xref: /openbmc/linux/net/tipc/name_table.c (revision 2c98da07)
1 /*
2  * net/tipc/name_table.c: TIPC name table code
3  *
4  * Copyright (c) 2000-2006, 2014-2018, Ericsson AB
5  * Copyright (c) 2004-2008, 2010-2014, Wind River Systems
6  * Copyright (c) 2020-2021, Red Hat Inc
7  * All rights reserved.
8  *
9  * Redistribution and use in source and binary forms, with or without
10  * modification, are permitted provided that the following conditions are met:
11  *
12  * 1. Redistributions of source code must retain the above copyright
13  *    notice, this list of conditions and the following disclaimer.
14  * 2. Redistributions in binary form must reproduce the above copyright
15  *    notice, this list of conditions and the following disclaimer in the
16  *    documentation and/or other materials provided with the distribution.
17  * 3. Neither the names of the copyright holders nor the names of its
18  *    contributors may be used to endorse or promote products derived from
19  *    this software without specific prior written permission.
20  *
21  * Alternatively, this software may be distributed under the terms of the
22  * GNU General Public License ("GPL") version 2 as published by the Free
23  * Software Foundation.
24  *
25  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
26  * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
27  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
28  * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
29  * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
30  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
31  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
32  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
33  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
34  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
35  * POSSIBILITY OF SUCH DAMAGE.
36  */
37 
38 #include <net/sock.h>
39 #include <linux/list_sort.h>
40 #include <linux/rbtree_augmented.h>
41 #include "core.h"
42 #include "netlink.h"
43 #include "name_table.h"
44 #include "name_distr.h"
45 #include "subscr.h"
46 #include "bcast.h"
47 #include "addr.h"
48 #include "node.h"
49 #include "group.h"
50 
51 /**
52  * struct service_range - container for all bindings of a service range
53  * @lower: service range lower bound
54  * @upper: service range upper bound
55  * @tree_node: member of service range RB tree
56  * @max: largest 'upper' in this node subtree
57  * @local_publ: list of identical publications made from this node
58  *   Used by closest_first lookup and multicast lookup algorithm
59  * @all_publ: all publications identical to this one, whatever node and scope
60  *   Used by round-robin lookup algorithm
61  */
62 struct service_range {
63 	u32 lower;
64 	u32 upper;
65 	struct rb_node tree_node;
66 	u32 max;
67 	struct list_head local_publ;
68 	struct list_head all_publ;
69 };
70 
71 /**
72  * struct tipc_service - container for all published instances of a service type
73  * @type: 32 bit 'type' value for service
74  * @publ_cnt: increasing counter for publications in this service
75  * @ranges: rb tree containing all service ranges for this service
76  * @service_list: links to adjacent name ranges in hash chain
77  * @subscriptions: list of subscriptions for this service type
78  * @lock: spinlock controlling access to pertaining service ranges/publications
79  * @rcu: RCU callback head used for deferred freeing
80  */
81 struct tipc_service {
82 	u32 type;
83 	u32 publ_cnt;
84 	struct rb_root ranges;
85 	struct hlist_node service_list;
86 	struct list_head subscriptions;
87 	spinlock_t lock; /* Covers service range list */
88 	struct rcu_head rcu;
89 };
90 
91 #define service_range_upper(sr) ((sr)->upper)
92 RB_DECLARE_CALLBACKS_MAX(static, sr_callbacks,
93 			 struct service_range, tree_node, u32, max,
94 			 service_range_upper)
95 
96 #define service_range_entry(rbtree_node)				\
97 	(container_of(rbtree_node, struct service_range, tree_node))
98 
99 #define service_range_overlap(sr, start, end)				\
100 	((sr)->lower <= (end) && (sr)->upper >= (start))
101 
102 /**
103  * service_range_foreach_match - iterate over tipc service rbtree for each
104  *                               range match
105  * @sr: the service range pointer as a loop cursor
106  * @sc: the pointer to tipc service which holds the service range rbtree
107  * @start: beginning of the search range (end >= start) for matching
108  * @end: end of the search range (end >= start) for matching
109  */
110 #define service_range_foreach_match(sr, sc, start, end)			\
111 	for (sr = service_range_match_first((sc)->ranges.rb_node,	\
112 					    start,			\
113 					    end);			\
114 	     sr;							\
115 	     sr = service_range_match_next(&(sr)->tree_node,		\
116 					   start,			\
117 					   end))
118 
119 /**
120  * service_range_match_first - find first service range matching a range
121  * @n: the root node of service range rbtree for searching
122  * @start: beginning of the search range (end >= start) for matching
123  * @end: end of the search range (end >= start) for matching
124  *
125  * Return: the leftmost service range node in the rbtree that overlaps the
126  * specific range if any. Otherwise, returns NULL.
127  */
128 static struct service_range *service_range_match_first(struct rb_node *n,
129 						       u32 start, u32 end)
130 {
131 	struct service_range *sr;
132 	struct rb_node *l, *r;
133 
134 	/* Non overlaps in tree at all? */
135 	if (!n || service_range_entry(n)->max < start)
136 		return NULL;
137 
138 	while (n) {
139 		l = n->rb_left;
140 		if (l && service_range_entry(l)->max >= start) {
141 			/* A leftmost overlap range node must be one in the left
142 			 * subtree. If not, it has lower > end, then nodes on
143 			 * the right side cannot satisfy the condition either.
144 			 */
145 			n = l;
146 			continue;
147 		}
148 
149 		/* No one in the left subtree can match, return if this node is
150 		 * an overlap i.e. leftmost.
