xref: /titanic_44/usr/src/uts/common/inet/ip/ip_ire.c (revision 61491074b8a9b27fe22ce320f874f909877c6d91)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 /*
22  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
23  * Use is subject to license terms.
24  */
25 /* Copyright (c) 1990 Mentat Inc. */
26 
27 /*
28  * This file contains routines that manipulate Internet Routing Entries (IREs).
29  */
30 
31 #include <sys/types.h>
32 #include <sys/stream.h>
33 #include <sys/stropts.h>
34 #include <sys/strsun.h>
35 #include <sys/strsubr.h>
36 #include <sys/ddi.h>
37 #include <sys/cmn_err.h>
38 #include <sys/policy.h>
39 
40 #include <sys/systm.h>
41 #include <sys/kmem.h>
42 #include <sys/param.h>
43 #include <sys/socket.h>
44 #include <net/if.h>
45 #include <net/route.h>
46 #include <netinet/in.h>
47 #include <net/if_dl.h>
48 #include <netinet/ip6.h>
49 #include <netinet/icmp6.h>
50 
51 #include <inet/common.h>
52 #include <inet/mi.h>
53 #include <inet/ip.h>
54 #include <inet/ip6.h>
55 #include <inet/ip_ndp.h>
56 #include <inet/arp.h>
57 #include <inet/ip_if.h>
58 #include <inet/ip_ire.h>
59 #include <inet/ip_ftable.h>
60 #include <inet/ip_rts.h>
61 #include <inet/nd.h>
62 
63 #include <net/pfkeyv2.h>
64 #include <inet/ipsec_info.h>
65 #include <inet/sadb.h>
66 #include <inet/tcp.h>
67 #include <inet/ipclassifier.h>
68 #include <sys/zone.h>
69 #include <sys/cpuvar.h>
70 
71 #include <sys/tsol/label.h>
72 #include <sys/tsol/tnet.h>
73 
74 struct kmem_cache *rt_entry_cache;
75 
76 /*
77  * Synchronization notes:
78  *
79  * The fields of the ire_t struct are protected in the following way :
80  *
81  * ire_next/ire_ptpn
82  *
83  *	- bucket lock of the respective tables (cache or forwarding tables).
84  *
85  * ire_mp, ire_rfq, ire_stq, ire_u *except* ire_gateway_addr[v6], ire_mask,
86  * ire_type, ire_create_time, ire_masklen, ire_ipversion, ire_flags, ire_ipif,
87  * ire_ihandle, ire_phandle, ire_nce, ire_bucket, ire_in_ill, ire_in_src_addr
88  *
89  *	- Set in ire_create_v4/v6 and never changes after that. Thus,
90  *	  we don't need a lock whenever these fields are accessed.
91  *
92  *	- ire_bucket and ire_masklen (also set in ire_create) is set in
93  *        ire_add_v4/ire_add_v6 before inserting in the bucket and never
94  *        changes after that. Thus we don't need a lock whenever these
95  *	  fields are accessed.
96  *
97  * ire_gateway_addr_v4[v6]
98  *
99  *	- ire_gateway_addr_v4[v6] is set during ire_create and later modified
100  *	  by rts_setgwr[v6]. As ire_gateway_addr is a uint32_t, updates to
101  *	  it assumed to be atomic and hence the other parts of the code
102  *	  does not use any locks. ire_gateway_addr_v6 updates are not atomic
103  *	  and hence any access to it uses ire_lock to get/set the right value.
104  *
105  * ire_ident, ire_refcnt
106  *
107  *	- Updated atomically using atomic_add_32
108  *
109  * ire_ssthresh, ire_rtt_sd, ire_rtt, ire_ib_pkt_count, ire_ob_pkt_count
110  *
111  *	- Assumes that 32 bit writes are atomic. No locks. ire_lock is
112  *	  used to serialize updates to ire_ssthresh, ire_rtt_sd, ire_rtt.
113  *
114  * ire_max_frag, ire_frag_flag
115  *
116  *	- ire_lock is used to set/read both of them together.
117  *
118  * ire_tire_mark
119  *
120  *	- Set in ire_create and updated in ire_expire, which is called
121  *	  by only one function namely ip_trash_timer_expire. Thus only
122  *	  one function updates and examines the value.
123  *
124  * ire_marks
125  *	- bucket lock protects this.
126  *
127  * ire_ipsec_overhead/ire_ll_hdr_length
128  *
129  *	- Place holder for returning the information to the upper layers
130  *	  when IRE_DB_REQ comes down.
131  *
132  *
133  * ipv6_ire_default_count is protected by the bucket lock of
134  * ip_forwarding_table_v6[0][0].
135  *
136  * ipv6_ire_default_index is not protected as it  is just a hint
137  * at which default gateway to use. There is nothing
138  * wrong in using the same gateway for two different connections.
139  *
140  * As we always hold the bucket locks in all the places while accessing
141  * the above values, it is natural to use them for protecting them.
142  *
143  * We have a separate cache table and forwarding table for IPv4 and IPv6.
144  * Cache table (ip_cache_table/ip_cache_table_v6) is a pointer to an
145  * array of irb_t structures. The IPv6 forwarding table
146  * (ip_forwarding_table_v6) is an array of pointers to arrays of irb_t
147  *  structure. ip_forwarding_table_v6 is allocated dynamically in
148  * ire_add_v6. ire_ft_init_lock is used to serialize multiple threads
149  * initializing the same bucket. Once a bucket is initialized, it is never
150  * de-alloacted. This assumption enables us to access
151  * ip_forwarding_table_v6[i] without any locks.
152  *
153  * The forwarding table for IPv4 is a radix tree whose leaves
154  * are rt_entry structures containing the irb_t for the rt_dst. The irb_t
155  * for IPv4 is dynamically allocated and freed.
156  *
157  * Each irb_t - ire bucket structure has a lock to protect
158  * a bucket and the ires residing in the bucket have a back pointer to
159  * the bucket structure. It also has a reference count for the number
160  * of threads walking the bucket - irb_refcnt which is bumped up
161  * using the macro IRB_REFHOLD macro. The flags irb_flags can be
162  * set to IRE_MARK_CONDEMNED indicating that there are some ires
163  * in this bucket that are marked with IRE_MARK_CONDEMNED and the
164  * last thread to leave the bucket should delete the ires. Usually
165  * this is done by the IRB_REFRELE macro which is used to decrement
166  * the reference count on a bucket. See comments above irb_t structure
167  * definition in ip.h for further details.
168  *
169  * IRE_REFHOLD/IRE_REFRELE macros operate on the ire which increments/
170  * decrements the reference count, ire_refcnt, atomically on the ire.
171  * ire_refcnt is modified only using this macro. Operations on the IRE
172  * could be described as follows :
173  *
174  * CREATE an ire with reference count initialized to 1.
175  *
176  * ADDITION of an ire holds the bucket lock, checks for duplicates
177  * and then adds the ire. ire_add_v4/ire_add_v6 returns the ire after
178  * bumping up once more i.e the reference count is 2. This is to avoid
179  * an extra lookup in the functions calling ire_add which wants to
180  * work with the ire after adding.
181  *
182  * LOOKUP of an ire bumps up the reference count using IRE_REFHOLD
183  * macro. It is valid to bump up the referece count of the IRE,
184  * after the lookup has returned an ire. Following are the lookup
185  * functions that return an HELD ire :
186  *
187  * ire_lookup_local[_v6], ire_ctable_lookup[_v6], ire_ftable_lookup[_v6],
188  * ire_cache_lookup[_v6], ire_lookup_multi[_v6], ire_route_lookup[_v6],
189  * ipif_to_ire[_v6].
190  *
191  * DELETION of an ire holds the bucket lock, removes it from the list
192  * and then decrements the reference count for having removed from the list
193  * by using the IRE_REFRELE macro. If some other thread has looked up
194  * the ire, the reference count would have been bumped up and hence
195  * this ire will not be freed once deleted. It will be freed once the
196  * reference count drops to zero.
197  *
198  * Add and Delete acquires the bucket lock as RW_WRITER, while all the
199  * lookups acquire the bucket lock as RW_READER.
200  *
201  * NOTE : The only functions that does the IRE_REFRELE when an ire is
202  *	  passed as an argument are :
203  *
204  *	  1) ip_wput_ire : This is because it IRE_REFHOLD/RELEs the
205  *			   broadcast ires it looks up internally within
206  *			   the function. Currently, for simplicity it does
207  *			   not differentiate the one that is passed in and
208  *			   the ones it looks up internally. It always
209  *			   IRE_REFRELEs.
210  *	  2) ire_send
211  *	     ire_send_v6 : As ire_send calls ip_wput_ire and other functions
212  *			   that take ire as an argument, it has to selectively
213  *			   IRE_REFRELE the ire. To maintain symmetry,
214  *			   ire_send_v6 does the same.
215  *
216  * Otherwise, the general rule is to do the IRE_REFRELE in the function
217  * that is passing the ire as an argument.
218  *
219  * In trying to locate ires the following points are to be noted.
220  *
221  * IRE_MARK_CONDEMNED signifies that the ire has been logically deleted and is
222  * to be ignored when walking the ires using ire_next.
223  *
224  * Zones note:
225  *	Walking IREs within a given zone also walks certain ires in other
226  *	zones.  This is done intentionally.  IRE walks with a specified
227  *	zoneid are used only when doing informational reports, and
228  *	zone users want to see things that they can access. See block
229  *	comment in ire_walk_ill_match().
230  */
231 
232 /*
233  * The minimum size of IRE cache table.  It will be recalcuated in
234  * ip_ire_init().
235  * Setable in /etc/system
236  */
237 uint32_t ip_cache_table_size = IP_CACHE_TABLE_SIZE;
238 uint32_t ip6_cache_table_size = IP6_CACHE_TABLE_SIZE;
239 
240 /*
241  * The size of the forwarding table.  We will make sure that it is a
242  * power of 2 in ip_ire_init().
243  * Setable in /etc/system
244  */
245 uint32_t ip6_ftable_hash_size = IP6_FTABLE_HASH_SIZE;
246 
247 struct	kmem_cache	*ire_cache;
248 static ire_t	ire_null;
249 
250 /*
251  * The threshold number of IRE in a bucket when the IREs are
252  * cleaned up.  This threshold is calculated later in ip_open()
253  * based on the speed of CPU and available memory.  This default
254  * value is the maximum.
255  *
256  * We have two kinds of cached IRE, temporary and
257  * non-temporary.  Temporary IREs are marked with
258  * IRE_MARK_TEMPORARY.  They are IREs created for non
259  * TCP traffic and for forwarding purposes.  All others
260  * are non-temporary IREs.  We don't mark IRE created for
261  * TCP as temporary because TCP is stateful and there are
262  * info stored in the IRE which can be shared by other TCP
263  * connections to the same destination.  For connected
264  * endpoint, we also don't want to mark the IRE used as
265  * temporary because the same IRE will be used frequently,
266  * otherwise, the app should not do a connect().  We change
267  * the marking at ip_bind_connected_*() if necessary.
268  *
269  * We want to keep the cache IRE hash bucket length reasonably
270  * short, otherwise IRE lookup functions will take "forever."
271  * We use the "crude" function that the IRE bucket
272  * length should be based on the CPU speed, which is 1 entry
273  * per x MHz, depending on the shift factor ip_ire_cpu_ratio
274  * (n).  This means that with a 750MHz CPU, the max bucket
275  * length can be (750 >> n) entries.
276  *
277  * Note that this threshold is separate for temp and non-temp
278  * IREs.  This means that the actual bucket length can be
279  * twice as that.  And while we try to keep temporary IRE
280  * length at most at the threshold value, we do not attempt to
281  * make the length for non-temporary IREs fixed, for the
282  * reason stated above.  Instead, we start trying to find
283  * "unused" non-temporary IREs when the bucket length reaches
284  * this threshold and clean them up.
285  *
286  * We also want to limit the amount of memory used by
287  * IREs.  So if we are allowed to use ~3% of memory (M)
288  * for those IREs, each bucket should not have more than
289  *
290  * 	M / num of cache bucket / sizeof (ire_t)
291  *
292  * Again the above memory uses are separate for temp and
293  * non-temp cached IREs.
294  *
295  * We may also want the limit to be a function of the number
296  * of interfaces and number of CPUs.  Doing the initialization
297  * in ip_open() means that every time an interface is plumbed,
298  * the max is re-calculated.  Right now, we don't do anything
299  * different.  In future, when we have more experience, we
300  * may want to change this behavior.
301  */
302 uint32_t ip_ire_max_bucket_cnt = 10;	/* Setable in /etc/system */
303 uint32_t ip6_ire_max_bucket_cnt = 10;
304 uint32_t ip_ire_cleanup_cnt = 2;
305 
306 /*
307  * The minimum of the temporary IRE bucket count.  We do not want
308  * the length of each bucket to be too short.  This may hurt
309  * performance of some apps as the temporary IREs are removed too
310  * often.
311  */
312 uint32_t ip_ire_min_bucket_cnt = 3;	/* /etc/system - not used */
313 uint32_t ip6_ire_min_bucket_cnt = 3;
314 
315 /*
316  * The ratio of memory consumed by IRE used for temporary to available
317  * memory.  This is a shift factor, so 6 means the ratio 1 to 64.  This
318  * value can be changed in /etc/system.  6 is a reasonable number.
319  */
320 uint32_t ip_ire_mem_ratio = 6;	/* /etc/system */
321 /* The shift factor for CPU speed to calculate the max IRE bucket length. */
322 uint32_t ip_ire_cpu_ratio = 7;	/* /etc/system */
323 
324 typedef struct nce_clookup_s {
325 	ipaddr_t ncecl_addr;
326 	boolean_t ncecl_found;
327 } nce_clookup_t;
328 
329 /*
330  * The maximum number of buckets in IRE cache table.  In future, we may
331  * want to make it a dynamic hash table.  For the moment, we fix the
332  * size and allocate the table in ip_ire_init() when IP is first loaded.
333  * We take into account the amount of memory a system has.
334  */
335 #define	IP_MAX_CACHE_TABLE_SIZE	4096
336 
337 /* Setable in /etc/system */
338 static uint32_t	ip_max_cache_table_size = IP_MAX_CACHE_TABLE_SIZE;
339 static uint32_t	ip6_max_cache_table_size = IP_MAX_CACHE_TABLE_SIZE;
340 
341 /* Zero iulp_t for initialization. */
342 const iulp_t	ire_uinfo_null = { 0 };
343 
344 static int	ire_add_v4(ire_t **ire_p, queue_t *q, mblk_t *mp,
345     ipsq_func_t func, boolean_t);
346 static void	ire_delete_v4(ire_t *ire);
347 static void	ire_walk_ipvers(pfv_t func, void *arg, uchar_t vers,
348     zoneid_t zoneid, ip_stack_t *);
349 static void	ire_walk_ill_ipvers(uint_t match_flags, uint_t ire_type,
350     pfv_t func, void *arg, uchar_t vers, ill_t *ill);
351 static void	ire_cache_cleanup(irb_t *irb, uint32_t threshold,
352     ire_t *ref_ire);
353 static	void	ip_nce_clookup_and_delete(nce_t *nce, void *arg);
354 static	ire_t	*ip4_ctable_lookup_impl(ire_ctable_args_t *margs);
355 #ifdef DEBUG
356 static void	ire_trace_cleanup(const ire_t *);
357 #endif
358 
359 /*
360  * To avoid bloating the code, we call this function instead of
361  * using the macro IRE_REFRELE. Use macro only in performance
362  * critical paths.
363  *
364  * Must not be called while holding any locks. Otherwise if this is
365  * the last reference to be released there is a chance of recursive mutex
366  * panic due to ire_refrele -> ipif_ill_refrele_tail -> qwriter_ip trying
367  * to restart an ioctl. The one exception is when the caller is sure that
368  * this is not the last reference to be released. Eg. if the caller is
369  * sure that the ire has not been deleted and won't be deleted.
370  */
371 void
372 ire_refrele(ire_t *ire)
373 {
374 	IRE_REFRELE(ire);
375 }
376 
377 void
378 ire_refrele_notr(ire_t *ire)
379 {
380 	IRE_REFRELE_NOTR(ire);
381 }
382 
383 /*
384  * kmem_cache_alloc constructor for IRE in kma space.
385  * Note that when ire_mp is set the IRE is stored in that mblk and
386  * not in this cache.
387  */
388 /* ARGSUSED */
389 static int
390 ip_ire_constructor(void *buf, void *cdrarg, int kmflags)
391 {
392 	ire_t	*ire = buf;
393 
394 	ire->ire_nce = NULL;
395 
396 	return (0);
397 }
398 
399 /* ARGSUSED1 */
400 static void
401 ip_ire_destructor(void *buf, void *cdrarg)
402 {
403 	ire_t	*ire = buf;
404 
405 	ASSERT(ire->ire_nce == NULL);
406 }
407 
408 /*
409  * This function is associated with the IP_IOC_IRE_ADVISE_NO_REPLY
410  * IOCTL.  It is used by TCP (or other ULPs) to supply revised information
411  * for an existing CACHED IRE.
412  */
413 /* ARGSUSED */
414 int
415 ip_ire_advise(queue_t *q, mblk_t *mp, cred_t *ioc_cr)
416 {
417 	uchar_t	*addr_ucp;
418 	ipic_t	*ipic;
419 	ire_t	*ire;
420 	ipaddr_t	addr;
421 	in6_addr_t	v6addr;
422 	irb_t	*irb;
423 	zoneid_t	zoneid;
424 	ip_stack_t	*ipst = CONNQ_TO_IPST(q);
425 
426 	ASSERT(q->q_next == NULL);
427 	zoneid = Q_TO_CONN(q)->conn_zoneid;
428 
429 	/*
430 	 * Check privilege using the ioctl credential; if it is NULL
431 	 * then this is a kernel message and therefor privileged.
432 	 */
433 	if (ioc_cr != NULL && secpolicy_ip_config(ioc_cr, B_FALSE) != 0)
434 		return (EPERM);
435 
436 	ipic = (ipic_t *)mp->b_rptr;
437 	if (!(addr_ucp = mi_offset_param(mp, ipic->ipic_addr_offset,
438 	    ipic->ipic_addr_length))) {
439 		return (EINVAL);
440 	}
441 	if (!OK_32PTR(addr_ucp))
442 		return (EINVAL);
443 	switch (ipic->ipic_addr_length) {
444 	case IP_ADDR_LEN: {
445 		/* Extract the destination address. */
446 		addr = *(ipaddr_t *)addr_ucp;
447 		/* Find the corresponding IRE. */
448 		ire = ire_cache_lookup(addr, zoneid, NULL, ipst);
449 		break;
450 	}
451 	case IPV6_ADDR_LEN: {
452 		/* Extract the destination address. */
453 		v6addr = *(in6_addr_t *)addr_ucp;
454 		/* Find the corresponding IRE. */
455 		ire = ire_cache_lookup_v6(&v6addr, zoneid, NULL, ipst);
456 		break;
457 	}
458 	default:
459 		return (EINVAL);
460 	}
461 
462 	if (ire == NULL)
463 		return (ENOENT);
464 	/*
465 	 * Update the round trip time estimate and/or the max frag size
466 	 * and/or the slow start threshold.
467 	 *
468 	 * We serialize multiple advises using ire_lock.
469 	 */
470 	mutex_enter(&ire->ire_lock);
471 	if (ipic->ipic_rtt) {
472 		/*
473 		 * If there is no old cached values, initialize them
474 		 * conservatively.  Set them to be (1.5 * new value).
475 		 */
476 		if (ire->ire_uinfo.iulp_rtt != 0) {
477 			ire->ire_uinfo.iulp_rtt = (ire->ire_uinfo.iulp_rtt +
478 			    ipic->ipic_rtt) >> 1;
479 		} else {
480 			ire->ire_uinfo.iulp_rtt = ipic->ipic_rtt +
481 			    (ipic->ipic_rtt >> 1);
482 		}
483 		if (ire->ire_uinfo.iulp_rtt_sd != 0) {
484 			ire->ire_uinfo.iulp_rtt_sd =
485 			    (ire->ire_uinfo.iulp_rtt_sd +
486 			    ipic->ipic_rtt_sd) >> 1;
487 		} else {
488 			ire->ire_uinfo.iulp_rtt_sd = ipic->ipic_rtt_sd +
489 			    (ipic->ipic_rtt_sd >> 1);
490 		}
491 	}
492 	if (ipic->ipic_max_frag)
493 		ire->ire_max_frag = MIN(ipic->ipic_max_frag, IP_MAXPACKET);
494 	if (ipic->ipic_ssthresh != 0) {
495 		if (ire->ire_uinfo.iulp_ssthresh != 0)
496 			ire->ire_uinfo.iulp_ssthresh =
497 			    (ipic->ipic_ssthresh +
498 			    ire->ire_uinfo.iulp_ssthresh) >> 1;
499 		else
500 			ire->ire_uinfo.iulp_ssthresh = ipic->ipic_ssthresh;
501 	}
502 	/*
503 	 * Don't need the ire_lock below this. ire_type does not change
504 	 * after initialization. ire_marks is protected by irb_lock.
505 	 */
506 	mutex_exit(&ire->ire_lock);
507 
508 	if (ipic->ipic_ire_marks != 0 && ire->ire_type == IRE_CACHE) {
509 		/*
510 		 * Only increment the temporary IRE count if the original
511 		 * IRE is not already marked temporary.
512 		 */
513 		irb = ire->ire_bucket;
514 		rw_enter(&irb->irb_lock, RW_WRITER);
515 		if ((ipic->ipic_ire_marks & IRE_MARK_TEMPORARY) &&
516 		    !(ire->ire_marks & IRE_MARK_TEMPORARY)) {
517 			irb->irb_tmp_ire_cnt++;
518 		}
519 		ire->ire_marks |= ipic->ipic_ire_marks;
520 		rw_exit(&irb->irb_lock);
521 	}
522 
523 	ire_refrele(ire);
524 	return (0);
525 }
526 
527 /*
528  * This function is associated with the IP_IOC_IRE_DELETE[_NO_REPLY]
529  * IOCTL[s].  The NO_REPLY form is used by TCP to delete a route IRE
530  * for a host that is not responding.  This will force an attempt to
531  * establish a new route, if available, and flush out the ARP entry so
532  * it will re-resolve.  Management processes may want to use the
533  * version that generates a reply.
534  *
535  * This function does not support IPv6 since Neighbor Unreachability Detection
536  * means that negative advise like this is useless.
537  */
538 /* ARGSUSED */
539 int
540 ip_ire_delete(queue_t *q, mblk_t *mp, cred_t *ioc_cr)
541 {
542 	uchar_t		*addr_ucp;
543 	ipaddr_t	addr;
544 	ire_t		*ire;
545 	ipid_t		*ipid;
546 	boolean_t	routing_sock_info = B_FALSE;	/* Sent info? */
547 	zoneid_t	zoneid;
548 	ire_t		*gire = NULL;
549 	ill_t		*ill;
550 	mblk_t		*arp_mp;
551 	ip_stack_t	*ipst;
552 
553 	ASSERT(q->q_next == NULL);
554 	zoneid = Q_TO_CONN(q)->conn_zoneid;
555 	ipst = CONNQ_TO_IPST(q);
556 
557 	/*
558 	 * Check privilege using the ioctl credential; if it is NULL
559 	 * then this is a kernel message and therefor privileged.
560 	 */
561 	if (ioc_cr != NULL && secpolicy_ip_config(ioc_cr, B_FALSE) != 0)
562 		return (EPERM);
563 
564 	ipid = (ipid_t *)mp->b_rptr;
565 
566 	/* Only actions on IRE_CACHEs are acceptable at present. */
567 	if (ipid->ipid_ire_type != IRE_CACHE)
568 		return (EINVAL);
569 
570 	addr_ucp = mi_offset_param(mp, ipid->ipid_addr_offset,
571 	    ipid->ipid_addr_length);
572 	if (addr_ucp == NULL || !OK_32PTR(addr_ucp))
573 		return (EINVAL);
574 	switch (ipid->ipid_addr_length) {
575 	case IP_ADDR_LEN:
576 		/* addr_ucp points at IP addr */
577 		break;
578 	case sizeof (sin_t): {
579 		sin_t	*sin;
580 		/*
581 		 * got complete (sockaddr) address - increment addr_ucp to point
582 		 * at the ip_addr field.
583 		 */
584 		sin = (sin_t *)addr_ucp;
585 		addr_ucp = (uchar_t *)&sin->sin_addr.s_addr;
586 		break;
587 	}
588 	default:
589 		return (EINVAL);
590 	}
591 	/* Extract the destination address. */
592 	bcopy(addr_ucp, &addr, IP_ADDR_LEN);
593 
594 	/* Try to find the CACHED IRE. */
595 	ire = ire_cache_lookup(addr, zoneid, NULL, ipst);
596 
597 	/* Nail it. */
598 	if (ire) {
599 		/* Allow delete only on CACHE entries */
600 		if (ire->ire_type != IRE_CACHE) {
601 			ire_refrele(ire);
602 			return (EINVAL);
603 		}
604 
605 		/*
606 		 * Verify that the IRE has been around for a while.
607 		 * This is to protect against transport protocols
608 		 * that are too eager in sending delete messages.
609 		 */
610 		if (gethrestime_sec() <
611 		    ire->ire_create_time + ipst->ips_ip_ignore_delete_time) {
612 			ire_refrele(ire);
613 			return (EINVAL);
614 		}
615 		/*
616 		 * Now we have a potentially dead cache entry. We need
617 		 * to remove it.
618 		 * If this cache entry is generated from a
619 		 * default route (i.e., ire_cmask == 0),
620 		 * search the default list and mark it dead and some
621 		 * background process will try to activate it.
622 		 */
623 		if ((ire->ire_gateway_addr != 0) && (ire->ire_cmask == 0)) {
624 			/*
625 			 * Make sure that we pick a different
626 			 * IRE_DEFAULT next time.
627 			 */
628 			ire_t *gw_ire;
629 			irb_t *irb = NULL;
630 			uint_t match_flags;
631 
632 			match_flags = (MATCH_IRE_DEFAULT | MATCH_IRE_RJ_BHOLE);
633 
634 			gire = ire_ftable_lookup(ire->ire_addr,
635 			    ire->ire_cmask, 0, 0,
636 			    ire->ire_ipif, NULL, zoneid, 0, NULL, match_flags,
637 			    ipst);
638 
639 			ip3dbg(("ire_ftable_lookup() returned gire %p\n",
640 			    (void *)gire));
641 
642 			if (gire != NULL) {
643 				irb = gire->ire_bucket;
644 
645 				/*
646 				 * We grab it as writer just to serialize
647 				 * multiple threads trying to bump up
648 				 * irb_rr_origin
649 				 */
650 				rw_enter(&irb->irb_lock, RW_WRITER);
651 				if ((gw_ire = irb->irb_rr_origin) == NULL) {
652 					rw_exit(&irb->irb_lock);
653 					goto done;
654 				}
655 
656 				DTRACE_PROBE1(ip__ire__del__origin,
657 				    (ire_t *), gw_ire);
658 
659 				/* Skip past the potentially bad gateway */
660 				if (ire->ire_gateway_addr ==
661 				    gw_ire->ire_gateway_addr) {
662 					ire_t *next = gw_ire->ire_next;
663 
664 					DTRACE_PROBE2(ip__ire__del,
665 					    (ire_t *), gw_ire, (irb_t *), irb);
666 					IRE_FIND_NEXT_ORIGIN(next);
667 					irb->irb_rr_origin = next;
668 				}
669 				rw_exit(&irb->irb_lock);
670 			}
671 		}
672 done:
673 		if (gire != NULL)
674 			IRE_REFRELE(gire);
675 		/* report the bad route to routing sockets */
676 		ip_rts_change(RTM_LOSING, ire->ire_addr, ire->ire_gateway_addr,
677 		    ire->ire_mask, ire->ire_src_addr, 0, 0, 0,
678 		    (RTA_DST | RTA_GATEWAY | RTA_NETMASK | RTA_IFA), ipst);
679 		routing_sock_info = B_TRUE;
680 
681 		/*
682 		 * TCP is really telling us to start over completely, and it
683 		 * expects that we'll resend the ARP query.  Tell ARP to
684 		 * discard the entry, if this is a local destination.
685 		 *
686 		 * But, if the ARP entry is permanent then it shouldn't be
687 		 * deleted, so we set ARED_F_PRESERVE_PERM.
688 		 */
689 		ill = ire->ire_stq->q_ptr;
690 		if (ire->ire_gateway_addr == 0 &&
691 		    (arp_mp = ill_ared_alloc(ill, addr)) != NULL) {
692 			ared_t *ared = (ared_t *)arp_mp->b_rptr;
693 
694 			ASSERT(ared->ared_cmd == AR_ENTRY_DELETE);
695 			ared->ared_flags |= ARED_F_PRESERVE_PERM;
696 			putnext(ill->ill_rq, arp_mp);
697 		}
698 
699 		ire_delete(ire);
700 		ire_refrele(ire);
701 	}
702 	/*
703 	 * Also look for an IRE_HOST type redirect ire and
704 	 * remove it if present.
705 	 */
706 	ire = ire_route_lookup(addr, 0, 0, IRE_HOST, NULL, NULL,
707 	    ALL_ZONES, NULL, MATCH_IRE_TYPE, ipst);
708 
709 	/* Nail it. */
710 	if (ire != NULL) {
711 		if (ire->ire_flags & RTF_DYNAMIC) {
712 			if (!routing_sock_info) {
713 				ip_rts_change(RTM_LOSING, ire->ire_addr,
714 				    ire->ire_gateway_addr, ire->ire_mask,
715 				    ire->ire_src_addr, 0, 0, 0,
716 				    (RTA_DST | RTA_GATEWAY |
717 				    RTA_NETMASK | RTA_IFA),
718 				    ipst);
719 			}
720 			ire_delete(ire);
721 		}
722 		ire_refrele(ire);
723 	}
724 	return (0);
725 }
726 
727 /*
728  * ip_ire_req is called by ip_wput when an IRE_DB_REQ_TYPE message is handed
729  * down from the Upper Level Protocol to request a copy of the IRE (to check
730  * its type or to extract information like round-trip time estimates or the
731  * MTU.)
732  * The address is assumed to be in the ire_addr field. If no IRE is found
733  * an IRE is returned with ire_type being zero.
734  * Note that the upper lavel protocol has to check for broadcast
735  * (IRE_BROADCAST) and multicast (CLASSD(addr)).
736  * If there is a b_cont the resulting IRE_DB_TYPE mblk is placed at the
737  * end of the returned message.
738  *
739  * TCP sends down a message of this type with a connection request packet
740  * chained on. UDP and ICMP send it down to verify that a route exists for
741  * the destination address when they get connected.
742  */
743 void
744 ip_ire_req(queue_t *q, mblk_t *mp)
745 {
746 	ire_t	*inire;
747 	ire_t	*ire;
748 	mblk_t	*mp1;
749 	ire_t	*sire = NULL;
750 	zoneid_t zoneid = Q_TO_CONN(q)->conn_zoneid;
751 	ip_stack_t	*ipst = CONNQ_TO_IPST(q);
752 
753 	ASSERT(q->q_next == NULL);
754 
755 	if ((mp->b_wptr - mp->b_rptr) < sizeof (ire_t) ||
756 	    !OK_32PTR(mp->b_rptr)) {
757 		freemsg(mp);
758 		return;
759 	}
760 	inire = (ire_t *)mp->b_rptr;
761 	/*
762 	 * Got it, now take our best shot at an IRE.
763 	 */
764 	if (inire->ire_ipversion == IPV6_VERSION) {
765 		ire = ire_route_lookup_v6(&inire->ire_addr_v6, 0, 0, 0,
766 		    NULL, &sire, zoneid, NULL,
767 		    (MATCH_IRE_RECURSIVE | MATCH_IRE_DEFAULT), ipst);
768 	} else {
769 		ASSERT(inire->ire_ipversion == IPV4_VERSION);
770 		ire = ire_route_lookup(inire->ire_addr, 0, 0, 0,
771 		    NULL, &sire, zoneid, NULL,
772 		    (MATCH_IRE_RECURSIVE | MATCH_IRE_DEFAULT), ipst);
773 	}
774 
775 	/*
776 	 * We prevent returning IRES with source address INADDR_ANY
777 	 * as these were temporarily created for sending packets
778 	 * from endpoints that have conn_unspec_src set.
