xref: /linux/net/core/neighbour.c (revision ba6e8564f459211117ce300eae2c7fdd23befe34)
1 /*
2  *	Generic address resolution entity
3  *
4  *	Authors:
5  *	Pedro Roque		<roque@di.fc.ul.pt>
6  *	Alexey Kuznetsov	<kuznet@ms2.inr.ac.ru>
7  *
8  *	This program is free software; you can redistribute it and/or
9  *      modify it under the terms of the GNU General Public License
10  *      as published by the Free Software Foundation; either version
11  *      2 of the License, or (at your option) any later version.
12  *
13  *	Fixes:
14  *	Vitaly E. Lavrov	releasing NULL neighbor in neigh_add.
15  *	Harald Welte		Add neighbour cache statistics like rtstat
16  */
17 
18 #include <linux/types.h>
19 #include <linux/kernel.h>
20 #include <linux/module.h>
21 #include <linux/socket.h>
22 #include <linux/netdevice.h>
23 #include <linux/proc_fs.h>
24 #ifdef CONFIG_SYSCTL
25 #include <linux/sysctl.h>
26 #endif
27 #include <linux/times.h>
28 #include <net/neighbour.h>
29 #include <net/dst.h>
30 #include <net/sock.h>
31 #include <net/netevent.h>
32 #include <net/netlink.h>
33 #include <linux/rtnetlink.h>
34 #include <linux/random.h>
35 #include <linux/string.h>
36 
37 #define NEIGH_DEBUG 1
38 
39 #define NEIGH_PRINTK(x...) printk(x)
40 #define NEIGH_NOPRINTK(x...) do { ; } while(0)
41 #define NEIGH_PRINTK0 NEIGH_PRINTK
42 #define NEIGH_PRINTK1 NEIGH_NOPRINTK
43 #define NEIGH_PRINTK2 NEIGH_NOPRINTK
44 
45 #if NEIGH_DEBUG >= 1
46 #undef NEIGH_PRINTK1
47 #define NEIGH_PRINTK1 NEIGH_PRINTK
48 #endif
49 #if NEIGH_DEBUG >= 2
50 #undef NEIGH_PRINTK2
51 #define NEIGH_PRINTK2 NEIGH_PRINTK
52 #endif
53 
54 #define PNEIGH_HASHMASK		0xF
55 
56 static void neigh_timer_handler(unsigned long arg);
57 #ifdef CONFIG_ARPD
58 static void neigh_app_notify(struct neighbour *n);
59 #endif
60 static int pneigh_ifdown(struct neigh_table *tbl, struct net_device *dev);
61 void neigh_changeaddr(struct neigh_table *tbl, struct net_device *dev);
62 
63 static struct neigh_table *neigh_tables;
64 #ifdef CONFIG_PROC_FS
65 static const struct file_operations neigh_stat_seq_fops;
66 #endif
67 
68 /*
69    Neighbour hash table buckets are protected with rwlock tbl->lock.
70 
71    - All the scans/updates to hash buckets MUST be made under this lock.
72    - NOTHING clever should be made under this lock: no callbacks
73      to protocol backends, no attempts to send something to network.
74      It will result in deadlocks, if backend/driver wants to use neighbour
75      cache.
76    - If the entry requires some non-trivial actions, increase
77      its reference count and release table lock.
78 
79    Neighbour entries are protected:
80    - with reference count.
81    - with rwlock neigh->lock
82 
83    Reference count prevents destruction.
84 
85    neigh->lock mainly serializes ll address data and its validity state.
86    However, the same lock is used to protect another entry fields:
87     - timer
88     - resolution queue
89 
90    Again, nothing clever shall be made under neigh->lock,
91    the most complicated procedure, which we allow is dev->hard_header.
92    It is supposed, that dev->hard_header is simplistic and does
93    not make callbacks to neighbour tables.
94 
95    The last lock is neigh_tbl_lock. It is pure SMP lock, protecting
96    list of neighbour tables. This list is used only in process context,
97  */
98 
99 static DEFINE_RWLOCK(neigh_tbl_lock);
100 
101 static int neigh_blackhole(struct sk_buff *skb)
102 {
103 	kfree_skb(skb);
104 	return -ENETDOWN;
105 }
106 
107 /*
108  * It is random distribution in the interval (1/2)*base...(3/2)*base.
109  * It corresponds to default IPv6 settings and is not overridable,
110  * because it is really reasonable choice.
111  */
112 
113 unsigned long neigh_rand_reach_time(unsigned long base)
114 {
115 	return (base ? (net_random() % base) + (base >> 1) : 0);
116 }
117 
118 
119 static int neigh_forced_gc(struct neigh_table *tbl)
120 {
121 	int shrunk = 0;
122 	int i;
123 
124 	NEIGH_CACHE_STAT_INC(tbl, forced_gc_runs);
125 
126 	write_lock_bh(&tbl->lock);
127 	for (i = 0; i <= tbl->hash_mask; i++) {
128 		struct neighbour *n, **np;
129 
130 		np = &tbl->hash_buckets[i];
131 		while ((n = *np) != NULL) {
132 			/* Neighbour record may be discarded if:
133 			 * - nobody refers to it.
134 			 * - it is not permanent
135 			 */
136 			write_lock(&n->lock);
137 			if (atomic_read(&n->refcnt) == 1 &&
138 			    !(n->nud_state & NUD_PERMANENT)) {
139 				*np	= n->next;
140 				n->dead = 1;
141 				shrunk	= 1;
142 				write_unlock(&n->lock);
143 				if (n->parms->neigh_cleanup)
144 					n->parms->neigh_cleanup(n);
145 				neigh_release(n);
146 				continue;
147 			}
148 			write_unlock(&n->lock);
149 			np = &n->next;
150 		}
151 	}
152 
153 	tbl->last_flush = jiffies;
154 
155 	write_unlock_bh(&tbl->lock);
156 
157 	return shrunk;
158 }
159 
160 static int neigh_del_timer(struct neighbour *n)
161 {
162 	if ((n->nud_state & NUD_IN_TIMER) &&
163 	    del_timer(&n->timer)) {
164 		neigh_release(n);
165 		return 1;
166 	}
167 	return 0;
168 }
169 
170 static void pneigh_queue_purge(struct sk_buff_head *list)
171 {
172 	struct sk_buff *skb;
173 
174 	while ((skb = skb_dequeue(list)) != NULL) {
175 		dev_put(skb->dev);
176 		kfree_skb(skb);
177 	}
178 }
179 
180 static void neigh_flush_dev(struct neigh_table *tbl, struct net_device *dev)
181 {
182 	int i;
183 
184 	for (i = 0; i <= tbl->hash_mask; i++) {
185 		struct neighbour *n, **np = &tbl->hash_buckets[i];
186 
187 		while ((n = *np) != NULL) {
188 			if (dev && n->dev != dev) {
189 				np = &n->next;
190 				continue;
191 			}
192 			*np = n->next;
193 			write_lock(&n->lock);
194 			neigh_del_timer(n);
195 			n->dead = 1;
196 
197 			if (atomic_read(&n->refcnt) != 1) {
198 				/* The most unpleasant situation.
199 				   We must destroy neighbour entry,
200 				   but someone still uses it.
201 
202 				   The destroy will be delayed until
203 				   the last user releases us, but
204 				   we must kill timers etc. and move
205 				   it to safe state.
206 				 */
207 				skb_queue_purge(&n->arp_queue);
208 				n->output = neigh_blackhole;
209 				if (n->nud_state & NUD_VALID)
210 					n->nud_state = NUD_NOARP;
211 				else
212 					n->nud_state = NUD_NONE;
213 				NEIGH_PRINTK2("neigh %p is stray.\n", n);
214 			}
215 			write_unlock(&n->lock);
216 			if (n->parms->neigh_cleanup)
217 				n->parms->neigh_cleanup(n);
218 			neigh_release(n);
219 		}
220 	}
221 }
222 
223 void neigh_changeaddr(struct neigh_table *tbl, struct net_device *dev)
224 {
225 	write_lock_bh(&tbl->lock);
226 	neigh_flush_dev(tbl, dev);
227 	write_unlock_bh(&tbl->lock);
228 }
229 
230 int neigh_ifdown(struct neigh_table *tbl, struct net_device *dev)
231 {
232 	write_lock_bh(&tbl->lock);
233 	neigh_flush_dev(tbl, dev);
234 	pneigh_ifdown(tbl, dev);
235 	write_unlock_bh(&tbl->lock);
236 
237 	del_timer_sync(&tbl->proxy_timer);
238 	pneigh_queue_purge(&tbl->proxy_queue);
239 	return 0;
240 }
241 
242 static struct neighbour *neigh_alloc(struct neigh_table *tbl)
243 {
244 	struct neighbour *n = NULL;
245 	unsigned long now = jiffies;
246 	int entries;
247 
248 	entries = atomic_inc_return(&tbl->entries) - 1;
249 	if (entries >= tbl->gc_thresh3 ||
250 	    (entries >= tbl->gc_thresh2 &&
251 	     time_after(now, tbl->last_flush + 5 * HZ))) {
252 		if (!neigh_forced_gc(tbl) &&
253 		    entries >= tbl->gc_thresh3)
254 			goto out_entries;
255 	}
256 
257 	n = kmem_cache_zalloc(tbl->kmem_cachep, GFP_ATOMIC);
258 	if (!n)
259 		goto out_entries;
260 
261 	skb_queue_head_init(&n->arp_queue);
262 	rwlock_init(&n->lock);
263 	n->updated	  = n->used = now;
264 	n->nud_state	  = NUD_NONE;
265 	n->output	  = neigh_blackhole;
266 	n->parms	  = neigh_parms_clone(&tbl->parms);
267 	init_timer(&n->timer);
268 	n->timer.function = neigh_timer_handler;
269 	n->timer.data	  = (unsigned long)n;
270 
271 	NEIGH_CACHE_STAT_INC(tbl, allocs);
272 	n->tbl		  = tbl;
273 	atomic_set(&n->refcnt, 1);
274 	n->dead		  = 1;
275 out:
276 	return n;
277 
278 out_entries:
279 	atomic_dec(&tbl->entries);
280 	goto out;
281 }
282 
283 static struct neighbour **neigh_hash_alloc(unsigned int entries)
284 {
285 	unsigned long size = entries * sizeof(struct neighbour *);
286 	struct neighbour **ret;
287 
288 	if (size <= PAGE_SIZE) {
289 		ret = kzalloc(size, GFP_ATOMIC);
290 	} else {
291 		ret = (struct neighbour **)
292 		      __get_free_pages(GFP_ATOMIC|__GFP_ZERO, get_order(size));
293 	}
294 	return ret;
295 }
296 
297 static void neigh_hash_free(struct neighbour **hash, unsigned int entries)
298 {
299 	unsigned long size = entries * sizeof(struct neighbour *);
300 
301 	if (size <= PAGE_SIZE)
302 		kfree(hash);
303 	else
304 		free_pages((unsigned long)hash, get_order(size));
305 }
306 
307 static void neigh_hash_grow(struct neigh_table *tbl, unsigned long new_entries)
308 {
309 	struct neighbour **new_hash, **old_hash;
310 	unsigned int i, new_hash_mask, old_entries;
311 
312 	NEIGH_CACHE_STAT_INC(tbl, hash_grows);
313 
314 	BUG_ON(new_entries & (new_entries - 1));
315 	new_hash = neigh_hash_alloc(new_entries);
316 	if (!new_hash)
317 		return;
318 
319 	old_entries = tbl->hash_mask + 1;
320 	new_hash_mask = new_entries - 1;
321 	old_hash = tbl->hash_buckets;
322 
323 	get_random_bytes(&tbl->hash_rnd, sizeof(tbl->hash_rnd));
324 	for (i = 0; i < old_entries; i++) {
325 		struct neighbour *n, *next;
326 
327 		for (n = old_hash[i]; n; n = next) {
328 			unsigned int hash_val = tbl->hash(n->primary_key, n->dev);
329 
330 			hash_val &= new_hash_mask;
331 			next = n->next;
332 
333 			n->next = new_hash[hash_val];
334 			new_hash[hash_val] = n;
335 		}
336 	}
337 	tbl->hash_buckets = new_hash;
338 	tbl->hash_mask = new_hash_mask;
339 
340 	neigh_hash_free(old_hash, old_entries);
341 }
342 
343 struct neighbour *neigh_lookup(struct neigh_table *tbl, const void *pkey,
344 			       struct net_device *dev)
345 {
346 	struct neighbour *n;
347 	int key_len = tbl->key_len;
348 	u32 hash_val = tbl->hash(pkey, dev);
349 
350 	NEIGH_CACHE_STAT_INC(tbl, lookups);
351 
352 	read_lock_bh(&tbl->lock);
353 	for (n = tbl->hash_buckets[hash_val & tbl->hash_mask]; n; n = n->next) {
354 		if (dev == n->dev && !memcmp(n->primary_key, pkey, key_len)) {
355 			neigh_hold(n);
356 			NEIGH_CACHE_STAT_INC(tbl, hits);
357 			break;
358 		}
359 	}
360 	read_unlock_bh(&tbl->lock);
361 	return n;
362 }
363 
364 struct neighbour *neigh_lookup_nodev(struct neigh_table *tbl, const void *pkey)
365 {
366 	struct neighbour *n;
367 	int key_len = tbl->key_len;
368 	u32 hash_val = tbl->hash(pkey, NULL);
369 
370 	NEIGH_CACHE_STAT_INC(tbl, lookups);
371 
372 	read_lock_bh(&tbl->lock);
373 	for (n = tbl->hash_buckets[hash_val & tbl->hash_mask]; n; n = n->next) {
374 		if (!memcmp(n->primary_key, pkey, key_len)) {
375 			neigh_hold(n);
376 			NEIGH_CACHE_STAT_INC(tbl, hits);
377 			break;
378 		}
379 	}
380 	read_unlock_bh(&tbl->lock);
381 	return n;
382 }
383 
384 struct neighbour *neigh_create(struct neigh_table *tbl, const void *pkey,
385 			       struct net_device *dev)
386 {
387 	u32 hash_val;
