xref: /linux/net/ipv6/ip6_fib.c (revision 606d099cdd1080bbb50ea50dc52d98252f8f10a1)
1 /*
2  *	Linux INET6 implementation
3  *	Forwarding Information Database
4  *
5  *	Authors:
6  *	Pedro Roque		<roque@di.fc.ul.pt>
7  *
8  *	$Id: ip6_fib.c,v 1.25 2001/10/31 21:55:55 davem Exp $
9  *
10  *	This program is free software; you can redistribute it and/or
11  *      modify it under the terms of the GNU General Public License
12  *      as published by the Free Software Foundation; either version
13  *      2 of the License, or (at your option) any later version.
14  */
15 
16 /*
17  * 	Changes:
18  * 	Yuji SEKIYA @USAGI:	Support default route on router node;
19  * 				remove ip6_null_entry from the top of
20  * 				routing table.
21  * 	Ville Nuorvala:		Fixed routing subtrees.
22  */
23 #include <linux/errno.h>
24 #include <linux/types.h>
25 #include <linux/net.h>
26 #include <linux/route.h>
27 #include <linux/netdevice.h>
28 #include <linux/in6.h>
29 #include <linux/init.h>
30 #include <linux/list.h>
31 
32 #ifdef 	CONFIG_PROC_FS
33 #include <linux/proc_fs.h>
34 #endif
35 
36 #include <net/ipv6.h>
37 #include <net/ndisc.h>
38 #include <net/addrconf.h>
39 
40 #include <net/ip6_fib.h>
41 #include <net/ip6_route.h>
42 
43 #define RT6_DEBUG 2
44 
45 #if RT6_DEBUG >= 3
46 #define RT6_TRACE(x...) printk(KERN_DEBUG x)
47 #else
48 #define RT6_TRACE(x...) do { ; } while (0)
49 #endif
50 
51 struct rt6_statistics	rt6_stats;
52 
53 static struct kmem_cache * fib6_node_kmem __read_mostly;
54 
55 enum fib_walk_state_t
56 {
57 #ifdef CONFIG_IPV6_SUBTREES
58 	FWS_S,
59 #endif
60 	FWS_L,
61 	FWS_R,
62 	FWS_C,
63 	FWS_U
64 };
65 
66 struct fib6_cleaner_t
67 {
68 	struct fib6_walker_t w;
69 	int (*func)(struct rt6_info *, void *arg);
70 	void *arg;
71 };
72 
73 static DEFINE_RWLOCK(fib6_walker_lock);
74 
75 #ifdef CONFIG_IPV6_SUBTREES
76 #define FWS_INIT FWS_S
77 #else
78 #define FWS_INIT FWS_L
79 #endif
80 
81 static void fib6_prune_clones(struct fib6_node *fn, struct rt6_info *rt);
82 static struct rt6_info * fib6_find_prefix(struct fib6_node *fn);
83 static struct fib6_node * fib6_repair_tree(struct fib6_node *fn);
84 static int fib6_walk(struct fib6_walker_t *w);
85 static int fib6_walk_continue(struct fib6_walker_t *w);
86 
87 /*
88  *	A routing update causes an increase of the serial number on the
89  *	affected subtree. This allows for cached routes to be asynchronously
90  *	tested when modifications are made to the destination cache as a
91  *	result of redirects, path MTU changes, etc.
92  */
93 
94 static __u32 rt_sernum;
95 
96 static DEFINE_TIMER(ip6_fib_timer, fib6_run_gc, 0, 0);
97 
98 static struct fib6_walker_t fib6_walker_list = {
99 	.prev	= &fib6_walker_list,
100 	.next	= &fib6_walker_list,
101 };
102 
103 #define FOR_WALKERS(w) for ((w)=fib6_walker_list.next; (w) != &fib6_walker_list; (w)=(w)->next)
104 
105 static inline void fib6_walker_link(struct fib6_walker_t *w)
106 {
107 	write_lock_bh(&fib6_walker_lock);
108 	w->next = fib6_walker_list.next;
109 	w->prev = &fib6_walker_list;
110 	w->next->prev = w;
111 	w->prev->next = w;
112 	write_unlock_bh(&fib6_walker_lock);
113 }
114 
115 static inline void fib6_walker_unlink(struct fib6_walker_t *w)
116 {
117 	write_lock_bh(&fib6_walker_lock);
118 	w->next->prev = w->prev;
119 	w->prev->next = w->next;
120 	w->prev = w->next = w;
121 	write_unlock_bh(&fib6_walker_lock);
122 }
123 static __inline__ u32 fib6_new_sernum(void)
124 {
125 	u32 n = ++rt_sernum;
126 	if ((__s32)n <= 0)
127 		rt_sernum = n = 1;
128 	return n;
129 }
130 
131 /*
132  *	Auxiliary address test functions for the radix tree.
133  *
134  *	These assume a 32bit processor (although it will work on
135  *	64bit processors)
136  */
137 
138 /*
139  *	test bit
140  */
141 
142 static __inline__ __be32 addr_bit_set(void *token, int fn_bit)
143 {
144 	__be32 *addr = token;
145 
146 	return htonl(1 << ((~fn_bit)&0x1F)) & addr[fn_bit>>5];
147 }
148 
149 static __inline__ struct fib6_node * node_alloc(void)
150 {
151 	struct fib6_node *fn;
152 
153 	if ((fn = kmem_cache_alloc(fib6_node_kmem, GFP_ATOMIC)) != NULL)
154 		memset(fn, 0, sizeof(struct fib6_node));
155 
156 	return fn;
157 }
158 
159 static __inline__ void node_free(struct fib6_node * fn)
160 {
161 	kmem_cache_free(fib6_node_kmem, fn);
162 }
163 
164 static __inline__ void rt6_release(struct rt6_info *rt)
165 {
166 	if (atomic_dec_and_test(&rt->rt6i_ref))
167 		dst_free(&rt->u.dst);
168 }
169 
170 static struct fib6_table fib6_main_tbl = {
171 	.tb6_id		= RT6_TABLE_MAIN,
172 	.tb6_root	= {
173 		.leaf		= &ip6_null_entry,
174 		.fn_flags	= RTN_ROOT | RTN_TL_ROOT | RTN_RTINFO,
175 	},
176 };
177 
178 #ifdef CONFIG_IPV6_MULTIPLE_TABLES
179 #define FIB_TABLE_HASHSZ 256
180 #else
181 #define FIB_TABLE_HASHSZ 1
182 #endif
183 static struct hlist_head fib_table_hash[FIB_TABLE_HASHSZ];
184 
185 static void fib6_link_table(struct fib6_table *tb)
186 {
187 	unsigned int h;
188 
189 	/*
190 	 * Initialize table lock at a single place to give lockdep a key,
191 	 * tables aren't visible prior to being linked to the list.
