xref: /linux/net/core/neighbour.c (revision 5d4a2e29fba5b2bef95b96a46b338ec4d76fa4fd)
1 /*
2  *	Generic address resolution entity
3  *
4  *	Authors:
5  *	Pedro Roque		<roque@di.fc.ul.pt>
6  *	Alexey Kuznetsov	<kuznet@ms2.inr.ac.ru>
7  *
8  *	This program is free software; you can redistribute it and/or
9  *      modify it under the terms of the GNU General Public License
10  *      as published by the Free Software Foundation; either version
11  *      2 of the License, or (at your option) any later version.
12  *
13  *	Fixes:
14  *	Vitaly E. Lavrov	releasing NULL neighbor in neigh_add.
15  *	Harald Welte		Add neighbour cache statistics like rtstat
16  */
17 
18 #include <linux/slab.h>
19 #include <linux/types.h>
20 #include <linux/kernel.h>
21 #include <linux/module.h>
22 #include <linux/socket.h>
23 #include <linux/netdevice.h>
24 #include <linux/proc_fs.h>
25 #ifdef CONFIG_SYSCTL
26 #include <linux/sysctl.h>
27 #endif
28 #include <linux/times.h>
29 #include <net/net_namespace.h>
30 #include <net/neighbour.h>
31 #include <net/dst.h>
32 #include <net/sock.h>
33 #include <net/netevent.h>
34 #include <net/netlink.h>
35 #include <linux/rtnetlink.h>
36 #include <linux/random.h>
37 #include <linux/string.h>
38 #include <linux/log2.h>
39 
40 #define NEIGH_DEBUG 1
41 
42 #define NEIGH_PRINTK(x...) printk(x)
43 #define NEIGH_NOPRINTK(x...) do { ; } while(0)
44 #define NEIGH_PRINTK0 NEIGH_PRINTK
45 #define NEIGH_PRINTK1 NEIGH_NOPRINTK
46 #define NEIGH_PRINTK2 NEIGH_NOPRINTK
47 
48 #if NEIGH_DEBUG >= 1
49 #undef NEIGH_PRINTK1
50 #define NEIGH_PRINTK1 NEIGH_PRINTK
51 #endif
52 #if NEIGH_DEBUG >= 2
53 #undef NEIGH_PRINTK2
54 #define NEIGH_PRINTK2 NEIGH_PRINTK
55 #endif
56 
57 #define PNEIGH_HASHMASK		0xF
58 
59 static void neigh_timer_handler(unsigned long arg);
60 static void __neigh_notify(struct neighbour *n, int type, int flags);
61 static void neigh_update_notify(struct neighbour *neigh);
62 static int pneigh_ifdown(struct neigh_table *tbl, struct net_device *dev);
63 
64 static struct neigh_table *neigh_tables;
65 #ifdef CONFIG_PROC_FS
66 static const struct file_operations neigh_stat_seq_fops;
67 #endif
68 
69 /*
70    Neighbour hash table buckets are protected with rwlock tbl->lock.
71 
72    - All the scans/updates to hash buckets MUST be made under this lock.
73    - NOTHING clever should be made under this lock: no callbacks
74      to protocol backends, no attempts to send something to network.
75      It will result in deadlocks, if backend/driver wants to use neighbour
76      cache.
77    - If the entry requires some non-trivial actions, increase
78      its reference count and release table lock.
79 
80    Neighbour entries are protected:
81    - with reference count.
82    - with rwlock neigh->lock
83 
84    Reference count prevents destruction.
85 
86    neigh->lock mainly serializes ll address data and its validity state.
87    However, the same lock is used to protect another entry fields:
88     - timer
89     - resolution queue
90 
91    Again, nothing clever shall be made under neigh->lock,
92    the most complicated procedure, which we allow is dev->hard_header.
93    It is supposed, that dev->hard_header is simplistic and does
94    not make callbacks to neighbour tables.
95 
96    The last lock is neigh_tbl_lock. It is pure SMP lock, protecting
97    list of neighbour tables. This list is used only in process context,
98  */
99 
100 static DEFINE_RWLOCK(neigh_tbl_lock);
101 
102 static int neigh_blackhole(struct sk_buff *skb)
103 {
104 	kfree_skb(skb);
105 	return -ENETDOWN;
106 }
107 
108 static void neigh_cleanup_and_release(struct neighbour *neigh)
109 {
110 	if (neigh->parms->neigh_cleanup)
111 		neigh->parms->neigh_cleanup(neigh);
112 
113 	__neigh_notify(neigh, RTM_DELNEIGH, 0);
114 	neigh_release(neigh);
115 }
116 
117 /*
118  * It is random distribution in the interval (1/2)*base...(3/2)*base.
119  * It corresponds to default IPv6 settings and is not overridable,
120  * because it is really reasonable choice.
121  */
122 
123 unsigned long neigh_rand_reach_time(unsigned long base)
124 {
125 	return (base ? (net_random() % base) + (base >> 1) : 0);
126 }
127 EXPORT_SYMBOL(neigh_rand_reach_time);
128 
129 
130 static int neigh_forced_gc(struct neigh_table *tbl)
131 {
132 	int shrunk = 0;
133 	int i;
134 
135 	NEIGH_CACHE_STAT_INC(tbl, forced_gc_runs);
136 
137 	write_lock_bh(&tbl->lock);
138 	for (i = 0; i <= tbl->hash_mask; i++) {
139 		struct neighbour *n, **np;
140 
141 		np = &tbl->hash_buckets[i];
142 		while ((n = *np) != NULL) {
143 			/* Neighbour record may be discarded if:
144 			 * - nobody refers to it.
145 			 * - it is not permanent
146 			 */
147 			write_lock(&n->lock);
148 			if (atomic_read(&n->refcnt) == 1 &&
149 			    !(n->nud_state & NUD_PERMANENT)) {
150 				*np	= n->next;
151 				n->dead = 1;
152 				shrunk	= 1;
153 				write_unlock(&n->lock);
154 				neigh_cleanup_and_release(n);
155 				continue;
156 			}
157 			write_unlock(&n->lock);
158 			np = &n->next;
159 		}
160 	}
161 
162 	tbl->last_flush = jiffies;
163 
164 	write_unlock_bh(&tbl->lock);
165 
166 	return shrunk;
167 }
168 
169 static void neigh_add_timer(struct neighbour *n, unsigned long when)
170 {
171 	neigh_hold(n);
172 	if (unlikely(mod_timer(&n->timer, when))) {
173 		printk("NEIGH: BUG, double timer add, state is %x\n",
174 		       n->nud_state);
175 		dump_stack();
176 	}
177 }
178 
179 static int neigh_del_timer(struct neighbour *n)
180 {
181 	if ((n->nud_state & NUD_IN_TIMER) &&
182 	    del_timer(&n->timer)) {
183 		neigh_release(n);
184 		return 1;
185 	}
186 	return 0;
187 }
188 
189 static void pneigh_queue_purge(struct sk_buff_head *list)
190 {
191 	struct sk_buff *skb;
192 
193 	while ((skb = skb_dequeue(list)) != NULL) {
194 		dev_put(skb->dev);
195 		kfree_skb(skb);
196 	}
197 }
198 
199 static void neigh_flush_dev(struct neigh_table *tbl, struct net_device *dev)
200 {
201 	int i;
202 
203 	for (i = 0; i <= tbl->hash_mask; i++) {
204 		struct neighbour *n, **np = &tbl->hash_buckets[i];
205 
206 		while ((n = *np) != NULL) {
207 			if (dev && n->dev != dev) {
208 				np = &n->next;
209 				continue;
210 			}
211 			*np = n->next;
212 			write_lock(&n->lock);
213 			neigh_del_timer(n);
214 			n->dead = 1;
215 
216 			if (atomic_read(&n->refcnt) != 1) {
217 				/* The most unpleasant situation.
218 				   We must destroy neighbour entry,
219 				   but someone still uses it.
220 
221 				   The destroy will be delayed until
222 				   the last user releases us, but
223 				   we must kill timers etc. and move
224 				   it to safe state.
225 				 */
226 				skb_queue_purge(&n->arp_queue);
227 				n->output = neigh_blackhole;
228 				if (n->nud_state & NUD_VALID)
229 					n->nud_state = NUD_NOARP;
230 				else
231 					n->nud_state = NUD_NONE;
232 				NEIGH_PRINTK2("neigh %p is stray.\n", n);
233 			}
234 			write_unlock(&n->lock);
235 			neigh_cleanup_and_release(n);
236 		}
237 	}
238 }
239 
240 void neigh_changeaddr(struct neigh_table *tbl, struct net_device *dev)
241 {
242 	write_lock_bh(&tbl->lock);
243 	neigh_flush_dev(tbl, dev);
244 	write_unlock_bh(&tbl->lock);
245 }
246 EXPORT_SYMBOL(neigh_changeaddr);
247 
248 int neigh_ifdown(struct neigh_table *tbl, struct net_device *dev)
249 {
250 	write_lock_bh(&tbl->lock);
251 	neigh_flush_dev(tbl, dev);
252 	pneigh_ifdown(tbl, dev);
253 	write_unlock_bh(&tbl->lock);
254 
255 	del_timer_sync(&tbl->proxy_timer);
256 	pneigh_queue_purge(&tbl->proxy_queue);
257 	return 0;
258 }
259 EXPORT_SYMBOL(neigh_ifdown);
260 
261 static struct neighbour *neigh_alloc(struct neigh_table *tbl)
262 {
263 	struct neighbour *n = NULL;
264 	unsigned long now = jiffies;
265 	int entries;
266 
267 	entries = atomic_inc_return(&tbl->entries) - 1;
268 	if (entries >= tbl->gc_thresh3 ||
269 	    (entries >= tbl->gc_thresh2 &&
270 	     time_after(now, tbl->last_flush + 5 * HZ))) {
271 		if (!neigh_forced_gc(tbl) &&
272 		    entries >= tbl->gc_thresh3)
273 			goto out_entries;
274 	}
275 
276 	n = kmem_cache_zalloc(tbl->kmem_cachep, GFP_ATOMIC);
277 	if (!n)
278 		goto out_entries;
279 
280 	skb_queue_head_init(&n->arp_queue);
281 	rwlock_init(&n->lock);
282 	n->updated	  = n->used = now;
283 	n->nud_state	  = NUD_NONE;
284 	n->output	  = neigh_blackhole;
285 	n->parms	  = neigh_parms_clone(&tbl->parms);
286 	setup_timer(&n->timer, neigh_timer_handler, (unsigned long)n);
287 
288 	NEIGH_CACHE_STAT_INC(tbl, allocs);
289 	n->tbl		  = tbl;
290 	atomic_set(&n->refcnt, 1);
291 	n->dead		  = 1;
292 out:
293 	return n;
294 
295 out_entries:
296 	atomic_dec(&tbl->entries);
297 	goto out;
298 }
299 
300 static struct neighbour **neigh_hash_alloc(unsigned int entries)
301 {
302 	unsigned long size = entries * sizeof(struct neighbour *);
303 	struct neighbour **ret;
304 
305 	if (size <= PAGE_SIZE) {
306 		ret = kzalloc(size, GFP_ATOMIC);
307 	} else {
308 		ret = (struct neighbour **)
309 		      __get_free_pages(GFP_ATOMIC|__GFP_ZERO, get_order(size));
310 	}
311 	return ret;
312 }
313 
314 static void neigh_hash_free(struct neighbour **hash, unsigned int entries)
315 {
316 	unsigned long size = entries * sizeof(struct neighbour *);
317 
318 	if (size <= PAGE_SIZE)
319 		kfree(hash);
320 	else
321 		free_pages((unsigned long)hash, get_order(size));
322 }
323 
324 static void neigh_hash_grow(struct neigh_table *tbl, unsigned long new_entries)
325 {
326 	struct neighbour **new_hash, **old_hash;
327 	unsigned int i, new_hash_mask, old_entries;
328 
329 	NEIGH_CACHE_STAT_INC(tbl, hash_grows);
330 
331 	BUG_ON(!is_power_of_2(new_entries));
332 	new_hash = neigh_hash_alloc(new_entries);
333 	if (!new_hash)
334 		return;
335 
336 	old_entries = tbl->hash_mask + 1;
337 	new_hash_mask = new_entries - 1;
338 	old_hash = tbl->hash_buckets;
339 
340 	get_random_bytes(&tbl->hash_rnd, sizeof(tbl->hash_rnd));
341 	for (i = 0; i < old_entries; i++) {
342 		struct neighbour *n, *next;
343 
344 		for (n = old_hash[i]; n; n = next) {
345 			unsigned int hash_val = tbl->hash(n->primary_key, n->dev);
346 
347 			hash_val &= new_hash_mask;
348 			next = n->next;
349 
350 			n->next = new_hash[hash_val];
351 			new_hash[hash_val] = n;
352 		}
353 	}
354 	tbl->hash_buckets = new_hash;
355 	tbl->hash_mask = new_hash_mask;
356 
357 	neigh_hash_free(old_hash, old_entries);
358 }
359 
360 struct neighbour *neigh_lookup(struct neigh_table *tbl, const void *pkey,
361 			       struct net_device *dev)
362 {
363 	struct neighbour *n;
364 	int key_len = tbl->key_len;
365 	u32 hash_val;
366 
367 	NEIGH_CACHE_STAT_INC(tbl, lookups);
368 
369 	read_lock_bh(&tbl->lock);
370 	hash_val = tbl->hash(pkey, dev);