151 		 */
152 		sr = service_range_entry(n);
153 		if (service_range_overlap(sr, start, end))
154 			return sr;
155 
156 		/* Ok, try to lookup on the right side */
157 		r = n->rb_right;
158 		if (sr->lower <= end &&
159 		    r && service_range_entry(r)->max >= start) {
160 			n = r;
161 			continue;
162 		}
163 		break;
164 	}
165 
166 	return NULL;
167 }
168 
169 /**
170  * service_range_match_next - find next service range matching a range
171  * @n: a node in service range rbtree from which the searching starts
172  * @start: beginning of the search range (end >= start) for matching
173  * @end: end of the search range (end >= start) for matching
174  *
175  * Return: the next service range node to the given node in the rbtree that
176  * overlaps the specific range if any. Otherwise, returns NULL.
177  */
178 static struct service_range *service_range_match_next(struct rb_node *n,
179 						      u32 start, u32 end)
180 {
181 	struct service_range *sr;
182 	struct rb_node *p, *r;
183 
184 	while (n) {
185 		r = n->rb_right;
186 		if (r && service_range_entry(r)->max >= start)
187 			/* A next overlap range node must be one in the right
188 			 * subtree. If not, it has lower > end, then any next
189 			 * successor (- an ancestor) of this node cannot
190 			 * satisfy the condition either.
191 			 */
192 			return service_range_match_first(r, start, end);
193 
194 		/* No one in the right subtree can match, go up to find an
195 		 * ancestor of this node which is parent of a left-hand child.
196 		 */
197 		while ((p = rb_parent(n)) && n == p->rb_right)
198 			n = p;
199 		if (!p)
200 			break;
201 
202 		/* Return if this ancestor is an overlap */
203 		sr = service_range_entry(p);
204 		if (service_range_overlap(sr, start, end))
205 			return sr;
206 
207 		/* Ok, try to lookup more from this ancestor */
208 		if (sr->lower <= end) {
209 			n = p;
210 			continue;
211 		}
212 		break;
213 	}
214 
215 	return NULL;
216 }
217 
218 static int hash(int x)
219 {
220 	return x & (TIPC_NAMETBL_SIZE - 1);
221 }
222 
223 /**
224  * tipc_publ_create - create a publication structure
225  * @ua: the service range the user is binding to
226  * @sk: the address of the socket that is bound
227  * @key: publication key
228  */
229 static struct publication *tipc_publ_create(struct tipc_uaddr *ua,
230 					    struct tipc_socket_addr *sk,
231 					    u32 key)
232 {
233 	struct publication *p = kzalloc(sizeof(*p), GFP_ATOMIC);
234 
235 	if (!p)
236 		return NULL;
237 
238 	p->sr = ua->sr;
239 	p->sk = *sk;
240 	p->scope = ua->scope;
241 	p->key = key;
242 	INIT_LIST_HEAD(&p->binding_sock);
243 	INIT_LIST_HEAD(&p->binding_node);
244 	INIT_LIST_HEAD(&p->local_publ);
245 	INIT_LIST_HEAD(&p->all_publ);
246 	INIT_LIST_HEAD(&p->list);
247 	return p;
248 }
249 
250 /**
251  * tipc_service_create - create a service structure for the specified 'type'
252  * @type: service type
253  * @hd: name_table services list
254  *
255  * Allocates a single range structure and sets it to all 0's.
256  */
257 static struct tipc_service *tipc_service_create(u32 type, struct hlist_head *hd)
258 {
259 	struct tipc_service *service = kzalloc(sizeof(*service), GFP_ATOMIC);
260 
261 	if (!service) {
262 		pr_warn("Service creation failed, no memory\n");
263 		return NULL;
264 	}
265 
266 	spin_lock_init(&service->lock);
267 	service->type = type;
268 	service->ranges = RB_ROOT;
269 	INIT_HLIST_NODE(&service->service_list);
270 	INIT_LIST_HEAD(&service->subscriptions);
271 	hlist_add_head_rcu(&service->service_list, hd);
272 	return service;
273 }
274 
275 /*  tipc_service_find_range - find service range matching publication parameters
276  */
277 static struct service_range *tipc_service_find_range(struct tipc_service *sc,
278 						     u32 lower, u32 upper)
279 {
280 	struct service_range *sr;
281 
282 	service_range_foreach_match(sr, sc, lower, upper) {
283 		/* Look for exact match */
284 		if (sr->lower == lower && sr->upper == upper)
285 			return sr;
286 	}
287 
288 	return NULL;
289 }
290 
291 static struct service_range *tipc_service_create_range(struct tipc_service *sc,
292 						       u32 lower, u32 upper)
293 {
294 	struct rb_node **n, *parent = NULL;
295 	struct service_range *sr;
296 
297 	n = &sc->ranges.rb_node;
298 	while (*n) {
299 		parent = *n;
300 		sr = service_range_entry(parent);
301 		if (lower == sr->lower && upper == sr->upper)
302 			return sr;
303 		if (sr->max < upper)
304 			sr->max = upper;
305 		if (lower <= sr->lower)
306 			n = &parent->rb_left;
307 		else
308 			n = &parent->rb_right;
309 	}
310 	sr = kzalloc(sizeof(*sr), GFP_ATOMIC);
311 	if (!sr)
312 		return NULL;
313 	sr->lower = lower;
314 	sr->upper = upper;
315 	sr->max = upper;
