net/core/neighbour.c

   1 /*
   2  *      Generic address resolution entity
   3  *
   4  *      Authors:
   5  *      Pedro Roque             <roque@di.fc.ul.pt>
   6  *      Alexey Kuznetsov        <kuznet@ms2.inr.ac.ru>
   7  *
   8  *      This program is free software; you can redistribute it and/or
   9  *      modify it under the terms of the GNU General Public License
  10  *      as published by the Free Software Foundation; either version
  11  *      2 of the License, or (at your option) any later version.
  12  *
  13  *      Fixes:
  14  *      Vitaly E. Lavrov        releasing NULL neighbor in neigh_add.
  15  *      Harald Welte            Add neighbour cache statistics like rtstat
  16  */
  17
  18 #include <linux/slab.h>
  19 #include <linux/types.h>
  20 #include <linux/kernel.h>
  21 #include <linux/module.h>
  22 #include <linux/socket.h>
  23 #include <linux/netdevice.h>
  24 #include <linux/proc_fs.h>
  25 #ifdef CONFIG_SYSCTL
  26 #include <linux/sysctl.h>
  27 #endif
  28 #include <linux/times.h>
  29 #include <net/net_namespace.h>
  30 #include <net/neighbour.h>
  31 #include <net/dst.h>
  32 #include <net/sock.h>
  33 #include <net/netevent.h>
  34 #include <net/netlink.h>
  35 #include <linux/rtnetlink.h>
  36 #include <linux/random.h>
  37 #include <linux/string.h>
  38 #include <linux/log2.h>
  39
  40 #define NEIGH_DEBUG 1
  41
  42 #define NEIGH_PRINTK(x...) printk(x)
  43 #define NEIGH_NOPRINTK(x...) do { ; } while(0)
  44 #define NEIGH_PRINTK0 NEIGH_PRINTK
  45 #define NEIGH_PRINTK1 NEIGH_NOPRINTK
  46 #define NEIGH_PRINTK2 NEIGH_NOPRINTK
  47
  48 #if NEIGH_DEBUG >= 1
  49 #undef NEIGH_PRINTK1
  50 #define NEIGH_PRINTK1 NEIGH_PRINTK
  51 #endif
  52 #if NEIGH_DEBUG >= 2
  53 #undef NEIGH_PRINTK2
  54 #define NEIGH_PRINTK2 NEIGH_PRINTK
  55 #endif
  56
  57 #define PNEIGH_HASHMASK         0xF
  58
  59 static void neigh_timer_handler(unsigned long arg);
  60 static void __neigh_notify(struct neighbour *n, int type, int flags);
  61 static void neigh_update_notify(struct neighbour *neigh);
  62 static int pneigh_ifdown(struct neigh_table *tbl, struct net_device *dev);
  63
  64 static struct neigh_table *neigh_tables;
  65 #ifdef CONFIG_PROC_FS
  66 static const struct file_operations neigh_stat_seq_fops;
  67 #endif
  68
  69 /*
  70    Neighbour hash table buckets are protected with rwlock tbl->lock.
  71
  72    - All the scans/updates to hash buckets MUST be made under this lock.
  73    - NOTHING clever should be made under this lock: no callbacks
  74      to protocol backends, no attempts to send something to network.
  75      It will result in deadlocks, if backend/driver wants to use neighbour
  76      cache.
  77    - If the entry requires some non-trivial actions, increase
  78      its reference count and release table lock.
  79
  80    Neighbour entries are protected:
  81    - with reference count.
  82    - with rwlock neigh->lock
  83
  84    Reference count prevents destruction.
  85
  86    neigh->lock mainly serializes ll address data and its validity state.
  87    However, the same lock is used to protect another entry fields:
  88     - timer
  89     - resolution queue
  90
  91    Again, nothing clever shall be made under neigh->lock,
  92    the most complicated procedure, which we allow is dev->hard_header.
  93    It is supposed, that dev->hard_header is simplistic and does
  94    not make callbacks to neighbour tables.
  95
  96    The last lock is neigh_tbl_lock. It is pure SMP lock, protecting
  97    list of neighbour tables. This list is used only in process context,
  98  */
  99
 100 static DEFINE_RWLOCK(neigh_tbl_lock);
 101
 102 static int neigh_blackhole(struct sk_buff *skb)
 103 {
 104         kfree_skb(skb);
 105         return -ENETDOWN;
 106 }
 107
 108 static void neigh_cleanup_and_release(struct neighbour *neigh)
 109 {
 110         if (neigh->parms->neigh_cleanup)
 111                 neigh->parms->neigh_cleanup(neigh);
 112
 113         __neigh_notify(neigh, RTM_DELNEIGH, 0);
 114         neigh_release(neigh);
 115 }
 116
 117 /*
 118  * It is random distribution in the interval (1/2)*base...(3/2)*base.
 119  * It corresponds to default IPv6 settings and is not overridable,
 120  * because it is really reasonable choice.
 121  */
 122
 123 unsigned long neigh_rand_reach_time(unsigned long base)
 124 {
 125         return base ? (net_random() % base) + (base >> 1) : 0;
 126 }
 127 EXPORT_SYMBOL(neigh_rand_reach_time);
 128
 129
 130 static int neigh_forced_gc(struct neigh_table *tbl)
 131 {
 132         int shrunk = 0;
 133         int i;
 134         struct neigh_hash_table *nht;
 135
 136         NEIGH_CACHE_STAT_INC(tbl, forced_gc_runs);
 137
 138         write_lock_bh(&tbl->lock);
 139         nht = rcu_dereference_protected(tbl->nht,
 140                                         lockdep_is_held(&tbl->lock));
 141         for (i = 0; i <= nht->hash_mask; i++) {
 142                 struct neighbour *n;
 143                 struct neighbour __rcu **np;
 144
 145                 np = &nht->hash_buckets[i];
 146                 while ((n = rcu_dereference_protected(*np,
 147                                         lockdep_is_held(&tbl->lock))) != NULL) {
 148                         /* Neighbour record may be discarded if:
 149                          * - nobody refers to it.
 150                          * - it is not permanent
 151                          */
 152                         write_lock(&n->lock);
 153                         if (atomic_read(&n->refcnt) == 1 &&
 154                             !(n->nud_state & NUD_PERMANENT)) {
 155                                 rcu_assign_pointer(*np,
 156                                         rcu_dereference_protected(n->next,
 157                                                   lockdep_is_held(&tbl->lock)));
 158                                 n->dead = 1;
 159                                 shrunk  = 1;
 160                                 write_unlock(&n->lock);
 161                                 neigh_cleanup_and_release(n);
 162                                 continue;
 163                         }
 164                         write_unlock(&n->lock);
 165                         np = &n->next;
 166                 }
 167         }
 168
 169         tbl->last_flush = jiffies;
 170
 171         write_unlock_bh(&tbl->lock);
 172
 173         return shrunk;
 174 }
 175
 176 static void neigh_add_timer(struct neighbour *n, unsigned long when)
 177 {
 178         neigh_hold(n);
 179         if (unlikely(mod_timer(&n->timer, when))) {
 180                 printk("NEIGH: BUG, double timer add, state is %x\n",
 181                        n->nud_state);
 182                 dump_stack();
 183         }
 184 }
 185
 186 static int neigh_del_timer(struct neighbour *n)
 187 {
 188         if ((n->nud_state & NUD_IN_TIMER) &&
 189             del_timer(&n->timer)) {
 190                 neigh_release(n);
 191                 return 1;
 192         }
 193         return 0;
 194 }
 195
 196 static void pneigh_queue_purge(struct sk_buff_head *list)
 197 {
 198         struct sk_buff *skb;
 199
 200         while ((skb = skb_dequeue(list)) != NULL) {
 201                 dev_put(skb->dev);
 202                 kfree_skb(skb);
 203         }
 204 }
 205
 206 static void neigh_flush_dev(struct neigh_table *tbl, struct net_device *dev)
 207 {
 208         int i;
 209         struct neigh_hash_table *nht;
 210
 211         nht = rcu_dereference_protected(tbl->nht,
 212                                         lockdep_is_held(&tbl->lock));
 213
 214         for (i = 0; i <= nht->hash_mask; i++) {
 215                 struct neighbour *n;
 216                 struct neighbour __rcu **np = &nht->hash_buckets[i];
 217
 218                 while ((n = rcu_dereference_protected(*np,
 219                                         lockdep_is_held(&tbl->lock))) != NULL) {
 220                         if (dev && n->dev != dev) {
 221                                 np = &n->next;
 222                                 continue;
 223                         }
 224                         rcu_assign_pointer(*np,
 225                                    rcu_dereference_protected(n->next,
 226                                                 lockdep_is_held(&tbl->lock)));
 227                         write_lock(&n->lock);
 228                         neigh_del_timer(n);
 229                         n->dead = 1;
 230
 231                         if (atomic_read(&n->refcnt) != 1) {
 232                                 /* The most unpleasant situation.
 233                                    We must destroy neighbour entry,
 234                                    but someone still uses it.
 235
 236                                    The destroy will be delayed until
 237                                    the last user releases us, but
 238                                    we must kill timers etc. and move
 239                                    it to safe state.
 240                                  */
 241                                 skb_queue_purge(&n->arp_queue);
 242                                 n->output = neigh_blackhole;
 243                                 if (n->nud_state & NUD_VALID)
 244                                         n->nud_state = NUD_NOARP;
 245                                 else
 246                                         n->nud_state = NUD_NONE;
 247                                 NEIGH_PRINTK2("neigh %p is stray.\n", n);
 248                         }
 249                         write_unlock(&n->lock);
 250                         neigh_cleanup_and_release(n);
 251                 }
 252         }
 253 }
 254
 255 void neigh_changeaddr(struct neigh_table *tbl, struct net_device *dev)
 256 {
 257         write_lock_bh(&tbl->lock);
 258         neigh_flush_dev(tbl, dev);
 259         write_unlock_bh(&tbl->lock);
 260 }
 261 EXPORT_SYMBOL(neigh_changeaddr);
 262
 263 int neigh_ifdown(struct neigh_table *tbl, struct net_device *dev)
 264 {
 265         write_lock_bh(&tbl->lock);
 266         neigh_flush_dev(tbl, dev);
 267         pneigh_ifdown(tbl, dev);
 268         write_unlock_bh(&tbl->lock);
 269
 270         del_timer_sync(&tbl->proxy_timer);
 271         pneigh_queue_purge(&tbl->proxy_queue);
 272         return 0;
 273 }
 274 EXPORT_SYMBOL(neigh_ifdown);
 275
 276 static struct neighbour *neigh_alloc(struct neigh_table *tbl)
 277 {
 278         struct neighbour *n = NULL;
 279         unsigned long now = jiffies;
 280         int entries;
 281
 282         entries = atomic_inc_return(&tbl->entries) - 1;
 283         if (entries >= tbl->gc_thresh3 ||
 284             (entries >= tbl->gc_thresh2 &&
 285              time_after(now, tbl->last_flush + 5 * HZ))) {
 286                 if (!neigh_forced_gc(tbl) &&
 287                     entries >= tbl->gc_thresh3)
 288                         goto out_entries;
 289         }
 290
 291         n = kmem_cache_zalloc(tbl->kmem_cachep, GFP_ATOMIC);
 292         if (!n)
 293                 goto out_entries;
 294
 295         skb_queue_head_init(&n->arp_queue);
 296         rwlock_init(&n->lock);
 297         n->updated        = n->used = now;
 298         n->nud_state      = NUD_NONE;
 299         n->output         = neigh_blackhole;
 300         n->parms          = neigh_parms_clone(&tbl->parms);
 301         setup_timer(&n->timer, neigh_timer_handler, (unsigned long)n);
 302
 303         NEIGH_CACHE_STAT_INC(tbl, allocs);
 304         n->tbl            = tbl;
 305         atomic_set(&n->refcnt, 1);
 306         n->dead           = 1;
 307 out:
 308         return n;
 309
 310 out_entries:
 311         atomic_dec(&tbl->entries);
 312         goto out;
 313 }
 314
 315 static struct neigh_hash_table *neigh_hash_alloc(unsigned int entries)
 316 {
 317         size_t size = entries * sizeof(struct neighbour *);
 318         struct neigh_hash_table *ret;
 319         struct neighbour **buckets;
 320
 321         ret = kmalloc(sizeof(*ret), GFP_ATOMIC);
 322         if (!ret)
 323                 return NULL;
 324         if (size <= PAGE_SIZE)
 325                 buckets = kzalloc(size, GFP_ATOMIC);
 326         else
 327                 buckets = (struct neighbour **)
 328                           __get_free_pages(GFP_ATOMIC | __GFP_ZERO,
 329                                            get_order(size));
 330         if (!buckets) {
 331                 kfree(ret);
 332                 return NULL;
 333         }
 334         rcu_assign_pointer(ret->hash_buckets, buckets);
 335         ret->hash_mask = entries - 1;
 336         get_random_bytes(&ret->hash_rnd, sizeof(ret->hash_rnd));
 337         return ret;
 338 }
 339
 340 static void neigh_hash_free_rcu(struct rcu_head *head)
 341 {
 342         struct neigh_hash_table *nht = container_of(head,
 343                                                     struct neigh_hash_table,
 344                                                     rcu);
 345         size_t size = (nht->hash_mask + 1) * sizeof(struct neighbour *);
 346         struct neighbour **buckets = nht->hash_buckets;
 347
 348         if (size <= PAGE_SIZE)
 349                 kfree(buckets);
 350         else
 351                 free_pages((unsigned long)buckets, get_order(size));
 352         kfree(nht);
 353 }
 354
 355 static struct neigh_hash_table *neigh_hash_grow(struct neigh_table *tbl,
 356                                                 unsigned long new_entries)
 357 {
 358         unsigned int i, hash;
 359         struct neigh_hash_table *new_nht, *old_nht;
 360
 361         NEIGH_CACHE_STAT_INC(tbl, hash_grows);
 362
 363         BUG_ON(!is_power_of_2(new_entries));
 364         old_nht = rcu_dereference_protected(tbl->nht,
 365                                             lockdep_is_held(&tbl->lock));
 366         new_nht = neigh_hash_alloc(new_entries);