192 	 */
193 	rwlock_init(&tb->tb6_lock);
194 
195 	h = tb->tb6_id & (FIB_TABLE_HASHSZ - 1);
196 
197 	/*
198 	 * No protection necessary, this is the only list mutatation
199 	 * operation, tables never disappear once they exist.
200 	 */
201 	hlist_add_head_rcu(&tb->tb6_hlist, &fib_table_hash[h]);
202 }
203 
204 #ifdef CONFIG_IPV6_MULTIPLE_TABLES
205 static struct fib6_table fib6_local_tbl = {
206 	.tb6_id		= RT6_TABLE_LOCAL,
207 	.tb6_root 	= {
208 		.leaf		= &ip6_null_entry,
209 		.fn_flags	= RTN_ROOT | RTN_TL_ROOT | RTN_RTINFO,
210 	},
211 };
212 
213 static struct fib6_table *fib6_alloc_table(u32 id)
214 {
215 	struct fib6_table *table;
216 
217 	table = kzalloc(sizeof(*table), GFP_ATOMIC);
218 	if (table != NULL) {
219 		table->tb6_id = id;
220 		table->tb6_root.leaf = &ip6_null_entry;
221 		table->tb6_root.fn_flags = RTN_ROOT | RTN_TL_ROOT | RTN_RTINFO;
222 	}
223 
224 	return table;
225 }
226 
227 struct fib6_table *fib6_new_table(u32 id)
228 {
229 	struct fib6_table *tb;
230 
231 	if (id == 0)
232 		id = RT6_TABLE_MAIN;
233 	tb = fib6_get_table(id);
234 	if (tb)
235 		return tb;
236 
237 	tb = fib6_alloc_table(id);
238 	if (tb != NULL)
239 		fib6_link_table(tb);
240 
241 	return tb;
242 }
243 
244 struct fib6_table *fib6_get_table(u32 id)
245 {
246 	struct fib6_table *tb;
247 	struct hlist_node *node;
248 	unsigned int h;
249 
250 	if (id == 0)
251 		id = RT6_TABLE_MAIN;
252 	h = id & (FIB_TABLE_HASHSZ - 1);
253 	rcu_read_lock();
254 	hlist_for_each_entry_rcu(tb, node, &fib_table_hash[h], tb6_hlist) {
255 		if (tb->tb6_id == id) {
256 			rcu_read_unlock();
257 			return tb;
258 		}
259 	}
260 	rcu_read_unlock();
261 
262 	return NULL;
263 }
264 
265 static void __init fib6_tables_init(void)
266 {
267 	fib6_link_table(&fib6_main_tbl);
268 	fib6_link_table(&fib6_local_tbl);
269 }
270 
271 #else
272 
273 struct fib6_table *fib6_new_table(u32 id)
274 {
275 	return fib6_get_table(id);
276 }
277 
278 struct fib6_table *fib6_get_table(u32 id)
279 {
280 	return &fib6_main_tbl;
281 }
282 
283 struct dst_entry *fib6_rule_lookup(struct flowi *fl, int flags,
284 				   pol_lookup_t lookup)
285 {
286 	return (struct dst_entry *) lookup(&fib6_main_tbl, fl, flags);
287 }
288 
289 static void __init fib6_tables_init(void)
290 {
291 	fib6_link_table(&fib6_main_tbl);
292 }
293 
294 #endif
295 
296 static int fib6_dump_node(struct fib6_walker_t *w)
297 {
298 	int res;
299 	struct rt6_info *rt;
300 
301 	for (rt = w->leaf; rt; rt = rt->u.next) {
302 		res = rt6_dump_route(rt, w->args);
303 		if (res < 0) {
304 			/* Frame is full, suspend walking */
305 			w->leaf = rt;
306 			return 1;
307 		}
308 		BUG_TRAP(res!=0);
309 	}
310 	w->leaf = NULL;
311 	return 0;
312 }
313 
314 static void fib6_dump_end(struct netlink_callback *cb)
315 {
316 	struct fib6_walker_t *w = (void*)cb->args[2];
317 
318 	if (w) {
319 		cb->args[2] = 0;
320 		kfree(w);
321 	}
322 	cb->done = (void*)cb->args[3];
323 	cb->args[1] = 3;
324 }
325 
326 static int fib6_dump_done(struct netlink_callback *cb)
327 {
328 	fib6_dump_end(cb);
329 	return cb->done ? cb->done(cb) : 0;
330 }
331 
332 static int fib6_dump_table(struct fib6_table *table, struct sk_buff *skb,
333 			   struct netlink_callback *cb)
334 {
335 	struct fib6_walker_t *w;
336 	int res;
337 
338 	w = (void *)cb->args[2];
339 	w->root = &table->tb6_root;
340 
341 	if (cb->args[4] == 0) {
342 		read_lock_bh(&table->tb6_lock);
343 		res = fib6_walk(w);
344 		read_unlock_bh(&table->tb6_lock);
345 		if (res > 0)
346 			cb->args[4] = 1;
347 	} else {
348 		read_lock_bh(&table->tb6_lock);
349 		res = fib6_walk_continue(w);
350 		read_unlock_bh(&table->tb6_lock);
351 		if (res != 0) {
352 			if (res < 0)
353 				fib6_walker_unlink(w);
354 			goto end;
355 		}
356 		fib6_walker_unlink(w);
357 		cb->args[4] = 0;
358 	}
359 end:
360 	return res;
361 }
362 
363 int inet6_dump_fib(struct sk_buff *skb, struct netlink_callback *cb)
364 {
365 	unsigned int h, s_h;
366 	unsigned int e = 0, s_e;
367 	struct rt6_rtnl_dump_arg arg;
368 	struct fib6_walker_t *w;
369 	struct fib6_table *tb;
370 	struct hlist_node *node;
371 	int res = 0;
372 
373 	s_h = cb->args[0];
374 	s_e = cb->args[1];
375 
376 	w = (void *)cb->args[2];
377 	if (w == NULL) {
378 		/* New dump:
379 		 *
380 		 * 1. hook callback destructor.