371 	for (n = tbl->hash_buckets[hash_val & tbl->hash_mask]; n; n = n->next) {
372 		if (dev == n->dev && !memcmp(n->primary_key, pkey, key_len)) {
373 			neigh_hold(n);
374 			NEIGH_CACHE_STAT_INC(tbl, hits);
375 			break;
376 		}
377 	}
378 	read_unlock_bh(&tbl->lock);
379 	return n;
380 }
381 EXPORT_SYMBOL(neigh_lookup);
382 
383 struct neighbour *neigh_lookup_nodev(struct neigh_table *tbl, struct net *net,
384 				     const void *pkey)
385 {
386 	struct neighbour *n;
387 	int key_len = tbl->key_len;
388 	u32 hash_val;
389 
390 	NEIGH_CACHE_STAT_INC(tbl, lookups);
391 
392 	read_lock_bh(&tbl->lock);
393 	hash_val = tbl->hash(pkey, NULL);
394 	for (n = tbl->hash_buckets[hash_val & tbl->hash_mask]; n; n = n->next) {
395 		if (!memcmp(n->primary_key, pkey, key_len) &&
396 		    net_eq(dev_net(n->dev), net)) {
397 			neigh_hold(n);
398 			NEIGH_CACHE_STAT_INC(tbl, hits);
399 			break;
400 		}
401 	}
402 	read_unlock_bh(&tbl->lock);
403 	return n;
404 }
405 EXPORT_SYMBOL(neigh_lookup_nodev);
406 
407 struct neighbour *neigh_create(struct neigh_table *tbl, const void *pkey,
408 			       struct net_device *dev)
409 {
410 	u32 hash_val;
411 	int key_len = tbl->key_len;
412 	int error;
413 	struct neighbour *n1, *rc, *n = neigh_alloc(tbl);
414 
415 	if (!n) {
416 		rc = ERR_PTR(-ENOBUFS);
417 		goto out;
418 	}
419 
420 	memcpy(n->primary_key, pkey, key_len);
421 	n->dev = dev;
422 	dev_hold(dev);
423 
424 	/* Protocol specific setup. */
425 	if (tbl->constructor &&	(error = tbl->constructor(n)) < 0) {
426 		rc = ERR_PTR(error);
427 		goto out_neigh_release;
428 	}
429 
430 	/* Device specific setup. */
431 	if (n->parms->neigh_setup &&
432 	    (error = n->parms->neigh_setup(n)) < 0) {
433 		rc = ERR_PTR(error);
434 		goto out_neigh_release;
435 	}
436 
437 	n->confirmed = jiffies - (n->parms->base_reachable_time << 1);
438 
439 	write_lock_bh(&tbl->lock);
440 
441 	if (atomic_read(&tbl->entries) > (tbl->hash_mask + 1))
442 		neigh_hash_grow(tbl, (tbl->hash_mask + 1) << 1);
443 
444 	hash_val = tbl->hash(pkey, dev) & tbl->hash_mask;
445 
446 	if (n->parms->dead) {
447 		rc = ERR_PTR(-EINVAL);
448 		goto out_tbl_unlock;
449 	}
450 
451 	for (n1 = tbl->hash_buckets[hash_val]; n1; n1 = n1->next) {
452 		if (dev == n1->dev && !memcmp(n1->primary_key, pkey, key_len)) {
453 			neigh_hold(n1);
454 			rc = n1;
455 			goto out_tbl_unlock;
456 		}
457 	}
458 
459 	n->next = tbl->hash_buckets[hash_val];
460 	tbl->hash_buckets[hash_val] = n;
461 	n->dead = 0;
462 	neigh_hold(n);
463 	write_unlock_bh(&tbl->lock);
464 	NEIGH_PRINTK2("neigh %p is created.\n", n);
465 	rc = n;
466 out:
467 	return rc;
468 out_tbl_unlock:
469 	write_unlock_bh(&tbl->lock);
470 out_neigh_release:
471 	neigh_release(n);
472 	goto out;
473 }
474 EXPORT_SYMBOL(neigh_create);
475 
476 static u32 pneigh_hash(const void *pkey, int key_len)
477 {
478 	u32 hash_val = *(u32 *)(pkey + key_len - 4);
479 	hash_val ^= (hash_val >> 16);
480 	hash_val ^= hash_val >> 8;
481 	hash_val ^= hash_val >> 4;
482 	hash_val &= PNEIGH_HASHMASK;
483 	return hash_val;
484 }
485 
486 static struct pneigh_entry *__pneigh_lookup_1(struct pneigh_entry *n,
487 					      struct net *net,
488 					      const void *pkey,
489 					      int key_len,
490 					      struct net_device *dev)
491 {
492 	while (n) {
493 		if (!memcmp(n->key, pkey, key_len) &&
494 		    net_eq(pneigh_net(n), net) &&
495 		    (n->dev == dev || !n->dev))
496 			return n;
497 		n = n->next;
498 	}
499 	return NULL;
500 }
501 
502 struct pneigh_entry *__pneigh_lookup(struct neigh_table *tbl,
503 		struct net *net, const void *pkey, struct net_device *dev)
504 {
505 	int key_len = tbl->key_len;
506 	u32 hash_val = pneigh_hash(pkey, key_len);
507 
508 	return __pneigh_lookup_1(tbl->phash_buckets[hash_val],
509 				 net, pkey, key_len, dev);
510 }
511 EXPORT_SYMBOL_GPL(__pneigh_lookup);
512 
513 struct pneigh_entry * pneigh_lookup(struct neigh_table *tbl,
514 				    struct net *net, const void *pkey,
515 				    struct net_device *dev, int creat)
516 {
517 	struct pneigh_entry *n;
518 	int key_len = tbl->key_len;
519 	u32 hash_val = pneigh_hash(pkey, key_len);
520 
521 	read_lock_bh(&tbl->lock);
522 	n = __pneigh_lookup_1(tbl->phash_buckets[hash_val],
523 			      net, pkey, key_len, dev);
524 	read_unlock_bh(&tbl->lock);
525 
526 	if (n || !creat)
527 		goto out;
528 
529 	ASSERT_RTNL();
530 
531 	n = kmalloc(sizeof(*n) + key_len, GFP_KERNEL);
532 	if (!n)
533 		goto out;
534 
535 	write_pnet(&n->net, hold_net(net));
536 	memcpy(n->key, pkey, key_len);
537 	n->dev = dev;
538 	if (dev)
539 		dev_hold(dev);
540 
541 	if (tbl->pconstructor && tbl->pconstructor(n)) {
542 		if (dev)
543 			dev_put(dev);
544 		release_net(net);
545 		kfree(n);
546 		n = NULL;
547 		goto out;
548 	}
549 
550 	write_lock_bh(&tbl->lock);
551 	n->next = tbl->phash_buckets[hash_val];
552 	tbl->phash_buckets[hash_val] = n;
553 	write_unlock_bh(&tbl->lock);
554 out:
555 	return n;
556 }
557 EXPORT_SYMBOL(pneigh_lookup);
558 
559 
560 int pneigh_delete(struct neigh_table *tbl, struct net *net, const void *pkey,
561 		  struct net_device *dev)
562 {
563 	struct pneigh_entry *n, **np;
564 	int key_len = tbl->key_len;
565 	u32 hash_val = pneigh_hash(pkey, key_len);
566 
567 	write_lock_bh(&tbl->lock);
568 	for (np = &tbl->phash_buckets[hash_val]; (n = *np) != NULL;
569 	     np = &n->next) {
570 		if (!memcmp(n->key, pkey, key_len) && n->dev == dev &&
571 		    net_eq(pneigh_net(n), net)) {
572 			*np = n->next;
573 			write_unlock_bh(&tbl->lock);
574 			if (tbl->pdestructor)
575 				tbl->pdestructor(n);
576 			if (n->dev)
577 				dev_put(n->dev);
578 			release_net(pneigh_net(n));
579 			kfree(n);
580 			return 0;
581 		}
582 	}
583 	write_unlock_bh(&tbl->lock);
584 	return -ENOENT;
585 }
586 
587 static int pneigh_ifdown(struct neigh_table *tbl, struct net_device *dev)
588 {
589 	struct pneigh_entry *n, **np;
590 	u32 h;
591 
592 	for (h = 0; h <= PNEIGH_HASHMASK; h++) {
593 		np = &tbl->phash_buckets[h];
594 		while ((n = *np) != NULL) {
595 			if (!dev || n->dev == dev) {
596 				*np = n->next;
597 				if (tbl->pdestructor)
598 					tbl->pdestructor(n);
599 				if (n->dev)
600 					dev_put(n->dev);
601 				release_net(pneigh_net(n));
602 				kfree(n);
603 				continue;
604 			}
605 			np = &n->next;
606 		}
607 	}
608 	return -ENOENT;
609 }
610 
611 static void neigh_parms_destroy(struct neigh_parms *parms);
612 
613 static inline void neigh_parms_put(struct neigh_parms *parms)
614 {
615 	if (atomic_dec_and_test(&parms->refcnt))
616 		neigh_parms_destroy(parms);
617 }
618 
619 /*
620  *	neighbour must already be out of the table;
621  *
622  */
623 void neigh_destroy(struct neighbour *neigh)
624 {
625 	struct hh_cache *hh;
626 
627 	NEIGH_CACHE_STAT_INC(neigh->tbl, destroys);
628 
629 	if (!neigh->dead) {
630 		printk(KERN_WARNING
631 		       "Destroying alive neighbour %p\n", neigh);
632 		dump_stack();
633 		return;
634 	}
635 
636 	if (neigh_del_timer(neigh))
637 		printk(KERN_WARNING "Impossible event.\n");
638 
639 	while ((hh = neigh->hh) != NULL) {
640 		neigh->hh = hh->hh_next;
641 		hh->hh_next = NULL;
642 
643 		write_seqlock_bh(&hh->hh_lock);
644 		hh->hh_output = neigh_blackhole;
645 		write_sequnlock_bh(&hh->hh_lock);
646 		if (atomic_dec_and_test(&hh->hh_refcnt))
647 			kfree(hh);
648 	}
649 
650 	skb_queue_purge(&neigh->arp_queue);
651 
652 	dev_put(neigh->dev);
653 	neigh_parms_put(neigh->parms);
654 
655 	NEIGH_PRINTK2("neigh %p is destroyed.\n", neigh);
656 
657 	atomic_dec(&neigh->tbl->entries);
658 	kmem_cache_free(neigh->tbl->kmem_cachep, neigh);
659 }
660 EXPORT_SYMBOL(neigh_destroy);
661 
662 /* Neighbour state is suspicious;
663    disable fast path.
664 
665    Called with write_locked neigh.
666  */
667 static void neigh_suspect(struct neighbour *neigh)
668 {
669 	struct hh_cache *hh;
670 
671 	NEIGH_PRINTK2("neigh %p is suspected.\n", neigh);
672 
673 	neigh->output = neigh->ops->output;
674 
675 	for (hh = neigh->hh; hh; hh = hh->hh_next)
676 		hh->hh_output = neigh->ops->output;
677 }
678 
679 /* Neighbour state is OK;
680    enable fast path.
681 
682    Called with write_locked neigh.
683  */
684 static void neigh_connect(struct neighbour *neigh)
685 {
686 	struct hh_cache *hh;
687 
688 	NEIGH_PRINTK2("neigh %p is connected.\n", neigh);
689 
690 	neigh->output = neigh->ops->connected_output;
691 
692 	for (hh = neigh->hh; hh; hh = hh->hh_next)
693 		hh->hh_output = neigh->ops->hh_output;
694 }
695 
696 static void neigh_periodic_work(struct work_struct *work)
697 {
698 	struct neigh_table *tbl = container_of(work, struct neigh_table, gc_work.work);
699 	struct neighbour *n, **np;
700 	unsigned int i;
701 
702 	NEIGH_CACHE_STAT_INC(tbl, periodic_gc_runs);
703 
704 	write_lock_bh(&tbl->lock);
705 
706 	/*
707 	 *	periodically recompute ReachableTime from random function
708 	 */
709 
710 	if (time_after(jiffies, tbl->last_rand + 300 * HZ)) {
711 		struct neigh_parms *p;
712 		tbl->last_rand = jiffies;
713 		for (p = &tbl->parms; p; p = p->next)
714 			p->reachable_time =
715 				neigh_rand_reach_time(p->base_reachable_time);
716 	}
717 
718 	for (i = 0 ; i <= tbl->hash_mask; i++) {
719 		np = &tbl->hash_buckets[i];
720 
721 		while ((n = *np) != NULL) {
722 			unsigned int state;
723 
724 			write_lock(&n->lock);
725 
726 			state = n->nud_state;
727 			if (state & (NUD_PERMANENT | NUD_IN_TIMER)) {
728 				write_unlock(&n->lock);
729 				goto next_elt;
730 			}
731 
732 			if (time_before(n->used, n->confirmed))
733 				n->used = n->confirmed;
734 
735 			if (atomic_read(&n->refcnt) == 1 &&
736 			    (state == NUD_FAILED ||
737 			     time_after(jiffies, n->used + n->parms->gc_staletime))) {
738 				*np = n->next;
739 				n->dead = 1;
740 				write_unlock(&n->lock);
741 				neigh_cleanup_and_release(n);
742 				continue;
743 			}
744 			write_unlock(&n->lock);
745 
746 next_elt:
747 			np = &n->next;
748 		}
749 		/*
750 		 * It's fine to release lock here, even if hash table
751 		 * grows while we are preempted.
752 		 */
753 		write_unlock_bh(&tbl->lock);
754 		cond_resched();
755 		write_lock_bh(&tbl->lock);
756 	}
757 	/* Cycle through all hash buckets every base_reachable_time/2 ticks.
758 	 * ARP entry timeouts range from 1/2 base_reachable_time to 3/2
759 	 * base_reachable_time.
760 	 */
761 	schedule_delayed_work(&tbl->gc_work,
762 			      tbl->parms.base_reachable_time >> 1);
763 	write_unlock_bh(&tbl->lock);
764 }
765 
766 static __inline__ int neigh_max_probes(struct neighbour *n)
767 {
768 	struct neigh_parms *p = n->parms;
769 	return (n->nud_state & NUD_PROBE ?
