xref: /linux/net/core/neighbour.c (revision 54a8a2220c936a47840c9a3d74910c5a56fae2ed)
1 /*
2  *	Generic address resolution entity
3  *
4  *	Authors:
5  *	Pedro Roque		<roque@di.fc.ul.pt>
6  *	Alexey Kuznetsov	<kuznet@ms2.inr.ac.ru>
7  *
8  *	This program is free software; you can redistribute it and/or
9  *      modify it under the terms of the GNU General Public License
10  *      as published by the Free Software Foundation; either version
11  *      2 of the License, or (at your option) any later version.
12  *
13  *	Fixes:
14  *	Vitaly E. Lavrov	releasing NULL neighbor in neigh_add.
15  *	Harald Welte		Add neighbour cache statistics like rtstat
16  */
17 
18 #include <linux/config.h>
19 #include <linux/types.h>
20 #include <linux/kernel.h>
21 #include <linux/module.h>
22 #include <linux/socket.h>
23 #include <linux/sched.h>
24 #include <linux/netdevice.h>
25 #include <linux/proc_fs.h>
26 #ifdef CONFIG_SYSCTL
27 #include <linux/sysctl.h>
28 #endif
29 #include <linux/times.h>
30 #include <net/neighbour.h>
31 #include <net/dst.h>
32 #include <net/sock.h>
33 #include <linux/rtnetlink.h>
34 #include <linux/random.h>
35 #include <linux/string.h>
36 
37 #define NEIGH_DEBUG 1
38 
39 #define NEIGH_PRINTK(x...) printk(x)
40 #define NEIGH_NOPRINTK(x...) do { ; } while(0)
41 #define NEIGH_PRINTK0 NEIGH_PRINTK
42 #define NEIGH_PRINTK1 NEIGH_NOPRINTK
43 #define NEIGH_PRINTK2 NEIGH_NOPRINTK
44 
45 #if NEIGH_DEBUG >= 1
46 #undef NEIGH_PRINTK1
47 #define NEIGH_PRINTK1 NEIGH_PRINTK
48 #endif
49 #if NEIGH_DEBUG >= 2
50 #undef NEIGH_PRINTK2
51 #define NEIGH_PRINTK2 NEIGH_PRINTK
52 #endif
53 
54 #define PNEIGH_HASHMASK		0xF
55 
56 static void neigh_timer_handler(unsigned long arg);
57 #ifdef CONFIG_ARPD
58 static void neigh_app_notify(struct neighbour *n);
59 #endif
60 static int pneigh_ifdown(struct neigh_table *tbl, struct net_device *dev);
61 void neigh_changeaddr(struct neigh_table *tbl, struct net_device *dev);
62 
63 static struct neigh_table *neigh_tables;
64 #ifdef CONFIG_PROC_FS
65 static struct file_operations neigh_stat_seq_fops;
66 #endif
67 
68 /*
69    Neighbour hash table buckets are protected with rwlock tbl->lock.
70 
71    - All the scans/updates to hash buckets MUST be made under this lock.
72    - NOTHING clever should be made under this lock: no callbacks
73      to protocol backends, no attempts to send something to network.
74      It will result in deadlocks, if backend/driver wants to use neighbour
75      cache.
76    - If the entry requires some non-trivial actions, increase
77      its reference count and release table lock.
78 
79    Neighbour entries are protected:
80    - with reference count.
81    - with rwlock neigh->lock
82 
83    Reference count prevents destruction.
84 
85    neigh->lock mainly serializes ll address data and its validity state.
86    However, the same lock is used to protect another entry fields:
87     - timer
88     - resolution queue
89 
90    Again, nothing clever shall be made under neigh->lock,
91    the most complicated procedure, which we allow is dev->hard_header.
92    It is supposed, that dev->hard_header is simplistic and does
93    not make callbacks to neighbour tables.
94 
95    The last lock is neigh_tbl_lock. It is pure SMP lock, protecting
96    list of neighbour tables. This list is used only in process context,
97  */
98 
99 static DEFINE_RWLOCK(neigh_tbl_lock);
100 
101 static int neigh_blackhole(struct sk_buff *skb)
102 {
103 	kfree_skb(skb);
104 	return -ENETDOWN;
105 }
106 
107 /*
108  * It is random distribution in the interval (1/2)*base...(3/2)*base.
109  * It corresponds to default IPv6 settings and is not overridable,
110  * because it is really reasonable choice.
111  */
112 
113 unsigned long neigh_rand_reach_time(unsigned long base)
114 {
115 	return (base ? (net_random() % base) + (base >> 1) : 0);
116 }
117 
118 
119 static int neigh_forced_gc(struct neigh_table *tbl)
120 {
121 	int shrunk = 0;
122 	int i;
123 
124 	NEIGH_CACHE_STAT_INC(tbl, forced_gc_runs);
125 
126 	write_lock_bh(&tbl->lock);
127 	for (i = 0; i <= tbl->hash_mask; i++) {
128 		struct neighbour *n, **np;
129 
130 		np = &tbl->hash_buckets[i];
131 		while ((n = *np) != NULL) {
132 			/* Neighbour record may be discarded if:
133 			 * - nobody refers to it.
134 			 * - it is not permanent
135 			 */
136 			write_lock(&n->lock);
137 			if (atomic_read(&n->refcnt) == 1 &&
138 			    !(n->nud_state & NUD_PERMANENT)) {
139 				*np	= n->next;
140 				n->dead = 1;
141 				shrunk	= 1;
142 				write_unlock(&n->lock);
143 				neigh_release(n);
144 				continue;
145 			}
146 			write_unlock(&n->lock);
147 			np = &n->next;
148 		}
149 	}
150 
151 	tbl->last_flush = jiffies;
152 
153 	write_unlock_bh(&tbl->lock);
154 
155 	return shrunk;
156 }
157 
158 static int neigh_del_timer(struct neighbour *n)
159 {
160 	if ((n->nud_state & NUD_IN_TIMER) &&
161 	    del_timer(&n->timer)) {
162 		neigh_release(n);
163 		return 1;
164 	}
165 	return 0;
166 }
167 
168 static void pneigh_queue_purge(struct sk_buff_head *list)
169 {
170 	struct sk_buff *skb;
171 
172 	while ((skb = skb_dequeue(list)) != NULL) {
173 		dev_put(skb->dev);
174 		kfree_skb(skb);
175 	}
176 }
177 
178 void neigh_changeaddr(struct neigh_table *tbl, struct net_device *dev)
179 {
180 	int i;
181 
182 	write_lock_bh(&tbl->lock);
183 
184 	for (i=0; i <= tbl->hash_mask; i++) {
185 		struct neighbour *n, **np;
186 
187 		np = &tbl->hash_buckets[i];
188 		while ((n = *np) != NULL) {
189 			if (dev && n->dev != dev) {
190 				np = &n->next;
191 				continue;
192 			}
193 			*np = n->next;
194 			write_lock_bh(&n->lock);
195 			n->dead = 1;
196 			neigh_del_timer(n);
197 			write_unlock_bh(&n->lock);
198 			neigh_release(n);
199 		}
200 	}
201 
202         write_unlock_bh(&tbl->lock);
203 }
204 
205 int neigh_ifdown(struct neigh_table *tbl, struct net_device *dev)
206 {
207 	int i;
208 
209 	write_lock_bh(&tbl->lock);
210 
211 	for (i = 0; i <= tbl->hash_mask; i++) {
212 		struct neighbour *n, **np = &tbl->hash_buckets[i];
213 
214 		while ((n = *np) != NULL) {
215 			if (dev && n->dev != dev) {
216 				np = &n->next;
217 				continue;
218 			}
219 			*np = n->next;
220 			write_lock(&n->lock);
221 			neigh_del_timer(n);
222 			n->dead = 1;
223 
224 			if (atomic_read(&n->refcnt) != 1) {
225 				/* The most unpleasant situation.
226 				   We must destroy neighbour entry,
227 				   but someone still uses it.
228 
229 				   The destroy will be delayed until
230 				   the last user releases us, but
231 				   we must kill timers etc. and move
232 				   it to safe state.
233 				 */
234 				skb_queue_purge(&n->arp_queue);
235 				n->output = neigh_blackhole;
236 				if (n->nud_state & NUD_VALID)
237 					n->nud_state = NUD_NOARP;
238 				else
239 					n->nud_state = NUD_NONE;
240 				NEIGH_PRINTK2("neigh %p is stray.\n", n);
241 			}
242 			write_unlock(&n->lock);
243 			neigh_release(n);
244 		}
245 	}
246 
247 	pneigh_ifdown(tbl, dev);
248 	write_unlock_bh(&tbl->lock);
249 
250 	del_timer_sync(&tbl->proxy_timer);
251 	pneigh_queue_purge(&tbl->proxy_queue);
252 	return 0;
253 }
254 
255 static struct neighbour *neigh_alloc(struct neigh_table *tbl)
256 {
257 	struct neighbour *n = NULL;
258 	unsigned long now = jiffies;
259 	int entries;
260 
261 	entries = atomic_inc_return(&tbl->entries) - 1;
262 	if (entries >= tbl->gc_thresh3 ||
263 	    (entries >= tbl->gc_thresh2 &&
264 	     time_after(now, tbl->last_flush + 5 * HZ))) {
265 		if (!neigh_forced_gc(tbl) &&
266 		    entries >= tbl->gc_thresh3)
267 			goto out_entries;
268 	}
269 
270 	n = kmem_cache_alloc(tbl->kmem_cachep, SLAB_ATOMIC);
271 	if (!n)
272 		goto out_entries;
273 
274 	memset(n, 0, tbl->entry_size);
275 
276 	skb_queue_head_init(&n->arp_queue);
277 	rwlock_init(&n->lock);
278 	n->updated	  = n->used = now;
279 	n->nud_state	  = NUD_NONE;
280 	n->output	  = neigh_blackhole;
281 	n->parms	  = neigh_parms_clone(&tbl->parms);
282 	init_timer(&n->timer);
283 	n->timer.function = neigh_timer_handler;
284 	n->timer.data	  = (unsigned long)n;
285 
286 	NEIGH_CACHE_STAT_INC(tbl, allocs);
287 	n->tbl		  = tbl;
288 	atomic_set(&n->refcnt, 1);
289 	n->dead		  = 1;
290 out:
291 	return n;
292 
293 out_entries:
294 	atomic_dec(&tbl->entries);
295 	goto out;
296 }
297 
298 static struct neighbour **neigh_hash_alloc(unsigned int entries)
299 {
300 	unsigned long size = entries * sizeof(struct neighbour *);
301 	struct neighbour **ret;
302 
303 	if (size <= PAGE_SIZE) {
304 		ret = kmalloc(size, GFP_ATOMIC);
305 	} else {
306 		ret = (struct neighbour **)
307 			__get_free_pages(GFP_ATOMIC, get_order(size));
308 	}
309 	if (ret)
310 		memset(ret, 0, size);
311 
312 	return ret;
313 }
314 
315 static void neigh_hash_free(struct neighbour **hash, unsigned int entries)
316 {
317 	unsigned long size = entries * sizeof(struct neighbour *);
318 
319 	if (size <= PAGE_SIZE)
320 		kfree(hash);
321 	else
322 		free_pages((unsigned long)hash, get_order(size));
323 }
324 
325 static void neigh_hash_grow(struct neigh_table *tbl, unsigned long new_entries)
326 {
327 	struct neighbour **new_hash, **old_hash;
328 	unsigned int i, new_hash_mask, old_entries;
329 
330 	NEIGH_CACHE_STAT_INC(tbl, hash_grows);
331 
332 	BUG_ON(new_entries & (new_entries - 1));
333 	new_hash = neigh_hash_alloc(new_entries);
334 	if (!new_hash)
335 		return;
336 
337 	old_entries = tbl->hash_mask + 1;
338 	new_hash_mask = new_entries - 1;
339 	old_hash = tbl->hash_buckets;
340 
341 	get_random_bytes(&tbl->hash_rnd, sizeof(tbl->hash_rnd));
342 	for (i = 0; i < old_entries; i++) {
343 		struct neighbour *n, *next;
344 
345 		for (n = old_hash[i]; n; n = next) {
346 			unsigned int hash_val = tbl->hash(n->primary_key, n->dev);
347 