388 	int key_len = tbl->key_len;
389 	int error;
390 	struct neighbour *n1, *rc, *n = neigh_alloc(tbl);
391 
392 	if (!n) {
393 		rc = ERR_PTR(-ENOBUFS);
394 		goto out;
395 	}
396 
397 	memcpy(n->primary_key, pkey, key_len);
398 	n->dev = dev;
399 	dev_hold(dev);
400 
401 	/* Protocol specific setup. */
402 	if (tbl->constructor &&	(error = tbl->constructor(n)) < 0) {
403 		rc = ERR_PTR(error);
404 		goto out_neigh_release;
405 	}
406 
407 	/* Device specific setup. */
408 	if (n->parms->neigh_setup &&
409 	    (error = n->parms->neigh_setup(n)) < 0) {
410 		rc = ERR_PTR(error);
411 		goto out_neigh_release;
412 	}
413 
414 	n->confirmed = jiffies - (n->parms->base_reachable_time << 1);
415 
416 	write_lock_bh(&tbl->lock);
417 
418 	if (atomic_read(&tbl->entries) > (tbl->hash_mask + 1))
419 		neigh_hash_grow(tbl, (tbl->hash_mask + 1) << 1);
420 
421 	hash_val = tbl->hash(pkey, dev) & tbl->hash_mask;
422 
423 	if (n->parms->dead) {
424 		rc = ERR_PTR(-EINVAL);
425 		goto out_tbl_unlock;
426 	}
427 
428 	for (n1 = tbl->hash_buckets[hash_val]; n1; n1 = n1->next) {
429 		if (dev == n1->dev && !memcmp(n1->primary_key, pkey, key_len)) {
430 			neigh_hold(n1);
431 			rc = n1;
432 			goto out_tbl_unlock;
433 		}
434 	}
435 
436 	n->next = tbl->hash_buckets[hash_val];
437 	tbl->hash_buckets[hash_val] = n;
438 	n->dead = 0;
439 	neigh_hold(n);
440 	write_unlock_bh(&tbl->lock);
441 	NEIGH_PRINTK2("neigh %p is created.\n", n);
442 	rc = n;
443 out:
444 	return rc;
445 out_tbl_unlock:
446 	write_unlock_bh(&tbl->lock);
447 out_neigh_release:
448 	neigh_release(n);
449 	goto out;
450 }
451 
452 struct pneigh_entry * pneigh_lookup(struct neigh_table *tbl, const void *pkey,
453 				    struct net_device *dev, int creat)
454 {
455 	struct pneigh_entry *n;
456 	int key_len = tbl->key_len;
457 	u32 hash_val = *(u32 *)(pkey + key_len - 4);
458 
459 	hash_val ^= (hash_val >> 16);
460 	hash_val ^= hash_val >> 8;
461 	hash_val ^= hash_val >> 4;
462 	hash_val &= PNEIGH_HASHMASK;
463 
464 	read_lock_bh(&tbl->lock);
465 
466 	for (n = tbl->phash_buckets[hash_val]; n; n = n->next) {
467 		if (!memcmp(n->key, pkey, key_len) &&
468 		    (n->dev == dev || !n->dev)) {
469 			read_unlock_bh(&tbl->lock);
470 			goto out;
471 		}
472 	}
473 	read_unlock_bh(&tbl->lock);
474 	n = NULL;
475 	if (!creat)
476 		goto out;
477 
478 	n = kmalloc(sizeof(*n) + key_len, GFP_KERNEL);
479 	if (!n)
480 		goto out;
481 
482 	memcpy(n->key, pkey, key_len);
483 	n->dev = dev;
484 	if (dev)
485 		dev_hold(dev);
486 
487 	if (tbl->pconstructor && tbl->pconstructor(n)) {
488 		if (dev)
489 			dev_put(dev);
490 		kfree(n);
491 		n = NULL;
492 		goto out;
493 	}
494 
495 	write_lock_bh(&tbl->lock);
496 	n->next = tbl->phash_buckets[hash_val];
497 	tbl->phash_buckets[hash_val] = n;
498 	write_unlock_bh(&tbl->lock);
499 out:
500 	return n;
501 }
502 
503 
504 int pneigh_delete(struct neigh_table *tbl, const void *pkey,
505 		  struct net_device *dev)
506 {
507 	struct pneigh_entry *n, **np;
508 	int key_len = tbl->key_len;
509 	u32 hash_val = *(u32 *)(pkey + key_len - 4);
510 
511 	hash_val ^= (hash_val >> 16);
512 	hash_val ^= hash_val >> 8;
513 	hash_val ^= hash_val >> 4;
514 	hash_val &= PNEIGH_HASHMASK;
515 
516 	write_lock_bh(&tbl->lock);
517 	for (np = &tbl->phash_buckets[hash_val]; (n = *np) != NULL;
518 	     np = &n->next) {
519 		if (!memcmp(n->key, pkey, key_len) && n->dev == dev) {
520 			*np = n->next;
521 			write_unlock_bh(&tbl->lock);
522 			if (tbl->pdestructor)
523 				tbl->pdestructor(n);
524 			if (n->dev)
525 				dev_put(n->dev);
526 			kfree(n);
527 			return 0;
528 		}
529 	}
530 	write_unlock_bh(&tbl->lock);
531 	return -ENOENT;
532 }
533 
534 static int pneigh_ifdown(struct neigh_table *tbl, struct net_device *dev)
535 {
536 	struct pneigh_entry *n, **np;
537 	u32 h;
538 
539 	for (h = 0; h <= PNEIGH_HASHMASK; h++) {
540 		np = &tbl->phash_buckets[h];
541 		while ((n = *np) != NULL) {
542 			if (!dev || n->dev == dev) {
543 				*np = n->next;
544 				if (tbl->pdestructor)
545 					tbl->pdestructor(n);
546 				if (n->dev)
547 					dev_put(n->dev);
548 				kfree(n);
549 				continue;
550 			}
551 			np = &n->next;
552 		}
553 	}
554 	return -ENOENT;
555 }
556 
557 
558 /*
559  *	neighbour must already be out of the table;
560  *
561  */
562 void neigh_destroy(struct neighbour *neigh)
563 {
564 	struct hh_cache *hh;
565 
566 	NEIGH_CACHE_STAT_INC(neigh->tbl, destroys);
567 
568 	if (!neigh->dead) {
569 		printk(KERN_WARNING
570 		       "Destroying alive neighbour %p\n", neigh);
571 		dump_stack();
572 		return;
573 	}
574 
575 	if (neigh_del_timer(neigh))
576 		printk(KERN_WARNING "Impossible event.\n");
577 
578 	while ((hh = neigh->hh) != NULL) {
579 		neigh->hh = hh->hh_next;
580 		hh->hh_next = NULL;
581 
582 		write_seqlock_bh(&hh->hh_lock);
583 		hh->hh_output = neigh_blackhole;
584 		write_sequnlock_bh(&hh->hh_lock);
585 		if (atomic_dec_and_test(&hh->hh_refcnt))
586 			kfree(hh);
587 	}
588 
589 	skb_queue_purge(&neigh->arp_queue);
590 
591 	dev_put(neigh->dev);
592 	neigh_parms_put(neigh->parms);
593 
594 	NEIGH_PRINTK2("neigh %p is destroyed.\n", neigh);
595 
596 	atomic_dec(&neigh->tbl->entries);
597 	kmem_cache_free(neigh->tbl->kmem_cachep, neigh);
598 }
599 
600 /* Neighbour state is suspicious;
601    disable fast path.
602 
603    Called with write_locked neigh.
604  */
605 static void neigh_suspect(struct neighbour *neigh)
606 {
607 	struct hh_cache *hh;
608 
609 	NEIGH_PRINTK2("neigh %p is suspected.\n", neigh);
610 
611 	neigh->output = neigh->ops->output;
612 
613 	for (hh = neigh->hh; hh; hh = hh->hh_next)
614 		hh->hh_output = neigh->ops->output;
615 }
616 
617 /* Neighbour state is OK;
618    enable fast path.
619 
620    Called with write_locked neigh.
621  */
622 static void neigh_connect(struct neighbour *neigh)
623 {
624 	struct hh_cache *hh;
625 
626 	NEIGH_PRINTK2("neigh %p is connected.\n", neigh);
627 
628 	neigh->output = neigh->ops->connected_output;
629 
630 	for (hh = neigh->hh; hh; hh = hh->hh_next)
631 		hh->hh_output = neigh->ops->hh_output;
632 }
633 
634 static void neigh_periodic_timer(unsigned long arg)
635 {
636 	struct neigh_table *tbl = (struct neigh_table *)arg;
637 	struct neighbour *n, **np;
638 	unsigned long expire, now = jiffies;
639 
640 	NEIGH_CACHE_STAT_INC(tbl, periodic_gc_runs);
641 
642 	write_lock(&tbl->lock);
643 
644 	/*
645 	 *	periodically recompute ReachableTime from random function
646 	 */
647 
648 	if (time_after(now, tbl->last_rand + 300 * HZ)) {
649 		struct neigh_parms *p;
650 		tbl->last_rand = now;
651 		for (p = &tbl->parms; p; p = p->next)
652 			p->reachable_time =
653 				neigh_rand_reach_time(p->base_reachable_time);
654 	}
655 
656 	np = &tbl->hash_buckets[tbl->hash_chain_gc];
657 	tbl->hash_chain_gc = ((tbl->hash_chain_gc + 1) & tbl->hash_mask);
658 
659 	while ((n = *np) != NULL) {
660 		unsigned int state;
661 
662 		write_lock(&n->lock);
663 
664 		state = n->nud_state;
665 		if (state & (NUD_PERMANENT | NUD_IN_TIMER)) {
666 			write_unlock(&n->lock);
667 			goto next_elt;
668 		}
669 
670 		if (time_before(n->used, n->confirmed))
671 			n->used = n->confirmed;
672 
673 		if (atomic_read(&n->refcnt) == 1 &&
674 		    (state == NUD_FAILED ||
675 		     time_after(now, n->used + n->parms->gc_staletime))) {
676 			*np = n->next;
677 			n->dead = 1;
678 			write_unlock(&n->lock);
679 			if (n->parms->neigh_cleanup)
680 				n->parms->neigh_cleanup(n);
681 			neigh_release(n);
682 			continue;
683 		}
684 		write_unlock(&n->lock);
685 
686 next_elt:
687 		np = &n->next;
688 	}
689 
690 	/* Cycle through all hash buckets every base_reachable_time/2 ticks.
691 	 * ARP entry timeouts range from 1/2 base_reachable_time to 3/2
692 	 * base_reachable_time.
693 	 */
694 	expire = tbl->parms.base_reachable_time >> 1;
695 	expire /= (tbl->hash_mask + 1);
696 	if (!expire)
697 		expire = 1;
698 
699 	if (expire>HZ)
700 		mod_timer(&tbl->gc_timer, round_jiffies(now + expire));
701 	else
702 		mod_timer(&tbl->gc_timer, now + expire);
703 
704 	write_unlock(&tbl->lock);
705 }
706 
707 static __inline__ int neigh_max_probes(struct neighbour *n)
708 {
709 	struct neigh_parms *p = n->parms;
710 	return (n->nud_state & NUD_PROBE ?
711 		p->ucast_probes :
712 		p->ucast_probes + p->app_probes + p->mcast_probes);
713 }
714 
715 static inline void neigh_add_timer(struct neighbour *n, unsigned long when)
716 {
717 	if (unlikely(mod_timer(&n->timer, when))) {
718 		printk("NEIGH: BUG, double timer add, state is %x\n",
719 		       n->nud_state);
720 		dump_stack();
721 	}
722 }
723 
724 /* Called when a timer expires for a neighbour entry. */
725 
726 static void neigh_timer_handler(unsigned long arg)
727 {
728 	unsigned long now, next;
729 	struct neighbour *neigh = (struct neighbour *)arg;
730 	unsigned state;
731 	int notify = 0;
732 
733 	write_lock(&neigh->lock);
734 
735 	state = neigh->nud_state;
736 	now = jiffies;
737 	next = now + HZ;
738 
739 	if (!(state & NUD_IN_TIMER)) {
740 #ifndef CONFIG_SMP
741 		printk(KERN_WARNING "neigh: timer & !nud_in_timer\n");
742 #endif
743 		goto out;
744 	}
745 
746 	if (state & NUD_REACHABLE) {
747 		if (time_before_eq(now,
748 				   neigh->confirmed + neigh->parms->reachable_time)) {
749 			NEIGH_PRINTK2("neigh %p is still alive.\n", neigh);
750 			next = neigh->confirmed + neigh->parms->reachable_time;
751 		} else if (time_before_eq(now,
752 					  neigh->used + neigh->parms->delay_probe_time)) {
753 			NEIGH_PRINTK2("neigh %p is delayed.\n", neigh);
754 			neigh->nud_state = NUD_DELAY;
755 			neigh->updated = jiffies;
756 			neigh_suspect(neigh);
757 			next = now + neigh->parms->delay_probe_time;
758 		} else {
759 			NEIGH_PRINTK2("neigh %p is suspected.\n", neigh);
760 			neigh->nud_state = NUD_STALE;
761 			neigh->updated = jiffies;
762 			neigh_suspect(neigh);
763 			notify = 1;
764 		}
765 	} else if (state & NUD_DELAY) {
766 		if (time_before_eq(now,
767 				   neigh->confirmed + neigh->parms->delay_probe_time)) {
768 			NEIGH_PRINTK2("neigh %p is now reachable.\n", neigh);
769 			neigh->nud_state = NUD_REACHABLE;
770 			neigh->updated = jiffies;
771 			neigh_connect(neigh);
772 			notify = 1;
773 			next = neigh->confirmed + neigh->parms->reachable_time;
774 		} else {
775 			NEIGH_PRINTK2("neigh %p is probed.\n", neigh);
776 			neigh->nud_state = NUD_PROBE;
777 			neigh->updated = jiffies;
778 			atomic_set(&neigh->probes, 0);
779 			next = now + neigh->parms->retrans_time;
780 		}
781 	} else {
782 		/* NUD_PROBE|NUD_INCOMPLETE */
783 		next = now + neigh->parms->retrans_time;
784 	}
785 
786 	if ((neigh->nud_state & (NUD_INCOMPLETE | NUD_PROBE)) &&
787 	    atomic_read(&neigh->probes) >= neigh_max_probes(neigh)) {
788 		struct sk_buff *skb;
789 
790 		neigh->nud_state = NUD_FAILED;
791 		neigh->updated = jiffies;
792 		notify = 1;
793 		NEIGH_CACHE_STAT_INC(neigh->tbl, res_failed);
794 		NEIGH_PRINTK2("neigh %p is failed.\n", neigh);
795 
796 		/* It is very thin place. report_unreachable is very complicated
797 		   routine. Particularly, it can hit the same neighbour entry!
