/*
   *	IPv6 Address [auto]configuration
   *	Linux INET6 implementation
   *
   *	Authors:

   *	Pedro Roque		<roque@di.fc.ul.pt>

   *	Alexey Kuznetsov	<kuznet@ms2.inr.ac.ru>
   *

   *	This program is free software; you can redistribute it and/or
   *      modify it under the terms of the GNU General Public License
   *      as published by the Free Software Foundation; either version
   *      2 of the License, or (at your option) any later version.
   */
  
  /*
   *	Changes:
   *
   *	Janos Farkas			:	delete timer on ifdown
   *	<chexum@bankinf.banki.hu>
   *	Andi Kleen			:	kill double kfree on module
   *						unload.
   *	Maciej W. Rozycki		:	FDDI support
   *	sekiya@USAGI			:	Don't send too many RS
   *						packets.
   *	yoshfuji@USAGI			:       Fixed interval between DAD
   *						packets.
   *	YOSHIFUJI Hideaki @USAGI	:	improved accuracy of
   *						address validation timer.
   *	YOSHIFUJI Hideaki @USAGI	:	Privacy Extensions (RFC3041)
   *						support.
   *	Yuji SEKIYA @USAGI		:	Don't assign a same IPv6
   *						address on a same interface.
   *	YOSHIFUJI Hideaki @USAGI	:	ARCnet support
   *	YOSHIFUJI Hideaki @USAGI	:	convert /proc/net/if_inet6 to
   *						seq_file.

   *	YOSHIFUJI Hideaki @USAGI	:	improved source address
   *						selection; consider scope,
   *						status etc.

   */

  #include <linux/errno.h>
  #include <linux/types.h>

  #include <linux/kernel.h>

  #include <linux/socket.h>
  #include <linux/sockios.h>

  #include <linux/net.h>
  #include <linux/in6.h>
  #include <linux/netdevice.h>

  #include <linux/if_addr.h>

  #include <linux/if_arp.h>
  #include <linux/if_arcnet.h>
  #include <linux/if_infiniband.h>
  #include <linux/route.h>
  #include <linux/inetdevice.h>
  #include <linux/init.h>

  #include <linux/slab.h>

  #ifdef CONFIG_SYSCTL
  #include <linux/sysctl.h>
  #endif

  #include <linux/capability.h>

  #include <linux/delay.h>
  #include <linux/notifier.h>

  #include <linux/string.h>

  #include <net/net_namespace.h>

  #include <net/sock.h>
  #include <net/snmp.h>
  
  #include <net/ipv6.h>
  #include <net/protocol.h>
  #include <net/ndisc.h>
  #include <net/ip6_route.h>
  #include <net/addrconf.h>
  #include <net/tcp.h>
  #include <net/ip.h>

  #include <net/netlink.h>

  #include <net/pkt_sched.h>

  #include <linux/if_tunnel.h>
  #include <linux/rtnetlink.h>
  
  #ifdef CONFIG_IPV6_PRIVACY
  #include <linux/random.h>

  #endif

  #include <linux/uaccess.h>

  #include <asm/unaligned.h>

  
  #include <linux/proc_fs.h>
  #include <linux/seq_file.h>

  #include <linux/export.h>

  
  /* Set to 3 to get tracing... */
  #define ACONF_DEBUG 2
  
  #if ACONF_DEBUG >= 3
  #define ADBG(x) printk x
  #else
  #define ADBG(x)
  #endif
  
  #define	INFINITY_LIFE_TIME	0xFFFFFFFF

  
  static inline u32 cstamp_delta(unsigned long cstamp)
  {
  	return (cstamp - INITIAL_JIFFIES) * 100UL / HZ;
  }

  #define ADDRCONF_TIMER_FUZZ_MINUS	(HZ > 50 ? HZ/50 : 1)
  #define ADDRCONF_TIMER_FUZZ		(HZ / 4)
  #define ADDRCONF_TIMER_FUZZ_MAX		(HZ)

  #ifdef CONFIG_SYSCTL

  static void addrconf_sysctl_register(struct inet6_dev *idev);

  static void addrconf_sysctl_unregister(struct inet6_dev *idev);
  #else
  static inline void addrconf_sysctl_register(struct inet6_dev *idev)
  {
  }
  
  static inline void addrconf_sysctl_unregister(struct inet6_dev *idev)
  {
  }

  #endif
  
  #ifdef CONFIG_IPV6_PRIVACY
  static int __ipv6_regen_rndid(struct inet6_dev *idev);

  static int __ipv6_try_regen_rndid(struct inet6_dev *idev, struct in6_addr *tmpaddr);

  static void ipv6_regen_rndid(unsigned long data);

  #endif

  static int ipv6_generate_eui64(u8 *eui, struct net_device *dev);

  static int ipv6_count_addresses(struct inet6_dev *idev);
  
  /*
   *	Configured unicast address hash table
   */

  static struct hlist_head inet6_addr_lst[IN6_ADDR_HSIZE];

  static DEFINE_SPINLOCK(addrconf_hash_lock);

  static void addrconf_verify(unsigned long);

  static DEFINE_TIMER(addr_chk_timer, addrconf_verify, 0, 0);

  static DEFINE_SPINLOCK(addrconf_verify_lock);
  
  static void addrconf_join_anycast(struct inet6_ifaddr *ifp);
  static void addrconf_leave_anycast(struct inet6_ifaddr *ifp);

  static void addrconf_type_change(struct net_device *dev,
  				 unsigned long event);

  static int addrconf_ifdown(struct net_device *dev, int how);

  static void addrconf_dad_start(struct inet6_ifaddr *ifp, u32 flags);

  static void addrconf_dad_timer(unsigned long data);
  static void addrconf_dad_completed(struct inet6_ifaddr *ifp);

  static void addrconf_dad_run(struct inet6_dev *idev);

  static void addrconf_rs_timer(unsigned long data);
  static void __ipv6_ifa_notify(int event, struct inet6_ifaddr *ifa);
  static void ipv6_ifa_notify(int event, struct inet6_ifaddr *ifa);

  static void inet6_prefix_notify(int event, struct inet6_dev *idev,

  				struct prefix_info *pinfo);

  static bool ipv6_chk_same_addr(struct net *net, const struct in6_addr *addr,
  			       struct net_device *dev);

  static ATOMIC_NOTIFIER_HEAD(inet6addr_chain);

  static struct ipv6_devconf ipv6_devconf __read_mostly = {

  	.forwarding		= 0,
  	.hop_limit		= IPV6_DEFAULT_HOPLIMIT,
  	.mtu6			= IPV6_MIN_MTU,
  	.accept_ra		= 1,
  	.accept_redirects	= 1,
  	.autoconf		= 1,
  	.force_mld_version	= 0,
  	.dad_transmits		= 1,
  	.rtr_solicits		= MAX_RTR_SOLICITATIONS,
  	.rtr_solicit_interval	= RTR_SOLICITATION_INTERVAL,
  	.rtr_solicit_delay	= MAX_RTR_SOLICITATION_DELAY,
  #ifdef CONFIG_IPV6_PRIVACY
  	.use_tempaddr 		= 0,
  	.temp_valid_lft		= TEMP_VALID_LIFETIME,
  	.temp_prefered_lft	= TEMP_PREFERRED_LIFETIME,
  	.regen_max_retry	= REGEN_MAX_RETRY,
  	.max_desync_factor	= MAX_DESYNC_FACTOR,
  #endif
  	.max_addresses		= IPV6_MAX_ADDRESSES,

  	.accept_ra_defrtr	= 1,

  	.accept_ra_pinfo	= 1,

  #ifdef CONFIG_IPV6_ROUTER_PREF
  	.accept_ra_rtr_pref	= 1,

  	.rtr_probe_interval	= 60 * HZ,

  #ifdef CONFIG_IPV6_ROUTE_INFO
  	.accept_ra_rt_info_max_plen = 0,
  #endif

  #endif

  	.proxy_ndp		= 0,

  	.accept_source_route	= 0,	/* we do not accept RH0 by default. */

  	.disable_ipv6		= 0,

  	.accept_dad		= 1,

  };

  static struct ipv6_devconf ipv6_devconf_dflt __read_mostly = {

  	.forwarding		= 0,
  	.hop_limit		= IPV6_DEFAULT_HOPLIMIT,
  	.mtu6			= IPV6_MIN_MTU,
  	.accept_ra		= 1,
  	.accept_redirects	= 1,
  	.autoconf		= 1,
  	.dad_transmits		= 1,
  	.rtr_solicits		= MAX_RTR_SOLICITATIONS,
  	.rtr_solicit_interval	= RTR_SOLICITATION_INTERVAL,
  	.rtr_solicit_delay	= MAX_RTR_SOLICITATION_DELAY,
  #ifdef CONFIG_IPV6_PRIVACY
  	.use_tempaddr		= 0,
  	.temp_valid_lft		= TEMP_VALID_LIFETIME,
  	.temp_prefered_lft	= TEMP_PREFERRED_LIFETIME,
  	.regen_max_retry	= REGEN_MAX_RETRY,
  	.max_desync_factor	= MAX_DESYNC_FACTOR,
  #endif
  	.max_addresses		= IPV6_MAX_ADDRESSES,