 367         if (!new_nht)
 368                 return old_nht;
 369
 370         for (i = 0; i <= old_nht->hash_mask; i++) {
 371                 struct neighbour *n, *next;
 372
 373                 for (n = rcu_dereference_protected(old_nht->hash_buckets[i],
 374                                                    lockdep_is_held(&tbl->lock));
 375                      n != NULL;
 376                      n = next) {
 377                         hash = tbl->hash(n->primary_key, n->dev,
 378                                          new_nht->hash_rnd);
 379
 380                         hash &= new_nht->hash_mask;
 381                         next = rcu_dereference_protected(n->next,
 382                                                 lockdep_is_held(&tbl->lock));
 383
 384                         rcu_assign_pointer(n->next,
 385                                            rcu_dereference_protected(
 386                                                 new_nht->hash_buckets[hash],
 387                                                 lockdep_is_held(&tbl->lock)));
 388                         rcu_assign_pointer(new_nht->hash_buckets[hash], n);
 389                 }
 390         }
 391
 392         rcu_assign_pointer(tbl->nht, new_nht);
 393         call_rcu(&old_nht->rcu, neigh_hash_free_rcu);
 394         return new_nht;
 395 }
 396
 397 struct neighbour *neigh_lookup(struct neigh_table *tbl, const void *pkey,
 398                                struct net_device *dev)
 399 {
 400         struct neighbour *n;
 401         int key_len = tbl->key_len;
 402         u32 hash_val;
 403         struct neigh_hash_table *nht;
 404
 405         NEIGH_CACHE_STAT_INC(tbl, lookups);
 406
 407         rcu_read_lock_bh();
 408         nht = rcu_dereference_bh(tbl->nht);
 409         hash_val = tbl->hash(pkey, dev, nht->hash_rnd) & nht->hash_mask;
 410
 411         for (n = rcu_dereference_bh(nht->hash_buckets[hash_val]);
 412              n != NULL;
 413              n = rcu_dereference_bh(n->next)) {
 414                 if (dev == n->dev && !memcmp(n->primary_key, pkey, key_len)) {
 415                         if (!atomic_inc_not_zero(&n->refcnt))
 416                                 n = NULL;
 417                         NEIGH_CACHE_STAT_INC(tbl, hits);
 418                         break;
 419                 }
 420         }
 421
 422         rcu_read_unlock_bh();
 423         return n;
 424 }
 425 EXPORT_SYMBOL(neigh_lookup);
 426
 427 struct neighbour *neigh_lookup_nodev(struct neigh_table *tbl, struct net *net,
 428                                      const void *pkey)
 429 {
 430         struct neighbour *n;
 431         int key_len = tbl->key_len;
 432         u32 hash_val;
 433         struct neigh_hash_table *nht;
 434
 435         NEIGH_CACHE_STAT_INC(tbl, lookups);
 436
 437         rcu_read_lock_bh();
 438         nht = rcu_dereference_bh(tbl->nht);
 439         hash_val = tbl->hash(pkey, NULL, nht->hash_rnd) & nht->hash_mask;
 440
 441         for (n = rcu_dereference_bh(nht->hash_buckets[hash_val]);
 442              n != NULL;
 443              n = rcu_dereference_bh(n->next)) {
 444                 if (!memcmp(n->primary_key, pkey, key_len) &&
 445                     net_eq(dev_net(n->dev), net)) {
 446                         if (!atomic_inc_not_zero(&n->refcnt))
 447                                 n = NULL;
 448                         NEIGH_CACHE_STAT_INC(tbl, hits);
 449                         break;
 450                 }
 451         }
 452
 453         rcu_read_unlock_bh();
 454         return n;
 455 }
 456 EXPORT_SYMBOL(neigh_lookup_nodev);
 457
 458 struct neighbour *neigh_create(struct neigh_table *tbl, const void *pkey,
 459                                struct net_device *dev)
 460 {
 461         u32 hash_val;
 462         int key_len = tbl->key_len;
 463         int error;
 464         struct neighbour *n1, *rc, *n = neigh_alloc(tbl);
 465         struct neigh_hash_table *nht;
 466
 467         if (!n) {
 468                 rc = ERR_PTR(-ENOBUFS);
 469                 goto out;
 470         }
 471
 472         memcpy(n->primary_key, pkey, key_len);
 473         n->dev = dev;
 474         dev_hold(dev);
 475
 476         /* Protocol specific setup. */
 477         if (tbl->constructor && (error = tbl->constructor(n)) < 0) {
 478                 rc = ERR_PTR(error);
 479                 goto out_neigh_release;
 480         }
 481
 482         /* Device specific setup. */
 483         if (n->parms->neigh_setup &&
 484             (error = n->parms->neigh_setup(n)) < 0) {
 485                 rc = ERR_PTR(error);
 486                 goto out_neigh_release;
 487         }
 488
 489         n->confirmed = jiffies - (n->parms->base_reachable_time << 1);
 490
 491         write_lock_bh(&tbl->lock);
 492         nht = rcu_dereference_protected(tbl->nht,
 493                                         lockdep_is_held(&tbl->lock));
 494
 495         if (atomic_read(&tbl->entries) > (nht->hash_mask + 1))
 496                 nht = neigh_hash_grow(tbl, (nht->hash_mask + 1) << 1);
 497
 498         hash_val = tbl->hash(pkey, dev, nht->hash_rnd) & nht->hash_mask;
 499
 500         if (n->parms->dead) {
 501                 rc = ERR_PTR(-EINVAL);
 502                 goto out_tbl_unlock;
 503         }
 504
 505         for (n1 = rcu_dereference_protected(nht->hash_buckets[hash_val],
 506                                             lockdep_is_held(&tbl->lock));
 507              n1 != NULL;
 508              n1 = rcu_dereference_protected(n1->next,
 509                         lockdep_is_held(&tbl->lock))) {
 510                 if (dev == n1->dev && !memcmp(n1->primary_key, pkey, key_len)) {
 511                         neigh_hold(n1);
 512                         rc = n1;
 513                         goto out_tbl_unlock;
 514                 }
 515         }
 516
 517         n->dead = 0;
 518         neigh_hold(n);
 519         rcu_assign_pointer(n->next,
 520                            rcu_dereference_protected(nht->hash_buckets[hash_val],
 521                                                      lockdep_is_held(&tbl->lock)));
 522         rcu_assign_pointer(nht->hash_buckets[hash_val], n);
 523         write_unlock_bh(&tbl->lock);
 524         NEIGH_PRINTK2("neigh %p is created.\n", n);
 525         rc = n;
 526 out:
 527         return rc;
 528 out_tbl_unlock:
 529         write_unlock_bh(&tbl->lock);
 530 out_neigh_release:
 531         neigh_release(n);
 532         goto out;
 533 }
 534 EXPORT_SYMBOL(neigh_create);
 535
 536 static u32 pneigh_hash(const void *pkey, int key_len)
 537 {
 538         u32 hash_val = *(u32 *)(pkey + key_len - 4);
 539         hash_val ^= (hash_val >> 16);
 540         hash_val ^= hash_val >> 8;
 541         hash_val ^= hash_val >> 4;
 542         hash_val &= PNEIGH_HASHMASK;
 543         return hash_val;
 544 }
 545
 546 static struct pneigh_entry *__pneigh_lookup_1(struct pneigh_entry *n,
 547                                               struct net *net,
 548                                               const void *pkey,
 549                                               int key_len,
 550                                               struct net_device *dev)
 551 {
 552         while (n) {
 553                 if (!memcmp(n->key, pkey, key_len) &&
 554                     net_eq(pneigh_net(n), net) &&
 555                     (n->dev == dev || !n->dev))
 556                         return n;
 557                 n = n->next;
 558         }
 559         return NULL;
 560 }
 561
 562 struct pneigh_entry *__pneigh_lookup(struct neigh_table *tbl,
 563                 struct net *net, const void *pkey, struct net_device *dev)
 564 {
 565         int key_len = tbl->key_len;
 566         u32 hash_val = pneigh_hash(pkey, key_len);
 567
 568         return __pneigh_lookup_1(tbl->phash_buckets[hash_val],
 569                                  net, pkey, key_len, dev);
 570 }
 571 EXPORT_SYMBOL_GPL(__pneigh_lookup);
 572
 573 struct pneigh_entry * pneigh_lookup(struct neigh_table *tbl,
 574                                     struct net *net, const void *pkey,
 575                                     struct net_device *dev, int creat)
 576 {
 577         struct pneigh_entry *n;
 578         int key_len = tbl->key_len;
 579         u32 hash_val = pneigh_hash(pkey, key_len);
 580
 581         read_lock_bh(&tbl->lock);
 582         n = __pneigh_lookup_1(tbl->phash_buckets[hash_val],
 583                               net, pkey, key_len, dev);
 584         read_unlock_bh(&tbl->lock);
 585
 586         if (n || !creat)
 587                 goto out;
 588
 589         ASSERT_RTNL();
 590
 591         n = kmalloc(sizeof(*n) + key_len, GFP_KERNEL);
 592         if (!n)
 593                 goto out;
 594
 595         write_pnet(&n->net, hold_net(net));
 596         memcpy(n->key, pkey, key_len);
 597         n->dev = dev;
 598         if (dev)
 599                 dev_hold(dev);
 600
 601         if (tbl->pconstructor && tbl->pconstructor(n)) {
 602                 if (dev)
 603                         dev_put(dev);
 604                 release_net(net);
 605                 kfree(n);
 606                 n = NULL;
 607                 goto out;
 608         }
 609
 610         write_lock_bh(&tbl->lock);
 611         n->next = tbl->phash_buckets[hash_val];
 612         tbl->phash_buckets[hash_val] = n;
 613         write_unlock_bh(&tbl->lock);
 614 out:
 615         return n;
 616 }
 617 EXPORT_SYMBOL(pneigh_lookup);
 618
 619
 620 int pneigh_delete(struct neigh_table *tbl, struct net *net, const void *pkey,
 621                   struct net_device *dev)
 622 {
 623         struct pneigh_entry *n, **np;
 624         int key_len = tbl->key_len;
 625         u32 hash_val = pneigh_hash(pkey, key_len);
 626
 627         write_lock_bh(&tbl->lock);
 628         for (np = &tbl->phash_buckets[hash_val]; (n = *np) != NULL;
 629              np = &n->next) {
 630                 if (!memcmp(n->key, pkey, key_len) && n->dev == dev &&
 631                     net_eq(pneigh_net(n), net)) {
 632                         *np = n->next;
 633                         write_unlock_bh(&tbl->lock);
 634                         if (tbl->pdestructor)
 635                                 tbl->pdestructor(n);
 636                         if (n->dev)
 637                                 dev_put(n->dev);
 638                         release_net(pneigh_net(n));
 639                         kfree(n);
 640                         return 0;
 641                 }
 642         }
 643         write_unlock_bh(&tbl->lock);
 644         return -ENOENT;
 645 }
 646
 647 static int pneigh_ifdown(struct neigh_table *tbl, struct net_device *dev)
 648 {
 649         struct pneigh_entry *n, **np;
 650         u32 h;
 651
 652         for (h = 0; h <= PNEIGH_HASHMASK; h++) {
 653                 np = &tbl->phash_buckets[h];
 654                 while ((n = *np) != NULL) {
 655                         if (!dev || n->dev == dev) {
 656                                 *np = n->next;
 657                                 if (tbl->pdestructor)
 658                                         tbl->pdestructor(n);
 659                                 if (n->dev)
 660                                         dev_put(n->dev);
 661                                 release_net(pneigh_net(n));
 662                                 kfree(n);
 663                                 continue;
 664                         }
 665                         np = &n->next;
 666                 }
 667         }
 668         return -ENOENT;
 669 }
 670
 671 static void neigh_parms_destroy(struct neigh_parms *parms);
 672
 673 static inline void neigh_parms_put(struct neigh_parms *parms)
 674 {
 675         if (atomic_dec_and_test(&parms->refcnt))
 676                 neigh_parms_destroy(parms);
 677 }
 678
 679 static void neigh_destroy_rcu(struct rcu_head *head)
 680 {
 681         struct neighbour *neigh = container_of(head, struct neighbour, rcu);
 682
 683         kmem_cache_free(neigh->tbl->kmem_cachep, neigh);
 684 }
 685 /*
 686  *      neighbour must already be out of the table;
 687  *
 688  */
 689 void neigh_destroy(struct neighbour *neigh)
 690 {
 691         struct hh_cache *hh;
 692
 693         NEIGH_CACHE_STAT_INC(neigh->tbl, destroys);
 694
 695         if (!neigh->dead) {
 696                 printk(KERN_WARNING
 697                        "Destroying alive neighbour %p\n", neigh);
 698                 dump_stack();
 699                 return;
 700         }
 701
 702         if (neigh_del_timer(neigh))
 703                 printk(KERN_WARNING "Impossible event.\n");
 704
 705         while ((hh = neigh->hh) != NULL) {
 706                 neigh->hh = hh->hh_next;
 707                 hh->hh_next = NULL;
 708
 709                 write_seqlock_bh(&hh->hh_lock);
 710                 hh->hh_output = neigh_blackhole;
 711                 write_sequnlock_bh(&hh->hh_lock);
 712                 hh_cache_put(hh);
 713         }
 714
 715         skb_queue_purge(&neigh->arp_queue);
 716
 717         dev_put(neigh->dev);
 718         neigh_parms_put(neigh->parms);
 719
 720         NEIGH_PRINTK2("neigh %p is destroyed.\n", neigh);
 721
 722         atomic_dec(&neigh->tbl->entries);
 723         call_rcu(&neigh->rcu, neigh_destroy_rcu);
 724 }
 725 EXPORT_SYMBOL(neigh_destroy);
 726
 727 /* Neighbour state is suspicious;
 728    disable fast path.
 729
 730    Called with write_locked neigh.
 731  */
 732 static void neigh_suspect(struct neighbour *neigh)
 733 {
 734         struct hh_cache *hh;
 735
 736         NEIGH_PRINTK2("neigh %p is suspected.\n", neigh);
 737
 738         neigh->output = neigh->ops->output;
 739
 740         for (hh = neigh->hh; hh; hh = hh->hh_next)
 741                 hh->hh_output = neigh->ops->output;
 742 }
 743
 744 /* Neighbour state is OK;
 745    enable fast path.
