 @@ -1,14 +1,14 @@
-/*	$NetBSD: if_arp.c,v 1.242 2017/02/11 15:37:30 roy Exp $	*/
+/*	$NetBSD: if_arp.c,v 1.243 2017/02/21 03:58:23 ozaki-r Exp $	*/
 /*-
  * Copyright (c) 1998, 2000, 2008 The NetBSD Foundation, Inc.
  * All rights reserved.
+ *
  * This code is derived from software contributed to The NetBSD Foundation
  * by Public Access Networks Corporation ("Panix").  It was developed under
  * contract to Panix by Eric Haszlakiewicz and Thor Lancelot Simon.
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
 @@ -58,43 +58,43 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
+ *
  *	@(#)if_ether.c	8.2 (Berkeley) 9/26/94
  */
 /*
  * Ethernet address resolution protocol.
  * TODO:
  *	add "inuse/lock" bit (or ref. count) along with valid bit
  */
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: if_arp.c,v 1.242 2017/02/11 15:37:30 roy Exp $");
+__KERNEL_RCSID(0, "$NetBSD: if_arp.c,v 1.243 2017/02/21 03:58:23 ozaki-r Exp $");
 #ifdef _KERNEL_OPT
 #include "opt_ddb.h"
 #include "opt_inet.h"
 #include "opt_net_mpsafe.h"
 #endif
 #ifdef INET
 #include "arp.h"
 #include "bridge.h"
 #include <sys/param.h>
 #include <sys/systm.h>
 #include <sys/callout.h>
-#include <sys/malloc.h>
+#include <sys/kmem.h>
 #include <sys/mbuf.h>
 #include <sys/socket.h>
 #include <sys/time.h>
 #include <sys/timetc.h>
 #include <sys/kernel.h>
 #include <sys/errno.h>
 #include <sys/ioctl.h>
 #include <sys/syslog.h>
 #include <sys/proc.h>
 #include <sys/protosw.h>
 #include <sys/domain.h>
 #include <sys/sysctl.h>
 #include <sys/socketvar.h>
 @@ -1505,27 +1505,26 @@ arp_ifinit(struct ifnet *ifp, struct ifa
+}
 TAILQ_HEAD(dadq_head, dadq);
 struct dadq {
 	TAILQ_ENTRY(dadq) dad_list;
 	struct ifaddr *dad_ifa;
 	int dad_count;		/* max ARP to send */
 	int dad_arp_tcount;	/* # of trials to send ARP */
 	int dad_arp_ocount;	/* ARP sent so far */
 	int dad_arp_announce;	/* max ARP announcements */
 	int dad_arp_acount;	/* # of announcements */
 	struct callout dad_timer_ch;
 };
 MALLOC_JUSTDEFINE(M_IPARP, "ARP DAD", "ARP DAD Structure");
 static struct dadq_head dadq;
 static int dad_init = 0;
 static int dad_maxtry = 15;     /* max # of *tries* to transmit DAD packet */
 static kmutex_t arp_dad_lock;
 static struct dadq *
 arp_dad_find(struct ifaddr *ifa)
+{
 	struct dadq *dp;
 	KASSERT(mutex_owned(&arp_dad_lock));
 @@ -1603,48 +1602,50 @@ arp_dad_start(struct ifaddr *ifa)
 		    ifa->ifa_ifp ? if_name(ifa->ifa_ifp) : "???");
 		return;
+	}
 	if (!ip_dad_count) {
 		ia->ia4_flags &= ~IN_IFF_TENTATIVE;
 		rt_newaddrmsg(RTM_NEWADDR, ifa, 0, NULL);
 		arpannounce1(ifa);
 		return;
+	}
 	KASSERT(ifa->ifa_ifp != NULL);
 	if (!(ifa->ifa_ifp->if_flags & IFF_UP))
 		return;
 	dp = kmem_intr_alloc(sizeof(*dp), KM_NOSLEEP);
 	mutex_enter(&arp_dad_lock);
 	if (arp_dad_find(ifa) != NULL) {
 		mutex_exit(&arp_dad_lock);
 		/* DAD already in progress */
 		if (dp != NULL)
 			kmem_intr_free(dp, sizeof(*dp));
 		return;
+	}
 	dp = malloc(sizeof(*dp), M_IPARP, M_NOWAIT);
 	if (dp == NULL) {
 		mutex_exit(&arp_dad_lock);
 		log(LOG_ERR, "%s: memory allocation failed for %s(%s)\n",
 		    __func__, in_fmtaddr(ipbuf, ia->ia_addr.sin_addr),
 		    ifa->ifa_ifp ? if_name(ifa->ifa_ifp) : "???");
 		return;
+	}
 	memset(dp, 0, sizeof(*dp));
 	callout_init(&dp->dad_timer_ch, CALLOUT_MPSAFE);
 	/*
 	 * Send ARP packet for DAD, ip_dad_count times.