779 	 */
780 	if (ire == NULL ||
781 	    (ire->ire_ipversion == IPV4_VERSION &&
782 	    ire->ire_src_addr == INADDR_ANY) ||
783 	    (ire->ire_ipversion == IPV6_VERSION &&
784 	    IN6_IS_ADDR_UNSPECIFIED(&ire->ire_src_addr_v6))) {
785 		inire->ire_type = 0;
786 	} else {
787 		bcopy(ire, inire, sizeof (ire_t));
788 		/* Copy the route metrics from the parent. */
789 		if (sire != NULL) {
790 			bcopy(&(sire->ire_uinfo), &(inire->ire_uinfo),
791 			    sizeof (iulp_t));
792 		}
793 
794 		/*
795 		 * As we don't lookup global policy here, we may not
796 		 * pass the right size if per-socket policy is not
797 		 * present. For these cases, path mtu discovery will
798 		 * do the right thing.
799 		 */
800 		inire->ire_ipsec_overhead = conn_ipsec_length(Q_TO_CONN(q));
801 
802 		/* Pass the latest setting of the ip_path_mtu_discovery */
803 		inire->ire_frag_flag |=
804 		    (ipst->ips_ip_path_mtu_discovery) ? IPH_DF : 0;
805 	}
806 	if (ire != NULL)
807 		ire_refrele(ire);
808 	if (sire != NULL)
809 		ire_refrele(sire);
810 	mp->b_wptr = &mp->b_rptr[sizeof (ire_t)];
811 	mp->b_datap->db_type = IRE_DB_TYPE;
812 
813 	/* Put the IRE_DB_TYPE mblk last in the chain */
814 	mp1 = mp->b_cont;
815 	if (mp1 != NULL) {
816 		mp->b_cont = NULL;
817 		linkb(mp1, mp);
818 		mp = mp1;
819 	}
820 	qreply(q, mp);
821 }
822 
823 /*
824  * Send a packet using the specified IRE.
825  * If ire_src_addr_v6 is all zero then discard the IRE after
826  * the packet has been sent.
827  */
828 static void
829 ire_send(queue_t *q, mblk_t *pkt, ire_t *ire)
830 {
831 	mblk_t *ipsec_mp;
832 	boolean_t is_secure;
833 	uint_t ifindex;
834 	ill_t	*ill;
835 	zoneid_t zoneid = ire->ire_zoneid;
836 	ip_stack_t	*ipst = ire->ire_ipst;
837 
838 	ASSERT(ire->ire_ipversion == IPV4_VERSION);
839 	ASSERT(!(ire->ire_type & IRE_LOCAL)); /* Has different ire_zoneid */
840 	ipsec_mp = pkt;
841 	is_secure = (pkt->b_datap->db_type == M_CTL);
842 	if (is_secure) {
843 		ipsec_out_t *io;
844 
845 		pkt = pkt->b_cont;
846 		io = (ipsec_out_t *)ipsec_mp->b_rptr;
847 		if (io->ipsec_out_type == IPSEC_OUT)
848 			zoneid = io->ipsec_out_zoneid;
849 	}
850 
851 	/* If the packet originated externally then */
852 	if (pkt->b_prev) {
853 		ire_refrele(ire);
854 		/*
855 		 * Extract the ifindex from b_prev (set in ip_rput_noire).
856 		 * Look up interface to see if it still exists (it could have
857 		 * been unplumbed by the time the reply came back from ARP)
858 		 */
859 		ifindex = (uint_t)(uintptr_t)pkt->b_prev;
860 		ill = ill_lookup_on_ifindex(ifindex, B_FALSE,
861 		    NULL, NULL, NULL, NULL, ipst);
862 		if (ill == NULL) {
863 			pkt->b_prev = NULL;
864 			pkt->b_next = NULL;
865 			freemsg(ipsec_mp);
866 			return;
867 		}
868 		q = ill->ill_rq;
869 		pkt->b_prev = NULL;
870 		/*
871 		 * This packet has not gone through IPSEC processing
872 		 * and hence we should not have any IPSEC message
873 		 * prepended.
874 		 */
875 		ASSERT(ipsec_mp == pkt);
876 		put(q, pkt);
877 		ill_refrele(ill);
878 	} else if (pkt->b_next) {
879 		/* Packets from multicast router */
880 		pkt->b_next = NULL;
881 		/*
882 		 * We never get the IPSEC_OUT while forwarding the
883 		 * packet for multicast router.
884 		 */
885 		ASSERT(ipsec_mp == pkt);
886 		ip_rput_forward(ire, (ipha_t *)pkt->b_rptr, ipsec_mp, NULL);
887 		ire_refrele(ire);
888 	} else {
889 		/* Locally originated packets */
890 		boolean_t delete_ire = B_FALSE;
891 		ipha_t *ipha = (ipha_t *)pkt->b_rptr;
892 
893 		/*
894 		 * If this IRE shouldn't be kept in the table (because its
895 		 * source address is unspecified), hold a reference to it so
896 		 * we can delete it even after e.g. ip_wput_ire() has dropped
897 		 * its reference.
898 		 */
899 		if (!(ire->ire_marks & IRE_MARK_NOADD) &&
900 		    ire->ire_src_addr == INADDR_ANY) {
901 			delete_ire = B_TRUE;
902 			IRE_REFHOLD(ire);
903 		}
904 
905 		/*
906 		 * If we were resolving a router we can not use the
907 		 * routers IRE for sending the packet (since it would
908 		 * violate the uniqness of the IP idents) thus we
909 		 * make another pass through ip_wput to create the IRE_CACHE
910 		 * for the destination.
911 		 * When IRE_MARK_NOADD is set, ire_add() is not called.
912 		 * Thus ip_wput() will never find a ire and result in an
913 		 * infinite loop. Thus we check whether IRE_MARK_NOADD is
914 		 * is set. This also implies that IRE_MARK_NOADD can only be
915 		 * used to send packets to directly connected hosts.
916 		 */
917 		if (ipha->ipha_dst != ire->ire_addr &&
918 		    !(ire->ire_marks & IRE_MARK_NOADD)) {
919 			ire_refrele(ire);	/* Held in ire_add */
920 			if (CONN_Q(q)) {
921 				(void) ip_output(Q_TO_CONN(q), ipsec_mp, q,
922 				    IRE_SEND);
923 			} else {
924 				(void) ip_output((void *)(uintptr_t)zoneid,
925 				    ipsec_mp, q, IRE_SEND);
926 			}
927 		} else {
928 			if (is_secure) {
929 				ipsec_out_t *oi;
930 				ipha_t *ipha;
931 
932 				oi = (ipsec_out_t *)ipsec_mp->b_rptr;
933 				ipha = (ipha_t *)ipsec_mp->b_cont->b_rptr;
934 				if (oi->ipsec_out_proc_begin) {
935 					/*
936 					 * This is the case where
937 					 * ip_wput_ipsec_out could not find
938 					 * the IRE and recreated a new one.
939 					 * As ip_wput_ipsec_out does ire
940 					 * lookups, ire_refrele for the extra
941 					 * bump in ire_add.
942 					 */
943 					ire_refrele(ire);
944 					ip_wput_ipsec_out(q, ipsec_mp, ipha,
945 					    NULL, NULL);
946 				} else {
947 					/*
948 					 * IRE_REFRELE will be done in
949 					 * ip_wput_ire.
950 					 */
951 					ip_wput_ire(q, ipsec_mp, ire, NULL,
952 					    IRE_SEND, zoneid);
953 				}
954 			} else {
955 				/*
956 				 * IRE_REFRELE will be done in ip_wput_ire.
957 				 */
958 				ip_wput_ire(q, ipsec_mp, ire, NULL,
959 				    IRE_SEND, zoneid);
960 			}
961 		}
962 		/*
963 		 * Special code to support sending a single packet with
964 		 * conn_unspec_src using an IRE which has no source address.
965 		 * The IRE is deleted here after sending the packet to avoid
966 		 * having other code trip on it. But before we delete the
967 		 * ire, somebody could have looked up this ire.
968 		 * We prevent returning/using this IRE by the upper layers
969 		 * by making checks to NULL source address in other places
970 		 * like e.g ip_ire_append, ip_ire_req and ip_bind_connected.
971 		 * Though this does not completely prevent other threads
972 		 * from using this ire, this should not cause any problems.
973 		 */
974 		if (delete_ire) {
975 			ip1dbg(("ire_send: delete IRE\n"));
976 			ire_delete(ire);
977 			ire_refrele(ire);	/* Held above */
978 		}
979 	}
980 }
981 
982 /*
983  * Send a packet using the specified IRE.
984  * If ire_src_addr_v6 is all zero then discard the IRE after
985  * the packet has been sent.
986  */
987 static void
988 ire_send_v6(queue_t *q, mblk_t *pkt, ire_t *ire)
989 {
990 	mblk_t *ipsec_mp;
991 	boolean_t secure;
992 	uint_t ifindex;
993 	zoneid_t zoneid = ire->ire_zoneid;
994 	ip_stack_t	*ipst = ire->ire_ipst;
995 
996 	ASSERT(ire->ire_ipversion == IPV6_VERSION);
997 	ASSERT(!(ire->ire_type & IRE_LOCAL)); /* Has different ire_zoneid */
998 	if (pkt->b_datap->db_type == M_CTL) {
999 		ipsec_out_t *io;
1000 
1001 		ipsec_mp = pkt;
1002 		pkt = pkt->b_cont;
1003 		secure = B_TRUE;
1004 		io = (ipsec_out_t *)ipsec_mp->b_rptr;
1005 		if (io->ipsec_out_type == IPSEC_OUT)
1006 			zoneid = io->ipsec_out_zoneid;
1007 	} else {
1008 		ipsec_mp = pkt;
1009 		secure = B_FALSE;
1010 	}
1011 
1012 	/* If the packet originated externally then */
1013 	if (pkt->b_prev) {
1014 		ill_t	*ill;
1015 		/*
1016 		 * Extract the ifindex from b_prev (set in ip_rput_data_v6).
1017 		 * Look up interface to see if it still exists (it could have
1018 		 * been unplumbed by the time the reply came back from the
1019 		 * resolver).
1020 		 */
1021 		ifindex = (uint_t)(uintptr_t)pkt->b_prev;
1022 		ill = ill_lookup_on_ifindex(ifindex, B_TRUE,
1023 		    NULL, NULL, NULL, NULL, ipst);
1024 		if (ill == NULL) {
1025 			pkt->b_prev = NULL;
1026 			pkt->b_next = NULL;
1027 			freemsg(ipsec_mp);
1028 			ire_refrele(ire);	/* Held in ire_add */
1029 			return;
1030 		}
1031 		q = ill->ill_rq;
1032 		pkt->b_prev = NULL;
1033 		/*
1034 		 * This packet has not gone through IPSEC processing
1035 		 * and hence we should not have any IPSEC message
1036 		 * prepended.
1037 		 */
1038 		ASSERT(ipsec_mp == pkt);
1039 		put(q, pkt);
1040 		ill_refrele(ill);
1041 	} else if (pkt->b_next) {
1042 		/* Packets from multicast router */
1043 		pkt->b_next = NULL;
1044 		/*
1045 		 * We never get the IPSEC_OUT while forwarding the
1046 		 * packet for multicast router.
1047 		 */
1048 		ASSERT(ipsec_mp == pkt);
1049 		/*
1050 		 * XXX TODO IPv6.
1051 		 */
1052 		freemsg(pkt);
1053 #ifdef XXX
1054 		ip_rput_forward(ire, (ipha_t *)pkt->b_rptr, pkt, NULL);
1055 #endif
1056 	} else {
1057 		if (secure) {
1058 			ipsec_out_t *oi;
1059 			ip6_t *ip6h;
1060 
1061 			oi = (ipsec_out_t *)ipsec_mp->b_rptr;
1062 			ip6h = (ip6_t *)ipsec_mp->b_cont->b_rptr;
1063 			if (oi->ipsec_out_proc_begin) {
1064 				/*
1065 				 * This is the case where
1066 				 * ip_wput_ipsec_out could not find
1067 				 * the IRE and recreated a new one.
1068 				 */
1069 				ip_wput_ipsec_out_v6(q, ipsec_mp, ip6h,
1070 				    NULL, NULL);
1071 			} else {
1072 				if (CONN_Q(q)) {
1073 					(void) ip_output_v6(Q_TO_CONN(q),
1074 					    ipsec_mp, q, IRE_SEND);
1075 				} else {
1076 					(void) ip_output_v6(
1077 					    (void *)(uintptr_t)zoneid,
1078 					    ipsec_mp, q, IRE_SEND);
1079 				}
1080 			}
1081 		} else {
1082 			/*
1083 			 * Send packets through ip_output_v6 so that any
1084 			 * ip6_info header can be processed again.
1085 			 */
1086 			if (CONN_Q(q)) {
1087 				(void) ip_output_v6(Q_TO_CONN(q), ipsec_mp, q,
1088 				    IRE_SEND);
1089 			} else {
1090 				(void) ip_output_v6((void *)(uintptr_t)zoneid,
1091 				    ipsec_mp, q, IRE_SEND);
1092 			}
1093 		}
1094 		/*
1095 		 * Special code to support sending a single packet with
1096 		 * conn_unspec_src using an IRE which has no source address.
1097 		 * The IRE is deleted here after sending the packet to avoid
1098 		 * having other code trip on it. But before we delete the
1099 		 * ire, somebody could have looked up this ire.
1100 		 * We prevent returning/using this IRE by the upper layers
1101 		 * by making checks to NULL source address in other places
1102 		 * like e.g ip_ire_append_v6, ip_ire_req and
1103 		 * ip_bind_connected_v6. Though, this does not completely
1104 		 * prevent other threads from using this ire, this should
1105 		 * not cause any problems.
1106 		 */
1107 		if (IN6_IS_ADDR_UNSPECIFIED(&ire->ire_src_addr_v6)) {
1108 			ip1dbg(("ire_send_v6: delete IRE\n"));
1109 			ire_delete(ire);
1110 		}
1111 	}
1112 	ire_refrele(ire);	/* Held in ire_add */
1113 }
1114 
1115 /*
1116  * Make sure that IRE bucket does not get too long.
1117  * This can cause lock up because ire_cache_lookup()
1118  * may take "forever" to finish.
1119  *
1120  * We only remove a maximum of cnt IREs each time.  This
1121  * should keep the bucket length approximately constant,
1122  * depending on cnt.  This should be enough to defend
1123  * against DoS attack based on creating temporary IREs
1124  * (for forwarding and non-TCP traffic).
1125  *
1126  * We also pass in the address of the newly created IRE
1127  * as we do not want to remove this straight after adding
1128  * it. New IREs are normally added at the tail of the
1129  * bucket.  This means that we are removing the "oldest"
1130  * temporary IREs added.  Only if there are IREs with
1131  * the same ire_addr, do we not add it at the tail.  Refer
1132  * to ire_add_v*().  It should be OK for our purpose.
1133  *
1134  * For non-temporary cached IREs, we make sure that they
1135  * have not been used for some time (defined below), they
1136  * are non-local destinations, and there is no one using
1137  * them at the moment (refcnt == 1).
1138  *
1139  * The above means that the IRE bucket length may become
1140  * very long, consisting of mostly non-temporary IREs.
1141  * This can happen when the hash function does a bad job
1142  * so that most TCP connections cluster to a specific bucket.
1143  * This "hopefully" should never happen.  It can also
1144  * happen if most TCP connections have very long lives.
1145  * Even with the minimal hash table size of 256, there
1146  * has to be a lot of such connections to make the bucket
1147  * length unreasonably long.  This should probably not
1148  * happen either.  The third can when this can happen is
1149  * when the machine is under attack, such as SYN flooding.
1150  * TCP should already have the proper mechanism to protect
1151  * that.  So we should be safe.
1152  *
1153  * This function is called by ire_add_then_send() after
1154  * a new IRE is added and the packet is sent.
1155  *
1156  * The idle cutoff interval is set to 60s.  It can be
1157  * changed using /etc/system.
1158  */
1159 uint32_t ire_idle_cutoff_interval = 60000;
1160 
1161 static void
1162 ire_cache_cleanup(irb_t *irb, uint32_t threshold, ire_t *ref_ire)
1163 {
1164 	ire_t *ire;
1165 	clock_t cut_off = drv_usectohz(ire_idle_cutoff_interval * 1000);
1166 	int cnt = ip_ire_cleanup_cnt;
1167 
1168 	/*
1169 	 * Try to remove cnt temporary IREs first.
1170 	 */
1171 	for (ire = irb->irb_ire; cnt > 0 && ire != NULL; ire = ire->ire_next) {
1172 		if (ire == ref_ire)
1173 			continue;
1174 		if (ire->ire_marks & IRE_MARK_CONDEMNED)
1175 			continue;
1176 		if (ire->ire_marks & IRE_MARK_TEMPORARY) {
1177 			ASSERT(ire->ire_type == IRE_CACHE);
1178 			ire_delete(ire);
1179 			cnt--;
1180 		}
1181 	}
1182 	if (cnt == 0)
1183 		return;
1184 
1185 	/*
1186 	 * If we didn't satisfy our removal target from temporary IREs
1187 	 * we see how many non-temporary IREs are currently in the bucket.
1188 	 * If this quantity is above the threshold then we see if there are any
1189 	 * candidates for removal. We are still limited to removing a maximum
1190 	 * of cnt IREs.
1191 	 */
1192 	if ((irb->irb_ire_cnt - irb->irb_tmp_ire_cnt) > threshold) {
1193 		for (ire = irb->irb_ire; cnt > 0 && ire != NULL;
1194 		    ire = ire->ire_next) {
1195 			if (ire == ref_ire)
1196 				continue;
1197 			if (ire->ire_type != IRE_CACHE)
1198 				continue;
1199 			if (ire->ire_marks & IRE_MARK_CONDEMNED)
1200 				continue;
1201 			if ((ire->ire_refcnt == 1) &&
1202 			    (lbolt - ire->ire_last_used_time > cut_off)) {
1203 				ire_delete(ire);
1204 				cnt--;
1205 			}
1206 		}
1207 	}
1208 }
1209 
1210 /*
1211  * ire_add_then_send is called when a new IRE has been created in order to
1212  * route an outgoing packet.  Typically, it is called from ip_wput when
1213  * a response comes back down from a resolver.  We add the IRE, and then
1214  * possibly run the packet through ip_wput or ip_rput, as appropriate.
1215  * However, we do not add the newly created IRE in the cache when
1216  * IRE_MARK_NOADD is set in the IRE. IRE_MARK_NOADD is set at
1217  * ip_newroute_ipif(). The ires with IRE_MARK_NOADD are ire_refrele'd by
1218  * ip_wput_ire() and get deleted.
1219  * Multirouting support: the packet is silently discarded when the new IRE
1220  * holds the RTF_MULTIRT flag, but is not the first IRE to be added with the
1221  * RTF_MULTIRT flag for the same destination address.
1222  * In this case, we just want to register this additional ire without
1223  * sending the packet, as it has already been replicated through
1224  * existing multirt routes in ip_wput().
1225  */
1226 void
1227 ire_add_then_send(queue_t *q, ire_t *ire, mblk_t *mp)
1228 {
1229 	irb_t *irb;
1230 	boolean_t drop = B_FALSE;
1231 	boolean_t mctl_present;
1232 	mblk_t *first_mp = NULL;
1233 	mblk_t *data_mp = NULL;
1234 	ire_t *dst_ire;
1235 	ipha_t *ipha;
1236 	ip6_t *ip6h;
1237 	ip_stack_t	*ipst = ire->ire_ipst;
1238 	int		ire_limit;
1239 
1240 	if (mp != NULL) {
1241 		/*
1242 		 * We first have to retrieve the destination address carried
1243 		 * by the packet.
1244 		 * We can't rely on ire as it can be related to a gateway.
1245 		 * The destination address will help in determining if
1246 		 * other RTF_MULTIRT ires are already registered.
1247 		 *
1248 		 * We first need to know where we are going : v4 or V6.
1249 		 * the ire version is enough, as there is no risk that
1250 		 * we resolve an IPv6 address with an IPv4 ire
1251 		 * or vice versa.
1252 		 */
1253 		EXTRACT_PKT_MP(mp, first_mp, mctl_present);
1254 		data_mp = mp;
1255 		mp = first_mp;
1256 		if (ire->ire_ipversion == IPV4_VERSION) {
1257 			ipha = (ipha_t *)data_mp->b_rptr;
1258 			dst_ire = ire_cache_lookup(ipha->ipha_dst,
1259 			    ire->ire_zoneid, msg_getlabel(mp), ipst);
1260 		} else {
1261 			ASSERT(ire->ire_ipversion == IPV6_VERSION);
1262 			ip6h = (ip6_t *)data_mp->b_rptr;
1263 			dst_ire = ire_cache_lookup_v6(&ip6h->ip6_dst,
1264 			    ire->ire_zoneid, msg_getlabel(mp), ipst);
1265 		}
1266 		if (dst_ire != NULL) {
1267 			if (dst_ire->ire_flags & RTF_MULTIRT) {
1268 				/*
1269 				 * At least one resolved multirt route
1270 				 * already exists for the destination,
1271 				 * don't sent this packet: either drop it
1272 				 * or complete the pending resolution,
1273 				 * depending on the ire.
1274 				 */
1275 				drop = B_TRUE;
1276 			}
1277 			ip1dbg(("ire_add_then_send: dst_ire %p "
1278 			    "[dst %08x, gw %08x], drop %d\n",
1279 			    (void *)dst_ire,
1280 			    (dst_ire->ire_ipversion == IPV4_VERSION) ? \
1281 			    ntohl(dst_ire->ire_addr) : \
1282 			    ntohl(V4_PART_OF_V6(dst_ire->ire_addr_v6)),
1283 			    (dst_ire->ire_ipversion == IPV4_VERSION) ? \
1284 			    ntohl(dst_ire->ire_gateway_addr) : \
1285 			    ntohl(V4_PART_OF_V6(
1286 			    dst_ire->ire_gateway_addr_v6)),
1287 			    drop));
1288 			ire_refrele(dst_ire);
1289 		}
1290 	}
1291 
1292 	if (!(ire->ire_marks & IRE_MARK_NOADD)) {
1293 		/* Regular packets with cache bound ires are here. */
1294 		(void) ire_add(&ire, NULL, NULL, NULL, B_FALSE);
1295 
1296 		if (ire == NULL) {
1297 			mp->b_prev = NULL;
1298 			mp->b_next = NULL;
1299 			MULTIRT_DEBUG_UNTAG(mp);
1300 			freemsg(mp);
1301 			return;
1302 		}
1303 		if (mp == NULL) {
1304 			ire_refrele(ire);	/* Held in ire_add_v4/v6 */
1305 			return;
1306 		}
1307 	}
1308 	if (drop) {
1309 		/*
1310 		 * If we're adding an RTF_MULTIRT ire, the resolution
1311 		 * is over: we just drop the packet.
1312 		 */
1313 		if (ire->ire_flags & RTF_MULTIRT) {
1314 			data_mp->b_prev = NULL;
1315 			data_mp->b_next = NULL;
1316 			MULTIRT_DEBUG_UNTAG(mp);
1317 			freemsg(mp);
1318 		} else {
1319 			/*
1320 			 * Otherwise, we're adding the ire to a gateway
1321 			 * for a multirt route.
1322 			 * Invoke ip_newroute() to complete the resolution
1323 			 * of the route. We will then come back here and
1324 			 * finally drop this packet in the above code.
1325 			 */
1326 			if (ire->ire_ipversion == IPV4_VERSION) {
1327 				/*
1328 				 * TODO: in order for CGTP to work in non-global
1329 				 * zones, ip_newroute() must create the IRE
1330 				 * cache in the zone indicated by
1331 				 * ire->ire_zoneid.
1332 				 */
1333 				ip_newroute(q, mp, ipha->ipha_dst,
1334 				    (CONN_Q(q) ? Q_TO_CONN(q) : NULL),
1335 				    ire->ire_zoneid, ipst);
1336 			} else {
1337 				int minlen = sizeof (ip6i_t) + IPV6_HDR_LEN;
1338 
1339 				ASSERT(ire->ire_ipversion == IPV6_VERSION);
1340 
1341 				/*
1342 				 * If necessary, skip over the ip6i_t to find
1343 				 * the header with the actual source address.
1344 				 */
1345 				if (ip6h->ip6_nxt == IPPROTO_RAW) {
1346 					if (MBLKL(data_mp) < minlen &&
1347 					    pullupmsg(data_mp, -1) == 0) {
1348 						ip1dbg(("ire_add_then_send: "
1349 						    "cannot pullupmsg ip6i\n"));
1350 						if (mctl_present)
1351 							freeb(first_mp);
1352 						ire_refrele(ire);
1353 						return;
1354 					}
1355 					ASSERT(MBLKL(data_mp) >= IPV6_HDR_LEN);
1356 					ip6h = (ip6_t *)(data_mp->b_rptr +
1357 					    sizeof (ip6i_t));
1358 				}
1359 				ip_newroute_v6(q, mp, &ip6h->ip6_dst,
1360 				    &ip6h->ip6_src, NULL, ire->ire_zoneid,
1361 				    ipst);
1362 			}
1363 		}
1364 
1365 		ire_refrele(ire); /* As done by ire_send(). */
1366 		return;
1367 	}
1368 	/*
1369 	 * Need to remember ire_bucket here as ire_send*() may delete
1370 	 * the ire so we cannot reference it after that.
1371 	 */
1372 	irb = ire->ire_bucket;
1373 	if (ire->ire_ipversion == IPV4_VERSION) {
1374 		ire_send(q, mp, ire);
1375 		ire_limit = ip_ire_max_bucket_cnt;
1376 	} else {
1377 		ire_send_v6(q, mp, ire);
1378 		ire_limit = ip6_ire_max_bucket_cnt;
1379 	}
1380 
1381 	/*
1382 	 * irb is NULL if the IRE was not added to the hash. This happens
1383 	 * when IRE_MARK_NOADD is set and when IREs are returned from
1384 	 * ire_update_srcif_v4().
1385 	 */
1386 	if (irb != NULL) {
1387 		IRB_REFHOLD(irb);
1388 		if (irb->irb_ire_cnt > ire_limit)
1389 			ire_cache_cleanup(irb, ire_limit, ire);
1390 		IRB_REFRELE(irb);
1391 	}
1392 }
1393 
1394 /*
1395  * Initialize the ire that is specific to IPv4 part and call
1396  * ire_init_common to finish it.
1397  */
1398 ire_t *
1399 ire_init(ire_t *ire, uchar_t *addr, uchar_t *mask, uchar_t *src_addr,
1400     uchar_t *gateway, uint_t *max_fragp, nce_t *src_nce, queue_t *rfq,
1401     queue_t *stq, ushort_t type, ipif_t *ipif, ipaddr_t cmask, uint32_t phandle,
1402     uint32_t ihandle, uint32_t flags, const iulp_t *ulp_info, tsol_gc_t *gc,
1403     tsol_gcgrp_t *gcgrp, ip_stack_t *ipst)
1404 {
1405 	ASSERT(type != IRE_CACHE || stq != NULL);
1406 	/*
1407 	 * Reject IRE security attribute creation/initialization
1408 	 * if system is not running in Trusted mode.
1409 	 */
1410 	if ((gc != NULL || gcgrp != NULL) && !is_system_labeled())
1411 		return (NULL);
1412 
1413 	BUMP_IRE_STATS(ipst->ips_ire_stats_v4, ire_stats_alloced);
1414 
1415 	if (addr != NULL)
1416 		bcopy(addr, &ire->ire_addr, IP_ADDR_LEN);
1417 	if (src_addr != NULL)
1418 		bcopy(src_addr, &ire->ire_src_addr, IP_ADDR_LEN);
1419 	if (mask != NULL) {
1420 		bcopy(mask, &ire->ire_mask, IP_ADDR_LEN);
1421 		ire->ire_masklen = ip_mask_to_plen(ire->ire_mask);
1422 	}
1423 	if (gateway != NULL) {
1424 		bcopy(gateway, &ire->ire_gateway_addr, IP_ADDR_LEN);
1425 	}
1426 
1427 	if (type == IRE_CACHE)
1428 		ire->ire_cmask = cmask;
1429 
1430 	/* ire_init_common will free the mblks upon encountering any failure */
1431 	if (!ire_init_common(ire, max_fragp, src_nce, rfq, stq, type, ipif,
1432 	    phandle, ihandle, flags, IPV4_VERSION, ulp_info, gc, gcgrp, ipst))
1433 		return (NULL);
1434 
1435 	return (ire);
1436 }
1437 
1438 /*
1439  * Similar to ire_create except that it is called only when
1440  * we want to allocate ire as an mblk e.g. we have an external
1441  * resolver ARP.
1442  */
1443 ire_t *
1444 ire_create_mp(uchar_t *addr, uchar_t *mask, uchar_t *src_addr, uchar_t *gateway,
1445     uint_t max_frag, nce_t *src_nce, queue_t *rfq, queue_t *stq, ushort_t type,
1446     ipif_t *ipif, ipaddr_t cmask, uint32_t phandle, uint32_t ihandle,
1447     uint32_t flags, const iulp_t *ulp_info, tsol_gc_t *gc, tsol_gcgrp_t *gcgrp,
1448     ip_stack_t *ipst)
1449 {
1450 	ire_t	*ire, *buf;
1451 	ire_t	*ret_ire;
1452 	mblk_t	*mp;
1453 	size_t	bufsize;
1454 	frtn_t	*frtnp;
1455 	ill_t	*ill;
1456 
1457 	bufsize = sizeof (ire_t) + sizeof (frtn_t);
1458 	buf = kmem_alloc(bufsize, KM_NOSLEEP);
1459 	if (buf == NULL) {
1460 		ip1dbg(("ire_create_mp: alloc failed\n"));
1461 		return (NULL);
1462 	}
1463 	frtnp = (frtn_t *)(buf + 1);
1464 	frtnp->free_arg = (caddr_t)buf;
1465 	frtnp->free_func = ire_freemblk;
1466 
1467 	/*
1468 	 * Allocate the new IRE. The ire created will hold a ref on
1469 	 * an nce_t after ire_nce_init, and this ref must either be
1470 	 * (a)  transferred to the ire_cache entry created when ire_add_v4
1471 	 *	is called after successful arp resolution, or,
1472 	 * (b)  released, when arp resolution fails
1473 	 * Case (b) is handled in ire_freemblk() which will be called
1474 	 * when mp is freed as a result of failed arp.
1475 	 */
1476 	mp = esballoc((unsigned char *)buf, bufsize, BPRI_MED, frtnp);
1477 	if (mp == NULL) {
1478 		ip1dbg(("ire_create_mp: alloc failed\n"));
1479 		kmem_free(buf, bufsize);
1480 		return (NULL);
1481 	}
1482 	ire = (ire_t *)mp->b_rptr;
1483 	mp->b_wptr = (uchar_t *)&ire[1];
1484 
1485 	/* Start clean. */
1486 	*ire = ire_null;
1487 	ire->ire_mp = mp;
1488 	mp->b_datap->db_type = IRE_DB_TYPE;
1489 	ire->ire_marks |= IRE_MARK_UNCACHED;
1490 
1491 	ret_ire = ire_init(ire, addr, mask, src_addr, gateway, NULL, src_nce,
1492 	    rfq, stq, type, ipif, cmask, phandle, ihandle, flags, ulp_info, gc,
1493 	    gcgrp, ipst);
1494 
1495 	ill = (ill_t *)(stq->q_ptr);
1496 	if (ret_ire == NULL) {
1497 		/* ire_freemblk needs these set */
1498 		ire->ire_stq_ifindex = ill->ill_phyint->phyint_ifindex;
1499 		ire->ire_stackid = ipst->ips_netstack->netstack_stackid;
1500 		ire->ire_ipst = ipst;
1501 		freeb(ire->ire_mp);
1502 		return (NULL);
1503 	}
1504 	ret_ire->ire_stq_ifindex = ill->ill_phyint->phyint_ifindex;
1505 	ret_ire->ire_stackid = ipst->ips_netstack->netstack_stackid;
1506 	ASSERT(ret_ire == ire);
1507 	ASSERT(ret_ire->ire_ipst == ipst);
1508 	/*
1509 	 * ire_max_frag is normally zero here and is atomically set
1510 	 * under the irebucket lock in ire_add_v[46] except for the
1511 	 * case of IRE_MARK_NOADD. In that event the the ire_max_frag
1512 	 * is non-zero here.