 746
 747    Called with write_locked neigh.
 748  */
 749 static void neigh_connect(struct neighbour *neigh)
 750 {
 751         struct hh_cache *hh;
 752
 753         NEIGH_PRINTK2("neigh %p is connected.\n", neigh);
 754
 755         neigh->output = neigh->ops->connected_output;
 756
 757         for (hh = neigh->hh; hh; hh = hh->hh_next)
 758                 hh->hh_output = neigh->ops->hh_output;
 759 }
 760
 761 static void neigh_periodic_work(struct work_struct *work)
 762 {
 763         struct neigh_table *tbl = container_of(work, struct neigh_table, gc_work.work);
 764         struct neighbour *n;
 765         struct neighbour __rcu **np;
 766         unsigned int i;
 767         struct neigh_hash_table *nht;
 768
 769         NEIGH_CACHE_STAT_INC(tbl, periodic_gc_runs);
 770
 771         write_lock_bh(&tbl->lock);
 772         nht = rcu_dereference_protected(tbl->nht,
 773                                         lockdep_is_held(&tbl->lock));
 774
 775         /*
 776          *      periodically recompute ReachableTime from random function
 777          */
 778
 779         if (time_after(jiffies, tbl->last_rand + 300 * HZ)) {
 780                 struct neigh_parms *p;
 781                 tbl->last_rand = jiffies;
 782                 for (p = &tbl->parms; p; p = p->next)
 783                         p->reachable_time =
 784                                 neigh_rand_reach_time(p->base_reachable_time);
 785         }
 786
 787         for (i = 0 ; i <= nht->hash_mask; i++) {
 788                 np = &nht->hash_buckets[i];
 789
 790                 while ((n = rcu_dereference_protected(*np,
 791                                 lockdep_is_held(&tbl->lock))) != NULL) {
 792                         unsigned int state;
 793
 794                         write_lock(&n->lock);
 795
 796                         state = n->nud_state;
 797                         if (state & (NUD_PERMANENT | NUD_IN_TIMER)) {
 798                                 write_unlock(&n->lock);
 799                                 goto next_elt;
 800                         }
 801
 802                         if (time_before(n->used, n->confirmed))
 803                                 n->used = n->confirmed;
 804
 805                         if (atomic_read(&n->refcnt) == 1 &&
 806                             (state == NUD_FAILED ||
 807                              time_after(jiffies, n->used + n->parms->gc_staletime))) {
 808                                 *np = n->next;
 809                                 n->dead = 1;
 810                                 write_unlock(&n->lock);
 811                                 neigh_cleanup_and_release(n);
 812                                 continue;
 813                         }
 814                         write_unlock(&n->lock);
 815
 816 next_elt:
 817                         np = &n->next;
 818                 }
 819                 /*
 820                  * It's fine to release lock here, even if hash table
 821                  * grows while we are preempted.
 822                  */
 823                 write_unlock_bh(&tbl->lock);
 824                 cond_resched();
 825                 write_lock_bh(&tbl->lock);
 826         }
 827         /* Cycle through all hash buckets every base_reachable_time/2 ticks.
 828          * ARP entry timeouts range from 1/2 base_reachable_time to 3/2
 829          * base_reachable_time.
 830          */
 831         schedule_delayed_work(&tbl->gc_work,
 832                               tbl->parms.base_reachable_time >> 1);
 833         write_unlock_bh(&tbl->lock);
 834 }
 835
 836 static __inline__ int neigh_max_probes(struct neighbour *n)
 837 {
 838         struct neigh_parms *p = n->parms;
 839         return (n->nud_state & NUD_PROBE) ?
 840                 p->ucast_probes :
 841                 p->ucast_probes + p->app_probes + p->mcast_probes;
 842 }
 843
 844 static void neigh_invalidate(struct neighbour *neigh)
 845         __releases(neigh->lock)
 846         __acquires(neigh->lock)
 847 {
 848         struct sk_buff *skb;
 849
 850         NEIGH_CACHE_STAT_INC(neigh->tbl, res_failed);
 851         NEIGH_PRINTK2("neigh %p is failed.\n", neigh);
 852         neigh->updated = jiffies;
 853
 854         /* It is very thin place. report_unreachable is very complicated
 855            routine. Particularly, it can hit the same neighbour entry!
 856
 857            So that, we try to be accurate and avoid dead loop. --ANK
 858          */
 859         while (neigh->nud_state == NUD_FAILED &&
 860                (skb = __skb_dequeue(&neigh->arp_queue)) != NULL) {
 861                 write_unlock(&neigh->lock);
 862                 neigh->ops->error_report(neigh, skb);
 863                 write_lock(&neigh->lock);
 864         }
 865         skb_queue_purge(&neigh->arp_queue);
 866 }
 867
 868 /* Called when a timer expires for a neighbour entry. */
 869
 870 static void neigh_timer_handler(unsigned long arg)
 871 {
 872         unsigned long now, next;
 873         struct neighbour *neigh = (struct neighbour *)arg;
 874         unsigned state;
 875         int notify = 0;
 876
 877         write_lock(&neigh->lock);
 878
 879         state = neigh->nud_state;
 880         now = jiffies;
 881         next = now + HZ;
 882
 883         if (!(state & NUD_IN_TIMER)) {
 884 #ifndef CONFIG_SMP
 885                 printk(KERN_WARNING "neigh: timer & !nud_in_timer\n");
 886 #endif
 887                 goto out;
 888         }
 889
 890         if (state & NUD_REACHABLE) {
 891                 if (time_before_eq(now,
 892                                    neigh->confirmed + neigh->parms->reachable_time)) {
 893                         NEIGH_PRINTK2("neigh %p is still alive.\n", neigh);
 894                         next = neigh->confirmed + neigh->parms->reachable_time;
 895                 } else if (time_before_eq(now,
 896                                           neigh->used + neigh->parms->delay_probe_time)) {
 897                         NEIGH_PRINTK2("neigh %p is delayed.\n", neigh);
 898                         neigh->nud_state = NUD_DELAY;
 899                         neigh->updated = jiffies;
 900                         neigh_suspect(neigh);
 901                         next = now + neigh->parms->delay_probe_time;
 902                 } else {
 903                         NEIGH_PRINTK2("neigh %p is suspected.\n", neigh);
 904                         neigh->nud_state = NUD_STALE;
 905                         neigh->updated = jiffies;
 906                         neigh_suspect(neigh);
 907                         notify = 1;
 908                 }
 909         } else if (state & NUD_DELAY) {
 910                 if (time_before_eq(now,
 911                                    neigh->confirmed + neigh->parms->delay_probe_time)) {
 912                         NEIGH_PRINTK2("neigh %p is now reachable.\n", neigh);
 913                         neigh->nud_state = NUD_REACHABLE;
 914                         neigh->updated = jiffies;
 915                         neigh_connect(neigh);
 916                         notify = 1;
 917                         next = neigh->confirmed + neigh->parms->reachable_time;
 918                 } else {
 919                         NEIGH_PRINTK2("neigh %p is probed.\n", neigh);
 920                         neigh->nud_state = NUD_PROBE;
 921                         neigh->updated = jiffies;
 922                         atomic_set(&neigh->probes, 0);
 923                         next = now + neigh->parms->retrans_time;
 924                 }
 925         } else {
 926                 /* NUD_PROBE|NUD_INCOMPLETE */
 927                 next = now + neigh->parms->retrans_time;
 928         }
 929
 930         if ((neigh->nud_state & (NUD_INCOMPLETE | NUD_PROBE)) &&
 931             atomic_read(&neigh->probes) >= neigh_max_probes(neigh)) {
 932                 neigh->nud_state = NUD_FAILED;
 933                 notify = 1;
 934                 neigh_invalidate(neigh);
 935         }
 936
 937         if (neigh->nud_state & NUD_IN_TIMER) {
 938                 if (time_before(next, jiffies + HZ/2))
 939                         next = jiffies + HZ/2;
 940                 if (!mod_timer(&neigh->timer, next))
 941                         neigh_hold(neigh);
 942         }
 943         if (neigh->nud_state & (NUD_INCOMPLETE | NUD_PROBE)) {
 944                 struct sk_buff *skb = skb_peek(&neigh->arp_queue);
 945                 /* keep skb alive even if arp_queue overflows */
 946                 if (skb)
 947                         skb = skb_copy(skb, GFP_ATOMIC);
 948                 write_unlock(&neigh->lock);
 949                 neigh->ops->solicit(neigh, skb);
 950                 atomic_inc(&neigh->probes);
 951                 kfree_skb(skb);
 952         } else {
 953 out:
 954                 write_unlock(&neigh->lock);
 955         }
 956
 957         if (notify)
 958                 neigh_update_notify(neigh);
 959
 960         neigh_release(neigh);
 961 }
 962
 963 int __neigh_event_send(struct neighbour *neigh, struct sk_buff *skb)
 964 {
 965         int rc;
 966         unsigned long now;
 967
 968         write_lock_bh(&neigh->lock);
 969
 970         rc = 0;
 971         if (neigh->nud_state & (NUD_CONNECTED | NUD_DELAY | NUD_PROBE))
 972                 goto out_unlock_bh;
 973
 974         now = jiffies;
 975
 976         if (!(neigh->nud_state & (NUD_STALE | NUD_INCOMPLETE))) {
 977                 if (neigh->parms->mcast_probes + neigh->parms->app_probes) {
 978                         atomic_set(&neigh->probes, neigh->parms->ucast_probes);
 979                         neigh->nud_state     = NUD_INCOMPLETE;
 980                         neigh->updated = jiffies;
 981                         neigh_add_timer(neigh, now + 1);
 982                 } else {
 983                         neigh->nud_state = NUD_FAILED;
 984                         neigh->updated = jiffies;
 985                         write_unlock_bh(&neigh->lock);
 986
 987                         kfree_skb(skb);
 988                         return 1;
 989                 }
 990         } else if (neigh->nud_state & NUD_STALE) {
 991                 NEIGH_PRINTK2("neigh %p is delayed.\n", neigh);
 992                 neigh->nud_state = NUD_DELAY;
 993                 neigh->updated = jiffies;
 994                 neigh_add_timer(neigh,
 995                                 jiffies + neigh->parms->delay_probe_time);
 996         }
 997
 998         if (neigh->nud_state == NUD_INCOMPLETE) {
 999                 if (skb) {
1000                         if (skb_queue_len(&neigh->arp_queue) >=
1001                             neigh->parms->queue_len) {
1002                                 struct sk_buff *buff;
1003                                 buff = __skb_dequeue(&neigh->arp_queue);
1004                                 kfree_skb(buff);
1005                                 NEIGH_CACHE_STAT_INC(neigh->tbl, unres_discards);
1006                         }
1007                         skb_dst_force(skb);
1008                         __skb_queue_tail(&neigh->arp_queue, skb);
1009                 }
1010                 rc = 1;
1011         }
1012 out_unlock_bh:
1013         write_unlock_bh(&neigh->lock);
1014         return rc;
1015 }
1016 EXPORT_SYMBOL(__neigh_event_send);
1017
1018 static void neigh_update_hhs(struct neighbour *neigh)
1019 {
1020         struct hh_cache *hh;
1021         void (*update)(struct hh_cache*, const struct net_device*, const unsigned char *)
1022                 = NULL;
1023
1024         if (neigh->dev->header_ops)
1025                 update = neigh->dev->header_ops->cache_update;
1026
1027         if (update) {
1028                 for (hh = neigh->hh; hh; hh = hh->hh_next) {
1029                         write_seqlock_bh(&hh->hh_lock);
1030                         update(hh, neigh->dev, neigh->ha);
1031                         write_sequnlock_bh(&hh->hh_lock);
1032                 }
1033         }
1034 }
1035
1036
1037
1038 /* Generic update routine.
1039    -- lladdr is new lladdr or NULL, if it is not supplied.
1040    -- new    is new state.
1041    -- flags
1042         NEIGH_UPDATE_F_OVERRIDE allows to override existing lladdr,
1043                                 if it is different.
1044         NEIGH_UPDATE_F_WEAK_OVERRIDE will suspect existing "connected"
1045                                 lladdr instead of overriding it
1046                                 if it is different.
1047                                 It also allows to retain current state
1048                                 if lladdr is unchanged.
1049         NEIGH_UPDATE_F_ADMIN    means that the change is administrative.
1050
1051         NEIGH_UPDATE_F_OVERRIDE_ISROUTER allows to override existing
1052                                 NTF_ROUTER flag.
1053         NEIGH_UPDATE_F_ISROUTER indicates if the neighbour is known as
1054                                 a router.
1055
1056    Caller MUST hold reference count on the entry.
1057  */
1058
1059 int neigh_update(struct neighbour *neigh, const u8 *lladdr, u8 new,
1060                  u32 flags)
1061 {
1062         u8 old;
1063         int err;
1064         int notify = 0;
1065         struct net_device *dev;
1066         int update_isrouter = 0;
1067
1068         write_lock_bh(&neigh->lock);
1069
1070         dev    = neigh->dev;
1071         old    = neigh->nud_state;
1072         err    = -EPERM;
1073
1074         if (!(flags & NEIGH_UPDATE_F_ADMIN) &&
1075             (old & (NUD_NOARP | NUD_PERMANENT)))
1076                 goto out;
1077
1078         if (!(new & NUD_VALID)) {
1079                 neigh_del_timer(neigh);
1080                 if (old & NUD_CONNECTED)
1081                         neigh_suspect(neigh);
1082                 neigh->nud_state = new;
1083                 err = 0;
1084                 notify = old & NUD_VALID;
1085                 if ((old & (NUD_INCOMPLETE | NUD_PROBE)) &&
1086                     (new & NUD_FAILED)) {
1087                         neigh_invalidate(neigh);
1088                         notify = 1;
1089                 }
1090                 goto out;
1091         }
1092
1093         /* Compare new lladdr with cached one */
1094         if (!dev->addr_len) {
1095                 /* First case: device needs no address. */
1096                 lladdr = neigh->ha;
1097         } else if (lladdr) {
1098                 /* The second case: if something is already cached
1099                    and a new address is proposed:
1100                    - compare new & old
1101                    - if they are different, check override flag
1102                  */
1103                 if ((old & NUD_VALID) &&
1104                     !memcmp(lladdr, neigh->ha, dev->addr_len))
1105                         lladdr = neigh->ha;
1106         } else {
1107                 /* No address is supplied; if we know something,
1108                    use it, otherwise discard the request.
1109                  */
1110                 err = -EINVAL;
1111                 if (!(old & NUD_VALID))
1112                         goto out;
1113                 lladdr = neigh->ha;
1114         }
1115
1116         if (new & NUD_CONNECTED)
1117                 neigh->confirmed = jiffies;
1118         neigh->updated = jiffies;
1119
1120         /* If entry was valid and address is not changed,
1121            do not change entry state, if new one is STALE.
