CVS log for src/sys/netinet/if_arp.c

Up to [cvs.NetBSD.org] / src / sys / netinet

Request diff between arbitrary revisions

Keyword substitution: kv
Default branch: MAIN

ARP/ND6: Revert prior

Turns out some people actually use this behaviour and strictly speaking
it is allowed by RFC5227 2.4 where it says:

   At any time, if a host receives
   an ARP packet (Request *or* Reply) where the 'sender IP address' is
   (one of) the host's own IP address(es) configured on that interface,
   but the 'sender hardware address' does not match any of the host's
   own interface addresses, then this is a conflicting ARP packet

The key part is "any of the host's own interface addreses".

ARP: only ignore messages from the receving interface

This means that you can no longer share the same IP addresses
on different interfaces connected to the same subnet.
This was a very non standard solution and you can now
get the same functionality by using lagg(4) instead.

While here, flip log movements sysctl back to 1.

This reverts r1.253 and r1.286.

Pull up following revision(s) (requested by ozaki-r in ticket #859):

	tests/net/arp/t_arp.sh: revision 1.47
	tests/net/arp/t_arp.sh: revision 1.48
	sys/netinet/if_arp.c: revision 1.315

arp: allow to send packets without an ARP resolution just after
receiving an ARP request

On receiving an ARP request, the current implemention creates an ARP
cache entry but with ND_LLINFO_NOSTATE.  Such an entry still needs
an ARP resolution to send back a packet to the requester.  The original
behavior before introducing the common ND framework didn't need the
resolution.  IPv6 doesn't as well.  To restore the original behavior,
make a new ARP cache entry with ND_LLINFO_STALE like IPv6 does.

tests: dedup t_arp.sh like others (NFC)

tests: add tests for ARP cache entry creations

arp: allow to send packets without an ARP resolution just after receiving an ARP request

On receiving an ARP request, the current implemention creates an ARP
cache entry but with ND_LLINFO_NOSTATE.  Such an entry still needs
an ARP resolution to send back a packet to the requester.  The original
behavior before introducing the common ND framework didn't need the
resolution.  IPv6 doesn't as well.  To restore the original behavior,
make a new ARP cache entry with ND_LLINFO_STALE like IPv6 does.

Pull up following revision(s) (requested by ozaki-r in ticket #1883):

	tests/net/arp/t_dad.sh: revision 1.16
	sys/netinet/in.c: revision 1.248
	tests/net/arp/t_arp.sh: revision 1.46
	sys/netinet/if_arp.c: revision 1.314

arp: fix the behavior on detecting an address duplication without IPv4 DAD

On receiving an ARP request that has the same source protocol address as
the own address, i.e., address duplication, the original behavior of
a kernel prior to supporing IPv4 DAD is to send an ARP reply.   It is
the same with a latest kernel with DAD enabled.  However, a latest
kernel without DAD sends back an GARP packet.  Restore the original
behavior.

inet: send GARP on link up if DAD is disabled

This behavior was accidentally removed at rev 1.233.

tests, arp: add tests of address duplications without DAD

tests, arp: add tests for GARP on link up

Pull up following revision(s) (requested by ozaki-r in ticket #812):

	tests/net/arp/t_dad.sh: revision 1.16
	sys/netinet/in.c: revision 1.248
	tests/net/arp/t_arp.sh: revision 1.46
	sys/netinet/if_arp.c: revision 1.314

arp: fix the behavior on detecting an address duplication without IPv4 DAD

On receiving an ARP request that has the same source protocol address as
the own address, i.e., address duplication, the original behavior of
a kernel prior to supporing IPv4 DAD is to send an ARP reply.   It is
the same with a latest kernel with DAD enabled.  However, a latest
kernel without DAD sends back an GARP packet.  Restore the original
behavior.

inet: send GARP on link up if DAD is disabled

This behavior was accidentally removed at rev 1.233.

tests, arp: add tests of address duplications without DAD

tests, arp: add tests for GARP on link up

arp: fix the behavior on detecting an address duplication without IPv4 DAD

On receiving an ARP request that has the same source protocol address as
the own address, i.e., address duplication, the original behavior of
a kernel prior to supporing IPv4 DAD is to send an ARP reply.   It is
the same with a latest kernel with DAD enabled.  However, a latest
kernel without DAD sends back an GARP packet.  Restore the original
behavior.

netinet: Use _NET_STAT* API instead of direct array access.

PR kern/58380

Pull up following revision(s) (requested by riastradh in ticket #618):

	sys/netinet/if_arp.c: revision 1.312

Attribute debug message.
Fixes PR 57959

Attribute debug message.
Fixes PR 57959

arp: Validate ARP source hardware address matches Ethernet source

RFC 5227 section 1.1 states that for a DaD ARP probe the sender hardware
address must match the hardware address of the interface sending the
packet.

We can now verify this by checking the mbuf tag PACKET_TAG_ETHERNET_SRC.

This fixes an obsure issue where an old router was sending out bogus
ARP probes.

Thanks to Ryo Shimizu <ryo@nerv.org> for the re-implementation.

Revert prior.

arp: Validate L2 sender hardware address matches ARP probe

RFC 5227 section 1.1 states that for a DaD ARP probe the sender hardware
address must match the hardware address of the interface sending the
packet.

We can now verify this by checking the mbuf packet header.

This fixes an obsure issue where an old router was sending out bogus
ARP probes.

Convert ARP from a legacy netisr to pktqueue.

Sync with HEAD.

- Make ALIGNED_POINTER use __alignof(t) instead of sizeof(t). This is more
  correct because it works with non-primitive types and provides the ABI
  alignment for the type the compiler will use.
- Remove all the *_HDR_ALIGNMENT macros and asserts
- Replace POINTER_ALIGNED_P with ACCESSIBLE_POINTER which is identical to
  ALIGNED_POINTER, but returns that the pointer is always aligned if the
  CPU supports unaligned accesses.
[ as proposed in tech-kern ]

One more time: backout arp header alignment, now that the alignment
asserted has been aligned to reality.
Also remove unused ARP_HDR_ALIGNED_P macro. Pointed out by roy.

Undo previous backout: alignment is needed here.
The reason for the previous backout was a misunderstanding (POINTER_ALIGNED_P
was broken, but the assertion fired even after it got fixed).

Undo previous; POINTER_ALIGNED_P was broken.

put back alignment (reported by martin@)

- centralize header align and pullup into a single inline function
- use a single macro to align pointers and expose the alignment, instead
  of hard-coding 3 in 1/2 the macros.
- fix an issue in the ipv6 lt2p where it was aligning for ipv4 and pulling
  for ipv6.

if_arp: Just KASSERT that arphrd is aligned

While here improve readability of checking ARP IEEE1394 matches interface.

Prior alignment fixes should not use an offset

if_arp: Ensure that arphdr is aligned

arp: Plug an mbuf leak

Implement RFC 7048, making Neighbor Unreachability Detection less impatient

RFC 7048 Section 3 says in the UNREACHABLE state packets continue to be
sent to the link-layer address and then backoff exponentially.
We adjust this slightly and move to the INCOMPLETE state after
`nd_mmaxtries` probes and then start backing off.

This results in simpler code whilst providing a more robust model which
doubles the time to failure over what we did before.
We don't want to be back to the old ARP model where no unreachability
errors are returned because very few applications would look at
unreachability hints provided such as ND_LLINFO_UNREACHABLE or RTM_MISS.

nd: Name l3addr union of llentry and use in-place of nd_addr.

Probably makes more sense and makes nd.h less messy.

ARP: Use ND rather than our own.

This brings the benefit of Neighbour Unreachability Detection which is
something ARP sorely lacks.

The new timings mirror those of IPv6 and are adjustable via sysctl(8).
Unlike IPv6 ND, these are global and not per interface.

Mostly merge changes from HEAD upto 20200411

route: RTM_MISS now puts the message source address in RTA_AUTHOR

route(8) also reports this.
A userland app could use this to blacklist nodes who probe for machines
that doesn't exist on a subnet / prefix.

arp: report RTM_MISS when removing an unresolved entry in the arp table

Otherwise we only get it when renewing and we've sent too many requests.
This mirrors INET6 behaviour.

Sync with head.

Pull up following revision(s) (requested by roy in ticket #645):

	sys/netinet/if_arp.c: revision 1.292

arp: find source address then target address when processing input

This fixes the case where another host having a duplicate ip address
starts using it right away without probing for it's availability.

While here, prefer ifatoia over a strict cast.

arp: find source address then target address when processing input

This fixes the case where another host having a duplicate ip address
starts using it right away without probing for it's availability.

While here, prefer ifatoia over a strict cast.

Remove FDDI support.

Remove Token Ring support.

Pull up following revision(s) (requested by roy in ticket #300):

	sys/netinet/if_arp.c: revision 1.289

ARP: Don't defend ARP probes.

We should let the nature of ARP takes it's course here when our address
is neither tentative nor duplicated.
This allows the host to work with ARP ping, which was broken in r1.279.

ARP: Don't defend ARP probes.

We should let the nature of ARP takes it's course here when our address
is neither tentative nor duplicated.
This allows the host to work with ARP ping, which was broken in r1.279.

Pull up following revision(s) (requested by ozaki-r in ticket #269):

	sys/netinet6/nd6.h: revision 1.88
	sys/net/rtsock_shared.c: revision 1.10
	sys/netinet6/nd6_nbr.c: revision 1.174
	sys/netinet6/nd6.c: revision 1.264
	sys/netinet/if_arp.c: revision 1.283
	sys/netinet/if_arp.c: revision 1.288

Initialize DAD components properly

The original code initialized each component in non-init functions such as
arp_dad_start and nd6_dad_find, conditionally based on a global flag for each.
However, it was racy because the flag and the code around it were not
protected by a lock and could cause a kernel panic at worst.

Fix the issue by initializing the components in bootup as usual.

 -

Initialize dom_mowner for MBUFTRACE

Pull up following revision(s) (requested by ozaki-r in ticket #1396):

	sys/netinet6/nd6.h: revision 1.88
	sys/netinet6/nd6_nbr.c: revision 1.174
	sys/netinet6/nd6.c: revision 1.264
	sys/netinet/if_arp.c: revision 1.288 (patch)

Initialize DAD components properly

The original code initialized each component in non-init functions such as
arp_dad_start and nd6_dad_find, conditionally based on a global flag for each.
However, it was racy because the flag and the code around it were not
protected by a lock and could cause a kernel panic at worst.

Fix the issue by initializing the components in bootup as usual.

Initialize DAD components properly

The original code initialized each component in non-init functions such as
arp_dad_start and nd6_dad_find, conditionally based on a global flag for each.
However, it was racy because the flag and the code around it were not
protected by a lock and could cause a kernel panic at worst.

Fix the issue by initializing the components in bootup as usual.

Pull up following revision(s) (requested by roy in ticket #170):

	sys/netinet/if_arp.c: revision 1.287

inet: Send RTM_MISS when we fail to resolve an address.

Takes the same approach as when adding a new address - we no longer
announce the new lladdr right away but we announce the result.

This will either be RTM_ADD or RTM_MISS.
RTM_DELETE is only sent if we have a lladdr assigned OR gc'ed.

This tells us when a new lladdr has been added (RTM_ADD),
changed (RTM_CHANGE), deleted (RTM_DELETED) or has failed to been
resolved (RTM_MISS). The latter case can be interpreted as unreachable.

inet: Send RTM_MISS when we fail to resolve an address.

Takes the same approach as when adding a new address - we no longer
announce the new lladdr right away but we announce the result.
This will either be RTM_ADD or RTM_MISS.
RTM_DELETE is only sent if we have a lladdr assigned OR gc'ed.

This tells us when a new lladdr has been added (RTM_ADD),
changed (RTM_CHANGE), deleted (RTM_DELETED) or has failed to been
resolved (RTM_MISS). The latter case can be interpreted as unreachable.

Pull up following revision(s) (requested by roy in ticket #147):

	sys/netinet/if_arp.c: revision 1.285
	sys/netinet/if_arp.c: revision 1.286

ARP: remove unused sysctl entry log_unknown_network

ARP: change default sysctl entry log_movements to 0
IP address sharing is a thing and shouldn't cause needless diagnostics
by default.

