route.c

   1// SPDX-License-Identifier: GPL-2.0
   2/*
   3 * Management Component Transport Protocol (MCTP) - routing
   4 * implementation.
   5 *
   6 * This is currently based on a simple routing table, with no dst cache. The
   7 * number of routes should stay fairly small, so the lookup cost is small.
   8 *
   9 * Copyright (c) 2021 Code Construct
  10 * Copyright (c) 2021 Google
  11 */
  12
  13#include <linux/idr.h>
  14#include <linux/kconfig.h>
  15#include <linux/mctp.h>
  16#include <linux/netdevice.h>
  17#include <linux/rtnetlink.h>
  18#include <linux/skbuff.h>
  19
  20#include <kunit/static_stub.h>
  21
  22#include <uapi/linux/if_arp.h>
  23
  24#include <net/mctp.h>
  25#include <net/mctpdevice.h>
  26#include <net/netlink.h>
  27#include <net/sock.h>
  28
  29#include <trace/events/mctp.h>
  30
  31static const unsigned int mctp_message_maxlen = 64 * 1024;
  32static const unsigned long mctp_key_lifetime = 6 * CONFIG_HZ;
  33
  34static void mctp_flow_prepare_output(struct sk_buff *skb, struct mctp_dev *dev);
  35
  36/* route output callbacks */
  37static int mctp_dst_discard(struct mctp_dst *dst, struct sk_buff *skb)
  38{
  39	kfree_skb(skb);
  40	return 0;
  41}
  42
  43static struct mctp_sock *mctp_lookup_bind_details(struct net *net,
  44						  struct sk_buff *skb,
  45						  u8 type, u8 dest,
  46						  u8 src, bool allow_net_any)
  47{
  48	struct mctp_skb_cb *cb = mctp_cb(skb);
  49	struct sock *sk;
  50	u8 hash;
  51
  52	WARN_ON_ONCE(!rcu_read_lock_held());
  53
  54	hash = mctp_bind_hash(type, dest, src);
  55
  56	sk_for_each_rcu(sk, &net->mctp.binds[hash]) {
  57		struct mctp_sock *msk = container_of(sk, struct mctp_sock, sk);
  58
  59		if (!allow_net_any && msk->bind_net == MCTP_NET_ANY)
  60			continue;
  61
  62		if (msk->bind_net != MCTP_NET_ANY && msk->bind_net != cb->net)
  63			continue;
  64
  65		if (msk->bind_type != type)
  66			continue;
  67
  68		if (msk->bind_peer_set &&
  69		    !mctp_address_matches(msk->bind_peer_addr, src))
  70			continue;
  71
  72		if (!mctp_address_matches(msk->bind_local_addr, dest))
  73			continue;
  74
  75		return msk;
  76	}
  77
  78	return NULL;
  79}
  80
  81static struct mctp_sock *mctp_lookup_bind(struct net *net, struct sk_buff *skb)
  82{
  83	struct mctp_sock *msk;
  84	struct mctp_hdr *mh;
  85	u8 type;
  86
  87	/* TODO: look up in skb->cb? */
  88	mh = mctp_hdr(skb);
  89
  90	if (!skb_headlen(skb))
  91		return NULL;
  92
  93	type = (*(u8 *)skb->data) & 0x7f;
  94
  95	/* Look for binds in order of widening scope. A given destination or
  96	 * source address also implies matching on a particular network.
  97	 *
  98	 * - Matching destination and source
  99	 * - Matching destination
 100	 * - Matching source
 101	 * - Matching network, any address
 102	 * - Any network or address
 103	 */
 104
 105	msk = mctp_lookup_bind_details(net, skb, type, mh->dest, mh->src,
 106				       false);
 107	if (msk)
 108		return msk;
 109	msk = mctp_lookup_bind_details(net, skb, type, MCTP_ADDR_ANY, mh->src,
 110				       false);
 111	if (msk)
 112		return msk;
 113	msk = mctp_lookup_bind_details(net, skb, type, mh->dest, MCTP_ADDR_ANY,
 114				       false);
 115	if (msk)
 116		return msk;
 117	msk = mctp_lookup_bind_details(net, skb, type, MCTP_ADDR_ANY,
 118				       MCTP_ADDR_ANY, false);
 119	if (msk)
 120		return msk;
 121	msk = mctp_lookup_bind_details(net, skb, type, MCTP_ADDR_ANY,
 122				       MCTP_ADDR_ANY, true);
 123	if (msk)
 124		return msk;
 125
 126	return NULL;
 127}
 128
 129/* A note on the key allocations.
 130 *
 131 * struct net->mctp.keys contains our set of currently-allocated keys for
 132 * MCTP tag management. The lookup tuple for these is the peer EID,
 133 * local EID and MCTP tag.
 134 *
 135 * In some cases, the peer EID may be MCTP_EID_ANY: for example, when a
 136 * broadcast message is sent, we may receive responses from any peer EID.
 137 * Because the broadcast dest address is equivalent to ANY, we create
 138 * a key with (local = local-eid, peer = ANY). This allows a match on the
 139 * incoming broadcast responses from any peer.
 140 *
 141 * We perform lookups when packets are received, and when tags are allocated
 142 * in two scenarios:
 143 *
 144 *  - when a packet is sent, with a locally-owned tag: we need to find an
 145 *    unused tag value for the (local, peer) EID pair.
 146 *
 147 *  - when a tag is manually allocated: we need to find an unused tag value
 148 *    for the peer EID, but don't have a specific local EID at that stage.
 149 *
 150 * in the latter case, on successful allocation, we end up with a tag with
 151 * (local = ANY, peer = peer-eid).
 152 *
 153 * So, the key set allows both a local EID of ANY, as well as a peer EID of
 154 * ANY in the lookup tuple. Both may be ANY if we prealloc for a broadcast.
 155 * The matching (in mctp_key_match()) during lookup allows the match value to
 156 * be ANY in either the dest or source addresses.
 157 *
 158 * When allocating (+ inserting) a tag, we need to check for conflicts amongst
 159 * the existing tag set. This requires macthing either exactly on the local
 160 * and peer addresses, or either being ANY.
 161 */
 162
 163static bool mctp_key_match(struct mctp_sk_key *key, unsigned int net,
 164			   mctp_eid_t local, mctp_eid_t peer, u8 tag)
 165{
 166	if (key->net != net)
 167		return false;
 168
 169	if (!mctp_address_matches(key->local_addr, local))
 170		return false;
 171
 172	if (!mctp_address_matches(key->peer_addr, peer))
 173		return false;
 174
 175	if (key->tag != tag)
 176		return false;
 177
 178	return true;
 179}
 180
 181/* returns a key (with key->lock held, and refcounted), or NULL if no such
 182 * key exists.