348 			hash_val &= new_hash_mask;
349 			next = n->next;
350 
351 			n->next = new_hash[hash_val];
352 			new_hash[hash_val] = n;
353 		}
354 	}
355 	tbl->hash_buckets = new_hash;
356 	tbl->hash_mask = new_hash_mask;
357 
358 	neigh_hash_free(old_hash, old_entries);
359 }
360 
361 struct neighbour *neigh_lookup(struct neigh_table *tbl, const void *pkey,
362 			       struct net_device *dev)
363 {
364 	struct neighbour *n;
365 	int key_len = tbl->key_len;
366 	u32 hash_val = tbl->hash(pkey, dev) & tbl->hash_mask;
367 
368 	NEIGH_CACHE_STAT_INC(tbl, lookups);
369 
370 	read_lock_bh(&tbl->lock);
371 	for (n = tbl->hash_buckets[hash_val]; n; n = n->next) {
372 		if (dev == n->dev && !memcmp(n->primary_key, pkey, key_len)) {
373 			neigh_hold(n);
374 			NEIGH_CACHE_STAT_INC(tbl, hits);
375 			break;
376 		}
377 	}
378 	read_unlock_bh(&tbl->lock);
379 	return n;
380 }
381 
382 struct neighbour *neigh_lookup_nodev(struct neigh_table *tbl, const void *pkey)
383 {
384 	struct neighbour *n;
385 	int key_len = tbl->key_len;
386 	u32 hash_val = tbl->hash(pkey, NULL) & tbl->hash_mask;
387 
388 	NEIGH_CACHE_STAT_INC(tbl, lookups);
389 
390 	read_lock_bh(&tbl->lock);
391 	for (n = tbl->hash_buckets[hash_val]; n; n = n->next) {
392 		if (!memcmp(n->primary_key, pkey, key_len)) {
393 			neigh_hold(n);
394 			NEIGH_CACHE_STAT_INC(tbl, hits);
395 			break;
396 		}
397 	}
398 	read_unlock_bh(&tbl->lock);
399 	return n;
400 }
401 
402 struct neighbour *neigh_create(struct neigh_table *tbl, const void *pkey,
403 			       struct net_device *dev)
404 {
405 	u32 hash_val;
406 	int key_len = tbl->key_len;
407 	int error;
408 	struct neighbour *n1, *rc, *n = neigh_alloc(tbl);
409 
410 	if (!n) {
411 		rc = ERR_PTR(-ENOBUFS);
412 		goto out;
413 	}
414 
415 	memcpy(n->primary_key, pkey, key_len);
416 	n->dev = dev;
417 	dev_hold(dev);
418 
419 	/* Protocol specific setup. */
420 	if (tbl->constructor &&	(error = tbl->constructor(n)) < 0) {
421 		rc = ERR_PTR(error);
422 		goto out_neigh_release;
423 	}
424 
425 	/* Device specific setup. */
426 	if (n->parms->neigh_setup &&
427 	    (error = n->parms->neigh_setup(n)) < 0) {
428 		rc = ERR_PTR(error);
429 		goto out_neigh_release;
430 	}
431 
432 	n->confirmed = jiffies - (n->parms->base_reachable_time << 1);
433 
434 	write_lock_bh(&tbl->lock);
435 
436 	if (atomic_read(&tbl->entries) > (tbl->hash_mask + 1))
437 		neigh_hash_grow(tbl, (tbl->hash_mask + 1) << 1);
438 
439 	hash_val = tbl->hash(pkey, dev) & tbl->hash_mask;
440 
441 	if (n->parms->dead) {
442 		rc = ERR_PTR(-EINVAL);
443 		goto out_tbl_unlock;
444 	}
445 
446 	for (n1 = tbl->hash_buckets[hash_val]; n1; n1 = n1->next) {
447 		if (dev == n1->dev && !memcmp(n1->primary_key, pkey, key_len)) {
448 			neigh_hold(n1);
449 			rc = n1;
450 			goto out_tbl_unlock;
451 		}
452 	}
453 
454 	n->next = tbl->hash_buckets[hash_val];
455 	tbl->hash_buckets[hash_val] = n;
456 	n->dead = 0;
457 	neigh_hold(n);
458 	write_unlock_bh(&tbl->lock);
459 	NEIGH_PRINTK2("neigh %p is created.\n", n);
460 	rc = n;
461 out:
462 	return rc;
463 out_tbl_unlock:
464 	write_unlock_bh(&tbl->lock);
465 out_neigh_release:
466 	neigh_release(n);
467 	goto out;
468 }
469 
470 struct pneigh_entry * pneigh_lookup(struct neigh_table *tbl, const void *pkey,
471 				    struct net_device *dev, int creat)
472 {
473 	struct pneigh_entry *n;
474 	int key_len = tbl->key_len;
475 	u32 hash_val = *(u32 *)(pkey + key_len - 4);
476 
477 	hash_val ^= (hash_val >> 16);
478 	hash_val ^= hash_val >> 8;
479 	hash_val ^= hash_val >> 4;
480 	hash_val &= PNEIGH_HASHMASK;
481 
482 	read_lock_bh(&tbl->lock);
483 
484 	for (n = tbl->phash_buckets[hash_val]; n; n = n->next) {
485 		if (!memcmp(n->key, pkey, key_len) &&
486 		    (n->dev == dev || !n->dev)) {
487 			read_unlock_bh(&tbl->lock);
488 			goto out;
489 		}
490 	}
491 	read_unlock_bh(&tbl->lock);
492 	n = NULL;
493 	if (!creat)
494 		goto out;
495 
496 	n = kmalloc(sizeof(*n) + key_len, GFP_KERNEL);
497 	if (!n)
498 		goto out;
499 
500 	memcpy(n->key, pkey, key_len);
501 	n->dev = dev;
502 	if (dev)
503 		dev_hold(dev);
504 
505 	if (tbl->pconstructor && tbl->pconstructor(n)) {
506 		if (dev)
507 			dev_put(dev);
508 		kfree(n);
509 		n = NULL;
510 		goto out;
511 	}
512 
513 	write_lock_bh(&tbl->lock);
514 	n->next = tbl->phash_buckets[hash_val];
515 	tbl->phash_buckets[hash_val] = n;
516 	write_unlock_bh(&tbl->lock);
517 out:
518 	return n;
519 }
520 
521 
522 int pneigh_delete(struct neigh_table *tbl, const void *pkey,
523 		  struct net_device *dev)
524 {
525 	struct pneigh_entry *n, **np;
526 	int key_len = tbl->key_len;
527 	u32 hash_val = *(u32 *)(pkey + key_len - 4);
528 
529 	hash_val ^= (hash_val >> 16);
530 	hash_val ^= hash_val >> 8;
531 	hash_val ^= hash_val >> 4;
532 	hash_val &= PNEIGH_HASHMASK;
533 
534 	write_lock_bh(&tbl->lock);
535 	for (np = &tbl->phash_buckets[hash_val]; (n = *np) != NULL;
536 	     np = &n->next) {
537 		if (!memcmp(n->key, pkey, key_len) && n->dev == dev) {
538 			*np = n->next;
539 			write_unlock_bh(&tbl->lock);
540 			if (tbl->pdestructor)
541 				tbl->pdestructor(n);
542 			if (n->dev)
543 				dev_put(n->dev);
544 			kfree(n);
545 			return 0;
546 		}
547 	}
548 	write_unlock_bh(&tbl->lock);
549 	return -ENOENT;
550 }
551 
552 static int pneigh_ifdown(struct neigh_table *tbl, struct net_device *dev)
553 {
554 	struct pneigh_entry *n, **np;
555 	u32 h;
556 
557 	for (h = 0; h <= PNEIGH_HASHMASK; h++) {
558 		np = &tbl->phash_buckets[h];
559 		while ((n = *np) != NULL) {
560 			if (!dev || n->dev == dev) {
561 				*np = n->next;
562 				if (tbl->pdestructor)
563 					tbl->pdestructor(n);
564 				if (n->dev)
565 					dev_put(n->dev);
566 				kfree(n);
567 				continue;
568 			}
569 			np = &n->next;
570 		}
571 	}
572 	return -ENOENT;
573 }
574 
575 
576 /*
577  *	neighbour must already be out of the table;
578  *
579  */
580 void neigh_destroy(struct neighbour *neigh)
581 {
582 	struct hh_cache *hh;
583 
584 	NEIGH_CACHE_STAT_INC(neigh->tbl, destroys);
585 
586 	if (!neigh->dead) {
587 		printk(KERN_WARNING
588 		       "Destroying alive neighbour %p\n", neigh);
589 		dump_stack();
590 		return;
591 	}
592 
593 	if (neigh_del_timer(neigh))
594 		printk(KERN_WARNING "Impossible event.\n");
595 
596 	while ((hh = neigh->hh) != NULL) {
597 		neigh->hh = hh->hh_next;
598 		hh->hh_next = NULL;
599 		write_lock_bh(&hh->hh_lock);
600 		hh->hh_output = neigh_blackhole;
601 		write_unlock_bh(&hh->hh_lock);
602 		if (atomic_dec_and_test(&hh->hh_refcnt))
603 			kfree(hh);
604 	}
605 
606 	if (neigh->ops && neigh->ops->destructor)
607 		(neigh->ops->destructor)(neigh);
608 
609 	skb_queue_purge(&neigh->arp_queue);
610 
611 	dev_put(neigh->dev);
612 	neigh_parms_put(neigh->parms);
613 
614 	NEIGH_PRINTK2("neigh %p is destroyed.\n", neigh);
615 
616 	atomic_dec(&neigh->tbl->entries);
617 	kmem_cache_free(neigh->tbl->kmem_cachep, neigh);
618 }
619 
620 /* Neighbour state is suspicious;
621    disable fast path.
622 
623    Called with write_locked neigh.
624  */
625 static void neigh_suspect(struct neighbour *neigh)
626 {
627 	struct hh_cache *hh;
628 
629 	NEIGH_PRINTK2("neigh %p is suspected.\n", neigh);
630 
631 	neigh->output = neigh->ops->output;
632 
633 	for (hh = neigh->hh; hh; hh = hh->hh_next)
634 		hh->hh_output = neigh->ops->output;
635 }
636 
637 /* Neighbour state is OK;
638    enable fast path.
639 
640    Called with write_locked neigh.
641  */
642 static void neigh_connect(struct neighbour *neigh)
643 {
644 	struct hh_cache *hh;
645 
646 	NEIGH_PRINTK2("neigh %p is connected.\n", neigh);
647 
648 	neigh->output = neigh->ops->connected_output;
649 
650 	for (hh = neigh->hh; hh; hh = hh->hh_next)
651 		hh->hh_output = neigh->ops->hh_output;
652 }
653 
654 static void neigh_periodic_timer(unsigned long arg)
655 {
656 	struct neigh_table *tbl = (struct neigh_table *)arg;
657 	struct neighbour *n, **np;
658 	unsigned long expire, now = jiffies;
659 
660 	NEIGH_CACHE_STAT_INC(tbl, periodic_gc_runs);
661 
662 	write_lock(&tbl->lock);
663 
664 	/*
665 	 *	periodically recompute ReachableTime from random function
666 	 */
667 
668 	if (time_after(now, tbl->last_rand + 300 * HZ)) {
669 		struct neigh_parms *p;
670 		tbl->last_rand = now;
671 		for (p = &tbl->parms; p; p = p->next)
672 			p->reachable_time =
673 				neigh_rand_reach_time(p->base_reachable_time);
674 	}
675 
676 	np = &tbl->hash_buckets[tbl->hash_chain_gc];
677 	tbl->hash_chain_gc = ((tbl->hash_chain_gc + 1) & tbl->hash_mask);
678 
679 	while ((n = *np) != NULL) {
680 		unsigned int state;
681 
682 		write_lock(&n->lock);
683 
684 		state = n->nud_state;
685 		if (state & (NUD_PERMANENT | NUD_IN_TIMER)) {
686 			write_unlock(&n->lock);
687 			goto next_elt;
688 		}
689 
690 		if (time_before(n->used, n->confirmed))
691 			n->used = n->confirmed;
692 
693 		if (atomic_read(&n->refcnt) == 1 &&
694 		    (state == NUD_FAILED ||
695 		     time_after(now, n->used + n->parms->gc_staletime))) {
696 			*np = n->next;
697 			n->dead = 1;
698 			write_unlock(&n->lock);
699 			neigh_release(n);
700 			continue;
701 		}
702 		write_unlock(&n->lock);
703 
704 next_elt:
705 		np = &n->next;
706 	}
707 
708  	/* Cycle through all hash buckets every base_reachable_time/2 ticks.
709  	 * ARP entry timeouts range from 1/2 base_reachable_time to 3/2
710  	 * base_reachable_time.
711 	 */
712 	expire = tbl->parms.base_reachable_time >> 1;
713 	expire /= (tbl->hash_mask + 1);
714 	if (!expire)
715 		expire = 1;
716 
717  	mod_timer(&tbl->gc_timer, now + expire);
718 
719 	write_unlock(&tbl->lock);
720 }
721 
722 static __inline__ int neigh_max_probes(struct neighbour *n)
723 {
724 	struct neigh_parms *p = n->parms;
725 	return (n->nud_state & NUD_PROBE ?
