net/core/neighbour.c

   1 /*
   2  *      Generic address resolution entity
   3  *
   4  *      Authors:
   5  *      Pedro Roque             <roque@di.fc.ul.pt>
   6  *      Alexey Kuznetsov        <kuznet@ms2.inr.ac.ru>
   7  *
   8  *      This program is free software; you can redistribute it and/or
   9  *      modify it under the terms of the GNU General Public License
  10  *      as published by the Free Software Foundation; either version
  11  *      2 of the License, or (at your option) any later version.
  12  *
  13  *      Fixes:
  14  *      Vitaly E. Lavrov        releasing NULL neighbor in neigh_add.
  15  *      Harald Welte            Add neighbour cache statistics like rtstat
  16  */
  17
  18 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
  19
  20 #include <linux/slab.h>
  21 #include <linux/types.h>
  22 #include <linux/kernel.h>
  23 #include <linux/module.h>
  24 #include <linux/socket.h>
  25 #include <linux/netdevice.h>
  26 #include <linux/proc_fs.h>
  27 #ifdef CONFIG_SYSCTL
  28 #include <linux/sysctl.h>
  29 #endif
  30 #include <linux/times.h>
  31 #include <net/net_namespace.h>
  32 #include <net/neighbour.h>
  33 #include <net/dst.h>
  34 #include <net/sock.h>
  35 #include <net/netevent.h>
  36 #include <net/netlink.h>
  37 #include <linux/rtnetlink.h>
  38 #include <linux/random.h>
  39 #include <linux/string.h>
  40 #include <linux/log2.h>
  41 #include <linux/inetdevice.h>
  42 #include <net/addrconf.h>
  43
  44 #define DEBUG
  45 #define NEIGH_DEBUG 1
  46 #define neigh_dbg(level, fmt, ...)              \
  47 do {                                            \
  48         if (level <= NEIGH_DEBUG)               \
  49                 pr_debug(fmt, ##__VA_ARGS__);   \
  50 } while (0)
  51
  52 #define PNEIGH_HASHMASK         0xF
  53
  54 static void neigh_timer_handler(unsigned long arg);
  55 static void __neigh_notify(struct neighbour *n, int type, int flags);
  56 static void neigh_update_notify(struct neighbour *neigh);
  57 static int pneigh_ifdown(struct neigh_table *tbl, struct net_device *dev);
  58
  59 static struct neigh_table *neigh_tables;
  60 #ifdef CONFIG_PROC_FS
  61 static const struct file_operations neigh_stat_seq_fops;
  62 #endif
  63
  64 /*
  65    Neighbour hash table buckets are protected with rwlock tbl->lock.
  66
  67    - All the scans/updates to hash buckets MUST be made under this lock.
  68    - NOTHING clever should be made under this lock: no callbacks
  69      to protocol backends, no attempts to send something to network.
  70      It will result in deadlocks, if backend/driver wants to use neighbour
  71      cache.
  72    - If the entry requires some non-trivial actions, increase
  73      its reference count and release table lock.
  74
  75    Neighbour entries are protected:
  76    - with reference count.
  77    - with rwlock neigh->lock
  78
  79    Reference count prevents destruction.
  80
  81    neigh->lock mainly serializes ll address data and its validity state.
  82    However, the same lock is used to protect another entry fields:
  83     - timer
  84     - resolution queue
  85
  86    Again, nothing clever shall be made under neigh->lock,
  87    the most complicated procedure, which we allow is dev->hard_header.
  88    It is supposed, that dev->hard_header is simplistic and does
  89    not make callbacks to neighbour tables.
  90
  91    The last lock is neigh_tbl_lock. It is pure SMP lock, protecting
  92    list of neighbour tables. This list is used only in process context,
  93  */
  94
  95 static DEFINE_RWLOCK(neigh_tbl_lock);
  96
  97 static int neigh_blackhole(struct neighbour *neigh, struct sk_buff *skb)
  98 {
  99         kfree_skb(skb);
 100         return -ENETDOWN;
 101 }
 102
 103 static void neigh_cleanup_and_release(struct neighbour *neigh)
 104 {
 105         if (neigh->parms->neigh_cleanup)
 106                 neigh->parms->neigh_cleanup(neigh);
 107
 108         __neigh_notify(neigh, RTM_DELNEIGH, 0);
 109         neigh_release(neigh);
 110 }
 111
 112 /*
 113  * It is random distribution in the interval (1/2)*base...(3/2)*base.
 114  * It corresponds to default IPv6 settings and is not overridable,
 115  * because it is really reasonable choice.
 116  */
 117
 118 unsigned long neigh_rand_reach_time(unsigned long base)
 119 {
 120         return base ? (net_random() % base) + (base >> 1) : 0;
 121 }
 122 EXPORT_SYMBOL(neigh_rand_reach_time);
 123
 124
 125 static int neigh_forced_gc(struct neigh_table *tbl)
 126 {
 127         int shrunk = 0;
 128         int i;
 129         struct neigh_hash_table *nht;
 130
 131         NEIGH_CACHE_STAT_INC(tbl, forced_gc_runs);
 132
 133         write_lock_bh(&tbl->lock);
 134         nht = rcu_dereference_protected(tbl->nht,
 135                                         lockdep_is_held(&tbl->lock));
 136         for (i = 0; i < (1 << nht->hash_shift); i++) {
 137                 struct neighbour *n;
 138                 struct neighbour __rcu **np;
 139
 140                 np = &nht->hash_buckets[i];
 141                 while ((n = rcu_dereference_protected(*np,
 142                                         lockdep_is_held(&tbl->lock))) != NULL) {
 143                         /* Neighbour record may be discarded if:
 144                          * - nobody refers to it.
 145                          * - it is not permanent
 146                          */
 147                         write_lock(&n->lock);
 148                         if (atomic_read(&n->refcnt) == 1 &&
 149                             !(n->nud_state & NUD_PERMANENT)) {
 150                                 rcu_assign_pointer(*np,
 151                                         rcu_dereference_protected(n->next,
 152                                                   lockdep_is_held(&tbl->lock)));
 153                                 n->dead = 1;
 154                                 shrunk  = 1;
 155                                 write_unlock(&n->lock);
 156                                 neigh_cleanup_and_release(n);
 157                                 continue;
 158                         }
 159                         write_unlock(&n->lock);
 160                         np = &n->next;
 161                 }
 162         }
 163
 164         tbl->last_flush = jiffies;
 165
 166         write_unlock_bh(&tbl->lock);
 167
 168         return shrunk;
 169 }
 170
 171 static void neigh_add_timer(struct neighbour *n, unsigned long when)
 172 {
 173         neigh_hold(n);
 174         if (unlikely(mod_timer(&n->timer, when))) {
 175                 printk("NEIGH: BUG, double timer add, state is %x\n",
 176                        n->nud_state);
 177                 dump_stack();
 178         }
 179 }
 180
 181 static int neigh_del_timer(struct neighbour *n)
 182 {
 183         if ((n->nud_state & NUD_IN_TIMER) &&
 184             del_timer(&n->timer)) {
 185                 neigh_release(n);
 186                 return 1;
 187         }
 188         return 0;
 189 }
 190
 191 static void pneigh_queue_purge(struct sk_buff_head *list)
 192 {
 193         struct sk_buff *skb;
 194
 195         while ((skb = skb_dequeue(list)) != NULL) {
 196                 dev_put(skb->dev);
 197                 kfree_skb(skb);
 198         }
 199 }
 200
 201 static void neigh_flush_dev(struct neigh_table *tbl, struct net_device *dev)
 202 {
 203         int i;
 204         struct neigh_hash_table *nht;
 205
 206         nht = rcu_dereference_protected(tbl->nht,
 207                                         lockdep_is_held(&tbl->lock));
 208
 209         for (i = 0; i < (1 << nht->hash_shift); i++) {
 210                 struct neighbour *n;
 211                 struct neighbour __rcu **np = &nht->hash_buckets[i];
 212
 213                 while ((n = rcu_dereference_protected(*np,
 214                                         lockdep_is_held(&tbl->lock))) != NULL) {
 215                         if (dev && n->dev != dev) {
 216                                 np = &n->next;
 217                                 continue;
 218                         }
 219                         rcu_assign_pointer(*np,
 220                                    rcu_dereference_protected(n->next,
 221                                                 lockdep_is_held(&tbl->lock)));
 222                         write_lock(&n->lock);
 223                         neigh_del_timer(n);
 224                         n->dead = 1;
 225
 226                         if (atomic_read(&n->refcnt) != 1) {
 227                                 /* The most unpleasant situation.
 228                                    We must destroy neighbour entry,
 229                                    but someone still uses it.
 230
 231                                    The destroy will be delayed until
 232                                    the last user releases us, but
 233                                    we must kill timers etc. and move
 234                                    it to safe state.
 235                                  */
 236                                 __skb_queue_purge(&n->arp_queue);
 237                                 n->arp_queue_len_bytes = 0;
 238                                 n->output = neigh_blackhole;
 239                                 if (n->nud_state & NUD_VALID)
 240                                         n->nud_state = NUD_NOARP;
 241                                 else
 242                                         n->nud_state = NUD_NONE;
 243                                 neigh_dbg(2, "neigh %p is stray\n", n);
 244                         }
 245                         write_unlock(&n->lock);
 246                         neigh_cleanup_and_release(n);
 247                 }
 248         }
 249 }
 250
 251 void neigh_changeaddr(struct neigh_table *tbl, struct net_device *dev)
 252 {
 253         write_lock_bh(&tbl->lock);
 254         neigh_flush_dev(tbl, dev);
 255         write_unlock_bh(&tbl->lock);
 256 }
 257 EXPORT_SYMBOL(neigh_changeaddr);
 258
 259 int neigh_ifdown(struct neigh_table *tbl, struct net_device *dev)
 260 {
 261         write_lock_bh(&tbl->lock);
 262         neigh_flush_dev(tbl, dev);
 263         pneigh_ifdown(tbl, dev);
 264         write_unlock_bh(&tbl->lock);
 265
 266         del_timer_sync(&tbl->proxy_timer);
 267         pneigh_queue_purge(&tbl->proxy_queue);
 268         return 0;
 269 }
 270 EXPORT_SYMBOL(neigh_ifdown);
 271
 272 static struct neighbour *neigh_alloc(struct neigh_table *tbl, struct net_device *dev)
 273 {
 274         struct neighbour *n = NULL;
 275         unsigned long now = jiffies;
 276         int entries;
 277
 278         entries = atomic_inc_return(&tbl->entries) - 1;
 279         if (entries >= tbl->gc_thresh3 ||
 280             (entries >= tbl->gc_thresh2 &&
 281              time_after(now, tbl->last_flush + 5 * HZ))) {
 282                 if (!neigh_forced_gc(tbl) &&
 283                     entries >= tbl->gc_thresh3)
 284                         goto out_entries;
 285         }
 286
 287         n = kzalloc(tbl->entry_size + dev->neigh_priv_len, GFP_ATOMIC);
 288         if (!n)
 289                 goto out_entries;
 290
 291         __skb_queue_head_init(&n->arp_queue);
 292         rwlock_init(&n->lock);
 293         seqlock_init(&n->ha_lock);
 294         n->updated        = n->used = now;
 295         n->nud_state      = NUD_NONE;
 296         n->output         = neigh_blackhole;
 297         seqlock_init(&n->hh.hh_lock);
 298         n->parms          = neigh_parms_clone(&tbl->parms);
 299         setup_timer(&n->timer, neigh_timer_handler, (unsigned long)n);
 300
 301         NEIGH_CACHE_STAT_INC(tbl, allocs);
 302         n->tbl            = tbl;
 303         atomic_set(&n->refcnt, 1);
 304         n->dead           = 1;
 305 out:
 306         return n;
 307
 308 out_entries:
 309         atomic_dec(&tbl->entries);
 310         goto out;
 311 }
 312
 313 static void neigh_get_hash_rnd(u32 *x)
 314 {
 315         get_random_bytes(x, sizeof(*x));
 316         *x |= 1;
 317 }
 318
 319 static struct neigh_hash_table *neigh_hash_alloc(unsigned int shift)
 320 {
 321         size_t size = (1 << shift) * sizeof(struct neighbour *);
 322         struct neigh_hash_table *ret;
 323         struct neighbour __rcu **buckets;
 324         int i;
 325
 326         ret = kmalloc(sizeof(*ret), GFP_ATOMIC);
 327         if (!ret)
 328                 return NULL;
 329         if (size <= PAGE_SIZE)
 330                 buckets = kzalloc(size, GFP_ATOMIC);
 331         else
 332                 buckets = (struct neighbour __rcu **)
 333                           __get_free_pages(GFP_ATOMIC | __GFP_ZERO,
 334                                            get_order(size));
 335         if (!buckets) {
 336                 kfree(ret);
 337                 return NULL;
 338         }
 339         ret->hash_buckets = buckets;
 340         ret->hash_shift = shift;
 341         for (i = 0; i < NEIGH_NUM_HASH_RND; i++)
 342                 neigh_get_hash_rnd(&ret->hash_rnd[i]);
 343         return ret;
 344 }
 345
 346 static void neigh_hash_free_rcu(struct rcu_head *head)
 347 {
 348         struct neigh_hash_table *nht = container_of(head,
 349                                                     struct neigh_hash_table,
 350                                                     rcu);
 351         size_t size = (1 << nht->hash_shift) * sizeof(struct neighbour *);
 352         struct neighbour __rcu **buckets = nht->hash_buckets;
 353
 354         if (size <= PAGE_SIZE)
 355                 kfree(buckets);
 356         else
 357                 free_pages((unsigned long)buckets, get_order(size));
 358         kfree(nht);
 359 }
 360
 361 static struct neigh_hash_table *neigh_hash_grow(struct neigh_table *tbl,
 362                                                 unsigned long new_shift)
 363 {
 364         unsigned int i, hash;
 365         struct neigh_hash_table *new_nht, *old_nht;
 366
 367         NEIGH_CACHE_STAT_INC(tbl, hash_grows);
 368
 369         old_nht = rcu_dereference_protected(tbl->nht,
 370                                             lockdep_is_held(&tbl->lock));
 371         new_nht = neigh_hash_alloc(new_shift);
 372         if (!new_nht)
 373                 return old_nht;
 374
 375         for (i = 0; i < (1 << old_nht->hash_shift); i++) {
 376                 struct neighbour *n, *next;
 377
 378                 for (n = rcu_dereference_protected(old_nht->hash_buckets[i],
 379                                                    lockdep_is_held(&tbl->lock));
 380                      n != NULL;
 381                      n = next) {
 382                         hash = tbl->hash(n->primary_key, n->dev,
 383                                          new_nht->hash_rnd);
 384
 385                         hash >>= (32 - new_nht->hash_shift);
 386                         next = rcu_dereference_protected(n->next,
 387                                                 lockdep_is_held(&tbl->lock));
 388
 389                         rcu_assign_pointer(n->next,
 390                                            rcu_dereference_protected(
 391                                                 new_nht->hash_buckets[hash],
 392                                                 lockdep_is_held(&tbl->lock)));
 393                         rcu_assign_pointer(new_nht->hash_buckets[hash], n);
 394                 }
 395         }
 396
 397         rcu_assign_pointer(tbl->nht, new_nht);
 398         call_rcu(&old_nht->rcu, neigh_hash_free_rcu);
 399         return new_nht;
 400 }
 401
 402 struct neighbour *neigh_lookup(struct neigh_table *tbl, const void *pkey,
 403                                struct net_device *dev)
 404 {
 405         struct neighbour *n;
 406         int key_len = tbl->key_len;
 407         u32 hash_val;
 408         struct neigh_hash_table *nht;
 409
 410         NEIGH_CACHE_STAT_INC(tbl, lookups);
 411
 412         rcu_read_lock_bh();