381 		 */
382 		cb->args[3] = (long)cb->done;
383 		cb->done = fib6_dump_done;
384 
385 		/*
386 		 * 2. allocate and initialize walker.
387 		 */
388 		w = kzalloc(sizeof(*w), GFP_ATOMIC);
389 		if (w == NULL)
390 			return -ENOMEM;
391 		w->func = fib6_dump_node;
392 		cb->args[2] = (long)w;
393 	}
394 
395 	arg.skb = skb;
396 	arg.cb = cb;
397 	w->args = &arg;
398 
399 	for (h = s_h; h < FIB_TABLE_HASHSZ; h++, s_e = 0) {
400 		e = 0;
401 		hlist_for_each_entry(tb, node, &fib_table_hash[h], tb6_hlist) {
402 			if (e < s_e)
403 				goto next;
404 			res = fib6_dump_table(tb, skb, cb);
405 			if (res != 0)
406 				goto out;
407 next:
408 			e++;
409 		}
410 	}
411 out:
412 	cb->args[1] = e;
413 	cb->args[0] = h;
414 
415 	res = res < 0 ? res : skb->len;
416 	if (res <= 0)
417 		fib6_dump_end(cb);
418 	return res;
419 }
420 
421 /*
422  *	Routing Table
423  *
424  *	return the appropriate node for a routing tree "add" operation
425  *	by either creating and inserting or by returning an existing
426  *	node.
427  */
428 
429 static struct fib6_node * fib6_add_1(struct fib6_node *root, void *addr,
430 				     int addrlen, int plen,
431 				     int offset)
432 {
433 	struct fib6_node *fn, *in, *ln;
434 	struct fib6_node *pn = NULL;
435 	struct rt6key *key;
436 	int	bit;
437        	__be32	dir = 0;
438 	__u32	sernum = fib6_new_sernum();
439 
440 	RT6_TRACE("fib6_add_1\n");
441 
442 	/* insert node in tree */
443 
444 	fn = root;
445 
446 	do {
447 		key = (struct rt6key *)((u8 *)fn->leaf + offset);
448 
449 		/*
450 		 *	Prefix match
451 		 */
452 		if (plen < fn->fn_bit ||
453 		    !ipv6_prefix_equal(&key->addr, addr, fn->fn_bit))
454 			goto insert_above;
455 
456 		/*
457 		 *	Exact match ?
458 		 */
459 
460 		if (plen == fn->fn_bit) {
461 			/* clean up an intermediate node */
462 			if ((fn->fn_flags & RTN_RTINFO) == 0) {
463 				rt6_release(fn->leaf);
464 				fn->leaf = NULL;
465 			}
466 
467 			fn->fn_sernum = sernum;
468 
469 			return fn;
470 		}
471 
472 		/*
473 		 *	We have more bits to go
474 		 */
475 
476 		/* Try to walk down on tree. */
477 		fn->fn_sernum = sernum;
478 		dir = addr_bit_set(addr, fn->fn_bit);
479 		pn = fn;
480 		fn = dir ? fn->right: fn->left;
481 	} while (fn);
482 
483 	/*
484 	 *	We walked to the bottom of tree.
485 	 *	Create new leaf node without children.
486 	 */
487 
488 	ln = node_alloc();
489 
490 	if (ln == NULL)
491 		return NULL;
492 	ln->fn_bit = plen;
493 
494 	ln->parent = pn;
495 	ln->fn_sernum = sernum;
496 
497 	if (dir)
498 		pn->right = ln;
499 	else
500 		pn->left  = ln;
501 
502 	return ln;
503 
504 
505 insert_above:
506 	/*
507 	 * split since we don't have a common prefix anymore or
508 	 * we have a less significant route.
509 	 * we've to insert an intermediate node on the list
510 	 * this new node will point to the one we need to create
511 	 * and the current
512 	 */
513 
514 	pn = fn->parent;
515 
516 	/* find 1st bit in difference between the 2 addrs.
517 
518 	   See comment in __ipv6_addr_diff: bit may be an invalid value,
519 	   but if it is >= plen, the value is ignored in any case.
520 	 */
521 
522 	bit = __ipv6_addr_diff(addr, &key->addr, addrlen);
523 
524 	/*
525 	 *		(intermediate)[in]
526 	 *	          /	   \
527 	 *	(new leaf node)[ln] (old node)[fn]
528 	 */
529 	if (plen > bit) {
530 		in = node_alloc();
531 		ln = node_alloc();
532 
533 		if (in == NULL || ln == NULL) {
534 			if (in)
535 				node_free(in);
536 			if (ln)
537 				node_free(ln);
538 			return NULL;
539 		}
540 
541 		/*
542 		 * new intermediate node.
543 		 * RTN_RTINFO will
544 		 * be off since that an address that chooses one of
545 		 * the branches would not match less specific routes
546 		 * in the other branch
547 		 */
548 
549 		in->fn_bit = bit;
550 
551 		in->parent = pn;
552 		in->leaf = fn->leaf;
553 		atomic_inc(&in->leaf->rt6i_ref);
554 
555 		in->fn_sernum = sernum;
556 
557 		/* update parent pointer */
558 		if (dir)
559 			pn->right = in;
560 		else
561 			pn->left  = in;
562 
563 		ln->fn_bit = plen;
564 
565 		ln->parent = in;
566 		fn->parent = in;
567 
568 		ln->fn_sernum = sernum;
569 
570 		if (addr_bit_set(addr, bit)) {
571 			in->right = ln;
572 			in->left  = fn;
573 		} else {
574 			in->left  = ln;
575 			in->right = fn;
576 		}
577 	} else { /* plen <= bit */
578 
579 		/*
580 		 *		(new leaf node)[ln]
581 		 *	          /	   \
582 		 *	     (old node)[fn] NULL
583 		 */
584 
585 		ln = node_alloc();
586 
587 		if (ln == NULL)
588 			return NULL;
589 
590 		ln->fn_bit = plen;
591 
592 		ln->parent = pn;
593 
594 		ln->fn_sernum = sernum;
595 
596 		if (dir)
597 			pn->right = ln;
598 		else
599 			pn->left  = ln;
600 
601 		if (addr_bit_set(&key->addr, plen))
602 			ln->right = fn;
603 		else
604 			ln->left  = fn;
605 
606 		fn->parent = ln;
607 	}
608 	return ln;
609 }
610 
611 /*
612  *	Insert routing information in a node.