 183 */
 184static struct mctp_sk_key *mctp_lookup_key(struct net *net, struct sk_buff *skb,
 185					   unsigned int netid, mctp_eid_t peer,
 186					   unsigned long *irqflags)
 187	__acquires(&key->lock)
 188{
 189	struct mctp_sk_key *key, *ret;
 190	unsigned long flags;
 191	struct mctp_hdr *mh;
 192	u8 tag;
 193
 194	mh = mctp_hdr(skb);
 195	tag = mh->flags_seq_tag & (MCTP_HDR_TAG_MASK | MCTP_HDR_FLAG_TO);
 196
 197	ret = NULL;
 198	spin_lock_irqsave(&net->mctp.keys_lock, flags);
 199
 200	hlist_for_each_entry(key, &net->mctp.keys, hlist) {
 201		if (!mctp_key_match(key, netid, mh->dest, peer, tag))
 202			continue;
 203
 204		spin_lock(&key->lock);
 205		if (key->valid) {
 206			refcount_inc(&key->refs);
 207			ret = key;
 208			break;
 209		}
 210		spin_unlock(&key->lock);
 211	}
 212
 213	if (ret) {
 214		spin_unlock(&net->mctp.keys_lock);
 215		*irqflags = flags;
 216	} else {
 217		spin_unlock_irqrestore(&net->mctp.keys_lock, flags);
 218	}
 219
 220	return ret;
 221}
 222
 223static struct mctp_sk_key *mctp_key_alloc(struct mctp_sock *msk,
 224					  unsigned int net,
 225					  mctp_eid_t local, mctp_eid_t peer,
 226					  u8 tag, gfp_t gfp)
 227{
 228	struct mctp_sk_key *key;
 229
 230	key = kzalloc(sizeof(*key), gfp);
 231	if (!key)
 232		return NULL;
 233
 234	key->net = net;
 235	key->peer_addr = peer;
 236	key->local_addr = local;
 237	key->tag = tag;
 238	key->sk = &msk->sk;
 239	key->valid = true;
 240	spin_lock_init(&key->lock);
 241	refcount_set(&key->refs, 1);
 242	sock_hold(key->sk);
 243
 244	return key;
 245}
 246
 247void mctp_key_unref(struct mctp_sk_key *key)
 248{
 249	unsigned long flags;
 250
 251	if (!refcount_dec_and_test(&key->refs))
 252		return;
 253
 254	/* even though no refs exist here, the lock allows us to stay
 255	 * consistent with the locking requirement of mctp_dev_release_key
 256	 */
 257	spin_lock_irqsave(&key->lock, flags);
 258	mctp_dev_release_key(key->dev, key);
 259	spin_unlock_irqrestore(&key->lock, flags);
 260
 261	sock_put(key->sk);
 262	kfree(key);
 263}
 264
 265static int mctp_key_add(struct mctp_sk_key *key, struct mctp_sock *msk)
 266{
 267	struct net *net = sock_net(&msk->sk);
 268	struct mctp_sk_key *tmp;
 269	unsigned long flags;
 270	int rc = 0;
 271
 272	spin_lock_irqsave(&net->mctp.keys_lock, flags);
 273
 274	if (sock_flag(&msk->sk, SOCK_DEAD)) {
 275		rc = -EINVAL;
 276		goto out_unlock;
 277	}
 278
 279	hlist_for_each_entry(tmp, &net->mctp.keys, hlist) {
 280		if (mctp_key_match(tmp, key->net, key->local_addr,
 281				   key->peer_addr, key->tag)) {
 282			spin_lock(&tmp->lock);
 283			if (tmp->valid)
 284				rc = -EEXIST;
 285			spin_unlock(&tmp->lock);
 286			if (rc)
 287				break;
 288		}
 289	}
 290
 291	if (!rc) {
 292		refcount_inc(&key->refs);
 293		key->expiry = jiffies + mctp_key_lifetime;
 294		timer_reduce(&msk->key_expiry, key->expiry);
 295
 296		hlist_add_head(&key->hlist, &net->mctp.keys);
 297		hlist_add_head(&key->sklist, &msk->keys);
 298	}
 299
 300out_unlock:
 301	spin_unlock_irqrestore(&net->mctp.keys_lock, flags);
 302
 303	return rc;
 304}
 305
 306/* Helper for mctp_route_input().
 307 * We're done with the key; unlock and unref the key.
 308 * For the usual case of automatic expiry we remove the key from lists.
 309 * In the case that manual allocation is set on a key we release the lock
 310 * and local ref, reset reassembly, but don't remove from lists.
 311 */
 312static void __mctp_key_done_in(struct mctp_sk_key *key, struct net *net,
 313			       unsigned long flags, unsigned long reason)
 314__releases(&key->lock)
 315{
 316	struct sk_buff *skb;
 317
 318	trace_mctp_key_release(key, reason);
 319	skb = key->reasm_head;
 320	key->reasm_head = NULL;
 321
 322	if (!key->manual_alloc) {
 323		key->reasm_dead = true;
 324		key->valid = false;
 325		mctp_dev_release_key(key->dev, key);
 326	}
 327	spin_unlock_irqrestore(&key->lock, flags);
 328
 329	if (!key->manual_alloc) {
 330		spin_lock_irqsave(&net->mctp.keys_lock, flags);
 331		if (!hlist_unhashed(&key->hlist)) {
 332			hlist_del_init(&key->hlist);
 333			hlist_del_init(&key->sklist);
 334			mctp_key_unref(key);
 335		}
 336		spin_unlock_irqrestore(&net->mctp.keys_lock, flags);
 337	}
 338
 339	/* and one for the local reference */
 340	mctp_key_unref(key);
 341
 342	kfree_skb(skb);
 343}
 344
 345#ifdef CONFIG_MCTP_FLOWS
 346static void mctp_skb_set_flow(struct sk_buff *skb, struct mctp_sk_key *key)
 347{
 348	struct mctp_flow *flow;
 349
 350	flow = skb_ext_add(skb, SKB_EXT_MCTP);
 351	if (!flow)
 352		return;
 353
 354	refcount_inc(&key->refs);
 355	flow->key = key;
 356}
 357
 358static void mctp_flow_prepare_output(struct sk_buff *skb, struct mctp_dev *dev)
 359{
 360	struct mctp_sk_key *key;
 361	struct mctp_flow *flow;
 362	unsigned long flags;
 363
 364	flow = skb_ext_find(skb, SKB_EXT_MCTP);
 365	if (!flow)
 366		return;
 367
 368	key = flow->key;
 369
 370	spin_lock_irqsave(&key->lock, flags);
 371
 372	if (!key->dev)
 373		mctp_dev_set_key(dev, key);
 374	else
 375		WARN_ON(key->dev != dev);
 376
 377	spin_unlock_irqrestore(&key->lock, flags);
 378}
 379#else
 380static void mctp_skb_set_flow(struct sk_buff *skb, struct mctp_sk_key *key) {}
 381static void mctp_flow_prepare_output(struct sk_buff *skb, struct mctp_dev *dev) {}
 382#endif
 383
 384/* takes ownership of skb, both in success and failure cases */
 385static int mctp_frag_queue(struct mctp_sk_key *key, struct sk_buff *skb)
 386{
 387	struct mctp_hdr *hdr = mctp_hdr(skb);
 388	u8 exp_seq, this_seq;
 389
 390	this_seq = (hdr->flags_seq_tag >> MCTP_HDR_SEQ_SHIFT)
 391		& MCTP_HDR_SEQ_MASK;
 392
 393	if (!key->reasm_head) {
 394		/* Since we're manipulating the shared frag_list, ensure it
 395		 * isn't shared with any other SKBs. In the cloned case,
 396		 * this will free the skb; callers can no longer access it
 397		 * safely.
 398		 */
 399		key->reasm_head = skb_unshare(skb, GFP_ATOMIC);
 400		if (!key->reasm_head)
 401			return -ENOMEM;
 402
 403		key->reasm_tailp = &(skb_shinfo(key->reasm_head)->frag_list);
 404		key->last_seq = this_seq;
 405		return 0;
 406	}
 407
 408	exp_seq = (key->last_seq + 1) & MCTP_HDR_SEQ_MASK;
 409
 410	if (this_seq != exp_seq)
 411		goto err_free;
 412
 413	if (key->reasm_head->len + skb->len > mctp_message_maxlen)
 414		goto err_free;
 415
 416	skb->next = NULL;
 417	skb->sk = NULL;
 418	*key->reasm_tailp = skb;
 419	key->reasm_tailp = &skb->next;
 420
 421	key->last_seq = this_seq;
 422
 423	key->reasm_head->data_len += skb->len;
 424	key->reasm_head->len += skb->len;
 425	key->reasm_head->truesize += skb->truesize;
 426
 427	return 0;
 428
 429err_free:
 430	kfree_skb(skb);
 431	return -EINVAL;
 432}
 433
 434static int mctp_dst_input(struct mctp_dst *dst, struct sk_buff *skb)
 435{
 436	struct mctp_sk_key *key, *any_key = NULL;
 437	struct net *net = dev_net(skb->dev);
 438	struct mctp_sock *msk;
 439	struct mctp_hdr *mh;
 440	unsigned int netid;
 441	unsigned long f;
 442	u8 tag, flags;
 443	int rc;
 444
 445	msk = NULL;
 446	rc = -EINVAL;
 447
 448	/* We may be receiving a locally-routed packet; drop source sk
 449	 * accounting.