ARP: change default sysctl entry log_movements to 0

IP address sharing is a thing and shouldn't cause needless diagnostics
by default.

ARP: remove unused sysctl entry log_unknown_network

Pull up following revision(s) (requested by roy in ticket #109):

	sys/net/route.h: revision 1.124
	sys/netinet6/nd6.c: revision 1.258
	sys/netinet6/nd6.c: revision 1.259
	sys/net/rtsock.c: revision 1.251
	sys/netinet/if_arp.c: revision 1.284
	sys/netinet6/nd6_nbr.c: revision 1.167

rtsock: rework rt_clonedmsg to take a message type and lladdr

We will use this in a future patch to notify userland of lladdr
changes.

XXX pullup -8 -9

 -

nd6: notify userland of neighbour lla updates once more

XXX pullup -8 -9

rtsock: rework rt_clonedmsg to take a message type and lladdr

We will use this in a future patch to notify userland of lladdr
changes.

XXX pullup -8 -9

Initialize dom_mowner for MBUFTRACE

Sync with HEAD

Introduce rt_addrmsg_src which adds RTA_AUTHOR to the message.
Use this when we notify userland of a duplicate address
and set RTA_AUTHOR to the hardware address of the sender.

While here, match the logging diagnostic of INET6 to the simpler one
of INET so it's consistent.

Move lla_snprintf from if_arp.c to dl_print.c

rtsock: Route address message simplification

Rename rt_newaddrmsg to rt_addrmsg_rt.
Add rt_addrmsg which drops the error and route arguments which are only
needed by one caller.

ARP: Enable Address Defence again.

Revert the tentative/duplicated check and test for if it's been broadcast
or not. This reverts r1.245.

Sync with HEAD, resolve a few conflicts

Replace M_ALIGN and MH_ALIGN by m_align.

Introduce and use ip_dad_enabled() and ip6_dad_enabled() functions

Sync with HEAD, resolve a couple of conflicts

Pull up following revision(s) (requested by ozaki-r in ticket #1080):

	sys/netinet6/nd6.c: revision 1.251
	sys/netinet/if_arp.c: revision 1.276
	sys/net/if.c: revision 1.438
	sys/net/if.c: revision 1.439
	sys/net/route.c: revision 1.214
	sys/net/route.c: revision 1.215
	sys/net/route.c: revision 1.216
	sys/netinet6/in6.c: revision 1.270
	sys/net/route.h: revision 1.120
	sys/net/if.c: revision 1.440

Remove a wrong assertion in ifaref

 -

Doing ifref on an ifa with IFA_DESTROYING is not a problem; the reference should
be dropped during the destruction of the ifa.

 -

Use atomic operations for ifa_refcnt

 -

Avoid a dangling pointer during rt_replace_ifa

 -

Avoid double rt_replace_ifa on rtrequest1(RTM_ADD)

Some callers of rtrequest1(RTM_ADD) adjust rt_ifa of an rtentry created by
rtrequest1 that may change rt_ifa (in ifa_rtrequest) with another ifa that is
different from requested one.  It's wasteful and even worse introduces a race
condition.  rtrequest1 should just use a passed ifa as is if a caller hopes so.

 -

Use rt_update framework on updating a rtentry

Avoid double rt_replace_ifa on rtrequest1(RTM_ADD)

Some callers of rtrequest1(RTM_ADD) adjust rt_ifa of an rtentry created by
rtrequest1 that may change rt_ifa (in ifa_rtrequest) with another ifa that is
different from requested one.  It's wasteful and even worse introduces a race
condition.  rtrequest1 should just use a passed ifa as is if a caller hopes so.

Sync with HEAD

static

Synch with HEAD

Remove now unused net_osdep.h includes, the other BSDs did the same.

Sync with HEAD, resolve some conflicts

Add XXX.

Remove unused mbuf argument from arpcreate() and arplookup().

Pull up following revision(s) (requested by ozaki-r in ticket #686):

	sys/netinet/if_arp.c: revision 1.271
	sys/netinet6/nd6_nbr.c: revision 1.151,1.152

Avoid passing NULL to nd6_dad_duplicated
Fix PR kern/53075

Fix a race condition on DAD destructions (again)

The previous fix to DAD timers was wrong; it avoided a use-after-free but
instead introduced a memory leak.  The destruction method had delegated
a destruction of a DAD timer to the timer itself and told that by setting NULL
to dp->dad_ifa.  However, the previous fix made DAD timers do nothing on
the sign.

Fixing the issue with using callout_stop isn't easy.  One approach is to have
a refcount on dp but it introduces extra complexity that we want to avoid.
The new fix falls back to using callout_halt, which was abandoned because of
softnet_lock.  Fortunately now the network stack is protected by KERNEL_LOCK
so we can remove softnet_lock from DAD timers (callout) and use callout_halt
safely.

Synch with HEAD

Pull up following revision(s) (requested by ozaki-r in ticket #622):
	sys/netinet/if_arp.c: revision 1.270
	sys/net/if_llatbl.c: revision 1.24 (patch)
	sys/net/if_llatbl.c: revision 1.25
	sys/net/if_llatbl.c: revision 1.26
	sys/net/route.c: revision 1.204
	sys/netinet6/in6.c: revision 1.261
	sys/netinet6/in6.c: revision 1.262 (patch)
	sys/netinet6/in6.c: revision 1.263
	sys/netinet/in.c: revision 1.216
	sys/netinet6/in6.c: revision 1.264
	sys/netinet6/nd6.c: revision 1.246 (patch)
	sys/netinet/if_arp.c: revision 1.269
	sys/net/if_llatbl.h: revision 1.14
	sys/netinet6/in6.c: revision 1.259
	sys/netinet/in.c: revision 1.220
	sys/netinet/in.c: revision 1.221 (patch)
	sys/netinet/in.c: revision 1.222
	sys/netinet/in.c: revision 1.223

Suppress noisy debugging outputs
Even if DEBUG they are too noisy under load.

Tweak sanity checks

Scheduling a timer of static entries is wrong.

Add assertions

We must not destroy llentries holding mbufs.

Fix reference leaks of llentry
callout_reset and callout_halt can cancel a pending callout without telling us.
Detect a cancel and remove a reference by using callout_pending and
callout_stop (it's a bit tricy though, we can detect it).
While here, we can remove remaining abuses of mutex_owned for softnet_lock.

Fix memory leaks on arp -d and ndp -d for static entries
We have to delete entries on in_lltable_delete and in6_lltable_delete
unconditionally.  Note that we don't need to worry about LLE_IFADDR because
there is no such entries now.

Use pool(9) for llentry allocations
llentry is easy to be leaked and pool suits for it because pool is usable to
detect leaks.

Also sweep unnecessary wrappers for llentry, in_llentry and in6_llentry.

Fix a race condition on DAD destructions (again)

The previous fix to DAD timers was wrong; it avoided a use-after-free but
instead introduced a memory leak.  The destruction method had delegated
a destruction of a DAD timer to the timer itself and told that by setting NULL
to dp->dad_ifa.  However, the previous fix made DAD timers do nothing on
the sign.

Fixing the issue with using callout_stop isn't easy.  One approach is to have
a refcount on dp but it introduces extra complexity that we want to avoid.

The new fix falls back to using callout_halt, which was abandoned because of
softnet_lock.  Fortunately now the network stack is protected by KERNEL_LOCK
so we can remove softnet_lock from DAD timers (callout) and use callout_halt
safely.

Fix reference leaks of llentry

callout_reset and callout_halt can cancel a pending callout without telling us.
Detect a cancel and remove a reference by using callout_pending and
callout_stop (it's a bit tricy though, we can detect it).

While here, we can remove remaining abuses of mutex_owned for softnet_lock.

Tweak sanity checks

Scheduling a timer of static entries is wrong.

Sprinkle some const.

Pull up following revision(s) (requested by ozaki-r in ticket #589):
	sys/netinet/if_arp.c: revision 1.267
	sys/netinet6/nd6_nbr.c: revision 1.146-1.148

Use KASSERT for checking a programming error

Simplify; pass dp to nd6_dad_duplicated instead of looking it up again in it

Avoid a race condition of DAD timer destructions

When we see dp->dad_ifa == NULL, it means that the ifa is being deleted and also
the callout is scheduled again by someone.  We shouldn't rely on a result of
callout_pending to know if the callout is scheduled because it returns false if
the subsequent callout handler is already on the fly.
We have to always delegate the destruction of dp to the subsequent handler
unconditionally if dp->dad_ifa == NULL. Otherwise, the first handler destroys
the dp and the second handler tries to handle destroyed dp.

Avoid a race condition of DAD timer destructions

When we see dp->dad_ifa == NULL, it means that the ifa is being deleted and also
the callout is scheduled again by someone.  We shouldn't rely on a result of
callout_pending to know if the callout is scheduled because it returns false if
the subsequent callout handler is already on the fly.

We have to always delegate the destruction of dp to the subsequent handler
unconditionally if dp->dad_ifa == NULL. Otherwise, the first handler destroys
the dp and the second handler tries to handle destroyed dp.

Remove IFF_STATICARP, we don't support this, and the code is useless in its
current form.

ok ozaki-r@

Mmh. Add a missing check: if ARP was disabled on the interface, don't
process ARP packets. Otherwise the kernel will add ARP entries even if

	ifconfig wm0 -arp

was entered.

Be tougher:

 * In arpintr(), don't allow IEEE1394 packets on non-IEEE1394 interfaces.

 * In revarpinput(), kick IEEE1394 packets right away. They are not
   supported.

Same change as rev1.258, but this time in revarpinput: use m_pullup.

Minor stylistic changes, and use C99 types.

Replace dead code by KASSERT.

Don't force ARPHRD_IEEE1394 on IEEE1394 interfaces. If it's not there, then
kick the packet. And do this earlier.

Use only one label, clearer.

Fix three things in arpintr():

 * mtod can't return NULL.

 * It is wrong to kick the packet if m->m_len < arplen. While this check
   always returns false for native Ethernet interfaces, it may not if the
   frame is encapsulated in EtherIP/L2TP. Use m_pullup instead.

 * Remove XXX, it is fine. Reduce the indentation level afterwards.

Style, no functional change.

Pull up following revision(s) (requested by ozaki-r in ticket #511):
	sys/kern/kern_timeout.c: revision 1.54
	sys/netinet6/nd6_nbr.c: revision 1.141
	sys/netinet6/nd6_nbr.c: revision 1.144
	sys/netinet/if_arp.c: revision 1.256
Fix a deadlock on callout_halt of nd6_dad_timer
We must not call callout_halt of nd6_dad_timer with holding nd6_dad_lock because
the lock is taken in nd6_dad_timer. Once softnet_lock goes away, we can pass the
lock to callout_halt, but for now we cannot.
Make DAD destructions (MP-)safe with callout_stop
arp_dad_stoptimer and nd6_dad_stoptimer can be called with or without
softnet_lock held and unfortunately we have no easy way to statically know which.
So it is hard to use callout_halt there.
To address the situation, we use callout_stop to make the code safe. The new
approach copes with the issue by delegating the destruction of a callout to
callout itself, which allows us to not wait the callout to finish. This can be
done thanks to that DAD objects are separated from other data such as ifa.
The approach is suggested by riastradh@
Proposed on tech-kern@ and tech-net@
Sanity-check if interlock is held when it's passed

Make DAD destructions (MP-)safe with callout_stop

arp_dad_stoptimer and nd6_dad_stoptimer can be called with or without
softnet_lock held and unfortunately we have no easy way to statically know which.
So it is hard to use callout_halt there.

To address the situation, we use callout_stop to make the code safe. The new
approach copes with the issue by delegating the destruction of a callout to
callout itself, which allows us to not wait the callout to finish. This can be
done thanks to that DAD objects are separated from other data such as ifa.