 	 * Note that we must delay the first transmission.
 	 */
 	callout_init(&dp->dad_timer_ch, CALLOUT_MPSAFE);
 	dp->dad_ifa = ifa;
 	ifaref(ifa);	/* just for safety */
 	dp->dad_count = ip_dad_count;
 	dp->dad_arp_announce = 0; /* Will be set when starting to announce */
 	dp->dad_arp_acount = dp->dad_arp_ocount = dp->dad_arp_tcount = 0;
 	TAILQ_INSERT_TAIL(&dadq, (struct dadq *)dp, dad_list);
 	ARPLOG(LOG_DEBUG, "%s: starting DAD for %s\n", if_name(ifa->ifa_ifp),
 	    ARPLOGADDR(ia->ia_addr.sin_addr));
 	arp_dad_starttimer(dp, cprng_fast32() % (PROBE_WAIT * hz));
 	mutex_exit(&arp_dad_lock);
 @@ -1665,37 +1666,37 @@ arp_dad_stop(struct ifaddr *ifa)
 	dp = arp_dad_find(ifa);
 	if (dp == NULL) {
 		mutex_exit(&arp_dad_lock);
 		/* DAD wasn't started yet */
 		return;
+	}
 	/* Prevent the timer from running anymore. */
 	TAILQ_REMOVE(&dadq, dp, dad_list);
 	mutex_exit(&arp_dad_lock);
 	arp_dad_stoptimer(dp);
-	free(dp, M_IPARP);
+	kmem_intr_free(dp, sizeof(*dp));
 	dp = NULL;
 	ifafree(ifa);
+}
 static void
 arp_dad_timer(struct ifaddr *ifa)
+{
 	struct in_ifaddr *ia = (struct in_ifaddr *)ifa;
 	struct dadq *dp;
 	char ipbuf[INET_ADDRSTRLEN];
 	bool need_free = false;
 #ifndef NET_MPSAFE
 	mutex_enter(softnet_lock);
 	KERNEL_LOCK(1, NULL);
 #endif
 	mutex_enter(&arp_dad_lock);
 	/* Sanity check */
 	if (ia == NULL) {
 		log(LOG_ERR, "%s: called with null parameter\n", __func__);
 		goto done;
+	}
 	dp = arp_dad_find(ifa);
 @@ -1713,29 +1714,27 @@ arp_dad_timer(struct ifaddr *ifa)
+	{
 		log(LOG_ERR, "%s: called with non-tentative address %s(%s)\n",
 		    __func__, in_fmtaddr(ipbuf, ia->ia_addr.sin_addr),
 		    ifa->ifa_ifp ? if_name(ifa->ifa_ifp) : "???");
 		goto done;
+	}
 	/* timeouted with IFF_{RUNNING,UP} check */
 	if (dp->dad_arp_tcount > dad_maxtry) {
 		ARPLOG(LOG_INFO, "%s: could not run DAD, driver problem?\n",
 		    if_name(ifa->ifa_ifp));
 		TAILQ_REMOVE(&dadq, dp, dad_list);
-		free(dp, M_IPARP);
+		need_free = true;
 		dp = NULL;
 		ifafree(ifa);
 		goto done;
+	}
 	/* Need more checks? */
 	if (dp->dad_arp_ocount < dp->dad_count) {
 		int adelay;
 		/*
 		 * We have more ARP to go.  Send ARP packet for DAD.