  	.accept_ra_defrtr	= 1,

  	.accept_ra_pinfo	= 1,

  #ifdef CONFIG_IPV6_ROUTER_PREF
  	.accept_ra_rtr_pref	= 1,

  	.rtr_probe_interval	= 60 * HZ,

  #ifdef CONFIG_IPV6_ROUTE_INFO
  	.accept_ra_rt_info_max_plen = 0,
  #endif

  #endif

  	.proxy_ndp		= 0,

  	.accept_source_route	= 0,	/* we do not accept RH0 by default. */

  	.disable_ipv6		= 0,

  	.accept_dad		= 1,

  };
  
  /* IPv6 Wildcard Address and Loopback Address defined by RFC2553 */

  const struct in6_addr in6addr_any = IN6ADDR_ANY_INIT;

  const struct in6_addr in6addr_loopback = IN6ADDR_LOOPBACK_INIT;

  const struct in6_addr in6addr_linklocal_allnodes = IN6ADDR_LINKLOCAL_ALLNODES_INIT;
  const struct in6_addr in6addr_linklocal_allrouters = IN6ADDR_LINKLOCAL_ALLROUTERS_INIT;

  /* Check if a valid qdisc is available */

  static inline bool addrconf_qdisc_ok(const struct net_device *dev)

  {

  	return !qdisc_tx_is_noop(dev);

  }

  /* Check if a route is valid prefix route */
  static inline int addrconf_is_prefix_route(const struct rt6_info *rt)
  {

  	return (rt->rt6i_flags & (RTF_GATEWAY | RTF_DEFAULT)) == 0;

  }

  static void addrconf_del_timer(struct inet6_ifaddr *ifp)
  {
  	if (del_timer(&ifp->timer))
  		__in6_ifa_put(ifp);
  }

  enum addrconf_timer_t {

  	AC_NONE,
  	AC_DAD,
  	AC_RS,
  };
  
  static void addrconf_mod_timer(struct inet6_ifaddr *ifp,
  			       enum addrconf_timer_t what,
  			       unsigned long when)
  {
  	if (!del_timer(&ifp->timer))
  		in6_ifa_hold(ifp);
  
  	switch (what) {
  	case AC_DAD:
  		ifp->timer.function = addrconf_dad_timer;
  		break;
  	case AC_RS:
  		ifp->timer.function = addrconf_rs_timer;
  		break;

  	default:
  		break;

  	}
  	ifp->timer.expires = jiffies + when;
  	add_timer(&ifp->timer);
  }

  static int snmp6_alloc_dev(struct inet6_dev *idev)
  {

  	if (snmp_mib_init((void __percpu **)idev->stats.ipv6,

  			  sizeof(struct ipstats_mib),
  			  __alignof__(struct ipstats_mib)) < 0)

  		goto err_ip;

  	idev->stats.icmpv6dev = kzalloc(sizeof(struct icmpv6_mib_device),
  					GFP_KERNEL);
  	if (!idev->stats.icmpv6dev)

  		goto err_icmp;

  	idev->stats.icmpv6msgdev = kzalloc(sizeof(struct icmpv6msg_mib_device),
  					   GFP_KERNEL);
  	if (!idev->stats.icmpv6msgdev)

  		goto err_icmpmsg;

  
  	return 0;

  err_icmpmsg:

  	kfree(idev->stats.icmpv6dev);

  err_icmp:

  	snmp_mib_free((void __percpu **)idev->stats.ipv6);

  err_ip:

  	return -ENOMEM;

  }

  static void snmp6_free_dev(struct inet6_dev *idev)

  {

  	kfree(idev->stats.icmpv6msgdev);
  	kfree(idev->stats.icmpv6dev);

  	snmp_mib_free((void __percpu **)idev->stats.ipv6);

  }

  /* Nobody refers to this device, we may destroy it. */
  
  void in6_dev_finish_destroy(struct inet6_dev *idev)
  {
  	struct net_device *dev = idev->dev;

  	WARN_ON(!list_empty(&idev->addr_list));

  	WARN_ON(idev->mc_list != NULL);

  #ifdef NET_REFCNT_DEBUG
  	printk(KERN_DEBUG "in6_dev_finish_destroy: %s
  ", dev ? dev->name : "NIL");
  #endif
  	dev_put(dev);
  	if (!idev->dead) {

  		pr_warning("Freeing alive inet6 device %p
  ", idev);

  		return;
  	}
  	snmp6_free_dev(idev);

  	kfree_rcu(idev, rcu);

  }

  EXPORT_SYMBOL(in6_dev_finish_destroy);

  static struct inet6_dev * ipv6_add_dev(struct net_device *dev)
  {
  	struct inet6_dev *ndev;
  
  	ASSERT_RTNL();
  
  	if (dev->mtu < IPV6_MIN_MTU)
  		return NULL;

  	ndev = kzalloc(sizeof(struct inet6_dev), GFP_KERNEL);

  	if (ndev == NULL)
  		return NULL;

  
  	rwlock_init(&ndev->lock);
  	ndev->dev = dev;

  	INIT_LIST_HEAD(&ndev->addr_list);

  	memcpy(&ndev->cnf, dev_net(dev)->ipv6.devconf_dflt, sizeof(ndev->cnf));

  	ndev->cnf.mtu6 = dev->mtu;
  	ndev->cnf.sysctl = NULL;
  	ndev->nd_parms = neigh_parms_alloc(dev, &nd_tbl);
  	if (ndev->nd_parms == NULL) {
  		kfree(ndev);
  		return NULL;
  	}

  	if (ndev->cnf.forwarding)
  		dev_disable_lro(dev);

  	/* We refer to the device */
  	dev_hold(dev);

  	if (snmp6_alloc_dev(ndev) < 0) {
  		ADBG((KERN_WARNING
  			"%s(): cannot allocate memory for statistics; dev=%s.
  ",

  			__func__, dev->name));

  		neigh_parms_release(&nd_tbl, ndev->nd_parms);

  		dev_put(dev);
  		kfree(ndev);

  		return NULL;
  	}

  	if (snmp6_register_dev(ndev) < 0) {
  		ADBG((KERN_WARNING
  			"%s(): cannot create /proc/net/dev_snmp6/%s
  ",

  			__func__, dev->name));

  		neigh_parms_release(&nd_tbl, ndev->nd_parms);
  		ndev->dead = 1;
  		in6_dev_finish_destroy(ndev);
  		return NULL;
  	}
  
  	/* One reference from device.  We must do this before
  	 * we invoke __ipv6_regen_rndid().
  	 */
  	in6_dev_hold(ndev);

  	if (dev->flags & (IFF_NOARP | IFF_LOOPBACK))
  		ndev->cnf.accept_dad = -1;

  #if defined(CONFIG_IPV6_SIT) || defined(CONFIG_IPV6_SIT_MODULE)
  	if (dev->type == ARPHRD_SIT && (dev->priv_flags & IFF_ISATAP)) {
  		printk(KERN_INFO
  		       "%s: Disabled Multicast RS
  ",
  		       dev->name);
  		ndev->cnf.rtr_solicits = 0;
  	}
  #endif

  #ifdef CONFIG_IPV6_PRIVACY

  	INIT_LIST_HEAD(&ndev->tempaddr_list);

  	setup_timer(&ndev->regen_timer, ipv6_regen_rndid, (unsigned long)ndev);

  	if ((dev->flags&IFF_LOOPBACK) ||
  	    dev->type == ARPHRD_TUNNEL ||

  	    dev->type == ARPHRD_TUNNEL6 ||

  	    dev->type == ARPHRD_SIT ||

  	    dev->type == ARPHRD_NONE) {

  		ndev->cnf.use_tempaddr = -1;
  	} else {
  		in6_dev_hold(ndev);
  		ipv6_regen_rndid((unsigned long) ndev);
  	}

  #endif

  	if (netif_running(dev) && addrconf_qdisc_ok(dev))

  		ndev->if_flags |= IF_READY;

  	ipv6_mc_init_dev(ndev);
  	ndev->tstamp = jiffies;

  	addrconf_sysctl_register(ndev);

  	/* protected by rtnl_lock */

  	rcu_assign_pointer(dev->ip6_ptr, ndev);

  
  	/* Join all-node multicast group */

  	ipv6_dev_mc_inc(dev, &in6addr_linklocal_allnodes);

  	return ndev;
  }

  static struct inet6_dev * ipv6_find_idev(struct net_device *dev)

  {
  	struct inet6_dev *idev;
  