The approach is suggested by riastradh@
Proposed on tech-kern@ and tech-net@

Pull up following revision(s) (requested by ozaki-r in ticket #456):
	sys/arch/arm/sunxi/sunxi_emac.c: 1.9
	sys/dev/ic/dwc_gmac.c: 1.43-1.44
	sys/dev/pci/if_iwm.c: 1.75
	sys/dev/pci/if_wm.c: 1.543
	sys/dev/pci/ixgbe/ixgbe.c: 1.112
	sys/dev/pci/ixgbe/ixv.c: 1.74
	sys/kern/sys_socket.c: 1.75
	sys/net/agr/if_agr.c: 1.43
	sys/net/bpf.c: 1.219
	sys/net/if.c: 1.397, 1.399, 1.401-1.403, 1.406-1.410, 1.412-1.416
	sys/net/if.h: 1.242-1.247, 1.250, 1.252-1.257
	sys/net/if_bridge.c: 1.140 via patch, 1.142-1.146
	sys/net/if_etherip.c: 1.40
	sys/net/if_ethersubr.c: 1.243, 1.246
	sys/net/if_faith.c: 1.57
	sys/net/if_gif.c: 1.132
	sys/net/if_l2tp.c: 1.15, 1.17
	sys/net/if_loop.c: 1.98-1.101
	sys/net/if_media.c: 1.35
	sys/net/if_pppoe.c: 1.131-1.132
	sys/net/if_spppsubr.c: 1.176-1.177
	sys/net/if_tun.c: 1.142
	sys/net/if_vlan.c: 1.107, 1.109, 1.114-1.121
	sys/net/npf/npf_ifaddr.c: 1.3
	sys/net/npf/npf_os.c: 1.8-1.9
	sys/net/rtsock.c: 1.230
	sys/netcan/if_canloop.c: 1.3-1.5
	sys/netinet/if_arp.c: 1.255
	sys/netinet/igmp.c: 1.65
	sys/netinet/in.c: 1.210-1.211
	sys/netinet/in_pcb.c: 1.180
	sys/netinet/ip_carp.c: 1.92, 1.94
	sys/netinet/ip_flow.c: 1.81
	sys/netinet/ip_input.c: 1.362
	sys/netinet/ip_mroute.c: 1.147
	sys/netinet/ip_output.c: 1.283, 1.285, 1.287
	sys/netinet6/frag6.c: 1.61
	sys/netinet6/in6.c: 1.251, 1.255
	sys/netinet6/in6_pcb.c: 1.162
	sys/netinet6/ip6_flow.c: 1.35
	sys/netinet6/ip6_input.c: 1.183
	sys/netinet6/ip6_output.c: 1.196
	sys/netinet6/mld6.c: 1.90
	sys/netinet6/nd6.c: 1.239-1.240
	sys/netinet6/nd6_nbr.c: 1.139
	sys/netinet6/nd6_rtr.c: 1.136
	sys/netipsec/ipsec_output.c: 1.65
	sys/rump/net/lib/libnetinet/netinet_component.c: 1.9-1.10
kmem_intr_free kmem_intr_[z]alloced memory
the underlying pools are the same but api-wise those should match
Unify IFEF_*_MPSAFE into IFEF_MPSAFE
There are already two flags for if_output and if_start, however, it seems such
MPSAFE flags are eventually needed for all if_XXX operations. Having discrete
flags for each operation is wasteful of if_extflags bits. So let's unify
the flags into one: IFEF_MPSAFE.
Fortunately IFEF_*_MPSAFE flags have never been included in any releases, so
we can change them without breaking backward compatibility of the releases
(though the kernel version of -current should be bumped).
Note that if an interface have both MP-safe and non-MP-safe operations at a
time, we have to set the IFEF_MPSAFE flag and let callees of non-MP-safe
opeartions take the kernel lock.
Proposed on tech-kern@ and tech-net@
Provide macros for softnet_lock and KERNEL_LOCK hiding NET_MPSAFE switch
It reduces C&P codes such as "#ifndef NET_MPSAFE KERNEL_LOCK(1, NULL); ..."
scattered all over the source code and makes it easy to identify remaining
KERNEL_LOCK and/or softnet_lock that are held even if NET_MPSAFE.
No functional change
Hold KERNEL_LOCK on if_ioctl selectively based on IFEF_MPSAFE
If IFEF_MPSAFE is set, hold the lock and otherwise don't hold.
This change requires additions of KERNEL_LOCK to subsequence functions from
if_ioctl such as ifmedia_ioctl and ifioctl_common to protect non-MP-safe
components.
Proposed on tech-kern@ and tech-net@
Ensure to hold if_ioctl_lock when calling if_flags_set
Fix locking against myself on ifpromisc
vlan_unconfig_locked could be called with holding if_ioctl_lock.
Ensure to not turn on IFF_RUNNING of an interface until its initialization completes
And ensure to turn off it before destruction as per IFF_RUNNING's description
"resource allocated". (The description is a bit doubtful though, I believe the
change is still proper.)
Ensure to hold if_ioctl_lock on if_up and if_down
One exception for if_down is if_detach; in the case the lock isn't needed
because it's guaranteed that no other one can access ifp at that point.
Make if_link_queue MP-safe if IFEF_MPSAFE
if_link_queue is a queue to store events of link state changes, which is
used to pass events from (typically) an interrupt handler to
if_link_state_change softint. The queue was protected by KERNEL_LOCK so far,
but if IFEF_MPSAFE is enabled, it becomes unsafe because (perhaps) an interrupt
handler of an interface with IFEF_MPSAFE doesn't take KERNEL_LOCK. Protect it
by a spin mutex.
Additionally with this change KERNEL_LOCK of if_link_state_change softint is
omitted if NET_MPSAFE is enabled.
Note that the spin mutex is now ifp->if_snd.ifq_lock as well as the case of
if_timer (see the comment).
Use IFADDR_WRITER_FOREACH instead of IFADDR_READER_FOREACH
At that point no other one modifies the list so IFADDR_READER_FOREACH
is unnecessary. Use of IFADDR_READER_FOREACH is harmless in general though,
if we try to detect contract violations of pserialize, using it violates
the contract. So avoid using it makes life easy.
Ensure to call if_addr_init with holding if_ioctl_lock
Get rid of outdated comments
Fix build of kernels without ether
By throwing out if_enable_vlan_mtu and if_disable_vlan_mtu that
created a unnecessary dependency from if.c to if_ethersubr.c.
PR kern/52790
Rename IFNET_LOCK to IFNET_GLOBAL_LOCK
IFNET_LOCK will be used in another lock, if_ioctl_lock (might be renamed then).
Wrap if_ioctl_lock with IFNET_* macros (NFC)
Also if_ioctl_lock perhaps needs to be renamed to something because it's now
not just for ioctl...
Reorder some destruction routines in if_detach
- Destroy if_ioctl_lock at the end of the if_detach because it's used in various
  destruction routines
- Move psref_target_destroy after pr_purgeif because we want to use psref in
  pr_purgeif (otherwise destruction procedures can be tricky)
Ensure to call if_mcast_op with holding IFNET_LOCK
Note that CARP doesn't deal with IFNET_LOCK yet.
Remove IFNET_GLOBAL_LOCK where it's unnecessary because IFNET_LOCK is held
Describe which lock is used to protect each member variable of struct ifnet
Requested by skrll@
Write a guideline for converting an interface to IFEF_MPSAFE
Requested by skrll@
Note that IFNET_LOCK must not be held in softint
Don't set IFEF_MPSAFE unless NET_MPSAFE at this point
Because recent investigations show that interfaces with IFEF_MPSAFE need to
follow additional restrictions to work with the flag safely. We should enable it
on an interface by default only if the interface surely satisfies the
restrictions, which are described in if.h.
Note that enabling IFEF_MPSAFE solely gains a few benefit on performance because
the network stack is still serialized by the big kernel locks by default.

update from HEAD

Pull up following revision(s) (requested by ozaki-r in ticket #353):
	sys/net/if_llatbl.c: 1.22
	sys/net/if_llatbl.h: 1.13
	sys/netinet/if_arp.c: 1.254
	sys/netinet/in.c: 1.208-1.209
	sys/netinet6/in6.c: 1.249-1.250
	sys/netinet6/nd6.c: 1.237
Remove redundant KASSERTMSG
The function is static, has just one caller and the caller does the same check.
--
Fix a deadlock between a route update and lltable
It happens because rtalloc1 is called from lltable with holding
IF_AFDATA_WLOCK.
If a route update is in action, rtalloc1 would wait for its completion with
holding IF_AFDATA_WLOCK. At the same moment, a softint (e.g., arpintr) may try
to take IF_AFDATA_WLOCK and get stuck on it. Unfortunately the stuck softint
prevents the route update from progressing because the route update calls
psref_target_destroy that needs the softint to complete.
A resource allocation graph of the senario looks like this:
    route update =(psref_target_destroy)=> softint => IF_AFDATA_WLOCK
    =(rt_update_wait)=> route update
Fix the deadlock by pulling rtalloc1 out of the lltable codes inside
IF_AFDATA_WLOCK.
Note that the deadlock happens only if NET_MPSAFE is enabled.

Provide macros for softnet_lock and KERNEL_LOCK hiding NET_MPSAFE switch

It reduces C&P codes such as "#ifndef NET_MPSAFE KERNEL_LOCK(1, NULL); ..."
scattered all over the source code and makes it easy to identify remaining
KERNEL_LOCK and/or softnet_lock that are held even if NET_MPSAFE.

No functional change

Fix a deadlock between a route update and lltable

It happens because rtalloc1 is called from lltable with holding
IF_AFDATA_WLOCK.

If a route update is in action, rtalloc1 would wait for its completion with
holding IF_AFDATA_WLOCK. At the same moment, a softint (e.g., arpintr) may try
to take IF_AFDATA_WLOCK and get stuck on it. Unfortunately the stuck softint
prevents the route update from progressing because the route update calls
psref_target_destroy that needs the softint to complete.

A resource allocation graph of the senario looks like this:
    route update =(psref_target_destroy)=> softint => IF_AFDATA_WLOCK
    =(rt_update_wait)=> route update

Fix the deadlock by pulling rtalloc1 out of the lltable codes inside
IF_AFDATA_WLOCK.

Note that the deadlock happens only if NET_MPSAFE is enabled.