798 
799 		   So that, we try to be accurate and avoid dead loop. --ANK
800 		 */
801 		while (neigh->nud_state == NUD_FAILED &&
802 		       (skb = __skb_dequeue(&neigh->arp_queue)) != NULL) {
803 			write_unlock(&neigh->lock);
804 			neigh->ops->error_report(neigh, skb);
805 			write_lock(&neigh->lock);
806 		}
807 		skb_queue_purge(&neigh->arp_queue);
808 	}
809 
810 	if (neigh->nud_state & NUD_IN_TIMER) {
811 		if (time_before(next, jiffies + HZ/2))
812 			next = jiffies + HZ/2;
813 		if (!mod_timer(&neigh->timer, next))
814 			neigh_hold(neigh);
815 	}
816 	if (neigh->nud_state & (NUD_INCOMPLETE | NUD_PROBE)) {
817 		struct sk_buff *skb = skb_peek(&neigh->arp_queue);
818 		/* keep skb alive even if arp_queue overflows */
819 		if (skb)
820 			skb_get(skb);
821 		write_unlock(&neigh->lock);
822 		neigh->ops->solicit(neigh, skb);
823 		atomic_inc(&neigh->probes);
824 		if (skb)
825 			kfree_skb(skb);
826 	} else {
827 out:
828 		write_unlock(&neigh->lock);
829 	}
830 	if (notify)
831 		call_netevent_notifiers(NETEVENT_NEIGH_UPDATE, neigh);
832 
833 #ifdef CONFIG_ARPD
834 	if (notify && neigh->parms->app_probes)
835 		neigh_app_notify(neigh);
836 #endif
837 	neigh_release(neigh);
838 }
839 
840 int __neigh_event_send(struct neighbour *neigh, struct sk_buff *skb)
841 {
842 	int rc;
843 	unsigned long now;
844 
845 	write_lock_bh(&neigh->lock);
846 
847 	rc = 0;
848 	if (neigh->nud_state & (NUD_CONNECTED | NUD_DELAY | NUD_PROBE))
849 		goto out_unlock_bh;
850 
851 	now = jiffies;
852 
853 	if (!(neigh->nud_state & (NUD_STALE | NUD_INCOMPLETE))) {
854 		if (neigh->parms->mcast_probes + neigh->parms->app_probes) {
855 			atomic_set(&neigh->probes, neigh->parms->ucast_probes);
856 			neigh->nud_state     = NUD_INCOMPLETE;
857 			neigh->updated = jiffies;
858 			neigh_hold(neigh);
859 			neigh_add_timer(neigh, now + 1);
860 		} else {
861 			neigh->nud_state = NUD_FAILED;
862 			neigh->updated = jiffies;
863 			write_unlock_bh(&neigh->lock);
864 
865 			if (skb)
866 				kfree_skb(skb);
867 			return 1;
868 		}
869 	} else if (neigh->nud_state & NUD_STALE) {
870 		NEIGH_PRINTK2("neigh %p is delayed.\n", neigh);
871 		neigh_hold(neigh);
872 		neigh->nud_state = NUD_DELAY;
873 		neigh->updated = jiffies;
874 		neigh_add_timer(neigh,
875 				jiffies + neigh->parms->delay_probe_time);
876 	}
877 
878 	if (neigh->nud_state == NUD_INCOMPLETE) {
879 		if (skb) {
880 			if (skb_queue_len(&neigh->arp_queue) >=
881 			    neigh->parms->queue_len) {
882 				struct sk_buff *buff;
883 				buff = neigh->arp_queue.next;
884 				__skb_unlink(buff, &neigh->arp_queue);
885 				kfree_skb(buff);
886 			}
887 			__skb_queue_tail(&neigh->arp_queue, skb);
888 		}
889 		rc = 1;
890 	}
891 out_unlock_bh:
892 	write_unlock_bh(&neigh->lock);
893 	return rc;
894 }
895 
896 static void neigh_update_hhs(struct neighbour *neigh)
897 {
898 	struct hh_cache *hh;
899 	void (*update)(struct hh_cache*, struct net_device*, unsigned char *) =
900 		neigh->dev->header_cache_update;
901 
902 	if (update) {
903 		for (hh = neigh->hh; hh; hh = hh->hh_next) {
904 			write_seqlock_bh(&hh->hh_lock);
905 			update(hh, neigh->dev, neigh->ha);
906 			write_sequnlock_bh(&hh->hh_lock);
907 		}
908 	}
909 }
910 
911 
912 
913 /* Generic update routine.
914    -- lladdr is new lladdr or NULL, if it is not supplied.
915    -- new    is new state.
916    -- flags
917 	NEIGH_UPDATE_F_OVERRIDE allows to override existing lladdr,
918 				if it is different.
919 	NEIGH_UPDATE_F_WEAK_OVERRIDE will suspect existing "connected"
920 				lladdr instead of overriding it
921 				if it is different.
922 				It also allows to retain current state
923 				if lladdr is unchanged.
924 	NEIGH_UPDATE_F_ADMIN	means that the change is administrative.
925 
926 	NEIGH_UPDATE_F_OVERRIDE_ISROUTER allows to override existing
927 				NTF_ROUTER flag.
928 	NEIGH_UPDATE_F_ISROUTER	indicates if the neighbour is known as
929 				a router.
930 
931    Caller MUST hold reference count on the entry.
932  */
933 
934 int neigh_update(struct neighbour *neigh, const u8 *lladdr, u8 new,
935 		 u32 flags)
936 {
937 	u8 old;
938 	int err;
939 	int notify = 0;
940 	struct net_device *dev;
941 	int update_isrouter = 0;
942 
943 	write_lock_bh(&neigh->lock);
944 
945 	dev    = neigh->dev;
946 	old    = neigh->nud_state;
947 	err    = -EPERM;
948 
949 	if (!(flags & NEIGH_UPDATE_F_ADMIN) &&
950 	    (old & (NUD_NOARP | NUD_PERMANENT)))
951 		goto out;
952 
953 	if (!(new & NUD_VALID)) {
954 		neigh_del_timer(neigh);
955 		if (old & NUD_CONNECTED)
956 			neigh_suspect(neigh);
957 		neigh->nud_state = new;
958 		err = 0;
959 		notify = old & NUD_VALID;
960 		goto out;
961 	}
962 
963 	/* Compare new lladdr with cached one */
964 	if (!dev->addr_len) {
965 		/* First case: device needs no address. */
966 		lladdr = neigh->ha;
967 	} else if (lladdr) {
968 		/* The second case: if something is already cached
969 		   and a new address is proposed:
970 		   - compare new & old
971 		   - if they are different, check override flag
972 		 */
973 		if ((old & NUD_VALID) &&
974 		    !memcmp(lladdr, neigh->ha, dev->addr_len))
975 			lladdr = neigh->ha;
976 	} else {
977 		/* No address is supplied; if we know something,
978 		   use it, otherwise discard the request.
979 		 */
980 		err = -EINVAL;
981 		if (!(old & NUD_VALID))
982 			goto out;
983 		lladdr = neigh->ha;
984 	}
985 
986 	if (new & NUD_CONNECTED)
987 		neigh->confirmed = jiffies;
988 	neigh->updated = jiffies;
989 
990 	/* If entry was valid and address is not changed,
991 	   do not change entry state, if new one is STALE.
992 	 */
993 	err = 0;
994 	update_isrouter = flags & NEIGH_UPDATE_F_OVERRIDE_ISROUTER;
995 	if (old & NUD_VALID) {
996 		if (lladdr != neigh->ha && !(flags & NEIGH_UPDATE_F_OVERRIDE)) {
997 			update_isrouter = 0;
998 			if ((flags & NEIGH_UPDATE_F_WEAK_OVERRIDE) &&
999 			    (old & NUD_CONNECTED)) {
1000 				lladdr = neigh->ha;
1001 				new = NUD_STALE;
1002 			} else
1003 				goto out;
1004 		} else {
1005 			if (lladdr == neigh->ha && new == NUD_STALE &&
1006 			    ((flags & NEIGH_UPDATE_F_WEAK_OVERRIDE) ||
1007 			     (old & NUD_CONNECTED))
1008 			    )
1009 				new = old;
1010 		}
1011 	}
1012 
1013 	if (new != old) {
1014 		neigh_del_timer(neigh);
1015 		if (new & NUD_IN_TIMER) {
1016 			neigh_hold(neigh);
1017 			neigh_add_timer(neigh, (jiffies +
1018 						((new & NUD_REACHABLE) ?
1019 						 neigh->parms->reachable_time :
1020 						 0)));
1021 		}
1022 		neigh->nud_state = new;
1023 	}
1024 
1025 	if (lladdr != neigh->ha) {
1026 		memcpy(&neigh->ha, lladdr, dev->addr_len);
1027 		neigh_update_hhs(neigh);
1028 		if (!(new & NUD_CONNECTED))
1029 			neigh->confirmed = jiffies -
1030 				      (neigh->parms->base_reachable_time << 1);
1031 		notify = 1;
1032 	}
1033 	if (new == old)
1034 		goto out;
1035 	if (new & NUD_CONNECTED)
1036 		neigh_connect(neigh);
1037 	else
1038 		neigh_suspect(neigh);
1039 	if (!(old & NUD_VALID)) {
1040 		struct sk_buff *skb;
1041 
1042 		/* Again: avoid dead loop if something went wrong */
1043 
1044 		while (neigh->nud_state & NUD_VALID &&
1045 		       (skb = __skb_dequeue(&neigh->arp_queue)) != NULL) {
1046 			struct neighbour *n1 = neigh;
1047 			write_unlock_bh(&neigh->lock);
1048 			/* On shaper/eql skb->dst->neighbour != neigh :( */
1049 			if (skb->dst && skb->dst->neighbour)
1050 				n1 = skb->dst->neighbour;
1051 			n1->output(skb);
1052 			write_lock_bh(&neigh->lock);
1053 		}
1054 		skb_queue_purge(&neigh->arp_queue);
1055 	}
1056 out:
1057 	if (update_isrouter) {
1058 		neigh->flags = (flags & NEIGH_UPDATE_F_ISROUTER) ?
1059 			(neigh->flags | NTF_ROUTER) :
1060 			(neigh->flags & ~NTF_ROUTER);
1061 	}
1062 	write_unlock_bh(&neigh->lock);
1063 
1064 	if (notify)
1065 		call_netevent_notifiers(NETEVENT_NEIGH_UPDATE, neigh);
1066 #ifdef CONFIG_ARPD
1067 	if (notify && neigh->parms->app_probes)
1068 		neigh_app_notify(neigh);
1069 #endif
1070 	return err;
1071 }
1072 
1073 struct neighbour *neigh_event_ns(struct neigh_table *tbl,
1074 				 u8 *lladdr, void *saddr,
1075 				 struct net_device *dev)
1076 {
1077 	struct neighbour *neigh = __neigh_lookup(tbl, saddr, dev,
1078 						 lladdr || !dev->addr_len);
1079 	if (neigh)
1080 		neigh_update(neigh, lladdr, NUD_STALE,
1081 			     NEIGH_UPDATE_F_OVERRIDE);
1082 	return neigh;
1083 }
1084 
1085 static void neigh_hh_init(struct neighbour *n, struct dst_entry *dst,
1086 			  __be16 protocol)
1087 {
1088 	struct hh_cache	*hh;
1089 	struct net_device *dev = dst->dev;
1090 
1091 	for (hh = n->hh; hh; hh = hh->hh_next)
1092 		if (hh->hh_type == protocol)
1093 			break;
1094 
1095 	if (!hh && (hh = kzalloc(sizeof(*hh), GFP_ATOMIC)) != NULL) {
1096 		seqlock_init(&hh->hh_lock);
1097 		hh->hh_type = protocol;
1098 		atomic_set(&hh->hh_refcnt, 0);
1099 		hh->hh_next = NULL;
1100 		if (dev->hard_header_cache(n, hh)) {
1101 			kfree(hh);
1102 			hh = NULL;
1103 		} else {
1104 			atomic_inc(&hh->hh_refcnt);
1105 			hh->hh_next = n->hh;
1106 			n->hh	    = hh;
1107 			if (n->nud_state & NUD_CONNECTED)
1108 				hh->hh_output = n->ops->hh_output;
1109 			else
1110 				hh->hh_output = n->ops->output;
1111 		}
1112 	}
1113 	if (hh)	{
1114 		atomic_inc(&hh->hh_refcnt);
1115 		dst->hh = hh;
1116 	}
1117 }
1118 
1119 /* This function can be used in contexts, where only old dev_queue_xmit
1120    worked, f.e. if you want to override normal output path (eql, shaper),
1121    but resolution is not made yet.