 		 */
 		arp_dad_output(dp, ifa);
 		if (dp->dad_arp_ocount < dp->dad_count)
 			adelay = (PROBE_MIN * hz) +
 @@ -1764,32 +1763,35 @@ announce:
 		 */
 		arpannounce1(ifa);
 		dp->dad_arp_acount++;
 		if (dp->dad_arp_acount < dp->dad_arp_announce) {
 			arp_dad_starttimer(dp, ANNOUNCE_INTERVAL * hz);
 			goto done;
+		}
 		ARPLOG(LOG_DEBUG,
 		    "%s: ARP announcement complete for %s\n",
 		    if_name(ifa->ifa_ifp), ARPLOGADDR(ia->ia_addr.sin_addr));
+	}
 	TAILQ_REMOVE(&dadq, dp, dad_list);
-	free(dp, M_IPARP);
+	need_free = true;
 	dp = NULL;
 	ifafree(ifa);
 done:
 	mutex_exit(&arp_dad_lock);
 	if (need_free) {
 		kmem_intr_free(dp, sizeof(*dp));
 		ifafree(ifa);
+	}
 #ifndef NET_MPSAFE
 	KERNEL_UNLOCK_ONE(NULL);
 	mutex_exit(softnet_lock);
 #endif
+}
 static void
 arp_dad_duplicated(struct ifaddr *ifa, const char *sha)
+{
 	struct in_ifaddr *ia = (struct in_ifaddr *)ifa;
 	struct ifnet *ifp = ifa->ifa_ifp;
 	char ipbuf[INET_ADDRSTRLEN];
 	const char *iastr;

 @@ -1,14 +1,14 @@
-/*	$NetBSD: if_inarp.h,v 1.50 2016/10/11 12:32:30 roy Exp $	*/
+/*	$NetBSD: if_inarp.h,v 1.51 2017/02/21 03:58:24 ozaki-r Exp $	*/
 /*
  * Copyright (c) 1982, 1986, 1993
  *	The Regents of the University of California.  All rights reserved.
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
  *    documentation and/or other materials provided with the distribution.
 @@ -59,29 +59,26 @@ struct sockaddr_inarp {
 /* ARP timings from RFC5227 */
 #define PROBE_WAIT               1
 #define PROBE_NUM                3
 #define PROBE_MIN                1
 #define PROBE_MAX                2
 #define ANNOUNCE_WAIT            2
 #define ANNOUNCE_NUM             2
 #define ANNOUNCE_INTERVAL        2
 #define MAX_CONFLICTS           10
 #define RATE_LIMIT_INTERVAL     60
 #define DEFEND_INTERVAL         10
 #include <sys/malloc.h>
 MALLOC_DECLARE(M_IPARP);
 extern struct ifqueue arpintrq;
 void arp_ifinit(struct ifnet *, struct ifaddr *);
 void arp_rtrequest(int, struct rtentry *, const struct rt_addrinfo *);
 int arpresolve(struct ifnet *, const struct rtentry *, struct mbuf *,
     const struct sockaddr *, void *, size_t);
 void arpintr(void);
 void arpannounce(struct ifnet *, struct ifaddr *, const uint8_t *);
 void arp_drain(void);
 int arpioctl(u_long, void *);
 void arpwhohas(struct ifnet *, struct in_addr *);
 void revarpinput(struct mbuf *);
 int revarpwhoarewe(struct ifnet *, struct in_addr *, struct in_addr *);

 @@ -1,14 +1,14 @@
-/*	$NetBSD: nd6_nbr.c,v 1.136 2017/01/16 15:44:47 christos Exp $	*/
+/*	$NetBSD: nd6_nbr.c,v 1.137 2017/02/21 03:58:24 ozaki-r Exp $	*/
 /*	$KAME: nd6_nbr.c,v 1.61 2001/02/10 16:06:14 jinmei Exp $	*/
 /*
  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
  * All rights reserved.