613  */
614 
615 static int fib6_add_rt2node(struct fib6_node *fn, struct rt6_info *rt,
616 			    struct nl_info *info)
617 {
618 	struct rt6_info *iter = NULL;
619 	struct rt6_info **ins;
620 
621 	ins = &fn->leaf;
622 
623 	if (fn->fn_flags&RTN_TL_ROOT &&
624 	    fn->leaf == &ip6_null_entry &&
625 	    !(rt->rt6i_flags & (RTF_DEFAULT | RTF_ADDRCONF)) ){
626 		fn->leaf = rt;
627 		rt->u.next = NULL;
628 		goto out;
629 	}
630 
631 	for (iter = fn->leaf; iter; iter=iter->u.next) {
632 		/*
633 		 *	Search for duplicates
634 		 */
635 
636 		if (iter->rt6i_metric == rt->rt6i_metric) {
637 			/*
638 			 *	Same priority level
639 			 */
640 
641 			if (iter->rt6i_dev == rt->rt6i_dev &&
642 			    iter->rt6i_idev == rt->rt6i_idev &&
643 			    ipv6_addr_equal(&iter->rt6i_gateway,
644 					    &rt->rt6i_gateway)) {
645 				if (!(iter->rt6i_flags&RTF_EXPIRES))
646 					return -EEXIST;
647 				iter->rt6i_expires = rt->rt6i_expires;
648 				if (!(rt->rt6i_flags&RTF_EXPIRES)) {
649 					iter->rt6i_flags &= ~RTF_EXPIRES;
650 					iter->rt6i_expires = 0;
651 				}
652 				return -EEXIST;
653 			}
654 		}
655 
656 		if (iter->rt6i_metric > rt->rt6i_metric)
657 			break;
658 
659 		ins = &iter->u.next;
660 	}
661 
662 	/*
663 	 *	insert node
664 	 */
665 
666 out:
667 	rt->u.next = iter;
668 	*ins = rt;
669 	rt->rt6i_node = fn;
670 	atomic_inc(&rt->rt6i_ref);
671 	inet6_rt_notify(RTM_NEWROUTE, rt, info);
672 	rt6_stats.fib_rt_entries++;
673 
674 	if ((fn->fn_flags & RTN_RTINFO) == 0) {
675 		rt6_stats.fib_route_nodes++;
676 		fn->fn_flags |= RTN_RTINFO;
677 	}
678 
679 	return 0;
680 }
681 
682 static __inline__ void fib6_start_gc(struct rt6_info *rt)
683 {
684 	if (ip6_fib_timer.expires == 0 &&
685 	    (rt->rt6i_flags & (RTF_EXPIRES|RTF_CACHE)))
686 		mod_timer(&ip6_fib_timer, jiffies + ip6_rt_gc_interval);
687 }
688 
689 void fib6_force_start_gc(void)
690 {
691 	if (ip6_fib_timer.expires == 0)
692 		mod_timer(&ip6_fib_timer, jiffies + ip6_rt_gc_interval);
693 }
694 
695 /*
696  *	Add routing information to the routing tree.
697  *	<destination addr>/<source addr>
698  *	with source addr info in sub-trees
699  */
700 
701 int fib6_add(struct fib6_node *root, struct rt6_info *rt, struct nl_info *info)
702 {
703 	struct fib6_node *fn, *pn = NULL;
704 	int err = -ENOMEM;
705 
706 	fn = fib6_add_1(root, &rt->rt6i_dst.addr, sizeof(struct in6_addr),
707 			rt->rt6i_dst.plen, offsetof(struct rt6_info, rt6i_dst));
708 
709 	if (fn == NULL)
710 		goto out;
711 
712 	pn = fn;
713 
714 #ifdef CONFIG_IPV6_SUBTREES
715 	if (rt->rt6i_src.plen) {
716 		struct fib6_node *sn;
717 
718 		if (fn->subtree == NULL) {
719 			struct fib6_node *sfn;
720 
721 			/*
722 			 * Create subtree.
723 			 *
724 			 *		fn[main tree]
725 			 *		|
726 			 *		sfn[subtree root]
727 			 *		   \
728 			 *		    sn[new leaf node]
729 			 */
730 
731 			/* Create subtree root node */
732 			sfn = node_alloc();
733 			if (sfn == NULL)
734 				goto st_failure;
735 
736 			sfn->leaf = &ip6_null_entry;
737 			atomic_inc(&ip6_null_entry.rt6i_ref);
738 			sfn->fn_flags = RTN_ROOT;
739 			sfn->fn_sernum = fib6_new_sernum();
740 
741 			/* Now add the first leaf node to new subtree */
742 
743 			sn = fib6_add_1(sfn, &rt->rt6i_src.addr,
744 					sizeof(struct in6_addr), rt->rt6i_src.plen,
745 					offsetof(struct rt6_info, rt6i_src));
746 
747 			if (sn == NULL) {
748 				/* If it is failed, discard just allocated
749 				   root, and then (in st_failure) stale node
750 				   in main tree.
751 				 */
752 				node_free(sfn);
753 				goto st_failure;
754 			}
755 
756 			/* Now link new subtree to main tree */
757 			sfn->parent = fn;
758 			fn->subtree = sfn;
759 		} else {
760 			sn = fib6_add_1(fn->subtree, &rt->rt6i_src.addr,
761 					sizeof(struct in6_addr), rt->rt6i_src.plen,
762 					offsetof(struct rt6_info, rt6i_src));
763 
764 			if (sn == NULL)
765 				goto st_failure;
766 		}
767 
768 		if (fn->leaf == NULL) {
769 			fn->leaf = rt;
770 			atomic_inc(&rt->rt6i_ref);
771 		}
772 		fn = sn;
773 	}
774 #endif
775 
776 	err = fib6_add_rt2node(fn, rt, info);
777 
778 	if (err == 0) {
779 		fib6_start_gc(rt);
780 		if (!(rt->rt6i_flags&RTF_CACHE))
781 			fib6_prune_clones(pn, rt);
782 	}
783 
784 out:
785 	if (err) {
786 #ifdef CONFIG_IPV6_SUBTREES
787 		/*
788 		 * If fib6_add_1 has cleared the old leaf pointer in the
789 		 * super-tree leaf node we have to find a new one for it.
