lladdr or NULL, if it is not supplied.
1043    -- new    is new state.
1044    -- flags
1045         NEIGH_UPDATE_F_OVERRIDE allows to override existing lladdr,
1046                                 if it is different.
1047         NEIGH_UPDATE_F_WEAK_OVERRIDE will suspect existing "connected"
1048                                 lladdr instead of overriding it
1049                                 if it is different.
1050                                 It also allows to retain current state
1051                                 if lladdr is unchanged.
1052         NEIGH_UPDATE_F_ADMIN    means that the change is administrative.
1053
1054         NEIGH_UPDATE_F_OVERRIDE_ISROUTER allows to override existing
1055                                 NTF_ROUTER flag.
1056         NEIGH_UPDATE_F_ISROUTER indicates if the neighbour is known as
1057                                 a router.
1058
1059    Caller MUST hold reference count on the entry.
1060  */
1061
1062 int neigh_update(struct neighbour *neigh, const u8 *lladdr, u8 new,
1063                  u32 flags)
1064 {
1065         u8 old;
1066         int err;
1067         int notify = 0;
1068         struct net_device *dev;
1069         int update_isrouter = 0;
1070
1071         write_lock_bh(&neigh->lock);
1072
1073         dev    = neigh->dev;
1074         old    = neigh->nud_state;
1075         err    = -EPERM;
1076
1077         if (!(flags & NEIGH_UPDATE_F_ADMIN) &&
1078             (old & (NUD_NOARP | NUD_PERMANENT)))
1079                 goto out;
1080
1081         if (!(new & NUD_VALID)) {
1082                 neigh_del_timer(neigh);
1083                 if (old & NUD_CONNECTED)
1084                         neigh_suspect(neigh);
1085                 neigh->nud_state = new;
1086                 err = 0;
1087                 notify = old & NUD_VALID;
1088                 if ((old & (NUD_INCOMPLETE | NUD_PROBE)) &&
1089                     (new & NUD_FAILED)) {
1090                         neigh_invalidate(neigh);
1091                         notify = 1;
1092                 }
1093                 goto out;
1094         }
1095
1096         /* Compare new lladdr with cached one */
1097         if (!dev->addr_len) {
1098                 /* First case: device needs no address. */
1099                 lladdr = neigh->ha;
1100         } else if (lladdr) {
1101                 /* The second case: if something is already cached
1102                    and a new address is proposed:
1103                    - compare new & old
1104                    - if they are different, check override flag
1105                  */
1106                 if ((old & NUD_VALID) &&
1107                     !memcmp(lladdr, neigh->ha, dev->addr_len))
1108                         lladdr = neigh->ha;
1109         } else {
1110                 /* No address is supplied; if we know something,
1111                    use it, otherwise discard the request.
1112                  */
1113                 err = -EINVAL;
1114                 if (!(old & NUD_VALID))
1115                         goto out;
1116                 lladdr = neigh->ha;
1117         }
1118
1119         if (new & NUD_CONNECTED)
1120                 neigh->confirmed = jiffies;
1121         neigh->updated = jiffies;
1122
1123         /* If entry was valid and address is not changed,
1124            do not change entry state, if new one is STALE.
1125          */
1126         err = 0;
1127         update_isrouter = flags & NEIGH_UPDATE_F_OVERRIDE_ISROUTER;
1128         if (old & NUD_VALID) {
1129                 if (lladdr != neigh->ha && !(flags & NEIGH_UPDATE_F_OVERRIDE)) {
1130                         update_isrouter = 0;
1131                         if ((flags & NEIGH_UPDATE_F_WEAK_OVERRIDE) &&
1132                             (old & NUD_CONNECTED)) {
1133                                 lladdr = neigh->ha;
1134                                 new = NUD_STALE;
1135                         } else
1136                                 goto out;
1137                 } else {
1138                         if (lladdr == neigh->ha && new == NUD_STALE &&
1139                             ((flags & NEIGH_UPDATE_F_WEAK_OVERRIDE) ||
1140                              (old & NUD_CONNECTED))
1141                             )
1142                                 new = old;
1143                 }
1144         }
1145
1146         if (new != old) {
1147                 neigh_del_timer(neigh);
1148                 if (new & NUD_PROBE)
1149                         atomic_set(&neigh->probes, 0);
1150                 if (new & NUD_IN_TIMER)
1151                         neigh_add_timer(neigh, (jiffies +
1152                                                 ((new & NUD_REACHABLE) ?
1153                                                  neigh->parms->reachable_time :
1154                                                  0)));
1155                 neigh->nud_state = new;
1156                 notify = 1;
1157         }
1158
1159         if (lladdr != neigh->ha) {
1160                 write_seqlock(&neigh->ha_lock);
1161                 memcpy(&neigh->ha, lladdr, dev->addr_len);
1162                 write_sequnlock(&neigh->ha_lock);
1163                 neigh_update_hhs(neigh);
1164                 if (!(new & NUD_CONNECTED))
1165                         neigh->confirmed = jiffies -
1166                                       (NEIGH_VAR(neigh->parms, BASE_REACHABLE_TIME) << 1);
1167                 notify = 1;
1168         }
1169         if (new == old)
1170                 goto out;
1171         if (new & NUD_CONNECTED)
1172                 neigh_connect(neigh);
1173         else
1174                 neigh_suspect(neigh);
1175         if (!(old & NUD_VALID)) {
1176                 struct sk_buff *skb;
1177
1178                 /* Again: avoid dead loop if something went wrong */
1179
1180                 while (neigh->nud_state & NUD_VALID &&
1181                        (skb = __skb_dequeue(&neigh->arp_queue)) != NULL) {
1182                         struct dst_entry *dst = skb_dst(skb);
1183                         struct neighbour *n2, *n1 = neigh;
1184                         write_unlock_bh(&neigh->lock);
1185
1186                         rcu_read_lock();
1187
1188                         /* Why not just use 'neigh' as-is?  The problem is that
1189                          * things such as shaper, eql, and sch_teql can end up
1190                          * using alternative, different, neigh objects to output
1191                          * the packet in the output path.  So what we need to do
1192                          * here is re-lookup the top-level neigh in the path so
1193                          * we can reinject the packet there.
1194                          */
1195                         n2 = NULL;
1196                         if (dst) {
1197                                 n2 = dst_neigh_lookup_skb(dst, skb);
1198                                 if (n2)
1199                                         n1 = n2;
1200                         }
1201                         n1->output(n1, skb);
1202                         if (n2)
1203                                 neigh_release(n2);
1204                         rcu_read_unlock();
1205
1206                         write_lock_bh(&neigh->lock);
1207                 }
1208                 __skb_queue_purge(&neigh->arp_queue);
1209                 neigh->arp_queue_len_bytes = 0;
1210         }
1211 out:
1212         if (update_isrouter) {
1213                 neigh->flags = (flags & NEIGH_UPDATE_F_ISROUTER) ?
1214                         (neigh->flags | NTF_ROUTER) :
1215                         (neigh->flags & ~NTF_ROUTER);
1216         }
1217         write_unlock_bh(&neigh->lock);
1218
1219         if (notify)
1220                 neigh_update_notify(neigh);
1221
1222         return err;
1223 }
1224 EXPORT_SYMBOL(neigh_update);
1225
1226 /* Update the neigh to listen temporarily for probe responses, even if it is
1227  * in a NUD_FAILED state. The caller has to hold neigh->lock for writing.
1228  */
1229 void __neigh_set_probe_once(struct neighbour *neigh)
1230 {
1231         neigh->updated = jiffies;
1232         if (!(neigh->nud_state & NUD_FAILED))
1233                 return;
1234         neigh->nud_state = NUD_INCOMPLETE;
1235         atomic_set(&neigh->probes, neigh_max_probes(neigh));
1236         neigh_add_timer(neigh,
1237                         jiffies + NEIGH_VAR(neigh->parms, RETRANS_TIME));
1238 }
1239 EXPORT_SYMBOL(__neigh_set_probe_once);
1240
1241 struct neighbour *neigh_event_ns(struct neigh_table *tbl,
1242                                  u8 *lladdr, void *saddr,
1243                                  struct net_device *dev)
1244 {
1245         struct neighbour *neigh = __neigh_lookup(tbl, saddr, dev,
1246                                                  lladdr || !dev->addr_len);
1247         if (neigh)
1248                 neigh_update(neigh, lladdr, NUD_STALE,
1249                              NEIGH_UPDATE_F_OVERRIDE);
1250         return neigh;
1251 }
1252 EXPORT_SYMBOL(neigh_event_ns);
1253
1254 /* called with read_lock_bh(&n->lock); */
1255 static void neigh_hh_init(struct neighbour *n)
1256 {
1257         struct net_device *dev = n->dev;
1258         __be16 prot = n->tbl->protocol;
1259         struct hh_cache *hh = &n->hh;
1260
1261         write_lock_bh(&n->lock);
1262
1263         /* Only one thread can come in here and initialize the
1264          * hh_cache entry.
