xref: /openbmc/linux/net/core/neighbour.c (revision abfbd895)
1 /*
2  *	Generic address resolution entity
3  *
4  *	Authors:
5  *	Pedro Roque		<roque@di.fc.ul.pt>
6  *	Alexey Kuznetsov	<kuznet@ms2.inr.ac.ru>
7  *
8  *	This program is free software; you can redistribute it and/or
9  *      modify it under the terms of the GNU General Public License
10  *      as published by the Free Software Foundation; either version
11  *      2 of the License, or (at your option) any later version.
12  *
13  *	Fixes:
14  *	Vitaly E. Lavrov	releasing NULL neighbor in neigh_add.
15  *	Harald Welte		Add neighbour cache statistics like rtstat
16  */
17 
18 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
19 
20 #include <linux/slab.h>
21 #include <linux/types.h>
22 #include <linux/kernel.h>
23 #include <linux/module.h>
24 #include <linux/socket.h>
25 #include <linux/netdevice.h>
26 #include <linux/proc_fs.h>
27 #ifdef CONFIG_SYSCTL
28 #include <linux/sysctl.h>
29 #endif
30 #include <linux/times.h>
31 #include <net/net_namespace.h>
32 #include <net/neighbour.h>
33 #include <net/dst.h>
34 #include <net/sock.h>
35 #include <net/netevent.h>
36 #include <net/netlink.h>
37 #include <linux/rtnetlink.h>
38 #include <linux/random.h>
39 #include <linux/string.h>
40 #include <linux/log2.h>
41 #include <linux/inetdevice.h>
42 #include <net/addrconf.h>
43 
44 #define DEBUG
45 #define NEIGH_DEBUG 1
46 #define neigh_dbg(level, fmt, ...)		\
47 do {						\
48 	if (level <= NEIGH_DEBUG)		\
49 		pr_debug(fmt, ##__VA_ARGS__);	\
50 } while (0)
51 
52 #define PNEIGH_HASHMASK		0xF
53 
54 static void neigh_timer_handler(unsigned long arg);
55 static void __neigh_notify(struct neighbour *n, int type, int flags);
56 static void neigh_update_notify(struct neighbour *neigh);
57 static int pneigh_ifdown(struct neigh_table *tbl, struct net_device *dev);
58 
59 #ifdef CONFIG_PROC_FS
60 static const struct file_operations neigh_stat_seq_fops;
61 #endif
62 
63 /*
64    Neighbour hash table buckets are protected with rwlock tbl->lock.
65 
66    - All the scans/updates to hash buckets MUST be made under this lock.
67    - NOTHING clever should be made under this lock: no callbacks
68      to protocol backends, no attempts to send something to network.
69      It will result in deadlocks, if backend/driver wants to use neighbour
70      cache.
71    - If the entry requires some non-trivial actions, increase
72      its reference count and release table lock.
73 
74    Neighbour entries are protected:
75    - with reference count.
76    - with rwlock neigh->lock
77 
78    Reference count prevents destruction.
79 
80    neigh->lock mainly serializes ll address data and its validity state.
81    However, the same lock is used to protect another entry fields:
82     - timer
83     - resolution queue
84 
85    Again, nothing clever shall be made under neigh->lock,
86    the most complicated procedure, which we allow is dev->hard_header.
87    It is supposed, that dev->hard_header is simplistic and does
88    not make callbacks to neighbour tables.
89  */
90 
91 static int neigh_blackhole(struct neighbour *neigh, struct sk_buff *skb)
92 {
93 	kfree_skb(skb);
94 	return -ENETDOWN;
95 }
96 
97 static void neigh_cleanup_and_release(struct neighbour *neigh)
98 {
99 	if (neigh->parms->neigh_cleanup)
100 		neigh->parms->neigh_cleanup(neigh);
101 
102 	__neigh_notify(neigh, RTM_DELNEIGH, 0);
103 	neigh_release(neigh);
104 }
105 
106 /*
107  * It is random distribution in the interval (1/2)*base...(3/2)*base.
108  * It corresponds to default IPv6 settings and is not overridable,
109  * because it is really reasonable choice.
110  */
111 
112 unsigned long neigh_rand_reach_time(unsigned long base)
113 {
114 	return base ? (prandom_u32() % base) + (base >> 1) : 0;
115 }
116 EXPORT_SYMBOL(neigh_rand_reach_time);
117 
118 
119 static int neigh_forced_gc(struct neigh_table *tbl)
120 {
121 	int shrunk = 0;
122 	int i;
123 	struct neigh_hash_table *nht;
124 
125 	NEIGH_CACHE_STAT_INC(tbl, forced_gc_runs);
126 
127 	write_lock_bh(&tbl->lock);
128 	nht = rcu_dereference_protected(tbl->nht,
129 					lockdep_is_held(&tbl->lock));
130 	for (i = 0; i < (1 << nht->hash_shift); i++) {
131 		struct neighbour *n;
132 		struct neighbour __rcu **np;
133 
134 		np = &nht->hash_buckets[i];
135 		while ((n = rcu_dereference_protected(*np,
136 					lockdep_is_held(&tbl->lock))) != NULL) {
137 			/* Neighbour record may be discarded if:
138 			 * - nobody refers to it.
139 			 * - it is not permanent
140 			 */
141 			write_lock(&n->lock);
142 			if (atomic_read(&n->refcnt) == 1 &&
143 			    !(n->nud_state & NUD_PERMANENT)) {
144 				rcu_assign_pointer(*np,
145 					rcu_dereference_protected(n->next,
146 						  lockdep_is_held(&tbl->lock)));
147 				n->dead = 1;
148 				shrunk	= 1;
149 				write_unlock(&n->lock);
150 				neigh_cleanup_and_release(n);
151 				continue;
152 			}
153 			write_unlock(&n->lock);
154 			np = &n->next;
155 		}
156 	}
157 
158 	tbl->last_flush = jiffies;
159 
160 	write_unlock_bh(&tbl->lock);
161 
162 	return shrunk;
163 }
164 
165 static void neigh_add_timer(struct neighbour *n, unsigned long when)
166 {
167 	neigh_hold(n);
168 	if (unlikely(mod_timer(&n->timer, when))) {
169 		printk("NEIGH: BUG, double timer add, state is %x\n",
170 		       n->nud_state);
171 		dump_stack();
172 	}
173 }
174 
175 static int neigh_del_timer(struct neighbour *n)
176 {
177 	if ((n->nud_state & NUD_IN_TIMER) &&
178 	    del_timer(&n->timer)) {
179 		neigh_release(n);
180 		return 1;
181 	}
182 	return 0;
183 }
184 
185 static void pneigh_queue_purge(struct sk_buff_head *list)
186 {
187 	struct sk_buff *skb;
188 
189 	while ((skb = skb_dequeue(list)) != NULL) {
190 		dev_put(skb->dev);
191 		kfree_skb(skb);
192 	}
193 }
194 
195 static void neigh_flush_dev(struct neigh_table *tbl, struct net_device *dev)
196 {
197 	int i;
198 	struct neigh_hash_table *nht;
199 
200 	nht = rcu_dereference_protected(tbl->nht,
201 					lockdep_is_held(&tbl->lock));
202 
203 	for (i = 0; i < (1 << nht->hash_shift); i++) {
204 		struct neighbour *n;
205 		struct neighbour __rcu **np = &nht->hash_buckets[i];
206 
207 		while ((n = rcu_dereference_protected(*np,
208 					lockdep_is_held(&tbl->lock))) != NULL) {
209 			if (dev && n->dev != dev) {
210 				np = &n->next;
211 				continue;
212 			}
213 			rcu_assign_pointer(*np,
214 				   rcu_dereference_protected(n->next,
215 						lockdep_is_held(&tbl->lock)));
216 			write_lock(&n->lock);
217 			neigh_del_timer(n);
218 			n->dead = 1;
219 
220 			if (atomic_read(&n->refcnt) != 1) {
221 				/* The most unpleasant situation.
222 				   We must destroy neighbour entry,
223 				   but someone still uses it.
224 
225 				   The destroy will be delayed until
226 				   the last user releases us, but
227 				   we must kill timers etc. and move
228 				   it to safe state.
229 				 */
230 				__skb_queue_purge(&n->arp_queue);
231 				n->arp_queue_len_bytes = 0;
232 				n->output = neigh_blackhole;
233 				if (n->nud_state & NUD_VALID)
234 					n->nud_state = NUD_NOARP;
235 				else
236 					n->nud_state = NUD_NONE;
237 				neigh_dbg(2, "neigh %p is stray\n", n);
238 			}
239 			write_unlock(&n->lock);
240 			neigh_cleanup_and_release(n);
241 		}
242 	}
243 }
244 
245 void neigh_changeaddr(struct neigh_table *tbl, struct net_device *dev)
246 {
247 	write_lock_bh(&tbl->lock);
248 	neigh_flush_dev(tbl, dev);
249 	write_unlock_bh(&tbl->lock);
250 }
251 EXPORT_SYMBOL(neigh_changeaddr);
252 
253 int neigh_ifdown(struct neigh_table *tbl, struct net_device *dev)
254 {
255 	write_lock_bh(&tbl->lock);
256 	neigh_flush_dev(tbl, dev);
257 	pneigh_ifdown(tbl, dev);
258 	write_unlock_bh(&tbl->lock);
259 
260 	del_timer_sync(&tbl->proxy_timer);
261 	pneigh_queue_purge(&tbl->proxy_queue);
262 	return 0;
263 }
264 EXPORT_SYMBOL(neigh_ifdown);
265 
266 static struct neighbour *neigh_alloc(struct neigh_table *tbl, struct net_device *dev)
267 {
268 	struct neighbour *n = NULL;
269 	unsigned long now = jiffies;
270 	int entries;
271 
272 	entries = atomic_inc_return(&tbl->entries) - 1;
273 	if (entries >= tbl->gc_thresh3 ||
274 	    (entries >= tbl->gc_thresh2 &&
275 	     time_after(now, tbl->last_flush + 5 * HZ))) {
276 		if (!neigh_forced_gc(tbl) &&
277 		    entries >= tbl->gc_thresh3) {
278 			net_info_ratelimited("%s: neighbor table overflow!\n",
279 					     tbl->id);
280 			NEIGH_CACHE_STAT_INC(tbl, table_fulls);
281 			goto out_entries;
282 		}
283 	}
284 
285 	n = kzalloc(tbl->entry_size + dev->neigh_priv_len, GFP_ATOMIC);
286 	if (!n)
287 		goto out_entries;
288 
289 	__skb_queue_head_init(&n->arp_queue);
290 	rwlock_init(&n->lock);
291 	seqlock_init(&n->ha_lock);
292 	n->updated	  = n->used = now;
293 	n->nud_state	  = NUD_NONE;
294 	n->output	  = neigh_blackhole;
295 	seqlock_init(&n->hh.hh_lock);
296 	n->parms	  = neigh_parms_clone(&tbl->parms);
297 	setup_timer(&n->timer, neigh_timer_handler, (unsigned long)n);
298 
299 	NEIGH_CACHE_STAT_INC(tbl, allocs);
300 	n->tbl		  = tbl;
301 	atomic_set(&n->refcnt, 1);
302 	n->dead		  = 1;
303 out:
304 	return n;
305 
306 out_entries:
307 	atomic_dec(&tbl->entries);
308 	goto out;
309 }
310 
311 static void neigh_get_hash_rnd(u32 *x)
312 {
313 	get_random_bytes(x, sizeof(*x));
314 	*x |= 1;
315 }
316 
317 static struct neigh_hash_table *neigh_hash_alloc(unsigned int shift)
318 {
319 	size_t size = (1 << shift) * sizeof(struct neighbour *);
320 	struct neigh_hash_table *ret;
321 	struct neighbour __rcu **buckets;
322 	int i;
323 
324 	ret = kmalloc(sizeof(*ret), GFP_ATOMIC);
325 	if (!ret)
326 		return NULL;
327 	if (size <= PAGE_SIZE)
328 		buckets = kzalloc(size, GFP_ATOMIC);
329 	else
330 		buckets = (struct neighbour __rcu **)
331 			  __get_free_pages(GFP_ATOMIC | __GFP_ZERO,
332 					   get_order(size));
333 	if (!buckets) {
334 		kfree(ret);
335 		return NULL;
336 	}
337 	ret->hash_buckets = buckets;
338 	ret->hash_shift = shift;
339 	for (i = 0; i < NEIGH_NUM_HASH_RND; i++)
340 		neigh_get_hash_rnd(&ret->hash_rnd[i]);
341 	return ret;
342 }
343 
344 static void neigh_hash_free_rcu(struct rcu_head *head)
345 {
346 	struct neigh_hash_table *nht = container_of(head,
347 						    struct neigh_hash_table,
348 						    rcu);
349 	size_t size = (1 << nht->hash_shift) * sizeof(struct neighbour *);
350 	struct neighbour __rcu **buckets = nht->hash_buckets;
351 
352 	if (size <= PAGE_SIZE)
353 		kfree(buckets);
354 	else
355 		free_pages((unsigned long)buckets, get_order(size));
356 	kfree(nht);
357 }
358 
359 static struct neigh_hash_table *neigh_hash_grow(struct neigh_table *tbl,
360 						unsigned long new_shift)
361 {
362 	unsigned int i, hash;
363 	struct neigh_hash_table *new_nht, *old_nht;
364 
365 	NEIGH_CACHE_STAT_INC(tbl, hash_grows);
366 
367 	old_nht = rcu_dereference_protected(tbl->nht,
368 					    lockdep_is_held(&tbl->lock));
369 	new_nht = neigh_hash_alloc(new_shift);
370 	if (!new_nht)
371 		return old_nht;
372 
373 	for (i = 0; i < (1 << old_nht->hash_shift); i++) {
374 		struct neighbour *n, *next;
375 
376 		for (n = rcu_dereference_protected(old_nht->hash_buckets[i],
377 						   lockdep_is_held(&tbl->lock));
378 		     n != NULL;
379 		     n = next) {
380 			hash = tbl->hash(n->primary_key, n->dev,
381 					 new_nht->hash_rnd);
382 
383 			hash >>= (32 - new_nht->hash_shift);
384 			next = rcu_dereference_protected(n->next,
385 						lockdep_is_held(&tbl->lock));
386 
387 			rcu_assign_pointer(n->next,
388 					   rcu_dereference_protected(
389 						new_nht->hash_buckets[hash],
390 						lockdep_is_held(&tbl->lock)));
391 			rcu_assign_pointer(new_nht->hash_buckets[hash], n);
392 		}
393 	}
394 
395 	rcu_assign_pointer(tbl->nht, new_nht);
396 	call_rcu(&old_nht->rcu, neigh_hash_free_rcu);
397 	return new_nht;
398 }
399 
400 struct neighbour *neigh_lookup(struct neigh_table *tbl, const void *pkey,
401 			       struct net_device *dev)
402 {
403 	struct neighbour *n;
404 
405 	NEIGH_CACHE_STAT_INC(tbl, lookups);
406 
407 	rcu_read_lock_bh();