 450	 *
 451	 * From here, we will either queue the skb - either to a frag_queue, or
 452	 * to a receiving socket. When that succeeds, we clear the skb pointer;
 453	 * a non-NULL skb on exit will be otherwise unowned, and hence
 454	 * kfree_skb()-ed.
 455	 */
 456	skb_orphan(skb);
 457
 458	if (skb->pkt_type == PACKET_OUTGOING)
 459		skb->pkt_type = PACKET_LOOPBACK;
 460
 461	/* ensure we have enough data for a header and a type */
 462	if (skb->len < sizeof(struct mctp_hdr) + 1)
 463		goto out;
 464
 465	/* grab header, advance data ptr */
 466	mh = mctp_hdr(skb);
 467	netid = mctp_cb(skb)->net;
 468	skb_pull(skb, sizeof(struct mctp_hdr));
 469
 470	if (mh->ver != 1)
 471		goto out;
 472
 473	flags = mh->flags_seq_tag & (MCTP_HDR_FLAG_SOM | MCTP_HDR_FLAG_EOM);
 474	tag = mh->flags_seq_tag & (MCTP_HDR_TAG_MASK | MCTP_HDR_FLAG_TO);
 475
 476	rcu_read_lock();
 477
 478	/* lookup socket / reasm context, exactly matching (src,dest,tag).
 479	 * we hold a ref on the key, and key->lock held.
 480	 */
 481	key = mctp_lookup_key(net, skb, netid, mh->src, &f);
 482
 483	if (flags & MCTP_HDR_FLAG_SOM) {
 484		if (key) {
 485			msk = container_of(key->sk, struct mctp_sock, sk);
 486		} else {
 487			/* first response to a broadcast? do a more general
 488			 * key lookup to find the socket, but don't use this
 489			 * key for reassembly - we'll create a more specific
 490			 * one for future packets if required (ie, !EOM).
 491			 *
 492			 * this lookup requires key->peer to be MCTP_ADDR_ANY,
 493			 * it doesn't match just any key->peer.
 494			 */
 495			any_key = mctp_lookup_key(net, skb, netid,
 496						  MCTP_ADDR_ANY, &f);
 497			if (any_key) {
 498				msk = container_of(any_key->sk,
 499						   struct mctp_sock, sk);
 500				spin_unlock_irqrestore(&any_key->lock, f);
 501			}
 502		}
 503
 504		if (!key && !msk && (tag & MCTP_HDR_FLAG_TO))
 505			msk = mctp_lookup_bind(net, skb);
 506
 507		if (!msk) {
 508			rc = -ENOENT;
 509			goto out_unlock;
 510		}
 511
 512		/* single-packet message? deliver to socket, clean up any
 513		 * pending key.
 514		 */
 515		if (flags & MCTP_HDR_FLAG_EOM) {
 516			rc = sock_queue_rcv_skb(&msk->sk, skb);
 517			if (!rc)
 518				skb = NULL;
 519			if (key) {
 520				/* we've hit a pending reassembly; not much we
 521				 * can do but drop it
 522				 */
 523				__mctp_key_done_in(key, net, f,
 524						   MCTP_TRACE_KEY_REPLIED);
 525				key = NULL;
 526			}
 527			goto out_unlock;
 528		}
 529
 530		/* broadcast response or a bind() - create a key for further
 531		 * packets for this message
 532		 */
 533		if (!key) {
 534			key = mctp_key_alloc(msk, netid, mh->dest, mh->src,
 535					     tag, GFP_ATOMIC);
 536			if (!key) {
 537				rc = -ENOMEM;
 538				goto out_unlock;
 539			}
 540
 541			/* we can queue without the key lock here, as the
 542			 * key isn't observable yet
 543			 */
 544			mctp_frag_queue(key, skb);
 545			skb = NULL;
 546
 547			/* if the key_add fails, we've raced with another
 548			 * SOM packet with the same src, dest and tag. There's
 549			 * no way to distinguish future packets, so all we
 550			 * can do is drop.
 551			 */
 552			rc = mctp_key_add(key, msk);
 553			if (!rc)
 554				trace_mctp_key_acquire(key);
 555
 556			/* we don't need to release key->lock on exit, so
 557			 * clean up here and suppress the unlock via
 558			 * setting to NULL
 559			 */
 560			mctp_key_unref(key);
 561			key = NULL;
 562
 563		} else {
 564			if (key->reasm_head || key->reasm_dead) {
 565				/* duplicate start? drop everything */
 566				__mctp_key_done_in(key, net, f,
 567						   MCTP_TRACE_KEY_INVALIDATED);
 568				rc = -EEXIST;
 569				key = NULL;
 570			} else {
 571				rc = mctp_frag_queue(key, skb);
 572				skb = NULL;
 573			}
 574		}
 575
 576	} else if (key) {
 577		/* this packet continues a previous message; reassemble
 578		 * using the message-specific key
 579		 */
 580
 581		/* we need to be continuing an existing reassembly... */
 582		if (!key->reasm_head) {
 583			rc = -EINVAL;
 584		} else {
 585			rc = mctp_frag_queue(key, skb);
 586			skb = NULL;
 587		}
 588
 589		if (rc)
 590			goto out_unlock;
 591
 592		/* end of message? deliver to socket, and we're done with
 593		 * the reassembly/response key
 594		 */
 595		if (flags & MCTP_HDR_FLAG_EOM) {
 596			rc = sock_queue_rcv_skb(key->sk, key->reasm_head);
 597			if (!rc)
 598				key->reasm_head = NULL;
 599			__mctp_key_done_in(key, net, f, MCTP_TRACE_KEY_REPLIED);
 600			key = NULL;
 601		}
 602
 603	} else {
 604		/* not a start, no matching key */
 605		rc = -ENOENT;
 606	}
 607
 608out_unlock:
 609	rcu_read_unlock();
 610	if (key) {
 611		spin_unlock_irqrestore(&key->lock, f);
 612		mctp_key_unref(key);
 613	}
 614	if (any_key)
 615		mctp_key_unref(any_key);
 616out:
 617	kfree_skb(skb);
 618	return rc;
 619}
 620
 621static int mctp_dst_output(struct mctp_dst *dst, struct sk_buff *skb)
 622{
 623	char daddr_buf[MAX_ADDR_LEN];
 624	char *daddr = NULL;
 625	int rc;
 626
 627	skb->protocol = htons(ETH_P_MCTP);
 628	skb->pkt_type = PACKET_OUTGOING;
 629	skb->dev = dst->dev->dev;
 630
 631	if (skb->len > dst->mtu) {
 632		kfree_skb(skb);
 633		return -EMSGSIZE;
 634	}
 635
 636	/* direct route; use the hwaddr we stashed in sendmsg */
 637	if (dst->halen) {
 638		if (dst->halen != skb->dev->addr_len) {
 639			/* sanity check, sendmsg should have already caught this */
 640			kfree_skb(skb);
 641			return -EMSGSIZE;
 642		}
 643		daddr = dst->haddr;
 644	} else {
 645		/* If lookup fails let the device handle daddr==NULL */
 646		if (mctp_neigh_lookup(dst->dev, dst->nexthop, daddr_buf) == 0)