1122          */
1123         err = 0;
1124         update_isrouter = flags & NEIGH_UPDATE_F_OVERRIDE_ISROUTER;
1125         if (old & NUD_VALID) {
1126                 if (lladdr != neigh->ha && !(flags & NEIGH_UPDATE_F_OVERRIDE)) {
1127                         update_isrouter = 0;
1128                         if ((flags & NEIGH_UPDATE_F_WEAK_OVERRIDE) &&
1129                             (old & NUD_CONNECTED)) {
1130                                 lladdr = neigh->ha;
1131                                 new = NUD_STALE;
1132                         } else
1133                                 goto out;
1134                 } else {
1135                         if (lladdr == neigh->ha && new == NUD_STALE &&
1136                             ((flags & NEIGH_UPDATE_F_WEAK_OVERRIDE) ||
1137                              (old & NUD_CONNECTED))
1138                             )
1139                                 new = old;
1140                 }
1141         }
1142
1143         if (new != old) {
1144                 neigh_del_timer(neigh);
1145                 if (new & NUD_IN_TIMER)
1146                         neigh_add_timer(neigh, (jiffies +
1147                                                 ((new & NUD_REACHABLE) ?
1148                                                  neigh->parms->reachable_time :
1149                                                  0)));
1150                 neigh->nud_state = new;
1151         }
1152
1153         if (lladdr != neigh->ha) {
1154                 memcpy(&neigh->ha, lladdr, dev->addr_len);
1155                 neigh_update_hhs(neigh);
1156                 if (!(new & NUD_CONNECTED))
1157                         neigh->confirmed = jiffies -
1158                                       (neigh->parms->base_reachable_time << 1);
1159                 notify = 1;
1160         }
1161         if (new == old)
1162                 goto out;
1163         if (new & NUD_CONNECTED)
1164                 neigh_connect(neigh);
1165         else
1166                 neigh_suspect(neigh);
1167         if (!(old & NUD_VALID)) {
1168                 struct sk_buff *skb;
1169
1170                 /* Again: avoid dead loop if something went wrong */
1171
1172                 while (neigh->nud_state & NUD_VALID &&
1173                        (skb = __skb_dequeue(&neigh->arp_queue)) != NULL) {
1174                         struct neighbour *n1 = neigh;
1175                         write_unlock_bh(&neigh->lock);
1176                         /* On shaper/eql skb->dst->neighbour != neigh :( */
1177                         if (skb_dst(skb) && skb_dst(skb)->neighbour)
1178                                 n1 = skb_dst(skb)->neighbour;
1179                         n1->output(skb);
1180                         write_lock_bh(&neigh->lock);
1181                 }
1182                 skb_queue_purge(&neigh->arp_queue);
1183         }
1184 out:
1185         if (update_isrouter) {
1186                 neigh->flags = (flags & NEIGH_UPDATE_F_ISROUTER) ?
1187                         (neigh->flags | NTF_ROUTER) :
1188                         (neigh->flags & ~NTF_ROUTER);
1189         }
1190         write_unlock_bh(&neigh->lock);
1191
1192         if (notify)
1193                 neigh_update_notify(neigh);
1194
1195         return err;
1196 }
1197 EXPORT_SYMBOL(neigh_update);
1198
1199 struct neighbour *neigh_event_ns(struct neigh_table *tbl,
1200                                  u8 *lladdr, void *saddr,
1201                                  struct net_device *dev)
1202 {
1203         struct neighbour *neigh = __neigh_lookup(tbl, saddr, dev,
1204                                                  lladdr || !dev->addr_len);
1205         if (neigh)
1206                 neigh_update(neigh, lladdr, NUD_STALE,
1207                              NEIGH_UPDATE_F_OVERRIDE);
1208         return neigh;
1209 }
1210 EXPORT_SYMBOL(neigh_event_ns);
1211
1212 static inline bool neigh_hh_lookup(struct neighbour *n, struct dst_entry *dst,
1213                                    __be16 protocol)
1214 {
1215         struct hh_cache *hh;
1216
1217         for (hh = n->hh; hh; hh = hh->hh_next) {
1218                 if (hh->hh_type == protocol) {
1219                         atomic_inc(&hh->hh_refcnt);
1220                         if (unlikely(cmpxchg(&dst->hh, NULL, hh) != NULL))
1221                                 hh_cache_put(hh);
1222                         return true;
1223                 }
1224         }
1225         return false;
1226 }
1227
1228 /* called with read_lock_bh(&n->lock); */
1229 static void neigh_hh_init(struct neighbour *n, struct dst_entry *dst,
1230                           __be16 protocol)
1231 {
1232         struct hh_cache *hh;
1233         struct net_device *dev = dst->dev;
1234
1235         if (likely(neigh_hh_lookup(n, dst, protocol)))
1236                 return;
1237
1238         /* slow path */
1239         hh = kzalloc(sizeof(*hh), GFP_ATOMIC);
1240         if (!hh)
1241                 return;
1242
1243         seqlock_init(&hh->hh_lock);
1244         hh->hh_type = protocol;
1245         atomic_set(&hh->hh_refcnt, 2);
1246
1247         if (dev->header_ops->cache(n, hh)) {
1248                 kfree(hh);
1249                 return;
1250         }
1251         read_unlock(&n->lock);
1252         write_lock(&n->lock);
1253
1254         /* must check if another thread already did the insert */
1255         if (neigh_hh_lookup(n, dst, protocol)) {
1256                 kfree(hh);
1257                 goto end;
1258         }
1259
1260         if (n->nud_state & NUD_CONNECTED)
1261                 hh->hh_output = n->ops->hh_output;
1262         else
1263                 hh->hh_output = n->ops->output;
1264
1265         hh->hh_next = n->hh;
1266         n->hh       = hh;
1267
1268         if (unlikely(cmpxchg(&dst->hh, NULL, hh) != NULL))
1269                 hh_cache_put(hh);
1270 end:
1271         write_unlock(&n->lock);
1272         read_lock(&n->lock);
1273 }
1274
1275 /* This function can be used in contexts, where only old dev_queue_xmit
1276  * worked, f.e. if you want to override normal output path (eql, shaper),
1277  * but resolution is not made yet.
1278  */
1279
1280 int neigh_compat_output(struct sk_buff *skb)
1281 {
1282         struct net_device *dev = skb->dev;
1283
1284         __skb_pull(skb, skb_network_offset(skb));
1285
1286         if (dev_hard_header(skb, dev, ntohs(skb->protocol), NULL, NULL,
1287                             skb->len) < 0 &&
1288             dev->header_ops->rebuild(skb))
1289                 return 0;
1290
1291         return dev_queue_xmit(skb);
1292 }
1293 EXPORT_SYMBOL(neigh_compat_output);
1294
1295 /* Slow and careful. */
1296
1297 int neigh_resolve_output(struct sk_buff *skb)
1298 {
1299         struct dst_entry *dst = skb_dst(skb);
1300         struct neighbour *neigh;
1301         int rc = 0;
1302
1303         if (!dst || !(neigh = dst->neighbour))
1304                 goto discard;
1305
1306         __skb_pull(skb, skb_network_offset(skb));
1307
1308         if (!neigh_event_send(neigh, skb)) {
1309                 int err;
1310                 struct net_device *dev = neigh->dev;
1311
1312                 read_lock_bh(&neigh->lock);
1313                 if (dev->header_ops->cache &&
1314                     !dst->hh &&
1315                     !(dst->flags & DST_NOCACHE))
1316                         neigh_hh_init(neigh, dst, dst->ops->protocol);
1317
1318                 err = dev_hard_header(skb, dev, ntohs(skb->protocol),
1319                                       neigh->ha, NULL, skb->len);
1320                 read_unlock_bh(&neigh->lock);
1321
1322                 if (err >= 0)
1323                         rc = neigh->ops->queue_xmit(skb);
1324                 else
1325                         goto out_kfree_skb;
1326         }
1327 out:
1328         return rc;
1329 discard:
1330         NEIGH_PRINTK1("neigh_resolve_output: dst=%p neigh=%p\n",
1331                       dst, dst ? dst->neighbour : NULL);
1332 out_kfree_skb:
1333         rc = -EINVAL;
1334         kfree_skb(skb);
1335         goto out;
1336 }
1337 EXPORT_SYMBOL(neigh_resolve_output);
1338
1339 /* As fast as possible without hh cache */
1340
1341 int neigh_connected_output(struct sk_buff *skb)
1342 {
1343         int err;
1344         struct dst_entry *dst = skb_dst(skb);
1345         struct neighbour *neigh = dst->neighbour;
1346         struct net_device *dev = neigh->dev;
1347
1348         __skb_pull(skb, skb_network_offset(skb));
1349
1350         read_lock_bh(&neigh->lock);
1351         err = dev_hard_header(skb, dev, ntohs(skb->protocol),
1352                               neigh->ha, NULL, skb->len);
1353         read_unlock_bh(&neigh->lock);
1354         if (err >= 0)
1355                 err = neigh->ops->queue_xmit(skb);
1356         else {
1357                 err = -EINVAL;
1358                 kfree_skb(skb);
1359         }
1360         return err;
1361 }
1362 EXPORT_SYMBOL(neigh_connected_output);
1363
1364 static void neigh_proxy_process(unsigned long arg)
1365 {
1366         struct neigh_table *tbl = (struct neigh_table *)arg;
1367         long sched_next = 0;
1368         unsigned long now = jiffies;
1369         struct sk_buff *skb, *n;
1370
1371         spin_lock(&tbl->proxy_queue.lock);
1372
1373         skb_queue_walk_safe(&tbl->proxy_queue, skb, n) {
1374                 long tdif = NEIGH_CB(skb)->sched_next - now;
1375
1376                 if (tdif <= 0) {
1377                         struct net_device *dev = skb->dev;
1378                         __skb_unlink(skb, &tbl->proxy_queue);
1379                         if (tbl->proxy_redo && netif_running(dev))
1380                                 tbl->proxy_redo(skb);
1381                         else
1382                                 kfree_skb(skb);
1383
1384                         dev_put(dev);
1385                 } else if (!sched_next || tdif < sched_next)
1386                         sched_next = tdif;
1387         }
1388         del_timer(&tbl->proxy_timer);
1389         if (sched_next)
1390                 mod_timer(&tbl->proxy_timer, jiffies + sched_next);
1391         spin_unlock(&tbl->proxy_queue.lock);
1392 }
1393
1394 void pneigh_enqueue(struct neigh_table *tbl, struct neigh_parms *p,
1395                     struct sk_buff *skb)
1396 {
1397         unsigned long now = jiffies;
1398         unsigned long sched_next = now + (net_random() % p->proxy_delay);
1399
1400         if (tbl->proxy_queue.qlen > p->proxy_qlen) {
1401                 kfree_skb(skb);
1402                 return;
1403         }
1404
1405         NEIGH_CB(skb)->sched_next = sched_next;
1406         NEIGH_CB(skb)->flags |= LOCALLY_ENQUEUED;
1407
1408         spin_lock(&tbl->proxy_queue.lock);
1409         if (del_timer(&tbl->proxy_timer)) {
1410                 if (time_before(tbl->proxy_timer.expires, sched_next))
1411                         sched_next = tbl->proxy_timer.expires;
1412         }
1413         skb_dst_drop(skb);
1414         dev_hold(skb->dev);
1415         __skb_queue_tail(&tbl->proxy_queue, skb);
1416         mod_timer(&tbl->proxy_timer, sched_next);
1417         spin_unlock(&tbl->proxy_queue.lock);
1418 }
1419 EXPORT_SYMBOL(pneigh_enqueue);
1420
1421 static inline struct neigh_parms *lookup_neigh_parms(struct neigh_table *tbl,
1422                                                       struct net *net, int ifindex)
1423 {
1424         struct neigh_parms *p;
1425
1426         for (p = &tbl->parms; p; p = p->next) {
1427                 if ((p->dev && p->dev->ifindex == ifindex && net_eq(neigh_parms_net(p), net)) ||
1428                     (!p->dev && !ifindex))
1429                         return p;
1430         }
1431
1432         return NULL;
1433 }
1434
1435 struct neigh_parms *neigh_parms_alloc(struct net_device *dev,
1436                                       struct neigh_table *tbl)
1437 {
1438         struct neigh_parms *p, *ref;
1439         struct net *net = dev_net(dev);
1440         const struct net_device_ops *ops = dev->netdev_ops;
1441
1442         ref = lookup_neigh_parms(tbl, net, 0);
1443         if (!ref)
1444                 return NULL;
1445
1446         p = kmemdup(ref, sizeof(*p), GFP_KERNEL);
1447         if (p) {
1448                 p->tbl            = tbl;
1449                 atomic_set(&p->refcnt, 1);
1450                 p->reachable_time =
1451                                 neigh_rand_reach_time(p->base_reachable_time);
1452
1453                 if (ops->ndo_neigh_setup && ops->ndo_neigh_setup(dev, p)) {
1454                         kfree(p);
1455                         return NULL;
1456                 }
1457
1458                 dev_hold(dev);
1459                 p->dev = dev;
1460                 write_pnet(&p->net, hold_net(net));
1461                 p->sysctl_table = NULL;
1462                 write_lock_bh(&tbl->lock);
1463                 p->next         = tbl->parms.next;
1464                 tbl->parms.next = p;
1465                 write_unlock_bh(&tbl->lock);
1466         }
1467         return p;
1468 }
1469 EXPORT_SYMBOL(neigh_parms_alloc);
1470
1471 static void neigh_rcu_free_parms(struct rcu_head *head)
1472 {
1473         struct neigh_parms *parms =
1474                 container_of(head, struct neigh_parms, rcu_head);
1475
1476         neigh_parms_put(parms);
1477 }
1478
1479 void neigh_parms_release(struct neigh_table *tbl, struct neigh_parms *parms)
1480 {
1481         struct neigh_parms **p;
1482
1483         if (!parms || parms == &tbl->parms)
1484                 return;
1485         write_lock_bh(&tbl->lock);
1486         for (p = &tbl->parms.next; *p; p = &(*p)->next) {
1487                 if (*p == parms) {
1488                         *p = parms->next;
1489                         parms->dead = 1;
1490                         write_unlock_bh(&tbl->lock);
