xref: /titanic_50/usr/src/uts/common/inet/ip/ip_ire.c (revision c2e7b48d563d0e56b74d853118918af352e75cbb)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License, Version 1.0 only
6  * (the "License").  You may not use this file except in compliance
7  * with the License.
8  *
9  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
10  * or http://www.opensolaris.org/os/licensing.
11  * See the License for the specific language governing permissions
12  * and limitations under the License.
13  *
14  * When distributing Covered Code, include this CDDL HEADER in each
15  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
16  * If applicable, add the following below this CDDL HEADER, with the
17  * fields enclosed by brackets "[]" replaced with your own identifying
18  * information: Portions Copyright [yyyy] [name of copyright owner]
19  *
20  * CDDL HEADER END
21  */
22 /*
23  * Copyright 2005 Sun Microsystems, Inc.  All rights reserved.
24  * Use is subject to license terms.
25  */
26 /* Copyright (c) 1990 Mentat Inc. */
27 
28 #pragma ident	"%Z%%M%	%I%	%E% SMI"
29 
30 
31 /*
32  * This file contains routines that manipulate Internet Routing Entries (IREs).
33  */
34 
35 #include <sys/types.h>
36 #include <sys/stream.h>
37 #include <sys/stropts.h>
38 #include <sys/strlog.h>
39 #include <sys/dlpi.h>
40 #include <sys/ddi.h>
41 #include <sys/cmn_err.h>
42 #include <sys/policy.h>
43 
44 #include <sys/systm.h>
45 #include <sys/kmem.h>
46 #include <sys/param.h>
47 #include <sys/socket.h>
48 #include <net/if.h>
49 #include <net/route.h>
50 #include <netinet/in.h>
51 #include <net/if_dl.h>
52 #include <netinet/ip6.h>
53 #include <netinet/icmp6.h>
54 
55 #include <inet/common.h>
56 #include <inet/mi.h>
57 #include <inet/ip.h>
58 #include <inet/ip6.h>
59 #include <inet/ip_ndp.h>
60 #include <inet/arp.h>
61 #include <inet/ip_if.h>
62 #include <inet/ip_ire.h>
63 #include <inet/ip_rts.h>
64 #include <inet/nd.h>
65 
66 #include <net/pfkeyv2.h>
67 #include <inet/ipsec_info.h>
68 #include <inet/sadb.h>
69 #include <sys/kmem.h>
70 #include <inet/tcp.h>
71 #include <inet/ipclassifier.h>
72 #include <sys/zone.h>
73 
74 /*
75  * Synchronization notes:
76  *
77  * The fields of the ire_t struct are protected in the following way :
78  *
79  * ire_next/ire_ptpn
80  *
81  *	- bucket lock of the respective tables (cache or forwarding tables).
82  *
83  * ire_fp_mp
84  * ire_dlureq_mp
85  *
86  *	- ire_lock protects multiple threads updating ire_fp_mp
87  *	  simultaneously. Otherwise no locks are used while accessing
88  *	  (both read/write) both the fields.
89  *
90  * ire_mp, ire_rfq, ire_stq, ire_u *except* ire_gateway_addr[v6], ire_mask,
91  * ire_type, ire_create_time, ire_masklen, ire_ipversion, ire_flags, ire_ipif,
92  * ire_ihandle, ire_phandle, ire_nce, ire_bucket, ire_in_ill, ire_in_src_addr
93  *
94  *	- Set in ire_create_v4/v6 and never changes after that. Thus,
95  *	  we don't need a lock whenever these fields are accessed.
96  *
97  *	- ire_bucket and ire_masklen (also set in ire_create) is set in
98  *        ire_add_v4/ire_add_v6 before inserting in the bucket and never
99  *        changes after that. Thus we don't need a lock whenever these
100  *	  fields are accessed.
101  *
102  * ire_gateway_addr_v4[v6]
103  *
104  *	- ire_gateway_addr_v4[v6] is set during ire_create and later modified
105  *	  by rts_setgwr[v6]. As ire_gateway_addr is a uint32_t, updates to
106  *	  it assumed to be atomic and hence the other parts of the code
107  *	  does not use any locks. ire_gateway_addr_v6 updates are not atomic
108  *	  and hence any access to it uses ire_lock to get/set the right value.
109  *
110  * ire_ident, ire_refcnt
111  *
112  *	- Updated atomically using atomic_add_32
113  *
114  * ire_ssthresh, ire_rtt_sd, ire_rtt, ire_ib_pkt_count, ire_ob_pkt_count
115  *
116  *	- Assumes that 32 bit writes are atomic. No locks. ire_lock is
117  *	  used to serialize updates to ire_ssthresh, ire_rtt_sd, ire_rtt.
118  *
119  * ire_max_frag, ire_frag_flag
120  *
121  *	- ire_lock is used to set/read both of them together.
122  *
123  * ire_tire_mark
124  *
125  *	- Set in ire_create and updated in ire_expire, which is called
126  *	  by only one function namely ip_trash_timer_expire. Thus only
127  *	  one function updates and examines the value.
128  *
129  * ire_marks
130  *	- bucket lock protects this.
131  *
132  * ire_ipsec_overhead/ire_ll_hdr_length
133  *
134  *	- Place holder for returning the information to the upper layers
135  *	  when IRE_DB_REQ comes down.
136  *
137  * ip_ire_default_count protected by the bucket lock of
138  * ip_forwarding_table[0][0].
139  *
140  * ipv6_ire_default_count is protected by the bucket lock of
141  * ip_forwarding_table_v6[0][0].
142  *
143  * ip_ire_default_index/ipv6_ire_default_index is not protected as it
144  * is just a hint at which default gateway to use. There is nothing
145  * wrong in using the same gateway for two different connections.
146  *
147  * As we always hold the bucket locks in all the places while accessing
148  * the above values, it is natural to use them for protecting them.
149  *
150  * We have a separate cache table and forwarding table for IPv4 and IPv6.
151  * Cache table (ip_cache_table/ip_cache_table_v6) is a pointer to an
152  * array of irb_t structure and forwarding table (ip_forwarding_table/
153  * ip_forwarding_table_v6) is an array of pointers to array of irb_t
154  * structure. ip_forwarding_table[_v6] is allocated dynamically in
155  * ire_add_v4/v6. ire_ft_init_lock is used to serialize multiple threads
156  * initializing the same bucket. Once a bucket is initialized, it is never
157  * de-alloacted. This assumption enables us to access ip_forwarding_table[i]
158  * or ip_forwarding_table_v6[i] without any locks.
159  *
160  * Each irb_t - ire bucket structure has a lock to protect
161  * a bucket and the ires residing in the bucket have a back pointer to
162  * the bucket structure. It also has a reference count for the number
163  * of threads walking the bucket - irb_refcnt which is bumped up
164  * using the macro IRB_REFHOLD macro. The flags irb_flags can be
165  * set to IRE_MARK_CONDEMNED indicating that there are some ires
166  * in this bucket that are marked with IRE_MARK_CONDEMNED and the
167  * last thread to leave the bucket should delete the ires. Usually
168  * this is done by the IRB_REFRELE macro which is used to decrement
169  * the reference count on a bucket.
170  *
171  * IRE_REFHOLD/IRE_REFRELE macros operate on the ire which increments/
172  * decrements the reference count, ire_refcnt, atomically on the ire.
173  * ire_refcnt is modified only using this macro. Operations on the IRE
174  * could be described as follows :
175  *
176  * CREATE an ire with reference count initialized to 1.
177  *
178  * ADDITION of an ire holds the bucket lock, checks for duplicates
179  * and then adds the ire. ire_add_v4/ire_add_v6 returns the ire after
180  * bumping up once more i.e the reference count is 2. This is to avoid
181  * an extra lookup in the functions calling ire_add which wants to
182  * work with the ire after adding.
183  *
184  * LOOKUP of an ire bumps up the reference count using IRE_REFHOLD
185  * macro. It is valid to bump up the referece count of the IRE,
186  * after the lookup has returned an ire. Following are the lookup
187  * functions that return an HELD ire :
188  *
189  * ire_lookup_local[_v6], ire_ctable_lookup[_v6], ire_ftable_lookup[_v6],
190  * ire_cache_lookup[_v6], ire_lookup_multi[_v6], ire_route_lookup[_v6],
191  * ipif_to_ire[_v6], ire_mrtun_lookup, ire_srcif_table_lookup.
192  *
193  * DELETION of an ire holds the bucket lock, removes it from the list
194  * and then decrements the reference count for having removed from the list
195  * by using the IRE_REFRELE macro. If some other thread has looked up
196  * the ire, the reference count would have been bumped up and hence
197  * this ire will not be freed once deleted. It will be freed once the
198  * reference count drops to zero.
199  *
200  * Add and Delete acquires the bucket lock as RW_WRITER, while all the
201  * lookups acquire the bucket lock as RW_READER.
202  *
203  * NOTE : The only functions that does the IRE_REFRELE when an ire is
204  *	  passed as an argument are :
205  *
206  *	  1) ip_wput_ire : This is because it IRE_REFHOLD/RELEs the
207  *			   broadcast ires it looks up internally within
208  *			   the function. Currently, for simplicity it does
209  *			   not differentiate the one that is passed in and
210  *			   the ones it looks up internally. It always
211  *			   IRE_REFRELEs.
212  *	  2) ire_send
213  *	     ire_send_v6 : As ire_send calls ip_wput_ire and other functions
214  *			   that take ire as an argument, it has to selectively
215  *			   IRE_REFRELE the ire. To maintain symmetry,
216  *			   ire_send_v6 does the same.
217  *
218  * Otherwise, the general rule is to do the IRE_REFRELE in the function
219  * that is passing the ire as an argument.
220  *
221  * In trying to locate ires the following points are to be noted.
222  *
223  * IRE_MARK_CONDEMNED signifies that the ire has been logically deleted and is
224  * to be ignored when walking the ires using ire_next.
225  *
226  * IRE_MARK_HIDDEN signifies that the ire is a special ire typically for the
227  * benefit of in.mpathd which needs to probe interfaces for failures. Normal
228  * applications should not be seeing this ire and hence this ire is ignored
229  * in most cases in the search using ire_next.
230  *
231  * Zones note:
232  *	Walking IREs within a given zone also walks certain ires in other
233  *	zones.  This is done intentionally.  IRE walks with a specified
234  *	zoneid are used only when doing informational reports, and
235  *	zone users want to see things that they can access. See block
236  *	comment in ire_walk_ill_match().
237  */
238 
239 static irb_t *ip_forwarding_table[IP_MASK_TABLE_SIZE];
240 /* This is dynamically allocated in ip_ire_init */
241 static irb_t *ip_cache_table;
242 /* This is dynamically allocated in ire_add_mrtun */
243 irb_t	*ip_mrtun_table;
244 
245 uint32_t	ire_handle = 1;
246 /*
247  * ire_ft_init_lock is used while initializing ip_forwarding_table
248  * dynamically in ire_add.
249  */
250 kmutex_t	ire_ft_init_lock;
251 kmutex_t	ire_mrtun_lock;  /* Protects creation of table and it's count */
252 kmutex_t	ire_srcif_table_lock; /* Same as above */
253 /*
254  * The following counts are used to determine whether a walk is
255  * needed through the reverse tunnel table or through ills
256  */
257 kmutex_t ire_handle_lock;	/* Protects ire_handle */
258 uint_t	ire_mrtun_count;	/* Number of ires in reverse tun table */
259 
260 /*
261  * A per-interface routing table is created ( if not present)
262  * when the first entry is added to this special routing table.
263  * This special routing table is accessed through the ill data structure.
264  * The routing table looks like cache table. For example, currently it
265  * is used by mobile-ip foreign agent to forward data that only comes from
266  * the home agent tunnel for a mobile node. Thus if the outgoing interface
267  * is a RESOLVER interface, IP may need to resolve the hardware address for
268  * the outgoing interface. The routing entries in this table are not updated
269  * in IRE_CACHE. When MCTL msg comes back from ARP, the incoming ill informa-
270  * tion is lost as the write queue is passed to ip_wput.
271  * But, before sending the packet out, the hardware information must be updated
272  * in the special forwarding table. ire_srcif_table_count keeps track of total
273  * number of ires that are in interface based tables. Each interface based
274  * table hangs off of the incoming ill and each ill_t also keeps a refcnt
275  * of ires in that table.
276  */
277 
278 uint_t	ire_srcif_table_count; /* Number of ires in all srcif tables */
279 
280 /*
281  * The minimum size of IRE cache table.  It will be recalcuated in
282  * ip_ire_init().
283  */
284 uint32_t ip_cache_table_size = IP_CACHE_TABLE_SIZE;
285 uint32_t ip6_cache_table_size = IP6_CACHE_TABLE_SIZE;
286 
287 /*
288  * The size of the forwarding table.  We will make sure that it is a
289  * power of 2 in ip_ire_init().
290  */
291 uint32_t ip_ftable_hash_size = IP_FTABLE_HASH_SIZE;
292 uint32_t ip6_ftable_hash_size = IP6_FTABLE_HASH_SIZE;
293 
294 struct	kmem_cache	*ire_cache;
295 static ire_t	ire_null;
296 
297 ire_stats_t ire_stats_v4;	/* IPv4 ire statistics */
298 ire_stats_t ire_stats_v6;	/* IPv6 ire statistics */
299 
300 /*
301  * The threshold number of IRE in a bucket when the IREs are
302  * cleaned up.  This threshold is calculated later in ip_open()
303  * based on the speed of CPU and available memory.  This default
304  * value is the maximum.
305  *
306  * We have two kinds of cached IRE, temporary and
307  * non-temporary.  Temporary IREs are marked with
308  * IRE_MARK_TEMPORARY.  They are IREs created for non
309  * TCP traffic and for forwarding purposes.  All others
310  * are non-temporary IREs.  We don't mark IRE created for
311  * TCP as temporary because TCP is stateful and there are
312  * info stored in the IRE which can be shared by other TCP
313  * connections to the same destination.  For connected
314  * endpoint, we also don't want to mark the IRE used as
315  * temporary because the same IRE will be used frequently,
316  * otherwise, the app should not do a connect().  We change
317  * the marking at ip_bind_connected_*() if necessary.
318  *
319  * We want to keep the cache IRE hash bucket length reasonably
320  * short, otherwise IRE lookup functions will take "forever."
321  * We use the "crude" function that the IRE bucket
322  * length should be based on the CPU speed, which is 1 entry
323  * per x MHz, depending on the shift factor ip_ire_cpu_ratio
324  * (n).  This means that with a 750MHz CPU, the max bucket
325  * length can be (750 >> n) entries.
326  *
327  * Note that this threshold is separate for temp and non-temp
328  * IREs.  This means that the actual bucket length can be
329  * twice as that.  And while we try to keep temporary IRE
330  * length at most at the threshold value, we do not attempt to
331  * make the length for non-temporary IREs fixed, for the
332  * reason stated above.  Instead, we start trying to find
333  * "unused" non-temporary IREs when the bucket length reaches
334  * this threshold and clean them up.
335  *
336  * We also want to limit the amount of memory used by
337  * IREs.  So if we are allowed to use ~3% of memory (M)
338  * for those IREs, each bucket should not have more than
339  *
340  * 	M / num of cache bucket / sizeof (ire_t)
341  *
342  * Again the above memory uses are separate for temp and
343  * non-temp cached IREs.
344  *
345  * We may also want the limit to be a function of the number
346  * of interfaces and number of CPUs.  Doing the initialization
347  * in ip_open() means that every time an interface is plumbed,
348  * the max is re-calculated.  Right now, we don't do anything
349  * different.  In future, when we have more experience, we
350  * may want to change this behavior.
351  */
352 uint32_t ip_ire_max_bucket_cnt = 10;
353 uint32_t ip6_ire_max_bucket_cnt = 10;
354 
355 /*
356  * The minimum of the temporary IRE bucket count.  We do not want
357  * the length of each bucket to be too short.  This may hurt
358  * performance of some apps as the temporary IREs are removed too
359  * often.
360  */
361 uint32_t ip_ire_min_bucket_cnt = 3;
362 uint32_t ip6_ire_min_bucket_cnt = 3;
363 
364 /*
365  * The ratio of memory consumed by IRE used for temporary to available
366  * memory.  This is a shift factor, so 6 means the ratio 1 to 64.  This
367  * value can be changed in /etc/system.  6 is a reasonable number.
368  */
369 uint32_t ip_ire_mem_ratio = 6;
370 /* The shift factor for CPU speed to calculate the max IRE bucket length. */
371 uint32_t ip_ire_cpu_ratio = 7;
372 
373 /*
374  * The maximum number of buckets in IRE cache table.  In future, we may
375  * want to make it a dynamic hash table.  For the moment, we fix the
376  * size and allocate the table in ip_ire_init() when IP is first loaded.
377  * We take into account the amount of memory a system has.
378  */
379 #define	IP_MAX_CACHE_TABLE_SIZE	4096
380 
381 static uint32_t	ip_max_cache_table_size = IP_MAX_CACHE_TABLE_SIZE;
382 static uint32_t	ip6_max_cache_table_size = IP_MAX_CACHE_TABLE_SIZE;
383 
384 #define	NUM_ILLS	3	/* To build the ILL list to unlock */
385 
386 /* Zero iulp_t for initialization. */
387 const iulp_t	ire_uinfo_null = { 0 };
388 
389 static int	ire_add_v4(ire_t **ire_p, queue_t *q, mblk_t *mp,
390     ipsq_func_t func);
391 static int	ire_add_srcif_v4(ire_t **ire_p, queue_t *q, mblk_t *mp,
392     ipsq_func_t func);
393 static ire_t	*ire_update_srcif_v4(ire_t *ire);
394 static void	ire_delete_v4(ire_t *ire);
395 static void	ire_report_ftable(ire_t *ire, char *mp);
396 static void	ire_report_ctable(ire_t *ire, char *mp);
397 static void	ire_report_mrtun_table(ire_t *ire, char *mp);
398 static void	ire_report_srcif_table(ire_t *ire, char *mp);
399 static void	ire_walk_ipvers(pfv_t func, char *arg, uchar_t vers,
400     zoneid_t zoneid);
401 static void	ire_walk_ill_ipvers(uint_t match_flags, uint_t ire_type,
402 		    pfv_t func, char *arg, uchar_t vers, ill_t *ill);
403 static	void	ire_walk_ill_tables(uint_t match_flags, uint_t ire_type,
404 		    pfv_t func, char *arg, size_t ftbl_sz, size_t htbl_sz,
405 		    irb_t **ipftbl, size_t ctbl_sz, irb_t *ipctbl, ill_t *ill,
406 		    zoneid_t zoneid);
407 static void	ire_delete_host_redirects(ipaddr_t gateway);
408 static boolean_t ire_match_args(ire_t *ire, ipaddr_t addr, ipaddr_t mask,
409 		    ipaddr_t gateway, int type, ipif_t *ipif, zoneid_t zoneid,
410 		    uint32_t ihandle, int match_flags);
411 static void	ire_cache_cleanup(irb_t *irb, uint32_t threshold, int cnt);
412 extern void	ill_unlock_ills(ill_t **list, int cnt);
413 static void	ire_fastpath_list_add(ill_t *ill, ire_t *ire);
414 extern void	th_trace_rrecord(th_trace_t *);
415 #ifdef IRE_DEBUG
416 static void	ire_trace_inactive(ire_t *);
417 #endif
418 
419 /*
420  * To avoid bloating the code, we call this function instead of
421  * using the macro IRE_REFRELE. Use macro only in performance
422  * critical paths.
423  *
424  * Must not be called while holding any locks. Otherwise if this is
425  * the last reference to be released there is a chance of recursive mutex
426  * panic due to ire_refrele -> ipif_ill_refrele_tail -> qwriter_ip trying
427  * to restart an ioctl. The one exception is when the caller is sure that
428  * this is not the last reference to be released. Eg. if the caller is
429  * sure that the ire has not been deleted and won't be deleted.
430  */
431 void
432 ire_refrele(ire_t *ire)
433 {
434 	IRE_REFRELE(ire);
435 }
436 
437 void
438 ire_refrele_notr(ire_t *ire)
439 {
440 	IRE_REFRELE_NOTR(ire);
441 }
442 
443 /*
444  * kmem_cache_alloc constructor for IRE in kma space.
445  * Note that when ire_mp is set the IRE is stored in that mblk and
446  * not in this cache.
447  */
448 /* ARGSUSED */
449 static int
450 ip_ire_constructor(void *buf, void *cdrarg, int kmflags)
451 {
452 	ire_t	*ire = buf;
453 
454 	ire->ire_fp_mp = NULL;
455 	ire->ire_dlureq_mp = NULL;
456 
457 	return (0);
458 }
459 
460 /* ARGSUSED1 */
461 static void
462 ip_ire_destructor(void *buf, void *cdrarg)
463 {
464 	ire_t	*ire = buf;
465 
466 	ASSERT(ire->ire_fp_mp == NULL);
467 	ASSERT(ire->ire_dlureq_mp == NULL);
468 }
469 
470 /*
471  * This function is associated with the IP_IOC_IRE_ADVISE_NO_REPLY
472  * IOCTL.  It is used by TCP (or other ULPs) to supply revised information
473  * for an existing CACHED IRE.