770 		p->ucast_probes :
771 		p->ucast_probes + p->app_probes + p->mcast_probes);
772 }
773 
774 static void neigh_invalidate(struct neighbour *neigh)
775 	__releases(neigh->lock)
776 	__acquires(neigh->lock)
777 {
778 	struct sk_buff *skb;
779 
780 	NEIGH_CACHE_STAT_INC(neigh->tbl, res_failed);
781 	NEIGH_PRINTK2("neigh %p is failed.\n", neigh);
782 	neigh->updated = jiffies;
783 
784 	/* It is very thin place. report_unreachable is very complicated
785 	   routine. Particularly, it can hit the same neighbour entry!
786 
787 	   So that, we try to be accurate and avoid dead loop. --ANK
788 	 */
789 	while (neigh->nud_state == NUD_FAILED &&
790 	       (skb = __skb_dequeue(&neigh->arp_queue)) != NULL) {
791 		write_unlock(&neigh->lock);
792 		neigh->ops->error_report(neigh, skb);
793 		write_lock(&neigh->lock);
794 	}
795 	skb_queue_purge(&neigh->arp_queue);
796 }
797 
798 /* Called when a timer expires for a neighbour entry. */
799 
800 static void neigh_timer_handler(unsigned long arg)
801 {
802 	unsigned long now, next;
803 	struct neighbour *neigh = (struct neighbour *)arg;
804 	unsigned state;
805 	int notify = 0;
806 
807 	write_lock(&neigh->lock);
808 
809 	state = neigh->nud_state;
810 	now = jiffies;
811 	next = now + HZ;
812 
813 	if (!(state & NUD_IN_TIMER)) {
814 #ifndef CONFIG_SMP
815 		printk(KERN_WARNING "neigh: timer & !nud_in_timer\n");
816 #endif
817 		goto out;
818 	}
819 
820 	if (state & NUD_REACHABLE) {
821 		if (time_before_eq(now,
822 				   neigh->confirmed + neigh->parms->reachable_time)) {
823 			NEIGH_PRINTK2("neigh %p is still alive.\n", neigh);
824 			next = neigh->confirmed + neigh->parms->reachable_time;
825 		} else if (time_before_eq(now,
826 					  neigh->used + neigh->parms->delay_probe_time)) {
827 			NEIGH_PRINTK2("neigh %p is delayed.\n", neigh);
828 			neigh->nud_state = NUD_DELAY;
829 			neigh->updated = jiffies;
830 			neigh_suspect(neigh);
831 			next = now + neigh->parms->delay_probe_time;
832 		} else {
833 			NEIGH_PRINTK2("neigh %p is suspected.\n", neigh);
834 			neigh->nud_state = NUD_STALE;
835 			neigh->updated = jiffies;
836 			neigh_suspect(neigh);
837 			notify = 1;
838 		}
839 	} else if (state & NUD_DELAY) {
840 		if (time_before_eq(now,
841 				   neigh->confirmed + neigh->parms->delay_probe_time)) {
842 			NEIGH_PRINTK2("neigh %p is now reachable.\n", neigh);
843 			neigh->nud_state = NUD_REACHABLE;
844 			neigh->updated = jiffies;
845 			neigh_connect(neigh);
846 			notify = 1;
847 			next = neigh->confirmed + neigh->parms->reachable_time;
848 		} else {
849 			NEIGH_PRINTK2("neigh %p is probed.\n", neigh);
850 			neigh->nud_state = NUD_PROBE;
851 			neigh->updated = jiffies;
852 			atomic_set(&neigh->probes, 0);
853 			next = now + neigh->parms->retrans_time;
854 		}
855 	} else {
856 		/* NUD_PROBE|NUD_INCOMPLETE */
857 		next = now + neigh->parms->retrans_time;
858 	}
859 
860 	if ((neigh->nud_state & (NUD_INCOMPLETE | NUD_PROBE)) &&
861 	    atomic_read(&neigh->probes) >= neigh_max_probes(neigh)) {
862 		neigh->nud_state = NUD_FAILED;
863 		notify = 1;
864 		neigh_invalidate(neigh);
865 	}
866 
867 	if (neigh->nud_state & NUD_IN_TIMER) {
868 		if (time_before(next, jiffies + HZ/2))
869 			next = jiffies + HZ/2;
870 		if (!mod_timer(&neigh->timer, next))
871 			neigh_hold(neigh);
872 	}
873 	if (neigh->nud_state & (NUD_INCOMPLETE | NUD_PROBE)) {
874 		struct sk_buff *skb = skb_peek(&neigh->arp_queue);
875 		/* keep skb alive even if arp_queue overflows */
876 		if (skb)
877 			skb = skb_copy(skb, GFP_ATOMIC);
878 		write_unlock(&neigh->lock);
879 		neigh->ops->solicit(neigh, skb);
880 		atomic_inc(&neigh->probes);
881 		kfree_skb(skb);
882 	} else {
883 out:
884 		write_unlock(&neigh->lock);
885 	}
886 
887 	if (notify)
888 		neigh_update_notify(neigh);
889 
890 	neigh_release(neigh);
891 }
892 
893 int __neigh_event_send(struct neighbour *neigh, struct sk_buff *skb)
894 {
895 	int rc;
896 	unsigned long now;
897 
898 	write_lock_bh(&neigh->lock);
899 
900 	rc = 0;
901 	if (neigh->nud_state & (NUD_CONNECTED | NUD_DELAY | NUD_PROBE))
902 		goto out_unlock_bh;
903 
904 	now = jiffies;
905 
906 	if (!(neigh->nud_state & (NUD_STALE | NUD_INCOMPLETE))) {
907 		if (neigh->parms->mcast_probes + neigh->parms->app_probes) {
908 			atomic_set(&neigh->probes, neigh->parms->ucast_probes);
909 			neigh->nud_state     = NUD_INCOMPLETE;
910 			neigh->updated = jiffies;
911 			neigh_add_timer(neigh, now + 1);
912 		} else {
913 			neigh->nud_state = NUD_FAILED;
914 			neigh->updated = jiffies;
915 			write_unlock_bh(&neigh->lock);
916 
917 			kfree_skb(skb);
918 			return 1;
919 		}
920 	} else if (neigh->nud_state & NUD_STALE) {
921 		NEIGH_PRINTK2("neigh %p is delayed.\n", neigh);
922 		neigh->nud_state = NUD_DELAY;
923 		neigh->updated = jiffies;
924 		neigh_add_timer(neigh,
925 				jiffies + neigh->parms->delay_probe_time);
926 	}
927 
928 	if (neigh->nud_state == NUD_INCOMPLETE) {
929 		if (skb) {
930 			if (skb_queue_len(&neigh->arp_queue) >=
931 			    neigh->parms->queue_len) {
932 				struct sk_buff *buff;
933 				buff = __skb_dequeue(&neigh->arp_queue);
934 				kfree_skb(buff);
935 				NEIGH_CACHE_STAT_INC(neigh->tbl, unres_discards);
936 			}
937 			skb_dst_force(skb);
938 			__skb_queue_tail(&neigh->arp_queue, skb);
939 		}
940 		rc = 1;
941 	}
942 out_unlock_bh:
943 	write_unlock_bh(&neigh->lock);
944 	return rc;
945 }
946 EXPORT_SYMBOL(__neigh_event_send);
947 
948 static void neigh_update_hhs(struct neighbour *neigh)
949 {
950 	struct hh_cache *hh;
951 	void (*update)(struct hh_cache*, const struct net_device*, const unsigned char *)
952 		= neigh->dev->header_ops->cache_update;
953 
954 	if (update) {
955 		for (hh = neigh->hh; hh; hh = hh->hh_next) {
956 			write_seqlock_bh(&hh->hh_lock);
957 			update(hh, neigh->dev, neigh->ha);
958 			write_sequnlock_bh(&hh->hh_lock);
959 		}
960 	}
961 }
962 
963 
964 
965 /* Generic update routine.
966    -- lladdr is new lladdr or NULL, if it is not supplied.
967    -- new    is new state.
968    -- flags
969 	NEIGH_UPDATE_F_OVERRIDE allows to override existing lladdr,
970 				if it is different.
971 	NEIGH_UPDATE_F_WEAK_OVERRIDE will suspect existing "connected"
972 				lladdr instead of overriding it
973 				if it is different.
974 				It also allows to retain current state
975 				if lladdr is unchanged.
976 	NEIGH_UPDATE_F_ADMIN	means that the change is administrative.
977 
978 	NEIGH_UPDATE_F_OVERRIDE_ISROUTER allows to override existing
979 				NTF_ROUTER flag.
980 	NEIGH_UPDATE_F_ISROUTER	indicates if the neighbour is known as
981 				a router.
982 
983    Caller MUST hold reference count on the entry.
984  */
985 
986 int neigh_update(struct neighbour *neigh, const u8 *lladdr, u8 new,
987 		 u32 flags)
988 {
989 	u8 old;
990 	int err;
991 	int notify = 0;
992 	struct net_device *dev;
993 	int update_isrouter = 0;
994 
995 	write_lock_bh(&neigh->lock);
996 
997 	dev    = neigh->dev;
998 	old    = neigh->nud_state;
999 	err    = -EPERM;
1000 
1001 	if (!(flags & NEIGH_UPDATE_F_ADMIN) &&
1002 	    (old & (NUD_NOARP | NUD_PERMANENT)))
1003 		goto out;
1004 
1005 	if (!(new & NUD_VALID)) {
1006 		neigh_del_timer(neigh);
1007 		if (old & NUD_CONNECTED)
1008 			neigh_suspect(neigh);
1009 		neigh->nud_state = new;
1010 		err = 0;
1011 		notify = old & NUD_VALID;
1012 		if ((old & (NUD_INCOMPLETE | NUD_PROBE)) &&
1013 		    (new & NUD_FAILED)) {
1014 			neigh_invalidate(neigh);
1015 			notify = 1;
1016 		}
1017 		goto out;
1018 	}
1019 
1020 	/* Compare new lladdr with cached one */
1021 	if (!dev->addr_len) {
1022 		/* First case: device needs no address. */
1023 		lladdr = neigh->ha;
1024 	} else if (lladdr) {
1025 		/* The second case: if something is already cached
1026 		   and a new address is proposed:
1027 		   - compare new & old
1028 		   - if they are different, check override flag
1029 		 */
1030 		if ((old & NUD_VALID) &&
1031 		    !memcmp(lladdr, neigh->ha, dev->addr_len))
1032 			lladdr = neigh->ha;
1033 	} else {
1034 		/* No address is supplied; if we know something,
1035 		   use it, otherwise discard the request.
1036 		 */
1037 		err = -EINVAL;
1038 		if (!(old & NUD_VALID))
1039 			goto out;
1040 		lladdr = neigh->ha;
1041 	}
1042 
1043 	if (new & NUD_CONNECTED)
1044 		neigh->confirmed = jiffies;
1045 	neigh->updated = jiffies;
1046 
1047 	/* If entry was valid and address is not changed,
1048 	   do not change entry state, if new one is STALE.
1049 	 */
1050 	err = 0;
1051 	update_isrouter = flags & NEIGH_UPDATE_F_OVERRIDE_ISROUTER;
1052 	if (old & NUD_VALID) {
1053 		if (lladdr != neigh->ha && !(flags & NEIGH_UPDATE_F_OVERRIDE)) {
1054 			update_isrouter = 0;
1055 			if ((flags & NEIGH_UPDATE_F_WEAK_OVERRIDE) &&
1056 			    (old & NUD_CONNECTED)) {
1057 				lladdr = neigh->ha;
1058 				new = NUD_STALE;
1059 			} else
1060 				goto out;
1061 		} else {
1062 			if (lladdr == neigh->ha && new == NUD_STALE &&
1063 			    ((flags & NEIGH_UPDATE_F_WEAK_OVERRIDE) ||
1064 			     (old & NUD_CONNECTED))
1065 			    )
1066 				new = old;
1067 		}
1068 	}
1069 
1070 	if (new != old) {
1071 		neigh_del_timer(neigh);
1072 		if (new & NUD_IN_TIMER)
1073 			neigh_add_timer(neigh, (jiffies +
1074 						((new & NUD_REACHABLE) ?
1075 						 neigh->parms->reachable_time :
1076 						 0)));
1077 		neigh->nud_state = new;
1078 	}
1079 
1080 	if (lladdr != neigh->ha) {
1081 		memcpy(&neigh->ha, lladdr, dev->addr_len);
1082 		neigh_update_hhs(neigh);
1083 		if (!(new & NUD_CONNECTED))
1084 			neigh->confirmed = jiffies -
1085 				      (neigh->parms->base_reachable_time << 1);
1086 		notify = 1;
1087 	}
1088 	if (new == old)
1089 		goto out;
1090 	if (new & NUD_CONNECTED)
1091 		neigh_connect(neigh);
1092 	else
1093 		neigh_suspect(neigh);
1094 	if (!(old & NUD_VALID)) {
1095 		struct sk_buff *skb;
1096 
1097 		/* Again: avoid dead loop if something went wrong */
1098 
1099 		while (neigh->nud_state & NUD_VALID &&
1100 		       (skb = __skb_dequeue(&neigh->arp_queue)) != NULL) {
1101 			struct neighbour *n1 = neigh;
1102 			write_unlock_bh(&neigh->lock);
1103 			/* On shaper/eql skb->dst->neighbour != neigh :( */
1104 			if (skb_dst(skb) && skb_dst(skb)->neighbour)
1105 				n1 = skb_dst(skb)->neighbour;
1106 			n1->output(skb);
1107 			write_lock_bh(&neigh->lock);
1108 		}
1109 		skb_queue_purge(&neigh->arp_queue);
1110 	}
1111 out:
1112 	if (update_isrouter) {
1113 		neigh->flags = (flags & NEIGH_UPDATE_F_ISROUTER) ?