1122  */
1123 
1124 int neigh_compat_output(struct sk_buff *skb)
1125 {
1126 	struct net_device *dev = skb->dev;
1127 
1128 	__skb_pull(skb, skb->nh.raw - skb->data);
1129 
1130 	if (dev->hard_header &&
1131 	    dev->hard_header(skb, dev, ntohs(skb->protocol), NULL, NULL,
1132 			     skb->len) < 0 &&
1133 	    dev->rebuild_header(skb))
1134 		return 0;
1135 
1136 	return dev_queue_xmit(skb);
1137 }
1138 
1139 /* Slow and careful. */
1140 
1141 int neigh_resolve_output(struct sk_buff *skb)
1142 {
1143 	struct dst_entry *dst = skb->dst;
1144 	struct neighbour *neigh;
1145 	int rc = 0;
1146 
1147 	if (!dst || !(neigh = dst->neighbour))
1148 		goto discard;
1149 
1150 	__skb_pull(skb, skb->nh.raw - skb->data);
1151 
1152 	if (!neigh_event_send(neigh, skb)) {
1153 		int err;
1154 		struct net_device *dev = neigh->dev;
1155 		if (dev->hard_header_cache && !dst->hh) {
1156 			write_lock_bh(&neigh->lock);
1157 			if (!dst->hh)
1158 				neigh_hh_init(neigh, dst, dst->ops->protocol);
1159 			err = dev->hard_header(skb, dev, ntohs(skb->protocol),
1160 					       neigh->ha, NULL, skb->len);
1161 			write_unlock_bh(&neigh->lock);
1162 		} else {
1163 			read_lock_bh(&neigh->lock);
1164 			err = dev->hard_header(skb, dev, ntohs(skb->protocol),
1165 					       neigh->ha, NULL, skb->len);
1166 			read_unlock_bh(&neigh->lock);
1167 		}
1168 		if (err >= 0)
1169 			rc = neigh->ops->queue_xmit(skb);
1170 		else
1171 			goto out_kfree_skb;
1172 	}
1173 out:
1174 	return rc;
1175 discard:
1176 	NEIGH_PRINTK1("neigh_resolve_output: dst=%p neigh=%p\n",
1177 		      dst, dst ? dst->neighbour : NULL);
1178 out_kfree_skb:
1179 	rc = -EINVAL;
1180 	kfree_skb(skb);
1181 	goto out;
1182 }
1183 
1184 /* As fast as possible without hh cache */
1185 
1186 int neigh_connected_output(struct sk_buff *skb)
1187 {
1188 	int err;
1189 	struct dst_entry *dst = skb->dst;
1190 	struct neighbour *neigh = dst->neighbour;
1191 	struct net_device *dev = neigh->dev;
1192 
1193 	__skb_pull(skb, skb->nh.raw - skb->data);
1194 
1195 	read_lock_bh(&neigh->lock);
1196 	err = dev->hard_header(skb, dev, ntohs(skb->protocol),
1197 			       neigh->ha, NULL, skb->len);
1198 	read_unlock_bh(&neigh->lock);
1199 	if (err >= 0)
1200 		err = neigh->ops->queue_xmit(skb);
1201 	else {
1202 		err = -EINVAL;
1203 		kfree_skb(skb);
1204 	}
1205 	return err;
1206 }
1207 
1208 static void neigh_proxy_process(unsigned long arg)
1209 {
1210 	struct neigh_table *tbl = (struct neigh_table *)arg;
1211 	long sched_next = 0;
1212 	unsigned long now = jiffies;
1213 	struct sk_buff *skb;
1214 
1215 	spin_lock(&tbl->proxy_queue.lock);
1216 
1217 	skb = tbl->proxy_queue.next;
1218 
1219 	while (skb != (struct sk_buff *)&tbl->proxy_queue) {
1220 		struct sk_buff *back = skb;
1221 		long tdif = NEIGH_CB(back)->sched_next - now;
1222 
1223 		skb = skb->next;
1224 		if (tdif <= 0) {
1225 			struct net_device *dev = back->dev;
1226 			__skb_unlink(back, &tbl->proxy_queue);
1227 			if (tbl->proxy_redo && netif_running(dev))
1228 				tbl->proxy_redo(back);
1229 			else
1230 				kfree_skb(back);
1231 
1232 			dev_put(dev);
1233 		} else if (!sched_next || tdif < sched_next)
1234 			sched_next = tdif;
1235 	}
1236 	del_timer(&tbl->proxy_timer);
1237 	if (sched_next)
1238 		mod_timer(&tbl->proxy_timer, jiffies + sched_next);
1239 	spin_unlock(&tbl->proxy_queue.lock);
1240 }
1241 
1242 void pneigh_enqueue(struct neigh_table *tbl, struct neigh_parms *p,
1243 		    struct sk_buff *skb)
1244 {
1245 	unsigned long now = jiffies;
1246 	unsigned long sched_next = now + (net_random() % p->proxy_delay);
1247 
1248 	if (tbl->proxy_queue.qlen > p->proxy_qlen) {
1249 		kfree_skb(skb);
1250 		return;
1251 	}
1252 
1253 	NEIGH_CB(skb)->sched_next = sched_next;
1254 	NEIGH_CB(skb)->flags |= LOCALLY_ENQUEUED;
1255 
1256 	spin_lock(&tbl->proxy_queue.lock);
1257 	if (del_timer(&tbl->proxy_timer)) {
1258 		if (time_before(tbl->proxy_timer.expires, sched_next))
1259 			sched_next = tbl->proxy_timer.expires;
1260 	}
1261 	dst_release(skb->dst);
1262 	skb->dst = NULL;
1263 	dev_hold(skb->dev);
1264 	__skb_queue_tail(&tbl->proxy_queue, skb);
1265 	mod_timer(&tbl->proxy_timer, sched_next);
1266 	spin_unlock(&tbl->proxy_queue.lock);
1267 }
1268 
1269 
1270 struct neigh_parms *neigh_parms_alloc(struct net_device *dev,
1271 				      struct neigh_table *tbl)
1272 {
1273 	struct neigh_parms *p = kmemdup(&tbl->parms, sizeof(*p), GFP_KERNEL);
1274 
1275 	if (p) {
1276 		p->tbl		  = tbl;
1277 		atomic_set(&p->refcnt, 1);
1278 		INIT_RCU_HEAD(&p->rcu_head);
1279 		p->reachable_time =
1280 				neigh_rand_reach_time(p->base_reachable_time);
1281 		if (dev) {
1282 			if (dev->neigh_setup && dev->neigh_setup(dev, p)) {
1283 				kfree(p);
1284 				return NULL;
1285 			}
1286 
1287 			dev_hold(dev);
1288 			p->dev = dev;
1289 		}
1290 		p->sysctl_table = NULL;
1291 		write_lock_bh(&tbl->lock);
1292 		p->next		= tbl->parms.next;
1293 		tbl->parms.next = p;
1294 		write_unlock_bh(&tbl->lock);
1295 	}
1296 	return p;
1297 }
1298 
1299 static void neigh_rcu_free_parms(struct rcu_head *head)
1300 {
1301 	struct neigh_parms *parms =
1302 		container_of(head, struct neigh_parms, rcu_head);
1303 
1304 	neigh_parms_put(parms);
1305 }
1306 
1307 void neigh_parms_release(struct neigh_table *tbl, struct neigh_parms *parms)
1308 {
1309 	struct neigh_parms **p;
1310 
1311 	if (!parms || parms == &tbl->parms)
1312 		return;
1313 	write_lock_bh(&tbl->lock);
1314 	for (p = &tbl->parms.next; *p; p = &(*p)->next) {
1315 		if (*p == parms) {
1316 			*p = parms->next;
1317 			parms->dead = 1;
1318 			write_unlock_bh(&tbl->lock);
1319 			if (parms->dev)
1320 				dev_put(parms->dev);
1321 			call_rcu(&parms->rcu_head, neigh_rcu_free_parms);
1322 			return;
1323 		}
1324 	}
1325 	write_unlock_bh(&tbl->lock);
1326 	NEIGH_PRINTK1("neigh_parms_release: not found\n");
1327 }
1328 
1329 void neigh_parms_destroy(struct neigh_parms *parms)
1330 {
1331 	kfree(parms);
1332 }
1333 
1334 void neigh_table_init_no_netlink(struct neigh_table *tbl)
1335 {
1336 	unsigned long now = jiffies;
1337 	unsigned long phsize;
1338 
1339 	atomic_set(&tbl->parms.refcnt, 1);
1340 	INIT_RCU_HEAD(&tbl->parms.rcu_head);
1341 	tbl->parms.reachable_time =
1342 			  neigh_rand_reach_time(tbl->parms.base_reachable_time);
1343 
1344 	if (!tbl->kmem_cachep)
1345 		tbl->kmem_cachep =
1346 			kmem_cache_create(tbl->id, tbl->entry_size, 0,
1347 					  SLAB_HWCACHE_ALIGN|SLAB_PANIC,
1348 					  NULL, NULL);
1349 	tbl->stats = alloc_percpu(struct neigh_statistics);
1350 	if (!tbl->stats)
1351 		panic("cannot create neighbour cache statistics");
1352 
1353 #ifdef CONFIG_PROC_FS
1354 	tbl->pde = create_proc_entry(tbl->id, 0, proc_net_stat);
1355 	if (!tbl->pde)
1356 		panic("cannot create neighbour proc dir entry");
1357 	tbl->pde->proc_fops = &neigh_stat_seq_fops;
1358 	tbl->pde->data = tbl;
1359 #endif
1360 
1361 	tbl->hash_mask = 1;
1362 	tbl->hash_buckets = neigh_hash_alloc(tbl->hash_mask + 1);
1363 
1364 	phsize = (PNEIGH_HASHMASK + 1) * sizeof(struct pneigh_entry *);
1365 	tbl->phash_buckets = kzalloc(phsize, GFP_KERNEL);
1366 
1367 	if (!tbl->hash_buckets || !tbl->phash_buckets)
1368 		panic("cannot allocate neighbour cache hashes");
1369 
1370 	get_random_bytes(&tbl->hash_rnd, sizeof(tbl->hash_rnd));
1371 
1372 	rwlock_init(&tbl->lock);
1373 	init_timer(&tbl->gc_timer);
1374 	tbl->gc_timer.data     = (unsigned long)tbl;
1375 	tbl->gc_timer.function = neigh_periodic_timer;
1376 	tbl->gc_timer.expires  = now + 1;
1377 	add_timer(&tbl->gc_timer);
1378 
1379 	init_timer(&tbl->proxy_timer);
1380 	tbl->proxy_timer.data	  = (unsigned long)tbl;
1381 	tbl->proxy_timer.function = neigh_proxy_process;
1382 	skb_queue_head_init(&tbl->proxy_queue);
1383 
1384 	tbl->last_flush = now;
1385 	tbl->last_rand	= now + tbl->parms.reachable_time * 20;
1386 }
1387 
1388 void neigh_table_init(struct neigh_table *tbl)
1389 {
1390 	struct neigh_table *tmp;
1391 
1392 	neigh_table_init_no_netlink(tbl);
1393 	write_lock(&neigh_tbl_lock);
1394 	for (tmp = neigh_tables; tmp; tmp = tmp->next) {
1395 		if (tmp->family == tbl->family)
1396 			break;
1397 	}
1398 	tbl->next	= neigh_tables;
1399 	neigh_tables	= tbl;
1400 	write_unlock(&neigh_tbl_lock);
1401 
1402 	if (unlikely(tmp)) {
1403 		printk(KERN_ERR "NEIGH: Registering multiple tables for "
1404 		       "family %d\n", tbl->family);
1405 		dump_stack();
1406 	}
1407 }
1408 
1409 int neigh_table_clear(struct neigh_table *tbl)
1410 {
1411 	struct neigh_table **tp;
1412 
1413 	/* It is not clean... Fix it to unload IPv6 module safely */
1414 	del_timer_sync(&tbl->gc_timer);
1415 	del_timer_sync(&tbl->proxy_timer);
1416 	pneigh_queue_purge(&tbl->proxy_queue);
1417 	neigh_ifdown(tbl, NULL);
1418 	if (atomic_read(&tbl->entries))
1419 		printk(KERN_CRIT "neighbour leakage\n");
1420 	write_lock(&neigh_tbl_lock);
1421 	for (tp = &neigh_tables; *tp; tp = &(*tp)->next) {
1422 		if (*tp == tbl) {
1423 			*tp = tbl->next;
1424 			break;
1425 		}
1426 	}
1427 	write_unlock(&neigh_tbl_lock);
1428 
1429 	neigh_hash_free(tbl->hash_buckets, tbl->hash_mask + 1);
1430 	tbl->hash_buckets = NULL;
1431 
1432 	kfree(tbl->phash_buckets);
1433 	tbl->phash_buckets = NULL;
1434 
1435 	free_percpu(tbl->stats);
1436 	tbl->stats = NULL;
1437 
1438 	return 0;
1439 }
1440 
1441 int neigh_delete(struct sk_buff *skb, struct nlmsghdr *nlh, void *arg)
1442 {
1443 	struct ndmsg *ndm;
1444 	struct nlattr *dst_attr;
1445 	struct neigh_table *tbl;
1446 	struct net_device *dev = NULL;
1447 	int err = -EINVAL;
1448 
1449 	if (nlmsg_len(nlh) < sizeof(*ndm))
1450 		goto out;
1451 
1452 	dst_attr = nlmsg_find_attr(nlh, sizeof(*ndm), NDA_DST);
1453 	if (dst_attr == NULL)
1454 		goto out;
1455 
1456 	ndm = nlmsg_data(nlh);
1457 	if (ndm->ndm_ifindex) {
1458 		dev = dev_get_by_index(ndm->ndm_ifindex);
1459 		if (dev == NULL) {
1460 			err = -ENODEV;
1461 			goto out;
1462 		}
1463 	}
1464 
1465 	read_lock(&neigh_tbl_lock);
1466 	for (tbl = neigh_tables; tbl; tbl = tbl->next) {
1467 		struct neighbour *neigh;
1468 
1469 		if (tbl->family != ndm->ndm_family)
1470 			continue;
1471 		read_unlock(&neigh_tbl_lock);
1472 
1473 		if (nla_len(dst_attr) < tbl->key_len)
1474 			goto out_dev_put;
1475 
1476 		if (ndm->ndm_flags & NTF_PROXY) {
1477 			err = pneigh_delete(tbl, nla_data(dst_attr), dev);
1478 			goto out_dev_put;
1479 		}
1480 