 647			daddr = daddr_buf;
 648	}
 649
 650	rc = dev_hard_header(skb, skb->dev, ntohs(skb->protocol),
 651			     daddr, skb->dev->dev_addr, skb->len);
 652	if (rc < 0) {
 653		kfree_skb(skb);
 654		return -EHOSTUNREACH;
 655	}
 656
 657	mctp_flow_prepare_output(skb, dst->dev);
 658
 659	rc = dev_queue_xmit(skb);
 660	if (rc)
 661		rc = net_xmit_errno(rc);
 662
 663	return rc;
 664}
 665
 666/* route alloc/release */
 667static void mctp_route_release(struct mctp_route *rt)
 668{
 669	if (refcount_dec_and_test(&rt->refs)) {
 670		if (rt->dst_type == MCTP_ROUTE_DIRECT)
 671			mctp_dev_put(rt->dev);
 672		kfree_rcu(rt, rcu);
 673	}
 674}
 675
 676/* returns a route with the refcount at 1 */
 677static struct mctp_route *mctp_route_alloc(void)
 678{
 679	struct mctp_route *rt;
 680
 681	rt = kzalloc(sizeof(*rt), GFP_KERNEL);
 682	if (!rt)
 683		return NULL;
 684
 685	INIT_LIST_HEAD(&rt->list);
 686	refcount_set(&rt->refs, 1);
 687	rt->output = mctp_dst_discard;
 688
 689	return rt;
 690}
 691
 692unsigned int mctp_default_net(struct net *net)
 693{
 694	return READ_ONCE(net->mctp.default_net);
 695}
 696
 697int mctp_default_net_set(struct net *net, unsigned int index)
 698{
 699	if (index == 0)
 700		return -EINVAL;
 701	WRITE_ONCE(net->mctp.default_net, index);
 702	return 0;
 703}
 704
 705/* tag management */
 706static void mctp_reserve_tag(struct net *net, struct mctp_sk_key *key,
 707			     struct mctp_sock *msk)
 708{
 709	struct netns_mctp *mns = &net->mctp;
 710
 711	lockdep_assert_held(&mns->keys_lock);
 712
 713	key->expiry = jiffies + mctp_key_lifetime;
 714	timer_reduce(&msk->key_expiry, key->expiry);
 715
 716	/* we hold the net->key_lock here, allowing updates to both
 717	 * then net and sk
 718	 */
 719	hlist_add_head_rcu(&key->hlist, &mns->keys);
 720	hlist_add_head_rcu(&key->sklist, &msk->keys);
 721	refcount_inc(&key->refs);
 722}
 723
 724/* Allocate a locally-owned tag value for (local, peer), and reserve
 725 * it for the socket msk
 726 */
 727struct mctp_sk_key *mctp_alloc_local_tag(struct mctp_sock *msk,
 728					 unsigned int netid,
 729					 mctp_eid_t local, mctp_eid_t peer,
 730					 bool manual, u8 *tagp)
 731{
 732	struct net *net = sock_net(&msk->sk);
 733	struct netns_mctp *mns = &net->mctp;
 734	struct mctp_sk_key *key, *tmp;
 735	unsigned long flags;
 736	u8 tagbits;
 737
 738	/* for NULL destination EIDs, we may get a response from any peer */
 739	if (peer == MCTP_ADDR_NULL)
 740		peer = MCTP_ADDR_ANY;
 741
 742	/* be optimistic, alloc now */
 743	key = mctp_key_alloc(msk, netid, local, peer, 0, GFP_KERNEL);
 744	if (!key)
 745		return ERR_PTR(-ENOMEM);
 746
 747	/* 8 possible tag values */
 748	tagbits = 0xff;
 749
 750	spin_lock_irqsave(&mns->keys_lock, flags);
 751
 752	/* Walk through the existing keys, looking for potential conflicting
 753	 * tags. If we find a conflict, clear that bit from tagbits
 754	 */
 755	hlist_for_each_entry(tmp, &mns->keys, hlist) {
 756		/* We can check the lookup fields (*_addr, tag) without the
 757		 * lock held, they don't change over the lifetime of the key.
 758		 */
 759
 760		/* tags are net-specific */
 761		if (tmp->net != netid)
 762			continue;
 763
 764		/* if we don't own the tag, it can't conflict */
 765		if (tmp->tag & MCTP_HDR_FLAG_TO)
 766			continue;
 767
 768		/* Since we're avoiding conflicting entries, match peer and
 769		 * local addresses, including with a wildcard on ANY. See
 770		 * 'A note on key allocations' for background.
 771		 */
 772		if (peer != MCTP_ADDR_ANY &&
 773		    !mctp_address_matches(tmp->peer_addr, peer))
 774			continue;
 775
 776		if (local != MCTP_ADDR_ANY &&
 777		    !mctp_address_matches(tmp->local_addr, local))
 778			continue;
 779
 780		spin_lock(&tmp->lock);
 781		/* key must still be valid. If we find a match, clear the
 782		 * potential tag value
 783		 */
 784		if (tmp->valid)
 785			tagbits &= ~(1 << tmp->tag);
 786		spin_unlock(&tmp->lock);
 787
 788		if (!tagbits)
 789			break;
 790	}
 791
 792	if (tagbits) {
 793		key->tag = __ffs(tagbits);
 794		mctp_reserve_tag(net, key, msk);
 795		trace_mctp_key_acquire(key);
 796
 797		key->manual_alloc = manual;
 798		*tagp = key->tag;
 799	}
 800
 801	spin_unlock_irqrestore(&mns->keys_lock, flags);
 802
 803	if (!tagbits) {
 804		mctp_key_unref(key);
 805		return ERR_PTR(-EBUSY);
 806	}
 807
 808	return key;
 809}
 810
 811static struct mctp_sk_key *mctp_lookup_prealloc_tag(struct mctp_sock *msk,
 812						    unsigned int netid,
 813						    mctp_eid_t daddr,
 814						    u8 req_tag, u8 *tagp)
 815{
 816	struct net *net = sock_net(&msk->sk);
 817	struct netns_mctp *mns = &net->mctp;
 818	struct mctp_sk_key *key, *tmp;
 819	unsigned long flags;
 820
 821	req_tag &= ~(MCTP_TAG_PREALLOC | MCTP_TAG_OWNER);
 822	key = NULL;
 823
 824	spin_lock_irqsave(&mns->keys_lock, flags);
 825
 826	hlist_for_each_entry(tmp, &mns->keys, hlist) {
 827		if (tmp->net != netid)
 828			continue;
 829
 830		if (tmp->tag != req_tag)
 831			continue;
 832
 833		if (!mctp_address_matches(tmp->peer_addr, daddr))
 834			continue;
 835
 836		if (!tmp->manual_alloc)
 837			continue;
 838
 839		spin_lock(&tmp->lock);
 840		if (tmp->valid) {
 841			key = tmp;
 842			refcount_inc(&key->refs);
 843			spin_unlock(&tmp->lock);
 844			break;
 845		}
 846		spin_unlock(&tmp->lock);
 847	}
 848	spin_unlock_irqrestore(&mns->keys_lock, flags);
 849
 850	if (!key)
 851		return ERR_PTR(-ENOENT);
 852
 853	if (tagp)
 854		*tagp = key->tag;
 855
 856	return key;
 857}
 858
 859/* routing lookups */
 860static unsigned int mctp_route_netid(struct mctp_route *rt)
 861{
 862	return rt->dst_type == MCTP_ROUTE_DIRECT ?