1114 			(neigh->flags | NTF_ROUTER) :
1115 			(neigh->flags & ~NTF_ROUTER);
1116 	}
1117 	write_unlock_bh(&neigh->lock);
1118 
1119 	if (notify)
1120 		neigh_update_notify(neigh);
1121 
1122 	return err;
1123 }
1124 EXPORT_SYMBOL(neigh_update);
1125 
1126 struct neighbour *neigh_event_ns(struct neigh_table *tbl,
1127 				 u8 *lladdr, void *saddr,
1128 				 struct net_device *dev)
1129 {
1130 	struct neighbour *neigh = __neigh_lookup(tbl, saddr, dev,
1131 						 lladdr || !dev->addr_len);
1132 	if (neigh)
1133 		neigh_update(neigh, lladdr, NUD_STALE,
1134 			     NEIGH_UPDATE_F_OVERRIDE);
1135 	return neigh;
1136 }
1137 EXPORT_SYMBOL(neigh_event_ns);
1138 
1139 static void neigh_hh_init(struct neighbour *n, struct dst_entry *dst,
1140 			  __be16 protocol)
1141 {
1142 	struct hh_cache	*hh;
1143 	struct net_device *dev = dst->dev;
1144 
1145 	for (hh = n->hh; hh; hh = hh->hh_next)
1146 		if (hh->hh_type == protocol)
1147 			break;
1148 
1149 	if (!hh && (hh = kzalloc(sizeof(*hh), GFP_ATOMIC)) != NULL) {
1150 		seqlock_init(&hh->hh_lock);
1151 		hh->hh_type = protocol;
1152 		atomic_set(&hh->hh_refcnt, 0);
1153 		hh->hh_next = NULL;
1154 
1155 		if (dev->header_ops->cache(n, hh)) {
1156 			kfree(hh);
1157 			hh = NULL;
1158 		} else {
1159 			atomic_inc(&hh->hh_refcnt);
1160 			hh->hh_next = n->hh;
1161 			n->hh	    = hh;
1162 			if (n->nud_state & NUD_CONNECTED)
1163 				hh->hh_output = n->ops->hh_output;
1164 			else
1165 				hh->hh_output = n->ops->output;
1166 		}
1167 	}
1168 	if (hh)	{
1169 		atomic_inc(&hh->hh_refcnt);
1170 		dst->hh = hh;
1171 	}
1172 }
1173 
1174 /* This function can be used in contexts, where only old dev_queue_xmit
1175    worked, f.e. if you want to override normal output path (eql, shaper),
1176    but resolution is not made yet.
1177  */
1178 
1179 int neigh_compat_output(struct sk_buff *skb)
1180 {
1181 	struct net_device *dev = skb->dev;
1182 
1183 	__skb_pull(skb, skb_network_offset(skb));
1184 
1185 	if (dev_hard_header(skb, dev, ntohs(skb->protocol), NULL, NULL,
1186 			    skb->len) < 0 &&
1187 	    dev->header_ops->rebuild(skb))
1188 		return 0;
1189 
1190 	return dev_queue_xmit(skb);
1191 }
1192 EXPORT_SYMBOL(neigh_compat_output);
1193 
1194 /* Slow and careful. */
1195 
1196 int neigh_resolve_output(struct sk_buff *skb)
1197 {
1198 	struct dst_entry *dst = skb_dst(skb);
1199 	struct neighbour *neigh;
1200 	int rc = 0;
1201 
1202 	if (!dst || !(neigh = dst->neighbour))
1203 		goto discard;
1204 
1205 	__skb_pull(skb, skb_network_offset(skb));
1206 
1207 	if (!neigh_event_send(neigh, skb)) {
1208 		int err;
1209 		struct net_device *dev = neigh->dev;
1210 		if (dev->header_ops->cache && !dst->hh) {
1211 			write_lock_bh(&neigh->lock);
1212 			if (!dst->hh)
1213 				neigh_hh_init(neigh, dst, dst->ops->protocol);
1214 			err = dev_hard_header(skb, dev, ntohs(skb->protocol),
1215 					      neigh->ha, NULL, skb->len);
1216 			write_unlock_bh(&neigh->lock);
1217 		} else {
1218 			read_lock_bh(&neigh->lock);
1219 			err = dev_hard_header(skb, dev, ntohs(skb->protocol),
1220 					      neigh->ha, NULL, skb->len);
1221 			read_unlock_bh(&neigh->lock);
1222 		}
1223 		if (err >= 0)
1224 			rc = neigh->ops->queue_xmit(skb);
1225 		else
1226 			goto out_kfree_skb;
1227 	}
1228 out:
1229 	return rc;
1230 discard:
1231 	NEIGH_PRINTK1("neigh_resolve_output: dst=%p neigh=%p\n",
1232 		      dst, dst ? dst->neighbour : NULL);
1233 out_kfree_skb:
1234 	rc = -EINVAL;
1235 	kfree_skb(skb);
1236 	goto out;
1237 }
1238 EXPORT_SYMBOL(neigh_resolve_output);
1239 
1240 /* As fast as possible without hh cache */
1241 
1242 int neigh_connected_output(struct sk_buff *skb)
1243 {
1244 	int err;
1245 	struct dst_entry *dst = skb_dst(skb);
1246 	struct neighbour *neigh = dst->neighbour;
1247 	struct net_device *dev = neigh->dev;
1248 
1249 	__skb_pull(skb, skb_network_offset(skb));
1250 
1251 	read_lock_bh(&neigh->lock);
1252 	err = dev_hard_header(skb, dev, ntohs(skb->protocol),
1253 			      neigh->ha, NULL, skb->len);
1254 	read_unlock_bh(&neigh->lock);
1255 	if (err >= 0)
1256 		err = neigh->ops->queue_xmit(skb);
1257 	else {
1258 		err = -EINVAL;
1259 		kfree_skb(skb);
1260 	}
1261 	return err;
1262 }
1263 EXPORT_SYMBOL(neigh_connected_output);
1264 
1265 static void neigh_proxy_process(unsigned long arg)
1266 {
1267 	struct neigh_table *tbl = (struct neigh_table *)arg;
1268 	long sched_next = 0;
1269 	unsigned long now = jiffies;
1270 	struct sk_buff *skb, *n;
1271 
1272 	spin_lock(&tbl->proxy_queue.lock);
1273 
1274 	skb_queue_walk_safe(&tbl->proxy_queue, skb, n) {
1275 		long tdif = NEIGH_CB(skb)->sched_next - now;
1276 
1277 		if (tdif <= 0) {
1278 			struct net_device *dev = skb->dev;
1279 			__skb_unlink(skb, &tbl->proxy_queue);
1280 			if (tbl->proxy_redo && netif_running(dev))
1281 				tbl->proxy_redo(skb);
1282 			else
1283 				kfree_skb(skb);
1284 
1285 			dev_put(dev);
1286 		} else if (!sched_next || tdif < sched_next)
1287 			sched_next = tdif;
1288 	}
1289 	del_timer(&tbl->proxy_timer);
1290 	if (sched_next)
1291 		mod_timer(&tbl->proxy_timer, jiffies + sched_next);
1292 	spin_unlock(&tbl->proxy_queue.lock);
1293 }
1294 
1295 void pneigh_enqueue(struct neigh_table *tbl, struct neigh_parms *p,
1296 		    struct sk_buff *skb)
1297 {
1298 	unsigned long now = jiffies;
1299 	unsigned long sched_next = now + (net_random() % p->proxy_delay);
1300 
1301 	if (tbl->proxy_queue.qlen > p->proxy_qlen) {
1302 		kfree_skb(skb);
1303 		return;
1304 	}
1305 
1306 	NEIGH_CB(skb)->sched_next = sched_next;
1307 	NEIGH_CB(skb)->flags |= LOCALLY_ENQUEUED;
1308 
1309 	spin_lock(&tbl->proxy_queue.lock);
1310 	if (del_timer(&tbl->proxy_timer)) {
1311 		if (time_before(tbl->proxy_timer.expires, sched_next))
1312 			sched_next = tbl->proxy_timer.expires;
1313 	}
1314 	skb_dst_drop(skb);
1315 	dev_hold(skb->dev);
1316 	__skb_queue_tail(&tbl->proxy_queue, skb);
1317 	mod_timer(&tbl->proxy_timer, sched_next);
1318 	spin_unlock(&tbl->proxy_queue.lock);
1319 }
1320 EXPORT_SYMBOL(pneigh_enqueue);
1321 
1322 static inline struct neigh_parms *lookup_neigh_parms(struct neigh_table *tbl,
1323 						      struct net *net, int ifindex)
1324 {
1325 	struct neigh_parms *p;
1326 
1327 	for (p = &tbl->parms; p; p = p->next) {
1328 		if ((p->dev && p->dev->ifindex == ifindex && net_eq(neigh_parms_net(p), net)) ||
1329 		    (!p->dev && !ifindex))
1330 			return p;
1331 	}
1332 
1333 	return NULL;
1334 }
1335 
1336 struct neigh_parms *neigh_parms_alloc(struct net_device *dev,
1337 				      struct neigh_table *tbl)
1338 {
1339 	struct neigh_parms *p, *ref;
1340 	struct net *net = dev_net(dev);
1341 	const struct net_device_ops *ops = dev->netdev_ops;
1342 
1343 	ref = lookup_neigh_parms(tbl, net, 0);
1344 	if (!ref)
1345 		return NULL;
1346 
1347 	p = kmemdup(ref, sizeof(*p), GFP_KERNEL);
1348 	if (p) {
1349 		p->tbl		  = tbl;
1350 		atomic_set(&p->refcnt, 1);
1351 		p->reachable_time =
1352 				neigh_rand_reach_time(p->base_reachable_time);
1353 
1354 		if (ops->ndo_neigh_setup && ops->ndo_neigh_setup(dev, p)) {
1355 			kfree(p);
1356 			return NULL;
1357 		}
1358 
1359 		dev_hold(dev);
1360 		p->dev = dev;
1361 		write_pnet(&p->net, hold_net(net));
1362 		p->sysctl_table = NULL;
1363 		write_lock_bh(&tbl->lock);
1364 		p->next		= tbl->parms.next;
1365 		tbl->parms.next = p;
1366 		write_unlock_bh(&tbl->lock);
1367 	}
1368 	return p;
1369 }
1370 EXPORT_SYMBOL(neigh_parms_alloc);
1371 
1372 static void neigh_rcu_free_parms(struct rcu_head *head)
1373 {
1374 	struct neigh_parms *parms =
1375 		container_of(head, struct neigh_parms, rcu_head);
1376 
1377 	neigh_parms_put(parms);
1378 }
1379 
1380 void neigh_parms_release(struct neigh_table *tbl, struct neigh_parms *parms)
1381 {
1382 	struct neigh_parms **p;
1383 
1384 	if (!parms || parms == &tbl->parms)
1385 		return;
1386 	write_lock_bh(&tbl->lock);
1387 	for (p = &tbl->parms.next; *p; p = &(*p)->next) {
1388 		if (*p == parms) {
1389 			*p = parms->next;
1390 			parms->dead = 1;
1391 			write_unlock_bh(&tbl->lock);
1392 			if (parms->dev)
1393 				dev_put(parms->dev);
1394 			call_rcu(&parms->rcu_head, neigh_rcu_free_parms);
1395 			return;
1396 		}
1397 	}
1398 	write_unlock_bh(&tbl->lock);
1399 	NEIGH_PRINTK1("neigh_parms_release: not found\n");
1400 }
1401 EXPORT_SYMBOL(neigh_parms_release);
1402 
1403 static void neigh_parms_destroy(struct neigh_parms *parms)
1404 {
1405 	release_net(neigh_parms_net(parms));
1406 	kfree(parms);
1407 }
1408 
1409 static struct lock_class_key neigh_table_proxy_queue_class;
1410 
1411 void neigh_table_init_no_netlink(struct neigh_table *tbl)
1412 {
1413 	unsigned long now = jiffies;
1414 	unsigned long phsize;
1415 
1416 	write_pnet(&tbl->parms.net, &init_net);
1417 	atomic_set(&tbl->parms.refcnt, 1);
1418 	tbl->parms.reachable_time =
1419 			  neigh_rand_reach_time(tbl->parms.base_reachable_time);
1420 
1421 	if (!tbl->kmem_cachep)
1422 		tbl->kmem_cachep =
1423 			kmem_cache_create(tbl->id, tbl->entry_size, 0,
1424 					  SLAB_HWCACHE_ALIGN|SLAB_PANIC,
1425 					  NULL);
1426 	tbl->stats = alloc_percpu(struct neigh_statistics);
1427 	if (!tbl->stats)
1428 		panic("cannot create neighbour cache statistics");
1429 
1430 #ifdef CONFIG_PROC_FS
1431 	if (!proc_create_data(tbl->id, 0, init_net.proc_net_stat,
1432 			      &neigh_stat_seq_fops, tbl))
1433 		panic("cannot create neighbour proc dir entry");
1434 #endif
1435 
1436 	tbl->hash_mask = 1;
1437 	tbl->hash_buckets = neigh_hash_alloc(tbl->hash_mask + 1);
1438 
1439 	phsize = (PNEIGH_HASHMASK + 1) * sizeof(struct pneigh_entry *);
1440 	tbl->phash_buckets = kzalloc(phsize, GFP_KERNEL);
1441 
1442 	if (!tbl->hash_buckets || !tbl->phash_buckets)