726 		p->ucast_probes :
727 		p->ucast_probes + p->app_probes + p->mcast_probes);
728 }
729 
730 static inline void neigh_add_timer(struct neighbour *n, unsigned long when)
731 {
732 	if (unlikely(mod_timer(&n->timer, when))) {
733 		printk("NEIGH: BUG, double timer add, state is %x\n",
734 		       n->nud_state);
735 	}
736 }
737 
738 /* Called when a timer expires for a neighbour entry. */
739 
740 static void neigh_timer_handler(unsigned long arg)
741 {
742 	unsigned long now, next;
743 	struct neighbour *neigh = (struct neighbour *)arg;
744 	unsigned state;
745 	int notify = 0;
746 
747 	write_lock(&neigh->lock);
748 
749 	state = neigh->nud_state;
750 	now = jiffies;
751 	next = now + HZ;
752 
753 	if (!(state & NUD_IN_TIMER)) {
754 #ifndef CONFIG_SMP
755 		printk(KERN_WARNING "neigh: timer & !nud_in_timer\n");
756 #endif
757 		goto out;
758 	}
759 
760 	if (state & NUD_REACHABLE) {
761 		if (time_before_eq(now,
762 				   neigh->confirmed + neigh->parms->reachable_time)) {
763 			NEIGH_PRINTK2("neigh %p is still alive.\n", neigh);
764 			next = neigh->confirmed + neigh->parms->reachable_time;
765 		} else if (time_before_eq(now,
766 					  neigh->used + neigh->parms->delay_probe_time)) {
767 			NEIGH_PRINTK2("neigh %p is delayed.\n", neigh);
768 			neigh->nud_state = NUD_DELAY;
769 			neigh_suspect(neigh);
770 			next = now + neigh->parms->delay_probe_time;
771 		} else {
772 			NEIGH_PRINTK2("neigh %p is suspected.\n", neigh);
773 			neigh->nud_state = NUD_STALE;
774 			neigh_suspect(neigh);
775 		}
776 	} else if (state & NUD_DELAY) {
777 		if (time_before_eq(now,
778 				   neigh->confirmed + neigh->parms->delay_probe_time)) {
779 			NEIGH_PRINTK2("neigh %p is now reachable.\n", neigh);
780 			neigh->nud_state = NUD_REACHABLE;
781 			neigh_connect(neigh);
782 			next = neigh->confirmed + neigh->parms->reachable_time;
783 		} else {
784 			NEIGH_PRINTK2("neigh %p is probed.\n", neigh);
785 			neigh->nud_state = NUD_PROBE;
786 			atomic_set(&neigh->probes, 0);
787 			next = now + neigh->parms->retrans_time;
788 		}
789 	} else {
790 		/* NUD_PROBE|NUD_INCOMPLETE */
791 		next = now + neigh->parms->retrans_time;
792 	}
793 
794 	if ((neigh->nud_state & (NUD_INCOMPLETE | NUD_PROBE)) &&
795 	    atomic_read(&neigh->probes) >= neigh_max_probes(neigh)) {
796 		struct sk_buff *skb;
797 
798 		neigh->nud_state = NUD_FAILED;
799 		notify = 1;
800 		NEIGH_CACHE_STAT_INC(neigh->tbl, res_failed);
801 		NEIGH_PRINTK2("neigh %p is failed.\n", neigh);
802 
803 		/* It is very thin place. report_unreachable is very complicated
804 		   routine. Particularly, it can hit the same neighbour entry!
805 
806 		   So that, we try to be accurate and avoid dead loop. --ANK
807 		 */
808 		while (neigh->nud_state == NUD_FAILED &&
809 		       (skb = __skb_dequeue(&neigh->arp_queue)) != NULL) {
810 			write_unlock(&neigh->lock);
811 			neigh->ops->error_report(neigh, skb);
812 			write_lock(&neigh->lock);
813 		}
814 		skb_queue_purge(&neigh->arp_queue);
815 	}
816 
817 	if (neigh->nud_state & NUD_IN_TIMER) {
818 		neigh_hold(neigh);
819 		if (time_before(next, jiffies + HZ/2))
820 			next = jiffies + HZ/2;
821 		neigh_add_timer(neigh, next);
822 	}
823 	if (neigh->nud_state & (NUD_INCOMPLETE | NUD_PROBE)) {
824 		struct sk_buff *skb = skb_peek(&neigh->arp_queue);
825 		/* keep skb alive even if arp_queue overflows */
826 		if (skb)
827 			skb_get(skb);
828 		write_unlock(&neigh->lock);
829 		neigh->ops->solicit(neigh, skb);
830 		atomic_inc(&neigh->probes);
831 		if (skb)
832 			kfree_skb(skb);
833 	} else {
834 out:
835 		write_unlock(&neigh->lock);
836 	}
837 
838 #ifdef CONFIG_ARPD
839 	if (notify && neigh->parms->app_probes)
840 		neigh_app_notify(neigh);
841 #endif
842 	neigh_release(neigh);
843 }
844 
845 int __neigh_event_send(struct neighbour *neigh, struct sk_buff *skb)
846 {
847 	int rc;
848 	unsigned long now;
849 
850 	write_lock_bh(&neigh->lock);
851 
852 	rc = 0;
853 	if (neigh->nud_state & (NUD_CONNECTED | NUD_DELAY | NUD_PROBE))
854 		goto out_unlock_bh;
855 
856 	now = jiffies;
857 
858 	if (!(neigh->nud_state & (NUD_STALE | NUD_INCOMPLETE))) {
859 		if (neigh->parms->mcast_probes + neigh->parms->app_probes) {
860 			atomic_set(&neigh->probes, neigh->parms->ucast_probes);
861 			neigh->nud_state     = NUD_INCOMPLETE;
862 			neigh_hold(neigh);
863 			neigh_add_timer(neigh, now + 1);
864 		} else {
865 			neigh->nud_state = NUD_FAILED;
866 			write_unlock_bh(&neigh->lock);
867 
868 			if (skb)
869 				kfree_skb(skb);
870 			return 1;
871 		}
872 	} else if (neigh->nud_state & NUD_STALE) {
873 		NEIGH_PRINTK2("neigh %p is delayed.\n", neigh);
874 		neigh_hold(neigh);
875 		neigh->nud_state = NUD_DELAY;
876 		neigh_add_timer(neigh,
877 				jiffies + neigh->parms->delay_probe_time);
878 	}
879 
880 	if (neigh->nud_state == NUD_INCOMPLETE) {
881 		if (skb) {
882 			if (skb_queue_len(&neigh->arp_queue) >=
883 			    neigh->parms->queue_len) {
884 				struct sk_buff *buff;
885 				buff = neigh->arp_queue.next;
886 				__skb_unlink(buff, &neigh->arp_queue);
887 				kfree_skb(buff);
888 			}
889 			__skb_queue_tail(&neigh->arp_queue, skb);
890 		}
891 		rc = 1;
892 	}
893 out_unlock_bh:
894 	write_unlock_bh(&neigh->lock);
895 	return rc;
896 }
897 
898 static __inline__ void neigh_update_hhs(struct neighbour *neigh)
899 {
900 	struct hh_cache *hh;
901 	void (*update)(struct hh_cache*, struct net_device*, unsigned char *) =
902 		neigh->dev->header_cache_update;
903 
904 	if (update) {
905 		for (hh = neigh->hh; hh; hh = hh->hh_next) {
906 			write_lock_bh(&hh->hh_lock);
907 			update(hh, neigh->dev, neigh->ha);
908 			write_unlock_bh(&hh->hh_lock);
909 		}
910 	}
911 }
912 
913 
914 
915 /* Generic update routine.
916    -- lladdr is new lladdr or NULL, if it is not supplied.
917    -- new    is new state.
918    -- flags
919 	NEIGH_UPDATE_F_OVERRIDE allows to override existing lladdr,
920 				if it is different.
921 	NEIGH_UPDATE_F_WEAK_OVERRIDE will suspect existing "connected"
922 				lladdr instead of overriding it
923 				if it is different.
924 				It also allows to retain current state
925 				if lladdr is unchanged.
926 	NEIGH_UPDATE_F_ADMIN	means that the change is administrative.
927 
928 	NEIGH_UPDATE_F_OVERRIDE_ISROUTER allows to override existing
929 				NTF_ROUTER flag.
930 	NEIGH_UPDATE_F_ISROUTER	indicates if the neighbour is known as
931 				a router.
932 
933    Caller MUST hold reference count on the entry.
934  */
935 
936 int neigh_update(struct neighbour *neigh, const u8 *lladdr, u8 new,
937 		 u32 flags)
938 {
939 	u8 old;
940 	int err;
941 #ifdef CONFIG_ARPD
942 	int notify = 0;
943 #endif
944 	struct net_device *dev;
945 	int update_isrouter = 0;
946 
947 	write_lock_bh(&neigh->lock);
948 
949 	dev    = neigh->dev;
950 	old    = neigh->nud_state;
951 	err    = -EPERM;
952 
953 	if (!(flags & NEIGH_UPDATE_F_ADMIN) &&
954 	    (old & (NUD_NOARP | NUD_PERMANENT)))
955 		goto out;
956 
957 	if (!(new & NUD_VALID)) {
958 		neigh_del_timer(neigh);
959 		if (old & NUD_CONNECTED)
960 			neigh_suspect(neigh);
961 		neigh->nud_state = new;
962 		err = 0;
963 #ifdef CONFIG_ARPD
964 		notify = old & NUD_VALID;
965 #endif
966 		goto out;
967 	}
968 
969 	/* Compare new lladdr with cached one */
970 	if (!dev->addr_len) {
971 		/* First case: device needs no address. */
972 		lladdr = neigh->ha;
973 	} else if (lladdr) {
974 		/* The second case: if something is already cached
975 		   and a new address is proposed:
976 		   - compare new & old
977 		   - if they are different, check override flag
978 		 */
979 		if ((old & NUD_VALID) &&
980 		    !memcmp(lladdr, neigh->ha, dev->addr_len))
981 			lladdr = neigh->ha;
982 	} else {
983 		/* No address is supplied; if we know something,
984 		   use it, otherwise discard the request.
985 		 */
986 		err = -EINVAL;
987 		if (!(old & NUD_VALID))
988 			goto out;
989 		lladdr = neigh->ha;
990 	}
991 
992 	if (new & NUD_CONNECTED)
993 		neigh->confirmed = jiffies;
994 	neigh->updated = jiffies;
995 
996 	/* If entry was valid and address is not changed,
997 	   do not change entry state, if new one is STALE.
998 	 */
999 	err = 0;
1000 	update_isrouter = flags & NEIGH_UPDATE_F_OVERRIDE_ISROUTER;
1001 	if (old & NUD_VALID) {
1002 		if (lladdr != neigh->ha && !(flags & NEIGH_UPDATE_F_OVERRIDE)) {
1003 			update_isrouter = 0;
1004 			if ((flags & NEIGH_UPDATE_F_WEAK_OVERRIDE) &&
1005 			    (old & NUD_CONNECTED)) {
1006 				lladdr = neigh->ha;
1007 				new = NUD_STALE;
1008 			} else
1009 				goto out;
1010 		} else {
1011 			if (lladdr == neigh->ha && new == NUD_STALE &&
1012 			    ((flags & NEIGH_UPDATE_F_WEAK_OVERRIDE) ||
1013 			     (old & NUD_CONNECTED))
1014 			    )
1015 				new = old;
1016 		}
1017 	}
1018 
1019 	if (new != old) {
1020 		neigh_del_timer(neigh);
1021 		if (new & NUD_IN_TIMER) {
1022 			neigh_hold(neigh);
1023 			neigh_add_timer(neigh, (jiffies +
1024 						((new & NUD_REACHABLE) ?
1025 						 neigh->parms->reachable_time :
1026 						 0)));
1027 		}
1028 		neigh->nud_state = new;
1029 	}
1030 
1031 	if (lladdr != neigh->ha) {
1032 		memcpy(&neigh->ha, lladdr, dev->addr_len);
1033 		neigh_update_hhs(neigh);
1034 		if (!(new & NUD_CONNECTED))
1035 			neigh->confirmed = jiffies -
1036 				      (neigh->parms->base_reachable_time << 1);
1037 #ifdef CONFIG_ARPD
1038 		notify = 1;
1039 #endif
1040 	}
1041 	if (new == old)
1042 		goto out;
1043 	if (new & NUD_CONNECTED)
1044 		neigh_connect(neigh);
1045 	else
1046 		neigh_suspect(neigh);
1047 	if (!(old & NUD_VALID)) {
1048 		struct sk_buff *skb;
1049 
1050 		/* Again: avoid dead loop if something went wrong */
1051 
1052 		while (neigh->nud_state & NUD_VALID &&
1053 		       (skb = __skb_dequeue(&neigh->arp_queue)) != NULL) {
1054 			struct neighbour *n1 = neigh;
1055 			write_unlock_bh(&neigh->lock);
1056 			/* On shaper/eql skb->dst->neighbour != neigh :( */
1057 			if (skb->dst && skb->dst->neighbour)
1058 				n1 = skb->dst->neighbour;
1059 			n1->output(skb);
1060 			write_lock_bh(&neigh->lock);
1061 		}
1062 		skb_queue_purge(&neigh->arp_queue);
1063 	}
1064 out:
1065 	if (update_isrouter) {
1066 		neigh->flags = (flags & NEIGH_UPDATE_F_ISROUTER) ?
1067 			(neigh->flags | NTF_ROUTER) :
1068 			(neigh->flags & ~NTF_ROUTER);
1069 	}
1070 	write_unlock_bh(&neigh->lock);
1071 #ifdef CONFIG_ARPD
1072 	if (notify && neigh->parms->app_probes)
1073 		neigh_app_notify(neigh);
1074 #endif
1075 	return err;
1076 }
1077 
1078 struct neighbour *neigh_event_ns(struct neigh_table *tbl,
1079 				 u8 *lladdr, void *saddr,
1080 				 struct net_device *dev)
1081 {
1082 	struct neighbour *neigh = __neigh_lookup(tbl, saddr, dev,
1083 						 lladdr || !dev->addr_len);
1084 	if (neigh)
1085 		neigh_update(neigh, lladdr, NUD_STALE,
1086 			     NEIGH_UPDATE_F_OVERRIDE);
1087 	return neigh;
1088 }
1089 
1090 static void neigh_hh_init(struct neighbour *n, struct dst_entry *dst,
1091 			  u16 protocol)
1092 {
1093 	struct hh_cache	*hh;
1094 	struct net_device *dev = dst->dev;
1095 
1096 	for (hh = n->hh; hh; hh = hh->hh_next)
1097 		if (hh->hh_type == protocol)
1098 			break;
1099 
1100 	if (!hh && (hh = kmalloc(sizeof(*hh), GFP_ATOMIC)) != NULL) {
1101 		memset(hh, 0, sizeof(struct hh_cache));
1102 		rwlock_init(&hh->hh_lock);
1103 		hh->hh_type = protocol;
1104 		atomic_set(&hh->hh_refcnt, 0);
1105 		hh->hh_next = NULL;
1106 		if (dev->hard_header_cache(n, hh)) {
1107 			kfree(hh);
1108 			hh = NULL;
1109 		} else {
1110 			atomic_inc(&hh->hh_refcnt);
1111 			hh->hh_next = n->hh;
1112 			n->hh	    = hh;
1113 			if (n->nud_state & NUD_CONNECTED)
1114 				hh->hh_output = n->ops->hh_output;
1115 			else
1116 				hh->hh_output = n->ops->output;
1117 		}
1118 	}
1119 	if (hh)	{
1120 		atomic_inc(&hh->hh_refcnt);
1121 		dst->hh = hh;
1122 	}
1123 }
1124 
1125 /* This function can be used in contexts, where only old dev_queue_xmit
1126    worked, f.e. if you want to override normal output path (eql, shaper),
1127    but resolution is not made yet.
