xref: /linux/net/ipv6/ip6_fib.c (revision c411ed854584a71b0e86ac3019b60e4789d88086)
1 /*
2  *	Linux INET6 implementation
3  *	Forwarding Information Database
4  *
5  *	Authors:
6  *	Pedro Roque		<roque@di.fc.ul.pt>
7  *
8  *	This program is free software; you can redistribute it and/or
9  *      modify it under the terms of the GNU General Public License
10  *      as published by the Free Software Foundation; either version
11  *      2 of the License, or (at your option) any later version.
12  *
13  *	Changes:
14  *	Yuji SEKIYA @USAGI:	Support default route on router node;
15  *				remove ip6_null_entry from the top of
16  *				routing table.
17  *	Ville Nuorvala:		Fixed routing subtrees.
18  */
19 
20 #define pr_fmt(fmt) "IPv6: " fmt
21 
22 #include <linux/errno.h>
23 #include <linux/types.h>
24 #include <linux/net.h>
25 #include <linux/route.h>
26 #include <linux/netdevice.h>
27 #include <linux/in6.h>
28 #include <linux/init.h>
29 #include <linux/list.h>
30 #include <linux/slab.h>
31 
32 #include <net/ipv6.h>
33 #include <net/ndisc.h>
34 #include <net/addrconf.h>
35 #include <net/lwtunnel.h>
36 #include <net/fib_notifier.h>
37 
38 #include <net/ip6_fib.h>
39 #include <net/ip6_route.h>
40 
41 #define RT6_DEBUG 2
42 
43 #if RT6_DEBUG >= 3
44 #define RT6_TRACE(x...) pr_debug(x)
45 #else
46 #define RT6_TRACE(x...) do { ; } while (0)
47 #endif
48 
49 static struct kmem_cache *fib6_node_kmem __read_mostly;
50 
51 struct fib6_cleaner {
52 	struct fib6_walker w;
53 	struct net *net;
54 	int (*func)(struct rt6_info *, void *arg);
55 	int sernum;
56 	void *arg;
57 };
58 
59 #ifdef CONFIG_IPV6_SUBTREES
60 #define FWS_INIT FWS_S
61 #else
62 #define FWS_INIT FWS_L
63 #endif
64 
65 static void fib6_prune_clones(struct net *net, struct fib6_node *fn);
66 static struct rt6_info *fib6_find_prefix(struct net *net, struct fib6_node *fn);
67 static struct fib6_node *fib6_repair_tree(struct net *net, struct fib6_node *fn);
68 static int fib6_walk(struct net *net, struct fib6_walker *w);
69 static int fib6_walk_continue(struct fib6_walker *w);
70 
71 /*
72  *	A routing update causes an increase of the serial number on the
73  *	affected subtree. This allows for cached routes to be asynchronously
74  *	tested when modifications are made to the destination cache as a
75  *	result of redirects, path MTU changes, etc.
76  */
77 
78 static void fib6_gc_timer_cb(unsigned long arg);
79 
80 #define FOR_WALKERS(net, w) \
81 	list_for_each_entry(w, &(net)->ipv6.fib6_walkers, lh)
82 
83 static void fib6_walker_link(struct net *net, struct fib6_walker *w)
84 {
85 	write_lock_bh(&net->ipv6.fib6_walker_lock);
86 	list_add(&w->lh, &net->ipv6.fib6_walkers);
87 	write_unlock_bh(&net->ipv6.fib6_walker_lock);
88 }
89 
90 static void fib6_walker_unlink(struct net *net, struct fib6_walker *w)
91 {
92 	write_lock_bh(&net->ipv6.fib6_walker_lock);
93 	list_del(&w->lh);
94 	write_unlock_bh(&net->ipv6.fib6_walker_lock);
95 }
96 
97 static int fib6_new_sernum(struct net *net)
98 {
99 	int new, old;
100 
101 	do {
102 		old = atomic_read(&net->ipv6.fib6_sernum);
103 		new = old < INT_MAX ? old + 1 : 1;
104 	} while (atomic_cmpxchg(&net->ipv6.fib6_sernum,
105 				old, new) != old);
106 	return new;
107 }
108 
109 enum {
110 	FIB6_NO_SERNUM_CHANGE = 0,
111 };
112 
113 /*
114  *	Auxiliary address test functions for the radix tree.
115  *
116  *	These assume a 32bit processor (although it will work on
117  *	64bit processors)
118  */
119 
120 /*
121  *	test bit
122  */
123 #if defined(__LITTLE_ENDIAN)
124 # define BITOP_BE32_SWIZZLE	(0x1F & ~7)
125 #else
126 # define BITOP_BE32_SWIZZLE	0
127 #endif
128 
129 static __be32 addr_bit_set(const void *token, int fn_bit)
130 {
131 	const __be32 *addr = token;
132 	/*
133 	 * Here,
134 	 *	1 << ((~fn_bit ^ BITOP_BE32_SWIZZLE) & 0x1f)
135 	 * is optimized version of
136 	 *	htonl(1 << ((~fn_bit)&0x1F))
137 	 * See include/asm-generic/bitops/le.h.
138 	 */
139 	return (__force __be32)(1 << ((~fn_bit ^ BITOP_BE32_SWIZZLE) & 0x1f)) &
140 	       addr[fn_bit >> 5];
141 }
142 
143 static struct fib6_node *node_alloc(void)
144 {
145 	struct fib6_node *fn;
146 
147 	fn = kmem_cache_zalloc(fib6_node_kmem, GFP_ATOMIC);
148 
149 	return fn;
150 }
151 
152 static void node_free(struct fib6_node *fn)
153 {
154 	kmem_cache_free(fib6_node_kmem, fn);
155 }
156 
157 void rt6_free_pcpu(struct rt6_info *non_pcpu_rt)
158 {
159 	int cpu;
160 
161 	if (!non_pcpu_rt->rt6i_pcpu)
162 		return;
163 
164 	for_each_possible_cpu(cpu) {
165 		struct rt6_info **ppcpu_rt;
166 		struct rt6_info *pcpu_rt;
167 
168 		ppcpu_rt = per_cpu_ptr(non_pcpu_rt->rt6i_pcpu, cpu);
169 		pcpu_rt = *ppcpu_rt;
170 		if (pcpu_rt) {
171 			dst_dev_put(&pcpu_rt->dst);
172 			dst_release(&pcpu_rt->dst);
173 			*ppcpu_rt = NULL;
174 		}
175 	}
176 
177 	free_percpu(non_pcpu_rt->rt6i_pcpu);
178 	non_pcpu_rt->rt6i_pcpu = NULL;
179 }
180 EXPORT_SYMBOL_GPL(rt6_free_pcpu);
181 
182 static void fib6_link_table(struct net *net, struct fib6_table *tb)
183 {
184 	unsigned int h;
185 
186 	/*
187 	 * Initialize table lock at a single place to give lockdep a key,
188 	 * tables aren't visible prior to being linked to the list.
189 	 */
190 	rwlock_init(&tb->tb6_lock);
191 
192 	h = tb->tb6_id & (FIB6_TABLE_HASHSZ - 1);
193 
194 	/*
195 	 * No protection necessary, this is the only list mutatation
196 	 * operation, tables never disappear once they exist.
197 	 */
198 	hlist_add_head_rcu(&tb->tb6_hlist, &net->ipv6.fib_table_hash[h]);
199 }
200 
201 #ifdef CONFIG_IPV6_MULTIPLE_TABLES
202 
203 static struct fib6_table *fib6_alloc_table(struct net *net, u32 id)
204 {
205 	struct fib6_table *table;
206 
207 	table = kzalloc(sizeof(*table), GFP_ATOMIC);
208 	if (table) {
209 		table->tb6_id = id;
210 		table->tb6_root.leaf = net->ipv6.ip6_null_entry;
211 		table->tb6_root.fn_flags = RTN_ROOT | RTN_TL_ROOT | RTN_RTINFO;
212 		inet_peer_base_init(&table->tb6_peers);
213 	}
214 
215 	return table;
216 }
217 
218 struct fib6_table *fib6_new_table(struct net *net, u32 id)
219 {
220 	struct fib6_table *tb;
221 
222 	if (id == 0)
223 		id = RT6_TABLE_MAIN;
224 	tb = fib6_get_table(net, id);
225 	if (tb)
226 		return tb;
227 
228 	tb = fib6_alloc_table(net, id);
229 	if (tb)
230 		fib6_link_table(net, tb);
231 
232 	return tb;
233 }
234 EXPORT_SYMBOL_GPL(fib6_new_table);
235 
236 struct fib6_table *fib6_get_table(struct net *net, u32 id)
237 {
238 	struct fib6_table *tb;
239 	struct hlist_head *head;
240 	unsigned int h;
241 
242 	if (id == 0)
243 		id = RT6_TABLE_MAIN;
244 	h = id & (FIB6_TABLE_HASHSZ - 1);
245 	rcu_read_lock();
246 	head = &net->ipv6.fib_table_hash[h];
247 	hlist_for_each_entry_rcu(tb, head, tb6_hlist) {
248 		if (tb->tb6_id == id) {
249 			rcu_read_unlock();
250 			return tb;
251 		}
252 	}
253 	rcu_read_unlock();
254 
255 	return NULL;
256 }
257 EXPORT_SYMBOL_GPL(fib6_get_table);
258 
259 static void __net_init fib6_tables_init(struct net *net)
260 {
261 	fib6_link_table(net, net->ipv6.fib6_main_tbl);
262 	fib6_link_table(net, net->ipv6.fib6_local_tbl);
263 }
264 #else
265 
266 struct fib6_table *fib6_new_table(struct net *net, u32 id)
267 {
268 	return fib6_get_table(net, id);
269 }
270 
271 struct fib6_table *fib6_get_table(struct net *net, u32 id)
272 {
273 	  return net->ipv6.fib6_main_tbl;
274 }
275 
276 struct dst_entry *fib6_rule_lookup(struct net *net, struct flowi6 *fl6,
277 				   int flags, pol_lookup_t lookup)
278 {
279 	struct rt6_info *rt;
280 
281 	rt = lookup(net, net->ipv6.fib6_main_tbl, fl6, flags);
282 	if (rt->dst.error == -EAGAIN) {
283 		ip6_rt_put(rt);
284 		rt = net->ipv6.ip6_null_entry;
285 		dst_hold(&rt->dst);
286 	}
287 
288 	return &rt->dst;
289 }
290 
291 static void __net_init fib6_tables_init(struct net *net)