790 		 */
791 		if (pn != fn && !pn->leaf && !(pn->fn_flags & RTN_RTINFO)) {
792 			pn->leaf = fib6_find_prefix(pn);
793 #if RT6_DEBUG >= 2
794 			if (!pn->leaf) {
795 				BUG_TRAP(pn->leaf != NULL);
796 				pn->leaf = &ip6_null_entry;
797 			}
798 #endif
799 			atomic_inc(&pn->leaf->rt6i_ref);
800 		}
801 #endif
802 		dst_free(&rt->u.dst);
803 	}
804 	return err;
805 
806 #ifdef CONFIG_IPV6_SUBTREES
807 	/* Subtree creation failed, probably main tree node
808 	   is orphan. If it is, shoot it.
809 	 */
810 st_failure:
811 	if (fn && !(fn->fn_flags & (RTN_RTINFO|RTN_ROOT)))
812 		fib6_repair_tree(fn);
813 	dst_free(&rt->u.dst);
814 	return err;
815 #endif
816 }
817 
818 /*
819  *	Routing tree lookup
820  *
821  */
822 
823 struct lookup_args {
824 	int		offset;		/* key offset on rt6_info	*/
825 	struct in6_addr	*addr;		/* search key			*/
826 };
827 
828 static struct fib6_node * fib6_lookup_1(struct fib6_node *root,
829 					struct lookup_args *args)
830 {
831 	struct fib6_node *fn;
832 	__be32 dir;
833 
834 	if (unlikely(args->offset == 0))
835 		return NULL;
836 
837 	/*
838 	 *	Descend on a tree
839 	 */
840 
841 	fn = root;
842 
843 	for (;;) {
844 		struct fib6_node *next;
845 
846 		dir = addr_bit_set(args->addr, fn->fn_bit);
847 
848 		next = dir ? fn->right : fn->left;
849 
850 		if (next) {
851 			fn = next;
852 			continue;
853 		}
854 
855 		break;
856 	}
857 
858 	while(fn) {
859 		if (FIB6_SUBTREE(fn) || fn->fn_flags & RTN_RTINFO) {
860 			struct rt6key *key;
861 
862 			key = (struct rt6key *) ((u8 *) fn->leaf +
863 						 args->offset);
864 
865 			if (ipv6_prefix_equal(&key->addr, args->addr, key->plen)) {
866 #ifdef CONFIG_IPV6_SUBTREES
867 				if (fn->subtree)
868 					fn = fib6_lookup_1(fn->subtree, args + 1);
869 #endif
870 				if (!fn || fn->fn_flags & RTN_RTINFO)
871 					return fn;
872 			}
873 		}
874 
875 		if (fn->fn_flags & RTN_ROOT)
876 			break;
877 
878 		fn = fn->parent;
879 	}
880 
881 	return NULL;
882 }
883 
884 struct fib6_node * fib6_lookup(struct fib6_node *root, struct in6_addr *daddr,
885 			       struct in6_addr *saddr)
886 {
887 	struct fib6_node *fn;
888 	struct lookup_args args[] = {
889 		{
890 			.offset = offsetof(struct rt6_info, rt6i_dst),
891 			.addr = daddr,
892 		},
893 #ifdef CONFIG_IPV6_SUBTREES
894 		{
895 			.offset = offsetof(struct rt6_info, rt6i_src),
896 			.addr = saddr,
897 		},
898 #endif
899 		{
900 			.offset = 0,	/* sentinel */
901 		}
902 	};
903 
904 	fn = fib6_lookup_1(root, daddr ? args : args + 1);
905 
906 	if (fn == NULL || fn->fn_flags & RTN_TL_ROOT)
907 		fn = root;
908 
909 	return fn;
910 }
911 
912 /*
913  *	Get node with specified destination prefix (and source prefix,
914  *	if subtrees are used)
915  */
916 
917 
918 static struct fib6_node * fib6_locate_1(struct fib6_node *root,
919 					struct in6_addr *addr,
920 					int plen, int offset)
921 {
922 	struct fib6_node *fn;
923 
924 	for (fn = root; fn ; ) {
925 		struct rt6key *key = (struct rt6key *)((u8 *)fn->leaf + offset);
926 
927 		/*
928 		 *	Prefix match
929 		 */
930 		if (plen < fn->fn_bit ||
931 		    !ipv6_prefix_equal(&key->addr, addr, fn->fn_bit))
932 			return NULL;
933 
934 		if (plen == fn->fn_bit)
935 			return fn;
936 
937 		/*
938 		 *	We have more bits to go
939 		 */
940 		if (addr_bit_set(addr, fn->fn_bit))
941 			fn = fn->right;
942 		else
943 			fn = fn->left;
944 	}
945 	return NULL;
946 }
947 
948 struct fib6_node * fib6_locate(struct fib6_node *root,
949 			       struct in6_addr *daddr, int dst_len,
950 			       struct in6_addr *saddr, int src_len)
951 {
952 	struct fib6_node *fn;
953 
954 	fn = fib6_locate_1(root, daddr, dst_len,
955 			   offsetof(struct rt6_info, rt6i_dst));
956 
957 #ifdef CONFIG_IPV6_SUBTREES
958 	if (src_len) {
959 		BUG_TRAP(saddr!=NULL);
960 		if (fn && fn->subtree)
961 			fn = fib6_locate_1(fn->subtree, saddr, src_len,
962 					   offsetof(struct rt6_info, rt6i_src));
963 	}
964 #endif
965 
966 	if (fn && fn->fn_flags&RTN_RTINFO)
967 		return fn;
968 
969 	return NULL;
970 }
971 
972 
973 /*
974  *	Deletion
975  *
976  */
977 
978 static struct rt6_info * fib6_find_prefix(struct fib6_node *fn)
979 {
980 	if (fn->fn_flags&RTN_ROOT)
981 		return &ip6_null_entry;
982 
983 	while(fn) {
984 		if(fn->left)
985 			return fn->left->leaf;
986 
987 		if(fn->right)
988 			return fn->right->leaf;
989 
990 		fn = FIB6_SUBTREE(fn);
991 	}
992 	return NULL;
993 }
994 
995 /*
996  *	Called to trim the tree of intermediate nodes when possible. "fn"
997  *	is the node we want to try and remove.