 413         nht = rcu_dereference_bh(tbl->nht);
 414         hash_val = tbl->hash(pkey, dev, nht->hash_rnd) >> (32 - nht->hash_shift);
 415
 416         for (n = rcu_dereference_bh(nht->hash_buckets[hash_val]);
 417              n != NULL;
 418              n = rcu_dereference_bh(n->next)) {
 419                 if (dev == n->dev && !memcmp(n->primary_key, pkey, key_len)) {
 420                         if (!atomic_inc_not_zero(&n->refcnt))
 421                                 n = NULL;
 422                         NEIGH_CACHE_STAT_INC(tbl, hits);
 423                         break;
 424                 }
 425         }
 426
 427         rcu_read_unlock_bh();
 428         return n;
 429 }
 430 EXPORT_SYMBOL(neigh_lookup);
 431
 432 struct neighbour *neigh_lookup_nodev(struct neigh_table *tbl, struct net *net,
 433                                      const void *pkey)
 434 {
 435         struct neighbour *n;
 436         int key_len = tbl->key_len;
 437         u32 hash_val;
 438         struct neigh_hash_table *nht;
 439
 440         NEIGH_CACHE_STAT_INC(tbl, lookups);
 441
 442         rcu_read_lock_bh();
 443         nht = rcu_dereference_bh(tbl->nht);
 444         hash_val = tbl->hash(pkey, NULL, nht->hash_rnd) >> (32 - nht->hash_shift);
 445
 446         for (n = rcu_dereference_bh(nht->hash_buckets[hash_val]);
 447              n != NULL;
 448              n = rcu_dereference_bh(n->next)) {
 449                 if (!memcmp(n->primary_key, pkey, key_len) &&
 450                     net_eq(dev_net(n->dev), net)) {
 451                         if (!atomic_inc_not_zero(&n->refcnt))
 452                                 n = NULL;
 453                         NEIGH_CACHE_STAT_INC(tbl, hits);
 454                         break;
 455                 }
 456         }
 457
 458         rcu_read_unlock_bh();
 459         return n;
 460 }
 461 EXPORT_SYMBOL(neigh_lookup_nodev);
 462
 463 struct neighbour *__neigh_create(struct neigh_table *tbl, const void *pkey,
 464                                  struct net_device *dev, bool want_ref)
 465 {
 466         u32 hash_val;
 467         int key_len = tbl->key_len;
 468         int error;
 469         struct neighbour *n1, *rc, *n = neigh_alloc(tbl, dev);
 470         struct neigh_hash_table *nht;
 471
 472         if (!n) {
 473                 rc = ERR_PTR(-ENOBUFS);
 474                 goto out;
 475         }
 476
 477         memcpy(n->primary_key, pkey, key_len);
 478         n->dev = dev;
 479         dev_hold(dev);
 480
 481         /* Protocol specific setup. */
 482         if (tbl->constructor && (error = tbl->constructor(n)) < 0) {
 483                 rc = ERR_PTR(error);
 484                 goto out_neigh_release;
 485         }
 486
 487         if (dev->netdev_ops->ndo_neigh_construct) {
 488                 error = dev->netdev_ops->ndo_neigh_construct(n);
 489                 if (error < 0) {
 490                         rc = ERR_PTR(error);
 491                         goto out_neigh_release;
 492                 }
 493         }
 494
 495         /* Device specific setup. */
 496         if (n->parms->neigh_setup &&
 497             (error = n->parms->neigh_setup(n)) < 0) {
 498                 rc = ERR_PTR(error);
 499                 goto out_neigh_release;
 500         }
 501
 502         n->confirmed = jiffies - (NEIGH_VAR(n->parms, BASE_REACHABLE_TIME) << 1);
 503
 504         write_lock_bh(&tbl->lock);
 505         nht = rcu_dereference_protected(tbl->nht,
 506                                         lockdep_is_held(&tbl->lock));
 507
 508         if (atomic_read(&tbl->entries) > (1 << nht->hash_shift))
 509                 nht = neigh_hash_grow(tbl, nht->hash_shift + 1);
 510
 511         hash_val = tbl->hash(pkey, dev, nht->hash_rnd) >> (32 - nht->hash_shift);
 512
 513         if (n->parms->dead) {
 514                 rc = ERR_PTR(-EINVAL);
 515                 goto out_tbl_unlock;
 516         }
 517
 518         for (n1 = rcu_dereference_protected(nht->hash_buckets[hash_val],
 519                                             lockdep_is_held(&tbl->lock));
 520              n1 != NULL;
 521              n1 = rcu_dereference_protected(n1->next,
 522                         lockdep_is_held(&tbl->lock))) {
 523                 if (dev == n1->dev && !memcmp(n1->primary_key, pkey, key_len)) {
 524                         if (want_ref)
 525                                 neigh_hold(n1);
 526                         rc = n1;
 527                         goto out_tbl_unlock;
 528                 }
 529         }
 530
 531         n->dead = 0;
 532         if (want_ref)
 533                 neigh_hold(n);
 534         rcu_assign_pointer(n->next,
 535                            rcu_dereference_protected(nht->hash_buckets[hash_val],
 536                                                      lockdep_is_held(&tbl->lock)));
 537         rcu_assign_pointer(nht->hash_buckets[hash_val], n);
 538         write_unlock_bh(&tbl->lock);
 539         neigh_dbg(2, "neigh %p is created\n", n);
 540         rc = n;
 541 out:
 542         return rc;
 543 out_tbl_unlock:
 544         write_unlock_bh(&tbl->lock);
 545 out_neigh_release:
 546         neigh_release(n);
 547         goto out;
 548 }
 549 EXPORT_SYMBOL(__neigh_create);
 550
 551 static u32 pneigh_hash(const void *pkey, int key_len)
 552 {
 553         u32 hash_val = *(u32 *)(pkey + key_len - 4);
 554         hash_val ^= (hash_val >> 16);
 555         hash_val ^= hash_val >> 8;
 556         hash_val ^= hash_val >> 4;
 557         hash_val &= PNEIGH_HASHMASK;
 558         return hash_val;
 559 }
 560
 561 static struct pneigh_entry *__pneigh_lookup_1(struct pneigh_entry *n,
 562                                               struct net *net,
 563                                               const void *pkey,
 564                                               int key_len,
 565                                               struct net_device *dev)
 566 {
 567         while (n) {
 568                 if (!memcmp(n->key, pkey, key_len) &&
 569                     net_eq(pneigh_net(n), net) &&
 570                     (n->dev == dev || !n->dev))
 571                         return n;
 572                 n = n->next;
 573         }
 574         return NULL;
 575 }
 576
 577 struct pneigh_entry *__pneigh_lookup(struct neigh_table *tbl,
 578                 struct net *net, const void *pkey, struct net_device *dev)
 579 {
 580         int key_len = tbl->key_len;
 581         u32 hash_val = pneigh_hash(pkey, key_len);
 582
 583         return __pneigh_lookup_1(tbl->phash_buckets[hash_val],
 584                                  net, pkey, key_len, dev);
 585 }
 586 EXPORT_SYMBOL_GPL(__pneigh_lookup);
 587
 588 struct pneigh_entry * pneigh_lookup(struct neigh_table *tbl,
 589                                     struct net *net, const void *pkey,
 590                                     struct net_device *dev, int creat)
 591 {
 592         struct pneigh_entry *n;
 593         int key_len = tbl->key_len;
 594         u32 hash_val = pneigh_hash(pkey, key_len);
 595
 596         read_lock_bh(&tbl->lock);
 597         n = __pneigh_lookup_1(tbl->phash_buckets[hash_val],
 598                               net, pkey, key_len, dev);
 599         read_unlock_bh(&tbl->lock);
 600
 601         if (n || !creat)
 602                 goto out;
 603
 604         ASSERT_RTNL();
 605
 606         n = kmalloc(sizeof(*n) + key_len, GFP_KERNEL);
 607         if (!n)
 608                 goto out;
 609
 610         write_pnet(&n->net, hold_net(net));
 611         memcpy(n->key, pkey, key_len);
 612         n->dev = dev;
 613         if (dev)
 614                 dev_hold(dev);
 615
 616         if (tbl->pconstructor && tbl->pconstructor(n)) {
 617                 if (dev)
 618                         dev_put(dev);
 619                 release_net(net);
 620                 kfree(n);
 621                 n = NULL;
 622                 goto out;
 623         }
 624
 625         write_lock_bh(&tbl->lock);
 626         n->next = tbl->phash_buckets[hash_val];
 627         tbl->phash_buckets[hash_val] = n;
 628         write_unlock_bh(&tbl->lock);
 629 out:
 630         return n;
 631 }
 632 EXPORT_SYMBOL(pneigh_lookup);
 633
 634
 635 int pneigh_delete(struct neigh_table *tbl, struct net *net, const void *pkey,
 636                   struct net_device *dev)
 637 {
 638         struct pneigh_entry *n, **np;
 639         int key_len = tbl->key_len;
 640         u32 hash_val = pneigh_hash(pkey, key_len);
 641
 642         write_lock_bh(&tbl->lock);
 643         for (np = &tbl->phash_buckets[hash_val]; (n = *np) != NULL;
 644              np = &n->next) {
 645                 if (!memcmp(n->key, pkey, key_len) && n->dev == dev &&
 646                     net_eq(pneigh_net(n), net)) {
 647                         *np = n->next;
 648                         write_unlock_bh(&tbl->lock);
 649                         if (tbl->pdestructor)
 650                                 tbl->pdestructor(n);
 651                         if (n->dev)
 652                                 dev_put(n->dev);
 653                         release_net(pneigh_net(n));
 654                         kfree(n);
 655                         return 0;
 656                 }
 657         }
 658         write_unlock_bh(&tbl->lock);
 659         return -ENOENT;
 660 }
 661
 662 static int pneigh_ifdown(struct neigh_table *tbl, struct net_device *dev)
 663 {
 664         struct pneigh_entry *n, **np;
 665         u32 h;
 666
 667         for (h = 0; h <= PNEIGH_HASHMASK; h++) {
 668                 np = &tbl->phash_buckets[h];
 669                 while ((n = *np) != NULL) {
 670                         if (!dev || n->dev == dev) {
 671                                 *np = n->next;
 672                                 if (tbl->pdestructor)
 673                                         tbl->pdestructor(n);
 674                                 if (n->dev)
 675                                         dev_put(n->dev);
 676                                 release_net(pneigh_net(n));
 677                                 kfree(n);
 678                                 continue;
 679                         }
 680                         np = &n->next;
 681                 }
 682         }
 683         return -ENOENT;
 684 }
 685
 686 static void neigh_parms_destroy(struct neigh_parms *parms);
 687
 688 static inline void neigh_parms_put(struct neigh_parms *parms)
 689 {
 690         if (atomic_dec_and_test(&parms->refcnt))
 691                 neigh_parms_destroy(parms);
 692 }
 693
 694 /*
 695  *      neighbour must already be out of the table;
 696  *
 697  */
 698 void neigh_destroy(struct neighbour *neigh)
 699 {
 700         struct net_device *dev = neigh->dev;
 701
 702         NEIGH_CACHE_STAT_INC(neigh->tbl, destroys);
 703
 704         if (!neigh->dead) {
 705                 pr_warn("Destroying alive neighbour %p\n", neigh);
 706                 dump_stack();
 707                 return;
 708         }
 709
 710         if (neigh_del_timer(neigh))
 711                 pr_warn("Impossible event\n");
 712
 713         write_lock_bh(&neigh->lock);
 714         __skb_queue_purge(&neigh->arp_queue);
 715         write_unlock_bh(&neigh->lock);
 716         neigh->arp_queue_len_bytes = 0;
 717
 718         if (dev->netdev_ops->ndo_neigh_destroy)
 719                 dev->netdev_ops->ndo_neigh_destroy(neigh);
 720
 721         dev_put(dev);
 722         neigh_parms_put(neigh->parms);
 723
 724         neigh_dbg(2, "neigh %p is destroyed\n", neigh);
 725
 726         atomic_dec(&neigh->tbl->entries);
 727         kfree_rcu(neigh, rcu);
 728 }
 729 EXPORT_SYMBOL(neigh_destroy);
 730
 731 /* Neighbour state is suspicious;
 732    disable fast path.
 733
 734    Called with write_locked neigh.
 735  */
 736 static void neigh_suspect(struct neighbour *neigh)
 737 {
 738         neigh_dbg(2, "neigh %p is suspected\n", neigh);
 739
 740         neigh->output = neigh->ops->output;
 741 }
 742
 743 /* Neighbour state is OK;
 744    enable fast path.
 745
 746    Called with write_locked neigh.
 747  */
 748 static void neigh_connect(struct neighbour *neigh)
 749 {
 750         neigh_dbg(2, "neigh %p is connected\n", neigh);
 751
 752         neigh->output = neigh->ops->connected_output;
 753 }
 754
 755 static void neigh_periodic_work(struct work_struct *work)
 756 {
 757         struct neigh_table *tbl = container_of(work, struct neigh_table, gc_work.work);
 758         struct neighbour *n;
 759         struct neighbour __rcu **np;
 760         unsigned int i;
 761         struct neigh_hash_table *nht;
 762
 763         NEIGH_CACHE_STAT_INC(tbl, periodic_gc_runs);
 764
 765         write_lock_bh(&tbl->lock);
 766         nht = rcu_dereference_protected(tbl->nht,
 767                                         lockdep_is_held(&tbl->lock));
 768
 769         if (atomic_read(&tbl->entries) < tbl->gc_thresh1)
 770                 goto out;
 771
 772         /*
 773          *      periodically recompute ReachableTime from random function
 774          */
 775
 776         if (time_after(jiffies, tbl->last_rand + 300 * HZ)) {
 777                 struct neigh_parms *p;
 778                 tbl->last_rand = jiffies;
 779                 for (p = &tbl->parms; p; p = p->next)
 780                         p->reachable_time =
 781                                 neigh_rand_reach_time(NEIGH_VAR(p, BASE_REACHABLE_TIME));
 782         }
 783
 784         for (i = 0 ; i < (1 << nht->hash_shift); i++) {
 785                 np = &nht->hash_buckets[i];
 786
 787                 while ((n = rcu_dereference_protected(*np,
 788                                 lockdep_is_held(&tbl->lock))) != NULL) {
 789                         unsigned int state;
 790
 791                         write_lock(&n->lock);
 792
 793                         state = n->nud_state;
 794                         if (state & (NUD_PERMANENT | NUD_IN_TIMER)) {
 795                                 write_unlock(&n->lock);
 796                                 goto next_elt;
 797                         }
 798
 799                         if (time_before(n->used, n->confirmed))
 800                                 n->used = n->confirmed;
 801
 802                         if (atomic_read(&n->refcnt) == 1 &&
 803                             (state == NUD_FAILED ||
 804                              time_after(jiffies, n->used + NEIGH_VAR(n->parms, GC_STALETIME)))) {
 805                                 *np = n->next;
 806                                 n->dead = 1;
 807                                 write_unlock(&n->lock);
 808                                 neigh_cleanup_and_release(n);
 809                                 continue;
 810                         }
 811                         write_unlock(&n->lock);
 812
 813 next_elt:
 814                         np = &n->next;
 815                 }
 816                 /*
 817                  * It's fine to release lock here, even if hash table
 818                  * grows while we are preempted.
 819                  */
 820                 write_unlock_bh(&tbl->lock);
 821                 cond_resched();
 822                 write_lock_bh(&tbl->lock);
 823                 nht = rcu_dereference_protected(tbl->nht,
 824                                                 lockdep_is_held(&tbl->lock));
 825         }
 826 out:
 827         /* Cycle through all hash buckets every BASE_REACHABLE_TIME/2 ticks.
 828          * ARP entry timeouts range from 1/2 BASE_REACHABLE_TIME to 3/2
 829          * BASE_REACHABLE_TIME.
 830          */
 831         schedule_delayed_work(&tbl->gc_work,
 832                               NEIGH_VAR(&tbl->parms, BASE_REACHABLE_TIME) >> 1);
 833         write_unlock_bh(&tbl->lock);
 834 }
 835
 836 static __inline__ int neigh_max_probes(struct neighbour *n)
 837 {
 838         struct neigh_parms *p = n->parms;
 839         return (n->nud_state & NUD_PROBE) ?