292 {
293 	fib6_link_table(net, net->ipv6.fib6_main_tbl);
294 }
295 
296 #endif
297 
298 unsigned int fib6_tables_seq_read(struct net *net)
299 {
300 	unsigned int h, fib_seq = 0;
301 
302 	rcu_read_lock();
303 	for (h = 0; h < FIB6_TABLE_HASHSZ; h++) {
304 		struct hlist_head *head = &net->ipv6.fib_table_hash[h];
305 		struct fib6_table *tb;
306 
307 		hlist_for_each_entry_rcu(tb, head, tb6_hlist) {
308 			read_lock_bh(&tb->tb6_lock);
309 			fib_seq += tb->fib_seq;
310 			read_unlock_bh(&tb->tb6_lock);
311 		}
312 	}
313 	rcu_read_unlock();
314 
315 	return fib_seq;
316 }
317 
318 static int call_fib6_entry_notifier(struct notifier_block *nb, struct net *net,
319 				    enum fib_event_type event_type,
320 				    struct rt6_info *rt)
321 {
322 	struct fib6_entry_notifier_info info = {
323 		.rt = rt,
324 	};
325 
326 	return call_fib6_notifier(nb, net, event_type, &info.info);
327 }
328 
329 static int call_fib6_entry_notifiers(struct net *net,
330 				     enum fib_event_type event_type,
331 				     struct rt6_info *rt)
332 {
333 	struct fib6_entry_notifier_info info = {
334 		.rt = rt,
335 	};
336 
337 	rt->rt6i_table->fib_seq++;
338 	return call_fib6_notifiers(net, event_type, &info.info);
339 }
340 
341 struct fib6_dump_arg {
342 	struct net *net;
343 	struct notifier_block *nb;
344 };
345 
346 static void fib6_rt_dump(struct rt6_info *rt, struct fib6_dump_arg *arg)
347 {
348 	if (rt == arg->net->ipv6.ip6_null_entry)
349 		return;
350 	call_fib6_entry_notifier(arg->nb, arg->net, FIB_EVENT_ENTRY_ADD, rt);
351 }
352 
353 static int fib6_node_dump(struct fib6_walker *w)
354 {
355 	struct rt6_info *rt;
356 
357 	for (rt = w->leaf; rt; rt = rt->dst.rt6_next)
358 		fib6_rt_dump(rt, w->args);
359 	w->leaf = NULL;
360 	return 0;
361 }
362 
363 static void fib6_table_dump(struct net *net, struct fib6_table *tb,
364 			    struct fib6_walker *w)
365 {
366 	w->root = &tb->tb6_root;
367 	read_lock_bh(&tb->tb6_lock);
368 	fib6_walk(net, w);
369 	read_unlock_bh(&tb->tb6_lock);
370 }
371 
372 /* Called with rcu_read_lock() */
373 int fib6_tables_dump(struct net *net, struct notifier_block *nb)
374 {
375 	struct fib6_dump_arg arg;
376 	struct fib6_walker *w;
377 	unsigned int h;
378 
379 	w = kzalloc(sizeof(*w), GFP_ATOMIC);
380 	if (!w)
381 		return -ENOMEM;
382 
383 	w->func = fib6_node_dump;
384 	arg.net = net;
385 	arg.nb = nb;
386 	w->args = &arg;
387 
388 	for (h = 0; h < FIB6_TABLE_HASHSZ; h++) {
389 		struct hlist_head *head = &net->ipv6.fib_table_hash[h];
390 		struct fib6_table *tb;
391 
392 		hlist_for_each_entry_rcu(tb, head, tb6_hlist)
393 			fib6_table_dump(net, tb, w);
394 	}
395 
396 	kfree(w);
397 
398 	return 0;
399 }
400 
401 static int fib6_dump_node(struct fib6_walker *w)
402 {
403 	int res;
404 	struct rt6_info *rt;
405 
406 	for (rt = w->leaf; rt; rt = rt->dst.rt6_next) {
407 		res = rt6_dump_route(rt, w->args);
408 		if (res < 0) {
409 			/* Frame is full, suspend walking */
410 			w->leaf = rt;
411 			return 1;
412 		}
413 
414 		/* Multipath routes are dumped in one route with the
415 		 * RTA_MULTIPATH attribute. Jump 'rt' to point to the
416 		 * last sibling of this route (no need to dump the
417 		 * sibling routes again)
418 		 */
419 		if (rt->rt6i_nsiblings)
420 			rt = list_last_entry(&rt->rt6i_siblings,
421 					     struct rt6_info,
422 					     rt6i_siblings);
423 	}
424 	w->leaf = NULL;
425 	return 0;
426 }
427 
428 static void fib6_dump_end(struct netlink_callback *cb)
429 {
430 	struct net *net = sock_net(cb->skb->sk);
431 	struct fib6_walker *w = (void *)cb->args[2];
432 
433 	if (w) {
434 		if (cb->args[4]) {
435 			cb->args[4] = 0;
436 			fib6_walker_unlink(net, w);
437 		}
438 		cb->args[2] = 0;
439 		kfree(w);
440 	}
441 	cb->done = (void *)cb->args[3];
442 	cb->args[1] = 3;
443 }
444 
445 static int fib6_dump_done(struct netlink_callback *cb)
446 {
447 	fib6_dump_end(cb);
448 	return cb->done ? cb->done(cb) : 0;
449 }
450 
451 static int fib6_dump_table(struct fib6_table *table, struct sk_buff *skb,
452 			   struct netlink_callback *cb)
453 {
454 	struct net *net = sock_net(skb->sk);
455 	struct fib6_walker *w;
456 	int res;
457 
458 	w = (void *)cb->args[2];
459 	w->root = &table->tb6_root;
460 
461 	if (cb->args[4] == 0) {
462 		w->count = 0;
463 		w->skip = 0;
464 
465 		read_lock_bh(&table->tb6_lock);
466 		res = fib6_walk(net, w);
467 		read_unlock_bh(&table->tb6_lock);
468 		if (res > 0) {
469 			cb->args[4] = 1;
470 			cb->args[5] = w->root->fn_sernum;
471 		}
472 	} else {
473 		if (cb->args[5] != w->root->fn_sernum) {
474 			/* Begin at the root if the tree changed */
475 			cb->args[5] = w->root->fn_sernum;
476 			w->state = FWS_INIT;
477 			w->node = w->root;
478 			w->skip = w->count;
479 		} else
480 			w->skip = 0;
481 
482 		read_lock_bh(&table->tb6_lock);
483 		res = fib6_walk_continue(w);
484 		read_unlock_bh(&table->tb6_lock);
485 		if (res <= 0) {
486 			fib6_walker_unlink(net, w);
487 			cb->args[4] = 0;
488 		}
489 	}
490 
491 	return res;
492 }
493 
494 static int inet6_dump_fib(struct sk_buff *skb, struct netlink_callback *cb)
495 {
496 	struct net *net = sock_net(skb->sk);
497 	unsigned int h, s_h;
498 	unsigned int e = 0, s_e;
499 	struct rt6_rtnl_dump_arg arg;
500 	struct fib6_walker *w;
501 	struct fib6_table *tb;
502 	struct hlist_head *head;
503 	int res = 0;
504 
505 	s_h = cb->args[0];
506 	s_e = cb->args[1];
507 
508 	w = (void *)cb->args[2];
509 	if (!w) {
510 		/* New dump:
511 		 *
512 		 * 1. hook callback destructor.
513 		 */
514 		cb->args[3] = (long)cb->done;
515 		cb->done = fib6_dump_done;
516 
517 		/*
518 		 * 2. allocate and initialize walker.
519 		 */
520 		w = kzalloc(sizeof(*w), GFP_ATOMIC);
521 		if (!w)
522 			return -ENOMEM;
523 		w->func = fib6_dump_node;
524 		cb->args[2] = (long)w;
525 	}
526 
527 	arg.skb = skb;
528 	arg.cb = cb;
529 	arg.net = net;
530 	w->args = &arg;
531 
532 	rcu_read_lock();
533 	for (h = s_h; h < FIB6_TABLE_HASHSZ; h++, s_e = 0) {
534 		e = 0;
535 		head = &net->ipv6.fib_table_hash[h];
536 		hlist_for_each_entry_rcu(tb, head, tb6_hlist) {
537 			if (e < s_e)
538 				goto next;
539 			res = fib6_dump_table(tb, skb, cb);
540 			if (res != 0)
541 				goto out;
542 next:
543 			e++;
544 		}
545 	}
546 out:
547 	rcu_read_unlock();
548 	cb->args[1] = e;
549 	cb->args[0] = h;
550 
551 	res = res < 0 ? res : skb->len;
552 	if (res <= 0)
553 		fib6_dump_end(cb);
554 	return res;
555 }
556 
557 /*
558  *	Routing Table
559  *
560  *	return the appropriate node for a routing tree "add" operation
561  *	by either creating and inserting or by returning an existing
562  *	node.
563  */
564 
565 static struct fib6_node *fib6_add_1(struct fib6_node *root,
566 				     struct in6_addr *addr, int plen,
567 				     int offset, int allow_create,
568 				     int replace_required, int sernum,
569 				     struct netlink_ext_ack *extack)
570 {
571 	struct fib6_node *fn, *in, *ln;
572 	struct fib6_node *pn = NULL;
573 	struct rt6key *key;
574 	int	bit;
575 	__be32	dir = 0;
576 
577 	RT6_TRACE("fib6_add_1\n");
578 
579 	/* insert node in tree */
580 
581 	fn = root;
582 
583 	do {
584 		key = (struct rt6key *)((u8 *)fn->leaf + offset);
585 
586 		/*
587 		 *	Prefix match
588 		 */
589 		if (plen < fn->fn_bit ||
590 		    !ipv6_prefix_equal(&key->addr, addr, fn->fn_bit)) {
591 			if (!allow_create) {
592 				if (replace_required) {
593 					NL_SET_ERR_MSG(extack,
594 						       "Can not replace route - no match found");
595 					pr_warn("Can't replace route, no match found\n");
596 					return ERR_PTR(-ENOENT);
597 				}
598 				pr_warn("NLM_F_CREATE should be set when creating new route\n");
599 			}
600 			goto insert_above;
601 		}
602 
603 		/*
604 		 *	Exact match ?