 863		READ_ONCE(rt->dev->net) : rt->gateway.net;
 864}
 865
 866static bool mctp_rt_match_eid(struct mctp_route *rt,
 867			      unsigned int net, mctp_eid_t eid)
 868{
 869	return mctp_route_netid(rt) == net &&
 870		rt->min <= eid && rt->max >= eid;
 871}
 872
 873/* compares match, used for duplicate prevention */
 874static bool mctp_rt_compare_exact(struct mctp_route *rt1,
 875				  struct mctp_route *rt2)
 876{
 877	ASSERT_RTNL();
 878	return mctp_route_netid(rt1) == mctp_route_netid(rt2) &&
 879		rt1->min == rt2->min &&
 880		rt1->max == rt2->max;
 881}
 882
 883/* must only be called on a direct route, as the final output hop */
 884static void mctp_dst_from_route(struct mctp_dst *dst, mctp_eid_t eid,
 885				unsigned int mtu, struct mctp_route *route)
 886{
 887	mctp_dev_hold(route->dev);
 888	dst->nexthop = eid;
 889	dst->dev = route->dev;
 890	dst->mtu = READ_ONCE(dst->dev->dev->mtu);
 891	if (mtu)
 892		dst->mtu = min(dst->mtu, mtu);
 893	dst->halen = 0;
 894	dst->output = route->output;
 895}
 896
 897int mctp_dst_from_extaddr(struct mctp_dst *dst, struct net *net, int ifindex,
 898			  unsigned char halen, const unsigned char *haddr)
 899{
 900	struct net_device *netdev;
 901	struct mctp_dev *dev;
 902	int rc = -ENOENT;
 903
 904	if (halen > sizeof(dst->haddr))
 905		return -EINVAL;
 906
 907	rcu_read_lock();
 908
 909	netdev = dev_get_by_index_rcu(net, ifindex);
 910	if (!netdev)
 911		goto out_unlock;
 912
 913	if (netdev->addr_len != halen) {
 914		rc = -EINVAL;
 915		goto out_unlock;
 916	}
 917
 918	dev = __mctp_dev_get(netdev);
 919	if (!dev)
 920		goto out_unlock;
 921
 922	dst->dev = dev;
 923	dst->mtu = READ_ONCE(netdev->mtu);
 924	dst->halen = halen;
 925	dst->output = mctp_dst_output;
 926	dst->nexthop = 0;
 927	memcpy(dst->haddr, haddr, halen);
 928
 929	rc = 0;
 930
 931out_unlock:
 932	rcu_read_unlock();
 933	return rc;
 934}
 935
 936void mctp_dst_release(struct mctp_dst *dst)
 937{
 938	mctp_dev_put(dst->dev);
 939}
 940
 941static struct mctp_route *mctp_route_lookup_single(struct net *net,
 942						   unsigned int dnet,
 943						   mctp_eid_t daddr)
 944{
 945	struct mctp_route *rt;
 946
 947	list_for_each_entry_rcu(rt, &net->mctp.routes, list) {
 948		if (mctp_rt_match_eid(rt, dnet, daddr))
 949			return rt;
 950	}
 951
 952	return NULL;
 953}
 954
 955/* populates *dst on successful lookup, if set */
 956int mctp_route_lookup(struct net *net, unsigned int dnet,
 957		      mctp_eid_t daddr, struct mctp_dst *dst)
 958{
 959	const unsigned int max_depth = 32;
 960	unsigned int depth, mtu = 0;
 961	int rc = -EHOSTUNREACH;
 962
 963	rcu_read_lock();
 964
 965	for (depth = 0; depth < max_depth; depth++) {
 966		struct mctp_route *rt;
 967
 968		rt = mctp_route_lookup_single(net, dnet, daddr);
 969		if (!rt)
 970			break;
 971
 972		/* clamp mtu to the smallest in the path, allowing 0
 973		 * to specify no restrictions
 974		 */
 975		if (mtu && rt->mtu)
 976			mtu = min(mtu, rt->mtu);
 977		else
 978			mtu = mtu ?: rt->mtu;
 979
 980		if (rt->dst_type == MCTP_ROUTE_DIRECT) {
 981			if (dst)
 982				mctp_dst_from_route(dst, daddr, mtu, rt);
 983			rc = 0;
 984			break;
 985
 986		} else if (rt->dst_type == MCTP_ROUTE_GATEWAY) {
 987			daddr = rt->gateway.eid;
 988		}
 989	}
 990
 991	rcu_read_unlock();
 992
 993	return rc;
 994}
 995
 996static int mctp_route_lookup_null(struct net *net, struct net_device *dev,
 997				  struct mctp_dst *dst)
 998{
 999	int rc = -EHOSTUNREACH;
1000	struct mctp_route *rt;
1001
1002	rcu_read_lock();
1003
1004	list_for_each_entry_rcu(rt, &net->mctp.routes, list) {
1005		if (rt->dst_type != MCTP_ROUTE_DIRECT || rt->type != RTN_LOCAL)
1006			continue;
1007
1008		if (rt->dev->dev != dev)
1009			continue;
1010
1011		mctp_dst_from_route(dst, 0, 0, rt);
1012		rc = 0;
1013		break;
1014	}
1015
1016	rcu_read_unlock();
1017
1018	return rc;
1019}
1020
1021static int mctp_do_fragment_route(struct mctp_dst *dst, struct sk_buff *skb,
1022				  unsigned int mtu, u8 tag)
1023{
1024	const unsigned int hlen = sizeof(struct mctp_hdr);
1025	struct mctp_hdr *hdr, *hdr2;
1026	unsigned int pos, size, headroom;
1027	struct sk_buff *skb2;
1028	int rc;
1029	u8 seq;
1030
1031	hdr = mctp_hdr(skb);
1032	seq = 0;
1033	rc = 0;
1034
1035	if (mtu < hlen + 1) {
1036		kfree_skb(skb);
1037		return -EMSGSIZE;
1038	}
1039
1040	/* keep same headroom as the original skb */
1041	headroom = skb_headroom(skb);
1042
1043	/* we've got the header */
1044	skb_pull(skb, hlen);
1045
1046	for (pos = 0; pos < skb->len;) {
1047		/* size of message payload */
1048		size = min(mtu - hlen, skb->len - pos);
1049
1050		skb2 = alloc_skb(headroom + hlen + size, GFP_KERNEL);
1051		if (!skb2) {
1052			rc = -ENOMEM;
1053			break;
1054		}
1055
1056		/* generic skb copy */
1057		skb2->protocol = skb->protocol;
1058		skb2->priority = skb->priority;
1059		skb2->dev = skb->dev;
1060		memcpy(skb2->cb, skb->cb, sizeof(skb2->cb));
1061
1062		if (skb->sk)
1063			skb_set_owner_w(skb2, skb->sk);
1064
1065		/* establish packet */
1066		skb_reserve(skb2, headroom);
1067		skb_reset_network_header(skb2);
1068		skb_put(skb2, hlen + size);
1069		skb2->transport_header = skb2->network_header + hlen;
1070
1071		/* copy header fields, calculate SOM/EOM flags & seq */
1072		hdr2 = mctp_hdr(skb2);
1073		hdr2->ver = hdr->ver;
1074		hdr2->dest = hdr->dest;
1075		hdr2->src = hdr->src;
1076		hdr2->flags_seq_tag = tag &
1077			(MCTP_HDR_TAG_MASK | MCTP_HDR_FLAG_TO);
1078
1079		if (pos == 0)
1080			hdr2->flags_seq_tag |= MCTP_HDR_FLAG_SOM;
1081
1082		if (pos + size == skb->len)
1083			hdr2->flags_seq_tag |= MCTP_HDR_FLAG_EOM;
1084
1085		hdr2->flags_seq_tag |= seq << MCTP_HDR_SEQ_SHIFT;
1086
1087		/* copy message payload */
1088		skb_copy_bits(skb, pos, skb_transport_header(skb2), size);
1089
1090		/* we need to copy the extensions, for MCTP flow data */
1091		skb_ext_copy(skb2, skb);
1092
1093		/* do route */
1094		rc = dst->output(dst, skb2);
1095		if (rc)
1096			break;
1097
1098		seq = (seq + 1) & MCTP_HDR_SEQ_MASK;
1099		pos += size;
1100	}
1101
1102	consume_skb(skb);
1103	return rc;
1104}
1105
1106int mctp_local_output(struct sock *sk, struct mctp_dst *dst,
1107		      struct sk_buff *skb, mctp_eid_t daddr, u8 req_tag)
1108{
1109	struct mctp_sock *msk = container_of(sk, struct mctp_sock, sk);
1110	struct mctp_sk_key *key;
1111	struct mctp_hdr *hdr;
1112	unsigned long flags;
1113	unsigned int netid;
1114	unsigned int mtu;
1115	mctp_eid_t saddr;
1116	int rc;
1117	u8 tag;
1118
1119	KUNIT_STATIC_STUB_REDIRECT(mctp_local_output, sk, dst, skb, daddr,
1120				   req_tag);
1121
1122	rc = -ENODEV;
1123
1124	spin_lock_irqsave(&dst->dev->addrs_lock, flags);
1125	if (dst->dev->num_addrs == 0) {
1126		rc = -EHOSTUNREACH;
1127	} else {
1128		/* use the outbound interface's first address as our source */
1129		saddr = dst->dev->addrs[0];
1130		rc = 0;
1131	}
1132	spin_unlock_irqrestore(&dst->dev->addrs_lock, flags);
1133	netid = READ_ONCE(dst->dev->net);
1134
1135	if (rc)
1136		goto out_release;
1137
1138	if (req_tag & MCTP_TAG_OWNER) {
1139		if (req_tag & MCTP_TAG_PREALLOC)
1140			key = mctp_lookup_prealloc_tag(msk, netid, daddr,
1141						       req_tag, &tag);
1142		else
1143			key = mctp_alloc_local_tag(msk, netid, saddr, daddr,
1144						   false, &tag);
1145
1146		if (IS_ERR(key)) {
1147			rc = PTR_ERR(key);
1148			goto out_release;
1149		}
1150		mctp_skb_set_flow(skb, key);
1151		/* done with the key in this scope */
1152		mctp_key_unref(key);
1153		tag |= MCTP_HDR_FLAG_TO;
1154	} else {
1155		key = NULL;
1156		tag = req_tag & MCTP_TAG_MASK;
1157	}
1158
1159	skb->pkt_type = PACKET_OUTGOING;
1160	skb->protocol = htons(ETH_P_MCTP);
1161	skb->priority = 0;
1162	skb_reset_transport_header(skb);
1163	skb_push(skb, sizeof(struct mctp_hdr));
1164	skb_reset_network_header(skb);
1165	skb->dev = dst->dev->dev;
1166
1167	/* set up common header fields */
1168	hdr = mctp_hdr(skb);
1169	hdr->ver = 1;
1170	hdr->dest = daddr;
1171	hdr->src = saddr;
1172
1173	mtu = dst->mtu;
1174
1175	if (skb->len + sizeof(struct mctp_hdr) <= mtu) {
1176		hdr->flags_seq_tag = MCTP_HDR_FLAG_SOM |
1177			MCTP_HDR_FLAG_EOM | tag;
1178		rc = dst->output(dst, skb);
1179	} else {
1180		rc = mctp_do_fragment_route(dst, skb, mtu, tag);
1181	}
1182
1183	/* route output functions consume the skb, even on error */
1184	skb = NULL;
1185
1186out_release:
1187	kfree_skb(skb);
1188	return rc;
1189}
1190
1191/* route management */
1192
1193/* mctp_route_add(): Add the provided route, previously allocated via
1194 * mctp_route_alloc(). On success, takes ownership of @rt, which includes a
1195 * hold on rt->dev for usage in the route table. On failure a caller will want
1196 * to mctp_route_release().