 840                 NEIGH_VAR(p, UCAST_PROBES) :
 841                 NEIGH_VAR(p, UCAST_PROBES) + NEIGH_VAR(p, APP_PROBES) +
 842                 NEIGH_VAR(p, MCAST_PROBES);
 843 }
 844
 845 static void neigh_invalidate(struct neighbour *neigh)
 846         __releases(neigh->lock)
 847         __acquires(neigh->lock)
 848 {
 849         struct sk_buff *skb;
 850
 851         NEIGH_CACHE_STAT_INC(neigh->tbl, res_failed);
 852         neigh_dbg(2, "neigh %p is failed\n", neigh);
 853         neigh->updated = jiffies;
 854
 855         /* It is very thin place. report_unreachable is very complicated
 856            routine. Particularly, it can hit the same neighbour entry!
 857
 858            So that, we try to be accurate and avoid dead loop. --ANK
 859          */
 860         while (neigh->nud_state == NUD_FAILED &&
 861                (skb = __skb_dequeue(&neigh->arp_queue)) != NULL) {
 862                 write_unlock(&neigh->lock);
 863                 neigh->ops->error_report(neigh, skb);
 864                 write_lock(&neigh->lock);
 865         }
 866         __skb_queue_purge(&neigh->arp_queue);
 867         neigh->arp_queue_len_bytes = 0;
 868 }
 869
 870 static void neigh_probe(struct neighbour *neigh)
 871         __releases(neigh->lock)
 872 {
 873         struct sk_buff *skb = skb_peek_tail(&neigh->arp_queue);
 874         /* keep skb alive even if arp_queue overflows */
 875         if (skb)
 876                 skb = skb_copy(skb, GFP_ATOMIC);
 877         write_unlock(&neigh->lock);
 878         neigh->ops->solicit(neigh, skb);
 879         atomic_inc(&neigh->probes);
 880         kfree_skb(skb);
 881 }
 882
 883 /* Called when a timer expires for a neighbour entry. */
 884
 885 static void neigh_timer_handler(unsigned long arg)
 886 {
 887         unsigned long now, next;
 888         struct neighbour *neigh = (struct neighbour *)arg;
 889         unsigned int state;
 890         int notify = 0;
 891
 892         write_lock(&neigh->lock);
 893
 894         state = neigh->nud_state;
 895         now = jiffies;
 896         next = now + HZ;
 897
 898         if (!(state & NUD_IN_TIMER))
 899                 goto out;
 900
 901         if (state & NUD_REACHABLE) {
 902                 if (time_before_eq(now,
 903                                    neigh->confirmed + neigh->parms->reachable_time)) {
 904                         neigh_dbg(2, "neigh %p is still alive\n", neigh);
 905                         next = neigh->confirmed + neigh->parms->reachable_time;
 906                 } else if (time_before_eq(now,
 907                                           neigh->used +
 908                                           NEIGH_VAR(neigh->parms, DELAY_PROBE_TIME))) {
 909                         neigh_dbg(2, "neigh %p is delayed\n", neigh);
 910                         neigh->nud_state = NUD_DELAY;
 911                         neigh->updated = jiffies;
 912                         neigh_suspect(neigh);
 913                         next = now + NEIGH_VAR(neigh->parms, DELAY_PROBE_TIME);
 914                 } else {
 915                         neigh_dbg(2, "neigh %p is suspected\n", neigh);
 916                         neigh->nud_state = NUD_STALE;
 917                         neigh->updated = jiffies;
 918                         neigh_suspect(neigh);
 919                         notify = 1;
 920                 }
 921         } else if (state & NUD_DELAY) {
 922                 if (time_before_eq(now,
 923                                    neigh->confirmed +
 924                                    NEIGH_VAR(neigh->parms, DELAY_PROBE_TIME))) {
 925                         neigh_dbg(2, "neigh %p is now reachable\n", neigh);
 926                         neigh->nud_state = NUD_REACHABLE;
 927                         neigh->updated = jiffies;
 928                         neigh_connect(neigh);
 929                         notify = 1;
 930                         next = neigh->confirmed + neigh->parms->reachable_time;
 931                 } else {
 932                         neigh_dbg(2, "neigh %p is probed\n", neigh);
 933                         neigh->nud_state = NUD_PROBE;
 934                         neigh->updated = jiffies;
 935                         atomic_set(&neigh->probes, 0);
 936                         next = now + NEIGH_VAR(neigh->parms, RETRANS_TIME);
 937                 }
 938         } else {
 939                 /* NUD_PROBE|NUD_INCOMPLETE */
 940                 next = now + NEIGH_VAR(neigh->parms, RETRANS_TIME);
 941         }
 942
 943         if ((neigh->nud_state & (NUD_INCOMPLETE | NUD_PROBE)) &&
 944             atomic_read(&neigh->probes) >= neigh_max_probes(neigh)) {
 945                 neigh->nud_state = NUD_FAILED;
 946                 notify = 1;
 947                 neigh_invalidate(neigh);
 948         }
 949
 950         if (neigh->nud_state & NUD_IN_TIMER) {
 951                 if (time_before(next, jiffies + HZ/2))
 952                         next = jiffies + HZ/2;
 953                 if (!mod_timer(&neigh->timer, next))
 954                         neigh_hold(neigh);
 955         }
 956         if (neigh->nud_state & (NUD_INCOMPLETE | NUD_PROBE)) {
 957                 neigh_probe(neigh);
 958         } else {
 959 out:
 960                 write_unlock(&neigh->lock);
 961         }
 962
 963         if (notify)
 964                 neigh_update_notify(neigh);
 965
 966         neigh_release(neigh);
 967 }
 968
 969 int __neigh_event_send(struct neighbour *neigh, struct sk_buff *skb)
 970 {
 971         int rc;
 972         bool immediate_probe = false;
 973
 974         write_lock_bh(&neigh->lock);
 975
 976         rc = 0;
 977         if (neigh->nud_state & (NUD_CONNECTED | NUD_DELAY | NUD_PROBE))
 978                 goto out_unlock_bh;
 979
 980         if (!(neigh->nud_state & (NUD_STALE | NUD_INCOMPLETE))) {
 981                 if (NEIGH_VAR(neigh->parms, MCAST_PROBES) +
 982                     NEIGH_VAR(neigh->parms, APP_PROBES)) {
 983                         unsigned long next, now = jiffies;
 984
 985                         atomic_set(&neigh->probes,
 986                                    NEIGH_VAR(neigh->parms, UCAST_PROBES));
 987                         neigh->nud_state     = NUD_INCOMPLETE;
 988                         neigh->updated = now;
 989                         next = now + max(NEIGH_VAR(neigh->parms, RETRANS_TIME),
 990                                          HZ/2);
 991                         neigh_add_timer(neigh, next);
 992                         immediate_probe = true;
 993                 } else {
 994                         neigh->nud_state = NUD_FAILED;
 995                         neigh->updated = jiffies;
 996                         write_unlock_bh(&neigh->lock);
 997
 998                         kfree_skb(skb);
 999                         return 1;
1000                 }
1001         } else if (neigh->nud_state & NUD_STALE) {
1002                 neigh_dbg(2, "neigh %p is delayed\n", neigh);
1003                 neigh->nud_state = NUD_DELAY;
1004                 neigh->updated = jiffies;
1005                 neigh_add_timer(neigh, jiffies +
1006                                 NEIGH_VAR(neigh->parms, DELAY_PROBE_TIME));
1007         }
1008
1009         if (neigh->nud_state == NUD_INCOMPLETE) {
1010                 if (skb) {
1011                         while (neigh->arp_queue_len_bytes + skb->truesize >
1012                                NEIGH_VAR(neigh->parms, QUEUE_LEN_BYTES)) {
1013                                 struct sk_buff *buff;
1014
1015                                 buff = __skb_dequeue(&neigh->arp_queue);
1016                                 if (!buff)
1017                                         break;
1018                                 neigh->arp_queue_len_bytes -= buff->truesize;
1019                                 kfree_skb(buff);
1020                                 NEIGH_CACHE_STAT_INC(neigh->tbl, unres_discards);
1021                         }
1022                         skb_dst_force(skb);
1023                         __skb_queue_tail(&neigh->arp_queue, skb);
1024                         neigh->arp_queue_len_bytes += skb->truesize;
1025                 }
1026                 rc = 1;
1027         }
1028 out_unlock_bh:
1029         if (immediate_probe)
1030                 neigh_probe(neigh);
1031         else
1032                 write_unlock(&neigh->lock);
1033         local_bh_enable();
1034         return rc;
1035 }
1036 EXPORT_SYMBOL(__neigh_event_send);
1037
1038 static void neigh_update_hhs(struct neighbour *neigh)
1039 {
1040         struct hh_cache *hh;
1041         void (*update)(struct hh_cache*, const struct net_device*, const unsigned char *)
1042                 = NULL;
1043
1044         if (neigh->dev->header_ops)
1045                 update = neigh->dev->header_ops->cache_update;
1046
1047         if (update) {
1048                 hh = &neigh->hh;
1049                 if (hh->hh_len) {
1050                         write_seqlock_bh(&hh->hh_lock);
1051                         update(hh, neigh->dev, neigh->ha);
1052                         write_sequnlock_bh(&hh->hh_lock);
1053                 }
1054         }
1055 }
1056
1057
1058
1059 /* Generic update routine.
1060    -- lladdr is new lladdr or NULL, if it is not supplied.
1061    -- new    is new state.
1062    -- flags
1063         NEIGH_UPDATE_F_OVERRIDE allows to override existing lladdr,
1064                                 if it is different.
1065         NEIGH_UPDATE_F_WEAK_OVERRIDE will suspect existing "connected"
1066                                 lladdr instead of overriding it
1067                                 if it is different.
1068                                 It also allows to retain current state
1069                                 if lladdr is unchanged.
1070         NEIGH_UPDATE_F_ADMIN    means that the change is administrative.
1071
1072         NEIGH_UPDATE_F_OVERRIDE_ISROUTER allows to override existing
1073                                 NTF_ROUTER flag.
1074         NEIGH_UPDATE_F_ISROUTER indicates if the neighbour is known as
1075                                 a router.
1076
1077    Caller MUST hold reference count on the entry.
1078  */
1079
1080 int neigh_update(struct neighbour *neigh, const u8 *lladdr, u8 new,
1081                  u32 flags)
1082 {
1083         u8 old;
1084         int err;
1085         int notify = 0;
1086         struct net_device *dev;
1087         int update_isrouter = 0;
1088
1089         write_lock_bh(&neigh->lock);
1090
1091         dev    = neigh->dev;
1092         old    = neigh->nud_state;
1093         err    = -EPERM;
1094
1095         if (!(flags & NEIGH_UPDATE_F_ADMIN) &&
1096             (old & (NUD_NOARP | NUD_PERMANENT)))
1097                 goto out;
1098
1099         if (!(new & NUD_VALID)) {
1100                 neigh_del_timer(neigh);
1101                 if (old & NUD_CONNECTED)
1102                         neigh_suspect(neigh);
1103                 neigh->nud_state = new;
1104                 err = 0;
1105                 notify = old & NUD_VALID;
1106                 if ((old & (NUD_INCOMPLETE | NUD_PROBE)) &&
1107                     (new & NUD_FAILED)) {
1108                         neigh_invalidate(neigh);
1109                         notify = 1;
1110                 }
1111                 goto out;
1112         }
1113
1114         /* Compare new lladdr with cached one */
1115         if (!dev->addr_len) {
1116                 /* First case: device needs no address. */
1117                 lladdr = neigh->ha;
1118         } else if (lladdr) {
1119                 /* The second case: if something is already cached
1120                    and a new address is proposed:
1121                    - compare new & old
1122                    - if they are different, check override flag
1123                  */
1124                 if ((old & NUD_VALID) &&
1125                     !memcmp(lladdr, neigh->ha, dev->addr_len))
1126                         lladdr = neigh->ha;
1127         } else {
1128                 /* No address is supplied; if we know something,
1129                    use it, otherwise discard the request.
1130                  */
1131                 err = -EINVAL;
1132                 if (!(old & NUD_VALID))
1133                         goto out;
1134                 lladdr = neigh->ha;
1135         }
1136
1137         if (new & NUD_CONNECTED)
1138                 neigh->confirmed = jiffies;
1139         neigh->updated = jiffies;
1140
1141         /* If entry was valid and address is not changed,
1142            do not change entry state, if new one is STALE.
1143          */
1144         err = 0;
1145         update_isrouter = flags & NEIGH_UPDATE_F_OVERRIDE_ISROUTER;
1146         if (old & NUD_VALID) {
1147                 if (lladdr != neigh->ha && !(flags & NEIGH_UPDATE_F_OVERRIDE)) {
1148                         update_isrouter = 0;
1149                         if ((flags & NEIGH_UPDATE_F_WEAK_OVERRIDE) &&
1150                             (old & NUD_CONNECTED)) {
1151                                 lladdr = neigh->ha;
1152                                 new = NUD_STALE;
1153                         } else
1154                                 goto out;
1155                 } else {
1156                         if (lladdr == neigh->ha && new == NUD_STALE &&
1157                             ((flags & NEIGH_UPDATE_F_WEAK_OVERRIDE) ||
1158                              (old & NUD_CONNECTED))
1159                             )
1160                                 new = old;
1161                 }
1162         }
1163
1164         if (new != old) {
1165                 neigh_del_timer(neigh);
1166                 if (new & NUD_IN_TIMER)
1167                         neigh_add_timer(neigh, (jiffies +
1168                                                 ((new & NUD_REACHABLE) ?
1169                                                  neigh->parms->reachable_time :
1170                                                  0)));
1171                 neigh->nud_state = new;
1172         }
1173
1174         if (lladdr != neigh->ha) {
1175                 write_seqlock(&neigh->ha_lock);
1176                 memcpy(&neigh->ha, lladdr, dev->addr_len);
1177                 write_sequnlock(&neigh->ha_lock);
1178                 neigh_update_hhs(neigh);
1179                 if (!(new & NUD_CONNECTED))
1180                         neigh->confirmed = jiffies -
1181                                       (NEIGH_VAR(neigh->parms, BASE_REACHABLE_TIME) << 1);
1182                 notify = 1;
1183         }
1184         if (new == old)
1185                 goto out;
1186         if (new & NUD_CONNECTED)
1187                 neigh_connect(neigh);
1188         else
1189                 neigh_suspect(neigh);
1190         if (!(old & NUD_VALID)) {
1191                 struct sk_buff *skb;
1192
1193                 /* Again: avoid dead loop if something went wrong */
1194
1195                 while (neigh->nud_state & NUD_VALID &&
1196                        (skb = __skb_dequeue(&neigh->arp_queue)) != NULL) {
1197                         struct dst_entry *dst = skb_dst(skb);
1198                         struct neighbour *n2, *n1 = neigh;
1199                         write_unlock_bh(&neigh->lock);
1200
1201                         rcu_read_lock();
1202
1203                         /* Why not just use 'neigh' as-is?  The problem is that
1204                          * things such as shaper, eql, and sch_teql can end up
1205                          * using alternative, different, neigh objects to output
1206                          * the packet in the output path.  So what we need to do
1207                          * here is re-lookup the top-level neigh in the path so
1208                          * we can reinject the packet there.
1209                          */
1210                         n2 = NULL;
1211                         if (dst) {
1212                                 n2 = dst_neigh_lookup_skb(dst, skb);
1213                                 if (n2)
1214                                         n1 = n2;
1215                         }
1216                         n1->output(n1, skb);
1217                         if (n2)
1218                                 neigh_release(n2);
1219                         rcu_read_unlock();
1220
1221                         write_lock_bh(&neigh->lock);
1222                 }
1223                 __skb_queue_purge(&neigh->arp_queue);
1224                 neigh->arp_queue_len_bytes = 0;
1225         }
1226 out:
1227         if (update_isrouter) {
1228                 neigh->flags = (flags & NEIGH_UPDATE_F_ISROUTER) ?