1443 		panic("cannot allocate neighbour cache hashes");
1444 
1445 	get_random_bytes(&tbl->hash_rnd, sizeof(tbl->hash_rnd));
1446 
1447 	rwlock_init(&tbl->lock);
1448 	INIT_DELAYED_WORK_DEFERRABLE(&tbl->gc_work, neigh_periodic_work);
1449 	schedule_delayed_work(&tbl->gc_work, tbl->parms.reachable_time);
1450 	setup_timer(&tbl->proxy_timer, neigh_proxy_process, (unsigned long)tbl);
1451 	skb_queue_head_init_class(&tbl->proxy_queue,
1452 			&neigh_table_proxy_queue_class);
1453 
1454 	tbl->last_flush = now;
1455 	tbl->last_rand	= now + tbl->parms.reachable_time * 20;
1456 }
1457 EXPORT_SYMBOL(neigh_table_init_no_netlink);
1458 
1459 void neigh_table_init(struct neigh_table *tbl)
1460 {
1461 	struct neigh_table *tmp;
1462 
1463 	neigh_table_init_no_netlink(tbl);
1464 	write_lock(&neigh_tbl_lock);
1465 	for (tmp = neigh_tables; tmp; tmp = tmp->next) {
1466 		if (tmp->family == tbl->family)
1467 			break;
1468 	}
1469 	tbl->next	= neigh_tables;
1470 	neigh_tables	= tbl;
1471 	write_unlock(&neigh_tbl_lock);
1472 
1473 	if (unlikely(tmp)) {
1474 		printk(KERN_ERR "NEIGH: Registering multiple tables for "
1475 		       "family %d\n", tbl->family);
1476 		dump_stack();
1477 	}
1478 }
1479 EXPORT_SYMBOL(neigh_table_init);
1480 
1481 int neigh_table_clear(struct neigh_table *tbl)
1482 {
1483 	struct neigh_table **tp;
1484 
1485 	/* It is not clean... Fix it to unload IPv6 module safely */
1486 	cancel_delayed_work(&tbl->gc_work);
1487 	flush_scheduled_work();
1488 	del_timer_sync(&tbl->proxy_timer);
1489 	pneigh_queue_purge(&tbl->proxy_queue);
1490 	neigh_ifdown(tbl, NULL);
1491 	if (atomic_read(&tbl->entries))
1492 		printk(KERN_CRIT "neighbour leakage\n");
1493 	write_lock(&neigh_tbl_lock);
1494 	for (tp = &neigh_tables; *tp; tp = &(*tp)->next) {
1495 		if (*tp == tbl) {
1496 			*tp = tbl->next;
1497 			break;
1498 		}
1499 	}
1500 	write_unlock(&neigh_tbl_lock);
1501 
1502 	neigh_hash_free(tbl->hash_buckets, tbl->hash_mask + 1);
1503 	tbl->hash_buckets = NULL;
1504 
1505 	kfree(tbl->phash_buckets);
1506 	tbl->phash_buckets = NULL;
1507 
1508 	remove_proc_entry(tbl->id, init_net.proc_net_stat);
1509 
1510 	free_percpu(tbl->stats);
1511 	tbl->stats = NULL;
1512 
1513 	kmem_cache_destroy(tbl->kmem_cachep);
1514 	tbl->kmem_cachep = NULL;
1515 
1516 	return 0;
1517 }
1518 EXPORT_SYMBOL(neigh_table_clear);
1519 
1520 static int neigh_delete(struct sk_buff *skb, struct nlmsghdr *nlh, void *arg)
1521 {
1522 	struct net *net = sock_net(skb->sk);
1523 	struct ndmsg *ndm;
1524 	struct nlattr *dst_attr;
1525 	struct neigh_table *tbl;
1526 	struct net_device *dev = NULL;
1527 	int err = -EINVAL;
1528 
1529 	if (nlmsg_len(nlh) < sizeof(*ndm))
1530 		goto out;
1531 
1532 	dst_attr = nlmsg_find_attr(nlh, sizeof(*ndm), NDA_DST);
1533 	if (dst_attr == NULL)
1534 		goto out;
1535 
1536 	ndm = nlmsg_data(nlh);
1537 	if (ndm->ndm_ifindex) {
1538 		dev = dev_get_by_index(net, ndm->ndm_ifindex);
1539 		if (dev == NULL) {
1540 			err = -ENODEV;
1541 			goto out;
1542 		}
1543 	}
1544 
1545 	read_lock(&neigh_tbl_lock);
1546 	for (tbl = neigh_tables; tbl; tbl = tbl->next) {
1547 		struct neighbour *neigh;
1548 
1549 		if (tbl->family != ndm->ndm_family)
1550 			continue;
1551 		read_unlock(&neigh_tbl_lock);
1552 
1553 		if (nla_len(dst_attr) < tbl->key_len)
1554 			goto out_dev_put;
1555 
1556 		if (ndm->ndm_flags & NTF_PROXY) {
1557 			err = pneigh_delete(tbl, net, nla_data(dst_attr), dev);
1558 			goto out_dev_put;
1559 		}
1560 
1561 		if (dev == NULL)
1562 			goto out_dev_put;
1563 
1564 		neigh = neigh_lookup(tbl, nla_data(dst_attr), dev);
1565 		if (neigh == NULL) {
1566 			err = -ENOENT;
1567 			goto out_dev_put;
1568 		}
1569 
1570 		err = neigh_update(neigh, NULL, NUD_FAILED,
1571 				   NEIGH_UPDATE_F_OVERRIDE |
1572 				   NEIGH_UPDATE_F_ADMIN);
1573 		neigh_release(neigh);
1574 		goto out_dev_put;
1575 	}
1576 	read_unlock(&neigh_tbl_lock);
1577 	err = -EAFNOSUPPORT;
1578 
1579 out_dev_put:
1580 	if (dev)
1581 		dev_put(dev);
1582 out:
1583 	return err;
1584 }
1585 
1586 static int neigh_add(struct sk_buff *skb, struct nlmsghdr *nlh, void *arg)
1587 {
1588 	struct net *net = sock_net(skb->sk);
1589 	struct ndmsg *ndm;
1590 	struct nlattr *tb[NDA_MAX+1];
1591 	struct neigh_table *tbl;
1592 	struct net_device *dev = NULL;
1593 	int err;
1594 
1595 	err = nlmsg_parse(nlh, sizeof(*ndm), tb, NDA_MAX, NULL);
1596 	if (err < 0)
1597 		goto out;
1598 
1599 	err = -EINVAL;
1600 	if (tb[NDA_DST] == NULL)
1601 		goto out;
1602 
1603 	ndm = nlmsg_data(nlh);
1604 	if (ndm->ndm_ifindex) {
1605 		dev = dev_get_by_index(net, ndm->ndm_ifindex);
1606 		if (dev == NULL) {
1607 			err = -ENODEV;
1608 			goto out;
1609 		}
1610 
1611 		if (tb[NDA_LLADDR] && nla_len(tb[NDA_LLADDR]) < dev->addr_len)
1612 			goto out_dev_put;
1613 	}
1614 
1615 	read_lock(&neigh_tbl_lock);
1616 	for (tbl = neigh_tables; tbl; tbl = tbl->next) {
1617 		int flags = NEIGH_UPDATE_F_ADMIN | NEIGH_UPDATE_F_OVERRIDE;
1618 		struct neighbour *neigh;
1619 		void *dst, *lladdr;
1620 
1621 		if (tbl->family != ndm->ndm_family)
1622 			continue;
1623 		read_unlock(&neigh_tbl_lock);
1624 
1625 		if (nla_len(tb[NDA_DST]) < tbl->key_len)
1626 			goto out_dev_put;
1627 		dst = nla_data(tb[NDA_DST]);
1628 		lladdr = tb[NDA_LLADDR] ? nla_data(tb[NDA_LLADDR]) : NULL;
1629 
1630 		if (ndm->ndm_flags & NTF_PROXY) {
1631 			struct pneigh_entry *pn;
1632 
1633 			err = -ENOBUFS;
1634 			pn = pneigh_lookup(tbl, net, dst, dev, 1);
1635 			if (pn) {
1636 				pn->flags = ndm->ndm_flags;
1637 				err = 0;
1638 			}
1639 			goto out_dev_put;
1640 		}
1641 
1642 		if (dev == NULL)
1643 			goto out_dev_put;
1644 
1645 		neigh = neigh_lookup(tbl, dst, dev);
1646 		if (neigh == NULL) {
1647 			if (!(nlh->nlmsg_flags & NLM_F_CREATE)) {
1648 				err = -ENOENT;
1649 				goto out_dev_put;
1650 			}
1651 
1652 			neigh = __neigh_lookup_errno(tbl, dst, dev);
1653 			if (IS_ERR(neigh)) {
1654 				err = PTR_ERR(neigh);
1655 				goto out_dev_put;
1656 			}
1657 		} else {
1658 			if (nlh->nlmsg_flags & NLM_F_EXCL) {
1659 				err = -EEXIST;
1660 				neigh_release(neigh);
1661 				goto out_dev_put;
1662 			}
1663 
1664 			if (!(nlh->nlmsg_flags & NLM_F_REPLACE))
1665 				flags &= ~NEIGH_UPDATE_F_OVERRIDE;
1666 		}
1667 
1668 		if (ndm->ndm_flags & NTF_USE) {
1669 			neigh_event_send(neigh, NULL);
1670 			err = 0;
1671 		} else
1672 			err = neigh_update(neigh, lladdr, ndm->ndm_state, flags);
1673 		neigh_release(neigh);
1674 		goto out_dev_put;
1675 	}
1676 
1677 	read_unlock(&neigh_tbl_lock);
1678 	err = -EAFNOSUPPORT;
1679 
1680 out_dev_put:
1681 	if (dev)
1682 		dev_put(dev);
1683 out:
1684 	return err;
1685 }
1686 
1687 static int neightbl_fill_parms(struct sk_buff *skb, struct neigh_parms *parms)
1688 {
1689 	struct nlattr *nest;
1690 
1691 	nest = nla_nest_start(skb, NDTA_PARMS);
1692 	if (nest == NULL)
1693 		return -ENOBUFS;
1694 
1695 	if (parms->dev)
1696 		NLA_PUT_U32(skb, NDTPA_IFINDEX, parms->dev->ifindex);
1697 
1698 	NLA_PUT_U32(skb, NDTPA_REFCNT, atomic_read(&parms->refcnt));
1699 	NLA_PUT_U32(skb, NDTPA_QUEUE_LEN, parms->queue_len);
1700 	NLA_PUT_U32(skb, NDTPA_PROXY_QLEN, parms->proxy_qlen);
1701 	NLA_PUT_U32(skb, NDTPA_APP_PROBES, parms->app_probes);
1702 	NLA_PUT_U32(skb, NDTPA_UCAST_PROBES, parms->ucast_probes);
1703 	NLA_PUT_U32(skb, NDTPA_MCAST_PROBES, parms->mcast_probes);
1704 	NLA_PUT_MSECS(skb, NDTPA_REACHABLE_TIME, parms->reachable_time);
1705 	NLA_PUT_MSECS(skb, NDTPA_BASE_REACHABLE_TIME,
1706 		      parms->base_reachable_time);
1707 	NLA_PUT_MSECS(skb, NDTPA_GC_STALETIME, parms->gc_staletime);
1708 	NLA_PUT_MSECS(skb, NDTPA_DELAY_PROBE_TIME, parms->delay_probe_time);
1709 	NLA_PUT_MSECS(skb, NDTPA_RETRANS_TIME, parms->retrans_time);
1710 	NLA_PUT_MSECS(skb, NDTPA_ANYCAST_DELAY, parms->anycast_delay);
1711 	NLA_PUT_MSECS(skb, NDTPA_PROXY_DELAY, parms->proxy_delay);
1712 	NLA_PUT_MSECS(skb, NDTPA_LOCKTIME, parms->locktime);
1713 
1714 	return nla_nest_end(skb, nest);
1715 
1716 nla_put_failure:
1717 	nla_nest_cancel(skb, nest);
1718 	return -EMSGSIZE;
1719 }
1720 
1721 static int neightbl_fill_info(struct sk_buff *skb, struct neigh_table *tbl,
1722 			      u32 pid, u32 seq, int type, int flags)
1723 {
1724 	struct nlmsghdr *nlh;
1725 	struct ndtmsg *ndtmsg;
1726 
1727 	nlh = nlmsg_put(skb, pid, seq, type, sizeof(*ndtmsg), flags);
1728 	if (nlh == NULL)
1729 		return -EMSGSIZE;
1730 
1731 	ndtmsg = nlmsg_data(nlh);
1732 
1733 	read_lock_bh(&tbl->lock);
1734 	ndtmsg->ndtm_family = tbl->family;
1735 	ndtmsg->ndtm_pad1   = 0;
1736 	ndtmsg->ndtm_pad2   = 0;
1737 
1738 	NLA_PUT_STRING(skb, NDTA_NAME, tbl->id);
1739 	NLA_PUT_MSECS(skb, NDTA_GC_INTERVAL, tbl->gc_interval);
1740 	NLA_PUT_U32(skb, NDTA_THRESH1, tbl->gc_thresh1);
1741 	NLA_PUT_U32(skb, NDTA_THRESH2, tbl->gc_thresh2);
1742 	NLA_PUT_U32(skb, NDTA_THRESH3, tbl->gc_thresh3);
1743 
1744 	{
1745 		unsigned long now = jiffies;
1746 		unsigned int flush_delta = now - tbl->last_flush;
1747 		unsigned int rand_delta = now - tbl->last_rand;
1748 
1749 		struct ndt_config ndc = {
1750 			.ndtc_key_len		= tbl->key_len,
1751 			.ndtc_entry_size	= tbl->entry_size,
1752 			.ndtc_entries		= atomic_read(&tbl->entries),
1753 			.ndtc_last_flush	= jiffies_to_msecs(flush_delta),
1754 			.ndtc_last_rand		= jiffies_to_msecs(rand_delta),
1755 			.ndtc_hash_rnd		= tbl->hash_rnd,
1756 			.ndtc_hash_mask		= tbl->hash_mask,
1757 			.ndtc_proxy_qlen	= tbl->proxy_queue.qlen,
1758 		};
1759 
1760 		NLA_PUT(skb, NDTA_CONFIG, sizeof(ndc), &ndc);
1761 	}
1762 
1763 	{
1764 		int cpu;
1765 		struct ndt_stats ndst;
1766 
1767 		memset(&ndst, 0, sizeof(ndst));
1768 
1769 		for_each_possible_cpu(cpu) {
1770 			struct neigh_statistics	*st;
1771 