474  */
475 /* ARGSUSED */
476 int
477 ip_ire_advise(queue_t *q, mblk_t *mp, cred_t *ioc_cr)
478 {
479 	uchar_t	*addr_ucp;
480 	ipic_t	*ipic;
481 	ire_t	*ire;
482 	ipaddr_t	addr;
483 	in6_addr_t	v6addr;
484 	irb_t	*irb;
485 	zoneid_t	zoneid;
486 
487 	ASSERT(q->q_next == NULL);
488 	zoneid = Q_TO_CONN(q)->conn_zoneid;
489 
490 	/*
491 	 * Check privilege using the ioctl credential; if it is NULL
492 	 * then this is a kernel message and therefor privileged.
493 	 */
494 	if (ioc_cr != NULL && secpolicy_net_config(ioc_cr, B_FALSE) != 0)
495 		return (EPERM);
496 
497 	ipic = (ipic_t *)mp->b_rptr;
498 	if (!(addr_ucp = mi_offset_param(mp, ipic->ipic_addr_offset,
499 	    ipic->ipic_addr_length))) {
500 		return (EINVAL);
501 	}
502 	if (!OK_32PTR(addr_ucp))
503 		return (EINVAL);
504 	switch (ipic->ipic_addr_length) {
505 	case IP_ADDR_LEN: {
506 		/* Extract the destination address. */
507 		addr = *(ipaddr_t *)addr_ucp;
508 		/* Find the corresponding IRE. */
509 		ire = ire_cache_lookup(addr, zoneid);
510 		break;
511 	}
512 	case IPV6_ADDR_LEN: {
513 		/* Extract the destination address. */
514 		v6addr = *(in6_addr_t *)addr_ucp;
515 		/* Find the corresponding IRE. */
516 		ire = ire_cache_lookup_v6(&v6addr, zoneid);
517 		break;
518 	}
519 	default:
520 		return (EINVAL);
521 	}
522 
523 	if (ire == NULL)
524 		return (ENOENT);
525 	/*
526 	 * Update the round trip time estimate and/or the max frag size
527 	 * and/or the slow start threshold.
528 	 *
529 	 * We serialize multiple advises using ire_lock.
530 	 */
531 	mutex_enter(&ire->ire_lock);
532 	if (ipic->ipic_rtt) {
533 		/*
534 		 * If there is no old cached values, initialize them
535 		 * conservatively.  Set them to be (1.5 * new value).
536 		 */
537 		if (ire->ire_uinfo.iulp_rtt != 0) {
538 			ire->ire_uinfo.iulp_rtt = (ire->ire_uinfo.iulp_rtt +
539 			    ipic->ipic_rtt) >> 1;
540 		} else {
541 			ire->ire_uinfo.iulp_rtt = ipic->ipic_rtt +
542 			    (ipic->ipic_rtt >> 1);
543 		}
544 		if (ire->ire_uinfo.iulp_rtt_sd != 0) {
545 			ire->ire_uinfo.iulp_rtt_sd =
546 			    (ire->ire_uinfo.iulp_rtt_sd +
547 			    ipic->ipic_rtt_sd) >> 1;
548 		} else {
549 			ire->ire_uinfo.iulp_rtt_sd = ipic->ipic_rtt_sd +
550 			    (ipic->ipic_rtt_sd >> 1);
551 		}
552 	}
553 	if (ipic->ipic_max_frag)
554 		ire->ire_max_frag = MIN(ipic->ipic_max_frag, IP_MAXPACKET);
555 	if (ipic->ipic_ssthresh != 0) {
556 		if (ire->ire_uinfo.iulp_ssthresh != 0)
557 			ire->ire_uinfo.iulp_ssthresh =
558 			    (ipic->ipic_ssthresh +
559 			    ire->ire_uinfo.iulp_ssthresh) >> 1;
560 		else
561 			ire->ire_uinfo.iulp_ssthresh = ipic->ipic_ssthresh;
562 	}
563 	/*
564 	 * Don't need the ire_lock below this. ire_type does not change
565 	 * after initialization. ire_marks is protected by irb_lock.
566 	 */
567 	mutex_exit(&ire->ire_lock);
568 
569 	if (ipic->ipic_ire_marks != 0 && ire->ire_type == IRE_CACHE) {
570 		/*
571 		 * Only increment the temporary IRE count if the original
572 		 * IRE is not already marked temporary.
573 		 */
574 		irb = ire->ire_bucket;
575 		rw_enter(&irb->irb_lock, RW_WRITER);
576 		if ((ipic->ipic_ire_marks & IRE_MARK_TEMPORARY) &&
577 		    !(ire->ire_marks & IRE_MARK_TEMPORARY)) {
578 			irb->irb_tmp_ire_cnt++;
579 		}
580 		ire->ire_marks |= ipic->ipic_ire_marks;
581 		rw_exit(&irb->irb_lock);
582 	}
583 
584 	ire_refrele(ire);
585 	return (0);
586 }
587 
588 /*
589  * This function is associated with the IP_IOC_IRE_DELETE[_NO_REPLY]
590  * IOCTL[s].  The NO_REPLY form is used by TCP to delete a route IRE
591  * for a host that is not responding.  This will force an attempt to
592  * establish a new route, if available.  Management processes may want
593  * to use the version that generates a reply.
594  *
595  * This function does not support IPv6 since Neighbor Unreachability Detection
596  * means that negative advise like this is useless.
597  */
598 /* ARGSUSED */
599 int
600 ip_ire_delete(queue_t *q, mblk_t *mp, cred_t *ioc_cr)
601 {
602 	uchar_t	*addr_ucp;
603 	ipaddr_t	addr;
604 	ire_t	*ire;
605 	ipid_t	*ipid;
606 	boolean_t routing_sock_info = B_FALSE;	/* Sent info? */
607 	zoneid_t	zoneid;
608 
609 	ASSERT(q->q_next == NULL);
610 	zoneid = Q_TO_CONN(q)->conn_zoneid;
611 
612 	/*
613 	 * Check privilege using the ioctl credential; if it is NULL
614 	 * then this is a kernel message and therefor privileged.
615 	 */
616 	if (ioc_cr != NULL && secpolicy_net_config(ioc_cr, B_FALSE) != 0)
617 		return (EPERM);
618 
619 	ipid = (ipid_t *)mp->b_rptr;
620 
621 	/* Only actions on IRE_CACHEs are acceptable at present. */
622 	if (ipid->ipid_ire_type != IRE_CACHE)
623 		return (EINVAL);
624 
625 	addr_ucp = mi_offset_param(mp, ipid->ipid_addr_offset,
626 		ipid->ipid_addr_length);
627 	if (addr_ucp == NULL || !OK_32PTR(addr_ucp))
628 		return (EINVAL);
629 	switch (ipid->ipid_addr_length) {
630 	case IP_ADDR_LEN:
631 		/* addr_ucp points at IP addr */
632 		break;
633 	case sizeof (sin_t): {
634 		sin_t	*sin;
635 		/*
636 		 * got complete (sockaddr) address - increment addr_ucp to point
637 		 * at the ip_addr field.
638 		 */
639 		sin = (sin_t *)addr_ucp;
640 		addr_ucp = (uchar_t *)&sin->sin_addr.s_addr;
641 		break;
642 	}
643 	default:
644 		return (EINVAL);
645 	}
646 	/* Extract the destination address. */
647 	bcopy(addr_ucp, &addr, IP_ADDR_LEN);
648 
649 	/* Try to find the CACHED IRE. */
650 	ire = ire_cache_lookup(addr, zoneid);
651 
652 	/* Nail it. */
653 	if (ire) {
654 		/* Allow delete only on CACHE entries */
655 		if (ire->ire_type != IRE_CACHE) {
656 			ire_refrele(ire);
657 			return (EINVAL);
658 		}
659 
660 		/*
661 		 * Verify that the IRE has been around for a while.
662 		 * This is to protect against transport protocols
663 		 * that are too eager in sending delete messages.
664 		 */
665 		if (gethrestime_sec() <
666 		    ire->ire_create_time + ip_ignore_delete_time) {
667 			ire_refrele(ire);
668 			return (EINVAL);
669 		}
670 		/*
671 		 * Now we have a potentially dead cache entry. We need
672 		 * to remove it.
673 		 * If this cache entry is generated from a default route,
674 		 * search the default list and mark it dead and some
675 		 * background process will try to activate it.
676 		 */
677 		if ((ire->ire_gateway_addr != 0) && (ire->ire_cmask == 0)) {
678 			/*
679 			 * Make sure that we pick a different
680 			 * IRE_DEFAULT next time.
681 			 * The ip_ire_default_count tracks the number of
682 			 * IRE_DEFAULT entries. However, the
683 			 * ip_forwarding_table[0] also contains
684 			 * interface routes thus the count can be zero.
685 			 */
686 			ire_t *gw_ire;
687 			irb_t *irb_ptr;
688 			irb_t *irb;
689 
690 			if (((irb_ptr = ip_forwarding_table[0]) != NULL) &&
691 			    (irb = &irb_ptr[0])->irb_ire != NULL &&
692 			    ip_ire_default_count != 0) {
693 				uint_t index;
694 
695 				/*
696 				 * We grab it as writer just to serialize
697 				 * multiple threads trying to bump up
698 				 * ip_ire_default_index.
699 				 */
700 				rw_enter(&irb->irb_lock, RW_WRITER);
701 				if ((gw_ire = irb->irb_ire) == NULL) {
702 					rw_exit(&irb->irb_lock);
703 					goto done;
704 				}
705 				index = ip_ire_default_index %
706 				    ip_ire_default_count;
707 				while (index-- && gw_ire->ire_next != NULL)
708 					gw_ire = gw_ire->ire_next;
709 
710 				/* Skip past the potentially bad gateway */
711 				if (ire->ire_gateway_addr ==
712 				    gw_ire->ire_gateway_addr)
713 					ip_ire_default_index++;
714 
715 				rw_exit(&irb->irb_lock);
716 		    }
717 		}
718 done:
719 		/* report the bad route to routing sockets */
720 		ip_rts_change(RTM_LOSING, ire->ire_addr, ire->ire_gateway_addr,
721 		    ire->ire_mask, ire->ire_src_addr, 0, 0, 0,
722 		    (RTA_DST | RTA_GATEWAY | RTA_NETMASK | RTA_IFA));
723 		routing_sock_info = B_TRUE;
724 		ire_delete(ire);
725 		ire_refrele(ire);
726 	}
727 	/* Also look for an IRE_HOST_REDIRECT and remove it if present */
728 	ire = ire_route_lookup(addr, 0, 0, IRE_HOST_REDIRECT, NULL, NULL,
729 	    ALL_ZONES, MATCH_IRE_TYPE);
730 
731 	/* Nail it. */
732 	if (ire) {
733 		if (!routing_sock_info) {
734 			ip_rts_change(RTM_LOSING, ire->ire_addr,
735 			    ire->ire_gateway_addr, ire->ire_mask,
736 			    ire->ire_src_addr, 0, 0, 0,
737 			    (RTA_DST | RTA_GATEWAY | RTA_NETMASK | RTA_IFA));
738 		}
739 		ire_delete(ire);
740 		ire_refrele(ire);
741 	}
742 	return (0);
743 }
744 
745 /*
746  * Named Dispatch routine to produce a formatted report on all IREs.
747  * This report is accessed by using the ndd utility to "get" ND variable
748  * "ipv4_ire_status".
749  */
750 /* ARGSUSED */
751 int
752 ip_ire_report(queue_t *q, mblk_t *mp, caddr_t arg, cred_t *ioc_cr)
753 {
754 	zoneid_t zoneid;
755 
756 	(void) mi_mpprintf(mp,
757 	    "IRE      " MI_COL_HDRPAD_STR
758 	/*   01234567[89ABCDEF] */
759 	    "rfq      " MI_COL_HDRPAD_STR
760 	/*   01234567[89ABCDEF] */
761 	    "stq      " MI_COL_HDRPAD_STR
762 	/*   01234567[89ABCDEF] */
763 	    " zone "
764 	/*   12345 */
765 	    "addr            mask            "
766 	/*   123.123.123.123 123.123.123.123 */
767 	    "src             gateway         mxfrg rtt   rtt_sd ssthresh ref "
768 	/*   123.123.123.123 123.123.123.123 12345 12345 123456 12345678 123 */
769 	    "rtomax tstamp_ok wscale_ok ecn_ok pmtud_ok sack sendpipe "
770 	/*   123456 123456789 123456789 123456 12345678 1234 12345678 */
771 	    "recvpipe in/out/forward type");
772 	/*   12345678 in/out/forward xxxxxxxxxx */
773 
774 	/*
775 	 * Because of the ndd constraint, at most we can have 64K buffer
776 	 * to put in all IRE info.  So to be more efficient, just
777 	 * allocate a 64K buffer here, assuming we need that large buffer.
778 	 * This should be OK as only root can do ndd /dev/ip.
779 	 */
780 	if ((mp->b_cont = allocb(ND_MAX_BUF_LEN, BPRI_HI)) == NULL) {
781 		/* The following may work even if we cannot get a large buf. */
782 		(void) mi_mpprintf(mp, "<< Out of buffer >>\n");
783 		return (0);
784 	}
785 
786 	zoneid = Q_TO_CONN(q)->conn_zoneid;
787 	if (zoneid == GLOBAL_ZONEID)
788 		zoneid = ALL_ZONES;
789 
790 	ire_walk_v4(ire_report_ftable, (char *)mp->b_cont, zoneid);
791 	ire_walk_v4(ire_report_ctable, (char *)mp->b_cont, zoneid);
792 
793 	return (0);
794 }
795 
796 /* ire_walk routine invoked for ip_ire_report for each IRE. */
797 static void
798 ire_report_ftable(ire_t *ire, char *mp)
799 {
800 	char	buf1[16];
801 	char	buf2[16];
802 	char	buf3[16];
803 	char	buf4[16];
804 	uint_t	fo_pkt_count;
805 	uint_t	ib_pkt_count;
806 	int	ref;
807 	uint_t	print_len, buf_len;
808 
809 	if (ire->ire_type & IRE_CACHETABLE)
810 	    return;
811 	buf_len = ((mblk_t *)mp)->b_datap->db_lim - ((mblk_t *)mp)->b_wptr;
812 	if (buf_len <= 0)
813 		return;
814 
815 	/* Number of active references of this ire */
816 	ref = ire->ire_refcnt;
817 	/* "inbound" to a non local address is a forward */
818 	ib_pkt_count = ire->ire_ib_pkt_count;
819 	fo_pkt_count = 0;
820 	if (!(ire->ire_type & (IRE_LOCAL|IRE_BROADCAST))) {
821 		fo_pkt_count = ib_pkt_count;
822 		ib_pkt_count = 0;
823 	}
824 	print_len = snprintf((char *)((mblk_t *)mp)->b_wptr, buf_len,
825 	    MI_COL_PTRFMT_STR MI_COL_PTRFMT_STR MI_COL_PTRFMT_STR "%5d "
826 	    "%s %s %s %s %05d %05ld %06ld %08d %03d %06d %09d %09d %06d %08d "
827 	    "%04d %08d %08d %d/%d/%d %s\n",
828 	    (void *)ire, (void *)ire->ire_rfq, (void *)ire->ire_stq,
829 	    (int)ire->ire_zoneid,
830 	    ip_dot_addr(ire->ire_addr, buf1), ip_dot_addr(ire->ire_mask, buf2),
831 	    ip_dot_addr(ire->ire_src_addr, buf3),
832 	    ip_dot_addr(ire->ire_gateway_addr, buf4),
833 	    ire->ire_max_frag, ire->ire_uinfo.iulp_rtt,
834 	    ire->ire_uinfo.iulp_rtt_sd,
835 	    ire->ire_uinfo.iulp_ssthresh, ref,
836 	    ire->ire_uinfo.iulp_rtomax,
837 	    (ire->ire_uinfo.iulp_tstamp_ok ? 1: 0),
838 	    (ire->ire_uinfo.iulp_wscale_ok ? 1: 0),
839 	    (ire->ire_uinfo.iulp_ecn_ok ? 1: 0),
840 	    (ire->ire_uinfo.iulp_pmtud_ok ? 1: 0),
841 	    ire->ire_uinfo.iulp_sack,
842 	    ire->ire_uinfo.iulp_spipe, ire->ire_uinfo.iulp_rpipe,
843 	    ib_pkt_count, ire->ire_ob_pkt_count, fo_pkt_count,
844 	    ip_nv_lookup(ire_nv_tbl, (int)ire->ire_type));
845 	if (print_len < buf_len) {
846 		((mblk_t *)mp)->b_wptr += print_len;
847 	} else {
848 		((mblk_t *)mp)->b_wptr += buf_len;
849 	}
850 }
851 
852 /* ire_walk routine invoked for ip_ire_report for each cached IRE. */
853 static void
854 ire_report_ctable(ire_t *ire, char *mp)
855 {
856 	char	buf1[16];
857 	char	buf2[16];
858 	char	buf3[16];
859 	char	buf4[16];
860 	uint_t	fo_pkt_count;
861 	uint_t	ib_pkt_count;
862 	int	ref;
863 	uint_t	print_len, buf_len;
864 
865 	if ((ire->ire_type & IRE_CACHETABLE) == 0)
866 	    return;
867 	buf_len = ((mblk_t *)mp)->b_datap->db_lim - ((mblk_t *)mp)->b_wptr;
868 	if (buf_len <= 0)
869 		return;
870 
871 	/* Number of active references of this ire */
872 	ref = ire->ire_refcnt;
873 	/* "inbound" to a non local address is a forward */
874 	ib_pkt_count = ire->ire_ib_pkt_count;
875 	fo_pkt_count = 0;
876 	if (!(ire->ire_type & (IRE_LOCAL|IRE_BROADCAST))) {
877 		fo_pkt_count = ib_pkt_count;
878 		ib_pkt_count = 0;
879 	}
880 	print_len =  snprintf((char *)((mblk_t *)mp)->b_wptr, buf_len,
881 	    MI_COL_PTRFMT_STR MI_COL_PTRFMT_STR MI_COL_PTRFMT_STR "%5d "
882 	    "%s %s %s %s %05d %05ld %06ld %08d %03d %06d %09d %09d %06d %08d "
883 	    "%04d %08d %08d %d/%d/%d %s\n",
884 	    (void *)ire, (void *)ire->ire_rfq, (void *)ire->ire_stq,
885 	    (int)ire->ire_zoneid,
886 	    ip_dot_addr(ire->ire_addr, buf1), ip_dot_addr(ire->ire_mask, buf2),
887 	    ip_dot_addr(ire->ire_src_addr, buf3),
888 	    ip_dot_addr(ire->ire_gateway_addr, buf4),
889 	    ire->ire_max_frag, ire->ire_uinfo.iulp_rtt,
890 	    ire->ire_uinfo.iulp_rtt_sd, ire->ire_uinfo.iulp_ssthresh, ref,
891 	    ire->ire_uinfo.iulp_rtomax,
892 	    (ire->ire_uinfo.iulp_tstamp_ok ? 1: 0),
893 	    (ire->ire_uinfo.iulp_wscale_ok ? 1: 0),
894 	    (ire->ire_uinfo.iulp_ecn_ok ? 1: 0),
895 	    (ire->ire_uinfo.iulp_pmtud_ok ? 1: 0),
896 	    ire->ire_uinfo.iulp_sack,
897 	    ire->ire_uinfo.iulp_spipe, ire->ire_uinfo.iulp_rpipe,
898 	    ib_pkt_count, ire->ire_ob_pkt_count, fo_pkt_count,
899 	    ip_nv_lookup(ire_nv_tbl, (int)ire->ire_type));
900 	if (print_len < buf_len) {
901 		((mblk_t *)mp)->b_wptr += print_len;
902 	} else {
903 		((mblk_t *)mp)->b_wptr += buf_len;
904 	}
905 }
906 
907 /* ARGSUSED */
908 int
909 ip_ire_report_mrtun(queue_t *q, mblk_t *mp, caddr_t arg, cred_t *ioc_cr)
910 {
911 	(void) mi_mpprintf(mp,
912 	"IRE      " MI_COL_HDRPAD_STR
913 	/*   01234567[89ABCDEF] */
914 	"stq      " MI_COL_HDRPAD_STR
915 	/*   01234567[89ABCDEF] */
916 	"in_ill    " MI_COL_HDRPAD_STR
917 	/*   01234567[89ABCDEF] */
918 	"in_src_addr            "
919 	/*   123.123.123.123 */
920 	"max_frag      "
921 	/*   12345 */
922 	"ref     ");
923 	/*   123 */
924 
925 	ire_walk_ill_mrtun(0, 0, ire_report_mrtun_table, (char *)mp, NULL);
926 	return (0);
927 }
928 
929 /* mrtun report table - supports ipv4_mrtun_ire_status ndd variable */
930 
931 static void
932 ire_report_mrtun_table(ire_t *ire, char *mp)
933 {
934 	char	buf1[INET_ADDRSTRLEN];
935 	int	ref;
936 
937 	/* Number of active references of this ire */
938 	ref = ire->ire_refcnt;
939 	ASSERT(ire->ire_type == IRE_MIPRTUN);
940 	(void) mi_mpprintf((mblk_t *)mp,
941 	    MI_COL_PTRFMT_STR MI_COL_PTRFMT_STR MI_COL_PTRFMT_STR
942 	    "%s          %05d             %03d",
943 	    (void *)ire, (void *)ire->ire_stq,
944 	    (void *)ire->ire_in_ill,
945 	    ip_dot_addr(ire->ire_in_src_addr, buf1),
946 	    ire->ire_max_frag, ref);
947 }
948 
949 /*
950  * Dispatch routine to format ires in interface based routine
951  */
952 /* ARGSUSED */
953 int
954 ip_ire_report_srcif(queue_t *q, mblk_t *mp, caddr_t arg, cred_t *ioc_cr)
955 {
956 
957 	/* Report all interface based ires */
958 
959 	(void) mi_mpprintf(mp,
960 	    "IRE      " MI_COL_HDRPAD_STR
961 	    /*   01234567[89ABCDEF] */
962 	    "stq      " MI_COL_HDRPAD_STR
963 	    /*   01234567[89ABCDEF] */
964 	    "in_ill    " MI_COL_HDRPAD_STR
965 	    /*   01234567[89ABCDEF] */
966 	    "addr            "
967 	    /*   123.123.123.123 */
968 	    "gateway         "
969 	    /*   123.123.123.123 */
970 	    "max_frag      "
971 	    /*   12345 */
972 	    "ref     "
973 	    /*   123 */
974 	    "type    "
975 	    /* ABCDEFGH */
976 	    "in/out/forward");
977 	ire_walk_srcif_table_v4(ire_report_srcif_table, (char *)mp);
978 	return (0);
979 }
980 
981 /* Reports the interface table ires */
982 static void
983 ire_report_srcif_table(ire_t *ire, char *mp)
984 {
985 	char    buf1[INET_ADDRSTRLEN];
986 	char    buf2[INET_ADDRSTRLEN];
987 	int	ref;
988 
989 	ref = ire->ire_refcnt;
990 	(void) mi_mpprintf((mblk_t *)mp,
991 	    MI_COL_PTRFMT_STR MI_COL_PTRFMT_STR MI_COL_PTRFMT_STR
992 	    "%s    %s      %05d       %03d      %s     %d",
993 	    (void *)ire, (void *)ire->ire_stq,
994 	    (void *)ire->ire_in_ill,
995 	    ip_dot_addr(ire->ire_addr, buf1),
996 	    ip_dot_addr(ire->ire_gateway_addr, buf2),
997 	    ire->ire_max_frag, ref,
998 	    ip_nv_lookup(ire_nv_tbl, (int)ire->ire_type),
999 	    ire->ire_ib_pkt_count);
1000 
1001 }
1002 /*
1003  * ip_ire_req is called by ip_wput when an IRE_DB_REQ_TYPE message is handed
1004  * down from the Upper Level Protocol to request a copy of the IRE (to check
1005  * its type or to extract information like round-trip time estimates or the
1006  * MTU.)