408 	n = __neigh_lookup_noref(tbl, pkey, dev);
409 	if (n) {
410 		if (!atomic_inc_not_zero(&n->refcnt))
411 			n = NULL;
412 		NEIGH_CACHE_STAT_INC(tbl, hits);
413 	}
414 
415 	rcu_read_unlock_bh();
416 	return n;
417 }
418 EXPORT_SYMBOL(neigh_lookup);
419 
420 struct neighbour *neigh_lookup_nodev(struct neigh_table *tbl, struct net *net,
421 				     const void *pkey)
422 {
423 	struct neighbour *n;
424 	int key_len = tbl->key_len;
425 	u32 hash_val;
426 	struct neigh_hash_table *nht;
427 
428 	NEIGH_CACHE_STAT_INC(tbl, lookups);
429 
430 	rcu_read_lock_bh();
431 	nht = rcu_dereference_bh(tbl->nht);
432 	hash_val = tbl->hash(pkey, NULL, nht->hash_rnd) >> (32 - nht->hash_shift);
433 
434 	for (n = rcu_dereference_bh(nht->hash_buckets[hash_val]);
435 	     n != NULL;
436 	     n = rcu_dereference_bh(n->next)) {
437 		if (!memcmp(n->primary_key, pkey, key_len) &&
438 		    net_eq(dev_net(n->dev), net)) {
439 			if (!atomic_inc_not_zero(&n->refcnt))
440 				n = NULL;
441 			NEIGH_CACHE_STAT_INC(tbl, hits);
442 			break;
443 		}
444 	}
445 
446 	rcu_read_unlock_bh();
447 	return n;
448 }
449 EXPORT_SYMBOL(neigh_lookup_nodev);
450 
451 struct neighbour *__neigh_create(struct neigh_table *tbl, const void *pkey,
452 				 struct net_device *dev, bool want_ref)
453 {
454 	u32 hash_val;
455 	int key_len = tbl->key_len;
456 	int error;
457 	struct neighbour *n1, *rc, *n = neigh_alloc(tbl, dev);
458 	struct neigh_hash_table *nht;
459 
460 	if (!n) {
461 		rc = ERR_PTR(-ENOBUFS);
462 		goto out;
463 	}
464 
465 	memcpy(n->primary_key, pkey, key_len);
466 	n->dev = dev;
467 	dev_hold(dev);
468 
469 	/* Protocol specific setup. */
470 	if (tbl->constructor &&	(error = tbl->constructor(n)) < 0) {
471 		rc = ERR_PTR(error);
472 		goto out_neigh_release;
473 	}
474 
475 	if (dev->netdev_ops->ndo_neigh_construct) {
476 		error = dev->netdev_ops->ndo_neigh_construct(n);
477 		if (error < 0) {
478 			rc = ERR_PTR(error);
479 			goto out_neigh_release;
480 		}
481 	}
482 
483 	/* Device specific setup. */
484 	if (n->parms->neigh_setup &&
485 	    (error = n->parms->neigh_setup(n)) < 0) {
486 		rc = ERR_PTR(error);
487 		goto out_neigh_release;
488 	}
489 
490 	n->confirmed = jiffies - (NEIGH_VAR(n->parms, BASE_REACHABLE_TIME) << 1);
491 
492 	write_lock_bh(&tbl->lock);
493 	nht = rcu_dereference_protected(tbl->nht,
494 					lockdep_is_held(&tbl->lock));
495 
496 	if (atomic_read(&tbl->entries) > (1 << nht->hash_shift))
497 		nht = neigh_hash_grow(tbl, nht->hash_shift + 1);
498 
499 	hash_val = tbl->hash(pkey, dev, nht->hash_rnd) >> (32 - nht->hash_shift);
500 
501 	if (n->parms->dead) {
502 		rc = ERR_PTR(-EINVAL);
503 		goto out_tbl_unlock;
504 	}
505 
506 	for (n1 = rcu_dereference_protected(nht->hash_buckets[hash_val],
507 					    lockdep_is_held(&tbl->lock));
508 	     n1 != NULL;
509 	     n1 = rcu_dereference_protected(n1->next,
510 			lockdep_is_held(&tbl->lock))) {
511 		if (dev == n1->dev && !memcmp(n1->primary_key, pkey, key_len)) {
512 			if (want_ref)
513 				neigh_hold(n1);
514 			rc = n1;
515 			goto out_tbl_unlock;
516 		}
517 	}
518 
519 	n->dead = 0;
520 	if (want_ref)
521 		neigh_hold(n);
522 	rcu_assign_pointer(n->next,
523 			   rcu_dereference_protected(nht->hash_buckets[hash_val],
524 						     lockdep_is_held(&tbl->lock)));
525 	rcu_assign_pointer(nht->hash_buckets[hash_val], n);
526 	write_unlock_bh(&tbl->lock);
527 	neigh_dbg(2, "neigh %p is created\n", n);
528 	rc = n;
529 out:
530 	return rc;
531 out_tbl_unlock:
532 	write_unlock_bh(&tbl->lock);
533 out_neigh_release:
534 	neigh_release(n);
535 	goto out;
536 }
537 EXPORT_SYMBOL(__neigh_create);
538 
539 static u32 pneigh_hash(const void *pkey, int key_len)
540 {
541 	u32 hash_val = *(u32 *)(pkey + key_len - 4);
542 	hash_val ^= (hash_val >> 16);
543 	hash_val ^= hash_val >> 8;
544 	hash_val ^= hash_val >> 4;
545 	hash_val &= PNEIGH_HASHMASK;
546 	return hash_val;
547 }
548 
549 static struct pneigh_entry *__pneigh_lookup_1(struct pneigh_entry *n,
550 					      struct net *net,
551 					      const void *pkey,
552 					      int key_len,
553 					      struct net_device *dev)
554 {
555 	while (n) {
556 		if (!memcmp(n->key, pkey, key_len) &&
557 		    net_eq(pneigh_net(n), net) &&
558 		    (n->dev == dev || !n->dev))
559 			return n;
560 		n = n->next;
561 	}
562 	return NULL;
563 }
564 
565 struct pneigh_entry *__pneigh_lookup(struct neigh_table *tbl,
566 		struct net *net, const void *pkey, struct net_device *dev)
567 {
568 	int key_len = tbl->key_len;
569 	u32 hash_val = pneigh_hash(pkey, key_len);
570 
571 	return __pneigh_lookup_1(tbl->phash_buckets[hash_val],
572 				 net, pkey, key_len, dev);
573 }
574 EXPORT_SYMBOL_GPL(__pneigh_lookup);
575 
576 struct pneigh_entry * pneigh_lookup(struct neigh_table *tbl,
577 				    struct net *net, const void *pkey,
578 				    struct net_device *dev, int creat)
579 {
580 	struct pneigh_entry *n;
581 	int key_len = tbl->key_len;
582 	u32 hash_val = pneigh_hash(pkey, key_len);
583 
584 	read_lock_bh(&tbl->lock);
585 	n = __pneigh_lookup_1(tbl->phash_buckets[hash_val],
586 			      net, pkey, key_len, dev);
587 	read_unlock_bh(&tbl->lock);
588 
589 	if (n || !creat)
590 		goto out;
591 
592 	ASSERT_RTNL();
593 
594 	n = kmalloc(sizeof(*n) + key_len, GFP_KERNEL);
595 	if (!n)
596 		goto out;
597 
598 	write_pnet(&n->net, net);
599 	memcpy(n->key, pkey, key_len);
600 	n->dev = dev;
601 	if (dev)
602 		dev_hold(dev);
603 
604 	if (tbl->pconstructor && tbl->pconstructor(n)) {
605 		if (dev)
606 			dev_put(dev);
607 		kfree(n);
608 		n = NULL;
609 		goto out;
610 	}
611 
612 	write_lock_bh(&tbl->lock);
613 	n->next = tbl->phash_buckets[hash_val];
614 	tbl->phash_buckets[hash_val] = n;
615 	write_unlock_bh(&tbl->lock);
616 out:
617 	return n;
618 }
619 EXPORT_SYMBOL(pneigh_lookup);
620 
621 
622 int pneigh_delete(struct neigh_table *tbl, struct net *net, const void *pkey,
623 		  struct net_device *dev)
624 {
625 	struct pneigh_entry *n, **np;
626 	int key_len = tbl->key_len;
627 	u32 hash_val = pneigh_hash(pkey, key_len);
628 
629 	write_lock_bh(&tbl->lock);
630 	for (np = &tbl->phash_buckets[hash_val]; (n = *np) != NULL;
631 	     np = &n->next) {
632 		if (!memcmp(n->key, pkey, key_len) && n->dev == dev &&
633 		    net_eq(pneigh_net(n), net)) {
634 			*np = n->next;
635 			write_unlock_bh(&tbl->lock);
636 			if (tbl->pdestructor)
637 				tbl->pdestructor(n);
638 			if (n->dev)
639 				dev_put(n->dev);
640 			kfree(n);
641 			return 0;
642 		}
643 	}
644 	write_unlock_bh(&tbl->lock);
645 	return -ENOENT;
646 }
647 
648 static int pneigh_ifdown(struct neigh_table *tbl, struct net_device *dev)
649 {
650 	struct pneigh_entry *n, **np;
651 	u32 h;
652 
653 	for (h = 0; h <= PNEIGH_HASHMASK; h++) {
654 		np = &tbl->phash_buckets[h];
655 		while ((n = *np) != NULL) {
656 			if (!dev || n->dev == dev) {
657 				*np = n->next;
658 				if (tbl->pdestructor)
659 					tbl->pdestructor(n);
660 				if (n->dev)
661 					dev_put(n->dev);
662 				kfree(n);
663 				continue;
664 			}
665 			np = &n->next;
666 		}
667 	}
668 	return -ENOENT;
669 }
670 
671 static void neigh_parms_destroy(struct neigh_parms *parms);
672 
673 static inline void neigh_parms_put(struct neigh_parms *parms)
674 {
675 	if (atomic_dec_and_test(&parms->refcnt))
676 		neigh_parms_destroy(parms);
677 }
678 
679 /*
680  *	neighbour must already be out of the table;
681  *
682  */
683 void neigh_destroy(struct neighbour *neigh)
684 {
685 	struct net_device *dev = neigh->dev;
686 
687 	NEIGH_CACHE_STAT_INC(neigh->tbl, destroys);
688 
689 	if (!neigh->dead) {
690 		pr_warn("Destroying alive neighbour %p\n", neigh);
691 		dump_stack();
692 		return;
693 	}
694 
695 	if (neigh_del_timer(neigh))
696 		pr_warn("Impossible event\n");
697 
698 	write_lock_bh(&neigh->lock);
699 	__skb_queue_purge(&neigh->arp_queue);
700 	write_unlock_bh(&neigh->lock);
701 	neigh->arp_queue_len_bytes = 0;
702 
703 	if (dev->netdev_ops->ndo_neigh_destroy)
704 		dev->netdev_ops->ndo_neigh_destroy(neigh);
705 
706 	dev_put(dev);
707 	neigh_parms_put(neigh->parms);
708 
709 	neigh_dbg(2, "neigh %p is destroyed\n", neigh);
710 
711 	atomic_dec(&neigh->tbl->entries);
712 	kfree_rcu(neigh, rcu);
713 }
714 EXPORT_SYMBOL(neigh_destroy);
715 
716 /* Neighbour state is suspicious;
717    disable fast path.
718 
719    Called with write_locked neigh.
720  */
721 static void neigh_suspect(struct neighbour *neigh)
722 {
723 	neigh_dbg(2, "neigh %p is suspected\n", neigh);
724 
725 	neigh->output = neigh->ops->output;
726 }
727 
728 /* Neighbour state is OK;
729    enable fast path.
730 
731    Called with write_locked neigh.
732  */
733 static void neigh_connect(struct neighbour *neigh)
734 {
735 	neigh_dbg(2, "neigh %p is connected\n", neigh);
736 
737 	neigh->output = neigh->ops->connected_output;
738 }
739 
740 static void neigh_periodic_work(struct work_struct *work)
741 {
742 	struct neigh_table *tbl = container_of(work, struct neigh_table, gc_work.work);
743 	struct neighbour *n;
744 	struct neighbour __rcu **np;
745 	unsigned int i;
746 	struct neigh_hash_table *nht;
747 
748 	NEIGH_CACHE_STAT_INC(tbl, periodic_gc_runs);
749 
750 	write_lock_bh(&tbl->lock);
751 	nht = rcu_dereference_protected(tbl->nht,
752 					lockdep_is_held(&tbl->lock));
753 
754 	/*
755 	 *	periodically recompute ReachableTime from random function
756 	 */
757 
758 	if (time_after(jiffies, tbl->last_rand + 300 * HZ)) {
759 		struct neigh_parms *p;
760 		tbl->last_rand = jiffies;
761 		list_for_each_entry(p, &tbl->parms_list, list)
762 			p->reachable_time =
763 				neigh_rand_reach_time(NEIGH_VAR(p, BASE_REACHABLE_TIME));
764 	}
765 
766 	if (atomic_read(&tbl->entries) < tbl->gc_thresh1)
767 		goto out;
768 
769 	for (i = 0 ; i < (1 << nht->hash_shift); i++) {
770 		np = &nht->hash_buckets[i];
771 
772 		while ((n = rcu_dereference_protected(*np,
773 				lockdep_is_held(&tbl->lock))) != NULL) {
774 			unsigned int state;
775 
776 			write_lock(&n->lock);
777 
778 			state = n->nud_state;
779 			if (state & (NUD_PERMANENT | NUD_IN_TIMER)) {
780 				write_unlock(&n->lock);
781 				goto next_elt;
782 			}
783 
784 			if (time_before(n->used, n->confirmed))
785 				n->used = n->confirmed;
786 
787 			if (atomic_read(&n->refcnt) == 1 &&
788 			    (state == NUD_FAILED ||
789 			     time_after(jiffies, n->used + NEIGH_VAR(n->parms, GC_STALETIME)))) {
790 				*np = n->next;
791 				n->dead = 1;
792 				write_unlock(&n->lock);
793 				neigh_cleanup_and_release(n);
794 				continue;
795 			}
796 			write_unlock(&n->lock);
797 
798 next_elt:
799 			np = &n->next;
800 		}
801 		/*
802 		 * It's fine to release lock here, even if hash table
803 		 * grows while we are preempted.
804 		 */
805 		write_unlock_bh(&tbl->lock);
806 		cond_resched();
807 		write_lock_bh(&tbl->lock);
808 		nht = rcu_dereference_protected(tbl->nht,
809 						lockdep_is_held(&tbl->lock));
810 	}
811 out:
812 	/* Cycle through all hash buckets every BASE_REACHABLE_TIME/2 ticks.
813 	 * ARP entry timeouts range from 1/2 BASE_REACHABLE_TIME to 3/2
814 	 * BASE_REACHABLE_TIME.
815 	 */
816 	queue_delayed_work(system_power_efficient_wq, &tbl->gc_work,
817 			      NEIGH_VAR(&tbl->parms, BASE_REACHABLE_TIME) >> 1);
818 	write_unlock_bh(&tbl->lock);
819 }
820 
821 static __inline__ int neigh_max_probes(struct neighbour *n)
822 {
823 	struct neigh_parms *p = n->parms;
824 	return NEIGH_VAR(p, UCAST_PROBES) + NEIGH_VAR(p, APP_PROBES) +
825 	       (n->nud_state & NUD_PROBE ? NEIGH_VAR(p, MCAST_REPROBES) :
826 	        NEIGH_VAR(p, MCAST_PROBES));
827 }
828 
829 static void neigh_invalidate(struct neighbour *neigh)
830 	__releases(neigh->lock)
831 	__acquires(neigh->lock)
832 {
833 	struct sk_buff *skb;
834 
835 	NEIGH_CACHE_STAT_INC(neigh->tbl, res_failed);
836 	neigh_dbg(2, "neigh %p is failed\n", neigh);
837 	neigh->updated = jiffies;
838 
839 	/* It is very thin place. report_unreachable is very complicated
840 	   routine. Particularly, it can hit the same neighbour entry!