605 		 */
606 
607 		if (plen == fn->fn_bit) {
608 			/* clean up an intermediate node */
609 			if (!(fn->fn_flags & RTN_RTINFO)) {
610 				rt6_release(fn->leaf);
611 				fn->leaf = NULL;
612 			}
613 
614 			fn->fn_sernum = sernum;
615 
616 			return fn;
617 		}
618 
619 		/*
620 		 *	We have more bits to go
621 		 */
622 
623 		/* Try to walk down on tree. */
624 		fn->fn_sernum = sernum;
625 		dir = addr_bit_set(addr, fn->fn_bit);
626 		pn = fn;
627 		fn = dir ? fn->right : fn->left;
628 	} while (fn);
629 
630 	if (!allow_create) {
631 		/* We should not create new node because
632 		 * NLM_F_REPLACE was specified without NLM_F_CREATE
633 		 * I assume it is safe to require NLM_F_CREATE when
634 		 * REPLACE flag is used! Later we may want to remove the
635 		 * check for replace_required, because according
636 		 * to netlink specification, NLM_F_CREATE
637 		 * MUST be specified if new route is created.
638 		 * That would keep IPv6 consistent with IPv4
639 		 */
640 		if (replace_required) {
641 			NL_SET_ERR_MSG(extack,
642 				       "Can not replace route - no match found");
643 			pr_warn("Can't replace route, no match found\n");
644 			return ERR_PTR(-ENOENT);
645 		}
646 		pr_warn("NLM_F_CREATE should be set when creating new route\n");
647 	}
648 	/*
649 	 *	We walked to the bottom of tree.
650 	 *	Create new leaf node without children.
651 	 */
652 
653 	ln = node_alloc();
654 
655 	if (!ln)
656 		return ERR_PTR(-ENOMEM);
657 	ln->fn_bit = plen;
658 
659 	ln->parent = pn;
660 	ln->fn_sernum = sernum;
661 
662 	if (dir)
663 		pn->right = ln;
664 	else
665 		pn->left  = ln;
666 
667 	return ln;
668 
669 
670 insert_above:
671 	/*
672 	 * split since we don't have a common prefix anymore or
673 	 * we have a less significant route.
674 	 * we've to insert an intermediate node on the list
675 	 * this new node will point to the one we need to create
676 	 * and the current
677 	 */
678 
679 	pn = fn->parent;
680 
681 	/* find 1st bit in difference between the 2 addrs.
682 
683 	   See comment in __ipv6_addr_diff: bit may be an invalid value,
684 	   but if it is >= plen, the value is ignored in any case.
685 	 */
686 
687 	bit = __ipv6_addr_diff(addr, &key->addr, sizeof(*addr));
688 
689 	/*
690 	 *		(intermediate)[in]
691 	 *	          /	   \
692 	 *	(new leaf node)[ln] (old node)[fn]
693 	 */
694 	if (plen > bit) {
695 		in = node_alloc();
696 		ln = node_alloc();
697 
698 		if (!in || !ln) {
699 			if (in)
700 				node_free(in);
701 			if (ln)
702 				node_free(ln);
703 			return ERR_PTR(-ENOMEM);
704 		}
705 
706 		/*
707 		 * new intermediate node.
708 		 * RTN_RTINFO will
709 		 * be off since that an address that chooses one of
710 		 * the branches would not match less specific routes
711 		 * in the other branch
712 		 */
713 
714 		in->fn_bit = bit;
715 
716 		in->parent = pn;
717 		in->leaf = fn->leaf;
718 		atomic_inc(&in->leaf->rt6i_ref);
719 
720 		in->fn_sernum = sernum;
721 
722 		/* update parent pointer */
723 		if (dir)
724 			pn->right = in;
725 		else
726 			pn->left  = in;
727 
728 		ln->fn_bit = plen;
729 
730 		ln->parent = in;
731 		fn->parent = in;
732 
733 		ln->fn_sernum = sernum;
734 
735 		if (addr_bit_set(addr, bit)) {
736 			in->right = ln;
737 			in->left  = fn;
738 		} else {
739 			in->left  = ln;
740 			in->right = fn;
741 		}
742 	} else { /* plen <= bit */
743 
744 		/*
745 		 *		(new leaf node)[ln]
746 		 *	          /	   \
747 		 *	     (old node)[fn] NULL
748 		 */
749 
750 		ln = node_alloc();
751 
752 		if (!ln)
753 			return ERR_PTR(-ENOMEM);
754 
755 		ln->fn_bit = plen;
756 
757 		ln->parent = pn;
758 
759 		ln->fn_sernum = sernum;
760 
761 		if (dir)
762 			pn->right = ln;
763 		else
764 			pn->left  = ln;
765 
766 		if (addr_bit_set(&key->addr, plen))
767 			ln->right = fn;
768 		else
769 			ln->left  = fn;
770 
771 		fn->parent = ln;
772 	}
773 	return ln;
774 }
775 
776 static bool rt6_qualify_for_ecmp(struct rt6_info *rt)
777 {
778 	return (rt->rt6i_flags & (RTF_GATEWAY|RTF_ADDRCONF|RTF_DYNAMIC)) ==
779 	       RTF_GATEWAY;
780 }
781 
782 static void fib6_copy_metrics(u32 *mp, const struct mx6_config *mxc)
783 {
784 	int i;
785 
786 	for (i = 0; i < RTAX_MAX; i++) {
787 		if (test_bit(i, mxc->mx_valid))
788 			mp[i] = mxc->mx[i];
789 	}
790 }
791 
792 static int fib6_commit_metrics(struct dst_entry *dst, struct mx6_config *mxc)
793 {
794 	if (!mxc->mx)
795 		return 0;
796 
797 	if (dst->flags & DST_HOST) {
798 		u32 *mp = dst_metrics_write_ptr(dst);
799 
800 		if (unlikely(!mp))
801 			return -ENOMEM;
802 
803 		fib6_copy_metrics(mp, mxc);
804 	} else {
805 		dst_init_metrics(dst, mxc->mx, false);
806 
807 		/* We've stolen mx now. */
808 		mxc->mx = NULL;
809 	}
810 
811 	return 0;
812 }
813 
814 static void fib6_purge_rt(struct rt6_info *rt, struct fib6_node *fn,
815 			  struct net *net)
816 {
817 	if (atomic_read(&rt->rt6i_ref) != 1) {
818 		/* This route is used as dummy address holder in some split
819 		 * nodes. It is not leaked, but it still holds other resources,
820 		 * which must be released in time. So, scan ascendant nodes
821 		 * and replace dummy references to this route with references
822 		 * to still alive ones.
823 		 */
824 		while (fn) {
825 			if (!(fn->fn_flags & RTN_RTINFO) && fn->leaf == rt) {
826 				fn->leaf = fib6_find_prefix(net, fn);
827 				atomic_inc(&fn->leaf->rt6i_ref);
828 				rt6_release(rt);
829 			}
830 			fn = fn->parent;
831 		}
832 	}
833 }
834 
835 /*
836  *	Insert routing information in a node.
837  */
838 
839 static int fib6_add_rt2node(struct fib6_node *fn, struct rt6_info *rt,
840 			    struct nl_info *info, struct mx6_config *mxc)
841 {
842 	struct rt6_info *iter = NULL;
843 	struct rt6_info **ins;
844 	struct rt6_info **fallback_ins = NULL;
845 	int replace = (info->nlh &&
846 		       (info->nlh->nlmsg_flags & NLM_F_REPLACE));
847 	int add = (!info->nlh ||
848 		   (info->nlh->nlmsg_flags & NLM_F_CREATE));
849 	int found = 0;
850 	bool rt_can_ecmp = rt6_qualify_for_ecmp(rt);
851 	u16 nlflags = NLM_F_EXCL;
852 	int err;
853 
854 	if (info->nlh && (info->nlh->nlmsg_flags & NLM_F_APPEND))
855 		nlflags |= NLM_F_APPEND;
856 
857 	ins = &fn->leaf;
858 
859 	for (iter = fn->leaf; iter; iter = iter->dst.rt6_next) {
860 		/*
861 		 *	Search for duplicates
862 		 */
863 
864 		if (iter->rt6i_metric == rt->rt6i_metric) {
865 			/*
866 			 *	Same priority level
867 			 */
868 			if (info->nlh &&
869 			    (info->nlh->nlmsg_flags & NLM_F_EXCL))
870 				return -EEXIST;
871 
872 			nlflags &= ~NLM_F_EXCL;
873 			if (replace) {
874 				if (rt_can_ecmp == rt6_qualify_for_ecmp(iter)) {
875 					found++;
876 					break;
877 				}
878 				if (rt_can_ecmp)
879 					fallback_ins = fallback_ins ?: ins;
880 				goto next_iter;
881 			}
882 
883 			if (rt6_duplicate_nexthop(iter, rt)) {
884 				if (rt->rt6i_nsiblings)
885 					rt->rt6i_nsiblings = 0;
886 				if (!(iter->rt6i_flags & RTF_EXPIRES))
887 					return -EEXIST;
888 				if (!(rt->rt6i_flags & RTF_EXPIRES))
889 					rt6_clean_expires(iter);
890 				else
891 					rt6_set_expires(iter, rt->dst.expires);
892 				iter->rt6i_pmtu = rt->rt6i_pmtu;
893 				return -EEXIST;
894 			}
895 			/* If we have the same destination and the same metric,
896 			 * but not the same gateway, then the route we try to
897 			 * add is sibling to this route, increment our counter
898 			 * of siblings, and later we will add our route to the
899 			 * list.
900 			 * Only static routes (which don't have flag
901 			 * RTF_EXPIRES) are used for ECMPv6.
902 			 *
903 			 * To avoid long list, we only had siblings if the
904 			 * route have a gateway.