316 	INIT_LIST_HEAD(&sr->local_publ);
317 	INIT_LIST_HEAD(&sr->all_publ);
318 	rb_link_node(&sr->tree_node, parent, n);
319 	rb_insert_augmented(&sr->tree_node, &sc->ranges, &sr_callbacks);
320 	return sr;
321 }
322 
323 static bool tipc_service_insert_publ(struct net *net,
324 				     struct tipc_service *sc,
325 				     struct publication *p)
326 {
327 	struct tipc_subscription *sub, *tmp;
328 	struct service_range *sr;
329 	struct publication *_p;
330 	u32 node = p->sk.node;
331 	bool first = false;
332 	bool res = false;
333 
334 	spin_lock_bh(&sc->lock);
335 	sr = tipc_service_create_range(sc, p->sr.lower, p->sr.upper);
336 	if (!sr)
337 		goto  exit;
338 
339 	first = list_empty(&sr->all_publ);
340 
341 	/* Return if the publication already exists */
342 	list_for_each_entry(_p, &sr->all_publ, all_publ) {
343 		if (_p->key == p->key && (!_p->sk.node || _p->sk.node == node))
344 			goto exit;
345 	}
346 
347 	if (in_own_node(net, p->sk.node))
348 		list_add(&p->local_publ, &sr->local_publ);
349 	list_add(&p->all_publ, &sr->all_publ);
350 	p->id = sc->publ_cnt++;
351 
352 	/* Any subscriptions waiting for notification?  */
353 	list_for_each_entry_safe(sub, tmp, &sc->subscriptions, service_list) {
354 		tipc_sub_report_overlap(sub, p->sr.lower, p->sr.upper,
355 					TIPC_PUBLISHED, p->sk.ref, p->sk.node,
356 					p->scope, first);
357 	}
358 	res = true;
359 exit:
360 	if (!res)
361 		pr_warn("Failed to bind to %u,%u,%u\n",
362 			p->sr.type, p->sr.lower, p->sr.upper);
363 	spin_unlock_bh(&sc->lock);
364 	return res;
365 }
366 
367 /**
368  * tipc_service_remove_publ - remove a publication from a service
369  * @r: service_range to remove publication from
370  * @sk: address publishing socket
371  * @key: target publication key
372  */
373 static struct publication *tipc_service_remove_publ(struct service_range *r,
374 						    struct tipc_socket_addr *sk,
375 						    u32 key)
376 {
377 	struct publication *p;
378 	u32 node = sk->node;
379 
380 	list_for_each_entry(p, &r->all_publ, all_publ) {
381 		if (p->key != key || (node && node != p->sk.node))
382 			continue;
383 		list_del(&p->all_publ);
384 		list_del(&p->local_publ);
385 		return p;
386 	}
387 	return NULL;
388 }
389 
390 /*
391  * Code reused: time_after32() for the same purpose
392  */
393 #define publication_after(pa, pb) time_after32((pa)->id, (pb)->id)
394 static int tipc_publ_sort(void *priv, struct list_head *a,
395 			  struct list_head *b)
396 {
397 	struct publication *pa, *pb;
398 
399 	pa = container_of(a, struct publication, list);
400 	pb = container_of(b, struct publication, list);
401 	return publication_after(pa, pb);
402 }
403 
404 /**
405  * tipc_service_subscribe - attach a subscription, and optionally
406  * issue the prescribed number of events if there is any service
407  * range overlapping with the requested range
408  * @service: the tipc_service to attach the @sub to
409  * @sub: the subscription to attach
410  */
411 static void tipc_service_subscribe(struct tipc_service *service,
412 				   struct tipc_subscription *sub)
413 {
414 	struct tipc_subscr *sb = &sub->evt.s;
415 	struct publication *p, *first, *tmp;
416 	struct list_head publ_list;
417 	struct service_range *sr;
418 	struct tipc_service_range r;
419 	u32 filter;
420 
421 	r.type = tipc_sub_read(sb, seq.type);
422 	r.lower = tipc_sub_read(sb, seq.lower);
423 	r.upper = tipc_sub_read(sb, seq.upper);
424 	filter = tipc_sub_read(sb, filter);
425 
426 	tipc_sub_get(sub);
427 	list_add(&sub->service_list, &service->subscriptions);
428 
429 	if (filter & TIPC_SUB_NO_STATUS)
430 		return;
431 
432 	INIT_LIST_HEAD(&publ_list);
433 	service_range_foreach_match(sr, service, r.lower, r.upper) {
434 		first = NULL;
435 		list_for_each_entry(p, &sr->all_publ, all_publ) {
436 			if (filter & TIPC_SUB_PORTS)
437 				list_add_tail(&p->list, &publ_list);
438 			else if (!first || publication_after(first, p))
439 				/* Pick this range's *first* publication */
440 				first = p;
441 		}
442 		if (first)
443 			list_add_tail(&first->list, &publ_list);
444 	}
445 
446 	/* Sort the publications before reporting */
447 	list_sort(NULL, &publ_list, tipc_publ_sort);
448 	list_for_each_entry_safe(p, tmp, &publ_list, list) {
449 		tipc_sub_report_overlap(sub, p->sr.lower, p->sr.upper,
450 					TIPC_PUBLISHED, p->sk.ref, p->sk.node,
451 					p->scope, true);
452 		list_del_init(&p->list);
453 	}
454 }
455 
456 static struct tipc_service *tipc_service_find(struct net *net, u32 type)
457 {
458 	struct name_table *nt = tipc_name_table(net);
459 	struct hlist_head *service_head;
460 	struct tipc_service *service;
461 
462 	service_head = &nt->services[hash(type)];
463 	hlist_for_each_entry_rcu(service, service_head, service_list) {