841 
842 	   So that, we try to be accurate and avoid dead loop. --ANK
843 	 */
844 	while (neigh->nud_state == NUD_FAILED &&
845 	       (skb = __skb_dequeue(&neigh->arp_queue)) != NULL) {
846 		write_unlock(&neigh->lock);
847 		neigh->ops->error_report(neigh, skb);
848 		write_lock(&neigh->lock);
849 	}
850 	__skb_queue_purge(&neigh->arp_queue);
851 	neigh->arp_queue_len_bytes = 0;
852 }
853 
854 static void neigh_probe(struct neighbour *neigh)
855 	__releases(neigh->lock)
856 {
857 	struct sk_buff *skb = skb_peek_tail(&neigh->arp_queue);
858 	/* keep skb alive even if arp_queue overflows */
859 	if (skb)
860 		skb = skb_clone(skb, GFP_ATOMIC);
861 	write_unlock(&neigh->lock);
862 	neigh->ops->solicit(neigh, skb);
863 	atomic_inc(&neigh->probes);
864 	kfree_skb(skb);
865 }
866 
867 /* Called when a timer expires for a neighbour entry. */
868 
869 static void neigh_timer_handler(unsigned long arg)
870 {
871 	unsigned long now, next;
872 	struct neighbour *neigh = (struct neighbour *)arg;
873 	unsigned int state;
874 	int notify = 0;
875 
876 	write_lock(&neigh->lock);
877 
878 	state = neigh->nud_state;
879 	now = jiffies;
880 	next = now + HZ;
881 
882 	if (!(state & NUD_IN_TIMER))
883 		goto out;
884 
885 	if (state & NUD_REACHABLE) {
886 		if (time_before_eq(now,
887 				   neigh->confirmed + neigh->parms->reachable_time)) {
888 			neigh_dbg(2, "neigh %p is still alive\n", neigh);
889 			next = neigh->confirmed + neigh->parms->reachable_time;
890 		} else if (time_before_eq(now,
891 					  neigh->used +
892 					  NEIGH_VAR(neigh->parms, DELAY_PROBE_TIME))) {
893 			neigh_dbg(2, "neigh %p is delayed\n", neigh);
894 			neigh->nud_state = NUD_DELAY;
895 			neigh->updated = jiffies;
896 			neigh_suspect(neigh);
897 			next = now + NEIGH_VAR(neigh->parms, DELAY_PROBE_TIME);
898 		} else {
899 			neigh_dbg(2, "neigh %p is suspected\n", neigh);
900 			neigh->nud_state = NUD_STALE;
901 			neigh->updated = jiffies;
902 			neigh_suspect(neigh);
903 			notify = 1;
904 		}
905 	} else if (state & NUD_DELAY) {
906 		if (time_before_eq(now,
907 				   neigh->confirmed +
908 				   NEIGH_VAR(neigh->parms, DELAY_PROBE_TIME))) {
909 			neigh_dbg(2, "neigh %p is now reachable\n", neigh);
910 			neigh->nud_state = NUD_REACHABLE;
911 			neigh->updated = jiffies;
912 			neigh_connect(neigh);
913 			notify = 1;
914 			next = neigh->confirmed + neigh->parms->reachable_time;
915 		} else {
916 			neigh_dbg(2, "neigh %p is probed\n", neigh);
917 			neigh->nud_state = NUD_PROBE;
918 			neigh->updated = jiffies;
919 			atomic_set(&neigh->probes, 0);
920 			notify = 1;
921 			next = now + NEIGH_VAR(neigh->parms, RETRANS_TIME);
922 		}
923 	} else {
924 		/* NUD_PROBE|NUD_INCOMPLETE */
925 		next = now + NEIGH_VAR(neigh->parms, RETRANS_TIME);
926 	}
927 
928 	if ((neigh->nud_state & (NUD_INCOMPLETE | NUD_PROBE)) &&
929 	    atomic_read(&neigh->probes) >= neigh_max_probes(neigh)) {
930 		neigh->nud_state = NUD_FAILED;
931 		notify = 1;
932 		neigh_invalidate(neigh);
933 		goto out;
934 	}
935 
936 	if (neigh->nud_state & NUD_IN_TIMER) {
937 		if (time_before(next, jiffies + HZ/2))
938 			next = jiffies + HZ/2;
939 		if (!mod_timer(&neigh->timer, next))
940 			neigh_hold(neigh);
941 	}
942 	if (neigh->nud_state & (NUD_INCOMPLETE | NUD_PROBE)) {
943 		neigh_probe(neigh);
944 	} else {
945 out:
946 		write_unlock(&neigh->lock);
947 	}
948 
949 	if (notify)
950 		neigh_update_notify(neigh);
951 
952 	neigh_release(neigh);
953 }
954 
955 int __neigh_event_send(struct neighbour *neigh, struct sk_buff *skb)
956 {
957 	int rc;
958 	bool immediate_probe = false;
959 
960 	write_lock_bh(&neigh->lock);
961 
962 	rc = 0;
963 	if (neigh->nud_state & (NUD_CONNECTED | NUD_DELAY | NUD_PROBE))
964 		goto out_unlock_bh;
965 	if (neigh->dead)
966 		goto out_dead;
967 
968 	if (!(neigh->nud_state & (NUD_STALE | NUD_INCOMPLETE))) {
969 		if (NEIGH_VAR(neigh->parms, MCAST_PROBES) +
970 		    NEIGH_VAR(neigh->parms, APP_PROBES)) {
971 			unsigned long next, now = jiffies;
972 
973 			atomic_set(&neigh->probes,
974 				   NEIGH_VAR(neigh->parms, UCAST_PROBES));
975 			neigh->nud_state     = NUD_INCOMPLETE;
976 			neigh->updated = now;
977 			next = now + max(NEIGH_VAR(neigh->parms, RETRANS_TIME),
978 					 HZ/2);
979 			neigh_add_timer(neigh, next);
980 			immediate_probe = true;
981 		} else {
982 			neigh->nud_state = NUD_FAILED;
983 			neigh->updated = jiffies;
984 			write_unlock_bh(&neigh->lock);
985 
986 			kfree_skb(skb);
987 			return 1;
988 		}
989 	} else if (neigh->nud_state & NUD_STALE) {
990 		neigh_dbg(2, "neigh %p is delayed\n", neigh);
991 		neigh->nud_state = NUD_DELAY;
992 		neigh->updated = jiffies;
993 		neigh_add_timer(neigh, jiffies +
994 				NEIGH_VAR(neigh->parms, DELAY_PROBE_TIME));
995 	}
996 
997 	if (neigh->nud_state == NUD_INCOMPLETE) {
998 		if (skb) {
999 			while (neigh->arp_queue_len_bytes + skb->truesize >
1000 			       NEIGH_VAR(neigh->parms, QUEUE_LEN_BYTES)) {
1001 				struct sk_buff *buff;
1002 
1003 				buff = __skb_dequeue(&neigh->arp_queue);
1004 				if (!buff)
1005 					break;
1006 				neigh->arp_queue_len_bytes -= buff->truesize;
1007 				kfree_skb(buff);
1008 				NEIGH_CACHE_STAT_INC(neigh->tbl, unres_discards);
1009 			}
1010 			skb_dst_force(skb);
1011 			__skb_queue_tail(&neigh->arp_queue, skb);
1012 			neigh->arp_queue_len_bytes += skb->truesize;
1013 		}
1014 		rc = 1;
1015 	}
1016 out_unlock_bh:
1017 	if (immediate_probe)
1018 		neigh_probe(neigh);
1019 	else
1020 		write_unlock(&neigh->lock);
1021 	local_bh_enable();
1022 	return rc;
1023 
1024 out_dead:
1025 	if (neigh->nud_state & NUD_STALE)
1026 		goto out_unlock_bh;
1027 	write_unlock_bh(&neigh->lock);
1028 	kfree_skb(skb);
1029 	return 1;
1030 }
1031 EXPORT_SYMBOL(__neigh_event_send);
1032 
1033 static void neigh_update_hhs(struct neighbour *neigh)
1034 {
1035 	struct hh_cache *hh;
1036 	void (*update)(struct hh_cache*, const struct net_device*, const unsigned char *)
1037 		= NULL;
1038 
1039 	if (neigh->dev->header_ops)
1040 		update = neigh->dev->header_ops->cache_update;
1041 
1042 	if (update) {
1043 		hh = &neigh->hh;
1044 		if (hh->hh_len) {
1045 			write_seqlock_bh(&hh->hh_lock);
1046 			update(hh, neigh->dev, neigh->ha);
1047 			write_sequnlock_bh(&hh->hh_lock);
1048 		}
1049 	}
1050 }
1051 
1052 
1053 
1054 /* Generic update routine.
1055    -- lladdr is new lladdr or NULL, if it is not supplied.
1056    -- new    is new state.
1057    -- flags
1058 	NEIGH_UPDATE_F_OVERRIDE allows to override existing lladdr,
1059 				if it is different.
1060 	NEIGH_UPDATE_F_WEAK_OVERRIDE will suspect existing "connected"
1061 				lladdr instead of overriding it
1062 				if it is different.
1063 				It also allows to retain current state
1064 				if lladdr is unchanged.
1065 	NEIGH_UPDATE_F_ADMIN	means that the change is administrative.
1066 
1067 	NEIGH_UPDATE_F_OVERRIDE_ISROUTER allows to override existing
1068 				NTF_ROUTER flag.
1069 	NEIGH_UPDATE_F_ISROUTER	indicates if the neighbour is known as
1070 				a router.
1071 
1072    Caller MUST hold reference count on the entry.
1073  */
1074 
1075 int neigh_update(struct neighbour *neigh, const u8 *lladdr, u8 new,
1076 		 u32 flags)
1077 {
1078 	u8 old;
1079 	int err;
1080 	int notify = 0;
1081 	struct net_device *dev;
1082 	int update_isrouter = 0;
1083 
1084 	write_lock_bh(&neigh->lock);
1085 
1086 	dev    = neigh->dev;
1087 	old    = neigh->nud_state;
1088 	err    = -EPERM;
1089 
1090 	if (!(flags & NEIGH_UPDATE_F_ADMIN) &&
1091 	    (old & (NUD_NOARP | NUD_PERMANENT)))
1092 		goto out;
1093 	if (neigh->dead)
1094 		goto out;
1095 
1096 	if (!(new & NUD_VALID)) {
1097 		neigh_del_timer(neigh);
1098 		if (old & NUD_CONNECTED)
1099 			neigh_suspect(neigh);
1100 		neigh->nud_state = new;
1101 		err = 0;
1102 		notify = old & NUD_VALID;
1103 		if ((old & (NUD_INCOMPLETE | NUD_PROBE)) &&
1104 		    (new & NUD_FAILED)) {
1105 			neigh_invalidate(neigh);
1106 			notify = 1;
1107 		}
1108 		goto out;
1109 	}
1110 
1111 	/* Compare new lladdr with cached one */
1112 	if (!dev->addr_len) {
1113 		/* First case: device needs no address. */
1114 		lladdr = neigh->ha;
1115 	} else if (lladdr) {
1116 		/* The second case: if something is already cached
1117 		   and a new address is proposed:
1118 		   - compare new & old
1119 		   - if they are different, check override flag
1120 		 */
1121 		if ((old & NUD_VALID) &&
1122 		    !memcmp(lladdr, neigh->ha, dev->addr_len))
1123 			lladdr = neigh->ha;
1124 	} else {
1125 		/* No address is supplied; if we know something,
1126 		   use it, otherwise discard the request.
1127 		 */
1128 		err = -EINVAL;
1129 		if (!(old & NUD_VALID))
1130 			goto out;
1131 		lladdr = neigh->ha;
1132 	}
1133 
1134 	if (new & NUD_CONNECTED)
1135 		neigh->confirmed = jiffies;
1136 	neigh->updated = jiffies;
1137 
1138 	/* If entry was valid and address is not changed,
1139 	   do not change entry state, if new one is STALE.
1140 	 */
1141 	err = 0;
1142 	update_isrouter = flags & NEIGH_UPDATE_F_OVERRIDE_ISROUTER;
1143 	if (old & NUD_VALID) {
1144 		if (lladdr != neigh->ha && !(flags & NEIGH_UPDATE_F_OVERRIDE)) {
1145 			update_isrouter = 0;
1146 			if ((flags & NEIGH_UPDATE_F_WEAK_OVERRIDE) &&
1147 			    (old & NUD_CONNECTED)) {
1148 				lladdr = neigh->ha;
1149 				new = NUD_STALE;
1150 			} else
1151 				goto out;
1152 		} else {
1153 			if (lladdr == neigh->ha && new == NUD_STALE &&
1154 			    ((flags & NEIGH_UPDATE_F_WEAK_OVERRIDE) ||
1155 			     (old & NUD_CONNECTED))
1156 			    )
1157 				new = old;
1158 		}
1159 	}
1160 
1161 	if (new != old) {
1162 		neigh_del_timer(neigh);
1163 		if (new & NUD_PROBE)
1164 			atomic_set(&neigh->probes, 0);
1165 		if (new & NUD_IN_TIMER)
1166 			neigh_add_timer(neigh, (jiffies +
1167 						((new & NUD_REACHABLE) ?
1168 						 neigh->parms->reachable_time :
1169 						 0)));
1170 		neigh->nud_state = new;
1171 		notify = 1;
1172 	}
1173 
1174 	if (lladdr != neigh->ha) {
1175 		write_seqlock(&neigh->ha_lock);
1176 		memcpy(&neigh->ha, lladdr, dev->addr_len);
1177 		write_sequnlock(&neigh->ha_lock);
1178 		neigh_update_hhs(neigh);
1179 		if (!(new & NUD_CONNECTED))
1180 			neigh->confirmed = jiffies -
1181 				      (NEIGH_VAR(neigh->parms, BASE_REACHABLE_TIME) << 1);
1182 		notify = 1;
1183 	}
1184 	if (new == old)
1185 		goto out;
1186 	if (new & NUD_CONNECTED)
1187 		neigh_connect(neigh);
1188 	else
1189 		neigh_suspect(neigh);
1190 	if (!(old & NUD_VALID)) {
1191 		struct sk_buff *skb;
1192 
1193 		/* Again: avoid dead loop if something went wrong */
1194 
1195 		while (neigh->nud_state & NUD_VALID &&
1196 		       (skb = __skb_dequeue(&neigh->arp_queue)) != NULL) {
1197 			struct dst_entry *dst = skb_dst(skb);
1198 			struct neighbour *n2, *n1 = neigh;
1199 			write_unlock_bh(&neigh->lock);
1200 
1201 			rcu_read_lock();
1202 
1203 			/* Why not just use 'neigh' as-is?  The problem is that
1204 			 * things such as shaper, eql, and sch_teql can end up
1205 			 * using alternative, different, neigh objects to output
1206 			 * the packet in the output path.  So what we need to do
1207 			 * here is re-lookup the top-level neigh in the path so
1208 			 * we can reinject the packet there.
1209 			 */
1210 			n2 = NULL;
1211 			if (dst) {
1212 				n2 = dst_neigh_lookup_skb(dst, skb);
1213 				if (n2)
1214 					n1 = n2;
1215 			}
1216 			n1->output(n1, skb);
1217 			if (n2)
1218 				neigh_release(n2);
1219 			rcu_read_unlock();
1220 
1221 			write_lock_bh(&neigh->lock);
1222 		}
1223 		__skb_queue_purge(&neigh->arp_queue);
1224 		neigh->arp_queue_len_bytes = 0;
1225 	}
1226 out:
1227 	if (update_isrouter) {
1228 		neigh->flags = (flags & NEIGH_UPDATE_F_ISROUTER) ?
1229 			(neigh->flags | NTF_ROUTER) :
1230 			(neigh->flags & ~NTF_ROUTER);
1231 	}
1232 	write_unlock_bh(&neigh->lock);
1233 
1234 	if (notify)
1235 		neigh_update_notify(neigh);
1236 
1237 	return err;
1238 }
1239 EXPORT_SYMBOL(neigh_update);
1240 
1241 /* Update the neigh to listen temporarily for probe responses, even if it is
1242  * in a NUD_FAILED state. The caller has to hold neigh->lock for writing.
1243  */
1244 void __neigh_set_probe_once(struct neighbour *neigh)
1245 {
1246 	if (neigh->dead)
1247 		return;
1248 	neigh->updated = jiffies;
1249 	if (!(neigh->nud_state & NUD_FAILED))
1250 		return;
1251 	neigh->nud_state = NUD_INCOMPLETE;
1252 	atomic_set(&neigh->probes, neigh_max_probes(neigh));
1253 	neigh_add_timer(neigh,
1254 			jiffies + NEIGH_VAR(neigh->parms, RETRANS_TIME));
1255 }
1256 EXPORT_SYMBOL(__neigh_set_probe_once);
1257 
1258 struct neighbour *neigh_event_ns(struct neigh_table *tbl,
1259 				 u8 *lladdr, void *saddr,
1260 				 struct net_device *dev)
1261 {
1262 	struct neighbour *neigh = __neigh_lookup(tbl, saddr, dev,
1263 						 lladdr || !dev->addr_len);
1264 	if (neigh)
1265 		neigh_update(neigh, lladdr, NUD_STALE,
1266 			     NEIGH_UPDATE_F_OVERRIDE);
1267 	return neigh;
1268 }
1269 EXPORT_SYMBOL(neigh_event_ns);
1270 
1271 /* called with read_lock_bh(&n->lock); */
1272 static void neigh_hh_init(struct neighbour *n)
1273 {
1274 	struct net_device *dev = n->dev;
1275 	__be16 prot = n->tbl->protocol;
1276 	struct hh_cache	*hh = &n->hh;
1277 
1278 	write_lock_bh(&n->lock);
1279 
1280 	/* Only one thread can come in here and initialize the
1281 	 * hh_cache entry.