1491                         if (parms->dev)
1492                                 dev_put(parms->dev);
1493                         call_rcu(&parms->rcu_head, neigh_rcu_free_parms);
1494                         return;
1495                 }
1496         }
1497         write_unlock_bh(&tbl->lock);
1498         NEIGH_PRINTK1("neigh_parms_release: not found\n");
1499 }
1500 EXPORT_SYMBOL(neigh_parms_release);
1501
1502 static void neigh_parms_destroy(struct neigh_parms *parms)
1503 {
1504         release_net(neigh_parms_net(parms));
1505         kfree(parms);
1506 }
1507
1508 static struct lock_class_key neigh_table_proxy_queue_class;
1509
1510 void neigh_table_init_no_netlink(struct neigh_table *tbl)
1511 {
1512         unsigned long now = jiffies;
1513         unsigned long phsize;
1514
1515         write_pnet(&tbl->parms.net, &init_net);
1516         atomic_set(&tbl->parms.refcnt, 1);
1517         tbl->parms.reachable_time =
1518                           neigh_rand_reach_time(tbl->parms.base_reachable_time);
1519
1520         if (!tbl->kmem_cachep)
1521                 tbl->kmem_cachep =
1522                         kmem_cache_create(tbl->id, tbl->entry_size, 0,
1523                                           SLAB_HWCACHE_ALIGN|SLAB_PANIC,
1524                                           NULL);
1525         tbl->stats = alloc_percpu(struct neigh_statistics);
1526         if (!tbl->stats)
1527                 panic("cannot create neighbour cache statistics");
1528
1529 #ifdef CONFIG_PROC_FS
1530         if (!proc_create_data(tbl->id, 0, init_net.proc_net_stat,
1531                               &neigh_stat_seq_fops, tbl))
1532                 panic("cannot create neighbour proc dir entry");
1533 #endif
1534
1535         tbl->nht = neigh_hash_alloc(8);
1536
1537         phsize = (PNEIGH_HASHMASK + 1) * sizeof(struct pneigh_entry *);
1538         tbl->phash_buckets = kzalloc(phsize, GFP_KERNEL);
1539
1540         if (!tbl->nht || !tbl->phash_buckets)
1541                 panic("cannot allocate neighbour cache hashes");
1542
1543         rwlock_init(&tbl->lock);
1544         INIT_DELAYED_WORK_DEFERRABLE(&tbl->gc_work, neigh_periodic_work);
1545         schedule_delayed_work(&tbl->gc_work, tbl->parms.reachable_time);
1546         setup_timer(&tbl->proxy_timer, neigh_proxy_process, (unsigned long)tbl);
1547         skb_queue_head_init_class(&tbl->proxy_queue,
1548                         &neigh_table_proxy_queue_class);
1549
1550         tbl->last_flush = now;
1551         tbl->last_rand  = now + tbl->parms.reachable_time * 20;
1552 }
1553 EXPORT_SYMBOL(neigh_table_init_no_netlink);
1554
1555 void neigh_table_init(struct neigh_table *tbl)
1556 {
1557         struct neigh_table *tmp;
1558
1559         neigh_table_init_no_netlink(tbl);
1560         write_lock(&neigh_tbl_lock);
1561         for (tmp = neigh_tables; tmp; tmp = tmp->next) {
1562                 if (tmp->family == tbl->family)
1563                         break;
1564         }
1565         tbl->next       = neigh_tables;
1566         neigh_tables    = tbl;
1567         write_unlock(&neigh_tbl_lock);
1568
1569         if (unlikely(tmp)) {
1570                 printk(KERN_ERR "NEIGH: Registering multiple tables for "
1571                        "family %d\n", tbl->family);
1572                 dump_stack();
1573         }
1574 }
1575 EXPORT_SYMBOL(neigh_table_init);
1576
1577 int neigh_table_clear(struct neigh_table *tbl)
1578 {
1579         struct neigh_table **tp;
1580
1581         /* It is not clean... Fix it to unload IPv6 module safely */
1582         cancel_delayed_work(&tbl->gc_work);
1583         flush_scheduled_work();
1584         del_timer_sync(&tbl->proxy_timer);
1585         pneigh_queue_purge(&tbl->proxy_queue);
1586         neigh_ifdown(tbl, NULL);
1587         if (atomic_read(&tbl->entries))
1588                 printk(KERN_CRIT "neighbour leakage\n");
1589         write_lock(&neigh_tbl_lock);
1590         for (tp = &neigh_tables; *tp; tp = &(*tp)->next) {
1591                 if (*tp == tbl) {
1592                         *tp = tbl->next;
1593                         break;
1594                 }
1595         }
1596         write_unlock(&neigh_tbl_lock);
1597
1598         call_rcu(&tbl->nht->rcu, neigh_hash_free_rcu);
1599         tbl->nht = NULL;
1600
1601         kfree(tbl->phash_buckets);
1602         tbl->phash_buckets = NULL;
1603
1604         remove_proc_entry(tbl->id, init_net.proc_net_stat);
1605
1606         free_percpu(tbl->stats);
1607         tbl->stats = NULL;
1608
1609         kmem_cache_destroy(tbl->kmem_cachep);
1610         tbl->kmem_cachep = NULL;
1611
1612         return 0;
1613 }
1614 EXPORT_SYMBOL(neigh_table_clear);
1615
1616 static int neigh_delete(struct sk_buff *skb, struct nlmsghdr *nlh, void *arg)
1617 {
1618         struct net *net = sock_net(skb->sk);
1619         struct ndmsg *ndm;
1620         struct nlattr *dst_attr;
1621         struct neigh_table *tbl;
1622         struct net_device *dev = NULL;
1623         int err = -EINVAL;
1624
1625         ASSERT_RTNL();
1626         if (nlmsg_len(nlh) < sizeof(*ndm))
1627                 goto out;
1628
1629         dst_attr = nlmsg_find_attr(nlh, sizeof(*ndm), NDA_DST);
1630         if (dst_attr == NULL)
1631                 goto out;
1632
1633         ndm = nlmsg_data(nlh);
1634         if (ndm->ndm_ifindex) {
1635                 dev = __dev_get_by_index(net, ndm->ndm_ifindex);
1636                 if (dev == NULL) {
1637                         err = -ENODEV;
1638                         goto out;
1639                 }
1640         }
1641
1642         read_lock(&neigh_tbl_lock);
1643         for (tbl = neigh_tables; tbl; tbl = tbl->next) {
1644                 struct neighbour *neigh;
1645
1646                 if (tbl->family != ndm->ndm_family)
1647                         continue;
1648                 read_unlock(&neigh_tbl_lock);
1649
1650                 if (nla_len(dst_attr) < tbl->key_len)
1651                         goto out;
1652
1653                 if (ndm->ndm_flags & NTF_PROXY) {
1654                         err = pneigh_delete(tbl, net, nla_data(dst_attr), dev);
1655                         goto out;
1656                 }
1657
1658                 if (dev == NULL)
1659                         goto out;
1660
1661                 neigh = neigh_lookup(tbl, nla_data(dst_attr), dev);
1662                 if (neigh == NULL) {
1663                         err = -ENOENT;
1664                         goto out;
1665                 }
1666
1667                 err = neigh_update(neigh, NULL, NUD_FAILED,
1668                                    NEIGH_UPDATE_F_OVERRIDE |
1669                                    NEIGH_UPDATE_F_ADMIN);
1670                 neigh_release(neigh);
1671                 goto out;
1672         }
1673         read_unlock(&neigh_tbl_lock);
1674         err = -EAFNOSUPPORT;
1675
1676 out:
1677         return err;
1678 }
1679
1680 static int neigh_add(struct sk_buff *skb, struct nlmsghdr *nlh, void *arg)
1681 {
1682         struct net *net = sock_net(skb->sk);
1683         struct ndmsg *ndm;
1684         struct nlattr *tb[NDA_MAX+1];
1685         struct neigh_table *tbl;
1686         struct net_device *dev = NULL;
1687         int err;
1688
1689         ASSERT_RTNL();
1690         err = nlmsg_parse(nlh, sizeof(*ndm), tb, NDA_MAX, NULL);
1691         if (err < 0)
1692                 goto out;
1693
1694         err = -EINVAL;
1695         if (tb[NDA_DST] == NULL)
1696                 goto out;
1697
1698         ndm = nlmsg_data(nlh);
1699         if (ndm->ndm_ifindex) {
1700                 dev = __dev_get_by_index(net, ndm->ndm_ifindex);
1701                 if (dev == NULL) {
1702                         err = -ENODEV;
1703                         goto out;
1704                 }
1705
1706                 if (tb[NDA_LLADDR] && nla_len(tb[NDA_LLADDR]) < dev->addr_len)
1707                         goto out;
1708         }
1709
1710         read_lock(&neigh_tbl_lock);
1711         for (tbl = neigh_tables; tbl; tbl = tbl->next) {
1712                 int flags = NEIGH_UPDATE_F_ADMIN | NEIGH_UPDATE_F_OVERRIDE;
1713                 struct neighbour *neigh;
1714                 void *dst, *lladdr;
1715
1716                 if (tbl->family != ndm->ndm_family)
1717                         continue;
1718                 read_unlock(&neigh_tbl_lock);
1719
1720                 if (nla_len(tb[NDA_DST]) < tbl->key_len)
1721                         goto out;
1722                 dst = nla_data(tb[NDA_DST]);
1723                 lladdr = tb[NDA_LLADDR] ? nla_data(tb[NDA_LLADDR]) : NULL;
1724
1725                 if (ndm->ndm_flags & NTF_PROXY) {
1726                         struct pneigh_entry *pn;
1727
1728                         err = -ENOBUFS;
1729                         pn = pneigh_lookup(tbl, net, dst, dev, 1);
1730                         if (pn) {
1731                                 pn->flags = ndm->ndm_flags;
1732                                 err = 0;
1733                         }
1734                         goto out;
1735                 }
1736
1737                 if (dev == NULL)
1738                         goto out;
1739
1740                 neigh = neigh_lookup(tbl, dst, dev);
1741                 if (neigh == NULL) {
1742                         if (!(nlh->nlmsg_flags & NLM_F_CREATE)) {
1743                                 err = -ENOENT;
1744                                 goto out;
1745                         }
1746
1747                         neigh = __neigh_lookup_errno(tbl, dst, dev);
1748                         if (IS_ERR(neigh)) {
1749                                 err = PTR_ERR(neigh);
1750                                 goto out;
1751                         }
1752                 } else {
1753                         if (nlh->nlmsg_flags & NLM_F_EXCL) {
1754                                 err = -EEXIST;
1755                                 neigh_release(neigh);
1756                                 goto out;
1757                         }
1758
1759                         if (!(nlh->nlmsg_flags & NLM_F_REPLACE))
1760                                 flags &= ~NEIGH_UPDATE_F_OVERRIDE;
1761                 }
1762
1763                 if (ndm->ndm_flags & NTF_USE) {
1764                         neigh_event_send(neigh, NULL);
1765                         err = 0;
1766                 } else
1767                         err = neigh_update(neigh, lladdr, ndm->ndm_state, flags);
1768                 neigh_release(neigh);
1769                 goto out;
1770         }
1771
1772         read_unlock(&neigh_tbl_lock);
1773         err = -EAFNOSUPPORT;
1774 out:
1775         return err;
1776 }
1777
1778 static int neightbl_fill_parms(struct sk_buff *skb, struct neigh_parms *parms)
1779 {
1780         struct nlattr *nest;
1781
1782         nest = nla_nest_start(skb, NDTA_PARMS);
1783         if (nest == NULL)
1784                 return -ENOBUFS;
1785
1786         if (parms->dev)
1787                 NLA_PUT_U32(skb, NDTPA_IFINDEX, parms->dev->ifindex);
1788
1789         NLA_PUT_U32(skb, NDTPA_REFCNT, atomic_read(&parms->refcnt));
1790         NLA_PUT_U32(skb, NDTPA_QUEUE_LEN, parms->queue_len);
1791         NLA_PUT_U32(skb, NDTPA_PROXY_QLEN, parms->proxy_qlen);
1792         NLA_PUT_U32(skb, NDTPA_APP_PROBES, parms->app_probes);
1793         NLA_PUT_U32(skb, NDTPA_UCAST_PROBES, parms->ucast_probes);
1794         NLA_PUT_U32(skb, NDTPA_MCAST_PROBES, parms->mcast_probes);
1795         NLA_PUT_MSECS(skb, NDTPA_REACHABLE_TIME, parms->reachable_time);
1796         NLA_PUT_MSECS(skb, NDTPA_BASE_REACHABLE_TIME,
1797                       parms->base_reachable_time);
1798         NLA_PUT_MSECS(skb, NDTPA_GC_STALETIME, parms->gc_staletime);
1799         NLA_PUT_MSECS(skb, NDTPA_DELAY_PROBE_TIME, parms->delay_probe_time);
1800         NLA_PUT_MSECS(skb, NDTPA_RETRANS_TIME, parms->retrans_time);
1801         NLA_PUT_MSECS(skb, NDTPA_ANYCAST_DELAY, parms->anycast_delay);
1802         NLA_PUT_MSECS(skb, NDTPA_PROXY_DELAY, parms->proxy_delay);
1803         NLA_PUT_MSECS(skb, NDTPA_LOCKTIME, parms->locktime);
1804
1805         return nla_nest_end(skb, nest);
1806
1807 nla_put_failure:
1808         nla_nest_cancel(skb, nest);
1809         return -EMSGSIZE;
1810 }
1811
1812 static int neightbl_fill_info(struct sk_buff *skb, struct neigh_table *tbl,
1813                               u32 pid, u32 seq, int type, int flags)
1814 {
1815         struct nlmsghdr *nlh;
1816         struct ndtmsg *ndtmsg;
1817
1818         nlh = nlmsg_put(skb, pid, seq, type, sizeof(*ndtmsg), flags);
1819         if (nlh == NULL)
1820                 return -EMSGSIZE;
1821
1822         ndtmsg = nlmsg_data(nlh);
1823
1824         read_lock_bh(&tbl->lock);
1825         ndtmsg->ndtm_family = tbl->family;
1826         ndtmsg->ndtm_pad1   = 0;
1827         ndtmsg->ndtm_pad2   = 0;
1828
1829         NLA_PUT_STRING(skb, NDTA_NAME, tbl->id);
1830         NLA_PUT_MSECS(skb, NDTA_GC_INTERVAL, tbl->gc_interval);
1831         NLA_PUT_U32(skb, NDTA_THRESH1, tbl->gc_thresh1);
1832         NLA_PUT_U32(skb, NDTA_THRESH2, tbl->gc_thresh2);
1833         NLA_PUT_U32(skb, NDTA_THRESH3, tbl->gc_thresh3);
1834
1835         {
1836                 unsigned long now = jiffies;
1837                 unsigned int flush_delta = now - tbl->last_flush;
1838                 unsigned int rand_delta = now - tbl->last_rand;
1839                 struct neigh_hash_table *nht;
1840                 struct ndt_config ndc = {
1841                         .ndtc_key_len           = tbl->key_len,
1842                         .ndtc_entry_size        = tbl->entry_size,
1843                         .ndtc_entries           = atomic_read(&tbl->entries),
1844                         .ndtc_last_flush        = jiffies_to_msecs(flush_delta),
1845                         .ndtc_last_rand         = jiffies_to_msecs(rand_delta),