1128  */
1129 
1130 int neigh_compat_output(struct sk_buff *skb)
1131 {
1132 	struct net_device *dev = skb->dev;
1133 
1134 	__skb_pull(skb, skb->nh.raw - skb->data);
1135 
1136 	if (dev->hard_header &&
1137 	    dev->hard_header(skb, dev, ntohs(skb->protocol), NULL, NULL,
1138 		    	     skb->len) < 0 &&
1139 	    dev->rebuild_header(skb))
1140 		return 0;
1141 
1142 	return dev_queue_xmit(skb);
1143 }
1144 
1145 /* Slow and careful. */
1146 
1147 int neigh_resolve_output(struct sk_buff *skb)
1148 {
1149 	struct dst_entry *dst = skb->dst;
1150 	struct neighbour *neigh;
1151 	int rc = 0;
1152 
1153 	if (!dst || !(neigh = dst->neighbour))
1154 		goto discard;
1155 
1156 	__skb_pull(skb, skb->nh.raw - skb->data);
1157 
1158 	if (!neigh_event_send(neigh, skb)) {
1159 		int err;
1160 		struct net_device *dev = neigh->dev;
1161 		if (dev->hard_header_cache && !dst->hh) {
1162 			write_lock_bh(&neigh->lock);
1163 			if (!dst->hh)
1164 				neigh_hh_init(neigh, dst, dst->ops->protocol);
1165 			err = dev->hard_header(skb, dev, ntohs(skb->protocol),
1166 					       neigh->ha, NULL, skb->len);
1167 			write_unlock_bh(&neigh->lock);
1168 		} else {
1169 			read_lock_bh(&neigh->lock);
1170 			err = dev->hard_header(skb, dev, ntohs(skb->protocol),
1171 					       neigh->ha, NULL, skb->len);
1172 			read_unlock_bh(&neigh->lock);
1173 		}
1174 		if (err >= 0)
1175 			rc = neigh->ops->queue_xmit(skb);
1176 		else
1177 			goto out_kfree_skb;
1178 	}
1179 out:
1180 	return rc;
1181 discard:
1182 	NEIGH_PRINTK1("neigh_resolve_output: dst=%p neigh=%p\n",
1183 		      dst, dst ? dst->neighbour : NULL);
1184 out_kfree_skb:
1185 	rc = -EINVAL;
1186 	kfree_skb(skb);
1187 	goto out;
1188 }
1189 
1190 /* As fast as possible without hh cache */
1191 
1192 int neigh_connected_output(struct sk_buff *skb)
1193 {
1194 	int err;
1195 	struct dst_entry *dst = skb->dst;
1196 	struct neighbour *neigh = dst->neighbour;
1197 	struct net_device *dev = neigh->dev;
1198 
1199 	__skb_pull(skb, skb->nh.raw - skb->data);
1200 
1201 	read_lock_bh(&neigh->lock);
1202 	err = dev->hard_header(skb, dev, ntohs(skb->protocol),
1203 			       neigh->ha, NULL, skb->len);
1204 	read_unlock_bh(&neigh->lock);
1205 	if (err >= 0)
1206 		err = neigh->ops->queue_xmit(skb);
1207 	else {
1208 		err = -EINVAL;
1209 		kfree_skb(skb);
1210 	}
1211 	return err;
1212 }
1213 
1214 static void neigh_proxy_process(unsigned long arg)
1215 {
1216 	struct neigh_table *tbl = (struct neigh_table *)arg;
1217 	long sched_next = 0;
1218 	unsigned long now = jiffies;
1219 	struct sk_buff *skb;
1220 
1221 	spin_lock(&tbl->proxy_queue.lock);
1222 
1223 	skb = tbl->proxy_queue.next;
1224 
1225 	while (skb != (struct sk_buff *)&tbl->proxy_queue) {
1226 		struct sk_buff *back = skb;
1227 		long tdif = NEIGH_CB(back)->sched_next - now;
1228 
1229 		skb = skb->next;
1230 		if (tdif <= 0) {
1231 			struct net_device *dev = back->dev;
1232 			__skb_unlink(back, &tbl->proxy_queue);
1233 			if (tbl->proxy_redo && netif_running(dev))
1234 				tbl->proxy_redo(back);
1235 			else
1236 				kfree_skb(back);
1237 
1238 			dev_put(dev);
1239 		} else if (!sched_next || tdif < sched_next)
1240 			sched_next = tdif;
1241 	}
1242 	del_timer(&tbl->proxy_timer);
1243 	if (sched_next)
1244 		mod_timer(&tbl->proxy_timer, jiffies + sched_next);
1245 	spin_unlock(&tbl->proxy_queue.lock);
1246 }
1247 
1248 void pneigh_enqueue(struct neigh_table *tbl, struct neigh_parms *p,
1249 		    struct sk_buff *skb)
1250 {
1251 	unsigned long now = jiffies;
1252 	unsigned long sched_next = now + (net_random() % p->proxy_delay);
1253 
1254 	if (tbl->proxy_queue.qlen > p->proxy_qlen) {
1255 		kfree_skb(skb);
1256 		return;
1257 	}
1258 
1259 	NEIGH_CB(skb)->sched_next = sched_next;
1260 	NEIGH_CB(skb)->flags |= LOCALLY_ENQUEUED;
1261 
1262 	spin_lock(&tbl->proxy_queue.lock);
1263 	if (del_timer(&tbl->proxy_timer)) {
1264 		if (time_before(tbl->proxy_timer.expires, sched_next))
1265 			sched_next = tbl->proxy_timer.expires;
1266 	}
1267 	dst_release(skb->dst);
1268 	skb->dst = NULL;
1269 	dev_hold(skb->dev);
1270 	__skb_queue_tail(&tbl->proxy_queue, skb);
1271 	mod_timer(&tbl->proxy_timer, sched_next);
1272 	spin_unlock(&tbl->proxy_queue.lock);
1273 }
1274 
1275 
1276 struct neigh_parms *neigh_parms_alloc(struct net_device *dev,
1277 				      struct neigh_table *tbl)
1278 {
1279 	struct neigh_parms *p = kmalloc(sizeof(*p), GFP_KERNEL);
1280 
1281 	if (p) {
1282 		memcpy(p, &tbl->parms, sizeof(*p));
1283 		p->tbl		  = tbl;
1284 		atomic_set(&p->refcnt, 1);
1285 		INIT_RCU_HEAD(&p->rcu_head);
1286 		p->reachable_time =
1287 				neigh_rand_reach_time(p->base_reachable_time);
1288 		if (dev) {
1289 			if (dev->neigh_setup && dev->neigh_setup(dev, p)) {
1290 				kfree(p);
1291 				return NULL;
1292 			}
1293 
1294 			dev_hold(dev);
1295 			p->dev = dev;
1296 		}
1297 		p->sysctl_table = NULL;
1298 		write_lock_bh(&tbl->lock);
1299 		p->next		= tbl->parms.next;
1300 		tbl->parms.next = p;
1301 		write_unlock_bh(&tbl->lock);
1302 	}
1303 	return p;
1304 }
1305 
1306 static void neigh_rcu_free_parms(struct rcu_head *head)
1307 {
1308 	struct neigh_parms *parms =
1309 		container_of(head, struct neigh_parms, rcu_head);
1310 
1311 	neigh_parms_put(parms);
1312 }
1313 
1314 void neigh_parms_release(struct neigh_table *tbl, struct neigh_parms *parms)
1315 {
1316 	struct neigh_parms **p;
1317 
1318 	if (!parms || parms == &tbl->parms)
1319 		return;
1320 	write_lock_bh(&tbl->lock);
1321 	for (p = &tbl->parms.next; *p; p = &(*p)->next) {
1322 		if (*p == parms) {
1323 			*p = parms->next;
1324 			parms->dead = 1;
1325 			write_unlock_bh(&tbl->lock);
1326 			if (parms->dev)
1327 				dev_put(parms->dev);
1328 			call_rcu(&parms->rcu_head, neigh_rcu_free_parms);
1329 			return;
1330 		}
1331 	}
1332 	write_unlock_bh(&tbl->lock);
1333 	NEIGH_PRINTK1("neigh_parms_release: not found\n");
1334 }
1335 
1336 void neigh_parms_destroy(struct neigh_parms *parms)
1337 {
1338 	kfree(parms);
1339 }
1340 
1341 
1342 void neigh_table_init(struct neigh_table *tbl)
1343 {
1344 	unsigned long now = jiffies;
1345 	unsigned long phsize;
1346 
1347 	atomic_set(&tbl->parms.refcnt, 1);
1348 	INIT_RCU_HEAD(&tbl->parms.rcu_head);
1349 	tbl->parms.reachable_time =
1350 			  neigh_rand_reach_time(tbl->parms.base_reachable_time);
1351 
1352 	if (!tbl->kmem_cachep)
1353 		tbl->kmem_cachep = kmem_cache_create(tbl->id,
1354 						     tbl->entry_size,
1355 						     0, SLAB_HWCACHE_ALIGN,
1356 						     NULL, NULL);
1357 
1358 	if (!tbl->kmem_cachep)
1359 		panic("cannot create neighbour cache");
1360 
1361 	tbl->stats = alloc_percpu(struct neigh_statistics);
1362 	if (!tbl->stats)
1363 		panic("cannot create neighbour cache statistics");
1364 
1365 #ifdef CONFIG_PROC_FS
1366 	tbl->pde = create_proc_entry(tbl->id, 0, proc_net_stat);
1367 	if (!tbl->pde)
1368 		panic("cannot create neighbour proc dir entry");
1369 	tbl->pde->proc_fops = &neigh_stat_seq_fops;
1370 	tbl->pde->data = tbl;
1371 #endif
1372 
1373 	tbl->hash_mask = 1;
1374 	tbl->hash_buckets = neigh_hash_alloc(tbl->hash_mask + 1);
1375 
1376 	phsize = (PNEIGH_HASHMASK + 1) * sizeof(struct pneigh_entry *);
1377 	tbl->phash_buckets = kmalloc(phsize, GFP_KERNEL);
1378 
1379 	if (!tbl->hash_buckets || !tbl->phash_buckets)
1380 		panic("cannot allocate neighbour cache hashes");
1381 
1382 	memset(tbl->phash_buckets, 0, phsize);
1383 
1384 	get_random_bytes(&tbl->hash_rnd, sizeof(tbl->hash_rnd));
1385 
1386 	rwlock_init(&tbl->lock);
1387 	init_timer(&tbl->gc_timer);
1388 	tbl->gc_timer.data     = (unsigned long)tbl;
1389 	tbl->gc_timer.function = neigh_periodic_timer;
1390 	tbl->gc_timer.expires  = now + 1;
1391 	add_timer(&tbl->gc_timer);
1392 
1393 	init_timer(&tbl->proxy_timer);
1394 	tbl->proxy_timer.data	  = (unsigned long)tbl;
1395 	tbl->proxy_timer.function = neigh_proxy_process;
1396 	skb_queue_head_init(&tbl->proxy_queue);
1397 
1398 	tbl->last_flush = now;
1399 	tbl->last_rand	= now + tbl->parms.reachable_time * 20;
1400 	write_lock(&neigh_tbl_lock);
1401 	tbl->next	= neigh_tables;
1402 	neigh_tables	= tbl;
1403 	write_unlock(&neigh_tbl_lock);
1404 }
1405 
1406 int neigh_table_clear(struct neigh_table *tbl)
1407 {
1408 	struct neigh_table **tp;
1409 
1410 	/* It is not clean... Fix it to unload IPv6 module safely */
1411 	del_timer_sync(&tbl->gc_timer);
1412 	del_timer_sync(&tbl->proxy_timer);
1413 	pneigh_queue_purge(&tbl->proxy_queue);
1414 	neigh_ifdown(tbl, NULL);
1415 	if (atomic_read(&tbl->entries))
1416 		printk(KERN_CRIT "neighbour leakage\n");
1417 	write_lock(&neigh_tbl_lock);
1418 	for (tp = &neigh_tables; *tp; tp = &(*tp)->next) {
1419 		if (*tp == tbl) {
1420 			*tp = tbl->next;
1421 			break;
1422 		}
1423 	}
1424 	write_unlock(&neigh_tbl_lock);
1425 
1426 	neigh_hash_free(tbl->hash_buckets, tbl->hash_mask + 1);
1427 	tbl->hash_buckets = NULL;
1428 
1429 	kfree(tbl->phash_buckets);
1430 	tbl->phash_buckets = NULL;
1431 
1432 	return 0;
1433 }
1434 
1435 int neigh_delete(struct sk_buff *skb, struct nlmsghdr *nlh, void *arg)
1436 {
1437 	struct ndmsg *ndm = NLMSG_DATA(nlh);
1438 	struct rtattr **nda = arg;
1439 	struct neigh_table *tbl;
1440 	struct net_device *dev = NULL;
1441 	int err = -ENODEV;
1442 
1443 	if (ndm->ndm_ifindex &&
1444 	    (dev = dev_get_by_index(ndm->ndm_ifindex)) == NULL)