1007  * The address is assumed to be in the ire_addr field. If no IRE is found
1008  * an IRE is returned with ire_type being zero.
1009  * Note that the upper lavel protocol has to check for broadcast
1010  * (IRE_BROADCAST) and multicast (CLASSD(addr)).
1011  * If there is a b_cont the resulting IRE_DB_TYPE mblk is placed at the
1012  * end of the returned message.
1013  *
1014  * TCP sends down a message of this type with a connection request packet
1015  * chained on. UDP and ICMP send it down to verify that a route exists for
1016  * the destination address when they get connected.
1017  */
1018 void
1019 ip_ire_req(queue_t *q, mblk_t *mp)
1020 {
1021 	ire_t	*inire;
1022 	ire_t	*ire;
1023 	mblk_t	*mp1;
1024 	ire_t	*sire = NULL;
1025 	zoneid_t zoneid = Q_TO_CONN(q)->conn_zoneid;
1026 
1027 	if ((mp->b_wptr - mp->b_rptr) < sizeof (ire_t) ||
1028 	    !OK_32PTR(mp->b_rptr)) {
1029 		freemsg(mp);
1030 		return;
1031 	}
1032 	inire = (ire_t *)mp->b_rptr;
1033 	/*
1034 	 * Got it, now take our best shot at an IRE.
1035 	 */
1036 	if (inire->ire_ipversion == IPV6_VERSION) {
1037 		ire = ire_route_lookup_v6(&inire->ire_addr_v6, 0, 0, 0,
1038 		    NULL, &sire, zoneid,
1039 		    (MATCH_IRE_RECURSIVE | MATCH_IRE_DEFAULT));
1040 	} else {
1041 		ASSERT(inire->ire_ipversion == IPV4_VERSION);
1042 		ire = ire_route_lookup(inire->ire_addr, 0, 0, 0,
1043 		    NULL, &sire, zoneid,
1044 		    (MATCH_IRE_RECURSIVE | MATCH_IRE_DEFAULT));
1045 	}
1046 
1047 	/*
1048 	 * We prevent returning IRES with source address INADDR_ANY
1049 	 * as these were temporarily created for sending packets
1050 	 * from endpoints that have conn_unspec_src set.
1051 	 */
1052 	if (ire == NULL ||
1053 	    (ire->ire_ipversion == IPV4_VERSION &&
1054 	    ire->ire_src_addr == INADDR_ANY) ||
1055 	    (ire->ire_ipversion == IPV6_VERSION &&
1056 	    IN6_IS_ADDR_UNSPECIFIED(&ire->ire_src_addr_v6))) {
1057 		inire->ire_type = 0;
1058 	} else {
1059 		bcopy(ire, inire, sizeof (ire_t));
1060 		/* Copy the route metrics from the parent. */
1061 		if (sire != NULL) {
1062 			bcopy(&(sire->ire_uinfo), &(inire->ire_uinfo),
1063 			    sizeof (iulp_t));
1064 		}
1065 
1066 		/*
1067 		 * As we don't lookup global policy here, we may not
1068 		 * pass the right size if per-socket policy is not
1069 		 * present. For these cases, path mtu discovery will
1070 		 * do the right thing.
1071 		 */
1072 		inire->ire_ipsec_overhead = conn_ipsec_length(Q_TO_CONN(q));
1073 
1074 		/* Pass the latest setting of the ip_path_mtu_discovery */
1075 		inire->ire_frag_flag |= (ip_path_mtu_discovery) ? IPH_DF : 0;
1076 	}
1077 	if (ire != NULL)
1078 		ire_refrele(ire);
1079 	if (sire != NULL)
1080 		ire_refrele(sire);
1081 	mp->b_wptr = &mp->b_rptr[sizeof (ire_t)];
1082 	mp->b_datap->db_type = IRE_DB_TYPE;
1083 
1084 	/* Put the IRE_DB_TYPE mblk last in the chain */
1085 	mp1 = mp->b_cont;
1086 	if (mp1 != NULL) {
1087 		mp->b_cont = NULL;
1088 		linkb(mp1, mp);
1089 		mp = mp1;
1090 	}
1091 	qreply(q, mp);
1092 }
1093 
1094 /*
1095  * Send a packet using the specified IRE.
1096  * If ire_src_addr_v6 is all zero then discard the IRE after
1097  * the packet has been sent.
1098  */
1099 static void
1100 ire_send(queue_t *q, mblk_t *pkt, ire_t *ire)
1101 {
1102 	mblk_t *mp;
1103 	mblk_t *ipsec_mp;
1104 	boolean_t is_secure;
1105 	uint_t ifindex;
1106 	ill_t	*ill;
1107 
1108 	ASSERT(ire->ire_ipversion == IPV4_VERSION);
1109 	ipsec_mp = pkt;
1110 	is_secure = (pkt->b_datap->db_type == M_CTL);
1111 	if (is_secure)
1112 		pkt = pkt->b_cont;
1113 
1114 	/* If the packet originated externally then */
1115 	if (pkt->b_prev) {
1116 		ire_refrele(ire);
1117 		/*
1118 		 * Extract the ifindex from b_prev (set in ip_rput_noire).
1119 		 * Look up interface to see if it still exists (it could have
1120 		 * been unplumbed by the time the reply came back from ARP)
1121 		 */
1122 		ifindex = (uint_t)(uintptr_t)pkt->b_prev;
1123 		ill = ill_lookup_on_ifindex(ifindex, B_FALSE,
1124 		    NULL, NULL, NULL, NULL);
1125 		if (ill == NULL) {
1126 			pkt->b_prev = NULL;
1127 			pkt->b_next = NULL;
1128 			freemsg(ipsec_mp);
1129 			return;
1130 		}
1131 		q = ill->ill_rq;
1132 		pkt->b_prev = NULL;
1133 		mp = allocb(0, BPRI_HI);
1134 		if (mp == NULL) {
1135 			ill_refrele(ill);
1136 			pkt->b_next = NULL;
1137 			freemsg(ipsec_mp);
1138 			return;
1139 		}
1140 		mp->b_datap->db_type = M_BREAK;
1141 		/*
1142 		 * This packet has not gone through IPSEC processing
1143 		 * and hence we should not have any IPSEC message
1144 		 * prepended.
1145 		 */
1146 		ASSERT(ipsec_mp == pkt);
1147 		mp->b_cont = ipsec_mp;
1148 		put(q, mp);
1149 		ill_refrele(ill);
1150 	} else if (pkt->b_next) {
1151 		/* Packets from multicast router */
1152 		pkt->b_next = NULL;
1153 		/*
1154 		 * We never get the IPSEC_OUT while forwarding the
1155 		 * packet for multicast router.
1156 		 */
1157 		ASSERT(ipsec_mp == pkt);
1158 		ip_rput_forward(ire, (ipha_t *)pkt->b_rptr, ipsec_mp, NULL);
1159 		ire_refrele(ire);
1160 	} else {
1161 		/* Locally originated packets */
1162 		boolean_t is_inaddr_any;
1163 		ipha_t *ipha = (ipha_t *)pkt->b_rptr;
1164 
1165 		/*
1166 		 * We need to do an ire_delete below for which
1167 		 * we need to make sure that the IRE will be
1168 		 * around even after calling ip_wput_ire -
1169 		 * which does ire_refrele. Otherwise somebody
1170 		 * could potentially delete this ire and hence
1171 		 * free this ire and we will be calling ire_delete
1172 		 * on a freed ire below.
1173 		 */
1174 		is_inaddr_any = (ire->ire_src_addr == INADDR_ANY);
1175 		if (is_inaddr_any) {
1176 			IRE_REFHOLD(ire);
1177 		}
1178 		/*
1179 		 * If we were resolving a router we can not use the
1180 		 * routers IRE for sending the packet (since it would
1181 		 * violate the uniqness of the IP idents) thus we
1182 		 * make another pass through ip_wput to create the IRE_CACHE
1183 		 * for the destination.
1184 		 * When IRE_MARK_NOADD is set, ire_add() is not called.
1185 		 * Thus ip_wput() will never find a ire and result in an
1186 		 * infinite loop. Thus we check whether IRE_MARK_NOADD is
1187 		 * is set. This also implies that IRE_MARK_NOADD can only be
1188 		 * used to send packets to directly connected hosts.
1189 		 */
1190 		if (ipha->ipha_dst != ire->ire_addr &&
1191 		    !(ire->ire_marks & IRE_MARK_NOADD)) {
1192 			ire_refrele(ire);	/* Held in ire_add */
1193 			(void) ip_output(Q_TO_CONN(q), ipsec_mp, q, IRE_SEND);
1194 		} else {
1195 			if (is_secure) {
1196 				ipsec_out_t *oi;
1197 				ipha_t *ipha;
1198 
1199 				oi = (ipsec_out_t *)ipsec_mp->b_rptr;
1200 				ipha = (ipha_t *)ipsec_mp->b_cont->b_rptr;
1201 				if (oi->ipsec_out_proc_begin) {
1202 					/*
1203 					 * This is the case where
1204 					 * ip_wput_ipsec_out could not find
1205 					 * the IRE and recreated a new one.
1206 					 * As ip_wput_ipsec_out does ire
1207 					 * lookups, ire_refrele for the extra
1208 					 * bump in ire_add.
1209 					 */
1210 					ire_refrele(ire);
1211 					ip_wput_ipsec_out(q, ipsec_mp, ipha,
1212 					    NULL, NULL);
1213 				} else {
1214 					/*
1215 					 * IRE_REFRELE will be done in
1216 					 * ip_wput_ire.
1217 					 */
1218 					ip_wput_ire(q, ipsec_mp, ire, NULL,
1219 					    IRE_SEND);
1220 				}
1221 			} else {
1222 				/*
1223 				 * IRE_REFRELE will be done in ip_wput_ire.
1224 				 */
1225 				ip_wput_ire(q, ipsec_mp, ire, NULL,
1226 				    IRE_SEND);
1227 			}
1228 		}
1229 		/*
1230 		 * Special code to support sending a single packet with
1231 		 * conn_unspec_src using an IRE which has no source address.
1232 		 * The IRE is deleted here after sending the packet to avoid
1233 		 * having other code trip on it. But before we delete the
1234 		 * ire, somebody could have looked up this ire.
1235 		 * We prevent returning/using this IRE by the upper layers
1236 		 * by making checks to NULL source address in other places
1237 		 * like e.g ip_ire_append, ip_ire_req and ip_bind_connected.
1238 		 * Though, this does not completely prevent other threads
1239 		 * from using this ire, this should not cause any problems.
1240 		 *
1241 		 * NOTE : We use is_inaddr_any instead of using ire_src_addr
1242 		 * because for the normal case i.e !is_inaddr_any, ire_refrele
1243 		 * above could have potentially freed the ire.
1244 		 */
1245 		if (is_inaddr_any) {
1246 			/*
1247 			 * If this IRE has been deleted by another thread, then
1248 			 * ire_bucket won't be NULL, but ire_ptpn will be NULL.
1249 			 * Thus, ire_delete will do nothing.  This check
1250 			 * guards against calling ire_delete when the IRE was
1251 			 * never inserted in the table, which is handled by
1252 			 * ire_delete as dropping another reference.
1253 			 */
1254 			if (ire->ire_bucket != NULL) {
1255 				ip1dbg(("ire_send: delete IRE\n"));
1256 				ire_delete(ire);
1257 			}
1258 			ire_refrele(ire);	/* Held above */
1259 		}
1260 	}
1261 }
1262 
1263 /*
1264  * Send a packet using the specified IRE.
1265  * If ire_src_addr_v6 is all zero then discard the IRE after
1266  * the packet has been sent.
1267  */
1268 static void
1269 ire_send_v6(queue_t *q, mblk_t *pkt, ire_t *ire)
1270 {
1271 	mblk_t *ipsec_mp;
1272 	boolean_t secure;
1273 	uint_t ifindex;
1274 
1275 	ASSERT(ire->ire_ipversion == IPV6_VERSION);
1276 	if (pkt->b_datap->db_type == M_CTL) {
1277 		ipsec_mp = pkt;
1278 		pkt = pkt->b_cont;
1279 		secure = B_TRUE;
1280 	} else {
1281 		ipsec_mp = pkt;
1282 		secure = B_FALSE;
1283 	}
1284 
1285 	/* If the packet originated externally then */
1286 	if (pkt->b_prev) {
1287 		ill_t	*ill;
1288 		/*
1289 		 * Extract the ifindex from b_prev (set in ip_rput_data_v6).
1290 		 * Look up interface to see if it still exists (it could have
1291 		 * been unplumbed by the time the reply came back from the
1292 		 * resolver). Unlike IPv4 there is no need for a prepended
1293 		 * M_BREAK since ip_rput_data_v6 does not process options
1294 		 * before finding an IRE.
1295 		 */
1296 		ifindex = (uint_t)(uintptr_t)pkt->b_prev;
1297 		ill = ill_lookup_on_ifindex(ifindex, B_TRUE,
1298 		    NULL, NULL, NULL, NULL);
1299 		if (ill == NULL) {
1300 			pkt->b_prev = NULL;
1301 			pkt->b_next = NULL;
1302 			freemsg(ipsec_mp);
1303 			ire_refrele(ire);	/* Held in ire_add */
1304 			return;
1305 		}
1306 		q = ill->ill_rq;
1307 		pkt->b_prev = NULL;
1308 		/*
1309 		 * This packet has not gone through IPSEC processing
1310 		 * and hence we should not have any IPSEC message
1311 		 * prepended.
1312 		 */
1313 		ASSERT(ipsec_mp == pkt);
1314 		put(q, pkt);
1315 		ill_refrele(ill);
1316 	} else if (pkt->b_next) {
1317 		/* Packets from multicast router */
1318 		pkt->b_next = NULL;
1319 		/*
1320 		 * We never get the IPSEC_OUT while forwarding the
1321 		 * packet for multicast router.
1322 		 */
1323 		ASSERT(ipsec_mp == pkt);
1324 		/*
1325 		 * XXX TODO IPv6.
1326 		 */
1327 		freemsg(pkt);
1328 #ifdef XXX
1329 		ip_rput_forward(ire, (ipha_t *)pkt->b_rptr, pkt, NULL);
1330 #endif
1331 	} else {
1332 		if (secure) {
1333 			ipsec_out_t *oi;
1334 			ip6_t *ip6h;
1335 
1336 			oi = (ipsec_out_t *)ipsec_mp->b_rptr;
1337 			ip6h = (ip6_t *)ipsec_mp->b_cont->b_rptr;
1338 			if (oi->ipsec_out_proc_begin) {
1339 				/*
1340 				 * This is the case where
1341 				 * ip_wput_ipsec_out could not find
1342 				 * the IRE and recreated a new one.
1343 				 */
1344 				ip_wput_ipsec_out_v6(q, ipsec_mp, ip6h,
1345 				    NULL, NULL);
1346 			} else {
1347 				(void) ip_output_v6(Q_TO_CONN(q), ipsec_mp,
1348 				    q, IRE_SEND);
1349 			}
1350 		} else {
1351 			/*
1352 			 * Send packets through ip_output_v6 so that any
1353 			 * ip6_info header can be processed again.
1354 			 */
1355 			(void) ip_output_v6(Q_TO_CONN(q), ipsec_mp, q,
1356 			    IRE_SEND);
1357 		}
1358 		/*
1359 		 * Special code to support sending a single packet with
1360 		 * conn_unspec_src using an IRE which has no source address.
1361 		 * The IRE is deleted here after sending the packet to avoid
1362 		 * having other code trip on it. But before we delete the
1363 		 * ire, somebody could have looked up this ire.
1364 		 * We prevent returning/using this IRE by the upper layers
1365 		 * by making checks to NULL source address in other places
1366 		 * like e.g ip_ire_append_v6, ip_ire_req and
1367 		 * ip_bind_connected_v6. Though, this does not completely
1368 		 * prevent other threads from using this ire, this should
1369 		 * not cause any problems.
1370 		 */
1371 		if (IN6_IS_ADDR_UNSPECIFIED(&ire->ire_src_addr_v6)) {
1372 			ip1dbg(("ire_send_v6: delete IRE\n"));
1373 			ire_delete(ire);
1374 		}
1375 	}
1376 	ire_refrele(ire);	/* Held in ire_add */
1377 }
1378 
1379 /*
1380  * Make sure that IRE bucket does not get too long.
1381  * This can cause lock up because ire_cache_lookup()
1382  * may take "forever" to finish.
1383  *
1384  * We just remove cnt IREs each time.  This means that
1385  * the bucket length will stay approximately constant,
1386  * depending on cnt.  This should be enough to defend
1387  * against DoS attack based on creating temporary IREs
1388  * (for forwarding and non-TCP traffic).
1389  *
1390  * Note that new IRE is normally added at the tail of the
1391  * bucket.  This means that we are removing the "oldest"
1392  * temporary IRE added.  Only if there are IREs with
1393  * the same ire_addr, do we not add it at the tail.  Refer
1394  * to ire_add_v*().  It should be OK for our purpose.
1395  *
1396  * For non-temporary cached IREs, we make sure that they
1397  * have not been used for some time (defined below), they
1398  * are non-local destinations, and there is no one using
1399  * them at the moment (refcnt == 1).
1400  *
1401  * The above means that the IRE bucket length may become
1402  * very long, consisting of mostly non-temporary IREs.
1403  * This can happen when the hash function does a bad job
1404  * so that most TCP connections cluster to a specific bucket.
1405  * This "hopefully" should never happen.  It can also
1406  * happen if most TCP connections have very long lives.