464 		if (service->type == type)
465 			return service;
466 	}
467 	return NULL;
468 };
469 
470 struct publication *tipc_nametbl_insert_publ(struct net *net,
471 					     struct tipc_uaddr *ua,
472 					     struct tipc_socket_addr *sk,
473 					     u32 key)
474 {
475 	struct name_table *nt = tipc_name_table(net);
476 	struct tipc_service *sc;
477 	struct publication *p;
478 	u32 type = ua->sr.type;
479 
480 	p = tipc_publ_create(ua, sk, key);
481 	if (!p)
482 		return NULL;
483 
484 	if (ua->sr.lower > ua->sr.upper) {
485 		pr_debug("Failed to bind illegal {%u,%u,%u} from node %u\n",
486 			 type, ua->sr.lower, ua->sr.upper, sk->node);
487 		return NULL;
488 	}
489 	sc = tipc_service_find(net, type);
490 	if (!sc)
491 		sc = tipc_service_create(type, &nt->services[hash(type)]);
492 	if (sc && tipc_service_insert_publ(net, sc, p))
493 		return p;
494 	kfree(p);
495 	return NULL;
496 }
497 
498 struct publication *tipc_nametbl_remove_publ(struct net *net,
499 					     struct tipc_uaddr *ua,
500 					     struct tipc_socket_addr *sk,
501 					     u32 key)
502 {
503 	struct tipc_subscription *sub, *tmp;
504 	struct publication *p = NULL;
505 	struct service_range *sr;
506 	struct tipc_service *sc;
507 	u32 upper = ua->sr.upper;
508 	u32 lower = ua->sr.lower;
509 	bool last;
510 
511 	sc = tipc_service_find(net, ua->sr.type);
512 	if (!sc)
513 		return NULL;
514 
515 	spin_lock_bh(&sc->lock);
516 	sr = tipc_service_find_range(sc, lower, upper);
517 	if (!sr)
518 		goto exit;
519 	p = tipc_service_remove_publ(sr, sk, key);
520 	if (!p)
521 		goto exit;
522 
523 	/* Notify any waiting subscriptions */
524 	last = list_empty(&sr->all_publ);
525 	list_for_each_entry_safe(sub, tmp, &sc->subscriptions, service_list) {
526 		tipc_sub_report_overlap(sub, lower, upper, TIPC_WITHDRAWN,
527 					sk->ref, sk->node, ua->scope, last);
528 	}
529 
530 	/* Remove service range item if this was its last publication */
531 	if (list_empty(&sr->all_publ)) {
532 		rb_erase_augmented(&sr->tree_node, &sc->ranges, &sr_callbacks);
533 		kfree(sr);
534 	}
535 
536 	/* Delete service item if this no more publications and subscriptions */
537 	if (RB_EMPTY_ROOT(&sc->ranges) && list_empty(&sc->subscriptions)) {
538 		hlist_del_init_rcu(&sc->service_list);
539 		kfree_rcu(sc, rcu);
540 	}
541 exit:
542 	spin_unlock_bh(&sc->lock);
543 	return p;
544 }
545 
546 /**
547  * tipc_nametbl_translate - perform service instance to socket translation
548  * @net: network namespace
549  * @type: message type
550  * @instance: message instance
551  * @dnode: the search domain used during translation
552  *
553  * On exit:
554  * - if translation is deferred to another node, leave 'dnode' unchanged and
555  * return 0
556  * - if translation is attempted and succeeds, set 'dnode' to the publishing
557  * node and return the published (non-zero) port number
558  * - if translation is attempted and fails, set 'dnode' to 0 and return 0
559  *
560  * Note that for legacy users (node configured with Z.C.N address format) the
561  * 'closest-first' lookup algorithm must be maintained, i.e., if dnode is 0
562  * we must look in the local binding list first
563  */
564 u32 tipc_nametbl_translate(struct net *net, u32 type, u32 instance, u32 *dnode)
565 {
566 	struct tipc_net *tn = tipc_net(net);
567 	bool legacy = tn->legacy_addr_format;
568 	u32 self = tipc_own_addr(net);
569 	struct service_range *sr;
570 	struct tipc_service *sc;
571 	struct list_head *list;
572 	struct publication *p;
573 	u32 port = 0;
574 	u32 node = 0;
575 
576 	if (!tipc_in_scope(legacy, *dnode, self))
577 		return 0;
578 
579 	rcu_read_lock();
580 	sc = tipc_service_find(net, type);
581 	if (unlikely(!sc))
582 		goto exit;
583 
584 	spin_lock_bh(&sc->lock);
585 	service_range_foreach_match(sr, sc, instance, instance) {
586 		/* Select lookup algo: local, closest-first or round-robin */
587 		if (*dnode == self) {
588 			list = &sr->local_publ;
589 			if (list_empty(list))
590 				continue;
591 			p = list_first_entry(list, struct publication,
592 					     local_publ);
593 			list_move_tail(&p->local_publ, &sr->local_publ);
594 		} else if (legacy && !*dnode && !list_empty(&sr->local_publ)) {
595 			list = &sr->local_publ;
596 			p = list_first_entry(list, struct publication,
597 					     local_publ);
598 			list_move_tail(&p->local_publ, &sr->local_publ);
599 		} else {
600 			list = &sr->all_publ;
601 			p = list_first_entry(list, struct publication,
602 					     all_publ);
603 			list_move_tail(&p->all_publ, &sr->all_publ);
604 		}
605 		port = p->sk.ref;
606 		node = p->sk.node;
607 		/* Todo: as for legacy, pick the first matching range only, a
608 		 * "true" round-robin will be performed as needed.