1481 		if (dev == NULL)
1482 			goto out_dev_put;
1483 
1484 		neigh = neigh_lookup(tbl, nla_data(dst_attr), dev);
1485 		if (neigh == NULL) {
1486 			err = -ENOENT;
1487 			goto out_dev_put;
1488 		}
1489 
1490 		err = neigh_update(neigh, NULL, NUD_FAILED,
1491 				   NEIGH_UPDATE_F_OVERRIDE |
1492 				   NEIGH_UPDATE_F_ADMIN);
1493 		neigh_release(neigh);
1494 		goto out_dev_put;
1495 	}
1496 	read_unlock(&neigh_tbl_lock);
1497 	err = -EAFNOSUPPORT;
1498 
1499 out_dev_put:
1500 	if (dev)
1501 		dev_put(dev);
1502 out:
1503 	return err;
1504 }
1505 
1506 int neigh_add(struct sk_buff *skb, struct nlmsghdr *nlh, void *arg)
1507 {
1508 	struct ndmsg *ndm;
1509 	struct nlattr *tb[NDA_MAX+1];
1510 	struct neigh_table *tbl;
1511 	struct net_device *dev = NULL;
1512 	int err;
1513 
1514 	err = nlmsg_parse(nlh, sizeof(*ndm), tb, NDA_MAX, NULL);
1515 	if (err < 0)
1516 		goto out;
1517 
1518 	err = -EINVAL;
1519 	if (tb[NDA_DST] == NULL)
1520 		goto out;
1521 
1522 	ndm = nlmsg_data(nlh);
1523 	if (ndm->ndm_ifindex) {
1524 		dev = dev_get_by_index(ndm->ndm_ifindex);
1525 		if (dev == NULL) {
1526 			err = -ENODEV;
1527 			goto out;
1528 		}
1529 
1530 		if (tb[NDA_LLADDR] && nla_len(tb[NDA_LLADDR]) < dev->addr_len)
1531 			goto out_dev_put;
1532 	}
1533 
1534 	read_lock(&neigh_tbl_lock);
1535 	for (tbl = neigh_tables; tbl; tbl = tbl->next) {
1536 		int flags = NEIGH_UPDATE_F_ADMIN | NEIGH_UPDATE_F_OVERRIDE;
1537 		struct neighbour *neigh;
1538 		void *dst, *lladdr;
1539 
1540 		if (tbl->family != ndm->ndm_family)
1541 			continue;
1542 		read_unlock(&neigh_tbl_lock);
1543 
1544 		if (nla_len(tb[NDA_DST]) < tbl->key_len)
1545 			goto out_dev_put;
1546 		dst = nla_data(tb[NDA_DST]);
1547 		lladdr = tb[NDA_LLADDR] ? nla_data(tb[NDA_LLADDR]) : NULL;
1548 
1549 		if (ndm->ndm_flags & NTF_PROXY) {
1550 			struct pneigh_entry *pn;
1551 
1552 			err = -ENOBUFS;
1553 			pn = pneigh_lookup(tbl, dst, dev, 1);
1554 			if (pn) {
1555 				pn->flags = ndm->ndm_flags;
1556 				err = 0;
1557 			}
1558 			goto out_dev_put;
1559 		}
1560 
1561 		if (dev == NULL)
1562 			goto out_dev_put;
1563 
1564 		neigh = neigh_lookup(tbl, dst, dev);
1565 		if (neigh == NULL) {
1566 			if (!(nlh->nlmsg_flags & NLM_F_CREATE)) {
1567 				err = -ENOENT;
1568 				goto out_dev_put;
1569 			}
1570 
1571 			neigh = __neigh_lookup_errno(tbl, dst, dev);
1572 			if (IS_ERR(neigh)) {
1573 				err = PTR_ERR(neigh);
1574 				goto out_dev_put;
1575 			}
1576 		} else {
1577 			if (nlh->nlmsg_flags & NLM_F_EXCL) {
1578 				err = -EEXIST;
1579 				neigh_release(neigh);
1580 				goto out_dev_put;
1581 			}
1582 
1583 			if (!(nlh->nlmsg_flags & NLM_F_REPLACE))
1584 				flags &= ~NEIGH_UPDATE_F_OVERRIDE;
1585 		}
1586 
1587 		err = neigh_update(neigh, lladdr, ndm->ndm_state, flags);
1588 		neigh_release(neigh);
1589 		goto out_dev_put;
1590 	}
1591 
1592 	read_unlock(&neigh_tbl_lock);
1593 	err = -EAFNOSUPPORT;
1594 
1595 out_dev_put:
1596 	if (dev)
1597 		dev_put(dev);
1598 out:
1599 	return err;
1600 }
1601 
1602 static int neightbl_fill_parms(struct sk_buff *skb, struct neigh_parms *parms)
1603 {
1604 	struct nlattr *nest;
1605 
1606 	nest = nla_nest_start(skb, NDTA_PARMS);
1607 	if (nest == NULL)
1608 		return -ENOBUFS;
1609 
1610 	if (parms->dev)
1611 		NLA_PUT_U32(skb, NDTPA_IFINDEX, parms->dev->ifindex);
1612 
1613 	NLA_PUT_U32(skb, NDTPA_REFCNT, atomic_read(&parms->refcnt));
1614 	NLA_PUT_U32(skb, NDTPA_QUEUE_LEN, parms->queue_len);
1615 	NLA_PUT_U32(skb, NDTPA_PROXY_QLEN, parms->proxy_qlen);
1616 	NLA_PUT_U32(skb, NDTPA_APP_PROBES, parms->app_probes);
1617 	NLA_PUT_U32(skb, NDTPA_UCAST_PROBES, parms->ucast_probes);
1618 	NLA_PUT_U32(skb, NDTPA_MCAST_PROBES, parms->mcast_probes);
1619 	NLA_PUT_MSECS(skb, NDTPA_REACHABLE_TIME, parms->reachable_time);
1620 	NLA_PUT_MSECS(skb, NDTPA_BASE_REACHABLE_TIME,
1621 		      parms->base_reachable_time);
1622 	NLA_PUT_MSECS(skb, NDTPA_GC_STALETIME, parms->gc_staletime);
1623 	NLA_PUT_MSECS(skb, NDTPA_DELAY_PROBE_TIME, parms->delay_probe_time);
1624 	NLA_PUT_MSECS(skb, NDTPA_RETRANS_TIME, parms->retrans_time);
1625 	NLA_PUT_MSECS(skb, NDTPA_ANYCAST_DELAY, parms->anycast_delay);
1626 	NLA_PUT_MSECS(skb, NDTPA_PROXY_DELAY, parms->proxy_delay);
1627 	NLA_PUT_MSECS(skb, NDTPA_LOCKTIME, parms->locktime);
1628 
1629 	return nla_nest_end(skb, nest);
1630 
1631 nla_put_failure:
1632 	return nla_nest_cancel(skb, nest);
1633 }
1634 
1635 static int neightbl_fill_info(struct sk_buff *skb, struct neigh_table *tbl,
1636 			      u32 pid, u32 seq, int type, int flags)
1637 {
1638 	struct nlmsghdr *nlh;
1639 	struct ndtmsg *ndtmsg;
1640 
1641 	nlh = nlmsg_put(skb, pid, seq, type, sizeof(*ndtmsg), flags);
1642 	if (nlh == NULL)
1643 		return -EMSGSIZE;
1644 
1645 	ndtmsg = nlmsg_data(nlh);
1646 
1647 	read_lock_bh(&tbl->lock);
1648 	ndtmsg->ndtm_family = tbl->family;
1649 	ndtmsg->ndtm_pad1   = 0;
1650 	ndtmsg->ndtm_pad2   = 0;
1651 
1652 	NLA_PUT_STRING(skb, NDTA_NAME, tbl->id);
1653 	NLA_PUT_MSECS(skb, NDTA_GC_INTERVAL, tbl->gc_interval);
1654 	NLA_PUT_U32(skb, NDTA_THRESH1, tbl->gc_thresh1);
1655 	NLA_PUT_U32(skb, NDTA_THRESH2, tbl->gc_thresh2);
1656 	NLA_PUT_U32(skb, NDTA_THRESH3, tbl->gc_thresh3);
1657 
1658 	{
1659 		unsigned long now = jiffies;
1660 		unsigned int flush_delta = now - tbl->last_flush;
1661 		unsigned int rand_delta = now - tbl->last_rand;
1662 
1663 		struct ndt_config ndc = {
1664 			.ndtc_key_len		= tbl->key_len,
1665 			.ndtc_entry_size	= tbl->entry_size,
1666 			.ndtc_entries		= atomic_read(&tbl->entries),
1667 			.ndtc_last_flush	= jiffies_to_msecs(flush_delta),
1668 			.ndtc_last_rand		= jiffies_to_msecs(rand_delta),
1669 			.ndtc_hash_rnd		= tbl->hash_rnd,
1670 			.ndtc_hash_mask		= tbl->hash_mask,
1671 			.ndtc_hash_chain_gc	= tbl->hash_chain_gc,
1672 			.ndtc_proxy_qlen	= tbl->proxy_queue.qlen,
1673 		};
1674 
1675 		NLA_PUT(skb, NDTA_CONFIG, sizeof(ndc), &ndc);
1676 	}
1677 
1678 	{
1679 		int cpu;
1680 		struct ndt_stats ndst;
1681 
1682 		memset(&ndst, 0, sizeof(ndst));
1683 
1684 		for_each_possible_cpu(cpu) {
1685 			struct neigh_statistics	*st;
1686 
1687 			st = per_cpu_ptr(tbl->stats, cpu);
1688 			ndst.ndts_allocs		+= st->allocs;
1689 			ndst.ndts_destroys		+= st->destroys;
1690 			ndst.ndts_hash_grows		+= st->hash_grows;
1691 			ndst.ndts_res_failed		+= st->res_failed;
1692 			ndst.ndts_lookups		+= st->lookups;
1693 			ndst.ndts_hits			+= st->hits;
1694 			ndst.ndts_rcv_probes_mcast	+= st->rcv_probes_mcast;
1695 			ndst.ndts_rcv_probes_ucast	+= st->rcv_probes_ucast;
1696 			ndst.ndts_periodic_gc_runs	+= st->periodic_gc_runs;
1697 			ndst.ndts_forced_gc_runs	+= st->forced_gc_runs;
1698 		}
1699 
1700 		NLA_PUT(skb, NDTA_STATS, sizeof(ndst), &ndst);
1701 	}
1702 
1703 	BUG_ON(tbl->parms.dev);
1704 	if (neightbl_fill_parms(skb, &tbl->parms) < 0)
1705 		goto nla_put_failure;
1706 
1707 	read_unlock_bh(&tbl->lock);
1708 	return nlmsg_end(skb, nlh);
1709 
1710 nla_put_failure:
1711 	read_unlock_bh(&tbl->lock);
1712 	nlmsg_cancel(skb, nlh);
1713 	return -EMSGSIZE;
1714 }
1715 
1716 static int neightbl_fill_param_info(struct sk_buff *skb,
1717 				    struct neigh_table *tbl,
1718 				    struct neigh_parms *parms,
1719 				    u32 pid, u32 seq, int type,
1720 				    unsigned int flags)
1721 {
1722 	struct ndtmsg *ndtmsg;
1723 	struct nlmsghdr *nlh;
1724 
1725 	nlh = nlmsg_put(skb, pid, seq, type, sizeof(*ndtmsg), flags);
1726 	if (nlh == NULL)
1727 		return -EMSGSIZE;
1728 
1729 	ndtmsg = nlmsg_data(nlh);
1730 
1731 	read_lock_bh(&tbl->lock);
1732 	ndtmsg->ndtm_family = tbl->family;
1733 	ndtmsg->ndtm_pad1   = 0;
1734 	ndtmsg->ndtm_pad2   = 0;
1735 
1736 	if (nla_put_string(skb, NDTA_NAME, tbl->id) < 0 ||
1737 	    neightbl_fill_parms(skb, parms) < 0)
1738 		goto errout;
1739 
1740 	read_unlock_bh(&tbl->lock);
1741 	return nlmsg_end(skb, nlh);
1742 errout:
1743 	read_unlock_bh(&tbl->lock);
1744 	nlmsg_cancel(skb, nlh);
1745 	return -EMSGSIZE;
1746 }
1747 
1748 static inline struct neigh_parms *lookup_neigh_params(struct neigh_table *tbl,
1749 						      int ifindex)
1750 {
1751 	struct neigh_parms *p;
1752 
1753 	for (p = &tbl->parms; p; p = p->next)
1754 		if ((p->dev && p->dev->ifindex == ifindex) ||
1755 		    (!p->dev && !ifindex))
1756 			return p;
1757 
1758 	return NULL;
1759 }
1760 
1761 static struct nla_policy nl_neightbl_policy[NDTA_MAX+1] __read_mostly = {
1762 	[NDTA_NAME]		= { .type = NLA_STRING },
1763 	[NDTA_THRESH1]		= { .type = NLA_U32 },
1764 	[NDTA_THRESH2]		= { .type = NLA_U32 },
1765 	[NDTA_THRESH3]		= { .type = NLA_U32 },
1766 	[NDTA_GC_INTERVAL]	= { .type = NLA_U64 },
1767 	[NDTA_PARMS]		= { .type = NLA_NESTED },
1768 };
1769 
1770 static struct nla_policy nl_ntbl_parm_policy[NDTPA_MAX+1] __read_mostly = {
1771 	[NDTPA_IFINDEX]			= { .type = NLA_U32 },
1772 	[NDTPA_QUEUE_LEN]		= { .type = NLA_U32 },
1773 	[NDTPA_PROXY_QLEN]		= { .type = NLA_U32 },
1774 	[NDTPA_APP_PROBES]		= { .type = NLA_U32 },
1775 	[NDTPA_UCAST_PROBES]		= { .type = NLA_U32 },
1776 	[NDTPA_MCAST_PROBES]		= { .type = NLA_U32 },
1777 	[NDTPA_BASE_REACHABLE_TIME]	= { .type = NLA_U64 },
1778 	[NDTPA_GC_STALETIME]		= { .type = NLA_U64 },
1779 	[NDTPA_DELAY_PROBE_TIME]	= { .type = NLA_U64 },
1780 	[NDTPA_RETRANS_TIME]		= { .type = NLA_U64 },
1781 	[NDTPA_ANYCAST_DELAY]		= { .type = NLA_U64 },
1782 	[NDTPA_PROXY_DELAY]		= { .type = NLA_U64 },
1783 	[NDTPA_LOCKTIME]		= { .type = NLA_U64 },
1784 };
1785 
1786 int neightbl_set(struct sk_buff *skb, struct nlmsghdr *nlh, void *arg)
1787 {
1788 	struct neigh_table *tbl;
1789 	struct ndtmsg *ndtmsg;
1790 	struct nlattr *tb[NDTA_MAX+1];
1791 	int err;
1792 
1793 	err = nlmsg_parse(nlh, sizeof(*ndtmsg), tb, NDTA_MAX,
1794 			  nl_neightbl_policy);
1795 	if (err < 0)
1796 		goto errout;
1797 
1798 	if (tb[NDTA_NAME] == NULL) {
1799 		err = -EINVAL;
1800 		goto errout;
1801 	}
1802 
1803 	ndtmsg = nlmsg_data(nlh);
1804 	read_lock(&neigh_tbl_lock);
1805 	for (tbl = neigh_tables; tbl; tbl = tbl->next) {
1806 		if (ndtmsg->ndtm_family && tbl->family != ndtmsg->ndtm_family)
1807 			continue;
1808 
1809 		if (nla_strcmp(tb[NDTA_NAME], tbl->id) == 0)
1810 			break;
1811 	}
1812 
1813 	if (tbl == NULL) {
1814 		err = -ENOENT;
1815 		goto errout_locked;
1816 	}
1817 
1818 	/*
1819 	 * We acquire tbl->lock to be nice to the periodic timers and
1820 	 * make sure they always see a consistent set of values.