1229                         (neigh->flags | NTF_ROUTER) :
1230                         (neigh->flags & ~NTF_ROUTER);
1231         }
1232         write_unlock_bh(&neigh->lock);
1233
1234         if (notify)
1235                 neigh_update_notify(neigh);
1236
1237         return err;
1238 }
1239 EXPORT_SYMBOL(neigh_update);
1240
1241 /* Update the neigh to listen temporarily for probe responses, even if it is
1242  * in a NUD_FAILED state. The caller has to hold neigh->lock for writing.
1243  */
1244 void __neigh_set_probe_once(struct neighbour *neigh)
1245 {
1246         neigh->updated = jiffies;
1247         if (!(neigh->nud_state & NUD_FAILED))
1248                 return;
1249         neigh->nud_state = NUD_PROBE;
1250         atomic_set(&neigh->probes, NEIGH_VAR(neigh->parms, UCAST_PROBES));
1251         neigh_add_timer(neigh,
1252                         jiffies + NEIGH_VAR(neigh->parms, RETRANS_TIME));
1253 }
1254 EXPORT_SYMBOL(__neigh_set_probe_once);
1255
1256 struct neighbour *neigh_event_ns(struct neigh_table *tbl,
1257                                  u8 *lladdr, void *saddr,
1258                                  struct net_device *dev)
1259 {
1260         struct neighbour *neigh = __neigh_lookup(tbl, saddr, dev,
1261                                                  lladdr || !dev->addr_len);
1262         if (neigh)
1263                 neigh_update(neigh, lladdr, NUD_STALE,
1264                              NEIGH_UPDATE_F_OVERRIDE);
1265         return neigh;
1266 }
1267 EXPORT_SYMBOL(neigh_event_ns);
1268
1269 /* called with read_lock_bh(&n->lock); */
1270 static void neigh_hh_init(struct neighbour *n, struct dst_entry *dst)
1271 {
1272         struct net_device *dev = dst->dev;
1273         __be16 prot = dst->ops->protocol;
1274         struct hh_cache *hh = &n->hh;
1275
1276         write_lock_bh(&n->lock);
1277
1278         /* Only one thread can come in here and initialize the
1279          * hh_cache entry.
1280          */
1281         if (!hh->hh_len)
1282                 dev->header_ops->cache(n, hh, prot);
1283
1284         write_unlock_bh(&n->lock);
1285 }
1286
1287 /* This function can be used in contexts, where only old dev_queue_xmit
1288  * worked, f.e. if you want to override normal output path (eql, shaper),
1289  * but resolution is not made yet.
1290  */
1291
1292 int neigh_compat_output(struct neighbour *neigh, struct sk_buff *skb)
1293 {
1294         struct net_device *dev = skb->dev;
1295
1296         __skb_pull(skb, skb_network_offset(skb));
1297
1298         if (dev_hard_header(skb, dev, ntohs(skb->protocol), NULL, NULL,
1299                             skb->len) < 0 &&
1300             dev->header_ops->rebuild(skb))
1301                 return 0;
1302
1303         return dev_queue_xmit(skb);
1304 }
1305 EXPORT_SYMBOL(neigh_compat_output);
1306
1307 /* Slow and careful. */
1308
1309 int neigh_resolve_output(struct neighbour *neigh, struct sk_buff *skb)
1310 {
1311         struct dst_entry *dst = skb_dst(skb);
1312         int rc = 0;
1313
1314         if (!dst)
1315                 goto discard;
1316
1317         if (!neigh_event_send(neigh, skb)) {
1318                 int err;
1319                 struct net_device *dev = neigh->dev;
1320                 unsigned int seq;
1321
1322                 if (dev->header_ops->cache && !neigh->hh.hh_len)
1323                         neigh_hh_init(neigh, dst);
1324
1325                 do {
1326                         __skb_pull(skb, skb_network_offset(skb));
1327                         seq = read_seqbegin(&neigh->ha_lock);
1328                         err = dev_hard_header(skb, dev, ntohs(skb->protocol),
1329                                               neigh->ha, NULL, skb->len);
1330                 } while (read_seqretry(&neigh->ha_lock, seq));
1331
1332                 if (err >= 0)
1333                         rc = dev_queue_xmit(skb);
1334                 else
1335                         goto out_kfree_skb;
1336         }
1337 out:
1338         return rc;
1339 discard:
1340         neigh_dbg(1, "%s: dst=%p neigh=%p\n", __func__, dst, neigh);
1341 out_kfree_skb:
1342         rc = -EINVAL;
1343         kfree_skb(skb);
1344         goto out;
1345 }
1346 EXPORT_SYMBOL(neigh_resolve_output);
1347
1348 /* As fast as possible without hh cache */
1349
1350 int neigh_connected_output(struct neighbour *neigh, struct sk_buff *skb)
1351 {
1352         struct net_device *dev = neigh->dev;
1353         unsigned int seq;
1354         int err;
1355
1356         do {
1357                 __skb_pull(skb, skb_network_offset(skb));
1358                 seq = read_seqbegin(&neigh->ha_lock);
1359                 err = dev_hard_header(skb, dev, ntohs(skb->protocol),
1360                                       neigh->ha, NULL, skb->len);
1361         } while (read_seqretry(&neigh->ha_lock, seq));
1362
1363         if (err >= 0)
1364                 err = dev_queue_xmit(skb);
1365         else {
1366                 err = -EINVAL;
1367                 kfree_skb(skb);
1368         }
1369         return err;
1370 }
1371 EXPORT_SYMBOL(neigh_connected_output);
1372
1373 int neigh_direct_output(struct neighbour *neigh, struct sk_buff *skb)
1374 {
1375         return dev_queue_xmit(skb);
1376 }
1377 EXPORT_SYMBOL(neigh_direct_output);
1378
1379 static void neigh_proxy_process(unsigned long arg)
1380 {
1381         struct neigh_table *tbl = (struct neigh_table *)arg;
1382         long sched_next = 0;
1383         unsigned long now = jiffies;
1384         struct sk_buff *skb, *n;
1385
1386         spin_lock(&tbl->proxy_queue.lock);
1387
1388         skb_queue_walk_safe(&tbl->proxy_queue, skb, n) {
1389                 long tdif = NEIGH_CB(skb)->sched_next - now;
1390
1391                 if (tdif <= 0) {
1392                         struct net_device *dev = skb->dev;
1393
1394                         __skb_unlink(skb, &tbl->proxy_queue);
1395                         if (tbl->proxy_redo && netif_running(dev)) {
1396                                 rcu_read_lock();
1397                                 tbl->proxy_redo(skb);
1398                                 rcu_read_unlock();
1399                         } else {
1400                                 kfree_skb(skb);
1401                         }
1402
1403                         dev_put(dev);
1404                 } else if (!sched_next || tdif < sched_next)
1405                         sched_next = tdif;
1406         }
1407         del_timer(&tbl->proxy_timer);
1408         if (sched_next)
1409                 mod_timer(&tbl->proxy_timer, jiffies + sched_next);
1410         spin_unlock(&tbl->proxy_queue.lock);
1411 }
1412
1413 void pneigh_enqueue(struct neigh_table *tbl, struct neigh_parms *p,
1414                     struct sk_buff *skb)
1415 {
1416         unsigned long now = jiffies;
1417         unsigned long sched_next = now + (net_random() %
1418                                           NEIGH_VAR(p, PROXY_DELAY));
1419
1420         if (tbl->proxy_queue.qlen > NEIGH_VAR(p, PROXY_QLEN)) {
1421                 kfree_skb(skb);
1422                 return;
1423         }
1424
1425         NEIGH_CB(skb)->sched_next = sched_next;
1426         NEIGH_CB(skb)->flags |= LOCALLY_ENQUEUED;
1427
1428         spin_lock(&tbl->proxy_queue.lock);
1429         if (del_timer(&tbl->proxy_timer)) {
1430                 if (time_before(tbl->proxy_timer.expires, sched_next))
1431                         sched_next = tbl->proxy_timer.expires;
1432         }
1433         skb_dst_drop(skb);
1434         dev_hold(skb->dev);
1435         __skb_queue_tail(&tbl->proxy_queue, skb);
1436         mod_timer(&tbl->proxy_timer, sched_next);
1437         spin_unlock(&tbl->proxy_queue.lock);
1438 }
1439 EXPORT_SYMBOL(pneigh_enqueue);
1440
1441 static inline struct neigh_parms *lookup_neigh_parms(struct neigh_table *tbl,
1442                                                       struct net *net, int ifindex)
1443 {
1444         struct neigh_parms *p;
1445
1446         for (p = &tbl->parms; p; p = p->next) {
1447                 if ((p->dev && p->dev->ifindex == ifindex && net_eq(neigh_parms_net(p), net)) ||
1448                     (!p->dev && !ifindex && net_eq(net, &init_net)))
1449                         return p;
1450         }
1451
1452         return NULL;
1453 }
1454
1455 struct neigh_parms *neigh_parms_alloc(struct net_device *dev,
1456                                       struct neigh_table *tbl)
1457 {
1458         struct neigh_parms *p;
1459         struct net *net = dev_net(dev);
1460         const struct net_device_ops *ops = dev->netdev_ops;
1461
1462         p = kmemdup(&tbl->parms, sizeof(*p), GFP_KERNEL);
1463         if (p) {
1464                 p->tbl            = tbl;
1465                 atomic_set(&p->refcnt, 1);
1466                 p->reachable_time =
1467                                 neigh_rand_reach_time(NEIGH_VAR(p, BASE_REACHABLE_TIME));
1468                 dev_hold(dev);
1469                 p->dev = dev;
1470                 write_pnet(&p->net, hold_net(net));
1471                 p->sysctl_table = NULL;
1472
1473                 if (ops->ndo_neigh_setup && ops->ndo_neigh_setup(dev, p)) {
1474                         release_net(net);
1475                         dev_put(dev);
1476                         kfree(p);
1477                         return NULL;
1478                 }
1479
1480                 write_lock_bh(&tbl->lock);
1481                 p->next         = tbl->parms.next;
1482                 tbl->parms.next = p;
1483                 write_unlock_bh(&tbl->lock);
1484
1485                 neigh_parms_data_state_cleanall(p);
1486         }
1487         return p;
1488 }
1489 EXPORT_SYMBOL(neigh_parms_alloc);
1490
1491 static void neigh_rcu_free_parms(struct rcu_head *head)
1492 {
1493         struct neigh_parms *parms =
1494                 container_of(head, struct neigh_parms, rcu_head);
1495
1496         neigh_parms_put(parms);
1497 }
1498
1499 void neigh_parms_release(struct neigh_table *tbl, struct neigh_parms *parms)
1500 {
1501         struct neigh_parms **p;
1502
1503         if (!parms || parms == &tbl->parms)
1504                 return;
1505         write_lock_bh(&tbl->lock);
1506         for (p = &tbl->parms.next; *p; p = &(*p)->next) {
1507                 if (*p == parms) {
1508                         *p = parms->next;
1509                         parms->dead = 1;
1510                         write_unlock_bh(&tbl->lock);
1511                         if (parms->dev)
1512                                 dev_put(parms->dev);
1513                         call_rcu(&parms->rcu_head, neigh_rcu_free_parms);
1514                         return;
1515                 }
1516         }
1517         write_unlock_bh(&tbl->lock);
1518         neigh_dbg(1, "%s: not found\n", __func__);
1519 }
1520 EXPORT_SYMBOL(neigh_parms_release);
1521
1522 static void neigh_parms_destroy(struct neigh_parms *parms)
1523 {
1524         release_net(neigh_parms_net(parms));
1525         kfree(parms);
1526 }
1527
1528 static struct lock_class_key neigh_table_proxy_queue_class;
1529
1530 static void neigh_table_init_no_netlink(struct neigh_table *tbl)
1531 {
1532         unsigned long now = jiffies;
1533         unsigned long phsize;
1534
1535         write_pnet(&tbl->parms.net, &init_net);
1536         atomic_set(&tbl->parms.refcnt, 1);
1537         tbl->parms.reachable_time =
1538                           neigh_rand_reach_time(NEIGH_VAR(&tbl->parms, BASE_REACHABLE_TIME));
1539
1540         tbl->stats = alloc_percpu(struct neigh_statistics);
1541         if (!tbl->stats)
1542                 panic("cannot create neighbour cache statistics");
1543
1544 #ifdef CONFIG_PROC_FS
1545         if (!proc_create_data(tbl->id, 0, init_net.proc_net_stat,
1546                               &neigh_stat_seq_fops, tbl))
1547                 panic("cannot create neighbour proc dir entry");
1548 #endif
1549
1550         RCU_INIT_POINTER(tbl->nht, neigh_hash_alloc(3));
1551
1552         phsize = (PNEIGH_HASHMASK + 1) * sizeof(struct pneigh_entry *);
1553         tbl->phash_buckets = kzalloc(phsize, GFP_KERNEL);
1554
1555         if (!tbl->nht || !tbl->phash_buckets)
1556                 panic("cannot allocate neighbour cache hashes");
1557
1558         if (!tbl->entry_size)
1559                 tbl->entry_size = ALIGN(offsetof(struct neighbour, primary_key) +
1560                                         tbl->key_len, NEIGH_PRIV_ALIGN);
1561         else
1562                 WARN_ON(tbl->entry_size % NEIGH_PRIV_ALIGN);
1563
1564         rwlock_init(&tbl->lock);
1565         INIT_DEFERRABLE_WORK(&tbl->gc_work, neigh_periodic_work);
1566         schedule_delayed_work(&tbl->gc_work, tbl->parms.reachable_time);
1567         setup_timer(&tbl->proxy_timer, neigh_proxy_process, (unsigned long)tbl);
1568         skb_queue_head_init_class(&tbl->proxy_queue,
1569                         &neigh_table_proxy_queue_class);
1570
1571         tbl->last_flush = now;
1572         tbl->last_rand  = now + tbl->parms.reachable_time * 20;
1573 }
1574
1575 void neigh_table_init(struct neigh_table *tbl)
1576 {
1577         struct neigh_table *tmp;
1578
1579         neigh_table_init_no_netlink(tbl);
1580         write_lock(&neigh_tbl_lock);
1581         for (tmp = neigh_tables; tmp; tmp = tmp->next) {
1582                 if (tmp->family == tbl->family)
1583                         break;
1584         }
1585         tbl->next       = neigh_tables;
1586         neigh_tables    = tbl;
1587         write_unlock(&neigh_tbl_lock);
1588
1589         if (unlikely(tmp)) {
1590                 pr_err("Registering multiple tables for family %d\n",
1591                        tbl->family);
1592                 dump_stack();
1593         }
1594 }
1595 EXPORT_SYMBOL(neigh_table_init);
1596
1597 int neigh_table_clear(struct neigh_table *tbl)
1598 {
1599         struct neigh_table **tp;
1600
1601         /* It is not clean... Fix it to unload IPv6 module safely */
1602         cancel_delayed_work_sync(&tbl->gc_work);
1603         del_timer_sync(&tbl->proxy_timer);
1604         pneigh_queue_purge(&tbl->proxy_queue);
1605         neigh_ifdown(tbl, NULL);
1606         if (atomic_read(&tbl->entries))
1607                 pr_crit("neighbour leakage\n");
1608         write_lock(&neigh_tbl_lock);
1609         for (tp = &neigh_tables; *tp; tp = &(*tp)->next) {
1610                 if (*tp == tbl) {
1611                         *tp = tbl->next;
1612                         break;
1613                 }
1614         }
1615         write_unlock(&neigh_tbl_lock);
1616
1617         call_rcu(&rcu_dereference_protected(tbl->nht, 1)->rcu,
1618                  neigh_hash_free_rcu);
1619         tbl->nht = NULL;
1620
1621         kfree(tbl->phash_buckets);
1622         tbl->phash_buckets = NULL;
1623
1624         remove_proc_entry(tbl->id, init_net.proc_net_stat);
1625
1626         free_percpu(tbl->stats);
1627         tbl->stats = NULL;
1628
1629         return 0;
1630 }
1631 EXPORT_SYMBOL(neigh_table_clear);
1632
1633 static int neigh_delete(struct sk_buff *skb, struct nlmsghdr *nlh)
1634 {
1635         struct net *net = sock_net(skb->sk);
1636         struct ndmsg *ndm;
1637         struct nlattr *dst_attr;
1638         struct neigh_table *tbl;
1639         struct net_device *dev = NULL;
1640         int err = -EINVAL;
1641
1642         ASSERT_RTNL();
1643         if (nlmsg_len(nlh) < sizeof(*ndm))
1644                 goto out;
1645
1646         dst_attr = nlmsg_find_attr(nlh, sizeof(*ndm), NDA_DST);