  	ASSERT_RTNL();

  	idev = __in6_dev_get(dev);
  	if (!idev) {
  		idev = ipv6_add_dev(dev);
  		if (!idev)

  			return NULL;
  	}

  	if (dev->flags&IFF_UP)
  		ipv6_mc_up(idev);
  	return idev;
  }
  
  #ifdef CONFIG_SYSCTL
  static void dev_forward_change(struct inet6_dev *idev)
  {
  	struct net_device *dev;
  	struct inet6_ifaddr *ifa;

  
  	if (!idev)
  		return;
  	dev = idev->dev;

  	if (idev->cnf.forwarding)
  		dev_disable_lro(dev);

  	if (dev && (dev->flags & IFF_MULTICAST)) {

  		if (idev->cnf.forwarding)

  			ipv6_dev_mc_inc(dev, &in6addr_linklocal_allrouters);

  		else

  			ipv6_dev_mc_dec(dev, &in6addr_linklocal_allrouters);

  	}

  
  	list_for_each_entry(ifa, &idev->addr_list, if_list) {

  		if (ifa->flags&IFA_F_TENTATIVE)
  			continue;

  		if (idev->cnf.forwarding)
  			addrconf_join_anycast(ifa);
  		else
  			addrconf_leave_anycast(ifa);
  	}
  }

  static void addrconf_forward_change(struct net *net, __s32 newf)

  {
  	struct net_device *dev;
  	struct inet6_dev *idev;

  	rcu_read_lock();
  	for_each_netdev_rcu(net, dev) {

  		idev = __in6_dev_get(dev);
  		if (idev) {

  			int changed = (!idev->cnf.forwarding) ^ (!newf);
  			idev->cnf.forwarding = newf;

  			if (changed)
  				dev_forward_change(idev);
  		}

  	}

  	rcu_read_unlock();

  }

  static int addrconf_fixup_forwarding(struct ctl_table *table, int *p, int old)

  {

  	struct net *net;
  
  	net = (struct net *)table->extra2;

  	if (p == &net->ipv6.devconf_dflt->forwarding)

  		return 0;

  	if (!rtnl_trylock()) {
  		/* Restore the original values before restarting */
  		*p = old;

  		return restart_syscall();

  	}

  	if (p == &net->ipv6.devconf_all->forwarding) {
  		__s32 newf = net->ipv6.devconf_all->forwarding;
  		net->ipv6.devconf_dflt->forwarding = newf;
  		addrconf_forward_change(net, newf);

  	} else if ((!*p) ^ (!old))
  		dev_forward_change((struct inet6_dev *)table->extra1);

  	rtnl_unlock();

  
  	if (*p)

  		rt6_purge_dflt_routers(net);

  	return 1;

  }

  #endif

  /* Nobody refers to this ifaddr, destroy it */

  void inet6_ifa_finish_destroy(struct inet6_ifaddr *ifp)
  {

  	WARN_ON(!hlist_unhashed(&ifp->addr_lst));

  #ifdef NET_REFCNT_DEBUG
  	printk(KERN_DEBUG "inet6_ifa_finish_destroy
  ");
  #endif
  
  	in6_dev_put(ifp->idev);
  
  	if (del_timer(&ifp->timer))

  		pr_notice("Timer is still running, when freeing ifa=%p
  ", ifp);

  	if (ifp->state != INET6_IFADDR_STATE_DEAD) {

  		pr_warning("Freeing alive inet6 address %p
  ", ifp);

  		return;
  	}

  	dst_release(&ifp->rt->dst);

  	kfree_rcu(ifp, rcu);

  }

  static void
  ipv6_link_dev_addr(struct inet6_dev *idev, struct inet6_ifaddr *ifp)
  {

  	struct list_head *p;

  	int ifp_scope = ipv6_addr_src_scope(&ifp->addr);

  
  	/*
  	 * Each device address list is sorted in order of scope -
  	 * global before linklocal.
  	 */

  	list_for_each(p, &idev->addr_list) {
  		struct inet6_ifaddr *ifa
  			= list_entry(p, struct inet6_ifaddr, if_list);

  		if (ifp_scope >= ipv6_addr_src_scope(&ifa->addr))

  			break;
  	}

  	list_add_tail(&ifp->if_list, p);

  }

  static u32 ipv6_addr_hash(const struct in6_addr *addr)

  {

  	/*
  	 * We perform the hash function over the last 64 bits of the address
  	 * This will include the IEEE address token on links that support it.
  	 */

  	return jhash_2words((__force u32)addr->s6_addr32[2],
  			    (__force u32)addr->s6_addr32[3], 0)

  		& (IN6_ADDR_HSIZE - 1);

  }

  /* On success it returns ifp with increased reference count */
  
  static struct inet6_ifaddr *
  ipv6_add_addr(struct inet6_dev *idev, const struct in6_addr *addr, int pfxlen,

  	      int scope, u32 flags)

  {
  	struct inet6_ifaddr *ifa = NULL;
  	struct rt6_info *rt;

  	unsigned int hash;

  	int err = 0;

  	int addr_type = ipv6_addr_type(addr);
  
  	if (addr_type == IPV6_ADDR_ANY ||
  	    addr_type & IPV6_ADDR_MULTICAST ||
  	    (!(idev->dev->flags & IFF_LOOPBACK) &&
  	     addr_type & IPV6_ADDR_LOOPBACK))
  		return ERR_PTR(-EADDRNOTAVAIL);

  	rcu_read_lock_bh();

  	if (idev->dead) {
  		err = -ENODEV;			/*XXX*/
  		goto out2;
  	}

  	if (idev->cnf.disable_ipv6) {

  		err = -EACCES;
  		goto out2;
  	}

  	spin_lock(&addrconf_hash_lock);

  
  	/* Ignore adding duplicate addresses on an interface */

  	if (ipv6_chk_same_addr(dev_net(idev->dev), addr, idev->dev)) {

  		ADBG(("ipv6_add_addr: already assigned
  "));
  		err = -EEXIST;
  		goto out;
  	}

  	ifa = kzalloc(sizeof(struct inet6_ifaddr), GFP_ATOMIC);

  
  	if (ifa == NULL) {
  		ADBG(("ipv6_add_addr: malloc failed
  "));
  		err = -ENOBUFS;
  		goto out;
  	}

  	rt = addrconf_dst_alloc(idev, addr, false);

  	if (IS_ERR(rt)) {
  		err = PTR_ERR(rt);
  		goto out;
  	}

  	ifa->addr = *addr;

  
  	spin_lock_init(&ifa->lock);

  	spin_lock_init(&ifa->state_lock);

  	init_timer(&ifa->timer);

  	INIT_HLIST_NODE(&ifa->addr_lst);

  	ifa->timer.data = (unsigned long) ifa;
  	ifa->scope = scope;
  	ifa->prefix_len = pfxlen;
  	ifa->flags = flags | IFA_F_TENTATIVE;
  	ifa->cstamp = ifa->tstamp = jiffies;

  	ifa->rt = rt;

  	ifa->idev = idev;
  	in6_dev_hold(idev);
  	/* For caller */
  	in6_ifa_hold(ifa);
  
  	/* Add to big hash table */
  	hash = ipv6_addr_hash(addr);

  	hlist_add_head_rcu(&ifa->addr_lst, &inet6_addr_lst[hash]);

  	spin_unlock(&addrconf_hash_lock);

  
  	write_lock(&idev->lock);
  	/* Add to inet6_dev unicast addr list. */

  	ipv6_link_dev_addr(idev, ifa);

  
  #ifdef CONFIG_IPV6_PRIVACY
  	if (ifa->flags&IFA_F_TEMPORARY) {

  		list_add(&ifa->tmp_list, &idev->tempaddr_list);

  		in6_ifa_hold(ifa);
  	}
  #endif

  	in6_ifa_hold(ifa);
  	write_unlock(&idev->lock);
  out2:

  	rcu_read_unlock_bh();

  	if (likely(err == 0))

  		atomic_notifier_call_chain(&inet6addr_chain, NETDEV_UP, ifa);

  	else {
  		kfree(ifa);
  		ifa = ERR_PTR(err);
  	}
  
  	return ifa;
  out:

  	spin_unlock(&addrconf_hash_lock);

  	goto out2;
  }
  
  /* This function wants to get referenced ifp and releases it before return */
  
  static void ipv6_del_addr(struct inet6_ifaddr *ifp)
  {

  	struct inet6_ifaddr *ifa, *ifn;

  	struct inet6_dev *idev = ifp->idev;

  	int state;

  	int deleted = 0, onlink = 0;
  	unsigned long expires = jiffies;

  	spin_lock_bh(&ifp->state_lock);
  	state = ifp->state;

  	ifp->state = INET6_IFADDR_STATE_DEAD;

  	spin_unlock_bh(&ifp->state_lock);
  
  	if (state == INET6_IFADDR_STATE_DEAD)
  		goto out;

  	spin_lock_bh(&addrconf_hash_lock);
  	hlist_del_init_rcu(&ifp->addr_lst);

  	spin_unlock_bh(&addrconf_hash_lock);

  
  	write_lock_bh(&idev->lock);
  #ifdef CONFIG_IPV6_PRIVACY
  	if (ifp->flags&IFA_F_TEMPORARY) {

  		list_del(&ifp->tmp_list);
  		if (ifp->ifpub) {
  			in6_ifa_put(ifp->ifpub);
  			ifp->ifpub = NULL;