609 		 */
610 		break;
611 	}
612 	spin_unlock_bh(&sc->lock);
613 
614 exit:
615 	rcu_read_unlock();
616 	*dnode = node;
617 	return port;
618 }
619 
620 bool tipc_nametbl_lookup(struct net *net, u32 type, u32 instance, u32 scope,
621 			 struct list_head *dsts, int *dstcnt, u32 exclude,
622 			 bool all)
623 {
624 	u32 self = tipc_own_addr(net);
625 	struct service_range *sr;
626 	struct tipc_service *sc;
627 	struct publication *p;
628 
629 	*dstcnt = 0;
630 	rcu_read_lock();
631 	sc = tipc_service_find(net, type);
632 	if (unlikely(!sc))
633 		goto exit;
634 
635 	spin_lock_bh(&sc->lock);
636 
637 	/* Todo: a full search i.e. service_range_foreach_match() instead? */
638 	sr = service_range_match_first(sc->ranges.rb_node, instance, instance);
639 	if (!sr)
640 		goto no_match;
641 
642 	list_for_each_entry(p, &sr->all_publ, all_publ) {
643 		if (p->scope != scope)
644 			continue;
645 		if (p->sk.ref == exclude && p->sk.node == self)
646 			continue;
647 		tipc_dest_push(dsts, p->sk.node, p->sk.ref);
648 		(*dstcnt)++;
649 		if (all)
650 			continue;
651 		list_move_tail(&p->all_publ, &sr->all_publ);
652 		break;
653 	}
654 no_match:
655 	spin_unlock_bh(&sc->lock);
656 exit:
657 	rcu_read_unlock();
658 	return !list_empty(dsts);
659 }
660 
661 void tipc_nametbl_mc_lookup(struct net *net, u32 type, u32 lower, u32 upper,
662 			    u32 scope, bool exact, struct list_head *dports)
663 {
664 	struct service_range *sr;
665 	struct tipc_service *sc;
666 	struct publication *p;
667 
668 	rcu_read_lock();
669 	sc = tipc_service_find(net, type);
670 	if (!sc)
671 		goto exit;
672 
673 	spin_lock_bh(&sc->lock);
674 	service_range_foreach_match(sr, sc, lower, upper) {
675 		list_for_each_entry(p, &sr->local_publ, local_publ) {
676 			if (p->scope == scope || (!exact && p->scope < scope))
677 				tipc_dest_push(dports, 0, p->sk.ref);
678 		}
679 	}
680 	spin_unlock_bh(&sc->lock);
681 exit:
682 	rcu_read_unlock();
683 }
684 
685 /* tipc_nametbl_lookup_dst_nodes - find broadcast destination nodes
686  * - Creates list of nodes that overlap the given multicast address
687  * - Determines if any node local destinations overlap
688  */
689 void tipc_nametbl_lookup_dst_nodes(struct net *net, u32 type, u32 lower,
690 				   u32 upper, struct tipc_nlist *nodes)
691 {
692 	struct service_range *sr;
693 	struct tipc_service *sc;
694 	struct publication *p;
695 
696 	rcu_read_lock();
697 	sc = tipc_service_find(net, type);
698 	if (!sc)
699 		goto exit;
700 
701 	spin_lock_bh(&sc->lock);
702 	service_range_foreach_match(sr, sc, lower, upper) {
703 		list_for_each_entry(p, &sr->all_publ, all_publ) {
704 			tipc_nlist_add(nodes, p->sk.node);
705 		}
706 	}
707 	spin_unlock_bh(&sc->lock);
708 exit:
709 	rcu_read_unlock();
710 }
711 
712 /* tipc_nametbl_build_group - build list of communication group members
713  */
714 void tipc_nametbl_build_group(struct net *net, struct tipc_group *grp,
715 			      u32 type, u32 scope)
716 {
717 	struct service_range *sr;
718 	struct tipc_service *sc;
719 	struct publication *p;
720 	struct rb_node *n;
721 
722 	rcu_read_lock();
723 	sc = tipc_service_find(net, type);
724 	if (!sc)
725 		goto exit;
726 
727 	spin_lock_bh(&sc->lock);
728 	for (n = rb_first(&sc->ranges); n; n = rb_next(n)) {
729 		sr = container_of(n, struct service_range, tree_node);
730 		list_for_each_entry(p, &sr->all_publ, all_publ) {
731 			if (p->scope != scope)
732 				continue;
733 			tipc_group_add_member(grp, p->sk.node, p->sk.ref, p->sr.lower);
734 		}
735 	}
736 	spin_unlock_bh(&sc->lock);
737 exit:
738 	rcu_read_unlock();
739 }
740 
741 /* tipc_nametbl_publish - add service binding to name table
742  */
743 struct publication *tipc_nametbl_publish(struct net *net, struct tipc_uaddr *ua,
744 					 struct tipc_socket_addr *sk, u32 key)
745 {
746 	struct name_table *nt = tipc_name_table(net);
747 	struct tipc_net *tn = tipc_net(net);
748 	struct publication *p = NULL;
749 	struct sk_buff *skb = NULL;
750 	u32 rc_dests;
751 
752 	spin_lock_bh(&tn->nametbl_lock);
753 
754 	if (nt->local_publ_count >= TIPC_MAX_PUBL) {