1821 	 */
1822 	write_lock_bh(&tbl->lock);
1823 
1824 	if (tb[NDTA_PARMS]) {
1825 		struct nlattr *tbp[NDTPA_MAX+1];
1826 		struct neigh_parms *p;
1827 		int i, ifindex = 0;
1828 
1829 		err = nla_parse_nested(tbp, NDTPA_MAX, tb[NDTA_PARMS],
1830 				       nl_ntbl_parm_policy);
1831 		if (err < 0)
1832 			goto errout_tbl_lock;
1833 
1834 		if (tbp[NDTPA_IFINDEX])
1835 			ifindex = nla_get_u32(tbp[NDTPA_IFINDEX]);
1836 
1837 		p = lookup_neigh_params(tbl, ifindex);
1838 		if (p == NULL) {
1839 			err = -ENOENT;
1840 			goto errout_tbl_lock;
1841 		}
1842 
1843 		for (i = 1; i <= NDTPA_MAX; i++) {
1844 			if (tbp[i] == NULL)
1845 				continue;
1846 
1847 			switch (i) {
1848 			case NDTPA_QUEUE_LEN:
1849 				p->queue_len = nla_get_u32(tbp[i]);
1850 				break;
1851 			case NDTPA_PROXY_QLEN:
1852 				p->proxy_qlen = nla_get_u32(tbp[i]);
1853 				break;
1854 			case NDTPA_APP_PROBES:
1855 				p->app_probes = nla_get_u32(tbp[i]);
1856 				break;
1857 			case NDTPA_UCAST_PROBES:
1858 				p->ucast_probes = nla_get_u32(tbp[i]);
1859 				break;
1860 			case NDTPA_MCAST_PROBES:
1861 				p->mcast_probes = nla_get_u32(tbp[i]);
1862 				break;
1863 			case NDTPA_BASE_REACHABLE_TIME:
1864 				p->base_reachable_time = nla_get_msecs(tbp[i]);
1865 				break;
1866 			case NDTPA_GC_STALETIME:
1867 				p->gc_staletime = nla_get_msecs(tbp[i]);
1868 				break;
1869 			case NDTPA_DELAY_PROBE_TIME:
1870 				p->delay_probe_time = nla_get_msecs(tbp[i]);
1871 				break;
1872 			case NDTPA_RETRANS_TIME:
1873 				p->retrans_time = nla_get_msecs(tbp[i]);
1874 				break;
1875 			case NDTPA_ANYCAST_DELAY:
1876 				p->anycast_delay = nla_get_msecs(tbp[i]);
1877 				break;
1878 			case NDTPA_PROXY_DELAY:
1879 				p->proxy_delay = nla_get_msecs(tbp[i]);
1880 				break;
1881 			case NDTPA_LOCKTIME:
1882 				p->locktime = nla_get_msecs(tbp[i]);
1883 				break;
1884 			}
1885 		}
1886 	}
1887 
1888 	if (tb[NDTA_THRESH1])
1889 		tbl->gc_thresh1 = nla_get_u32(tb[NDTA_THRESH1]);
1890 
1891 	if (tb[NDTA_THRESH2])
1892 		tbl->gc_thresh2 = nla_get_u32(tb[NDTA_THRESH2]);
1893 
1894 	if (tb[NDTA_THRESH3])
1895 		tbl->gc_thresh3 = nla_get_u32(tb[NDTA_THRESH3]);
1896 
1897 	if (tb[NDTA_GC_INTERVAL])
1898 		tbl->gc_interval = nla_get_msecs(tb[NDTA_GC_INTERVAL]);
1899 
1900 	err = 0;
1901 
1902 errout_tbl_lock:
1903 	write_unlock_bh(&tbl->lock);
1904 errout_locked:
1905 	read_unlock(&neigh_tbl_lock);
1906 errout:
1907 	return err;
1908 }
1909 
1910 int neightbl_dump_info(struct sk_buff *skb, struct netlink_callback *cb)
1911 {
1912 	int family, tidx, nidx = 0;
1913 	int tbl_skip = cb->args[0];
1914 	int neigh_skip = cb->args[1];
1915 	struct neigh_table *tbl;
1916 
1917 	family = ((struct rtgenmsg *) nlmsg_data(cb->nlh))->rtgen_family;
1918 
1919 	read_lock(&neigh_tbl_lock);
1920 	for (tbl = neigh_tables, tidx = 0; tbl; tbl = tbl->next, tidx++) {
1921 		struct neigh_parms *p;
1922 
1923 		if (tidx < tbl_skip || (family && tbl->family != family))
1924 			continue;
1925 
1926 		if (neightbl_fill_info(skb, tbl, NETLINK_CB(cb->skb).pid,
1927 				       cb->nlh->nlmsg_seq, RTM_NEWNEIGHTBL,
1928 				       NLM_F_MULTI) <= 0)
1929 			break;
1930 
1931 		for (nidx = 0, p = tbl->parms.next; p; p = p->next, nidx++) {
1932 			if (nidx < neigh_skip)
1933 				continue;
1934 
1935 			if (neightbl_fill_param_info(skb, tbl, p,
1936 						     NETLINK_CB(cb->skb).pid,
1937 						     cb->nlh->nlmsg_seq,
1938 						     RTM_NEWNEIGHTBL,
1939 						     NLM_F_MULTI) <= 0)
1940 				goto out;
1941 		}
1942 
1943 		neigh_skip = 0;
1944 	}
1945 out:
1946 	read_unlock(&neigh_tbl_lock);
1947 	cb->args[0] = tidx;
1948 	cb->args[1] = nidx;
1949 
1950 	return skb->len;
1951 }
1952 
1953 static int neigh_fill_info(struct sk_buff *skb, struct neighbour *neigh,
1954 			   u32 pid, u32 seq, int type, unsigned int flags)
1955 {
1956 	unsigned long now = jiffies;
1957 	struct nda_cacheinfo ci;
1958 	struct nlmsghdr *nlh;
1959 	struct ndmsg *ndm;
1960 
1961 	nlh = nlmsg_put(skb, pid, seq, type, sizeof(*ndm), flags);
1962 	if (nlh == NULL)
1963 		return -EMSGSIZE;
1964 
1965 	ndm = nlmsg_data(nlh);
1966 	ndm->ndm_family	 = neigh->ops->family;
1967 	ndm->ndm_pad1    = 0;
1968 	ndm->ndm_pad2    = 0;
1969 	ndm->ndm_flags	 = neigh->flags;
1970 	ndm->ndm_type	 = neigh->type;
1971 	ndm->ndm_ifindex = neigh->dev->ifindex;
1972 
1973 	NLA_PUT(skb, NDA_DST, neigh->tbl->key_len, neigh->primary_key);
1974 
1975 	read_lock_bh(&neigh->lock);
1976 	ndm->ndm_state	 = neigh->nud_state;
1977 	if ((neigh->nud_state & NUD_VALID) &&
1978 	    nla_put(skb, NDA_LLADDR, neigh->dev->addr_len, neigh->ha) < 0) {
1979 		read_unlock_bh(&neigh->lock);
1980 		goto nla_put_failure;
1981 	}
1982 
1983 	ci.ndm_used	 = now - neigh->used;
1984 	ci.ndm_confirmed = now - neigh->confirmed;
1985 	ci.ndm_updated	 = now - neigh->updated;
1986 	ci.ndm_refcnt	 = atomic_read(&neigh->refcnt) - 1;
1987 	read_unlock_bh(&neigh->lock);
1988 
1989 	NLA_PUT_U32(skb, NDA_PROBES, atomic_read(&neigh->probes));
1990 	NLA_PUT(skb, NDA_CACHEINFO, sizeof(ci), &ci);
1991 
1992 	return nlmsg_end(skb, nlh);
1993 
1994 nla_put_failure:
1995 	nlmsg_cancel(skb, nlh);
1996 	return -EMSGSIZE;
1997 }
1998 
1999 
2000 static int neigh_dump_table(struct neigh_table *tbl, struct sk_buff *skb,
2001 			    struct netlink_callback *cb)
2002 {
2003 	struct neighbour *n;
2004 	int rc, h, s_h = cb->args[1];
2005 	int idx, s_idx = idx = cb->args[2];
2006 
2007 	read_lock_bh(&tbl->lock);
2008 	for (h = 0; h <= tbl->hash_mask; h++) {
2009 		if (h < s_h)
2010 			continue;
2011 		if (h > s_h)
2012 			s_idx = 0;
2013 		for (n = tbl->hash_buckets[h], idx = 0; n; n = n->next, idx++) {
2014 			if (idx < s_idx)
2015 				continue;
2016 			if (neigh_fill_info(skb, n, NETLINK_CB(cb->skb).pid,
2017 					    cb->nlh->nlmsg_seq,
2018 					    RTM_NEWNEIGH,
2019 					    NLM_F_MULTI) <= 0) {
2020 				read_unlock_bh(&tbl->lock);
2021 				rc = -1;
2022 				goto out;
2023 			}
2024 		}
2025 	}
2026 	read_unlock_bh(&tbl->lock);
2027 	rc = skb->len;
2028 out:
2029 	cb->args[1] = h;
2030 	cb->args[2] = idx;
2031 	return rc;
2032 }
2033 
2034 int neigh_dump_info(struct sk_buff *skb, struct netlink_callback *cb)
2035 {
2036 	struct neigh_table *tbl;
2037 	int t, family, s_t;
2038 
2039 	read_lock(&neigh_tbl_lock);
2040 	family = ((struct rtgenmsg *) nlmsg_data(cb->nlh))->rtgen_family;
2041 	s_t = cb->args[0];
2042 
2043 	for (tbl = neigh_tables, t = 0; tbl; tbl = tbl->next, t++) {
2044 		if (t < s_t || (family && tbl->family != family))
2045 			continue;
2046 		if (t > s_t)
2047 			memset(&cb->args[1], 0, sizeof(cb->args) -
2048 						sizeof(cb->args[0]));
2049 		if (neigh_dump_table(tbl, skb, cb) < 0)
2050 			break;
2051 	}
2052 	read_unlock(&neigh_tbl_lock);
2053 
2054 	cb->args[0] = t;
2055 	return skb->len;
2056 }
2057 
2058 void neigh_for_each(struct neigh_table *tbl, void (*cb)(struct neighbour *, void *), void *cookie)
2059 {
2060 	int chain;
2061 
2062 	read_lock_bh(&tbl->lock);
2063 	for (chain = 0; chain <= tbl->hash_mask; chain++) {
2064 		struct neighbour *n;
2065 
2066 		for (n = tbl->hash_buckets[chain]; n; n = n->next)
2067 			cb(n, cookie);
2068 	}
2069 	read_unlock_bh(&tbl->lock);
2070 }
2071 EXPORT_SYMBOL(neigh_for_each);
2072 
2073 /* The tbl->lock must be held as a writer and BH disabled. */
2074 void __neigh_for_each_release(struct neigh_table *tbl,
2075 			      int (*cb)(struct neighbour *))
2076 {
2077 	int chain;
2078 
2079 	for (chain = 0; chain <= tbl->hash_mask; chain++) {
2080 		struct neighbour *n, **np;
2081 
2082 		np = &tbl->hash_buckets[chain];
2083 		while ((n = *np) != NULL) {
2084 			int release;
2085 
2086 			write_lock(&n->lock);
2087 			release = cb(n);
2088 			if (release) {
2089 				*np = n->next;
2090 				n->dead = 1;
2091 			} else
2092 				np = &n->next;
2093 			write_unlock(&n->lock);
2094 			if (release) {
2095 				if (n->parms->neigh_cleanup)
2096 					n->parms->neigh_cleanup(n);
2097 				neigh_release(n);
2098 			}
2099 		}
2100 	}
2101 }
2102 EXPORT_SYMBOL(__neigh_for_each_release);
2103 
2104 #ifdef CONFIG_PROC_FS
2105 
2106 static struct neighbour *neigh_get_first(struct seq_file *seq)
2107 {
2108 	struct neigh_seq_state *state = seq->private;
2109 	struct neigh_table *tbl = state->tbl;
2110 	struct neighbour *n = NULL;
2111 	int bucket = state->bucket;
2112 
2113 	state->flags &= ~NEIGH_SEQ_IS_PNEIGH;
2114 	for (bucket = 0; bucket <= tbl->hash_mask; bucket++) {
2115 		n = tbl->hash_buckets[bucket];
2116 
2117 		while (n) {
2118 			if (state->neigh_sub_iter) {
2119 				loff_t fakep = 0;
2120 				void *v;
2121 
2122 				v = state->neigh_sub_iter(state, n, &fakep);
2123 				if (!v)
2124 					goto next;
2125 			}
2126 			if (!(state->flags & NEIGH_SEQ_SKIP_NOARP))
2127 				break;
2128 			if (n->nud_state & ~NUD_NOARP)
2129 				break;
2130 		next:
2131 			n = n->next;
2132 		}
2133 
2134 		if (n)
2135 			break;
2136 	}
2137 	state->bucket = bucket;
2138 
2139 	return n;