  		}

  		__in6_ifa_put(ifp);

  	}
  #endif

  	list_for_each_entry_safe(ifa, ifn, &idev->addr_list, if_list) {

  		if (ifa == ifp) {

  			list_del_init(&ifp->if_list);

  			__in6_ifa_put(ifp);

  			if (!(ifp->flags & IFA_F_PERMANENT) || onlink > 0)
  				break;
  			deleted = 1;

  			continue;

  		} else if (ifp->flags & IFA_F_PERMANENT) {
  			if (ipv6_prefix_equal(&ifa->addr, &ifp->addr,
  					      ifp->prefix_len)) {
  				if (ifa->flags & IFA_F_PERMANENT) {
  					onlink = 1;
  					if (deleted)
  						break;
  				} else {
  					unsigned long lifetime;
  
  					if (!onlink)
  						onlink = -1;
  
  					spin_lock(&ifa->lock);

  
  					lifetime = addrconf_timeout_fixup(ifa->valid_lft, HZ);
  					/*
  					 * Note: Because this address is
  					 * not permanent, lifetime <
  					 * LONG_MAX / HZ here.
  					 */

  					if (time_before(expires,
  							ifa->tstamp + lifetime * HZ))
  						expires = ifa->tstamp + lifetime * HZ;
  					spin_unlock(&ifa->lock);
  				}
  			}
  		}
  	}
  	write_unlock_bh(&idev->lock);

  	addrconf_del_timer(ifp);

  	ipv6_ifa_notify(RTM_DELADDR, ifp);

  	atomic_notifier_call_chain(&inet6addr_chain, NETDEV_DOWN, ifp);

  	/*
  	 * Purge or update corresponding prefix
  	 *
  	 * 1) we don't purge prefix here if address was not permanent.
  	 *    prefix is managed by its own lifetime.
  	 * 2) if there're no addresses, delete prefix.
  	 * 3) if there're still other permanent address(es),
  	 *    corresponding prefix is still permanent.
  	 * 4) otherwise, update prefix lifetime to the
  	 *    longest valid lifetime among the corresponding
  	 *    addresses on the device.
  	 *    Note: subsequent RA will update lifetime.
  	 *
  	 * --yoshfuji
  	 */
  	if ((ifp->flags & IFA_F_PERMANENT) && onlink < 1) {
  		struct in6_addr prefix;
  		struct rt6_info *rt;

  		struct net *net = dev_net(ifp->idev->dev);

  		ipv6_addr_prefix(&prefix, &ifp->addr, ifp->prefix_len);

  		rt = rt6_lookup(net, &prefix, NULL, ifp->idev->dev->ifindex, 1);

  		if (rt && addrconf_is_prefix_route(rt)) {

  			if (onlink == 0) {

  				ip6_del_rt(rt);

  				rt = NULL;
  			} else if (!(rt->rt6i_flags & RTF_EXPIRES)) {

  				rt->dst.expires = expires;

  				rt->rt6i_flags |= RTF_EXPIRES;
  			}
  		}

  		dst_release(&rt->dst);

  	}

  	/* clean up prefsrc entries */
  	rt6_remove_prefsrc(ifp);

  out:

  	in6_ifa_put(ifp);
  }
  
  #ifdef CONFIG_IPV6_PRIVACY
  static int ipv6_create_tempaddr(struct inet6_ifaddr *ifp, struct inet6_ifaddr *ift)
  {
  	struct inet6_dev *idev = ifp->idev;
  	struct in6_addr addr, *tmpaddr;

  	unsigned long tmp_prefered_lft, tmp_valid_lft, tmp_tstamp, age;

  	unsigned long regen_advance;

  	int tmp_plen;
  	int ret = 0;
  	int max_addresses;

  	u32 addr_flags;

  	unsigned long now = jiffies;

  
  	write_lock(&idev->lock);
  	if (ift) {
  		spin_lock_bh(&ift->lock);
  		memcpy(&addr.s6_addr[8], &ift->addr.s6_addr[8], 8);
  		spin_unlock_bh(&ift->lock);
  		tmpaddr = &addr;
  	} else {
  		tmpaddr = NULL;
  	}
  retry:
  	in6_dev_hold(idev);
  	if (idev->cnf.use_tempaddr <= 0) {
  		write_unlock(&idev->lock);
  		printk(KERN_INFO
  			"ipv6_create_tempaddr(): use_tempaddr is disabled.
  ");
  		in6_dev_put(idev);
  		ret = -1;
  		goto out;
  	}
  	spin_lock_bh(&ifp->lock);
  	if (ifp->regen_count++ >= idev->cnf.regen_max_retry) {
  		idev->cnf.use_tempaddr = -1;	/*XXX*/
  		spin_unlock_bh(&ifp->lock);
  		write_unlock(&idev->lock);
  		printk(KERN_WARNING
  			"ipv6_create_tempaddr(): regeneration time exceeded. disabled temporary address support.
  ");
  		in6_dev_put(idev);
  		ret = -1;
  		goto out;
  	}
  	in6_ifa_hold(ifp);
  	memcpy(addr.s6_addr, ifp->addr.s6_addr, 8);
  	if (__ipv6_try_regen_rndid(idev, tmpaddr) < 0) {
  		spin_unlock_bh(&ifp->lock);
  		write_unlock(&idev->lock);
  		printk(KERN_WARNING
  			"ipv6_create_tempaddr(): regeneration of randomized interface id failed.
  ");
  		in6_ifa_put(ifp);
  		in6_dev_put(idev);
  		ret = -1;
  		goto out;
  	}
  	memcpy(&addr.s6_addr[8], idev->rndid, 8);

  	age = (now - ifp->tstamp) / HZ;

  	tmp_valid_lft = min_t(__u32,
  			      ifp->valid_lft,

  			      idev->cnf.temp_valid_lft + age);

  	tmp_prefered_lft = min_t(__u32,
  				 ifp->prefered_lft,

  				 idev->cnf.temp_prefered_lft + age -

  				 idev->cnf.max_desync_factor);

  	tmp_plen = ifp->prefix_len;
  	max_addresses = idev->cnf.max_addresses;

  	tmp_tstamp = ifp->tstamp;
  	spin_unlock_bh(&ifp->lock);

  	regen_advance = idev->cnf.regen_max_retry *
  	                idev->cnf.dad_transmits *
  	                idev->nd_parms->retrans_time / HZ;

  	write_unlock(&idev->lock);

  	/* A temporary address is created only if this calculated Preferred
  	 * Lifetime is greater than REGEN_ADVANCE time units.  In particular,
  	 * an implementation must not create a temporary address with a zero
  	 * Preferred Lifetime.
  	 */
  	if (tmp_prefered_lft <= regen_advance) {
  		in6_ifa_put(ifp);
  		in6_dev_put(idev);
  		ret = -1;
  		goto out;
  	}

  	addr_flags = IFA_F_TEMPORARY;
  	/* set in addrconf_prefix_rcv() */
  	if (ifp->flags & IFA_F_OPTIMISTIC)
  		addr_flags |= IFA_F_OPTIMISTIC;

  	ift = !max_addresses ||

  	      ipv6_count_addresses(idev) < max_addresses ?

  		ipv6_add_addr(idev, &addr, tmp_plen,

  			      ipv6_addr_type(&addr)&IPV6_ADDR_SCOPE_MASK,
  			      addr_flags) : NULL;

  	if (!ift || IS_ERR(ift)) {
  		in6_ifa_put(ifp);
  		in6_dev_put(idev);
  		printk(KERN_INFO
  			"ipv6_create_tempaddr(): retry temporary address regeneration.
  ");
  		tmpaddr = &addr;
  		write_lock(&idev->lock);
  		goto retry;
  	}
  
  	spin_lock_bh(&ift->lock);
  	ift->ifpub = ifp;
  	ift->valid_lft = tmp_valid_lft;
  	ift->prefered_lft = tmp_prefered_lft;

  	ift->cstamp = now;

  	ift->tstamp = tmp_tstamp;
  	spin_unlock_bh(&ift->lock);
  
  	addrconf_dad_start(ift, 0);
  	in6_ifa_put(ift);
  	in6_dev_put(idev);
  out:
  	return ret;
  }
  #endif
  
  /*

   *	Choose an appropriate source address (RFC3484)