1445 		goto out;
1446 
1447 	read_lock(&neigh_tbl_lock);
1448 	for (tbl = neigh_tables; tbl; tbl = tbl->next) {
1449 		struct rtattr *dst_attr = nda[NDA_DST - 1];
1450 		struct neighbour *n;
1451 
1452 		if (tbl->family != ndm->ndm_family)
1453 			continue;
1454 		read_unlock(&neigh_tbl_lock);
1455 
1456 		err = -EINVAL;
1457 		if (!dst_attr || RTA_PAYLOAD(dst_attr) < tbl->key_len)
1458 			goto out_dev_put;
1459 
1460 		if (ndm->ndm_flags & NTF_PROXY) {
1461 			err = pneigh_delete(tbl, RTA_DATA(dst_attr), dev);
1462 			goto out_dev_put;
1463 		}
1464 
1465 		if (!dev)
1466 			goto out;
1467 
1468 		n = neigh_lookup(tbl, RTA_DATA(dst_attr), dev);
1469 		if (n) {
1470 			err = neigh_update(n, NULL, NUD_FAILED,
1471 					   NEIGH_UPDATE_F_OVERRIDE|
1472 					   NEIGH_UPDATE_F_ADMIN);
1473 			neigh_release(n);
1474 		}
1475 		goto out_dev_put;
1476 	}
1477 	read_unlock(&neigh_tbl_lock);
1478 	err = -EADDRNOTAVAIL;
1479 out_dev_put:
1480 	if (dev)
1481 		dev_put(dev);
1482 out:
1483 	return err;
1484 }
1485 
1486 int neigh_add(struct sk_buff *skb, struct nlmsghdr *nlh, void *arg)
1487 {
1488 	struct ndmsg *ndm = NLMSG_DATA(nlh);
1489 	struct rtattr **nda = arg;
1490 	struct neigh_table *tbl;
1491 	struct net_device *dev = NULL;
1492 	int err = -ENODEV;
1493 
1494 	if (ndm->ndm_ifindex &&
1495 	    (dev = dev_get_by_index(ndm->ndm_ifindex)) == NULL)
1496 		goto out;
1497 
1498 	read_lock(&neigh_tbl_lock);
1499 	for (tbl = neigh_tables; tbl; tbl = tbl->next) {
1500 		struct rtattr *lladdr_attr = nda[NDA_LLADDR - 1];
1501 		struct rtattr *dst_attr = nda[NDA_DST - 1];
1502 		int override = 1;
1503 		struct neighbour *n;
1504 
1505 		if (tbl->family != ndm->ndm_family)
1506 			continue;
1507 		read_unlock(&neigh_tbl_lock);
1508 
1509 		err = -EINVAL;
1510 		if (!dst_attr || RTA_PAYLOAD(dst_attr) < tbl->key_len)
1511 			goto out_dev_put;
1512 
1513 		if (ndm->ndm_flags & NTF_PROXY) {
1514 			err = -ENOBUFS;
1515 			if (pneigh_lookup(tbl, RTA_DATA(dst_attr), dev, 1))
1516 				err = 0;
1517 			goto out_dev_put;
1518 		}
1519 
1520 		err = -EINVAL;
1521 		if (!dev)
1522 			goto out;
1523 		if (lladdr_attr && RTA_PAYLOAD(lladdr_attr) < dev->addr_len)
1524 			goto out_dev_put;
1525 
1526 		n = neigh_lookup(tbl, RTA_DATA(dst_attr), dev);
1527 		if (n) {
1528 			if (nlh->nlmsg_flags & NLM_F_EXCL) {
1529 				err = -EEXIST;
1530 				neigh_release(n);
1531 				goto out_dev_put;
1532 			}
1533 
1534 			override = nlh->nlmsg_flags & NLM_F_REPLACE;
1535 		} else if (!(nlh->nlmsg_flags & NLM_F_CREATE)) {
1536 			err = -ENOENT;
1537 			goto out_dev_put;
1538 		} else {
1539 			n = __neigh_lookup_errno(tbl, RTA_DATA(dst_attr), dev);
1540 			if (IS_ERR(n)) {
1541 				err = PTR_ERR(n);
1542 				goto out_dev_put;
1543 			}
1544 		}
1545 
1546 		err = neigh_update(n,
1547 				   lladdr_attr ? RTA_DATA(lladdr_attr) : NULL,
1548 				   ndm->ndm_state,
1549 				   (override ? NEIGH_UPDATE_F_OVERRIDE : 0) |
1550 				   NEIGH_UPDATE_F_ADMIN);
1551 
1552 		neigh_release(n);
1553 		goto out_dev_put;
1554 	}
1555 
1556 	read_unlock(&neigh_tbl_lock);
1557 	err = -EADDRNOTAVAIL;
1558 out_dev_put:
1559 	if (dev)
1560 		dev_put(dev);
1561 out:
1562 	return err;
1563 }
1564 
1565 static int neightbl_fill_parms(struct sk_buff *skb, struct neigh_parms *parms)
1566 {
1567 	struct rtattr *nest = NULL;
1568 
1569 	nest = RTA_NEST(skb, NDTA_PARMS);
1570 
1571 	if (parms->dev)
1572 		RTA_PUT_U32(skb, NDTPA_IFINDEX, parms->dev->ifindex);
1573 
1574 	RTA_PUT_U32(skb, NDTPA_REFCNT, atomic_read(&parms->refcnt));
1575 	RTA_PUT_U32(skb, NDTPA_QUEUE_LEN, parms->queue_len);
1576 	RTA_PUT_U32(skb, NDTPA_PROXY_QLEN, parms->proxy_qlen);
1577 	RTA_PUT_U32(skb, NDTPA_APP_PROBES, parms->app_probes);
1578 	RTA_PUT_U32(skb, NDTPA_UCAST_PROBES, parms->ucast_probes);
1579 	RTA_PUT_U32(skb, NDTPA_MCAST_PROBES, parms->mcast_probes);
1580 	RTA_PUT_MSECS(skb, NDTPA_REACHABLE_TIME, parms->reachable_time);
1581 	RTA_PUT_MSECS(skb, NDTPA_BASE_REACHABLE_TIME,
1582 		      parms->base_reachable_time);
1583 	RTA_PUT_MSECS(skb, NDTPA_GC_STALETIME, parms->gc_staletime);
1584 	RTA_PUT_MSECS(skb, NDTPA_DELAY_PROBE_TIME, parms->delay_probe_time);
1585 	RTA_PUT_MSECS(skb, NDTPA_RETRANS_TIME, parms->retrans_time);
1586 	RTA_PUT_MSECS(skb, NDTPA_ANYCAST_DELAY, parms->anycast_delay);
1587 	RTA_PUT_MSECS(skb, NDTPA_PROXY_DELAY, parms->proxy_delay);
1588 	RTA_PUT_MSECS(skb, NDTPA_LOCKTIME, parms->locktime);
1589 
1590 	return RTA_NEST_END(skb, nest);
1591 
1592 rtattr_failure:
1593 	return RTA_NEST_CANCEL(skb, nest);
1594 }
1595 
1596 static int neightbl_fill_info(struct neigh_table *tbl, struct sk_buff *skb,
1597 			      struct netlink_callback *cb)
1598 {
1599 	struct nlmsghdr *nlh;
1600 	struct ndtmsg *ndtmsg;
1601 
1602 	nlh = NLMSG_NEW_ANSWER(skb, cb, RTM_NEWNEIGHTBL, sizeof(struct ndtmsg),
1603 			       NLM_F_MULTI);
1604 
1605 	ndtmsg = NLMSG_DATA(nlh);
1606 
1607 	read_lock_bh(&tbl->lock);
1608 	ndtmsg->ndtm_family = tbl->family;
1609 	ndtmsg->ndtm_pad1   = 0;
1610 	ndtmsg->ndtm_pad2   = 0;
1611 
1612 	RTA_PUT_STRING(skb, NDTA_NAME, tbl->id);
1613 	RTA_PUT_MSECS(skb, NDTA_GC_INTERVAL, tbl->gc_interval);
1614 	RTA_PUT_U32(skb, NDTA_THRESH1, tbl->gc_thresh1);
1615 	RTA_PUT_U32(skb, NDTA_THRESH2, tbl->gc_thresh2);
1616 	RTA_PUT_U32(skb, NDTA_THRESH3, tbl->gc_thresh3);
1617 
1618 	{
1619 		unsigned long now = jiffies;
1620 		unsigned int flush_delta = now - tbl->last_flush;
1621 		unsigned int rand_delta = now - tbl->last_rand;
1622 
1623 		struct ndt_config ndc = {
1624 			.ndtc_key_len		= tbl->key_len,
1625 			.ndtc_entry_size	= tbl->entry_size,
1626 			.ndtc_entries		= atomic_read(&tbl->entries),
1627 			.ndtc_last_flush	= jiffies_to_msecs(flush_delta),
1628 			.ndtc_last_rand		= jiffies_to_msecs(rand_delta),
1629 			.ndtc_hash_rnd		= tbl->hash_rnd,
1630 			.ndtc_hash_mask		= tbl->hash_mask,
1631 			.ndtc_hash_chain_gc	= tbl->hash_chain_gc,
1632 			.ndtc_proxy_qlen	= tbl->proxy_queue.qlen,
1633 		};
1634 
1635 		RTA_PUT(skb, NDTA_CONFIG, sizeof(ndc), &ndc);
1636 	}
1637 
1638 	{
1639 		int cpu;
1640 		struct ndt_stats ndst;
1641 
1642 		memset(&ndst, 0, sizeof(ndst));
1643 
1644 		for (cpu = 0; cpu < NR_CPUS; cpu++) {
1645 			struct neigh_statistics	*st;
1646 
1647 			if (!cpu_possible(cpu))
1648 				continue;
1649 
1650 			st = per_cpu_ptr(tbl->stats, cpu);
1651 			ndst.ndts_allocs		+= st->allocs;
1652 			ndst.ndts_destroys		+= st->destroys;
1653 			ndst.ndts_hash_grows		+= st->hash_grows;
1654 			ndst.ndts_res_failed		+= st->res_failed;
1655 			ndst.ndts_lookups		+= st->lookups;
1656 			ndst.ndts_hits			+= st->hits;
1657 			ndst.ndts_rcv_probes_mcast	+= st->rcv_probes_mcast;
1658 			ndst.ndts_rcv_probes_ucast	+= st->rcv_probes_ucast;
1659 			ndst.ndts_periodic_gc_runs	+= st->periodic_gc_runs;
1660 			ndst.ndts_forced_gc_runs	+= st->forced_gc_runs;
1661 		}
1662 
1663 		RTA_PUT(skb, NDTA_STATS, sizeof(ndst), &ndst);
1664 	}
1665 
1666 	BUG_ON(tbl->parms.dev);
1667 	if (neightbl_fill_parms(skb, &tbl->parms) < 0)
1668 		goto rtattr_failure;
1669 
1670 	read_unlock_bh(&tbl->lock);
1671 	return NLMSG_END(skb, nlh);
1672 
1673 rtattr_failure:
1674 	read_unlock_bh(&tbl->lock);
1675 	return NLMSG_CANCEL(skb, nlh);
1676 
1677 nlmsg_failure:
1678 	return -1;
1679 }
1680 
1681 static int neightbl_fill_param_info(struct neigh_table *tbl,
1682 				    struct neigh_parms *parms,
1683 				    struct sk_buff *skb,
1684 				    struct netlink_callback *cb)
1685 {
1686 	struct ndtmsg *ndtmsg;
1687 	struct nlmsghdr *nlh;
1688 
1689 	nlh = NLMSG_NEW_ANSWER(skb, cb, RTM_NEWNEIGHTBL, sizeof(struct ndtmsg),
1690 			       NLM_F_MULTI);
1691 
1692 	ndtmsg = NLMSG_DATA(nlh);
1693 
1694 	read_lock_bh(&tbl->lock);
1695 	ndtmsg->ndtm_family = tbl->family;
1696 	ndtmsg->ndtm_pad1   = 0;
1697 	ndtmsg->ndtm_pad2   = 0;
1698 	RTA_PUT_STRING(skb, NDTA_NAME, tbl->id);
1699 
1700 	if (neightbl_fill_parms(skb, parms) < 0)
1701 		goto rtattr_failure;
1702 
1703 	read_unlock_bh(&tbl->lock);
1704 	return NLMSG_END(skb, nlh);
1705 
1706 rtattr_failure:
1707 	read_unlock_bh(&tbl->lock);
1708 	return NLMSG_CANCEL(skb, nlh);
1709 
1710 nlmsg_failure:
1711 	return -1;
1712 }
1713 
1714 static inline struct neigh_parms *lookup_neigh_params(struct neigh_table *tbl,
1715 						      int ifindex)
1716 {
1717 	struct neigh_parms *p;
1718 
1719 	for (p = &tbl->parms; p; p = p->next)
1720 		if ((p->dev && p->dev->ifindex == ifindex) ||
1721 		    (!p->dev && !ifindex))
1722 			return p;
1723 
1724 	return NULL;
1725 }
1726 
1727 int neightbl_set(struct sk_buff *skb, struct nlmsghdr *nlh, void *arg)
1728 {
1729 	struct neigh_table *tbl;
1730 	struct ndtmsg *ndtmsg = NLMSG_DATA(nlh);
1731 	struct rtattr **tb = arg;
1732 	int err = -EINVAL;
1733 
1734 	if (!tb[NDTA_NAME - 1] || !RTA_PAYLOAD(tb[NDTA_NAME - 1]))
1735 		return -EINVAL;
1736 
1737 	read_lock(&neigh_tbl_lock);
1738 	for (tbl = neigh_tables; tbl; tbl = tbl->next) {
1739 		if (ndtmsg->ndtm_family && tbl->family != ndtmsg->ndtm_family)
1740 			continue;
1741 
1742 		if (!rtattr_strcmp(tb[NDTA_NAME - 1], tbl->id))
1743 			break;
1744 	}
1745 
1746 	if (tbl == NULL) {
1747 		err = -ENOENT;
1748 		goto errout;
1749 	}
1750 
1751 	/*
1752 	 * We acquire tbl->lock to be nice to the periodic timers and
1753 	 * make sure they always see a consistent set of values.