1407  * Even with the minimal hash table size of 256, there
1408  * has to be a lot of such connections to make the bucket
1409  * length unreasonably long.  This should probably not
1410  * happen either.  The third can when this can happen is
1411  * when the machine is under attack, such as SYN flooding.
1412  * TCP should already have the proper mechanism to protect
1413  * that.  So we should be safe.
1414  *
1415  * This function is called by ire_add_then_send() after
1416  * a new IRE is added and the packet is sent.
1417  *
1418  * The idle cutoff interval is set to 60s.  It can be
1419  * changed using /etc/system.
1420  */
1421 uint32_t ire_idle_cutoff_interval = 60000;
1422 
1423 static void
1424 ire_cache_cleanup(irb_t *irb, uint32_t threshold, int cnt)
1425 {
1426 	ire_t *ire;
1427 	int tmp_cnt = cnt;
1428 	clock_t cut_off = drv_usectohz(ire_idle_cutoff_interval * 1000);
1429 
1430 	/*
1431 	 * irb is NULL if the IRE is not added to the hash.  This
1432 	 * happens when IRE_MARK_NOADD is set in ire_add_then_send()
1433 	 * and when ires are returned from ire_update_srcif_v4() routine.
1434 	 */
1435 	if (irb == NULL)
1436 		return;
1437 
1438 	IRB_REFHOLD(irb);
1439 	if (irb->irb_tmp_ire_cnt > threshold) {
1440 		for (ire = irb->irb_ire; ire != NULL && tmp_cnt > 0;
1441 		    ire = ire->ire_next) {
1442 			if (ire->ire_marks & IRE_MARK_CONDEMNED)
1443 				continue;
1444 			if (ire->ire_marks & IRE_MARK_TEMPORARY) {
1445 				ASSERT(ire->ire_type == IRE_CACHE);
1446 				ire_delete(ire);
1447 				tmp_cnt--;
1448 			}
1449 		}
1450 	}
1451 	if (irb->irb_ire_cnt - irb->irb_tmp_ire_cnt > threshold) {
1452 		for (ire = irb->irb_ire; ire != NULL && cnt > 0;
1453 		    ire = ire->ire_next) {
1454 			if (ire->ire_marks & IRE_MARK_CONDEMNED ||
1455 			    ire->ire_gateway_addr == 0) {
1456 				continue;
1457 			}
1458 			if ((ire->ire_type == IRE_CACHE) &&
1459 			    (lbolt - ire->ire_last_used_time > cut_off) &&
1460 			    (ire->ire_refcnt == 1)) {
1461 				ire_delete(ire);
1462 				cnt--;
1463 			}
1464 		}
1465 	}
1466 	IRB_REFRELE(irb);
1467 }
1468 
1469 /*
1470  * ire_add_then_send is called when a new IRE has been created in order to
1471  * route an outgoing packet.  Typically, it is called from ip_wput when
1472  * a response comes back down from a resolver.  We add the IRE, and then
1473  * possibly run the packet through ip_wput or ip_rput, as appropriate.
1474  * However, we do not add the newly created IRE in the cache when
1475  * IRE_MARK_NOADD is set in the IRE. IRE_MARK_NOADD is set at
1476  * ip_newroute_ipif(). The ires with IRE_MARK_NOADD and ires returned
1477  * by ire_update_srcif_v4() are ire_refrele'd by ip_wput_ire() and get
1478  * deleted.
1479  * Multirouting support: the packet is silently discarded when the new IRE
1480  * holds the RTF_MULTIRT flag, but is not the first IRE to be added with the
1481  * RTF_MULTIRT flag for the same destination address.
1482  * In this case, we just want to register this additional ire without
1483  * sending the packet, as it has already been replicated through
1484  * existing multirt routes in ip_wput().
1485  */
1486 void
1487 ire_add_then_send(queue_t *q, ire_t *ire, mblk_t *mp)
1488 {
1489 	irb_t *irb;
1490 	boolean_t drop = B_FALSE;
1491 	/* LINTED : set but not used in function */
1492 	boolean_t mctl_present;
1493 	mblk_t *first_mp = NULL;
1494 	mblk_t *save_mp = NULL;
1495 	ire_t *dst_ire;
1496 	ipha_t *ipha;
1497 	ip6_t *ip6h;
1498 
1499 	if (mp != NULL) {
1500 		/*
1501 		 * We first have to retrieve the destination address carried
1502 		 * by the packet.
1503 		 * We can't rely on ire as it can be related to a gateway.
1504 		 * The destination address will help in determining if
1505 		 * other RTF_MULTIRT ires are already registered.
1506 		 *
1507 		 * We first need to know where we are going : v4 or V6.
1508 		 * the ire version is enough, as there is no risk that
1509 		 * we resolve an IPv6 address with an IPv4 ire
1510 		 * or vice versa.
1511 		 */
1512 		if (ire->ire_ipversion == IPV4_VERSION) {
1513 			EXTRACT_PKT_MP(mp, first_mp, mctl_present);
1514 			ipha = (ipha_t *)mp->b_rptr;
1515 			save_mp = mp;
1516 			mp = first_mp;
1517 
1518 			dst_ire = ire_cache_lookup(ipha->ipha_dst,
1519 			    ire->ire_zoneid);
1520 		} else {
1521 			/*
1522 			 * Get a pointer to the beginning of the IPv6 header.
1523 			 * Ignore leading IPsec control mblks.
1524 			 */
1525 			first_mp = mp;
1526 			if (mp->b_datap->db_type == M_CTL) {
1527 				mp = mp->b_cont;
1528 			}
1529 			ip6h = (ip6_t *)mp->b_rptr;
1530 			save_mp = mp;
1531 			mp = first_mp;
1532 			dst_ire = ire_cache_lookup_v6(&ip6h->ip6_dst,
1533 			    ire->ire_zoneid);
1534 		}
1535 		if (dst_ire != NULL) {
1536 			if (dst_ire->ire_flags & RTF_MULTIRT) {
1537 				/*
1538 				 * At least one resolved multirt route
1539 				 * already exists for the destination,
1540 				 * don't sent this packet: either drop it
1541 				 * or complete the pending resolution,
1542 				 * depending on the ire.
1543 				 */
1544 				drop = B_TRUE;
1545 			}
1546 			ip1dbg(("ire_add_then_send: dst_ire %p "
1547 			    "[dst %08x, gw %08x], drop %d\n",
1548 			    (void *)dst_ire,
1549 			    (dst_ire->ire_ipversion == IPV4_VERSION) ? \
1550 				ntohl(dst_ire->ire_addr) : \
1551 				ntohl(V4_PART_OF_V6(dst_ire->ire_addr_v6)),
1552 			    (dst_ire->ire_ipversion == IPV4_VERSION) ? \
1553 				ntohl(dst_ire->ire_gateway_addr) : \
1554 				ntohl(V4_PART_OF_V6(
1555 				    dst_ire->ire_gateway_addr_v6)),
1556 			    drop));
1557 			ire_refrele(dst_ire);
1558 		}
1559 	}
1560 
1561 	if (!(ire->ire_marks & IRE_MARK_NOADD)) {
1562 		/*
1563 		 * Regular packets with cache bound ires and
1564 		 * the packets from ARP response for ires which
1565 		 * belong to the ire_srcif_v4 table, are here.
1566 		 */
1567 		if (ire->ire_in_ill == NULL) {
1568 			/* Add the ire */
1569 			(void) ire_add(&ire, NULL, NULL, NULL);
1570 		} else {
1571 			/*
1572 			 * This must be ARP response for ire in interface based
1573 			 * table. Note that we don't add them in cache table,
1574 			 * instead we update the existing table with dlureq_mp
1575 			 * information. The reverse tunnel ires do not come
1576 			 * here, as reverse tunnel is non-resolver interface.
1577 			 * XXX- another design alternative was to mark the
1578 			 * ires in interface based table with a special mark to
1579 			 * make absolutely sure that we operate in right ires.
1580 			 * This idea was not implemented as part of code review
1581 			 * suggestion, as ire_in_ill suffice to distinguish
1582 			 * between the regular ires and interface based
1583 			 * ires now and thus we save a bit in the ire_marks.
1584 			 */
1585 			ire = ire_update_srcif_v4(ire);
1586 		}
1587 
1588 		if (ire == NULL) {
1589 			mp->b_prev = NULL;
1590 			mp->b_next = NULL;
1591 			MULTIRT_DEBUG_UNTAG(mp);
1592 			freemsg(mp);
1593 			return;
1594 		}
1595 		if (mp == NULL) {
1596 			ire_refrele(ire);	/* Held in ire_add_v4/v6 */
1597 			return;
1598 		}
1599 	}
1600 	if (drop) {
1601 		/*
1602 		 * If we're adding an RTF_MULTIRT ire, the resolution
1603 		 * is over: we just drop the packet.
1604 		 */
1605 		if (ire->ire_flags & RTF_MULTIRT) {
1606 			if (save_mp) {
1607 				save_mp->b_prev = NULL;
1608 				save_mp->b_next = NULL;
1609 			}
1610 			MULTIRT_DEBUG_UNTAG(mp);
1611 			freemsg(mp);
1612 		} else {
1613 			/*
1614 			 * Otherwise, we're adding the ire to a gateway
1615 			 * for a multirt route.
1616 			 * Invoke ip_newroute() to complete the resolution
1617 			 * of the route. We will then come back here and
1618 			 * finally drop this packet in the above code.
1619 			 */
1620 			if (ire->ire_ipversion == IPV4_VERSION) {
1621 				/*
1622 				 * TODO: in order for CGTP to work in non-global
1623 				 * zones, ip_newroute() must create the IRE
1624 				 * cache in the zone indicated by
1625 				 * ire->ire_zoneid.
1626 				 */
1627 				ip_newroute(q, mp, ipha->ipha_dst, 0,
1628 				    (CONN_Q(q) ? Q_TO_CONN(q) : NULL));
1629 			} else {
1630 				ip_newroute_v6(q, mp, &ip6h->ip6_dst, NULL,
1631 				    NULL, ire->ire_zoneid);
1632 			}
1633 		}
1634 
1635 		ire_refrele(ire); /* As done by ire_send(). */
1636 		return;
1637 	}
1638 	/*
1639 	 * Need to remember ire_bucket here as ire_send*() may delete
1640 	 * the ire so we cannot reference it after that.
1641 	 */
1642 	irb = ire->ire_bucket;
1643 	if (ire->ire_ipversion == IPV6_VERSION) {
1644 		ire_send_v6(q, mp, ire);
1645 		/*
1646 		 * Clean up more than 1 IRE so that the clean up does not
1647 		 * need to be done every time when a new IRE is added and
1648 		 * the threshold is reached.
1649 		 */
1650 		ire_cache_cleanup(irb, ip6_ire_max_bucket_cnt, 2);
1651 	} else {
1652 		ire_send(q, mp, ire);
1653 		ire_cache_cleanup(irb, ip_ire_max_bucket_cnt, 2);
1654 	}
1655 }
1656 
1657 /*
1658  * Initialize the ire that is specific to IPv4 part and call
1659  * ire_init_common to finish it.
1660  */
1661 ire_t *
1662 ire_init(ire_t *ire, uchar_t *addr, uchar_t *mask, uchar_t *src_addr,
1663     uchar_t *gateway, uchar_t *in_src_addr, uint_t *max_fragp, mblk_t *fp_mp,
1664     queue_t *rfq, queue_t *stq, ushort_t type, mblk_t *dlureq_mp, ipif_t *ipif,
1665     ill_t *in_ill, ipaddr_t cmask, uint32_t phandle, uint32_t ihandle,
1666     uint32_t flags, const iulp_t *ulp_info)
1667 {
1668 	if (fp_mp != NULL) {
1669 		/*
1670 		 * We can't dupb() here as multiple threads could be
1671 		 * calling dupb on the same mp which is incorrect.
1672 		 * First dupb() should be called only by one thread.
1673 		 */
1674 		fp_mp = copyb(fp_mp);
1675 		if (fp_mp == NULL)
1676 			return (NULL);
1677 	}
1678 
1679 	if (dlureq_mp != NULL) {
1680 		/*
1681 		 * We can't dupb() here as multiple threads could be
1682 		 * calling dupb on the same mp which is incorrect.
1683 		 * First dupb() should be called only by one thread.
1684 		 */
1685 		dlureq_mp = copyb(dlureq_mp);
1686 		if (dlureq_mp == NULL) {
1687 			if (fp_mp != NULL)
1688 				freeb(fp_mp);
1689 			return (NULL);
1690 		}
1691 	}
1692 
1693 	/*
1694 	 * Check that IRE_IF_RESOLVER and IRE_IF_NORESOLVER have a
1695 	 * dlureq_mp which is the ill_resolver_mp for IRE_IF_RESOLVER
1696 	 * and DL_UNITDATA_REQ for IRE_IF_NORESOLVER.
1697 	 */
1698 	if ((type & IRE_INTERFACE) &&
1699 	    dlureq_mp == NULL) {
1700 		ASSERT(fp_mp == NULL);
1701 		ip0dbg(("ire_init: no dlureq_mp\n"));
1702 		return (NULL);
1703 	}
1704 
1705 	BUMP_IRE_STATS(ire_stats_v4, ire_stats_alloced);
1706 
1707 	if (addr != NULL)
1708 		bcopy(addr, &ire->ire_addr, IP_ADDR_LEN);
1709 	if (src_addr != NULL)
1710 		bcopy(src_addr, &ire->ire_src_addr, IP_ADDR_LEN);
1711 	if (mask != NULL) {
1712 		bcopy(mask, &ire->ire_mask, IP_ADDR_LEN);
1713 		ire->ire_masklen = ip_mask_to_plen(ire->ire_mask);
1714 	}
1715 	if (gateway != NULL) {
1716 		bcopy(gateway, &ire->ire_gateway_addr, IP_ADDR_LEN);
1717 	}
1718 	if (in_src_addr != NULL) {
1719 		bcopy(in_src_addr, &ire->ire_in_src_addr, IP_ADDR_LEN);
1720 	}
1721 
1722 	if (type == IRE_CACHE)
1723 		ire->ire_cmask = cmask;
1724 
1725 	ire_init_common(ire, max_fragp, fp_mp, rfq, stq, type, dlureq_mp,
1726 	    ipif, in_ill, phandle, ihandle, flags, IPV4_VERSION, ulp_info);
1727 
1728 	return (ire);
1729 }
1730 
1731 /*
1732  * Similar to ire_create except that it is called only when
1733  * we want to allocate ire as an mblk e.g. we have an external
1734  * resolver ARP.
1735  */
1736 ire_t *
1737 ire_create_mp(uchar_t *addr, uchar_t *mask, uchar_t *src_addr, uchar_t *gateway,
1738     uchar_t *in_src_addr, uint_t max_frag, mblk_t *fp_mp, queue_t *rfq,
1739     queue_t *stq, ushort_t type, mblk_t *dlureq_mp, ipif_t *ipif, ill_t *in_ill,
1740     ipaddr_t cmask, uint32_t phandle, uint32_t ihandle, uint32_t flags,
1741     const iulp_t *ulp_info)
1742 {
1743 	ire_t	*ire;
1744 	ire_t	*ret_ire;
1745 	mblk_t	*mp;
1746 
1747 	/* Allocate the new IRE. */
1748 	mp = allocb(sizeof (ire_t), BPRI_MED);
1749 	if (mp == NULL) {
1750 		ip1dbg(("ire_create_mp: alloc failed\n"));
1751 		return (NULL);
1752 	}
1753 
1754 	ire = (ire_t *)mp->b_rptr;
1755 	mp->b_wptr = (uchar_t *)&ire[1];
1756 
1757 	/* Start clean. */
1758 	*ire = ire_null;
1759 	ire->ire_mp = mp;
1760 	mp->b_datap->db_type = IRE_DB_TYPE;
1761 
1762 	ret_ire = ire_init(ire, addr, mask, src_addr, gateway, in_src_addr,
1763 	    NULL, fp_mp, rfq, stq, type, dlureq_mp, ipif, in_ill, cmask,
1764 	    phandle, ihandle, flags, ulp_info);
1765 
1766 	if (ret_ire == NULL) {
1767 		freeb(ire->ire_mp);
1768 		return (NULL);
1769 	}
1770 	ASSERT(ret_ire == ire);
1771 	/*
1772 	 * ire_max_frag is normally zero here and is atomically set
1773 	 * under the irebucket lock in ire_add_v[46] except for the
1774 	 * case of IRE_MARK_NOADD. In that event the the ire_max_frag
1775 	 * is non-zero here.
1776 	 */
1777 	ire->ire_max_frag = max_frag;
1778 	return (ire);
1779 }
1780 
1781 /*
1782  * ire_create is called to allocate and initialize a new IRE.
1783  *
1784  * NOTE : This is called as writer sometimes though not required
1785  * by this function.
1786  */
1787 ire_t *
1788 ire_create(uchar_t *addr, uchar_t *mask, uchar_t *src_addr, uchar_t *gateway,
1789     uchar_t *in_src_addr, uint_t *max_fragp, mblk_t *fp_mp, queue_t *rfq,
1790     queue_t *stq, ushort_t type, mblk_t *dlureq_mp, ipif_t *ipif, ill_t *in_ill,
1791     ipaddr_t cmask, uint32_t phandle, uint32_t ihandle, uint32_t flags,
1792     const iulp_t *ulp_info)
1793 {
1794 	ire_t	*ire;
1795 	ire_t	*ret_ire;
1796 
1797 	ire = kmem_cache_alloc(ire_cache, KM_NOSLEEP);
1798 	if (ire == NULL) {
1799 		ip1dbg(("ire_create: alloc failed\n"));
1800 		return (NULL);
1801 	}
1802 	*ire = ire_null;
1803 
1804 	ret_ire = ire_init(ire, addr, mask, src_addr, gateway, in_src_addr,
1805 	    max_fragp, fp_mp, rfq, stq, type, dlureq_mp, ipif, in_ill,  cmask,
1806 	    phandle, ihandle, flags, ulp_info);
1807 
1808 	if (ret_ire == NULL) {
1809 		kmem_cache_free(ire_cache, ire);
1810 		return (NULL);
1811 	}
1812 	ASSERT(ret_ire == ire);
1813 	return (ire);
1814 }
1815 
1816 
1817 /*
1818  * Common to IPv4 and IPv6
1819  */
1820 void
1821 ire_init_common(ire_t *ire, uint_t *max_fragp, mblk_t *fp_mp,
1822     queue_t *rfq, queue_t *stq, ushort_t type,
1823     mblk_t *dlureq_mp, ipif_t *ipif, ill_t *in_ill, uint32_t phandle,
1824     uint32_t ihandle, uint32_t flags, uchar_t ipversion,
1825     const iulp_t *ulp_info)
1826 {
1827 	ire->ire_max_fragp = max_fragp;
1828 	ire->ire_frag_flag |= (ip_path_mtu_discovery) ? IPH_DF : 0;
1829 
1830 	ASSERT(fp_mp == NULL || fp_mp->b_datap->db_type == M_DATA);
1831 	if (ipif) {
1832 		if (ipif->ipif_isv6)
1833 			ASSERT(ipversion == IPV6_VERSION);
1834 		else
1835 			ASSERT(ipversion == IPV4_VERSION);
1836 	}
1837 
1838 	ire->ire_fp_mp = fp_mp;
1839 	ire->ire_dlureq_mp = dlureq_mp;
1840 	ire->ire_stq = stq;
1841 	ire->ire_rfq = rfq;
1842 	ire->ire_type = type;
1843 	ire->ire_flags = RTF_UP | flags;
1844 	ire->ire_ident = TICK_TO_MSEC(lbolt);
1845 	bcopy(ulp_info, &ire->ire_uinfo, sizeof (iulp_t));
1846 
1847 	ire->ire_tire_mark = ire->ire_ob_pkt_count + ire->ire_ib_pkt_count;
1848 	ire->ire_last_used_time = lbolt;
1849 	ire->ire_create_time = (uint32_t)gethrestime_sec();
1850 
1851 	/*
1852 	 * If this IRE is an IRE_CACHE, inherit the handles from the
1853 	 * parent IREs. For others in the forwarding table, assign appropriate
1854 	 * new ones.
1855 	 *
1856 	 * The mutex protecting ire_handle is because ire_create is not always
1857 	 * called as a writer.