1846                         .ndtc_proxy_qlen        = tbl->proxy_queue.qlen,
1847                 };
1848
1849                 rcu_read_lock_bh();
1850                 nht = rcu_dereference_bh(tbl->nht);
1851                 ndc.ndtc_hash_rnd = nht->hash_rnd;
1852                 ndc.ndtc_hash_mask = nht->hash_mask;
1853                 rcu_read_unlock_bh();
1854
1855                 NLA_PUT(skb, NDTA_CONFIG, sizeof(ndc), &ndc);
1856         }
1857
1858         {
1859                 int cpu;
1860                 struct ndt_stats ndst;
1861
1862                 memset(&ndst, 0, sizeof(ndst));
1863
1864                 for_each_possible_cpu(cpu) {
1865                         struct neigh_statistics *st;
1866
1867                         st = per_cpu_ptr(tbl->stats, cpu);
1868                         ndst.ndts_allocs                += st->allocs;
1869                         ndst.ndts_destroys              += st->destroys;
1870                         ndst.ndts_hash_grows            += st->hash_grows;
1871                         ndst.ndts_res_failed            += st->res_failed;
1872                         ndst.ndts_lookups               += st->lookups;
1873                         ndst.ndts_hits                  += st->hits;
1874                         ndst.ndts_rcv_probes_mcast      += st->rcv_probes_mcast;
1875                         ndst.ndts_rcv_probes_ucast      += st->rcv_probes_ucast;
1876                         ndst.ndts_periodic_gc_runs      += st->periodic_gc_runs;
1877                         ndst.ndts_forced_gc_runs        += st->forced_gc_runs;
1878                 }
1879
1880                 NLA_PUT(skb, NDTA_STATS, sizeof(ndst), &ndst);
1881         }
1882
1883         BUG_ON(tbl->parms.dev);
1884         if (neightbl_fill_parms(skb, &tbl->parms) < 0)
1885                 goto nla_put_failure;
1886
1887         read_unlock_bh(&tbl->lock);
1888         return nlmsg_end(skb, nlh);
1889
1890 nla_put_failure:
1891         read_unlock_bh(&tbl->lock);
1892         nlmsg_cancel(skb, nlh);
1893         return -EMSGSIZE;
1894 }
1895
1896 static int neightbl_fill_param_info(struct sk_buff *skb,
1897                                     struct neigh_table *tbl,
1898                                     struct neigh_parms *parms,
1899                                     u32 pid, u32 seq, int type,
1900                                     unsigned int flags)
1901 {
1902         struct ndtmsg *ndtmsg;
1903         struct nlmsghdr *nlh;
1904
1905         nlh = nlmsg_put(skb, pid, seq, type, sizeof(*ndtmsg), flags);
1906         if (nlh == NULL)
1907                 return -EMSGSIZE;
1908
1909         ndtmsg = nlmsg_data(nlh);
1910
1911         read_lock_bh(&tbl->lock);
1912         ndtmsg->ndtm_family = tbl->family;
1913         ndtmsg->ndtm_pad1   = 0;
1914         ndtmsg->ndtm_pad2   = 0;
1915
1916         if (nla_put_string(skb, NDTA_NAME, tbl->id) < 0 ||
1917             neightbl_fill_parms(skb, parms) < 0)
1918                 goto errout;
1919
1920         read_unlock_bh(&tbl->lock);
1921         return nlmsg_end(skb, nlh);
1922 errout:
1923         read_unlock_bh(&tbl->lock);
1924         nlmsg_cancel(skb, nlh);
1925         return -EMSGSIZE;
1926 }
1927
1928 static const struct nla_policy nl_neightbl_policy[NDTA_MAX+1] = {
1929         [NDTA_NAME]             = { .type = NLA_STRING },
1930         [NDTA_THRESH1]          = { .type = NLA_U32 },
1931         [NDTA_THRESH2]          = { .type = NLA_U32 },
1932         [NDTA_THRESH3]          = { .type = NLA_U32 },
1933         [NDTA_GC_INTERVAL]      = { .type = NLA_U64 },
1934         [NDTA_PARMS]            = { .type = NLA_NESTED },
1935 };
1936
1937 static const struct nla_policy nl_ntbl_parm_policy[NDTPA_MAX+1] = {
1938         [NDTPA_IFINDEX]                 = { .type = NLA_U32 },
1939         [NDTPA_QUEUE_LEN]               = { .type = NLA_U32 },
1940         [NDTPA_PROXY_QLEN]              = { .type = NLA_U32 },
1941         [NDTPA_APP_PROBES]              = { .type = NLA_U32 },
1942         [NDTPA_UCAST_PROBES]            = { .type = NLA_U32 },
1943         [NDTPA_MCAST_PROBES]            = { .type = NLA_U32 },
1944         [NDTPA_BASE_REACHABLE_TIME]     = { .type = NLA_U64 },
1945         [NDTPA_GC_STALETIME]            = { .type = NLA_U64 },
1946         [NDTPA_DELAY_PROBE_TIME]        = { .type = NLA_U64 },
1947         [NDTPA_RETRANS_TIME]            = { .type = NLA_U64 },
1948         [NDTPA_ANYCAST_DELAY]           = { .type = NLA_U64 },
1949         [NDTPA_PROXY_DELAY]             = { .type = NLA_U64 },
1950         [NDTPA_LOCKTIME]                = { .type = NLA_U64 },
1951 };
1952
1953 static int neightbl_set(struct sk_buff *skb, struct nlmsghdr *nlh, void *arg)
1954 {
1955         struct net *net = sock_net(skb->sk);
1956         struct neigh_table *tbl;
1957         struct ndtmsg *ndtmsg;
1958         struct nlattr *tb[NDTA_MAX+1];
1959         int err;
1960
1961         err = nlmsg_parse(nlh, sizeof(*ndtmsg), tb, NDTA_MAX,
1962                           nl_neightbl_policy);
1963         if (err < 0)
1964                 goto errout;
1965
1966         if (tb[NDTA_NAME] == NULL) {
1967                 err = -EINVAL;
1968                 goto errout;
1969         }
1970
1971         ndtmsg = nlmsg_data(nlh);
1972         read_lock(&neigh_tbl_lock);
1973         for (tbl = neigh_tables; tbl; tbl = tbl->next) {
1974                 if (ndtmsg->ndtm_family && tbl->family != ndtmsg->ndtm_family)
1975                         continue;
1976
1977                 if (nla_strcmp(tb[NDTA_NAME], tbl->id) == 0)
1978                         break;
1979         }
1980
1981         if (tbl == NULL) {
1982                 err = -ENOENT;
1983                 goto errout_locked;
1984         }
1985
1986         /*
1987          * We acquire tbl->lock to be nice to the periodic timers and
1988          * make sure they always see a consistent set of values.
1989          */
1990         write_lock_bh(&tbl->lock);
1991
1992         if (tb[NDTA_PARMS]) {
1993                 struct nlattr *tbp[NDTPA_MAX+1];
1994                 struct neigh_parms *p;
1995                 int i, ifindex = 0;
1996
1997                 err = nla_parse_nested(tbp, NDTPA_MAX, tb[NDTA_PARMS],
1998                                        nl_ntbl_parm_policy);
1999                 if (err < 0)
2000                         goto errout_tbl_lock;
2001
2002                 if (tbp[NDTPA_IFINDEX])
2003                         ifindex = nla_get_u32(tbp[NDTPA_IFINDEX]);
2004
2005                 p = lookup_neigh_parms(tbl, net, ifindex);
2006                 if (p == NULL) {
2007                         err = -ENOENT;
2008                         goto errout_tbl_lock;
2009                 }
2010
2011                 for (i = 1; i <= NDTPA_MAX; i++) {
2012                         if (tbp[i] == NULL)
2013                                 continue;
2014
2015                         switch (i) {
2016                         case NDTPA_QUEUE_LEN:
2017                                 p->queue_len = nla_get_u32(tbp[i]);
2018                                 break;
2019                         case NDTPA_PROXY_QLEN:
2020                                 p->proxy_qlen = nla_get_u32(tbp[i]);
2021                                 break;
2022                         case NDTPA_APP_PROBES:
2023                                 p->app_probes = nla_get_u32(tbp[i]);
2024                                 break;
2025                         case NDTPA_UCAST_PROBES:
2026                                 p->ucast_probes = nla_get_u32(tbp[i]);
2027                                 break;
2028                         case NDTPA_MCAST_PROBES:
2029                                 p->mcast_probes = nla_get_u32(tbp[i]);
2030                                 break;
2031                         case NDTPA_BASE_REACHABLE_TIME:
2032                                 p->base_reachable_time = nla_get_msecs(tbp[i]);
2033                                 break;
2034                         case NDTPA_GC_STALETIME:
2035                                 p->gc_staletime = nla_get_msecs(tbp[i]);
2036                                 break;
2037                         case NDTPA_DELAY_PROBE_TIME:
2038                                 p->delay_probe_time = nla_get_msecs(tbp[i]);
2039                                 break;
2040                         case NDTPA_RETRANS_TIME:
2041                                 p->retrans_time = nla_get_msecs(tbp[i]);
2042                                 break;
2043                         case NDTPA_ANYCAST_DELAY:
2044                                 p->anycast_delay = nla_get_msecs(tbp[i]);
2045                                 break;
2046                         case NDTPA_PROXY_DELAY:
2047                                 p->proxy_delay = nla_get_msecs(tbp[i]);
2048                                 break;
2049                         case NDTPA_LOCKTIME:
2050                                 p->locktime = nla_get_msecs(tbp[i]);
2051                                 break;
2052                         }
2053                 }
2054         }
2055
2056         if (tb[NDTA_THRESH1])
2057                 tbl->gc_thresh1 = nla_get_u32(tb[NDTA_THRESH1]);
2058
2059         if (tb[NDTA_THRESH2])
2060                 tbl->gc_thresh2 = nla_get_u32(tb[NDTA_THRESH2]);
2061
2062         if (tb[NDTA_THRESH3])
2063                 tbl->gc_thresh3 = nla_get_u32(tb[NDTA_THRESH3]);
2064
2065         if (tb[NDTA_GC_INTERVAL])
2066                 tbl->gc_interval = nla_get_msecs(tb[NDTA_GC_INTERVAL]);
2067
2068         err = 0;
2069
2070 errout_tbl_lock:
2071         write_unlock_bh(&tbl->lock);
2072 errout_locked:
2073         read_unlock(&neigh_tbl_lock);
2074 errout:
2075         return err;
2076 }
2077
2078 static int neightbl_dump_info(struct sk_buff *skb, struct netlink_callback *cb)
2079 {
2080         struct net *net = sock_net(skb->sk);
2081         int family, tidx, nidx = 0;
2082         int tbl_skip = cb->args[0];
2083         int neigh_skip = cb->args[1];
2084         struct neigh_table *tbl;
2085
2086         family = ((struct rtgenmsg *) nlmsg_data(cb->nlh))->rtgen_family;
2087
2088         read_lock(&neigh_tbl_lock);
2089         for (tbl = neigh_tables, tidx = 0; tbl; tbl = tbl->next, tidx++) {
2090                 struct neigh_parms *p;
2091
2092                 if (tidx < tbl_skip || (family && tbl->family != family))
2093                         continue;
2094
2095                 if (neightbl_fill_info(skb, tbl, NETLINK_CB(cb->skb).pid,
2096                                        cb->nlh->nlmsg_seq, RTM_NEWNEIGHTBL,
2097                                        NLM_F_MULTI) <= 0)
2098                         break;
2099
2100                 for (nidx = 0, p = tbl->parms.next; p; p = p->next) {
2101                         if (!net_eq(neigh_parms_net(p), net))
2102                                 continue;
2103
2104                         if (nidx < neigh_skip)
2105                                 goto next;
2106
2107                         if (neightbl_fill_param_info(skb, tbl, p,
2108                                                      NETLINK_CB(cb->skb).pid,
2109                                                      cb->nlh->nlmsg_seq,
2110                                                      RTM_NEWNEIGHTBL,
2111                                                      NLM_F_MULTI) <= 0)
2112                                 goto out;
2113                 next:
2114                         nidx++;
2115                 }
2116
2117                 neigh_skip = 0;
2118         }
2119 out:
2120         read_unlock(&neigh_tbl_lock);
2121         cb->args[0] = tidx;
2122         cb->args[1] = nidx;
2123
2124         return skb->len;
2125 }
2126
2127 static int neigh_fill_info(struct sk_buff *skb, struct neighbour *neigh,
2128                            u32 pid, u32 seq, int type, unsigned int flags)
2129 {
2130         unsigned long now = jiffies;
2131         struct nda_cacheinfo ci;
2132         struct nlmsghdr *nlh;
2133         struct ndmsg *ndm;
2134
2135         nlh = nlmsg_put(skb, pid, seq, type, sizeof(*ndm), flags);
2136         if (nlh == NULL)
2137                 return -EMSGSIZE;
2138
2139         ndm = nlmsg_data(nlh);
2140         ndm->ndm_family  = neigh->ops->family;
2141         ndm->ndm_pad1    = 0;
2142         ndm->ndm_pad2    = 0;
2143         ndm->ndm_flags   = neigh->flags;
2144         ndm->ndm_type    = neigh->type;
2145         ndm->ndm_ifindex = neigh->dev->ifindex;
2146
2147         NLA_PUT(skb, NDA_DST, neigh->tbl->key_len, neigh->primary_key);
2148
2149         read_lock_bh(&neigh->lock);
2150         ndm->ndm_state   = neigh->nud_state;
2151         if ((neigh->nud_state & NUD_VALID) &&
2152             nla_put(skb, NDA_LLADDR, neigh->dev->addr_len, neigh->ha) < 0) {
2153                 read_unlock_bh(&neigh->lock);
2154                 goto nla_put_failure;
2155         }
2156
2157         ci.ndm_used      = jiffies_to_clock_t(now - neigh->used);
2158         ci.ndm_confirmed = jiffies_to_clock_t(now - neigh->confirmed);
2159         ci.ndm_updated   = jiffies_to_clock_t(now - neigh->updated);
2160         ci.ndm_refcnt    = atomic_read(&neigh->refcnt) - 1;
2161         read_unlock_bh(&neigh->lock);
2162
2163         NLA_PUT_U32(skb, NDA_PROBES, atomic_read(&neigh->probes));
2164         NLA_PUT(skb, NDA_CACHEINFO, sizeof(ci), &ci);
2165
2166         return nlmsg_end(skb, nlh);
2167
2168 nla_put_failure:
2169         nlmsg_cancel(skb, nlh);
2170         return -EMSGSIZE;
2171 }
2172
2173 static void neigh_update_notify(struct neighbour *neigh)
2174 {
2175         call_netevent_notifiers(NETEVENT_NEIGH_UPDATE, neigh);
2176         __neigh_notify(neigh, RTM_NEWNEIGH, 0);
2177 }
2178
2179 static int neigh_dump_table(struct neigh_table *tbl, struct sk_buff *skb,
2180                             struct netlink_callback *cb)