1513 	 */
1514 	ire->ire_max_frag = max_frag;
1515 	return (ire);
1516 }
1517 
1518 /*
1519  * ire_create is called to allocate and initialize a new IRE.
1520  *
1521  * NOTE : This is called as writer sometimes though not required
1522  * by this function.
1523  */
1524 ire_t *
1525 ire_create(uchar_t *addr, uchar_t *mask, uchar_t *src_addr, uchar_t *gateway,
1526     uint_t *max_fragp, nce_t *src_nce, queue_t *rfq, queue_t *stq,
1527     ushort_t type, ipif_t *ipif, ipaddr_t cmask, uint32_t phandle,
1528     uint32_t ihandle, uint32_t flags, const iulp_t *ulp_info, tsol_gc_t *gc,
1529     tsol_gcgrp_t *gcgrp, ip_stack_t *ipst)
1530 {
1531 	ire_t	*ire;
1532 	ire_t	*ret_ire;
1533 
1534 	ire = kmem_cache_alloc(ire_cache, KM_NOSLEEP);
1535 	if (ire == NULL) {
1536 		ip1dbg(("ire_create: alloc failed\n"));
1537 		return (NULL);
1538 	}
1539 	*ire = ire_null;
1540 
1541 	ret_ire = ire_init(ire, addr, mask, src_addr, gateway, max_fragp,
1542 	    src_nce, rfq, stq, type, ipif, cmask, phandle, ihandle, flags,
1543 	    ulp_info, gc, gcgrp, ipst);
1544 
1545 	if (ret_ire == NULL) {
1546 		kmem_cache_free(ire_cache, ire);
1547 		return (NULL);
1548 	}
1549 	ASSERT(ret_ire == ire);
1550 	return (ire);
1551 }
1552 
1553 /*
1554  * Common to IPv4 and IPv6
1555  */
1556 boolean_t
1557 ire_init_common(ire_t *ire, uint_t *max_fragp, nce_t *src_nce, queue_t *rfq,
1558     queue_t *stq, ushort_t type, ipif_t *ipif, uint32_t phandle,
1559     uint32_t ihandle, uint32_t flags, uchar_t ipversion, const iulp_t *ulp_info,
1560     tsol_gc_t *gc, tsol_gcgrp_t *gcgrp, ip_stack_t *ipst)
1561 {
1562 	ire->ire_max_fragp = max_fragp;
1563 	ire->ire_frag_flag |= (ipst->ips_ip_path_mtu_discovery) ? IPH_DF : 0;
1564 
1565 #ifdef DEBUG
1566 	if (ipif != NULL) {
1567 		if (ipif->ipif_isv6)
1568 			ASSERT(ipversion == IPV6_VERSION);
1569 		else
1570 			ASSERT(ipversion == IPV4_VERSION);
1571 	}
1572 #endif /* DEBUG */
1573 
1574 	/*
1575 	 * Create/initialize IRE security attribute only in Trusted mode;
1576 	 * if the passed in gc/gcgrp is non-NULL, we expect that the caller
1577 	 * has held a reference to it and will release it when this routine
1578 	 * returns a failure, otherwise we own the reference.  We do this
1579 	 * prior to initializing the rest IRE fields.
1580 	 *
1581 	 * Don't allocate ire_gw_secattr for the resolver case to prevent
1582 	 * memory leak (in case of external resolution failure). We'll
1583 	 * allocate it after a successful external resolution, in ire_add().
1584 	 * Note that ire->ire_mp != NULL here means this ire is headed
1585 	 * to an external resolver.
1586 	 */
1587 	if (is_system_labeled()) {
1588 		if ((type & (IRE_LOCAL | IRE_LOOPBACK | IRE_BROADCAST |
1589 		    IRE_INTERFACE)) != 0) {
1590 			/* release references on behalf of caller */
1591 			if (gc != NULL)
1592 				GC_REFRELE(gc);
1593 			if (gcgrp != NULL)
1594 				GCGRP_REFRELE(gcgrp);
1595 		} else if ((ire->ire_mp == NULL) &&
1596 		    tsol_ire_init_gwattr(ire, ipversion, gc, gcgrp) != 0) {
1597 			return (B_FALSE);
1598 		}
1599 	}
1600 
1601 	ire->ire_stq = stq;
1602 	ire->ire_rfq = rfq;
1603 	ire->ire_type = type;
1604 	ire->ire_flags = RTF_UP | flags;
1605 	ire->ire_ident = TICK_TO_MSEC(lbolt);
1606 	bcopy(ulp_info, &ire->ire_uinfo, sizeof (iulp_t));
1607 
1608 	ire->ire_tire_mark = ire->ire_ob_pkt_count + ire->ire_ib_pkt_count;
1609 	ire->ire_last_used_time = lbolt;
1610 	ire->ire_create_time = (uint32_t)gethrestime_sec();
1611 
1612 	/*
1613 	 * If this IRE is an IRE_CACHE, inherit the handles from the
1614 	 * parent IREs. For others in the forwarding table, assign appropriate
1615 	 * new ones.
1616 	 *
1617 	 * The mutex protecting ire_handle is because ire_create is not always
1618 	 * called as a writer.
1619 	 */
1620 	if (ire->ire_type & IRE_OFFSUBNET) {
1621 		mutex_enter(&ipst->ips_ire_handle_lock);
1622 		ire->ire_phandle = (uint32_t)ipst->ips_ire_handle++;
1623 		mutex_exit(&ipst->ips_ire_handle_lock);
1624 	} else if (ire->ire_type & IRE_INTERFACE) {
1625 		mutex_enter(&ipst->ips_ire_handle_lock);
1626 		ire->ire_ihandle = (uint32_t)ipst->ips_ire_handle++;
1627 		mutex_exit(&ipst->ips_ire_handle_lock);
1628 	} else if (ire->ire_type == IRE_CACHE) {
1629 		ire->ire_phandle = phandle;
1630 		ire->ire_ihandle = ihandle;
1631 	}
1632 	ire->ire_ipif = ipif;
1633 	if (ipif != NULL) {
1634 		ire->ire_ipif_seqid = ipif->ipif_seqid;
1635 		ire->ire_ipif_ifindex =
1636 		    ipif->ipif_ill->ill_phyint->phyint_ifindex;
1637 		ire->ire_zoneid = ipif->ipif_zoneid;
1638 	} else {
1639 		ire->ire_zoneid = GLOBAL_ZONEID;
1640 	}
1641 	ire->ire_ipversion = ipversion;
1642 	mutex_init(&ire->ire_lock, NULL, MUTEX_DEFAULT, NULL);
1643 	if (ipversion == IPV4_VERSION) {
1644 		/*
1645 		 * IPv6 initializes the ire_nce in ire_add_v6, which expects
1646 		 * to find the ire_nce to be null when it is called.
1647 		 */
1648 		if (ire_nce_init(ire, src_nce) != 0) {
1649 			/* some failure occurred. propagate error back */
1650 			return (B_FALSE);
1651 		}
1652 	}
1653 	ire->ire_refcnt = 1;
1654 	ire->ire_ipst = ipst;	/* No netstack_hold */
1655 	ire->ire_trace_disable = B_FALSE;
1656 
1657 	return (B_TRUE);
1658 }
1659 
1660 /*
1661  * This routine is called repeatedly by ipif_up to create broadcast IREs.
1662  * It is passed a pointer to a slot in an IRE pointer array into which to
1663  * place the pointer to the new IRE, if indeed we create one.  If the
1664  * IRE corresponding to the address passed in would be a duplicate of an
1665  * existing one, we don't create the new one.  irep is incremented before
1666  * return only if we do create a new IRE.  (Always called as writer.)
1667  *
1668  * Note that with the "match_flags" parameter, we can match on either
1669  * a particular logical interface (MATCH_IRE_IPIF) or for all logical
1670  * interfaces for a given physical interface (MATCH_IRE_ILL).  Currently,
1671  * we only create broadcast ire's on a per physical interface basis. If
1672  * someone is going to be mucking with logical interfaces, it is important
1673  * to call "ipif_check_bcast_ires()" to make sure that any change to a
1674  * logical interface will not cause critical broadcast IRE's to be deleted.
1675  */
1676 ire_t **
1677 ire_check_and_create_bcast(ipif_t *ipif, ipaddr_t  addr, ire_t **irep,
1678     int match_flags)
1679 {
1680 	ire_t *ire;
1681 	uint64_t check_flags = IPIF_DEPRECATED | IPIF_NOLOCAL | IPIF_ANYCAST;
1682 	boolean_t prefer;
1683 	ill_t *ill = ipif->ipif_ill;
1684 	ip_stack_t *ipst = ill->ill_ipst;
1685 
1686 	/*
1687 	 * No broadcast IREs for the LOOPBACK interface
1688 	 * or others such as point to point and IPIF_NOXMIT.
1689 	 */
1690 	if (!(ipif->ipif_flags & IPIF_BROADCAST) ||
1691 	    (ipif->ipif_flags & IPIF_NOXMIT))
1692 		return (irep);
1693 
1694 	/*
1695 	 * If this new IRE would be a duplicate, only prefer it if one of
1696 	 * the following is true:
1697 	 *
1698 	 * 1. The existing one has IPIF_DEPRECATED|IPIF_LOCAL|IPIF_ANYCAST
1699 	 *    set and the new one has all of those clear.
1700 	 *
1701 	 * 2. The existing one corresponds to an underlying ILL in an IPMP
1702 	 *    group and the new one corresponds to an IPMP group interface.
1703 	 */
1704 	if ((ire = ire_ctable_lookup(addr, 0, IRE_BROADCAST, ipif,
1705 	    ipif->ipif_zoneid, NULL, match_flags, ipst)) != NULL) {
1706 		prefer = ((ire->ire_ipif->ipif_flags & check_flags) &&
1707 		    !(ipif->ipif_flags & check_flags)) ||
1708 		    (IS_UNDER_IPMP(ire->ire_ipif->ipif_ill) && IS_IPMP(ill));
1709 		if (!prefer) {
1710 			ire_refrele(ire);
1711 			return (irep);
1712 		}
1713 
1714 		/*
1715 		 * Bcast ires exist in pairs. Both have to be deleted,
1716 		 * Since we are exclusive we can make the above assertion.
1717 		 * The 1st has to be refrele'd since it was ctable_lookup'd.
1718 		 */
1719 		ASSERT(IAM_WRITER_IPIF(ipif));
1720 		ASSERT(ire->ire_next->ire_addr == ire->ire_addr);
1721 		ire_delete(ire->ire_next);
1722 		ire_delete(ire);
1723 		ire_refrele(ire);
1724 	}
1725 	return (ire_create_bcast(ipif, addr, irep));
1726 }
1727 
1728 uint_t ip_loopback_mtu = IP_LOOPBACK_MTU;
1729 
1730 /*
1731  * This routine is called from ipif_check_bcast_ires and ire_check_bcast.
1732  * It leaves all the verifying and deleting to those routines. So it always
1733  * creates 2 bcast ires and chains them into the ire array passed in.
1734  */
1735 ire_t **
1736 ire_create_bcast(ipif_t *ipif, ipaddr_t  addr, ire_t **irep)
1737 {
1738 	ip_stack_t	*ipst = ipif->ipif_ill->ill_ipst;
1739 	ill_t		*ill = ipif->ipif_ill;
1740 
1741 	ASSERT(IAM_WRITER_IPIF(ipif));
1742 
1743 	if (IS_IPMP(ill)) {
1744 		/*
1745 		 * Broadcast IREs for the IPMP meta-interface use the
1746 		 * nominated broadcast interface to send and receive packets.
1747 		 * If there's no nominated interface, send the packets down to
1748 		 * the IPMP stub driver, which will discard them.  If the
1749 		 * nominated broadcast interface changes, ill_refresh_bcast()
1750 		 * will refresh the broadcast IREs.
1751 		 */
1752 		if ((ill = ipmp_illgrp_cast_ill(ill->ill_grp)) == NULL)
1753 			ill = ipif->ipif_ill;
1754 	}
1755 
1756 	*irep++ = ire_create(
1757 	    (uchar_t *)&addr,			/* dest addr */
1758 	    (uchar_t *)&ip_g_all_ones,		/* mask */
1759 	    (uchar_t *)&ipif->ipif_src_addr,	/* source addr */
1760 	    NULL,				/* no gateway */
1761 	    &ipif->ipif_mtu,			/* max frag */
1762 	    NULL,				/* no src nce */
1763 	    ill->ill_rq,			/* recv-from queue */
1764 	    ill->ill_wq,			/* send-to queue */
1765 	    IRE_BROADCAST,
1766 	    ipif,
1767 	    0,
1768 	    0,
1769 	    0,
1770 	    0,
1771 	    &ire_uinfo_null,
1772 	    NULL,
1773 	    NULL,
1774 	    ipst);
1775 
1776 	*irep++ = ire_create(
1777 	    (uchar_t *)&addr,			/* dest address */
1778 	    (uchar_t *)&ip_g_all_ones,		/* mask */
1779 	    (uchar_t *)&ipif->ipif_src_addr,	/* source address */
1780 	    NULL,				/* no gateway */
1781 	    &ip_loopback_mtu,			/* max frag size */
1782 	    NULL,				/* no src_nce */
1783 	    ill->ill_rq,			/* recv-from queue */
1784 	    NULL,				/* no send-to queue */
1785 	    IRE_BROADCAST,			/* Needed for fanout in wput */
1786 	    ipif,
1787 	    0,
1788 	    0,
1789 	    0,
1790 	    0,
1791 	    &ire_uinfo_null,
1792 	    NULL,
1793 	    NULL,
1794 	    ipst);
1795 
1796 	return (irep);
1797 }
1798 
1799 /*
1800  * ire_walk routine to delete or update any IRE_CACHE that might contain
1801  * stale information.
1802  * The flags state which entries to delete or update.
1803  * Garbage collection is done separately using kmem alloc callbacks to
1804  * ip_trash_ire_reclaim.
1805  * Used for both IPv4 and IPv6. However, IPv6 only uses FLUSH_MTU_TIME
1806  * since other stale information is cleaned up using NUD.
1807  */
1808 void
1809 ire_expire(ire_t *ire, char *arg)
1810 {
1811 	ire_expire_arg_t	*ieap = (ire_expire_arg_t *)(uintptr_t)arg;
1812 	ill_t			*stq_ill;
1813 	int			flush_flags = ieap->iea_flush_flag;
1814 	ip_stack_t		*ipst = ieap->iea_ipst;
1815 
1816 	if ((flush_flags & FLUSH_REDIRECT_TIME) &&
1817 	    (ire->ire_flags & RTF_DYNAMIC)) {
1818 		/* Make sure we delete the corresponding IRE_CACHE */
1819 		ip1dbg(("ire_expire: all redirects\n"));
1820 		ip_rts_rtmsg(RTM_DELETE, ire, 0, ipst);
1821 		ire_delete(ire);
1822 		atomic_dec_32(&ipst->ips_ip_redirect_cnt);
1823 		return;
1824 	}
1825 	if (ire->ire_type != IRE_CACHE)
1826 		return;
1827 
1828 	if (flush_flags & FLUSH_ARP_TIME) {
1829 		/*
1830 		 * Remove all IRE_CACHE except IPv4 multicast ires. These
1831 		 * ires will be deleted by ip_trash_ire_reclaim_stack()
1832 		 * when system runs low in memory.
1833 		 * Verify that create time is more than ip_ire_arp_interval
1834 		 * milliseconds ago.
1835 		 */
1836 
1837 		if (!(ire->ire_ipversion == IPV4_VERSION &&
1838 		    CLASSD(ire->ire_addr)) && NCE_EXPIRED(ire->ire_nce, ipst)) {
1839 			ire_delete(ire);
1840 			return;
1841 		}
1842 	}
1843 
1844 	if (ipst->ips_ip_path_mtu_discovery && (flush_flags & FLUSH_MTU_TIME) &&
1845 	    (ire->ire_ipif != NULL)) {
1846 		/* Increase pmtu if it is less than the interface mtu */
1847 		mutex_enter(&ire->ire_lock);
1848 		/*
1849 		 * If the ipif is a vni (whose mtu is 0, since it's virtual)
1850 		 * get the mtu from the sending interfaces' ipif
1851 		 */
1852 		if (IS_VNI(ire->ire_ipif->ipif_ill)) {
1853 			stq_ill = ire->ire_stq->q_ptr;
1854 			ire->ire_max_frag = MIN(stq_ill->ill_ipif->ipif_mtu,
1855 			    IP_MAXPACKET);
1856 		} else {
1857 			ire->ire_max_frag = MIN(ire->ire_ipif->ipif_mtu,
1858 			    IP_MAXPACKET);
1859 		}
1860 		ire->ire_marks &= ~IRE_MARK_PMTU;
1861 		ire->ire_frag_flag |= IPH_DF;
1862 		mutex_exit(&ire->ire_lock);
1863 	}
1864 }
1865 
1866 /*
1867  * Return any local address.  We use this to target ourselves
1868  * when the src address was specified as 'default'.
1869  * Preference for IRE_LOCAL entries.
1870  */
1871 ire_t *
1872 ire_lookup_local(zoneid_t zoneid, ip_stack_t *ipst)
1873 {
1874 	ire_t	*ire;
1875 	irb_t	*irb;
1876 	ire_t	*maybe = NULL;
1877 	int i;
1878 
1879 	for (i = 0; i < ipst->ips_ip_cache_table_size;  i++) {
1880 		irb = &ipst->ips_ip_cache_table[i];
1881 		if (irb->irb_ire == NULL)
1882 			continue;
1883 		rw_enter(&irb->irb_lock, RW_READER);
1884 		for (ire = irb->irb_ire; ire != NULL; ire = ire->ire_next) {
1885 			if ((ire->ire_marks & IRE_MARK_CONDEMNED) ||
1886 			    (ire->ire_zoneid != zoneid &&
1887 			    ire->ire_zoneid != ALL_ZONES))
1888 				continue;
1889 			switch (ire->ire_type) {
1890 			case IRE_LOOPBACK:
1891 				if (maybe == NULL) {
1892 					IRE_REFHOLD(ire);
1893 					maybe = ire;
1894 				}
1895 				break;
1896 			case IRE_LOCAL:
1897 				if (maybe != NULL) {
1898 					ire_refrele(maybe);
1899 				}
1900 				IRE_REFHOLD(ire);
1901 				rw_exit(&irb->irb_lock);
1902 				return (ire);
1903 			}
1904 		}
1905 		rw_exit(&irb->irb_lock);
1906 	}
1907 	return (maybe);
1908 }
1909 
1910 /*
1911  * If the specified IRE is associated with a particular ILL, return
1912  * that ILL pointer (May be called as writer.).
1913  *
1914  * NOTE : This is not a generic function that can be used always.
1915  * This function always returns the ill of the outgoing packets
1916  * if this ire is used.
1917  */
1918 ill_t *
1919 ire_to_ill(const ire_t *ire)
1920 {
1921 	ill_t *ill = NULL;
1922 
1923 	/*
1924 	 * 1) For an IRE_CACHE, ire_ipif is the one where it obtained
1925 	 *    the source address from. ire_stq is the one where the
1926 	 *    packets will be sent out on. We return that here.
1927 	 *
1928 	 * 2) IRE_BROADCAST normally has a loopback and a non-loopback
1929 	 *    copy and they always exist next to each other with loopback
1930 	 *    copy being the first one. If we are called on the non-loopback
1931 	 *    copy, return the one pointed by ire_stq. If it was called on
1932 	 *    a loopback copy, we still return the one pointed by the next
1933 	 *    ire's ire_stq pointer i.e the one pointed by the non-loopback
1934 	 *    copy. We don't want use ire_ipif as it might represent the
1935 	 *    source address (if we borrow source addresses for
1936 	 *    IRE_BROADCASTS in the future).
1937 	 *    However if an interface is currently coming up, the above
1938 	 *    condition may not hold during that period since the ires
1939 	 *    are added one at a time. Thus one of the pair could have been
1940 	 *    added and the other not yet added.
1941 	 * 3) For many other IREs (e.g., IRE_LOCAL), ire_rfq indicates the ill.
1942 	 * 4) For all others return the ones pointed by ire_ipif->ipif_ill.
1943 	 *    That handles IRE_LOOPBACK.
1944 	 */
1945 
1946 	if (ire->ire_type == IRE_CACHE) {
1947 		ill = (ill_t *)ire->ire_stq->q_ptr;
1948 	} else if (ire->ire_type == IRE_BROADCAST) {
1949 		if (ire->ire_stq != NULL) {
1950 			ill = (ill_t *)ire->ire_stq->q_ptr;
1951 		} else {
1952 			ire_t  *ire_next;
1953 
1954 			ire_next = ire->ire_next;
1955 			if (ire_next != NULL &&
1956 			    ire_next->ire_type == IRE_BROADCAST &&
1957 			    ire_next->ire_addr == ire->ire_addr &&
1958 			    ire_next->ire_ipif == ire->ire_ipif) {
1959 				ill = (ill_t *)ire_next->ire_stq->q_ptr;
1960 			}
1961 		}
1962 	} else if (ire->ire_rfq != NULL) {
1963 		ill = ire->ire_rfq->q_ptr;
1964 	} else if (ire->ire_ipif != NULL) {
1965 		ill = ire->ire_ipif->ipif_ill;
1966 	}
1967 	return (ill);
1968 }
1969 
1970 /* Arrange to call the specified function for every IRE in the world. */
1971 void
1972 ire_walk(pfv_t func, void *arg, ip_stack_t *ipst)
1973 {
1974 	ire_walk_ipvers(func, arg, 0, ALL_ZONES, ipst);
1975 }
1976 
1977 void
1978 ire_walk_v4(pfv_t func, void *arg, zoneid_t zoneid, ip_stack_t *ipst)
1979 {
1980 	ire_walk_ipvers(func, arg, IPV4_VERSION, zoneid, ipst);
1981 }
1982 
1983 void
1984 ire_walk_v6(pfv_t func, void *arg, zoneid_t zoneid, ip_stack_t *ipst)
1985 {
1986 	ire_walk_ipvers(func, arg, IPV6_VERSION, zoneid, ipst);
1987 }
1988 
1989 /*
1990  * Walk a particular version. version == 0 means both v4 and v6.
1991  */
1992 static void
1993 ire_walk_ipvers(pfv_t func, void *arg, uchar_t vers, zoneid_t zoneid,
1994     ip_stack_t *ipst)
1995 {
1996 	if (vers != IPV6_VERSION) {
1997 		/*
1998 		 * ip_forwarding_table variable doesn't matter for IPv4 since
1999 		 * ire_walk_ill_tables uses ips_ip_ftable for IPv4.
2000 		 */
2001 		ire_walk_ill_tables(0, 0, func, arg, IP_MASK_TABLE_SIZE,
2002 		    0, NULL,
2003 		    ipst->ips_ip_cache_table_size, ipst->ips_ip_cache_table,
2004 		    NULL, zoneid, ipst);
2005 	}
2006 	if (vers != IPV4_VERSION) {
2007 		ire_walk_ill_tables(0, 0, func, arg, IP6_MASK_TABLE_SIZE,
2008 		    ipst->ips_ip6_ftable_hash_size,
2009 		    ipst->ips_ip_forwarding_table_v6,
2010 		    ipst->ips_ip6_cache_table_size,
2011 		    ipst->ips_ip_cache_table_v6, NULL, zoneid, ipst);
2012 	}
2013 }
2014 
2015 /*
2016  * Arrange to call the specified function for every IRE that matches the ill.
2017  */
2018 void
2019 ire_walk_ill(uint_t match_flags, uint_t ire_type, pfv_t func, void *arg,
2020     ill_t *ill)
2021 {
2022 	uchar_t vers = (ill->ill_isv6 ? IPV6_VERSION : IPV4_VERSION);
2023 
2024 	ire_walk_ill_ipvers(match_flags, ire_type, func, arg, vers, ill);
2025 }
2026 
2027 void
2028 ire_walk_ill_v4(uint_t match_flags, uint_t ire_type, pfv_t func, void *arg,
2029     ill_t *ill)
2030 {
2031 	ire_walk_ill_ipvers(match_flags, ire_type, func, arg, IPV4_VERSION,
2032 	    ill);
2033 }
2034 
2035 void
2036 ire_walk_ill_v6(uint_t match_flags, uint_t ire_type, pfv_t func, void *arg,
2037     ill_t *ill)
2038 {
2039 	ire_walk_ill_ipvers(match_flags, ire_type, func, arg, IPV6_VERSION,
2040 	    ill);
2041 }
2042 
2043 /*
2044  * Walk a particular ill and version.
2045  */
2046 static void
2047 ire_walk_ill_ipvers(uint_t match_flags, uint_t ire_type, pfv_t func,
2048     void *arg, uchar_t vers, ill_t *ill)
2049 {
2050 	ip_stack_t	*ipst = ill->ill_ipst;
2051 
2052 	if (vers == IPV4_VERSION) {
2053 		ire_walk_ill_tables(match_flags, ire_type, func, arg,
2054 		    IP_MASK_TABLE_SIZE, 0,
2055 		    NULL, ipst->ips_ip_cache_table_size,
2056 		    ipst->ips_ip_cache_table, ill, ALL_ZONES, ipst);
2057 	} else if (vers == IPV6_VERSION) {
2058 		ire_walk_ill_tables(match_flags, ire_type, func, arg,
2059 		    IP6_MASK_TABLE_SIZE, ipst->ips_ip6_ftable_hash_size,
2060 		    ipst->ips_ip_forwarding_table_v6,
2061 		    ipst->ips_ip6_cache_table_size,
2062 		    ipst->ips_ip_cache_table_v6, ill, ALL_ZONES, ipst);
2063 	}
2064 }
2065 
2066 boolean_t
2067 ire_walk_ill_match(uint_t match_flags, uint_t ire_type, ire_t *ire,
2068     ill_t *ill, zoneid_t zoneid, ip_stack_t *ipst)
2069 {
2070 	ill_t *ire_stq_ill = NULL;
2071 	ill_t *ire_ipif_ill = NULL;
2072 
2073 	ASSERT(match_flags != 0 || zoneid != ALL_ZONES);
2074 	/*
2075 	 * MATCH_IRE_ILL: We match both on ill pointed by ire_stq and
2076 	 *    ire_ipif.  Only in the case of IRE_CACHEs can ire_stq and
2077 	 *    ire_ipif be pointing to different ills. But we want to keep
2078 	 *    this function generic enough for future use. So, we always
2079 	 *    try to match on both.  The only caller of this function
2080 	 *    ire_walk_ill_tables, will call "func" after we return from
2081 	 *    this function. We expect "func" to do the right filtering
2082 	 *    of ires in this case.
2083 	 */
2084 	if (match_flags & MATCH_IRE_ILL) {
2085 		if (ire->ire_stq != NULL)
2086 			ire_stq_ill = ire->ire_stq->q_ptr;
2087 		if (ire->ire_ipif != NULL)
2088 			ire_ipif_ill = ire->ire_ipif->ipif_ill;
2089 	}
2090 
2091 	if (zoneid != ALL_ZONES) {
2092 		/*
2093 		 * We're walking the IREs for a specific zone. The only relevant
2094 		 * IREs are:
2095 		 * - all IREs with a matching ire_zoneid
2096 		 * - all IRE_OFFSUBNETs as they're shared across all zones
2097 		 * - IRE_INTERFACE IREs for interfaces with a usable source addr
2098 		 *   with a matching zone
2099 		 * - IRE_DEFAULTs with a gateway reachable from the zone
2100 		 * We should really match on IRE_OFFSUBNETs and IRE_DEFAULTs
2101 		 * using the same rule; but the above rules are consistent with
2102 		 * the behavior of ire_ftable_lookup[_v6]() so that all the
2103 		 * routes that can be matched during lookup are also matched
2104 		 * here.
2105 		 */
2106 		if (zoneid != ire->ire_zoneid && ire->ire_zoneid != ALL_ZONES) {
2107 			/*
2108 			 * Note, IRE_INTERFACE can have the stq as NULL. For
2109 			 * example, if the default multicast route is tied to
2110 			 * the loopback address.
2111 			 */
2112 			if ((ire->ire_type & IRE_INTERFACE) &&
2113 			    (ire->ire_stq != NULL)) {
2114 				ire_stq_ill = (ill_t *)ire->ire_stq->q_ptr;
2115 				if (ire->ire_ipversion == IPV4_VERSION) {
2116 					if (!ipif_usesrc_avail(ire_stq_ill,
2117 					    zoneid))
2118 						/* No usable src addr in zone */
2119 						return (B_FALSE);
2120 				} else if (ire_stq_ill->ill_usesrc_ifindex
2121 				    != 0) {
2122 					/*
2123 					 * For IPv6 use ipif_select_source_v6()
2124 					 * so the right scope selection is done
2125 					 */
2126 					ipif_t *src_ipif;
2127 					src_ipif =
2128 					    ipif_select_source_v6(ire_stq_ill,
2129 					    &ire->ire_addr_v6, B_FALSE,
2130 					    IPV6_PREFER_SRC_DEFAULT,
2131 					    zoneid);
2132 					if (src_ipif != NULL) {
2133 						ipif_refrele(src_ipif);
2134 					} else {
2135 						return (B_FALSE);
2136 					}
2137 				} else {
2138 					return (B_FALSE);
2139 				}
2140 
2141 			} else if (!(ire->ire_type & IRE_OFFSUBNET)) {
2142 				return (B_FALSE);
2143 			}
2144 		}
2145 
2146 		/*
2147 		 * Match all default routes from the global zone, irrespective
2148 		 * of reachability. For a non-global zone only match those
2149 		 * where ire_gateway_addr has a IRE_INTERFACE for the zoneid.