1265          */
1266         if (!hh->hh_len)
1267                 dev->header_ops->cache(n, hh, prot);
1268
1269         write_unlock_bh(&n->lock);
1270 }
1271
1272 /* Slow and careful. */
1273
1274 int neigh_resolve_output(struct neighbour *neigh, struct sk_buff *skb)
1275 {
1276         int rc = 0;
1277
1278         if (!neigh_event_send(neigh, skb)) {
1279                 int err;
1280                 struct net_device *dev = neigh->dev;
1281                 unsigned int seq;
1282
1283                 if (dev->header_ops->cache && !neigh->hh.hh_len)
1284                         neigh_hh_init(neigh);
1285
1286                 do {
1287                         __skb_pull(skb, skb_network_offset(skb));
1288                         seq = read_seqbegin(&neigh->ha_lock);
1289                         err = dev_hard_header(skb, dev, ntohs(skb->protocol),
1290                                               neigh->ha, NULL, skb->len);
1291                 } while (read_seqretry(&neigh->ha_lock, seq));
1292
1293                 if (err >= 0)
1294                         rc = dev_queue_xmit(skb);
1295                 else
1296                         goto out_kfree_skb;
1297         }
1298 out:
1299         return rc;
1300 out_kfree_skb:
1301         rc = -EINVAL;
1302         kfree_skb(skb);
1303         goto out;
1304 }
1305 EXPORT_SYMBOL(neigh_resolve_output);
1306
1307 /* As fast as possible without hh cache */
1308
1309 int neigh_connected_output(struct neighbour *neigh, struct sk_buff *skb)
1310 {
1311         struct net_device *dev = neigh->dev;
1312         unsigned int seq;
1313         int err;
1314
1315         do {
1316                 __skb_pull(skb, skb_network_offset(skb));
1317                 seq = read_seqbegin(&neigh->ha_lock);
1318                 err = dev_hard_header(skb, dev, ntohs(skb->protocol),
1319                                       neigh->ha, NULL, skb->len);
1320         } while (read_seqretry(&neigh->ha_lock, seq));
1321
1322         if (err >= 0)
1323                 err = dev_queue_xmit(skb);
1324         else {
1325                 err = -EINVAL;
1326                 kfree_skb(skb);
1327         }
1328         return err;
1329 }
1330 EXPORT_SYMBOL(neigh_connected_output);
1331
1332 int neigh_direct_output(struct neighbour *neigh, struct sk_buff *skb)
1333 {
1334         return dev_queue_xmit(skb);
1335 }
1336 EXPORT_SYMBOL(neigh_direct_output);
1337
1338 static void neigh_proxy_process(unsigned long arg)
1339 {
1340         struct neigh_table *tbl = (struct neigh_table *)arg;
1341         long sched_next = 0;
1342         unsigned long now = jiffies;
1343         struct sk_buff *skb, *n;
1344
1345         spin_lock(&tbl->proxy_queue.lock);
1346
1347         skb_queue_walk_safe(&tbl->proxy_queue, skb, n) {
1348                 long tdif = NEIGH_CB(skb)->sched_next - now;
1349
1350                 if (tdif <= 0) {
1351                         struct net_device *dev = skb->dev;
1352
1353                         __skb_unlink(skb, &tbl->proxy_queue);
1354                         if (tbl->proxy_redo && netif_running(dev)) {
1355                                 rcu_read_lock();
1356                                 tbl->proxy_redo(skb);
1357                                 rcu_read_unlock();
1358                         } else {
1359                                 kfree_skb(skb);
1360                         }
1361
1362                         dev_put(dev);
1363                 } else if (!sched_next || tdif < sched_next)
1364                         sched_next = tdif;
1365         }
1366         del_timer(&tbl->proxy_timer);
1367         if (sched_next)
1368                 mod_timer(&tbl->proxy_timer, jiffies + sched_next);
1369         spin_unlock(&tbl->proxy_queue.lock);
1370 }
1371
1372 void pneigh_enqueue(struct neigh_table *tbl, struct neigh_parms *p,
1373                     struct sk_buff *skb)
1374 {
1375         unsigned long now = jiffies;
1376
1377         unsigned long sched_next = now + (prandom_u32() %
1378                                           NEIGH_VAR(p, PROXY_DELAY));
1379
1380         if (tbl->proxy_queue.qlen > NEIGH_VAR(p, PROXY_QLEN)) {
1381                 kfree_skb(skb);
1382                 return;
1383         }
1384
1385         NEIGH_CB(skb)->sched_next = sched_next;
1386         NEIGH_CB(skb)->flags |= LOCALLY_ENQUEUED;
1387
1388         spin_lock(&tbl->proxy_queue.lock);
1389         if (del_timer(&tbl->proxy_timer)) {
1390                 if (time_before(tbl->proxy_timer.expires, sched_next))
1391                         sched_next = tbl->proxy_timer.expires;
1392         }
1393         skb_dst_drop(skb);
1394         dev_hold(skb->dev);
1395         __skb_queue_tail(&tbl->proxy_queue, skb);
1396         mod_timer(&tbl->proxy_timer, sched_next);
1397         spin_unlock(&tbl->proxy_queue.lock);
1398 }
1399 EXPORT_SYMBOL(pneigh_enqueue);
1400
1401 static inline struct neigh_parms *lookup_neigh_parms(struct neigh_table *tbl,
1402                                                       struct net *net, int ifindex)
1403 {
1404         struct neigh_parms *p;
1405
1406         list_for_each_entry(p, &tbl->parms_list, list) {
1407                 if ((p->dev && p->dev->ifindex == ifindex && net_eq(neigh_parms_net(p), net)) ||
1408                     (!p->dev && !ifindex && net_eq(net, &init_net)))
1409                         return p;
1410         }
1411
1412         return NULL;
1413 }
1414
1415 struct neigh_parms *neigh_parms_alloc(struct net_device *dev,
1416                                       struct neigh_table *tbl)
1417 {
1418         struct neigh_parms *p;
1419         struct net *net = dev_net(dev);
1420         const struct net_device_ops *ops = dev->netdev_ops;
1421
1422         p = kmemdup(&tbl->parms, sizeof(*p), GFP_KERNEL);
1423         if (p) {
1424                 p->tbl            = tbl;
1425                 atomic_set(&p->refcnt, 1);
1426                 p->reachable_time =
1427                                 neigh_rand_reach_time(NEIGH_VAR(p, BASE_REACHABLE_TIME));
1428                 dev_hold(dev);
1429                 p->dev = dev;
1430                 write_pnet(&p->net, net);
1431                 p->sysctl_table = NULL;
1432
1433                 if (ops->ndo_neigh_setup && ops->ndo_neigh_setup(dev, p)) {
1434                         dev_put(dev);
1435                         kfree(p);
1436                         return NULL;
1437                 }
1438
1439                 write_lock_bh(&tbl->lock);
1440                 list_add(&p->list, &tbl->parms.list);
1441                 write_unlock_bh(&tbl->lock);
1442
1443                 neigh_parms_data_state_cleanall(p);
1444         }
1445         return p;
1446 }
1447 EXPORT_SYMBOL(neigh_parms_alloc);
1448
1449 static void neigh_rcu_free_parms(struct rcu_head *head)
1450 {
1451         struct neigh_parms *parms =
1452                 container_of(head, struct neigh_parms, rcu_head);
1453
1454         neigh_parms_put(parms);
1455 }
1456
1457 void neigh_parms_release(struct neigh_table *tbl, struct neigh_parms *parms)
1458 {
1459         if (!parms || parms == &tbl->parms)
1460                 return;
1461         write_lock_bh(&tbl->lock);
1462         list_del(&parms->list);
1463         parms->dead = 1;
1464         write_unlock_bh(&tbl->lock);
1465         if (parms->dev)
1466                 dev_put(parms->dev);
1467         call_rcu(&parms->rcu_head, neigh_rcu_free_parms);
1468 }
1469 EXPORT_SYMBOL(neigh_parms_release);
1470
1471 static void neigh_parms_destroy(struct neigh_parms *parms)
1472 {
1473         kfree(parms);
1474 }
1475
1476 static struct lock_class_key neigh_table_proxy_queue_class;
1477
1478 static struct neigh_table *neigh_tables[NEIGH_NR_TABLES] __read_mostly;
1479
1480 void neigh_table_init(int index, struct neigh_table *tbl)
1481 {
1482         unsigned long now = jiffies;
1483         unsigned long phsize;
1484
1485         INIT_LIST_HEAD(&tbl->parms_list);
1486         list_add(&tbl->parms.list, &tbl->parms_list);
1487         write_pnet(&tbl->parms.net, &init_net);
1488         atomic_set(&tbl->parms.refcnt, 1);
1489         tbl->parms.reachable_time =
1490                           neigh_rand_reach_time(NEIGH_VAR(&tbl->parms, BASE_REACHABLE_TIME));
1491
1492         tbl->stats = alloc_percpu(struct neigh_statistics);
1493         if (!tbl->stats)
1494                 panic("cannot create neighbour cache statistics");
1495
1496 #ifdef CONFIG_PROC_FS
1497         if (!proc_create_data(tbl->id, 0, init_net.proc_net_stat,
1498                               &neigh_stat_seq_fops, tbl))
1499                 panic("cannot create neighbour proc dir entry");
1500 #endif
1501
1502         RCU_INIT_POINTER(tbl->nht, neigh_hash_alloc(3));
1503
1504         phsize = (PNEIGH_HASHMASK + 1) * sizeof(struct pneigh_entry *);
1505         tbl->phash_buckets = kzalloc(phsize, GFP_KERNEL);
1506
1507         if (!tbl->nht || !tbl->phash_buckets)
1508                 panic("cannot allocate neighbour cache hashes");
1509
1510         if (!tbl->entry_size)
1511                 tbl->entry_size = ALIGN(offsetof(struct neighbour, primary_key) +
1512                                         tbl->key_len, NEIGH_PRIV_ALIGN);
1513         else
1514                 WARN_ON(tbl->entry_size % NEIGH_PRIV_ALIGN);
1515
1516         rwlock_init(&tbl->lock);
1517         INIT_DEFERRABLE_WORK(&tbl->gc_work, neigh_periodic_work);
1518         queue_delayed_work(system_power_efficient_wq, &tbl->gc_work,
1519                         tbl->parms.reachable_time);
1520         setup_timer(&tbl->proxy_timer, neigh_proxy_process, (unsigned long)tbl);
1521         skb_queue_head_init_class(&tbl->proxy_queue,
1522                         &neigh_table_proxy_queue_class);
1523
1524         tbl->last_flush = now;
1525         tbl->last_rand  = now + tbl->parms.reachable_time * 20;
1526
1527         neigh_tables[index] = tbl;
1528 }
1529 EXPORT_SYMBOL(neigh_table_init);
1530
1531 int neigh_table_clear(int index, struct neigh_table *tbl)
1532 {
1533         neigh_tables[index] = NULL;
1534         /* It is not clean... Fix it to unload IPv6 module safely */
1535         cancel_delayed_work_sync(&tbl->gc_work);
1536         del_timer_sync(&tbl->proxy_timer);
1537         pneigh_queue_purge(&tbl->proxy_queue);
1538         neigh_ifdown(tbl, NULL);
1539         if (atomic_read(&tbl->entries))
1540                 pr_crit("neighbour leakage\n");
1541
1542         call_rcu(&rcu_dereference_protected(tbl->nht, 1)->rcu,
1543                  neigh_hash_free_rcu);
1544         tbl->nht = NULL;
1545
1546         kfree(tbl->phash_buckets);
1547         tbl->phash_buckets = NULL;
1548