2181 {
2182         struct net *net = sock_net(skb->sk);
2183         struct neighbour *n;
2184         int rc, h, s_h = cb->args[1];
2185         int idx, s_idx = idx = cb->args[2];
2186         struct neigh_hash_table *nht;
2187
2188         rcu_read_lock_bh();
2189         nht = rcu_dereference_bh(tbl->nht);
2190
2191         for (h = 0; h <= nht->hash_mask; h++) {
2192                 if (h < s_h)
2193                         continue;
2194                 if (h > s_h)
2195                         s_idx = 0;
2196                 for (n = rcu_dereference_bh(nht->hash_buckets[h]), idx = 0;
2197                      n != NULL;
2198                      n = rcu_dereference_bh(n->next)) {
2199                         if (!net_eq(dev_net(n->dev), net))
2200                                 continue;
2201                         if (idx < s_idx)
2202                                 goto next;
2203                         if (neigh_fill_info(skb, n, NETLINK_CB(cb->skb).pid,
2204                                             cb->nlh->nlmsg_seq,
2205                                             RTM_NEWNEIGH,
2206                                             NLM_F_MULTI) <= 0) {
2207                                 rc = -1;
2208                                 goto out;
2209                         }
2210 next:
2211                         idx++;
2212                 }
2213         }
2214         rc = skb->len;
2215 out:
2216         rcu_read_unlock_bh();
2217         cb->args[1] = h;
2218         cb->args[2] = idx;
2219         return rc;
2220 }
2221
2222 static int neigh_dump_info(struct sk_buff *skb, struct netlink_callback *cb)
2223 {
2224         struct neigh_table *tbl;
2225         int t, family, s_t;
2226
2227         read_lock(&neigh_tbl_lock);
2228         family = ((struct rtgenmsg *) nlmsg_data(cb->nlh))->rtgen_family;
2229         s_t = cb->args[0];
2230
2231         for (tbl = neigh_tables, t = 0; tbl; tbl = tbl->next, t++) {
2232                 if (t < s_t || (family && tbl->family != family))
2233                         continue;
2234                 if (t > s_t)
2235                         memset(&cb->args[1], 0, sizeof(cb->args) -
2236                                                 sizeof(cb->args[0]));
2237                 if (neigh_dump_table(tbl, skb, cb) < 0)
2238                         break;
2239         }
2240         read_unlock(&neigh_tbl_lock);
2241
2242         cb->args[0] = t;
2243         return skb->len;
2244 }
2245
2246 void neigh_for_each(struct neigh_table *tbl, void (*cb)(struct neighbour *, void *), void *cookie)
2247 {
2248         int chain;
2249         struct neigh_hash_table *nht;
2250
2251         rcu_read_lock_bh();
2252         nht = rcu_dereference_bh(tbl->nht);
2253
2254         read_lock(&tbl->lock); /* avoid resizes */
2255         for (chain = 0; chain <= nht->hash_mask; chain++) {
2256                 struct neighbour *n;
2257
2258                 for (n = rcu_dereference_bh(nht->hash_buckets[chain]);
2259                      n != NULL;
2260                      n = rcu_dereference_bh(n->next))
2261                         cb(n, cookie);
2262         }
2263         read_unlock(&tbl->lock);
2264         rcu_read_unlock_bh();
2265 }
2266 EXPORT_SYMBOL(neigh_for_each);
2267
2268 /* The tbl->lock must be held as a writer and BH disabled. */
2269 void __neigh_for_each_release(struct neigh_table *tbl,
2270                               int (*cb)(struct neighbour *))
2271 {
2272         int chain;
2273         struct neigh_hash_table *nht;
2274
2275         nht = rcu_dereference_protected(tbl->nht,
2276                                         lockdep_is_held(&tbl->lock));
2277         for (chain = 0; chain <= nht->hash_mask; chain++) {
2278                 struct neighbour *n;
2279                 struct neighbour __rcu **np;
2280
2281                 np = &nht->hash_buckets[chain];
2282                 while ((n = rcu_dereference_protected(*np,
2283                                         lockdep_is_held(&tbl->lock))) != NULL) {
2284                         int release;
2285
2286                         write_lock(&n->lock);
2287                         release = cb(n);
2288                         if (release) {
2289                                 rcu_assign_pointer(*np,
2290                                         rcu_dereference_protected(n->next,
2291                                                 lockdep_is_held(&tbl->lock)));
2292                                 n->dead = 1;
2293                         } else
2294                                 np = &n->next;
2295                         write_unlock(&n->lock);
2296                         if (release)
2297                                 neigh_cleanup_and_release(n);
2298                 }
2299         }
2300 }
2301 EXPORT_SYMBOL(__neigh_for_each_release);
2302
2303 #ifdef CONFIG_PROC_FS
2304
2305 static struct neighbour *neigh_get_first(struct seq_file *seq)
2306 {
2307         struct neigh_seq_state *state = seq->private;
2308         struct net *net = seq_file_net(seq);
2309         struct neigh_hash_table *nht = state->nht;
2310         struct neighbour *n = NULL;
2311         int bucket = state->bucket;
2312
2313         state->flags &= ~NEIGH_SEQ_IS_PNEIGH;
2314         for (bucket = 0; bucket <= nht->hash_mask; bucket++) {
2315                 n = rcu_dereference_bh(nht->hash_buckets[bucket]);
2316
2317                 while (n) {
2318                         if (!net_eq(dev_net(n->dev), net))
2319                                 goto next;
2320                         if (state->neigh_sub_iter) {
2321                                 loff_t fakep = 0;
2322                                 void *v;
2323
2324                                 v = state->neigh_sub_iter(state, n, &fakep);
2325                                 if (!v)
2326                                         goto next;
2327                         }
2328                         if (!(state->flags & NEIGH_SEQ_SKIP_NOARP))
2329                                 break;
2330                         if (n->nud_state & ~NUD_NOARP)
2331                                 break;
2332 next:
2333                         n = rcu_dereference_bh(n->next);
2334                 }
2335
2336                 if (n)
2337                         break;
2338         }
2339         state->bucket = bucket;
2340
2341         return n;
2342 }
2343
2344 static struct neighbour *neigh_get_next(struct seq_file *seq,
2345                                         struct neighbour *n,
2346                                         loff_t *pos)
2347 {
2348         struct neigh_seq_state *state = seq->private;
2349         struct net *net = seq_file_net(seq);
2350         struct neigh_hash_table *nht = state->nht;
2351
2352         if (state->neigh_sub_iter) {
2353                 void *v = state->neigh_sub_iter(state, n, pos);
2354                 if (v)
2355                         return n;
2356         }
2357         n = rcu_dereference_bh(n->next);
2358
2359         while (1) {
2360                 while (n) {
2361                         if (!net_eq(dev_net(n->dev), net))
2362                                 goto next;
2363                         if (state->neigh_sub_iter) {
2364                                 void *v = state->neigh_sub_iter(state, n, pos);
2365                                 if (v)
2366                                         return n;
2367                                 goto next;
2368                         }
2369                         if (!(state->flags & NEIGH_SEQ_SKIP_NOARP))
2370                                 break;
2371
2372                         if (n->nud_state & ~NUD_NOARP)
2373                                 break;
2374 next:
2375                         n = rcu_dereference_bh(n->next);
2376                 }
2377
2378                 if (n)
2379                         break;
2380
2381                 if (++state->bucket > nht->hash_mask)
2382                         break;
2383
2384                 n = rcu_dereference_bh(nht->hash_buckets[state->bucket]);
2385         }
2386
2387         if (n && pos)
2388                 --(*pos);
2389         return n;
2390 }
2391
2392 static struct neighbour *neigh_get_idx(struct seq_file *seq, loff_t *pos)
2393 {
2394         struct neighbour *n = neigh_get_first(seq);
2395
2396         if (n) {
2397                 --(*pos);
2398                 while (*pos) {
2399                         n = neigh_get_next(seq, n, pos);
2400                         if (!n)
2401                                 break;
2402                 }
2403         }
2404         return *pos ? NULL : n;
2405 }
2406
2407 static struct pneigh_entry *pneigh_get_first(struct seq_file *seq)
2408 {
2409         struct neigh_seq_state *state = seq->private;
2410         struct net *net = seq_file_net(seq);
2411         struct neigh_table *tbl = state->tbl;
2412         struct pneigh_entry *pn = NULL;
2413         int bucket = state->bucket;
2414
2415         state->flags |= NEIGH_SEQ_IS_PNEIGH;
2416         for (bucket = 0; bucket <= PNEIGH_HASHMASK; bucket++) {
2417                 pn = tbl->phash_buckets[bucket];
2418                 while (pn && !net_eq(pneigh_net(pn), net))
2419                         pn = pn->next;
2420                 if (pn)
2421                         break;
2422         }
2423         state->bucket = bucket;
2424
2425         return pn;
2426 }
2427
2428 static struct pneigh_entry *pneigh_get_next(struct seq_file *seq,
2429                                             struct pneigh_entry *pn,
2430                                             loff_t *pos)
2431 {
2432         struct neigh_seq_state *state = seq->private;
2433         struct net *net = seq_file_net(seq);
2434         struct neigh_table *tbl = state->tbl;
2435
2436         pn = pn->next;
2437         while (!pn) {
2438                 if (++state->bucket > PNEIGH_HASHMASK)
2439                         break;
2440                 pn = tbl->phash_buckets[state->bucket];
2441                 while (pn && !net_eq(pneigh_net(pn), net))
2442                         pn = pn->next;
2443                 if (pn)
2444                         break;
2445         }
2446
2447         if (pn && pos)
2448                 --(*pos);
2449
2450         return pn;
2451 }
2452
2453 static struct pneigh_entry *pneigh_get_idx(struct seq_file *seq, loff_t *pos)
2454 {
2455         struct pneigh_entry *pn = pneigh_get_first(seq);
2456
2457         if (pn) {
2458                 --(*pos);
2459                 while (*pos) {
2460                         pn = pneigh_get_next(seq, pn, pos);
2461                         if (!pn)
2462                                 break;
2463                 }
2464         }
2465         return *pos ? NULL : pn;
2466 }
2467
2468 static void *neigh_get_idx_any(struct seq_file *seq, loff_t *pos)
2469 {
2470         struct neigh_seq_state *state = seq->private;
2471         void *rc;
2472         loff_t idxpos = *pos;
2473
2474         rc = neigh_get_idx(seq, &idxpos);
2475         if (!rc && !(state->flags & NEIGH_SEQ_NEIGH_ONLY))
2476                 rc = pneigh_get_idx(seq, &idxpos);
2477
2478         return rc;
2479 }
2480
2481 void *neigh_seq_start(struct seq_file *seq, loff_t *pos, struct neigh_table *tbl, unsigned int neigh_seq_flags)
2482         __acquires(rcu_bh)
2483 {
2484         struct neigh_seq_state *state = seq->private;
2485
2486         state->tbl = tbl;
2487         state->bucket = 0;
2488         state->flags = (neigh_seq_flags & ~NEIGH_SEQ_IS_PNEIGH);
2489
2490         rcu_read_lock_bh();
2491         state->nht = rcu_dereference_bh(tbl->nht);
2492
2493         return *pos ? neigh_get_idx_any(seq, pos) : SEQ_START_TOKEN;
2494 }
2495 EXPORT_SYMBOL(neigh_seq_start);
2496
2497 void *neigh_seq_next(struct seq_file *seq, void *v, loff_t *pos)
2498 {
2499         struct neigh_seq_state *state;
2500         void *rc;
2501
2502         if (v == SEQ_START_TOKEN) {
2503                 rc = neigh_get_first(seq);
2504                 goto out;
2505         }
2506
2507         state = seq->private;
2508         if (!(state->flags & NEIGH_SEQ_IS_PNEIGH)) {
2509                 rc = neigh_get_next(seq, v, NULL);
2510                 if (rc)
2511                         goto out;
2512                 if (!(state->flags & NEIGH_SEQ_NEIGH_ONLY))
2513                         rc = pneigh_get_first(seq);
2514         } else {
2515                 BUG_ON(state->flags & NEIGH_SEQ_NEIGH_ONLY);
2516                 rc = pneigh_get_next(seq, v, NULL);
2517         }
2518 out:
2519         ++(*pos);
2520         return rc;
2521 }
2522 EXPORT_SYMBOL(neigh_seq_next);
2523
2524 void neigh_seq_stop(struct seq_file *seq, void *v)
2525         __releases(rcu_bh)
2526 {
2527         rcu_read_unlock_bh();
2528 }
2529 EXPORT_SYMBOL(neigh_seq_stop);
2530
2531 /* statistics via seq_file */
2532
2533 static void *neigh_stat_seq_start(struct seq_file *seq, loff_t *pos)
2534 {
2535         struct neigh_table *tbl = seq->private;
2536         int cpu;
2537
2538         if (*pos == 0)
2539                 return SEQ_START_TOKEN;
2540
2541         for (cpu = *pos-1; cpu < nr_cpu_ids; ++cpu) {
2542                 if (!cpu_possible(cpu))
2543                         continue;
2544                 *pos = cpu+1;
2545                 return per_cpu_ptr(tbl->stats, cpu);
2546         }
2547         return NULL;
2548 }
2549
2550 static void *neigh_stat_seq_next(struct seq_file *seq, void *v, loff_t *pos)
2551 {
2552         struct neigh_table *tbl = seq->private;
2553         int cpu;
2554
2555         for (cpu = *pos; cpu < nr_cpu_ids; ++cpu) {
2556                 if (!cpu_possible(cpu))
2557                         continue;
2558                 *pos = cpu+1;
2559                 return per_cpu_ptr(tbl->stats, cpu);
2560         }
2561         return NULL;