1754 	 */
1755 	write_lock_bh(&tbl->lock);
1756 
1757 	if (tb[NDTA_THRESH1 - 1])
1758 		tbl->gc_thresh1 = RTA_GET_U32(tb[NDTA_THRESH1 - 1]);
1759 
1760 	if (tb[NDTA_THRESH2 - 1])
1761 		tbl->gc_thresh2 = RTA_GET_U32(tb[NDTA_THRESH2 - 1]);
1762 
1763 	if (tb[NDTA_THRESH3 - 1])
1764 		tbl->gc_thresh3 = RTA_GET_U32(tb[NDTA_THRESH3 - 1]);
1765 
1766 	if (tb[NDTA_GC_INTERVAL - 1])
1767 		tbl->gc_interval = RTA_GET_MSECS(tb[NDTA_GC_INTERVAL - 1]);
1768 
1769 	if (tb[NDTA_PARMS - 1]) {
1770 		struct rtattr *tbp[NDTPA_MAX];
1771 		struct neigh_parms *p;
1772 		u32 ifindex = 0;
1773 
1774 		if (rtattr_parse_nested(tbp, NDTPA_MAX, tb[NDTA_PARMS - 1]) < 0)
1775 			goto rtattr_failure;
1776 
1777 		if (tbp[NDTPA_IFINDEX - 1])
1778 			ifindex = RTA_GET_U32(tbp[NDTPA_IFINDEX - 1]);
1779 
1780 		p = lookup_neigh_params(tbl, ifindex);
1781 		if (p == NULL) {
1782 			err = -ENOENT;
1783 			goto rtattr_failure;
1784 		}
1785 
1786 		if (tbp[NDTPA_QUEUE_LEN - 1])
1787 			p->queue_len = RTA_GET_U32(tbp[NDTPA_QUEUE_LEN - 1]);
1788 
1789 		if (tbp[NDTPA_PROXY_QLEN - 1])
1790 			p->proxy_qlen = RTA_GET_U32(tbp[NDTPA_PROXY_QLEN - 1]);
1791 
1792 		if (tbp[NDTPA_APP_PROBES - 1])
1793 			p->app_probes = RTA_GET_U32(tbp[NDTPA_APP_PROBES - 1]);
1794 
1795 		if (tbp[NDTPA_UCAST_PROBES - 1])
1796 			p->ucast_probes =
1797 			   RTA_GET_U32(tbp[NDTPA_UCAST_PROBES - 1]);
1798 
1799 		if (tbp[NDTPA_MCAST_PROBES - 1])
1800 			p->mcast_probes =
1801 			   RTA_GET_U32(tbp[NDTPA_MCAST_PROBES - 1]);
1802 
1803 		if (tbp[NDTPA_BASE_REACHABLE_TIME - 1])
1804 			p->base_reachable_time =
1805 			   RTA_GET_MSECS(tbp[NDTPA_BASE_REACHABLE_TIME - 1]);
1806 
1807 		if (tbp[NDTPA_GC_STALETIME - 1])
1808 			p->gc_staletime =
1809 			   RTA_GET_MSECS(tbp[NDTPA_GC_STALETIME - 1]);
1810 
1811 		if (tbp[NDTPA_DELAY_PROBE_TIME - 1])
1812 			p->delay_probe_time =
1813 			   RTA_GET_MSECS(tbp[NDTPA_DELAY_PROBE_TIME - 1]);
1814 
1815 		if (tbp[NDTPA_RETRANS_TIME - 1])
1816 			p->retrans_time =
1817 			   RTA_GET_MSECS(tbp[NDTPA_RETRANS_TIME - 1]);
1818 
1819 		if (tbp[NDTPA_ANYCAST_DELAY - 1])
1820 			p->anycast_delay =
1821 			   RTA_GET_MSECS(tbp[NDTPA_ANYCAST_DELAY - 1]);
1822 
1823 		if (tbp[NDTPA_PROXY_DELAY - 1])
1824 			p->proxy_delay =
1825 			   RTA_GET_MSECS(tbp[NDTPA_PROXY_DELAY - 1]);
1826 
1827 		if (tbp[NDTPA_LOCKTIME - 1])
1828 			p->locktime = RTA_GET_MSECS(tbp[NDTPA_LOCKTIME - 1]);
1829 	}
1830 
1831 	err = 0;
1832 
1833 rtattr_failure:
1834 	write_unlock_bh(&tbl->lock);
1835 errout:
1836 	read_unlock(&neigh_tbl_lock);
1837 	return err;
1838 }
1839 
1840 int neightbl_dump_info(struct sk_buff *skb, struct netlink_callback *cb)
1841 {
1842 	int idx, family;
1843 	int s_idx = cb->args[0];
1844 	struct neigh_table *tbl;
1845 
1846 	family = ((struct rtgenmsg *)NLMSG_DATA(cb->nlh))->rtgen_family;
1847 
1848 	read_lock(&neigh_tbl_lock);
1849 	for (tbl = neigh_tables, idx = 0; tbl; tbl = tbl->next) {
1850 		struct neigh_parms *p;
1851 
1852 		if (idx < s_idx || (family && tbl->family != family))
1853 			continue;
1854 
1855 		if (neightbl_fill_info(tbl, skb, cb) <= 0)
1856 			break;
1857 
1858 		for (++idx, p = tbl->parms.next; p; p = p->next, idx++) {
1859 			if (idx < s_idx)
1860 				continue;
1861 
1862 			if (neightbl_fill_param_info(tbl, p, skb, cb) <= 0)
1863 				goto out;
1864 		}
1865 
1866 	}
1867 out:
1868 	read_unlock(&neigh_tbl_lock);
1869 	cb->args[0] = idx;
1870 
1871 	return skb->len;
1872 }
1873 
1874 static int neigh_fill_info(struct sk_buff *skb, struct neighbour *n,
1875 			   u32 pid, u32 seq, int event, unsigned int flags)
1876 {
1877 	unsigned long now = jiffies;
1878 	unsigned char *b = skb->tail;
1879 	struct nda_cacheinfo ci;
1880 	int locked = 0;
1881 	u32 probes;
1882 	struct nlmsghdr *nlh = NLMSG_NEW(skb, pid, seq, event,
1883 					 sizeof(struct ndmsg), flags);
1884 	struct ndmsg *ndm = NLMSG_DATA(nlh);
1885 
1886 	ndm->ndm_family	 = n->ops->family;
1887 	ndm->ndm_pad1    = 0;
1888 	ndm->ndm_pad2    = 0;
1889 	ndm->ndm_flags	 = n->flags;
1890 	ndm->ndm_type	 = n->type;
1891 	ndm->ndm_ifindex = n->dev->ifindex;
1892 	RTA_PUT(skb, NDA_DST, n->tbl->key_len, n->primary_key);
1893 	read_lock_bh(&n->lock);
1894 	locked		 = 1;
1895 	ndm->ndm_state	 = n->nud_state;
1896 	if (n->nud_state & NUD_VALID)
1897 		RTA_PUT(skb, NDA_LLADDR, n->dev->addr_len, n->ha);
1898 	ci.ndm_used	 = now - n->used;
1899 	ci.ndm_confirmed = now - n->confirmed;
1900 	ci.ndm_updated	 = now - n->updated;
1901 	ci.ndm_refcnt	 = atomic_read(&n->refcnt) - 1;
1902 	probes = atomic_read(&n->probes);
1903 	read_unlock_bh(&n->lock);
1904 	locked		 = 0;
1905 	RTA_PUT(skb, NDA_CACHEINFO, sizeof(ci), &ci);
1906 	RTA_PUT(skb, NDA_PROBES, sizeof(probes), &probes);
1907 	nlh->nlmsg_len	 = skb->tail - b;
1908 	return skb->len;
1909 
1910 nlmsg_failure:
1911 rtattr_failure:
1912 	if (locked)
1913 		read_unlock_bh(&n->lock);
1914 	skb_trim(skb, b - skb->data);
1915 	return -1;
1916 }
1917 
1918 
1919 static int neigh_dump_table(struct neigh_table *tbl, struct sk_buff *skb,
1920 			    struct netlink_callback *cb)
1921 {
1922 	struct neighbour *n;
1923 	int rc, h, s_h = cb->args[1];
1924 	int idx, s_idx = idx = cb->args[2];
1925 
1926 	for (h = 0; h <= tbl->hash_mask; h++) {
1927 		if (h < s_h)
1928 			continue;
1929 		if (h > s_h)
1930 			s_idx = 0;
1931 		read_lock_bh(&tbl->lock);
1932 		for (n = tbl->hash_buckets[h], idx = 0; n; n = n->next, idx++) {
1933 			if (idx < s_idx)
1934 				continue;
1935 			if (neigh_fill_info(skb, n, NETLINK_CB(cb->skb).pid,
1936 					    cb->nlh->nlmsg_seq,
1937 					    RTM_NEWNEIGH,
1938 					    NLM_F_MULTI) <= 0) {
1939 				read_unlock_bh(&tbl->lock);
1940 				rc = -1;
1941 				goto out;
1942 			}
1943 		}
1944 		read_unlock_bh(&tbl->lock);
1945 	}
1946 	rc = skb->len;
1947 out:
1948 	cb->args[1] = h;
1949 	cb->args[2] = idx;
1950 	return rc;
1951 }
1952 
1953 int neigh_dump_info(struct sk_buff *skb, struct netlink_callback *cb)
1954 {
1955 	struct neigh_table *tbl;
1956 	int t, family, s_t;
1957 
1958 	read_lock(&neigh_tbl_lock);
1959 	family = ((struct rtgenmsg *)NLMSG_DATA(cb->nlh))->rtgen_family;
1960 	s_t = cb->args[0];
1961 
1962 	for (tbl = neigh_tables, t = 0; tbl; tbl = tbl->next, t++) {
1963 		if (t < s_t || (family && tbl->family != family))
1964 			continue;
1965 		if (t > s_t)
1966 			memset(&cb->args[1], 0, sizeof(cb->args) -
1967 						sizeof(cb->args[0]));
1968 		if (neigh_dump_table(tbl, skb, cb) < 0)
1969 			break;
1970 	}
1971 	read_unlock(&neigh_tbl_lock);
1972 
1973 	cb->args[0] = t;
1974 	return skb->len;
1975 }
1976 
1977 void neigh_for_each(struct neigh_table *tbl, void (*cb)(struct neighbour *, void *), void *cookie)
1978 {
1979 	int chain;
1980 
1981 	read_lock_bh(&tbl->lock);
1982 	for (chain = 0; chain <= tbl->hash_mask; chain++) {
1983 		struct neighbour *n;
1984 
1985 		for (n = tbl->hash_buckets[chain]; n; n = n->next)
1986 			cb(n, cookie);
1987 	}
1988 	read_unlock_bh(&tbl->lock);
1989 }
1990 EXPORT_SYMBOL(neigh_for_each);
1991 
1992 /* The tbl->lock must be held as a writer and BH disabled. */
1993 void __neigh_for_each_release(struct neigh_table *tbl,
1994 			      int (*cb)(struct neighbour *))
1995 {
1996 	int chain;
1997 
1998 	for (chain = 0; chain <= tbl->hash_mask; chain++) {
1999 		struct neighbour *n, **np;
2000 
2001 		np = &tbl->hash_buckets[chain];
2002 		while ((n = *np) != NULL) {
2003 			int release;
2004 
2005 			write_lock(&n->lock);
2006 			release = cb(n);
2007 			if (release) {
2008 				*np = n->next;
2009 				n->dead = 1;
2010 			} else
2011 				np = &n->next;
2012 			write_unlock(&n->lock);
2013 			if (release)
2014 				neigh_release(n);
2015 		}
2016 	}
2017 }
2018 EXPORT_SYMBOL(__neigh_for_each_release);
2019 
2020 #ifdef CONFIG_PROC_FS
2021 
2022 static struct neighbour *neigh_get_first(struct seq_file *seq)
2023 {
2024 	struct neigh_seq_state *state = seq->private;
2025 	struct neigh_table *tbl = state->tbl;
2026 	struct neighbour *n = NULL;
2027 	int bucket = state->bucket;
2028 
2029 	state->flags &= ~NEIGH_SEQ_IS_PNEIGH;
2030 	for (bucket = 0; bucket <= tbl->hash_mask; bucket++) {
2031 		n = tbl->hash_buckets[bucket];
2032 
2033 		while (n) {
2034 			if (state->neigh_sub_iter) {
2035 				loff_t fakep = 0;
2036 				void *v;
2037 
2038 				v = state->neigh_sub_iter(state, n, &fakep);
2039 				if (!v)
2040 					goto next;
2041 			}
2042 			if (!(state->flags & NEIGH_SEQ_SKIP_NOARP))
2043 				break;
2044 			if (n->nud_state & ~NUD_NOARP)
2045 				break;
2046 		next:
2047 			n = n->next;
2048 		}
2049 
2050 		if (n)
2051 			break;
2052 	}
2053 	state->bucket = bucket;
2054 
2055 	return n;
2056 }
2057 
2058 static struct neighbour *neigh_get_next(struct seq_file *seq,
2059 					struct neighbour *n,
2060 					loff_t *pos)
2061 {
2062 	struct neigh_seq_state *state = seq->private;