1858 	 */
1859 	if (ire->ire_type & IRE_OFFSUBNET) {
1860 		mutex_enter(&ire_handle_lock);
1861 		ire->ire_phandle = (uint32_t)ire_handle++;
1862 		mutex_exit(&ire_handle_lock);
1863 	} else if (ire->ire_type & IRE_INTERFACE) {
1864 		mutex_enter(&ire_handle_lock);
1865 		ire->ire_ihandle = (uint32_t)ire_handle++;
1866 		mutex_exit(&ire_handle_lock);
1867 	} else if (ire->ire_type == IRE_CACHE) {
1868 		ire->ire_phandle = phandle;
1869 		ire->ire_ihandle = ihandle;
1870 	}
1871 	ire->ire_in_ill = in_ill;
1872 	ire->ire_ipif = ipif;
1873 	if (ipif != NULL) {
1874 		ire->ire_ipif_seqid = ipif->ipif_seqid;
1875 		ire->ire_zoneid = ipif->ipif_zoneid;
1876 	} else {
1877 		ire->ire_zoneid = GLOBAL_ZONEID;
1878 	}
1879 	ire->ire_ipversion = ipversion;
1880 	ire->ire_refcnt = 1;
1881 	mutex_init(&ire->ire_lock, NULL, MUTEX_DEFAULT, NULL);
1882 
1883 #ifdef IRE_DEBUG
1884 	bzero(ire->ire_trace, sizeof (th_trace_t *) * IP_TR_HASH_MAX);
1885 #endif
1886 }
1887 
1888 /*
1889  * This routine is called repeatedly by ipif_up to create broadcast IREs.
1890  * It is passed a pointer to a slot in an IRE pointer array into which to
1891  * place the pointer to the new IRE, if indeed we create one.  If the
1892  * IRE corresponding to the address passed in would be a duplicate of an
1893  * existing one, we don't create the new one.  irep is incremented before
1894  * return only if we do create a new IRE.  (Always called as writer.)
1895  *
1896  * Note that with the "match_flags" parameter, we can match on either
1897  * a particular logical interface (MATCH_IRE_IPIF) or for all logical
1898  * interfaces for a given physical interface (MATCH_IRE_ILL).  Currently,
1899  * we only create broadcast ire's on a per physical interface basis. If
1900  * someone is going to be mucking with logical interfaces, it is important
1901  * to call "ipif_check_bcast_ires()" to make sure that any change to a
1902  * logical interface will not cause critical broadcast IRE's to be deleted.
1903  */
1904 ire_t **
1905 ire_check_and_create_bcast(ipif_t *ipif, ipaddr_t  addr, ire_t **irep,
1906     int match_flags)
1907 {
1908 	ire_t *ire;
1909 	uint64_t check_flags = IPIF_DEPRECATED | IPIF_NOLOCAL | IPIF_ANYCAST;
1910 
1911 	/*
1912 	 * No broadcast IREs for the LOOPBACK interface
1913 	 * or others such as point to point and IPIF_NOXMIT.
1914 	 */
1915 	if (!(ipif->ipif_flags & IPIF_BROADCAST) ||
1916 	    (ipif->ipif_flags & IPIF_NOXMIT))
1917 		return (irep);
1918 
1919 	/* If this would be a duplicate, don't bother. */
1920 	if ((ire = ire_ctable_lookup(addr, 0, IRE_BROADCAST, ipif,
1921 	    ipif->ipif_zoneid, match_flags)) != NULL) {
1922 		/*
1923 		 * We look for non-deprecated (and non-anycast, non-nolocal)
1924 		 * ipifs as the best choice. ipifs with check_flags matching
1925 		 * (deprecated, etc) are used only if non-deprecated ipifs
1926 		 * are not available. if the existing ire's ipif is deprecated
1927 		 * and the new ipif is non-deprecated, switch to the new ipif
1928 		 */
1929 		if ((!(ire->ire_ipif->ipif_flags & check_flags)) ||
1930 		    (ipif->ipif_flags & check_flags)) {
1931 			ire_refrele(ire);
1932 			return (irep);
1933 		}
1934 		/*
1935 		 * Bcast ires exist in pairs. Both have to be deleted,
1936 		 * Since we are exclusive we can make the above assertion.
1937 		 * The 1st has to be refrele'd since it was ctable_lookup'd.
1938 		 */
1939 		ASSERT(IAM_WRITER_IPIF(ipif));
1940 		ASSERT(ire->ire_next->ire_addr == ire->ire_addr);
1941 		ire_delete(ire->ire_next);
1942 		ire_delete(ire);
1943 		ire_refrele(ire);
1944 	}
1945 
1946 	irep = ire_create_bcast(ipif, addr, irep);
1947 
1948 	return (irep);
1949 }
1950 
1951 uint_t ip_loopback_mtu = IP_LOOPBACK_MTU;
1952 
1953 /*
1954  * This routine is called from ipif_check_bcast_ires and ire_check_bcast.
1955  * It leaves all the verifying and deleting to those routines. So it always
1956  * creates 2 bcast ires and chains them into the ire array passed in.
1957  */
1958 ire_t **
1959 ire_create_bcast(ipif_t *ipif, ipaddr_t  addr, ire_t **irep)
1960 {
1961 	*irep++ = ire_create(
1962 	    (uchar_t *)&addr,			/* dest addr */
1963 	    (uchar_t *)&ip_g_all_ones,		/* mask */
1964 	    (uchar_t *)&ipif->ipif_src_addr,	/* source addr */
1965 	    NULL,				/* no gateway */
1966 	    NULL,				/* no in_src_addr */
1967 	    &ipif->ipif_mtu,			/* max frag */
1968 	    NULL,				/* fast path header */
1969 	    ipif->ipif_rq,			/* recv-from queue */
1970 	    ipif->ipif_wq,			/* send-to queue */
1971 	    IRE_BROADCAST,
1972 	    ipif->ipif_bcast_mp,		/* xmit header */
1973 	    ipif,
1974 	    NULL,
1975 	    0,
1976 	    0,
1977 	    0,
1978 	    0,
1979 	    &ire_uinfo_null);
1980 
1981 	*irep++ = ire_create(
1982 		(uchar_t *)&addr,		 /* dest address */
1983 		(uchar_t *)&ip_g_all_ones,	 /* mask */
1984 		(uchar_t *)&ipif->ipif_src_addr, /* source address */
1985 		NULL,				 /* no gateway */
1986 		NULL,				 /* no in_src_addr */
1987 		&ip_loopback_mtu,		 /* max frag size */
1988 		NULL,				 /* Fast Path header */
1989 		ipif->ipif_rq,			 /* recv-from queue */
1990 		NULL,				 /* no send-to queue */
1991 		IRE_BROADCAST,		/* Needed for fanout in wput */
1992 		NULL,
1993 		ipif,
1994 		NULL,
1995 		0,
1996 		0,
1997 		0,
1998 		0,
1999 		&ire_uinfo_null);
2000 
2001 	return (irep);
2002 }
2003 
2004 /*
2005  * ire_walk routine to delete or update any IRE_CACHE that might contain
2006  * stale information.
2007  * The flags state which entries to delete or update.
2008  * Garbage collection is done separately using kmem alloc callbacks to
2009  * ip_trash_ire_reclaim.
2010  * Used for both IPv4 and IPv6. However, IPv6 only uses FLUSH_MTU_TIME
2011  * since other stale information is cleaned up using NUD.
2012  */
2013 void
2014 ire_expire(ire_t *ire, char *arg)
2015 {
2016 	int flush_flags = (int)(uintptr_t)arg;
2017 	ill_t	*stq_ill;
2018 
2019 	if ((flush_flags & FLUSH_REDIRECT_TIME) &&
2020 	    ire->ire_type == IRE_HOST_REDIRECT) {
2021 		/* Make sure we delete the corresponding IRE_CACHE */
2022 		ip1dbg(("ire_expire: all redirects\n"));
2023 		ip_rts_rtmsg(RTM_DELETE, ire, 0);
2024 		ire_delete(ire);
2025 		return;
2026 	}
2027 	if (ire->ire_type != IRE_CACHE)
2028 		return;
2029 
2030 	if (flush_flags & FLUSH_ARP_TIME) {
2031 		/*
2032 		 * Remove all IRE_CACHE.
2033 		 * Verify that create time is more than
2034 		 * ip_ire_arp_interval milliseconds ago.
2035 		 */
2036 		if (((uint32_t)gethrestime_sec() - ire->ire_create_time) *
2037 		    MILLISEC > ip_ire_arp_interval) {
2038 			ip1dbg(("ire_expire: all IRE_CACHE\n"));
2039 			ire_delete(ire);
2040 			return;
2041 		}
2042 	}
2043 
2044 	if (ip_path_mtu_discovery && (flush_flags & FLUSH_MTU_TIME) &&
2045 	    (ire->ire_ipif != NULL)) {
2046 		/* Increase pmtu if it is less than the interface mtu */
2047 		mutex_enter(&ire->ire_lock);
2048 		/*
2049 		 * If the ipif is a vni (whose mtu is 0, since it's virtual)
2050 		 * get the mtu from the sending interfaces' ipif
2051 		 */
2052 		if (IS_VNI(ire->ire_ipif->ipif_ill)) {
2053 			stq_ill = ire->ire_stq->q_ptr;
2054 			ire->ire_max_frag = MIN(stq_ill->ill_ipif->ipif_mtu,
2055 			    IP_MAXPACKET);
2056 		} else {
2057 			ire->ire_max_frag = MIN(ire->ire_ipif->ipif_mtu,
2058 			    IP_MAXPACKET);
2059 		}
2060 		ire->ire_frag_flag |= IPH_DF;
2061 		mutex_exit(&ire->ire_lock);
2062 	}
2063 }
2064 
2065 /*
2066  * Do fast path probing if necessary.
2067  */
2068 static void
2069 ire_fastpath(ire_t *ire)
2070 {
2071 	ill_t	*ill;
2072 	int res;
2073 
2074 	if (ire->ire_fp_mp != NULL || ire->ire_dlureq_mp == NULL ||
2075 	    (ire->ire_stq == NULL)) {
2076 		/*
2077 		 * Already contains fastpath info or
2078 		 * doesn't have DL_UNITDATA_REQ header
2079 		 * or is a loopback broadcast ire i.e. no stq.
2080 		 */
2081 		return;
2082 	}
2083 	ill = ire_to_ill(ire);
2084 	if (ill == NULL)
2085 		return;
2086 	ire_fastpath_list_add(ill, ire);
2087 	res = ill_fastpath_probe(ill, ire->ire_dlureq_mp);
2088 	/*
2089 	 * EAGAIN is an indication of a transient error
2090 	 * i.e. allocation failure etc. leave the ire in the list it will
2091 	 * be updated when another probe happens for another ire if not
2092 	 * it will be taken out of the list when the ire is deleted.
2093 	 */
2094 	if (res != 0 && res != EAGAIN)
2095 		ire_fastpath_list_delete(ill, ire);
2096 }
2097 
2098 /*
2099  * Update all IRE's that are not in fastpath mode and
2100  * have an dlureq_mp that matches mp. mp->b_cont contains
2101  * the fastpath header.
2102  *
2103  * Returns TRUE if entry should be dequeued, or FALSE otherwise.
2104  */
2105 boolean_t
2106 ire_fastpath_update(ire_t *ire, void *arg)
2107 {
2108 	mblk_t 	*mp, *fp_mp;
2109 	uchar_t 	*up, *up2;
2110 	ptrdiff_t	cmplen;
2111 
2112 	ASSERT((ire->ire_type & (IRE_CACHE | IRE_BROADCAST |
2113 	    IRE_MIPRTUN)) != 0);
2114 
2115 	/*
2116 	 * Already contains fastpath info or doesn't have
2117 	 * DL_UNITDATA_REQ header.
2118 	 */
2119 	if (ire->ire_fp_mp != NULL || ire->ire_dlureq_mp == NULL)
2120 		return (B_TRUE);
2121 
2122 	ip2dbg(("ire_fastpath_update: trying\n"));
2123 	mp = arg;
2124 	up = mp->b_rptr;
2125 	cmplen = mp->b_wptr - up;
2126 	/* Serialize multiple fast path updates */
2127 	mutex_enter(&ire->ire_lock);
2128 	up2 = ire->ire_dlureq_mp->b_rptr;
2129 	ASSERT(cmplen >= 0);
2130 	if (ire->ire_dlureq_mp->b_wptr - up2 != cmplen ||
2131 	    bcmp(up, up2, cmplen) != 0) {
2132 		mutex_exit(&ire->ire_lock);
2133 		/*
2134 		 * Don't take the ire off the fastpath list yet,
2135 		 * since the response may come later.
2136 		 */
2137 		return (B_FALSE);
2138 	}
2139 	/* Matched - install mp as the ire_fp_mp */
2140 	ip1dbg(("ire_fastpath_update: match\n"));
2141 	fp_mp = dupb(mp->b_cont);
2142 	if (fp_mp) {
2143 		/*
2144 		 * We checked ire_fp_mp above. Check it again with the
2145 		 * lock. Update fp_mp only if it has not been done
2146 		 * already.
2147 		 */
2148 		if (ire->ire_fp_mp == NULL) {
2149 			/*
2150 			 * ire_ll_hdr_length is just an optimization to
2151 			 * store the length. It is used to return the
2152 			 * fast path header length to the upper layers.
2153 			 */
2154 			ire->ire_fp_mp = fp_mp;
2155 			ire->ire_ll_hdr_length =
2156 			    (uint_t)(fp_mp->b_wptr - fp_mp->b_rptr);
2157 		} else {
2158 			freeb(fp_mp);
2159 		}
2160 	}
2161 	mutex_exit(&ire->ire_lock);
2162 	return (B_TRUE);
2163 }
2164 
2165 /*
2166  * This function handles the DL_NOTE_FASTPATH_FLUSH notification from the
2167  * driver.
2168  */
2169 /* ARGSUSED */
2170 void
2171 ire_fastpath_flush(ire_t *ire, void *arg)
2172 {
2173 	ill_t	*ill;
2174 	int	res;
2175 
2176 	/* No fastpath info? */
2177 	if (ire->ire_fp_mp == NULL || ire->ire_dlureq_mp == NULL)
2178 		return;
2179 
2180 	/*
2181 	 * Just remove the IRE if it is for non-broadcast dest.  Then
2182 	 * we will create another one which will have the correct
2183 	 * fastpath info.
2184 	 */
2185 	switch (ire->ire_type) {
2186 	case IRE_CACHE:
2187 		ire_delete(ire);
2188 		break;
2189 	case IRE_MIPRTUN:
2190 	case IRE_BROADCAST:
2191 		/*
2192 		 * We can't delete the ire since it is difficult to
2193 		 * recreate these ire's without going through the
2194 		 * ipif down/up dance. The ire_fp_mp is protected by the
2195 		 * ire_lock in the case of IRE_MIPRTUN and IRE_BROADCAST.
2196 		 * All access to ire_fp_mp in the case of these 2 ire types
2197 		 * is protected by ire_lock.
2198 		 */
2199 		mutex_enter(&ire->ire_lock);
2200 		if (ire->ire_fp_mp != NULL) {
2201 			freeb(ire->ire_fp_mp);
2202 			ire->ire_fp_mp = NULL;
2203 			mutex_exit(&ire->ire_lock);
2204 			/*
2205 			 * No fastpath probe if there is no stq i.e.
2206 			 * i.e. the case of loopback broadcast ire.
2207 			 */
2208 			if (ire->ire_stq == NULL)
2209 				break;
2210 			ill = (ill_t *)((ire->ire_stq)->q_ptr);
2211 			ire_fastpath_list_add(ill, ire);
2212 			res = ill_fastpath_probe(ill, ire->ire_dlureq_mp);
2213 			/*
2214 			 * EAGAIN is an indication of a transient error
2215 			 * i.e. allocation failure etc. leave the ire in the
2216 			 * list it will be updated when another probe happens
2217 			 * for another ire if not it will be taken out of the
2218 			 * list when the ire is deleted.
2219 			 */
2220 			if (res != 0 && res != EAGAIN)
2221 				ire_fastpath_list_delete(ill, ire);
2222 		} else {
2223 			mutex_exit(&ire->ire_lock);
2224 		}
2225 		break;
2226 	default:
2227 		/* This should not happen! */
2228 		ip0dbg(("ire_fastpath_flush: Wrong ire type %s\n",
2229 		    ip_nv_lookup(ire_nv_tbl, (int)ire->ire_type)));
2230 		break;
2231 	}
2232 }
2233 
2234 /*
2235  * Drain the list of ire's waiting for fastpath response.
2236  */
2237 void
2238 ire_fastpath_list_dispatch(ill_t *ill, boolean_t (*func)(ire_t *, void *),
2239     void *arg)
2240 {
2241 	ire_t	 *next_ire;
2242 	ire_t	 *current_ire;
2243 	ire_t	 *first_ire;
2244 	ire_t	 *prev_ire = NULL;
2245 
2246 	ASSERT(ill != NULL);
2247 
2248 	mutex_enter(&ill->ill_lock);
2249 	first_ire = current_ire = (ire_t *)ill->ill_fastpath_list;
2250 	while (current_ire != (ire_t *)&ill->ill_fastpath_list) {
2251 		next_ire = current_ire->ire_fastpath;
2252 		/*
2253 		 * Take it off the list if we're flushing, or if the callback
2254 		 * routine tells us to do so.  Otherwise, leave the ire in the
2255 		 * fastpath list to handle any pending response from the lower
2256 		 * layer.  We can't drain the list when the callback routine
2257 		 * comparison failed, because the response is asynchronous in
2258 		 * nature, and may not arrive in the same order as the list
2259 		 * insertion.
2260 		 */
2261 		if (func == NULL || func(current_ire, arg)) {
2262 			current_ire->ire_fastpath = NULL;
2263 			if (current_ire == first_ire)
2264 				ill->ill_fastpath_list = first_ire = next_ire;
2265 			else
2266 				prev_ire->ire_fastpath = next_ire;
2267 		} else {
2268 			/* previous element that is still in the list */
2269 			prev_ire = current_ire;
2270 		}
2271 		current_ire = next_ire;
2272 	}
2273 	mutex_exit(&ill->ill_lock);
2274 }
2275 
2276 /*
2277  * Add ire to the ire fastpath list.
2278  */
2279 static void
2280 ire_fastpath_list_add(ill_t *ill, ire_t *ire)
2281 {
2282 	ASSERT(ill != NULL);
2283 	ASSERT(ire->ire_stq != NULL);
2284 
2285 	rw_enter(&ire->ire_bucket->irb_lock, RW_READER);
2286 	mutex_enter(&ill->ill_lock);
2287 
2288 	/*
2289 	 * if ire has not been deleted and
2290 	 * is not already in the list add it.
2291 	 */
2292 	if (((ire->ire_marks & IRE_MARK_CONDEMNED) == 0) &&
2293 	    (ire->ire_fastpath == NULL)) {
2294 		ire->ire_fastpath = (ire_t *)ill->ill_fastpath_list;
2295 		ill->ill_fastpath_list = ire;
2296 	}
2297 
2298 	mutex_exit(&ill->ill_lock);
2299 	rw_exit(&ire->ire_bucket->irb_lock);
2300 }
2301 
2302 /*
2303  * remove ire from the ire fastpath list.
2304  */
2305 void
2306 ire_fastpath_list_delete(ill_t *ill, ire_t *ire)
2307 {
2308 	ire_t	*ire_ptr;
2309 
2310 	ASSERT(ire->ire_stq != NULL && ill != NULL);
2311 
2312 	mutex_enter(&ill->ill_lock);
2313 	if (ire->ire_fastpath == NULL)
2314 		goto done;
2315 
2316 	ASSERT(ill->ill_fastpath_list != &ill->ill_fastpath_list);
2317 
2318 	if (ill->ill_fastpath_list == ire) {
2319 		ill->ill_fastpath_list = ire->ire_fastpath;
2320 	} else {
2321 		ire_ptr = ill->ill_fastpath_list;
2322 		while (ire_ptr != (ire_t *)&ill->ill_fastpath_list) {
2323 			if (ire_ptr->ire_fastpath == ire) {
2324 				ire_ptr->ire_fastpath = ire->ire_fastpath;
2325 				break;
2326 			}
2327 			ire_ptr = ire_ptr->ire_fastpath;
2328 		}
2329 	}
2330 	ire->ire_fastpath = NULL;
2331 done:
2332 	mutex_exit(&ill->ill_lock);
2333 }
2334 
2335 
2336 /*
2337  * Find an IRE_INTERFACE for the multicast group.
2338  * Allows different routes for multicast addresses
2339  * in the unicast routing table (akin to 224.0.0.0 but could be more specific)
2340  * which point at different interfaces. This is used when IP_MULTICAST_IF
2341  * isn't specified (when sending) and when IP_ADD_MEMBERSHIP doesn't
2342  * specify the interface to join on.
2343  *
2344  * Supports IP_BOUND_IF by following the ipif/ill when recursing.
2345  */
2346 ire_t *
2347 ire_lookup_multi(ipaddr_t group, zoneid_t zoneid)
2348 {
2349 	ire_t	*ire;
2350 	ipif_t	*ipif = NULL;
2351 	int	match_flags = MATCH_IRE_TYPE;
2352 	ipaddr_t gw_addr;
2353 
2354 	ire = ire_ftable_lookup(group, 0, 0, 0, NULL, NULL, zoneid,
2355 	    0, MATCH_IRE_DEFAULT);
2356 
2357 	/* We search a resolvable ire in case of multirouting. */
2358 	if ((ire != NULL) && (ire->ire_flags & RTF_MULTIRT)) {
2359 		ire_t *cire = NULL;
2360 		/*
2361 		 * If the route is not resolvable, the looked up ire
2362 		 * may be changed here. In that case, ire_multirt_lookup()
2363 		 * IRE_REFRELE the original ire and change it.