1197 *
1198 * We expect that the caller has set rt->type, rt->dst_type, rt->min, rt->max,
1199 * rt->mtu and either rt->dev (with a reference held appropriately) or
1200 * rt->gateway. Other fields will be populated.
1201 */
1202static int mctp_route_add(struct net *net, struct mctp_route *rt)
1203{
1204	struct mctp_route *ert;
1205
1206	if (!mctp_address_unicast(rt->min) || !mctp_address_unicast(rt->max))
1207		return -EINVAL;
1208
1209	if (rt->dst_type == MCTP_ROUTE_DIRECT && !rt->dev)
1210		return -EINVAL;
1211
1212	if (rt->dst_type == MCTP_ROUTE_GATEWAY && !rt->gateway.eid)
1213		return -EINVAL;
1214
1215	switch (rt->type) {
1216	case RTN_LOCAL:
1217		rt->output = mctp_dst_input;
1218		break;
1219	case RTN_UNICAST:
1220		rt->output = mctp_dst_output;
1221		break;
1222	default:
1223		return -EINVAL;
1224	}
1225
1226	ASSERT_RTNL();
1227
1228	/* Prevent duplicate identical routes. */
1229	list_for_each_entry(ert, &net->mctp.routes, list) {
1230		if (mctp_rt_compare_exact(rt, ert)) {
1231			return -EEXIST;
1232		}
1233	}
1234
1235	list_add_rcu(&rt->list, &net->mctp.routes);
1236
1237	return 0;
1238}
1239
1240static int mctp_route_remove(struct net *net, unsigned int netid,
1241			     mctp_eid_t daddr_start, unsigned int daddr_extent,
1242			     unsigned char type)
1243{
1244	struct mctp_route *rt, *tmp;
1245	mctp_eid_t daddr_end;
1246	bool dropped;
1247
1248	if (daddr_extent > 0xff || daddr_start + daddr_extent >= 255)
1249		return -EINVAL;
1250
1251	daddr_end = daddr_start + daddr_extent;
1252	dropped = false;
1253
1254	ASSERT_RTNL();
1255
1256	list_for_each_entry_safe(rt, tmp, &net->mctp.routes, list) {
1257		if (mctp_route_netid(rt) == netid &&
1258		    rt->min == daddr_start && rt->max == daddr_end &&
1259		    rt->type == type) {
1260			list_del_rcu(&rt->list);
1261			/* TODO: immediate RTM_DELROUTE */
1262			mctp_route_release(rt);
1263			dropped = true;
1264		}
1265	}
1266
1267	return dropped ? 0 : -ENOENT;
1268}
1269
1270int mctp_route_add_local(struct mctp_dev *mdev, mctp_eid_t addr)
1271{
1272	struct mctp_route *rt;
1273	int rc;
1274
1275	rt = mctp_route_alloc();
1276	if (!rt)
1277		return -ENOMEM;
1278
1279	rt->min = addr;
1280	rt->max = addr;
1281	rt->dst_type = MCTP_ROUTE_DIRECT;
1282	rt->dev = mdev;
1283	rt->type = RTN_LOCAL;
1284
1285	mctp_dev_hold(rt->dev);
1286
1287	rc = mctp_route_add(dev_net(mdev->dev), rt);
1288	if (rc)
1289		mctp_route_release(rt);
1290
1291	return rc;
1292}
1293
1294int mctp_route_remove_local(struct mctp_dev *mdev, mctp_eid_t addr)
1295{
1296	return mctp_route_remove(dev_net(mdev->dev), mdev->net,
1297				 addr, 0, RTN_LOCAL);
1298}
1299
1300/* removes all entries for a given device */
1301void mctp_route_remove_dev(struct mctp_dev *mdev)
1302{
1303	struct net *net = dev_net(mdev->dev);
1304	struct mctp_route *rt, *tmp;
1305
1306	ASSERT_RTNL();
1307	list_for_each_entry_safe(rt, tmp, &net->mctp.routes, list) {
1308		if (rt->dst_type == MCTP_ROUTE_DIRECT && rt->dev == mdev) {
1309			list_del_rcu(&rt->list);
1310			/* TODO: immediate RTM_DELROUTE */
1311			mctp_route_release(rt);
1312		}
1313	}
1314}
1315
1316/* Incoming packet-handling */
1317
1318static int mctp_pkttype_receive(struct sk_buff *skb, struct net_device *dev,
1319				struct packet_type *pt,
1320				struct net_device *orig_dev)
1321{
1322	struct net *net = dev_net(dev);
1323	struct mctp_dev *mdev;
1324	struct mctp_skb_cb *cb;
1325	struct mctp_dst dst;
1326	struct mctp_hdr *mh;
1327	int rc;
1328
1329	rcu_read_lock();
1330	mdev = __mctp_dev_get(dev);
1331	rcu_read_unlock();
1332	if (!mdev) {
1333		/* basic non-data sanity checks */
1334		goto err_drop;
1335	}
1336
1337	if (!pskb_may_pull(skb, sizeof(struct mctp_hdr)))
1338		goto err_drop;
1339
1340	skb_reset_transport_header(skb);
1341	skb_reset_network_header(skb);
1342
1343	/* We have enough for a header; decode and route */
1344	mh = mctp_hdr(skb);
1345	if (mh->ver < MCTP_VER_MIN || mh->ver > MCTP_VER_MAX)
1346		goto err_drop;
1347
1348	/* source must be valid unicast or null; drop reserved ranges and
1349	 * broadcast
1350	 */
1351	if (!(mctp_address_unicast(mh->src) || mctp_address_null(mh->src)))
1352		goto err_drop;
1353
1354	/* dest address: as above, but allow broadcast */
1355	if (!(mctp_address_unicast(mh->dest) || mctp_address_null(mh->dest) ||
1356	      mctp_address_broadcast(mh->dest)))
1357		goto err_drop;
1358
1359	/* MCTP drivers must populate halen/haddr */
1360	if (dev->type == ARPHRD_MCTP) {
1361		cb = mctp_cb(skb);
1362	} else {
1363		cb = __mctp_cb(skb);
1364		cb->halen = 0;
1365	}
1366	cb->net = READ_ONCE(mdev->net);
1367	cb->ifindex = dev->ifindex;
1368
1369	rc = mctp_route_lookup(net, cb->net, mh->dest, &dst);
1370
1371	/* NULL EID, but addressed to our physical address */
1372	if (rc && mh->dest == MCTP_ADDR_NULL && skb->pkt_type == PACKET_HOST)
1373		rc = mctp_route_lookup_null(net, dev, &dst);
1374
1375	if (rc)
1376		goto err_drop;
1377
1378	dst.output(&dst, skb);
1379	mctp_dst_release(&dst);
1380	mctp_dev_put(mdev);
1381
1382	return NET_RX_SUCCESS;
1383
1384err_drop:
1385	kfree_skb(skb);
1386	mctp_dev_put(mdev);
1387	return NET_RX_DROP;
1388}
1389
1390static struct packet_type mctp_packet_type = {
1391	.type = cpu_to_be16(ETH_P_MCTP),
1392	.func = mctp_pkttype_receive,
1393};
1394
1395/* netlink interface */
1396
1397static const struct nla_policy rta_mctp_policy[RTA_MAX + 1] = {
1398	[RTA_DST]		= { .type = NLA_U8 },
1399	[RTA_METRICS]		= { .type = NLA_NESTED },
1400	[RTA_OIF]		= { .type = NLA_U32 },
1401	[RTA_GATEWAY]		= NLA_POLICY_EXACT_LEN(sizeof(struct mctp_fq_addr)),
1402};
1403
1404static const struct nla_policy rta_metrics_policy[RTAX_MAX + 1] = {
1405	[RTAX_MTU]		= { .type = NLA_U32 },
1406};
1407
1408/* base parsing; common to both _lookup and _populate variants.