1282 	 */
1283 	if (!hh->hh_len)
1284 		dev->header_ops->cache(n, hh, prot);
1285 
1286 	write_unlock_bh(&n->lock);
1287 }
1288 
1289 /* Slow and careful. */
1290 
1291 int neigh_resolve_output(struct neighbour *neigh, struct sk_buff *skb)
1292 {
1293 	int rc = 0;
1294 
1295 	if (!neigh_event_send(neigh, skb)) {
1296 		int err;
1297 		struct net_device *dev = neigh->dev;
1298 		unsigned int seq;
1299 
1300 		if (dev->header_ops->cache && !neigh->hh.hh_len)
1301 			neigh_hh_init(neigh);
1302 
1303 		do {
1304 			__skb_pull(skb, skb_network_offset(skb));
1305 			seq = read_seqbegin(&neigh->ha_lock);
1306 			err = dev_hard_header(skb, dev, ntohs(skb->protocol),
1307 					      neigh->ha, NULL, skb->len);
1308 		} while (read_seqretry(&neigh->ha_lock, seq));
1309 
1310 		if (err >= 0)
1311 			rc = dev_queue_xmit(skb);
1312 		else
1313 			goto out_kfree_skb;
1314 	}
1315 out:
1316 	return rc;
1317 out_kfree_skb:
1318 	rc = -EINVAL;
1319 	kfree_skb(skb);
1320 	goto out;
1321 }
1322 EXPORT_SYMBOL(neigh_resolve_output);
1323 
1324 /* As fast as possible without hh cache */
1325 
1326 int neigh_connected_output(struct neighbour *neigh, struct sk_buff *skb)
1327 {
1328 	struct net_device *dev = neigh->dev;
1329 	unsigned int seq;
1330 	int err;
1331 
1332 	do {
1333 		__skb_pull(skb, skb_network_offset(skb));
1334 		seq = read_seqbegin(&neigh->ha_lock);
1335 		err = dev_hard_header(skb, dev, ntohs(skb->protocol),
1336 				      neigh->ha, NULL, skb->len);
1337 	} while (read_seqretry(&neigh->ha_lock, seq));
1338 
1339 	if (err >= 0)
1340 		err = dev_queue_xmit(skb);
1341 	else {
1342 		err = -EINVAL;
1343 		kfree_skb(skb);
1344 	}
1345 	return err;
1346 }
1347 EXPORT_SYMBOL(neigh_connected_output);
1348 
1349 int neigh_direct_output(struct neighbour *neigh, struct sk_buff *skb)
1350 {
1351 	return dev_queue_xmit(skb);
1352 }
1353 EXPORT_SYMBOL(neigh_direct_output);
1354 
1355 static void neigh_proxy_process(unsigned long arg)
1356 {
1357 	struct neigh_table *tbl = (struct neigh_table *)arg;
1358 	long sched_next = 0;
1359 	unsigned long now = jiffies;
1360 	struct sk_buff *skb, *n;
1361 
1362 	spin_lock(&tbl->proxy_queue.lock);
1363 
1364 	skb_queue_walk_safe(&tbl->proxy_queue, skb, n) {
1365 		long tdif = NEIGH_CB(skb)->sched_next - now;
1366 
1367 		if (tdif <= 0) {
1368 			struct net_device *dev = skb->dev;
1369 
1370 			__skb_unlink(skb, &tbl->proxy_queue);
1371 			if (tbl->proxy_redo && netif_running(dev)) {
1372 				rcu_read_lock();
1373 				tbl->proxy_redo(skb);
1374 				rcu_read_unlock();
1375 			} else {
1376 				kfree_skb(skb);
1377 			}
1378 
1379 			dev_put(dev);
1380 		} else if (!sched_next || tdif < sched_next)
1381 			sched_next = tdif;
1382 	}
1383 	del_timer(&tbl->proxy_timer);
1384 	if (sched_next)
1385 		mod_timer(&tbl->proxy_timer, jiffies + sched_next);
1386 	spin_unlock(&tbl->proxy_queue.lock);
1387 }
1388 
1389 void pneigh_enqueue(struct neigh_table *tbl, struct neigh_parms *p,
1390 		    struct sk_buff *skb)
1391 {
1392 	unsigned long now = jiffies;
1393 
1394 	unsigned long sched_next = now + (prandom_u32() %
1395 					  NEIGH_VAR(p, PROXY_DELAY));
1396 
1397 	if (tbl->proxy_queue.qlen > NEIGH_VAR(p, PROXY_QLEN)) {
1398 		kfree_skb(skb);
1399 		return;
1400 	}
1401 
1402 	NEIGH_CB(skb)->sched_next = sched_next;
1403 	NEIGH_CB(skb)->flags |= LOCALLY_ENQUEUED;
1404 
1405 	spin_lock(&tbl->proxy_queue.lock);
1406 	if (del_timer(&tbl->proxy_timer)) {
1407 		if (time_before(tbl->proxy_timer.expires, sched_next))
1408 			sched_next = tbl->proxy_timer.expires;
1409 	}
1410 	skb_dst_drop(skb);
1411 	dev_hold(skb->dev);
1412 	__skb_queue_tail(&tbl->proxy_queue, skb);
1413 	mod_timer(&tbl->proxy_timer, sched_next);
1414 	spin_unlock(&tbl->proxy_queue.lock);
1415 }
1416 EXPORT_SYMBOL(pneigh_enqueue);
1417 
1418 static inline struct neigh_parms *lookup_neigh_parms(struct neigh_table *tbl,
1419 						      struct net *net, int ifindex)
1420 {
1421 	struct neigh_parms *p;
1422 
1423 	list_for_each_entry(p, &tbl->parms_list, list) {
1424 		if ((p->dev && p->dev->ifindex == ifindex && net_eq(neigh_parms_net(p), net)) ||
1425 		    (!p->dev && !ifindex && net_eq(net, &init_net)))
1426 			return p;
1427 	}
1428 
1429 	return NULL;
1430 }
1431 
1432 struct neigh_parms *neigh_parms_alloc(struct net_device *dev,
1433 				      struct neigh_table *tbl)
1434 {
1435 	struct neigh_parms *p;
1436 	struct net *net = dev_net(dev);
1437 	const struct net_device_ops *ops = dev->netdev_ops;
1438 
1439 	p = kmemdup(&tbl->parms, sizeof(*p), GFP_KERNEL);
1440 	if (p) {
1441 		p->tbl		  = tbl;
1442 		atomic_set(&p->refcnt, 1);
1443 		p->reachable_time =
1444 				neigh_rand_reach_time(NEIGH_VAR(p, BASE_REACHABLE_TIME));
1445 		dev_hold(dev);
1446 		p->dev = dev;
1447 		write_pnet(&p->net, net);
1448 		p->sysctl_table = NULL;
1449 
1450 		if (ops->ndo_neigh_setup && ops->ndo_neigh_setup(dev, p)) {
1451 			dev_put(dev);
1452 			kfree(p);
1453 			return NULL;
1454 		}
1455 
1456 		write_lock_bh(&tbl->lock);
1457 		list_add(&p->list, &tbl->parms.list);
1458 		write_unlock_bh(&tbl->lock);
1459 
1460 		neigh_parms_data_state_cleanall(p);
1461 	}
1462 	return p;
1463 }
1464 EXPORT_SYMBOL(neigh_parms_alloc);
1465 
1466 static void neigh_rcu_free_parms(struct rcu_head *head)
1467 {
1468 	struct neigh_parms *parms =
1469 		container_of(head, struct neigh_parms, rcu_head);
1470 
1471 	neigh_parms_put(parms);
1472 }
1473 
1474 void neigh_parms_release(struct neigh_table *tbl, struct neigh_parms *parms)
1475 {
1476 	if (!parms || parms == &tbl->parms)
1477 		return;
1478 	write_lock_bh(&tbl->lock);
1479 	list_del(&parms->list);
1480 	parms->dead = 1;
1481 	write_unlock_bh(&tbl->lock);
1482 	if (parms->dev)
1483 		dev_put(parms->dev);
1484 	call_rcu(&parms->rcu_head, neigh_rcu_free_parms);
1485 }
1486 EXPORT_SYMBOL(neigh_parms_release);
1487 
1488 static void neigh_parms_destroy(struct neigh_parms *parms)
1489 {
1490 	kfree(parms);
1491 }
1492 
1493 static struct lock_class_key neigh_table_proxy_queue_class;
1494 
1495 static struct neigh_table *neigh_tables[NEIGH_NR_TABLES] __read_mostly;
1496 
1497 void neigh_table_init(int index, struct neigh_table *tbl)
1498 {
1499 	unsigned long now = jiffies;
1500 	unsigned long phsize;
1501 
1502 	INIT_LIST_HEAD(&tbl->parms_list);
1503 	list_add(&tbl->parms.list, &tbl->parms_list);
1504 	write_pnet(&tbl->parms.net, &init_net);
1505 	atomic_set(&tbl->parms.refcnt, 1);
1506 	tbl->parms.reachable_time =
1507 			  neigh_rand_reach_time(NEIGH_VAR(&tbl->parms, BASE_REACHABLE_TIME));
1508 
1509 	tbl->stats = alloc_percpu(struct neigh_statistics);
1510 	if (!tbl->stats)
1511 		panic("cannot create neighbour cache statistics");
1512 
1513 #ifdef CONFIG_PROC_FS
1514 	if (!proc_create_data(tbl->id, 0, init_net.proc_net_stat,
1515 			      &neigh_stat_seq_fops, tbl))
1516 		panic("cannot create neighbour proc dir entry");
1517 #endif
1518 
1519 	RCU_INIT_POINTER(tbl->nht, neigh_hash_alloc(3));
1520 
1521 	phsize = (PNEIGH_HASHMASK + 1) * sizeof(struct pneigh_entry *);
1522 	tbl->phash_buckets = kzalloc(phsize, GFP_KERNEL);
1523 
1524 	if (!tbl->nht || !tbl->phash_buckets)
1525 		panic("cannot allocate neighbour cache hashes");
1526 
1527 	if (!tbl->entry_size)
1528 		tbl->entry_size = ALIGN(offsetof(struct neighbour, primary_key) +
1529 					tbl->key_len, NEIGH_PRIV_ALIGN);
1530 	else
1531 		WARN_ON(tbl->entry_size % NEIGH_PRIV_ALIGN);
1532 
1533 	rwlock_init(&tbl->lock);
1534 	INIT_DEFERRABLE_WORK(&tbl->gc_work, neigh_periodic_work);
1535 	queue_delayed_work(system_power_efficient_wq, &tbl->gc_work,
1536 			tbl->parms.reachable_time);
1537 	setup_timer(&tbl->proxy_timer, neigh_proxy_process, (unsigned long)tbl);
1538 	skb_queue_head_init_class(&tbl->proxy_queue,
1539 			&neigh_table_proxy_queue_class);
1540 
1541 	tbl->last_flush = now;
1542 	tbl->last_rand	= now + tbl->parms.reachable_time * 20;
1543 
1544 	neigh_tables[index] = tbl;
1545 }
1546 EXPORT_SYMBOL(neigh_table_init);
1547 
1548 int neigh_table_clear(int index, struct neigh_table *tbl)
1549 {
1550 	neigh_tables[index] = NULL;
1551 	/* It is not clean... Fix it to unload IPv6 module safely */
1552 	cancel_delayed_work_sync(&tbl->gc_work);
1553 	del_timer_sync(&tbl->proxy_timer);
1554 	pneigh_queue_purge(&tbl->proxy_queue);
1555 	neigh_ifdown(tbl, NULL);
1556 	if (atomic_read(&tbl->entries))
1557 		pr_crit("neighbour leakage\n");
1558 
1559 	call_rcu(&rcu_dereference_protected(tbl->nht, 1)->rcu,
1560 		 neigh_hash_free_rcu);
1561 	tbl->nht = NULL;
1562 
1563 	kfree(tbl->phash_buckets);
1564 	tbl->phash_buckets = NULL;
1565 
1566 	remove_proc_entry(tbl->id, init_net.proc_net_stat);
1567 
1568 	free_percpu(tbl->stats);
1569 	tbl->stats = NULL;
1570 
1571 	return 0;
1572 }
1573 EXPORT_SYMBOL(neigh_table_clear);
1574 
1575 static struct neigh_table *neigh_find_table(int family)
1576 {
1577 	struct neigh_table *tbl = NULL;
1578 
1579 	switch (family) {
1580 	case AF_INET:
1581 		tbl = neigh_tables[NEIGH_ARP_TABLE];
1582 		break;
1583 	case AF_INET6:
1584 		tbl = neigh_tables[NEIGH_ND_TABLE];
1585 		break;
1586 	case AF_DECnet:
1587 		tbl = neigh_tables[NEIGH_DN_TABLE];
1588 		break;
1589 	}
1590 
1591 	return tbl;
1592 }
1593 
1594 static int neigh_delete(struct sk_buff *skb, struct nlmsghdr *nlh)
1595 {
1596 	struct net *net = sock_net(skb->sk);
1597 	struct ndmsg *ndm;
1598 	struct nlattr *dst_attr;
1599 	struct neigh_table *tbl;
1600 	struct neighbour *neigh;
1601 	struct net_device *dev = NULL;
1602 	int err = -EINVAL;
1603 
1604 	ASSERT_RTNL();
1605 	if (nlmsg_len(nlh) < sizeof(*ndm))
1606 		goto out;
1607 
1608 	dst_attr = nlmsg_find_attr(nlh, sizeof(*ndm), NDA_DST);
1609 	if (dst_attr == NULL)
1610 		goto out;
1611 
1612 	ndm = nlmsg_data(nlh);
1613 	if (ndm->ndm_ifindex) {
1614 		dev = __dev_get_by_index(net, ndm->ndm_ifindex);
1615 		if (dev == NULL) {
1616 			err = -ENODEV;
1617 			goto out;
1618 		}
1619 	}
1620 
1621 	tbl = neigh_find_table(ndm->ndm_family);
1622 	if (tbl == NULL)
1623 		return -EAFNOSUPPORT;
1624 
1625 	if (nla_len(dst_attr) < tbl->key_len)
1626 		goto out;
1627 
1628 	if (ndm->ndm_flags & NTF_PROXY) {
1629 		err = pneigh_delete(tbl, net, nla_data(dst_attr), dev);
1630 		goto out;
1631 	}
1632 
1633 	if (dev == NULL)
1634 		goto out;
1635 
1636 	neigh = neigh_lookup(tbl, nla_data(dst_attr), dev);
1637 	if (neigh == NULL) {
1638 		err = -ENOENT;
1639 		goto out;
1640 	}
1641 
1642 	err = neigh_update(neigh, NULL, NUD_FAILED,
1643 			   NEIGH_UPDATE_F_OVERRIDE |