1549         remove_proc_entry(tbl->id, init_net.proc_net_stat);
1550
1551         free_percpu(tbl->stats);
1552         tbl->stats = NULL;
1553
1554         return 0;
1555 }
1556 EXPORT_SYMBOL(neigh_table_clear);
1557
1558 static struct neigh_table *neigh_find_table(int family)
1559 {
1560         struct neigh_table *tbl = NULL;
1561
1562         switch (family) {
1563         case AF_INET:
1564                 tbl = neigh_tables[NEIGH_ARP_TABLE];
1565                 break;
1566         case AF_INET6:
1567                 tbl = neigh_tables[NEIGH_ND_TABLE];
1568                 break;
1569         case AF_DECnet:
1570                 tbl = neigh_tables[NEIGH_DN_TABLE];
1571                 break;
1572         }
1573
1574         return tbl;
1575 }
1576
1577 static int neigh_delete(struct sk_buff *skb, struct nlmsghdr *nlh)
1578 {
1579         struct net *net = sock_net(skb->sk);
1580         struct ndmsg *ndm;
1581         struct nlattr *dst_attr;
1582         struct neigh_table *tbl;
1583         struct neighbour *neigh;
1584         struct net_device *dev = NULL;
1585         int err = -EINVAL;
1586
1587         ASSERT_RTNL();
1588         if (nlmsg_len(nlh) < sizeof(*ndm))
1589                 goto out;
1590
1591         dst_attr = nlmsg_find_attr(nlh, sizeof(*ndm), NDA_DST);
1592         if (dst_attr == NULL)
1593                 goto out;
1594
1595         ndm = nlmsg_data(nlh);
1596         if (ndm->ndm_ifindex) {
1597                 dev = __dev_get_by_index(net, ndm->ndm_ifindex);
1598                 if (dev == NULL) {
1599                         err = -ENODEV;
1600                         goto out;
1601                 }
1602         }
1603
1604         tbl = neigh_find_table(ndm->ndm_family);
1605         if (tbl == NULL)
1606                 return -EAFNOSUPPORT;
1607
1608         if (nla_len(dst_attr) < tbl->key_len)
1609                 goto out;
1610
1611         if (ndm->ndm_flags & NTF_PROXY) {
1612                 err = pneigh_delete(tbl, net, nla_data(dst_attr), dev);
1613                 goto out;
1614         }
1615
1616         if (dev == NULL)
1617                 goto out;
1618
1619         neigh = neigh_lookup(tbl, nla_data(dst_attr), dev);
1620         if (neigh == NULL) {
1621                 err = -ENOENT;
1622                 goto out;
1623         }
1624
1625         err = neigh_update(neigh, NULL, NUD_FAILED,
1626                            NEIGH_UPDATE_F_OVERRIDE |
1627                            NEIGH_UPDATE_F_ADMIN);
1628         neigh_release(neigh);
1629
1630 out:
1631         return err;
1632 }
1633
1634 static int neigh_add(struct sk_buff *skb, struct nlmsghdr *nlh)
1635 {
1636         int flags = NEIGH_UPDATE_F_ADMIN | NEIGH_UPDATE_F_OVERRIDE;
1637         struct net *net = sock_net(skb->sk);
1638         struct ndmsg *ndm;
1639         struct nlattr *tb[NDA_MAX+1];
1640         struct neigh_table *tbl;
1641         struct net_device *dev = NULL;
1642         struct neighbour *neigh;
1643         void *dst, *lladdr;
1644         int err;
1645
1646         ASSERT_RTNL();
1647         err = nlmsg_parse(nlh, sizeof(*ndm), tb, NDA_MAX, NULL);
1648         if (err < 0)
1649                 goto out;
1650
1651         err = -EINVAL;
1652         if (tb[NDA_DST] == NULL)
1653                 goto out;
1654
1655         ndm = nlmsg_data(nlh);
1656         if (ndm->ndm_ifindex) {
1657                 dev = __dev_get_by_index(net, ndm->ndm_ifindex);
1658                 if (dev == NULL) {
1659                         err = -ENODEV;
1660                         goto out;
1661                 }
1662
1663                 if (tb[NDA_LLADDR] && nla_len(tb[NDA_LLADDR]) < dev->addr_len)
1664                         goto out;
1665         }
1666
1667         tbl = neigh_find_table(ndm->ndm_family);
1668         if (tbl == NULL)
1669                 return -EAFNOSUPPORT;
1670
1671         if (nla_len(tb[NDA_DST]) < tbl->key_len)
1672                 goto out;
1673         dst = nla_data(tb[NDA_DST]);
1674         lladdr = tb[NDA_LLADDR] ? nla_data(tb[NDA_LLADDR]) : NULL;
1675
1676         if (ndm->ndm_flags & NTF_PROXY) {
1677                 struct pneigh_entry *pn;
1678
1679                 err = -ENOBUFS;
1680                 pn = pneigh_lookup(tbl, net, dst, dev, 1);
1681                 if (pn) {
1682                         pn->flags = ndm->ndm_flags;
1683                         err = 0;
1684                 }
1685                 goto out;
1686         }
1687
1688         if (dev == NULL)
1689                 goto out;
1690
1691         neigh = neigh_lookup(tbl, dst, dev);
1692         if (neigh == NULL) {
1693                 if (!(nlh->nlmsg_flags & NLM_F_CREATE)) {
1694                         err = -ENOENT;
1695                         goto out;
1696                 }
1697
1698                 neigh = __neigh_lookup_errno(tbl, dst, dev);
1699                 if (IS_ERR(neigh)) {
1700                         err = PTR_ERR(neigh);
1701                         goto out;
1702                 }
1703         } else {
1704                 if (nlh->nlmsg_flags & NLM_F_EXCL) {
1705                         err = -EEXIST;
1706                         neigh_release(neigh);
1707                         goto out;
1708                 }
1709
1710                 if (!(nlh->nlmsg_flags & NLM_F_REPLACE))
1711                         flags &= ~NEIGH_UPDATE_F_OVERRIDE;
1712         }
1713
1714         if (ndm->ndm_flags & NTF_USE) {
1715                 neigh_event_send(neigh, NULL);
1716                 err = 0;
1717         } else
1718                 err = neigh_update(neigh, lladdr, ndm->ndm_state, flags);
1719         neigh_release(neigh);
1720
1721 out:
1722         return err;
1723 }
1724
1725 static int neightbl_fill_parms(struct sk_buff *skb, struct neigh_parms *parms)
1726 {
1727         struct nlattr *nest;
1728
1729         nest = nla_nest_start(skb, NDTA_PARMS);
1730         if (nest == NULL)
1731                 return -ENOBUFS;
1732
1733         if ((parms->dev &&
1734              nla_put_u32(skb, NDTPA_IFINDEX, parms->dev->ifindex)) ||
1735             nla_put_u32(skb, NDTPA_REFCNT, atomic_read(&parms->refcnt)) ||
1736             nla_put_u32(skb, NDTPA_QUEUE_LENBYTES,
1737                         NEIGH_VAR(parms, QUEUE_LEN_BYTES)) ||
1738             /* approximative value for deprecated QUEUE_LEN (in packets) */
1739             nla_put_u32(skb, NDTPA_QUEUE_LEN,
1740                         NEIGH_VAR(parms, QUEUE_LEN_BYTES) / SKB_TRUESIZE(ETH_FRAME_LEN)) ||
1741             nla_put_u32(skb, NDTPA_PROXY_QLEN, NEIGH_VAR(parms, PROXY_QLEN)) ||
1742             nla_put_u32(skb, NDTPA_APP_PROBES, NEIGH_VAR(parms, APP_PROBES)) ||
1743             nla_put_u32(skb, NDTPA_UCAST_PROBES,
1744                         NEIGH_VAR(parms, UCAST_PROBES)) ||
1745             nla_put_u32(skb, NDTPA_MCAST_PROBES,
1746                         NEIGH_VAR(parms, MCAST_PROBES)) ||
1747             nla_put_u32(skb, NDTPA_MCAST_REPROBES,
1748                         NEIGH_VAR(parms, MCAST_REPROBES)) ||
1749             nla_put_msecs(skb, NDTPA_REACHABLE_TIME, parms->reachable_time) ||
1750             nla_put_msecs(skb, NDTPA_BASE_REACHABLE_TIME,
1751                           NEIGH_VAR(parms, BASE_REACHABLE_TIME)) ||
1752             nla_put_msecs(skb, NDTPA_GC_STALETIME,
1753                           NEIGH_VAR(parms, GC_STALETIME)) ||
1754             nla_put_msecs(skb, NDTPA_DELAY_PROBE_TIME,
1755                           NEIGH_VAR(parms, DELAY_PROBE_TIME)) ||
1756             nla_put_msecs(skb, NDTPA_RETRANS_TIME,
1757                           NEIGH_VAR(parms, RETRANS_TIME)) ||
1758             nla_put_msecs(skb, NDTPA_ANYCAST_DELAY,
1759                           NEIGH_VAR(parms, ANYCAST_DELAY)) ||
1760             nla_put_msecs(skb, NDTPA_PROXY_DELAY,
1761                           NEIGH_VAR(parms, PROXY_DELAY)) ||
1762             nla_put_msecs(skb, NDTPA_LOCKTIME,
1763                           NEIGH_VAR(parms, LOCKTIME)))
1764                 goto nla_put_failure;
1765         return nla_nest_end(skb, nest);
1766
1767 nla_put_failure:
1768         nla_nest_cancel(skb, nest);
1769         return -EMSGSIZE;
1770 }
1771
1772 static int neightbl_fill_info(struct sk_buff *skb, struct neigh_table *tbl,
1773                               u32 pid, u32 seq, int type, int flags)
1774 {
1775         struct nlmsghdr *nlh;
1776         struct ndtmsg *ndtmsg;
1777
1778         nlh = nlmsg_put(skb, pid, seq, type, sizeof(*ndtmsg), flags);
1779         if (nlh == NULL)
1780                 return -EMSGSIZE;
1781
1782         ndtmsg = nlmsg_data(nlh);
1783
1784         read_lock_bh(&tbl->lock);
1785         ndtmsg->ndtm_family = tbl->family;
1786         ndtmsg->ndtm_pad1   = 0;
1787         ndtmsg->ndtm_pad2   = 0;
1788
1789         if (nla_put_string(skb, NDTA_NAME, tbl->id) ||
1790             nla_put_msecs(skb, NDTA_GC_INTERVAL, tbl->gc_interval) ||
1791             nla_put_u32(skb, NDTA_THRESH1, tbl->gc_thresh1) ||
1792             nla_put_u32(skb, NDTA_THRESH2, tbl->gc_thresh2) ||
1793             nla_put_u32(skb, NDTA_THRESH3, tbl->gc_thresh3))
1794                 goto nla_put_failure;
1795         {
1796                 unsigned long now = jiffies;
1797                 unsigned int flush_delta = now - tbl->last_flush;
1798                 unsigned int rand_delta = now - tbl->last_rand;
1799                 struct neigh_hash_table *nht;
1800                 struct ndt_config ndc = {
1801                         .ndtc_key_len           = tbl->key_len,
1802                         .ndtc_entry_size        = tbl->entry_size,
1803                         .ndtc_entries           = atomic_read(&tbl->entries),
1804                         .ndtc_last_flush        = jiffies_to_msecs(flush_delta),
1805                         .ndtc_last_rand         = jiffies_to_msecs(rand_delta),
1806                         .ndtc_proxy_qlen        = tbl->proxy_queue.qlen,
1807                 };
1808
1809                 rcu_read_lock_bh();
1810                 nht = rcu_dereference_bh(tbl->nht);
1811                 ndc.ndtc_hash_rnd = nht->hash_rnd[0];
1812                 ndc.ndtc_hash_mask = ((1 << nht->hash_shift) - 1);
1813                 rcu_read_unlock_bh();
1814
1815                 if (nla_put(skb, NDTA_CONFIG, sizeof(ndc), &ndc))
1816                         goto nla_put_failure;
1817         }
1818
1819         {
1820                 int cpu;
1821                 struct ndt_stats ndst;
1822
1823                 memset(&ndst, 0, sizeof(ndst));
1824
1825                 for_each_possible_cpu(cpu) {
1826                         struct neigh_statistics *st;
1827
1828                         st = per_cpu_ptr(tbl->stats, cpu);