1647         if (dst_attr == NULL)
1648                 goto out;
1649
1650         ndm = nlmsg_data(nlh);
1651         if (ndm->ndm_ifindex) {
1652                 dev = __dev_get_by_index(net, ndm->ndm_ifindex);
1653                 if (dev == NULL) {
1654                         err = -ENODEV;
1655                         goto out;
1656                 }
1657         }
1658
1659         read_lock(&neigh_tbl_lock);
1660         for (tbl = neigh_tables; tbl; tbl = tbl->next) {
1661                 struct neighbour *neigh;
1662
1663                 if (tbl->family != ndm->ndm_family)
1664                         continue;
1665                 read_unlock(&neigh_tbl_lock);
1666
1667                 if (nla_len(dst_attr) < tbl->key_len)
1668                         goto out;
1669
1670                 if (ndm->ndm_flags & NTF_PROXY) {
1671                         err = pneigh_delete(tbl, net, nla_data(dst_attr), dev);
1672                         goto out;
1673                 }
1674
1675                 if (dev == NULL)
1676                         goto out;
1677
1678                 neigh = neigh_lookup(tbl, nla_data(dst_attr), dev);
1679                 if (neigh == NULL) {
1680                         err = -ENOENT;
1681                         goto out;
1682                 }
1683
1684                 err = neigh_update(neigh, NULL, NUD_FAILED,
1685                                    NEIGH_UPDATE_F_OVERRIDE |
1686                                    NEIGH_UPDATE_F_ADMIN);
1687                 neigh_release(neigh);
1688                 goto out;
1689         }
1690         read_unlock(&neigh_tbl_lock);
1691         err = -EAFNOSUPPORT;
1692
1693 out:
1694         return err;
1695 }
1696
1697 static int neigh_add(struct sk_buff *skb, struct nlmsghdr *nlh)
1698 {
1699         struct net *net = sock_net(skb->sk);
1700         struct ndmsg *ndm;
1701         struct nlattr *tb[NDA_MAX+1];
1702         struct neigh_table *tbl;
1703         struct net_device *dev = NULL;
1704         int err;
1705
1706         ASSERT_RTNL();
1707         err = nlmsg_parse(nlh, sizeof(*ndm), tb, NDA_MAX, NULL);
1708         if (err < 0)
1709                 goto out;
1710
1711         err = -EINVAL;
1712         if (tb[NDA_DST] == NULL)
1713                 goto out;
1714
1715         ndm = nlmsg_data(nlh);
1716         if (ndm->ndm_ifindex) {
1717                 dev = __dev_get_by_index(net, ndm->ndm_ifindex);
1718                 if (dev == NULL) {
1719                         err = -ENODEV;
1720                         goto out;
1721                 }
1722
1723                 if (tb[NDA_LLADDR] && nla_len(tb[NDA_LLADDR]) < dev->addr_len)
1724                         goto out;
1725         }
1726
1727         read_lock(&neigh_tbl_lock);
1728         for (tbl = neigh_tables; tbl; tbl = tbl->next) {
1729                 int flags = NEIGH_UPDATE_F_ADMIN | NEIGH_UPDATE_F_OVERRIDE;
1730                 struct neighbour *neigh;
1731                 void *dst, *lladdr;
1732
1733                 if (tbl->family != ndm->ndm_family)
1734                         continue;
1735                 read_unlock(&neigh_tbl_lock);
1736
1737                 if (nla_len(tb[NDA_DST]) < tbl->key_len)
1738                         goto out;
1739                 dst = nla_data(tb[NDA_DST]);
1740                 lladdr = tb[NDA_LLADDR] ? nla_data(tb[NDA_LLADDR]) : NULL;
1741
1742                 if (ndm->ndm_flags & NTF_PROXY) {
1743                         struct pneigh_entry *pn;
1744
1745                         err = -ENOBUFS;
1746                         pn = pneigh_lookup(tbl, net, dst, dev, 1);
1747                         if (pn) {
1748                                 pn->flags = ndm->ndm_flags;
1749                                 err = 0;
1750                         }
1751                         goto out;
1752                 }
1753
1754                 if (dev == NULL)
1755                         goto out;
1756
1757                 neigh = neigh_lookup(tbl, dst, dev);
1758                 if (neigh == NULL) {
1759                         if (!(nlh->nlmsg_flags & NLM_F_CREATE)) {
1760                                 err = -ENOENT;
1761                                 goto out;
1762                         }
1763
1764                         neigh = __neigh_lookup_errno(tbl, dst, dev);
1765                         if (IS_ERR(neigh)) {
1766                                 err = PTR_ERR(neigh);
1767                                 goto out;
1768                         }
1769                 } else {
1770                         if (nlh->nlmsg_flags & NLM_F_EXCL) {
1771                                 err = -EEXIST;
1772                                 neigh_release(neigh);
1773                                 goto out;
1774                         }
1775
1776                         if (!(nlh->nlmsg_flags & NLM_F_REPLACE))
1777                                 flags &= ~NEIGH_UPDATE_F_OVERRIDE;
1778                 }
1779
1780                 if (ndm->ndm_flags & NTF_USE) {
1781                         neigh_event_send(neigh, NULL);
1782                         err = 0;
1783                 } else
1784                         err = neigh_update(neigh, lladdr, ndm->ndm_state, flags);
1785                 neigh_release(neigh);
1786                 goto out;
1787         }
1788
1789         read_unlock(&neigh_tbl_lock);
1790         err = -EAFNOSUPPORT;
1791 out:
1792         return err;
1793 }
1794
1795 static int neightbl_fill_parms(struct sk_buff *skb, struct neigh_parms *parms)
1796 {
1797         struct nlattr *nest;
1798
1799         nest = nla_nest_start(skb, NDTA_PARMS);
1800         if (nest == NULL)
1801                 return -ENOBUFS;
1802
1803         if ((parms->dev &&
1804              nla_put_u32(skb, NDTPA_IFINDEX, parms->dev->ifindex)) ||
1805             nla_put_u32(skb, NDTPA_REFCNT, atomic_read(&parms->refcnt)) ||
1806             nla_put_u32(skb, NDTPA_QUEUE_LENBYTES,
1807                         NEIGH_VAR(parms, QUEUE_LEN_BYTES)) ||
1808             /* approximative value for deprecated QUEUE_LEN (in packets) */
1809             nla_put_u32(skb, NDTPA_QUEUE_LEN,
1810                         NEIGH_VAR(parms, QUEUE_LEN_BYTES) / SKB_TRUESIZE(ETH_FRAME_LEN)) ||
1811             nla_put_u32(skb, NDTPA_PROXY_QLEN, NEIGH_VAR(parms, PROXY_QLEN)) ||
1812             nla_put_u32(skb, NDTPA_APP_PROBES, NEIGH_VAR(parms, APP_PROBES)) ||
1813             nla_put_u32(skb, NDTPA_UCAST_PROBES,
1814                         NEIGH_VAR(parms, UCAST_PROBES)) ||
1815             nla_put_u32(skb, NDTPA_MCAST_PROBES,
1816                         NEIGH_VAR(parms, MCAST_PROBES)) ||
1817             nla_put_msecs(skb, NDTPA_REACHABLE_TIME, parms->reachable_time) ||
1818             nla_put_msecs(skb, NDTPA_BASE_REACHABLE_TIME,
1819                           NEIGH_VAR(parms, BASE_REACHABLE_TIME)) ||
1820             nla_put_msecs(skb, NDTPA_GC_STALETIME,
1821                           NEIGH_VAR(parms, GC_STALETIME)) ||
1822             nla_put_msecs(skb, NDTPA_DELAY_PROBE_TIME,
1823                           NEIGH_VAR(parms, DELAY_PROBE_TIME)) ||
1824             nla_put_msecs(skb, NDTPA_RETRANS_TIME,
1825                           NEIGH_VAR(parms, RETRANS_TIME)) ||
1826             nla_put_msecs(skb, NDTPA_ANYCAST_DELAY,
1827                           NEIGH_VAR(parms, ANYCAST_DELAY)) ||
1828             nla_put_msecs(skb, NDTPA_PROXY_DELAY,
1829                           NEIGH_VAR(parms, PROXY_DELAY)) ||
1830             nla_put_msecs(skb, NDTPA_LOCKTIME,
1831                           NEIGH_VAR(parms, LOCKTIME)))
1832                 goto nla_put_failure;
1833         return nla_nest_end(skb, nest);
1834
1835 nla_put_failure:
1836         nla_nest_cancel(skb, nest);
1837         return -EMSGSIZE;
1838 }
1839
1840 static int neightbl_fill_info(struct sk_buff *skb, struct neigh_table *tbl,
1841                               u32 pid, u32 seq, int type, int flags)
1842 {
1843         struct nlmsghdr *nlh;
1844         struct ndtmsg *ndtmsg;
1845
1846         nlh = nlmsg_put(skb, pid, seq, type, sizeof(*ndtmsg), flags);
1847         if (nlh == NULL)
1848                 return -EMSGSIZE;
1849
1850         ndtmsg = nlmsg_data(nlh);
1851
1852         read_lock_bh(&tbl->lock);
1853         ndtmsg->ndtm_family = tbl->family;
1854         ndtmsg->ndtm_pad1   = 0;
1855         ndtmsg->ndtm_pad2   = 0;
1856
1857         if (nla_put_string(skb, NDTA_NAME, tbl->id) ||
1858             nla_put_msecs(skb, NDTA_GC_INTERVAL, tbl->gc_interval) ||
1859             nla_put_u32(skb, NDTA_THRESH1, tbl->gc_thresh1) ||
1860             nla_put_u32(skb, NDTA_THRESH2, tbl->gc_thresh2) ||
1861             nla_put_u32(skb, NDTA_THRESH3, tbl->gc_thresh3))
1862                 goto nla_put_failure;
1863         {
1864                 unsigned long now = jiffies;
1865                 unsigned int flush_delta = now - tbl->last_flush;
1866                 unsigned int rand_delta = now - tbl->last_rand;
1867                 struct neigh_hash_table *nht;
1868                 struct ndt_config ndc = {
1869                         .ndtc_key_len           = tbl->key_len,
1870                         .ndtc_entry_size        = tbl->entry_size,
1871                         .ndtc_entries           = atomic_read(&tbl->entries),
1872                         .ndtc_last_flush        = jiffies_to_msecs(flush_delta),
1873                         .ndtc_last_rand         = jiffies_to_msecs(rand_delta),
1874                         .ndtc_proxy_qlen        = tbl->proxy_queue.qlen,
1875                 };
1876
1877                 rcu_read_lock_bh();
1878                 nht = rcu_dereference_bh(tbl->nht);
1879                 ndc.ndtc_hash_rnd = nht->hash_rnd[0];
1880                 ndc.ndtc_hash_mask = ((1 << nht->hash_shift) - 1);
1881                 rcu_read_unlock_bh();
1882
1883                 if (nla_put(skb, NDTA_CONFIG, sizeof(ndc), &ndc))
1884                         goto nla_put_failure;
1885         }
1886
1887         {
1888                 int cpu;
1889                 struct ndt_stats ndst;
1890
1891                 memset(&ndst, 0, sizeof(ndst));
1892
1893                 for_each_possible_cpu(cpu) {
1894                         struct neigh_statistics *st;
1895
1896                         st = per_cpu_ptr(tbl->stats, cpu);
1897                         ndst.ndts_allocs                += st->allocs;
1898                         ndst.ndts_destroys              += st->destroys;
1899                         ndst.ndts_hash_grows            += st->hash_grows;
1900                         ndst.ndts_res_failed            += st->res_failed;
1901                         ndst.ndts_lookups               += st->lookups;
1902                         ndst.ndts_hits                  += st->hits;
1903                         ndst.ndts_rcv_probes_mcast      += st->rcv_probes_mcast;
1904                         ndst.ndts_rcv_probes_ucast      += st->rcv_probes_ucast;
1905                         ndst.ndts_periodic_gc_runs      += st->periodic_gc_runs;
1906                         ndst.ndts_forced_gc_runs        += st->forced_gc_runs;
1907                 }
1908
1909                 if (nla_put(skb, NDTA_STATS, sizeof(ndst), &ndst))
1910                         goto nla_put_failure;
1911         }
1912
1913         BUG_ON(tbl->parms.dev);
1914         if (neightbl_fill_parms(skb, &tbl->parms) < 0)
1915                 goto nla_put_failure;
1916
1917         read_unlock_bh(&tbl->lock);
1918         return nlmsg_end(skb, nlh);
1919
1920 nla_put_failure:
1921         read_unlock_bh(&tbl->lock);
1922         nlmsg_cancel(skb, nlh);
1923         return -EMSGSIZE;
1924 }
1925
1926 static int neightbl_fill_param_info(struct sk_buff *skb,
1927                                     struct neigh_table *tbl,
1928                                     struct neigh_parms *parms,
1929                                     u32 pid, u32 seq, int type,
1930                                     unsigned int flags)
1931 {
1932         struct ndtmsg *ndtmsg;
1933         struct nlmsghdr *nlh;
1934
1935         nlh = nlmsg_put(skb, pid, seq, type, sizeof(*ndtmsg), flags);
1936         if (nlh == NULL)
1937                 return -EMSGSIZE;
1938
1939         ndtmsg = nlmsg_data(nlh);
1940
1941         read_lock_bh(&tbl->lock);
1942         ndtmsg->ndtm_family = tbl->family;
1943         ndtmsg->ndtm_pad1   = 0;
1944         ndtmsg->ndtm_pad2   = 0;
1945
1946         if (nla_put_string(skb, NDTA_NAME, tbl->id) < 0 ||
1947             neightbl_fill_parms(skb, parms) < 0)
1948                 goto errout;
1949
1950         read_unlock_bh(&tbl->lock);
1951         return nlmsg_end(skb, nlh);
1952 errout:
1953         read_unlock_bh(&tbl->lock);
1954         nlmsg_cancel(skb, nlh);
1955         return -EMSGSIZE;
1956 }
1957
1958 static const struct nla_policy nl_neightbl_policy[NDTA_MAX+1] = {
1959         [NDTA_NAME]             = { .type = NLA_STRING },
1960         [NDTA_THRESH1]          = { .type = NLA_U32 },
1961         [NDTA_THRESH2]          = { .type = NLA_U32 },
1962         [NDTA_THRESH3]          = { .type = NLA_U32 },
1963         [NDTA_GC_INTERVAL]      = { .type = NLA_U64 },
1964         [NDTA_PARMS]            = { .type = NLA_NESTED },
1965 };
1966
1967 static const struct nla_policy nl_ntbl_parm_policy[NDTPA_MAX+1] = {
1968         [NDTPA_IFINDEX]                 = { .type = NLA_U32 },
1969         [NDTPA_QUEUE_LEN]               = { .type = NLA_U32 },
1970         [NDTPA_PROXY_QLEN]              = { .type = NLA_U32 },
1971         [NDTPA_APP_PROBES]              = { .type = NLA_U32 },
1972         [NDTPA_UCAST_PROBES]            = { .type = NLA_U32 },
1973         [NDTPA_MCAST_PROBES]            = { .type = NLA_U32 },
1974         [NDTPA_BASE_REACHABLE_TIME]     = { .type = NLA_U64 },
1975         [NDTPA_GC_STALETIME]            = { .type = NLA_U64 },
1976         [NDTPA_DELAY_PROBE_TIME]        = { .type = NLA_U64 },
1977         [NDTPA_RETRANS_TIME]            = { .type = NLA_U64 },
1978         [NDTPA_ANYCAST_DELAY]           = { .type = NLA_U64 },
1979         [NDTPA_PROXY_DELAY]             = { .type = NLA_U64 },
1980         [NDTPA_LOCKTIME]                = { .type = NLA_U64 },
1981 };
1982
1983 static int neightbl_set(struct sk_buff *skb, struct nlmsghdr *nlh)
1984 {
1985         struct net *net = sock_net(skb->sk);
1986         struct neigh_table *tbl;
1987         struct ndtmsg *ndtmsg;
1988         struct nlattr *tb[NDTA_MAX+1];
1989         int err;
1990
1991         err = nlmsg_parse(nlh, sizeof(*ndtmsg), tb, NDTA_MAX,
1992                           nl_neightbl_policy);
1993         if (err < 0)
1994                 goto errout;
1995
1996         if (tb[NDTA_NAME] == NULL) {
1997                 err = -EINVAL;
1998                 goto errout;
1999         }
2000
2001         ndtmsg = nlmsg_data(nlh);
2002         read_lock(&neigh_tbl_lock);
2003         for (tbl = neigh_tables; tbl; tbl = tbl->next) {
2004                 if (ndtmsg->ndtm_family && tbl->family != ndtmsg->ndtm_family)
2005                         continue;
2006
2007                 if (nla_strcmp(tb[NDTA_NAME], tbl->id) == 0)
2008                         break;
2009         }
2010
2011         if (tbl == NULL) {
2012                 err = -ENOENT;
2013                 goto errout_locked;
2014         }
2015
2016         /*
2017          * We acquire tbl->lock to be nice to the periodic timers and
2018          * make sure they always see a consistent set of values.