1409 *
1410 * For gateway routes (which have a RTA_GATEWAY, and no RTA_OIF), we populate
1411 * *gatweayp. for direct routes (RTA_OIF, no RTA_GATEWAY), we populate *mdev.
1412 */
1413static int mctp_route_nlparse_common(struct net *net, struct nlmsghdr *nlh,
1414				     struct netlink_ext_ack *extack,
1415				     struct nlattr **tb, struct rtmsg **rtm,
1416				     struct mctp_dev **mdev,
1417				     struct mctp_fq_addr *gatewayp,
1418				     mctp_eid_t *daddr_start)
1419{
1420	struct mctp_fq_addr *gateway = NULL;
1421	unsigned int ifindex = 0;
1422	struct net_device *dev;
1423	int rc;
1424
1425	rc = nlmsg_parse(nlh, sizeof(struct rtmsg), tb, RTA_MAX,
1426			 rta_mctp_policy, extack);
1427	if (rc < 0) {
1428		NL_SET_ERR_MSG(extack, "incorrect format");
1429		return rc;
1430	}
1431
1432	if (!tb[RTA_DST]) {
1433		NL_SET_ERR_MSG(extack, "dst EID missing");
1434		return -EINVAL;
1435	}
1436	*daddr_start = nla_get_u8(tb[RTA_DST]);
1437
1438	if (tb[RTA_OIF])
1439		ifindex = nla_get_u32(tb[RTA_OIF]);
1440
1441	if (tb[RTA_GATEWAY])
1442		gateway = nla_data(tb[RTA_GATEWAY]);
1443
1444	if (ifindex && gateway) {
1445		NL_SET_ERR_MSG(extack,
1446			       "cannot specify both ifindex and gateway");
1447		return -EINVAL;
1448
1449	} else if (ifindex) {
1450		dev = __dev_get_by_index(net, ifindex);
1451		if (!dev) {
1452			NL_SET_ERR_MSG(extack, "bad ifindex");
1453			return -ENODEV;
1454		}
1455		*mdev = mctp_dev_get_rtnl(dev);
1456		if (!*mdev)
1457			return -ENODEV;
1458		gatewayp->eid = 0;
1459
1460	} else if (gateway) {
1461		if (!mctp_address_unicast(gateway->eid)) {
1462			NL_SET_ERR_MSG(extack, "bad gateway");
1463			return -EINVAL;
1464		}
1465
1466		gatewayp->eid = gateway->eid;
1467		gatewayp->net = gateway->net != MCTP_NET_ANY ?
1468			gateway->net :
1469			READ_ONCE(net->mctp.default_net);
1470		*mdev = NULL;
1471
1472	} else {
1473		NL_SET_ERR_MSG(extack, "no route output provided");
1474		return -EINVAL;
1475	}
1476
1477	*rtm = nlmsg_data(nlh);
1478	if ((*rtm)->rtm_family != AF_MCTP) {
1479		NL_SET_ERR_MSG(extack, "route family must be AF_MCTP");
1480		return -EINVAL;
1481	}
1482
1483	if ((*rtm)->rtm_type != RTN_UNICAST) {
1484		NL_SET_ERR_MSG(extack, "rtm_type must be RTN_UNICAST");
1485		return -EINVAL;
1486	}
1487
1488	return 0;
1489}
1490
1491/* Route parsing for lookup operations; we only need the "route target"
1492 * components (ie., network and dest-EID range).
1493 */
1494static int mctp_route_nlparse_lookup(struct net *net, struct nlmsghdr *nlh,
1495				     struct netlink_ext_ack *extack,
1496				     unsigned char *type, unsigned int *netid,
1497				     mctp_eid_t *daddr_start,
1498				     unsigned int *daddr_extent)
1499{
1500	struct nlattr *tb[RTA_MAX + 1];
1501	struct mctp_fq_addr gw;
1502	struct mctp_dev *mdev;
1503	struct rtmsg *rtm;
1504	int rc;
1505
1506	rc = mctp_route_nlparse_common(net, nlh, extack, tb, &rtm,
1507				       &mdev, &gw, daddr_start);
1508	if (rc)
1509		return rc;
1510
1511	if (mdev) {
1512		*netid = mdev->net;
1513	} else if (gw.eid) {
1514		*netid = gw.net;
1515	} else {
1516		/* bug: _nlparse_common should not allow this */
1517		return -1;
1518	}
1519
1520	*type = rtm->rtm_type;
1521	*daddr_extent = rtm->rtm_dst_len;
1522
1523	return 0;
1524}
1525
1526/* Full route parse for RTM_NEWROUTE: populate @rt. On success,
1527 * MCTP_ROUTE_DIRECT routes (ie, those with a direct dev) will hold a reference
1528 * to that dev.