1829                         ndst.ndts_allocs                += st->allocs;
1830                         ndst.ndts_destroys              += st->destroys;
1831                         ndst.ndts_hash_grows            += st->hash_grows;
1832                         ndst.ndts_res_failed            += st->res_failed;
1833                         ndst.ndts_lookups               += st->lookups;
1834                         ndst.ndts_hits                  += st->hits;
1835                         ndst.ndts_rcv_probes_mcast      += st->rcv_probes_mcast;
1836                         ndst.ndts_rcv_probes_ucast      += st->rcv_probes_ucast;
1837                         ndst.ndts_periodic_gc_runs      += st->periodic_gc_runs;
1838                         ndst.ndts_forced_gc_runs        += st->forced_gc_runs;
1839                 }
1840
1841                 if (nla_put(skb, NDTA_STATS, sizeof(ndst), &ndst))
1842                         goto nla_put_failure;
1843         }
1844
1845         BUG_ON(tbl->parms.dev);
1846         if (neightbl_fill_parms(skb, &tbl->parms) < 0)
1847                 goto nla_put_failure;
1848
1849         read_unlock_bh(&tbl->lock);
1850         nlmsg_end(skb, nlh);
1851         return 0;
1852
1853 nla_put_failure:
1854         read_unlock_bh(&tbl->lock);
1855         nlmsg_cancel(skb, nlh);
1856         return -EMSGSIZE;
1857 }
1858
1859 static int neightbl_fill_param_info(struct sk_buff *skb,
1860                                     struct neigh_table *tbl,
1861                                     struct neigh_parms *parms,
1862                                     u32 pid, u32 seq, int type,
1863                                     unsigned int flags)
1864 {
1865         struct ndtmsg *ndtmsg;
1866         struct nlmsghdr *nlh;
1867
1868         nlh = nlmsg_put(skb, pid, seq, type, sizeof(*ndtmsg), flags);
1869         if (nlh == NULL)
1870                 return -EMSGSIZE;
1871
1872         ndtmsg = nlmsg_data(nlh);
1873
1874         read_lock_bh(&tbl->lock);
1875         ndtmsg->ndtm_family = tbl->family;
1876         ndtmsg->ndtm_pad1   = 0;
1877         ndtmsg->ndtm_pad2   = 0;
1878
1879         if (nla_put_string(skb, NDTA_NAME, tbl->id) < 0 ||
1880             neightbl_fill_parms(skb, parms) < 0)
1881                 goto errout;
1882
1883         read_unlock_bh(&tbl->lock);
1884         nlmsg_end(skb, nlh);
1885         return 0;
1886 errout:
1887         read_unlock_bh(&tbl->lock);
1888         nlmsg_cancel(skb, nlh);
1889         return -EMSGSIZE;
1890 }
1891
1892 static const struct nla_policy nl_neightbl_policy[NDTA_MAX+1] = {
1893         [NDTA_NAME]             = { .type = NLA_STRING },
1894         [NDTA_THRESH1]          = { .type = NLA_U32 },
1895         [NDTA_THRESH2]          = { .type = NLA_U32 },
1896         [NDTA_THRESH3]          = { .type = NLA_U32 },
1897         [NDTA_GC_INTERVAL]      = { .type = NLA_U64 },
1898         [NDTA_PARMS]            = { .type = NLA_NESTED },
1899 };
1900
1901 static const struct nla_policy nl_ntbl_parm_policy[NDTPA_MAX+1] = {
1902         [NDTPA_IFINDEX]                 = { .type = NLA_U32 },
1903         [NDTPA_QUEUE_LEN]               = { .type = NLA_U32 },
1904         [NDTPA_PROXY_QLEN]              = { .type = NLA_U32 },
1905         [NDTPA_APP_PROBES]              = { .type = NLA_U32 },
1906         [NDTPA_UCAST_PROBES]            = { .type = NLA_U32 },
1907         [NDTPA_MCAST_PROBES]            = { .type = NLA_U32 },
1908         [NDTPA_MCAST_REPROBES]          = { .type = NLA_U32 },
1909         [NDTPA_BASE_REACHABLE_TIME]     = { .type = NLA_U64 },
1910         [NDTPA_GC_STALETIME]            = { .type = NLA_U64 },
1911         [NDTPA_DELAY_PROBE_TIME]        = { .type = NLA_U64 },
1912         [NDTPA_RETRANS_TIME]            = { .type = NLA_U64 },
1913         [NDTPA_ANYCAST_DELAY]           = { .type = NLA_U64 },
1914         [NDTPA_PROXY_DELAY]             = { .type = NLA_U64 },
1915         [NDTPA_LOCKTIME]                = { .type = NLA_U64 },
1916 };
1917
1918 static int neightbl_set(struct sk_buff *skb, struct nlmsghdr *nlh)
1919 {
1920         struct net *net = sock_net(skb->sk);
1921         struct neigh_table *tbl;
1922         struct ndtmsg *ndtmsg;
1923         struct nlattr *tb[NDTA_MAX+1];
1924         bool found = false;
1925         int err, tidx;
1926
1927         err = nlmsg_parse(nlh, sizeof(*ndtmsg), tb, NDTA_MAX,
1928                           nl_neightbl_policy);
1929         if (err < 0)
1930                 goto errout;
1931
1932         if (tb[NDTA_NAME] == NULL) {
1933                 err = -EINVAL;
1934                 goto errout;
1935         }
1936
1937         ndtmsg = nlmsg_data(nlh);
1938
1939         for (tidx = 0; tidx < NEIGH_NR_TABLES; tidx++) {
1940                 tbl = neigh_tables[tidx];
1941                 if (!tbl)
1942                         continue;
1943                 if (ndtmsg->ndtm_family && tbl->family != ndtmsg->ndtm_family)
1944                         continue;
1945                 if (nla_strcmp(tb[NDTA_NAME], tbl->id) == 0) {
1946                         found = true;
1947                         break;
1948                 }
1949         }
1950
1951         if (!found)
1952                 return -ENOENT;
1953
1954         /*
1955          * We acquire tbl->lock to be nice to the periodic timers and
1956          * make sure they always see a consistent set of values.
1957          */
1958         write_lock_bh(&tbl->lock);
1959
1960         if (tb[NDTA_PARMS]) {
1961                 struct nlattr *tbp[NDTPA_MAX+1];
1962                 struct neigh_parms *p;
1963                 int i, ifindex = 0;
1964
1965                 err = nla_parse_nested(tbp, NDTPA_MAX, tb[NDTA_PARMS],
1966                                        nl_ntbl_parm_policy);
1967                 if (err < 0)
1968                         goto errout_tbl_lock;
1969
1970                 if (tbp[NDTPA_IFINDEX])
1971                         ifindex = nla_get_u32(tbp[NDTPA_IFINDEX]);
1972
1973                 p = lookup_neigh_parms(tbl, net, ifindex);
1974                 if (p == NULL) {
1975                         err = -ENOENT;
1976                         goto errout_tbl_lock;
1977                 }
1978
1979                 for (i = 1; i <= NDTPA_MAX; i++) {
1980                         if (tbp[i] == NULL)
1981                                 continue;
1982
1983                         switch (i) {
1984                         case NDTPA_QUEUE_LEN:
1985                                 NEIGH_VAR_SET(p, QUEUE_LEN_BYTES,
1986                                               nla_get_u32(tbp[i]) *
1987                                               SKB_TRUESIZE(ETH_FRAME_LEN));
1988                                 break;
1989                         case NDTPA_QUEUE_LENBYTES:
1990                                 NEIGH_VAR_SET(p, QUEUE_LEN_BYTES,
1991                                               nla_get_u32(tbp[i]));
1992                                 break;
1993                         case NDTPA_PROXY_QLEN:
1994                                 NEIGH_VAR_SET(p, PROXY_QLEN,
1995                                               nla_get_u32(tbp[i]));
1996                                 break;
1997                         case NDTPA_APP_PROBES:
1998                                 NEIGH_VAR_SET(p, APP_PROBES,
1999                                               nla_get_u32(tbp[i]));
2000                                 break;
2001                         case NDTPA_UCAST_PROBES:
2002                                 NEIGH_VAR_SET(p, UCAST_PROBES,
2003                                               nla_get_u32(tbp[i]));
2004                                 break;
2005                         case NDTPA_MCAST_PROBES:
2006                                 NEIGH_VAR_SET(p, MCAST_PROBES,
2007                                               nla_get_u32(tbp[i]));
2008                                 break;
2009                         case NDTPA_MCAST_REPROBES:
2010                                 NEIGH_VAR_SET(p, MCAST_REPROBES,
2011                                               nla_get_u32(tbp[i]));
2012                                 break;
2013                         case NDTPA_BASE_REACHABLE_TIME:
2014                                 NEIGH_VAR_SET(p, BASE_REACHABLE_TIME,
2015                                               nla_get_msecs(tbp[i]));
2016                                 /* update reachable_time as well, otherwise, the change will
2017                                  * only be effective after the next time neigh_periodic_work
2018                                  * decides to recompute it (can be multiple minutes)
2019                                  */
2020                                 p->reachable_time =
2021                                         neigh_rand_reach_time(NEIGH_VAR(p, BASE_REACHABLE_TIME));
2022                                 break;
2023                         case NDTPA_GC_STALETIME:
2024                                 NEIGH_VAR_SET(p, GC_STALETIME,
2025                                               nla_get_msecs(tbp[i]));
2026                                 break;
2027                         case NDTPA_DELAY_PROBE_TIME:
2028                                 NEIGH_VAR_SET(p, DELAY_PROBE_TIME,
2029                                               nla_get_msecs(tbp[i]));
2030                                 break;
2031                         case NDTPA_RETRANS_TIME:
2032                                 NEIGH_VAR_SET(p, RETRANS_TIME,
2033                                               nla_get_msecs(tbp[i]));
2034                                 break;
2035                         case NDTPA_ANYCAST_DELAY:
2036                                 NEIGH_VAR_SET(p, ANYCAST_DELAY,
2037                                               nla_get_msecs(tbp[i]));
2038                                 break;
2039                         case NDTPA_PROXY_DELAY:
2040                                 NEIGH_VAR_SET(p, PROXY_DELAY,
2041                                               nla_get_msecs(tbp[i]));
2042                                 break;
2043                         case NDTPA_LOCKTIME:
2044                                 NEIGH_VAR_SET(p, LOCKTIME,
2045                                               nla_get_msecs(tbp[i]));
2046                                 break;
2047                         }
2048                 }
2049         }
2050
2051         err = -ENOENT;
2052         if ((tb[NDTA_THRESH1] || tb[NDTA_THRESH2] ||
2053              tb[NDTA_THRESH3] || tb[NDTA_GC_INTERVAL]) &&
2054             !net_eq(net, &init_net))
2055                 goto errout_tbl_lock;
2056