2019          */
2020         write_lock_bh(&tbl->lock);
2021
2022         if (tb[NDTA_PARMS]) {
2023                 struct nlattr *tbp[NDTPA_MAX+1];
2024                 struct neigh_parms *p;
2025                 int i, ifindex = 0;
2026
2027                 err = nla_parse_nested(tbp, NDTPA_MAX, tb[NDTA_PARMS],
2028                                        nl_ntbl_parm_policy);
2029                 if (err < 0)
2030                         goto errout_tbl_lock;
2031
2032                 if (tbp[NDTPA_IFINDEX])
2033                         ifindex = nla_get_u32(tbp[NDTPA_IFINDEX]);
2034
2035                 p = lookup_neigh_parms(tbl, net, ifindex);
2036                 if (p == NULL) {
2037                         err = -ENOENT;
2038                         goto errout_tbl_lock;
2039                 }
2040
2041                 for (i = 1; i <= NDTPA_MAX; i++) {
2042                         if (tbp[i] == NULL)
2043                                 continue;
2044
2045                         switch (i) {
2046                         case NDTPA_QUEUE_LEN:
2047                                 NEIGH_VAR_SET(p, QUEUE_LEN_BYTES,
2048                                               nla_get_u32(tbp[i]) *
2049                                               SKB_TRUESIZE(ETH_FRAME_LEN));
2050                                 break;
2051                         case NDTPA_QUEUE_LENBYTES:
2052                                 NEIGH_VAR_SET(p, QUEUE_LEN_BYTES,
2053                                               nla_get_u32(tbp[i]));
2054                                 break;
2055                         case NDTPA_PROXY_QLEN:
2056                                 NEIGH_VAR_SET(p, PROXY_QLEN,
2057                                               nla_get_u32(tbp[i]));
2058                                 break;
2059                         case NDTPA_APP_PROBES:
2060                                 NEIGH_VAR_SET(p, APP_PROBES,
2061                                               nla_get_u32(tbp[i]));
2062                                 break;
2063                         case NDTPA_UCAST_PROBES:
2064                                 NEIGH_VAR_SET(p, UCAST_PROBES,
2065                                               nla_get_u32(tbp[i]));
2066                                 break;
2067                         case NDTPA_MCAST_PROBES:
2068                                 NEIGH_VAR_SET(p, MCAST_PROBES,
2069                                               nla_get_u32(tbp[i]));
2070                                 break;
2071                         case NDTPA_BASE_REACHABLE_TIME:
2072                                 NEIGH_VAR_SET(p, BASE_REACHABLE_TIME,
2073                                               nla_get_msecs(tbp[i]));
2074                                 break;
2075                         case NDTPA_GC_STALETIME:
2076                                 NEIGH_VAR_SET(p, GC_STALETIME,
2077                                               nla_get_msecs(tbp[i]));
2078                                 break;
2079                         case NDTPA_DELAY_PROBE_TIME:
2080                                 NEIGH_VAR_SET(p, DELAY_PROBE_TIME,
2081                                               nla_get_msecs(tbp[i]));
2082                                 break;
2083                         case NDTPA_RETRANS_TIME:
2084                                 NEIGH_VAR_SET(p, RETRANS_TIME,
2085                                               nla_get_msecs(tbp[i]));
2086                                 break;
2087                         case NDTPA_ANYCAST_DELAY:
2088                                 NEIGH_VAR_SET(p, ANYCAST_DELAY, nla_get_msecs(tbp[i]));
2089                                 break;
2090                         case NDTPA_PROXY_DELAY:
2091                                 NEIGH_VAR_SET(p, PROXY_DELAY, nla_get_msecs(tbp[i]));
2092                                 break;
2093                         case NDTPA_LOCKTIME:
2094                                 NEIGH_VAR_SET(p, LOCKTIME, nla_get_msecs(tbp[i]));
2095                                 break;
2096                         }
2097                 }
2098         }
2099
2100         err = -ENOENT;
2101         if ((tb[NDTA_THRESH1] || tb[NDTA_THRESH2] ||
2102              tb[NDTA_THRESH3] || tb[NDTA_GC_INTERVAL]) &&
2103             !net_eq(net, &init_net))
2104                 goto errout_tbl_lock;
2105
2106         if (tb[NDTA_THRESH1])
2107                 tbl->gc_thresh1 = nla_get_u32(tb[NDTA_THRESH1]);
2108
2109         if (tb[NDTA_THRESH2])
2110                 tbl->gc_thresh2 = nla_get_u32(tb[NDTA_THRESH2]);
2111
2112         if (tb[NDTA_THRESH3])
2113                 tbl->gc_thresh3 = nla_get_u32(tb[NDTA_THRESH3]);
2114
2115         if (tb[NDTA_GC_INTERVAL])
2116                 tbl->gc_interval = nla_get_msecs(tb[NDTA_GC_INTERVAL]);
2117
2118         err = 0;
2119
2120 errout_tbl_lock:
2121         write_unlock_bh(&tbl->lock);
2122 errout_locked:
2123         read_unlock(&neigh_tbl_lock);
2124 errout:
2125         return err;
2126 }
2127
2128 static int neightbl_dump_info(struct sk_buff *skb, struct netlink_callback *cb)
2129 {
2130         struct net *net = sock_net(skb->sk);
2131         int family, tidx, nidx = 0;
2132         int tbl_skip = cb->args[0];
2133         int neigh_skip = cb->args[1];
2134         struct neigh_table *tbl;
2135
2136         family = ((struct rtgenmsg *) nlmsg_data(cb->nlh))->rtgen_family;
2137
2138         read_lock(&neigh_tbl_lock);
2139         for (tbl = neigh_tables, tidx = 0; tbl; tbl = tbl->next, tidx++) {
2140                 struct neigh_parms *p;
2141
2142                 if (tidx < tbl_skip || (family && tbl->family != family))
2143                         continue;
2144
2145                 if (neightbl_fill_info(skb, tbl, NETLINK_CB(cb->skb).portid,
2146                                        cb->nlh->nlmsg_seq, RTM_NEWNEIGHTBL,
2147                                        NLM_F_MULTI) <= 0)
2148                         break;
2149
2150                 for (nidx = 0, p = tbl->parms.next; p; p = p->next) {
2151                         if (!net_eq(neigh_parms_net(p), net))
2152                                 continue;
2153
2154                         if (nidx < neigh_skip)
2155                                 goto next;
2156
2157                         if (neightbl_fill_param_info(skb, tbl, p,
2158                                                      NETLINK_CB(cb->skb).portid,
2159                                                      cb->nlh->nlmsg_seq,
2160                                                      RTM_NEWNEIGHTBL,
2161                                                      NLM_F_MULTI) <= 0)
2162                                 goto out;
2163                 next:
2164                         nidx++;
2165                 }
2166
2167                 neigh_skip = 0;
2168         }
2169 out:
2170         read_unlock(&neigh_tbl_lock);
2171         cb->args[0] = tidx;
2172         cb->args[1] = nidx;
2173
2174         return skb->len;
2175 }
2176
2177 static int neigh_fill_info(struct sk_buff *skb, struct neighbour *neigh,
2178                            u32 pid, u32 seq, int type, unsigned int flags)
2179 {
2180         unsigned long now = jiffies;
2181         struct nda_cacheinfo ci;
2182         struct nlmsghdr *nlh;
2183         struct ndmsg *ndm;
2184
2185         nlh = nlmsg_put(skb, pid, seq, type, sizeof(*ndm), flags);
2186         if (nlh == NULL)
2187                 return -EMSGSIZE;
2188
2189         ndm = nlmsg_data(nlh);
2190         ndm->ndm_family  = neigh->ops->family;
2191         ndm->ndm_pad1    = 0;
2192         ndm->ndm_pad2    = 0;
2193         ndm->ndm_flags   = neigh->flags;
2194         ndm->ndm_type    = neigh->type;
2195         ndm->ndm_ifindex = neigh->dev->ifindex;
2196
2197         if (nla_put(skb, NDA_DST, neigh->tbl->key_len, neigh->primary_key))
2198                 goto nla_put_failure;
2199
2200         read_lock_bh(&neigh->lock);
2201         ndm->ndm_state   = neigh->nud_state;
2202         if (neigh->nud_state & NUD_VALID) {
2203                 char haddr[MAX_ADDR_LEN];
2204
2205                 neigh_ha_snapshot(haddr, neigh, neigh->dev);
2206                 if (nla_put(skb, NDA_LLADDR, neigh->dev->addr_len, haddr) < 0) {
2207                         read_unlock_bh(&neigh->lock);
2208                         goto nla_put_failure;
2209                 }
2210         }
2211
2212         ci.ndm_used      = jiffies_to_clock_t(now - neigh->used);
2213         ci.ndm_confirmed = jiffies_to_clock_t(now - neigh->confirmed);
2214         ci.ndm_updated   = jiffies_to_clock_t(now - neigh->updated);
2215         ci.ndm_refcnt    = atomic_read(&neigh->refcnt) - 1;
2216         read_unlock_bh(&neigh->lock);
2217
2218         if (nla_put_u32(skb, NDA_PROBES, atomic_read(&neigh->probes)) ||
2219             nla_put(skb, NDA_CACHEINFO, sizeof(ci), &ci))
2220                 goto nla_put_failure;
2221
2222         return nlmsg_end(skb, nlh);
2223
2224 nla_put_failure:
2225         nlmsg_cancel(skb, nlh);
2226         return -EMSGSIZE;
2227 }
2228
2229 static int pneigh_fill_info(struct sk_buff *skb, struct pneigh_entry *pn,
2230                             u32 pid, u32 seq, int type, unsigned int flags,
2231                             struct neigh_table *tbl)
2232 {
2233         struct nlmsghdr *nlh;
2234         struct ndmsg *ndm;
2235
2236         nlh = nlmsg_put(skb, pid, seq, type, sizeof(*ndm), flags);
2237         if (nlh == NULL)
2238                 return -EMSGSIZE;
2239
2240         ndm = nlmsg_data(nlh);
2241         ndm->ndm_family  = tbl->family;
2242         ndm->ndm_pad1    = 0;
2243         ndm->ndm_pad2    = 0;
2244         ndm->ndm_flags   = pn->flags | NTF_PROXY;
2245         ndm->ndm_type    = NDA_DST;
2246         ndm->ndm_ifindex = pn->dev->ifindex;
2247         ndm->ndm_state   = NUD_NONE;
2248
2249         if (nla_put(skb, NDA_DST, tbl->key_len, pn->key))
2250                 goto nla_put_failure;
2251
2252         return nlmsg_end(skb, nlh);
2253
2254 nla_put_failure:
2255         nlmsg_cancel(skb, nlh);
2256         return -EMSGSIZE;
2257 }
2258
2259 static void neigh_update_notify(struct neighbour *neigh)
2260 {
2261         call_netevent_notifiers(NETEVENT_NEIGH_UPDATE, neigh);
2262         __neigh_notify(neigh, RTM_NEWNEIGH, 0);
2263 }
2264
2265 static int neigh_dump_table(struct neigh_table *tbl, struct sk_buff *skb,
2266                             struct netlink_callback *cb)
2267 {
2268         struct net *net = sock_net(skb->sk);
2269         struct neighbour *n;
2270         int rc, h, s_h = cb->args[1];
2271         int idx, s_idx = idx = cb->args[2];
2272         struct neigh_hash_table *nht;
2273
2274         rcu_read_lock_bh();
2275         nht = rcu_dereference_bh(tbl->nht);
2276
2277         for (h = s_h; h < (1 << nht->hash_shift); h++) {
2278                 if (h > s_h)
2279                         s_idx = 0;
2280                 for (n = rcu_dereference_bh(nht->hash_buckets[h]), idx = 0;
2281                      n != NULL;
2282                      n = rcu_dereference_bh(n->next)) {
2283                         if (!net_eq(dev_net(n->dev), net))
2284                                 continue;
2285                         if (idx < s_idx)
2286                                 goto next;
2287                         if (neigh_fill_info(skb, n, NETLINK_CB(cb->skb).portid,
2288                                             cb->nlh->nlmsg_seq,
2289                                             RTM_NEWNEIGH,
2290                                             NLM_F_MULTI) <= 0) {
2291                                 rc = -1;
2292                                 goto out;
2293                         }
2294 next:
2295                         idx++;
2296                 }
2297         }
2298         rc = skb->len;
2299 out:
2300         rcu_read_unlock_bh();
2301         cb->args[1] = h;
2302         cb->args[2] = idx;
2303         return rc;
2304 }
2305
2306 static int pneigh_dump_table(struct neigh_table *tbl, struct sk_buff *skb,
2307                              struct netlink_callback *cb)
2308 {
2309         struct pneigh_entry *n;
2310         struct net *net = sock_net(skb->sk);
2311         int rc, h, s_h = cb->args[3];
2312         int idx, s_idx = idx = cb->args[4];
2313
2314         read_lock_bh(&tbl->lock);
2315
2316         for (h = s_h; h <= PNEIGH_HASHMASK; h++) {
2317                 if (h > s_h)
2318                         s_idx = 0;
2319                 for (n = tbl->phash_buckets[h], idx = 0; n; n = n->next) {
2320                         if (dev_net(n->dev) != net)
2321                                 continue;
2322                         if (idx < s_idx)
2323                                 goto next;
2324                         if (pneigh_fill_info(skb, n, NETLINK_CB(cb->skb).portid,
2325                                             cb->nlh->nlmsg_seq,
2326                                             RTM_NEWNEIGH,
2327                                             NLM_F_MULTI, tbl) <= 0) {
2328                                 read_unlock_bh(&tbl->lock);
2329                                 rc = -1;
2330                                 goto out;
2331                         }
2332                 next:
2333                         idx++;
2334                 }
2335         }
2336
2337         read_unlock_bh(&tbl->lock);
2338         rc = skb->len;
2339 out:
2340         cb->args[3] = h;
2341         cb->args[4] = idx;
2342         return rc;
2343
2344 }
2345
2346 static int neigh_dump_info(struct sk_buff *skb, struct netlink_callback *cb)
2347 {
2348         struct neigh_table *tbl;
2349         int t, family, s_t;
2350         int proxy = 0;
2351         int err;
2352
2353         read_lock(&neigh_tbl_lock);
2354         family = ((struct rtgenmsg *) nlmsg_data(cb->nlh))->rtgen_family;
2355
2356         /* check for full ndmsg structure presence, family member is
2357          * the same for both structures
2358          */
2359         if (nlmsg_len(cb->nlh) >= sizeof(struct ndmsg) &&
2360             ((struct ndmsg *) nlmsg_data(cb->nlh))->ndm_flags == NTF_PROXY)
2361                 proxy = 1;
2362
2363         s_t = cb->args[0];
2364
2365         for (tbl = neigh_tables, t = 0; tbl;
2366              tbl = tbl->next, t++) {
2367                 if (t < s_t || (family && tbl->family != family))
2368                         continue;
2369                 if (t > s_t)
2370                         memset(&cb->args[1], 0, sizeof(cb->args) -