1644 			   NEIGH_UPDATE_F_ADMIN);
1645 	neigh_release(neigh);
1646 
1647 out:
1648 	return err;
1649 }
1650 
1651 static int neigh_add(struct sk_buff *skb, struct nlmsghdr *nlh)
1652 {
1653 	int flags = NEIGH_UPDATE_F_ADMIN | NEIGH_UPDATE_F_OVERRIDE;
1654 	struct net *net = sock_net(skb->sk);
1655 	struct ndmsg *ndm;
1656 	struct nlattr *tb[NDA_MAX+1];
1657 	struct neigh_table *tbl;
1658 	struct net_device *dev = NULL;
1659 	struct neighbour *neigh;
1660 	void *dst, *lladdr;
1661 	int err;
1662 
1663 	ASSERT_RTNL();
1664 	err = nlmsg_parse(nlh, sizeof(*ndm), tb, NDA_MAX, NULL);
1665 	if (err < 0)
1666 		goto out;
1667 
1668 	err = -EINVAL;
1669 	if (tb[NDA_DST] == NULL)
1670 		goto out;
1671 
1672 	ndm = nlmsg_data(nlh);
1673 	if (ndm->ndm_ifindex) {
1674 		dev = __dev_get_by_index(net, ndm->ndm_ifindex);
1675 		if (dev == NULL) {
1676 			err = -ENODEV;
1677 			goto out;
1678 		}
1679 
1680 		if (tb[NDA_LLADDR] && nla_len(tb[NDA_LLADDR]) < dev->addr_len)
1681 			goto out;
1682 	}
1683 
1684 	tbl = neigh_find_table(ndm->ndm_family);
1685 	if (tbl == NULL)
1686 		return -EAFNOSUPPORT;
1687 
1688 	if (nla_len(tb[NDA_DST]) < tbl->key_len)
1689 		goto out;
1690 	dst = nla_data(tb[NDA_DST]);
1691 	lladdr = tb[NDA_LLADDR] ? nla_data(tb[NDA_LLADDR]) : NULL;
1692 
1693 	if (ndm->ndm_flags & NTF_PROXY) {
1694 		struct pneigh_entry *pn;
1695 
1696 		err = -ENOBUFS;
1697 		pn = pneigh_lookup(tbl, net, dst, dev, 1);
1698 		if (pn) {
1699 			pn->flags = ndm->ndm_flags;
1700 			err = 0;
1701 		}
1702 		goto out;
1703 	}
1704 
1705 	if (dev == NULL)
1706 		goto out;
1707 
1708 	neigh = neigh_lookup(tbl, dst, dev);
1709 	if (neigh == NULL) {
1710 		if (!(nlh->nlmsg_flags & NLM_F_CREATE)) {
1711 			err = -ENOENT;
1712 			goto out;
1713 		}
1714 
1715 		neigh = __neigh_lookup_errno(tbl, dst, dev);
1716 		if (IS_ERR(neigh)) {
1717 			err = PTR_ERR(neigh);
1718 			goto out;
1719 		}
1720 	} else {
1721 		if (nlh->nlmsg_flags & NLM_F_EXCL) {
1722 			err = -EEXIST;
1723 			neigh_release(neigh);
1724 			goto out;
1725 		}
1726 
1727 		if (!(nlh->nlmsg_flags & NLM_F_REPLACE))
1728 			flags &= ~NEIGH_UPDATE_F_OVERRIDE;
1729 	}
1730 
1731 	if (ndm->ndm_flags & NTF_USE) {
1732 		neigh_event_send(neigh, NULL);
1733 		err = 0;
1734 	} else
1735 		err = neigh_update(neigh, lladdr, ndm->ndm_state, flags);
1736 	neigh_release(neigh);
1737 
1738 out:
1739 	return err;
1740 }
1741 
1742 static int neightbl_fill_parms(struct sk_buff *skb, struct neigh_parms *parms)
1743 {
1744 	struct nlattr *nest;
1745 
1746 	nest = nla_nest_start(skb, NDTA_PARMS);
1747 	if (nest == NULL)
1748 		return -ENOBUFS;
1749 
1750 	if ((parms->dev &&
1751 	     nla_put_u32(skb, NDTPA_IFINDEX, parms->dev->ifindex)) ||
1752 	    nla_put_u32(skb, NDTPA_REFCNT, atomic_read(&parms->refcnt)) ||
1753 	    nla_put_u32(skb, NDTPA_QUEUE_LENBYTES,
1754 			NEIGH_VAR(parms, QUEUE_LEN_BYTES)) ||
1755 	    /* approximative value for deprecated QUEUE_LEN (in packets) */
1756 	    nla_put_u32(skb, NDTPA_QUEUE_LEN,
1757 			NEIGH_VAR(parms, QUEUE_LEN_BYTES) / SKB_TRUESIZE(ETH_FRAME_LEN)) ||
1758 	    nla_put_u32(skb, NDTPA_PROXY_QLEN, NEIGH_VAR(parms, PROXY_QLEN)) ||
1759 	    nla_put_u32(skb, NDTPA_APP_PROBES, NEIGH_VAR(parms, APP_PROBES)) ||
1760 	    nla_put_u32(skb, NDTPA_UCAST_PROBES,
1761 			NEIGH_VAR(parms, UCAST_PROBES)) ||
1762 	    nla_put_u32(skb, NDTPA_MCAST_PROBES,
1763 			NEIGH_VAR(parms, MCAST_PROBES)) ||
1764 	    nla_put_u32(skb, NDTPA_MCAST_REPROBES,
1765 			NEIGH_VAR(parms, MCAST_REPROBES)) ||
1766 	    nla_put_msecs(skb, NDTPA_REACHABLE_TIME, parms->reachable_time) ||
1767 	    nla_put_msecs(skb, NDTPA_BASE_REACHABLE_TIME,
1768 			  NEIGH_VAR(parms, BASE_REACHABLE_TIME)) ||
1769 	    nla_put_msecs(skb, NDTPA_GC_STALETIME,
1770 			  NEIGH_VAR(parms, GC_STALETIME)) ||
1771 	    nla_put_msecs(skb, NDTPA_DELAY_PROBE_TIME,
1772 			  NEIGH_VAR(parms, DELAY_PROBE_TIME)) ||
1773 	    nla_put_msecs(skb, NDTPA_RETRANS_TIME,
1774 			  NEIGH_VAR(parms, RETRANS_TIME)) ||
1775 	    nla_put_msecs(skb, NDTPA_ANYCAST_DELAY,
1776 			  NEIGH_VAR(parms, ANYCAST_DELAY)) ||
1777 	    nla_put_msecs(skb, NDTPA_PROXY_DELAY,
1778 			  NEIGH_VAR(parms, PROXY_DELAY)) ||
1779 	    nla_put_msecs(skb, NDTPA_LOCKTIME,
1780 			  NEIGH_VAR(parms, LOCKTIME)))
1781 		goto nla_put_failure;
1782 	return nla_nest_end(skb, nest);
1783 
1784 nla_put_failure:
1785 	nla_nest_cancel(skb, nest);
1786 	return -EMSGSIZE;
1787 }
1788 
1789 static int neightbl_fill_info(struct sk_buff *skb, struct neigh_table *tbl,
1790 			      u32 pid, u32 seq, int type, int flags)
1791 {
1792 	struct nlmsghdr *nlh;
1793 	struct ndtmsg *ndtmsg;
1794 
1795 	nlh = nlmsg_put(skb, pid, seq, type, sizeof(*ndtmsg), flags);
1796 	if (nlh == NULL)
1797 		return -EMSGSIZE;
1798 
1799 	ndtmsg = nlmsg_data(nlh);
1800 
1801 	read_lock_bh(&tbl->lock);
1802 	ndtmsg->ndtm_family = tbl->family;
1803 	ndtmsg->ndtm_pad1   = 0;
1804 	ndtmsg->ndtm_pad2   = 0;
1805 
1806 	if (nla_put_string(skb, NDTA_NAME, tbl->id) ||
1807 	    nla_put_msecs(skb, NDTA_GC_INTERVAL, tbl->gc_interval) ||
1808 	    nla_put_u32(skb, NDTA_THRESH1, tbl->gc_thresh1) ||
1809 	    nla_put_u32(skb, NDTA_THRESH2, tbl->gc_thresh2) ||
1810 	    nla_put_u32(skb, NDTA_THRESH3, tbl->gc_thresh3))
1811 		goto nla_put_failure;
1812 	{
1813 		unsigned long now = jiffies;
1814 		unsigned int flush_delta = now - tbl->last_flush;
1815 		unsigned int rand_delta = now - tbl->last_rand;
1816 		struct neigh_hash_table *nht;
1817 		struct ndt_config ndc = {
1818 			.ndtc_key_len		= tbl->key_len,
1819 			.ndtc_entry_size	= tbl->entry_size,
1820 			.ndtc_entries		= atomic_read(&tbl->entries),
1821 			.ndtc_last_flush	= jiffies_to_msecs(flush_delta),
1822 			.ndtc_last_rand		= jiffies_to_msecs(rand_delta),
1823 			.ndtc_proxy_qlen	= tbl->proxy_queue.qlen,
1824 		};
1825 
1826 		rcu_read_lock_bh();
1827 		nht = rcu_dereference_bh(tbl->nht);
1828 		ndc.ndtc_hash_rnd = nht->hash_rnd[0];
1829 		ndc.ndtc_hash_mask = ((1 << nht->hash_shift) - 1);
1830 		rcu_read_unlock_bh();
1831 
1832 		if (nla_put(skb, NDTA_CONFIG, sizeof(ndc), &ndc))
1833 			goto nla_put_failure;
1834 	}
1835 
1836 	{
1837 		int cpu;
1838 		struct ndt_stats ndst;
1839 
1840 		memset(&ndst, 0, sizeof(ndst));
1841 
1842 		for_each_possible_cpu(cpu) {
1843 			struct neigh_statistics	*st;
1844 
1845 			st = per_cpu_ptr(tbl->stats, cpu);
1846 			ndst.ndts_allocs		+= st->allocs;
1847 			ndst.ndts_destroys		+= st->destroys;
1848 			ndst.ndts_hash_grows		+= st->hash_grows;
1849 			ndst.ndts_res_failed		+= st->res_failed;
1850 			ndst.ndts_lookups		+= st->lookups;
1851 			ndst.ndts_hits			+= st->hits;
1852 			ndst.ndts_rcv_probes_mcast	+= st->rcv_probes_mcast;
1853 			ndst.ndts_rcv_probes_ucast	+= st->rcv_probes_ucast;
1854 			ndst.ndts_periodic_gc_runs	+= st->periodic_gc_runs;
1855 			ndst.ndts_forced_gc_runs	+= st->forced_gc_runs;
1856 			ndst.ndts_table_fulls		+= st->table_fulls;
1857 		}
1858 
1859 		if (nla_put(skb, NDTA_STATS, sizeof(ndst), &ndst))
1860 			goto nla_put_failure;
1861 	}
1862 
1863 	BUG_ON(tbl->parms.dev);
1864 	if (neightbl_fill_parms(skb, &tbl->parms) < 0)
1865 		goto nla_put_failure;
1866 
1867 	read_unlock_bh(&tbl->lock);
1868 	nlmsg_end(skb, nlh);
1869 	return 0;
1870 
1871 nla_put_failure:
1872 	read_unlock_bh(&tbl->lock);
1873 	nlmsg_cancel(skb, nlh);
1874 	return -EMSGSIZE;
1875 }
1876 
1877 static int neightbl_fill_param_info(struct sk_buff *skb,
1878 				    struct neigh_table *tbl,
1879 				    struct neigh_parms *parms,
1880 				    u32 pid, u32 seq, int type,
1881 				    unsigned int flags)
1882 {
1883 	struct ndtmsg *ndtmsg;
1884 	struct nlmsghdr *nlh;
1885 
1886 	nlh = nlmsg_put(skb, pid, seq, type, sizeof(*ndtmsg), flags);
1887 	if (nlh == NULL)
1888 		return -EMSGSIZE;
1889 
1890 	ndtmsg = nlmsg_data(nlh);
1891 
1892 	read_lock_bh(&tbl->lock);
1893 	ndtmsg->ndtm_family = tbl->family;
1894 	ndtmsg->ndtm_pad1   = 0;
1895 	ndtmsg->ndtm_pad2   = 0;
1896 
1897 	if (nla_put_string(skb, NDTA_NAME, tbl->id) < 0 ||
1898 	    neightbl_fill_parms(skb, parms) < 0)
1899 		goto errout;
1900 
1901 	read_unlock_bh(&tbl->lock);
1902 	nlmsg_end(skb, nlh);
1903 	return 0;
1904 errout:
1905 	read_unlock_bh(&tbl->lock);
1906 	nlmsg_cancel(skb, nlh);
1907 	return -EMSGSIZE;
1908 }
1909 
1910 static const struct nla_policy nl_neightbl_policy[NDTA_MAX+1] = {
1911 	[NDTA_NAME]		= { .type = NLA_STRING },
1912 	[NDTA_THRESH1]		= { .type = NLA_U32 },
1913 	[NDTA_THRESH2]		= { .type = NLA_U32 },
1914 	[NDTA_THRESH3]		= { .type = NLA_U32 },
1915 	[NDTA_GC_INTERVAL]	= { .type = NLA_U64 },
1916 	[NDTA_PARMS]		= { .type = NLA_NESTED },
1917 };
1918 
1919 static const struct nla_policy nl_ntbl_parm_policy[NDTPA_MAX+1] = {
1920 	[NDTPA_IFINDEX]			= { .type = NLA_U32 },
1921 	[NDTPA_QUEUE_LEN]		= { .type = NLA_U32 },
1922 	[NDTPA_PROXY_QLEN]		= { .type = NLA_U32 },
1923 	[NDTPA_APP_PROBES]		= { .type = NLA_U32 },
1924 	[NDTPA_UCAST_PROBES]		= { .type = NLA_U32 },
1925 	[NDTPA_MCAST_PROBES]		= { .type = NLA_U32 },
1926 	[NDTPA_MCAST_REPROBES]		= { .type = NLA_U32 },
1927 	[NDTPA_BASE_REACHABLE_TIME]	= { .type = NLA_U64 },
1928 	[NDTPA_GC_STALETIME]		= { .type = NLA_U64 },
1929 	[NDTPA_DELAY_PROBE_TIME]	= { .type = NLA_U64 },
1930 	[NDTPA_RETRANS_TIME]		= { .type = NLA_U64 },
1931 	[NDTPA_ANYCAST_DELAY]		= { .type = NLA_U64 },
1932 	[NDTPA_PROXY_DELAY]		= { .type = NLA_U64 },
1933 	[NDTPA_LOCKTIME]		= { .type = NLA_U64 },
1934 };
1935 
1936 static int neightbl_set(struct sk_buff *skb, struct nlmsghdr *nlh)
1937 {
1938 	struct net *net = sock_net(skb->sk);
1939 	struct neigh_table *tbl;
1940 	struct ndtmsg *ndtmsg;
1941 	struct nlattr *tb[NDTA_MAX+1];
1942 	bool found = false;
1943 	int err, tidx;
1944 
1945 	err = nlmsg_parse(nlh, sizeof(*ndtmsg), tb, NDTA_MAX,
1946 			  nl_neightbl_policy);
1947 	if (err < 0)
1948 		goto errout;
1949 
1950 	if (tb[NDTA_NAME] == NULL) {
1951 		err = -EINVAL;
1952 		goto errout;
1953 	}
1954 
1955 	ndtmsg = nlmsg_data(nlh);
1956 
1957 	for (tidx = 0; tidx < NEIGH_NR_TABLES; tidx++) {
1958 		tbl = neigh_tables[tidx];
1959 		if (!tbl)
1960 			continue;
1961 		if (ndtmsg->ndtm_family && tbl->family != ndtmsg->ndtm_family)
1962 			continue;
1963 		if (nla_strcmp(tb[NDTA_NAME], tbl->id) == 0) {
1964 			found = true;
1965 			break;
1966 		}
1967 	}
1968 
1969 	if (!found)
1970 		return -ENOENT;
1971 
1972 	/*
1973 	 * We acquire tbl->lock to be nice to the periodic timers and
1974 	 * make sure they always see a consistent set of values.