905 			 */
906 			if (rt_can_ecmp &&
907 			    rt6_qualify_for_ecmp(iter))
908 				rt->rt6i_nsiblings++;
909 		}
910 
911 		if (iter->rt6i_metric > rt->rt6i_metric)
912 			break;
913 
914 next_iter:
915 		ins = &iter->dst.rt6_next;
916 	}
917 
918 	if (fallback_ins && !found) {
919 		/* No ECMP-able route found, replace first non-ECMP one */
920 		ins = fallback_ins;
921 		iter = *ins;
922 		found++;
923 	}
924 
925 	/* Reset round-robin state, if necessary */
926 	if (ins == &fn->leaf)
927 		fn->rr_ptr = NULL;
928 
929 	/* Link this route to others same route. */
930 	if (rt->rt6i_nsiblings) {
931 		unsigned int rt6i_nsiblings;
932 		struct rt6_info *sibling, *temp_sibling;
933 
934 		/* Find the first route that have the same metric */
935 		sibling = fn->leaf;
936 		while (sibling) {
937 			if (sibling->rt6i_metric == rt->rt6i_metric &&
938 			    rt6_qualify_for_ecmp(sibling)) {
939 				list_add_tail(&rt->rt6i_siblings,
940 					      &sibling->rt6i_siblings);
941 				break;
942 			}
943 			sibling = sibling->dst.rt6_next;
944 		}
945 		/* For each sibling in the list, increment the counter of
946 		 * siblings. BUG() if counters does not match, list of siblings
947 		 * is broken!
948 		 */
949 		rt6i_nsiblings = 0;
950 		list_for_each_entry_safe(sibling, temp_sibling,
951 					 &rt->rt6i_siblings, rt6i_siblings) {
952 			sibling->rt6i_nsiblings++;
953 			BUG_ON(sibling->rt6i_nsiblings != rt->rt6i_nsiblings);
954 			rt6i_nsiblings++;
955 		}
956 		BUG_ON(rt6i_nsiblings != rt->rt6i_nsiblings);
957 	}
958 
959 	/*
960 	 *	insert node
961 	 */
962 	if (!replace) {
963 		if (!add)
964 			pr_warn("NLM_F_CREATE should be set when creating new route\n");
965 
966 add:
967 		nlflags |= NLM_F_CREATE;
968 		err = fib6_commit_metrics(&rt->dst, mxc);
969 		if (err)
970 			return err;
971 
972 		rt->dst.rt6_next = iter;
973 		*ins = rt;
974 		rt->rt6i_node = fn;
975 		atomic_inc(&rt->rt6i_ref);
976 		call_fib6_entry_notifiers(info->nl_net, FIB_EVENT_ENTRY_ADD,
977 					  rt);
978 		if (!info->skip_notify)
979 			inet6_rt_notify(RTM_NEWROUTE, rt, info, nlflags);
980 		info->nl_net->ipv6.rt6_stats->fib_rt_entries++;
981 
982 		if (!(fn->fn_flags & RTN_RTINFO)) {
983 			info->nl_net->ipv6.rt6_stats->fib_route_nodes++;
984 			fn->fn_flags |= RTN_RTINFO;
985 		}
986 
987 	} else {
988 		int nsiblings;
989 
990 		if (!found) {
991 			if (add)
992 				goto add;
993 			pr_warn("NLM_F_REPLACE set, but no existing node found!\n");
994 			return -ENOENT;
995 		}
996 
997 		err = fib6_commit_metrics(&rt->dst, mxc);
998 		if (err)
999 			return err;
1000 
1001 		*ins = rt;
1002 		rt->rt6i_node = fn;
1003 		rt->dst.rt6_next = iter->dst.rt6_next;
1004 		atomic_inc(&rt->rt6i_ref);
1005 		call_fib6_entry_notifiers(info->nl_net, FIB_EVENT_ENTRY_REPLACE,
1006 					  rt);
1007 		if (!info->skip_notify)
1008 			inet6_rt_notify(RTM_NEWROUTE, rt, info, NLM_F_REPLACE);
1009 		if (!(fn->fn_flags & RTN_RTINFO)) {
1010 			info->nl_net->ipv6.rt6_stats->fib_route_nodes++;
1011 			fn->fn_flags |= RTN_RTINFO;
1012 		}
1013 		nsiblings = iter->rt6i_nsiblings;
1014 		iter->rt6i_node = NULL;
1015 		fib6_purge_rt(iter, fn, info->nl_net);
1016 		if (fn->rr_ptr == iter)
1017 			fn->rr_ptr = NULL;
1018 		rt6_release(iter);
1019 
1020 		if (nsiblings) {
1021 			/* Replacing an ECMP route, remove all siblings */
1022 			ins = &rt->dst.rt6_next;
1023 			iter = *ins;
1024 			while (iter) {
1025 				if (iter->rt6i_metric > rt->rt6i_metric)
1026 					break;
1027 				if (rt6_qualify_for_ecmp(iter)) {
1028 					*ins = iter->dst.rt6_next;
1029 					iter->rt6i_node = NULL;
1030 					fib6_purge_rt(iter, fn, info->nl_net);
1031 					if (fn->rr_ptr == iter)
1032 						fn->rr_ptr = NULL;
1033 					rt6_release(iter);
1034 					nsiblings--;
1035 				} else {
1036 					ins = &iter->dst.rt6_next;
1037 				}
1038 				iter = *ins;
1039 			}
1040 			WARN_ON(nsiblings != 0);
1041 		}
1042 	}
1043 
1044 	return 0;
1045 }
1046 
1047 static void fib6_start_gc(struct net *net, struct rt6_info *rt)
1048 {
1049 	if (!timer_pending(&net->ipv6.ip6_fib_timer) &&
1050 	    (rt->rt6i_flags & (RTF_EXPIRES | RTF_CACHE)))
1051 		mod_timer(&net->ipv6.ip6_fib_timer,
1052 			  jiffies + net->ipv6.sysctl.ip6_rt_gc_interval);
1053 }
1054 
1055 void fib6_force_start_gc(struct net *net)
1056 {
1057 	if (!timer_pending(&net->ipv6.ip6_fib_timer))
1058 		mod_timer(&net->ipv6.ip6_fib_timer,
1059 			  jiffies + net->ipv6.sysctl.ip6_rt_gc_interval);
1060 }
1061 
1062 /*
1063  *	Add routing information to the routing tree.
1064  *	<destination addr>/<source addr>
1065  *	with source addr info in sub-trees
1066  */
1067 
1068 int fib6_add(struct fib6_node *root, struct rt6_info *rt,
1069 	     struct nl_info *info, struct mx6_config *mxc,
1070 	     struct netlink_ext_ack *extack)
1071 {
1072 	struct fib6_node *fn, *pn = NULL;
1073 	int err = -ENOMEM;
1074 	int allow_create = 1;
1075 	int replace_required = 0;
1076 	int sernum = fib6_new_sernum(info->nl_net);
1077 
1078 	if (WARN_ON_ONCE(!atomic_read(&rt->dst.__refcnt)))
1079 		return -EINVAL;
1080 
1081 	if (info->nlh) {
1082 		if (!(info->nlh->nlmsg_flags & NLM_F_CREATE))
1083 			allow_create = 0;
1084 		if (info->nlh->nlmsg_flags & NLM_F_REPLACE)
1085 			replace_required = 1;
1086 	}
1087 	if (!allow_create && !replace_required)
1088 		pr_warn("RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE\n");
1089 
1090 	fn = fib6_add_1(root, &rt->rt6i_dst.addr, rt->rt6i_dst.plen,
1091 			offsetof(struct rt6_info, rt6i_dst), allow_create,
1092 			replace_required, sernum, extack);
1093 	if (IS_ERR(fn)) {
1094 		err = PTR_ERR(fn);
1095 		fn = NULL;
1096 		goto out;
1097 	}
1098 
1099 	pn = fn;
1100 
1101 #ifdef CONFIG_IPV6_SUBTREES
1102 	if (rt->rt6i_src.plen) {
1103 		struct fib6_node *sn;
1104 
1105 		if (!fn->subtree) {
1106 			struct fib6_node *sfn;
1107 
1108 			/*
1109 			 * Create subtree.
1110 			 *
1111 			 *		fn[main tree]
1112 			 *		|
1113 			 *		sfn[subtree root]
1114 			 *		   \
1115 			 *		    sn[new leaf node]
1116 			 */
1117 
1118 			/* Create subtree root node */
1119 			sfn = node_alloc();
1120 			if (!sfn)
1121 				goto failure;
1122 
1123 			sfn->leaf = info->nl_net->ipv6.ip6_null_entry;
1124 			atomic_inc(&info->nl_net->ipv6.ip6_null_entry->rt6i_ref);
1125 			sfn->fn_flags = RTN_ROOT;
1126 			sfn->fn_sernum = sernum;
1127 
1128 			/* Now add the first leaf node to new subtree */
1129 
1130 			sn = fib6_add_1(sfn, &rt->rt6i_src.addr,
1131 					rt->rt6i_src.plen,
1132 					offsetof(struct rt6_info, rt6i_src),
1133 					allow_create, replace_required, sernum,
1134 					extack);
1135 
1136 			if (IS_ERR(sn)) {
1137 				/* If it is failed, discard just allocated
1138 				   root, and then (in failure) stale node
1139 				   in main tree.
1140 				 */
1141 				node_free(sfn);
1142 				err = PTR_ERR(sn);
1143 				goto failure;
1144 			}
1145 
1146 			/* Now link new subtree to main tree */
1147 			sfn->parent = fn;
1148 			fn->subtree = sfn;
1149 		} else {
1150 			sn = fib6_add_1(fn->subtree, &rt->rt6i_src.addr,
1151 					rt->rt6i_src.plen,
1152 					offsetof(struct rt6_info, rt6i_src),
1153 					allow_create, replace_required, sernum,
1154 					extack);
1155 
1156 			if (IS_ERR(sn)) {
1157 				err = PTR_ERR(sn);
1158 				goto failure;
1159 			}
1160 		}
1161 
1162 		if (!fn->leaf) {
1163 			fn->leaf = rt;
1164 			atomic_inc(&rt->rt6i_ref);
1165 		}
1166 		fn = sn;
1167 	}
1168 #endif
1169 
1170 	err = fib6_add_rt2node(fn, rt, info, mxc);
1171 	if (!err) {
1172 		fib6_start_gc(info->nl_net, rt);
1173 		if (!(rt->rt6i_flags & RTF_CACHE))
1174 			fib6_prune_clones(info->nl_net, pn);
1175 	}
1176 
1177 out:
1178 	if (err) {
1179 #ifdef CONFIG_IPV6_SUBTREES
1180 		/*
1181 		 * If fib6_add_1 has cleared the old leaf pointer in the
1182 		 * super-tree leaf node we have to find a new one for it.