2063 	struct neigh_table *tbl = state->tbl;
2064 
2065 	if (state->neigh_sub_iter) {
2066 		void *v = state->neigh_sub_iter(state, n, pos);
2067 		if (v)
2068 			return n;
2069 	}
2070 	n = n->next;
2071 
2072 	while (1) {
2073 		while (n) {
2074 			if (state->neigh_sub_iter) {
2075 				void *v = state->neigh_sub_iter(state, n, pos);
2076 				if (v)
2077 					return n;
2078 				goto next;
2079 			}
2080 			if (!(state->flags & NEIGH_SEQ_SKIP_NOARP))
2081 				break;
2082 
2083 			if (n->nud_state & ~NUD_NOARP)
2084 				break;
2085 		next:
2086 			n = n->next;
2087 		}
2088 
2089 		if (n)
2090 			break;
2091 
2092 		if (++state->bucket > tbl->hash_mask)
2093 			break;
2094 
2095 		n = tbl->hash_buckets[state->bucket];
2096 	}
2097 
2098 	if (n && pos)
2099 		--(*pos);
2100 	return n;
2101 }
2102 
2103 static struct neighbour *neigh_get_idx(struct seq_file *seq, loff_t *pos)
2104 {
2105 	struct neighbour *n = neigh_get_first(seq);
2106 
2107 	if (n) {
2108 		while (*pos) {
2109 			n = neigh_get_next(seq, n, pos);
2110 			if (!n)
2111 				break;
2112 		}
2113 	}
2114 	return *pos ? NULL : n;
2115 }
2116 
2117 static struct pneigh_entry *pneigh_get_first(struct seq_file *seq)
2118 {
2119 	struct neigh_seq_state *state = seq->private;
2120 	struct neigh_table *tbl = state->tbl;
2121 	struct pneigh_entry *pn = NULL;
2122 	int bucket = state->bucket;
2123 
2124 	state->flags |= NEIGH_SEQ_IS_PNEIGH;
2125 	for (bucket = 0; bucket <= PNEIGH_HASHMASK; bucket++) {
2126 		pn = tbl->phash_buckets[bucket];
2127 		if (pn)
2128 			break;
2129 	}
2130 	state->bucket = bucket;
2131 
2132 	return pn;
2133 }
2134 
2135 static struct pneigh_entry *pneigh_get_next(struct seq_file *seq,
2136 					    struct pneigh_entry *pn,
2137 					    loff_t *pos)
2138 {
2139 	struct neigh_seq_state *state = seq->private;
2140 	struct neigh_table *tbl = state->tbl;
2141 
2142 	pn = pn->next;
2143 	while (!pn) {
2144 		if (++state->bucket > PNEIGH_HASHMASK)
2145 			break;
2146 		pn = tbl->phash_buckets[state->bucket];
2147 		if (pn)
2148 			break;
2149 	}
2150 
2151 	if (pn && pos)
2152 		--(*pos);
2153 
2154 	return pn;
2155 }
2156 
2157 static struct pneigh_entry *pneigh_get_idx(struct seq_file *seq, loff_t *pos)
2158 {
2159 	struct pneigh_entry *pn = pneigh_get_first(seq);
2160 
2161 	if (pn) {
2162 		while (*pos) {
2163 			pn = pneigh_get_next(seq, pn, pos);
2164 			if (!pn)
2165 				break;
2166 		}
2167 	}
2168 	return *pos ? NULL : pn;
2169 }
2170 
2171 static void *neigh_get_idx_any(struct seq_file *seq, loff_t *pos)
2172 {
2173 	struct neigh_seq_state *state = seq->private;
2174 	void *rc;
2175 
2176 	rc = neigh_get_idx(seq, pos);
2177 	if (!rc && !(state->flags & NEIGH_SEQ_NEIGH_ONLY))
2178 		rc = pneigh_get_idx(seq, pos);
2179 
2180 	return rc;
2181 }
2182 
2183 void *neigh_seq_start(struct seq_file *seq, loff_t *pos, struct neigh_table *tbl, unsigned int neigh_seq_flags)
2184 {
2185 	struct neigh_seq_state *state = seq->private;
2186 	loff_t pos_minus_one;
2187 
2188 	state->tbl = tbl;
2189 	state->bucket = 0;
2190 	state->flags = (neigh_seq_flags & ~NEIGH_SEQ_IS_PNEIGH);
2191 
2192 	read_lock_bh(&tbl->lock);
2193 
2194 	pos_minus_one = *pos - 1;
2195 	return *pos ? neigh_get_idx_any(seq, &pos_minus_one) : SEQ_START_TOKEN;
2196 }
2197 EXPORT_SYMBOL(neigh_seq_start);
2198 
2199 void *neigh_seq_next(struct seq_file *seq, void *v, loff_t *pos)
2200 {
2201 	struct neigh_seq_state *state;
2202 	void *rc;
2203 
2204 	if (v == SEQ_START_TOKEN) {
2205 		rc = neigh_get_idx(seq, pos);
2206 		goto out;
2207 	}
2208 
2209 	state = seq->private;
2210 	if (!(state->flags & NEIGH_SEQ_IS_PNEIGH)) {
2211 		rc = neigh_get_next(seq, v, NULL);
2212 		if (rc)
2213 			goto out;
2214 		if (!(state->flags & NEIGH_SEQ_NEIGH_ONLY))
2215 			rc = pneigh_get_first(seq);
2216 	} else {
2217 		BUG_ON(state->flags & NEIGH_SEQ_NEIGH_ONLY);
2218 		rc = pneigh_get_next(seq, v, NULL);
2219 	}
2220 out:
2221 	++(*pos);
2222 	return rc;
2223 }
2224 EXPORT_SYMBOL(neigh_seq_next);
2225 
2226 void neigh_seq_stop(struct seq_file *seq, void *v)
2227 {
2228 	struct neigh_seq_state *state = seq->private;
2229 	struct neigh_table *tbl = state->tbl;
2230 
2231 	read_unlock_bh(&tbl->lock);
2232 }
2233 EXPORT_SYMBOL(neigh_seq_stop);
2234 
2235 /* statistics via seq_file */
2236 
2237 static void *neigh_stat_seq_start(struct seq_file *seq, loff_t *pos)
2238 {
2239 	struct proc_dir_entry *pde = seq->private;
2240 	struct neigh_table *tbl = pde->data;
2241 	int cpu;
2242 
2243 	if (*pos == 0)
2244 		return SEQ_START_TOKEN;
2245 
2246 	for (cpu = *pos-1; cpu < NR_CPUS; ++cpu) {
2247 		if (!cpu_possible(cpu))
2248 			continue;
2249 		*pos = cpu+1;
2250 		return per_cpu_ptr(tbl->stats, cpu);
2251 	}
2252 	return NULL;
2253 }
2254 
2255 static void *neigh_stat_seq_next(struct seq_file *seq, void *v, loff_t *pos)
2256 {
2257 	struct proc_dir_entry *pde = seq->private;
2258 	struct neigh_table *tbl = pde->data;
2259 	int cpu;
2260 
2261 	for (cpu = *pos; cpu < NR_CPUS; ++cpu) {
2262 		if (!cpu_possible(cpu))
2263 			continue;
2264 		*pos = cpu+1;
2265 		return per_cpu_ptr(tbl->stats, cpu);
2266 	}
2267 	return NULL;
2268 }
2269 
2270 static void neigh_stat_seq_stop(struct seq_file *seq, void *v)
2271 {
2272 
2273 }
2274 
2275 static int neigh_stat_seq_show(struct seq_file *seq, void *v)
2276 {
2277 	struct proc_dir_entry *pde = seq->private;
2278 	struct neigh_table *tbl = pde->data;
2279 	struct neigh_statistics *st = v;
2280 
2281 	if (v == SEQ_START_TOKEN) {
2282 		seq_printf(seq, "entries  allocs destroys hash_grows  lookups hits  res_failed  rcv_probes_mcast rcv_probes_ucast  periodic_gc_runs forced_gc_runs\n");
2283 		return 0;
2284 	}
2285 
2286 	seq_printf(seq, "%08x  %08lx %08lx %08lx  %08lx %08lx  %08lx  "
2287 			"%08lx %08lx  %08lx %08lx\n",
2288 		   atomic_read(&tbl->entries),
2289 
2290 		   st->allocs,
2291 		   st->destroys,
2292 		   st->hash_grows,
2293 
2294 		   st->lookups,
2295 		   st->hits,
2296 
2297 		   st->res_failed,
2298 
2299 		   st->rcv_probes_mcast,
2300 		   st->rcv_probes_ucast,
2301 
2302 		   st->periodic_gc_runs,
2303 		   st->forced_gc_runs
2304 		   );
2305 
2306 	return 0;
2307 }
2308 
2309 static struct seq_operations neigh_stat_seq_ops = {
2310 	.start	= neigh_stat_seq_start,
2311 	.next	= neigh_stat_seq_next,
2312 	.stop	= neigh_stat_seq_stop,
2313 	.show	= neigh_stat_seq_show,
2314 };
2315 
2316 static int neigh_stat_seq_open(struct inode *inode, struct file *file)
2317 {
2318 	int ret = seq_open(file, &neigh_stat_seq_ops);
2319 
2320 	if (!ret) {
2321 		struct seq_file *sf = file->private_data;
2322 		sf->private = PDE(inode);
2323 	}
2324 	return ret;
2325 };
2326 
2327 static struct file_operations neigh_stat_seq_fops = {
2328 	.owner	 = THIS_MODULE,
2329 	.open 	 = neigh_stat_seq_open,
2330 	.read	 = seq_read,
2331 	.llseek	 = seq_lseek,
2332 	.release = seq_release,
2333 };
2334 
2335 #endif /* CONFIG_PROC_FS */
2336 
2337 #ifdef CONFIG_ARPD
2338 void neigh_app_ns(struct neighbour *n)
2339 {
2340 	struct nlmsghdr  *nlh;
2341 	int size = NLMSG_SPACE(sizeof(struct ndmsg) + 256);
2342 	struct sk_buff *skb = alloc_skb(size, GFP_ATOMIC);
2343 
2344 	if (!skb)
2345 		return;
2346 
2347 	if (neigh_fill_info(skb, n, 0, 0, RTM_GETNEIGH, 0) < 0) {
2348 		kfree_skb(skb);
2349 		return;
2350 	}
2351 	nlh			   = (struct nlmsghdr *)skb->data;
2352 	nlh->nlmsg_flags	   = NLM_F_REQUEST;
2353 	NETLINK_CB(skb).dst_group  = RTNLGRP_NEIGH;
2354 	netlink_broadcast(rtnl, skb, 0, RTNLGRP_NEIGH, GFP_ATOMIC);
2355 }
2356 
2357 static void neigh_app_notify(struct neighbour *n)
2358 {
2359 	struct nlmsghdr *nlh;
2360 	int size = NLMSG_SPACE(sizeof(struct ndmsg) + 256);
2361 	struct sk_buff *skb = alloc_skb(size, GFP_ATOMIC);
2362 
2363 	if (!skb)
2364 		return;
2365 
2366 	if (neigh_fill_info(skb, n, 0, 0, RTM_NEWNEIGH, 0) < 0) {
2367 		kfree_skb(skb);
2368 		return;
2369 	}
2370 	nlh			   = (struct nlmsghdr *)skb->data;
2371 	NETLINK_CB(skb).dst_group  = RTNLGRP_NEIGH;
2372 	netlink_broadcast(rtnl, skb, 0, RTNLGRP_NEIGH, GFP_ATOMIC);
2373 }
2374 
2375 #endif /* CONFIG_ARPD */
2376 
2377 #ifdef CONFIG_SYSCTL
2378 
2379 static struct neigh_sysctl_table {
2380 	struct ctl_table_header *sysctl_header;
2381 	ctl_table		neigh_vars[__NET_NEIGH_MAX];
2382 	ctl_table		neigh_dev[2];
2383 	ctl_table		neigh_neigh_dir[2];
2384 	ctl_table		neigh_proto_dir[2];
2385 	ctl_table		neigh_root_dir[2];
2386 } neigh_sysctl_template = {
2387 	.neigh_vars = {
2388 		{
2389 			.ctl_name	= NET_NEIGH_MCAST_SOLICIT,
2390 			.procname	= "mcast_solicit",
2391 			.maxlen		= sizeof(int),
2392 			.mode		= 0644,
2393 			.proc_handler	= &proc_dointvec,
2394 		},
2395 		{
2396 			.ctl_name	= NET_NEIGH_UCAST_SOLICIT,
2397 			.procname	= "ucast_solicit",
2398 			.maxlen		= sizeof(int),
2399 			.mode		= 0644,
2400 			.proc_handler	= &proc_dointvec,