   */

  enum {
  	IPV6_SADDR_RULE_INIT = 0,
  	IPV6_SADDR_RULE_LOCAL,
  	IPV6_SADDR_RULE_SCOPE,
  	IPV6_SADDR_RULE_PREFERRED,
  #ifdef CONFIG_IPV6_MIP6
  	IPV6_SADDR_RULE_HOA,
  #endif
  	IPV6_SADDR_RULE_OIF,
  	IPV6_SADDR_RULE_LABEL,
  #ifdef CONFIG_IPV6_PRIVACY
  	IPV6_SADDR_RULE_PRIVACY,
  #endif
  	IPV6_SADDR_RULE_ORCHID,
  	IPV6_SADDR_RULE_PREFIX,
  	IPV6_SADDR_RULE_MAX
  };

  struct ipv6_saddr_score {

  	int			rule;
  	int			addr_type;
  	struct inet6_ifaddr	*ifa;
  	DECLARE_BITMAP(scorebits, IPV6_SADDR_RULE_MAX);
  	int			scopedist;
  	int			matchlen;

  };

  struct ipv6_saddr_dst {

  	const struct in6_addr *addr;

  	int ifindex;
  	int scope;
  	int label;

  	unsigned int prefs;

  };

  static inline int ipv6_saddr_preferred(int type)

  {

  	if (type & (IPV6_ADDR_MAPPED|IPV6_ADDR_COMPATv4|IPV6_ADDR_LOOPBACK))

  		return 1;
  	return 0;

  }

  static int ipv6_get_saddr_eval(struct net *net,
  			       struct ipv6_saddr_score *score,

  			       struct ipv6_saddr_dst *dst,
  			       int i)
  {
  	int ret;
  
  	if (i <= score->rule) {
  		switch (i) {
  		case IPV6_SADDR_RULE_SCOPE:
  			ret = score->scopedist;
  			break;
  		case IPV6_SADDR_RULE_PREFIX:
  			ret = score->matchlen;
  			break;
  		default:
  			ret = !!test_bit(i, score->scorebits);
  		}
  		goto out;
  	}
  
  	switch (i) {
  	case IPV6_SADDR_RULE_INIT:
  		/* Rule 0: remember if hiscore is not ready yet */
  		ret = !!score->ifa;
  		break;
  	case IPV6_SADDR_RULE_LOCAL:
  		/* Rule 1: Prefer same address */
  		ret = ipv6_addr_equal(&score->ifa->addr, dst->addr);
  		break;
  	case IPV6_SADDR_RULE_SCOPE:
  		/* Rule 2: Prefer appropriate scope
  		 *
  		 *      ret
  		 *       ^
  		 *    -1 |  d 15
  		 *    ---+--+-+---> scope
  		 *       |
  		 *       |             d is scope of the destination.
  		 *  B-d  |  \
  		 *       |   \      <- smaller scope is better if
  		 *  B-15 |    \        if scope is enough for destinaion.
  		 *       |             ret = B - scope (-1 <= scope >= d <= 15).
  		 * d-C-1 | /
  		 *       |/         <- greater is better
  		 *   -C  /             if scope is not enough for destination.
  		 *      /|             ret = scope - C (-1 <= d < scope <= 15).
  		 *
  		 * d - C - 1 < B -15 (for all -1 <= d <= 15).
  		 * C > d + 14 - B >= 15 + 14 - B = 29 - B.
  		 * Assume B = 0 and we get C > 29.
  		 */
  		ret = __ipv6_addr_src_scope(score->addr_type);
  		if (ret >= dst->scope)
  			ret = -ret;
  		else
  			ret -= 128;	/* 30 is enough */
  		score->scopedist = ret;
  		break;
  	case IPV6_SADDR_RULE_PREFERRED:
  		/* Rule 3: Avoid deprecated and optimistic addresses */
  		ret = ipv6_saddr_preferred(score->addr_type) ||
  		      !(score->ifa->flags & (IFA_F_DEPRECATED|IFA_F_OPTIMISTIC));
  		break;
  #ifdef CONFIG_IPV6_MIP6
  	case IPV6_SADDR_RULE_HOA:

  	    {

  		/* Rule 4: Prefer home address */

  		int prefhome = !(dst->prefs & IPV6_PREFER_SRC_COA);
  		ret = !(score->ifa->flags & IFA_F_HOMEADDRESS) ^ prefhome;

  		break;

  	    }

  #endif
  	case IPV6_SADDR_RULE_OIF:
  		/* Rule 5: Prefer outgoing interface */
  		ret = (!dst->ifindex ||
  		       dst->ifindex == score->ifa->idev->dev->ifindex);
  		break;
  	case IPV6_SADDR_RULE_LABEL:
  		/* Rule 6: Prefer matching label */

  		ret = ipv6_addr_label(net,
  				      &score->ifa->addr, score->addr_type,

  				      score->ifa->idev->dev->ifindex) == dst->label;
  		break;
  #ifdef CONFIG_IPV6_PRIVACY
  	case IPV6_SADDR_RULE_PRIVACY:

  	    {

  		/* Rule 7: Prefer public address

  		 * Note: prefer temporary address if use_tempaddr >= 2

  		 */

  		int preftmp = dst->prefs & (IPV6_PREFER_SRC_PUBLIC|IPV6_PREFER_SRC_TMP) ?
  				!!(dst->prefs & IPV6_PREFER_SRC_TMP) :
  				score->ifa->idev->cnf.use_tempaddr >= 2;
  		ret = (!(score->ifa->flags & IFA_F_TEMPORARY)) ^ preftmp;

  		break;

  	    }

  #endif
  	case IPV6_SADDR_RULE_ORCHID:
  		/* Rule 8-: Prefer ORCHID vs ORCHID or
  		 *	    non-ORCHID vs non-ORCHID
  		 */
  		ret = !(ipv6_addr_orchid(&score->ifa->addr) ^
  			ipv6_addr_orchid(dst->addr));
  		break;
  	case IPV6_SADDR_RULE_PREFIX:
  		/* Rule 8: Use longest matching prefix */
  		score->matchlen = ret = ipv6_addr_diff(&score->ifa->addr,
  						       dst->addr);
  		break;
  	default:
  		ret = 0;
  	}
  
  	if (ret)
  		__set_bit(i, score->scorebits);
  	score->rule = i;
  out:
  	return ret;
  }

  int ipv6_dev_get_saddr(struct net *net, struct net_device *dst_dev,

  		       const struct in6_addr *daddr, unsigned int prefs,

  		       struct in6_addr *saddr)

  {

  	struct ipv6_saddr_score scores[2],
  				*score = &scores[0], *hiscore = &scores[1];

  	struct ipv6_saddr_dst dst;

  	struct net_device *dev;

  	int dst_type;

  	dst_type = __ipv6_addr_type(daddr);
  	dst.addr = daddr;
  	dst.ifindex = dst_dev ? dst_dev->ifindex : 0;
  	dst.scope = __ipv6_addr_src_scope(dst_type);

  	dst.label = ipv6_addr_label(net, daddr, dst_type, dst.ifindex);

  	dst.prefs = prefs;

  
  	hiscore->rule = -1;
  	hiscore->ifa = NULL;

  	rcu_read_lock();

  	for_each_netdev_rcu(net, dev) {

  		struct inet6_dev *idev;

  		/* Candidate Source Address (section 4)

  		 *  - multicast and link-local destination address,
  		 *    the set of candidate source address MUST only
  		 *    include addresses assigned to interfaces
  		 *    belonging to the same link as the outgoing
  		 *    interface.
  		 * (- For site-local destination addresses, the
  		 *    set of candidate source addresses MUST only
  		 *    include addresses assigned to interfaces
  		 *    belonging to the same site as the outgoing
  		 *    interface.)
  		 */

  		if (((dst_type & IPV6_ADDR_MULTICAST) ||
  		     dst.scope <= IPV6_ADDR_SCOPE_LINKLOCAL) &&
  		    dst.ifindex && dev->ifindex != dst.ifindex)

  			continue;

  		idev = __in6_dev_get(dev);

  		if (!idev)
  			continue;
  
  		read_lock_bh(&idev->lock);

  		list_for_each_entry(score->ifa, &idev->addr_list, if_list) {

  			int i;

  			/*

  			 * - Tentative Address (RFC2462 section 5.4)
  			 *  - A tentative address is not considered
  			 *    "assigned to an interface" in the traditional

  			 *    sense, unless it is also flagged as optimistic.