1183 		 */
1184 		if (pn != fn && pn->leaf == rt) {
1185 			pn->leaf = NULL;
1186 			atomic_dec(&rt->rt6i_ref);
1187 		}
1188 		if (pn != fn && !pn->leaf && !(pn->fn_flags & RTN_RTINFO)) {
1189 			pn->leaf = fib6_find_prefix(info->nl_net, pn);
1190 #if RT6_DEBUG >= 2
1191 			if (!pn->leaf) {
1192 				WARN_ON(pn->leaf == NULL);
1193 				pn->leaf = info->nl_net->ipv6.ip6_null_entry;
1194 			}
1195 #endif
1196 			atomic_inc(&pn->leaf->rt6i_ref);
1197 		}
1198 #endif
1199 		goto failure;
1200 	}
1201 	return err;
1202 
1203 failure:
1204 	/* fn->leaf could be NULL if fn is an intermediate node and we
1205 	 * failed to add the new route to it in both subtree creation
1206 	 * failure and fib6_add_rt2node() failure case.
1207 	 * In both cases, fib6_repair_tree() should be called to fix
1208 	 * fn->leaf.
1209 	 */
1210 	if (fn && !(fn->fn_flags & (RTN_RTINFO|RTN_ROOT)))
1211 		fib6_repair_tree(info->nl_net, fn);
1212 	/* Always release dst as dst->__refcnt is guaranteed
1213 	 * to be taken before entering this function
1214 	 */
1215 	dst_release_immediate(&rt->dst);
1216 	return err;
1217 }
1218 
1219 /*
1220  *	Routing tree lookup
1221  *
1222  */
1223 
1224 struct lookup_args {
1225 	int			offset;		/* key offset on rt6_info	*/
1226 	const struct in6_addr	*addr;		/* search key			*/
1227 };
1228 
1229 static struct fib6_node *fib6_lookup_1(struct fib6_node *root,
1230 				       struct lookup_args *args)
1231 {
1232 	struct fib6_node *fn;
1233 	__be32 dir;
1234 
1235 	if (unlikely(args->offset == 0))
1236 		return NULL;
1237 
1238 	/*
1239 	 *	Descend on a tree
1240 	 */
1241 
1242 	fn = root;
1243 
1244 	for (;;) {
1245 		struct fib6_node *next;
1246 
1247 		dir = addr_bit_set(args->addr, fn->fn_bit);
1248 
1249 		next = dir ? fn->right : fn->left;
1250 
1251 		if (next) {
1252 			fn = next;
1253 			continue;
1254 		}
1255 		break;
1256 	}
1257 
1258 	while (fn) {
1259 		if (FIB6_SUBTREE(fn) || fn->fn_flags & RTN_RTINFO) {
1260 			struct rt6key *key;
1261 
1262 			key = (struct rt6key *) ((u8 *) fn->leaf +
1263 						 args->offset);
1264 
1265 			if (ipv6_prefix_equal(&key->addr, args->addr, key->plen)) {
1266 #ifdef CONFIG_IPV6_SUBTREES
1267 				if (fn->subtree) {
1268 					struct fib6_node *sfn;
1269 					sfn = fib6_lookup_1(fn->subtree,
1270 							    args + 1);
1271 					if (!sfn)
1272 						goto backtrack;
1273 					fn = sfn;
1274 				}
1275 #endif
1276 				if (fn->fn_flags & RTN_RTINFO)
1277 					return fn;
1278 			}
1279 		}
1280 #ifdef CONFIG_IPV6_SUBTREES
1281 backtrack:
1282 #endif
1283 		if (fn->fn_flags & RTN_ROOT)
1284 			break;
1285 
1286 		fn = fn->parent;
1287 	}
1288 
1289 	return NULL;
1290 }
1291 
1292 struct fib6_node *fib6_lookup(struct fib6_node *root, const struct in6_addr *daddr,
1293 			      const struct in6_addr *saddr)
1294 {
1295 	struct fib6_node *fn;
1296 	struct lookup_args args[] = {
1297 		{
1298 			.offset = offsetof(struct rt6_info, rt6i_dst),
1299 			.addr = daddr,
1300 		},
1301 #ifdef CONFIG_IPV6_SUBTREES
1302 		{
1303 			.offset = offsetof(struct rt6_info, rt6i_src),
1304 			.addr = saddr,
1305 		},
1306 #endif
1307 		{
1308 			.offset = 0,	/* sentinel */
1309 		}
1310 	};
1311 
1312 	fn = fib6_lookup_1(root, daddr ? args : args + 1);
1313 	if (!fn || fn->fn_flags & RTN_TL_ROOT)
1314 		fn = root;
1315 
1316 	return fn;
1317 }
1318 
1319 /*
1320  *	Get node with specified destination prefix (and source prefix,
1321  *	if subtrees are used)
1322  */
1323 
1324 
1325 static struct fib6_node *fib6_locate_1(struct fib6_node *root,
1326 				       const struct in6_addr *addr,
1327 				       int plen, int offset)
1328 {
1329 	struct fib6_node *fn;
1330 
1331 	for (fn = root; fn ; ) {
1332 		struct rt6key *key = (struct rt6key *)((u8 *)fn->leaf + offset);
1333 
1334 		/*
1335 		 *	Prefix match
1336 		 */
1337 		if (plen < fn->fn_bit ||
1338 		    !ipv6_prefix_equal(&key->addr, addr, fn->fn_bit))
1339 			return NULL;
1340 
1341 		if (plen == fn->fn_bit)
1342 			return fn;
1343 
1344 		/*
1345 		 *	We have more bits to go
1346 		 */
1347 		if (addr_bit_set(addr, fn->fn_bit))
1348 			fn = fn->right;
1349 		else
1350 			fn = fn->left;
1351 	}
1352 	return NULL;
1353 }
1354 
1355 struct fib6_node *fib6_locate(struct fib6_node *root,
1356 			      const struct in6_addr *daddr, int dst_len,
1357 			      const struct in6_addr *saddr, int src_len)
1358 {
1359 	struct fib6_node *fn;
1360 
1361 	fn = fib6_locate_1(root, daddr, dst_len,
1362 			   offsetof(struct rt6_info, rt6i_dst));
1363 
1364 #ifdef CONFIG_IPV6_SUBTREES
1365 	if (src_len) {
1366 		WARN_ON(saddr == NULL);
1367 		if (fn && fn->subtree)
1368 			fn = fib6_locate_1(fn->subtree, saddr, src_len,
1369 					   offsetof(struct rt6_info, rt6i_src));
1370 	}
1371 #endif
1372 
1373 	if (fn && fn->fn_flags & RTN_RTINFO)
1374 		return fn;
1375 
1376 	return NULL;
1377 }
1378 
1379 
1380 /*
1381  *	Deletion
1382  *
1383  */
1384 
1385 static struct rt6_info *fib6_find_prefix(struct net *net, struct fib6_node *fn)
1386 {
1387 	if (fn->fn_flags & RTN_ROOT)
1388 		return net->ipv6.ip6_null_entry;
1389 
1390 	while (fn) {
1391 		if (fn->left)
1392 			return fn->left->leaf;
1393 		if (fn->right)
1394 			return fn->right->leaf;
1395 
1396 		fn = FIB6_SUBTREE(fn);
1397 	}
1398 	return NULL;
1399 }
1400 
1401 /*
1402  *	Called to trim the tree of intermediate nodes when possible. "fn"
1403  *	is the node we want to try and remove.