2150 		 */
2151 		if (ire->ire_type == IRE_DEFAULT && zoneid != GLOBAL_ZONEID) {
2152 			int ire_match_flags = 0;
2153 			in6_addr_t gw_addr_v6;
2154 			ire_t *rire;
2155 
2156 			ire_match_flags |= MATCH_IRE_TYPE;
2157 			if (ire->ire_ipif != NULL)
2158 				ire_match_flags |= MATCH_IRE_ILL;
2159 
2160 			if (ire->ire_ipversion == IPV4_VERSION) {
2161 				rire = ire_route_lookup(ire->ire_gateway_addr,
2162 				    0, 0, IRE_INTERFACE, ire->ire_ipif, NULL,
2163 				    zoneid, NULL, ire_match_flags, ipst);
2164 			} else {
2165 				ASSERT(ire->ire_ipversion == IPV6_VERSION);
2166 				mutex_enter(&ire->ire_lock);
2167 				gw_addr_v6 = ire->ire_gateway_addr_v6;
2168 				mutex_exit(&ire->ire_lock);
2169 				rire = ire_route_lookup_v6(&gw_addr_v6,
2170 				    NULL, NULL, IRE_INTERFACE, ire->ire_ipif,
2171 				    NULL, zoneid, NULL, ire_match_flags, ipst);
2172 			}
2173 			if (rire == NULL) {
2174 				return (B_FALSE);
2175 			}
2176 			ire_refrele(rire);
2177 		}
2178 	}
2179 
2180 	if (((!(match_flags & MATCH_IRE_TYPE)) ||
2181 	    (ire->ire_type & ire_type)) &&
2182 	    ((!(match_flags & MATCH_IRE_ILL)) ||
2183 	    (ire_stq_ill == ill || ire_ipif_ill == ill ||
2184 	    ire_ipif_ill != NULL && IS_IN_SAME_ILLGRP(ire_ipif_ill, ill)))) {
2185 		return (B_TRUE);
2186 	}
2187 	return (B_FALSE);
2188 }
2189 
2190 int
2191 rtfunc(struct radix_node *rn, void *arg)
2192 {
2193 	struct rtfuncarg *rtf = arg;
2194 	struct rt_entry *rt;
2195 	irb_t *irb;
2196 	ire_t *ire;
2197 	boolean_t ret;
2198 
2199 	rt = (struct rt_entry *)rn;
2200 	ASSERT(rt != NULL);
2201 	irb = &rt->rt_irb;
2202 	for (ire = irb->irb_ire; ire != NULL; ire = ire->ire_next) {
2203 		if ((rtf->rt_match_flags != 0) ||
2204 		    (rtf->rt_zoneid != ALL_ZONES)) {
2205 			ret = ire_walk_ill_match(rtf->rt_match_flags,
2206 			    rtf->rt_ire_type, ire,
2207 			    rtf->rt_ill, rtf->rt_zoneid, rtf->rt_ipst);
2208 		} else
2209 			ret = B_TRUE;
2210 		if (ret)
2211 			(*rtf->rt_func)(ire, rtf->rt_arg);
2212 	}
2213 	return (0);
2214 }
2215 
2216 /*
2217  * Walk the ftable and the ctable entries that match the ill.
2218  */
2219 void
2220 ire_walk_ill_tables(uint_t match_flags, uint_t ire_type, pfv_t func,
2221     void *arg, size_t ftbl_sz, size_t htbl_sz, irb_t **ipftbl,
2222     size_t ctbl_sz, irb_t *ipctbl, ill_t *ill, zoneid_t zoneid,
2223     ip_stack_t *ipst)
2224 {
2225 	irb_t	*irb_ptr;
2226 	irb_t	*irb;
2227 	ire_t	*ire;
2228 	int i, j;
2229 	boolean_t ret;
2230 	struct rtfuncarg rtfarg;
2231 
2232 	ASSERT((!(match_flags & MATCH_IRE_ILL)) || (ill != NULL));
2233 	ASSERT(!(match_flags & MATCH_IRE_TYPE) || (ire_type != 0));
2234 	/*
2235 	 * Optimize by not looking at the forwarding table if there
2236 	 * is a MATCH_IRE_TYPE specified with no IRE_FORWARDTABLE
2237 	 * specified in ire_type.
2238 	 */
2239 	if (!(match_flags & MATCH_IRE_TYPE) ||
2240 	    ((ire_type & IRE_FORWARDTABLE) != 0)) {
2241 		/* knobs such that routine is called only for v6 case */
2242 		if (ipftbl == ipst->ips_ip_forwarding_table_v6) {
2243 			for (i = (ftbl_sz - 1);  i >= 0; i--) {
2244 				if ((irb_ptr = ipftbl[i]) == NULL)
2245 					continue;
2246 				for (j = 0; j < htbl_sz; j++) {
2247 					irb = &irb_ptr[j];
2248 					if (irb->irb_ire == NULL)
2249 						continue;
2250 
2251 					IRB_REFHOLD(irb);
2252 					for (ire = irb->irb_ire; ire != NULL;
2253 					    ire = ire->ire_next) {
2254 						if (match_flags == 0 &&
2255 						    zoneid == ALL_ZONES) {
2256 							ret = B_TRUE;
2257 						} else {
2258 							ret =
2259 							    ire_walk_ill_match(
2260 							    match_flags,
2261 							    ire_type, ire, ill,
2262 							    zoneid, ipst);
2263 						}
2264 						if (ret)
2265 							(*func)(ire, arg);
2266 					}
2267 					IRB_REFRELE(irb);
2268 				}
2269 			}
2270 		} else {
2271 			(void) memset(&rtfarg, 0, sizeof (rtfarg));
2272 			rtfarg.rt_func = func;
2273 			rtfarg.rt_arg = arg;
2274 			if (match_flags != 0) {
2275 				rtfarg.rt_match_flags = match_flags;
2276 			}
2277 			rtfarg.rt_ire_type = ire_type;
2278 			rtfarg.rt_ill = ill;
2279 			rtfarg.rt_zoneid = zoneid;
2280 			rtfarg.rt_ipst = ipst;	/* No netstack_hold */
2281 			(void) ipst->ips_ip_ftable->rnh_walktree_mt(
2282 			    ipst->ips_ip_ftable,
2283 			    rtfunc, &rtfarg, irb_refhold_rn, irb_refrele_rn);
2284 		}
2285 	}
2286 
2287 	/*
2288 	 * Optimize by not looking at the cache table if there
2289 	 * is a MATCH_IRE_TYPE specified with no IRE_CACHETABLE
2290 	 * specified in ire_type.
2291 	 */
2292 	if (!(match_flags & MATCH_IRE_TYPE) ||
2293 	    ((ire_type & IRE_CACHETABLE) != 0)) {
2294 		for (i = 0; i < ctbl_sz;  i++) {
2295 			irb = &ipctbl[i];
2296 			if (irb->irb_ire == NULL)
2297 				continue;
2298 			IRB_REFHOLD(irb);
2299 			for (ire = irb->irb_ire; ire != NULL;
2300 			    ire = ire->ire_next) {
2301 				if (match_flags == 0 && zoneid == ALL_ZONES) {
2302 					ret = B_TRUE;
2303 				} else {
2304 					ret = ire_walk_ill_match(
2305 					    match_flags, ire_type,
2306 					    ire, ill, zoneid, ipst);
2307 				}
2308 				if (ret)
2309 					(*func)(ire, arg);
2310 			}
2311 			IRB_REFRELE(irb);
2312 		}
2313 	}
2314 }
2315 
2316 /*
2317  * This function takes a mask and returns
2318  * number of bits set in the mask. If no
2319  * bit is set it returns 0.
2320  * Assumes a contiguous mask.
2321  */
2322 int
2323 ip_mask_to_plen(ipaddr_t mask)
2324 {
2325 	return (mask == 0 ? 0 : IP_ABITS - (ffs(ntohl(mask)) -1));
2326 }
2327 
2328 /*
2329  * Convert length for a mask to the mask.
2330  */
2331 ipaddr_t
2332 ip_plen_to_mask(uint_t masklen)
2333 {
2334 	return (htonl(IP_HOST_MASK << (IP_ABITS - masklen)));
2335 }
2336 
2337 void
2338 ire_atomic_end(irb_t *irb_ptr, ire_t *ire)
2339 {
2340 	ill_t *stq_ill, *ipif_ill;
2341 	ip_stack_t *ipst = ire->ire_ipst;
2342 
2343 	stq_ill = ire->ire_stq != NULL ? ire->ire_stq->q_ptr : NULL;
2344 	ipif_ill = ire->ire_ipif != NULL ? ire->ire_ipif->ipif_ill : NULL;
2345 	RELEASE_ILL_LOCKS(ipif_ill, stq_ill);
2346 	rw_exit(&irb_ptr->irb_lock);
2347 	rw_exit(&ipst->ips_ill_g_usesrc_lock);
2348 }
2349 
2350 /*
2351  * ire_add_v[46] atomically make sure that the ipif or ill associated
2352  * with the new ire being added is stable and not IPIF_CHANGING or ILL_CHANGING
2353  * before adding the ire to the table. This ensures that we don't create
2354  * new IRE_CACHEs with stale values for parameters that are passed to
2355  * ire_create such as ire_max_frag. Note that ire_create() is passed a pointer
2356  * to the ipif_mtu, and not the value. The actual value is derived from the
2357  * parent ire or ipif under the bucket lock.
2358  */
2359 int
2360 ire_atomic_start(irb_t *irb_ptr, ire_t *ire, queue_t *q, mblk_t *mp,
2361     ipsq_func_t func)
2362 {
2363 	ill_t	*stq_ill;
2364 	ill_t	*ipif_ill;
2365 	int	error = 0;
2366 	ill_t	*ill = NULL;
2367 	ip_stack_t	*ipst = ire->ire_ipst;
2368 
2369 	stq_ill = ire->ire_stq != NULL ? ire->ire_stq->q_ptr : NULL;
2370 	ipif_ill = ire->ire_ipif != NULL ? ire->ire_ipif->ipif_ill : NULL;
2371 
2372 	ASSERT((q != NULL && mp != NULL && func != NULL) ||
2373 	    (q == NULL && mp == NULL && func == NULL));
2374 	rw_enter(&ipst->ips_ill_g_usesrc_lock, RW_READER);
2375 	GRAB_CONN_LOCK(q);
2376 	rw_enter(&irb_ptr->irb_lock, RW_WRITER);
2377 	GRAB_ILL_LOCKS(ipif_ill, stq_ill);
2378 
2379 	/*
2380 	 * While the IRE is in the process of being added, a user may have
2381 	 * invoked the ifconfig usesrc option on the stq_ill to make it a
2382 	 * usesrc client ILL. Check for this possibility here, if it is true
2383 	 * then we fail adding the IRE_CACHE. Another check is to make sure
2384 	 * that an ipif_ill of an IRE_CACHE being added is not part of a usesrc
2385 	 * group. The ill_g_usesrc_lock is released in ire_atomic_end
2386 	 */
2387 	if ((ire->ire_type & IRE_CACHE) &&
2388 	    (ire->ire_marks & IRE_MARK_USESRC_CHECK)) {
2389 		if (stq_ill->ill_usesrc_ifindex != 0) {
2390 			ASSERT(stq_ill->ill_usesrc_grp_next != NULL);
2391 			if ((ipif_ill->ill_phyint->phyint_ifindex !=
2392 			    stq_ill->ill_usesrc_ifindex) ||
2393 			    (ipif_ill->ill_usesrc_grp_next == NULL) ||
2394 			    (ipif_ill->ill_usesrc_ifindex != 0)) {
2395 				error = EINVAL;
2396 				goto done;
2397 			}
2398 		} else if (ipif_ill->ill_usesrc_grp_next != NULL) {
2399 			error = EINVAL;
2400 			goto done;
2401 		}
2402 	}
2403 
2404 	/*
2405 	 * Don't allow IRE's to be created on changing ill's.  Also, since
2406 	 * IPMP flags can be set on an ill without quiescing it, if we're not
2407 	 * a writer on stq_ill, check that the flags still allow IRE creation.
2408 	 */
2409 	if ((stq_ill != NULL) && !IAM_WRITER_ILL(stq_ill)) {
2410 		if (stq_ill->ill_state_flags & ILL_CHANGING) {
2411 			ill = stq_ill;
2412 			error = EAGAIN;
2413 		} else if (IS_UNDER_IPMP(stq_ill)) {
2414 			mutex_enter(&stq_ill->ill_phyint->phyint_lock);
2415 			if (!ipmp_ill_is_active(stq_ill) &&
2416 			    !(ire->ire_marks & IRE_MARK_TESTHIDDEN)) {
2417 				error = EINVAL;
2418 			}
2419 			mutex_exit(&stq_ill->ill_phyint->phyint_lock);
2420 		}
2421 		if (error != 0)
2422 			goto done;
2423 	}
2424 
2425 	if ((ipif_ill != NULL) && !IAM_WRITER_ILL(ipif_ill) &&
2426 	    (ipif_ill->ill_state_flags & ILL_CHANGING)) {
2427 		ill = ipif_ill;
2428 		error = EAGAIN;
2429 		goto done;
2430 	}
2431 
2432 	if ((ire->ire_ipif != NULL) && !IAM_WRITER_IPIF(ire->ire_ipif) &&
2433 	    (ire->ire_ipif->ipif_state_flags & IPIF_CHANGING)) {
2434 		ill = ire->ire_ipif->ipif_ill;
2435 		ASSERT(ill != NULL);
2436 		error = EAGAIN;
2437 		goto done;
2438 	}
2439 
2440 done:
2441 	if (error == EAGAIN && ILL_CAN_WAIT(ill, q)) {
2442 		ipsq_t *ipsq = ill->ill_phyint->phyint_ipsq;
2443 		mutex_enter(&ipsq->ipsq_lock);
2444 		mutex_enter(&ipsq->ipsq_xop->ipx_lock);
2445 		ire_atomic_end(irb_ptr, ire);
2446 		ipsq_enq(ipsq, q, mp, func, NEW_OP, ill);
2447 		mutex_exit(&ipsq->ipsq_xop->ipx_lock);
2448 		mutex_exit(&ipsq->ipsq_lock);
2449 		error = EINPROGRESS;
2450 	} else if (error != 0) {
2451 		ire_atomic_end(irb_ptr, ire);
2452 	}
2453 
2454 	RELEASE_CONN_LOCK(q);
2455 	return (error);
2456 }
2457 
2458 /*
2459  * Add a fully initialized IRE to an appropriate table based on
2460  * ire_type.
2461  *
2462  * allow_unresolved == B_FALSE indicates a legacy code-path call
2463  * that has prohibited the addition of incomplete ire's. If this
2464  * parameter is set, and we find an nce that is in a state other
2465  * than ND_REACHABLE, we fail the add. Note that nce_state could be
2466  * something other than ND_REACHABLE if the nce had just expired and
2467  * the ire_create preceding the ire_add added a new ND_INITIAL nce.
2468  */
2469 int
2470 ire_add(ire_t **irep, queue_t *q, mblk_t *mp, ipsq_func_t func,
2471     boolean_t allow_unresolved)
2472 {
2473 	ire_t	*ire1;
2474 	ill_t	*stq_ill = NULL;
2475 	ill_t	*ill;
2476 	ipif_t	*ipif = NULL;
2477 	ill_walk_context_t ctx;
2478 	ire_t	*ire = *irep;
2479 	int	error;
2480 	boolean_t ire_is_mblk = B_FALSE;
2481 	tsol_gcgrp_t *gcgrp = NULL;
2482 	tsol_gcgrp_addr_t ga;
2483 	ip_stack_t	*ipst = ire->ire_ipst;
2484 
2485 	/* get ready for the day when original ire is not created as mblk */
2486 	if (ire->ire_mp != NULL) {
2487 		ire_is_mblk = B_TRUE;
2488 		/* Copy the ire to a kmem_alloc'ed area */
2489 		ire1 = kmem_cache_alloc(ire_cache, KM_NOSLEEP);
2490 		if (ire1 == NULL) {
2491 			ip1dbg(("ire_add: alloc failed\n"));
2492 			ire_delete(ire);
2493 			*irep = NULL;
2494 			return (ENOMEM);
2495 		}
2496 		ire->ire_marks &= ~IRE_MARK_UNCACHED;
2497 		*ire1 = *ire;
2498 		ire1->ire_mp = NULL;
2499 		ire1->ire_stq_ifindex = 0;
2500 		freeb(ire->ire_mp);
2501 		ire = ire1;
2502 	}
2503 	if (ire->ire_stq != NULL)
2504 		stq_ill = ire->ire_stq->q_ptr;
2505 
2506 	if (stq_ill != NULL && ire->ire_type == IRE_CACHE &&
2507 	    stq_ill->ill_net_type == IRE_IF_RESOLVER) {
2508 		rw_enter(&ipst->ips_ill_g_lock, RW_READER);
2509 		ill = ILL_START_WALK_ALL(&ctx, ipst);
2510 		for (; ill != NULL; ill = ill_next(&ctx, ill)) {
2511 			mutex_enter(&ill->ill_lock);
2512 			if (ill->ill_state_flags & ILL_CONDEMNED) {
2513 				mutex_exit(&ill->ill_lock);
2514 				continue;
2515 			}
2516 			/*
2517 			 * We need to make sure that the ipif is a valid one
2518 			 * before adding the IRE_CACHE. This happens only
2519 			 * with IRE_CACHE when there is an external resolver.
2520 			 *
2521 			 * We can unplumb a logical interface while the
2522 			 * packet is waiting in ARP with the IRE. Then,
2523 			 * later on when we feed the IRE back, the ipif
2524 			 * has to be re-checked. This can't happen with
2525 			 * NDP currently, as we never queue the IRE with
2526 			 * the packet. We always try to recreate the IRE
2527 			 * when the resolution is completed. But, we do
2528 			 * it for IPv6 also here so that in future if
2529 			 * we have external resolvers, it will work without
2530 			 * any change.
2531 			 */
2532 			ipif = ipif_lookup_seqid(ill, ire->ire_ipif_seqid);
2533 			if (ipif != NULL) {
2534 				ipif_refhold_locked(ipif);
2535 				mutex_exit(&ill->ill_lock);
2536 				break;
2537 			}
2538 			mutex_exit(&ill->ill_lock);
2539 		}
2540 		rw_exit(&ipst->ips_ill_g_lock);
2541 		if (ipif == NULL ||
2542 		    (ipif->ipif_isv6 &&
2543 		    !IN6_IS_ADDR_UNSPECIFIED(&ire->ire_src_addr_v6) &&
2544 		    !IN6_ARE_ADDR_EQUAL(&ire->ire_src_addr_v6,
2545 		    &ipif->ipif_v6src_addr)) ||
2546 		    (!ipif->ipif_isv6 &&
2547 		    ire->ire_src_addr != ipif->ipif_src_addr) ||
2548 		    ire->ire_zoneid != ipif->ipif_zoneid) {
2549 			if (ipif != NULL)
2550 				ipif_refrele(ipif);
2551 			ire->ire_ipif = NULL;
2552 			ire_delete(ire);
2553 			*irep = NULL;
2554 			return (EINVAL);
2555 		}
2556 
2557 		ASSERT(ill != NULL);
2558 
2559 		/*
2560 		 * Since we didn't attach label security attributes to the
2561 		 * ire for the resolver case, we need to add it now. (only
2562 		 * for v4 resolver and v6 xresolv case).
2563 		 */
2564 		if (is_system_labeled() && ire_is_mblk) {
2565 			if (ire->ire_ipversion == IPV4_VERSION) {
2566 				ga.ga_af = AF_INET;
2567 				IN6_IPADDR_TO_V4MAPPED(ire->ire_gateway_addr !=
2568 				    INADDR_ANY ? ire->ire_gateway_addr :
2569 				    ire->ire_addr, &ga.ga_addr);
2570 			} else {
2571 				ga.ga_af = AF_INET6;
2572 				ga.ga_addr = IN6_IS_ADDR_UNSPECIFIED(
2573 				    &ire->ire_gateway_addr_v6) ?
2574 				    ire->ire_addr_v6 :
2575 				    ire->ire_gateway_addr_v6;
2576 			}
2577 			gcgrp = gcgrp_lookup(&ga, B_FALSE);
2578 			error = tsol_ire_init_gwattr(ire, ire->ire_ipversion,
2579 			    NULL, gcgrp);
2580 			if (error != 0) {
2581 				if (gcgrp != NULL) {
2582 					GCGRP_REFRELE(gcgrp);
2583 					gcgrp = NULL;
2584 				}
2585 				ipif_refrele(ipif);
2586 				ire->ire_ipif = NULL;
2587 				ire_delete(ire);
2588 				*irep = NULL;
2589 				return (error);
2590 			}
2591 		}
2592 	}
2593 
2594 	/*
2595 	 * In case ire was changed
2596 	 */
2597 	*irep = ire;
2598 	if (ire->ire_ipversion == IPV6_VERSION)
2599 		error = ire_add_v6(irep, q, mp, func);
2600 	else
2601 		error = ire_add_v4(irep, q, mp, func, allow_unresolved);
2602 	if (ipif != NULL)
2603 		ipif_refrele(ipif);
2604 	return (error);
2605 }
2606 
2607 /*
2608  * Add an initialized IRE to an appropriate table based on ire_type.
2609  *
2610  * The forward table contains IRE_PREFIX/IRE_HOST and
2611  * IRE_IF_RESOLVER/IRE_IF_NORESOLVER and IRE_DEFAULT.
2612  *
2613  * The cache table contains IRE_BROADCAST/IRE_LOCAL/IRE_LOOPBACK
2614  * and IRE_CACHE.
2615  *
2616  * NOTE : This function is called as writer though not required
2617  * by this function.
2618  */
2619 static int
2620 ire_add_v4(ire_t **ire_p, queue_t *q, mblk_t *mp, ipsq_func_t func,
2621     boolean_t allow_unresolved)
2622 {
2623 	ire_t	*ire1;
2624 	irb_t	*irb_ptr;
2625 	ire_t	**irep;
2626 	int	flags;
2627 	ire_t	*pire = NULL;
2628 	ill_t	*stq_ill;
2629 	ire_t	*ire = *ire_p;
2630 	int	error;
2631 	boolean_t need_refrele = B_FALSE;
2632 	nce_t	*nce;
2633 	ip_stack_t	*ipst = ire->ire_ipst;
2634 	uint_t	marks = 0;
2635 
2636 	/*
2637 	 * IREs with source addresses hosted on interfaces that are under IPMP
2638 	 * should be hidden so that applications don't accidentally end up
2639 	 * sending packets with test addresses as their source addresses, or
2640 	 * sending out interfaces that are e.g. IFF_INACTIVE.  Hide them here.
2641 	 */
2642 	if (ire->ire_ipif != NULL && IS_UNDER_IPMP(ire->ire_ipif->ipif_ill))
2643 		marks |= IRE_MARK_TESTHIDDEN;
2644 
2645 	if (ire->ire_ipif != NULL)
2646 		ASSERT(!MUTEX_HELD(&ire->ire_ipif->ipif_ill->ill_lock));
2647 	if (ire->ire_stq != NULL)
2648 		ASSERT(!MUTEX_HELD(
2649 		    &((ill_t *)(ire->ire_stq->q_ptr))->ill_lock));
2650 	ASSERT(ire->ire_ipversion == IPV4_VERSION);
2651 	ASSERT(ire->ire_mp == NULL); /* Calls should go through ire_add */
2652 
2653 	/* Find the appropriate list head. */
2654 	switch (ire->ire_type) {
2655 	case IRE_HOST:
2656 		ire->ire_mask = IP_HOST_MASK;
2657 		ire->ire_masklen = IP_ABITS;
2658 		ire->ire_marks |= marks;
2659 		if ((ire->ire_flags & RTF_SETSRC) == 0)
2660 			ire->ire_src_addr = 0;
2661 		break;
2662 	case IRE_CACHE:
2663 		ire->ire_mask = IP_HOST_MASK;
2664 		ire->ire_masklen = IP_ABITS;
2665 		ire->ire_marks |= marks;
2666 		break;
2667 	case IRE_BROADCAST:
2668 	case IRE_LOCAL:
2669 	case IRE_LOOPBACK:
2670 		ire->ire_mask = IP_HOST_MASK;
2671 		ire->ire_masklen = IP_ABITS;
2672 		break;
2673 	case IRE_PREFIX:
2674 	case IRE_DEFAULT:
2675 		ire->ire_marks |= marks;
2676 		if ((ire->ire_flags & RTF_SETSRC) == 0)
2677 			ire->ire_src_addr = 0;
2678 		break;
2679 	case IRE_IF_RESOLVER:
2680 	case IRE_IF_NORESOLVER:
2681 		ire->ire_marks |= marks;
2682 		break;
2683 	default:
2684 		ip0dbg(("ire_add_v4: ire %p has unrecognized IRE type (%d)\n",
2685 		    (void *)ire, ire->ire_type));
2686 		ire_delete(ire);
2687 		*ire_p = NULL;
2688 		return (EINVAL);
2689 	}
2690 
2691 	/* Make sure the address is properly masked. */
2692 	ire->ire_addr &= ire->ire_mask;
2693 
2694 	/*
2695 	 * ip_newroute/ip_newroute_multi are unable to prevent the deletion
2696 	 * of the interface route while adding an IRE_CACHE for an on-link
2697 	 * destination in the IRE_IF_RESOLVER case, since the ire has to
2698 	 * go to ARP and return. We can't do a REFHOLD on the
2699 	 * associated interface ire for fear of ARP freeing the message.
2700 	 * Here we look up the interface ire in the forwarding table and
2701 	 * make sure that the interface route has not been deleted.
2702 	 */
2703 	if (ire->ire_type == IRE_CACHE && ire->ire_gateway_addr == 0 &&
2704 	    ((ill_t *)ire->ire_stq->q_ptr)->ill_net_type == IRE_IF_RESOLVER) {
2705 
2706 		ASSERT(ire->ire_max_fragp == NULL);
2707 		if (CLASSD(ire->ire_addr) && !(ire->ire_flags & RTF_SETSRC)) {
2708 			/*
2709 			 * The ihandle that we used in ip_newroute_multi
2710 			 * comes from the interface route corresponding
2711 			 * to ire_ipif. Lookup here to see if it exists
2712 			 * still.
2713 			 * If the ire has a source address assigned using
2714 			 * RTF_SETSRC, ire_ipif is the logical interface holding
2715 			 * this source address, so we can't use it to check for
2716 			 * the existence of the interface route. Instead we rely
2717 			 * on the brute force ihandle search in
2718 			 * ire_ihandle_lookup_onlink() below.
2719 			 */
2720 			pire = ipif_to_ire(ire->ire_ipif);
2721 			if (pire == NULL) {
2722 				ire_delete(ire);
2723 				*ire_p = NULL;
2724 				return (EINVAL);
2725 			} else if (pire->ire_ihandle != ire->ire_ihandle) {
2726 				ire_refrele(pire);
2727 				ire_delete(ire);
2728 				*ire_p = NULL;
2729 				return (EINVAL);
2730 			}
2731 		} else {
2732 			pire = ire_ihandle_lookup_onlink(ire);
2733 			if (pire == NULL) {
2734 				ire_delete(ire);
2735 				*ire_p = NULL;
2736 				return (EINVAL);
2737 			}
2738 		}
2739 		/* Prevent pire from getting deleted */
2740 		IRB_REFHOLD(pire->ire_bucket);
2741 		/* Has it been removed already ? */
2742 		if (pire->ire_marks & IRE_MARK_CONDEMNED) {
2743 			IRB_REFRELE(pire->ire_bucket);
2744 			ire_refrele(pire);
2745 			ire_delete(ire);
2746 			*ire_p = NULL;
2747 			return (EINVAL);
2748 		}
2749 	} else {
2750 		ASSERT(ire->ire_max_fragp != NULL);
2751 	}
2752 	flags = (MATCH_IRE_MASK | MATCH_IRE_TYPE | MATCH_IRE_GW);
2753 
2754 	if (ire->ire_ipif != NULL) {
2755 		/*
2756 		 * We use MATCH_IRE_IPIF while adding IRE_CACHES only
2757 		 * for historic reasons and to maintain symmetry with
2758 		 * IPv6 code path. Historically this was used by
2759 		 * multicast code to create multiple IRE_CACHES on
2760 		 * a single ill with different ipifs. This was used
2761 		 * so that multicast packets leaving the node had the
2762 		 * right source address. This is no longer needed as
2763 		 * ip_wput initializes the address correctly.
2764 		 */
2765 		flags |= MATCH_IRE_IPIF;
2766 		/*
2767 		 * If we are creating a hidden IRE, make sure we search for
2768 		 * hidden IREs when searching for duplicates below.
2769 		 * Otherwise, we might find an IRE on some other interface
2770 		 * that's not marked hidden.
2771 		 */
2772 		if (ire->ire_marks & IRE_MARK_TESTHIDDEN)
2773 			flags |= MATCH_IRE_MARK_TESTHIDDEN;
2774 	}
2775 	if ((ire->ire_type & IRE_CACHETABLE) == 0) {
2776 		irb_ptr = ire_get_bucket(ire);
2777 		need_refrele = B_TRUE;
2778 		if (irb_ptr == NULL) {
2779 			/*
2780 			 * This assumes that the ire has not added
2781 			 * a reference to the ipif.
2782 			 */
2783 			ire->ire_ipif = NULL;
2784 			ire_delete(ire);
2785 			if (pire != NULL) {
2786 				IRB_REFRELE(pire->ire_bucket);
2787 				ire_refrele(pire);
2788 			}
2789 			*ire_p = NULL;
2790 			return (EINVAL);
2791 		}
2792 	} else {
2793 		irb_ptr = &(ipst->ips_ip_cache_table[IRE_ADDR_HASH(
2794 		    ire->ire_addr, ipst->ips_ip_cache_table_size)]);
2795 	}
2796 
2797 	/*
2798 	 * Start the atomic add of the ire. Grab the ill locks,
2799 	 * ill_g_usesrc_lock and the bucket lock. Check for condemned
2800 	 *
2801 	 * If ipif or ill is changing ire_atomic_start() may queue the
2802 	 * request and return EINPROGRESS.
2803 	 * To avoid lock order problems, get the ndp4->ndp_g_lock.
2804 	 */
2805 	mutex_enter(&ipst->ips_ndp4->ndp_g_lock);
2806 	error = ire_atomic_start(irb_ptr, ire, q, mp, func);
2807 	if (error != 0) {
2808 		mutex_exit(&ipst->ips_ndp4->ndp_g_lock);
2809 		/*
2810 		 * We don't know whether it is a valid ipif or not.
2811 		 * So, set it to NULL. This assumes that the ire has not added
2812 		 * a reference to the ipif.
2813 		 */
2814 		ire->ire_ipif = NULL;
2815 		ire_delete(ire);
2816 		if (pire != NULL) {
2817 			IRB_REFRELE(pire->ire_bucket);
2818 			ire_refrele(pire);
2819 		}
2820 		*ire_p = NULL;
2821 		if (need_refrele)
2822 			IRB_REFRELE(irb_ptr);
2823 		return (error);
2824 	}
2825 	/*
2826 	 * To avoid creating ires having stale values for the ire_max_frag
2827 	 * we get the latest value atomically here. For more details
2828 	 * see the block comment in ip_sioctl_mtu and in DL_NOTE_SDU_CHANGE
2829 	 * in ip_rput_dlpi_writer
2830 	 */
2831 	if (ire->ire_max_fragp == NULL) {
2832 		if (CLASSD(ire->ire_addr))
2833 			ire->ire_max_frag = ire->ire_ipif->ipif_mtu;
2834 		else
2835 			ire->ire_max_frag = pire->ire_max_frag;
2836 	} else {
2837 		uint_t	max_frag;
2838 
2839 		max_frag = *ire->ire_max_fragp;
2840 		ire->ire_max_fragp = NULL;
2841 		ire->ire_max_frag = max_frag;
2842 	}
2843 	/*
2844 	 * Atomically check for duplicate and insert in the table.
2845 	 */
2846 	for (ire1 = irb_ptr->irb_ire; ire1 != NULL; ire1 = ire1->ire_next) {
2847 		if (ire1->ire_marks & IRE_MARK_CONDEMNED)
2848 			continue;
2849 		if (ire->ire_ipif != NULL) {
2850 			/*
2851 			 * We do MATCH_IRE_ILL implicitly here for IREs
2852 			 * with a non-null ire_ipif, including IRE_CACHEs.
2853 			 * As ire_ipif and ire_stq could point to two
2854 			 * different ills, we can't pass just ire_ipif to
2855 			 * ire_match_args and get a match on both ills.
2856 			 * This is just needed for duplicate checks here and
2857 			 * so we don't add an extra argument to
2858 			 * ire_match_args for this. Do it locally.
2859 			 *
2860 			 * NOTE : Currently there is no part of the code
2861 			 * that asks for both MATH_IRE_IPIF and MATCH_IRE_ILL
2862 			 * match for IRE_CACHEs. Thus we don't want to
2863 			 * extend the arguments to ire_match_args.
2864 			 */
2865 			if (ire1->ire_stq != ire->ire_stq)
2866 				continue;
2867 			/*
2868 			 * Multiroute IRE_CACHEs for a given destination can
2869 			 * have the same ire_ipif, typically if their source
2870 			 * address is forced using RTF_SETSRC, and the same
2871 			 * send-to queue. We differentiate them using the parent
2872 			 * handle.