Sync with HEAD

Pull up following revision(s) (requested by ozaki-r in ticket #107):
	usr.sbin/arp/arp.c: revision 1.56
	sys/net/rtsock.c: revision 1.218
	sys/net/if_llatbl.c: revision 1.20
	usr.sbin/arp/arp.c: revision 1.57
	sys/net/rtsock.c: revision 1.219
	sys/net/if_llatbl.c: revision 1.21
	usr.sbin/arp/arp.c: revision 1.58
	tests/net/net_common.sh: revision 1.19
	sys/netinet6/nd6.h: revision 1.84
	sys/netinet6/nd6.h: revision 1.85
	tests/net/arp/t_arp.sh: revision 1.23
	sys/netinet6/in6.c: revision 1.246
	tests/net/arp/t_arp.sh: revision 1.24
	sys/netinet6/in6.c: revision 1.247
	tests/net/arp/t_arp.sh: revision 1.25
	sys/netinet6/in6.c: revision 1.248
	tests/net/arp/t_arp.sh: revision 1.26
	usr.sbin/ndp/ndp.c: revision 1.49
	tests/net/arp/t_arp.sh: revision 1.27
	tests/net/ndp/t_ndp.sh: revision 1.20
	tests/net/arp/t_arp.sh: revision 1.28
	tests/net/ndp/t_ndp.sh: revision 1.21
	tests/net/arp/t_arp.sh: revision 1.29
	tests/net/ndp/t_ndp.sh: revision 1.22
	tests/net/ndp/t_ndp.sh: revision 1.23
	tests/net/route/t_flags6.sh: revision 1.13
	tests/net/ndp/t_ndp.sh: revision 1.24
	tests/net/route/t_flags6.sh: revision 1.14
	tests/net/ndp/t_ndp.sh: revision 1.25
	tests/net/route/t_flags6.sh: revision 1.15
	tests/net/ndp/t_ndp.sh: revision 1.26
	sbin/route/rtutil.c: revision 1.9
	tests/net/ndp/t_ndp.sh: revision 1.27
	tests/net/ndp/t_ndp.sh: revision 1.28
	tests/net/net/t_ipv6address.sh: revision 1.14
	tests/net/ndp/t_ra.sh: revision 1.28
	tests/net/ndp/t_ndp.sh: revision 1.29
	sys/net/route.h: revision 1.113
	tests/net/ndp/t_ra.sh: revision 1.29
	sys/net/rtsock.c: revision 1.220
	sys/net/rtsock.c: revision 1.221
	sys/net/rtsock.c: revision 1.222
	sys/net/rtsock.c: revision 1.223
	tests/net/route/t_route.sh: revision 1.13
	sys/net/rtsock.c: revision 1.224
	sys/net/route.c: revision 1.196
	sys/net/if_llatbl.c: revision 1.19
	sys/net/route.c: revision 1.197
	sbin/route/route.c: revision 1.156
	tests/net/route/t_flags.sh: revision 1.16
	tests/net/route/t_flags.sh: revision 1.17
	usr.sbin/ndp/ndp.c: revision 1.50
	tests/net/route/t_flags.sh: revision 1.18
	sys/netinet/in.c: revision 1.204
	tests/net/route/t_flags.sh: revision 1.19
	sys/netinet/in.c: revision 1.205
	tests/net/arp/t_arp.sh: revision 1.30
	tests/net/arp/t_arp.sh: revision 1.31
	sys/net/if_llatbl.h: revision 1.11
	tests/net/arp/t_arp.sh: revision 1.32
	sys/net/if_llatbl.h: revision 1.12
	tests/net/arp/t_arp.sh: revision 1.33
	sys/netinet6/nd6.c: revision 1.233
	sys/netinet6/nd6.c: revision 1.234
	sys/netinet/if_arp.c: revision 1.251
	sys/netinet6/nd6.c: revision 1.235
	sys/netinet/if_arp.c: revision 1.252
	sbin/route/route.8: revision 1.57
	sys/net/rtsock.c: revision 1.214
	sys/net/rtsock.c: revision 1.215
	sys/net/rtsock.c: revision 1.216
	sys/net/rtsock.c: revision 1.217
whitespace police
Simplify
We can assume that rt_ifp is always non-NULL.
Sending a routing message (RTM_ADD) on adding an llentry
A message used to be sent on adding a cloned route. Restore the
behavior for backward compatibility.
Requested by ryo@
Drop RTF_CONNECTED from a result of RTM_GET for ARP/NDP entries
ARP/NDP entries aren't connected routes.
Reported by ryo@
Support -c <count> option for route monitor
route command exits if it receives <count> routing messages where
<count> is a value specified by -c.
The option is useful to get only particular message(s) in a test script.
Test routing messages emitted on operations of ARP/NDP entries
Do netstat -a for an appropriate protocol
Add missing declarations for cleanup
Set net.inet.arp.keep only if it's required
Don't create a permanent L2 cache entry on adding an address to an interface
It was created to copy FreeBSD, however actually the cache isn't
necessary. Remove it to simplify the code and reduce the cost to
maintain it (e.g., keep a consistency with a corresponding local
route).
Fix typo
Fix in_lltable_match_prefix
The function has not been used but will be used soon.
Remove unused function (nd6_rem_ifa_lle)
Allow in6_lltable_free_entry to be called without holding the afdata lock of ifp as well as in_lltable_free_entry
This behavior is a bit odd and should be fixed in the future...
Purge ARP/NDP entries on an interface when the interface is down
Fix PR kern/51179
Purge all related L2 caches on removing a route
The change addresses situations similar to PR 51179.
Purge L2 caches on changing an interface of a route
The change addresses situations similar to PR 51179.
Test implicit removals of ARP/NDP entries
One test case reproudces PR 51179.
Fix build of kernels without both INET and INET6
Tweak lltable_sysctl_dumparp
- Rename lltable_sysctl_dumparp to lltable_sysctl_dump
  because it's not only for ARP
- Enable it not only for INET but also for INET6
Fix usage of routing messages on arp -d and ndp -d
It didn't work as we expected; we should set RTA_GATEWAY not
RTA_IFP on RTM_GET to return an if_index and the kernel should
use it on RTM_DELETE.
Improve backward compatibility of (fake) routing messages on adding an ARP/NDP entry
A message originally included only DST and GATEWAY. Restore it.
Fix ifdef; care about a case w/ INET6 and w/o INET
Drop RTF_UP from a routing message of a deleted ARP/NDP entry
Check existence of ARP/NDP entries
Checking ARP/NDP entries is valid rather than checking routes.
Fix wrong comment
Drop RTF_LLINFO flag (now it's RTF_LLDATA) from local routes
They don't have llinfo anymore. And also the change fixes unexpected
behavior of ARP proxy.
Restore ARP/NDP entries to route show and netstat -r
Requested by dyoung@ some time ago
Enable to remove multiple ARP/NDP entries for one destination
The kernel can have multiple ARP/NDP entries which have an indentical
destination on different interfaces. This is normal and can be
reproduce easily by ping -I or ping6 -S. We should be able to remove
such entries.
arp -d <ip> and ndp -d <ip> are changed to fetch all ARP/NDP entries
and remove matched entries. So we can remove multiple entries
described above. This fetch all and selective removal behavior is
the same as arp <ip> and ndp <ip>; they also do fetch all entries
and show only matched entries.
Related to PR 51179
Check if ARP/NDP entries are purged when a related route is deleted

Pull up following revision(s) (requested by roy in ticket #77):
	sys/net/if.h: revision 1.240
	sys/netinet/if_arp.c: revision 1.253
	sys/net/if.c: revision 1.395
Introduce if_get_bylla to find an interface with the active
local link address.
--
Use if_get_bylla() instead of just looking at the lla of the interface
the address belongs to.
This allows any ARP message we receieved from another interface to
be correctly dropped.
While here, move the protocol length check higher up the food chain.

Use if_get_bylla() instead of just looking at the lla of the interface
the address belongs to.
This allows any ARP message we receieved from another interface to
be correctly dropped.

While here, move the protocol length check higher up the food chain.

Don't create a permanent L2 cache entry on adding an address to an interface

It was created to copy FreeBSD, however actually the cache isn't
necessary. Remove it to simplify the code and reduce the cost to
maintain it (e.g., keep a consistency with a corresponding local
route).

Sending a routing message (RTM_ADD) on adding an llentry

A message used to be sent on adding a cloned route. Restore the
behavior for backward compatibility.

Requested by ryo@

Resolve conflicts from previous merge (all resulting from $NetBSD
keywork expansion)

Lookup caches from a CARP interface if the packet is routed to the interface

This fixes CARP setups without carpdev (physical interface) having any IPs.

replace in_fmtaddr() by IN_PRINT(), and delete function in_fmtaddr()

Sync with HEAD

Sync with HEAD

Get rid of unused macros

Sync with HEAD

If we're not doing DAD, don't set IN_IFF_TENTATIVE.

Sync with netbsd-7-1-RELEASE

If an ARP packet is received to the null host (0.0.0.0) then look for
an address matching the sender IP address on the interface.
This allows DAD to fail during the probe phase when a reverse ARP
proxy is present.

Only check target address collision if the sender address is the null
address (ie a DAD probe) or our matching address is either TENTATIVE
or DUPLICATED.

Only do DaD if the interface actually has the address.

Replace malloc for DAD with kmem and move them out of the lock for DAD

Allow Unicast Poll from RFC 1122 to bypass DaD checking.

Add missing NULL checks for m_get_rcvif

Pull up following revision(s) (requested by maxv in ticket #1356):
	sys/netinet/if_arp.c: revision 1.238, 1.239 via patch
Make sure the protocol address length equals that of IPv4. Also, make sure
the hardware address length equals that of the interface we received the
packet on. Otherwise a packet could easily set them both to zero and make
the kernel read beyond the allocated mbuf, which is terrible.
Note: for the latter we drop the packet instead of replying, since it is
malformed.
Note: I also added an ugly hack in CARP, since it apparently expects at
least six bytes.
--
Add some checks, mostly same as in_arpinput.

Pull up following revision(s) (requested by maxv in ticket #1356):
	sys/netinet/if_arp.c: revision 1.238, 1.239 via patch
Make sure the protocol address length equals that of IPv4. Also, make sure
the hardware address length equals that of the interface we received the
packet on. Otherwise a packet could easily set them both to zero and make
the kernel read beyond the allocated mbuf, which is terrible.
Note: for the latter we drop the packet instead of replying, since it is
malformed.
Note: I also added an ugly hack in CARP, since it apparently expects at
least six bytes.
--
Add some checks, mostly same as in_arpinput.

Sync with HEAD

Pull up following revision(s) (requested by maxv in ticket #1432):
	sys/netinet/if_arp.c: 1.238, 1.239 via patch
Make sure the protocol address length equals that of IPv4. Also, make sure
the hardware address length equals that of the interface we received the
packet on. Otherwise a packet could easily set them both to zero and make
the kernel read beyond the allocated mbuf, which is terrible.
Note: for the latter we drop the packet instead of replying, since it is
malformed.
Note: I also added an ugly hack in CARP, since it apparently expects at
least six bytes.
--
Add some checks, mostly same as in_arpinput.

Pull up following revision(s) (requested by maxv in ticket #1432):
	sys/netinet/if_arp.c: 1.238, 1.239 via patch
Make sure the protocol address length equals that of IPv4. Also, make sure
the hardware address length equals that of the interface we received the
packet on. Otherwise a packet could easily set them both to zero and make
the kernel read beyond the allocated mbuf, which is terrible.
Note: for the latter we drop the packet instead of replying, since it is
malformed.
Note: I also added an ugly hack in CARP, since it apparently expects at
least six bytes.
--
Add some checks, mostly same as in_arpinput.

Pull up following revision(s) (requested by maxv in ticket #1432):
	sys/netinet/if_arp.c: 1.238, 1.239 via patch
Make sure the protocol address length equals that of IPv4. Also, make sure
the hardware address length equals that of the interface we received the
packet on. Otherwise a packet could easily set them both to zero and make
the kernel read beyond the allocated mbuf, which is terrible.
Note: for the latter we drop the packet instead of replying, since it is
malformed.
Note: I also added an ugly hack in CARP, since it apparently expects at
least six bytes.
--
Add some checks, mostly same as in_arpinput.

Tweak softnet_lock and NET_MPSAFE

- Don't hold softnet_lock in some functions if NET_MPSAFE
- Add softnet_lock to sysctl_net_inet_icmp_redirtimeout
- Add softnet_lock to expire_upcalls of ip_mroute.c
- Restore softnet_lock for in{,6}_pcbpurgeif{,0} if NET_MPSAFE
- Mark some softnet_lock for future work

Add some checks, mostly same as in_arpinput.

Make sure the protocol address length equals that of IPv4. Also, make sure
the hardware address length equals that of the interface we received the
packet on. Otherwise a packet could easily set them both to zero and make
the kernel read beyond the allocated mbuf, which is terrible.

Note: for the latter we drop the packet instead of replying, since it is
malformed.

Note: I also added an ugly hack in CARP, since it apparently expects at
least six bytes.

Style

Reput a nullcheck that was mistakenly removed in rev1.204. ar_hrd is
packet-controlled.

rename arplog -> ARPLOG to make it clear that it is a macro and tuck-in the
buffer used for address formatting.

Make ip6_sprintf(), in_fmtaddr(), lla_snprintf() and icmp6_redirect_diag() mpsafe.

Reviewed by ozaki-r@

Sync with HEAD.  (Note that most of these changes are simply $NetBSD$
tag issues.)

Make the routing table and rtcaches MP-safe

See the following descriptions for details.

Proposed on tech-kern and tech-net


Overview
--------

We protect the routing table with a rwock and protect
rtcaches with another rwlock. Each rtentry is protected
from being freed or updated via reference counting and psref.

Global rwlocks
--------------

There are two rwlocks; one for the routing table (rt_lock) and
the other for rtcaches (rtcache_lock). rtcache_lock covers
all existing rtcaches; there may have room for optimizations
(future work).