2364 		 */
2365 		(void) ire_multirt_lookup(&cire, &ire, MULTIRT_CACHEGW);
2366 		if (cire != NULL)
2367 			ire_refrele(cire);
2368 	}
2369 	if (ire == NULL)
2370 		return (NULL);
2371 	/*
2372 	 * Make sure we follow ire_ipif.
2373 	 *
2374 	 * We need to determine the interface route through
2375 	 * which the gateway will be reached. We don't really
2376 	 * care which interface is picked if the interface is
2377 	 * part of a group.
2378 	 */
2379 	if (ire->ire_ipif != NULL) {
2380 		ipif = ire->ire_ipif;
2381 		match_flags |= MATCH_IRE_ILL_GROUP;
2382 	}
2383 
2384 	switch (ire->ire_type) {
2385 	case IRE_DEFAULT:
2386 	case IRE_PREFIX:
2387 	case IRE_HOST:
2388 		gw_addr = ire->ire_gateway_addr;
2389 		ire_refrele(ire);
2390 		ire = ire_ftable_lookup(gw_addr, 0, 0,
2391 		    IRE_INTERFACE, ipif, NULL, zoneid, 0,
2392 		    match_flags);
2393 		return (ire);
2394 	case IRE_IF_NORESOLVER:
2395 	case IRE_IF_RESOLVER:
2396 		return (ire);
2397 	default:
2398 		ire_refrele(ire);
2399 		return (NULL);
2400 	}
2401 }
2402 
2403 /*
2404  * Return any local address.  We use this to target ourselves
2405  * when the src address was specified as 'default'.
2406  * Preference for IRE_LOCAL entries.
2407  */
2408 ire_t *
2409 ire_lookup_local(zoneid_t zoneid)
2410 {
2411 	ire_t	*ire;
2412 	irb_t	*irb;
2413 	ire_t	*maybe = NULL;
2414 	int i;
2415 
2416 	for (i = 0; i < ip_cache_table_size;  i++) {
2417 		irb = &ip_cache_table[i];
2418 		if (irb->irb_ire == NULL)
2419 			continue;
2420 		rw_enter(&irb->irb_lock, RW_READER);
2421 		for (ire = irb->irb_ire; ire != NULL; ire = ire->ire_next) {
2422 			if ((ire->ire_marks & IRE_MARK_CONDEMNED) ||
2423 			    ire->ire_zoneid != zoneid)
2424 				continue;
2425 			switch (ire->ire_type) {
2426 			case IRE_LOOPBACK:
2427 				if (maybe == NULL) {
2428 					IRE_REFHOLD(ire);
2429 					maybe = ire;
2430 				}
2431 				break;
2432 			case IRE_LOCAL:
2433 				if (maybe != NULL) {
2434 					ire_refrele(maybe);
2435 				}
2436 				IRE_REFHOLD(ire);
2437 				rw_exit(&irb->irb_lock);
2438 				return (ire);
2439 			}
2440 		}
2441 		rw_exit(&irb->irb_lock);
2442 	}
2443 	return (maybe);
2444 }
2445 
2446 /*
2447  * If the specified IRE is associated with a particular ILL, return
2448  * that ILL pointer (May be called as writer.).
2449  *
2450  * NOTE : This is not a generic function that can be used always.
2451  * This function always returns the ill of the outgoing packets
2452  * if this ire is used.
2453  */
2454 ill_t *
2455 ire_to_ill(ire_t *ire)
2456 {
2457 	ill_t *ill = NULL;
2458 
2459 	/*
2460 	 * 1) For an IRE_CACHE, ire_ipif is the one where it obtained
2461 	 *    the source address from. ire_stq is the one where the
2462 	 *    packets will be sent out on. We return that here.
2463 	 *
2464 	 * 2) IRE_BROADCAST normally has a loopback and a non-loopback
2465 	 *    copy and they always exist next to each other with loopback
2466 	 *    copy being the first one. If we are called on the non-loopback
2467 	 *    copy, return the one pointed by ire_stq. If it was called on
2468 	 *    a loopback copy, we still return the one pointed by the next
2469 	 *    ire's ire_stq pointer i.e the one pointed by the non-loopback
2470 	 *    copy. We don't want use ire_ipif as it might represent the
2471 	 *    source address (if we borrow source addresses for
2472 	 *    IRE_BROADCASTS in the future).
2473 	 *    However if an interface is currently coming up, the above
2474 	 *    condition may not hold during that period since the ires
2475 	 *    are added one at a time. Thus one of the pair could have been
2476 	 *    added and the other not yet added.
2477 	 * 3) For all others return the ones pointed by ire_ipif->ipif_ill.
2478 	 */
2479 
2480 	if (ire->ire_type == IRE_CACHE) {
2481 		ill = (ill_t *)ire->ire_stq->q_ptr;
2482 	} else if (ire->ire_type == IRE_BROADCAST) {
2483 		if (ire->ire_stq != NULL) {
2484 			ill = (ill_t *)ire->ire_stq->q_ptr;
2485 		} else {
2486 			ire_t  *ire_next;
2487 
2488 			ire_next = ire->ire_next;
2489 			if (ire_next != NULL &&
2490 			    ire_next->ire_type == IRE_BROADCAST &&
2491 			    ire_next->ire_addr == ire->ire_addr &&
2492 			    ire_next->ire_ipif == ire->ire_ipif) {
2493 				ill = (ill_t *)ire_next->ire_stq->q_ptr;
2494 			}
2495 		}
2496 	} else if (ire->ire_ipif != NULL) {
2497 		ill = ire->ire_ipif->ipif_ill;
2498 	}
2499 	return (ill);
2500 }
2501 
2502 /* Arrange to call the specified function for every IRE in the world. */
2503 void
2504 ire_walk(pfv_t func, char *arg)
2505 {
2506 	ire_walk_ipvers(func, arg, 0, ALL_ZONES);
2507 }
2508 
2509 void
2510 ire_walk_v4(pfv_t func, char *arg, zoneid_t zoneid)
2511 {
2512 	ire_walk_ipvers(func, arg, IPV4_VERSION, zoneid);
2513 }
2514 
2515 void
2516 ire_walk_v6(pfv_t func, char *arg, zoneid_t zoneid)
2517 {
2518 	ire_walk_ipvers(func, arg, IPV6_VERSION, zoneid);
2519 }
2520 
2521 /*
2522  * Walk a particular version. version == 0 means both v4 and v6.
2523  */
2524 static void
2525 ire_walk_ipvers(pfv_t func, char *arg, uchar_t vers, zoneid_t zoneid)
2526 {
2527 	if (vers != IPV6_VERSION) {
2528 		ire_walk_ill_tables(0, 0, func, arg, IP_MASK_TABLE_SIZE,
2529 		    ip_ftable_hash_size, ip_forwarding_table,
2530 		    ip_cache_table_size, ip_cache_table, NULL, zoneid);
2531 	}
2532 	if (vers != IPV4_VERSION) {
2533 		ire_walk_ill_tables(0, 0, func, arg, IP6_MASK_TABLE_SIZE,
2534 		    ip6_ftable_hash_size, ip_forwarding_table_v6,
2535 		    ip6_cache_table_size, ip_cache_table_v6, NULL, zoneid);
2536 	}
2537 }
2538 
2539 /*
2540  * Arrange to call the specified
2541  * function for every IRE that matches the ill.
2542  */
2543 void
2544 ire_walk_ill(uint_t match_flags, uint_t ire_type, pfv_t func, char *arg,
2545     ill_t *ill)
2546 {
2547 	ire_walk_ill_ipvers(match_flags, ire_type, func, arg, 0, ill);
2548 }
2549 
2550 void
2551 ire_walk_ill_v4(uint_t match_flags, uint_t ire_type, pfv_t func, char *arg,
2552     ill_t *ill)
2553 {
2554 	ire_walk_ill_ipvers(match_flags, ire_type, func, arg, IPV4_VERSION,
2555 	    ill);
2556 }
2557 
2558 void
2559 ire_walk_ill_v6(uint_t match_flags, uint_t ire_type, pfv_t func, char *arg,
2560     ill_t *ill)
2561 {
2562 	ire_walk_ill_ipvers(match_flags, ire_type, func, arg, IPV6_VERSION,
2563 	    ill);
2564 }
2565 
2566 /*
2567  * Walk a particular ill and version. version == 0 means both v4 and v6.
2568  */
2569 static void
2570 ire_walk_ill_ipvers(uint_t match_flags, uint_t ire_type, pfv_t func,
2571     char *arg, uchar_t vers, ill_t *ill)
2572 {
2573 	if (vers != IPV6_VERSION) {
2574 		ire_walk_ill_tables(match_flags, ire_type, func, arg,
2575 		    IP_MASK_TABLE_SIZE, ip_ftable_hash_size,
2576 		    ip_forwarding_table, ip_cache_table_size,
2577 		    ip_cache_table, ill, ALL_ZONES);
2578 	}
2579 	if (vers != IPV4_VERSION) {
2580 		ire_walk_ill_tables(match_flags, ire_type, func, arg,
2581 		    IP6_MASK_TABLE_SIZE, ip6_ftable_hash_size,
2582 		    ip_forwarding_table_v6, ip6_cache_table_size,
2583 		    ip_cache_table_v6, ill, ALL_ZONES);
2584 	}
2585 }
2586 
2587 static boolean_t
2588 ire_walk_ill_match(uint_t match_flags, uint_t ire_type, ire_t *ire,
2589     ill_t *ill, zoneid_t zoneid)
2590 {
2591 	ill_t *ire_stq_ill = NULL;
2592 	ill_t *ire_ipif_ill = NULL;
2593 	ill_group_t *ire_ill_group = NULL;
2594 
2595 	ASSERT(match_flags != 0 || zoneid != ALL_ZONES);
2596 	/*
2597 	 * 1) MATCH_IRE_WQ : Used specifically to match on ire_stq.
2598 	 *    The fast path update uses this to make sure it does not
2599 	 *    update the fast path header of interface X with the fast
2600 	 *    path updates it recieved on interface Y.  It is similar
2601 	 *    in handling DL_NOTE_FASTPATH_FLUSH.
2602 	 *
2603 	 * 2) MATCH_IRE_ILL/MATCH_IRE_ILL_GROUP : We match both on ill
2604 	 *    pointed by ire_stq and ire_ipif. Only in the case of
2605 	 *    IRE_CACHEs can ire_stq and ire_ipif be pointing to
2606 	 *    different ills. But we want to keep this function generic
2607 	 *    enough for future use. So, we always try to match on both.
2608 	 *    The only caller of this function ire_walk_ill_tables, will
2609 	 *    call "func" after we return from this function. We expect
2610 	 *    "func" to do the right filtering of ires in this case.
2611 	 *
2612 	 * NOTE : In the case of MATCH_IRE_ILL_GROUP, groups
2613 	 * pointed by ire_stq and ire_ipif should always be the same.
2614 	 * So, we just match on only one of them.
2615 	 */
2616 	if (match_flags & (MATCH_IRE_ILL|MATCH_IRE_ILL_GROUP)) {
2617 		if (ire->ire_stq != NULL)
2618 			ire_stq_ill = (ill_t *)ire->ire_stq->q_ptr;
2619 		if (ire->ire_ipif != NULL)
2620 			ire_ipif_ill = ire->ire_ipif->ipif_ill;
2621 		if (ire_stq_ill != NULL)
2622 			ire_ill_group = ire_stq_ill->ill_group;
2623 		if ((ire_ill_group == NULL) && (ire_ipif_ill != NULL))
2624 			ire_ill_group = ire_ipif_ill->ill_group;
2625 	}
2626 
2627 	if (zoneid != ALL_ZONES) {
2628 		/*
2629 		 * We're walking the IREs for a specific zone. The only relevant
2630 		 * IREs are:
2631 		 * - all IREs with a matching ire_zoneid
2632 		 * - all IRE_OFFSUBNETs as they're shared across all zones
2633 		 * - IRE_INTERFACE IREs for interfaces with a usable source addr
2634 		 *   with a matching zone
2635 		 * - IRE_DEFAULTs with a gateway reachable from the zone
2636 		 * We should really match on IRE_OFFSUBNETs and IRE_DEFAULTs
2637 		 * using the same rule; but the above rules are consistent with
2638 		 * the behavior of ire_ftable_lookup[_v6]() so that all the
2639 		 * routes that can be matched during lookup are also matched
2640 		 * here.
2641 		 */
2642 		if (zoneid != ire->ire_zoneid) {
2643 			/*
2644 			 * Note, IRE_INTERFACE can have the stq as NULL. For
2645 			 * example, if the default multicast route is tied to
2646 			 * the loopback address.
2647 			 */
2648 			if ((ire->ire_type & IRE_INTERFACE) &&
2649 			    (ire->ire_stq != NULL)) {
2650 				ire_stq_ill = (ill_t *)ire->ire_stq->q_ptr;
2651 				if (ire->ire_ipversion == IPV4_VERSION) {
2652 					if (!ipif_usesrc_avail(ire_stq_ill,
2653 					    zoneid))
2654 						/* No usable src addr in zone */
2655 						return (B_FALSE);
2656 				} else if (ire_stq_ill->ill_usesrc_ifindex
2657 				    != 0) {
2658 					/*
2659 					 * For IPv6 use ipif_select_source_v6()
2660 					 * so the right scope selection is done
2661 					 */
2662 					ipif_t *src_ipif;
2663 					src_ipif =
2664 					    ipif_select_source_v6(ire_stq_ill,
2665 					    &ire->ire_addr_v6, B_FALSE,
2666 					    IPV6_PREFER_SRC_DEFAULT,
2667 					    zoneid);
2668 					if (src_ipif != NULL) {
2669 						ipif_refrele(src_ipif);
2670 					} else {
2671 						return (B_FALSE);
2672 					}
2673 				} else {
2674 					return (B_FALSE);
2675 				}
2676 
2677 			} else if (!(ire->ire_type & IRE_OFFSUBNET)) {
2678 				return (B_FALSE);
2679 			}
2680 		}
2681 
2682 		/*
2683 		 * Match all default routes from the global zone, irrespective
2684 		 * of reachability.
2685 		 */
2686 		if (ire->ire_type == IRE_DEFAULT && zoneid != GLOBAL_ZONEID) {
2687 			int ire_match_flags = 0;
2688 			in6_addr_t gw_addr_v6;
2689 			ire_t *rire;
2690 
2691 			if (ire->ire_ipif != NULL) {
2692 				ire_match_flags |= MATCH_IRE_ILL_GROUP;
2693 			}
2694 			if (ire->ire_ipversion == IPV4_VERSION) {
2695 				rire = ire_route_lookup(ire->ire_gateway_addr,
2696 				    0, 0, 0, ire->ire_ipif, NULL, zoneid,
2697 				    ire_match_flags);
2698 			} else {
2699 				ASSERT(ire->ire_ipversion == IPV6_VERSION);
2700 				mutex_enter(&ire->ire_lock);
2701 				gw_addr_v6 = ire->ire_gateway_addr_v6;
2702 				mutex_exit(&ire->ire_lock);
2703 				rire = ire_route_lookup_v6(&gw_addr_v6,
2704 				    NULL, NULL, 0, ire->ire_ipif, NULL, zoneid,
2705 				    ire_match_flags);
2706 			}
2707 			if (rire == NULL) {
2708 				return (B_FALSE);
2709 			}
2710 			ire_refrele(rire);
2711 		}
2712 	}
2713 
2714 	if (((!(match_flags & MATCH_IRE_TYPE)) ||
2715 		(ire->ire_type & ire_type)) &&
2716 	    ((!(match_flags & MATCH_IRE_WQ)) ||
2717 		(ire->ire_stq == ill->ill_wq)) &&
2718 	    ((!(match_flags & MATCH_IRE_ILL)) ||
2719 		(ire_stq_ill == ill || ire_ipif_ill == ill)) &&
2720 	    ((!(match_flags & MATCH_IRE_ILL_GROUP)) ||
2721 		(ire_stq_ill == ill) || (ire_ipif_ill == ill) ||
2722 		(ire_ill_group != NULL &&
2723 		ire_ill_group == ill->ill_group))) {
2724 		return (B_TRUE);
2725 	}
2726 	return (B_FALSE);
2727 }
2728 
2729 /*
2730  * Walk the ftable and the ctable entries that match the ill.
2731  */
2732 static void
2733 ire_walk_ill_tables(uint_t match_flags, uint_t ire_type, pfv_t func,
2734     char *arg, size_t ftbl_sz, size_t htbl_sz, irb_t **ipftbl,
2735     size_t ctbl_sz, irb_t *ipctbl, ill_t *ill, zoneid_t zoneid)
2736 {
2737 	irb_t	*irb_ptr;
2738 	irb_t	*irb;
2739 	ire_t	*ire;
2740 	int i, j;
2741 	boolean_t ret;
2742 
2743 	ASSERT((!(match_flags & (MATCH_IRE_WQ | MATCH_IRE_ILL |
2744 	    MATCH_IRE_ILL_GROUP))) || (ill != NULL));
2745 	ASSERT(!(match_flags & MATCH_IRE_TYPE) || (ire_type != 0));
2746 	/*
2747 	 * Optimize by not looking at the forwarding table if there
2748 	 * is a MATCH_IRE_TYPE specified with no IRE_FORWARDTABLE
2749 	 * specified in ire_type.
2750 	 */
2751 	if (!(match_flags & MATCH_IRE_TYPE) ||
2752 	    ((ire_type & IRE_FORWARDTABLE) != 0)) {
2753 		for (i = (ftbl_sz - 1);  i >= 0; i--) {
2754 			if ((irb_ptr = ipftbl[i]) == NULL)
2755 				continue;
2756 			for (j = 0; j < htbl_sz; j++) {
2757 				irb = &irb_ptr[j];
2758 				if (irb->irb_ire == NULL)
2759 					continue;
2760 				IRB_REFHOLD(irb);
2761 				for (ire = irb->irb_ire; ire != NULL;
2762 				    ire = ire->ire_next) {
2763 					if (match_flags == 0 &&
2764 					    zoneid == ALL_ZONES) {
2765 						ret = B_TRUE;
2766 					} else {
2767 						ret = ire_walk_ill_match(
2768 						    match_flags, ire_type,
2769 						    ire, ill, zoneid);
2770 					}
2771 					if (ret)
2772 						(*func)(ire, arg);
2773 				}
2774 				IRB_REFRELE(irb);
2775 			}
2776 		}
2777 	}
2778 
2779 	/*
2780 	 * Optimize by not looking at the cache table if there
2781 	 * is a MATCH_IRE_TYPE specified with no IRE_CACHETABLE
2782 	 * specified in ire_type.
2783 	 */
2784 	if (!(match_flags & MATCH_IRE_TYPE) ||
2785 	    ((ire_type & IRE_CACHETABLE) != 0)) {
2786 		for (i = 0; i < ctbl_sz;  i++) {
2787 			irb = &ipctbl[i];
2788 			if (irb->irb_ire == NULL)
2789 				continue;
2790 			IRB_REFHOLD(irb);
2791 			for (ire = irb->irb_ire; ire != NULL;
2792 			    ire = ire->ire_next) {
2793 				if (match_flags == 0 && zoneid == ALL_ZONES) {
2794 					ret = B_TRUE;
2795 				} else {
2796 					ret = ire_walk_ill_match(
2797 					    match_flags, ire_type,
2798 					    ire, ill, zoneid);
2799 				}
2800 				if (ret)
2801 					(*func)(ire, arg);
2802 			}
2803 			IRB_REFRELE(irb);
2804 		}
2805 	}
2806 }
2807 
2808 /*
2809  * This routine walks through the ill chain to find if there is any
2810  * ire linked to the ill's interface based forwarding table
2811  * The arg could be ill or mp. This routine is called when a ill goes
2812  * down/deleted or the 'ipv4_ire_srcif_status' report is printed.
2813  */
2814 void
2815 ire_walk_srcif_table_v4(pfv_t func, char *arg)
2816 {
2817 	irb_t   *irb;
2818 	ire_t   *ire;
2819 	ill_t	*ill, *next_ill;
2820 	int	i;
2821 	int	total_count;
2822 	ill_walk_context_t ctx;
2823 
2824 	/*
2825 	 * Take care of ire's in other ill's per-interface forwarding
2826 	 * table. Check if any ire in any of the ill's ill_srcif_table
2827 	 * is pointing to this ill.