1404  */
1405 
1406 static struct fib6_node *fib6_repair_tree(struct net *net,
1407 					   struct fib6_node *fn)
1408 {
1409 	int children;
1410 	int nstate;
1411 	struct fib6_node *child, *pn;
1412 	struct fib6_walker *w;
1413 	int iter = 0;
1414 
1415 	for (;;) {
1416 		RT6_TRACE("fixing tree: plen=%d iter=%d\n", fn->fn_bit, iter);
1417 		iter++;
1418 
1419 		WARN_ON(fn->fn_flags & RTN_RTINFO);
1420 		WARN_ON(fn->fn_flags & RTN_TL_ROOT);
1421 		WARN_ON(fn->leaf);
1422 
1423 		children = 0;
1424 		child = NULL;
1425 		if (fn->right)
1426 			child = fn->right, children |= 1;
1427 		if (fn->left)
1428 			child = fn->left, children |= 2;
1429 
1430 		if (children == 3 || FIB6_SUBTREE(fn)
1431 #ifdef CONFIG_IPV6_SUBTREES
1432 		    /* Subtree root (i.e. fn) may have one child */
1433 		    || (children && fn->fn_flags & RTN_ROOT)
1434 #endif
1435 		    ) {
1436 			fn->leaf = fib6_find_prefix(net, fn);
1437 #if RT6_DEBUG >= 2
1438 			if (!fn->leaf) {
1439 				WARN_ON(!fn->leaf);
1440 				fn->leaf = net->ipv6.ip6_null_entry;
1441 			}
1442 #endif
1443 			atomic_inc(&fn->leaf->rt6i_ref);
1444 			return fn->parent;
1445 		}
1446 
1447 		pn = fn->parent;
1448 #ifdef CONFIG_IPV6_SUBTREES
1449 		if (FIB6_SUBTREE(pn) == fn) {
1450 			WARN_ON(!(fn->fn_flags & RTN_ROOT));
1451 			FIB6_SUBTREE(pn) = NULL;
1452 			nstate = FWS_L;
1453 		} else {
1454 			WARN_ON(fn->fn_flags & RTN_ROOT);
1455 #endif
1456 			if (pn->right == fn)
1457 				pn->right = child;
1458 			else if (pn->left == fn)
1459 				pn->left = child;
1460 #if RT6_DEBUG >= 2
1461 			else
1462 				WARN_ON(1);
1463 #endif
1464 			if (child)
1465 				child->parent = pn;
1466 			nstate = FWS_R;
1467 #ifdef CONFIG_IPV6_SUBTREES
1468 		}
1469 #endif
1470 
1471 		read_lock(&net->ipv6.fib6_walker_lock);
1472 		FOR_WALKERS(net, w) {
1473 			if (!child) {
1474 				if (w->root == fn) {
1475 					w->root = w->node = NULL;
1476 					RT6_TRACE("W %p adjusted by delroot 1\n", w);
1477 				} else if (w->node == fn) {
1478 					RT6_TRACE("W %p adjusted by delnode 1, s=%d/%d\n", w, w->state, nstate);
1479 					w->node = pn;
1480 					w->state = nstate;
1481 				}
1482 			} else {
1483 				if (w->root == fn) {
1484 					w->root = child;
1485 					RT6_TRACE("W %p adjusted by delroot 2\n", w);
1486 				}
1487 				if (w->node == fn) {
1488 					w->node = child;
1489 					if (children&2) {
1490 						RT6_TRACE("W %p adjusted by delnode 2, s=%d\n", w, w->state);
1491 						w->state = w->state >= FWS_R ? FWS_U : FWS_INIT;
1492 					} else {
1493 						RT6_TRACE("W %p adjusted by delnode 2, s=%d\n", w, w->state);
1494 						w->state = w->state >= FWS_C ? FWS_U : FWS_INIT;
1495 					}
1496 				}
1497 			}
1498 		}
1499 		read_unlock(&net->ipv6.fib6_walker_lock);
1500 
1501 		node_free(fn);
1502 		if (pn->fn_flags & RTN_RTINFO || FIB6_SUBTREE(pn))
1503 			return pn;
1504 
1505 		rt6_release(pn->leaf);
1506 		pn->leaf = NULL;
1507 		fn = pn;
1508 	}
1509 }
1510 
1511 static void fib6_del_route(struct fib6_node *fn, struct rt6_info **rtp,
1512 			   struct nl_info *info)
1513 {
1514 	struct fib6_walker *w;
1515 	struct rt6_info *rt = *rtp;
1516 	struct net *net = info->nl_net;
1517 
1518 	RT6_TRACE("fib6_del_route\n");
1519 
1520 	/* Unlink it */
1521 	*rtp = rt->dst.rt6_next;
1522 	rt->rt6i_node = NULL;
1523 	net->ipv6.rt6_stats->fib_rt_entries--;
1524 	net->ipv6.rt6_stats->fib_discarded_routes++;
1525 
1526 	/* Reset round-robin state, if necessary */
1527 	if (fn->rr_ptr == rt)
1528 		fn->rr_ptr = NULL;
1529 
1530 	/* Remove this entry from other siblings */
1531 	if (rt->rt6i_nsiblings) {
1532 		struct rt6_info *sibling, *next_sibling;
1533 
1534 		list_for_each_entry_safe(sibling, next_sibling,
1535 					 &rt->rt6i_siblings, rt6i_siblings)
1536 			sibling->rt6i_nsiblings--;
1537 		rt->rt6i_nsiblings = 0;
1538 		list_del_init(&rt->rt6i_siblings);
1539 	}
1540 
1541 	/* Adjust walkers */
1542 	read_lock(&net->ipv6.fib6_walker_lock);
1543 	FOR_WALKERS(net, w) {
1544 		if (w->state == FWS_C && w->leaf == rt) {
1545 			RT6_TRACE("walker %p adjusted by delroute\n", w);
1546 			w->leaf = rt->dst.rt6_next;
1547 			if (!w->leaf)
1548 				w->state = FWS_U;
1549 		}
1550 	}
1551 	read_unlock(&net->ipv6.fib6_walker_lock);
1552 
1553 	rt->dst.rt6_next = NULL;
1554 
1555 	/* If it was last route, expunge its radix tree node */
1556 	if (!fn->leaf) {
1557 		fn->fn_flags &= ~RTN_RTINFO;
1558 		net->ipv6.rt6_stats->fib_route_nodes--;
1559 		fn = fib6_repair_tree(net, fn);
1560 	}
1561 
1562 	fib6_purge_rt(rt, fn, net);
1563 
1564 	call_fib6_entry_notifiers(net, FIB_EVENT_ENTRY_DEL, rt);
1565 	if (!info->skip_notify)
1566 		inet6_rt_notify(RTM_DELROUTE, rt, info, 0);
1567 	rt6_release(rt);
1568 }
1569 
1570 int fib6_del(struct rt6_info *rt, struct nl_info *info)
1571 {
1572 	struct net *net = info->nl_net;
1573 	struct fib6_node *fn = rt->rt6i_node;
1574 	struct rt6_info **rtp;
1575 
1576 #if RT6_DEBUG >= 2
1577 	if (rt->dst.obsolete > 0) {
1578 		WARN_ON(fn);
1579 		return -ENOENT;
1580 	}
1581 #endif
1582 	if (!fn || rt == net->ipv6.ip6_null_entry)
1583 		return -ENOENT;
1584 
1585 	WARN_ON(!(fn->fn_flags & RTN_RTINFO));
1586 
1587 	if (!(rt->rt6i_flags & RTF_CACHE)) {
1588 		struct fib6_node *pn = fn;
1589 #ifdef CONFIG_IPV6_SUBTREES
1590 		/* clones of this route might be in another subtree */
1591 		if (rt->rt6i_src.plen) {
1592 			while (!(pn->fn_flags & RTN_ROOT))
1593 				pn = pn->parent;
1594 			pn = pn->parent;
1595 		}
1596 #endif
1597 		fib6_prune_clones(info->nl_net, pn);
1598 	}
1599 
1600 	/*
1601 	 *	Walk the leaf entries looking for ourself
1602 	 */
1603 
1604 	for (rtp = &fn->leaf; *rtp; rtp = &(*rtp)->dst.rt6_next) {
1605 		if (*rtp == rt) {
1606 			fib6_del_route(fn, rtp, info);
1607 			return 0;
1608 		}
1609 	}
1610 	return -ENOENT;
1611 }
1612 
1613 /*
1614  *	Tree traversal function.
1615  *
1616  *	Certainly, it is not interrupt safe.
1617  *	However, it is internally reenterable wrt itself and fib6_add/fib6_del.
1618  *	It means, that we can modify tree during walking
1619  *	and use this function for garbage collection, clone pruning,
1620  *	cleaning tree when a device goes down etc. etc.
1621  *
1622  *	It guarantees that every node will be traversed,
1623  *	and that it will be traversed only once.
1624  *
1625  *	Callback function w->func may return:
1626  *	0 -> continue walking.
1627  *	positive value -> walking is suspended (used by tree dumps,
1628  *	and probably by gc, if it will be split to several slices)
1629  *	negative value -> terminate walking.
1630  *
1631  *	The function itself returns:
1632  *	0   -> walk is complete.
1633  *	>0  -> walk is incomplete (i.e. suspended)
1634  *	<0  -> walk is terminated by an error.
1635  */
1636 
1637 static int fib6_walk_continue(struct fib6_walker *w)
1638 {
1639 	struct fib6_node *fn, *pn;
1640 
1641 	for (;;) {
1642 		fn = w->node;
1643 		if (!fn)
1644 			return 0;
1645 
1646 		if (w->prune && fn != w->root &&
1647 		    fn->fn_flags & RTN_RTINFO && w->state < FWS_C) {
1648 			w->state = FWS_C;
1649 			w->leaf = fn->leaf;
1650 		}
1651 		switch (w->state) {
1652 #ifdef CONFIG_IPV6_SUBTREES
1653 		case FWS_S:
1654 			if (FIB6_SUBTREE(fn)) {
1655 				w->node = FIB6_SUBTREE(fn);
1656 				continue;
1657 			}
1658 			w->state = FWS_L;
1659 #endif
1660 		case FWS_L:
1661 			if (fn->left) {
1662 				w->node = fn->left;
1663 				w->state = FWS_INIT;
1664 				continue;
1665 			}
1666 			w->state = FWS_R;
1667 		case FWS_R:
1668 			if (fn->right) {
1669 				w->node = fn->right;
1670 				w->state = FWS_INIT;
1671 				continue;
1672 			}
1673 			w->state = FWS_C;
1674 			w->leaf = fn->leaf;
1675 		case FWS_C:
1676 			if (w->leaf && fn->fn_flags & RTN_RTINFO) {
1677 				int err;
1678 
1679 				if (w->skip) {
1680 					w->skip--;
1681 					goto skip;
1682 				}
1683 
1684 				err = w->func(w);
1685 				if (err)
1686 					return err;
1687 
1688 				w->count++;
1689 				continue;
1690 			}
1691 skip:
1692 			w->state = FWS_U;
1693 		case FWS_U:
1694 			if (fn == w->root)
1695 				return 0;
1696 			pn = fn->parent;
1697 			w->node = pn;
1698 #ifdef CONFIG_IPV6_SUBTREES
1699 			if (FIB6_SUBTREE(pn) == fn) {
1700 				WARN_ON(!(fn->fn_flags & RTN_ROOT));
1701 				w->state = FWS_L;
1702 				continue;
1703 			}
1704 #endif
1705 			if (pn->left == fn) {
1706 				w->state = FWS_R;
1707 				continue;
1708 			}
1709 			if (pn->right == fn) {
1710 				w->state = FWS_C;
1711 				w->leaf = w->node->leaf;
1712 				continue;
1713 			}
1714 #if RT6_DEBUG >= 2
1715 			WARN_ON(1);
1716 #endif
1717 		}
1718 	}
1719 }
1720 
1721 static int fib6_walk(struct net *net, struct fib6_walker *w)
1722 {
1723 	int res;
1724 
1725 	w->state = FWS_INIT;
1726 	w->node = w->root;
1727 
1728 	fib6_walker_link(net, w);
1729 	res = fib6_walk_continue(w);
1730 	if (res <= 0)
1731 		fib6_walker_unlink(net, w);
1732 	return res;
1733 }
1734 
1735 static int fib6_clean_node(struct fib6_walker *w)
1736 {
1737 	int res;
1738 	struct rt6_info *rt;
1739 	struct fib6_cleaner *c = container_of(w, struct fib6_cleaner, w);
1740 	struct nl_info info = {
1741 		.nl_net = c->net,
1742 	};
1743 
1744 	if (c->sernum != FIB6_NO_SERNUM_CHANGE &&
1745 	    w->node->fn_sernum != c->sernum)
1746 		w->node->fn_sernum = c->sernum;
1747 
1748 	if (!c->func) {
1749 		WARN_ON_ONCE(c->sernum == FIB6_NO_SERNUM_CHANGE);
1750 		w->leaf = NULL;
1751 		return 0;
1752 	}
1753 
1754 	for (rt = w->leaf; rt; rt = rt->dst.rt6_next) {
1755 		res = c->func(rt, c->arg);
1756 		if (res < 0) {
1757 			w->leaf = rt;
1758 			res = fib6_del(rt, &info);
1759 			if (res) {
1760 #if RT6_DEBUG >= 2
1761 				pr_debug("%s: del failed: rt=%p@%p err=%d\n",
1762 					 __func__, rt, rt->rt6i_node, res);
1763 #endif
1764 				continue;
1765 			}
1766 			return 0;
1767 		}
1768 		WARN_ON(res != 0);
1769 	}
1770 	w->leaf = rt;
1771 	return 0;
1772 }
1773 
1774 /*
1775  *	Convenient frontend to tree walker.