998  */
999 
1000 static struct fib6_node * fib6_repair_tree(struct fib6_node *fn)
1001 {
1002 	int children;
1003 	int nstate;
1004 	struct fib6_node *child, *pn;
1005 	struct fib6_walker_t *w;
1006 	int iter = 0;
1007 
1008 	for (;;) {
1009 		RT6_TRACE("fixing tree: plen=%d iter=%d\n", fn->fn_bit, iter);
1010 		iter++;
1011 
1012 		BUG_TRAP(!(fn->fn_flags&RTN_RTINFO));
1013 		BUG_TRAP(!(fn->fn_flags&RTN_TL_ROOT));
1014 		BUG_TRAP(fn->leaf==NULL);
1015 
1016 		children = 0;
1017 		child = NULL;
1018 		if (fn->right) child = fn->right, children |= 1;
1019 		if (fn->left) child = fn->left, children |= 2;
1020 
1021 		if (children == 3 || FIB6_SUBTREE(fn)
1022 #ifdef CONFIG_IPV6_SUBTREES
1023 		    /* Subtree root (i.e. fn) may have one child */
1024 		    || (children && fn->fn_flags&RTN_ROOT)
1025 #endif
1026 		    ) {
1027 			fn->leaf = fib6_find_prefix(fn);
1028 #if RT6_DEBUG >= 2
1029 			if (fn->leaf==NULL) {
1030 				BUG_TRAP(fn->leaf);
1031 				fn->leaf = &ip6_null_entry;
1032 			}
1033 #endif
1034 			atomic_inc(&fn->leaf->rt6i_ref);
1035 			return fn->parent;
1036 		}
1037 
1038 		pn = fn->parent;
1039 #ifdef CONFIG_IPV6_SUBTREES
1040 		if (FIB6_SUBTREE(pn) == fn) {
1041 			BUG_TRAP(fn->fn_flags&RTN_ROOT);
1042 			FIB6_SUBTREE(pn) = NULL;
1043 			nstate = FWS_L;
1044 		} else {
1045 			BUG_TRAP(!(fn->fn_flags&RTN_ROOT));
1046 #endif
1047 			if (pn->right == fn) pn->right = child;
1048 			else if (pn->left == fn) pn->left = child;
1049 #if RT6_DEBUG >= 2
1050 			else BUG_TRAP(0);
1051 #endif
1052 			if (child)
1053 				child->parent = pn;
1054 			nstate = FWS_R;
1055 #ifdef CONFIG_IPV6_SUBTREES
1056 		}
1057 #endif
1058 
1059 		read_lock(&fib6_walker_lock);
1060 		FOR_WALKERS(w) {
1061 			if (child == NULL) {
1062 				if (w->root == fn) {
1063 					w->root = w->node = NULL;
1064 					RT6_TRACE("W %p adjusted by delroot 1\n", w);
1065 				} else if (w->node == fn) {
1066 					RT6_TRACE("W %p adjusted by delnode 1, s=%d/%d\n", w, w->state, nstate);
1067 					w->node = pn;
1068 					w->state = nstate;
1069 				}
1070 			} else {
1071 				if (w->root == fn) {
1072 					w->root = child;
1073 					RT6_TRACE("W %p adjusted by delroot 2\n", w);
1074 				}
1075 				if (w->node == fn) {
1076 					w->node = child;
1077 					if (children&2) {
1078 						RT6_TRACE("W %p adjusted by delnode 2, s=%d\n", w, w->state);
1079 						w->state = w->state>=FWS_R ? FWS_U : FWS_INIT;
1080 					} else {
1081 						RT6_TRACE("W %p adjusted by delnode 2, s=%d\n", w, w->state);
1082 						w->state = w->state>=FWS_C ? FWS_U : FWS_INIT;
1083 					}
1084 				}
1085 			}
1086 		}
1087 		read_unlock(&fib6_walker_lock);
1088 
1089 		node_free(fn);
1090 		if (pn->fn_flags&RTN_RTINFO || FIB6_SUBTREE(pn))
1091 			return pn;
1092 
1093 		rt6_release(pn->leaf);
1094 		pn->leaf = NULL;
1095 		fn = pn;
1096 	}
1097 }
1098 
1099 static void fib6_del_route(struct fib6_node *fn, struct rt6_info **rtp,
1100 			   struct nl_info *info)
1101 {
1102 	struct fib6_walker_t *w;
1103 	struct rt6_info *rt = *rtp;
1104 
1105 	RT6_TRACE("fib6_del_route\n");
1106 
1107 	/* Unlink it */
1108 	*rtp = rt->u.next;
1109 	rt->rt6i_node = NULL;
1110 	rt6_stats.fib_rt_entries--;
1111 	rt6_stats.fib_discarded_routes++;
1112 
1113 	/* Adjust walkers */
1114 	read_lock(&fib6_walker_lock);
1115 	FOR_WALKERS(w) {
1116 		if (w->state == FWS_C && w->leaf == rt) {
1117 			RT6_TRACE("walker %p adjusted by delroute\n", w);
1118 			w->leaf = rt->u.next;
1119 			if (w->leaf == NULL)
1120 				w->state = FWS_U;
1121 		}
1122 	}
1123 	read_unlock(&fib6_walker_lock);
1124 
1125 	rt->u.next = NULL;
1126 
1127 	if (fn->leaf == NULL && fn->fn_flags&RTN_TL_ROOT)
1128 		fn->leaf = &ip6_null_entry;
1129 
1130 	/* If it was last route, expunge its radix tree node */
1131 	if (fn->leaf == NULL) {
1132 		fn->fn_flags &= ~RTN_RTINFO;
1133 		rt6_stats.fib_route_nodes--;
1134 		fn = fib6_repair_tree(fn);
1135 	}
1136 
1137 	if (atomic_read(&rt->rt6i_ref) != 1) {
1138 		/* This route is used as dummy address holder in some split
1139 		 * nodes. It is not leaked, but it still holds other resources,
1140 		 * which must be released in time. So, scan ascendant nodes
1141 		 * and replace dummy references to this route with references
1142 		 * to still alive ones.