2828 	 */
2829 	mutex_enter(&ire_srcif_table_lock);
2830 	if (ire_srcif_table_count == 0) {
2831 		mutex_exit(&ire_srcif_table_lock);
2832 		return;
2833 	}
2834 	mutex_exit(&ire_srcif_table_lock);
2835 
2836 #ifdef DEBUG
2837 	/* Keep accounting of all interface based table ires */
2838 	total_count = 0;
2839 	rw_enter(&ill_g_lock, RW_READER);
2840 	ill = ILL_START_WALK_V4(&ctx);
2841 	while (ill != NULL) {
2842 		mutex_enter(&ill->ill_lock);
2843 		total_count += ill->ill_srcif_refcnt;
2844 		next_ill = ill_next(&ctx, ill);
2845 		mutex_exit(&ill->ill_lock);
2846 		ill = next_ill;
2847 	}
2848 	rw_exit(&ill_g_lock);
2849 
2850 	/* Hold lock here to make sure ire_srcif_table_count is stable */
2851 	mutex_enter(&ire_srcif_table_lock);
2852 	i = ire_srcif_table_count;
2853 	mutex_exit(&ire_srcif_table_lock);
2854 	ip1dbg(("ire_walk_srcif_v4: ire_srcif_table_count %d "
2855 	    "total ill_srcif_refcnt %d\n", i, total_count));
2856 #endif
2857 	rw_enter(&ill_g_lock, RW_READER);
2858 	ill = ILL_START_WALK_V4(&ctx);
2859 	while (ill != NULL) {
2860 		mutex_enter(&ill->ill_lock);
2861 		if ((ill->ill_srcif_refcnt == 0) || !ILL_CAN_LOOKUP(ill)) {
2862 			next_ill = ill_next(&ctx, ill);
2863 			mutex_exit(&ill->ill_lock);
2864 			ill = next_ill;
2865 			continue;
2866 		}
2867 		ill_refhold_locked(ill);
2868 		mutex_exit(&ill->ill_lock);
2869 		rw_exit(&ill_g_lock);
2870 		if (ill->ill_srcif_table != NULL) {
2871 			for (i = 0; i < IP_SRCIF_TABLE_SIZE; i++) {
2872 				irb = &(ill->ill_srcif_table[i]);
2873 				if (irb->irb_ire == NULL)
2874 					continue;
2875 				IRB_REFHOLD(irb);
2876 				for (ire = irb->irb_ire; ire != NULL;
2877 				    ire = ire->ire_next) {
2878 					(*func)(ire, arg);
2879 				}
2880 				IRB_REFRELE(irb);
2881 			}
2882 		}
2883 		rw_enter(&ill_g_lock, RW_READER);
2884 		next_ill = ill_next(&ctx, ill);
2885 		ill_refrele(ill);
2886 		ill = next_ill;
2887 	}
2888 	rw_exit(&ill_g_lock);
2889 }
2890 
2891 /*
2892  * This function takes a mask and returns
2893  * number of bits set in the mask. If no
2894  * bit is set it returns 0.
2895  * Assumes a contiguous mask.
2896  */
2897 int
2898 ip_mask_to_plen(ipaddr_t mask)
2899 {
2900 	return (mask == 0 ? 0 : IP_ABITS - (ffs(ntohl(mask)) -1));
2901 }
2902 
2903 /*
2904  * Convert length for a mask to the mask.
2905  */
2906 ipaddr_t
2907 ip_plen_to_mask(uint_t masklen)
2908 {
2909 	return (htonl(IP_HOST_MASK << (IP_ABITS - masklen)));
2910 }
2911 
2912 void
2913 ire_atomic_end(irb_t *irb_ptr, ire_t *ire)
2914 {
2915 	ill_t	*ill_list[NUM_ILLS];
2916 
2917 	ill_list[0] = ire->ire_stq != NULL ? ire->ire_stq->q_ptr : NULL;
2918 	ill_list[1] = ire->ire_ipif != NULL ? ire->ire_ipif->ipif_ill : NULL;
2919 	ill_list[2] = ire->ire_in_ill;
2920 	ill_unlock_ills(ill_list, NUM_ILLS);
2921 	rw_exit(&irb_ptr->irb_lock);
2922 	rw_exit(&ill_g_usesrc_lock);
2923 }
2924 
2925 /*
2926  * ire_add_v[46] atomically make sure that the ipif or ill associated
2927  * with the new ire being added is stable and not IPIF_CHANGING or ILL_CHANGING
2928  * before adding the ire to the table. This ensures that we don't create
2929  * new IRE_CACHEs with stale values for parameters that are passed to
2930  * ire_create such as ire_max_frag. Note that ire_create() is passed a pointer
2931  * to the ipif_mtu, and not the value. The actual value is derived from the
2932  * parent ire or ipif under the bucket lock.
2933  */
2934 int
2935 ire_atomic_start(irb_t *irb_ptr, ire_t *ire, queue_t *q, mblk_t *mp,
2936     ipsq_func_t func)
2937 {
2938 	ill_t	*stq_ill;
2939 	ill_t	*ipif_ill;
2940 	ill_t	*in_ill;
2941 	ill_t	*ill_list[NUM_ILLS];
2942 	int	cnt = NUM_ILLS;
2943 	int	error = 0;
2944 	ill_t	*ill = NULL;
2945 
2946 	ill_list[0] = stq_ill = ire->ire_stq !=
2947 		NULL ? ire->ire_stq->q_ptr : NULL;
2948 	ill_list[1] = ipif_ill = ire->ire_ipif !=
2949 		NULL ? ire->ire_ipif->ipif_ill : NULL;
2950 	ill_list[2] = in_ill = ire->ire_in_ill;
2951 
2952 	ASSERT((q != NULL && mp != NULL && func != NULL) ||
2953 	    (q == NULL && mp == NULL && func == NULL));
2954 	rw_enter(&ill_g_usesrc_lock, RW_READER);
2955 	GRAB_CONN_LOCK(q);
2956 	rw_enter(&irb_ptr->irb_lock, RW_WRITER);
2957 	ill_lock_ills(ill_list, cnt);
2958 
2959 	/*
2960 	 * While the IRE is in the process of being added, a user may have
2961 	 * invoked the ifconfig usesrc option on the stq_ill to make it a
2962 	 * usesrc client ILL. Check for this possibility here, if it is true
2963 	 * then we fail adding the IRE_CACHE. Another check is to make sure
2964 	 * that an ipif_ill of an IRE_CACHE being added is not part of a usesrc
2965 	 * group. The ill_g_usesrc_lock is released in ire_atomic_end
2966 	 */
2967 	if ((ire->ire_type & IRE_CACHE) &&
2968 	    (ire->ire_marks & IRE_MARK_USESRC_CHECK)) {
2969 		if (stq_ill->ill_usesrc_ifindex != 0) {
2970 			ASSERT(stq_ill->ill_usesrc_grp_next != NULL);
2971 			if ((ipif_ill->ill_phyint->phyint_ifindex !=
2972 			    stq_ill->ill_usesrc_ifindex) ||
2973 			    (ipif_ill->ill_usesrc_grp_next == NULL) ||
2974 			    (ipif_ill->ill_usesrc_ifindex != 0)) {
2975 				error = EINVAL;
2976 				goto done;
2977 			}
2978 		} else if (ipif_ill->ill_usesrc_grp_next != NULL) {
2979 			error = EINVAL;
2980 			goto done;
2981 		}
2982 	}
2983 
2984 	/*
2985 	 * IPMP flag settings happen without taking the exclusive route
2986 	 * in ip_sioctl_flags. So we need to make an atomic check here
2987 	 * for FAILED/OFFLINE/INACTIVE flags or if it has hit the
2988 	 * FAILBACK=no case.
2989 	 */
2990 	if ((stq_ill != NULL) && !IAM_WRITER_ILL(stq_ill)) {
2991 		if (stq_ill->ill_state_flags & ILL_CHANGING) {
2992 			ill = stq_ill;
2993 			error = EAGAIN;
2994 		} else if ((stq_ill->ill_phyint->phyint_flags & PHYI_OFFLINE) ||
2995 		    (ill_is_probeonly(stq_ill) &&
2996 		    !(ire->ire_marks & IRE_MARK_HIDDEN))) {
2997 			error = EINVAL;
2998 		}
2999 		goto done;
3000 	}
3001 
3002 	/*
3003 	 * We don't check for OFFLINE/FAILED in this case because
3004 	 * the source address selection logic (ipif_select_source)
3005 	 * may still select a source address from such an ill. The
3006 	 * assumption is that these addresses will be moved by in.mpathd
3007 	 * soon. (i.e. this is a race). However link local addresses
3008 	 * will not move and hence ipif_select_source_v6 tries to avoid
3009 	 * FAILED ills. Please see ipif_select_source_v6 for more info
3010 	 */
3011 	if ((ipif_ill != NULL) && !IAM_WRITER_ILL(ipif_ill) &&
3012 	    (ipif_ill->ill_state_flags & ILL_CHANGING)) {
3013 		ill = ipif_ill;
3014 		error = EAGAIN;
3015 		goto done;
3016 	}
3017 
3018 	if ((in_ill != NULL) && !IAM_WRITER_ILL(in_ill) &&
3019 	    (in_ill->ill_state_flags & ILL_CHANGING)) {
3020 		ill = in_ill;
3021 		error = EAGAIN;
3022 		goto done;
3023 	}
3024 
3025 	if ((ire->ire_ipif != NULL) && !IAM_WRITER_IPIF(ire->ire_ipif) &&
3026 	    (ire->ire_ipif->ipif_state_flags & IPIF_CHANGING)) {
3027 		ill = ire->ire_ipif->ipif_ill;
3028 		ASSERT(ill != NULL);
3029 		error = EAGAIN;
3030 		goto done;
3031 	}
3032 
3033 done:
3034 	if (error == EAGAIN && ILL_CAN_WAIT(ill, q)) {
3035 		ipsq_t *ipsq = ill->ill_phyint->phyint_ipsq;
3036 		mutex_enter(&ipsq->ipsq_lock);
3037 		ire_atomic_end(irb_ptr, ire);
3038 		ipsq_enq(ipsq, q, mp, func, NEW_OP, ill);
3039 		mutex_exit(&ipsq->ipsq_lock);
3040 		error = EINPROGRESS;
3041 	} else if (error != 0) {
3042 		ire_atomic_end(irb_ptr, ire);
3043 	}
3044 
3045 	RELEASE_CONN_LOCK(q);
3046 	return (error);
3047 }
3048 
3049 /*
3050  * Add a fully initialized IRE to an appropriate table based on
3051  * ire_type.
3052  */
3053 int
3054 ire_add(ire_t **irep, queue_t *q, mblk_t *mp, ipsq_func_t func)
3055 {
3056 	ire_t	*ire1;
3057 	ill_t	*stq_ill = NULL;
3058 	ill_t	*ill;
3059 	ipif_t	*ipif = NULL;
3060 	ill_walk_context_t ctx;
3061 	ire_t	*ire = *irep;
3062 	int	error;
3063 
3064 	ASSERT(ire->ire_type != IRE_MIPRTUN);
3065 
3066 	/* get ready for the day when original ire is not created as mblk */
3067 	if (ire->ire_mp != NULL) {
3068 		/* Copy the ire to a kmem_alloc'ed area */
3069 		ire1 = kmem_cache_alloc(ire_cache, KM_NOSLEEP);
3070 		if (ire1 == NULL) {
3071 			ip1dbg(("ire_add: alloc failed\n"));
3072 			ire_delete(ire);
3073 			*irep = NULL;
3074 			return (ENOMEM);
3075 		}
3076 		*ire1 = *ire;
3077 		ire1->ire_mp = NULL;
3078 		freeb(ire->ire_mp);
3079 		ire = ire1;
3080 	}
3081 	if (ire->ire_stq != NULL)
3082 		stq_ill = (ill_t *)ire->ire_stq->q_ptr;
3083 
3084 	if (ire->ire_type == IRE_CACHE) {
3085 		/*
3086 		 * If this interface is FAILED, or INACTIVE or has hit
3087 		 * the FAILBACK=no case, we create IRE_CACHES marked
3088 		 * HIDDEN for some special cases e.g. bind to
3089 		 * IPIF_NOFAILOVER address etc. So, if this interface
3090 		 * is FAILED/INACTIVE/hit FAILBACK=no case, and we are
3091 		 * not creating hidden ires, we should not allow that.
3092 		 * This happens because the state of the interface
3093 		 * changed while we were waiting in ARP. If this is the
3094 		 * daemon sending probes, the next probe will create
3095 		 * HIDDEN ires and we will create an ire then. This
3096 		 * cannot happen with NDP currently because IRE is
3097 		 * never queued in NDP. But it can happen in the
3098 		 * future when we have external resolvers with IPv6.
3099 		 * If the interface gets marked with OFFLINE while we
3100 		 * are waiting in ARP, don't add the ire.
3101 		 */
3102 		if ((stq_ill->ill_phyint->phyint_flags & PHYI_OFFLINE) ||
3103 		    (ill_is_probeonly(stq_ill) &&
3104 		    !(ire->ire_marks & IRE_MARK_HIDDEN))) {
3105 			/*
3106 			 * We don't know whether it is a valid ipif or not.
3107 			 * unless we do the check below. So, set it to NULL.
3108 			 */
3109 			ire->ire_ipif = NULL;
3110 			ire_delete(ire);
3111 			*irep = NULL;
3112 			return (EINVAL);
3113 		}
3114 	}
3115 
3116 	if (stq_ill != NULL && ire->ire_type == IRE_CACHE &&
3117 	    stq_ill->ill_net_type == IRE_IF_RESOLVER) {
3118 		rw_enter(&ill_g_lock, RW_READER);
3119 		ill = ILL_START_WALK_ALL(&ctx);
3120 		for (; ill != NULL; ill = ill_next(&ctx, ill)) {
3121 			mutex_enter(&ill->ill_lock);
3122 			if (ill->ill_state_flags & ILL_CONDEMNED) {
3123 				mutex_exit(&ill->ill_lock);
3124 				continue;
3125 			}
3126 			/*
3127 			 * We need to make sure that the ipif is a valid one
3128 			 * before adding the IRE_CACHE. This happens only
3129 			 * with IRE_CACHE when there is an external resolver.
3130 			 *
3131 			 * We can unplumb a logical interface while the
3132 			 * packet is waiting in ARP with the IRE. Then,
3133 			 * later on when we feed the IRE back, the ipif
3134 			 * has to be re-checked. This can't happen with
3135 			 * NDP currently, as we never queue the IRE with
3136 			 * the packet. We always try to recreate the IRE
3137 			 * when the resolution is completed. But, we do
3138 			 * it for IPv6 also here so that in future if
3139 			 * we have external resolvers, it will work without
3140 			 * any change.
3141 			 */
3142 			ipif = ipif_lookup_seqid(ill, ire->ire_ipif_seqid);
3143 			if (ipif != NULL) {
3144 				ipif_refhold_locked(ipif);
3145 				mutex_exit(&ill->ill_lock);
3146 				break;
3147 			}
3148 			mutex_exit(&ill->ill_lock);
3149 		}
3150 		rw_exit(&ill_g_lock);
3151 		if (ipif == NULL ||
3152 		    (ipif->ipif_isv6 &&
3153 		    !IN6_ARE_ADDR_EQUAL(&ire->ire_src_addr_v6,
3154 		    &ipif->ipif_v6src_addr)) ||
3155 		    (!ipif->ipif_isv6 &&
3156 		    ire->ire_src_addr != ipif->ipif_src_addr) ||
3157 		    (ire->ire_zoneid != ipif->ipif_zoneid)) {
3158 
3159 			if (ipif != NULL)
3160 				ipif_refrele(ipif);
3161 			ire->ire_ipif = NULL;
3162 			ire_delete(ire);
3163 			*irep = NULL;
3164 			return (EINVAL);
3165 		}
3166 
3167 
3168 		ASSERT(ill != NULL);
3169 		/*
3170 		 * If this group was dismantled while this packets was
3171 		 * queued in ARP, don't add it here.
3172 		 */
3173 		if (ire->ire_ipif->ipif_ill->ill_group != ill->ill_group) {
3174 			/* We don't want ire_inactive bump stats for this */
3175 			ipif_refrele(ipif);
3176 			ire->ire_ipif = NULL;
3177 			ire_delete(ire);
3178 			*irep = NULL;
3179 			return (EINVAL);
3180 		}
3181 	}
3182 
3183 	/*
3184 	 * In case ire was changed
3185 	 */
3186 	*irep = ire;
3187 	if (ire->ire_ipversion == IPV6_VERSION) {
3188 		error = ire_add_v6(irep, q, mp, func);
3189 	} else {
3190 		if (ire->ire_in_ill == NULL)
3191 			error = ire_add_v4(irep, q, mp, func);
3192 		else
3193 			error = ire_add_srcif_v4(irep, q, mp, func);
3194 	}
3195 	if (ipif != NULL)
3196 		ipif_refrele(ipif);
3197 	return (error);
3198 }
3199 
3200 /*
3201  * Add a fully initialized IRE to an appropriate
3202  * table based on ire_type.
3203  *
3204  * The forward table contains IRE_PREFIX/IRE_HOST/IRE_HOST_REDIRECT
3205  * IRE_IF_RESOLVER/IRE_IF_NORESOLVER and IRE_DEFAULT.
3206  *
3207  * The cache table contains IRE_BROADCAST/IRE_LOCAL/IRE_LOOPBACK
3208  * and IRE_CACHE.
3209  *
3210  * NOTE : This function is called as writer though not required
3211  * by this function.
3212  */
3213 static int
3214 ire_add_v4(ire_t **ire_p, queue_t *q, mblk_t *mp, ipsq_func_t func)
3215 {
3216 	ire_t	*ire1;
3217 	int	mask_table_index;
3218 	irb_t	*irb_ptr;
3219 	ire_t	**irep;
3220 	int	flags;
3221 	ire_t	*pire = NULL;
3222 	ill_t	*stq_ill;
3223 	ire_t	*ire = *ire_p;
3224 	int	error;
3225 
3226 	if (ire->ire_ipif != NULL)
3227 		ASSERT(!MUTEX_HELD(&ire->ire_ipif->ipif_ill->ill_lock));
3228 	if (ire->ire_stq != NULL)
3229 		ASSERT(!MUTEX_HELD(
3230 		    &((ill_t *)(ire->ire_stq->q_ptr))->ill_lock));
3231 	ASSERT(ire->ire_ipversion == IPV4_VERSION);
3232 	ASSERT(ire->ire_mp == NULL); /* Calls should go through ire_add */
3233 	ASSERT(ire->ire_in_ill == NULL); /* No srcif entries */
3234 
3235 	/* Find the appropriate list head. */
3236 	switch (ire->ire_type) {
3237 	case IRE_HOST:
3238 		ire->ire_mask = IP_HOST_MASK;
3239 		ire->ire_masklen = IP_ABITS;
3240 		if ((ire->ire_flags & RTF_SETSRC) == 0)
3241 			ire->ire_src_addr = 0;
3242 		break;
3243 	case IRE_HOST_REDIRECT:
3244 		ire->ire_mask = IP_HOST_MASK;
3245 		ire->ire_masklen = IP_ABITS;
3246 		ire->ire_src_addr = 0;
3247 		break;
3248 	case IRE_CACHE:
3249 	case IRE_BROADCAST:
3250 	case IRE_LOCAL:
3251 	case IRE_LOOPBACK:
3252 		ire->ire_mask = IP_HOST_MASK;
3253 		ire->ire_masklen = IP_ABITS;
3254 		break;
3255 	case IRE_PREFIX:
3256 		if ((ire->ire_flags & RTF_SETSRC) == 0)
3257 			ire->ire_src_addr = 0;
3258 		break;
3259 	case IRE_DEFAULT:
3260 		if ((ire->ire_flags & RTF_SETSRC) == 0)
3261 			ire->ire_src_addr = 0;
3262 		break;
3263 	case IRE_IF_RESOLVER:
3264 	case IRE_IF_NORESOLVER:
3265 		break;
3266 	default:
3267 		printf("ire_add_v4: ire %p has unrecognized IRE type (%d)\n",
3268 		    (void *)ire, ire->ire_type);
3269 		ire_delete(ire);
3270 		*ire_p = NULL;
3271 		return (EINVAL);
3272 	}
3273 
3274 	/* Make sure the address is properly masked. */
3275 	ire->ire_addr &= ire->ire_mask;
3276 
3277 	if ((ire->ire_type & IRE_CACHETABLE) == 0) {
3278 		/* IRE goes into Forward Table */
3279 		mask_table_index = ire->ire_masklen;
3280 		if ((ip_forwarding_table[mask_table_index]) == NULL) {
3281 			irb_t *ptr;
3282 			int i;
3283 
3284 			ptr = (irb_t *)mi_zalloc((ip_ftable_hash_size *
3285 			    sizeof (irb_t)));
3286 			if (ptr == NULL) {
3287 				ire_delete(ire);
3288 				*ire_p = NULL;
3289 				return (ENOMEM);
3290 			}
3291 			for (i = 0; i < ip_ftable_hash_size; i++) {
3292 				rw_init(&ptr[i].irb_lock, NULL,
3293 				    RW_DEFAULT, NULL);
3294 			}
3295 			mutex_enter(&ire_ft_init_lock);
3296 			if (ip_forwarding_table[mask_table_index] == NULL) {
3297 				ip_forwarding_table[mask_table_index] = ptr;
3298 				mutex_exit(&ire_ft_init_lock);
3299 			} else {
3300 				/*
3301 				 * Some other thread won the race in
3302 				 * initializing the forwarding table at the
3303 				 * same index.