1975 	 */
1976 	write_lock_bh(&tbl->lock);
1977 
1978 	if (tb[NDTA_PARMS]) {
1979 		struct nlattr *tbp[NDTPA_MAX+1];
1980 		struct neigh_parms *p;
1981 		int i, ifindex = 0;
1982 
1983 		err = nla_parse_nested(tbp, NDTPA_MAX, tb[NDTA_PARMS],
1984 				       nl_ntbl_parm_policy);
1985 		if (err < 0)
1986 			goto errout_tbl_lock;
1987 
1988 		if (tbp[NDTPA_IFINDEX])
1989 			ifindex = nla_get_u32(tbp[NDTPA_IFINDEX]);
1990 
1991 		p = lookup_neigh_parms(tbl, net, ifindex);
1992 		if (p == NULL) {
1993 			err = -ENOENT;
1994 			goto errout_tbl_lock;
1995 		}
1996 
1997 		for (i = 1; i <= NDTPA_MAX; i++) {
1998 			if (tbp[i] == NULL)
1999 				continue;
2000 
2001 			switch (i) {
2002 			case NDTPA_QUEUE_LEN:
2003 				NEIGH_VAR_SET(p, QUEUE_LEN_BYTES,
2004 					      nla_get_u32(tbp[i]) *
2005 					      SKB_TRUESIZE(ETH_FRAME_LEN));
2006 				break;
2007 			case NDTPA_QUEUE_LENBYTES:
2008 				NEIGH_VAR_SET(p, QUEUE_LEN_BYTES,
2009 					      nla_get_u32(tbp[i]));
2010 				break;
2011 			case NDTPA_PROXY_QLEN:
2012 				NEIGH_VAR_SET(p, PROXY_QLEN,
2013 					      nla_get_u32(tbp[i]));
2014 				break;
2015 			case NDTPA_APP_PROBES:
2016 				NEIGH_VAR_SET(p, APP_PROBES,
2017 					      nla_get_u32(tbp[i]));
2018 				break;
2019 			case NDTPA_UCAST_PROBES:
2020 				NEIGH_VAR_SET(p, UCAST_PROBES,
2021 					      nla_get_u32(tbp[i]));
2022 				break;
2023 			case NDTPA_MCAST_PROBES:
2024 				NEIGH_VAR_SET(p, MCAST_PROBES,
2025 					      nla_get_u32(tbp[i]));
2026 				break;
2027 			case NDTPA_MCAST_REPROBES:
2028 				NEIGH_VAR_SET(p, MCAST_REPROBES,
2029 					      nla_get_u32(tbp[i]));
2030 				break;
2031 			case NDTPA_BASE_REACHABLE_TIME:
2032 				NEIGH_VAR_SET(p, BASE_REACHABLE_TIME,
2033 					      nla_get_msecs(tbp[i]));
2034 				/* update reachable_time as well, otherwise, the change will
2035 				 * only be effective after the next time neigh_periodic_work
2036 				 * decides to recompute it (can be multiple minutes)
2037 				 */
2038 				p->reachable_time =
2039 					neigh_rand_reach_time(NEIGH_VAR(p, BASE_REACHABLE_TIME));
2040 				break;
2041 			case NDTPA_GC_STALETIME:
2042 				NEIGH_VAR_SET(p, GC_STALETIME,
2043 					      nla_get_msecs(tbp[i]));
2044 				break;
2045 			case NDTPA_DELAY_PROBE_TIME:
2046 				NEIGH_VAR_SET(p, DELAY_PROBE_TIME,
2047 					      nla_get_msecs(tbp[i]));
2048 				break;
2049 			case NDTPA_RETRANS_TIME:
2050 				NEIGH_VAR_SET(p, RETRANS_TIME,
2051 					      nla_get_msecs(tbp[i]));
2052 				break;
2053 			case NDTPA_ANYCAST_DELAY:
2054 				NEIGH_VAR_SET(p, ANYCAST_DELAY,
2055 					      nla_get_msecs(tbp[i]));
2056 				break;
2057 			case NDTPA_PROXY_DELAY:
2058 				NEIGH_VAR_SET(p, PROXY_DELAY,
2059 					      nla_get_msecs(tbp[i]));
2060 				break;
2061 			case NDTPA_LOCKTIME:
2062 				NEIGH_VAR_SET(p, LOCKTIME,
2063 					      nla_get_msecs(tbp[i]));
2064 				break;
2065 			}
2066 		}
2067 	}
2068 
2069 	err = -ENOENT;
2070 	if ((tb[NDTA_THRESH1] || tb[NDTA_THRESH2] ||
2071 	     tb[NDTA_THRESH3] || tb[NDTA_GC_INTERVAL]) &&
2072 	    !net_eq(net, &init_net))
2073 		goto errout_tbl_lock;
2074 
2075 	if (tb[NDTA_THRESH1])
2076 		tbl->gc_thresh1 = nla_get_u32(tb[NDTA_THRESH1]);
2077 
2078 	if (tb[NDTA_THRESH2])
2079 		tbl->gc_thresh2 = nla_get_u32(tb[NDTA_THRESH2]);
2080 
2081 	if (tb[NDTA_THRESH3])
2082 		tbl->gc_thresh3 = nla_get_u32(tb[NDTA_THRESH3]);
2083 
2084 	if (tb[NDTA_GC_INTERVAL])
2085 		tbl->gc_interval = nla_get_msecs(tb[NDTA_GC_INTERVAL]);
2086 
2087 	err = 0;
2088 
2089 errout_tbl_lock:
2090 	write_unlock_bh(&tbl->lock);
2091 errout:
2092 	return err;
2093 }
2094 
2095 static int neightbl_dump_info(struct sk_buff *skb, struct netlink_callback *cb)
2096 {
2097 	struct net *net = sock_net(skb->sk);
2098 	int family, tidx, nidx = 0;
2099 	int tbl_skip = cb->args[0];
2100 	int neigh_skip = cb->args[1];
2101 	struct neigh_table *tbl;
2102 
2103 	family = ((struct rtgenmsg *) nlmsg_data(cb->nlh))->rtgen_family;
2104 
2105 	for (tidx = 0; tidx < NEIGH_NR_TABLES; tidx++) {
2106 		struct neigh_parms *p;
2107 
2108 		tbl = neigh_tables[tidx];
2109 		if (!tbl)
2110 			continue;
2111 
2112 		if (tidx < tbl_skip || (family && tbl->family != family))
2113 			continue;
2114 
2115 		if (neightbl_fill_info(skb, tbl, NETLINK_CB(cb->skb).portid,
2116 				       cb->nlh->nlmsg_seq, RTM_NEWNEIGHTBL,
2117 				       NLM_F_MULTI) < 0)
2118 			break;
2119 
2120 		nidx = 0;
2121 		p = list_next_entry(&tbl->parms, list);
2122 		list_for_each_entry_from(p, &tbl->parms_list, list) {
2123 			if (!net_eq(neigh_parms_net(p), net))
2124 				continue;
2125 
2126 			if (nidx < neigh_skip)
2127 				goto next;
2128 
2129 			if (neightbl_fill_param_info(skb, tbl, p,
2130 						     NETLINK_CB(cb->skb).portid,
2131 						     cb->nlh->nlmsg_seq,
2132 						     RTM_NEWNEIGHTBL,
2133 						     NLM_F_MULTI) < 0)
2134 				goto out;
2135 		next:
2136 			nidx++;
2137 		}
2138 
2139 		neigh_skip = 0;
2140 	}
2141 out:
2142 	cb->args[0] = tidx;
2143 	cb->args[1] = nidx;
2144 
2145 	return skb->len;
2146 }
2147 
2148 static int neigh_fill_info(struct sk_buff *skb, struct neighbour *neigh,
2149 			   u32 pid, u32 seq, int type, unsigned int flags)
2150 {
2151 	unsigned long now = jiffies;
2152 	struct nda_cacheinfo ci;
2153 	struct nlmsghdr *nlh;
2154 	struct ndmsg *ndm;
2155 
2156 	nlh = nlmsg_put(skb, pid, seq, type, sizeof(*ndm), flags);
2157 	if (nlh == NULL)
2158 		return -EMSGSIZE;
2159 
2160 	ndm = nlmsg_data(nlh);
2161 	ndm->ndm_family	 = neigh->ops->family;
2162 	ndm->ndm_pad1    = 0;
2163 	ndm->ndm_pad2    = 0;
2164 	ndm->ndm_flags	 = neigh->flags;
2165 	ndm->ndm_type	 = neigh->type;
2166 	ndm->ndm_ifindex = neigh->dev->ifindex;
2167 
2168 	if (nla_put(skb, NDA_DST, neigh->tbl->key_len, neigh->primary_key))
2169 		goto nla_put_failure;
2170 
2171 	read_lock_bh(&neigh->lock);
2172 	ndm->ndm_state	 = neigh->nud_state;
2173 	if (neigh->nud_state & NUD_VALID) {
2174 		char haddr[MAX_ADDR_LEN];
2175 
2176 		neigh_ha_snapshot(haddr, neigh, neigh->dev);
2177 		if (nla_put(skb, NDA_LLADDR, neigh->dev->addr_len, haddr) < 0) {
2178 			read_unlock_bh(&neigh->lock);
2179 			goto nla_put_failure;
2180 		}
2181 	}
2182 
2183 	ci.ndm_used	 = jiffies_to_clock_t(now - neigh->used);
2184 	ci.ndm_confirmed = jiffies_to_clock_t(now - neigh->confirmed);
2185 	ci.ndm_updated	 = jiffies_to_clock_t(now - neigh->updated);
2186 	ci.ndm_refcnt	 = atomic_read(&neigh->refcnt) - 1;
2187 	read_unlock_bh(&neigh->lock);
2188 
2189 	if (nla_put_u32(skb, NDA_PROBES, atomic_read(&neigh->probes)) ||
2190 	    nla_put(skb, NDA_CACHEINFO, sizeof(ci), &ci))
2191 		goto nla_put_failure;
2192 
2193 	nlmsg_end(skb, nlh);
2194 	return 0;
2195 
2196 nla_put_failure:
2197 	nlmsg_cancel(skb, nlh);
2198 	return -EMSGSIZE;
2199 }
2200 
2201 static int pneigh_fill_info(struct sk_buff *skb, struct pneigh_entry *pn,
2202 			    u32 pid, u32 seq, int type, unsigned int flags,
2203 			    struct neigh_table *tbl)
2204 {
2205 	struct nlmsghdr *nlh;
2206 	struct ndmsg *ndm;
2207 
2208 	nlh = nlmsg_put(skb, pid, seq, type, sizeof(*ndm), flags);
2209 	if (nlh == NULL)
2210 		return -EMSGSIZE;
2211 
2212 	ndm = nlmsg_data(nlh);
2213 	ndm->ndm_family	 = tbl->family;
2214 	ndm->ndm_pad1    = 0;
2215 	ndm->ndm_pad2    = 0;
2216 	ndm->ndm_flags	 = pn->flags | NTF_PROXY;
2217 	ndm->ndm_type	 = RTN_UNICAST;
2218 	ndm->ndm_ifindex = pn->dev ? pn->dev->ifindex : 0;
2219 	ndm->ndm_state	 = NUD_NONE;
2220 
2221 	if (nla_put(skb, NDA_DST, tbl->key_len, pn->key))
2222 		goto nla_put_failure;
2223 
2224 	nlmsg_end(skb, nlh);
2225 	return 0;
2226 
2227 nla_put_failure:
2228 	nlmsg_cancel(skb, nlh);
2229 	return -EMSGSIZE;
2230 }
2231 
2232 static void neigh_update_notify(struct neighbour *neigh)
2233 {
2234 	call_netevent_notifiers(NETEVENT_NEIGH_UPDATE, neigh);
2235 	__neigh_notify(neigh, RTM_NEWNEIGH, 0);
2236 }
2237 
2238 static bool neigh_master_filtered(struct net_device *dev, int master_idx)
2239 {
2240 	struct net_device *master;
2241 
2242 	if (!master_idx)
2243 		return false;
2244 
2245 	master = netdev_master_upper_dev_get(dev);
2246 	if (!master || master->ifindex != master_idx)
2247 		return true;
2248 
2249 	return false;
2250 }
2251 
2252 static bool neigh_ifindex_filtered(struct net_device *dev, int filter_idx)
2253 {
2254 	if (filter_idx && dev->ifindex != filter_idx)
2255 		return true;
2256 
2257 	return false;
2258 }
2259 
2260 static int neigh_dump_table(struct neigh_table *tbl, struct sk_buff *skb,
2261 			    struct netlink_callback *cb)
2262 {
2263 	struct net *net = sock_net(skb->sk);
2264 	const struct nlmsghdr *nlh = cb->nlh;
2265 	struct nlattr *tb[NDA_MAX + 1];
2266 	struct neighbour *n;
2267 	int rc, h, s_h = cb->args[1];
2268 	int idx, s_idx = idx = cb->args[2];
2269 	struct neigh_hash_table *nht;
2270 	int filter_master_idx = 0, filter_idx = 0;
2271 	unsigned int flags = NLM_F_MULTI;
2272 	int err;
2273 
2274 	err = nlmsg_parse(nlh, sizeof(struct ndmsg), tb, NDA_MAX, NULL);
2275 	if (!err) {
2276 		if (tb[NDA_IFINDEX])
2277 			filter_idx = nla_get_u32(tb[NDA_IFINDEX]);
2278 
2279 		if (tb[NDA_MASTER])
2280 			filter_master_idx = nla_get_u32(tb[NDA_MASTER]);
2281 
2282 		if (filter_idx || filter_master_idx)
2283 			flags |= NLM_F_DUMP_FILTERED;
2284 	}
2285 
2286 	rcu_read_lock_bh();
2287 	nht = rcu_dereference_bh(tbl->nht);
2288 
2289 	for (h = s_h; h < (1 << nht->hash_shift); h++) {
2290 		if (h > s_h)
2291 			s_idx = 0;
2292 		for (n = rcu_dereference_bh(nht->hash_buckets[h]), idx = 0;
2293 		     n != NULL;
2294 		     n = rcu_dereference_bh(n->next)) {
2295 			if (!net_eq(dev_net(n->dev), net))
2296 				continue;
2297 			if (neigh_ifindex_filtered(n->dev, filter_idx))
2298 				continue;
2299 			if (neigh_master_filtered(n->dev, filter_master_idx))
2300 				continue;
2301 			if (idx < s_idx)
2302 				goto next;
2303 			if (neigh_fill_info(skb, n, NETLINK_CB(cb->skb).portid,
2304 					    cb->nlh->nlmsg_seq,
2305 					    RTM_NEWNEIGH,
2306 					    flags) < 0) {
2307 				rc = -1;
2308 				goto out;
2309 			}
2310 next:
2311 			idx++;
2312 		}
2313 	}
2314 	rc = skb->len;
2315 out:
2316 	rcu_read_unlock_bh();
2317 	cb->args[1] = h;
2318 	cb->args[2] = idx;
2319 	return rc;
2320 }
2321 
2322 static int pneigh_dump_table(struct neigh_table *tbl, struct sk_buff *skb,
2323 			     struct netlink_callback *cb)
2324 {
2325 	struct pneigh_entry *n;
2326 	struct net *net = sock_net(skb->sk);
2327 	int rc, h, s_h = cb->args[3];
2328 	int idx, s_idx = idx = cb->args[4];
2329 
2330 	read_lock_bh(&tbl->lock);
2331 
2332 	for (h = s_h; h <= PNEIGH_HASHMASK; h++) {
2333 		if (h > s_h)
2334 			s_idx = 0;
2335 		for (n = tbl->phash_buckets[h], idx = 0; n; n = n->next) {
2336 			if (pneigh_net(n) != net)
2337 				continue;
2338 			if (idx < s_idx)
2339 				goto next;
2340 			if (pneigh_fill_info(skb, n, NETLINK_CB(cb->skb).portid,
2341 					    cb->nlh->nlmsg_seq,
2342 					    RTM_NEWNEIGH,
2343 					    NLM_F_MULTI, tbl) < 0) {
2344 				read_unlock_bh(&tbl->lock);
2345 				rc = -1;
2346 				goto out;
2347 			}
2348 		next:
2349 			idx++;
2350 		}
2351 	}
2352 
2353 	read_unlock_bh(&tbl->lock);
2354 	rc = skb->len;
2355 out:
2356 	cb->args[3] = h;
2357 	cb->args[4] = idx;
2358 	return rc;
2359 
2360 }
2361 
2362 static int neigh_dump_info(struct sk_buff *skb, struct netlink_callback *cb)
2363 {
2364 	struct neigh_table *tbl;
2365 	int t, family, s_t;
2366 	int proxy = 0;
2367 	int err;
2368 
2369 	family = ((struct rtgenmsg *) nlmsg_data(cb->nlh))->rtgen_family;
2370 
2371 	/* check for full ndmsg structure presence, family member is
2372 	 * the same for both structures
2373 	 */
2374 	if (nlmsg_len(cb->nlh) >= sizeof(struct ndmsg) &&
2375 	    ((struct ndmsg *) nlmsg_data(cb->nlh))->ndm_flags == NTF_PROXY)
2376 		proxy = 1;
2377 
2378 	s_t = cb->args[0];
2379 
2380 	for (t = 0; t < NEIGH_NR_TABLES; t++) {
2381 		tbl = neigh_tables[t];
2382 
2383 		if (!tbl)
2384 			continue;
2385 		if (t < s_t || (family && tbl->family != family))
2386 			continue;
2387 		if (t > s_t)
2388 			memset(&cb->args[1], 0, sizeof(cb->args) -
2389 						sizeof(cb->args[0]));
2390 		if (proxy)
2391 			err = pneigh_dump_table(tbl, skb, cb);
2392 		else
2393 			err = neigh_dump_table(tbl, skb, cb);
2394 		if (err < 0)
2395 			break;
2396 	}
2397 
2398 	cb->args[0] = t;
2399 	return skb->len;
2400 }
2401 
2402 void neigh_for_each(struct neigh_table *tbl, void (*cb)(struct neighbour *, void *), void *cookie)
2403 {
2404 	int chain;