  			 * - Candidate Source Address (section 4)

  			 *  - In any case, anycast addresses, multicast
  			 *    addresses, and the unspecified address MUST
  			 *    NOT be included in a candidate set.
  			 */

  			if ((score->ifa->flags & IFA_F_TENTATIVE) &&
  			    (!(score->ifa->flags & IFA_F_OPTIMISTIC)))

  				continue;

  
  			score->addr_type = __ipv6_addr_type(&score->ifa->addr);
  
  			if (unlikely(score->addr_type == IPV6_ADDR_ANY ||
  				     score->addr_type & IPV6_ADDR_MULTICAST)) {

  				LIMIT_NETDEBUG(KERN_DEBUG

  					       "ADDRCONF: unspecified / multicast address "

  					       "assigned as unicast address on %s",
  					       dev->name);
  				continue;
  			}

  			score->rule = -1;
  			bitmap_zero(score->scorebits, IPV6_SADDR_RULE_MAX);
  
  			for (i = 0; i < IPV6_SADDR_RULE_MAX; i++) {
  				int minihiscore, miniscore;

  				minihiscore = ipv6_get_saddr_eval(net, hiscore, &dst, i);
  				miniscore = ipv6_get_saddr_eval(net, score, &dst, i);

  
  				if (minihiscore > miniscore) {
  					if (i == IPV6_SADDR_RULE_SCOPE &&
  					    score->scopedist > 0) {
  						/*
  						 * special case:
  						 * each remaining entry
  						 * has too small (not enough)
  						 * scope, because ifa entries
  						 * are sorted by their scope
  						 * values.
  						 */
  						goto try_nextdev;
  					}
  					break;
  				} else if (minihiscore < miniscore) {

  					if (hiscore->ifa)
  						in6_ifa_put(hiscore->ifa);
  
  					in6_ifa_hold(score->ifa);

  					swap(hiscore, score);

  
  					/* restore our iterator */
  					score->ifa = hiscore->ifa;
  
  					break;

  				}

  			}

  		}

  try_nextdev:

  		read_unlock_bh(&idev->lock);

  	}

  	rcu_read_unlock();

  	if (!hiscore->ifa)

  		return -EADDRNOTAVAIL;

  	*saddr = hiscore->ifa->addr;

  	in6_ifa_put(hiscore->ifa);

  	return 0;

  }

  EXPORT_SYMBOL(ipv6_dev_get_saddr);

  int ipv6_get_lladdr(struct net_device *dev, struct in6_addr *addr,
  		    unsigned char banned_flags)

  {
  	struct inet6_dev *idev;
  	int err = -EADDRNOTAVAIL;

  	rcu_read_lock();

  	idev = __in6_dev_get(dev);
  	if (idev) {

  		struct inet6_ifaddr *ifp;
  
  		read_lock_bh(&idev->lock);

  		list_for_each_entry(ifp, &idev->addr_list, if_list) {
  			if (ifp->scope == IFA_LINK &&
  			    !(ifp->flags & banned_flags)) {

  				*addr = ifp->addr;

  				err = 0;
  				break;
  			}
  		}
  		read_unlock_bh(&idev->lock);
  	}

  	rcu_read_unlock();

  	return err;
  }
  
  static int ipv6_count_addresses(struct inet6_dev *idev)
  {
  	int cnt = 0;
  	struct inet6_ifaddr *ifp;
  
  	read_lock_bh(&idev->lock);

  	list_for_each_entry(ifp, &idev->addr_list, if_list)

  		cnt++;
  	read_unlock_bh(&idev->lock);
  	return cnt;
  }

  int ipv6_chk_addr(struct net *net, const struct in6_addr *addr,

  		  struct net_device *dev, int strict)

  {

  	struct inet6_ifaddr *ifp;

  	struct hlist_node *node;

  	unsigned int hash = ipv6_addr_hash(addr);

  	rcu_read_lock_bh();
  	hlist_for_each_entry_rcu(ifp, node, &inet6_addr_lst[hash], addr_lst) {

  		if (!net_eq(dev_net(ifp->idev->dev), net))

  			continue;

  		if (ipv6_addr_equal(&ifp->addr, addr) &&

  		    !(ifp->flags&IFA_F_TENTATIVE) &&
  		    (dev == NULL || ifp->idev->dev == dev ||
  		     !(ifp->scope&(IFA_LINK|IFA_HOST) || strict))) {
  			rcu_read_unlock_bh();
  			return 1;

  		}
  	}

  	rcu_read_unlock_bh();
  	return 0;

  }

  EXPORT_SYMBOL(ipv6_chk_addr);

  static bool ipv6_chk_same_addr(struct net *net, const struct in6_addr *addr,
  			       struct net_device *dev)

  {

  	unsigned int hash = ipv6_addr_hash(addr);

  	struct inet6_ifaddr *ifp;
  	struct hlist_node *node;

  	hlist_for_each_entry(ifp, node, &inet6_addr_lst[hash], addr_lst) {

  		if (!net_eq(dev_net(ifp->idev->dev), net))

  			continue;

  		if (ipv6_addr_equal(&ifp->addr, addr)) {
  			if (dev == NULL || ifp->idev->dev == dev)

  				return true;

  		}
  	}

  	return false;

  }

  int ipv6_chk_prefix(const struct in6_addr *addr, struct net_device *dev)

  {
  	struct inet6_dev *idev;
  	struct inet6_ifaddr *ifa;
  	int	onlink;
  
  	onlink = 0;
  	rcu_read_lock();
  	idev = __in6_dev_get(dev);
  	if (idev) {
  		read_lock_bh(&idev->lock);

  		list_for_each_entry(ifa, &idev->addr_list, if_list) {

  			onlink = ipv6_prefix_equal(addr, &ifa->addr,
  						   ifa->prefix_len);
  			if (onlink)
  				break;
  		}
  		read_unlock_bh(&idev->lock);
  	}
  	rcu_read_unlock();
  	return onlink;
  }
  
  EXPORT_SYMBOL(ipv6_chk_prefix);

  struct inet6_ifaddr *ipv6_get_ifaddr(struct net *net, const struct in6_addr *addr,

  				     struct net_device *dev, int strict)

  {

  	struct inet6_ifaddr *ifp, *result = NULL;

  	unsigned int hash = ipv6_addr_hash(addr);

  	struct hlist_node *node;

  	rcu_read_lock_bh();

  	hlist_for_each_entry_rcu_bh(ifp, node, &inet6_addr_lst[hash], addr_lst) {

  		if (!net_eq(dev_net(ifp->idev->dev), net))

  			continue;

  		if (ipv6_addr_equal(&ifp->addr, addr)) {
  			if (dev == NULL || ifp->idev->dev == dev ||
  			    !(ifp->scope&(IFA_LINK|IFA_HOST) || strict)) {

  				result = ifp;

  				in6_ifa_hold(ifp);
  				break;
  			}
  		}
  	}

  	rcu_read_unlock_bh();

  	return result;

  }

  /* Gets referenced address, destroys ifaddr */

  static void addrconf_dad_stop(struct inet6_ifaddr *ifp, int dad_failed)

  {

  	if (ifp->flags&IFA_F_PERMANENT) {
  		spin_lock_bh(&ifp->lock);
  		addrconf_del_timer(ifp);
  		ifp->flags |= IFA_F_TENTATIVE;

  		if (dad_failed)
  			ifp->flags |= IFA_F_DADFAILED;

  		spin_unlock_bh(&ifp->lock);

  		if (dad_failed)
  			ipv6_ifa_notify(0, ifp);

  		in6_ifa_put(ifp);
  #ifdef CONFIG_IPV6_PRIVACY
  	} else if (ifp->flags&IFA_F_TEMPORARY) {
  		struct inet6_ifaddr *ifpub;
  		spin_lock_bh(&ifp->lock);
  		ifpub = ifp->ifpub;
  		if (ifpub) {
  			in6_ifa_hold(ifpub);
  			spin_unlock_bh(&ifp->lock);
  			ipv6_create_tempaddr(ifpub, ifp);
  			in6_ifa_put(ifpub);
  		} else {
  			spin_unlock_bh(&ifp->lock);
  		}
  		ipv6_del_addr(ifp);
  #endif
  	} else
  		ipv6_del_addr(ifp);
  }

  static int addrconf_dad_end(struct inet6_ifaddr *ifp)
  {
  	int err = -ENOENT;
  
  	spin_lock(&ifp->state_lock);
  	if (ifp->state == INET6_IFADDR_STATE_DAD) {
  		ifp->state = INET6_IFADDR_STATE_POSTDAD;
  		err = 0;
  	}
  	spin_unlock(&ifp->state_lock);
  
  	return err;
  }

  void addrconf_dad_failure(struct inet6_ifaddr *ifp)
  {

  	struct inet6_dev *idev = ifp->idev;

  	if (addrconf_dad_end(ifp)) {
  		in6_ifa_put(ifp);

  		return;

  	}

  	if (net_ratelimit())

  		printk(KERN_INFO "%s: IPv6 duplicate address %pI6c detected!
  ",
  			ifp->idev->dev->name, &ifp->addr);

  	if (idev->cnf.accept_dad > 1 && !idev->cnf.disable_ipv6) {
  		struct in6_addr addr;
  
  		addr.s6_addr32[0] = htonl(0xfe800000);
  		addr.s6_addr32[1] = 0;
  
  		if (!ipv6_generate_eui64(addr.s6_addr + 8, idev->dev) &&
  		    ipv6_addr_equal(&ifp->addr, &addr)) {
  			/* DAD failed for link-local based on MAC address */
  			idev->cnf.disable_ipv6 = 1;

  
  			printk(KERN_INFO "%s: IPv6 being disabled!
  ",
  				ifp->idev->dev->name);