The locking order is rtcache_lock first and rt_lock is next.

rtentry references
------------------

References to an rtentry is managed with reference counting
and psref. Either of the two mechanisms is used depending on
where a rtentry is obtained. Reference counting is used when
we obtain a rtentry from the routing table directly via
rtalloc1 and rtrequest{,1} while psref is used when we obtain
a rtentry from a rtcache via rtcache_* APIs. In both cases,
a caller can sleep/block with holding an obtained rtentry.

The reasons why we use two different mechanisms are (i) only
using reference counting hurts the performance due to atomic
instructions (rtcache case) (ii) ease of implementation;
applying psref to APIs such rtaloc1 and rtrequest{,1} requires
additional works (adding a local variable and an argument).

We will finally migrate to use only psref but we can do it
when we have a lockless routing table alternative.

Reference counting for rtentry
------------------------------

rt_refcnt now doesn't count permanent references such as for
rt_timers and rtcaches, instead it is used only for temporal
references when obtaining a rtentry via rtalloc1 and rtrequest{,1}.
We can do so because destroying a rtentry always involves
removing references of rt_timers and rtcaches to the rtentry
and we don't need to track such references. This also makes
it easy to wait for readers to release references on deleting
or updating a rtentry, i.e., we can simply wait until the
reference counter is 0 or 1. (If there are permanent references
the counter can be arbitrary.)

rt_ref increments a reference counter of a rtentry and rt_unref
decrements it. rt_ref is called inside APIs (rtalloc1 and
rtrequest{,1} so users don't need to care about it while
users must call rt_unref to an obtained rtentry after using it.

rtfree is removed and we use rt_unref and rt_free instead.
rt_unref now just decrements the counter of a given rtentry
and rt_free just tries to destroy a given rtentry.

See the next section for destructions of rtentries by rt_free.

Destructions of rtentries
-------------------------

We destroy a rtentry only when we call rtrequst{,1}(RTM_DELETE);
the original implementation can destroy in any rtfree where it's
the last reference. If we use reference counting or psref, it's
easy to understand if the place that a rtentry is destroyed is
fixed.

rt_free waits for references to a given rtentry to be released
before actually destroying the rtentry. rt_free uses a condition
variable (cv_wait) (and psref_target_destroy for psref) to wait.

Unfortunately rtrequst{,1}(RTM_DELETE) can be called in softint
that we cannot use cv_wait. In that case, we have to defer the
destruction to a workqueue.

rtentry#rt_cv, rtentry#rt_psref and global variables
(see rt_free_global) are added to conduct the procedure.

Updates of rtentries
--------------------

One difficulty to use refcnt/psref instead of rwlock for rtentry
is updates of rtentries. We need an additional mechanism to
prevent readers from seeing inconsistency of a rtentry being
updated.

We introduce RTF_UPDATING flag to rtentries that are updating.
While the flag is set to a rtentry, users cannot acquire the
rtentry. By doing so, we avoid users to see inconsistent
rtentries.

There are two options when a user tries to acquire a rtentry
with the RTF_UPDATING flag; if a user runs in softint context
the user fails to acquire a rtentry (NULL is returned).
Otherwise a user waits until the update completes by waiting
on cv.

The procedure of a updater is simpler to destruction of
a rtentry. Wait on cv (and psref) and after all readers left,
proceed with the update.

Global variables (see rt_update_global) are added to conduct
the procedure.

Currently we apply the mechanism to only RTM_CHANGE in
rtsock.c. We would have to apply other codes. See
"Known issues" section.

psref for rtentry
-----------------

When we obtain a rtentry from a rtcache via rtcache_* APIs,
psref is used to reference to the rtentry.

rtcache_ref acquires a reference to a rtentry with psref
and rtcache_unref releases the reference after using it.
rtcache_ref is called inside rtcache_* APIs and users don't
need to take care of it while users must call rtcache_unref
to release the reference.

struct psref and int bound that is needed for psref is
embedded into struct route. By doing so we don't need to
add local variables and additional argument to APIs.

However this adds another constraint to psref other than
reference counting one's; holding a reference of an rtentry
via a rtcache is allowed by just one caller at the same time.
So we must not acquire a rtentry via a rtcache twice and
avoid a recursive use of a rtcache. And also a rtcache must
be arranged to be used by a LWP/softint at the same time
somehow. For IP forwarding case, we have per-CPU rtcaches
used in softint so the constraint is guaranteed. For a h
rtcache of a PCB case, the constraint is guaranteed by the
solock of each PCB. Any other cases (pf, ipf, stf and ipsec)
are currently guaranteed by only the existence of the global
locks (softnet_lock and/or KERNEL_LOCK). If we've found the
cases that we cannot guarantee the constraint, we would need
to introduce other rtcache APIs that use simple reference
counting.

psref of rtcache is created with IPL_SOFTNET and so rtcache
shouldn't used at an IPL higher than IPL_SOFTNET.

Note that rtcache_free is used to invalidate a given rtcache.
We don't need another care by my change; just keep them as
they are.

Performance impact
------------------

When NET_MPSAFE is disabled the performance drop is 3% while
when it's enabled the drop is increased to 11%. The difference
comes from that currently we don't take any global locks and
don't use psref if NET_MPSAFE is disabled.

We can optimize the performance of the case of NET_MPSAFE
on by reducing lookups of rtcache that uses psref;
currently we do two lookups but we should be able to trim
one of two. This is a future work.

Known issues
------------

There are two known issues to be solved; one is that
a caller of rtrequest(RTM_ADD) may change rtentry (see rtinit).
We need to prevent new references during the update. Or
we may be able to remove the code (perhaps, need more
investigations).

The other is rtredirect that updates a rtentry. We need
to apply our update mechanism, however it's not easy because
rtredirect is called in softint and we cannot apply our
mechanism simply. One solution is to defer rtredirect to
a workqueue but it requires some code restructuring.

Sync with HEAD

Don't handle ARP duplication for the unspecified address.

Sync with HEAD

Don't hold global locks if NET_MPSAFE is enabled

If NET_MPSAFE is enabled, don't hold KERNEL_LOCK and softnet_lock in
part of the network stack such as IP forwarding paths. The aim of the
change is to make it easy to test the network stack without the locks
and reduce our local diffs.

By default (i.e., if NET_MPSAFE isn't enabled), the locks are held
as they used to be.

Reviewed by knakahara@

Implement RFC 5227 2.4 Ongoing Conflict Detection and Address Defence.

If ip_dad_count is 0, then the conflict is just logged and the address
is not marked as duplicated.

Mark arprequest static and introduce arpannounce so that gratuitous
ARP requests are only send from valid addresses.

Sync with HEAD

Fix race condition on ifqueue used by traditional netisr

If a underlying network device driver supports MSI/MSI-X, RX interrupts
can be delivered to arbitrary CPUs. This means that Layer 2 subroutines
such as ether_input (softint) and subsequent Layer 3 subroutines (softint)
which are called via traditional netisr can be dispatched on an arbitrary
CPU. Layer 2 subroutines now run without any locks (expected) and so a
Layer 2 subroutine and a Layer 3 subroutine can run in parallel.

There is a shared data between a Layer 2 routine and a Layer 3 routine,
that is ifqueue and IF_ENQUEUE (from L2) and IF_DEQUEUE (from L3) on it
are racy now.

To fix the race condition, use ifqueue#ifq_lock to protect ifqueue
instead of splnet that is meaningless now.

The same race condition exists in route_intr. Fix it as well.

Reviewed by knakahara@

Dealing with arplog is a bit more complicated...

Clear IN_IFF_TENTATIVE when stopping DaD here.

Don't setup DaD for INADDR_ANY

Allow arplog to be used outside of if_arp.c

Refine arplog to be like nd6log.

Restore ARP_STAT_DFRTOTAL deleted unexpectedly

Sync with HEAD

Apply pserialize and psref to struct ifaddr and its variants

This change makes struct ifaddr and its variants (in_ifaddr and in6_ifaddr)
MP-safe by using pserialize and psref. At this moment, pserialize_perform
and psref_target_destroy are disabled because (1) we don't need them
because of softnet_lock (2) they cause a deadlock because of softnet_lock.
So we'll enable them when we remove softnet_lock in the future.

Fix panic on adding/deleting IP addresses under network load

Adding and deleting IP addresses aren't serialized with other network
opeartions, e.g., forwarding packets. So if we add or delete an IP
address under network load, a kernel panic may happen on manipulating
network-related shared objects such as rtentry and rtcache.

To avoid such panicks, we still need to hold softnet_lock in in_control
and in6_control that are called via ioctl and do network-related operations
including IP address additions/deletions.

Fix PR kern/51356

Sync with HEAD

Make DAD of ARP/NDP MP-safe with coarse-grained locks

The change also prevents arp_dad_timer/nd6_dad_timer from running if
arp_dad_stop/nd6_dad_stop is called, which makes sure that callout_reset
won't be called during callout_halt.

Use KASSERT for checking non-NULL of ifa->ifa_ifp

ifa->ifa_ifp should be always non-NULL, so doing the check only if
DIAGNOSTIC is ok.

Sync with HEAD

Replace macros to get an IP address with proper inline functions

The inline functions are more friendly for applying psz/psref;
they consist of only simple interations.

Tweak indentation

Make sure to free all interface addresses in if_detach

Addresses of an interface (struct ifaddr) have a (reverse) pointer of an
interface object (ifa->ifa_ifp). If the addresses are surely freed when
their interface is destroyed, the pointer is always valid and we don't
need a tweak of replacing the pointer to if_index like mbuf.

In order to make sure the assumption, the following changes are required:
- Deactivate the interface at the firstish of if_detach. This prevents
  in6_unlink_ifa from saving multicast addresses (wrongly)
- Invalidate rtcache(s) and clear a rtentry referencing an address on
  RTM_DELETE. rtcache(s) may delay freeing an address
- Replace callout_stop with callout_halt of DAD timers to ensure stopping
  such timers in if_detach

Make sure that ifaddr is published after its initialization finished

Basically we should insert an item to a collection (say a list) after
item's initialization has been completed to avoid accessing an item
that is initialized halfway. ifaddr (in{,6}_ifaddr) isn't processed
like so and needs to be fixed.

In order to do so, we need to tweak {arp,nd6}_rtrequest that depend
on that an ifaddr is inserted during its initialization; they explore
interface's address list to determine that rt_getkey(rt) of a given
rtentry is in the list to know whether the route's interface should
be a loopback, which doesn't work after the change. To make it work,
first check RTF_LOCAL flag that is set in rt_ifa_addlocal that calls
{arp,nd6}_rtrequest eventually. Note that we still need the original
code for the case to remove and re-add a local interface route.

Add missing NULL checks for m_get_rcvif_psref

apply if_output_lock() to L3 callers which call ifp->if_output() of L2(or L3 tunneling).

Avoid storing a pointer of an interface in a mbuf

Having a pointer of an interface in a mbuf isn't safe if we remove big
kernel locks; an interface object (ifnet) can be destroyed anytime in any
packet processing and accessing such object via a pointer is racy. Instead
we have to get an object from the interface collection (ifindex2ifnet) via
an interface index (if_index) that is stored to a mbuf instead of an
pointer.

The change provides two APIs: m_{get,put}_rcvif_psref that use psref(9)
for sleep-able critical sections and m_{get,put}_rcvif that use
pserialize(9) for other critical sections. The change also adds another
API called m_get_rcvif_NOMPSAFE, that is NOT MP-safe and for transition
moratorium, i.e., it is intended to be used for places where are not
planned to be MP-ified soon.

The change adds some overhead due to psref to performance sensitive paths,
however the overhead is not serious, 2% down at worst.

Proposed on tech-kern and tech-net.

Sync with HEAD

Get rid of unnecessary assignment

Check error of rt_setgate and rt_settag

Sync with HEAD

Constify rtentry of arpresolve

We don't need to (rather shouldn't) modify rtentry in there.