2371                                                 sizeof(cb->args[0]));
2372                 if (proxy)
2373                         err = pneigh_dump_table(tbl, skb, cb);
2374                 else
2375                         err = neigh_dump_table(tbl, skb, cb);
2376                 if (err < 0)
2377                         break;
2378         }
2379         read_unlock(&neigh_tbl_lock);
2380
2381         cb->args[0] = t;
2382         return skb->len;
2383 }
2384
2385 void neigh_for_each(struct neigh_table *tbl, void (*cb)(struct neighbour *, void *), void *cookie)
2386 {
2387         int chain;
2388         struct neigh_hash_table *nht;
2389
2390         rcu_read_lock_bh();
2391         nht = rcu_dereference_bh(tbl->nht);
2392
2393         read_lock(&tbl->lock); /* avoid resizes */
2394         for (chain = 0; chain < (1 << nht->hash_shift); chain++) {
2395                 struct neighbour *n;
2396
2397                 for (n = rcu_dereference_bh(nht->hash_buckets[chain]);
2398                      n != NULL;
2399                      n = rcu_dereference_bh(n->next))
2400                         cb(n, cookie);
2401         }
2402         read_unlock(&tbl->lock);
2403         rcu_read_unlock_bh();
2404 }
2405 EXPORT_SYMBOL(neigh_for_each);
2406
2407 /* The tbl->lock must be held as a writer and BH disabled. */
2408 void __neigh_for_each_release(struct neigh_table *tbl,
2409                               int (*cb)(struct neighbour *))
2410 {
2411         int chain;
2412         struct neigh_hash_table *nht;
2413
2414         nht = rcu_dereference_protected(tbl->nht,
2415                                         lockdep_is_held(&tbl->lock));
2416         for (chain = 0; chain < (1 << nht->hash_shift); chain++) {
2417                 struct neighbour *n;
2418                 struct neighbour __rcu **np;
2419
2420                 np = &nht->hash_buckets[chain];
2421                 while ((n = rcu_dereference_protected(*np,
2422                                         lockdep_is_held(&tbl->lock))) != NULL) {
2423                         int release;
2424
2425                         write_lock(&n->lock);
2426                         release = cb(n);
2427                         if (release) {
2428                                 rcu_assign_pointer(*np,
2429                                         rcu_dereference_protected(n->next,
2430                                                 lockdep_is_held(&tbl->lock)));
2431                                 n->dead = 1;
2432                         } else
2433                                 np = &n->next;
2434                         write_unlock(&n->lock);
2435                         if (release)
2436                                 neigh_cleanup_and_release(n);
2437                 }
2438         }
2439 }
2440 EXPORT_SYMBOL(__neigh_for_each_release);
2441
2442 #ifdef CONFIG_PROC_FS
2443
2444 static struct neighbour *neigh_get_first(struct seq_file *seq)
2445 {
2446         struct neigh_seq_state *state = seq->private;
2447         struct net *net = seq_file_net(seq);
2448         struct neigh_hash_table *nht = state->nht;
2449         struct neighbour *n = NULL;
2450         int bucket = state->bucket;
2451
2452         state->flags &= ~NEIGH_SEQ_IS_PNEIGH;
2453         for (bucket = 0; bucket < (1 << nht->hash_shift); bucket++) {
2454                 n = rcu_dereference_bh(nht->hash_buckets[bucket]);
2455
2456                 while (n) {
2457                         if (!net_eq(dev_net(n->dev), net))
2458                                 goto next;
2459                         if (state->neigh_sub_iter) {
2460                                 loff_t fakep = 0;
2461                                 void *v;
2462
2463                                 v = state->neigh_sub_iter(state, n, &fakep);
2464                                 if (!v)
2465                                         goto next;
2466                         }
2467                         if (!(state->flags & NEIGH_SEQ_SKIP_NOARP))
2468                                 break;
2469                         if (n->nud_state & ~NUD_NOARP)
2470                                 break;
2471 next:
2472                         n = rcu_dereference_bh(n->next);
2473                 }
2474
2475                 if (n)
2476                         break;
2477         }
2478         state->bucket = bucket;
2479
2480         return n;
2481 }
2482
2483 static struct neighbour *neigh_get_next(struct seq_file *seq,
2484                                         struct neighbour *n,
2485                                         loff_t *pos)
2486 {
2487         struct neigh_seq_state *state = seq->private;
2488         struct net *net = seq_file_net(seq);
2489         struct neigh_hash_table *nht = state->nht;
2490
2491         if (state->neigh_sub_iter) {
2492                 void *v = state->neigh_sub_iter(state, n, pos);
2493                 if (v)
2494                         return n;
2495         }
2496         n = rcu_dereference_bh(n->next);
2497
2498         while (1) {
2499                 while (n) {
2500                         if (!net_eq(dev_net(n->dev), net))
2501                                 goto next;
2502                         if (state->neigh_sub_iter) {
2503                                 void *v = state->neigh_sub_iter(state, n, pos);
2504                                 if (v)
2505                                         return n;
2506                                 goto next;
2507                         }
2508                         if (!(state->flags & NEIGH_SEQ_SKIP_NOARP))
2509                                 break;
2510
2511                         if (n->nud_state & ~NUD_NOARP)
2512                                 break;
2513 next:
2514                         n = rcu_dereference_bh(n->next);
2515                 }
2516
2517                 if (n)
2518                         break;
2519
2520                 if (++state->bucket >= (1 << nht->hash_shift))
2521                         break;
2522
2523                 n = rcu_dereference_bh(nht->hash_buckets[state->bucket]);
2524         }
2525
2526         if (n && pos)
2527                 --(*pos);
2528         return n;
2529 }
2530
2531 static struct neighbour *neigh_get_idx(struct seq_file *seq, loff_t *pos)
2532 {
2533         struct neighbour *n = neigh_get_first(seq);
2534
2535         if (n) {
2536                 --(*pos);
2537                 while (*pos) {
2538                         n = neigh_get_next(seq, n, pos);
2539                         if (!n)
2540                                 break;
2541                 }
2542         }
2543         return *pos ? NULL : n;
2544 }
2545
2546 static struct pneigh_entry *pneigh_get_first(struct seq_file *seq)
2547 {
2548         struct neigh_seq_state *state = seq->private;
2549         struct net *net = seq_file_net(seq);
2550         struct neigh_table *tbl = state->tbl;
2551         struct pneigh_entry *pn = NULL;
2552         int bucket = state->bucket;
2553
2554         state->flags |= NEIGH_SEQ_IS_PNEIGH;
2555         for (bucket = 0; bucket <= PNEIGH_HASHMASK; bucket++) {
2556                 pn = tbl->phash_buckets[bucket];
2557                 while (pn && !net_eq(pneigh_net(pn), net))
2558                         pn = pn->next;
2559                 if (pn)
2560                         break;
2561         }
2562         state->bucket = bucket;
2563
2564         return pn;
2565 }
2566
2567 static struct pneigh_entry *pneigh_get_next(struct seq_file *seq,
2568                                             struct pneigh_entry *pn,
2569                                             loff_t *pos)
2570 {
2571         struct neigh_seq_state *state = seq->private;
2572         struct net *net = seq_file_net(seq);
2573         struct neigh_table *tbl = state->tbl;
2574
2575         do {
2576                 pn = pn->next;
2577         } while (pn && !net_eq(pneigh_net(pn), net));
2578
2579         while (!pn) {
2580                 if (++state->bucket > PNEIGH_HASHMASK)
2581                         break;
2582                 pn = tbl->phash_buckets[state->bucket];
2583                 while (pn && !net_eq(pneigh_net(pn), net))
2584                         pn = pn->next;
2585                 if (pn)
2586                         break;
2587         }
2588
2589         if (pn && pos)
2590                 --(*pos);
2591
2592         return pn;
2593 }
2594
2595 static struct pneigh_entry *pneigh_get_idx(struct seq_file *seq, loff_t *pos)
2596 {
2597         struct pneigh_entry *pn = pneigh_get_first(seq);
2598
2599         if (pn) {
2600                 --(*pos);
2601                 while (*pos) {
2602                         pn = pneigh_get_next(seq, pn, pos);
2603                         if (!pn)
2604                                 break;
2605                 }
2606         }
2607         return *pos ? NULL : pn;
2608 }
2609
2610 static void *neigh_get_idx_any(struct seq_file *seq, loff_t *pos)
2611 {
2612         struct neigh_seq_state *state = seq->private;
2613         void *rc;
2614         loff_t idxpos = *pos;
2615
2616         rc = neigh_get_idx(seq, &idxpos);
2617         if (!rc && !(state->flags & NEIGH_SEQ_NEIGH_ONLY))
2618                 rc = pneigh_get_idx(seq, &idxpos);
2619
2620         return rc;
2621 }
2622
2623 void *neigh_seq_start(struct seq_file *seq, loff_t *pos, struct neigh_table *tbl, unsigned int neigh_seq_flags)
2624         __acquires(rcu_bh)
2625 {
2626         struct neigh_seq_state *state = seq->private;
2627
2628         state->tbl = tbl;
2629         state->bucket = 0;
2630         state->flags = (neigh_seq_flags & ~NEIGH_SEQ_IS_PNEIGH);
2631
2632         rcu_read_lock_bh();
2633         state->nht = rcu_dereference_bh(tbl->nht);
2634
2635         return *pos ? neigh_get_idx_any(seq, pos) : SEQ_START_TOKEN;
2636 }
2637 EXPORT_SYMBOL(neigh_seq_start);
2638
2639 void *neigh_seq_next(struct seq_file *seq, void *v, loff_t *pos)
2640 {
2641         struct neigh_seq_state *state;
2642         void *rc;
2643
2644         if (v == SEQ_START_TOKEN) {
2645                 rc = neigh_get_first(seq);
2646                 goto out;
2647         }
2648
2649         state = seq->private;
2650         if (!(state->flags & NEIGH_SEQ_IS_PNEIGH)) {
2651                 rc = neigh_get_next(seq, v, NULL);
2652                 if (rc)
2653                         goto out;
2654                 if (!(state->flags & NEIGH_SEQ_NEIGH_ONLY))
2655                         rc = pneigh_get_first(seq);
2656         } else {
2657                 BUG_ON(state->flags & NEIGH_SEQ_NEIGH_ONLY);
2658                 rc = pneigh_get_next(seq, v, NULL);
2659         }
2660 out:
2661         ++(*pos);
2662         return rc;
2663 }
2664 EXPORT_SYMBOL(neigh_seq_next);
2665
2666 void neigh_seq_stop(struct seq_file *seq, void *v)
2667         __releases(rcu_bh)
2668 {
2669         rcu_read_unlock_bh();
2670 }
2671 EXPORT_SYMBOL(neigh_seq_stop);
2672
2673 /* statistics via seq_file */
2674
2675 static void *neigh_stat_seq_start(struct seq_file *seq, loff_t *pos)
2676 {
2677         struct neigh_table *tbl = seq->private;
2678         int cpu;
2679
2680         if (*pos == 0)
2681                 return SEQ_START_TOKEN;
2682
2683         for (cpu = *pos-1; cpu < nr_cpu_ids; ++cpu) {
2684                 if (!cpu_possible(cpu))
2685                         continue;
2686                 *pos = cpu+1;
2687                 return per_cpu_ptr(tbl->stats, cpu);
2688         }
2689         return NULL;
2690 }
2691
2692 static void *neigh_stat_seq_next(struct seq_file *seq, void *v, loff_t *pos)
2693 {
2694         struct neigh_table *tbl = seq->private;
2695         int cpu;
2696
2697         for (cpu = *pos; cpu < nr_cpu_ids; ++cpu) {
2698                 if (!cpu_possible(cpu))
2699                         continue;
2700                 *pos = cpu+1;
2701                 return per_cpu_ptr(tbl->stats, cpu);
2702         }
2703         return NULL;
2704 }
2705
2706 static void neigh_stat_seq_stop(struct seq_file *seq, void *v)
2707 {
2708
2709 }
2710
2711 static int neigh_stat_seq_show(struct seq_file *seq, void *v)
2712 {
2713         struct neigh_table *tbl = seq->private;
2714         struct neigh_statistics *st = v;
2715
2716         if (v == SEQ_START_TOKEN) {
2717                 seq_printf(seq, "entries  allocs destroys hash_grows  lookups hits  res_failed  rcv_probes_mcast rcv_probes_ucast  periodic_gc_runs forced_gc_runs unresolved_discards\n");
2718                 return 0;
2719         }
2720
2721         seq_printf(seq, "%08x  %08lx %08lx %08lx  %08lx %08lx  %08lx  "
2722                         "%08lx %08lx  %08lx %08lx %08lx\n",
2723                    atomic_read(&tbl->entries),
2724
2725                    st->allocs,
2726                    st->destroys,
2727                    st->hash_grows,
2728
2729                    st->lookups,
2730                    st->hits,
2731
2732                    st->res_failed,
2733
2734                    st->rcv_probes_mcast,
2735                    st->rcv_probes_ucast,
2736
2737                    st->periodic_gc_runs,
2738                    st->forced_gc_runs,
2739                    st->unres_discards
2740                    );
2741
2742         return 0;
2743 }
2744
2745 static const struct seq_operations neigh_stat_seq_ops = {
2746         .start  = neigh_stat_seq_start,
2747         .next   = neigh_stat_seq_next,
2748         .stop   = neigh_stat_seq_stop,
2749         .show   = neigh_stat_seq_show,
2750 };
2751
2752 static int neigh_stat_seq_open(struct inode *inode, struct file *file)
2753 {
2754         int ret = seq_open(file, &neigh_stat_seq_ops);
2755
2756         if (!ret) {
2757                 struct seq_file *sf = file->private_data;
2758                 sf->private = PDE_DATA(inode);
2759         }
2760         return ret;
2761 };
2762
2763 static const struct file_operations neigh_stat_seq_fops = {
2764         .owner   = THIS_MODULE,
2765         .open    = neigh_stat_seq_open,
2766         .read    = seq_read,
2767         .llseek  = seq_lseek,
2768         .release = seq_release,
2769 };
2770
2771 #endif /* CONFIG_PROC_FS */
2772
2773 static inline size_t neigh_nlmsg_size(void)
2774 {
2775         return NLMSG_ALIGN(sizeof(struct ndmsg))
2776                + nla_total_size(MAX_ADDR_LEN) /* NDA_DST */
2777                + nla_total_size(MAX_ADDR_LEN) /* NDA_LLADDR */
2778                + nla_total_size(sizeof(struct nda_cacheinfo))
2779                + nla_total_size(4); /* NDA_PROBES */
2780 }
2781