1143 		 */
1144 		while (fn) {
1145 			if (!(fn->fn_flags&RTN_RTINFO) && fn->leaf == rt) {
1146 				fn->leaf = fib6_find_prefix(fn);
1147 				atomic_inc(&fn->leaf->rt6i_ref);
1148 				rt6_release(rt);
1149 			}
1150 			fn = fn->parent;
1151 		}
1152 		/* No more references are possible at this point. */
1153 		if (atomic_read(&rt->rt6i_ref) != 1) BUG();
1154 	}
1155 
1156 	inet6_rt_notify(RTM_DELROUTE, rt, info);
1157 	rt6_release(rt);
1158 }
1159 
1160 int fib6_del(struct rt6_info *rt, struct nl_info *info)
1161 {
1162 	struct fib6_node *fn = rt->rt6i_node;
1163 	struct rt6_info **rtp;
1164 
1165 #if RT6_DEBUG >= 2
1166 	if (rt->u.dst.obsolete>0) {
1167 		BUG_TRAP(fn==NULL);
1168 		return -ENOENT;
1169 	}
1170 #endif
1171 	if (fn == NULL || rt == &ip6_null_entry)
1172 		return -ENOENT;
1173 
1174 	BUG_TRAP(fn->fn_flags&RTN_RTINFO);
1175 
1176 	if (!(rt->rt6i_flags&RTF_CACHE)) {
1177 		struct fib6_node *pn = fn;
1178 #ifdef CONFIG_IPV6_SUBTREES
1179 		/* clones of this route might be in another subtree */
1180 		if (rt->rt6i_src.plen) {
1181 			while (!(pn->fn_flags&RTN_ROOT))
1182 				pn = pn->parent;
1183 			pn = pn->parent;
1184 		}
1185 #endif
1186 		fib6_prune_clones(pn, rt);
1187 	}
1188 
1189 	/*
1190 	 *	Walk the leaf entries looking for ourself
1191 	 */
1192 
1193 	for (rtp = &fn->leaf; *rtp; rtp = &(*rtp)->u.next) {
1194 		if (*rtp == rt) {
1195 			fib6_del_route(fn, rtp, info);
1196 			return 0;
1197 		}
1198 	}
1199 	return -ENOENT;
1200 }
1201 
1202 /*
1203  *	Tree traversal function.
1204  *
1205  *	Certainly, it is not interrupt safe.
1206  *	However, it is internally reenterable wrt itself and fib6_add/fib6_del.
1207  *	It means, that we can modify tree during walking
1208  *	and use this function for garbage collection, clone pruning,
1209  *	cleaning tree when a device goes down etc. etc.
1210  *
1211  *	It guarantees that every node will be traversed,
1212  *	and that it will be traversed only once.
1213  *
1214  *	Callback function w->func may return:
1215  *	0 -> continue walking.
1216  *	positive value -> walking is suspended (used by tree dumps,
1217  *	and probably by gc, if it will be split to several slices)
1218  *	negative value -> terminate walking.
1219  *
1220  *	The function itself returns:
1221  *	0   -> walk is complete.
1222  *	>0  -> walk is incomplete (i.e. suspended)
1223  *	<0  -> walk is terminated by an error.
1224  */
1225 
1226 static int fib6_walk_continue(struct fib6_walker_t *w)
1227 {
1228 	struct fib6_node *fn, *pn;
1229 
1230 	for (;;) {
1231 		fn = w->node;
1232 		if (fn == NULL)
1233 			return 0;
1234 
1235 		if (w->prune && fn != w->root &&
1236 		    fn->fn_flags&RTN_RTINFO && w->state < FWS_C) {
1237 			w->state = FWS_C;
1238 			w->leaf = fn->leaf;
1239 		}
1240 		switch (w->state) {
1241 #ifdef CONFIG_IPV6_SUBTREES
1242 		case FWS_S:
1243 			if (FIB6_SUBTREE(fn)) {
1244 				w->node = FIB6_SUBTREE(fn);
1245 				continue;
1246 			}
1247 			w->state = FWS_L;
1248 #endif
1249 		case FWS_L:
1250 			if (fn->left) {
1251 				w->node = fn->left;
1252 				w->state = FWS_INIT;
1253 				continue;
1254 			}
1255 			w->state = FWS_R;
1256 		case FWS_R:
1257 			if (fn->right) {
1258 				w->node = fn->right;
1259 				w->state = FWS_INIT;
1260 				continue;
1261 			}
1262 			w->state = FWS_C;
1263 			w->leaf = fn->leaf;
1264 		case FWS_C:
1265 			if (w->leaf && fn->fn_flags&RTN_RTINFO) {
1266 				int err = w->func(w);
1267 				if (err)
1268 					return err;
1269 				continue;
1270 			}
1271 			w->state = FWS_U;
1272 		case FWS_U:
1273 			if (fn == w->root)
1274 				return 0;
1275 			pn = fn->parent;
1276 			w->node = pn;
1277 #ifdef CONFIG_IPV6_SUBTREES
1278 			if (FIB6_SUBTREE(pn) == fn) {
1279 				BUG_TRAP(fn->fn_flags&RTN_ROOT);
1280 				w->state = FWS_L;
1281 				continue;
1282 			}
1283 #endif
1284 			if (pn->left == fn) {
1285 				w->state = FWS_R;
1286 				continue;
1287 			}
1288 			if (pn->right == fn) {
1289 				w->state = FWS_C;
1290 				w->leaf = w->node->leaf;
1291 				continue;
1292 			}
1293 #if RT6_DEBUG >= 2
1294 			BUG_TRAP(0);
1295 #endif
1296 		}
1297 	}
1298 }
1299 
1300 static int fib6_walk(struct fib6_walker_t *w)
1301 {
1302 	int res;
1303 
1304 	w->state = FWS_INIT;
1305 	w->node = w->root;
1306 
1307 	fib6_walker_link(w);
1308 	res = fib6_walk_continue(w);
1309 	if (res <= 0)
1310 		fib6_walker_unlink(w);
1311 	return res;
1312 }
1313 
1314 static int fib6_clean_node(struct fib6_walker_t *w)
1315 {
1316 	int res;
1317 	struct rt6_info *rt;
1318 	struct fib6_cleaner_t *c = (struct fib6_cleaner_t*)w;
1319 
1320 	for (rt = w->leaf; rt; rt = rt->u.next) {
1321 		res = c->func(rt, c->arg);
1322 		if (res < 0) {
1323 			w->leaf = rt;
1324 			res = fib6_del(rt, NULL);
1325 			if (res) {
1326 #if RT6_DEBUG >= 2
1327 				printk(KERN_DEBUG "fib6_clean_node: del failed: rt=%p@%p err=%d\n", rt, rt->rt6i_node, res);
1328 #endif
1329 				continue;
1330 			}
1331 			return 0;
1332 		}
1333 		BUG_TRAP(res==0);
1334 	}
1335 	w->leaf = rt;
1336 	return 0;
1337 }
1338 
1339 /*
1340  *	Convenient frontend to tree walker.