Fix panic on receiving an ARP request

The panic happened if an ARP request has a spa (i.e., IP address) whose
ARP entry already exists in the table as a static ARP entry.

ddb: rename show arptab to show routes

show arptab command of ddb is now inappropriate because it actually dumps
routes but arp entries aren't routes anymore. So rename it to show routes
and move the code from if_arp.c to route.c.

ok christos@

- tidy up error messages
- add a length argument to arpresolve()
- add KASSERT for overflow

Separate nexthop caches from the routing table

By this change, nexthop caches (IP-MAC address pair) are not stored
in the routing table anymore. Instead nexthop caches are stored in
each network interface; we already have lltable/llentry data structure
for this purpose. This change also obsoletes the concept of cloning/cloned
routes. Cloned routes no longer exist while cloning routes still exist
with renamed to connected routes.

Noticeable changes are:
- Nexthop caches aren't listed in route show/netstat -r
  - sysctl(NET_RT_DUMP) doesn't return them
  - If RTF_LLDATA is specified, it returns nexthop caches
- Several definitions of routing flags and messages are removed
  - RTF_CLONING, RTF_XRESOLVE, RTF_LLINFO, RTF_CLONED and RTM_RESOLVE
- RTF_CONNECTED is added
  - It has the same value of RTF_CLONING for backward compatibility
- route's -xresolve, -[no]cloned and -llinfo options are removed
  - -[no]cloning remains because it seems there are users
  - -[no]connected is introduced and recommended
    to be used instead of -[no]cloning
- route show/netstat -r drops some flags
  - 'L' and 'c' are not seen anymore
  - 'C' now indicates a connected route
- Gateway value of a route of an interface address is now not
  a L2 address but "link#N" like a connected (cloning) route
- Proxy ARP: "arp -s ... pub" doesn't create a route

You can know details of behavior changes by seeing diffs under tests/.

Proposed on tech-net and tech-kern:
  http://mail-index.netbsd.org/tech-net/2016/03/11/msg005701.html

Sync with HEAD

Remove unnecessary LLE_REMREF

The code around it was copied from arptimer, but LLE_REMREF
is unnecessary because it is needed only for arptimer that
is called after LLE_ADDREF.

This is a possible fix for PR#50548, PR#50702 and PR#50704.

Revert previous: ran cvs commit when I meant cvs diff.  Sorry!

Hit up-arrow one too few times.

Give proper prototype to ip_output.

Eliminate struct protosw::pr_output.

You can't use this unless you know what it is a priori: the formal
prototype is variadic, and the different instances (e.g., ip_output,
route_output) have different real prototypes.

Convert the only user of it, raw_send in net/raw_cb.c, to take an
explicit callback argument.  Convert the only instances of it,
route_output and key_output, to such explicit callbacks for raw_send.
Use assertions to make sure the conversion to explicit callbacks is
warranted.

Discussed on tech-net with no objections:
https://mail-index.netbsd.org/tech-net/2016/01/16/msg005484.html

Make revarprequest static

Sync with HEAD (as of 26th Dec)

Fix memory leak of llentry#la_opaque

llentry#la_opaque which is for token ring is allocated in arp.c
and freed in arp.c when freeing llentry. However, llentry can be
freed from other places, e.g., lltable_free. In such cases,
la_opaque is never freed.

To fix that, add a new callback (lle_ll_free) to llentry and
register a destruction function of la_opque to it. On freeing a
llentry, we can surely free la_opque via the callback.

Fix token_rif extractions from llentry

Introduce arp_settimer

No functional change.

Get rid of a big block in in_arpinput

No functional change.

Restore softnet_lock and KERNEL_LOCK for rtrequest and rtfree

We still need them for rt operations.

Pull up following revision(s) (requested by ozaki-r in ticket #1328):
	sys/netinet/if_arp.c: revision 1.160
Add sysctl to selectively log arp packets from unknown network. (Adrien URBAN).

Fix db_print_llinfo

rt_llinfo is now struct llentry.

Fix inappropriate rt_flags check

It depended on either RTF_CLONED or RTF_CLONING must be set, however,
the assumption didn't meet for userland problems that create a route
via RTM_ADD.

This fixes an issue that running rarpd causes the following kernel panic
reported by nonaka@:
  panic: kernel diagnostic assertion "(la->la_flags & LLE_STATIC) == 0"
  failed: file "/usr/src/sys/netinet/if_arp.c", line 1339

Pull up following revision(s) (requested by ozaki-r in ticket #985):
	sys/netinet/if_arp.c: revision 1.160
Add sysctl to selectively log arp packets from unknown network. (Adrien URBAN).

Stop callout in arp_rtrequest(RTM_DELETE)

This change fixes arptimer panic after removing an interface
(say by drvctl -d), which is reported by Takahiro Hayashi.

This change also fixes llentry's reference counting; we have
to take into account rtentry#rt_llinfo as well as arptimer.

Stop using softnet_lock (fix possible deadlock)

Using softnet_lock for mutual exclusion between lltable_free and
arptimer was wrong and had an issue causing a deadlock between
them;  lltable_free waits arptimer completion by calling
callout_halt with softnet_lock that is held in arptimer, however
lltable_free also holds llentry's lock that is also held in
arptimer so arptimer never obtain the lock and both never go
forward eventually.  We have to pass llentry's lock to
callout_halt instead.

In the event of an error within arpresolve(), delete the cloned route
otherwise it would never be deleted.

Save and clear the la route while we have a write lock

arpresolve() now returns 0 on success otherwise an error code.
Callers of arpresolve() now pass the error code back to their caller,
masking out EWOULDBLOCK.

This allows applications such as ping(8) to display a suitable error
condition.

Move the NOARP check up a bit so that it works when an la is created
but hasn't been resolved yet.
Fixes PR kern/17611.

Simplify la handling in arpresolve() by asking arplookup() not to create
a la. If a la is needed arpresolve() will then create it or mark the
current la as writable.

Create a temporary define involving IFF_STATICARP if we have it
instead of just testing for __FreeBSD__.
No functional change.

ok: ozaki-r@

Create an llentry after fixing an interface to store

In case of RTF_LOCAL routes, we change an output interface
of a route from original one to lo0ifp. An llentry also
has to be stored to lo0ifp in such cases.

Problem reported by roy@

Fix arplookup logic

It should first lookup and then create an entry if not found (and if
creation is requested).

Sync with HEAD

If, for whatever reason, a local interface route is removed and then
re-added, mark it as a local route.

While here, if changing the route to go via the loopback interface
remove any inherited MTU value.

Remove wrong KASSERT in arptfree

la_rt can be NULL because arptimer that calls arptfree doesn't always
free llentry so llentry can remain with la_rt == NULL. So we instead
check whether la_rt is NULL or not and do arptfree if not.

This fixes PR kern/50184 (confirmed by martin@) and
PR kern/50186 (maybe).

Revert v1.176 for further proper fix

CID 1322880: remove unnecessary m != NULL checks

CID 1322878: simplify log output flow

XXX: Disable KASSERT for now since locking is broken for interface removals.

Remove obsolete global variables and sysctl MIBs

Replace ARP cache (llinfo) with lltable/llentry

Highlights of the change are:
- Use llentry instead of llinfo to manage ARP caches
  - ARP specific data are stored in the hashed list
    of an interface instead of the global list (llinfo_arp)
- Fine-grain locking on llentry
- arptimer (callout) per ARP cache
  - the global timer callout with the big locks can be
    removed (though softnet_lock is still required for now)
- net.inet.arp.prune is now obsoleted
  - it was the interval of the global timer callout
- net.inet.arp.refresh is now obsoleted
  - it was a parameter that prevents expiration of active caches
  - Removed to simplify the timer logic, but we may be able to
    restore the feature if really needed

Proposed on tech-kern and tech-net.

sprinkle _KERNEL_OPT

Move insane goto label

Use time_uptime instead of time_second to avoid time leaps

Some codes in sys/net* use time_second to manage time periods such as
cache expirations. However, time_second doesn't increase monotonically
and can leap by say settimeofday(2) according to time_second(9). We
should use time_uptime instead of it to avoid such time leaps.

This change replaces time_second with time_uptime. Additionally it
converts a time based on time_uptime to a time based on time_second
when the kernel passes the time to userland programs that expect
the latter, and vice versa.

Note that we shouldn't leak time_uptime to other hosts over the
netowrk. My investigation shows there is no such leak:
http://mail-index.netbsd.org/tech-net/2015/08/06/msg005332.html

Discussed on tech-kern and tech-net.

Make global variables static

Sync with HEAD

Replace NARC with NARCNET to follow renaming at 2007

Hmm, is anyone using this?

Use LIST_FOREACH{,_SAFE}

The first loop doesn't remove any items in it, so we can use
LIST_FOREACH instead of LIST_FOREACH_SAFE.

Use NULL instead of 0 for pointers

Make arp_init, in_revarpinput and revarprequest static

Separate ARP handling DAD from inet.
This is done by signalling the intent to try tentative addresses
and then clearing the intent once the address is setup.
When the ARP handler is installed (arp_ifinit) then it adds
dad start and stop functions to the address which are used instead
of calling ARP directly.

Rename delay variable as it shadows a global on arm.

Add IPv4 address flags IN_IFF_TENTATIVE, IN_IFF_DUPLICATED and
IN_IFF_DETATCHED to mimic the IPv6 address behaviour.
Add SIOCGIFAFLAG_IN ioctl to retrieve the address flag via the
ifreq structure.
Add IPv4 DAD detection via the ARP methods described in RFC 5227.
Add sysctls net.inet.ip.dad_count and net.inet.arp.debug.

Discussed on tech-net@

Sync with HEAD

Add RTF_BROADCAST to mark routes used for the broadcast address when
they are created on the fly. This makes it clear what the route is for
and allows an optimisation in ip_output() by avoiding a call to
in_broadcast() because most of the time we do talk to a host.
It also avoids a needless allocation for the storage of llinfo_arp and
thus vanishes from arp(8) - it showed as incomplete anyway so this
is a nice side effect.

Guard against this and routes marked with RTF_BLACKHOLE in
ip_fastforward().
While here, guard against routes marked with RTF_BLACKHOLE in
ip6_fastforward().
RTF_BROADCAST is IPv4 only, so don't bother checking that here.

Introduce the routing flag RTF_LOCAL to track local address routes.
Add functions rt_ifa_addlocal() and rt_ifa_remlocal() to add and remove
local routes for the address and announce the new address and route
to the routing socket.

Add in_ifaddlocal() and in_ifremlocal() to use these functions.
Rename in6_if{add,rem}loop() to in6_if{add,rem}local() and use these
functions.

rtinit() no longer announces the address, just the network route for the
address. As such, calls to rt_newaddrmsg() have been removed from
in_addprefix() and in_scrubprefix().

This solves the problem of potentially more than one announcement, or no
announcement at all for the address in certain situations.

Add sysctl to selectively log arp packets from unknown network. (Adrien URBAN).

Deanonymize structure for llinfo_arp.

Rebase to HEAD as of a few days ago.

Rebase.