2140 }
2141 
2142 static struct neighbour *neigh_get_next(struct seq_file *seq,
2143 					struct neighbour *n,
2144 					loff_t *pos)
2145 {
2146 	struct neigh_seq_state *state = seq->private;
2147 	struct neigh_table *tbl = state->tbl;
2148 
2149 	if (state->neigh_sub_iter) {
2150 		void *v = state->neigh_sub_iter(state, n, pos);
2151 		if (v)
2152 			return n;
2153 	}
2154 	n = n->next;
2155 
2156 	while (1) {
2157 		while (n) {
2158 			if (state->neigh_sub_iter) {
2159 				void *v = state->neigh_sub_iter(state, n, pos);
2160 				if (v)
2161 					return n;
2162 				goto next;
2163 			}
2164 			if (!(state->flags & NEIGH_SEQ_SKIP_NOARP))
2165 				break;
2166 
2167 			if (n->nud_state & ~NUD_NOARP)
2168 				break;
2169 		next:
2170 			n = n->next;
2171 		}
2172 
2173 		if (n)
2174 			break;
2175 
2176 		if (++state->bucket > tbl->hash_mask)
2177 			break;
2178 
2179 		n = tbl->hash_buckets[state->bucket];
2180 	}
2181 
2182 	if (n && pos)
2183 		--(*pos);
2184 	return n;
2185 }
2186 
2187 static struct neighbour *neigh_get_idx(struct seq_file *seq, loff_t *pos)
2188 {
2189 	struct neighbour *n = neigh_get_first(seq);
2190 
2191 	if (n) {
2192 		while (*pos) {
2193 			n = neigh_get_next(seq, n, pos);
2194 			if (!n)
2195 				break;
2196 		}
2197 	}
2198 	return *pos ? NULL : n;
2199 }
2200 
2201 static struct pneigh_entry *pneigh_get_first(struct seq_file *seq)
2202 {
2203 	struct neigh_seq_state *state = seq->private;
2204 	struct neigh_table *tbl = state->tbl;
2205 	struct pneigh_entry *pn = NULL;
2206 	int bucket = state->bucket;
2207 
2208 	state->flags |= NEIGH_SEQ_IS_PNEIGH;
2209 	for (bucket = 0; bucket <= PNEIGH_HASHMASK; bucket++) {
2210 		pn = tbl->phash_buckets[bucket];
2211 		if (pn)
2212 			break;
2213 	}
2214 	state->bucket = bucket;
2215 
2216 	return pn;
2217 }
2218 
2219 static struct pneigh_entry *pneigh_get_next(struct seq_file *seq,
2220 					    struct pneigh_entry *pn,
2221 					    loff_t *pos)
2222 {
2223 	struct neigh_seq_state *state = seq->private;
2224 	struct neigh_table *tbl = state->tbl;
2225 
2226 	pn = pn->next;
2227 	while (!pn) {
2228 		if (++state->bucket > PNEIGH_HASHMASK)
2229 			break;
2230 		pn = tbl->phash_buckets[state->bucket];
2231 		if (pn)
2232 			break;
2233 	}
2234 
2235 	if (pn && pos)
2236 		--(*pos);
2237 
2238 	return pn;
2239 }
2240 
2241 static struct pneigh_entry *pneigh_get_idx(struct seq_file *seq, loff_t *pos)
2242 {
2243 	struct pneigh_entry *pn = pneigh_get_first(seq);
2244 
2245 	if (pn) {
2246 		while (*pos) {
2247 			pn = pneigh_get_next(seq, pn, pos);
2248 			if (!pn)
2249 				break;
2250 		}
2251 	}
2252 	return *pos ? NULL : pn;
2253 }
2254 
2255 static void *neigh_get_idx_any(struct seq_file *seq, loff_t *pos)
2256 {
2257 	struct neigh_seq_state *state = seq->private;
2258 	void *rc;
2259 
2260 	rc = neigh_get_idx(seq, pos);
2261 	if (!rc && !(state->flags & NEIGH_SEQ_NEIGH_ONLY))
2262 		rc = pneigh_get_idx(seq, pos);
2263 
2264 	return rc;
2265 }
2266 
2267 void *neigh_seq_start(struct seq_file *seq, loff_t *pos, struct neigh_table *tbl, unsigned int neigh_seq_flags)
2268 {
2269 	struct neigh_seq_state *state = seq->private;
2270 	loff_t pos_minus_one;
2271 
2272 	state->tbl = tbl;
2273 	state->bucket = 0;
2274 	state->flags = (neigh_seq_flags & ~NEIGH_SEQ_IS_PNEIGH);
2275 
2276 	read_lock_bh(&tbl->lock);
2277 
2278 	pos_minus_one = *pos - 1;
2279 	return *pos ? neigh_get_idx_any(seq, &pos_minus_one) : SEQ_START_TOKEN;
2280 }
2281 EXPORT_SYMBOL(neigh_seq_start);
2282 
2283 void *neigh_seq_next(struct seq_file *seq, void *v, loff_t *pos)
2284 {
2285 	struct neigh_seq_state *state;
2286 	void *rc;
2287 
2288 	if (v == SEQ_START_TOKEN) {
2289 		rc = neigh_get_idx(seq, pos);
2290 		goto out;
2291 	}
2292 
2293 	state = seq->private;
2294 	if (!(state->flags & NEIGH_SEQ_IS_PNEIGH)) {
2295 		rc = neigh_get_next(seq, v, NULL);
2296 		if (rc)
2297 			goto out;
2298 		if (!(state->flags & NEIGH_SEQ_NEIGH_ONLY))
2299 			rc = pneigh_get_first(seq);
2300 	} else {
2301 		BUG_ON(state->flags & NEIGH_SEQ_NEIGH_ONLY);
2302 		rc = pneigh_get_next(seq, v, NULL);
2303 	}
2304 out:
2305 	++(*pos);
2306 	return rc;
2307 }
2308 EXPORT_SYMBOL(neigh_seq_next);
2309 
2310 void neigh_seq_stop(struct seq_file *seq, void *v)
2311 {
2312 	struct neigh_seq_state *state = seq->private;
2313 	struct neigh_table *tbl = state->tbl;
2314 
2315 	read_unlock_bh(&tbl->lock);
2316 }
2317 EXPORT_SYMBOL(neigh_seq_stop);
2318 
2319 /* statistics via seq_file */
2320 
2321 static void *neigh_stat_seq_start(struct seq_file *seq, loff_t *pos)
2322 {
2323 	struct proc_dir_entry *pde = seq->private;
2324 	struct neigh_table *tbl = pde->data;
2325 	int cpu;
2326 
2327 	if (*pos == 0)
2328 		return SEQ_START_TOKEN;
2329 
2330 	for (cpu = *pos-1; cpu < NR_CPUS; ++cpu) {
2331 		if (!cpu_possible(cpu))
2332 			continue;
2333 		*pos = cpu+1;
2334 		return per_cpu_ptr(tbl->stats, cpu);
2335 	}
2336 	return NULL;
2337 }
2338 
2339 static void *neigh_stat_seq_next(struct seq_file *seq, void *v, loff_t *pos)
2340 {
2341 	struct proc_dir_entry *pde = seq->private;
2342 	struct neigh_table *tbl = pde->data;
2343 	int cpu;
2344 
2345 	for (cpu = *pos; cpu < NR_CPUS; ++cpu) {
2346 		if (!cpu_possible(cpu))
2347 			continue;
2348 		*pos = cpu+1;
2349 		return per_cpu_ptr(tbl->stats, cpu);
2350 	}
2351 	return NULL;
2352 }
2353 
2354 static void neigh_stat_seq_stop(struct seq_file *seq, void *v)
2355 {
2356 
2357 }
2358 
2359 static int neigh_stat_seq_show(struct seq_file *seq, void *v)
2360 {
2361 	struct proc_dir_entry *pde = seq->private;
2362 	struct neigh_table *tbl = pde->data;
2363 	struct neigh_statistics *st = v;
2364 
2365 	if (v == SEQ_START_TOKEN) {
2366 		seq_printf(seq, "entries  allocs destroys hash_grows  lookups hits  res_failed  rcv_probes_mcast rcv_probes_ucast  periodic_gc_runs forced_gc_runs\n");
2367 		return 0;
2368 	}
2369 
2370 	seq_printf(seq, "%08x  %08lx %08lx %08lx  %08lx %08lx  %08lx  "
2371 			"%08lx %08lx  %08lx %08lx\n",
2372 		   atomic_read(&tbl->entries),
2373 
2374 		   st->allocs,
2375 		   st->destroys,
2376 		   st->hash_grows,
2377 
2378 		   st->lookups,
2379 		   st->hits,
2380 
2381 		   st->res_failed,
2382 
2383 		   st->rcv_probes_mcast,
2384 		   st->rcv_probes_ucast,
2385 
2386 		   st->periodic_gc_runs,
2387 		   st->forced_gc_runs
2388 		   );
2389 
2390 	return 0;
2391 }
2392 
2393 static struct seq_operations neigh_stat_seq_ops = {
2394 	.start	= neigh_stat_seq_start,
2395 	.next	= neigh_stat_seq_next,
2396 	.stop	= neigh_stat_seq_stop,
2397 	.show	= neigh_stat_seq_show,
2398 };
2399 
2400 static int neigh_stat_seq_open(struct inode *inode, struct file *file)
2401 {
2402 	int ret = seq_open(file, &neigh_stat_seq_ops);
2403 
2404 	if (!ret) {
2405 		struct seq_file *sf = file->private_data;
2406 		sf->private = PDE(inode);
2407 	}
2408 	return ret;
2409 };
2410 
2411 static const struct file_operations neigh_stat_seq_fops = {
2412 	.owner	 = THIS_MODULE,
2413 	.open 	 = neigh_stat_seq_open,
2414 	.read	 = seq_read,
2415 	.llseek	 = seq_lseek,
2416 	.release = seq_release,
2417 };
2418 
2419 #endif /* CONFIG_PROC_FS */
2420 
2421 #ifdef CONFIG_ARPD
2422 static inline size_t neigh_nlmsg_size(void)
2423 {
2424 	return NLMSG_ALIGN(sizeof(struct ndmsg))
2425 	       + nla_total_size(MAX_ADDR_LEN) /* NDA_DST */
2426 	       + nla_total_size(MAX_ADDR_LEN) /* NDA_LLADDR */
2427 	       + nla_total_size(sizeof(struct nda_cacheinfo))
2428 	       + nla_total_size(4); /* NDA_PROBES */
2429 }
2430 
2431 static void __neigh_notify(struct neighbour *n, int type, int flags)
2432 {
2433 	struct sk_buff *skb;
2434 	int err = -ENOBUFS;
2435 
2436 	skb = nlmsg_new(neigh_nlmsg_size(), GFP_ATOMIC);
2437 	if (skb == NULL)
2438 		goto errout;
2439 
2440 	err = neigh_fill_info(skb, n, 0, 0, type, flags);
2441 	if (err < 0) {
2442 		/* -EMSGSIZE implies BUG in neigh_nlmsg_size() */
2443 		WARN_ON(err == -EMSGSIZE);
2444 		kfree_skb(skb);
2445 		goto errout;
2446 	}
2447 	err = rtnl_notify(skb, 0, RTNLGRP_NEIGH, NULL, GFP_ATOMIC);
2448 errout:
2449 	if (err < 0)
2450 		rtnl_set_sk_err(RTNLGRP_NEIGH, err);
2451 }
2452 
2453 void neigh_app_ns(struct neighbour *n)
2454 {
2455 	__neigh_notify(n, RTM_GETNEIGH, NLM_F_REQUEST);
2456 }
2457 
2458 static void neigh_app_notify(struct neighbour *n)
2459 {
2460 	__neigh_notify(n, RTM_NEWNEIGH, 0);
2461 }
2462 
2463 #endif /* CONFIG_ARPD */
2464 
2465 #ifdef CONFIG_SYSCTL
2466 
2467 static struct neigh_sysctl_table {
2468 	struct ctl_table_header *sysctl_header;
2469 	ctl_table		neigh_vars[__NET_NEIGH_MAX];
2470 	ctl_table		neigh_dev[2];
2471 	ctl_table		neigh_neigh_dir[2];
2472 	ctl_table		neigh_proto_dir[2];
2473 	ctl_table		neigh_root_dir[2];
2474 } neigh_sysctl_template __read_mostly = {
2475 	.neigh_vars = {
2476 		{
2477 			.ctl_name	= NET_NEIGH_MCAST_SOLICIT,
2478 			.procname	= "mcast_solicit",
2479 			.maxlen		= sizeof(int),
2480 			.mode		= 0644,