2057         if (tb[NDTA_THRESH1])
2058                 tbl->gc_thresh1 = nla_get_u32(tb[NDTA_THRESH1]);
2059
2060         if (tb[NDTA_THRESH2])
2061                 tbl->gc_thresh2 = nla_get_u32(tb[NDTA_THRESH2]);
2062
2063         if (tb[NDTA_THRESH3])
2064                 tbl->gc_thresh3 = nla_get_u32(tb[NDTA_THRESH3]);
2065
2066         if (tb[NDTA_GC_INTERVAL])
2067                 tbl->gc_interval = nla_get_msecs(tb[NDTA_GC_INTERVAL]);
2068
2069         err = 0;
2070
2071 errout_tbl_lock:
2072         write_unlock_bh(&tbl->lock);
2073 errout:
2074         return err;
2075 }
2076
2077 static int neightbl_dump_info(struct sk_buff *skb, struct netlink_callback *cb)
2078 {
2079         struct net *net = sock_net(skb->sk);
2080         int family, tidx, nidx = 0;
2081         int tbl_skip = cb->args[0];
2082         int neigh_skip = cb->args[1];
2083         struct neigh_table *tbl;
2084
2085         family = ((struct rtgenmsg *) nlmsg_data(cb->nlh))->rtgen_family;
2086
2087         for (tidx = 0; tidx < NEIGH_NR_TABLES; tidx++) {
2088                 struct neigh_parms *p;
2089
2090                 tbl = neigh_tables[tidx];
2091                 if (!tbl)
2092                         continue;
2093
2094                 if (tidx < tbl_skip || (family && tbl->family != family))
2095                         continue;
2096
2097                 if (neightbl_fill_info(skb, tbl, NETLINK_CB(cb->skb).portid,
2098                                        cb->nlh->nlmsg_seq, RTM_NEWNEIGHTBL,
2099                                        NLM_F_MULTI) < 0)
2100                         break;
2101
2102                 nidx = 0;
2103                 p = list_next_entry(&tbl->parms, list);
2104                 list_for_each_entry_from(p, &tbl->parms_list, list) {
2105                         if (!net_eq(neigh_parms_net(p), net))
2106                                 continue;
2107
2108                         if (nidx < neigh_skip)
2109                                 goto next;
2110
2111                         if (neightbl_fill_param_info(skb, tbl, p,
2112                                                      NETLINK_CB(cb->skb).portid,
2113                                                      cb->nlh->nlmsg_seq,
2114                                                      RTM_NEWNEIGHTBL,
2115                                                      NLM_F_MULTI) < 0)
2116                                 goto out;
2117                 next:
2118                         nidx++;
2119                 }
2120
2121                 neigh_skip = 0;
2122         }
2123 out:
2124         cb->args[0] = tidx;
2125         cb->args[1] = nidx;
2126
2127         return skb->len;
2128 }
2129
2130 static int neigh_fill_info(struct sk_buff *skb, struct neighbour *neigh,
2131                            u32 pid, u32 seq, int type, unsigned int flags)
2132 {
2133         unsigned long now = jiffies;
2134         struct nda_cacheinfo ci;
2135         struct nlmsghdr *nlh;
2136         struct ndmsg *ndm;
2137
2138         nlh = nlmsg_put(skb, pid, seq, type, sizeof(*ndm), flags);
2139         if (nlh == NULL)
2140                 return -EMSGSIZE;
2141
2142         ndm = nlmsg_data(nlh);
2143         ndm->ndm_family  = neigh->ops->family;
2144         ndm->ndm_pad1    = 0;
2145         ndm->ndm_pad2    = 0;
2146         ndm->ndm_flags   = neigh->flags;
2147         ndm->ndm_type    = neigh->type;
2148         ndm->ndm_ifindex = neigh->dev->ifindex;
2149
2150         if (nla_put(skb, NDA_DST, neigh->tbl->key_len, neigh->primary_key))
2151                 goto nla_put_failure;
2152
2153         read_lock_bh(&neigh->lock);
2154         ndm->ndm_state   = neigh->nud_state;
2155         if (neigh->nud_state & NUD_VALID) {
2156                 char haddr[MAX_ADDR_LEN];
2157
2158                 neigh_ha_snapshot(haddr, neigh, neigh->dev);
2159                 if (nla_put(skb, NDA_LLADDR, neigh->dev->addr_len, haddr) < 0) {
2160                         read_unlock_bh(&neigh->lock);
2161                         goto nla_put_failure;
2162                 }
2163         }
2164
2165         ci.ndm_used      = jiffies_to_clock_t(now - neigh->used);
2166         ci.ndm_confirmed = jiffies_to_clock_t(now - neigh->confirmed);
2167         ci.ndm_updated   = jiffies_to_clock_t(now - neigh->updated);
2168         ci.ndm_refcnt    = atomic_read(&neigh->refcnt) - 1;
2169         read_unlock_bh(&neigh->lock);
2170
2171         if (nla_put_u32(skb, NDA_PROBES, atomic_read(&neigh->probes)) ||
2172             nla_put(skb, NDA_CACHEINFO, sizeof(ci), &ci))
2173                 goto nla_put_failure;
2174
2175         nlmsg_end(skb, nlh);
2176         return 0;
2177
2178 nla_put_failure:
2179         nlmsg_cancel(skb, nlh);
2180         return -EMSGSIZE;
2181 }
2182
2183 static int pneigh_fill_info(struct sk_buff *skb, struct pneigh_entry *pn,
2184                             u32 pid, u32 seq, int type, unsigned int flags,
2185                             struct neigh_table *tbl)
2186 {
2187         struct nlmsghdr *nlh;
2188         struct ndmsg *ndm;
2189
2190         nlh = nlmsg_put(skb, pid, seq, type, sizeof(*ndm), flags);
2191         if (nlh == NULL)
2192                 return -EMSGSIZE;
2193
2194         ndm = nlmsg_data(nlh);
2195         ndm->ndm_family  = tbl->family;
2196         ndm->ndm_pad1    = 0;
2197         ndm->ndm_pad2    = 0;
2198         ndm->ndm_flags   = pn->flags | NTF_PROXY;
2199         ndm->ndm_type    = RTN_UNICAST;
2200         ndm->ndm_ifindex = pn->dev->ifindex;
2201         ndm->ndm_state   = NUD_NONE;
2202
2203         if (nla_put(skb, NDA_DST, tbl->key_len, pn->key))
2204                 goto nla_put_failure;
2205
2206         nlmsg_end(skb, nlh);
2207         return 0;
2208
2209 nla_put_failure:
2210         nlmsg_cancel(skb, nlh);
2211         return -EMSGSIZE;
2212 }
2213
2214 static void neigh_update_notify(struct neighbour *neigh)
2215 {
2216         call_netevent_notifiers(NETEVENT_NEIGH_UPDATE, neigh);
2217         __neigh_notify(neigh, RTM_NEWNEIGH, 0);
2218 }
2219
2220 static int neigh_dump_table(struct neigh_table *tbl, struct sk_buff *skb,
2221                             struct netlink_callback *cb)
2222 {
2223         struct net *net = sock_net(skb->sk);
2224         struct neighbour *n;
2225         int rc, h, s_h = cb->args[1];
2226         int idx, s_idx = idx = cb->args[2];
2227         struct neigh_hash_table *nht;
2228
2229         rcu_read_lock_bh();
2230         nht = rcu_dereference_bh(tbl->nht);
2231
2232         for (h = s_h; h < (1 << nht->hash_shift); h++) {
2233                 if (h > s_h)
2234                         s_idx = 0;
2235                 for (n = rcu_dereference_bh(nht->hash_buckets[h]), idx = 0;
2236                      n != NULL;
2237                      n = rcu_dereference_bh(n->next)) {
2238                         if (!net_eq(dev_net(n->dev), net))
2239                                 continue;
2240                         if (idx < s_idx)
2241                                 goto next;
2242                         if (neigh_fill_info(skb, n, NETLINK_CB(cb->skb).portid,
2243                                             cb->nlh->nlmsg_seq,
2244                                             RTM_NEWNEIGH,
2245                                             NLM_F_MULTI) < 0) {
2246                                 rc = -1;
2247                                 goto out;
2248                         }
2249 next:
2250                         idx++;
2251                 }
2252         }
2253         rc = skb->len;
2254 out:
2255         rcu_read_unlock_bh();
2256         cb->args[1] = h;
2257         cb->args[2] = idx;
2258         return rc;
2259 }
2260
2261 static int pneigh_dump_table(struct neigh_table *tbl, struct sk_buff *skb,
2262                              struct netlink_callback *cb)
2263 {
2264         struct pneigh_entry *n;
2265         struct net *net = sock_net(skb->sk);
2266         int rc, h, s_h = cb->args[3];
2267         int idx, s_idx = idx = cb->args[4];
2268
2269         read_lock_bh(&tbl->lock);
2270
2271         for (h = s_h; h <= PNEIGH_HASHMASK; h++) {
2272                 if (h > s_h)
2273                         s_idx = 0;
2274                 for (n = tbl->phash_buckets[h], idx = 0; n; n = n->next) {
2275                         if (dev_net(n->dev) != net)
2276                                 continue;
2277                         if (idx < s_idx)
2278                                 goto next;
2279                         if (pneigh_fill_info(skb, n, NETLINK_CB(cb->skb).portid,
2280                                             cb->nlh->nlmsg_seq,
2281                                             RTM_NEWNEIGH,
2282                                             NLM_F_MULTI, tbl) < 0) {
2283                                 read_unlock_bh(&tbl->lock);
2284                                 rc = -1;
2285                                 goto out;
2286                         }
2287                 next:
2288                         idx++;
2289                 }
2290         }
2291
2292         read_unlock_bh(&tbl->lock);
2293         rc = skb->len;
2294 out:
2295         cb->args[3] = h;
2296         cb->args[4] = idx;
2297         return rc;
2298
2299 }
2300
2301 static int neigh_dump_info(struct sk_buff *skb, struct netlink_callback *cb)
2302 {
2303         struct neigh_table *tbl;
2304         int t, family, s_t;
2305         int proxy = 0;
2306         int err;
2307
2308         family = ((struct rtgenmsg *) nlmsg_data(cb->nlh))->rtgen_family;
2309
2310         /* check for full ndmsg structure presence, family member is
2311          * the same for both structures
2312          */
2313         if (nlmsg_len(cb->nlh) >= sizeof(struct ndmsg) &&
2314             ((struct ndmsg *) nlmsg_data(cb->nlh))->ndm_flags == NTF_PROXY)
2315                 proxy = 1;
2316
2317         s_t = cb->args[0];
2318
2319         for (t = 0; t < NEIGH_NR_TABLES; t++) {
2320                 tbl = neigh_tables[t];
2321
2322                 if (!tbl)
2323                         continue;
2324                 if (t < s_t || (family && tbl->family != family))
2325                         continue;
2326                 if (t > s_t)
2327                         memset(&cb->args[1], 0, sizeof(cb->args) -
2328                                                 sizeof(cb->args[0]));
2329                 if (proxy)
2330                         err = pneigh_dump_table(tbl, skb, cb);
2331                 else
2332                         err = neigh_dump_table(tbl, skb, cb);
2333                 if (err < 0)
2334                         break;
2335         }
2336
2337         cb->args[0] = t;
2338         return skb->len;
2339 }