2401 		},
2402 		{
2403 			.ctl_name	= NET_NEIGH_APP_SOLICIT,
2404 			.procname	= "app_solicit",
2405 			.maxlen		= sizeof(int),
2406 			.mode		= 0644,
2407 			.proc_handler	= &proc_dointvec,
2408 		},
2409 		{
2410 			.ctl_name	= NET_NEIGH_RETRANS_TIME,
2411 			.procname	= "retrans_time",
2412 			.maxlen		= sizeof(int),
2413 			.mode		= 0644,
2414 			.proc_handler	= &proc_dointvec_userhz_jiffies,
2415 		},
2416 		{
2417 			.ctl_name	= NET_NEIGH_REACHABLE_TIME,
2418 			.procname	= "base_reachable_time",
2419 			.maxlen		= sizeof(int),
2420 			.mode		= 0644,
2421 			.proc_handler	= &proc_dointvec_jiffies,
2422 			.strategy	= &sysctl_jiffies,
2423 		},
2424 		{
2425 			.ctl_name	= NET_NEIGH_DELAY_PROBE_TIME,
2426 			.procname	= "delay_first_probe_time",
2427 			.maxlen		= sizeof(int),
2428 			.mode		= 0644,
2429 			.proc_handler	= &proc_dointvec_jiffies,
2430 			.strategy	= &sysctl_jiffies,
2431 		},
2432 		{
2433 			.ctl_name	= NET_NEIGH_GC_STALE_TIME,
2434 			.procname	= "gc_stale_time",
2435 			.maxlen		= sizeof(int),
2436 			.mode		= 0644,
2437 			.proc_handler	= &proc_dointvec_jiffies,
2438 			.strategy	= &sysctl_jiffies,
2439 		},
2440 		{
2441 			.ctl_name	= NET_NEIGH_UNRES_QLEN,
2442 			.procname	= "unres_qlen",
2443 			.maxlen		= sizeof(int),
2444 			.mode		= 0644,
2445 			.proc_handler	= &proc_dointvec,
2446 		},
2447 		{
2448 			.ctl_name	= NET_NEIGH_PROXY_QLEN,
2449 			.procname	= "proxy_qlen",
2450 			.maxlen		= sizeof(int),
2451 			.mode		= 0644,
2452 			.proc_handler	= &proc_dointvec,
2453 		},
2454 		{
2455 			.ctl_name	= NET_NEIGH_ANYCAST_DELAY,
2456 			.procname	= "anycast_delay",
2457 			.maxlen		= sizeof(int),
2458 			.mode		= 0644,
2459 			.proc_handler	= &proc_dointvec_userhz_jiffies,
2460 		},
2461 		{
2462 			.ctl_name	= NET_NEIGH_PROXY_DELAY,
2463 			.procname	= "proxy_delay",
2464 			.maxlen		= sizeof(int),
2465 			.mode		= 0644,
2466 			.proc_handler	= &proc_dointvec_userhz_jiffies,
2467 		},
2468 		{
2469 			.ctl_name	= NET_NEIGH_LOCKTIME,
2470 			.procname	= "locktime",
2471 			.maxlen		= sizeof(int),
2472 			.mode		= 0644,
2473 			.proc_handler	= &proc_dointvec_userhz_jiffies,
2474 		},
2475 		{
2476 			.ctl_name	= NET_NEIGH_GC_INTERVAL,
2477 			.procname	= "gc_interval",
2478 			.maxlen		= sizeof(int),
2479 			.mode		= 0644,
2480 			.proc_handler	= &proc_dointvec_jiffies,
2481 			.strategy	= &sysctl_jiffies,
2482 		},
2483 		{
2484 			.ctl_name	= NET_NEIGH_GC_THRESH1,
2485 			.procname	= "gc_thresh1",
2486 			.maxlen		= sizeof(int),
2487 			.mode		= 0644,
2488 			.proc_handler	= &proc_dointvec,
2489 		},
2490 		{
2491 			.ctl_name	= NET_NEIGH_GC_THRESH2,
2492 			.procname	= "gc_thresh2",
2493 			.maxlen		= sizeof(int),
2494 			.mode		= 0644,
2495 			.proc_handler	= &proc_dointvec,
2496 		},
2497 		{
2498 			.ctl_name	= NET_NEIGH_GC_THRESH3,
2499 			.procname	= "gc_thresh3",
2500 			.maxlen		= sizeof(int),
2501 			.mode		= 0644,
2502 			.proc_handler	= &proc_dointvec,
2503 		},
2504 		{
2505 			.ctl_name	= NET_NEIGH_RETRANS_TIME_MS,
2506 			.procname	= "retrans_time_ms",
2507 			.maxlen		= sizeof(int),
2508 			.mode		= 0644,
2509 			.proc_handler	= &proc_dointvec_ms_jiffies,
2510 			.strategy	= &sysctl_ms_jiffies,
2511 		},
2512 		{
2513 			.ctl_name	= NET_NEIGH_REACHABLE_TIME_MS,
2514 			.procname	= "base_reachable_time_ms",
2515 			.maxlen		= sizeof(int),
2516 			.mode		= 0644,
2517 			.proc_handler	= &proc_dointvec_ms_jiffies,
2518 			.strategy	= &sysctl_ms_jiffies,
2519 		},
2520 	},
2521 	.neigh_dev = {
2522 		{
2523 			.ctl_name	= NET_PROTO_CONF_DEFAULT,
2524 			.procname	= "default",
2525 			.mode		= 0555,
2526 		},
2527 	},
2528 	.neigh_neigh_dir = {
2529 		{
2530 			.procname	= "neigh",
2531 			.mode		= 0555,
2532 		},
2533 	},
2534 	.neigh_proto_dir = {
2535 		{
2536 			.mode		= 0555,
2537 		},
2538 	},
2539 	.neigh_root_dir = {
2540 		{
2541 			.ctl_name	= CTL_NET,
2542 			.procname	= "net",
2543 			.mode		= 0555,
2544 		},
2545 	},
2546 };
2547 
2548 int neigh_sysctl_register(struct net_device *dev, struct neigh_parms *p,
2549 			  int p_id, int pdev_id, char *p_name,
2550 			  proc_handler *handler, ctl_handler *strategy)
2551 {
2552 	struct neigh_sysctl_table *t = kmalloc(sizeof(*t), GFP_KERNEL);
2553 	const char *dev_name_source = NULL;
2554 	char *dev_name = NULL;
2555 	int err = 0;
2556 
2557 	if (!t)
2558 		return -ENOBUFS;
2559 	memcpy(t, &neigh_sysctl_template, sizeof(*t));
2560 	t->neigh_vars[0].data  = &p->mcast_probes;
2561 	t->neigh_vars[1].data  = &p->ucast_probes;
2562 	t->neigh_vars[2].data  = &p->app_probes;
2563 	t->neigh_vars[3].data  = &p->retrans_time;
2564 	t->neigh_vars[4].data  = &p->base_reachable_time;
2565 	t->neigh_vars[5].data  = &p->delay_probe_time;
2566 	t->neigh_vars[6].data  = &p->gc_staletime;
2567 	t->neigh_vars[7].data  = &p->queue_len;
2568 	t->neigh_vars[8].data  = &p->proxy_qlen;
2569 	t->neigh_vars[9].data  = &p->anycast_delay;
2570 	t->neigh_vars[10].data = &p->proxy_delay;
2571 	t->neigh_vars[11].data = &p->locktime;
2572 
2573 	if (dev) {
2574 		dev_name_source = dev->name;
2575 		t->neigh_dev[0].ctl_name = dev->ifindex;
2576 		t->neigh_vars[12].procname = NULL;
2577 		t->neigh_vars[13].procname = NULL;
2578 		t->neigh_vars[14].procname = NULL;
2579 		t->neigh_vars[15].procname = NULL;
2580 	} else {
2581  		dev_name_source = t->neigh_dev[0].procname;
2582 		t->neigh_vars[12].data = (int *)(p + 1);
2583 		t->neigh_vars[13].data = (int *)(p + 1) + 1;
2584 		t->neigh_vars[14].data = (int *)(p + 1) + 2;
2585 		t->neigh_vars[15].data = (int *)(p + 1) + 3;
2586 	}
2587 
2588 	t->neigh_vars[16].data  = &p->retrans_time;
2589 	t->neigh_vars[17].data  = &p->base_reachable_time;
2590 
2591 	if (handler || strategy) {
2592 		/* RetransTime */
2593 		t->neigh_vars[3].proc_handler = handler;
2594 		t->neigh_vars[3].strategy = strategy;
2595 		t->neigh_vars[3].extra1 = dev;
2596 		/* ReachableTime */
2597 		t->neigh_vars[4].proc_handler = handler;
2598 		t->neigh_vars[4].strategy = strategy;
2599 		t->neigh_vars[4].extra1 = dev;
2600 		/* RetransTime (in milliseconds)*/
2601 		t->neigh_vars[16].proc_handler = handler;
2602 		t->neigh_vars[16].strategy = strategy;
2603 		t->neigh_vars[16].extra1 = dev;
2604 		/* ReachableTime (in milliseconds) */
2605 		t->neigh_vars[17].proc_handler = handler;
2606 		t->neigh_vars[17].strategy = strategy;
2607 		t->neigh_vars[17].extra1 = dev;
2608 	}
2609 
2610 	dev_name = kstrdup(dev_name_source, GFP_KERNEL);
2611 	if (!dev_name) {
2612 		err = -ENOBUFS;
2613 		goto free;
2614 	}
2615 
2616  	t->neigh_dev[0].procname = dev_name;
2617 
2618 	t->neigh_neigh_dir[0].ctl_name = pdev_id;
2619 
2620 	t->neigh_proto_dir[0].procname = p_name;
2621 	t->neigh_proto_dir[0].ctl_name = p_id;
2622 
2623 	t->neigh_dev[0].child	       = t->neigh_vars;
2624 	t->neigh_neigh_dir[0].child    = t->neigh_dev;
2625 	t->neigh_proto_dir[0].child    = t->neigh_neigh_dir;
2626 	t->neigh_root_dir[0].child     = t->neigh_proto_dir;
2627 
2628 	t->sysctl_header = register_sysctl_table(t->neigh_root_dir, 0);
2629 	if (!t->sysctl_header) {
2630 		err = -ENOBUFS;
2631 		goto free_procname;
2632 	}
2633 	p->sysctl_table = t;
2634 	return 0;
2635 
2636 	/* error path */
2637  free_procname:
2638 	kfree(dev_name);
2639  free:
2640 	kfree(t);
2641 
2642 	return err;
2643 }
2644 
2645 void neigh_sysctl_unregister(struct neigh_parms *p)
2646 {
2647 	if (p->sysctl_table) {
2648 		struct neigh_sysctl_table *t = p->sysctl_table;
2649 		p->sysctl_table = NULL;
2650 		unregister_sysctl_table(t->sysctl_header);
2651 		kfree(t->neigh_dev[0].procname);
2652 		kfree(t);
2653 	}
2654 }
2655 
2656 #endif	/* CONFIG_SYSCTL */
2657 
2658 EXPORT_SYMBOL(__neigh_event_send);
2659 EXPORT_SYMBOL(neigh_add);
2660 EXPORT_SYMBOL(neigh_changeaddr);
2661 EXPORT_SYMBOL(neigh_compat_output);
2662 EXPORT_SYMBOL(neigh_connected_output);
2663 EXPORT_SYMBOL(neigh_create);
2664 EXPORT_SYMBOL(neigh_delete);
2665 EXPORT_SYMBOL(neigh_destroy);
2666 EXPORT_SYMBOL(neigh_dump_info);
2667 EXPORT_SYMBOL(neigh_event_ns);
2668 EXPORT_SYMBOL(neigh_ifdown);
2669 EXPORT_SYMBOL(neigh_lookup);
2670 EXPORT_SYMBOL(neigh_lookup_nodev);
2671 EXPORT_SYMBOL(neigh_parms_alloc);
2672 EXPORT_SYMBOL(neigh_parms_release);
2673 EXPORT_SYMBOL(neigh_rand_reach_time);
2674 EXPORT_SYMBOL(neigh_resolve_output);
2675 EXPORT_SYMBOL(neigh_table_clear);
2676 EXPORT_SYMBOL(neigh_table_init);
2677 EXPORT_SYMBOL(neigh_update);
2678 EXPORT_SYMBOL(neigh_update_hhs);
2679 EXPORT_SYMBOL(pneigh_enqueue);
2680 EXPORT_SYMBOL(pneigh_lookup);
2681 EXPORT_SYMBOL(neightbl_dump_info);
2682 EXPORT_SYMBOL(neightbl_set);
2683 
2684 #ifdef CONFIG_ARPD
2685 EXPORT_SYMBOL(neigh_app_ns);
2686 #endif
2687 #ifdef CONFIG_SYSCTL
2688 EXPORT_SYMBOL(neigh_sysctl_register);
2689 EXPORT_SYMBOL(neigh_sysctl_unregister);
2690 #endif
2691