2481 			.proc_handler	= &proc_dointvec,
2482 		},
2483 		{
2484 			.ctl_name	= NET_NEIGH_UCAST_SOLICIT,
2485 			.procname	= "ucast_solicit",
2486 			.maxlen		= sizeof(int),
2487 			.mode		= 0644,
2488 			.proc_handler	= &proc_dointvec,
2489 		},
2490 		{
2491 			.ctl_name	= NET_NEIGH_APP_SOLICIT,
2492 			.procname	= "app_solicit",
2493 			.maxlen		= sizeof(int),
2494 			.mode		= 0644,
2495 			.proc_handler	= &proc_dointvec,
2496 		},
2497 		{
2498 			.ctl_name	= NET_NEIGH_RETRANS_TIME,
2499 			.procname	= "retrans_time",
2500 			.maxlen		= sizeof(int),
2501 			.mode		= 0644,
2502 			.proc_handler	= &proc_dointvec_userhz_jiffies,
2503 		},
2504 		{
2505 			.ctl_name	= NET_NEIGH_REACHABLE_TIME,
2506 			.procname	= "base_reachable_time",
2507 			.maxlen		= sizeof(int),
2508 			.mode		= 0644,
2509 			.proc_handler	= &proc_dointvec_jiffies,
2510 			.strategy	= &sysctl_jiffies,
2511 		},
2512 		{
2513 			.ctl_name	= NET_NEIGH_DELAY_PROBE_TIME,
2514 			.procname	= "delay_first_probe_time",
2515 			.maxlen		= sizeof(int),
2516 			.mode		= 0644,
2517 			.proc_handler	= &proc_dointvec_jiffies,
2518 			.strategy	= &sysctl_jiffies,
2519 		},
2520 		{
2521 			.ctl_name	= NET_NEIGH_GC_STALE_TIME,
2522 			.procname	= "gc_stale_time",
2523 			.maxlen		= sizeof(int),
2524 			.mode		= 0644,
2525 			.proc_handler	= &proc_dointvec_jiffies,
2526 			.strategy	= &sysctl_jiffies,
2527 		},
2528 		{
2529 			.ctl_name	= NET_NEIGH_UNRES_QLEN,
2530 			.procname	= "unres_qlen",
2531 			.maxlen		= sizeof(int),
2532 			.mode		= 0644,
2533 			.proc_handler	= &proc_dointvec,
2534 		},
2535 		{
2536 			.ctl_name	= NET_NEIGH_PROXY_QLEN,
2537 			.procname	= "proxy_qlen",
2538 			.maxlen		= sizeof(int),
2539 			.mode		= 0644,
2540 			.proc_handler	= &proc_dointvec,
2541 		},
2542 		{
2543 			.ctl_name	= NET_NEIGH_ANYCAST_DELAY,
2544 			.procname	= "anycast_delay",
2545 			.maxlen		= sizeof(int),
2546 			.mode		= 0644,
2547 			.proc_handler	= &proc_dointvec_userhz_jiffies,
2548 		},
2549 		{
2550 			.ctl_name	= NET_NEIGH_PROXY_DELAY,
2551 			.procname	= "proxy_delay",
2552 			.maxlen		= sizeof(int),
2553 			.mode		= 0644,
2554 			.proc_handler	= &proc_dointvec_userhz_jiffies,
2555 		},
2556 		{
2557 			.ctl_name	= NET_NEIGH_LOCKTIME,
2558 			.procname	= "locktime",
2559 			.maxlen		= sizeof(int),
2560 			.mode		= 0644,
2561 			.proc_handler	= &proc_dointvec_userhz_jiffies,
2562 		},
2563 		{
2564 			.ctl_name	= NET_NEIGH_GC_INTERVAL,
2565 			.procname	= "gc_interval",
2566 			.maxlen		= sizeof(int),
2567 			.mode		= 0644,
2568 			.proc_handler	= &proc_dointvec_jiffies,
2569 			.strategy	= &sysctl_jiffies,
2570 		},
2571 		{
2572 			.ctl_name	= NET_NEIGH_GC_THRESH1,
2573 			.procname	= "gc_thresh1",
2574 			.maxlen		= sizeof(int),
2575 			.mode		= 0644,
2576 			.proc_handler	= &proc_dointvec,
2577 		},
2578 		{
2579 			.ctl_name	= NET_NEIGH_GC_THRESH2,
2580 			.procname	= "gc_thresh2",
2581 			.maxlen		= sizeof(int),
2582 			.mode		= 0644,
2583 			.proc_handler	= &proc_dointvec,
2584 		},
2585 		{
2586 			.ctl_name	= NET_NEIGH_GC_THRESH3,
2587 			.procname	= "gc_thresh3",
2588 			.maxlen		= sizeof(int),
2589 			.mode		= 0644,
2590 			.proc_handler	= &proc_dointvec,
2591 		},
2592 		{
2593 			.ctl_name	= NET_NEIGH_RETRANS_TIME_MS,
2594 			.procname	= "retrans_time_ms",
2595 			.maxlen		= sizeof(int),
2596 			.mode		= 0644,
2597 			.proc_handler	= &proc_dointvec_ms_jiffies,
2598 			.strategy	= &sysctl_ms_jiffies,
2599 		},
2600 		{
2601 			.ctl_name	= NET_NEIGH_REACHABLE_TIME_MS,
2602 			.procname	= "base_reachable_time_ms",
2603 			.maxlen		= sizeof(int),
2604 			.mode		= 0644,
2605 			.proc_handler	= &proc_dointvec_ms_jiffies,
2606 			.strategy	= &sysctl_ms_jiffies,
2607 		},
2608 	},
2609 	.neigh_dev = {
2610 		{
2611 			.ctl_name	= NET_PROTO_CONF_DEFAULT,
2612 			.procname	= "default",
2613 			.mode		= 0555,
2614 		},
2615 	},
2616 	.neigh_neigh_dir = {
2617 		{
2618 			.procname	= "neigh",
2619 			.mode		= 0555,
2620 		},
2621 	},
2622 	.neigh_proto_dir = {
2623 		{
2624 			.mode		= 0555,
2625 		},
2626 	},
2627 	.neigh_root_dir = {
2628 		{
2629 			.ctl_name	= CTL_NET,
2630 			.procname	= "net",
2631 			.mode		= 0555,
2632 		},
2633 	},
2634 };
2635 
2636 int neigh_sysctl_register(struct net_device *dev, struct neigh_parms *p,
2637 			  int p_id, int pdev_id, char *p_name,
2638 			  proc_handler *handler, ctl_handler *strategy)
2639 {
2640 	struct neigh_sysctl_table *t = kmemdup(&neigh_sysctl_template,
2641 					       sizeof(*t), GFP_KERNEL);
2642 	const char *dev_name_source = NULL;
2643 	char *dev_name = NULL;
2644 	int err = 0;
2645 
2646 	if (!t)
2647 		return -ENOBUFS;
2648 	t->neigh_vars[0].data  = &p->mcast_probes;
2649 	t->neigh_vars[1].data  = &p->ucast_probes;
2650 	t->neigh_vars[2].data  = &p->app_probes;
2651 	t->neigh_vars[3].data  = &p->retrans_time;
2652 	t->neigh_vars[4].data  = &p->base_reachable_time;
2653 	t->neigh_vars[5].data  = &p->delay_probe_time;
2654 	t->neigh_vars[6].data  = &p->gc_staletime;
2655 	t->neigh_vars[7].data  = &p->queue_len;
2656 	t->neigh_vars[8].data  = &p->proxy_qlen;
2657 	t->neigh_vars[9].data  = &p->anycast_delay;
2658 	t->neigh_vars[10].data = &p->proxy_delay;
2659 	t->neigh_vars[11].data = &p->locktime;
2660 
2661 	if (dev) {
2662 		dev_name_source = dev->name;
2663 		t->neigh_dev[0].ctl_name = dev->ifindex;
2664 		t->neigh_vars[12].procname = NULL;
2665 		t->neigh_vars[13].procname = NULL;
2666 		t->neigh_vars[14].procname = NULL;
2667 		t->neigh_vars[15].procname = NULL;
2668 	} else {
2669 		dev_name_source = t->neigh_dev[0].procname;
2670 		t->neigh_vars[12].data = (int *)(p + 1);
2671 		t->neigh_vars[13].data = (int *)(p + 1) + 1;
2672 		t->neigh_vars[14].data = (int *)(p + 1) + 2;
2673 		t->neigh_vars[15].data = (int *)(p + 1) + 3;
2674 	}
2675 
2676 	t->neigh_vars[16].data  = &p->retrans_time;
2677 	t->neigh_vars[17].data  = &p->base_reachable_time;
2678 
2679 	if (handler || strategy) {
2680 		/* RetransTime */
2681 		t->neigh_vars[3].proc_handler = handler;
2682 		t->neigh_vars[3].strategy = strategy;
2683 		t->neigh_vars[3].extra1 = dev;
2684 		/* ReachableTime */
2685 		t->neigh_vars[4].proc_handler = handler;
2686 		t->neigh_vars[4].strategy = strategy;
2687 		t->neigh_vars[4].extra1 = dev;
2688 		/* RetransTime (in milliseconds)*/
2689 		t->neigh_vars[16].proc_handler = handler;
2690 		t->neigh_vars[16].strategy = strategy;
2691 		t->neigh_vars[16].extra1 = dev;
2692 		/* ReachableTime (in milliseconds) */
2693 		t->neigh_vars[17].proc_handler = handler;
2694 		t->neigh_vars[17].strategy = strategy;
2695 		t->neigh_vars[17].extra1 = dev;
2696 	}
2697 
2698 	dev_name = kstrdup(dev_name_source, GFP_KERNEL);
2699 	if (!dev_name) {
2700 		err = -ENOBUFS;
2701 		goto free;
2702 	}
2703 
2704 	t->neigh_dev[0].procname = dev_name;
2705 
2706 	t->neigh_neigh_dir[0].ctl_name = pdev_id;
2707 
2708 	t->neigh_proto_dir[0].procname = p_name;
2709 	t->neigh_proto_dir[0].ctl_name = p_id;
2710 
2711 	t->neigh_dev[0].child	       = t->neigh_vars;
2712 	t->neigh_neigh_dir[0].child    = t->neigh_dev;
2713 	t->neigh_proto_dir[0].child    = t->neigh_neigh_dir;
2714 	t->neigh_root_dir[0].child     = t->neigh_proto_dir;
2715 
2716 	t->sysctl_header = register_sysctl_table(t->neigh_root_dir);
2717 	if (!t->sysctl_header) {
2718 		err = -ENOBUFS;
2719 		goto free_procname;
2720 	}
2721 	p->sysctl_table = t;
2722 	return 0;
2723 
2724 	/* error path */
2725  free_procname:
2726 	kfree(dev_name);
2727  free:
2728 	kfree(t);
2729 
2730 	return err;
2731 }
2732 
2733 void neigh_sysctl_unregister(struct neigh_parms *p)
2734 {
2735 	if (p->sysctl_table) {
2736 		struct neigh_sysctl_table *t = p->sysctl_table;
2737 		p->sysctl_table = NULL;
2738 		unregister_sysctl_table(t->sysctl_header);
2739 		kfree(t->neigh_dev[0].procname);
2740 		kfree(t);
2741 	}
2742 }
2743 
2744 #endif	/* CONFIG_SYSCTL */
2745 
2746 EXPORT_SYMBOL(__neigh_event_send);
2747 EXPORT_SYMBOL(neigh_changeaddr);
2748 EXPORT_SYMBOL(neigh_compat_output);
2749 EXPORT_SYMBOL(neigh_connected_output);
2750 EXPORT_SYMBOL(neigh_create);
2751 EXPORT_SYMBOL(neigh_delete);
2752 EXPORT_SYMBOL(neigh_destroy);
2753 EXPORT_SYMBOL(neigh_dump_info);
2754 EXPORT_SYMBOL(neigh_event_ns);
2755 EXPORT_SYMBOL(neigh_ifdown);
2756 EXPORT_SYMBOL(neigh_lookup);
2757 EXPORT_SYMBOL(neigh_lookup_nodev);
2758 EXPORT_SYMBOL(neigh_parms_alloc);
2759 EXPORT_SYMBOL(neigh_parms_release);
2760 EXPORT_SYMBOL(neigh_rand_reach_time);
2761 EXPORT_SYMBOL(neigh_resolve_output);
2762 EXPORT_SYMBOL(neigh_table_clear);
2763 EXPORT_SYMBOL(neigh_table_init);
2764 EXPORT_SYMBOL(neigh_table_init_no_netlink);
2765 EXPORT_SYMBOL(neigh_update);
2766 EXPORT_SYMBOL(pneigh_enqueue);
2767 EXPORT_SYMBOL(pneigh_lookup);
2768 
2769 #ifdef CONFIG_ARPD
2770 EXPORT_SYMBOL(neigh_app_ns);
2771 #endif
2772 #ifdef CONFIG_SYSCTL
2773 EXPORT_SYMBOL(neigh_sysctl_register);
2774 EXPORT_SYMBOL(neigh_sysctl_unregister);
2775 #endif
2776