1772 			st = per_cpu_ptr(tbl->stats, cpu);
1773 			ndst.ndts_allocs		+= st->allocs;
1774 			ndst.ndts_destroys		+= st->destroys;
1775 			ndst.ndts_hash_grows		+= st->hash_grows;
1776 			ndst.ndts_res_failed		+= st->res_failed;
1777 			ndst.ndts_lookups		+= st->lookups;
1778 			ndst.ndts_hits			+= st->hits;
1779 			ndst.ndts_rcv_probes_mcast	+= st->rcv_probes_mcast;
1780 			ndst.ndts_rcv_probes_ucast	+= st->rcv_probes_ucast;
1781 			ndst.ndts_periodic_gc_runs	+= st->periodic_gc_runs;
1782 			ndst.ndts_forced_gc_runs	+= st->forced_gc_runs;
1783 		}
1784 
1785 		NLA_PUT(skb, NDTA_STATS, sizeof(ndst), &ndst);
1786 	}
1787 
1788 	BUG_ON(tbl->parms.dev);
1789 	if (neightbl_fill_parms(skb, &tbl->parms) < 0)
1790 		goto nla_put_failure;
1791 
1792 	read_unlock_bh(&tbl->lock);
1793 	return nlmsg_end(skb, nlh);
1794 
1795 nla_put_failure:
1796 	read_unlock_bh(&tbl->lock);
1797 	nlmsg_cancel(skb, nlh);
1798 	return -EMSGSIZE;
1799 }
1800 
1801 static int neightbl_fill_param_info(struct sk_buff *skb,
1802 				    struct neigh_table *tbl,
1803 				    struct neigh_parms *parms,
1804 				    u32 pid, u32 seq, int type,
1805 				    unsigned int flags)
1806 {
1807 	struct ndtmsg *ndtmsg;
1808 	struct nlmsghdr *nlh;
1809 
1810 	nlh = nlmsg_put(skb, pid, seq, type, sizeof(*ndtmsg), flags);
1811 	if (nlh == NULL)
1812 		return -EMSGSIZE;
1813 
1814 	ndtmsg = nlmsg_data(nlh);
1815 
1816 	read_lock_bh(&tbl->lock);
1817 	ndtmsg->ndtm_family = tbl->family;
1818 	ndtmsg->ndtm_pad1   = 0;
1819 	ndtmsg->ndtm_pad2   = 0;
1820 
1821 	if (nla_put_string(skb, NDTA_NAME, tbl->id) < 0 ||
1822 	    neightbl_fill_parms(skb, parms) < 0)
1823 		goto errout;
1824 
1825 	read_unlock_bh(&tbl->lock);
1826 	return nlmsg_end(skb, nlh);
1827 errout:
1828 	read_unlock_bh(&tbl->lock);
1829 	nlmsg_cancel(skb, nlh);
1830 	return -EMSGSIZE;
1831 }
1832 
1833 static const struct nla_policy nl_neightbl_policy[NDTA_MAX+1] = {
1834 	[NDTA_NAME]		= { .type = NLA_STRING },
1835 	[NDTA_THRESH1]		= { .type = NLA_U32 },
1836 	[NDTA_THRESH2]		= { .type = NLA_U32 },
1837 	[NDTA_THRESH3]		= { .type = NLA_U32 },
1838 	[NDTA_GC_INTERVAL]	= { .type = NLA_U64 },
1839 	[NDTA_PARMS]		= { .type = NLA_NESTED },
1840 };
1841 
1842 static const struct nla_policy nl_ntbl_parm_policy[NDTPA_MAX+1] = {
1843 	[NDTPA_IFINDEX]			= { .type = NLA_U32 },
1844 	[NDTPA_QUEUE_LEN]		= { .type = NLA_U32 },
1845 	[NDTPA_PROXY_QLEN]		= { .type = NLA_U32 },
1846 	[NDTPA_APP_PROBES]		= { .type = NLA_U32 },
1847 	[NDTPA_UCAST_PROBES]		= { .type = NLA_U32 },
1848 	[NDTPA_MCAST_PROBES]		= { .type = NLA_U32 },
1849 	[NDTPA_BASE_REACHABLE_TIME]	= { .type = NLA_U64 },
1850 	[NDTPA_GC_STALETIME]		= { .type = NLA_U64 },
1851 	[NDTPA_DELAY_PROBE_TIME]	= { .type = NLA_U64 },
1852 	[NDTPA_RETRANS_TIME]		= { .type = NLA_U64 },
1853 	[NDTPA_ANYCAST_DELAY]		= { .type = NLA_U64 },
1854 	[NDTPA_PROXY_DELAY]		= { .type = NLA_U64 },
1855 	[NDTPA_LOCKTIME]		= { .type = NLA_U64 },
1856 };
1857 
1858 static int neightbl_set(struct sk_buff *skb, struct nlmsghdr *nlh, void *arg)
1859 {
1860 	struct net *net = sock_net(skb->sk);
1861 	struct neigh_table *tbl;
1862 	struct ndtmsg *ndtmsg;
1863 	struct nlattr *tb[NDTA_MAX+1];
1864 	int err;
1865 
1866 	err = nlmsg_parse(nlh, sizeof(*ndtmsg), tb, NDTA_MAX,
1867 			  nl_neightbl_policy);
1868 	if (err < 0)
1869 		goto errout;
1870 
1871 	if (tb[NDTA_NAME] == NULL) {
1872 		err = -EINVAL;
1873 		goto errout;
1874 	}
1875 
1876 	ndtmsg = nlmsg_data(nlh);
1877 	read_lock(&neigh_tbl_lock);
1878 	for (tbl = neigh_tables; tbl; tbl = tbl->next) {
1879 		if (ndtmsg->ndtm_family && tbl->family != ndtmsg->ndtm_family)
1880 			continue;
1881 
1882 		if (nla_strcmp(tb[NDTA_NAME], tbl->id) == 0)
1883 			break;
1884 	}
1885 
1886 	if (tbl == NULL) {
1887 		err = -ENOENT;
1888 		goto errout_locked;
1889 	}
1890 
1891 	/*
1892 	 * We acquire tbl->lock to be nice to the periodic timers and
1893 	 * make sure they always see a consistent set of values.
1894 	 */
1895 	write_lock_bh(&tbl->lock);
1896 
1897 	if (tb[NDTA_PARMS]) {
1898 		struct nlattr *tbp[NDTPA_MAX+1];
1899 		struct neigh_parms *p;
1900 		int i, ifindex = 0;
1901 
1902 		err = nla_parse_nested(tbp, NDTPA_MAX, tb[NDTA_PARMS],
1903 				       nl_ntbl_parm_policy);
1904 		if (err < 0)
1905 			goto errout_tbl_lock;
1906 
1907 		if (tbp[NDTPA_IFINDEX])
1908 			ifindex = nla_get_u32(tbp[NDTPA_IFINDEX]);
1909 
1910 		p = lookup_neigh_parms(tbl, net, ifindex);
1911 		if (p == NULL) {
1912 			err = -ENOENT;
1913 			goto errout_tbl_lock;
1914 		}
1915 
1916 		for (i = 1; i <= NDTPA_MAX; i++) {
1917 			if (tbp[i] == NULL)
1918 				continue;
1919 
1920 			switch (i) {
1921 			case NDTPA_QUEUE_LEN:
1922 				p->queue_len = nla_get_u32(tbp[i]);
1923 				break;
1924 			case NDTPA_PROXY_QLEN:
1925 				p->proxy_qlen = nla_get_u32(tbp[i]);
1926 				break;
1927 			case NDTPA_APP_PROBES:
1928 				p->app_probes = nla_get_u32(tbp[i]);
1929 				break;
1930 			case NDTPA_UCAST_PROBES:
1931 				p->ucast_probes = nla_get_u32(tbp[i]);
1932 				break;
1933 			case NDTPA_MCAST_PROBES:
1934 				p->mcast_probes = nla_get_u32(tbp[i]);
1935 				break;
1936 			case NDTPA_BASE_REACHABLE_TIME:
1937 				p->base_reachable_time = nla_get_msecs(tbp[i]);
1938 				break;
1939 			case NDTPA_GC_STALETIME:
1940 				p->gc_staletime = nla_get_msecs(tbp[i]);
1941 				break;
1942 			case NDTPA_DELAY_PROBE_TIME:
1943 				p->delay_probe_time = nla_get_msecs(tbp[i]);
1944 				break;
1945 			case NDTPA_RETRANS_TIME:
1946 				p->retrans_time = nla_get_msecs(tbp[i]);
1947 				break;
1948 			case NDTPA_ANYCAST_DELAY:
1949 				p->anycast_delay = nla_get_msecs(tbp[i]);
1950 				break;
1951 			case NDTPA_PROXY_DELAY:
1952 				p->proxy_delay = nla_get_msecs(tbp[i]);
1953 				break;
1954 			case NDTPA_LOCKTIME:
1955 				p->locktime = nla_get_msecs(tbp[i]);
1956 				break;
1957 			}
1958 		}
1959 	}
1960 
1961 	if (tb[NDTA_THRESH1])
1962 		tbl->gc_thresh1 = nla_get_u32(tb[NDTA_THRESH1]);
1963 
1964 	if (tb[NDTA_THRESH2])
1965 		tbl->gc_thresh2 = nla_get_u32(tb[NDTA_THRESH2]);
1966 
1967 	if (tb[NDTA_THRESH3])
1968 		tbl->gc_thresh3 = nla_get_u32(tb[NDTA_THRESH3]);
1969 
1970 	if (tb[NDTA_GC_INTERVAL])
1971 		tbl->gc_interval = nla_get_msecs(tb[NDTA_GC_INTERVAL]);
1972 
1973 	err = 0;
1974 
1975 errout_tbl_lock:
1976 	write_unlock_bh(&tbl->lock);
1977 errout_locked:
1978 	read_unlock(&neigh_tbl_lock);
1979 errout:
1980 	return err;
1981 }
1982 
1983 static int neightbl_dump_info(struct sk_buff *skb, struct netlink_callback *cb)
1984 {
1985 	struct net *net = sock_net(skb->sk);
1986 	int family, tidx, nidx = 0;
1987 	int tbl_skip = cb->args[0];
1988 	int neigh_skip = cb->args[1];
1989 	struct neigh_table *tbl;
1990 
1991 	family = ((struct rtgenmsg *) nlmsg_data(cb->nlh))->rtgen_family;
1992 
1993 	read_lock(&neigh_tbl_lock);
1994 	for (tbl = neigh_tables, tidx = 0; tbl; tbl = tbl->next, tidx++) {
1995 		struct neigh_parms *p;
1996 
1997 		if (tidx < tbl_skip || (family && tbl->family != family))
1998 			continue;
1999 
2000 		if (neightbl_fill_info(skb, tbl, NETLINK_CB(cb->skb).pid,
2001 				       cb->nlh->nlmsg_seq, RTM_NEWNEIGHTBL,
2002 				       NLM_F_MULTI) <= 0)
2003 			break;
2004 
2005 		for (nidx = 0, p = tbl->parms.next; p; p = p->next) {
2006 			if (!net_eq(neigh_parms_net(p), net))
2007 				continue;
2008 
2009 			if (nidx < neigh_skip)
2010 				goto next;
2011 
2012 			if (neightbl_fill_param_info(skb, tbl, p,
2013 						     NETLINK_CB(cb->skb).pid,
2014 						     cb->nlh->nlmsg_seq,
2015 						     RTM_NEWNEIGHTBL,
2016 						     NLM_F_MULTI) <= 0)
2017 				goto out;
2018 		next:
2019 			nidx++;
2020 		}
2021 
2022 		neigh_skip = 0;
2023 	}
2024 out:
2025 	read_unlock(&neigh_tbl_lock);
2026 	cb->args[0] = tidx;
2027 	cb->args[1] = nidx;
2028 
2029 	return skb->len;
2030 }
2031 
2032 static int neigh_fill_info(struct sk_buff *skb, struct neighbour *neigh,
2033 			   u32 pid, u32 seq, int type, unsigned int flags)
2034 {
2035 	unsigned long now = jiffies;
2036 	struct nda_cacheinfo ci;
2037 	struct nlmsghdr *nlh;
2038 	struct ndmsg *ndm;
2039 
2040 	nlh = nlmsg_put(skb, pid, seq, type, sizeof(*ndm), flags);
2041 	if (nlh == NULL)
2042 		return -EMSGSIZE;
2043 
2044 	ndm = nlmsg_data(nlh);
2045 	ndm->ndm_family	 = neigh->ops->family;
2046 	ndm->ndm_pad1    = 0;
2047 	ndm->ndm_pad2    = 0;
2048 	ndm->ndm_flags	 = neigh->flags;
2049 	ndm->ndm_type	 = neigh->type;
2050 	ndm->ndm_ifindex = neigh->dev->ifindex;
2051 
2052 	NLA_PUT(skb, NDA_DST, neigh->tbl->key_len, neigh->primary_key);
2053 
2054 	read_lock_bh(&neigh->lock);
2055 	ndm->ndm_state	 = neigh->nud_state;
2056 	if ((neigh->nud_state & NUD_VALID) &&
2057 	    nla_put(skb, NDA_LLADDR, neigh->dev->addr_len, neigh->ha) < 0) {
2058 		read_unlock_bh(&neigh->lock);
2059 		goto nla_put_failure;
2060 	}
2061 
2062 	ci.ndm_used	 = jiffies_to_clock_t(now - neigh->used);
2063 	ci.ndm_confirmed = jiffies_to_clock_t(now - neigh->confirmed);
2064 	ci.ndm_updated	 = jiffies_to_clock_t(now - neigh->updated);
2065 	ci.ndm_refcnt	 = atomic_read(&neigh->refcnt) - 1;
2066 	read_unlock_bh(&neigh->lock);
2067 
2068 	NLA_PUT_U32(skb, NDA_PROBES, atomic_read(&neigh->probes));
2069 	NLA_PUT(skb, NDA_CACHEINFO, sizeof(ci), &ci);
2070 
2071 	return nlmsg_end(skb, nlh);
2072 
2073 nla_put_failure:
2074 	nlmsg_cancel(skb, nlh);
2075 	return -EMSGSIZE;
2076 }
2077 
2078 static void neigh_update_notify(struct neighbour *neigh)
2079 {
2080 	call_netevent_notifiers(NETEVENT_NEIGH_UPDATE, neigh);
2081 	__neigh_notify(neigh, RTM_NEWNEIGH, 0);
2082 }
2083 
2084 static int neigh_dump_table(struct neigh_table *tbl, struct sk_buff *skb,
2085 			    struct netlink_callback *cb)
2086 {
2087 	struct net * net = sock_net(skb->sk);
2088 	struct neighbour *n;