2873 			 */
2874 			if (ire->ire_type == IRE_CACHE &&
2875 			    (ire1->ire_flags & RTF_MULTIRT) &&
2876 			    (ire->ire_flags & RTF_MULTIRT) &&
2877 			    (ire1->ire_phandle != ire->ire_phandle))
2878 				continue;
2879 		}
2880 		if (ire1->ire_zoneid != ire->ire_zoneid)
2881 			continue;
2882 		if (ire_match_args(ire1, ire->ire_addr, ire->ire_mask,
2883 		    ire->ire_gateway_addr, ire->ire_type, ire->ire_ipif,
2884 		    ire->ire_zoneid, 0, NULL, flags, NULL)) {
2885 			/*
2886 			 * Return the old ire after doing a REFHOLD.
2887 			 * As most of the callers continue to use the IRE
2888 			 * after adding, we return a held ire. This will
2889 			 * avoid a lookup in the caller again. If the callers
2890 			 * don't want to use it, they need to do a REFRELE.
2891 			 */
2892 			ip1dbg(("found dup ire existing %p new %p\n",
2893 			    (void *)ire1, (void *)ire));
2894 			IRE_REFHOLD(ire1);
2895 			ire_atomic_end(irb_ptr, ire);
2896 			mutex_exit(&ipst->ips_ndp4->ndp_g_lock);
2897 			ire_delete(ire);
2898 			if (pire != NULL) {
2899 				/*
2900 				 * Assert that it is not removed from the
2901 				 * list yet.
2902 				 */
2903 				ASSERT(pire->ire_ptpn != NULL);
2904 				IRB_REFRELE(pire->ire_bucket);
2905 				ire_refrele(pire);
2906 			}
2907 			*ire_p = ire1;
2908 			if (need_refrele)
2909 				IRB_REFRELE(irb_ptr);
2910 			return (0);
2911 		}
2912 	}
2913 
2914 	if (ire->ire_type & IRE_CACHE) {
2915 		ASSERT(ire->ire_stq != NULL);
2916 		nce = ndp_lookup_v4(ire_to_ill(ire),
2917 		    ((ire->ire_gateway_addr != INADDR_ANY) ?
2918 		    &ire->ire_gateway_addr : &ire->ire_addr),
2919 		    B_TRUE);
2920 		if (nce != NULL)
2921 			mutex_enter(&nce->nce_lock);
2922 		/*
2923 		 * if the nce is NCE_F_CONDEMNED, or if it is not ND_REACHABLE
2924 		 * and the caller has prohibited the addition of incomplete
2925 		 * ire's, we fail the add. Note that nce_state could be
2926 		 * something other than ND_REACHABLE if the nce had
2927 		 * just expired and the ire_create preceding the
2928 		 * ire_add added a new ND_INITIAL nce.
2929 		 */
2930 		if ((nce == NULL) ||
2931 		    (nce->nce_flags & NCE_F_CONDEMNED) ||
2932 		    (!allow_unresolved &&
2933 		    (nce->nce_state != ND_REACHABLE))) {
2934 			if (nce != NULL) {
2935 				DTRACE_PROBE1(ire__bad__nce, nce_t *, nce);
2936 				mutex_exit(&nce->nce_lock);
2937 			}
2938 			ire_atomic_end(irb_ptr, ire);
2939 			mutex_exit(&ipst->ips_ndp4->ndp_g_lock);
2940 			if (nce != NULL)
2941 				NCE_REFRELE(nce);
2942 			DTRACE_PROBE1(ire__no__nce, ire_t *, ire);
2943 			ire_delete(ire);
2944 			if (pire != NULL) {
2945 				IRB_REFRELE(pire->ire_bucket);
2946 				ire_refrele(pire);
2947 			}
2948 			*ire_p = NULL;
2949 			if (need_refrele)
2950 				IRB_REFRELE(irb_ptr);
2951 			return (EINVAL);
2952 		} else {
2953 			ire->ire_nce = nce;
2954 			mutex_exit(&nce->nce_lock);
2955 			/*
2956 			 * We are associating this nce to the ire, so
2957 			 * change the nce ref taken in ndp_lookup_v4() from
2958 			 * NCE_REFHOLD to NCE_REFHOLD_NOTR
2959 			 */
2960 			NCE_REFHOLD_TO_REFHOLD_NOTR(ire->ire_nce);
2961 		}
2962 	}
2963 	/*
2964 	 * Make it easy for ip_wput_ire() to hit multiple broadcast ires by
2965 	 * grouping identical addresses together on the hash chain.  We do
2966 	 * this only for IRE_BROADCASTs as ip_wput_ire is currently interested
2967 	 * in such groupings only for broadcasts.
2968 	 *
2969 	 * Find the first entry that matches ire_addr. *irep will be null
2970 	 * if no match.
2971 	 *
2972 	 * Note: the loopback and non-loopback broadcast entries for an
2973 	 * interface MUST be added before any MULTIRT entries.
2974 	 */
2975 	irep = (ire_t **)irb_ptr;
2976 	while ((ire1 = *irep) != NULL && ire->ire_addr != ire1->ire_addr)
2977 		irep = &ire1->ire_next;
2978 	if (ire->ire_type == IRE_BROADCAST && *irep != NULL) {
2979 		/*
2980 		 * We found some ire (i.e *irep) with a matching addr. We
2981 		 * want to group ires with same addr.
2982 		 */
2983 		for (;;) {
2984 			ire1 = *irep;
2985 			if ((ire1->ire_next == NULL) ||
2986 			    (ire1->ire_next->ire_addr != ire->ire_addr) ||
2987 			    (ire1->ire_type != IRE_BROADCAST) ||
2988 			    (ire1->ire_flags & RTF_MULTIRT) ||
2989 			    (ire1->ire_ipif->ipif_ill->ill_grp ==
2990 			    ire->ire_ipif->ipif_ill->ill_grp))
2991 				break;
2992 			irep = &ire1->ire_next;
2993 		}
2994 		ASSERT(*irep != NULL);
2995 		/*
2996 		 * The ire will be added before *irep, so
2997 		 * if irep is a MULTIRT ire, just break to
2998 		 * ire insertion code.
2999 		 */
3000 		if (((*irep)->ire_flags & RTF_MULTIRT) != 0)
3001 			goto insert_ire;
3002 
3003 		irep = &((*irep)->ire_next);
3004 
3005 		/*
3006 		 * Either we have hit the end of the list or the address
3007 		 * did not match.
3008 		 */
3009 		while (*irep != NULL) {
3010 			ire1 = *irep;
3011 			if ((ire1->ire_addr != ire->ire_addr) ||
3012 			    (ire1->ire_type != IRE_BROADCAST))
3013 				break;
3014 			if (ire1->ire_ipif == ire->ire_ipif) {
3015 				irep = &ire1->ire_next;
3016 				break;
3017 			}
3018 			irep = &ire1->ire_next;
3019 		}
3020 	} else if (*irep != NULL) {
3021 		/*
3022 		 * Find the last ire which matches ire_addr.
3023 		 * Needed to do tail insertion among entries with the same
3024 		 * ire_addr.
3025 		 */
3026 		while (ire->ire_addr == ire1->ire_addr) {
3027 			irep = &ire1->ire_next;
3028 			ire1 = *irep;
3029 			if (ire1 == NULL)
3030 				break;
3031 		}
3032 	}
3033 
3034 insert_ire:
3035 	/* Insert at *irep */
3036 	ire1 = *irep;
3037 	if (ire1 != NULL)
3038 		ire1->ire_ptpn = &ire->ire_next;
3039 	ire->ire_next = ire1;
3040 	/* Link the new one in. */
3041 	ire->ire_ptpn = irep;
3042 
3043 	/*
3044 	 * ire_walk routines de-reference ire_next without holding
3045 	 * a lock. Before we point to the new ire, we want to make
3046 	 * sure the store that sets the ire_next of the new ire
3047 	 * reaches global visibility, so that ire_walk routines
3048 	 * don't see a truncated list of ires i.e if the ire_next
3049 	 * of the new ire gets set after we do "*irep = ire" due
3050 	 * to re-ordering, the ire_walk thread will see a NULL
3051 	 * once it accesses the ire_next of the new ire.
3052 	 * membar_producer() makes sure that the following store
3053 	 * happens *after* all of the above stores.
3054 	 */
3055 	membar_producer();
3056 	*irep = ire;
3057 	ire->ire_bucket = irb_ptr;
3058 	/*
3059 	 * We return a bumped up IRE above. Keep it symmetrical
3060 	 * so that the callers will always have to release. This
3061 	 * helps the callers of this function because they continue
3062 	 * to use the IRE after adding and hence they don't have to
3063 	 * lookup again after we return the IRE.
3064 	 *
3065 	 * NOTE : We don't have to use atomics as this is appearing
3066 	 * in the list for the first time and no one else can bump
3067 	 * up the reference count on this yet.
3068 	 */
3069 	IRE_REFHOLD_LOCKED(ire);
3070 	BUMP_IRE_STATS(ipst->ips_ire_stats_v4, ire_stats_inserted);
3071 
3072 	irb_ptr->irb_ire_cnt++;
3073 	if (irb_ptr->irb_marks & IRB_MARK_FTABLE)
3074 		irb_ptr->irb_nire++;
3075 
3076 	if (ire->ire_marks & IRE_MARK_TEMPORARY)
3077 		irb_ptr->irb_tmp_ire_cnt++;
3078 
3079 	if (ire->ire_ipif != NULL) {
3080 		DTRACE_PROBE3(ipif__incr__cnt, (ipif_t *), ire->ire_ipif,
3081 		    (char *), "ire", (void *), ire);
3082 		ire->ire_ipif->ipif_ire_cnt++;
3083 		if (ire->ire_stq != NULL) {
3084 			stq_ill = (ill_t *)ire->ire_stq->q_ptr;
3085 			DTRACE_PROBE3(ill__incr__cnt, (ill_t *), stq_ill,
3086 			    (char *), "ire", (void *), ire);
3087 			stq_ill->ill_ire_cnt++;
3088 		}
3089 	} else {
3090 		ASSERT(ire->ire_stq == NULL);
3091 	}
3092 
3093 	ire_atomic_end(irb_ptr, ire);
3094 	mutex_exit(&ipst->ips_ndp4->ndp_g_lock);
3095 
3096 	if (pire != NULL) {
3097 		/* Assert that it is not removed from the list yet */
3098 		ASSERT(pire->ire_ptpn != NULL);
3099 		IRB_REFRELE(pire->ire_bucket);
3100 		ire_refrele(pire);
3101 	}
3102 
3103 	if (ire->ire_type != IRE_CACHE) {
3104 		/*
3105 		 * For ire's with host mask see if there is an entry
3106 		 * in the cache. If there is one flush the whole cache as
3107 		 * there might be multiple entries due to RTF_MULTIRT (CGTP).
3108 		 * If no entry is found than there is no need to flush the
3109 		 * cache.
3110 		 */
3111 		if (ire->ire_mask == IP_HOST_MASK) {
3112 			ire_t *lire;
3113 			lire = ire_ctable_lookup(ire->ire_addr, NULL, IRE_CACHE,
3114 			    NULL, ALL_ZONES, NULL, MATCH_IRE_TYPE, ipst);
3115 			if (lire != NULL) {
3116 				ire_refrele(lire);
3117 				ire_flush_cache_v4(ire, IRE_FLUSH_ADD);
3118 			}
3119 		} else {
3120 			ire_flush_cache_v4(ire, IRE_FLUSH_ADD);
3121 		}
3122 	}
3123 	/*
3124 	 * We had to delay the fast path probe until the ire is inserted
3125 	 * in the list. Otherwise the fast path ack won't find the ire in
3126 	 * the table.
3127 	 */
3128 	if (ire->ire_type == IRE_CACHE ||
3129 	    (ire->ire_type == IRE_BROADCAST && ire->ire_stq != NULL)) {
3130 		ASSERT(ire->ire_nce != NULL);
3131 		if (ire->ire_nce->nce_state == ND_REACHABLE)
3132 			nce_fastpath(ire->ire_nce);
3133 	}
3134 	if (ire->ire_ipif != NULL)
3135 		ASSERT(!MUTEX_HELD(&ire->ire_ipif->ipif_ill->ill_lock));
3136 	*ire_p = ire;
3137 	if (need_refrele) {
3138 		IRB_REFRELE(irb_ptr);
3139 	}
3140 	return (0);
3141 }
3142 
3143 /*
3144  * IRB_REFRELE is the only caller of the function. ire_unlink calls to
3145  * do the final cleanup for this ire.
3146  */
3147 void
3148 ire_cleanup(ire_t *ire)
3149 {
3150 	ire_t *ire_next;
3151 	ip_stack_t *ipst = ire->ire_ipst;
3152 
3153 	ASSERT(ire != NULL);
3154 
3155 	while (ire != NULL) {
3156 		ire_next = ire->ire_next;
3157 		if (ire->ire_ipversion == IPV4_VERSION) {
3158 			ire_delete_v4(ire);
3159 			BUMP_IRE_STATS(ipst->ips_ire_stats_v4,
3160 			    ire_stats_deleted);
3161 		} else {
3162 			ASSERT(ire->ire_ipversion == IPV6_VERSION);
3163 			ire_delete_v6(ire);
3164 			BUMP_IRE_STATS(ipst->ips_ire_stats_v6,
3165 			    ire_stats_deleted);
3166 		}
3167 		/*
3168 		 * Now it's really out of the list. Before doing the
3169 		 * REFRELE, set ire_next to NULL as ire_inactive asserts
3170 		 * so.
3171 		 */
3172 		ire->ire_next = NULL;
3173 		IRE_REFRELE_NOTR(ire);
3174 		ire = ire_next;
3175 	}
3176 }
3177 
3178 /*
3179  * IRB_REFRELE is the only caller of the function. It calls to unlink
3180  * all the CONDEMNED ires from this bucket.
3181  */
3182 ire_t *
3183 ire_unlink(irb_t *irb)
3184 {
3185 	ire_t *ire;
3186 	ire_t *ire1;
3187 	ire_t **ptpn;
3188 	ire_t *ire_list = NULL;
3189 
3190 	ASSERT(RW_WRITE_HELD(&irb->irb_lock));
3191 	ASSERT(((irb->irb_marks & IRB_MARK_FTABLE) && irb->irb_refcnt == 1) ||
3192 	    (irb->irb_refcnt == 0));
3193 	ASSERT(irb->irb_marks & IRB_MARK_CONDEMNED);
3194 	ASSERT(irb->irb_ire != NULL);
3195 
3196 	for (ire = irb->irb_ire; ire != NULL; ire = ire1) {
3197 		ip_stack_t	*ipst = ire->ire_ipst;
3198 
3199 		ire1 = ire->ire_next;
3200 		if (ire->ire_marks & IRE_MARK_CONDEMNED) {
3201 			ptpn = ire->ire_ptpn;
3202 			ire1 = ire->ire_next;
3203 			if (ire1)
3204 				ire1->ire_ptpn = ptpn;
3205 			*ptpn = ire1;
3206 			ire->ire_ptpn = NULL;
3207 			ire->ire_next = NULL;
3208 			if (ire->ire_type == IRE_DEFAULT) {
3209 				/*
3210 				 * IRE is out of the list. We need to adjust
3211 				 * the accounting before the caller drops
3212 				 * the lock.
3213 				 */
3214 				if (ire->ire_ipversion == IPV6_VERSION) {
3215 					ASSERT(ipst->
3216 					    ips_ipv6_ire_default_count !=
3217 					    0);
3218 					ipst->ips_ipv6_ire_default_count--;
3219 				}
3220 			}
3221 			/*
3222 			 * We need to call ire_delete_v4 or ire_delete_v6
3223 			 * to clean up the cache or the redirects pointing at
3224 			 * the default gateway. We need to drop the lock
3225 			 * as ire_flush_cache/ire_delete_host_redircts require
3226 			 * so. But we can't drop the lock, as ire_unlink needs
3227 			 * to atomically remove the ires from the list.
3228 			 * So, create a temporary list of CONDEMNED ires
3229 			 * for doing ire_delete_v4/ire_delete_v6 operations
3230 			 * later on.
3231 			 */
3232 			ire->ire_next = ire_list;
3233 			ire_list = ire;
3234 		}
3235 	}
3236 	irb->irb_marks &= ~IRB_MARK_CONDEMNED;
3237 	return (ire_list);
3238 }
3239 
3240 /*
3241  * Delete all the cache entries with this 'addr'.  When IP gets a gratuitous
3242  * ARP message on any of its interface queue, it scans the nce table and
3243  * deletes and calls ndp_delete() for the appropriate nce. This action
3244  * also deletes all the neighbor/ire cache entries for that address.
3245  * This function is called from ip_arp_news in ip.c and also for
3246  * ARP ioctl processing in ip_if.c. ip_ire_clookup_and_delete returns
3247  * true if it finds a nce entry which is used by ip_arp_news to determine if
3248  * it needs to do an ire_walk_v4. The return value is also  used for the
3249  * same purpose by ARP IOCTL processing * in ip_if.c when deleting
3250  * ARP entries. For SIOC*IFARP ioctls in addition to the address,
3251  * ip_if->ipif_ill also needs to be matched.
3252  */
3253 boolean_t
3254 ip_ire_clookup_and_delete(ipaddr_t addr, ipif_t *ipif, ip_stack_t *ipst)
3255 {
3256 	ill_t	*ill;
3257 	nce_t	*nce;
3258 
3259 	ill = (ipif ? ipif->ipif_ill : NULL);
3260 
3261 	if (ill != NULL) {
3262 		/*
3263 		 * clean up the nce (and any relevant ire's) that matches
3264 		 * on addr and ill.
3265 		 */
3266 		nce = ndp_lookup_v4(ill, &addr, B_FALSE);
3267 		if (nce != NULL) {
3268 			ndp_delete(nce);
3269 			return (B_TRUE);
3270 		}
3271 	} else {
3272 		/*
3273 		 * ill is wildcard. clean up all nce's and
3274 		 * ire's that match on addr
3275 		 */
3276 		nce_clookup_t cl;
3277 
3278 		cl.ncecl_addr = addr;
3279 		cl.ncecl_found = B_FALSE;
3280 
3281 		ndp_walk_common(ipst->ips_ndp4, NULL,
3282 		    (pfi_t)ip_nce_clookup_and_delete, (uchar_t *)&cl, B_TRUE);
3283 
3284 		/*
3285 		 *  ncecl_found would be set by ip_nce_clookup_and_delete if
3286 		 *  we found a matching nce.
3287 		 */
3288 		return (cl.ncecl_found);
3289 	}
3290 	return (B_FALSE);
3291 
3292 }
3293 
3294 /* Delete the supplied nce if its nce_addr matches the supplied address */
3295 static void
3296 ip_nce_clookup_and_delete(nce_t *nce, void *arg)
3297 {
3298 	nce_clookup_t *cl = (nce_clookup_t *)arg;
3299 	ipaddr_t nce_addr;
3300 
3301 	IN6_V4MAPPED_TO_IPADDR(&nce->nce_addr, nce_addr);
3302 	if (nce_addr == cl->ncecl_addr) {
3303 		cl->ncecl_found = B_TRUE;
3304 		/* clean up the nce (and any relevant ire's) */
3305 		ndp_delete(nce);
3306 	}
3307 }
3308 
3309 /*
3310  * Clean up the radix node for this ire. Must be called by IRB_REFRELE
3311  * when there are no ire's left in the bucket. Returns TRUE if the bucket
3312  * is deleted and freed.
3313  */
3314 boolean_t
3315 irb_inactive(irb_t *irb)
3316 {
3317 	struct rt_entry *rt;
3318 	struct radix_node *rn;
3319 	ip_stack_t *ipst = irb->irb_ipst;
3320 
3321 	ASSERT(irb->irb_ipst != NULL);
3322 
3323 	rt = IRB2RT(irb);
3324 	rn = (struct radix_node *)rt;
3325 
3326 	/* first remove it from the radix tree. */
3327 	RADIX_NODE_HEAD_WLOCK(ipst->ips_ip_ftable);
3328 	rw_enter(&irb->irb_lock, RW_WRITER);
3329 	if (irb->irb_refcnt == 1 && irb->irb_nire == 0) {
3330 		rn = ipst->ips_ip_ftable->rnh_deladdr(rn->rn_key, rn->rn_mask,
3331 		    ipst->ips_ip_ftable);
3332 		DTRACE_PROBE1(irb__free, rt_t *,  rt);
3333 		ASSERT((void *)rn == (void *)rt);
3334 		Free(rt, rt_entry_cache);
3335 		/* irb_lock is freed */
3336 		RADIX_NODE_HEAD_UNLOCK(ipst->ips_ip_ftable);
3337 		return (B_TRUE);
3338 	}
3339 	rw_exit(&irb->irb_lock);
3340 	RADIX_NODE_HEAD_UNLOCK(ipst->ips_ip_ftable);
3341 	return (B_FALSE);
3342 }
3343 
3344 /*
3345  * Delete the specified IRE.
3346  */
3347 void
3348 ire_delete(ire_t *ire)
3349 {
3350 	ire_t	*ire1;
3351 	ire_t	**ptpn;
3352 	irb_t *irb;
3353 	ip_stack_t	*ipst = ire->ire_ipst;
3354 
3355 	if ((irb = ire->ire_bucket) == NULL) {
3356 		/*
3357 		 * It was never inserted in the list. Should call REFRELE
3358 		 * to free this IRE.
3359 		 */
3360 		IRE_REFRELE_NOTR(ire);
3361 		return;
3362 	}
3363 
3364 	rw_enter(&irb->irb_lock, RW_WRITER);
3365 
3366 	if (irb->irb_rr_origin == ire) {
3367 		irb->irb_rr_origin = NULL;
3368 	}
3369 
3370 	/*
3371 	 * In case of V4 we might still be waiting for fastpath ack.
3372 	 */
3373 	if (ire->ire_ipversion == IPV4_VERSION &&
3374 	    (ire->ire_type == IRE_CACHE ||
3375 	    (ire->ire_type == IRE_BROADCAST && ire->ire_stq != NULL))) {
3376 		ASSERT(ire->ire_nce != NULL);
3377 		nce_fastpath_list_delete(ire->ire_nce);
3378 	}
3379 
3380 	if (ire->ire_ptpn == NULL) {
3381 		/*
3382 		 * Some other thread has removed us from the list.
3383 		 * It should have done the REFRELE for us.
3384 		 */
3385 		rw_exit(&irb->irb_lock);
3386 		return;
3387 	}
3388 
3389 	if (!(ire->ire_marks & IRE_MARK_CONDEMNED)) {
3390 		irb->irb_ire_cnt--;
3391 		ire->ire_marks |= IRE_MARK_CONDEMNED;
3392 		if (ire->ire_marks & IRE_MARK_TEMPORARY) {
3393 			irb->irb_tmp_ire_cnt--;
3394 			ire->ire_marks &= ~IRE_MARK_TEMPORARY;
3395 		}
3396 	}
3397 
3398 	if (irb->irb_refcnt != 0) {
3399 		/*
3400 		 * The last thread to leave this bucket will
3401 		 * delete this ire.
3402 		 */
3403 		irb->irb_marks |= IRB_MARK_CONDEMNED;
3404 		rw_exit(&irb->irb_lock);
3405 		return;
3406 	}
3407 
3408 	/*
3409 	 * Normally to delete an ire, we walk the bucket. While we
3410 	 * walk the bucket, we normally bump up irb_refcnt and hence
3411 	 * we return from above where we mark CONDEMNED and the ire
3412 	 * gets deleted from ire_unlink. This case is where somebody
3413 	 * knows the ire e.g by doing a lookup, and wants to delete the
3414 	 * IRE. irb_refcnt would be 0 in this case if nobody is walking
3415 	 * the bucket.
3416 	 */
3417 	ptpn = ire->ire_ptpn;
3418 	ire1 = ire->ire_next;
3419 	if (ire1 != NULL)
3420 		ire1->ire_ptpn = ptpn;
3421 	ASSERT(ptpn != NULL);
3422 	*ptpn = ire1;
3423 	ire->ire_ptpn = NULL;
3424 	ire->ire_next = NULL;
3425 	if (ire->ire_ipversion == IPV6_VERSION) {
3426 		BUMP_IRE_STATS(ipst->ips_ire_stats_v6, ire_stats_deleted);
3427 	} else {
3428 		BUMP_IRE_STATS(ipst->ips_ire_stats_v4, ire_stats_deleted);
3429 	}
3430 	/*
3431 	 * ip_wput/ip_wput_v6 checks this flag to see whether
3432 	 * it should still use the cached ire or not.
3433 	 */
3434 	if (ire->ire_type == IRE_DEFAULT) {
3435 		/*
3436 		 * IRE is out of the list. We need to adjust the
3437 		 * accounting before we drop the lock.
3438 		 */
3439 		if (ire->ire_ipversion == IPV6_VERSION) {
3440 			ASSERT(ipst->ips_ipv6_ire_default_count != 0);
3441 			ipst->ips_ipv6_ire_default_count--;
3442 		}
3443 	}
3444 	rw_exit(&irb->irb_lock);
3445 
3446 	if (ire->ire_ipversion == IPV6_VERSION) {
3447 		ire_delete_v6(ire);
3448 	} else {
3449 		ire_delete_v4(ire);
3450 	}
3451 	/*
3452 	 * We removed it from the list. Decrement the
3453 	 * reference count.
3454 	 */
3455 	IRE_REFRELE_NOTR(ire);
3456 }
3457 
3458 /*
3459  * Delete the specified IRE.
3460  * All calls should use ire_delete().
3461  * Sometimes called as writer though not required by this function.
3462  *
3463  * NOTE : This function is called only if the ire was added
3464  * in the list.
3465  */
3466 static void
3467 ire_delete_v4(ire_t *ire)
3468 {
3469 	ip_stack_t	*ipst = ire->ire_ipst;
3470 
3471 	ASSERT(ire->ire_refcnt >= 1);
3472 	ASSERT(ire->ire_ipversion == IPV4_VERSION);
3473 
3474 	if (ire->ire_type != IRE_CACHE)
3475 		ire_flush_cache_v4(ire, IRE_FLUSH_DELETE);
3476 	if (ire->ire_type == IRE_DEFAULT) {
3477 		/*
3478 		 * when a default gateway is going away
3479 		 * delete all the host redirects pointing at that
3480 		 * gateway.
3481 		 */
3482 		ire_delete_host_redirects(ire->ire_gateway_addr, ipst);
3483 	}
3484 }
3485 
3486 /*
3487  * IRE_REFRELE/ire_refrele are the only caller of the function. It calls
3488  * to free the ire when the reference count goes to zero.
3489  */
3490 void
3491 ire_inactive(ire_t *ire)
3492 {
3493 	nce_t	*nce;
3494 	ill_t	*ill = NULL;
3495 	ill_t	*stq_ill = NULL;
3496 	ipif_t	*ipif;
3497 	boolean_t	need_wakeup = B_FALSE;
3498 	irb_t 	*irb;
3499 	ip_stack_t	*ipst = ire->ire_ipst;
3500 
3501 	ASSERT(ire->ire_refcnt == 0);
3502 	ASSERT(ire->ire_ptpn == NULL);
3503 	ASSERT(ire->ire_next == NULL);
3504 
3505 	if (ire->ire_gw_secattr != NULL) {
3506 		ire_gw_secattr_free(ire->ire_gw_secattr);
3507 		ire->ire_gw_secattr = NULL;
3508 	}
3509 
3510 	if (ire->ire_mp != NULL) {
3511 		ASSERT(ire->ire_bucket == NULL);
3512 		mutex_destroy(&ire->ire_lock);
3513 		BUMP_IRE_STATS(ipst->ips_ire_stats_v4, ire_stats_freed);
3514 		if (ire->ire_nce != NULL)
3515 			NCE_REFRELE_NOTR(ire->ire_nce);
3516 		freeb(ire->ire_mp);
3517 		return;
3518 	}
3519 
3520 	if ((nce = ire->ire_nce) != NULL) {
3521 		NCE_REFRELE_NOTR(nce);
3522 		ire->ire_nce = NULL;
3523 	}
3524 
3525 	if (ire->ire_ipif == NULL)
3526 		goto end;
3527 
3528 	ipif = ire->ire_ipif;
3529 	ill = ipif->ipif_ill;
3530 
3531 	if (ire->ire_bucket == NULL) {
3532 		/* The ire was never inserted in the table. */
3533 		goto end;
3534 	}
3535 
3536 	/*
3537 	 * ipif_ire_cnt on this ipif goes down by 1. If the ire_stq is
3538 	 * non-null ill_ire_count also goes down by 1.
3539 	 *
3540 	 * The ipif that is associated with an ire is ire->ire_ipif and
3541 	 * hence when the ire->ire_ipif->ipif_ire_cnt drops to zero we call
3542 	 * ipif_ill_refrele_tail. Usually stq_ill is null or the same as
3543 	 * ire->ire_ipif->ipif_ill. So nothing more needs to be done.
3544 	 * However, for VNI or IPMP IRE entries, stq_ill can be different.
3545 	 * If this is different from ire->ire_ipif->ipif_ill and if the
3546 	 * ill_ire_cnt on the stq_ill also has dropped to zero, we call
3547 	 * ipif_ill_refrele_tail on the stq_ill.
3548 	 */
3549 	if (ire->ire_stq != NULL)
3550 		stq_ill = ire->ire_stq->q_ptr;
3551 
3552 	if (stq_ill == NULL || stq_ill == ill) {
3553 		/* Optimize the most common case */
3554 		mutex_enter(&ill->ill_lock);
3555 		ASSERT(ipif->ipif_ire_cnt != 0);
3556 		DTRACE_PROBE3(ipif__decr__cnt, (ipif_t *), ipif,
3557 		    (char *), "ire", (void *), ire);
3558 		ipif->ipif_ire_cnt--;
3559 		if (IPIF_DOWN_OK(ipif))
3560 			need_wakeup = B_TRUE;
3561 		if (stq_ill != NULL) {
3562 			ASSERT(stq_ill->ill_ire_cnt != 0);
3563 			DTRACE_PROBE3(ill__decr__cnt, (ill_t *), stq_ill,
3564 			    (char *), "ire", (void *), ire);
3565 			stq_ill->ill_ire_cnt--;
3566 			if (ILL_DOWN_OK(stq_ill))
3567 				need_wakeup = B_TRUE;
3568 		}
3569 		if (need_wakeup) {
3570 			/* Drops the ill lock */
3571 			ipif_ill_refrele_tail(ill);
3572 		} else {
3573 			mutex_exit(&ill->ill_lock);
3574 		}
3575 	} else {
3576 		/*
3577 		 * We can't grab all the ill locks at the same time.
3578 		 * It can lead to recursive lock enter in the call to
3579 		 * ipif_ill_refrele_tail and later. Instead do it 1 at
3580 		 * a time.