2340
2341 void neigh_for_each(struct neigh_table *tbl, void (*cb)(struct neighbour *, void *), void *cookie)
2342 {
2343         int chain;
2344         struct neigh_hash_table *nht;
2345
2346         rcu_read_lock_bh();
2347         nht = rcu_dereference_bh(tbl->nht);
2348
2349         read_lock(&tbl->lock); /* avoid resizes */
2350         for (chain = 0; chain < (1 << nht->hash_shift); chain++) {
2351                 struct neighbour *n;
2352
2353                 for (n = rcu_dereference_bh(nht->hash_buckets[chain]);
2354                      n != NULL;
2355                      n = rcu_dereference_bh(n->next))
2356                         cb(n, cookie);
2357         }
2358         read_unlock(&tbl->lock);
2359         rcu_read_unlock_bh();
2360 }
2361 EXPORT_SYMBOL(neigh_for_each);
2362
2363 /* The tbl->lock must be held as a writer and BH disabled. */
2364 void __neigh_for_each_release(struct neigh_table *tbl,
2365                               int (*cb)(struct neighbour *))
2366 {
2367         int chain;
2368         struct neigh_hash_table *nht;
2369
2370         nht = rcu_dereference_protected(tbl->nht,
2371                                         lockdep_is_held(&tbl->lock));
2372         for (chain = 0; chain < (1 << nht->hash_shift); chain++) {
2373                 struct neighbour *n;
2374                 struct neighbour __rcu **np;
2375
2376                 np = &nht->hash_buckets[chain];
2377                 while ((n = rcu_dereference_protected(*np,
2378                                         lockdep_is_held(&tbl->lock))) != NULL) {
2379                         int release;
2380
2381                         write_lock(&n->lock);
2382                         release = cb(n);
2383                         if (release) {
2384                                 rcu_assign_pointer(*np,
2385                                         rcu_dereference_protected(n->next,
2386                                                 lockdep_is_held(&tbl->lock)));
2387                                 n->dead = 1;
2388                         } else
2389                                 np = &n->next;
2390                         write_unlock(&n->lock);
2391                         if (release)
2392                                 neigh_cleanup_and_release(n);
2393                 }
2394         }
2395 }
2396 EXPORT_SYMBOL(__neigh_for_each_release);
2397
2398 int neigh_xmit(int index, struct net_device *dev,
2399                const void *addr, struct sk_buff *skb)
2400 {
2401         int err = -EAFNOSUPPORT;
2402         if (likely(index < NEIGH_NR_TABLES)) {
2403                 struct neigh_table *tbl;
2404                 struct neighbour *neigh;
2405
2406                 tbl = neigh_tables[index];
2407                 if (!tbl)
2408                         goto out;
2409                 neigh = __neigh_lookup_noref(tbl, addr, dev);
2410                 if (!neigh)
2411                         neigh = __neigh_create(tbl, addr, dev, false);
2412                 err = PTR_ERR(neigh);
2413                 if (IS_ERR(neigh))
2414                         goto out_kfree_skb;
2415                 err = neigh->output(neigh, skb);
2416         }
2417         else if (index == NEIGH_LINK_TABLE) {
2418                 err = dev_hard_header(skb, dev, ntohs(skb->protocol),
2419                                       addr, NULL, skb->len);
2420                 if (err < 0)
2421                         goto out_kfree_skb;
2422                 err = dev_queue_xmit(skb);
2423         }
2424 out:
2425         return err;
2426 out_kfree_skb:
2427         kfree_skb(skb);
2428         goto out;
2429 }
2430 EXPORT_SYMBOL(neigh_xmit);
2431
2432 #ifdef CONFIG_PROC_FS
2433
2434 static struct neighbour *neigh_get_first(struct seq_file *seq)
2435 {
2436         struct neigh_seq_state *state = seq->private;
2437         struct net *net = seq_file_net(seq);
2438         struct neigh_hash_table *nht = state->nht;
2439         struct neighbour *n = NULL;
2440         int bucket = state->bucket;
2441
2442         state->flags &= ~NEIGH_SEQ_IS_PNEIGH;
2443         for (bucket = 0; bucket < (1 << nht->hash_shift); bucket++) {
2444                 n = rcu_dereference_bh(nht->hash_buckets[bucket]);
2445
2446                 while (n) {
2447                         if (!net_eq(dev_net(n->dev), net))
2448                                 goto next;
2449                         if (state->neigh_sub_iter) {
2450                                 loff_t fakep = 0;
2451                                 void *v;
2452
2453                                 v = state->neigh_sub_iter(state, n, &fakep);
2454                                 if (!v)
2455                                         goto next;
2456                         }
2457                         if (!(state->flags & NEIGH_SEQ_SKIP_NOARP))
2458                                 break;
2459                         if (n->nud_state & ~NUD_NOARP)
2460                                 break;
2461 next:
2462                         n = rcu_dereference_bh(n->next);
2463                 }
2464
2465                 if (n)
2466                         break;
2467         }
2468         state->bucket = bucket;
2469
2470         return n;
2471 }
2472
2473 static struct neighbour *neigh_get_next(struct seq_file *seq,
2474                                         struct neighbour *n,
2475                                         loff_t *pos)
2476 {
2477         struct neigh_seq_state *state = seq->private;
2478         struct net *net = seq_file_net(seq);
2479         struct neigh_hash_table *nht = state->nht;
2480
2481         if (state->neigh_sub_iter) {
2482                 void *v = state->neigh_sub_iter(state, n, pos);
2483                 if (v)
2484                         return n;
2485         }
2486         n = rcu_dereference_bh(n->next);
2487
2488         while (1) {
2489                 while (n) {
2490                         if (!net_eq(dev_net(n->dev), net))
2491                                 goto next;
2492                         if (state->neigh_sub_iter) {
2493                                 void *v = state->neigh_sub_iter(state, n, pos);
2494                                 if (v)
2495                                         return n;
2496                                 goto next;
2497                         }
2498                         if (!(state->flags & NEIGH_SEQ_SKIP_NOARP))
2499                                 break;
2500
2501                         if (n->nud_state & ~NUD_NOARP)
2502                                 break;
2503 next:
2504                         n = rcu_dereference_bh(n->next);
2505                 }
2506
2507                 if (n)
2508                         break;
2509
2510                 if (++state->bucket >= (1 << nht->hash_shift))
2511                         break;
2512
2513                 n = rcu_dereference_bh(nht->hash_buckets[state->bucket]);
2514         }
2515
2516         if (n && pos)
2517                 --(*pos);
2518         return n;
2519 }
2520
2521 static struct neighbour *neigh_get_idx(struct seq_file *seq, loff_t *pos)
2522 {
2523         struct neighbour *n = neigh_get_first(seq);
2524
2525         if (n) {
2526                 --(*pos);
2527                 while (*pos) {
2528                         n = neigh_get_next(seq, n, pos);
2529                         if (!n)
2530                                 break;
2531                 }
2532         }
2533         return *pos ? NULL : n;
2534 }
2535
2536 static struct pneigh_entry *pneigh_get_first(struct seq_file *seq)
2537 {
2538         struct neigh_seq_state *state = seq->private;
2539         struct net *net = seq_file_net(seq);
2540         struct neigh_table *tbl = state->tbl;
2541         struct pneigh_entry *pn = NULL;
2542         int bucket = state->bucket;
2543
2544         state->flags |= NEIGH_SEQ_IS_PNEIGH;
2545         for (bucket = 0; bucket <= PNEIGH_HASHMASK; bucket++) {
2546                 pn = tbl->phash_buckets[bucket];
2547                 while (pn && !net_eq(pneigh_net(pn), net))
2548                         pn = pn->next;
2549                 if (pn)
2550                         break;
2551         }
2552         state->bucket = bucket;
2553
2554         return pn;
2555 }
2556
2557 static struct pneigh_entry *pneigh_get_next(struct seq_file *seq,
2558                                             struct pneigh_entry *pn,
2559                                             loff_t *pos)
2560 {
2561         struct neigh_seq_state *state = seq->private;
2562         struct net *net = seq_file_net(seq);
2563         struct neigh_table *tbl = state->tbl;
2564
2565         do {
2566                 pn = pn->next;
2567         } while (pn && !net_eq(pneigh_net(pn), net));
2568
2569         while (!pn) {
2570                 if (++state->bucket > PNEIGH_HASHMASK)
2571                         break;
2572                 pn = tbl->phash_buckets[state->bucket];
2573                 while (pn && !net_eq(pneigh_net(pn), net))
2574                         pn = pn->next;
2575                 if (pn)
2576                         break;
2577         }
2578
2579         if (pn && pos)
2580                 --(*pos);
2581
2582         return pn;
2583 }
2584
2585 static struct pneigh_entry *pneigh_get_idx(struct seq_file *seq, loff_t *pos)
2586 {
2587         struct pneigh_entry *pn = pneigh_get_first(seq);
2588
2589         if (pn) {
2590                 --(*pos);
2591                 while (*pos) {
2592                         pn = pneigh_get_next(seq, pn, pos);
2593                         if (!pn)
2594                                 break;
2595                 }
2596         }
2597         return *pos ? NULL : pn;
2598 }
2599
2600 static void *neigh_get_idx_any(struct seq_file *seq, loff_t *pos)
2601 {
2602         struct neigh_seq_state *state = seq->private;
2603         void *rc;
2604         loff_t idxpos = *pos;
2605
2606         rc = neigh_get_idx(seq, &idxpos);
2607         if (!rc && !(state->flags & NEIGH_SEQ_NEIGH_ONLY))
2608                 rc = pneigh_get_idx(seq, &idxpos);
2609
2610         return rc;
2611 }
2612
2613 void *neigh_seq_start(struct seq_file *seq, loff_t *pos, struct neigh_table *tbl, unsigned int neigh_seq_flags)
2614         __acquires(rcu_bh)
2615 {
2616         struct neigh_seq_state *state = seq->private;
2617
2618         state->tbl = tbl;
2619         state->bucket = 0;
2620         state->flags = (neigh_seq_flags & ~NEIGH_SEQ_IS_PNEIGH);
2621
2622         rcu_read_lock_bh();
2623         state->nht = rcu_dereference_bh(tbl->nht);
2624
2625         return *pos ? neigh_get_idx_any(seq, pos) : SEQ_START_TOKEN;
2626 }
2627 EXPORT_SYMBOL(neigh_seq_start);