755 		pr_warn("Bind failed, max limit %u reached\n", TIPC_MAX_PUBL);
756 		goto exit;
757 	}
758 
759 	p = tipc_nametbl_insert_publ(net, ua, sk, key);
760 	if (p) {
761 		nt->local_publ_count++;
762 		skb = tipc_named_publish(net, p);
763 	}
764 	rc_dests = nt->rc_dests;
765 exit:
766 	spin_unlock_bh(&tn->nametbl_lock);
767 
768 	if (skb)
769 		tipc_node_broadcast(net, skb, rc_dests);
770 	return p;
771 
772 }
773 
774 /**
775  * tipc_nametbl_withdraw - withdraw a service binding
776  * @net: network namespace
777  * @ua: service address/range being unbound
778  * @sk: address of the socket being unbound from
779  * @key: target publication key
780  */
781 void tipc_nametbl_withdraw(struct net *net, struct tipc_uaddr *ua,
782 			   struct tipc_socket_addr *sk, u32 key)
783 {
784 	struct name_table *nt = tipc_name_table(net);
785 	struct tipc_net *tn = tipc_net(net);
786 	struct sk_buff *skb = NULL;
787 	struct publication *p;
788 	u32 rc_dests;
789 
790 	spin_lock_bh(&tn->nametbl_lock);
791 
792 	p = tipc_nametbl_remove_publ(net, ua, sk, key);
793 	if (p) {
794 		nt->local_publ_count--;
795 		skb = tipc_named_withdraw(net, p);
796 		list_del_init(&p->binding_sock);
797 		kfree_rcu(p, rcu);
798 	} else {
799 		pr_err("Failed to remove local publication {%u,%u,%u}/%u\n",
800 		       ua->sr.type, ua->sr.lower, ua->sr.upper, key);
801 	}
802 	rc_dests = nt->rc_dests;
803 	spin_unlock_bh(&tn->nametbl_lock);
804 
805 	if (skb)
806 		tipc_node_broadcast(net, skb, rc_dests);
807 }
808 
809 /**
810  * tipc_nametbl_subscribe - add a subscription object to the name table
811  * @sub: subscription to add
812  */
813 bool tipc_nametbl_subscribe(struct tipc_subscription *sub)
814 {
815 	struct name_table *nt = tipc_name_table(sub->net);
816 	struct tipc_net *tn = tipc_net(sub->net);
817 	struct tipc_subscr *s = &sub->evt.s;
818 	u32 type = tipc_sub_read(s, seq.type);
819 	struct tipc_service *sc;
820 	bool res = true;
821 
822 	spin_lock_bh(&tn->nametbl_lock);
823 	sc = tipc_service_find(sub->net, type);
824 	if (!sc)
825 		sc = tipc_service_create(type, &nt->services[hash(type)]);
826 	if (sc) {
827 		spin_lock_bh(&sc->lock);
828 		tipc_service_subscribe(sc, sub);
829 		spin_unlock_bh(&sc->lock);
830 	} else {
831 		pr_warn("Failed to subscribe for {%u,%u,%u}\n", type,
832 			tipc_sub_read(s, seq.lower),
833 			tipc_sub_read(s, seq.upper));
834 		res = false;
835 	}
836 	spin_unlock_bh(&tn->nametbl_lock);
837 	return res;
838 }
839 
840 /**
841  * tipc_nametbl_unsubscribe - remove a subscription object from name table
842  * @sub: subscription to remove
843  */
844 void tipc_nametbl_unsubscribe(struct tipc_subscription *sub)
845 {
846 	struct tipc_net *tn = tipc_net(sub->net);
847 	struct tipc_subscr *s = &sub->evt.s;
848 	u32 type = tipc_sub_read(s, seq.type);
849 	struct tipc_service *sc;
850 
851 	spin_lock_bh(&tn->nametbl_lock);
852 	sc = tipc_service_find(sub->net, type);
853 	if (!sc)
854 		goto exit;
855 
856 	spin_lock_bh(&sc->lock);
857 	list_del_init(&sub->service_list);
858 	tipc_sub_put(sub);
859 
860 	/* Delete service item if no more publications and subscriptions */
861 	if (RB_EMPTY_ROOT(&sc->ranges) && list_empty(&sc->subscriptions)) {
862 		hlist_del_init_rcu(&sc->service_list);
863 		kfree_rcu(sc, rcu);
864 	}
865 	spin_unlock_bh(&sc->lock);
866 exit:
867 	spin_unlock_bh(&tn->nametbl_lock);
868 }
869 
870 int tipc_nametbl_init(struct net *net)
871 {
872 	struct tipc_net *tn = tipc_net(net);
873 	struct name_table *nt;
874 	int i;
875 
876 	nt = kzalloc(sizeof(*nt), GFP_KERNEL);
877 	if (!nt)
878 		return -ENOMEM;
879 
880 	for (i = 0; i < TIPC_NAMETBL_SIZE; i++)
881 		INIT_HLIST_HEAD(&nt->services[i]);
882 
883 	INIT_LIST_HEAD(&nt->node_scope);
884 	INIT_LIST_HEAD(&nt->cluster_scope);
885 	rwlock_init(&nt->cluster_scope_lock);
886 	tn->nametbl = nt;
887 	spin_lock_init(&tn->nametbl_lock);
888 	return 0;
889 }
890 
891 /**
892  * tipc_service_delete - purge all publications for a service and delete it
893  * @net: the associated network namespace
894  * @sc: tipc_service to delete
895  */
896 static void tipc_service_delete(struct net *net, struct tipc_service *sc)