  		}
  	}

  	addrconf_dad_stop(ifp, 1);

  }

  
  /* Join to solicited addr multicast group. */

  void addrconf_join_solict(struct net_device *dev, const struct in6_addr *addr)

  {
  	struct in6_addr maddr;
  
  	if (dev->flags&(IFF_LOOPBACK|IFF_NOARP))
  		return;
  
  	addrconf_addr_solict_mult(addr, &maddr);
  	ipv6_dev_mc_inc(dev, &maddr);
  }

  void addrconf_leave_solict(struct inet6_dev *idev, const struct in6_addr *addr)

  {
  	struct in6_addr maddr;
  
  	if (idev->dev->flags&(IFF_LOOPBACK|IFF_NOARP))
  		return;
  
  	addrconf_addr_solict_mult(addr, &maddr);
  	__ipv6_dev_mc_dec(idev, &maddr);
  }

  static void addrconf_join_anycast(struct inet6_ifaddr *ifp)

  {
  	struct in6_addr addr;

  	if (ifp->prefix_len == 127) /* RFC 6164 */
  		return;

  	ipv6_addr_prefix(&addr, &ifp->addr, ifp->prefix_len);
  	if (ipv6_addr_any(&addr))
  		return;
  	ipv6_dev_ac_inc(ifp->idev->dev, &addr);
  }

  static void addrconf_leave_anycast(struct inet6_ifaddr *ifp)

  {
  	struct in6_addr addr;

  	if (ifp->prefix_len == 127) /* RFC 6164 */
  		return;

  	ipv6_addr_prefix(&addr, &ifp->addr, ifp->prefix_len);
  	if (ipv6_addr_any(&addr))
  		return;
  	__ipv6_dev_ac_dec(ifp->idev, &addr);
  }

  static int addrconf_ifid_eui48(u8 *eui, struct net_device *dev)
  {
  	if (dev->addr_len != ETH_ALEN)
  		return -1;
  	memcpy(eui, dev->dev_addr, 3);
  	memcpy(eui + 5, dev->dev_addr + 3, 3);
  
  	/*
  	 * The zSeries OSA network cards can be shared among various
  	 * OS instances, but the OSA cards have only one MAC address.
  	 * This leads to duplicate address conflicts in conjunction
  	 * with IPv6 if more than one instance uses the same card.
  	 *
  	 * The driver for these cards can deliver a unique 16-bit
  	 * identifier for each instance sharing the same card.  It is
  	 * placed instead of 0xFFFE in the interface identifier.  The
  	 * "u" bit of the interface identifier is not inverted in this
  	 * case.  Hence the resulting interface identifier has local
  	 * scope according to RFC2373.
  	 */
  	if (dev->dev_id) {
  		eui[3] = (dev->dev_id >> 8) & 0xFF;
  		eui[4] = dev->dev_id & 0xFF;
  	} else {
  		eui[3] = 0xFF;
  		eui[4] = 0xFE;
  		eui[0] ^= 2;
  	}
  	return 0;
  }
  
  static int addrconf_ifid_arcnet(u8 *eui, struct net_device *dev)
  {
  	/* XXX: inherit EUI-64 from other interface -- yoshfuji */
  	if (dev->addr_len != ARCNET_ALEN)
  		return -1;
  	memset(eui, 0, 7);
  	eui[7] = *(u8*)dev->dev_addr;
  	return 0;
  }
  
  static int addrconf_ifid_infiniband(u8 *eui, struct net_device *dev)
  {
  	if (dev->addr_len != INFINIBAND_ALEN)
  		return -1;
  	memcpy(eui, dev->dev_addr + 12, 8);
  	eui[0] |= 2;
  	return 0;
  }

  static int __ipv6_isatap_ifid(u8 *eui, __be32 addr)

  {

  	if (addr == 0)
  		return -1;

  	eui[0] = (ipv4_is_zeronet(addr) || ipv4_is_private_10(addr) ||
  		  ipv4_is_loopback(addr) || ipv4_is_linklocal_169(addr) ||
  		  ipv4_is_private_172(addr) || ipv4_is_test_192(addr) ||
  		  ipv4_is_anycast_6to4(addr) || ipv4_is_private_192(addr) ||
  		  ipv4_is_test_198(addr) || ipv4_is_multicast(addr) ||
  		  ipv4_is_lbcast(addr)) ? 0x00 : 0x02;
  	eui[1] = 0;
  	eui[2] = 0x5E;
  	eui[3] = 0xFE;
  	memcpy(eui + 4, &addr, 4);
  	return 0;
  }

  
  static int addrconf_ifid_sit(u8 *eui, struct net_device *dev)
  {
  	if (dev->priv_flags & IFF_ISATAP)
  		return __ipv6_isatap_ifid(eui, *(__be32 *)dev->dev_addr);
  	return -1;
  }

  static int addrconf_ifid_gre(u8 *eui, struct net_device *dev)
  {
  	return __ipv6_isatap_ifid(eui, *(__be32 *)dev->dev_addr);
  }

  static int ipv6_generate_eui64(u8 *eui, struct net_device *dev)
  {
  	switch (dev->type) {
  	case ARPHRD_ETHER:
  	case ARPHRD_FDDI:
  	case ARPHRD_IEEE802_TR:

  		return addrconf_ifid_eui48(eui, dev);

  	case ARPHRD_ARCNET:

  		return addrconf_ifid_arcnet(eui, dev);

  	case ARPHRD_INFINIBAND:

  		return addrconf_ifid_infiniband(eui, dev);

  	case ARPHRD_SIT:

  		return addrconf_ifid_sit(eui, dev);

  	case ARPHRD_IPGRE:
  		return addrconf_ifid_gre(eui, dev);

  	}
  	return -1;
  }
  
  static int ipv6_inherit_eui64(u8 *eui, struct inet6_dev *idev)
  {
  	int err = -1;
  	struct inet6_ifaddr *ifp;
  
  	read_lock_bh(&idev->lock);

  	list_for_each_entry(ifp, &idev->addr_list, if_list) {

  		if (ifp->scope == IFA_LINK && !(ifp->flags&IFA_F_TENTATIVE)) {
  			memcpy(eui, ifp->addr.s6_addr+8, 8);
  			err = 0;
  			break;
  		}
  	}
  	read_unlock_bh(&idev->lock);
  	return err;
  }
  
  #ifdef CONFIG_IPV6_PRIVACY
  /* (re)generation of randomized interface identifier (RFC 3041 3.2, 3.5) */
  static int __ipv6_regen_rndid(struct inet6_dev *idev)
  {

  regen:

  	get_random_bytes(idev->rndid, sizeof(idev->rndid));

  	idev->rndid[0] &= ~0x02;

  
  	/*
  	 * <draft-ietf-ipngwg-temp-addresses-v2-00.txt>:
  	 * check if generated address is not inappropriate
  	 *
  	 *  - Reserved subnet anycast (RFC 2526)
  	 *	11111101 11....11 1xxxxxxx

  	 *  - ISATAP (RFC4214) 6.1

  	 *	00-00-5E-FE-xx-xx-xx-xx
  	 *  - value 0
  	 *  - XXX: already assigned to an address on the device
  	 */

  	if (idev->rndid[0] == 0xfd &&

  	    (idev->rndid[1]&idev->rndid[2]&idev->rndid[3]&idev->rndid[4]&idev->rndid[5]&idev->rndid[6]) == 0xff &&
  	    (idev->rndid[7]&0x80))
  		goto regen;
  	if ((idev->rndid[0]|idev->rndid[1]) == 0) {
  		if (idev->rndid[2] == 0x5e && idev->rndid[3] == 0xfe)
  			goto regen;
  		if ((idev->rndid[2]|idev->rndid[3]|idev->rndid[4]|idev->rndid[5]|idev->rndid[6]|idev->rndid[7]) == 0x00)
  			goto regen;
  	}
  
  	return 0;
  }
  
  static void ipv6_regen_rndid(unsigned long data)
  {
  	struct inet6_dev *idev = (struct inet6_dev *) data;
  	unsigned long expires;

  	rcu_read_lock_bh();

  	write_lock_bh(&idev->lock);
  
  	if (idev->dead)
  		goto out;
  
  	if (__ipv6_regen_rndid(idev) < 0)
  		goto out;

  	expires = jiffies +

  		idev->cnf.temp_prefered_lft * HZ -

  		idev->cnf.regen_max_retry * idev->cnf.dad_transmits * idev->nd_parms->retrans_time -
  		idev->cnf.max_desync_factor * HZ;

  	if (time_before(expires, jiffies)) {
  		printk(KERN_WARNING
  			"ipv6_regen_rndid(): too short regeneration interval; timer disabled for %s.
  ",
  			idev->dev->name);
  		goto out;
  	}
  
  	if (!mod_timer(&idev->regen_timer, expires))
  		in6_dev_hold(idev);
  
  out:
  	write_unlock_bh(&idev->lock);

  	rcu_read_unlock_bh();

  	in6_dev_put(idev);
  }
  
  static int __ipv6_try_regen_rndid(struct inet6_dev *idev, struct in6_addr *tmpaddr) {
  	int ret = 0;
  
  	if (tmpaddr && memcmp(idev->rndid, &tmpaddr->s6_addr[8], 8) == 0)
  		ret = __ipv6_regen_rndid(idev);
  	return ret;
  }
  #endif
  