1341  *
1342  *	func is called on each route.
1343  *		It may return -1 -> delete this route.
1344  *		              0  -> continue walking
1345  *
1346  *	prune==1 -> only immediate children of node (certainly,
1347  *	ignoring pure split nodes) will be scanned.
1348  */
1349 
1350 static void fib6_clean_tree(struct fib6_node *root,
1351 			    int (*func)(struct rt6_info *, void *arg),
1352 			    int prune, void *arg)
1353 {
1354 	struct fib6_cleaner_t c;
1355 
1356 	c.w.root = root;
1357 	c.w.func = fib6_clean_node;
1358 	c.w.prune = prune;
1359 	c.func = func;
1360 	c.arg = arg;
1361 
1362 	fib6_walk(&c.w);
1363 }
1364 
1365 void fib6_clean_all(int (*func)(struct rt6_info *, void *arg),
1366 		    int prune, void *arg)
1367 {
1368 	struct fib6_table *table;
1369 	struct hlist_node *node;
1370 	unsigned int h;
1371 
1372 	rcu_read_lock();
1373 	for (h = 0; h < FIB_TABLE_HASHSZ; h++) {
1374 		hlist_for_each_entry_rcu(table, node, &fib_table_hash[h],
1375 					 tb6_hlist) {
1376 			write_lock_bh(&table->tb6_lock);
1377 			fib6_clean_tree(&table->tb6_root, func, prune, arg);
1378 			write_unlock_bh(&table->tb6_lock);
1379 		}
1380 	}
1381 	rcu_read_unlock();
1382 }
1383 
1384 static int fib6_prune_clone(struct rt6_info *rt, void *arg)
1385 {
1386 	if (rt->rt6i_flags & RTF_CACHE) {
1387 		RT6_TRACE("pruning clone %p\n", rt);
1388 		return -1;
1389 	}
1390 
1391 	return 0;
1392 }
1393 
1394 static void fib6_prune_clones(struct fib6_node *fn, struct rt6_info *rt)
1395 {
1396 	fib6_clean_tree(fn, fib6_prune_clone, 1, rt);
1397 }
1398 
1399 /*
1400  *	Garbage collection
1401  */
1402 
1403 static struct fib6_gc_args
1404 {
1405 	int			timeout;
1406 	int			more;
1407 } gc_args;
1408 
1409 static int fib6_age(struct rt6_info *rt, void *arg)
1410 {
1411 	unsigned long now = jiffies;
1412 
1413 	/*
1414 	 *	check addrconf expiration here.
1415 	 *	Routes are expired even if they are in use.
1416 	 *
1417 	 *	Also age clones. Note, that clones are aged out
1418 	 *	only if they are not in use now.
1419 	 */
1420 
1421 	if (rt->rt6i_flags&RTF_EXPIRES && rt->rt6i_expires) {
1422 		if (time_after(now, rt->rt6i_expires)) {
1423 			RT6_TRACE("expiring %p\n", rt);
1424 			return -1;
1425 		}
1426 		gc_args.more++;
1427 	} else if (rt->rt6i_flags & RTF_CACHE) {
1428 		if (atomic_read(&rt->u.dst.__refcnt) == 0 &&
1429 		    time_after_eq(now, rt->u.dst.lastuse + gc_args.timeout)) {
1430 			RT6_TRACE("aging clone %p\n", rt);
1431 			return -1;
1432 		} else if ((rt->rt6i_flags & RTF_GATEWAY) &&
1433 			   (!(rt->rt6i_nexthop->flags & NTF_ROUTER))) {
1434 			RT6_TRACE("purging route %p via non-router but gateway\n",
1435 				  rt);
1436 			return -1;
1437 		}
1438 		gc_args.more++;
1439 	}
1440 
1441 	return 0;
1442 }
1443 
1444 static DEFINE_SPINLOCK(fib6_gc_lock);
1445 
1446 void fib6_run_gc(unsigned long dummy)
1447 {
1448 	if (dummy != ~0UL) {
1449 		spin_lock_bh(&fib6_gc_lock);
1450 		gc_args.timeout = dummy ? (int)dummy : ip6_rt_gc_interval;
1451 	} else {
1452 		local_bh_disable();
1453 		if (!spin_trylock(&fib6_gc_lock)) {
1454 			mod_timer(&ip6_fib_timer, jiffies + HZ);
1455 			local_bh_enable();
1456 			return;
1457 		}
1458 		gc_args.timeout = ip6_rt_gc_interval;
1459 	}
1460 	gc_args.more = 0;
1461 
1462 	ndisc_dst_gc(&gc_args.more);
1463 	fib6_clean_all(fib6_age, 0, NULL);
1464 
1465 	if (gc_args.more)
1466 		mod_timer(&ip6_fib_timer, jiffies + ip6_rt_gc_interval);
1467 	else {
1468 		del_timer(&ip6_fib_timer);
1469 		ip6_fib_timer.expires = 0;
1470 	}
1471 	spin_unlock_bh(&fib6_gc_lock);
1472 }
1473 
1474 void __init fib6_init(void)
1475 {
1476 	fib6_node_kmem = kmem_cache_create("fib6_nodes",
1477 					   sizeof(struct fib6_node),
1478 					   0, SLAB_HWCACHE_ALIGN|SLAB_PANIC,
1479 					   NULL, NULL);
1480 
1481 	fib6_tables_init();
1482 }
1483 
1484 void fib6_gc_cleanup(void)
1485 {
1486 	del_timer(&ip6_fib_timer);
1487 	kmem_cache_destroy(fib6_node_kmem);
1488 }
1489