897 {
898 	struct service_range *sr, *tmpr;
899 	struct publication *p, *tmp;
900 
901 	spin_lock_bh(&sc->lock);
902 	rbtree_postorder_for_each_entry_safe(sr, tmpr, &sc->ranges, tree_node) {
903 		list_for_each_entry_safe(p, tmp, &sr->all_publ, all_publ) {
904 			tipc_service_remove_publ(sr, &p->sk, p->key);
905 			kfree_rcu(p, rcu);
906 		}
907 		rb_erase_augmented(&sr->tree_node, &sc->ranges, &sr_callbacks);
908 		kfree(sr);
909 	}
910 	hlist_del_init_rcu(&sc->service_list);
911 	spin_unlock_bh(&sc->lock);
912 	kfree_rcu(sc, rcu);
913 }
914 
915 void tipc_nametbl_stop(struct net *net)
916 {
917 	struct name_table *nt = tipc_name_table(net);
918 	struct tipc_net *tn = tipc_net(net);
919 	struct hlist_head *service_head;
920 	struct tipc_service *service;
921 	u32 i;
922 
923 	/* Verify name table is empty and purge any lingering
924 	 * publications, then release the name table
925 	 */
926 	spin_lock_bh(&tn->nametbl_lock);
927 	for (i = 0; i < TIPC_NAMETBL_SIZE; i++) {
928 		if (hlist_empty(&nt->services[i]))
929 			continue;
930 		service_head = &nt->services[i];
931 		hlist_for_each_entry_rcu(service, service_head, service_list) {
932 			tipc_service_delete(net, service);
933 		}
934 	}
935 	spin_unlock_bh(&tn->nametbl_lock);
936 
937 	synchronize_net();
938 	kfree(nt);
939 }
940 
941 static int __tipc_nl_add_nametable_publ(struct tipc_nl_msg *msg,
942 					struct tipc_service *service,
943 					struct service_range *sr,
944 					u32 *last_key)
945 {
946 	struct publication *p;
947 	struct nlattr *attrs;
948 	struct nlattr *b;
949 	void *hdr;
950 
951 	if (*last_key) {
952 		list_for_each_entry(p, &sr->all_publ, all_publ)
953 			if (p->key == *last_key)
954 				break;
955 		if (p->key != *last_key)
956 			return -EPIPE;
957 	} else {
958 		p = list_first_entry(&sr->all_publ,
959 				     struct publication,
960 				     all_publ);
961 	}
962 
963 	list_for_each_entry_from(p, &sr->all_publ, all_publ) {
964 		*last_key = p->key;
965 
966 		hdr = genlmsg_put(msg->skb, msg->portid, msg->seq,
967 				  &tipc_genl_family, NLM_F_MULTI,
968 				  TIPC_NL_NAME_TABLE_GET);
969 		if (!hdr)
970 			return -EMSGSIZE;
971 
972 		attrs = nla_nest_start_noflag(msg->skb, TIPC_NLA_NAME_TABLE);
973 		if (!attrs)
974 			goto msg_full;
975 
976 		b = nla_nest_start_noflag(msg->skb, TIPC_NLA_NAME_TABLE_PUBL);
977 		if (!b)
978 			goto attr_msg_full;
979 
980 		if (nla_put_u32(msg->skb, TIPC_NLA_PUBL_TYPE, service->type))
981 			goto publ_msg_full;
982 		if (nla_put_u32(msg->skb, TIPC_NLA_PUBL_LOWER, sr->lower))
983 			goto publ_msg_full;
984 		if (nla_put_u32(msg->skb, TIPC_NLA_PUBL_UPPER, sr->upper))
985 			goto publ_msg_full;
986 		if (nla_put_u32(msg->skb, TIPC_NLA_PUBL_SCOPE, p->scope))
987 			goto publ_msg_full;
988 		if (nla_put_u32(msg->skb, TIPC_NLA_PUBL_NODE, p->sk.node))
989 			goto publ_msg_full;
990 		if (nla_put_u32(msg->skb, TIPC_NLA_PUBL_REF, p->sk.ref))
991 			goto publ_msg_full;
992 		if (nla_put_u32(msg->skb, TIPC_NLA_PUBL_KEY, p->key))
993 			goto publ_msg_full;
994 
995 		nla_nest_end(msg->skb, b);
996 		nla_nest_end(msg->skb, attrs);
997 		genlmsg_end(msg->skb, hdr);
998 	}
999 	*last_key = 0;
1000 
1001 	return 0;
1002 
1003 publ_msg_full:
1004 	nla_nest_cancel(msg->skb, b);
1005 attr_msg_full:
1006 	nla_nest_cancel(msg->skb, attrs);
1007 msg_full:
1008 	genlmsg_cancel(msg->skb, hdr);
1009 
1010 	return -EMSGSIZE;
1011 }
1012 
1013 static int __tipc_nl_service_range_list(struct tipc_nl_msg *msg,
1014 					struct tipc_service *sc,
1015 					u32 *last_lower, u32 *last_key)
1016 {
1017 	struct service_range *sr;
1018 	struct rb_node *n;
1019 	int err;
1020 
1021 	for (n = rb_first(&sc->ranges); n; n = rb_next(n)) {
1022 		sr = container_of(n, struct service_range, tree_node);
1023 		if (sr->lower < *last_lower)
1024 			continue;
1025 		err = __tipc_nl_add_nametable_publ(msg, sc, sr, last_key);
1026 		if (err) {
1027 			*last_lower = sr->lower;
1028 			return err;
1029 		}
1030 	}
1031 	*last_lower = 0;
1032 	return 0;
1033 }
1034 
1035 static int tipc_nl_service_list(struct net *net, struct tipc_nl_msg *msg,