2628
2629 void *neigh_seq_next(struct seq_file *seq, void *v, loff_t *pos)
2630 {
2631         struct neigh_seq_state *state;
2632         void *rc;
2633
2634         if (v == SEQ_START_TOKEN) {
2635                 rc = neigh_get_first(seq);
2636                 goto out;
2637         }
2638
2639         state = seq->private;
2640         if (!(state->flags & NEIGH_SEQ_IS_PNEIGH)) {
2641                 rc = neigh_get_next(seq, v, NULL);
2642                 if (rc)
2643                         goto out;
2644                 if (!(state->flags & NEIGH_SEQ_NEIGH_ONLY))
2645                         rc = pneigh_get_first(seq);
2646         } else {
2647                 BUG_ON(state->flags & NEIGH_SEQ_NEIGH_ONLY);
2648                 rc = pneigh_get_next(seq, v, NULL);
2649         }
2650 out:
2651         ++(*pos);
2652         return rc;
2653 }
2654 EXPORT_SYMBOL(neigh_seq_next);
2655
2656 void neigh_seq_stop(struct seq_file *seq, void *v)
2657         __releases(rcu_bh)
2658 {
2659         rcu_read_unlock_bh();
2660 }
2661 EXPORT_SYMBOL(neigh_seq_stop);
2662
2663 /* statistics via seq_file */
2664
2665 static void *neigh_stat_seq_start(struct seq_file *seq, loff_t *pos)
2666 {
2667         struct neigh_table *tbl = seq->private;
2668         int cpu;
2669
2670         if (*pos == 0)
2671                 return SEQ_START_TOKEN;
2672
2673         for (cpu = *pos-1; cpu < nr_cpu_ids; ++cpu) {
2674                 if (!cpu_possible(cpu))
2675                         continue;
2676                 *pos = cpu+1;
2677                 return per_cpu_ptr(tbl->stats, cpu);
2678         }
2679         return NULL;
2680 }
2681
2682 static void *neigh_stat_seq_next(struct seq_file *seq, void *v, loff_t *pos)
2683 {
2684         struct neigh_table *tbl = seq->private;
2685         int cpu;
2686
2687         for (cpu = *pos; cpu < nr_cpu_ids; ++cpu) {
2688                 if (!cpu_possible(cpu))
2689                         continue;
2690                 *pos = cpu+1;
2691                 return per_cpu_ptr(tbl->stats, cpu);
2692         }
2693         return NULL;
2694 }
2695
2696 static void neigh_stat_seq_stop(struct seq_file *seq, void *v)
2697 {
2698
2699 }
2700
2701 static int neigh_stat_seq_show(struct seq_file *seq, void *v)
2702 {
2703         struct neigh_table *tbl = seq->private;
2704         struct neigh_statistics *st = v;
2705
2706         if (v == SEQ_START_TOKEN) {
2707                 seq_printf(seq, "entries  allocs destroys hash_grows  lookups hits  res_failed  rcv_probes_mcast rcv_probes_ucast  periodic_gc_runs forced_gc_runs unresolved_discards\n");
2708                 return 0;
2709         }
2710
2711         seq_printf(seq, "%08x  %08lx %08lx %08lx  %08lx %08lx  %08lx  "
2712                         "%08lx %08lx  %08lx %08lx %08lx\n",
2713                    atomic_read(&tbl->entries),
2714
2715                    st->allocs,
2716                    st->destroys,
2717                    st->hash_grows,
2718
2719                    st->lookups,
2720                    st->hits,
2721
2722                    st->res_failed,
2723
2724                    st->rcv_probes_mcast,
2725                    st->rcv_probes_ucast,
2726
2727                    st->periodic_gc_runs,
2728                    st->forced_gc_runs,
2729                    st->unres_discards
2730                    );
2731
2732         return 0;
2733 }
2734
2735 static const struct seq_operations neigh_stat_seq_ops = {
2736         .start  = neigh_stat_seq_start,
2737         .next   = neigh_stat_seq_next,
2738         .stop   = neigh_stat_seq_stop,
2739         .show   = neigh_stat_seq_show,
2740 };
2741
2742 static int neigh_stat_seq_open(struct inode *inode, struct file *file)
2743 {
2744         int ret = seq_open(file, &neigh_stat_seq_ops);
2745
2746         if (!ret) {
2747                 struct seq_file *sf = file->private_data;
2748                 sf->private = PDE_DATA(inode);
2749         }
2750         return ret;
2751 };
2752
2753 static const struct file_operations neigh_stat_seq_fops = {
2754         .owner   = THIS_MODULE,
2755         .open    = neigh_stat_seq_open,
2756         .read    = seq_read,
2757         .llseek  = seq_lseek,
2758         .release = seq_release,
2759 };
2760
2761 #endif /* CONFIG_PROC_FS */
2762
2763 static inline size_t neigh_nlmsg_size(void)
2764 {
2765         return NLMSG_ALIGN(sizeof(struct ndmsg))
2766                + nla_total_size(MAX_ADDR_LEN) /* NDA_DST */
2767                + nla_total_size(MAX_ADDR_LEN) /* NDA_LLADDR */
2768                + nla_total_size(sizeof(struct nda_cacheinfo))
2769                + nla_total_size(4); /* NDA_PROBES */
2770 }
2771
2772 static void __neigh_notify(struct neighbour *n, int type, int flags)
2773 {
2774         struct net *net = dev_net(n->dev);
2775         struct sk_buff *skb;
2776         int err = -ENOBUFS;
2777
2778         skb = nlmsg_new(neigh_nlmsg_size(), GFP_ATOMIC);
2779         if (skb == NULL)
2780                 goto errout;
2781
2782         err = neigh_fill_info(skb, n, 0, 0, type, flags);
2783         if (err < 0) {
2784                 /* -EMSGSIZE implies BUG in neigh_nlmsg_size() */
2785                 WARN_ON(err == -EMSGSIZE);
2786                 kfree_skb(skb);
2787                 goto errout;
2788         }
2789         rtnl_notify(skb, net, 0, RTNLGRP_NEIGH, NULL, GFP_ATOMIC);
2790         return;
2791 errout:
2792         if (err < 0)
2793                 rtnl_set_sk_err(net, RTNLGRP_NEIGH, err);
2794 }
2795
2796 void neigh_app_ns(struct neighbour *n)
2797 {
2798         __neigh_notify(n, RTM_GETNEIGH, NLM_F_REQUEST);
2799 }
2800 EXPORT_SYMBOL(neigh_app_ns);
2801
2802 #ifdef CONFIG_SYSCTL
2803 static int zero;
2804 static int int_max = INT_MAX;
2805 static int unres_qlen_max = INT_MAX / SKB_TRUESIZE(ETH_FRAME_LEN);
2806
2807 static int proc_unres_qlen(struct ctl_table *ctl, int write,
2808                            void __user *buffer, size_t *lenp, loff_t *ppos)
2809 {
2810         int size, ret;
2811         struct ctl_table tmp = *ctl;
2812
2813         tmp.extra1 = &zero;
2814         tmp.extra2 = &unres_qlen_max;
2815         tmp.data = &size;
2816
2817         size = *(int *)ctl->data / SKB_TRUESIZE(ETH_FRAME_LEN);
2818         ret = proc_dointvec_minmax(&tmp, write, buffer, lenp, ppos);
2819
2820         if (write && !ret)
2821                 *(int *)ctl->data = size * SKB_TRUESIZE(ETH_FRAME_LEN);
2822         return ret;
2823 }
2824
2825 static struct neigh_parms *neigh_get_dev_parms_rcu(struct net_device *dev,
2826                                                    int family)
2827 {
2828         switch (family) {
2829         case AF_INET:
2830                 return __in_dev_arp_parms_get_rcu(dev);
2831         case AF_INET6:
2832                 return __in6_dev_nd_parms_get_rcu(dev);
2833         }
2834         return NULL;
2835 }
2836
2837 static void neigh_copy_dflt_parms(struct net *net, struct neigh_parms *p,
2838                                   int index)
2839 {
2840         struct net_device *dev;
2841         int family = neigh_parms_family(p);
2842
2843         rcu_read_lock();
2844         for_each_netdev_rcu(net, dev) {
2845                 struct neigh_parms *dst_p =
2846                                 neigh_get_dev_parms_rcu(dev, family);
2847
2848                 if (dst_p && !test_bit(index, dst_p->data_state))
2849                         dst_p->data[index] = p->data[index];
2850         }
2851         rcu_read_unlock();
2852 }
2853
2854 static void neigh_proc_update(struct ctl_table *ctl, int write)
2855 {
2856         struct net_device *dev = ctl->extra1;
2857         struct neigh_parms *p = ctl->extra2;
2858         struct net *net = neigh_parms_net(p);
2859         int index = (int *) ctl->data - p->data;
2860
2861         if (!write)
2862                 return;
2863
2864         set_bit(index, p->data_state);
2865         if (!dev) /* NULL dev means this is default value */
2866                 neigh_copy_dflt_parms(net, p, index);
2867 }
2868
2869 static int neigh_proc_dointvec_zero_intmax(struct ctl_table *ctl, int write,
2870                                            void __user *buffer,
2871                                            size_t *lenp, loff_t *ppos)
2872 {
2873         struct ctl_table tmp = *ctl;
2874         int ret;
2875
2876         tmp.extra1 = &zero;
2877         tmp.extra2 = &int_max;
2878
2879         ret = proc_dointvec_minmax(&tmp, write, buffer, lenp, ppos);
2880         neigh_proc_update(ctl, write);
2881         return ret;
2882 }
2883
2884 int neigh_proc_dointvec(struct ctl_table *ctl, int write,
2885                         void __user *buffer, size_t *lenp, loff_t *ppos)
2886 {
2887         int ret = proc_dointvec(ctl, write, buffer, lenp, ppos);
2888
2889         neigh_proc_update(ctl, write);
2890         return ret;
2891 }
2892 EXPORT_SYMBOL(neigh_proc_dointvec);
2893
2894 int neigh_proc_dointvec_jiffies(struct ctl_table *ctl, int write,
2895                                 void __user *buffer,
2896                                 size_t *lenp, loff_t *ppos)
2897 {
2898         int ret = proc_dointvec_jiffies(ctl, write, buffer, lenp, ppos);
2899
2900         neigh_proc_update(ctl, write);
2901         return ret;
2902 }
2903 EXPORT_SYMBOL(neigh_proc_dointvec_jiffies);
2904
2905 static int neigh_proc_dointvec_userhz_jiffies(struct ctl_table *ctl, int write,
2906                                               void __user *buffer,
2907                                               size_t *lenp, loff_t *ppos)
2908 {
2909         int ret = proc_dointvec_userhz_jiffies(ctl, write, buffer, lenp, ppos);
2910
2911         neigh_proc_update(ctl, write);
2912         return ret;
2913 }
2914
2915 int neigh_proc_dointvec_ms_jiffies(struct ctl_table *ctl, int write,
2916                                    void __user *buffer,
2917                                    size_t *lenp, loff_t *ppos)
2918 {
2919         int ret = proc_dointvec_ms_jiffies(ctl, write, buffer, lenp, ppos);
2920
2921         neigh_proc_update(ctl, write);
2922         return ret;
2923 }
2924 EXPORT_SYMBOL(neigh_proc_dointvec_ms_jiffies);
2925
2926 static int neigh_proc_dointvec_unres_qlen(struct ctl_table *ctl, int write,
2927                                           void __user *buffer,
2928                                           size_t *lenp, loff_t *ppos)
2929 {
2930         int ret = proc_unres_qlen(ctl, write, buffer, lenp, ppos);
2931
2932         neigh_proc_update(ctl, write);
2933         return ret;
2934 }
2935
2936 static int neigh_proc_base_reachable_time(struct ctl_table *ctl, int write,
2937                                           void __user *buffer,