1529 */
1530static int mctp_route_nlparse_populate(struct net *net, struct nlmsghdr *nlh,
1531				       struct netlink_ext_ack *extack,
1532				       struct mctp_route *rt)
1533{
1534	struct nlattr *tbx[RTAX_MAX + 1];
1535	struct nlattr *tb[RTA_MAX + 1];
1536	unsigned int daddr_extent;
1537	struct mctp_fq_addr gw;
1538	mctp_eid_t daddr_start;
1539	struct mctp_dev *dev;
1540	struct rtmsg *rtm;
1541	u32 mtu = 0;
1542	int rc;
1543
1544	rc = mctp_route_nlparse_common(net, nlh, extack, tb, &rtm,
1545				       &dev, &gw, &daddr_start);
1546	if (rc)
1547		return rc;
1548
1549	daddr_extent = rtm->rtm_dst_len;
1550
1551	if (daddr_extent > 0xff || daddr_extent + daddr_start >= 255) {
1552		NL_SET_ERR_MSG(extack, "invalid eid range");
1553		return -EINVAL;
1554	}
1555
1556	if (tb[RTA_METRICS]) {
1557		rc = nla_parse_nested(tbx, RTAX_MAX, tb[RTA_METRICS],
1558				      rta_metrics_policy, NULL);
1559		if (rc < 0) {
1560			NL_SET_ERR_MSG(extack, "incorrect RTA_METRICS format");
1561			return rc;
1562		}
1563		if (tbx[RTAX_MTU])
1564			mtu = nla_get_u32(tbx[RTAX_MTU]);
1565	}
1566
1567	rt->type = rtm->rtm_type;
1568	rt->min = daddr_start;
1569	rt->max = daddr_start + daddr_extent;
1570	rt->mtu = mtu;
1571	if (gw.eid) {
1572		rt->dst_type = MCTP_ROUTE_GATEWAY;
1573		rt->gateway.eid = gw.eid;
1574		rt->gateway.net = gw.net;
1575	} else {
1576		rt->dst_type = MCTP_ROUTE_DIRECT;
1577		rt->dev = dev;
1578		mctp_dev_hold(rt->dev);
1579	}
1580
1581	return 0;
1582}
1583
1584static int mctp_newroute(struct sk_buff *skb, struct nlmsghdr *nlh,
1585			 struct netlink_ext_ack *extack)
1586{
1587	struct net *net = sock_net(skb->sk);
1588	struct mctp_route *rt;
1589	int rc;
1590
1591	rt = mctp_route_alloc();
1592	if (!rt)
1593		return -ENOMEM;
1594
1595	rc = mctp_route_nlparse_populate(net, nlh, extack, rt);
1596	if (rc < 0)
1597		goto err_free;
1598
1599	if (rt->dst_type == MCTP_ROUTE_DIRECT &&
1600	    rt->dev->dev->flags & IFF_LOOPBACK) {
1601		NL_SET_ERR_MSG(extack, "no routes to loopback");
1602		rc = -EINVAL;
1603		goto err_free;
1604	}
1605
1606	rc = mctp_route_add(net, rt);
1607	if (!rc)
1608		return 0;
1609
1610err_free:
1611	mctp_route_release(rt);
1612	return rc;
1613}
1614
1615static int mctp_delroute(struct sk_buff *skb, struct nlmsghdr *nlh,
1616			 struct netlink_ext_ack *extack)
1617{
1618	struct net *net = sock_net(skb->sk);
1619	unsigned int netid, daddr_extent;
1620	unsigned char type = RTN_UNSPEC;
1621	mctp_eid_t daddr_start;
1622	int rc;
1623
1624	rc = mctp_route_nlparse_lookup(net, nlh, extack, &type, &netid,
1625				       &daddr_start, &daddr_extent);
1626	if (rc < 0)
1627		return rc;
1628
1629	/* we only have unicast routes */
1630	if (type != RTN_UNICAST)
1631		return -EINVAL;
1632
1633	rc = mctp_route_remove(net, netid, daddr_start, daddr_extent, type);
1634	return rc;
1635}
1636
1637static int mctp_fill_rtinfo(struct sk_buff *skb, struct mctp_route *rt,
1638			    u32 portid, u32 seq, int event, unsigned int flags)
1639{
1640	struct nlmsghdr *nlh;
1641	struct rtmsg *hdr;
1642	void *metrics;
1643
1644	nlh = nlmsg_put(skb, portid, seq, event, sizeof(*hdr), flags);
1645	if (!nlh)
1646		return -EMSGSIZE;
1647
1648	hdr = nlmsg_data(nlh);
1649	memset(hdr, 0, sizeof(*hdr));
1650	hdr->rtm_family = AF_MCTP;
1651
1652	/* we use the _len fields as a number of EIDs, rather than
1653	 * a number of bits in the address
1654	 */
1655	hdr->rtm_dst_len = rt->max - rt->min;
1656	hdr->rtm_src_len = 0;
1657	hdr->rtm_tos = 0;
1658	hdr->rtm_table = RT_TABLE_DEFAULT;
1659	hdr->rtm_protocol = RTPROT_STATIC; /* everything is user-defined */
1660	hdr->rtm_type = rt->type;
1661
1662	if (nla_put_u8(skb, RTA_DST, rt->min))
1663		goto cancel;
1664
1665	metrics = nla_nest_start_noflag(skb, RTA_METRICS);
1666	if (!metrics)
1667		goto cancel;
1668
1669	if (rt->mtu) {
1670		if (nla_put_u32(skb, RTAX_MTU, rt->mtu))
1671			goto cancel;
1672	}
1673
1674	nla_nest_end(skb, metrics);
1675
1676	if (rt->dst_type == MCTP_ROUTE_DIRECT) {
1677		hdr->rtm_scope = RT_SCOPE_LINK;
1678		if (nla_put_u32(skb, RTA_OIF, rt->dev->dev->ifindex))
1679			goto cancel;
1680	} else if (rt->dst_type == MCTP_ROUTE_GATEWAY) {
1681		hdr->rtm_scope = RT_SCOPE_UNIVERSE;
1682		if (nla_put(skb, RTA_GATEWAY,
1683			    sizeof(rt->gateway), &rt->gateway))
1684			goto cancel;
1685	}
1686
1687	nlmsg_end(skb, nlh);
1688
1689	return 0;
1690
1691cancel:
1692	nlmsg_cancel(skb, nlh);
1693	return -EMSGSIZE;
1694}
1695
1696static int mctp_dump_rtinfo(struct sk_buff *skb, struct netlink_callback *cb)
1697{
1698	struct net *net = sock_net(skb->sk);
1699	struct mctp_route *rt;
1700	int s_idx, idx;
1701
1702	/* TODO: allow filtering on route data, possibly under
1703	 * cb->strict_check
1704	 */
1705
1706	/* TODO: change to struct overlay */
1707	s_idx = cb->args[0];
1708	idx = 0;
1709
1710	rcu_read_lock();
1711	list_for_each_entry_rcu(rt, &net->mctp.routes, list) {
1712		if (idx++ < s_idx)
1713			continue;
1714		if (mctp_fill_rtinfo(skb, rt,
1715				     NETLINK_CB(cb->skb).portid,
1716				     cb->nlh->nlmsg_seq,
1717				     RTM_NEWROUTE, NLM_F_MULTI) < 0)
1718			break;
1719	}
1720
1721	rcu_read_unlock();
1722	cb->args[0] = idx;
1723
1724	return skb->len;
1725}
1726
1727/* net namespace implementation */
1728static int __net_init mctp_routes_net_init(struct net *net)
1729{
1730	struct netns_mctp *ns = &net->mctp;
1731
1732	INIT_LIST_HEAD(&ns->routes);
1733	hash_init(ns->binds);
1734	mutex_init(&ns->bind_lock);
1735	INIT_HLIST_HEAD(&ns->keys);
1736	spin_lock_init(&ns->keys_lock);
1737	WARN_ON(mctp_default_net_set(net, MCTP_INITIAL_DEFAULT_NET));
1738	return 0;
1739}
1740
1741static void __net_exit mctp_routes_net_exit(struct net *net)
1742{
1743	struct mctp_route *rt;
1744
1745	rcu_read_lock();
1746	list_for_each_entry_rcu(rt, &net->mctp.routes, list)
1747		mctp_route_release(rt);
1748	rcu_read_unlock();
1749}
1750
1751static struct pernet_operations mctp_net_ops = {
1752	.init = mctp_routes_net_init,
1753	.exit = mctp_routes_net_exit,
1754};
1755
1756static const struct rtnl_msg_handler mctp_route_rtnl_msg_handlers[] = {
1757	{THIS_MODULE, PF_MCTP, RTM_NEWROUTE, mctp_newroute, NULL, 0},
1758	{THIS_MODULE, PF_MCTP, RTM_DELROUTE, mctp_delroute, NULL, 0},
1759	{THIS_MODULE, PF_MCTP, RTM_GETROUTE, NULL, mctp_dump_rtinfo, 0},
1760};
1761
1762int __init mctp_routes_init(void)
1763{
1764	int err;
1765
1766	dev_add_pack(&mctp_packet_type);
1767
1768	err = register_pernet_subsys(&mctp_net_ops);
1769	if (err)
1770		goto err_pernet;
1771
1772	err = rtnl_register_many(mctp_route_rtnl_msg_handlers);
1773	if (err)
1774		goto err_rtnl;
1775
1776	return 0;
1777
1778err_rtnl:
1779	unregister_pernet_subsys(&mctp_net_ops);
1780err_pernet:
1781	dev_remove_pack(&mctp_packet_type);
1782	return err;
1783}
1784
1785void mctp_routes_exit(void)
1786{
1787	rtnl_unregister_many(mctp_route_rtnl_msg_handlers);
1788	unregister_pernet_subsys(&mctp_net_ops);
1789	dev_remove_pack(&mctp_packet_type);
1790}
1791
1792#if IS_ENABLED(CONFIG_MCTP_TEST)
1793#include "test/route-test.c"
1794#endif