1036 				u32 *last_type, u32 *last_lower, u32 *last_key)
1037 {
1038 	struct tipc_net *tn = tipc_net(net);
1039 	struct tipc_service *service = NULL;
1040 	struct hlist_head *head;
1041 	int err;
1042 	int i;
1043 
1044 	if (*last_type)
1045 		i = hash(*last_type);
1046 	else
1047 		i = 0;
1048 
1049 	for (; i < TIPC_NAMETBL_SIZE; i++) {
1050 		head = &tn->nametbl->services[i];
1051 
1052 		if (*last_type ||
1053 		    (!i && *last_key && (*last_lower == *last_key))) {
1054 			service = tipc_service_find(net, *last_type);
1055 			if (!service)
1056 				return -EPIPE;
1057 		} else {
1058 			hlist_for_each_entry_rcu(service, head, service_list)
1059 				break;
1060 			if (!service)
1061 				continue;
1062 		}
1063 
1064 		hlist_for_each_entry_from_rcu(service, service_list) {
1065 			spin_lock_bh(&service->lock);
1066 			err = __tipc_nl_service_range_list(msg, service,
1067 							   last_lower,
1068 							   last_key);
1069 
1070 			if (err) {
1071 				*last_type = service->type;
1072 				spin_unlock_bh(&service->lock);
1073 				return err;
1074 			}
1075 			spin_unlock_bh(&service->lock);
1076 		}
1077 		*last_type = 0;
1078 	}
1079 	return 0;
1080 }
1081 
1082 int tipc_nl_name_table_dump(struct sk_buff *skb, struct netlink_callback *cb)
1083 {
1084 	struct net *net = sock_net(skb->sk);
1085 	u32 last_type = cb->args[0];
1086 	u32 last_lower = cb->args[1];
1087 	u32 last_key = cb->args[2];
1088 	int done = cb->args[3];
1089 	struct tipc_nl_msg msg;
1090 	int err;
1091 
1092 	if (done)
1093 		return 0;
1094 
1095 	msg.skb = skb;
1096 	msg.portid = NETLINK_CB(cb->skb).portid;
1097 	msg.seq = cb->nlh->nlmsg_seq;
1098 
1099 	rcu_read_lock();
1100 	err = tipc_nl_service_list(net, &msg, &last_type,
1101 				   &last_lower, &last_key);
1102 	if (!err) {
1103 		done = 1;
1104 	} else if (err != -EMSGSIZE) {
1105 		/* We never set seq or call nl_dump_check_consistent() this
1106 		 * means that setting prev_seq here will cause the consistence
1107 		 * check to fail in the netlink callback handler. Resulting in
1108 		 * the NLMSG_DONE message having the NLM_F_DUMP_INTR flag set if
1109 		 * we got an error.
1110 		 */
1111 		cb->prev_seq = 1;
1112 	}
1113 	rcu_read_unlock();
1114 
1115 	cb->args[0] = last_type;
1116 	cb->args[1] = last_lower;
1117 	cb->args[2] = last_key;
1118 	cb->args[3] = done;
1119 
1120 	return skb->len;
1121 }
1122 
1123 struct tipc_dest *tipc_dest_find(struct list_head *l, u32 node, u32 port)
1124 {
1125 	struct tipc_dest *dst;
1126 
1127 	list_for_each_entry(dst, l, list) {
1128 		if (dst->node == node && dst->port == port)
1129 			return dst;
1130 	}
1131 	return NULL;
1132 }
1133 
1134 bool tipc_dest_push(struct list_head *l, u32 node, u32 port)
1135 {
1136 	struct tipc_dest *dst;
1137 
1138 	if (tipc_dest_find(l, node, port))
1139 		return false;
1140 
1141 	dst = kmalloc(sizeof(*dst), GFP_ATOMIC);
1142 	if (unlikely(!dst))
1143 		return false;
1144 	dst->node = node;
1145 	dst->port = port;
1146 	list_add(&dst->list, l);
1147 	return true;
1148 }
1149 
1150 bool tipc_dest_pop(struct list_head *l, u32 *node, u32 *port)
1151 {
1152 	struct tipc_dest *dst;
1153 
1154 	if (list_empty(l))
1155 		return false;
1156 	dst = list_first_entry(l, typeof(*dst), list);
1157 	if (port)
1158 		*port = dst->port;
1159 	if (node)
1160 		*node = dst->node;
1161 	list_del(&dst->list);
1162 	kfree(dst);
1163 	return true;
1164 }
1165 
1166 bool tipc_dest_del(struct list_head *l, u32 node, u32 port)
1167 {
1168 	struct tipc_dest *dst;
1169 
1170 	dst = tipc_dest_find(l, node, port);
1171 	if (!dst)
1172 		return false;
1173 	list_del(&dst->list);
1174 	kfree(dst);
1175 	return true;
1176 }
1177 
1178 void tipc_dest_list_purge(struct list_head *l)
1179 {
1180 	struct tipc_dest *dst, *tmp;
1181 
1182 	list_for_each_entry_safe(dst, tmp, l, list) {
1183 		list_del(&dst->list);
1184 		kfree(dst);
1185 	}
1186 }
1187 
1188 int tipc_dest_list_len(struct list_head *l)
1189 {
1190 	struct tipc_dest *dst;
1191 	int i = 0;
1192 
1193 	list_for_each_entry(dst, l, list) {
1194 		i++;
1195 	}
1196 	return i;
1197 }
1198