  /*
   *	Add prefix route.
   */
  
  static void
  addrconf_prefix_route(struct in6_addr *pfx, int plen, struct net_device *dev,

  		      unsigned long expires, u32 flags)

  {

  	struct fib6_config cfg = {
  		.fc_table = RT6_TABLE_PREFIX,
  		.fc_metric = IP6_RT_PRIO_ADDRCONF,
  		.fc_ifindex = dev->ifindex,
  		.fc_expires = expires,
  		.fc_dst_len = plen,
  		.fc_flags = RTF_UP | flags,

  		.fc_nlinfo.nl_net = dev_net(dev),

  		.fc_protocol = RTPROT_KERNEL,

  	};

  	cfg.fc_dst = *pfx;

  
  	/* Prevent useless cloning on PtP SIT.
  	   This thing is done here expecting that the whole
  	   class of non-broadcast devices need not cloning.
  	 */

  #if defined(CONFIG_IPV6_SIT) || defined(CONFIG_IPV6_SIT_MODULE)

  	if (dev->type == ARPHRD_SIT && (dev->flags & IFF_POINTOPOINT))
  		cfg.fc_flags |= RTF_NONEXTHOP;

  #endif

  	ip6_route_add(&cfg);

  }

  
  static struct rt6_info *addrconf_get_prefix_route(const struct in6_addr *pfx,
  						  int plen,
  						  const struct net_device *dev,
  						  u32 flags, u32 noflags)
  {
  	struct fib6_node *fn;
  	struct rt6_info *rt = NULL;
  	struct fib6_table *table;
  
  	table = fib6_get_table(dev_net(dev), RT6_TABLE_PREFIX);
  	if (table == NULL)
  		return NULL;
  
  	write_lock_bh(&table->tb6_lock);
  	fn = fib6_locate(&table->tb6_root, pfx, plen, NULL, 0);
  	if (!fn)
  		goto out;
  	for (rt = fn->leaf; rt; rt = rt->dst.rt6_next) {

  		if (rt->dst.dev->ifindex != dev->ifindex)

  			continue;
  		if ((rt->rt6i_flags & flags) != flags)
  			continue;
  		if ((noflags != 0) && ((rt->rt6i_flags & flags) != 0))
  			continue;
  		dst_hold(&rt->dst);
  		break;
  	}
  out:
  	write_unlock_bh(&table->tb6_lock);
  	return rt;
  }

  /* Create "default" multicast route to the interface */
  
  static void addrconf_add_mroute(struct net_device *dev)
  {

  	struct fib6_config cfg = {
  		.fc_table = RT6_TABLE_LOCAL,
  		.fc_metric = IP6_RT_PRIO_ADDRCONF,
  		.fc_ifindex = dev->ifindex,
  		.fc_dst_len = 8,
  		.fc_flags = RTF_UP,

  		.fc_nlinfo.nl_net = dev_net(dev),

  	};
  
  	ipv6_addr_set(&cfg.fc_dst, htonl(0xFF000000), 0, 0, 0);
  
  	ip6_route_add(&cfg);

  }

  #if defined(CONFIG_IPV6_SIT) || defined(CONFIG_IPV6_SIT_MODULE)

  static void sit_route_add(struct net_device *dev)
  {

  	struct fib6_config cfg = {
  		.fc_table = RT6_TABLE_MAIN,
  		.fc_metric = IP6_RT_PRIO_ADDRCONF,
  		.fc_ifindex = dev->ifindex,
  		.fc_dst_len = 96,
  		.fc_flags = RTF_UP | RTF_NONEXTHOP,

  		.fc_nlinfo.nl_net = dev_net(dev),

  	};

  
  	/* prefix length - 96 bits "::d.d.d.d" */

  	ip6_route_add(&cfg);

  }

  #endif

  
  static void addrconf_add_lroute(struct net_device *dev)
  {
  	struct in6_addr addr;
  
  	ipv6_addr_set(&addr,  htonl(0xFE800000), 0, 0, 0);
  	addrconf_prefix_route(&addr, 64, dev, 0, 0);
  }
  
  static struct inet6_dev *addrconf_add_dev(struct net_device *dev)
  {
  	struct inet6_dev *idev;
  
  	ASSERT_RTNL();

  	idev = ipv6_find_idev(dev);
  	if (!idev)

  		return ERR_PTR(-ENOBUFS);
  
  	if (idev->cnf.disable_ipv6)
  		return ERR_PTR(-EACCES);

  
  	/* Add default multicast route */

  	if (!(dev->flags & IFF_LOOPBACK))
  		addrconf_add_mroute(dev);

  
  	/* Add link local route */
  	addrconf_add_lroute(dev);
  	return idev;
  }

  void addrconf_prefix_rcv(struct net_device *dev, u8 *opt, int len, bool sllao)

  {
  	struct prefix_info *pinfo;
  	__u32 valid_lft;
  	__u32 prefered_lft;
  	int addr_type;

  	struct inet6_dev *in6_dev;

  	struct net *net = dev_net(dev);

  
  	pinfo = (struct prefix_info *) opt;

  	if (len < sizeof(struct prefix_info)) {
  		ADBG(("addrconf: prefix option too short
  "));
  		return;
  	}

  	/*
  	 *	Validation checks ([ADDRCONF], page 19)
  	 */
  
  	addr_type = ipv6_addr_type(&pinfo->prefix);
  
  	if (addr_type & (IPV6_ADDR_MULTICAST|IPV6_ADDR_LINKLOCAL))
  		return;
  
  	valid_lft = ntohl(pinfo->valid);
  	prefered_lft = ntohl(pinfo->prefered);
  
  	if (prefered_lft > valid_lft) {
  		if (net_ratelimit())
  			printk(KERN_WARNING "addrconf: prefix option has invalid lifetime
  ");
  		return;
  	}
  
  	in6_dev = in6_dev_get(dev);
  
  	if (in6_dev == NULL) {
  		if (net_ratelimit())
  			printk(KERN_DEBUG "addrconf: device %s not configured
  ", dev->name);
  		return;
  	}
  
  	/*
  	 *	Two things going on here:
  	 *	1) Add routes for on-link prefixes
  	 *	2) Configure prefixes with the auto flag set
  	 */

  	if (pinfo->onlink) {
  		struct rt6_info *rt;
  		unsigned long rt_expires;

  		/* Avoid arithmetic overflow. Really, we could
  		 * save rt_expires in seconds, likely valid_lft,
  		 * but it would require division in fib gc, that it
  		 * not good.
  		 */

  		if (HZ > USER_HZ)
  			rt_expires = addrconf_timeout_fixup(valid_lft, HZ);
  		else
  			rt_expires = addrconf_timeout_fixup(valid_lft, USER_HZ);

  		if (addrconf_finite_timeout(rt_expires))
  			rt_expires *= HZ;

  		rt = addrconf_get_prefix_route(&pinfo->prefix,
  					       pinfo->prefix_len,
  					       dev,
  					       RTF_ADDRCONF | RTF_PREFIX_RT,
  					       RTF_GATEWAY | RTF_DEFAULT);

  		if (rt) {

  			/* Autoconf prefix route */
  			if (valid_lft == 0) {
  				ip6_del_rt(rt);
  				rt = NULL;

  			} else if (addrconf_finite_timeout(rt_expires)) {

  				/* not infinity */

  				rt->dst.expires = jiffies + rt_expires;

  				rt->rt6i_flags |= RTF_EXPIRES;
  			} else {
  				rt->rt6i_flags &= ~RTF_EXPIRES;

  				rt->dst.expires = 0;

  			}
  		} else if (valid_lft) {

  			clock_t expires = 0;

  			int flags = RTF_ADDRCONF | RTF_PREFIX_RT;
  			if (addrconf_finite_timeout(rt_expires)) {

  				/* not infinity */
  				flags |= RTF_EXPIRES;
  				expires = jiffies_to_clock_t(rt_expires);
  			}

  			addrconf_prefix_route(&pinfo->prefix, pinfo->prefix_len,