2938                                           size_t *lenp, loff_t *ppos)
2939 {
2940         struct neigh_parms *p = ctl->extra2;
2941         int ret;
2942
2943         if (strcmp(ctl->procname, "base_reachable_time") == 0)
2944                 ret = neigh_proc_dointvec_jiffies(ctl, write, buffer, lenp, ppos);
2945         else if (strcmp(ctl->procname, "base_reachable_time_ms") == 0)
2946                 ret = neigh_proc_dointvec_ms_jiffies(ctl, write, buffer, lenp, ppos);
2947         else
2948                 ret = -1;
2949
2950         if (write && ret == 0) {
2951                 /* update reachable_time as well, otherwise, the change will
2952                  * only be effective after the next time neigh_periodic_work
2953                  * decides to recompute it
2954                  */
2955                 p->reachable_time =
2956                         neigh_rand_reach_time(NEIGH_VAR(p, BASE_REACHABLE_TIME));
2957         }
2958         return ret;
2959 }
2960
2961 #define NEIGH_PARMS_DATA_OFFSET(index)  \
2962         (&((struct neigh_parms *) 0)->data[index])
2963
2964 #define NEIGH_SYSCTL_ENTRY(attr, data_attr, name, mval, proc) \
2965         [NEIGH_VAR_ ## attr] = { \
2966                 .procname       = name, \
2967                 .data           = NEIGH_PARMS_DATA_OFFSET(NEIGH_VAR_ ## data_attr), \
2968                 .maxlen         = sizeof(int), \
2969                 .mode           = mval, \
2970                 .proc_handler   = proc, \
2971         }
2972
2973 #define NEIGH_SYSCTL_ZERO_INTMAX_ENTRY(attr, name) \
2974         NEIGH_SYSCTL_ENTRY(attr, attr, name, 0644, neigh_proc_dointvec_zero_intmax)
2975
2976 #define NEIGH_SYSCTL_JIFFIES_ENTRY(attr, name) \
2977         NEIGH_SYSCTL_ENTRY(attr, attr, name, 0644, neigh_proc_dointvec_jiffies)
2978
2979 #define NEIGH_SYSCTL_USERHZ_JIFFIES_ENTRY(attr, name) \
2980         NEIGH_SYSCTL_ENTRY(attr, attr, name, 0644, neigh_proc_dointvec_userhz_jiffies)
2981
2982 #define NEIGH_SYSCTL_MS_JIFFIES_ENTRY(attr, name) \
2983         NEIGH_SYSCTL_ENTRY(attr, attr, name, 0644, neigh_proc_dointvec_ms_jiffies)
2984
2985 #define NEIGH_SYSCTL_MS_JIFFIES_REUSED_ENTRY(attr, data_attr, name) \
2986         NEIGH_SYSCTL_ENTRY(attr, data_attr, name, 0644, neigh_proc_dointvec_ms_jiffies)
2987
2988 #define NEIGH_SYSCTL_UNRES_QLEN_REUSED_ENTRY(attr, data_attr, name) \
2989         NEIGH_SYSCTL_ENTRY(attr, data_attr, name, 0644, neigh_proc_dointvec_unres_qlen)
2990
2991 static struct neigh_sysctl_table {
2992         struct ctl_table_header *sysctl_header;
2993         struct ctl_table neigh_vars[NEIGH_VAR_MAX + 1];
2994 } neigh_sysctl_template __read_mostly = {
2995         .neigh_vars = {
2996                 NEIGH_SYSCTL_ZERO_INTMAX_ENTRY(MCAST_PROBES, "mcast_solicit"),
2997                 NEIGH_SYSCTL_ZERO_INTMAX_ENTRY(UCAST_PROBES, "ucast_solicit"),
2998                 NEIGH_SYSCTL_ZERO_INTMAX_ENTRY(APP_PROBES, "app_solicit"),
2999                 NEIGH_SYSCTL_ZERO_INTMAX_ENTRY(MCAST_REPROBES, "mcast_resolicit"),
3000                 NEIGH_SYSCTL_USERHZ_JIFFIES_ENTRY(RETRANS_TIME, "retrans_time"),
3001                 NEIGH_SYSCTL_JIFFIES_ENTRY(BASE_REACHABLE_TIME, "base_reachable_time"),
3002                 NEIGH_SYSCTL_JIFFIES_ENTRY(DELAY_PROBE_TIME, "delay_first_probe_time"),
3003                 NEIGH_SYSCTL_JIFFIES_ENTRY(GC_STALETIME, "gc_stale_time"),
3004                 NEIGH_SYSCTL_ZERO_INTMAX_ENTRY(QUEUE_LEN_BYTES, "unres_qlen_bytes"),
3005                 NEIGH_SYSCTL_ZERO_INTMAX_ENTRY(PROXY_QLEN, "proxy_qlen"),
3006                 NEIGH_SYSCTL_USERHZ_JIFFIES_ENTRY(ANYCAST_DELAY, "anycast_delay"),
3007                 NEIGH_SYSCTL_USERHZ_JIFFIES_ENTRY(PROXY_DELAY, "proxy_delay"),
3008                 NEIGH_SYSCTL_USERHZ_JIFFIES_ENTRY(LOCKTIME, "locktime"),
3009                 NEIGH_SYSCTL_UNRES_QLEN_REUSED_ENTRY(QUEUE_LEN, QUEUE_LEN_BYTES, "unres_qlen"),
3010                 NEIGH_SYSCTL_MS_JIFFIES_REUSED_ENTRY(RETRANS_TIME_MS, RETRANS_TIME, "retrans_time_ms"),
3011                 NEIGH_SYSCTL_MS_JIFFIES_REUSED_ENTRY(BASE_REACHABLE_TIME_MS, BASE_REACHABLE_TIME, "base_reachable_time_ms"),
3012                 [NEIGH_VAR_GC_INTERVAL] = {
3013                         .procname       = "gc_interval",
3014                         .maxlen         = sizeof(int),
3015                         .mode           = 0644,
3016                         .proc_handler   = proc_dointvec_jiffies,
3017                 },
3018                 [NEIGH_VAR_GC_THRESH1] = {
3019                         .procname       = "gc_thresh1",
3020                         .maxlen         = sizeof(int),
3021                         .mode           = 0644,
3022                         .extra1         = &zero,
3023                         .extra2         = &int_max,
3024                         .proc_handler   = proc_dointvec_minmax,
3025                 },
3026                 [NEIGH_VAR_GC_THRESH2] = {
3027                         .procname       = "gc_thresh2",
3028                         .maxlen         = sizeof(int),
3029                         .mode           = 0644,
3030                         .extra1         = &zero,
3031                         .extra2         = &int_max,
3032                         .proc_handler   = proc_dointvec_minmax,
3033                 },
3034                 [NEIGH_VAR_GC_THRESH3] = {
3035                         .procname       = "gc_thresh3",
3036                         .maxlen         = sizeof(int),
3037                         .mode           = 0644,
3038                         .extra1         = &zero,
3039                         .extra2         = &int_max,
3040                         .proc_handler   = proc_dointvec_minmax,
3041                 },
3042                 {},
3043         },
3044 };
3045
3046 int neigh_sysctl_register(struct net_device *dev, struct neigh_parms *p,
3047                           proc_handler *handler)
3048 {
3049         int i;
3050         struct neigh_sysctl_table *t;
3051         const char *dev_name_source;
3052         char neigh_path[ sizeof("net//neigh/") + IFNAMSIZ + IFNAMSIZ ];
3053         char *p_name;
3054
3055         t = kmemdup(&neigh_sysctl_template, sizeof(*t), GFP_KERNEL);
3056         if (!t)
3057                 goto err;
3058
3059         for (i = 0; i < NEIGH_VAR_GC_INTERVAL; i++) {
3060                 t->neigh_vars[i].data += (long) p;
3061                 t->neigh_vars[i].extra1 = dev;
3062                 t->neigh_vars[i].extra2 = p;
3063         }
3064
3065         if (dev) {
3066                 dev_name_source = dev->name;
3067                 /* Terminate the table early */
3068                 memset(&t->neigh_vars[NEIGH_VAR_GC_INTERVAL], 0,
3069                        sizeof(t->neigh_vars[NEIGH_VAR_GC_INTERVAL]));
3070         } else {
3071                 struct neigh_table *tbl = p->tbl;
3072                 dev_name_source = "default";
3073                 t->neigh_vars[NEIGH_VAR_GC_INTERVAL].data = &tbl->gc_interval;
3074                 t->neigh_vars[NEIGH_VAR_GC_THRESH1].data = &tbl->gc_thresh1;
3075                 t->neigh_vars[NEIGH_VAR_GC_THRESH2].data = &tbl->gc_thresh2;
3076                 t->neigh_vars[NEIGH_VAR_GC_THRESH3].data = &tbl->gc_thresh3;
3077         }
3078
3079         if (handler) {
3080                 /* RetransTime */
3081                 t->neigh_vars[NEIGH_VAR_RETRANS_TIME].proc_handler = handler;
3082                 /* ReachableTime */
3083                 t->neigh_vars[NEIGH_VAR_BASE_REACHABLE_TIME].proc_handler = handler;
3084                 /* RetransTime (in milliseconds)*/
3085                 t->neigh_vars[NEIGH_VAR_RETRANS_TIME_MS].proc_handler = handler;
3086                 /* ReachableTime (in milliseconds) */
3087                 t->neigh_vars[NEIGH_VAR_BASE_REACHABLE_TIME_MS].proc_handler = handler;
3088         } else {
3089                 /* Those handlers will update p->reachable_time after
3090                  * base_reachable_time(_ms) is set to ensure the new timer starts being
3091                  * applied after the next neighbour update instead of waiting for
3092                  * neigh_periodic_work to update its value (can be multiple minutes)
3093                  * So any handler that replaces them should do this as well
3094                  */
3095                 /* ReachableTime */
3096                 t->neigh_vars[NEIGH_VAR_BASE_REACHABLE_TIME].proc_handler =
3097                         neigh_proc_base_reachable_time;
3098                 /* ReachableTime (in milliseconds) */
3099                 t->neigh_vars[NEIGH_VAR_BASE_REACHABLE_TIME_MS].proc_handler =
3100                         neigh_proc_base_reachable_time;
3101         }
3102
3103         /* Don't export sysctls to unprivileged users */
3104         if (neigh_parms_net(p)->user_ns != &init_user_ns)
3105                 t->neigh_vars[0].procname = NULL;
3106
3107         switch (neigh_parms_family(p)) {
3108         case AF_INET:
3109               p_name = "ipv4";
3110               break;
3111         case AF_INET6:
3112               p_name = "ipv6";
3113               break;
3114         default:
3115               BUG();
3116         }
3117
3118         snprintf(neigh_path, sizeof(neigh_path), "net/%s/neigh/%s",
3119                 p_name, dev_name_source);
3120         t->sysctl_header =
3121                 register_net_sysctl(neigh_parms_net(p), neigh_path, t->neigh_vars);
3122         if (!t->sysctl_header)
3123                 goto free;
3124
3125         p->sysctl_table = t;
3126         return 0;
3127
3128 free:
3129         kfree(t);
3130 err:
3131         return -ENOBUFS;
3132 }
3133 EXPORT_SYMBOL(neigh_sysctl_register);
3134
3135 void neigh_sysctl_unregister(struct neigh_parms *p)
3136 {
3137         if (p->sysctl_table) {
3138                 struct neigh_sysctl_table *t = p->sysctl_table;
3139                 p->sysctl_table = NULL;
3140                 unregister_net_sysctl_table(t->sysctl_header);
3141                 kfree(t);
3142         }
3143 }
3144 EXPORT_SYMBOL(neigh_sysctl_unregister);
3145
3146 #endif  /* CONFIG_SYSCTL */
3147
3148 static int __init neigh_init(void)
3149 {
3150         rtnl_register(PF_UNSPEC, RTM_NEWNEIGH, neigh_add, NULL, NULL);
3151         rtnl_register(PF_UNSPEC, RTM_DELNEIGH, neigh_delete, NULL, NULL);
3152         rtnl_register(PF_UNSPEC, RTM_GETNEIGH, NULL, neigh_dump_info, NULL);
3153
3154         rtnl_register(PF_UNSPEC, RTM_GETNEIGHTBL, NULL, neightbl_dump_info,
3155                       NULL);
3156         rtnl_register(PF_UNSPEC, RTM_SETNEIGHTBL, neightbl_set, NULL, NULL);
3157
3158         return 0;
3159 }
3160
3161 subsys_initcall(neigh_init);
3162