2089 	int rc, h, s_h = cb->args[1];
2090 	int idx, s_idx = idx = cb->args[2];
2091 
2092 	read_lock_bh(&tbl->lock);
2093 	for (h = 0; h <= tbl->hash_mask; h++) {
2094 		if (h < s_h)
2095 			continue;
2096 		if (h > s_h)
2097 			s_idx = 0;
2098 		for (n = tbl->hash_buckets[h], idx = 0; n; n = n->next) {
2099 			if (!net_eq(dev_net(n->dev), net))
2100 				continue;
2101 			if (idx < s_idx)
2102 				goto next;
2103 			if (neigh_fill_info(skb, n, NETLINK_CB(cb->skb).pid,
2104 					    cb->nlh->nlmsg_seq,
2105 					    RTM_NEWNEIGH,
2106 					    NLM_F_MULTI) <= 0) {
2107 				read_unlock_bh(&tbl->lock);
2108 				rc = -1;
2109 				goto out;
2110 			}
2111 		next:
2112 			idx++;
2113 		}
2114 	}
2115 	read_unlock_bh(&tbl->lock);
2116 	rc = skb->len;
2117 out:
2118 	cb->args[1] = h;
2119 	cb->args[2] = idx;
2120 	return rc;
2121 }
2122 
2123 static int neigh_dump_info(struct sk_buff *skb, struct netlink_callback *cb)
2124 {
2125 	struct neigh_table *tbl;
2126 	int t, family, s_t;
2127 
2128 	read_lock(&neigh_tbl_lock);
2129 	family = ((struct rtgenmsg *) nlmsg_data(cb->nlh))->rtgen_family;
2130 	s_t = cb->args[0];
2131 
2132 	for (tbl = neigh_tables, t = 0; tbl; tbl = tbl->next, t++) {
2133 		if (t < s_t || (family && tbl->family != family))
2134 			continue;
2135 		if (t > s_t)
2136 			memset(&cb->args[1], 0, sizeof(cb->args) -
2137 						sizeof(cb->args[0]));
2138 		if (neigh_dump_table(tbl, skb, cb) < 0)
2139 			break;
2140 	}
2141 	read_unlock(&neigh_tbl_lock);
2142 
2143 	cb->args[0] = t;
2144 	return skb->len;
2145 }
2146 
2147 void neigh_for_each(struct neigh_table *tbl, void (*cb)(struct neighbour *, void *), void *cookie)
2148 {
2149 	int chain;
2150 
2151 	read_lock_bh(&tbl->lock);
2152 	for (chain = 0; chain <= tbl->hash_mask; chain++) {
2153 		struct neighbour *n;
2154 
2155 		for (n = tbl->hash_buckets[chain]; n; n = n->next)
2156 			cb(n, cookie);
2157 	}
2158 	read_unlock_bh(&tbl->lock);
2159 }
2160 EXPORT_SYMBOL(neigh_for_each);
2161 
2162 /* The tbl->lock must be held as a writer and BH disabled. */
2163 void __neigh_for_each_release(struct neigh_table *tbl,
2164 			      int (*cb)(struct neighbour *))
2165 {
2166 	int chain;
2167 
2168 	for (chain = 0; chain <= tbl->hash_mask; chain++) {
2169 		struct neighbour *n, **np;
2170 
2171 		np = &tbl->hash_buckets[chain];
2172 		while ((n = *np) != NULL) {
2173 			int release;
2174 
2175 			write_lock(&n->lock);
2176 			release = cb(n);
2177 			if (release) {
2178 				*np = n->next;
2179 				n->dead = 1;
2180 			} else
2181 				np = &n->next;
2182 			write_unlock(&n->lock);
2183 			if (release)
2184 				neigh_cleanup_and_release(n);
2185 		}
2186 	}
2187 }
2188 EXPORT_SYMBOL(__neigh_for_each_release);
2189 
2190 #ifdef CONFIG_PROC_FS
2191 
2192 static struct neighbour *neigh_get_first(struct seq_file *seq)
2193 {
2194 	struct neigh_seq_state *state = seq->private;
2195 	struct net *net = seq_file_net(seq);
2196 	struct neigh_table *tbl = state->tbl;
2197 	struct neighbour *n = NULL;
2198 	int bucket = state->bucket;
2199 
2200 	state->flags &= ~NEIGH_SEQ_IS_PNEIGH;
2201 	for (bucket = 0; bucket <= tbl->hash_mask; bucket++) {
2202 		n = tbl->hash_buckets[bucket];
2203 
2204 		while (n) {
2205 			if (!net_eq(dev_net(n->dev), net))
2206 				goto next;
2207 			if (state->neigh_sub_iter) {
2208 				loff_t fakep = 0;
2209 				void *v;
2210 
2211 				v = state->neigh_sub_iter(state, n, &fakep);
2212 				if (!v)
2213 					goto next;
2214 			}
2215 			if (!(state->flags & NEIGH_SEQ_SKIP_NOARP))
2216 				break;
2217 			if (n->nud_state & ~NUD_NOARP)
2218 				break;
2219 		next:
2220 			n = n->next;
2221 		}
2222 
2223 		if (n)
2224 			break;
2225 	}
2226 	state->bucket = bucket;
2227 
2228 	return n;
2229 }
2230 
2231 static struct neighbour *neigh_get_next(struct seq_file *seq,
2232 					struct neighbour *n,
2233 					loff_t *pos)
2234 {
2235 	struct neigh_seq_state *state = seq->private;
2236 	struct net *net = seq_file_net(seq);
2237 	struct neigh_table *tbl = state->tbl;
2238 
2239 	if (state->neigh_sub_iter) {
2240 		void *v = state->neigh_sub_iter(state, n, pos);
2241 		if (v)
2242 			return n;
2243 	}
2244 	n = n->next;
2245 
2246 	while (1) {
2247 		while (n) {
2248 			if (!net_eq(dev_net(n->dev), net))
2249 				goto next;
2250 			if (state->neigh_sub_iter) {
2251 				void *v = state->neigh_sub_iter(state, n, pos);
2252 				if (v)
2253 					return n;
2254 				goto next;
2255 			}
2256 			if (!(state->flags & NEIGH_SEQ_SKIP_NOARP))
2257 				break;
2258 
2259 			if (n->nud_state & ~NUD_NOARP)
2260 				break;
2261 		next:
2262 			n = n->next;
2263 		}
2264 
2265 		if (n)
2266 			break;
2267 
2268 		if (++state->bucket > tbl->hash_mask)
2269 			break;
2270 
2271 		n = tbl->hash_buckets[state->bucket];
2272 	}
2273 
2274 	if (n && pos)
2275 		--(*pos);
2276 	return n;
2277 }
2278 
2279 static struct neighbour *neigh_get_idx(struct seq_file *seq, loff_t *pos)
2280 {
2281 	struct neighbour *n = neigh_get_first(seq);
2282 
2283 	if (n) {
2284 		--(*pos);
2285 		while (*pos) {
2286 			n = neigh_get_next(seq, n, pos);
2287 			if (!n)
2288 				break;
2289 		}
2290 	}
2291 	return *pos ? NULL : n;
2292 }
2293 
2294 static struct pneigh_entry *pneigh_get_first(struct seq_file *seq)
2295 {
2296 	struct neigh_seq_state *state = seq->private;
2297 	struct net *net = seq_file_net(seq);
2298 	struct neigh_table *tbl = state->tbl;
2299 	struct pneigh_entry *pn = NULL;
2300 	int bucket = state->bucket;
2301 
2302 	state->flags |= NEIGH_SEQ_IS_PNEIGH;
2303 	for (bucket = 0; bucket <= PNEIGH_HASHMASK; bucket++) {
2304 		pn = tbl->phash_buckets[bucket];
2305 		while (pn && !net_eq(pneigh_net(pn), net))
2306 			pn = pn->next;
2307 		if (pn)
2308 			break;
2309 	}
2310 	state->bucket = bucket;
2311 
2312 	return pn;
2313 }
2314 
2315 static struct pneigh_entry *pneigh_get_next(struct seq_file *seq,
2316 					    struct pneigh_entry *pn,
2317 					    loff_t *pos)
2318 {
2319 	struct neigh_seq_state *state = seq->private;
2320 	struct net *net = seq_file_net(seq);
2321 	struct neigh_table *tbl = state->tbl;
2322 
2323 	pn = pn->next;
2324 	while (!pn) {
2325 		if (++state->bucket > PNEIGH_HASHMASK)
2326 			break;
2327 		pn = tbl->phash_buckets[state->bucket];
2328 		while (pn && !net_eq(pneigh_net(pn), net))
2329 			pn = pn->next;
2330 		if (pn)
2331 			break;
2332 	}
2333 
2334 	if (pn && pos)
2335 		--(*pos);
2336 
2337 	return pn;
2338 }
2339 
2340 static struct pneigh_entry *pneigh_get_idx(struct seq_file *seq, loff_t *pos)
2341 {
2342 	struct pneigh_entry *pn = pneigh_get_first(seq);
2343 
2344 	if (pn) {
2345 		--(*pos);
2346 		while (*pos) {
2347 			pn = pneigh_get_next(seq, pn, pos);
2348 			if (!pn)
2349 				break;
2350 		}
2351 	}
2352 	return *pos ? NULL : pn;
2353 }
2354 
2355 static void *neigh_get_idx_any(struct seq_file *seq, loff_t *pos)
2356 {
2357 	struct neigh_seq_state *state = seq->private;
2358 	void *rc;
2359 	loff_t idxpos = *pos;
2360 
2361 	rc = neigh_get_idx(seq, &idxpos);
2362 	if (!rc && !(state->flags & NEIGH_SEQ_NEIGH_ONLY))
2363 		rc = pneigh_get_idx(seq, &idxpos);
2364 
2365 	return rc;
2366 }
2367 
2368 void *neigh_seq_start(struct seq_file *seq, loff_t *pos, struct neigh_table *tbl, unsigned int neigh_seq_flags)
2369 	__acquires(tbl->lock)
2370 {
2371 	struct neigh_seq_state *state = seq->private;
2372 
2373 	state->tbl = tbl;
2374 	state->bucket = 0;
2375 	state->flags = (neigh_seq_flags & ~NEIGH_SEQ_IS_PNEIGH);
2376 
2377 	read_lock_bh(&tbl->lock);
2378 
2379 	return *pos ? neigh_get_idx_any(seq, pos) : SEQ_START_TOKEN;
2380 }
2381 EXPORT_SYMBOL(neigh_seq_start);
2382 
2383 void *neigh_seq_next(struct seq_file *seq, void *v, loff_t *pos)
2384 {
2385 	struct neigh_seq_state *state;
2386 	void *rc;
2387 
2388 	if (v == SEQ_START_TOKEN) {
2389 		rc = neigh_get_first(seq);
2390 		goto out;
2391 	}
2392 
2393 	state = seq->private;
2394 	if (!(state->flags & NEIGH_SEQ_IS_PNEIGH)) {
2395 		rc = neigh_get_next(seq, v, NULL);
2396 		if (rc)
2397 			goto out;
2398 		if (!(state->flags & NEIGH_SEQ_NEIGH_ONLY))
2399 			rc = pneigh_get_first(seq);
2400 	} else {
2401 		BUG_ON(state->flags & NEIGH_SEQ_NEIGH_ONLY);
2402 		rc = pneigh_get_next(seq, v, NULL);
2403 	}
2404 out:
2405 	++(*pos);
2406 	return rc;
2407 }
2408 EXPORT_SYMBOL(neigh_seq_next);
2409 
2410 void neigh_seq_stop(struct seq_file *seq, void *v)
2411 	__releases(tbl->lock)
2412 {
2413 	struct neigh_seq_state *state = seq->private;
2414 	struct neigh_table *tbl = state->tbl;
2415 
2416 	read_unlock_bh(&tbl->lock);
2417 }
2418 EXPORT_SYMBOL(neigh_seq_stop);
2419 
2420 /* statistics via seq_file */
2421 
2422 static void *neigh_stat_seq_start(struct seq_file *seq, loff_t *pos)
2423 {
2424 	struct neigh_table *tbl = seq->private;
2425 	int cpu;
2426 
2427 	if (*pos == 0)
2428 		return SEQ_START_TOKEN;
2429 
2430 	for (cpu = *pos-1; cpu < nr_cpu_ids; ++cpu) {
2431 		if (!cpu_possible(cpu))
2432 			continue;
2433 		*pos = cpu+1;
2434 		return per_cpu_ptr(tbl->stats, cpu);
2435 	}
2436 	return NULL;
2437 }
2438 
2439 static void *neigh_stat_seq_next(struct seq_file *seq, void *v, loff_t *pos)
2440 {
2441 	struct neigh_table *tbl = seq->private;
2442 	int cpu;
2443 
2444 	for (cpu = *pos; cpu < nr_cpu_ids; ++cpu) {
2445 		if (!cpu_possible(cpu))
2446 			continue;
2447 		*pos = cpu+1;
2448 		return per_cpu_ptr(tbl->stats, cpu);
2449 	}
2450 	return NULL;
2451 }
2452 
2453 static void neigh_stat_seq_stop(struct seq_file *seq, void *v)
2454 {
2455 
2456 }
2457 
2458 static int neigh_stat_seq_show(struct seq_file *seq, void *v)
2459 {
2460 	struct neigh_table *tbl = seq->private;
2461 	struct neigh_statistics *st = v;
2462 
2463 	if (v == SEQ_START_TOKEN) {