3581 		 */
3582 		mutex_enter(&ill->ill_lock);
3583 		ASSERT(ipif->ipif_ire_cnt != 0);
3584 		DTRACE_PROBE3(ipif__decr__cnt, (ipif_t *), ipif,
3585 		    (char *), "ire", (void *), ire);
3586 		ipif->ipif_ire_cnt--;
3587 		if (IPIF_DOWN_OK(ipif)) {
3588 			/* Drops the lock */
3589 			ipif_ill_refrele_tail(ill);
3590 		} else {
3591 			mutex_exit(&ill->ill_lock);
3592 		}
3593 		if (stq_ill != NULL) {
3594 			mutex_enter(&stq_ill->ill_lock);
3595 			ASSERT(stq_ill->ill_ire_cnt != 0);
3596 			DTRACE_PROBE3(ill__decr__cnt, (ill_t *), stq_ill,
3597 			    (char *), "ire", (void *), ire);
3598 			stq_ill->ill_ire_cnt--;
3599 			if (ILL_DOWN_OK(stq_ill)) {
3600 				/* Drops the ill lock */
3601 				ipif_ill_refrele_tail(stq_ill);
3602 			} else {
3603 				mutex_exit(&stq_ill->ill_lock);
3604 			}
3605 		}
3606 	}
3607 end:
3608 	/* This should be true for both V4 and V6 */
3609 
3610 	if ((ire->ire_type & IRE_FORWARDTABLE) &&
3611 	    (ire->ire_ipversion == IPV4_VERSION) &&
3612 	    ((irb = ire->ire_bucket) != NULL)) {
3613 		rw_enter(&irb->irb_lock, RW_WRITER);
3614 		irb->irb_nire--;
3615 		/*
3616 		 * Instead of examining the conditions for freeing
3617 		 * the radix node here, we do it by calling
3618 		 * IRB_REFRELE which is a single point in the code
3619 		 * that embeds that logic. Bump up the refcnt to
3620 		 * be able to call IRB_REFRELE
3621 		 */
3622 		IRB_REFHOLD_LOCKED(irb);
3623 		rw_exit(&irb->irb_lock);
3624 		IRB_REFRELE(irb);
3625 	}
3626 	ire->ire_ipif = NULL;
3627 
3628 #ifdef DEBUG
3629 	ire_trace_cleanup(ire);
3630 #endif
3631 	mutex_destroy(&ire->ire_lock);
3632 	if (ire->ire_ipversion == IPV6_VERSION) {
3633 		BUMP_IRE_STATS(ipst->ips_ire_stats_v6, ire_stats_freed);
3634 	} else {
3635 		BUMP_IRE_STATS(ipst->ips_ire_stats_v4, ire_stats_freed);
3636 	}
3637 	ASSERT(ire->ire_mp == NULL);
3638 	/* Has been allocated out of the cache */
3639 	kmem_cache_free(ire_cache, ire);
3640 }
3641 
3642 /*
3643  * ire_walk routine to delete all IRE_CACHE/IRE_HOST types redirect
3644  * entries that have a given gateway address.
3645  */
3646 void
3647 ire_delete_cache_gw(ire_t *ire, char *cp)
3648 {
3649 	ipaddr_t	gw_addr;
3650 
3651 	if (!(ire->ire_type & IRE_CACHE) &&
3652 	    !(ire->ire_flags & RTF_DYNAMIC))
3653 		return;
3654 
3655 	bcopy(cp, &gw_addr, sizeof (gw_addr));
3656 	if (ire->ire_gateway_addr == gw_addr) {
3657 		ip1dbg(("ire_delete_cache_gw: deleted 0x%x type %d to 0x%x\n",
3658 		    (int)ntohl(ire->ire_addr), ire->ire_type,
3659 		    (int)ntohl(ire->ire_gateway_addr)));
3660 		ire_delete(ire);
3661 	}
3662 }
3663 
3664 /*
3665  * Remove all IRE_CACHE entries that match the ire specified.
3666  *
3667  * The flag argument indicates if the flush request is due to addition
3668  * of new route (IRE_FLUSH_ADD) or deletion of old route (IRE_FLUSH_DELETE).
3669  *
3670  * This routine takes only the IREs from the forwarding table and flushes
3671  * the corresponding entries from the cache table.
3672  *
3673  * When flushing due to the deletion of an old route, it
3674  * just checks the cache handles (ire_phandle and ire_ihandle) and
3675  * deletes the ones that match.
3676  *
3677  * When flushing due to the creation of a new route, it checks
3678  * if a cache entry's address matches the one in the IRE and
3679  * that the cache entry's parent has a less specific mask than the
3680  * one in IRE. The destination of such a cache entry could be the
3681  * gateway for other cache entries, so we need to flush those as
3682  * well by looking for gateway addresses matching the IRE's address.
3683  */
3684 void
3685 ire_flush_cache_v4(ire_t *ire, int flag)
3686 {
3687 	int i;
3688 	ire_t *cire;
3689 	irb_t *irb;
3690 	ip_stack_t	*ipst = ire->ire_ipst;
3691 
3692 	if (ire->ire_type & IRE_CACHE)
3693 		return;
3694 
3695 	/*
3696 	 * If a default is just created, there is no point
3697 	 * in going through the cache, as there will not be any
3698 	 * cached ires.
3699 	 */
3700 	if (ire->ire_type == IRE_DEFAULT && flag == IRE_FLUSH_ADD)
3701 		return;
3702 	if (flag == IRE_FLUSH_ADD) {
3703 		/*
3704 		 * This selective flush is due to the addition of
3705 		 * new IRE.
3706 		 */
3707 		for (i = 0; i < ipst->ips_ip_cache_table_size; i++) {
3708 			irb = &ipst->ips_ip_cache_table[i];
3709 			if ((cire = irb->irb_ire) == NULL)
3710 				continue;
3711 			IRB_REFHOLD(irb);
3712 			for (cire = irb->irb_ire; cire != NULL;
3713 			    cire = cire->ire_next) {
3714 				if (cire->ire_type != IRE_CACHE)
3715 					continue;
3716 				/*
3717 				 * If 'cire' belongs to the same subnet
3718 				 * as the new ire being added, and 'cire'
3719 				 * is derived from a prefix that is less
3720 				 * specific than the new ire being added,
3721 				 * we need to flush 'cire'; for instance,
3722 				 * when a new interface comes up.
3723 				 */
3724 				if (((cire->ire_addr & ire->ire_mask) ==
3725 				    (ire->ire_addr & ire->ire_mask)) &&
3726 				    (ip_mask_to_plen(cire->ire_cmask) <=
3727 				    ire->ire_masklen)) {
3728 					ire_delete(cire);
3729 					continue;
3730 				}
3731 				/*
3732 				 * This is the case when the ire_gateway_addr
3733 				 * of 'cire' belongs to the same subnet as
3734 				 * the new ire being added.
3735 				 * Flushing such ires is sometimes required to
3736 				 * avoid misrouting: say we have a machine with
3737 				 * two interfaces (I1 and I2), a default router
3738 				 * R on the I1 subnet, and a host route to an
3739 				 * off-link destination D with a gateway G on
3740 				 * the I2 subnet.
3741 				 * Under normal operation, we will have an
3742 				 * on-link cache entry for G and an off-link
3743 				 * cache entry for D with G as ire_gateway_addr,
3744 				 * traffic to D will reach its destination
3745 				 * through gateway G.
3746 				 * If the administrator does 'ifconfig I2 down',
3747 				 * the cache entries for D and G will be
3748 				 * flushed. However, G will now be resolved as
3749 				 * an off-link destination using R (the default
3750 				 * router) as gateway. Then D will also be
3751 				 * resolved as an off-link destination using G
3752 				 * as gateway - this behavior is due to
3753 				 * compatibility reasons, see comment in
3754 				 * ire_ihandle_lookup_offlink(). Traffic to D
3755 				 * will go to the router R and probably won't
3756 				 * reach the destination.
3757 				 * The administrator then does 'ifconfig I2 up'.
3758 				 * Since G is on the I2 subnet, this routine
3759 				 * will flush its cache entry. It must also
3760 				 * flush the cache entry for D, otherwise
3761 				 * traffic will stay misrouted until the IRE
3762 				 * times out.
3763 				 */
3764 				if ((cire->ire_gateway_addr & ire->ire_mask) ==
3765 				    (ire->ire_addr & ire->ire_mask)) {
3766 					ire_delete(cire);
3767 					continue;
3768 				}
3769 			}
3770 			IRB_REFRELE(irb);
3771 		}
3772 	} else {
3773 		/*
3774 		 * delete the cache entries based on
3775 		 * handle in the IRE as this IRE is
3776 		 * being deleted/changed.
3777 		 */
3778 		for (i = 0; i < ipst->ips_ip_cache_table_size; i++) {
3779 			irb = &ipst->ips_ip_cache_table[i];
3780 			if ((cire = irb->irb_ire) == NULL)
3781 				continue;
3782 			IRB_REFHOLD(irb);
3783 			for (cire = irb->irb_ire; cire != NULL;
3784 			    cire = cire->ire_next) {
3785 				if (cire->ire_type != IRE_CACHE)
3786 					continue;
3787 				if ((cire->ire_phandle == 0 ||
3788 				    cire->ire_phandle != ire->ire_phandle) &&
3789 				    (cire->ire_ihandle == 0 ||
3790 				    cire->ire_ihandle != ire->ire_ihandle))
3791 					continue;
3792 				ire_delete(cire);
3793 			}
3794 			IRB_REFRELE(irb);
3795 		}
3796 	}
3797 }
3798 
3799 /*
3800  * Matches the arguments passed with the values in the ire.
3801  *
3802  * Note: for match types that match using "ipif" passed in, ipif
3803  * must be checked for non-NULL before calling this routine.
3804  */
3805 boolean_t
3806 ire_match_args(ire_t *ire, ipaddr_t addr, ipaddr_t mask, ipaddr_t gateway,
3807     int type, const ipif_t *ipif, zoneid_t zoneid, uint32_t ihandle,
3808     const ts_label_t *tsl, int match_flags, queue_t *wq)
3809 {
3810 	ill_t *ire_ill = NULL, *dst_ill;
3811 	ill_t *ipif_ill = NULL;
3812 
3813 	ASSERT(ire->ire_ipversion == IPV4_VERSION);
3814 	ASSERT((ire->ire_addr & ~ire->ire_mask) == 0);
3815 	ASSERT((!(match_flags & MATCH_IRE_ILL)) ||
3816 	    (ipif != NULL && !ipif->ipif_isv6));
3817 	ASSERT(!(match_flags & MATCH_IRE_WQ) || wq != NULL);
3818 
3819 	/*
3820 	 * If MATCH_IRE_MARK_TESTHIDDEN is set, then only return the IRE if it
3821 	 * is in fact hidden, to ensure the caller gets the right one.  One
3822 	 * exception: if the caller passed MATCH_IRE_IHANDLE, then they
3823 	 * already know the identity of the given IRE_INTERFACE entry and
3824 	 * there's no point trying to hide it from them.
3825 	 */
3826 	if (ire->ire_marks & IRE_MARK_TESTHIDDEN) {
3827 		if (match_flags & MATCH_IRE_IHANDLE)
3828 			match_flags |= MATCH_IRE_MARK_TESTHIDDEN;
3829 
3830 		if (!(match_flags & MATCH_IRE_MARK_TESTHIDDEN))
3831 			return (B_FALSE);
3832 	}
3833 
3834 	/*
3835 	 * MATCH_IRE_MARK_PRIVATE_ADDR is set when IP_NEXTHOP option
3836 	 * is used. In that case the routing table is bypassed and the
3837 	 * packets are sent directly to the specified nexthop. The
3838 	 * IRE_CACHE entry representing this route should be marked
3839 	 * with IRE_MARK_PRIVATE_ADDR.
3840 	 */
3841 
3842 	if (!(match_flags & MATCH_IRE_MARK_PRIVATE_ADDR) &&
3843 	    (ire->ire_marks & IRE_MARK_PRIVATE_ADDR))
3844 		return (B_FALSE);
3845 
3846 	if (zoneid != ALL_ZONES && zoneid != ire->ire_zoneid &&
3847 	    ire->ire_zoneid != ALL_ZONES) {
3848 		/*
3849 		 * If MATCH_IRE_ZONEONLY has been set and the supplied zoneid is
3850 		 * valid and does not match that of ire_zoneid, a failure to
3851 		 * match is reported at this point. Otherwise, since some IREs
3852 		 * that are available in the global zone can be used in local
3853 		 * zones, additional checks need to be performed:
3854 		 *
3855 		 *	IRE_BROADCAST, IRE_CACHE and IRE_LOOPBACK
3856 		 *	entries should never be matched in this situation.
3857 		 *
3858 		 *	IRE entries that have an interface associated with them
3859 		 *	should in general not match unless they are an IRE_LOCAL
3860 		 *	or in the case when MATCH_IRE_DEFAULT has been set in
3861 		 *	the caller.  In the case of the former, checking of the
3862 		 *	other fields supplied should take place.
3863 		 *
3864 		 *	In the case where MATCH_IRE_DEFAULT has been set,
3865 		 *	all of the ipif's associated with the IRE's ill are
3866 		 *	checked to see if there is a matching zoneid.  If any
3867 		 *	one ipif has a matching zoneid, this IRE is a
3868 		 *	potential candidate so checking of the other fields
3869 		 *	takes place.
3870 		 *
3871 		 *	In the case where the IRE_INTERFACE has a usable source
3872 		 *	address (indicated by ill_usesrc_ifindex) in the
3873 		 *	correct zone then it's permitted to return this IRE
3874 		 */
3875 		if (match_flags & MATCH_IRE_ZONEONLY)
3876 			return (B_FALSE);
3877 		if (ire->ire_type & (IRE_BROADCAST | IRE_CACHE | IRE_LOOPBACK))
3878 			return (B_FALSE);
3879 		/*
3880 		 * Note, IRE_INTERFACE can have the stq as NULL. For
3881 		 * example, if the default multicast route is tied to
3882 		 * the loopback address.
3883 		 */
3884 		if ((ire->ire_type & IRE_INTERFACE) &&
3885 		    (ire->ire_stq != NULL)) {
3886 			dst_ill = (ill_t *)ire->ire_stq->q_ptr;
3887 			/*
3888 			 * If there is a usable source address in the
3889 			 * zone, then it's ok to return an
3890 			 * IRE_INTERFACE
3891 			 */
3892 			if (ipif_usesrc_avail(dst_ill, zoneid)) {
3893 				ip3dbg(("ire_match_args: dst_ill %p match %d\n",
3894 				    (void *)dst_ill,
3895 				    (ire->ire_addr == (addr & mask))));
3896 			} else {
3897 				ip3dbg(("ire_match_args: src_ipif NULL"
3898 				    " dst_ill %p\n", (void *)dst_ill));
3899 				return (B_FALSE);
3900 			}
3901 		}
3902 		if (ire->ire_ipif != NULL && ire->ire_type != IRE_LOCAL &&
3903 		    !(ire->ire_type & IRE_INTERFACE)) {
3904 			ipif_t	*tipif;
3905 
3906 			if ((match_flags & MATCH_IRE_DEFAULT) == 0) {
3907 				return (B_FALSE);
3908 			}
3909 			mutex_enter(&ire->ire_ipif->ipif_ill->ill_lock);
3910 			for (tipif = ire->ire_ipif->ipif_ill->ill_ipif;
3911 			    tipif != NULL; tipif = tipif->ipif_next) {
3912 				if (IPIF_CAN_LOOKUP(tipif) &&
3913 				    (tipif->ipif_flags & IPIF_UP) &&
3914 				    (tipif->ipif_zoneid == zoneid ||
3915 				    tipif->ipif_zoneid == ALL_ZONES))
3916 					break;
3917 			}
3918 			mutex_exit(&ire->ire_ipif->ipif_ill->ill_lock);
3919 			if (tipif == NULL) {
3920 				return (B_FALSE);
3921 			}
3922 		}
3923 	}
3924 
3925 	/*
3926 	 * For IRE_CACHE entries, MATCH_IRE_ILL means that somebody wants to
3927 	 * send out ire_stq (ire_ipif for IRE_CACHE entries is just the means
3928 	 * of getting a source address -- i.e., ire_src_addr ==
3929 	 * ire->ire_ipif->ipif_src_addr).  ire_to_ill() handles this.
3930 	 *
3931 	 * NOTE: For IPMP, MATCH_IRE_ILL usually matches any ill in the group.
3932 	 * However, if MATCH_IRE_MARK_TESTHIDDEN is set (i.e., the IRE is for
3933 	 * IPMP test traffic), then the ill must match exactly.
3934 	 */
3935 	if (match_flags & MATCH_IRE_ILL) {
3936 		ire_ill = ire_to_ill(ire);
3937 		ipif_ill = ipif->ipif_ill;
3938 	}
3939 
3940 	if ((ire->ire_addr == (addr & mask)) &&
3941 	    ((!(match_flags & MATCH_IRE_GW)) ||
3942 	    (ire->ire_gateway_addr == gateway)) &&
3943 	    ((!(match_flags & MATCH_IRE_TYPE)) ||
3944 	    (ire->ire_type & type)) &&
3945 	    ((!(match_flags & MATCH_IRE_SRC)) ||
3946 	    (ire->ire_src_addr == ipif->ipif_src_addr)) &&
3947 	    ((!(match_flags & MATCH_IRE_IPIF)) ||
3948 	    (ire->ire_ipif == ipif)) &&
3949 	    ((!(match_flags & MATCH_IRE_MARK_TESTHIDDEN)) ||
3950 	    (ire->ire_marks & IRE_MARK_TESTHIDDEN)) &&
3951 	    ((!(match_flags & MATCH_IRE_MARK_PRIVATE_ADDR)) ||
3952 	    (ire->ire_type != IRE_CACHE ||
3953 	    ire->ire_marks & IRE_MARK_PRIVATE_ADDR)) &&
3954 	    ((!(match_flags & MATCH_IRE_WQ)) ||
3955 	    (ire->ire_stq == wq)) &&
3956 	    ((!(match_flags & MATCH_IRE_ILL)) ||
3957 	    (ire_ill == ipif_ill ||
3958 	    (!(match_flags & MATCH_IRE_MARK_TESTHIDDEN) &&
3959 	    ire_ill != NULL && IS_IN_SAME_ILLGRP(ipif_ill, ire_ill)))) &&
3960 	    ((!(match_flags & MATCH_IRE_IHANDLE)) ||
3961 	    (ire->ire_ihandle == ihandle)) &&
3962 	    ((!(match_flags & MATCH_IRE_MASK)) ||
3963 	    (ire->ire_mask == mask)) &&
3964 	    ((!(match_flags & MATCH_IRE_SECATTR)) ||
3965 	    (!is_system_labeled()) ||
3966 	    (tsol_ire_match_gwattr(ire, tsl) == 0))) {
3967 		/* We found the matched IRE */
3968 		return (B_TRUE);
3969 	}
3970 	return (B_FALSE);
3971 }
3972 
3973 /*
3974  * Lookup for a route in all the tables
3975  */
3976 ire_t *
3977 ire_route_lookup(ipaddr_t addr, ipaddr_t mask, ipaddr_t gateway,
3978     int type, const ipif_t *ipif, ire_t **pire, zoneid_t zoneid,
3979     const ts_label_t *tsl, int flags, ip_stack_t *ipst)
3980 {
3981 	ire_t *ire = NULL;
3982 
3983 	/*
3984 	 * ire_match_args() will dereference ipif MATCH_IRE_SRC or
3985 	 * MATCH_IRE_ILL is set.
3986 	 */
3987 	if ((flags & (MATCH_IRE_SRC | MATCH_IRE_ILL)) && (ipif == NULL))
3988 		return (NULL);
3989 
3990 	/*
3991 	 * might be asking for a cache lookup,
3992 	 * This is not best way to lookup cache,
3993 	 * user should call ire_cache_lookup directly.
3994 	 *
3995 	 * If MATCH_IRE_TYPE was set, first lookup in the cache table and then
3996 	 * in the forwarding table, if the applicable type flags were set.
3997 	 */
3998 	if ((flags & MATCH_IRE_TYPE) == 0 || (type & IRE_CACHETABLE) != 0) {
3999 		ire = ire_ctable_lookup(addr, gateway, type, ipif, zoneid,
4000 		    tsl, flags, ipst);
4001 		if (ire != NULL)
4002 			return (ire);
4003 	}
4004 	if ((flags & MATCH_IRE_TYPE) == 0 || (type & IRE_FORWARDTABLE) != 0) {
4005 		ire = ire_ftable_lookup(addr, mask, gateway, type, ipif, pire,
4006 		    zoneid, 0, tsl, flags, ipst);
4007 	}
4008 	return (ire);
4009 }
4010 
4011 /*
4012  * Delete the IRE cache for the gateway and all IRE caches whose
4013  * ire_gateway_addr points to this gateway, and allow them to
4014  * be created on demand by ip_newroute.
4015  */
4016 void
4017 ire_clookup_delete_cache_gw(ipaddr_t addr, zoneid_t zoneid, ip_stack_t *ipst)
4018 {
4019 	irb_t *irb;
4020 	ire_t *ire;
4021 
4022 	irb = &ipst->ips_ip_cache_table[IRE_ADDR_HASH(addr,
4023 	    ipst->ips_ip_cache_table_size)];
4024 	IRB_REFHOLD(irb);
4025 	for (ire = irb->irb_ire; ire != NULL; ire = ire->ire_next) {
4026 		if (ire->ire_marks & IRE_MARK_CONDEMNED)
4027 			continue;
4028 
4029 		ASSERT(ire->ire_mask == IP_HOST_MASK);
4030 		if (ire_match_args(ire, addr, ire->ire_mask, 0, IRE_CACHE,
4031 		    NULL, zoneid, 0, NULL, MATCH_IRE_TYPE, NULL)) {
4032 			ire_delete(ire);
4033 		}
4034 	}
4035 	IRB_REFRELE(irb);
4036 
4037 	ire_walk_v4(ire_delete_cache_gw, &addr, zoneid, ipst);
4038 }
4039 
4040 /*
4041  * Looks up cache table for a route.
4042  * specific lookup can be indicated by
4043  * passing the MATCH_* flags and the
4044  * necessary parameters.
4045  */
4046 ire_t *
4047 ire_ctable_lookup(ipaddr_t addr, ipaddr_t gateway, int type, const ipif_t *ipif,
4048     zoneid_t zoneid, const ts_label_t *tsl, int flags, ip_stack_t *ipst)
4049 {
4050 	ire_ctable_args_t	margs;
4051 
4052 	margs.ict_addr = &addr;
4053 	margs.ict_gateway = &gateway;
4054 	margs.ict_type = type;
4055 	margs.ict_ipif = ipif;
4056 	margs.ict_zoneid = zoneid;
4057 	margs.ict_tsl = tsl;
4058 	margs.ict_flags = flags;
4059 	margs.ict_ipst = ipst;
4060 	margs.ict_wq = NULL;
4061 
4062 	return (ip4_ctable_lookup_impl(&margs));
4063 }
4064 
4065 /*
4066  * Check whether the IRE_LOCAL and the IRE potentially used to transmit
4067  * (could be an IRE_CACHE, IRE_BROADCAST, or IRE_INTERFACE) are identical
4068  * or part of the same illgrp.  (In the IPMP case, usually the two IREs
4069  * will both belong to the IPMP ill, but exceptions are possible -- e.g.
4070  * if IPMP test addresses are on their own subnet.)
4071  */
4072 boolean_t
4073 ire_local_same_lan(ire_t *ire_local, ire_t *xmit_ire)
4074 {
4075 	ill_t *recv_ill, *xmit_ill;
4076 
4077 	ASSERT(ire_local->ire_type & (IRE_LOCAL|IRE_LOOPBACK));
4078 	ASSERT(xmit_ire->ire_type & (IRE_CACHETABLE|IRE_INTERFACE));
4079 
4080 	recv_ill = ire_to_ill(ire_local);
4081 	xmit_ill = ire_to_ill(xmit_ire);
4082 
4083 	ASSERT(recv_ill != NULL);
4084 	ASSERT(xmit_ill != NULL);
4085 
4086 	return (IS_ON_SAME_LAN(recv_ill, xmit_ill));
4087 }
4088 
4089 /*
4090  * Check if the IRE_LOCAL uses the same ill as another route would use.
4091  * If there is no alternate route, or the alternate is a REJECT or BLACKHOLE,
4092  * then we don't allow this IRE_LOCAL to be used.
4093  */
4094 boolean_t
4095 ire_local_ok_across_zones(ire_t *ire_local, zoneid_t zoneid, void *addr,
4096     const ts_label_t *tsl, ip_stack_t *ipst)
4097 {
4098 	ire_t		*alt_ire;
4099 	boolean_t	rval;
4100 	int		flags;
4101 
4102 	flags = MATCH_IRE_RECURSIVE | MATCH_IRE_DEFAULT | MATCH_IRE_RJ_BHOLE;
4103 
4104 	if (ire_local->ire_ipversion == IPV4_VERSION) {
4105 		alt_ire = ire_ftable_lookup(*((ipaddr_t *)addr), 0, 0, 0, NULL,
4106 		    NULL, zoneid, 0, tsl, flags, ipst);
4107 	} else {
4108 		alt_ire = ire_ftable_lookup_v6(addr, NULL, NULL, 0, NULL,
4109 		    NULL, zoneid, 0, tsl, flags, ipst);
4110 	}
4111 
4112 	if (alt_ire == NULL)
4113 		return (B_FALSE);
4114 
4115 	if (alt_ire->ire_flags & (RTF_REJECT|RTF_BLACKHOLE)) {
4116 		ire_refrele(alt_ire);
4117 		return (B_FALSE);
4118 	}
4119 	rval = ire_local_same_lan(ire_local, alt_ire);
4120 
4121 	ire_refrele(alt_ire);
4122 	return (rval);
4123 }
4124 
4125 /*
4126  * Lookup cache
4127  *
4128  * In general the zoneid has to match (where ALL_ZONES match all of them).
4129  * But for IRE_LOCAL we also need to handle the case where L2 should
4130  * conceptually loop back the packet. This is necessary since neither
4131  * Ethernet drivers nor Ethernet hardware loops back packets sent to their
4132  * own MAC address. This loopback is needed when the normal
4133  * routes (ignoring IREs with different zoneids) would send out the packet on
4134  * the same ill as the ill with which this IRE_LOCAL is associated.
4135  *
4136  * Earlier versions of this code always matched an IRE_LOCAL independently of
4137  * the zoneid. We preserve that earlier behavior when
4138  * ip_restrict_interzone_loopback is turned off.
4139  */
4140 ire_t *
4141 ire_cache_lookup(ipaddr_t addr, zoneid_t zoneid, const ts_label_t *tsl,
4142     ip_stack_t *ipst)
4143 {
4144 	irb_t *irb_ptr;
4145 	ire_t *ire;
4146 
4147 	irb_ptr = &ipst->ips_ip_cache_table[IRE_ADDR_HASH(addr,
4148 	    ipst->ips_ip_cache_table_size)];
4149 	rw_enter(&irb_ptr->irb_lock, RW_READER);
4150 	for (ire = irb_ptr->irb_ire; ire != NULL; ire = ire->ire_next) {
4151 		if (ire->ire_marks & (IRE_MARK_CONDEMNED |
4152 		    IRE_MARK_TESTHIDDEN | IRE_MARK_PRIVATE_ADDR)) {
4153 			continue;
4154 		}
4155 		if (ire->ire_addr == addr) {
4156 			/*
4157 			 * Finally, check if the security policy has any
4158 			 * restriction on using this route for the specified
4159 			 * message.
4160 			 */
4161 			if (tsl != NULL &&
4162 			    ire->ire_gw_secattr != NULL &&
4163 			    tsol_ire_match_gwattr(ire, tsl) != 0) {
4164 				continue;
4165 			}
4166 
4167 			if (zoneid == ALL_ZONES || ire->ire_zoneid == zoneid ||
4168 			    ire->ire_zoneid == ALL_ZONES) {
4169 				IRE_REFHOLD(ire);
4170 				rw_exit(&irb_ptr->irb_lock);
4171 				return (ire);
4172 			}
4173 
4174 			if (ire->ire_type == IRE_LOCAL) {
4175 				if (ipst->ips_ip_restrict_interzone_loopback &&
4176 				    !ire_local_ok_across_zones(ire, zoneid,
4177 				    &addr, tsl, ipst))
4178 					continue;
4179 
4180 				IRE_REFHOLD(ire);
4181 				rw_exit(&irb_ptr->irb_lock);
4182 				return (ire);
4183 			}
4184 		}
4185 	}
4186 	rw_exit(&irb_ptr->irb_lock);
4187 	return (NULL);
4188 }
4189 
4190 ire_t *
4191 ire_cache_lookup_simple(ipaddr_t dst, ip_stack_t *ipst)
4192 {
4193 	irb_t *irb_ptr;
4194 	ire_t *ire;
4195 
4196 	/*
4197 	 * Look for an ire in the cachetable whose
4198 	 * ire_addr matches the destination.
4199 	 * Since we are being called by forwarding fastpath
4200 	 * no need to check for Trusted Solaris label.
4201 	 */
4202 	irb_ptr = &ipst->ips_ip_cache_table[IRE_ADDR_HASH(
4203 	    dst, ipst->ips_ip_cache_table_size)];
4204 	rw_enter(&irb_ptr->irb_lock, RW_READER);
4205 	for (ire = irb_ptr->irb_ire; ire != NULL; ire = ire->ire_next) {
4206 		if (ire->ire_marks & (IRE_MARK_CONDEMNED | IRE_MARK_TESTHIDDEN |
4207 		    IRE_MARK_PRIVATE_ADDR)) {
4208 			continue;
4209 		}
4210 		if (ire->ire_addr == dst) {
4211 			IRE_REFHOLD(ire);
4212 			rw_exit(&irb_ptr->irb_lock);
4213 			return (ire);
4214 		}
4215 	}
4216 	rw_exit(&irb_ptr->irb_lock);
4217 	return (NULL);
4218 }
4219 
4220 /*
4221  * Locate the interface ire that is tied to the cache ire 'cire' via
4222  * cire->ire_ihandle.
4223  *
4224  * We are trying to create the cache ire for an offlink destn based
4225  * on the cache ire of the gateway in 'cire'. 'pire' is the prefix ire
4226  * as found by ip_newroute(). We are called from ip_newroute() in
4227  * the IRE_CACHE case.
4228  */
4229 ire_t *
4230 ire_ihandle_lookup_offlink(ire_t *cire, ire_t *pire)
4231 {
4232 	ire_t	*ire;
4233 	int	match_flags;
4234 	ipaddr_t gw_addr;
4235 	ipif_t	*gw_ipif;
4236 	ip_stack_t	*ipst = cire->ire_ipst;
4237 
4238 	ASSERT(cire != NULL && pire != NULL);
4239 
4240 	/*
4241 	 * We don't need to specify the zoneid to ire_ftable_lookup() below
4242 	 * because the ihandle refers to an ipif which can be in only one zone.
4243 	 */
4244 	match_flags =  MATCH_IRE_TYPE | MATCH_IRE_IHANDLE | MATCH_IRE_MASK;
4245 	if (pire->ire_ipif != NULL)
4246 		match_flags |= MATCH_IRE_ILL;
4247 	/*
4248 	 * We know that the mask of the interface ire equals cire->ire_cmask.
4249 	 * (When ip_newroute() created 'cire' for the gateway it set its
4250 	 * cmask from the interface ire's mask)
4251 	 */
4252 	ire = ire_ftable_lookup(cire->ire_addr, cire->ire_cmask, 0,
4253 	    IRE_INTERFACE, pire->ire_ipif, NULL, ALL_ZONES, cire->ire_ihandle,
4254 	    NULL, match_flags, ipst);
4255 	if (ire != NULL)
4256 		return (ire);
4257 	/*
4258 	 * If we didn't find an interface ire above, we can't declare failure.
4259 	 * For backwards compatibility, we need to support prefix routes
4260 	 * pointing to next hop gateways that are not on-link.
4261 	 *
4262 	 * Assume we are trying to ping some offlink destn, and we have the
4263 	 * routing table below.
4264 	 *
4265 	 * Eg.	default	- gw1		<--- pire	(line 1)
4266 	 *	gw1	- gw2				(line 2)
4267 	 *	gw2	- hme0				(line 3)
4268 	 *
4269 	 * If we already have a cache ire for gw1 in 'cire', the
4270 	 * ire_ftable_lookup above would have failed, since there is no
4271 	 * interface ire to reach gw1. We will fallthru below.
4272 	 *
4273 	 * Here we duplicate the steps that ire_ftable_lookup() did in
4274 	 * getting 'cire' from 'pire', in the MATCH_IRE_RECURSIVE case.
4275 	 * The differences are the following
4276 	 * i.   We want the interface ire only, so we call ire_ftable_lookup()
4277 	 *	instead of ire_route_lookup()
4278 	 * ii.  We look for only prefix routes in the 1st call below.
4279 	 * ii.  We want to match on the ihandle in the 2nd call below.