2782 static void __neigh_notify(struct neighbour *n, int type, int flags)
2783 {
2784         struct net *net = dev_net(n->dev);
2785         struct sk_buff *skb;
2786         int err = -ENOBUFS;
2787
2788         skb = nlmsg_new(neigh_nlmsg_size(), GFP_ATOMIC);
2789         if (skb == NULL)
2790                 goto errout;
2791
2792         err = neigh_fill_info(skb, n, 0, 0, type, flags);
2793         if (err < 0) {
2794                 /* -EMSGSIZE implies BUG in neigh_nlmsg_size() */
2795                 WARN_ON(err == -EMSGSIZE);
2796                 kfree_skb(skb);
2797                 goto errout;
2798         }
2799         rtnl_notify(skb, net, 0, RTNLGRP_NEIGH, NULL, GFP_ATOMIC);
2800         return;
2801 errout:
2802         if (err < 0)
2803                 rtnl_set_sk_err(net, RTNLGRP_NEIGH, err);
2804 }
2805
2806 void neigh_app_ns(struct neighbour *n)
2807 {
2808         __neigh_notify(n, RTM_GETNEIGH, NLM_F_REQUEST);
2809 }
2810 EXPORT_SYMBOL(neigh_app_ns);
2811
2812 #ifdef CONFIG_SYSCTL
2813 static int zero;
2814 static int int_max = INT_MAX;
2815 static int unres_qlen_max = INT_MAX / SKB_TRUESIZE(ETH_FRAME_LEN);
2816
2817 static int proc_unres_qlen(struct ctl_table *ctl, int write,
2818                            void __user *buffer, size_t *lenp, loff_t *ppos)
2819 {
2820         int size, ret;
2821         struct ctl_table tmp = *ctl;
2822
2823         tmp.extra1 = &zero;
2824         tmp.extra2 = &unres_qlen_max;
2825         tmp.data = &size;
2826
2827         size = *(int *)ctl->data / SKB_TRUESIZE(ETH_FRAME_LEN);
2828         ret = proc_dointvec_minmax(&tmp, write, buffer, lenp, ppos);
2829
2830         if (write && !ret)
2831                 *(int *)ctl->data = size * SKB_TRUESIZE(ETH_FRAME_LEN);
2832         return ret;
2833 }
2834
2835 static struct neigh_parms *neigh_get_dev_parms_rcu(struct net_device *dev,
2836                                                    int family)
2837 {
2838         switch (family) {
2839         case AF_INET:
2840                 return __in_dev_arp_parms_get_rcu(dev);
2841         case AF_INET6:
2842                 return __in6_dev_nd_parms_get_rcu(dev);
2843         }
2844         return NULL;
2845 }
2846
2847 static void neigh_copy_dflt_parms(struct net *net, struct neigh_parms *p,
2848                                   int index)
2849 {
2850         struct net_device *dev;
2851         int family = neigh_parms_family(p);
2852
2853         rcu_read_lock();
2854         for_each_netdev_rcu(net, dev) {
2855                 struct neigh_parms *dst_p =
2856                                 neigh_get_dev_parms_rcu(dev, family);
2857
2858                 if (dst_p && !test_bit(index, dst_p->data_state))
2859                         dst_p->data[index] = p->data[index];
2860         }
2861         rcu_read_unlock();
2862 }
2863
2864 static void neigh_proc_update(struct ctl_table *ctl, int write)
2865 {
2866         struct net_device *dev = ctl->extra1;
2867         struct neigh_parms *p = ctl->extra2;
2868         struct net *net = neigh_parms_net(p);
2869         int index = (int *) ctl->data - p->data;
2870
2871         if (!write)
2872                 return;
2873
2874         set_bit(index, p->data_state);
2875         if (!dev) /* NULL dev means this is default value */
2876                 neigh_copy_dflt_parms(net, p, index);
2877 }
2878
2879 static int neigh_proc_dointvec_zero_intmax(struct ctl_table *ctl, int write,
2880                                            void __user *buffer,
2881                                            size_t *lenp, loff_t *ppos)
2882 {
2883         struct ctl_table tmp = *ctl;
2884         int ret;
2885
2886         tmp.extra1 = &zero;
2887         tmp.extra2 = &int_max;
2888
2889         ret = proc_dointvec_minmax(&tmp, write, buffer, lenp, ppos);
2890         neigh_proc_update(ctl, write);
2891         return ret;
2892 }
2893
2894 int neigh_proc_dointvec(struct ctl_table *ctl, int write,
2895                         void __user *buffer, size_t *lenp, loff_t *ppos)
2896 {
2897         int ret = proc_dointvec(ctl, write, buffer, lenp, ppos);
2898
2899         neigh_proc_update(ctl, write);
2900         return ret;
2901 }
2902 EXPORT_SYMBOL(neigh_proc_dointvec);
2903
2904 int neigh_proc_dointvec_jiffies(struct ctl_table *ctl, int write,
2905                                 void __user *buffer,
2906                                 size_t *lenp, loff_t *ppos)
2907 {
2908         int ret = proc_dointvec_jiffies(ctl, write, buffer, lenp, ppos);
2909
2910         neigh_proc_update(ctl, write);
2911         return ret;
2912 }
2913 EXPORT_SYMBOL(neigh_proc_dointvec_jiffies);
2914
2915 static int neigh_proc_dointvec_userhz_jiffies(struct ctl_table *ctl, int write,
2916                                               void __user *buffer,
2917                                               size_t *lenp, loff_t *ppos)
2918 {
2919         int ret = proc_dointvec_userhz_jiffies(ctl, write, buffer, lenp, ppos);
2920
2921         neigh_proc_update(ctl, write);
2922         return ret;
2923 }
2924
2925 int neigh_proc_dointvec_ms_jiffies(struct ctl_table *ctl, int write,
2926                                    void __user *buffer,
2927                                    size_t *lenp, loff_t *ppos)
2928 {
2929         int ret = proc_dointvec_ms_jiffies(ctl, write, buffer, lenp, ppos);
2930
2931         neigh_proc_update(ctl, write);
2932         return ret;
2933 }
2934 EXPORT_SYMBOL(neigh_proc_dointvec_ms_jiffies);
2935
2936 static int neigh_proc_dointvec_unres_qlen(struct ctl_table *ctl, int write,
2937                                           void __user *buffer,
2938                                           size_t *lenp, loff_t *ppos)
2939 {
2940         int ret = proc_unres_qlen(ctl, write, buffer, lenp, ppos);
2941
2942         neigh_proc_update(ctl, write);
2943         return ret;
2944 }
2945
2946 #define NEIGH_PARMS_DATA_OFFSET(index)  \
2947         (&((struct neigh_parms *) 0)->data[index])
2948
2949 #define NEIGH_SYSCTL_ENTRY(attr, data_attr, name, mval, proc) \
2950         [NEIGH_VAR_ ## attr] = { \
2951                 .procname       = name, \
2952                 .data           = NEIGH_PARMS_DATA_OFFSET(NEIGH_VAR_ ## data_attr), \
2953                 .maxlen         = sizeof(int), \
2954                 .mode           = mval, \
2955                 .proc_handler   = proc, \
2956         }
2957
2958 #define NEIGH_SYSCTL_ZERO_INTMAX_ENTRY(attr, name) \
2959         NEIGH_SYSCTL_ENTRY(attr, attr, name, 0644, neigh_proc_dointvec_zero_intmax)
2960
2961 #define NEIGH_SYSCTL_JIFFIES_ENTRY(attr, name) \
2962         NEIGH_SYSCTL_ENTRY(attr, attr, name, 0644, neigh_proc_dointvec_jiffies)
2963
2964 #define NEIGH_SYSCTL_USERHZ_JIFFIES_ENTRY(attr, name) \
2965         NEIGH_SYSCTL_ENTRY(attr, attr, name, 0644, neigh_proc_dointvec_userhz_jiffies)
2966
2967 #define NEIGH_SYSCTL_MS_JIFFIES_ENTRY(attr, name) \
2968         NEIGH_SYSCTL_ENTRY(attr, attr, name, 0644, neigh_proc_dointvec_ms_jiffies)
2969
2970 #define NEIGH_SYSCTL_MS_JIFFIES_REUSED_ENTRY(attr, data_attr, name) \
2971         NEIGH_SYSCTL_ENTRY(attr, data_attr, name, 0644, neigh_proc_dointvec_ms_jiffies)
2972
2973 #define NEIGH_SYSCTL_UNRES_QLEN_REUSED_ENTRY(attr, data_attr, name) \
2974         NEIGH_SYSCTL_ENTRY(attr, data_attr, name, 0644, neigh_proc_dointvec_unres_qlen)
2975
2976 static struct neigh_sysctl_table {
2977         struct ctl_table_header *sysctl_header;
2978         struct ctl_table neigh_vars[NEIGH_VAR_MAX + 1];
2979 } neigh_sysctl_template __read_mostly = {
2980         .neigh_vars = {
2981                 NEIGH_SYSCTL_ZERO_INTMAX_ENTRY(MCAST_PROBES, "mcast_solicit"),
2982                 NEIGH_SYSCTL_ZERO_INTMAX_ENTRY(UCAST_PROBES, "ucast_solicit"),
2983                 NEIGH_SYSCTL_ZERO_INTMAX_ENTRY(APP_PROBES, "app_solicit"),
2984                 NEIGH_SYSCTL_USERHZ_JIFFIES_ENTRY(RETRANS_TIME, "retrans_time"),
2985                 NEIGH_SYSCTL_JIFFIES_ENTRY(BASE_REACHABLE_TIME, "base_reachable_time"),
2986                 NEIGH_SYSCTL_JIFFIES_ENTRY(DELAY_PROBE_TIME, "delay_first_probe_time"),
2987                 NEIGH_SYSCTL_JIFFIES_ENTRY(GC_STALETIME, "gc_stale_time"),
2988                 NEIGH_SYSCTL_ZERO_INTMAX_ENTRY(QUEUE_LEN_BYTES, "unres_qlen_bytes"),
2989                 NEIGH_SYSCTL_ZERO_INTMAX_ENTRY(PROXY_QLEN, "proxy_qlen"),
2990                 NEIGH_SYSCTL_USERHZ_JIFFIES_ENTRY(ANYCAST_DELAY, "anycast_delay"),
2991                 NEIGH_SYSCTL_USERHZ_JIFFIES_ENTRY(PROXY_DELAY, "proxy_delay"),
2992                 NEIGH_SYSCTL_USERHZ_JIFFIES_ENTRY(LOCKTIME, "locktime"),
2993                 NEIGH_SYSCTL_UNRES_QLEN_REUSED_ENTRY(QUEUE_LEN, QUEUE_LEN_BYTES, "unres_qlen"),
2994                 NEIGH_SYSCTL_MS_JIFFIES_REUSED_ENTRY(RETRANS_TIME_MS, RETRANS_TIME, "retrans_time_ms"),
2995                 NEIGH_SYSCTL_MS_JIFFIES_REUSED_ENTRY(BASE_REACHABLE_TIME_MS, BASE_REACHABLE_TIME, "base_reachable_time_ms"),
2996                 [NEIGH_VAR_GC_INTERVAL] = {
2997                         .procname       = "gc_interval",
2998                         .maxlen         = sizeof(int),
2999                         .mode           = 0644,
3000                         .proc_handler   = proc_dointvec_jiffies,
3001                 },
3002                 [NEIGH_VAR_GC_THRESH1] = {
3003                         .procname       = "gc_thresh1",
3004                         .maxlen         = sizeof(int),
3005                         .mode           = 0644,
3006                         .extra1         = &zero,
3007                         .extra2         = &int_max,
3008                         .proc_handler   = proc_dointvec_minmax,
3009                 },
3010                 [NEIGH_VAR_GC_THRESH2] = {
3011                         .procname       = "gc_thresh2",
3012                         .maxlen         = sizeof(int),
3013                         .mode           = 0644,
3014                         .extra1         = &zero,
3015                         .extra2         = &int_max,
3016                         .proc_handler   = proc_dointvec_minmax,
3017                 },
3018                 [NEIGH_VAR_GC_THRESH3] = {
3019                         .procname       = "gc_thresh3",
3020                         .maxlen         = sizeof(int),
3021                         .mode           = 0644,
3022                         .extra1         = &zero,
3023                         .extra2         = &int_max,
3024                         .proc_handler   = proc_dointvec_minmax,
3025                 },
3026                 {},
3027         },
3028 };
3029
3030 int neigh_sysctl_register(struct net_device *dev, struct neigh_parms *p,
3031                           proc_handler *handler)
3032 {
3033         int i;
3034         struct neigh_sysctl_table *t;
3035         const char *dev_name_source;
3036         char neigh_path[ sizeof("net//neigh/") + IFNAMSIZ + IFNAMSIZ ];
3037         char *p_name;
3038
3039         t = kmemdup(&neigh_sysctl_template, sizeof(*t), GFP_KERNEL);
3040         if (!t)
3041                 goto err;
3042
3043         for (i = 0; i < ARRAY_SIZE(t->neigh_vars); i++) {
3044                 t->neigh_vars[i].data += (long) p;
3045                 t->neigh_vars[i].extra1 = dev;
3046                 t->neigh_vars[i].extra2 = p;
3047         }
3048
3049         if (dev) {
3050                 dev_name_source = dev->name;
3051                 /* Terminate the table early */
3052                 memset(&t->neigh_vars[NEIGH_VAR_GC_INTERVAL], 0,
3053                        sizeof(t->neigh_vars[NEIGH_VAR_GC_INTERVAL]));
3054         } else {
3055                 dev_name_source = "default";
3056                 t->neigh_vars[NEIGH_VAR_GC_INTERVAL].data = (int *)(p + 1);
3057                 t->neigh_vars[NEIGH_VAR_GC_THRESH1].data = (int *)(p + 1) + 1;
3058                 t->neigh_vars[NEIGH_VAR_GC_THRESH2].data = (int *)(p + 1) + 2;
3059                 t->neigh_vars[NEIGH_VAR_GC_THRESH3].data = (int *)(p + 1) + 3;
3060         }
3061
3062         if (handler) {
3063                 /* RetransTime */
3064                 t->neigh_vars[NEIGH_VAR_RETRANS_TIME].proc_handler = handler;
3065                 /* ReachableTime */
3066                 t->neigh_vars[NEIGH_VAR_BASE_REACHABLE_TIME].proc_handler = handler;
3067                 /* RetransTime (in milliseconds)*/
3068                 t->neigh_vars[NEIGH_VAR_RETRANS_TIME_MS].proc_handler = handler;
3069                 /* ReachableTime (in milliseconds) */
3070                 t->neigh_vars[NEIGH_VAR_BASE_REACHABLE_TIME_MS].proc_handler = handler;
3071         }
3072
3073         /* Don't export sysctls to unprivileged users */
3074         if (neigh_parms_net(p)->user_ns != &init_user_ns)
3075                 t->neigh_vars[0].procname = NULL;
3076
3077         switch (neigh_parms_family(p)) {
3078         case AF_INET:
3079               p_name = "ipv4";
3080               break;
3081         case AF_INET6:
3082               p_name = "ipv6";
3083               break;
3084         default:
3085               BUG();
3086         }
3087
3088         snprintf(neigh_path, sizeof(neigh_path), "net/%s/neigh/%s",
3089                 p_name, dev_name_source);
3090         t->sysctl_header =
3091                 register_net_sysctl(neigh_parms_net(p), neigh_path, t->neigh_vars);
3092         if (!t->sysctl_header)
3093                 goto free;
3094
3095         p->sysctl_table = t;
3096         return 0;
3097
3098 free:
3099         kfree(t);
3100 err:
3101         return -ENOBUFS;
3102 }
3103 EXPORT_SYMBOL(neigh_sysctl_register);
3104
3105 void neigh_sysctl_unregister(struct neigh_parms *p)
3106 {
3107         if (p->sysctl_table) {
3108                 struct neigh_sysctl_table *t = p->sysctl_table;
3109                 p->sysctl_table = NULL;
3110                 unregister_net_sysctl_table(t->sysctl_header);
3111                 kfree(t);
3112         }
3113 }
3114 EXPORT_SYMBOL(neigh_sysctl_unregister);
3115
3116 #endif  /* CONFIG_SYSCTL */
3117
3118 static int __init neigh_init(void)
3119 {
3120         rtnl_register(PF_UNSPEC, RTM_NEWNEIGH, neigh_add, NULL, NULL);
3121         rtnl_register(PF_UNSPEC, RTM_DELNEIGH, neigh_delete, NULL, NULL);
3122         rtnl_register(PF_UNSPEC, RTM_GETNEIGH, NULL, neigh_dump_info, NULL);
3123
3124         rtnl_register(PF_UNSPEC, RTM_GETNEIGHTBL, NULL, neightbl_dump_info,
3125                       NULL);
3126         rtnl_register(PF_UNSPEC, RTM_SETNEIGHTBL, neightbl_set, NULL, NULL);
3127
3128         return 0;
3129 }
3130
3131 subsys_initcall(neigh_init);
3132