2405 	struct neigh_hash_table *nht;
2406 
2407 	rcu_read_lock_bh();
2408 	nht = rcu_dereference_bh(tbl->nht);
2409 
2410 	read_lock(&tbl->lock); /* avoid resizes */
2411 	for (chain = 0; chain < (1 << nht->hash_shift); chain++) {
2412 		struct neighbour *n;
2413 
2414 		for (n = rcu_dereference_bh(nht->hash_buckets[chain]);
2415 		     n != NULL;
2416 		     n = rcu_dereference_bh(n->next))
2417 			cb(n, cookie);
2418 	}
2419 	read_unlock(&tbl->lock);
2420 	rcu_read_unlock_bh();
2421 }
2422 EXPORT_SYMBOL(neigh_for_each);
2423 
2424 /* The tbl->lock must be held as a writer and BH disabled. */
2425 void __neigh_for_each_release(struct neigh_table *tbl,
2426 			      int (*cb)(struct neighbour *))
2427 {
2428 	int chain;
2429 	struct neigh_hash_table *nht;
2430 
2431 	nht = rcu_dereference_protected(tbl->nht,
2432 					lockdep_is_held(&tbl->lock));
2433 	for (chain = 0; chain < (1 << nht->hash_shift); chain++) {
2434 		struct neighbour *n;
2435 		struct neighbour __rcu **np;
2436 
2437 		np = &nht->hash_buckets[chain];
2438 		while ((n = rcu_dereference_protected(*np,
2439 					lockdep_is_held(&tbl->lock))) != NULL) {
2440 			int release;
2441 
2442 			write_lock(&n->lock);
2443 			release = cb(n);
2444 			if (release) {
2445 				rcu_assign_pointer(*np,
2446 					rcu_dereference_protected(n->next,
2447 						lockdep_is_held(&tbl->lock)));
2448 				n->dead = 1;
2449 			} else
2450 				np = &n->next;
2451 			write_unlock(&n->lock);
2452 			if (release)
2453 				neigh_cleanup_and_release(n);
2454 		}
2455 	}
2456 }
2457 EXPORT_SYMBOL(__neigh_for_each_release);
2458 
2459 int neigh_xmit(int index, struct net_device *dev,
2460 	       const void *addr, struct sk_buff *skb)
2461 {
2462 	int err = -EAFNOSUPPORT;
2463 	if (likely(index < NEIGH_NR_TABLES)) {
2464 		struct neigh_table *tbl;
2465 		struct neighbour *neigh;
2466 
2467 		tbl = neigh_tables[index];
2468 		if (!tbl)
2469 			goto out;
2470 		neigh = __neigh_lookup_noref(tbl, addr, dev);
2471 		if (!neigh)
2472 			neigh = __neigh_create(tbl, addr, dev, false);
2473 		err = PTR_ERR(neigh);
2474 		if (IS_ERR(neigh))
2475 			goto out_kfree_skb;
2476 		err = neigh->output(neigh, skb);
2477 	}
2478 	else if (index == NEIGH_LINK_TABLE) {
2479 		err = dev_hard_header(skb, dev, ntohs(skb->protocol),
2480 				      addr, NULL, skb->len);
2481 		if (err < 0)
2482 			goto out_kfree_skb;
2483 		err = dev_queue_xmit(skb);
2484 	}
2485 out:
2486 	return err;
2487 out_kfree_skb:
2488 	kfree_skb(skb);
2489 	goto out;
2490 }
2491 EXPORT_SYMBOL(neigh_xmit);
2492 
2493 #ifdef CONFIG_PROC_FS
2494 
2495 static struct neighbour *neigh_get_first(struct seq_file *seq)
2496 {
2497 	struct neigh_seq_state *state = seq->private;
2498 	struct net *net = seq_file_net(seq);
2499 	struct neigh_hash_table *nht = state->nht;
2500 	struct neighbour *n = NULL;
2501 	int bucket = state->bucket;
2502 
2503 	state->flags &= ~NEIGH_SEQ_IS_PNEIGH;
2504 	for (bucket = 0; bucket < (1 << nht->hash_shift); bucket++) {
2505 		n = rcu_dereference_bh(nht->hash_buckets[bucket]);
2506 
2507 		while (n) {
2508 			if (!net_eq(dev_net(n->dev), net))
2509 				goto next;
2510 			if (state->neigh_sub_iter) {
2511 				loff_t fakep = 0;
2512 				void *v;
2513 
2514 				v = state->neigh_sub_iter(state, n, &fakep);
2515 				if (!v)
2516 					goto next;
2517 			}
2518 			if (!(state->flags & NEIGH_SEQ_SKIP_NOARP))
2519 				break;
2520 			if (n->nud_state & ~NUD_NOARP)
2521 				break;
2522 next:
2523 			n = rcu_dereference_bh(n->next);
2524 		}
2525 
2526 		if (n)
2527 			break;
2528 	}
2529 	state->bucket = bucket;
2530 
2531 	return n;
2532 }
2533 
2534 static struct neighbour *neigh_get_next(struct seq_file *seq,
2535 					struct neighbour *n,
2536 					loff_t *pos)
2537 {
2538 	struct neigh_seq_state *state = seq->private;
2539 	struct net *net = seq_file_net(seq);
2540 	struct neigh_hash_table *nht = state->nht;
2541 
2542 	if (state->neigh_sub_iter) {
2543 		void *v = state->neigh_sub_iter(state, n, pos);
2544 		if (v)
2545 			return n;
2546 	}
2547 	n = rcu_dereference_bh(n->next);
2548 
2549 	while (1) {
2550 		while (n) {
2551 			if (!net_eq(dev_net(n->dev), net))
2552 				goto next;
2553 			if (state->neigh_sub_iter) {
2554 				void *v = state->neigh_sub_iter(state, n, pos);
2555 				if (v)
2556 					return n;
2557 				goto next;
2558 			}
2559 			if (!(state->flags & NEIGH_SEQ_SKIP_NOARP))
2560 				break;
2561 
2562 			if (n->nud_state & ~NUD_NOARP)
2563 				break;
2564 next:
2565 			n = rcu_dereference_bh(n->next);
2566 		}
2567 
2568 		if (n)
2569 			break;
2570 
2571 		if (++state->bucket >= (1 << nht->hash_shift))
2572 			break;
2573 
2574 		n = rcu_dereference_bh(nht->hash_buckets[state->bucket]);
2575 	}
2576 
2577 	if (n && pos)
2578 		--(*pos);
2579 	return n;
2580 }
2581 
2582 static struct neighbour *neigh_get_idx(struct seq_file *seq, loff_t *pos)
2583 {
2584 	struct neighbour *n = neigh_get_first(seq);
2585 
2586 	if (n) {
2587 		--(*pos);
2588 		while (*pos) {
2589 			n = neigh_get_next(seq, n, pos);
2590 			if (!n)
2591 				break;
2592 		}
2593 	}
2594 	return *pos ? NULL : n;
2595 }
2596 
2597 static struct pneigh_entry *pneigh_get_first(struct seq_file *seq)
2598 {
2599 	struct neigh_seq_state *state = seq->private;
2600 	struct net *net = seq_file_net(seq);
2601 	struct neigh_table *tbl = state->tbl;
2602 	struct pneigh_entry *pn = NULL;
2603 	int bucket = state->bucket;
2604 
2605 	state->flags |= NEIGH_SEQ_IS_PNEIGH;
2606 	for (bucket = 0; bucket <= PNEIGH_HASHMASK; bucket++) {
2607 		pn = tbl->phash_buckets[bucket];
2608 		while (pn && !net_eq(pneigh_net(pn), net))
2609 			pn = pn->next;
2610 		if (pn)
2611 			break;
2612 	}
2613 	state->bucket = bucket;
2614 
2615 	return pn;
2616 }
2617 
2618 static struct pneigh_entry *pneigh_get_next(struct seq_file *seq,
2619 					    struct pneigh_entry *pn,
2620 					    loff_t *pos)
2621 {
2622 	struct neigh_seq_state *state = seq->private;
2623 	struct net *net = seq_file_net(seq);
2624 	struct neigh_table *tbl = state->tbl;
2625 
2626 	do {
2627 		pn = pn->next;
2628 	} while (pn && !net_eq(pneigh_net(pn), net));
2629 
2630 	while (!pn) {
2631 		if (++state->bucket > PNEIGH_HASHMASK)
2632 			break;
2633 		pn = tbl->phash_buckets[state->bucket];
2634 		while (pn && !net_eq(pneigh_net(pn), net))
2635 			pn = pn->next;
2636 		if (pn)
2637 			break;
2638 	}
2639 
2640 	if (pn && pos)
2641 		--(*pos);
2642 
2643 	return pn;
2644 }
2645 
2646 static struct pneigh_entry *pneigh_get_idx(struct seq_file *seq, loff_t *pos)
2647 {
2648 	struct pneigh_entry *pn = pneigh_get_first(seq);
2649 
2650 	if (pn) {
2651 		--(*pos);
2652 		while (*pos) {
2653 			pn = pneigh_get_next(seq, pn, pos);
2654 			if (!pn)
2655 				break;
2656 		}
2657 	}
2658 	return *pos ? NULL : pn;
2659 }
2660 
2661 static void *neigh_get_idx_any(struct seq_file *seq, loff_t *pos)
2662 {
2663 	struct neigh_seq_state *state = seq->private;
2664 	void *rc;
2665 	loff_t idxpos = *pos;
2666 
2667 	rc = neigh_get_idx(seq, &idxpos);
2668 	if (!rc && !(state->flags & NEIGH_SEQ_NEIGH_ONLY))
2669 		rc = pneigh_get_idx(seq, &idxpos);
2670 
2671 	return rc;
2672 }
2673 
2674 void *neigh_seq_start(struct seq_file *seq, loff_t *pos, struct neigh_table *tbl, unsigned int neigh_seq_flags)
2675 	__acquires(rcu_bh)
2676 {
2677 	struct neigh_seq_state *state = seq->private;
2678 
2679 	state->tbl = tbl;
2680 	state->bucket = 0;
2681 	state->flags = (neigh_seq_flags & ~NEIGH_SEQ_IS_PNEIGH);
2682 
2683 	rcu_read_lock_bh();
2684 	state->nht = rcu_dereference_bh(tbl->nht);
2685 
2686 	return *pos ? neigh_get_idx_any(seq, pos) : SEQ_START_TOKEN;
2687 }
2688 EXPORT_SYMBOL(neigh_seq_start);
2689 
2690 void *neigh_seq_next(struct seq_file *seq, void *v, loff_t *pos)
2691 {
2692 	struct neigh_seq_state *state;
2693 	void *rc;
2694 
2695 	if (v == SEQ_START_TOKEN) {
2696 		rc = neigh_get_first(seq);
2697 		goto out;
2698 	}
2699 
2700 	state = seq->private;
2701 	if (!(state->flags & NEIGH_SEQ_IS_PNEIGH)) {
2702 		rc = neigh_get_next(seq, v, NULL);
2703 		if (rc)
2704 			goto out;
2705 		if (!(state->flags & NEIGH_SEQ_NEIGH_ONLY))
2706 			rc = pneigh_get_first(seq);
2707 	} else {
2708 		BUG_ON(state->flags & NEIGH_SEQ_NEIGH_ONLY);
2709 		rc = pneigh_get_next(seq, v, NULL);
2710 	}
2711 out:
2712 	++(*pos);
2713 	return rc;
2714 }
2715 EXPORT_SYMBOL(neigh_seq_next);
2716 
2717 void neigh_seq_stop(struct seq_file *seq, void *v)
2718 	__releases(rcu_bh)
2719 {
2720 	rcu_read_unlock_bh();
2721 }
2722 EXPORT_SYMBOL(neigh_seq_stop);
2723 
2724 /* statistics via seq_file */
2725 
2726 static void *neigh_stat_seq_start(struct seq_file *seq, loff_t *pos)
2727 {
2728 	struct neigh_table *tbl = seq->private;
2729 	int cpu;
2730 
2731 	if (*pos == 0)
2732 		return SEQ_START_TOKEN;
2733 
2734 	for (cpu = *pos-1; cpu < nr_cpu_ids; ++cpu) {
2735 		if (!cpu_possible(cpu))
2736 			continue;
2737 		*pos = cpu+1;
2738 		return per_cpu_ptr(tbl->stats, cpu);
2739 	}
2740 	return NULL;
2741 }
2742 
2743 static void *neigh_stat_seq_next(struct seq_file *seq, void *v, loff_t *pos)
2744 {
2745 	struct neigh_table *tbl = seq->private;
2746 	int cpu;
2747 
2748 	for (cpu = *pos; cpu < nr_cpu_ids; ++cpu) {
2749 		if (!cpu_possible(cpu))
2750 			continue;
2751 		*pos = cpu+1;
2752 		return per_cpu_ptr(tbl->stats, cpu);
2753 	}
2754 	return NULL;
2755 }
2756 
2757 static void neigh_stat_seq_stop(struct seq_file *seq, void *v)
2758 {
2759 
2760 }
2761 
2762 static int neigh_stat_seq_show(struct seq_file *seq, void *v)
2763 {
2764 	struct neigh_table *tbl = seq->private;
2765 	struct neigh_statistics *st = v;
2766 
2767 	if (v == SEQ_START_TOKEN) {
2768 		seq_printf(seq, "entries  allocs destroys hash_grows  lookups hits  res_failed  rcv_probes_mcast rcv_probes_ucast  periodic_gc_runs forced_gc_runs unresolved_discards table_fulls\n");
2769 		return 0;
2770 	}
2771 
2772 	seq_printf(seq, "%08x  %08lx %08lx %08lx  %08lx %08lx  %08lx  "
2773 			"%08lx %08lx  %08lx %08lx %08lx %08lx\n",
2774 		   atomic_read(&tbl->entries),
2775 
2776 		   st->allocs,
2777 		   st->destroys,
2778 		   st->hash_grows,
2779 
2780 		   st->lookups,
2781 		   st->hits,
2782 
2783 		   st->res_failed,
2784 
2785 		   st->rcv_probes_mcast,
2786 		   st->rcv_probes_ucast,
2787 
2788 		   st->periodic_gc_runs,
2789 		   st->forced_gc_runs,
2790 		   st->unres_discards,
2791 		   st->table_fulls
2792 		   );
2793 
2794 	return 0;
2795 }
2796 
2797 static const struct seq_operations neigh_stat_seq_ops = {
2798 	.start	= neigh_stat_seq_start,
2799 	.next	= neigh_stat_seq_next,
2800 	.stop	= neigh_stat_seq_stop,
2801 	.show	= neigh_stat_seq_show,
2802 };
2803 
2804 static int neigh_stat_seq_open(struct inode *inode, struct file *file)
2805 {
2806 	int ret = seq_open(file, &neigh_stat_seq_ops);
2807 
2808 	if (!ret) {
2809 		struct seq_file *sf = file->private_data;
2810 		sf->private = PDE_DATA(inode);
2811 	}
2812 	return ret;
2813 };
2814 
2815 static const struct file_operations neigh_stat_seq_fops = {
2816 	.owner	 = THIS_MODULE,
2817 	.open 	 = neigh_stat_seq_open,
2818 	.read	 = seq_read,
2819 	.llseek	 = seq_lseek,
2820 	.release = seq_release,
2821 };
2822 
2823 #endif /* CONFIG_PROC_FS */
2824 
2825 static inline size_t neigh_nlmsg_size(void)
2826 {
2827 	return NLMSG_ALIGN(sizeof(struct ndmsg))
2828 	       + nla_total_size(MAX_ADDR_LEN) /* NDA_DST */
2829 	       + nla_total_size(MAX_ADDR_LEN) /* NDA_LLADDR */
2830 	       + nla_total_size(sizeof(struct nda_cacheinfo))
2831 	       + nla_total_size(4); /* NDA_PROBES */
2832 }
2833 
2834 static void __neigh_notify(struct neighbour *n, int type, int flags)
2835 {
2836 	struct net *net = dev_net(n->dev);
2837 	struct sk_buff *skb;
2838 	int err = -ENOBUFS;
2839 
2840 	skb = nlmsg_new(neigh_nlmsg_size(), GFP_ATOMIC);
2841 	if (skb == NULL)
2842 		goto errout;
2843 
2844 	err = neigh_fill_info(skb, n, 0, 0, type, flags);
2845 	if (err < 0) {
2846 		/* -EMSGSIZE implies BUG in neigh_nlmsg_size() */
2847 		WARN_ON(err == -EMSGSIZE);
2848 		kfree_skb(skb);
2849 		goto errout;
2850 	}
2851 	rtnl_notify(skb, net, 0, RTNLGRP_NEIGH, NULL, GFP_ATOMIC);
2852 	return;
2853 errout:
2854 	if (err < 0)
2855 		rtnl_set_sk_err(net, RTNLGRP_NEIGH, err);
2856 }
2857 
2858 void neigh_app_ns(struct neighbour *n)
2859 {
2860 	__neigh_notify(n, RTM_GETNEIGH, NLM_F_REQUEST);
2861 }
2862 EXPORT_SYMBOL(neigh_app_ns);
2863 
2864 #ifdef CONFIG_SYSCTL
2865 static int zero;
2866 static int int_max = INT_MAX;