2562 }
2563
2564 static void neigh_stat_seq_stop(struct seq_file *seq, void *v)
2565 {
2566
2567 }
2568
2569 static int neigh_stat_seq_show(struct seq_file *seq, void *v)
2570 {
2571         struct neigh_table *tbl = seq->private;
2572         struct neigh_statistics *st = v;
2573
2574         if (v == SEQ_START_TOKEN) {
2575                 seq_printf(seq, "entries  allocs destroys hash_grows  lookups hits  res_failed  rcv_probes_mcast rcv_probes_ucast  periodic_gc_runs forced_gc_runs unresolved_discards\n");
2576                 return 0;
2577         }
2578
2579         seq_printf(seq, "%08x  %08lx %08lx %08lx  %08lx %08lx  %08lx  "
2580                         "%08lx %08lx  %08lx %08lx %08lx\n",
2581                    atomic_read(&tbl->entries),
2582
2583                    st->allocs,
2584                    st->destroys,
2585                    st->hash_grows,
2586
2587                    st->lookups,
2588                    st->hits,
2589
2590                    st->res_failed,
2591
2592                    st->rcv_probes_mcast,
2593                    st->rcv_probes_ucast,
2594
2595                    st->periodic_gc_runs,
2596                    st->forced_gc_runs,
2597                    st->unres_discards
2598                    );
2599
2600         return 0;
2601 }
2602
2603 static const struct seq_operations neigh_stat_seq_ops = {
2604         .start  = neigh_stat_seq_start,
2605         .next   = neigh_stat_seq_next,
2606         .stop   = neigh_stat_seq_stop,
2607         .show   = neigh_stat_seq_show,
2608 };
2609
2610 static int neigh_stat_seq_open(struct inode *inode, struct file *file)
2611 {
2612         int ret = seq_open(file, &neigh_stat_seq_ops);
2613
2614         if (!ret) {
2615                 struct seq_file *sf = file->private_data;
2616                 sf->private = PDE(inode)->data;
2617         }
2618         return ret;
2619 };
2620
2621 static const struct file_operations neigh_stat_seq_fops = {
2622         .owner   = THIS_MODULE,
2623         .open    = neigh_stat_seq_open,
2624         .read    = seq_read,
2625         .llseek  = seq_lseek,
2626         .release = seq_release,
2627 };
2628
2629 #endif /* CONFIG_PROC_FS */
2630
2631 static inline size_t neigh_nlmsg_size(void)
2632 {
2633         return NLMSG_ALIGN(sizeof(struct ndmsg))
2634                + nla_total_size(MAX_ADDR_LEN) /* NDA_DST */
2635                + nla_total_size(MAX_ADDR_LEN) /* NDA_LLADDR */
2636                + nla_total_size(sizeof(struct nda_cacheinfo))
2637                + nla_total_size(4); /* NDA_PROBES */
2638 }
2639
2640 static void __neigh_notify(struct neighbour *n, int type, int flags)
2641 {
2642         struct net *net = dev_net(n->dev);
2643         struct sk_buff *skb;
2644         int err = -ENOBUFS;
2645
2646         skb = nlmsg_new(neigh_nlmsg_size(), GFP_ATOMIC);
2647         if (skb == NULL)
2648                 goto errout;
2649
2650         err = neigh_fill_info(skb, n, 0, 0, type, flags);
2651         if (err < 0) {
2652                 /* -EMSGSIZE implies BUG in neigh_nlmsg_size() */
2653                 WARN_ON(err == -EMSGSIZE);
2654                 kfree_skb(skb);
2655                 goto errout;
2656         }
2657         rtnl_notify(skb, net, 0, RTNLGRP_NEIGH, NULL, GFP_ATOMIC);
2658         return;
2659 errout:
2660         if (err < 0)
2661                 rtnl_set_sk_err(net, RTNLGRP_NEIGH, err);
2662 }
2663
2664 #ifdef CONFIG_ARPD
2665 void neigh_app_ns(struct neighbour *n)
2666 {
2667         __neigh_notify(n, RTM_GETNEIGH, NLM_F_REQUEST);
2668 }
2669 EXPORT_SYMBOL(neigh_app_ns);
2670 #endif /* CONFIG_ARPD */
2671
2672 #ifdef CONFIG_SYSCTL
2673
2674 #define NEIGH_VARS_MAX 19
2675
2676 static struct neigh_sysctl_table {
2677         struct ctl_table_header *sysctl_header;
2678         struct ctl_table neigh_vars[NEIGH_VARS_MAX];
2679         char *dev_name;
2680 } neigh_sysctl_template __read_mostly = {
2681         .neigh_vars = {
2682                 {
2683                         .procname       = "mcast_solicit",
2684                         .maxlen         = sizeof(int),
2685                         .mode           = 0644,
2686                         .proc_handler   = proc_dointvec,
2687                 },
2688                 {
2689                         .procname       = "ucast_solicit",
2690                         .maxlen         = sizeof(int),
2691                         .mode           = 0644,
2692                         .proc_handler   = proc_dointvec,
2693                 },
2694                 {
2695                         .procname       = "app_solicit",
2696                         .maxlen         = sizeof(int),
2697                         .mode           = 0644,
2698                         .proc_handler   = proc_dointvec,
2699                 },
2700                 {
2701                         .procname       = "retrans_time",
2702                         .maxlen         = sizeof(int),
2703                         .mode           = 0644,
2704                         .proc_handler   = proc_dointvec_userhz_jiffies,
2705                 },
2706                 {
2707                         .procname       = "base_reachable_time",
2708                         .maxlen         = sizeof(int),
2709                         .mode           = 0644,
2710                         .proc_handler   = proc_dointvec_jiffies,
2711                 },
2712                 {
2713                         .procname       = "delay_first_probe_time",
2714                         .maxlen         = sizeof(int),
2715                         .mode           = 0644,
2716                         .proc_handler   = proc_dointvec_jiffies,
2717                 },
2718                 {
2719                         .procname       = "gc_stale_time",
2720                         .maxlen         = sizeof(int),
2721                         .mode           = 0644,
2722                         .proc_handler   = proc_dointvec_jiffies,
2723                 },
2724                 {
2725                         .procname       = "unres_qlen",
2726                         .maxlen         = sizeof(int),
2727                         .mode           = 0644,
2728                         .proc_handler   = proc_dointvec,
2729                 },
2730                 {
2731                         .procname       = "proxy_qlen",
2732                         .maxlen         = sizeof(int),
2733                         .mode           = 0644,
2734                         .proc_handler   = proc_dointvec,
2735                 },
2736                 {
2737                         .procname       = "anycast_delay",
2738                         .maxlen         = sizeof(int),
2739                         .mode           = 0644,
2740                         .proc_handler   = proc_dointvec_userhz_jiffies,
2741                 },
2742                 {
2743                         .procname       = "proxy_delay",
2744                         .maxlen         = sizeof(int),
2745                         .mode           = 0644,
2746                         .proc_handler   = proc_dointvec_userhz_jiffies,
2747                 },
2748                 {
2749                         .procname       = "locktime",
2750                         .maxlen         = sizeof(int),
2751                         .mode           = 0644,
2752                         .proc_handler   = proc_dointvec_userhz_jiffies,
2753                 },
2754                 {
2755                         .procname       = "retrans_time_ms",
2756                         .maxlen         = sizeof(int),
2757                         .mode           = 0644,
2758                         .proc_handler   = proc_dointvec_ms_jiffies,
2759                 },
2760                 {
2761                         .procname       = "base_reachable_time_ms",
2762                         .maxlen         = sizeof(int),
2763                         .mode           = 0644,
2764                         .proc_handler   = proc_dointvec_ms_jiffies,
2765                 },
2766                 {
2767                         .procname       = "gc_interval",
2768                         .maxlen         = sizeof(int),
2769                         .mode           = 0644,
2770                         .proc_handler   = proc_dointvec_jiffies,
2771                 },
2772                 {
2773                         .procname       = "gc_thresh1",
2774                         .maxlen         = sizeof(int),
2775                         .mode           = 0644,
2776                         .proc_handler   = proc_dointvec,
2777                 },
2778                 {
2779                         .procname       = "gc_thresh2",
2780                         .maxlen         = sizeof(int),
2781                         .mode           = 0644,
2782                         .proc_handler   = proc_dointvec,
2783                 },
2784                 {
2785                         .procname       = "gc_thresh3",
2786                         .maxlen         = sizeof(int),
2787                         .mode           = 0644,
2788                         .proc_handler   = proc_dointvec,
2789                 },
2790                 {},
2791         },
2792 };
2793
2794 int neigh_sysctl_register(struct net_device *dev, struct neigh_parms *p,
2795                           char *p_name, proc_handler *handler)
2796 {
2797         struct neigh_sysctl_table *t;
2798         const char *dev_name_source = NULL;
2799
2800 #define NEIGH_CTL_PATH_ROOT     0
2801 #define NEIGH_CTL_PATH_PROTO    1
2802 #define NEIGH_CTL_PATH_NEIGH    2
2803 #define NEIGH_CTL_PATH_DEV      3
2804
2805         struct ctl_path neigh_path[] = {
2806                 { .procname = "net",     },
2807                 { .procname = "proto",   },
2808                 { .procname = "neigh",   },
2809                 { .procname = "default", },
2810                 { },
2811         };
2812
2813         t = kmemdup(&neigh_sysctl_template, sizeof(*t), GFP_KERNEL);
2814         if (!t)
2815                 goto err;
2816
2817         t->neigh_vars[0].data  = &p->mcast_probes;
2818         t->neigh_vars[1].data  = &p->ucast_probes;
2819         t->neigh_vars[2].data  = &p->app_probes;
2820         t->neigh_vars[3].data  = &p->retrans_time;
2821         t->neigh_vars[4].data  = &p->base_reachable_time;
2822         t->neigh_vars[5].data  = &p->delay_probe_time;
2823         t->neigh_vars[6].data  = &p->gc_staletime;
2824         t->neigh_vars[7].data  = &p->queue_len;
2825         t->neigh_vars[8].data  = &p->proxy_qlen;
2826         t->neigh_vars[9].data  = &p->anycast_delay;
2827         t->neigh_vars[10].data = &p->proxy_delay;
2828         t->neigh_vars[11].data = &p->locktime;
2829         t->neigh_vars[12].data  = &p->retrans_time;
2830         t->neigh_vars[13].data  = &p->base_reachable_time;
2831
2832         if (dev) {
2833                 dev_name_source = dev->name;
2834                 /* Terminate the table early */
2835                 memset(&t->neigh_vars[14], 0, sizeof(t->neigh_vars[14]));
2836         } else {
2837                 dev_name_source = neigh_path[NEIGH_CTL_PATH_DEV].procname;
2838                 t->neigh_vars[14].data = (int *)(p + 1);
2839                 t->neigh_vars[15].data = (int *)(p + 1) + 1;
2840                 t->neigh_vars[16].data = (int *)(p + 1) + 2;
2841                 t->neigh_vars[17].data = (int *)(p + 1) + 3;
2842         }
2843
2844
2845         if (handler) {
2846                 /* RetransTime */
2847                 t->neigh_vars[3].proc_handler = handler;
2848                 t->neigh_vars[3].extra1 = dev;
2849                 /* ReachableTime */
2850                 t->neigh_vars[4].proc_handler = handler;
2851                 t->neigh_vars[4].extra1 = dev;
2852                 /* RetransTime (in milliseconds)*/
2853                 t->neigh_vars[12].proc_handler = handler;
2854                 t->neigh_vars[12].extra1 = dev;
2855                 /* ReachableTime (in milliseconds) */
2856                 t->neigh_vars[13].proc_handler = handler;
2857                 t->neigh_vars[13].extra1 = dev;
2858         }
2859
2860         t->dev_name = kstrdup(dev_name_source, GFP_KERNEL);
2861         if (!t->dev_name)
2862                 goto free;
2863
2864         neigh_path[NEIGH_CTL_PATH_DEV].procname = t->dev_name;
2865         neigh_path[NEIGH_CTL_PATH_PROTO].procname = p_name;
2866
2867         t->sysctl_header =
2868                 register_net_sysctl_table(neigh_parms_net(p), neigh_path, t->neigh_vars);
2869         if (!t->sysctl_header)
2870                 goto free_procname;
2871
2872         p->sysctl_table = t;
2873         return 0;
2874
2875 free_procname:
2876         kfree(t->dev_name);
2877 free:
2878         kfree(t);
2879 err:
2880         return -ENOBUFS;
2881 }
2882 EXPORT_SYMBOL(neigh_sysctl_register);
2883
2884 void neigh_sysctl_unregister(struct neigh_parms *p)
2885 {
2886         if (p->sysctl_table) {
2887                 struct neigh_sysctl_table *t = p->sysctl_table;
2888                 p->sysctl_table = NULL;
2889                 unregister_sysctl_table(t->sysctl_header);
2890                 kfree(t->dev_name);
2891                 kfree(t);
2892         }
2893 }
2894 EXPORT_SYMBOL(neigh_sysctl_unregister);
2895
2896 #endif  /* CONFIG_SYSCTL */
2897
2898 static int __init neigh_init(void)
2899 {
2900         rtnl_register(PF_UNSPEC, RTM_NEWNEIGH, neigh_add, NULL);
2901         rtnl_register(PF_UNSPEC, RTM_DELNEIGH, neigh_delete, NULL);
2902         rtnl_register(PF_UNSPEC, RTM_GETNEIGH, NULL, neigh_dump_info);
2903
2904         rtnl_register(PF_UNSPEC, RTM_GETNEIGHTBL, NULL, neightbl_dump_info);
2905         rtnl_register(PF_UNSPEC, RTM_SETNEIGHTBL, neightbl_set, NULL);
2906
2907         return 0;
2908 }
2909
2910 subsys_initcall(neigh_init);
2911