4280 	 */
4281 	match_flags =  MATCH_IRE_TYPE;
4282 	if (pire->ire_ipif != NULL)
4283 		match_flags |= MATCH_IRE_ILL;
4284 	ire = ire_ftable_lookup(pire->ire_gateway_addr, 0, 0, IRE_OFFSUBNET,
4285 	    pire->ire_ipif, NULL, ALL_ZONES, 0, NULL, match_flags, ipst);
4286 	if (ire == NULL)
4287 		return (NULL);
4288 	/*
4289 	 * At this point 'ire' corresponds to the entry shown in line 2.
4290 	 * gw_addr is 'gw2' in the example above.
4291 	 */
4292 	gw_addr = ire->ire_gateway_addr;
4293 	gw_ipif = ire->ire_ipif;
4294 	ire_refrele(ire);
4295 
4296 	match_flags |= MATCH_IRE_IHANDLE;
4297 	ire = ire_ftable_lookup(gw_addr, 0, 0, IRE_INTERFACE,
4298 	    gw_ipif, NULL, ALL_ZONES, cire->ire_ihandle, NULL, match_flags,
4299 	    ipst);
4300 	return (ire);
4301 }
4302 
4303 /*
4304  * Return the IRE_LOOPBACK, IRE_IF_RESOLVER or IRE_IF_NORESOLVER
4305  * ire associated with the specified ipif.
4306  *
4307  * This might occasionally be called when IPIF_UP is not set since
4308  * the IP_MULTICAST_IF as well as creating interface routes
4309  * allows specifying a down ipif (ipif_lookup* match ipifs that are down).
4310  *
4311  * Note that if IPIF_NOLOCAL, IPIF_NOXMIT, or IPIF_DEPRECATED is set on
4312  * the ipif, this routine might return NULL.
4313  */
4314 ire_t *
4315 ipif_to_ire(const ipif_t *ipif)
4316 {
4317 	ire_t	*ire;
4318 	ip_stack_t *ipst = ipif->ipif_ill->ill_ipst;
4319 	uint_t	match_flags = MATCH_IRE_TYPE | MATCH_IRE_IPIF | MATCH_IRE_MASK;
4320 
4321 	/*
4322 	 * IRE_INTERFACE entries for ills under IPMP are IRE_MARK_TESTHIDDEN
4323 	 * so that they aren't accidentally returned.  However, if the
4324 	 * caller's ipif is on an ill under IPMP, there's no need to hide 'em.
4325 	 */
4326 	if (IS_UNDER_IPMP(ipif->ipif_ill))
4327 		match_flags |= MATCH_IRE_MARK_TESTHIDDEN;
4328 
4329 	ASSERT(!ipif->ipif_isv6);
4330 	if (ipif->ipif_ire_type == IRE_LOOPBACK) {
4331 		ire = ire_ctable_lookup(ipif->ipif_lcl_addr, 0, IRE_LOOPBACK,
4332 		    ipif, ALL_ZONES, NULL, (MATCH_IRE_TYPE | MATCH_IRE_IPIF),
4333 		    ipst);
4334 	} else if (ipif->ipif_flags & IPIF_POINTOPOINT) {
4335 		/* In this case we need to lookup destination address. */
4336 		ire = ire_ftable_lookup(ipif->ipif_pp_dst_addr, IP_HOST_MASK, 0,
4337 		    IRE_INTERFACE, ipif, NULL, ALL_ZONES, 0, NULL, match_flags,
4338 		    ipst);
4339 	} else {
4340 		ire = ire_ftable_lookup(ipif->ipif_subnet,
4341 		    ipif->ipif_net_mask, 0, IRE_INTERFACE, ipif, NULL,
4342 		    ALL_ZONES, 0, NULL, match_flags, ipst);
4343 	}
4344 	return (ire);
4345 }
4346 
4347 /*
4348  * ire_walk function.
4349  * Count the number of IRE_CACHE entries in different categories.
4350  */
4351 void
4352 ire_cache_count(ire_t *ire, char *arg)
4353 {
4354 	ire_cache_count_t *icc = (ire_cache_count_t *)arg;
4355 
4356 	if (ire->ire_type != IRE_CACHE)
4357 		return;
4358 
4359 	icc->icc_total++;
4360 
4361 	if (ire->ire_ipversion == IPV6_VERSION) {
4362 		mutex_enter(&ire->ire_lock);
4363 		if (IN6_IS_ADDR_UNSPECIFIED(&ire->ire_gateway_addr_v6)) {
4364 			mutex_exit(&ire->ire_lock);
4365 			icc->icc_onlink++;
4366 			return;
4367 		}
4368 		mutex_exit(&ire->ire_lock);
4369 	} else {
4370 		if (ire->ire_gateway_addr == 0) {
4371 			icc->icc_onlink++;
4372 			return;
4373 		}
4374 	}
4375 
4376 	ASSERT(ire->ire_ipif != NULL);
4377 	if (ire->ire_max_frag < ire->ire_ipif->ipif_mtu)
4378 		icc->icc_pmtu++;
4379 	else if (ire->ire_tire_mark != ire->ire_ob_pkt_count +
4380 	    ire->ire_ib_pkt_count)
4381 		icc->icc_offlink++;
4382 	else
4383 		icc->icc_unused++;
4384 }
4385 
4386 /*
4387  * ire_walk function called by ip_trash_ire_reclaim().
4388  * Free a fraction of the IRE_CACHE cache entries. The fractions are
4389  * different for different categories of IRE_CACHE entries.
4390  * A fraction of zero means to not free any in that category.
4391  * Use the hash bucket id plus lbolt as a random number. Thus if the fraction
4392  * is N then every Nth hash bucket chain will be freed.
4393  */
4394 void
4395 ire_cache_reclaim(ire_t *ire, char *arg)
4396 {
4397 	ire_cache_reclaim_t *icr = (ire_cache_reclaim_t *)arg;
4398 	uint_t rand;
4399 	ip_stack_t	*ipst = icr->icr_ipst;
4400 
4401 	if (ire->ire_type != IRE_CACHE)
4402 		return;
4403 
4404 	if (ire->ire_ipversion == IPV6_VERSION) {
4405 		rand = (uint_t)lbolt +
4406 		    IRE_ADDR_HASH_V6(ire->ire_addr_v6,
4407 		    ipst->ips_ip6_cache_table_size);
4408 		mutex_enter(&ire->ire_lock);
4409 		if (IN6_IS_ADDR_UNSPECIFIED(&ire->ire_gateway_addr_v6)) {
4410 			mutex_exit(&ire->ire_lock);
4411 			if (icr->icr_onlink != 0 &&
4412 			    (rand/icr->icr_onlink)*icr->icr_onlink == rand) {
4413 				ire_delete(ire);
4414 				return;
4415 			}
4416 			goto done;
4417 		}
4418 		mutex_exit(&ire->ire_lock);
4419 	} else {
4420 		rand = (uint_t)lbolt +
4421 		    IRE_ADDR_HASH(ire->ire_addr, ipst->ips_ip_cache_table_size);
4422 		if (ire->ire_gateway_addr == 0) {
4423 			if (icr->icr_onlink != 0 &&
4424 			    (rand/icr->icr_onlink)*icr->icr_onlink == rand) {
4425 				ire_delete(ire);
4426 				return;
4427 			}
4428 			goto done;
4429 		}
4430 	}
4431 	/* Not onlink IRE */
4432 	ASSERT(ire->ire_ipif != NULL);
4433 	if (ire->ire_max_frag < ire->ire_ipif->ipif_mtu) {
4434 		/* Use ptmu fraction */
4435 		if (icr->icr_pmtu != 0 &&
4436 		    (rand/icr->icr_pmtu)*icr->icr_pmtu == rand) {
4437 			ire_delete(ire);
4438 			return;
4439 		}
4440 	} else if (ire->ire_tire_mark != ire->ire_ob_pkt_count +
4441 	    ire->ire_ib_pkt_count) {
4442 		/* Use offlink fraction */
4443 		if (icr->icr_offlink != 0 &&
4444 		    (rand/icr->icr_offlink)*icr->icr_offlink == rand) {
4445 			ire_delete(ire);
4446 			return;
4447 		}
4448 	} else {
4449 		/* Use unused fraction */
4450 		if (icr->icr_unused != 0 &&
4451 		    (rand/icr->icr_unused)*icr->icr_unused == rand) {
4452 			ire_delete(ire);
4453 			return;
4454 		}
4455 	}
4456 done:
4457 	/*
4458 	 * Update tire_mark so that those that haven't been used since this
4459 	 * reclaim will be considered unused next time we reclaim.
4460 	 */
4461 	ire->ire_tire_mark = ire->ire_ob_pkt_count + ire->ire_ib_pkt_count;
4462 }
4463 
4464 static void
4465 power2_roundup(uint32_t *value)
4466 {
4467 	int i;
4468 
4469 	for (i = 1; i < 31; i++) {
4470 		if (*value <= (1 << i))
4471 			break;
4472 	}
4473 	*value = (1 << i);
4474 }
4475 
4476 /* Global init for all zones */
4477 void
4478 ip_ire_g_init()
4479 {
4480 	/*
4481 	 * Create ire caches, ire_reclaim()
4482 	 * will give IRE_CACHE back to system when needed.
4483 	 * This needs to be done here before anything else, since
4484 	 * ire_add() expects the cache to be created.
4485 	 */
4486 	ire_cache = kmem_cache_create("ire_cache",
4487 	    sizeof (ire_t), 0, ip_ire_constructor,
4488 	    ip_ire_destructor, ip_trash_ire_reclaim, NULL, NULL, 0);
4489 
4490 	rt_entry_cache = kmem_cache_create("rt_entry",
4491 	    sizeof (struct rt_entry), 0, NULL, NULL, NULL, NULL, NULL, 0);
4492 
4493 	/*
4494 	 * Have radix code setup kmem caches etc.
4495 	 */
4496 	rn_init();
4497 }
4498 
4499 void
4500 ip_ire_init(ip_stack_t *ipst)
4501 {
4502 	int i;
4503 	uint32_t mem_cnt;
4504 	uint32_t cpu_cnt;
4505 	uint32_t min_cnt;
4506 	pgcnt_t mem_avail;
4507 
4508 	/*
4509 	 * ip_ire_max_bucket_cnt is sized below based on the memory
4510 	 * size and the cpu speed of the machine. This is upper
4511 	 * bounded by the compile time value of ip_ire_max_bucket_cnt
4512 	 * and is lower bounded by the compile time value of
4513 	 * ip_ire_min_bucket_cnt.  Similar logic applies to
4514 	 * ip6_ire_max_bucket_cnt.
4515 	 *
4516 	 * We calculate this for each IP Instances in order to use
4517 	 * the kmem_avail and ip_ire_{min,max}_bucket_cnt that are
4518 	 * in effect when the zone is booted.
4519 	 */
4520 	mem_avail = kmem_avail();
4521 	mem_cnt = (mem_avail >> ip_ire_mem_ratio) /
4522 	    ip_cache_table_size / sizeof (ire_t);
4523 	cpu_cnt = CPU->cpu_type_info.pi_clock >> ip_ire_cpu_ratio;
4524 
4525 	min_cnt = MIN(cpu_cnt, mem_cnt);
4526 	if (min_cnt < ip_ire_min_bucket_cnt)
4527 		min_cnt = ip_ire_min_bucket_cnt;
4528 	if (ip_ire_max_bucket_cnt > min_cnt) {
4529 		ip_ire_max_bucket_cnt = min_cnt;
4530 	}
4531 
4532 	mem_cnt = (mem_avail >> ip_ire_mem_ratio) /
4533 	    ip6_cache_table_size / sizeof (ire_t);
4534 	min_cnt = MIN(cpu_cnt, mem_cnt);
4535 	if (min_cnt < ip6_ire_min_bucket_cnt)
4536 		min_cnt = ip6_ire_min_bucket_cnt;
4537 	if (ip6_ire_max_bucket_cnt > min_cnt) {
4538 		ip6_ire_max_bucket_cnt = min_cnt;
4539 	}
4540 
4541 	mutex_init(&ipst->ips_ire_ft_init_lock, NULL, MUTEX_DEFAULT, 0);
4542 	mutex_init(&ipst->ips_ire_handle_lock, NULL, MUTEX_DEFAULT, NULL);
4543 
4544 	(void) rn_inithead((void **)&ipst->ips_ip_ftable, 32);
4545 
4546 	/* Calculate the IPv4 cache table size. */
4547 	ipst->ips_ip_cache_table_size = MAX(ip_cache_table_size,
4548 	    ((mem_avail >> ip_ire_mem_ratio) / sizeof (ire_t) /
4549 	    ip_ire_max_bucket_cnt));
4550 	if (ipst->ips_ip_cache_table_size > ip_max_cache_table_size)
4551 		ipst->ips_ip_cache_table_size = ip_max_cache_table_size;
4552 	/*
4553 	 * Make sure that the table size is always a power of 2.  The
4554 	 * hash macro IRE_ADDR_HASH() depends on that.
4555 	 */
4556 	power2_roundup(&ipst->ips_ip_cache_table_size);
4557 
4558 	ipst->ips_ip_cache_table = kmem_zalloc(ipst->ips_ip_cache_table_size *
4559 	    sizeof (irb_t), KM_SLEEP);
4560 
4561 	for (i = 0; i < ipst->ips_ip_cache_table_size; i++) {
4562 		rw_init(&ipst->ips_ip_cache_table[i].irb_lock, NULL,
4563 		    RW_DEFAULT, NULL);
4564 	}
4565 
4566 	/* Calculate the IPv6 cache table size. */
4567 	ipst->ips_ip6_cache_table_size = MAX(ip6_cache_table_size,
4568 	    ((mem_avail >> ip_ire_mem_ratio) / sizeof (ire_t) /
4569 	    ip6_ire_max_bucket_cnt));
4570 	if (ipst->ips_ip6_cache_table_size > ip6_max_cache_table_size)
4571 		ipst->ips_ip6_cache_table_size = ip6_max_cache_table_size;
4572 	/*
4573 	 * Make sure that the table size is always a power of 2.  The
4574 	 * hash macro IRE_ADDR_HASH_V6() depends on that.
4575 	 */
4576 	power2_roundup(&ipst->ips_ip6_cache_table_size);
4577 
4578 	ipst->ips_ip_cache_table_v6 = kmem_zalloc(
4579 	    ipst->ips_ip6_cache_table_size * sizeof (irb_t), KM_SLEEP);
4580 
4581 	for (i = 0; i < ipst->ips_ip6_cache_table_size; i++) {
4582 		rw_init(&ipst->ips_ip_cache_table_v6[i].irb_lock, NULL,
4583 		    RW_DEFAULT, NULL);
4584 	}
4585 
4586 	/*
4587 	 * Make sure that the forwarding table size is a power of 2.
4588 	 * The IRE*_ADDR_HASH() macroes depend on that.
4589 	 */
4590 	ipst->ips_ip6_ftable_hash_size = ip6_ftable_hash_size;
4591 	power2_roundup(&ipst->ips_ip6_ftable_hash_size);
4592 
4593 	ipst->ips_ire_handle = 1;
4594 }
4595 
4596 void
4597 ip_ire_g_fini(void)
4598 {
4599 	kmem_cache_destroy(ire_cache);
4600 	kmem_cache_destroy(rt_entry_cache);
4601 
4602 	rn_fini();
4603 }
4604 
4605 void
4606 ip_ire_fini(ip_stack_t *ipst)
4607 {
4608 	int i;
4609 
4610 	/*
4611 	 * Delete all IREs - assumes that the ill/ipifs have
4612 	 * been removed so what remains are just the ftable and IRE_CACHE.
4613 	 */
4614 	ire_walk(ire_delete, NULL, ipst);
4615 
4616 	rn_freehead(ipst->ips_ip_ftable);
4617 	ipst->ips_ip_ftable = NULL;
4618 
4619 	mutex_destroy(&ipst->ips_ire_ft_init_lock);
4620 	mutex_destroy(&ipst->ips_ire_handle_lock);
4621 
4622 	for (i = 0; i < ipst->ips_ip_cache_table_size; i++) {
4623 		ASSERT(ipst->ips_ip_cache_table[i].irb_ire == NULL);
4624 		rw_destroy(&ipst->ips_ip_cache_table[i].irb_lock);
4625 	}
4626 	kmem_free(ipst->ips_ip_cache_table,
4627 	    ipst->ips_ip_cache_table_size * sizeof (irb_t));
4628 	ipst->ips_ip_cache_table = NULL;
4629 
4630 	for (i = 0; i < ipst->ips_ip6_cache_table_size; i++) {
4631 		ASSERT(ipst->ips_ip_cache_table_v6[i].irb_ire == NULL);
4632 		rw_destroy(&ipst->ips_ip_cache_table_v6[i].irb_lock);
4633 	}
4634 	kmem_free(ipst->ips_ip_cache_table_v6,
4635 	    ipst->ips_ip6_cache_table_size * sizeof (irb_t));
4636 	ipst->ips_ip_cache_table_v6 = NULL;
4637 
4638 	for (i = 0; i < IP6_MASK_TABLE_SIZE; i++) {
4639 		irb_t *ptr;
4640 		int j;
4641 
4642 		if ((ptr = ipst->ips_ip_forwarding_table_v6[i]) == NULL)
4643 			continue;
4644 
4645 		for (j = 0; j < ipst->ips_ip6_ftable_hash_size; j++) {
4646 			ASSERT(ptr[j].irb_ire == NULL);
4647 			rw_destroy(&ptr[j].irb_lock);
4648 		}
4649 		mi_free(ptr);
4650 		ipst->ips_ip_forwarding_table_v6[i] = NULL;
4651 	}
4652 }
4653 
4654 /*
4655  * Check if another multirt route resolution is needed.
4656  * B_TRUE is returned is there remain a resolvable route,
4657  * or if no route for that dst is resolved yet.
4658  * B_FALSE is returned if all routes for that dst are resolved
4659  * or if the remaining unresolved routes are actually not
4660  * resolvable.
4661  * This only works in the global zone.
4662  */
4663 boolean_t
4664 ire_multirt_need_resolve(ipaddr_t dst, const ts_label_t *tsl, ip_stack_t *ipst)
4665 {
4666 	ire_t	*first_fire;
4667 	ire_t	*first_cire;
4668 	ire_t	*fire;
4669 	ire_t	*cire;
4670 	irb_t	*firb;
4671 	irb_t	*cirb;
4672 	int	unres_cnt = 0;
4673 	boolean_t resolvable = B_FALSE;
4674 
4675 	/* Retrieve the first IRE_HOST that matches the destination */
4676 	first_fire = ire_ftable_lookup(dst, IP_HOST_MASK, 0, IRE_HOST, NULL,
4677 	    NULL, ALL_ZONES, 0, tsl,
4678 	    MATCH_IRE_MASK | MATCH_IRE_TYPE | MATCH_IRE_SECATTR, ipst);
4679 
4680 	/* No route at all */
4681 	if (first_fire == NULL) {
4682 		return (B_TRUE);
4683 	}
4684 
4685 	firb = first_fire->ire_bucket;
4686 	ASSERT(firb != NULL);
4687 
4688 	/* Retrieve the first IRE_CACHE ire for that destination. */
4689 	first_cire = ire_cache_lookup(dst, GLOBAL_ZONEID, tsl, ipst);
4690 
4691 	/* No resolved route. */
4692 	if (first_cire == NULL) {
4693 		ire_refrele(first_fire);
4694 		return (B_TRUE);
4695 	}
4696 
4697 	/*
4698 	 * At least one route is resolved. Here we look through the forward
4699 	 * and cache tables, to compare the number of declared routes
4700 	 * with the number of resolved routes. The search for a resolvable
4701 	 * route is performed only if at least one route remains
4702 	 * unresolved.
4703 	 */
4704 	cirb = first_cire->ire_bucket;
4705 	ASSERT(cirb != NULL);
4706 
4707 	/* Count the number of routes to that dest that are declared. */
4708 	IRB_REFHOLD(firb);
4709 	for (fire = first_fire; fire != NULL; fire = fire->ire_next) {
4710 		if (!(fire->ire_flags & RTF_MULTIRT))
4711 			continue;
4712 		if (fire->ire_addr != dst)
4713 			continue;
4714 		unres_cnt++;
4715 	}
4716 	IRB_REFRELE(firb);
4717 
4718 	/* Then subtract the number of routes to that dst that are resolved */
4719 	IRB_REFHOLD(cirb);
4720 	for (cire = first_cire; cire != NULL; cire = cire->ire_next) {
4721 		if (!(cire->ire_flags & RTF_MULTIRT))
4722 			continue;
4723 		if (cire->ire_addr != dst)
4724 			continue;
4725 		if (cire->ire_marks & (IRE_MARK_CONDEMNED|IRE_MARK_TESTHIDDEN))
4726 			continue;
4727 		unres_cnt--;
4728 	}
4729 	IRB_REFRELE(cirb);
4730 
4731 	/* At least one route is unresolved; search for a resolvable route. */
4732 	if (unres_cnt > 0)
4733 		resolvable = ire_multirt_lookup(&first_cire, &first_fire,
4734 		    MULTIRT_USESTAMP | MULTIRT_CACHEGW, NULL, tsl, ipst);
4735 
4736 	if (first_fire != NULL)
4737 		ire_refrele(first_fire);
4738 
4739 	if (first_cire != NULL)
4740 		ire_refrele(first_cire);
4741 
4742 	return (resolvable);
4743 }
4744 
4745 /*
4746  * Explore a forward_table bucket, starting from fire_arg.
4747  * fire_arg MUST be an IRE_HOST entry.
4748  *
4749  * Return B_TRUE and update *ire_arg and *fire_arg
4750  * if at least one resolvable route is found. *ire_arg
4751  * is the IRE entry for *fire_arg's gateway.
4752  *
4753  * Return B_FALSE otherwise (all routes are resolved or
4754  * the remaining unresolved routes are all unresolvable).
4755  *
4756  * The IRE selection relies on a priority mechanism
4757  * driven by the flags passed in by the caller.
4758  * The caller, such as ip_newroute_ipif(), can get the most
4759  * relevant ire at each stage of a multiple route resolution.
4760  *
4761  * The rules are:
4762  *
4763  * - if MULTIRT_CACHEGW is specified in flags, IRE_CACHETABLE
4764  *   ires are preferred for the gateway. This gives the highest
4765  *   priority to routes that can be resolved without using
4766  *   a resolver.
4767  *
4768  * - if MULTIRT_CACHEGW is not specified, or if MULTIRT_CACHEGW
4769  *   is specified but no IRE_CACHETABLE ire entry for the gateway
4770  *   is found, the following rules apply.
4771  *
4772  * - if MULTIRT_USESTAMP is specified in flags, IRE_INTERFACE
4773  *   ires for the gateway, that have not been tried since
4774  *   a configurable amount of time, are preferred.
4775  *   This applies when a resolver must be invoked for
4776  *   a missing route, but we don't want to use the resolver
4777  *   upon each packet emission. If no such resolver is found,
4778  *   B_FALSE is returned.
4779  *   The MULTIRT_USESTAMP flag can be combined with
4780  *   MULTIRT_CACHEGW.
4781  *
4782  * - if MULTIRT_USESTAMP is not specified in flags, the first
4783  *   unresolved but resolvable route is selected.
4784  *
4785  * - Otherwise, there is no resolvable route, and
4786  *   B_FALSE is returned.
4787  *
4788  * At last, MULTIRT_SETSTAMP can be specified in flags to
4789  * request the timestamp of unresolvable routes to
4790  * be refreshed. This prevents the useless exploration
4791  * of those routes for a while, when MULTIRT_USESTAMP is used.
4792  *
4793  * The argument already_resolved_count is an output variable to track number
4794  * of already resolved multirt routes.
4795  *
4796  * This only works in the global zone.
4797  */
4798 boolean_t
4799 ire_multirt_lookup(ire_t **ire_arg, ire_t **fire_arg, uint32_t flags,
4800     int *already_resolved_count, const ts_label_t *tsl, ip_stack_t *ipst)
4801 {
4802 	clock_t	delta;
4803 	ire_t	*best_fire = NULL;
4804 	ire_t	*best_cire = NULL;
4805 	ire_t	*first_fire;
4806 	ire_t	*first_cire;
4807 	ire_t	*fire;
4808 	ire_t	*cire;
4809 	irb_t	*firb = NULL;
4810 	irb_t	*cirb = NULL;
4811 	ire_t	*gw_ire;
4812 	boolean_t	already_resolved;
4813 	boolean_t	res;
4814 	ipaddr_t	dst;
4815 	ipaddr_t	gw;
4816 
4817 	ip2dbg(("ire_multirt_lookup: *ire_arg %p, *fire_arg %p, flags %04x\n",
4818 	    (void *)*ire_arg, (void *)*fire_arg, flags));
4819 
4820 	ASSERT(ire_arg != NULL);
4821 	ASSERT(fire_arg != NULL);
4822 
4823 	/* Not an IRE_HOST ire; give up. */
4824 	if ((*fire_arg == NULL) || ((*fire_arg)->ire_type != IRE_HOST)) {
4825 		return (B_FALSE);
4826 	}
4827 
4828 	/* This is the first IRE_HOST ire for that destination. */
4829 	first_fire = *fire_arg;
4830 	firb = first_fire->ire_bucket;
4831 	ASSERT(firb != NULL);
4832 
4833 	dst = first_fire->ire_addr;
4834 
4835 	ip2dbg(("ire_multirt_lookup: dst %08x\n", ntohl(dst)));
4836 
4837 	/*
4838 	 * Retrieve the first IRE_CACHE ire for that destination;
4839 	 * if we don't find one, no route for that dest is
4840 	 * resolved yet.
4841 	 */
4842 	first_cire = ire_cache_lookup(dst, GLOBAL_ZONEID, tsl, ipst);
4843 	if (first_cire != NULL) {
4844 		cirb = first_cire->ire_bucket;
4845 	}
4846 
4847 	ip2dbg(("ire_multirt_lookup: first_cire %p\n", (void *)first_cire));
4848 
4849 	/*
4850 	 * Search for a resolvable route, giving the top priority
4851 	 * to routes that can be resolved without any call to the resolver.
4852 	 */
4853 	IRB_REFHOLD(firb);
4854 
4855 	if (!CLASSD(dst)) {
4856 		/*
4857 		 * For all multiroute IRE_HOST ires for that destination,
4858 		 * check if the route via the IRE_HOST's gateway is
4859 		 * resolved yet.
4860 		 */
4861 		for (fire = first_fire; fire != NULL; fire = fire->ire_next) {
4862 
4863 			if (!(fire->ire_flags & RTF_MULTIRT))
4864 				continue;
4865 			if (fire->ire_addr != dst)
4866 				continue;
4867 
4868 			if (fire->ire_gw_secattr != NULL &&
4869 			    tsol_ire_match_gwattr(fire, tsl) != 0) {
4870 				continue;
4871 			}
4872 
4873 			gw = fire->ire_gateway_addr;
4874 
4875 			ip2dbg(("ire_multirt_lookup: fire %p, "
4876 			    "ire_addr %08x, ire_gateway_addr %08x\n",
4877 			    (void *)fire, ntohl(fire->ire_addr), ntohl(gw)));
4878 
4879 			already_resolved = B_FALSE;
4880 
4881 			if (first_cire != NULL) {
4882 				ASSERT(cirb != NULL);
4883 
4884 				IRB_REFHOLD(cirb);
4885 				/*
4886 				 * For all IRE_CACHE ires for that
4887 				 * destination.
4888 				 */
4889 				for (cire = first_cire;
4890 				    cire != NULL;
4891 				    cire = cire->ire_next) {
4892 
4893 					if (!(cire->ire_flags & RTF_MULTIRT))
4894 						continue;
4895 					if (cire->ire_addr != dst)
4896 						continue;
4897 					if (cire->ire_marks &
4898 					    (IRE_MARK_CONDEMNED |
4899 					    IRE_MARK_TESTHIDDEN))
4900 						continue;
4901 
4902 					if (cire->ire_gw_secattr != NULL &&
4903 					    tsol_ire_match_gwattr(cire,
4904 					    tsl) != 0) {
4905 						continue;
4906 					}
4907 
4908 					/*
4909 					 * Check if the IRE_CACHE's gateway
4910 					 * matches the IRE_HOST's gateway.
4911 					 */
4912 					if (cire->ire_gateway_addr == gw) {
4913 						already_resolved = B_TRUE;
4914 						break;
4915 					}
4916 				}
4917 				IRB_REFRELE(cirb);
4918 			}
4919 
4920 			/*
4921 			 * This route is already resolved;
4922 			 * proceed with next one.
4923 			 */
4924 			if (already_resolved) {
4925 				ip2dbg(("ire_multirt_lookup: found cire %p, "
4926 				    "already resolved\n", (void *)cire));
4927 
4928 				if (already_resolved_count != NULL)
4929 					(*already_resolved_count)++;
4930 				continue;
4931 			}
4932 
4933 			/*
4934 			 * The route is unresolved; is it actually
4935 			 * resolvable, i.e. is there a cache or a resolver
4936 			 * for the gateway?
4937 			 */
4938 			gw_ire = ire_route_lookup(gw, 0, 0, 0, NULL, NULL,
4939 			    ALL_ZONES, tsl,
4940 			    MATCH_IRE_RECURSIVE | MATCH_IRE_SECATTR, ipst);
4941 
4942 			ip2dbg(("ire_multirt_lookup: looked up gw_ire %p\n",
4943 			    (void *)gw_ire));
4944 
4945 			/*
4946 			 * If gw_ire is typed IRE_CACHETABLE,
4947 			 * this route can be resolved without any call to the
4948 			 * resolver. If the MULTIRT_CACHEGW flag is set,
4949 			 * give the top priority to this ire and exit the
4950 			 * loop.
4951 			 * This is typically the case when an ARP reply
4952 			 * is processed through ip_wput_nondata().
4953 			 */
4954 			if ((flags & MULTIRT_CACHEGW) &&
4955 			    (gw_ire != NULL) &&
4956 			    (gw_ire->ire_type & IRE_CACHETABLE)) {
4957 				ASSERT(gw_ire->ire_nce == NULL ||
4958 				    gw_ire->ire_nce->nce_state == ND_REACHABLE);
4959 				/*
4960 				 * Release the resolver associated to the
4961 				 * previous candidate best ire, if any.
4962 				 */
4963 				if (best_cire != NULL) {
4964 					ire_refrele(best_cire);
4965 					ASSERT(best_fire != NULL);
4966 				}
4967 
4968 				best_fire = fire;
4969 				best_cire = gw_ire;
4970 
4971 				ip2dbg(("ire_multirt_lookup: found top prio "
4972 				    "best_fire %p, best_cire %p\n",
4973 				    (void *)best_fire, (void *)best_cire));
4974 				break;
4975 			}
4976 
4977 			/*
4978 			 * Compute the time elapsed since our preceding
4979 			 * attempt to  resolve that route.
4980 			 * If the MULTIRT_USESTAMP flag is set, we take that
4981 			 * route into account only if this time interval
4982 			 * exceeds ip_multirt_resolution_interval;
4983 			 * this prevents us from attempting to resolve a
4984 			 * broken route upon each sending of a packet.
4985 			 */
4986 			delta = lbolt - fire->ire_last_used_time;
4987 			delta = TICK_TO_MSEC(delta);
4988 
4989 			res = (boolean_t)((delta >
4990 			    ipst->ips_ip_multirt_resolution_interval) ||
4991 			    (!(flags & MULTIRT_USESTAMP)));
4992 
4993 			ip2dbg(("ire_multirt_lookup: fire %p, delta %lu, "
4994 			    "res %d\n",
4995 			    (void *)fire, delta, res));
4996 
4997 			if (res) {
4998 				/*
4999 				 * We are here if MULTIRT_USESTAMP flag is set
5000 				 * and the resolver for fire's gateway
5001 				 * has not been tried since
5002 				 * ip_multirt_resolution_interval, or if
5003 				 * MULTIRT_USESTAMP is not set but gw_ire did
5004 				 * not fill the conditions for MULTIRT_CACHEGW,
5005 				 * or if neither MULTIRT_USESTAMP nor
5006 				 * MULTIRT_CACHEGW are set.