2464 		seq_printf(seq, "entries  allocs destroys hash_grows  lookups hits  res_failed  rcv_probes_mcast rcv_probes_ucast  periodic_gc_runs forced_gc_runs unresolved_discards\n");
2465 		return 0;
2466 	}
2467 
2468 	seq_printf(seq, "%08x  %08lx %08lx %08lx  %08lx %08lx  %08lx  "
2469 			"%08lx %08lx  %08lx %08lx %08lx\n",
2470 		   atomic_read(&tbl->entries),
2471 
2472 		   st->allocs,
2473 		   st->destroys,
2474 		   st->hash_grows,
2475 
2476 		   st->lookups,
2477 		   st->hits,
2478 
2479 		   st->res_failed,
2480 
2481 		   st->rcv_probes_mcast,
2482 		   st->rcv_probes_ucast,
2483 
2484 		   st->periodic_gc_runs,
2485 		   st->forced_gc_runs,
2486 		   st->unres_discards
2487 		   );
2488 
2489 	return 0;
2490 }
2491 
2492 static const struct seq_operations neigh_stat_seq_ops = {
2493 	.start	= neigh_stat_seq_start,
2494 	.next	= neigh_stat_seq_next,
2495 	.stop	= neigh_stat_seq_stop,
2496 	.show	= neigh_stat_seq_show,
2497 };
2498 
2499 static int neigh_stat_seq_open(struct inode *inode, struct file *file)
2500 {
2501 	int ret = seq_open(file, &neigh_stat_seq_ops);
2502 
2503 	if (!ret) {
2504 		struct seq_file *sf = file->private_data;
2505 		sf->private = PDE(inode)->data;
2506 	}
2507 	return ret;
2508 };
2509 
2510 static const struct file_operations neigh_stat_seq_fops = {
2511 	.owner	 = THIS_MODULE,
2512 	.open 	 = neigh_stat_seq_open,
2513 	.read	 = seq_read,
2514 	.llseek	 = seq_lseek,
2515 	.release = seq_release,
2516 };
2517 
2518 #endif /* CONFIG_PROC_FS */
2519 
2520 static inline size_t neigh_nlmsg_size(void)
2521 {
2522 	return NLMSG_ALIGN(sizeof(struct ndmsg))
2523 	       + nla_total_size(MAX_ADDR_LEN) /* NDA_DST */
2524 	       + nla_total_size(MAX_ADDR_LEN) /* NDA_LLADDR */
2525 	       + nla_total_size(sizeof(struct nda_cacheinfo))
2526 	       + nla_total_size(4); /* NDA_PROBES */
2527 }
2528 
2529 static void __neigh_notify(struct neighbour *n, int type, int flags)
2530 {
2531 	struct net *net = dev_net(n->dev);
2532 	struct sk_buff *skb;
2533 	int err = -ENOBUFS;
2534 
2535 	skb = nlmsg_new(neigh_nlmsg_size(), GFP_ATOMIC);
2536 	if (skb == NULL)
2537 		goto errout;
2538 
2539 	err = neigh_fill_info(skb, n, 0, 0, type, flags);
2540 	if (err < 0) {
2541 		/* -EMSGSIZE implies BUG in neigh_nlmsg_size() */
2542 		WARN_ON(err == -EMSGSIZE);
2543 		kfree_skb(skb);
2544 		goto errout;
2545 	}
2546 	rtnl_notify(skb, net, 0, RTNLGRP_NEIGH, NULL, GFP_ATOMIC);
2547 	return;
2548 errout:
2549 	if (err < 0)
2550 		rtnl_set_sk_err(net, RTNLGRP_NEIGH, err);
2551 }
2552 
2553 #ifdef CONFIG_ARPD
2554 void neigh_app_ns(struct neighbour *n)
2555 {
2556 	__neigh_notify(n, RTM_GETNEIGH, NLM_F_REQUEST);
2557 }
2558 EXPORT_SYMBOL(neigh_app_ns);
2559 #endif /* CONFIG_ARPD */
2560 
2561 #ifdef CONFIG_SYSCTL
2562 
2563 #define NEIGH_VARS_MAX 19
2564 
2565 static struct neigh_sysctl_table {
2566 	struct ctl_table_header *sysctl_header;
2567 	struct ctl_table neigh_vars[NEIGH_VARS_MAX];
2568 	char *dev_name;
2569 } neigh_sysctl_template __read_mostly = {
2570 	.neigh_vars = {
2571 		{
2572 			.procname	= "mcast_solicit",
2573 			.maxlen		= sizeof(int),
2574 			.mode		= 0644,
2575 			.proc_handler	= proc_dointvec,
2576 		},
2577 		{
2578 			.procname	= "ucast_solicit",
2579 			.maxlen		= sizeof(int),
2580 			.mode		= 0644,
2581 			.proc_handler	= proc_dointvec,
2582 		},
2583 		{
2584 			.procname	= "app_solicit",
2585 			.maxlen		= sizeof(int),
2586 			.mode		= 0644,
2587 			.proc_handler	= proc_dointvec,
2588 		},
2589 		{
2590 			.procname	= "retrans_time",
2591 			.maxlen		= sizeof(int),
2592 			.mode		= 0644,
2593 			.proc_handler	= proc_dointvec_userhz_jiffies,
2594 		},
2595 		{
2596 			.procname	= "base_reachable_time",
2597 			.maxlen		= sizeof(int),
2598 			.mode		= 0644,
2599 			.proc_handler	= proc_dointvec_jiffies,
2600 		},
2601 		{
2602 			.procname	= "delay_first_probe_time",
2603 			.maxlen		= sizeof(int),
2604 			.mode		= 0644,
2605 			.proc_handler	= proc_dointvec_jiffies,
2606 		},
2607 		{
2608 			.procname	= "gc_stale_time",
2609 			.maxlen		= sizeof(int),
2610 			.mode		= 0644,
2611 			.proc_handler	= proc_dointvec_jiffies,
2612 		},
2613 		{
2614 			.procname	= "unres_qlen",
2615 			.maxlen		= sizeof(int),
2616 			.mode		= 0644,
2617 			.proc_handler	= proc_dointvec,
2618 		},
2619 		{
2620 			.procname	= "proxy_qlen",
2621 			.maxlen		= sizeof(int),
2622 			.mode		= 0644,
2623 			.proc_handler	= proc_dointvec,
2624 		},
2625 		{
2626 			.procname	= "anycast_delay",
2627 			.maxlen		= sizeof(int),
2628 			.mode		= 0644,
2629 			.proc_handler	= proc_dointvec_userhz_jiffies,
2630 		},
2631 		{
2632 			.procname	= "proxy_delay",
2633 			.maxlen		= sizeof(int),
2634 			.mode		= 0644,
2635 			.proc_handler	= proc_dointvec_userhz_jiffies,
2636 		},
2637 		{
2638 			.procname	= "locktime",
2639 			.maxlen		= sizeof(int),
2640 			.mode		= 0644,
2641 			.proc_handler	= proc_dointvec_userhz_jiffies,
2642 		},
2643 		{
2644 			.procname	= "retrans_time_ms",
2645 			.maxlen		= sizeof(int),
2646 			.mode		= 0644,
2647 			.proc_handler	= proc_dointvec_ms_jiffies,
2648 		},
2649 		{
2650 			.procname	= "base_reachable_time_ms",
2651 			.maxlen		= sizeof(int),
2652 			.mode		= 0644,
2653 			.proc_handler	= proc_dointvec_ms_jiffies,
2654 		},
2655 		{
2656 			.procname	= "gc_interval",
2657 			.maxlen		= sizeof(int),
2658 			.mode		= 0644,
2659 			.proc_handler	= proc_dointvec_jiffies,
2660 		},
2661 		{
2662 			.procname	= "gc_thresh1",
2663 			.maxlen		= sizeof(int),
2664 			.mode		= 0644,
2665 			.proc_handler	= proc_dointvec,
2666 		},
2667 		{
2668 			.procname	= "gc_thresh2",
2669 			.maxlen		= sizeof(int),
2670 			.mode		= 0644,
2671 			.proc_handler	= proc_dointvec,
2672 		},
2673 		{
2674 			.procname	= "gc_thresh3",
2675 			.maxlen		= sizeof(int),
2676 			.mode		= 0644,
2677 			.proc_handler	= proc_dointvec,
2678 		},
2679 		{},
2680 	},
2681 };
2682 
2683 int neigh_sysctl_register(struct net_device *dev, struct neigh_parms *p,
2684 			  char *p_name, proc_handler *handler)
2685 {
2686 	struct neigh_sysctl_table *t;
2687 	const char *dev_name_source = NULL;
2688 
2689 #define NEIGH_CTL_PATH_ROOT	0
2690 #define NEIGH_CTL_PATH_PROTO	1
2691 #define NEIGH_CTL_PATH_NEIGH	2
2692 #define NEIGH_CTL_PATH_DEV	3
2693 
2694 	struct ctl_path neigh_path[] = {
2695 		{ .procname = "net",	 },
2696 		{ .procname = "proto",	 },
2697 		{ .procname = "neigh",	 },
2698 		{ .procname = "default", },
2699 		{ },
2700 	};
2701 
2702 	t = kmemdup(&neigh_sysctl_template, sizeof(*t), GFP_KERNEL);
2703 	if (!t)
2704 		goto err;
2705 
2706 	t->neigh_vars[0].data  = &p->mcast_probes;
2707 	t->neigh_vars[1].data  = &p->ucast_probes;
2708 	t->neigh_vars[2].data  = &p->app_probes;
2709 	t->neigh_vars[3].data  = &p->retrans_time;
2710 	t->neigh_vars[4].data  = &p->base_reachable_time;
2711 	t->neigh_vars[5].data  = &p->delay_probe_time;
2712 	t->neigh_vars[6].data  = &p->gc_staletime;
2713 	t->neigh_vars[7].data  = &p->queue_len;
2714 	t->neigh_vars[8].data  = &p->proxy_qlen;
2715 	t->neigh_vars[9].data  = &p->anycast_delay;
2716 	t->neigh_vars[10].data = &p->proxy_delay;
2717 	t->neigh_vars[11].data = &p->locktime;
2718 	t->neigh_vars[12].data  = &p->retrans_time;
2719 	t->neigh_vars[13].data  = &p->base_reachable_time;
2720 
2721 	if (dev) {
2722 		dev_name_source = dev->name;
2723 		/* Terminate the table early */
2724 		memset(&t->neigh_vars[14], 0, sizeof(t->neigh_vars[14]));
2725 	} else {
2726 		dev_name_source = neigh_path[NEIGH_CTL_PATH_DEV].procname;
2727 		t->neigh_vars[14].data = (int *)(p + 1);
2728 		t->neigh_vars[15].data = (int *)(p + 1) + 1;
2729 		t->neigh_vars[16].data = (int *)(p + 1) + 2;
2730 		t->neigh_vars[17].data = (int *)(p + 1) + 3;
2731 	}
2732 
2733 
2734 	if (handler) {
2735 		/* RetransTime */
2736 		t->neigh_vars[3].proc_handler = handler;
2737 		t->neigh_vars[3].extra1 = dev;
2738 		/* ReachableTime */
2739 		t->neigh_vars[4].proc_handler = handler;
2740 		t->neigh_vars[4].extra1 = dev;
2741 		/* RetransTime (in milliseconds)*/
2742 		t->neigh_vars[12].proc_handler = handler;
2743 		t->neigh_vars[12].extra1 = dev;
2744 		/* ReachableTime (in milliseconds) */
2745 		t->neigh_vars[13].proc_handler = handler;
2746 		t->neigh_vars[13].extra1 = dev;
2747 	}
2748 
2749 	t->dev_name = kstrdup(dev_name_source, GFP_KERNEL);
2750 	if (!t->dev_name)
2751 		goto free;
2752 
2753 	neigh_path[NEIGH_CTL_PATH_DEV].procname = t->dev_name;
2754 	neigh_path[NEIGH_CTL_PATH_PROTO].procname = p_name;
2755 
2756 	t->sysctl_header =
2757 		register_net_sysctl_table(neigh_parms_net(p), neigh_path, t->neigh_vars);
2758 	if (!t->sysctl_header)
2759 		goto free_procname;
2760 
2761 	p->sysctl_table = t;
2762 	return 0;
2763 
2764 free_procname:
2765 	kfree(t->dev_name);
2766 free:
2767 	kfree(t);
2768 err:
2769 	return -ENOBUFS;
2770 }
2771 EXPORT_SYMBOL(neigh_sysctl_register);
2772 
2773 void neigh_sysctl_unregister(struct neigh_parms *p)
2774 {
2775 	if (p->sysctl_table) {
2776 		struct neigh_sysctl_table *t = p->sysctl_table;
2777 		p->sysctl_table = NULL;
2778 		unregister_sysctl_table(t->sysctl_header);
2779 		kfree(t->dev_name);
2780 		kfree(t);
2781 	}
2782 }
2783 EXPORT_SYMBOL(neigh_sysctl_unregister);
2784 
2785 #endif	/* CONFIG_SYSCTL */
2786 
2787 static int __init neigh_init(void)
2788 {
2789 	rtnl_register(PF_UNSPEC, RTM_NEWNEIGH, neigh_add, NULL);
2790 	rtnl_register(PF_UNSPEC, RTM_DELNEIGH, neigh_delete, NULL);
2791 	rtnl_register(PF_UNSPEC, RTM_GETNEIGH, NULL, neigh_dump_info);
2792 
2793 	rtnl_register(PF_UNSPEC, RTM_GETNEIGHTBL, NULL, neightbl_dump_info);
2794 	rtnl_register(PF_UNSPEC, RTM_SETNEIGHTBL, neightbl_set, NULL);
2795 
2796 	return 0;
2797 }
2798 
2799 subsys_initcall(neigh_init);
2800 
2801