2867 static int unres_qlen_max = INT_MAX / SKB_TRUESIZE(ETH_FRAME_LEN);
2868 
2869 static int proc_unres_qlen(struct ctl_table *ctl, int write,
2870 			   void __user *buffer, size_t *lenp, loff_t *ppos)
2871 {
2872 	int size, ret;
2873 	struct ctl_table tmp = *ctl;
2874 
2875 	tmp.extra1 = &zero;
2876 	tmp.extra2 = &unres_qlen_max;
2877 	tmp.data = &size;
2878 
2879 	size = *(int *)ctl->data / SKB_TRUESIZE(ETH_FRAME_LEN);
2880 	ret = proc_dointvec_minmax(&tmp, write, buffer, lenp, ppos);
2881 
2882 	if (write && !ret)
2883 		*(int *)ctl->data = size * SKB_TRUESIZE(ETH_FRAME_LEN);
2884 	return ret;
2885 }
2886 
2887 static struct neigh_parms *neigh_get_dev_parms_rcu(struct net_device *dev,
2888 						   int family)
2889 {
2890 	switch (family) {
2891 	case AF_INET:
2892 		return __in_dev_arp_parms_get_rcu(dev);
2893 	case AF_INET6:
2894 		return __in6_dev_nd_parms_get_rcu(dev);
2895 	}
2896 	return NULL;
2897 }
2898 
2899 static void neigh_copy_dflt_parms(struct net *net, struct neigh_parms *p,
2900 				  int index)
2901 {
2902 	struct net_device *dev;
2903 	int family = neigh_parms_family(p);
2904 
2905 	rcu_read_lock();
2906 	for_each_netdev_rcu(net, dev) {
2907 		struct neigh_parms *dst_p =
2908 				neigh_get_dev_parms_rcu(dev, family);
2909 
2910 		if (dst_p && !test_bit(index, dst_p->data_state))
2911 			dst_p->data[index] = p->data[index];
2912 	}
2913 	rcu_read_unlock();
2914 }
2915 
2916 static void neigh_proc_update(struct ctl_table *ctl, int write)
2917 {
2918 	struct net_device *dev = ctl->extra1;
2919 	struct neigh_parms *p = ctl->extra2;
2920 	struct net *net = neigh_parms_net(p);
2921 	int index = (int *) ctl->data - p->data;
2922 
2923 	if (!write)
2924 		return;
2925 
2926 	set_bit(index, p->data_state);
2927 	if (!dev) /* NULL dev means this is default value */
2928 		neigh_copy_dflt_parms(net, p, index);
2929 }
2930 
2931 static int neigh_proc_dointvec_zero_intmax(struct ctl_table *ctl, int write,
2932 					   void __user *buffer,
2933 					   size_t *lenp, loff_t *ppos)
2934 {
2935 	struct ctl_table tmp = *ctl;
2936 	int ret;
2937 
2938 	tmp.extra1 = &zero;
2939 	tmp.extra2 = &int_max;
2940 
2941 	ret = proc_dointvec_minmax(&tmp, write, buffer, lenp, ppos);
2942 	neigh_proc_update(ctl, write);
2943 	return ret;
2944 }
2945 
2946 int neigh_proc_dointvec(struct ctl_table *ctl, int write,
2947 			void __user *buffer, size_t *lenp, loff_t *ppos)
2948 {
2949 	int ret = proc_dointvec(ctl, write, buffer, lenp, ppos);
2950 
2951 	neigh_proc_update(ctl, write);
2952 	return ret;
2953 }
2954 EXPORT_SYMBOL(neigh_proc_dointvec);
2955 
2956 int neigh_proc_dointvec_jiffies(struct ctl_table *ctl, int write,
2957 				void __user *buffer,
2958 				size_t *lenp, loff_t *ppos)
2959 {
2960 	int ret = proc_dointvec_jiffies(ctl, write, buffer, lenp, ppos);
2961 
2962 	neigh_proc_update(ctl, write);
2963 	return ret;
2964 }
2965 EXPORT_SYMBOL(neigh_proc_dointvec_jiffies);
2966 
2967 static int neigh_proc_dointvec_userhz_jiffies(struct ctl_table *ctl, int write,
2968 					      void __user *buffer,
2969 					      size_t *lenp, loff_t *ppos)
2970 {
2971 	int ret = proc_dointvec_userhz_jiffies(ctl, write, buffer, lenp, ppos);
2972 
2973 	neigh_proc_update(ctl, write);
2974 	return ret;
2975 }
2976 
2977 int neigh_proc_dointvec_ms_jiffies(struct ctl_table *ctl, int write,
2978 				   void __user *buffer,
2979 				   size_t *lenp, loff_t *ppos)
2980 {
2981 	int ret = proc_dointvec_ms_jiffies(ctl, write, buffer, lenp, ppos);
2982 
2983 	neigh_proc_update(ctl, write);
2984 	return ret;
2985 }
2986 EXPORT_SYMBOL(neigh_proc_dointvec_ms_jiffies);
2987 
2988 static int neigh_proc_dointvec_unres_qlen(struct ctl_table *ctl, int write,
2989 					  void __user *buffer,
2990 					  size_t *lenp, loff_t *ppos)
2991 {
2992 	int ret = proc_unres_qlen(ctl, write, buffer, lenp, ppos);
2993 
2994 	neigh_proc_update(ctl, write);
2995 	return ret;
2996 }
2997 
2998 static int neigh_proc_base_reachable_time(struct ctl_table *ctl, int write,
2999 					  void __user *buffer,
3000 					  size_t *lenp, loff_t *ppos)
3001 {
3002 	struct neigh_parms *p = ctl->extra2;
3003 	int ret;
3004 
3005 	if (strcmp(ctl->procname, "base_reachable_time") == 0)
3006 		ret = neigh_proc_dointvec_jiffies(ctl, write, buffer, lenp, ppos);
3007 	else if (strcmp(ctl->procname, "base_reachable_time_ms") == 0)
3008 		ret = neigh_proc_dointvec_ms_jiffies(ctl, write, buffer, lenp, ppos);
3009 	else
3010 		ret = -1;
3011 
3012 	if (write && ret == 0) {
3013 		/* update reachable_time as well, otherwise, the change will
3014 		 * only be effective after the next time neigh_periodic_work
3015 		 * decides to recompute it
3016 		 */
3017 		p->reachable_time =
3018 			neigh_rand_reach_time(NEIGH_VAR(p, BASE_REACHABLE_TIME));
3019 	}
3020 	return ret;
3021 }
3022 
3023 #define NEIGH_PARMS_DATA_OFFSET(index)	\
3024 	(&((struct neigh_parms *) 0)->data[index])
3025 
3026 #define NEIGH_SYSCTL_ENTRY(attr, data_attr, name, mval, proc) \
3027 	[NEIGH_VAR_ ## attr] = { \
3028 		.procname	= name, \
3029 		.data		= NEIGH_PARMS_DATA_OFFSET(NEIGH_VAR_ ## data_attr), \
3030 		.maxlen		= sizeof(int), \
3031 		.mode		= mval, \
3032 		.proc_handler	= proc, \
3033 	}
3034 
3035 #define NEIGH_SYSCTL_ZERO_INTMAX_ENTRY(attr, name) \
3036 	NEIGH_SYSCTL_ENTRY(attr, attr, name, 0644, neigh_proc_dointvec_zero_intmax)
3037 
3038 #define NEIGH_SYSCTL_JIFFIES_ENTRY(attr, name) \
3039 	NEIGH_SYSCTL_ENTRY(attr, attr, name, 0644, neigh_proc_dointvec_jiffies)
3040 
3041 #define NEIGH_SYSCTL_USERHZ_JIFFIES_ENTRY(attr, name) \
3042 	NEIGH_SYSCTL_ENTRY(attr, attr, name, 0644, neigh_proc_dointvec_userhz_jiffies)
3043 
3044 #define NEIGH_SYSCTL_MS_JIFFIES_ENTRY(attr, name) \
3045 	NEIGH_SYSCTL_ENTRY(attr, attr, name, 0644, neigh_proc_dointvec_ms_jiffies)
3046 
3047 #define NEIGH_SYSCTL_MS_JIFFIES_REUSED_ENTRY(attr, data_attr, name) \
3048 	NEIGH_SYSCTL_ENTRY(attr, data_attr, name, 0644, neigh_proc_dointvec_ms_jiffies)
3049 
3050 #define NEIGH_SYSCTL_UNRES_QLEN_REUSED_ENTRY(attr, data_attr, name) \
3051 	NEIGH_SYSCTL_ENTRY(attr, data_attr, name, 0644, neigh_proc_dointvec_unres_qlen)
3052 
3053 static struct neigh_sysctl_table {
3054 	struct ctl_table_header *sysctl_header;
3055 	struct ctl_table neigh_vars[NEIGH_VAR_MAX + 1];
3056 } neigh_sysctl_template __read_mostly = {
3057 	.neigh_vars = {
3058 		NEIGH_SYSCTL_ZERO_INTMAX_ENTRY(MCAST_PROBES, "mcast_solicit"),
3059 		NEIGH_SYSCTL_ZERO_INTMAX_ENTRY(UCAST_PROBES, "ucast_solicit"),
3060 		NEIGH_SYSCTL_ZERO_INTMAX_ENTRY(APP_PROBES, "app_solicit"),
3061 		NEIGH_SYSCTL_ZERO_INTMAX_ENTRY(MCAST_REPROBES, "mcast_resolicit"),
3062 		NEIGH_SYSCTL_USERHZ_JIFFIES_ENTRY(RETRANS_TIME, "retrans_time"),
3063 		NEIGH_SYSCTL_JIFFIES_ENTRY(BASE_REACHABLE_TIME, "base_reachable_time"),
3064 		NEIGH_SYSCTL_JIFFIES_ENTRY(DELAY_PROBE_TIME, "delay_first_probe_time"),
3065 		NEIGH_SYSCTL_JIFFIES_ENTRY(GC_STALETIME, "gc_stale_time"),
3066 		NEIGH_SYSCTL_ZERO_INTMAX_ENTRY(QUEUE_LEN_BYTES, "unres_qlen_bytes"),
3067 		NEIGH_SYSCTL_ZERO_INTMAX_ENTRY(PROXY_QLEN, "proxy_qlen"),
3068 		NEIGH_SYSCTL_USERHZ_JIFFIES_ENTRY(ANYCAST_DELAY, "anycast_delay"),
3069 		NEIGH_SYSCTL_USERHZ_JIFFIES_ENTRY(PROXY_DELAY, "proxy_delay"),
3070 		NEIGH_SYSCTL_USERHZ_JIFFIES_ENTRY(LOCKTIME, "locktime"),
3071 		NEIGH_SYSCTL_UNRES_QLEN_REUSED_ENTRY(QUEUE_LEN, QUEUE_LEN_BYTES, "unres_qlen"),
3072 		NEIGH_SYSCTL_MS_JIFFIES_REUSED_ENTRY(RETRANS_TIME_MS, RETRANS_TIME, "retrans_time_ms"),
3073 		NEIGH_SYSCTL_MS_JIFFIES_REUSED_ENTRY(BASE_REACHABLE_TIME_MS, BASE_REACHABLE_TIME, "base_reachable_time_ms"),
3074 		[NEIGH_VAR_GC_INTERVAL] = {
3075 			.procname	= "gc_interval",
3076 			.maxlen		= sizeof(int),
3077 			.mode		= 0644,
3078 			.proc_handler	= proc_dointvec_jiffies,
3079 		},
3080 		[NEIGH_VAR_GC_THRESH1] = {
3081 			.procname	= "gc_thresh1",
3082 			.maxlen		= sizeof(int),
3083 			.mode		= 0644,
3084 			.extra1 	= &zero,
3085 			.extra2		= &int_max,
3086 			.proc_handler	= proc_dointvec_minmax,
3087 		},
3088 		[NEIGH_VAR_GC_THRESH2] = {
3089 			.procname	= "gc_thresh2",
3090 			.maxlen		= sizeof(int),
3091 			.mode		= 0644,
3092 			.extra1 	= &zero,
3093 			.extra2		= &int_max,
3094 			.proc_handler	= proc_dointvec_minmax,
3095 		},
3096 		[NEIGH_VAR_GC_THRESH3] = {
3097 			.procname	= "gc_thresh3",
3098 			.maxlen		= sizeof(int),
3099 			.mode		= 0644,
3100 			.extra1 	= &zero,
3101 			.extra2		= &int_max,
3102 			.proc_handler	= proc_dointvec_minmax,
3103 		},
3104 		{},
3105 	},
3106 };
3107 
3108 int neigh_sysctl_register(struct net_device *dev, struct neigh_parms *p,
3109 			  proc_handler *handler)
3110 {
3111 	int i;
3112 	struct neigh_sysctl_table *t;
3113 	const char *dev_name_source;
3114 	char neigh_path[ sizeof("net//neigh/") + IFNAMSIZ + IFNAMSIZ ];
3115 	char *p_name;
3116 
3117 	t = kmemdup(&neigh_sysctl_template, sizeof(*t), GFP_KERNEL);
3118 	if (!t)
3119 		goto err;
3120 
3121 	for (i = 0; i < NEIGH_VAR_GC_INTERVAL; i++) {
3122 		t->neigh_vars[i].data += (long) p;
3123 		t->neigh_vars[i].extra1 = dev;
3124 		t->neigh_vars[i].extra2 = p;
3125 	}
3126 
3127 	if (dev) {
3128 		dev_name_source = dev->name;
3129 		/* Terminate the table early */
3130 		memset(&t->neigh_vars[NEIGH_VAR_GC_INTERVAL], 0,
3131 		       sizeof(t->neigh_vars[NEIGH_VAR_GC_INTERVAL]));
3132 	} else {
3133 		struct neigh_table *tbl = p->tbl;
3134 		dev_name_source = "default";
3135 		t->neigh_vars[NEIGH_VAR_GC_INTERVAL].data = &tbl->gc_interval;
3136 		t->neigh_vars[NEIGH_VAR_GC_THRESH1].data = &tbl->gc_thresh1;
3137 		t->neigh_vars[NEIGH_VAR_GC_THRESH2].data = &tbl->gc_thresh2;
3138 		t->neigh_vars[NEIGH_VAR_GC_THRESH3].data = &tbl->gc_thresh3;
3139 	}
3140 
3141 	if (handler) {
3142 		/* RetransTime */
3143 		t->neigh_vars[NEIGH_VAR_RETRANS_TIME].proc_handler = handler;
3144 		/* ReachableTime */
3145 		t->neigh_vars[NEIGH_VAR_BASE_REACHABLE_TIME].proc_handler = handler;
3146 		/* RetransTime (in milliseconds)*/
3147 		t->neigh_vars[NEIGH_VAR_RETRANS_TIME_MS].proc_handler = handler;
3148 		/* ReachableTime (in milliseconds) */
3149 		t->neigh_vars[NEIGH_VAR_BASE_REACHABLE_TIME_MS].proc_handler = handler;
3150 	} else {
3151 		/* Those handlers will update p->reachable_time after
3152 		 * base_reachable_time(_ms) is set to ensure the new timer starts being
3153 		 * applied after the next neighbour update instead of waiting for
3154 		 * neigh_periodic_work to update its value (can be multiple minutes)
3155 		 * So any handler that replaces them should do this as well
3156 		 */
3157 		/* ReachableTime */
3158 		t->neigh_vars[NEIGH_VAR_BASE_REACHABLE_TIME].proc_handler =
3159 			neigh_proc_base_reachable_time;
3160 		/* ReachableTime (in milliseconds) */
3161 		t->neigh_vars[NEIGH_VAR_BASE_REACHABLE_TIME_MS].proc_handler =
3162 			neigh_proc_base_reachable_time;
3163 	}
3164 
3165 	/* Don't export sysctls to unprivileged users */
3166 	if (neigh_parms_net(p)->user_ns != &init_user_ns)
3167 		t->neigh_vars[0].procname = NULL;
3168 
3169 	switch (neigh_parms_family(p)) {
3170 	case AF_INET:
3171 	      p_name = "ipv4";
3172 	      break;
3173 	case AF_INET6:
3174 	      p_name = "ipv6";
3175 	      break;
3176 	default:
3177 	      BUG();
3178 	}
3179 
3180 	snprintf(neigh_path, sizeof(neigh_path), "net/%s/neigh/%s",
3181 		p_name, dev_name_source);
3182 	t->sysctl_header =
3183 		register_net_sysctl(neigh_parms_net(p), neigh_path, t->neigh_vars);
3184 	if (!t->sysctl_header)
3185 		goto free;
3186 
3187 	p->sysctl_table = t;
3188 	return 0;
3189 
3190 free:
3191 	kfree(t);
3192 err:
3193 	return -ENOBUFS;
3194 }
3195 EXPORT_SYMBOL(neigh_sysctl_register);
3196 
3197 void neigh_sysctl_unregister(struct neigh_parms *p)
3198 {
3199 	if (p->sysctl_table) {
3200 		struct neigh_sysctl_table *t = p->sysctl_table;
3201 		p->sysctl_table = NULL;
3202 		unregister_net_sysctl_table(t->sysctl_header);
3203 		kfree(t);
3204 	}
3205 }
3206 EXPORT_SYMBOL(neigh_sysctl_unregister);
3207 
3208 #endif	/* CONFIG_SYSCTL */
3209 
3210 static int __init neigh_init(void)
3211 {
3212 	rtnl_register(PF_UNSPEC, RTM_NEWNEIGH, neigh_add, NULL, NULL);
3213 	rtnl_register(PF_UNSPEC, RTM_DELNEIGH, neigh_delete, NULL, NULL);
3214 	rtnl_register(PF_UNSPEC, RTM_GETNEIGH, NULL, neigh_dump_info, NULL);
3215 
3216 	rtnl_register(PF_UNSPEC, RTM_GETNEIGHTBL, NULL, neightbl_dump_info,
3217 		      NULL);
3218 	rtnl_register(PF_UNSPEC, RTM_SETNEIGHTBL, neightbl_set, NULL, NULL);
3219 
3220 	return 0;
3221 }
3222 
3223 subsys_initcall(neigh_init);
3224 
3225