5007 				 */
5008 				if (gw_ire != NULL) {
5009 					if (best_fire == NULL) {
5010 						ASSERT(best_cire == NULL);
5011 
5012 						best_fire = fire;
5013 						best_cire = gw_ire;
5014 
5015 						ip2dbg(("ire_multirt_lookup:"
5016 						    "found candidate "
5017 						    "best_fire %p, "
5018 						    "best_cire %p\n",
5019 						    (void *)best_fire,
5020 						    (void *)best_cire));
5021 
5022 						/*
5023 						 * If MULTIRT_CACHEGW is not
5024 						 * set, we ignore the top
5025 						 * priority ires that can
5026 						 * be resolved without any
5027 						 * call to the resolver;
5028 						 * In that case, there is
5029 						 * actually no need
5030 						 * to continue the loop.
5031 						 */
5032 						if (!(flags &
5033 						    MULTIRT_CACHEGW)) {
5034 							break;
5035 						}
5036 						continue;
5037 					}
5038 				} else {
5039 					/*
5040 					 * No resolver for the gateway: the
5041 					 * route is not resolvable.
5042 					 * If the MULTIRT_SETSTAMP flag is
5043 					 * set, we stamp the IRE_HOST ire,
5044 					 * so we will not select it again
5045 					 * during this resolution interval.
5046 					 */
5047 					if (flags & MULTIRT_SETSTAMP)
5048 						fire->ire_last_used_time =
5049 						    lbolt;
5050 				}
5051 			}
5052 
5053 			if (gw_ire != NULL)
5054 				ire_refrele(gw_ire);
5055 		}
5056 	} else { /* CLASSD(dst) */
5057 
5058 		for (fire = first_fire;
5059 		    fire != NULL;
5060 		    fire = fire->ire_next) {
5061 
5062 			if (!(fire->ire_flags & RTF_MULTIRT))
5063 				continue;
5064 			if (fire->ire_addr != dst)
5065 				continue;
5066 
5067 			if (fire->ire_gw_secattr != NULL &&
5068 			    tsol_ire_match_gwattr(fire, tsl) != 0) {
5069 				continue;
5070 			}
5071 
5072 			already_resolved = B_FALSE;
5073 
5074 			gw = fire->ire_gateway_addr;
5075 
5076 			gw_ire = ire_ftable_lookup(gw, 0, 0, IRE_INTERFACE,
5077 			    NULL, NULL, ALL_ZONES, 0, tsl,
5078 			    MATCH_IRE_RECURSIVE | MATCH_IRE_TYPE |
5079 			    MATCH_IRE_SECATTR, ipst);
5080 
5081 			/* No resolver for the gateway; we skip this ire. */
5082 			if (gw_ire == NULL) {
5083 				continue;
5084 			}
5085 			ASSERT(gw_ire->ire_nce == NULL ||
5086 			    gw_ire->ire_nce->nce_state == ND_REACHABLE);
5087 
5088 			if (first_cire != NULL) {
5089 
5090 				IRB_REFHOLD(cirb);
5091 				/*
5092 				 * For all IRE_CACHE ires for that
5093 				 * destination.
5094 				 */
5095 				for (cire = first_cire;
5096 				    cire != NULL;
5097 				    cire = cire->ire_next) {
5098 
5099 					if (!(cire->ire_flags & RTF_MULTIRT))
5100 						continue;
5101 					if (cire->ire_addr != dst)
5102 						continue;
5103 					if (cire->ire_marks &
5104 					    (IRE_MARK_CONDEMNED |
5105 					    IRE_MARK_TESTHIDDEN))
5106 						continue;
5107 
5108 					if (cire->ire_gw_secattr != NULL &&
5109 					    tsol_ire_match_gwattr(cire,
5110 					    tsl) != 0) {
5111 						continue;
5112 					}
5113 
5114 					/*
5115 					 * Cache entries are linked to the
5116 					 * parent routes using the parent handle
5117 					 * (ire_phandle). If no cache entry has
5118 					 * the same handle as fire, fire is
5119 					 * still unresolved.
5120 					 */
5121 					ASSERT(cire->ire_phandle != 0);
5122 					if (cire->ire_phandle ==
5123 					    fire->ire_phandle) {
5124 						already_resolved = B_TRUE;
5125 						break;
5126 					}
5127 				}
5128 				IRB_REFRELE(cirb);
5129 			}
5130 
5131 			/*
5132 			 * This route is already resolved; proceed with
5133 			 * next one.
5134 			 */
5135 			if (already_resolved) {
5136 				ire_refrele(gw_ire);
5137 				if (already_resolved_count != NULL)
5138 					(*already_resolved_count)++;
5139 				continue;
5140 			}
5141 
5142 			/*
5143 			 * Compute the time elapsed since our preceding
5144 			 * attempt to resolve that route.
5145 			 * If the MULTIRT_USESTAMP flag is set, we take
5146 			 * that route into account only if this time
5147 			 * interval exceeds ip_multirt_resolution_interval;
5148 			 * this prevents us from attempting to resolve a
5149 			 * broken route upon each sending of a packet.
5150 			 */
5151 			delta = lbolt - fire->ire_last_used_time;
5152 			delta = TICK_TO_MSEC(delta);
5153 
5154 			res = (boolean_t)((delta >
5155 			    ipst->ips_ip_multirt_resolution_interval) ||
5156 			    (!(flags & MULTIRT_USESTAMP)));
5157 
5158 			ip3dbg(("ire_multirt_lookup: fire %p, delta %lx, "
5159 			    "flags %04x, res %d\n",
5160 			    (void *)fire, delta, flags, res));
5161 
5162 			if (res) {
5163 				if (best_cire != NULL) {
5164 					/*
5165 					 * Release the resolver associated
5166 					 * to the preceding candidate best
5167 					 * ire, if any.
5168 					 */
5169 					ire_refrele(best_cire);
5170 					ASSERT(best_fire != NULL);
5171 				}
5172 				best_fire = fire;
5173 				best_cire = gw_ire;
5174 				continue;
5175 			}
5176 
5177 			ire_refrele(gw_ire);
5178 		}
5179 	}
5180 
5181 	if (best_fire != NULL) {
5182 		IRE_REFHOLD(best_fire);
5183 	}
5184 	IRB_REFRELE(firb);
5185 
5186 	/* Release the first IRE_CACHE we initially looked up, if any. */
5187 	if (first_cire != NULL)
5188 		ire_refrele(first_cire);
5189 
5190 	/* Found a resolvable route. */
5191 	if (best_fire != NULL) {
5192 		ASSERT(best_cire != NULL);
5193 
5194 		if (*fire_arg != NULL)
5195 			ire_refrele(*fire_arg);
5196 		if (*ire_arg != NULL)
5197 			ire_refrele(*ire_arg);
5198 
5199 		/*
5200 		 * Update the passed-in arguments with the
5201 		 * resolvable multirt route we found.
5202 		 */
5203 		*fire_arg = best_fire;
5204 		*ire_arg = best_cire;
5205 
5206 		ip2dbg(("ire_multirt_lookup: returning B_TRUE, "
5207 		    "*fire_arg %p, *ire_arg %p\n",
5208 		    (void *)best_fire, (void *)best_cire));
5209 
5210 		return (B_TRUE);
5211 	}
5212 
5213 	ASSERT(best_cire == NULL);
5214 
5215 	ip2dbg(("ire_multirt_lookup: returning B_FALSE, *fire_arg %p, "
5216 	    "*ire_arg %p\n",
5217 	    (void *)*fire_arg, (void *)*ire_arg));
5218 
5219 	/* No resolvable route. */
5220 	return (B_FALSE);
5221 }
5222 
5223 /*
5224  * IRE iterator for inbound and loopback broadcast processing.
5225  * Given an IRE_BROADCAST ire, walk the ires with the same destination
5226  * address, but skip over the passed-in ire. Returns the next ire without
5227  * a hold - assumes that the caller holds a reference on the IRE bucket.
5228  */
5229 ire_t *
5230 ire_get_next_bcast_ire(ire_t *curr, ire_t *ire)
5231 {
5232 	ill_t *ill;
5233 
5234 	if (curr == NULL) {
5235 		for (curr = ire->ire_bucket->irb_ire; curr != NULL;
5236 		    curr = curr->ire_next) {
5237 			if (curr->ire_addr == ire->ire_addr)
5238 				break;
5239 		}
5240 	} else {
5241 		curr = curr->ire_next;
5242 	}
5243 	ill = ire_to_ill(ire);
5244 	for (; curr != NULL; curr = curr->ire_next) {
5245 		if (curr->ire_addr != ire->ire_addr) {
5246 			/*
5247 			 * All the IREs to a given destination are contiguous;
5248 			 * break out once the address doesn't match.
5249 			 */
5250 			break;
5251 		}
5252 		if (curr == ire) {
5253 			/* skip over the passed-in ire */
5254 			continue;
5255 		}
5256 		if ((curr->ire_stq != NULL && ire->ire_stq == NULL) ||
5257 		    (curr->ire_stq == NULL && ire->ire_stq != NULL)) {
5258 			/*
5259 			 * If the passed-in ire is loopback, skip over
5260 			 * non-loopback ires and vice versa.
5261 			 */
5262 			continue;
5263 		}
5264 		if (ire_to_ill(curr) != ill) {
5265 			/* skip over IREs going through a different interface */
5266 			continue;
5267 		}
5268 		if (curr->ire_marks & IRE_MARK_CONDEMNED) {
5269 			/* skip over deleted IREs */
5270 			continue;
5271 		}
5272 		return (curr);
5273 	}
5274 	return (NULL);
5275 }
5276 
5277 #ifdef DEBUG
5278 void
5279 ire_trace_ref(ire_t *ire)
5280 {
5281 	mutex_enter(&ire->ire_lock);
5282 	if (ire->ire_trace_disable) {
5283 		mutex_exit(&ire->ire_lock);
5284 		return;
5285 	}
5286 
5287 	if (th_trace_ref(ire, ire->ire_ipst)) {
5288 		mutex_exit(&ire->ire_lock);
5289 	} else {
5290 		ire->ire_trace_disable = B_TRUE;
5291 		mutex_exit(&ire->ire_lock);
5292 		ire_trace_cleanup(ire);
5293 	}
5294 }
5295 
5296 void
5297 ire_untrace_ref(ire_t *ire)
5298 {
5299 	mutex_enter(&ire->ire_lock);
5300 	if (!ire->ire_trace_disable)
5301 		th_trace_unref(ire);
5302 	mutex_exit(&ire->ire_lock);
5303 }
5304 
5305 static void
5306 ire_trace_cleanup(const ire_t *ire)
5307 {
5308 	th_trace_cleanup(ire, ire->ire_trace_disable);
5309 }
5310 #endif /* DEBUG */
5311 
5312 /*
5313  * Generate a message chain with an arp request to resolve the in_ire.
5314  * It is assumed that in_ire itself is currently in the ire cache table,
5315  * so we create a fake_ire filled with enough information about ire_addr etc.
5316  * to retrieve in_ire when the DL_UNITDATA response from the resolver
5317  * comes back. The fake_ire itself is created by calling esballoc with
5318  * the fr_rtnp (free routine) set to ire_freemblk. This routine will be
5319  * invoked when the mblk containing fake_ire is freed.
5320  */
5321 void
5322 ire_arpresolve(ire_t *in_ire)
5323 {
5324 	areq_t		*areq;
5325 	ipaddr_t	*addrp;
5326 	mblk_t 		*ire_mp, *areq_mp;
5327 	ire_t 		*ire, *buf;
5328 	size_t		bufsize;
5329 	frtn_t		*frtnp;
5330 	ill_t		*dst_ill;
5331 	ip_stack_t	*ipst;
5332 
5333 	ASSERT(in_ire->ire_nce != NULL);
5334 
5335 	dst_ill = ire_to_ill(in_ire);
5336 	ipst = dst_ill->ill_ipst;
5337 
5338 	/*
5339 	 * Construct message chain for the resolver
5340 	 * of the form:
5341 	 *	ARP_REQ_MBLK-->IRE_MBLK
5342 	 *
5343 	 * NOTE : If the response does not
5344 	 * come back, ARP frees the packet. For this reason,
5345 	 * we can't REFHOLD the bucket of save_ire to prevent
5346 	 * deletions. We may not be able to REFRELE the bucket
5347 	 * if the response never comes back. Thus, before
5348 	 * adding the ire, ire_add_v4 will make sure that the
5349 	 * interface route does not get deleted. This is the
5350 	 * only case unlike ip_newroute_v6, ip_newroute_ipif_v6
5351 	 * where we can always prevent deletions because of
5352 	 * the synchronous nature of adding IRES i.e
5353 	 * ire_add_then_send is called after creating the IRE.
5354 	 */
5355 
5356 	/*
5357 	 * We use esballoc to allocate the second part (IRE_MBLK)
5358 	 * of the message chain depicted above.  This mblk will be freed
5359 	 * by arp when there is a timeout, and otherwise passed to IP
5360 	 * and IP will free it after processing the ARP response.
5361 	 */
5362 
5363 	bufsize = sizeof (ire_t) + sizeof (frtn_t);
5364 	buf = kmem_alloc(bufsize, KM_NOSLEEP);
5365 	if (buf == NULL) {
5366 		ip1dbg(("ire_arpresolve: alloc buffer failed\n"));
5367 		return;
5368 	}
5369 	frtnp = (frtn_t *)(buf + 1);
5370 	frtnp->free_arg = (caddr_t)buf;
5371 	frtnp->free_func = ire_freemblk;
5372 
5373 	ire_mp = esballoc((unsigned char *)buf, bufsize, BPRI_MED, frtnp);
5374 	if (ire_mp == NULL) {
5375 		ip1dbg(("ire_arpresolve: esballoc failed\n"));
5376 		kmem_free(buf, bufsize);
5377 		return;
5378 	}
5379 
5380 	areq_mp = copyb(dst_ill->ill_resolver_mp);
5381 	if (areq_mp == NULL) {
5382 		freemsg(ire_mp);
5383 		return;
5384 	}
5385 
5386 	ire_mp->b_datap->db_type = IRE_ARPRESOLVE_TYPE;
5387 	ire = (ire_t *)buf;
5388 	/*
5389 	 * keep enough info in the fake ire so that we can pull up
5390 	 * the incomplete ire (in_ire) after result comes back from
5391 	 * arp and make it complete.
5392 	 */
5393 	*ire = ire_null;
5394 	ire->ire_u = in_ire->ire_u;
5395 	ire->ire_ipif_seqid = in_ire->ire_ipif_seqid;
5396 	ire->ire_ipif_ifindex = in_ire->ire_ipif_ifindex;
5397 	ire->ire_ipif = in_ire->ire_ipif;
5398 	ire->ire_stq = dst_ill->ill_wq;
5399 	ire->ire_stq_ifindex = dst_ill->ill_phyint->phyint_ifindex;
5400 	ire->ire_zoneid = in_ire->ire_zoneid;
5401 	ire->ire_stackid = ipst->ips_netstack->netstack_stackid;
5402 	ire->ire_ipst = ipst;
5403 
5404 	/*
5405 	 * ire_freemblk will be called when ire_mp is freed, both for
5406 	 * successful and failed arp resolution. IRE_MARK_UNCACHED will be set
5407 	 * when the arp resolution failed.
5408 	 */
5409 	ire->ire_marks |= IRE_MARK_UNCACHED;
5410 	ire->ire_mp = ire_mp;
5411 	ire_mp->b_wptr = (uchar_t *)&ire[1];
5412 	ire_mp->b_cont = NULL;
5413 	linkb(areq_mp, ire_mp);
5414 
5415 	/*
5416 	 * Fill in the source and dest addrs for the resolver.
5417 	 * NOTE: this depends on memory layouts imposed by
5418 	 * ill_init().
5419 	 */
5420 	areq = (areq_t *)areq_mp->b_rptr;
5421 	addrp = (ipaddr_t *)((char *)areq + areq->areq_sender_addr_offset);
5422 	*addrp = ire->ire_src_addr;
5423 
5424 	addrp = (ipaddr_t *)((char *)areq + areq->areq_target_addr_offset);
5425 	if (ire->ire_gateway_addr != INADDR_ANY) {
5426 		*addrp = ire->ire_gateway_addr;
5427 	} else {
5428 		*addrp = ire->ire_addr;
5429 	}
5430 
5431 	/* Up to the resolver. */
5432 	if (canputnext(dst_ill->ill_rq)) {
5433 		putnext(dst_ill->ill_rq, areq_mp);
5434 	} else {
5435 		freemsg(areq_mp);
5436 	}
5437 }
5438 
5439 /*
5440  * Esballoc free function for AR_ENTRY_QUERY request to clean up any
5441  * unresolved ire_t and/or nce_t structures when ARP resolution fails.
5442  *
5443  * This function can be called by ARP via free routine for ire_mp or
5444  * by IPv4(both host and forwarding path) via ire_delete
5445  * in case ARP resolution fails.
5446  * NOTE: Since IP is MT, ARP can call into IP but not vice versa
5447  * (for IP to talk to ARP, it still has to send AR* messages).
5448  *
5449  * Note that the ARP/IP merge should replace the functioanlity by providing
5450  * direct function calls to clean up unresolved entries in ire/nce lists.
5451  */
5452 void
5453 ire_freemblk(ire_t *ire_mp)
5454 {
5455 	nce_t		*nce = NULL;
5456 	ill_t		*ill;
5457 	ip_stack_t	*ipst;
5458 	netstack_t	*ns = NULL;
5459 
5460 	ASSERT(ire_mp != NULL);
5461 
5462 	if ((ire_mp->ire_addr == NULL) && (ire_mp->ire_gateway_addr == NULL)) {
5463 		ip1dbg(("ire_freemblk(0x%p) ire_addr is NULL\n",
5464 		    (void *)ire_mp));
5465 		goto cleanup;
5466 	}
5467 	if ((ire_mp->ire_marks & IRE_MARK_UNCACHED) == 0) {
5468 		goto cleanup; /* everything succeeded. just free and return */
5469 	}
5470 
5471 	/*
5472 	 * the arp information corresponding to this ire_mp was not
5473 	 * transferred to an ire_cache entry. Need
5474 	 * to clean up incomplete ire's and nce, if necessary.
5475 	 */
5476 	ASSERT(ire_mp->ire_stq != NULL);
5477 	ASSERT(ire_mp->ire_stq_ifindex != 0);
5478 	ASSERT(ire_mp->ire_ipst != NULL);
5479 
5480 	ns = netstack_find_by_stackid(ire_mp->ire_stackid);
5481 	ipst = (ns ? ns->netstack_ip : NULL);
5482 	if (ipst == NULL || ipst != ire_mp->ire_ipst) /* Disapeared on us */
5483 		goto  cleanup;
5484 
5485 	/*
5486 	 * Get any nce's corresponding to this ire_mp. We first have to
5487 	 * make sure that the ill is still around.
5488 	 */
5489 	ill = ill_lookup_on_ifindex(ire_mp->ire_stq_ifindex,
5490 	    B_FALSE, NULL, NULL, NULL, NULL, ipst);
5491 	if (ill == NULL || (ire_mp->ire_stq != ill->ill_wq) ||
5492 	    (ill->ill_state_flags & ILL_CONDEMNED)) {
5493 		/*
5494 		 * ill went away. no nce to clean up.
5495 		 * Note that the ill_state_flags could be set to
5496 		 * ILL_CONDEMNED after this point, but if we know
5497 		 * that it is CONDEMNED now, we just bail out quickly.
5498 		 */
5499 		if (ill != NULL)
5500 			ill_refrele(ill);
5501 		goto cleanup;
5502 	}
5503 	nce = ndp_lookup_v4(ill,
5504 	    ((ire_mp->ire_gateway_addr != INADDR_ANY) ?
5505 	    &ire_mp->ire_gateway_addr : &ire_mp->ire_addr),
5506 	    B_FALSE);
5507 	ill_refrele(ill);
5508 
5509 	if ((nce != NULL) && (nce->nce_state != ND_REACHABLE)) {
5510 		/*
5511 		 * some incomplete nce was found.
5512 		 */
5513 		DTRACE_PROBE2(ire__freemblk__arp__resolv__fail,
5514 		    nce_t *, nce, ire_t *, ire_mp);
5515 		/*
5516 		 * Send the icmp_unreachable messages for the queued mblks in
5517 		 * ire->ire_nce->nce_qd_mp, since ARP resolution failed
5518 		 * for this ire
5519 		 */
5520 		arp_resolv_failed(nce);
5521 		/*
5522 		 * Delete the nce and clean up all ire's pointing at this nce
5523 		 * in the cachetable
5524 		 */
5525 		ndp_delete(nce);
5526 	}
5527 	if (nce != NULL)
5528 		NCE_REFRELE(nce); /* release the ref taken by ndp_lookup_v4 */
5529 
5530 cleanup:
5531 	if (ns != NULL)
5532 		netstack_rele(ns);
5533 	/*
5534 	 * Get rid of the ire buffer
5535 	 * We call kmem_free here(instead of ire_delete()), since
5536 	 * this is the freeb's callback.
5537 	 */
5538 	kmem_free(ire_mp, sizeof (ire_t) + sizeof (frtn_t));
5539 }
5540 
5541 /*
5542  * find, or create if needed, a neighbor cache entry nce_t for IRE_CACHE and
5543  * non-loopback IRE_BROADCAST ire's.
5544  *
5545  * If a neighbor-cache entry has to be created (i.e., one does not already
5546  * exist in the nce list) the nce_res_mp and nce_state of the neighbor cache
5547  * entry are initialized in ndp_add_v4(). These values are picked from
5548  * the src_nce, if one is passed in. Otherwise (if src_nce == NULL) the
5549  * ire->ire_type and the outgoing interface (ire_to_ill(ire)) values
5550  * determine the {nce_state, nce_res_mp} of the nce_t created. All
5551  * IRE_BROADCAST entries have nce_state = ND_REACHABLE, and the nce_res_mp
5552  * is set to the ill_bcast_mp of the outgoing inerface. For unicast ire
5553  * entries,
5554  *   - if the outgoing interface is of type IRE_IF_RESOLVER, a newly created
5555  *     nce_t will have a null nce_res_mp, and will be in the ND_INITIAL state.
5556  *   - if the outgoing interface is a IRE_IF_NORESOLVER interface, no link
5557  *     layer resolution is necessary, so that the nce_t will be in the
5558  *     ND_REACHABLE state and the nce_res_mp will have a copy of the
5559  *     ill_resolver_mp of the outgoing interface.
5560  *
5561  * The link layer information needed for broadcast addresses, and for
5562  * packets sent on IRE_IF_NORESOLVER interfaces is a constant mapping that
5563  * never needs re-verification for the lifetime of the nce_t. These are
5564  * therefore marked NCE_F_PERMANENT, and never allowed to expire via
5565  * NCE_EXPIRED.
5566  *
5567  * IRE_CACHE ire's contain the information for  the nexthop (ire_gateway_addr)
5568  * in the case of indirect routes, and for the dst itself (ire_addr) in the
5569  * case of direct routes, with the nce_res_mp containing a template
5570  * DL_UNITDATA request.
5571  *
5572  * The actual association of the ire_nce to the nce created here is
5573  * typically done in ire_add_v4 for IRE_CACHE entries. Exceptions
5574  * to this rule are SO_DONTROUTE ire's (IRE_MARK_NO_ADD), for which
5575  * the ire_nce assignment is done in ire_add_then_send.
5576  */
5577 int
5578 ire_nce_init(ire_t *ire, nce_t *src_nce)
5579 {
5580 	in_addr_t	addr4;
5581 	int		err;
5582 	nce_t		*nce = NULL;
5583 	ill_t		*ire_ill;
5584 	uint16_t	nce_flags = 0;
5585 	ip_stack_t	*ipst;
5586 
5587 	if (ire->ire_stq == NULL)
5588 		return (0); /* no need to create nce for local/loopback */
5589 
5590 	switch (ire->ire_type) {
5591 	case IRE_CACHE:
5592 		if (ire->ire_gateway_addr != INADDR_ANY)
5593 			addr4 = ire->ire_gateway_addr; /* 'G' route */
5594 		else
5595 			addr4 = ire->ire_addr; /* direct route */
5596 		break;
5597 	case IRE_BROADCAST:
5598 		addr4 = ire->ire_addr;
5599 		nce_flags |= (NCE_F_PERMANENT|NCE_F_BCAST);
5600 		break;
5601 	default:
5602 		return (0);
5603 	}
5604 
5605 	/*
5606 	 * ire_ipif is picked based on RTF_SETSRC, usesrc etc.
5607 	 * rules in ire_forward_src_ipif. We want the dlureq_mp
5608 	 * for the outgoing interface, which we get from the ire_stq.
5609 	 */
5610 	ire_ill = ire_to_ill(ire);
5611 	ipst = ire_ill->ill_ipst;
5612 
5613 	/*
5614 	 * IRE_IF_NORESOLVER entries never need re-verification and
5615 	 * do not expire, so we mark them as NCE_F_PERMANENT.
5616 	 */
5617 	if (ire_ill->ill_net_type == IRE_IF_NORESOLVER)
5618 		nce_flags |= NCE_F_PERMANENT;
5619 
5620 retry_nce:
5621 	err = ndp_lookup_then_add_v4(ire_ill, &addr4, nce_flags,
5622 	    &nce, src_nce);
5623 
5624 	if (err == EEXIST && NCE_EXPIRED(nce, ipst)) {
5625 		/*
5626 		 * We looked up an expired nce.
5627 		 * Go back and try to create one again.
5628 		 */
5629 		ndp_delete(nce);
5630 		NCE_REFRELE(nce);
5631 		nce = NULL;
5632 		goto retry_nce;
5633 	}
5634 
5635 	ip1dbg(("ire 0x%p addr 0x%lx type 0x%x; found nce 0x%p err %d\n",
5636 	    (void *)ire, (ulong_t)addr4, ire->ire_type, (void *)nce, err));
5637 
5638 	switch (err) {
5639 	case 0:
5640 	case EEXIST:
5641 		/*
5642 		 * return a pointer to a newly created or existing nce_t;
5643 		 * note that the ire-nce mapping is many-one, i.e.,
5644 		 * multiple ire's could point to the same nce_t.
5645 		 */
5646 		break;
5647 	default:
5648 		DTRACE_PROBE2(nce__init__fail, ill_t *, ire_ill, int, err);
5649 		return (EINVAL);
5650 	}
5651 	/*
5652 	 * IRE_BROADCAST ire's must be linked to NCE_F_BCAST nce's and
5653 	 * vice-versa (IRE_CACHE <-> unicast nce entries). We may have found an
5654 	 * existing unicast (or bcast) nce when trying to add a BROADCAST (or
5655 	 * unicast) ire, e.g., when address/netmask modifications were in
5656 	 * progress, and the ipif_ndp_down() call to quiesce existing state
5657 	 * during the addr/mask modification may have skipped the ndp_delete()
5658 	 * because the ipif being affected was not the last one on the ill.  We
5659 	 * recover from the missed ndp_delete() now, by deleting the old nce and
5660 	 * adding a new one with the correct NCE_F_BCAST state.
5661 	 */
5662 	if (ire->ire_type == IRE_BROADCAST) {
5663 		if ((nce->nce_flags & NCE_F_BCAST) == 0) {
5664 			/* IRE_BROADCAST needs NCE_F_BCAST */
5665 			ndp_delete(nce);
5666 			NCE_REFRELE(nce);
5667 			goto retry_nce;
5668 		}
5669 		/*
5670 		 * Two bcast ires are created for each interface;
5671 		 * 1. loopback copy (which does not  have an
5672 		 *    ire_stq, and therefore has no ire_nce), and,
5673 		 * 2. the non-loopback copy, which has the nce_res_mp
5674 		 *    initialized to a copy of the ill_bcast_mp, and
5675 		 *    is marked as ND_REACHABLE at this point.
5676 		 *    This nce does not undergo any further state changes,
5677 		 *    and exists as long as the interface is plumbed.
5678 		 * Note: the assignment of ire_nce here is a historical
5679 		 * artifact of old code that used to inline ire_add().
5680 		 */
5681 		ire->ire_nce = nce;
5682 		/*
5683 		 * We are associating this nce to the ire,
5684 		 * so change the nce ref taken in
5685 		 * ndp_lookup_then_add_v4() from
5686 		 * NCE_REFHOLD to NCE_REFHOLD_NOTR
5687 		 */
5688 		NCE_REFHOLD_TO_REFHOLD_NOTR(ire->ire_nce);
5689 	} else {
5690 		if ((nce->nce_flags & NCE_F_BCAST) != 0) {
5691 			/* IRE_CACHE needs unicast nce */
5692 			ndp_delete(nce);
5693 			NCE_REFRELE(nce);
5694 			goto retry_nce;
5695 		}
5696 		/*
5697 		 * We are not using this nce_t just yet so release
5698 		 * the ref taken in ndp_lookup_then_add_v4()
5699 		 */
5700 		NCE_REFRELE(nce);
5701 	}
5702 	return (0);
5703 }
5704 
5705 /*
5706  * This is the implementation of the IPv4 IRE cache lookup procedure.
5707  * Separating the interface from the implementation allows additional
5708  * flexibility when specifying search criteria.
5709  */
5710 static ire_t *
5711 ip4_ctable_lookup_impl(ire_ctable_args_t *margs)
5712 {
5713 	irb_t			*irb_ptr;
5714 	ire_t			*ire;
5715 	ip_stack_t		*ipst = margs->ict_ipst;
5716 
5717 	if ((margs->ict_flags & (MATCH_IRE_SRC | MATCH_IRE_ILL)) &&
5718 	    (margs->ict_ipif == NULL)) {
5719 		return (NULL);
5720 	}
5721 
5722 	irb_ptr = &ipst->ips_ip_cache_table[IRE_ADDR_HASH(
5723 	    *((ipaddr_t *)margs->ict_addr), ipst->ips_ip_cache_table_size)];
5724 	rw_enter(&irb_ptr->irb_lock, RW_READER);
5725 	for (ire = irb_ptr->irb_ire; ire != NULL; ire = ire->ire_next) {
5726 		if (ire->ire_marks & IRE_MARK_CONDEMNED)
5727 			continue;
5728 		ASSERT(ire->ire_mask == IP_HOST_MASK);
5729 		if (ire_match_args(ire, *((ipaddr_t *)margs->ict_addr),
5730 		    ire->ire_mask, *((ipaddr_t *)margs->ict_gateway),
5731 		    margs->ict_type, margs->ict_ipif, margs->ict_zoneid, 0,
5732 		    margs->ict_tsl, margs->ict_flags, margs->ict_wq)) {
5733 			IRE_REFHOLD(ire);
5734 			rw_exit(&irb_ptr->irb_lock);
5735 			return (ire);
5736 		}
5737 	}
5738 
5739 	rw_exit(&irb_ptr->irb_lock);
5740 	return (NULL);
5741 }
5742 
5743 /*
5744  * This function locates IRE_CACHE entries which were added by the
5745  * ire_forward() path. We can fully specify the IRE we are looking for by
5746  * providing the ipif (MATCH_IRE_IPIF) *and* the stq (MATCH_IRE_WQ).
5747  */
5748 ire_t *
5749 ire_arpresolve_lookup(ipaddr_t addr, ipaddr_t gw, ipif_t *ipif,
5750     zoneid_t zoneid, ip_stack_t *ipst, queue_t *wq)
5751 {
5752 	ire_ctable_args_t	margs;
5753 
5754 	margs.ict_addr = &addr;
5755 	margs.ict_gateway = &gw;
5756 	margs.ict_type = IRE_CACHE;
5757 	margs.ict_ipif = ipif;
5758 	margs.ict_zoneid = zoneid;
5759 	margs.ict_tsl = NULL;
5760 	margs.ict_flags = MATCH_IRE_GW | MATCH_IRE_IPIF | MATCH_IRE_ZONEONLY |
5761 	    MATCH_IRE_TYPE | MATCH_IRE_WQ;
5762 	margs.ict_ipst = ipst;
5763 	margs.ict_wq = wq;
5764 
5765 	return (ip4_ctable_lookup_impl(&margs));
5766 }
5767