1776  *
1777  *	func is called on each route.
1778  *		It may return -1 -> delete this route.
1779  *		              0  -> continue walking
1780  *
1781  *	prune==1 -> only immediate children of node (certainly,
1782  *	ignoring pure split nodes) will be scanned.
1783  */
1784 
1785 static void fib6_clean_tree(struct net *net, struct fib6_node *root,
1786 			    int (*func)(struct rt6_info *, void *arg),
1787 			    bool prune, int sernum, void *arg)
1788 {
1789 	struct fib6_cleaner c;
1790 
1791 	c.w.root = root;
1792 	c.w.func = fib6_clean_node;
1793 	c.w.prune = prune;
1794 	c.w.count = 0;
1795 	c.w.skip = 0;
1796 	c.func = func;
1797 	c.sernum = sernum;
1798 	c.arg = arg;
1799 	c.net = net;
1800 
1801 	fib6_walk(net, &c.w);
1802 }
1803 
1804 static void __fib6_clean_all(struct net *net,
1805 			     int (*func)(struct rt6_info *, void *),
1806 			     int sernum, void *arg)
1807 {
1808 	struct fib6_table *table;
1809 	struct hlist_head *head;
1810 	unsigned int h;
1811 
1812 	rcu_read_lock();
1813 	for (h = 0; h < FIB6_TABLE_HASHSZ; h++) {
1814 		head = &net->ipv6.fib_table_hash[h];
1815 		hlist_for_each_entry_rcu(table, head, tb6_hlist) {
1816 			write_lock_bh(&table->tb6_lock);
1817 			fib6_clean_tree(net, &table->tb6_root,
1818 					func, false, sernum, arg);
1819 			write_unlock_bh(&table->tb6_lock);
1820 		}
1821 	}
1822 	rcu_read_unlock();
1823 }
1824 
1825 void fib6_clean_all(struct net *net, int (*func)(struct rt6_info *, void *),
1826 		    void *arg)
1827 {
1828 	__fib6_clean_all(net, func, FIB6_NO_SERNUM_CHANGE, arg);
1829 }
1830 
1831 static int fib6_prune_clone(struct rt6_info *rt, void *arg)
1832 {
1833 	if (rt->rt6i_flags & RTF_CACHE) {
1834 		RT6_TRACE("pruning clone %p\n", rt);
1835 		return -1;
1836 	}
1837 
1838 	return 0;
1839 }
1840 
1841 static void fib6_prune_clones(struct net *net, struct fib6_node *fn)
1842 {
1843 	fib6_clean_tree(net, fn, fib6_prune_clone, true,
1844 			FIB6_NO_SERNUM_CHANGE, NULL);
1845 }
1846 
1847 static void fib6_flush_trees(struct net *net)
1848 {
1849 	int new_sernum = fib6_new_sernum(net);
1850 
1851 	__fib6_clean_all(net, NULL, new_sernum, NULL);
1852 }
1853 
1854 /*
1855  *	Garbage collection
1856  */
1857 
1858 struct fib6_gc_args
1859 {
1860 	int			timeout;
1861 	int			more;
1862 };
1863 
1864 static int fib6_age(struct rt6_info *rt, void *arg)
1865 {
1866 	struct fib6_gc_args *gc_args = arg;
1867 	unsigned long now = jiffies;
1868 
1869 	/*
1870 	 *	check addrconf expiration here.
1871 	 *	Routes are expired even if they are in use.
1872 	 *
1873 	 *	Also age clones. Note, that clones are aged out
1874 	 *	only if they are not in use now.
1875 	 */
1876 
1877 	if (rt->rt6i_flags & RTF_EXPIRES && rt->dst.expires) {
1878 		if (time_after(now, rt->dst.expires)) {
1879 			RT6_TRACE("expiring %p\n", rt);
1880 			return -1;
1881 		}
1882 		gc_args->more++;
1883 	} else if (rt->rt6i_flags & RTF_CACHE) {
1884 		if (atomic_read(&rt->dst.__refcnt) == 1 &&
1885 		    time_after_eq(now, rt->dst.lastuse + gc_args->timeout)) {
1886 			RT6_TRACE("aging clone %p\n", rt);
1887 			return -1;
1888 		} else if (rt->rt6i_flags & RTF_GATEWAY) {
1889 			struct neighbour *neigh;
1890 			__u8 neigh_flags = 0;
1891 
1892 			neigh = dst_neigh_lookup(&rt->dst, &rt->rt6i_gateway);
1893 			if (neigh) {
1894 				neigh_flags = neigh->flags;
1895 				neigh_release(neigh);
1896 			}
1897 			if (!(neigh_flags & NTF_ROUTER)) {
1898 				RT6_TRACE("purging route %p via non-router but gateway\n",
1899 					  rt);
1900 				return -1;
1901 			}
1902 		}
1903 		gc_args->more++;
1904 	}
1905 
1906 	return 0;
1907 }
1908 
1909 void fib6_run_gc(unsigned long expires, struct net *net, bool force)
1910 {
1911 	struct fib6_gc_args gc_args;
1912 	unsigned long now;
1913 
1914 	if (force) {
1915 		spin_lock_bh(&net->ipv6.fib6_gc_lock);
1916 	} else if (!spin_trylock_bh(&net->ipv6.fib6_gc_lock)) {
1917 		mod_timer(&net->ipv6.ip6_fib_timer, jiffies + HZ);
1918 		return;
1919 	}
1920 	gc_args.timeout = expires ? (int)expires :
1921 			  net->ipv6.sysctl.ip6_rt_gc_interval;
1922 	gc_args.more = 0;
1923 
1924 	fib6_clean_all(net, fib6_age, &gc_args);
1925 	now = jiffies;
1926 	net->ipv6.ip6_rt_last_gc = now;
1927 
1928 	if (gc_args.more)
1929 		mod_timer(&net->ipv6.ip6_fib_timer,
1930 			  round_jiffies(now
1931 					+ net->ipv6.sysctl.ip6_rt_gc_interval));
1932 	else
1933 		del_timer(&net->ipv6.ip6_fib_timer);
1934 	spin_unlock_bh(&net->ipv6.fib6_gc_lock);
1935 }
1936 
1937 static void fib6_gc_timer_cb(unsigned long arg)
1938 {
1939 	fib6_run_gc(0, (struct net *)arg, true);
1940 }
1941 
1942 static int __net_init fib6_net_init(struct net *net)
1943 {
1944 	size_t size = sizeof(struct hlist_head) * FIB6_TABLE_HASHSZ;
1945 	int err;
1946 
1947 	err = fib6_notifier_init(net);
1948 	if (err)
1949 		return err;
1950 
1951 	spin_lock_init(&net->ipv6.fib6_gc_lock);
1952 	rwlock_init(&net->ipv6.fib6_walker_lock);
1953 	INIT_LIST_HEAD(&net->ipv6.fib6_walkers);
1954 	setup_timer(&net->ipv6.ip6_fib_timer, fib6_gc_timer_cb, (unsigned long)net);
1955 
1956 	net->ipv6.rt6_stats = kzalloc(sizeof(*net->ipv6.rt6_stats), GFP_KERNEL);
1957 	if (!net->ipv6.rt6_stats)
1958 		goto out_timer;
1959 
1960 	/* Avoid false sharing : Use at least a full cache line */
1961 	size = max_t(size_t, size, L1_CACHE_BYTES);
1962 
1963 	net->ipv6.fib_table_hash = kzalloc(size, GFP_KERNEL);
1964 	if (!net->ipv6.fib_table_hash)
1965 		goto out_rt6_stats;
1966 
1967 	net->ipv6.fib6_main_tbl = kzalloc(sizeof(*net->ipv6.fib6_main_tbl),
1968 					  GFP_KERNEL);
1969 	if (!net->ipv6.fib6_main_tbl)
1970 		goto out_fib_table_hash;
1971 
1972 	net->ipv6.fib6_main_tbl->tb6_id = RT6_TABLE_MAIN;
1973 	net->ipv6.fib6_main_tbl->tb6_root.leaf = net->ipv6.ip6_null_entry;
1974 	net->ipv6.fib6_main_tbl->tb6_root.fn_flags =
1975 		RTN_ROOT | RTN_TL_ROOT | RTN_RTINFO;
1976 	inet_peer_base_init(&net->ipv6.fib6_main_tbl->tb6_peers);
1977 
1978 #ifdef CONFIG_IPV6_MULTIPLE_TABLES
1979 	net->ipv6.fib6_local_tbl = kzalloc(sizeof(*net->ipv6.fib6_local_tbl),
1980 					   GFP_KERNEL);
1981 	if (!net->ipv6.fib6_local_tbl)
1982 		goto out_fib6_main_tbl;
1983 	net->ipv6.fib6_local_tbl->tb6_id = RT6_TABLE_LOCAL;
1984 	net->ipv6.fib6_local_tbl->tb6_root.leaf = net->ipv6.ip6_null_entry;
1985 	net->ipv6.fib6_local_tbl->tb6_root.fn_flags =
1986 		RTN_ROOT | RTN_TL_ROOT | RTN_RTINFO;
1987 	inet_peer_base_init(&net->ipv6.fib6_local_tbl->tb6_peers);
1988 #endif
1989 	fib6_tables_init(net);
1990 
1991 	return 0;
1992 
1993 #ifdef CONFIG_IPV6_MULTIPLE_TABLES
1994 out_fib6_main_tbl:
1995 	kfree(net->ipv6.fib6_main_tbl);
1996 #endif
1997 out_fib_table_hash:
1998 	kfree(net->ipv6.fib_table_hash);
1999 out_rt6_stats:
2000 	kfree(net->ipv6.rt6_stats);
2001 out_timer:
2002 	fib6_notifier_exit(net);
2003 	return -ENOMEM;
2004 }
2005 
2006 static void fib6_net_exit(struct net *net)