Pull up following revision(s) (requested by bouyer in ticket #1067):
	sys/dist/ipf/netinet/ip_fil_netbsd.c	1.9 via patch
	sys/net/if_ethersubr.c			1.197 via patch
	sys/net/if_loop.c			1.77 via patch
	sys/net/if_vlan.c			1.70 via patch
	sys/netinet/if_arp.c			1.158
	sys/netinet/ip_carp.c			1.54 via patch
	sys/netinet6/ip6_flow.c			1.23 via patch
	sys/netinet6/nd6.c			1.150 via patch
	sys/rump/librump/rumpkern/klock.c	1.4

Make sure *(if_output)() is called with KERNEL_LOCK held to avoid mbuf leak.
See http://mail-index.netbsd.org/tech-net/2014/04/09/msg004511.html
for details. For netinet6, the problem report, fix and test were done
by njoly@ on current-users@

Pull up following revision(s) (requested by bouyer in ticket #1067):
	sys/dist/ipf/netinet/ip_fil_netbsd.c	1.9 via patch
	sys/net/if_ethersubr.c			1.197 via patch
	sys/net/if_loop.c			1.77 via patch
	sys/net/if_vlan.c			1.70 via patch
	sys/netinet/if_arp.c			1.158
	sys/netinet/ip_carp.c			1.54 via patch
	sys/netinet6/ip6_flow.c			1.23 via patch
	sys/netinet6/nd6.c			1.150 via patch
	sys/rump/librump/rumpkern/klock.c	1.4

Make sure *(if_output)() is called with KERNEL_LOCK held to avoid mbuf leak.
See http://mail-index.netbsd.org/tech-net/2014/04/09/msg004511.html
for details. For netinet6, the problem report, fix and test were done
by njoly@ on current-users@

Pull up following revision(s) (requested by bouyer in ticket #1067):
	sys/dist/ipf/netinet/ip_fil_netbsd.c	1.9 via patch
	sys/net/if_ethersubr.c			1.197 via patch
	sys/net/if_loop.c			1.77 via patch
	sys/net/if_vlan.c			1.70 via patch
	sys/netinet/if_arp.c			1.158
	sys/netinet/ip_carp.c			1.54 via patch
	sys/netinet6/ip6_flow.c			1.23 via patch
	sys/netinet6/nd6.c			1.150 via patch
	sys/rump/librump/rumpkern/klock.c	1.4

Make sure *(if_output)() is called with KERNEL_LOCK held to avoid mbuf leak.
See http://mail-index.netbsd.org/tech-net/2014/04/09/msg004511.html
for details. For netinet6, the problem report, fix and test were done
by njoly@ on current-users@

Call ifp->if_output in revarprequest with KERNEL_LOCK held

Otherwise, it hits KASSERT(KERNEL_LOCKED_P()) in ether_output
when nfs_boot fails and tries RARP.

sync with head.

for a reference, the tree before this commit was tagged
as yamt-pagecache-tag8.

this commit was splitted into small chunks to avoid
a limitation of cvs.  ("Protocol error: too many arguments")

sync with head

Add struct pr_usrreqs with a pr_generic function and prepare for the
dismantling of pr_usrreq in the protocols; no functional change intended.
PRU_ATTACH/PRU_DETACH changes will follow soon.

Bump for struct protosw.  Welcome to 6.99.62!

revarprequest: Avoid leaking mbuf.

In revarprequest, an mbuf could perhaps be leaked in an error path.
My reading of the code is that this is not possible, because ar_pro is
set to ETHERNET_IP, and ar_tha can only be null in the 1394 case.
But, better to have the free call anyway; ar_tha does not have a
documented interface contract :-)

Pointed out by Maxime Villard.

Ensure that the top level sysctl nodes (kern, vfs, net, ...) exist before
the sysctl link sets are processed, and remove redundancy.

Shaves >13kB off of an amd64 GENERIC, not to mention >1k duplicate
lines of code.

Checkpoint work in progress:
- Initial split of the protocol user-request method into the following
  methods: pr_attach, pr_detach and pr_generic for old the pr_usrreq.
- Adjust socreate(9) and sonewconn(9) to call pr_attach without the
  socket lock held (as a preparation for the locking scheme adjustment).
- Adjust all pr_attach routines to assert that PCB is not set.
- Sprinkle various comments, document some routines and their locking.
- Remove M_PCB, replace with kmem(9).
- Fix few bugs spotted on the way.

sync with head

merge to -current.

Remove dead variable

- fix offsetof usage, and redundant defines
- kill pointer casts to 0

Add 3 logging sysctls for arp from freebsd:

1. log_movements: do you want to log the arp overwritten message or not?
2. log_wrong_iface: do you want to log when an arp arrives at the wrong
   interface?
3. log_permanent_modify: do you want to log when an arp message attempts
   to overwrite a static entry?

I did not call the sysctls log_arp like FreeBSD does, because we already
have an arp sysctl level. The default is on for all three of them.

Sync with HEAD.

sync with head

arp_drain() may be called with locks held, so instead of doing any work
in arp_drain(), set a drain-needed flag.  Do the work in the fasttimo
handler.

Contributed by Coyote Point Systems, Inc.

sync with head

Sync with HEAD

Add a new AF/PF_ROUTE which is 64-bit clean which makes the routing socket
interface (and its associated sysctls) act identically for both 32 and 64 bit
programs.  The old unclean one remains for backward compatibility.

Fix printf for u_quad_t route changes.

sync to netbsd-5

sync with head

Pull up following revision(s) (requested by christos in ticket #1156):
	sys/net/if_arcsubr.c: revision 1.61
	sys/net/if_ethersubr.c: revision 1.173
	sys/net/if_fddisubr.c: revision 1.78
	sys/net/if_tokensubr.c: revision 1.58 via patch
	sys/netinet/if_arp.c: revision 1.149
ar_tha() can return NULL; treat this as an error.

Pull up following revision(s) (requested by christos in ticket #1156):
	sys/net/if_arcsubr.c: revision 1.61
	sys/net/if_ethersubr.c: revision 1.173
	sys/net/if_fddisubr.c: revision 1.78
	sys/net/if_tokensubr.c: revision 1.58 via patch
	sys/netinet/if_arp.c: revision 1.149
ar_tha() can return NULL; treat this as an error.

ar_tha() can return NULL; treat this as an error.

Handle RFC 5227 ARP probes properly, don't drop 0.0.0.0 source packets
silently. (Patrik Lahti <plahti at qnx dot com>)

Replace a large number of link set based sysctl node creations with
calls from subsystem constructors.  Benefits both future kernel
modules and rump.

no change to sysctl nodes on i386/MONOLITHIC & build tested i386/ALL

Pull up following revision(s) (requested by dyoung in ticket #911):
	sys/netinet/if_arp.c: revision 1.146
Don't require the gateway address to have room for both an interface
name and address.  Room for an address will do.  This should fix
a regression in 'arp -s ...' on interfaces such as xennet0 with
unusually long names. Fix PR #41878.

sync with head.

Don't require the gateway address to have room for both an interface
name and address.  Room for an address will do.  This should fix
a regression in 'arp -s ...' on interfaces such as xennet0 with
unusually long names.

I will request a pull-up to netbsd-5.

sync with head.

Sync with HEAD.

Sync with HEAD.

merge christos-time_t

fix time_t format

Update haad-dm branch to haad-dm-base2.

merge with head.

*** Summary ***

When a link-layer address changes (e.g., ifconfig ex0 link
02:de:ad:be:ef:02 active), send a gratuitous ARP and/or a Neighbor
Advertisement to update the network-/link-layer address bindings
on our LAN peers.

Refuse a change of ethernet address to the address 00:00:00:00:00:00
or to any multicast/broadcast address.  (Thanks matt@.)

Reorder ifnet ioctl operations so that driver ioctls may inherit
the functions of their "class"---ether_ioctl(), fddi_ioctl(), et
cetera---and the class ioctls may inherit from the generic ioctl,
ifioctl_common(), but both driver- and class-ioctls may override
the generic behavior.  Make network drivers share more code.

Distinguish a "factory" link-layer address from others for the
purposes of both protecting that address from deletion and computing
EUI64.

Return consistent, appropriate error codes from network drivers.

Improve readability.  KNF.

*** Details ***

In if_attach(), always initialize the interface ioctl routine,
ifnet->if_ioctl, if the driver has not already initialized it.
Delete if_ioctl == NULL tests everywhere else, because it cannot
happen.

In the ioctl routines of network interfaces, inherit common ioctl
behaviors by calling either ifioctl_common() or whichever ioctl
routine is appropriate for the class of interface---e.g., ether_ioctl()
for ethernets.

Stop (ab)using SIOCSIFADDR and start to use SIOCINITIFADDR.  In
the user->kernel interface, SIOCSIFADDR's argument was an ifreq,
but on the protocol->ifnet interface, SIOCSIFADDR's argument was
an ifaddr.  That was confusing, and it would work against me as I
make it possible for a network interface to overload most ioctls.
On the protocol->ifnet interface, replace SIOCSIFADDR with
SIOCINITIFADDR.  In ifioctl(), return EPERM if userland tries to
invoke SIOCINITIFADDR.

In ifioctl(), give the interface the first shot at handling most
interface ioctls, and give the protocol the second shot, instead
of the other way around. Finally, let compatibility code (COMPAT_OSOCK)
take a shot.

Pull device initialization out of switch statements under
SIOCINITIFADDR.  For example, pull ..._init() out of any switch
statement that looks like this:

        switch (...->sa_family) {
        case ...:
                ..._init();
                ...
                break;
        ...
        default:
                ..._init();
                ...
                break;
        }

Rewrite many if-else clauses that handle all permutations of IFF_UP
and IFF_RUNNING to use a switch statement,

        switch (x & (IFF_UP|IFF_RUNNING)) {
        case 0:
                ...
                break;
        case IFF_RUNNING:
                ...
                break;
        case IFF_UP:
                ...
                break;
        case IFF_UP|IFF_RUNNING:
                ...
                break;
        }

unifdef lots of code containing #ifdef FreeBSD, #ifdef NetBSD, and
#ifdef SIOCSIFMTU, especially in fwip(4) and in ndis(4).

In ipw(4), remove an if_set_sadl() call that is out of place.

In nfe(4), reuse the jumbo MTU logic in ether_ioctl().

Let ethernets register a callback for setting h/w state such as
promiscuous mode and the multicast filter in accord with a change
in the if_flags: ether_set_ifflags_cb() registers a callback that
returns ENETRESET if the caller should reset the ethernet by calling
if_init(), 0 on success, != 0 on failure.  Pull common code from
ex(4), gem(4), nfe(4), sip(4), tlp(4), vge(4) into ether_ioctl(),
and register if_flags callbacks for those drivers.

Return ENOTTY instead of EINVAL for inappropriate ioctls.  In
zyd(4), use ENXIO instead of ENOTTY to indicate that the device is
not any longer attached.

Add to if_set_sadl() a boolean 'factory' argument that indicates
whether a link-layer address was assigned by the factory or some
other source.  In a comment, recommend using the factory address
for generating an EUI64, and update in6_get_hw_ifid() to prefer a
factory address to any other link-layer address.

Add a routing message, RTM_LLINFO_UPD, that tells protocols to
update the binding of network-layer addresses to link-layer addresses.
Implement this message in IPv4 and IPv6 by sending a gratuitous
ARP or a neighbor advertisement, respectively.  Generate RTM_LLINFO_UPD
messages on a change of an interface's link-layer address.

In ether_ioctl(), do not let SIOCALIFADDR set a link-layer address
that is broadcast/multicast or equal to 00:00:00:00:00:00.

Make ether_ioctl() call ifioctl_common() to handle ioctls that it
does not understand.

In gif(4), initialize if_softc and use it, instead of assuming that
the gif_softc and ifp overlap.

Let ifioctl_common() handle SIOCGIFADDR.

Sprinkle rtcache_invariants(), which checks on DIAGNOSTIC kernels
that certain invariants on a struct route are satisfied.

In agr(4), rewrite agr_ioctl_filter() to be a bit more explicit
about the ioctls that we do not allow on an agr(4) member interface.

bzero -> memset.  Delete unnecessary casts to void *.  Use
sockaddr_in_init() and sockaddr_in6_init().  Compare pointers with
NULL instead of "testing truth".  Replace some instances of (type
*)0 with NULL.  Change some K&R prototypes to ANSI C, and join
lines.

Sync with head.

Constify the rt_addrinfo argument to the ifa_rtrequest member
function of struct ifaddr.

arp_drain: no reason to complain if arp_lock is already held.

Sync with HEAD.

Sync with HEAD.

Sync with wrstuden-revivesa-base-2.

Sync with netbsd-4.

Pull up following revision(s) (requested by uebayasi in ticket #1191):
	sys/netinet/if_arp.c: revision 1.141
Missing "\n" in log(9) messages.

Pull up following revision(s) (requested by uebayasi in ticket #1191):
	sys/netinet/if_arp.c: revision 1.141
Missing "\n" in log(9) messages.

Pull up following revision(s) (requested by uebayasi in ticket #1956):
	sys/netinet/if_arp.c: revision 1.141
Missing "\n" in log(9) messages.