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
 @@ -21,36 +21,36 @@
  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  */
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: nd6_nbr.c,v 1.136 2017/01/16 15:44:47 christos Exp $");
+__KERNEL_RCSID(0, "$NetBSD: nd6_nbr.c,v 1.137 2017/02/21 03:58:24 ozaki-r Exp $");
 #ifdef _KERNEL_OPT
 #include "opt_inet.h"
 #include "opt_net_mpsafe.h"
 #endif
 #include <sys/param.h>
 #include <sys/systm.h>
-#include <sys/malloc.h>
+#include <sys/kmem.h>
 #include <sys/mbuf.h>
 #include <sys/socket.h>
 #include <sys/socketvar.h>
 #include <sys/sockio.h>
 #include <sys/time.h>
 #include <sys/kernel.h>
 #include <sys/errno.h>
 #include <sys/ioctl.h>
 #include <sys/syslog.h>
 #include <sys/queue.h>
 #include <sys/callout.h>
 #include <net/if.h>
 @@ -1144,51 +1144,53 @@ nd6_dad_start(struct ifaddr *ifa, int xt
 			IN6_PRINT(ip6buf, &ia->ia_addr.sin6_addr),
 			ifa->ifa_ifp ? if_name(ifa->ifa_ifp) : "???");
 		return;
+	}
 	if (ia->ia6_flags & IN6_IFF_ANYCAST || !ip6_dad_count) {
 		ia->ia6_flags &= ~IN6_IFF_TENTATIVE;
 		rt_newaddrmsg(RTM_NEWADDR, ifa, 0, NULL);
 		return;
+	}
 	KASSERT(ifa->ifa_ifp != NULL);
 	if (!(ifa->ifa_ifp->if_flags & IFF_UP))
 		return;
 	dp = kmem_intr_alloc(sizeof(*dp), KM_NOSLEEP);
 	mutex_enter(&nd6_dad_lock);
 	if (nd6_dad_find(ifa) != NULL) {
 		mutex_exit(&nd6_dad_lock);
 		/* DAD already in progress */
 		if (dp != NULL)
 			kmem_intr_free(dp, sizeof(*dp));
 		return;
+	}
 	dp = malloc(sizeof(*dp), M_IP6NDP, M_NOWAIT);
 	if (dp == NULL) {
 		mutex_exit(&nd6_dad_lock);
 		log(LOG_ERR, "nd6_dad_start: memory allocation failed for "
 			"%s(%s)\n",
 			IN6_PRINT(ip6buf, &ia->ia_addr.sin6_addr),
 			ifa->ifa_ifp ? if_name(ifa->ifa_ifp) : "???");
 		return;
+	}
 	memset(dp, 0, sizeof(*dp));
 	callout_init(&dp->dad_timer_ch, CALLOUT_MPSAFE);
 	/*
 	 * Send NS packet for DAD, ip6_dad_count times.
 	 * Note that we must delay the first transmission, if this is the
 	 * first packet to be sent from the interface after interface
 	 * (re)initialization.
 	 */
 	callout_init(&dp->dad_timer_ch, CALLOUT_MPSAFE);
 	dp->dad_ifa = ifa;
 	ifaref(ifa);	/* just for safety */
 	dp->dad_count = ip6_dad_count;
 	dp->dad_ns_icount = dp->dad_na_icount = 0;
 	dp->dad_ns_ocount = dp->dad_ns_tcount = 0;
 	TAILQ_INSERT_TAIL(&dadq, (struct dadq *)dp, dad_list);
 	nd6log(LOG_DEBUG, "%s: starting DAD for %s\n", if_name(ifa->ifa_ifp),
 	    IN6_PRINT(ip6buf, &ia->ia_addr.sin6_addr));
 	if (xtick == 0) {
 		nd6_dad_ns_output(dp, ifa);
 		nd6_dad_starttimer(dp,
 @@ -1213,38 +1215,38 @@ nd6_dad_stop(struct ifaddr *ifa)
 	dp = nd6_dad_find(ifa);
 	if (dp == NULL) {
 		mutex_exit(&nd6_dad_lock);
 		/* DAD wasn't started yet */
 		return;
+	}
 	/* Prevent the timer from running anymore. */
 	TAILQ_REMOVE(&dadq, dp, dad_list);
 	mutex_exit(&nd6_dad_lock);
 	nd6_dad_stoptimer(dp);
-	free(dp, M_IP6NDP);
+	kmem_intr_free(dp, sizeof(*dp));
 	dp = NULL;
 	ifafree(ifa);
+}