2007 {
2008 	rt6_ifdown(net, NULL);
2009 	del_timer_sync(&net->ipv6.ip6_fib_timer);
2010 
2011 #ifdef CONFIG_IPV6_MULTIPLE_TABLES
2012 	inetpeer_invalidate_tree(&net->ipv6.fib6_local_tbl->tb6_peers);
2013 	kfree(net->ipv6.fib6_local_tbl);
2014 #endif
2015 	inetpeer_invalidate_tree(&net->ipv6.fib6_main_tbl->tb6_peers);
2016 	kfree(net->ipv6.fib6_main_tbl);
2017 	kfree(net->ipv6.fib_table_hash);
2018 	kfree(net->ipv6.rt6_stats);
2019 	fib6_notifier_exit(net);
2020 }
2021 
2022 static struct pernet_operations fib6_net_ops = {
2023 	.init = fib6_net_init,
2024 	.exit = fib6_net_exit,
2025 };
2026 
2027 int __init fib6_init(void)
2028 {
2029 	int ret = -ENOMEM;
2030 
2031 	fib6_node_kmem = kmem_cache_create("fib6_nodes",
2032 					   sizeof(struct fib6_node),
2033 					   0, SLAB_HWCACHE_ALIGN,
2034 					   NULL);
2035 	if (!fib6_node_kmem)
2036 		goto out;
2037 
2038 	ret = register_pernet_subsys(&fib6_net_ops);
2039 	if (ret)
2040 		goto out_kmem_cache_create;
2041 
2042 	ret = __rtnl_register(PF_INET6, RTM_GETROUTE, NULL, inet6_dump_fib,
2043 			      0);
2044 	if (ret)
2045 		goto out_unregister_subsys;
2046 
2047 	__fib6_flush_trees = fib6_flush_trees;
2048 out:
2049 	return ret;
2050 
2051 out_unregister_subsys:
2052 	unregister_pernet_subsys(&fib6_net_ops);
2053 out_kmem_cache_create:
2054 	kmem_cache_destroy(fib6_node_kmem);
2055 	goto out;
2056 }
2057 
2058 void fib6_gc_cleanup(void)
2059 {
2060 	unregister_pernet_subsys(&fib6_net_ops);
2061 	kmem_cache_destroy(fib6_node_kmem);
2062 }
2063 
2064 #ifdef CONFIG_PROC_FS
2065 
2066 struct ipv6_route_iter {
2067 	struct seq_net_private p;
2068 	struct fib6_walker w;
2069 	loff_t skip;
2070 	struct fib6_table *tbl;
2071 	int sernum;
2072 };
2073 
2074 static int ipv6_route_seq_show(struct seq_file *seq, void *v)
2075 {
2076 	struct rt6_info *rt = v;
2077 	struct ipv6_route_iter *iter = seq->private;
2078 
2079 	seq_printf(seq, "%pi6 %02x ", &rt->rt6i_dst.addr, rt->rt6i_dst.plen);
2080 
2081 #ifdef CONFIG_IPV6_SUBTREES
2082 	seq_printf(seq, "%pi6 %02x ", &rt->rt6i_src.addr, rt->rt6i_src.plen);
2083 #else
2084 	seq_puts(seq, "00000000000000000000000000000000 00 ");
2085 #endif
2086 	if (rt->rt6i_flags & RTF_GATEWAY)
2087 		seq_printf(seq, "%pi6", &rt->rt6i_gateway);
2088 	else
2089 		seq_puts(seq, "00000000000000000000000000000000");
2090 
2091 	seq_printf(seq, " %08x %08x %08x %08x %8s\n",
2092 		   rt->rt6i_metric, atomic_read(&rt->dst.__refcnt),
2093 		   rt->dst.__use, rt->rt6i_flags,
2094 		   rt->dst.dev ? rt->dst.dev->name : "");
2095 	iter->w.leaf = NULL;
2096 	return 0;
2097 }
2098 
2099 static int ipv6_route_yield(struct fib6_walker *w)
2100 {
2101 	struct ipv6_route_iter *iter = w->args;
2102 
2103 	if (!iter->skip)
2104 		return 1;
2105 
2106 	do {
2107 		iter->w.leaf = iter->w.leaf->dst.rt6_next;
2108 		iter->skip--;
2109 		if (!iter->skip && iter->w.leaf)
2110 			return 1;
2111 	} while (iter->w.leaf);
2112 
2113 	return 0;
2114 }
2115 
2116 static void ipv6_route_seq_setup_walk(struct ipv6_route_iter *iter,
2117 				      struct net *net)
2118 {
2119 	memset(&iter->w, 0, sizeof(iter->w));
2120 	iter->w.func = ipv6_route_yield;
2121 	iter->w.root = &iter->tbl->tb6_root;
2122 	iter->w.state = FWS_INIT;
2123 	iter->w.node = iter->w.root;
2124 	iter->w.args = iter;
2125 	iter->sernum = iter->w.root->fn_sernum;
2126 	INIT_LIST_HEAD(&iter->w.lh);
2127 	fib6_walker_link(net, &iter->w);
2128 }
2129 
2130 static struct fib6_table *ipv6_route_seq_next_table(struct fib6_table *tbl,
2131 						    struct net *net)
2132 {
2133 	unsigned int h;
2134 	struct hlist_node *node;
2135 
2136 	if (tbl) {
2137 		h = (tbl->tb6_id & (FIB6_TABLE_HASHSZ - 1)) + 1;
2138 		node = rcu_dereference_bh(hlist_next_rcu(&tbl->tb6_hlist));
2139 	} else {
2140 		h = 0;
2141 		node = NULL;
2142 	}
2143 
2144 	while (!node && h < FIB6_TABLE_HASHSZ) {
2145 		node = rcu_dereference_bh(
2146 			hlist_first_rcu(&net->ipv6.fib_table_hash[h++]));
2147 	}
2148 	return hlist_entry_safe(node, struct fib6_table, tb6_hlist);
2149 }
2150 
2151 static void ipv6_route_check_sernum(struct ipv6_route_iter *iter)
2152 {
2153 	if (iter->sernum != iter->w.root->fn_sernum) {
2154 		iter->sernum = iter->w.root->fn_sernum;
2155 		iter->w.state = FWS_INIT;
2156 		iter->w.node = iter->w.root;
2157 		WARN_ON(iter->w.skip);
2158 		iter->w.skip = iter->w.count;
2159 	}
2160 }
2161 
2162 static void *ipv6_route_seq_next(struct seq_file *seq, void *v, loff_t *pos)
2163 {
2164 	int r;
2165 	struct rt6_info *n;
2166 	struct net *net = seq_file_net(seq);
2167 	struct ipv6_route_iter *iter = seq->private;
2168 
2169 	if (!v)
2170 		goto iter_table;
2171 
2172 	n = ((struct rt6_info *)v)->dst.rt6_next;
2173 	if (n) {
2174 		++*pos;
2175 		return n;
2176 	}
2177 
2178 iter_table:
2179 	ipv6_route_check_sernum(iter);
2180 	read_lock(&iter->tbl->tb6_lock);
2181 	r = fib6_walk_continue(&iter->w);
2182 	read_unlock(&iter->tbl->tb6_lock);
2183 	if (r > 0) {
2184 		if (v)
2185 			++*pos;
2186 		return iter->w.leaf;
2187 	} else if (r < 0) {
2188 		fib6_walker_unlink(net, &iter->w);
2189 		return NULL;
2190 	}
2191 	fib6_walker_unlink(net, &iter->w);
2192 
2193 	iter->tbl = ipv6_route_seq_next_table(iter->tbl, net);
2194 	if (!iter->tbl)
2195 		return NULL;
2196 
2197 	ipv6_route_seq_setup_walk(iter, net);
2198 	goto iter_table;
2199 }
2200 
2201 static void *ipv6_route_seq_start(struct seq_file *seq, loff_t *pos)
2202 	__acquires(RCU_BH)
2203 {
2204 	struct net *net = seq_file_net(seq);
2205 	struct ipv6_route_iter *iter = seq->private;
2206 
2207 	rcu_read_lock_bh();
2208 	iter->tbl = ipv6_route_seq_next_table(NULL, net);
2209 	iter->skip = *pos;
2210 
2211 	if (iter->tbl) {
2212 		ipv6_route_seq_setup_walk(iter, net);
2213 		return ipv6_route_seq_next(seq, NULL, pos);
2214 	} else {
2215 		return NULL;
2216 	}
2217 }
2218 
2219 static bool ipv6_route_iter_active(struct ipv6_route_iter *iter)
2220 {
2221 	struct fib6_walker *w = &iter->w;
2222 	return w->node && !(w->state == FWS_U && w->node == w->root);
2223 }
2224 
2225 static void ipv6_route_seq_stop(struct seq_file *seq, void *v)
2226 	__releases(RCU_BH)
2227 {
2228 	struct net *net = seq_file_net(seq);
2229 	struct ipv6_route_iter *iter = seq->private;
2230 
2231 	if (ipv6_route_iter_active(iter))
2232 		fib6_walker_unlink(net, &iter->w);
2233 
2234 	rcu_read_unlock_bh();
2235 }
2236 
2237 static const struct seq_operations ipv6_route_seq_ops = {
2238 	.start	= ipv6_route_seq_start,
2239 	.next	= ipv6_route_seq_next,
2240 	.stop	= ipv6_route_seq_stop,
2241 	.show	= ipv6_route_seq_show
2242 };
2243 
2244 int ipv6_route_open(struct inode *inode, struct file *file)
2245 {
2246 	return seq_open_net(inode, file, &ipv6_route_seq_ops,
2247 			    sizeof(struct ipv6_route_iter));
2248 }
2249 
2250 #endif /* CONFIG_PROC_FS */
2251