Pull up following revision(s) (requested by uebayasi in ticket #1956):
	sys/netinet/if_arp.c: revision 1.141
Missing "\n" in log(9) messages.

Pull up following revision(s) (requested by uebayasi in ticket #1956):
	sys/netinet/if_arp.c: revision 1.141
Missing "\n" in log(9) messages.

Missing "\n" in log(9) messages.

Sync w/ -current. 34 merge conflicts to follow.

Sync with HEAD.

sync with head.

sync with head.

bzero -> memset, bcopy -> memcpy.

Cosmetic: use __arraycount().  s/0/NULL/ where appropriate.  Pass
"null" instead of 0 to printf %s.  Remove superfluous parentheses
in return statements.  Compare pointers with NULL instead of "testing
truth."

Use memset() instead of Bzero().

In arplookup1(), put the static sockaddr_inarp onto the stack, and
zero it before use.

Simplify the interface to netstat_sysctl() and allocate space for
the collated counters using kmem_alloc().

PR kern/38577

PR kern/38497 Out of memory allocating ksiginfo

Work around: don't acquire softnet_lock in protocol drain routines.

Remove clause 3 and 4 from TNF licenses

Merge the socket locking patch:

- Socket layer becomes MP safe.
- Unix protocols become MP safe.
- Allows protocol processing interrupts to safely block on locks.
- Fixes a number of race conditions.

With much feedback from matt@ and plunky@.

Use <net/net_stats.h> / netstat_sysctl().

Make ARP stats per-cpu.

Welcome to the time_t=long long dev_t=uint64_t branch.

sync with HEAD

Sync with HEAD.

Sync with HEAD.

sync with head

Now that __HAVE_TIMECOUNTER and __HAVE_GENERIC_TODR are invariants,
remove the conditionals and the code associated with the undef case.

sync with HEAD

Sync with HEAD.

Pullup to HEAD

Sync with HEAD.

Sync with head.

Use struct initializers. No functional change.

Sync with HEAD.

Sync with HEAD

sync with head.

Sync with HEAD.

Follow up on arc -> arcnet renaming.  Pointed out by joerg@.

sync with HEAD

Sync with head.

Sync with HEAD.

sync with head.

Sync with HEAD.

We cannot sleep in a software interrupt, so do not sockaddr_dl_alloc(...,
M_WAITOK).  Instead, sockaddr_dl_init() a sockaddr_dl on the stack.

Use malloc(9) for sockaddrs instead of pool(9), and remove dom_sa_pool
and dom_sa_len members from struct domain.  Pools of fixed-size
objects are too rigid for sockaddr_dls, whose size can vary over
a wide range.

Return sockaddr_dl to its "historical" size.  Now that I'm using
malloc(9) instead of pool(9) to allocate sockaddr_dl, I can create
a sockaddr_dl of any size in the kernel, so expanding sockaddr_dl
is useless.

Avoid using sizeof(struct sockaddr_dl) in the kernel.

Introduce sockaddr_dl_alloc() for allocating & initializing an
arbitrary sockaddr_dl on the heap.

Add an argument, the sockaddr length, to sockaddr_alloc(),
sockaddr_copy(), and sockaddr_dl_setaddr().

Constify: LLADDR() -> CLLADDR().

Where the kernel overwrites LLADDR(), use sockaddr_dl_setaddr(),
instead.  Used properly, sockaddr_dl_setaddr() will not overrun
the end of the sockaddr.

Reorganize and extract arplookup1() for code-sharing.  Share
null_sdl.  Introduce arp_setgate() for initializing a link-layer
nexthop, and use it to fulfill RTM_SETGATE requests.

Sync with HEAD.

Sync with HEAD.

Take steps to hide the radix_node implementation of the forwarding table
from the forwarding table's users:

        Introduce rt_walktree() for walking the routing table and
        applying a function to each rtentry.  Replace most
        rn_walktree() calls with it.

        Use rt_getkey()/rt_setkey() to get/set a route's destination.
        Keep a pointer to the sockaddr key in the rtentry, so that
        rtentry users do not have to grovel in the radix_node for
        the key.

        Add a RTM_GET method to rtrequest.  Use that instead of
        radix_node lookups in, e.g., carp(4).

Add sys/net/link_proto.c, which supplies sockaddr routines for
link-layer socket addresses (sockaddr_dl).

Cosmetic:

        Constify.  KNF.  Stop open-coding LIST_FOREACH, TAILQ_FOREACH,
        et cetera.  Use NULL instead of 0 for null pointers.  Use
        __arraycount().  Reduce gratuitous parenthesization.

        Stop using variadic arguments for rip6_output(), it is
        unnecessary.

        Remove the unnecessary rtentry member rt_genmask and the
        code to maintain it, since nothing actually used it.

        Make rt_maskedcopy() easier to read by using meaningful variable
        names.

        Extract a subroutine intern_netmask() for looking up a netmask in
        the masks table.

        Start converting backslash-ridden IPv6 macros in
        sys/netinet6/in6_var.h into inline subroutines that one
        can read without special eyeglasses.

One functional change: when the kernel serves an RTM_GET, RTM_LOCK,
or RTM_CHANGE request, it applies the netmask (if supplied) to a
destination before searching for it in the forwarding table.

I have changed sys/netinet/ip_carp.c, carp_setroute(), to remove
the unlawful radix_node knowledge.

Apart from the changes to carp(4), netiso, ATM, and strip(4), I
have run the changes on three nodes in my wireless routing testbed,
which involves IPv4 + IPv6 dynamic routing acrobatics, and it's
working beautifully so far.

file if_arp.c was added on branch matt-mips64 on 2007-07-19 20:48:54 +0000

Take steps to hide the radix_node implementation of the forwarding table
from the forwarding table's users:

        Introduce rt_walktree() for walking the routing table and
        applying a function to each rtentry.  Replace most
        rn_walktree() calls with it.

        Use rt_getkey()/rt_setkey() to get/set a route's destination.
        Keep a pointer to the sockaddr key in the rtentry, so that
        rtentry users do not have to grovel in the radix_node for
        the key.

        Add a RTM_GET method to rtrequest.  Use that instead of
        radix_node lookups in, e.g., carp(4).

Add sys/net/link_proto.c, which supplies sockaddr routines for
link-layer socket addresses (sockaddr_dl).

Cosmetic:

        Constify.  KNF.  Stop open-coding LIST_FOREACH, TAILQ_FOREACH,
        et cetera.  Use NULL instead of 0 for null pointers.  Use
        __arraycount().  Reduce gratuitous parenthesization.

        Stop using variadic arguments for rip6_output(), it is
        unnecessary.

        Remove the unnecessary rtentry member rt_genmask and the
        code to maintain it, since nothing actually used it.

        Make rt_maskedcopy() easier to read by using meaningful variable
        names.

        Extract a subroutine intern_netmask() for looking up a netmask in
        the masks table.

        Start converting backslash-ridden IPv6 macros in
        sys/netinet6/in6_var.h into inline subroutines that one
        can read without special eyeglasses.

One functional change: when the kernel serves an RTM_GET, RTM_LOCK,
or RTM_CHANGE request, it applies the netmask (if supplied) to a
destination before searching for it in the forwarding table.

I have changed sys/netinet/ip_carp.c, carp_setroute(), to remove
the unlawful radix_node knowledge.

Apart from the changes to carp(4), netiso, ATM, and strip(4), I
have run the changes on three nodes in my wireless routing testbed,
which involves IPv4 + IPv6 dynamic routing acrobatics, and it's
working beautifully so far.

Sync with head.

Sync with head.

Merge some of the less invasive changes from the vmlocking branch:

- kthread, callout, devsw API changes
- select()/poll() improvements
- miscellaneous MT safety improvements

Adapt to callout API change.

Complete removal of radix_node knowledge.

Get rid of radix_node_head.rnh_walktree, because it is only ever
set to rn_walktree.

Introduce rt_walktree(), which applies a subroutine to every route
in a particular address family.  Use it instead of rn_walktree()
virtually everywhere.  This helps to hide the routing table
implementation.

Sync with HEAD.

Kill caddr_t; there will be some MI fallout, but it will be fixed shortly.

- sync with head.
- move sched_changepri back to kern_synch.c as it doesn't know PPQ anymore.

sync with head.

Fix lossage from boolean_t -> bool and updated x86 bus_dma.

KNF: de-__P, bzero -> memset, bcmp -> memcmp.  Remove extraneous
   parentheses in return statements.

Cosmetic: don't open-code TAILQ_FOREACH().

Cosmetic: change types of variables to avoid oodles of casts: in
   in6_src.c, avoid casts by changing several route_in6 pointers
   to struct route pointers.  Remove unnecessary casts to caddr_t
   elsewhere.

Pave the way for eliminating address family-specific route caches:
   soon, struct route will not embed a sockaddr, but it will hold
   a reference to an external sockaddr, instead.  We will set the
   destination sockaddr using rtcache_setdst().  (I created a stub
   for it, but it isn't used anywhere, yet.)  rtcache_free() will
   free the sockaddr.  I have extracted from rtcache_free() a helper
   subroutine, rtcache_clear().  rtcache_clear() will "forget" a
   cached route, but it will not forget the destination by releasing
   the sockaddr.  I use rtcache_clear() instead of rtcache_free()
   in rtcache_update(), because rtcache_update() is not supposed
   to forget the destination.

Constify:

   1 Introduce const accessor for route->ro_dst, rtcache_getdst().

   2 Constify the 'dst' argument to ifnet->if_output().  This
     led me to constify a lot of code called by output routines.

   3 Constify the sockaddr argument to protosw->pr_ctlinput.  This
     led me to constify a lot of code called by ctlinput routines.

   4 Introduce const macros for converting from a generic sockaddr
     to family-specific sockaddrs, e.g., sockaddr_in: satocsin6,
     satocsin, et cetera.

file if_arp.c was added on branch yamt-idlelwp on 2007-02-27 16:54:52 +0000

bcopy -> memcpy

Use NULL instead of (struct rtentry *)0.

Sync with head.

sync with head.

sync with head.

fix spelling of accidentally; from Zapher

Sync with head.

__unused removal on arguments; approved by core.

Add a source-address selection policy mechanism to the kernel.

Also, add ioctls SIOCGIFADDRPREF/SIOCSIFADDRPREF to get/set preference
numbers for addresses.  Make ifconfig(8) set/display preference
numbers.

To activate source-address selection policies in your kernel, add
'options IPSELSRC' to your kernel configuration.

Miscellaneous changes in support of source-address selection:

        1 Factor out some common code, producing rt_replace_ifa().

        2 Abbreviate a for-loop with TAILQ_FOREACH().

        3 Add the predicates on IPv4 addresses IN_LINKLOCAL() and
          IN_PRIVATE(), that are true for link-local unicast
          (169.254/16) and RFC1918 private addresses, respectively.
          Add the predicate IN_ANY_LOCAL() that is true for link-local
          unicast and multicast.

        4 Add IPv4-specific interface attach/detach routines,
          in_domifattach and in_domifdetach, which build #ifdef
          IPSELSRC.

See in_getifa(9) for a more thorough description of source-address
selection policy.

sync with head

- sprinkle __unused on function decls.
- fix a couple of unused bugs
- no more -Wno-unused for i386

sync with head

sync with head.

Fix initializers

sync with head.

sync with head.

Sync with head.

merge FreeBSD timecounters from branch simonb-timecounters
- struct timeval time is gone
  time.tv_sec -> time_second
- struct timeval mono_time is gone
  mono_time.tv_sec -> time_uptime
- access to time via
	{get,}{micro,nano,bin}time()
	get* versions are fast but less precise
- support NTP nanokernel implementation (NTP API 4)
- further reading:
  Timecounter Paper: http://phk.freebsd.dk/pubs/timecounter.pdf
  NTP Nanokernel: http://www.eecis.udel.edu/~mills/ntp/html/kern.html

Sync with head.

Make sure the mbuf is writable before trying to write to it.

Merge 2006-05-24 NetBSD-current into the "peter-altq" branch.

sync with head.