 static void
 nd6_dad_timer(struct ifaddr *ifa)
+{
 	struct in6_ifaddr *ia = (struct in6_ifaddr *)ifa;
 	struct dadq *dp;
 	int duplicate = 0;
 	char ip6buf[INET6_ADDRSTRLEN];
 	bool need_free = false;
 #ifndef NET_MPSAFE
 	mutex_enter(softnet_lock);
 	KERNEL_LOCK(1, NULL);
 #endif
 	mutex_enter(&nd6_dad_lock);
 	/* Sanity check */
 	if (ia == NULL) {
 		log(LOG_ERR, "nd6_dad_timer: called with null parameter\n");
 		goto done;
+	}
 	dp = nd6_dad_find(ifa);
 @@ -1263,29 +1265,27 @@ nd6_dad_timer(struct ifaddr *ifa)
 		log(LOG_ERR, "nd6_dad_timer: called with non-tentative address "
 			"%s(%s)\n",
 			IN6_PRINT(ip6buf, &ia->ia_addr.sin6_addr),
 			ifa->ifa_ifp ? if_name(ifa->ifa_ifp) : "???");
 		goto done;
+	}
 	/* timeouted with IFF_{RUNNING,UP} check */
 	if (dp->dad_ns_tcount > dad_maxtry) {
 		nd6log(LOG_INFO, "%s: could not run DAD, driver problem?\n",
 			if_name(ifa->ifa_ifp));
 		TAILQ_REMOVE(&dadq, dp, dad_list);
-		free(dp, M_IP6NDP);
+		need_free = true;
 		dp = NULL;
 		ifafree(ifa);
 		goto done;
+	}
 	/* Need more checks? */
 	if (dp->dad_ns_ocount < dp->dad_count) {
 		/*
 		 * We have more NS to go.  Send NS packet for DAD.
 		 */
 		nd6_dad_ns_output(dp, ifa);
 		nd6_dad_starttimer(dp,
 		    (long)ND_IFINFO(ifa->ifa_ifp)->retrans * hz / 1000);
 	} else {
 		/*
 @@ -1312,35 +1312,38 @@ nd6_dad_timer(struct ifaddr *ifa)
 			/*
 			 * We are done with DAD.  No NA came, no NS came.
 			 * No duplicate address found.
 			 */
 			ia->ia6_flags &= ~IN6_IFF_TENTATIVE;
 			rt_newaddrmsg(RTM_NEWADDR, ifa, 0, NULL);
 			nd6log(LOG_DEBUG,
 			    "%s: DAD complete for %s - no duplicates found\n",
 			    if_name(ifa->ifa_ifp),
 			    IN6_PRINT(ip6buf, &ia->ia_addr.sin6_addr));
 			TAILQ_REMOVE(&dadq, dp, dad_list);
-			free(dp, M_IP6NDP);
+			need_free = true;
 			dp = NULL;
 			ifafree(ifa);
+		}
+	}
 done:
 	mutex_exit(&nd6_dad_lock);
 	if (need_free) {
 		kmem_intr_free(dp, sizeof(*dp));
 		ifafree(ifa);
 		ifa = NULL;
+	}
 	if (duplicate)
 		nd6_dad_duplicated(ifa);
 #ifndef NET_MPSAFE
 	KERNEL_UNLOCK_ONE(NULL);
 	mutex_exit(softnet_lock);
 #endif
+}
 static void
 nd6_dad_duplicated(struct ifaddr *ifa)
+{
 	struct in6_ifaddr *ia = (struct in6_ifaddr *)ifa;
 @@ -1403,28 +1406,27 @@ nd6_dad_duplicated(struct ifaddr *ifa)
 			    IN6_ARE_ADDR_EQUAL(&ia->ia_addr.sin6_addr, &in6)) {
 				ND_IFINFO(ifp)->flags |= ND6_IFF_IFDISABLED;
 				log(LOG_ERR, "%s: possible hardware address "
 				    "duplication detected, disable IPv6\n",
 				    if_name(ifp));
+			}
 			break;
+		}
+	}
 	TAILQ_REMOVE(&dadq, dp, dad_list);
 	mutex_exit(&nd6_dad_lock);
-	free(dp, M_IP6NDP);
+	kmem_intr_free(dp, sizeof(*dp));
 	dp = NULL;
 	ifafree(ifa);
+}
 static void
 nd6_dad_ns_output(struct dadq *dp, struct ifaddr *ifa)
+{
 	struct in6_ifaddr *ia = (struct in6_ifaddr *)ifa;
 	struct ifnet *ifp = ifa->ifa_ifp;
 	dp->dad_ns_tcount++;
 	if ((ifp->if_flags & IFF_UP) == 0) {
 #if 0
 		printf("%s: interface down?\n", if_name(ifp));