3304 				 */
3305 				mutex_exit(&ire_ft_init_lock);
3306 				for (i = 0; i < ip_ftable_hash_size; i++) {
3307 					rw_destroy(&ptr[i].irb_lock);
3308 				}
3309 				mi_free(ptr);
3310 			}
3311 		}
3312 		irb_ptr = &(ip_forwarding_table[mask_table_index][
3313 		    IRE_ADDR_HASH(ire->ire_addr, ip_ftable_hash_size)]);
3314 	} else {
3315 		irb_ptr = &(ip_cache_table[IRE_ADDR_HASH(ire->ire_addr,
3316 		    ip_cache_table_size)]);
3317 	}
3318 	/*
3319 	 * ip_newroute/ip_newroute_multi are unable to prevent the deletion
3320 	 * of the interface route while adding an IRE_CACHE for an on-link
3321 	 * destination in the IRE_IF_RESOLVER case, since the ire has to
3322 	 * go to ARP and return. We can't do a REFHOLD on the
3323 	 * associated interface ire for fear of ARP freeing the message.
3324 	 * Here we look up the interface ire in the forwarding table and
3325 	 * make sure that the interface route has not been deleted.
3326 	 */
3327 	if (ire->ire_type == IRE_CACHE && ire->ire_gateway_addr == 0 &&
3328 	    ((ill_t *)ire->ire_stq->q_ptr)->ill_net_type == IRE_IF_RESOLVER) {
3329 		ASSERT(ire->ire_max_fragp == NULL);
3330 		if (CLASSD(ire->ire_addr) && !(ire->ire_flags & RTF_SETSRC)) {
3331 			/*
3332 			 * The ihandle that we used in ip_newroute_multi
3333 			 * comes from the interface route corresponding
3334 			 * to ire_ipif. Lookup here to see if it exists
3335 			 * still.
3336 			 * If the ire has a source address assigned using
3337 			 * RTF_SETSRC, ire_ipif is the logical interface holding
3338 			 * this source address, so we can't use it to check for
3339 			 * the existence of the interface route. Instead we rely
3340 			 * on the brute force ihandle search in
3341 			 * ire_ihandle_lookup_onlink() below.
3342 			 */
3343 			pire = ipif_to_ire(ire->ire_ipif);
3344 			if (pire == NULL) {
3345 				ire_delete(ire);
3346 				*ire_p = NULL;
3347 				return (EINVAL);
3348 			} else if (pire->ire_ihandle != ire->ire_ihandle) {
3349 				ire_refrele(pire);
3350 				ire_delete(ire);
3351 				*ire_p = NULL;
3352 				return (EINVAL);
3353 			}
3354 		} else {
3355 			pire = ire_ihandle_lookup_onlink(ire);
3356 			if (pire == NULL) {
3357 				ire_delete(ire);
3358 				*ire_p = NULL;
3359 				return (EINVAL);
3360 			}
3361 		}
3362 		/* Prevent pire from getting deleted */
3363 		IRB_REFHOLD(pire->ire_bucket);
3364 		/* Has it been removed already ? */
3365 		if (pire->ire_marks & IRE_MARK_CONDEMNED) {
3366 			IRB_REFRELE(pire->ire_bucket);
3367 			ire_refrele(pire);
3368 			ire_delete(ire);
3369 			*ire_p = NULL;
3370 			return (EINVAL);
3371 		}
3372 	} else {
3373 		ASSERT(ire->ire_max_fragp != NULL);
3374 	}
3375 	flags = (MATCH_IRE_MASK | MATCH_IRE_TYPE | MATCH_IRE_GW);
3376 
3377 	if (ire->ire_ipif != NULL) {
3378 		/*
3379 		 * We use MATCH_IRE_IPIF while adding IRE_CACHES only
3380 		 * for historic reasons and to maintain symmetry with
3381 		 * IPv6 code path. Historically this was used by
3382 		 * multicast code to create multiple IRE_CACHES on
3383 		 * a single ill with different ipifs. This was used
3384 		 * so that multicast packets leaving the node had the
3385 		 * right source address. This is no longer needed as
3386 		 * ip_wput initializes the address correctly.
3387 		 */
3388 		flags |= MATCH_IRE_IPIF;
3389 		/*
3390 		 * If we are creating hidden ires, make sure we search on
3391 		 * this ill (MATCH_IRE_ILL) and a hidden ire,
3392 		 * while we are searching for duplicates below. Otherwise we
3393 		 * could potentially find an IRE on some other interface
3394 		 * and it may not be a IRE marked with IRE_MARK_HIDDEN. We
3395 		 * shouldn't do this as this will lead to an infinite loop
3396 		 * (if we get to ip_wput again) eventually we need an hidden
3397 		 * ire for this packet to go out. MATCH_IRE_ILL is explicitly
3398 		 * done below.
3399 		 */
3400 		if (ire->ire_type == IRE_CACHE &&
3401 		    (ire->ire_marks & IRE_MARK_HIDDEN))
3402 			flags |= (MATCH_IRE_MARK_HIDDEN);
3403 	}
3404 
3405 	/*
3406 	 * Start the atomic add of the ire. Grab the ill locks,
3407 	 * ill_g_usesrc_lock and the bucket lock. Check for condemned
3408 	 *
3409 	 * If ipif or ill is changing ire_atomic_start() may queue the
3410 	 * request and return EINPROGRESS.
3411 	 */
3412 	error = ire_atomic_start(irb_ptr, ire, q, mp, func);
3413 	if (error != 0) {
3414 		/*
3415 		 * We don't know whether it is a valid ipif or not.
3416 		 * So, set it to NULL. This assumes that the ire has not added
3417 		 * a reference to the ipif.
3418 		 */
3419 		ire->ire_ipif = NULL;
3420 		ire_delete(ire);
3421 		if (pire != NULL) {
3422 			IRB_REFRELE(pire->ire_bucket);
3423 			ire_refrele(pire);
3424 		}
3425 		*ire_p = NULL;
3426 		return (error);
3427 	}
3428 	/*
3429 	 * To avoid creating ires having stale values for the ire_max_frag
3430 	 * we get the latest value atomically here. For more details
3431 	 * see the block comment in ip_sioctl_mtu and in DL_NOTE_SDU_CHANGE
3432 	 * in ip_rput_dlpi_writer
3433 	 */
3434 	if (ire->ire_max_fragp == NULL) {
3435 		if (CLASSD(ire->ire_addr))
3436 			ire->ire_max_frag = ire->ire_ipif->ipif_mtu;
3437 		else
3438 			ire->ire_max_frag = pire->ire_max_frag;
3439 	} else {
3440 		uint_t	max_frag;
3441 
3442 		max_frag = *ire->ire_max_fragp;
3443 		ire->ire_max_fragp = NULL;
3444 		ire->ire_max_frag = max_frag;
3445 	}
3446 	/*
3447 	 * Atomically check for duplicate and insert in the table.
3448 	 */
3449 	for (ire1 = irb_ptr->irb_ire; ire1 != NULL; ire1 = ire1->ire_next) {
3450 		if (ire1->ire_marks & IRE_MARK_CONDEMNED)
3451 			continue;
3452 		if (ire->ire_ipif != NULL) {
3453 			/*
3454 			 * We do MATCH_IRE_ILL implicitly here for IREs
3455 			 * with a non-null ire_ipif, including IRE_CACHEs.
3456 			 * As ire_ipif and ire_stq could point to two
3457 			 * different ills, we can't pass just ire_ipif to
3458 			 * ire_match_args and get a match on both ills.
3459 			 * This is just needed for duplicate checks here and
3460 			 * so we don't add an extra argument to
3461 			 * ire_match_args for this. Do it locally.
3462 			 *
3463 			 * NOTE : Currently there is no part of the code
3464 			 * that asks for both MATH_IRE_IPIF and MATCH_IRE_ILL
3465 			 * match for IRE_CACHEs. Thus we don't want to
3466 			 * extend the arguments to ire_match_args.
3467 			 */
3468 			if (ire1->ire_stq != ire->ire_stq)
3469 				continue;
3470 			/*
3471 			 * Multiroute IRE_CACHEs for a given destination can
3472 			 * have the same ire_ipif, typically if their source
3473 			 * address is forced using RTF_SETSRC, and the same
3474 			 * send-to queue. We differentiate them using the parent
3475 			 * handle.
3476 			 */
3477 			if (ire->ire_type == IRE_CACHE &&
3478 			    (ire1->ire_flags & RTF_MULTIRT) &&
3479 			    (ire->ire_flags & RTF_MULTIRT) &&
3480 			    (ire1->ire_phandle != ire->ire_phandle))
3481 				continue;
3482 		}
3483 		if (ire1->ire_zoneid != ire->ire_zoneid)
3484 			continue;
3485 		if (ire_match_args(ire1, ire->ire_addr, ire->ire_mask,
3486 		    ire->ire_gateway_addr, ire->ire_type, ire->ire_ipif,
3487 		    ire->ire_zoneid, 0, flags)) {
3488 			/*
3489 			 * Return the old ire after doing a REFHOLD.
3490 			 * As most of the callers continue to use the IRE
3491 			 * after adding, we return a held ire. This will
3492 			 * avoid a lookup in the caller again. If the callers
3493 			 * don't want to use it, they need to do a REFRELE.
3494 			 */
3495 			ip1dbg(("found dup ire existing %p new %p",
3496 			    (void *)ire1, (void *)ire));
3497 			IRE_REFHOLD(ire1);
3498 			ire_atomic_end(irb_ptr, ire);
3499 			ire_delete(ire);
3500 			if (pire != NULL) {
3501 				/*
3502 				 * Assert that it is not removed from the
3503 				 * list yet.
3504 				 */
3505 				ASSERT(pire->ire_ptpn != NULL);
3506 				IRB_REFRELE(pire->ire_bucket);
3507 				ire_refrele(pire);
3508 			}
3509 			*ire_p = ire1;
3510 			return (0);
3511 		}
3512 	}
3513 
3514 	/*
3515 	 * Make it easy for ip_wput_ire() to hit multiple broadcast ires by
3516 	 * grouping identical addresses together on the hash chain. We also
3517 	 * don't want to send multiple copies out if there are two ills part
3518 	 * of the same group. Thus we group the ires with same addr and same
3519 	 * ill group together so that ip_wput_ire can easily skip all the
3520 	 * ires with same addr and same group after sending the first copy.
3521 	 * We do this only for IRE_BROADCASTs as ip_wput_ire is currently
3522 	 * interested in such groupings only for broadcasts.
3523 	 *
3524 	 * NOTE : If the interfaces are brought up first and then grouped,
3525 	 * illgrp_insert will handle it. We come here when the interfaces
3526 	 * are already in group and we are bringing them UP.
3527 	 *
3528 	 * Find the first entry that matches ire_addr. *irep will be null
3529 	 * if no match.
3530 	 */
3531 	irep = (ire_t **)irb_ptr;
3532 	while ((ire1 = *irep) != NULL && ire->ire_addr != ire1->ire_addr)
3533 		irep = &ire1->ire_next;
3534 	if (ire->ire_type == IRE_BROADCAST && *irep != NULL) {
3535 		/*
3536 		 * We found some ire (i.e *irep) with a matching addr. We
3537 		 * want to group ires with same addr and same ill group
3538 		 * together.
3539 		 *
3540 		 * First get to the entry that matches our address and
3541 		 * ill group i.e stop as soon as we find the first ire
3542 		 * matching the ill group and address. If there is only
3543 		 * an address match, we should walk and look for some
3544 		 * group match. These are some of the possible scenarios :
3545 		 *
3546 		 * 1) There are no groups at all i.e all ire's ill_group
3547 		 *    are NULL. In that case we will essentially group
3548 		 *    all the ires with the same addr together. Same as
3549 		 *    the "else" block of this "if".
3550 		 *
3551 		 * 2) There are some groups and this ire's ill_group is
3552 		 *    NULL. In this case, we will first find the group
3553 		 *    that matches the address and a NULL group. Then
3554 		 *    we will insert the ire at the end of that group.
3555 		 *
3556 		 * 3) There are some groups and this ires's ill_group is
3557 		 *    non-NULL. In this case we will first find the group
3558 		 *    that matches the address and the ill_group. Then
3559 		 *    we will insert the ire at the end of that group.
3560 		 */
3561 		/* LINTED : constant in conditional context */
3562 		while (1) {
3563 			ire1 = *irep;
3564 			if ((ire1->ire_next == NULL) ||
3565 			    (ire1->ire_next->ire_addr != ire->ire_addr) ||
3566 			    (ire1->ire_type != IRE_BROADCAST) ||
3567 			    (ire1->ire_ipif->ipif_ill->ill_group ==
3568 			    ire->ire_ipif->ipif_ill->ill_group))
3569 				break;
3570 			irep = &ire1->ire_next;
3571 		}
3572 		ASSERT(*irep != NULL);
3573 		irep = &((*irep)->ire_next);
3574 
3575 		/*
3576 		 * Either we have hit the end of the list or the address
3577 		 * did not match or the group *matched*. If we found
3578 		 * a match on the group, skip to the end of the group.
3579 		 */
3580 		while (*irep != NULL) {
3581 			ire1 = *irep;
3582 			if ((ire1->ire_addr != ire->ire_addr) ||
3583 			    (ire1->ire_type != IRE_BROADCAST) ||
3584 			    (ire1->ire_ipif->ipif_ill->ill_group !=
3585 			    ire->ire_ipif->ipif_ill->ill_group))
3586 				break;
3587 			if (ire1->ire_ipif->ipif_ill->ill_group == NULL &&
3588 			    ire1->ire_ipif == ire->ire_ipif) {
3589 				irep = &ire1->ire_next;
3590 				break;
3591 			}
3592 			irep = &ire1->ire_next;
3593 		}
3594 	} else if (*irep != NULL) {
3595 		/*
3596 		 * Find the last ire which matches ire_addr.
3597 		 * Needed to do tail insertion among entries with the same
3598 		 * ire_addr.
3599 		 */
3600 		while (ire->ire_addr == ire1->ire_addr) {
3601 			irep = &ire1->ire_next;
3602 			ire1 = *irep;
3603 			if (ire1 == NULL)
3604 				break;
3605 		}
3606 	}
3607 
3608 	if (ire->ire_type == IRE_DEFAULT) {
3609 		/*
3610 		 * We keep a count of default gateways which is used when
3611 		 * assigning them as routes.
3612 		 */
3613 		ip_ire_default_count++;
3614 		ASSERT(ip_ire_default_count != 0); /* Wraparound */
3615 	}
3616 	/* Insert at *irep */
3617 	ire1 = *irep;
3618 	if (ire1 != NULL)
3619 		ire1->ire_ptpn = &ire->ire_next;
3620 	ire->ire_next = ire1;
3621 	/* Link the new one in. */
3622 	ire->ire_ptpn = irep;
3623 
3624 	/*
3625 	 * ire_walk routines de-reference ire_next without holding
3626 	 * a lock. Before we point to the new ire, we want to make
3627 	 * sure the store that sets the ire_next of the new ire
3628 	 * reaches global visibility, so that ire_walk routines
3629 	 * don't see a truncated list of ires i.e if the ire_next
3630 	 * of the new ire gets set after we do "*irep = ire" due
3631 	 * to re-ordering, the ire_walk thread will see a NULL
3632 	 * once it accesses the ire_next of the new ire.
3633 	 * membar_producer() makes sure that the following store
3634 	 * happens *after* all of the above stores.
3635 	 */
3636 	membar_producer();
3637 	*irep = ire;
3638 	ire->ire_bucket = irb_ptr;
3639 	/*
3640 	 * We return a bumped up IRE above. Keep it symmetrical
3641 	 * so that the callers will always have to release. This
3642 	 * helps the callers of this function because they continue
3643 	 * to use the IRE after adding and hence they don't have to
3644 	 * lookup again after we return the IRE.
3645 	 *
3646 	 * NOTE : We don't have to use atomics as this is appearing
3647 	 * in the list for the first time and no one else can bump
3648 	 * up the reference count on this yet.
3649 	 */
3650 	IRE_REFHOLD_LOCKED(ire);
3651 	BUMP_IRE_STATS(ire_stats_v4, ire_stats_inserted);
3652 	irb_ptr->irb_ire_cnt++;
3653 	if (ire->ire_marks & IRE_MARK_TEMPORARY)
3654 		irb_ptr->irb_tmp_ire_cnt++;
3655 
3656 	if (ire->ire_ipif != NULL) {
3657 		ire->ire_ipif->ipif_ire_cnt++;
3658 		if (ire->ire_stq != NULL) {
3659 			stq_ill = (ill_t *)ire->ire_stq->q_ptr;
3660 			stq_ill->ill_ire_cnt++;
3661 		}
3662 	} else {
3663 		ASSERT(ire->ire_stq == NULL);
3664 	}
3665 
3666 	ire_atomic_end(irb_ptr, ire);
3667 
3668 	if (pire != NULL) {
3669 		/* Assert that it is not removed from the list yet */
3670 		ASSERT(pire->ire_ptpn != NULL);
3671 		IRB_REFRELE(pire->ire_bucket);
3672 		ire_refrele(pire);
3673 	}
3674 
3675 	if (ire->ire_type != IRE_CACHE) {
3676 		/*
3677 		 * For ire's with with host mask see if there is an entry
3678 		 * in the cache. If there is one flush the whole cache as
3679 		 * there might be multiple entries due to RTF_MULTIRT (CGTP).
3680 		 * If no entry is found than there is no need to flush the
3681 		 * cache.
3682 		 */
3683 		if (ire->ire_mask == IP_HOST_MASK) {
3684 			ire_t *lire;
3685 			lire = ire_ctable_lookup(ire->ire_addr, NULL, IRE_CACHE,
3686 			    NULL, ALL_ZONES, MATCH_IRE_TYPE);
3687 			if (lire != NULL) {
3688 				ire_refrele(lire);
3689 				ire_flush_cache_v4(ire, IRE_FLUSH_ADD);
3690 			}
3691 		} else {
3692 			ire_flush_cache_v4(ire, IRE_FLUSH_ADD);
3693 		}
3694 	}
3695 	/*
3696 	 * We had to delay the fast path probe until the ire is inserted
3697 	 * in the list. Otherwise the fast path ack won't find the ire in
3698 	 * the table.
3699 	 */
3700 	if (ire->ire_type == IRE_CACHE || ire->ire_type == IRE_BROADCAST)
3701 		ire_fastpath(ire);
3702 	if (ire->ire_ipif != NULL)
3703 		ASSERT(!MUTEX_HELD(&ire->ire_ipif->ipif_ill->ill_lock));
3704 	*ire_p = ire;
3705 	return (0);
3706 }
3707 
3708 /*
3709  * Search for all HOST REDIRECT routes that are
3710  * pointing at the specified gateway and
3711  * delete them. This routine is called only
3712  * when a default gateway is going away.
3713  */
3714 static void
3715 ire_delete_host_redirects(ipaddr_t gateway)
3716 {
3717 	irb_t *irb_ptr;
3718 	irb_t *irb;
3719 	ire_t *ire;
3720 	int i;
3721 
3722 	/* get the hash table for HOST routes */
3723 	irb_ptr = ip_forwarding_table[(IP_MASK_TABLE_SIZE - 1)];
3724 	if (irb_ptr == NULL)
3725 		return;
3726 	for (i = 0; (i < ip_ftable_hash_size); i++) {
3727 		irb = &irb_ptr[i];
3728 		IRB_REFHOLD(irb);
3729 		for (ire = irb->irb_ire; ire != NULL; ire = ire->ire_next) {
3730 			if (ire->ire_type != IRE_HOST_REDIRECT)
3731 				continue;
3732 			if (ire->ire_gateway_addr == gateway) {
3733 				ire_delete(ire);
3734 			}
3735 		}
3736 		IRB_REFRELE(irb);
3737 	}
3738 }
3739 
3740 /*
3741  * IRB_REFRELE is the only caller of the function. ire_unlink calls to
3742  * do the final cleanup for this ire.
3743  */
3744 void
3745 ire_cleanup(ire_t *ire)
3746 {
3747 	ire_t *ire_next;
3748 
3749 	ASSERT(ire != NULL);
3750 
3751 	while (ire != NULL) {
3752 		ire_next = ire->ire_next;
3753 		if (ire->ire_ipversion == IPV4_VERSION) {
3754 			ire_delete_v4(ire);
3755 			BUMP_IRE_STATS(ire_stats_v4, ire_stats_deleted);
3756 		} else {
3757 			ASSERT(ire->ire_ipversion == IPV6_VERSION);
3758 			ire_delete_v6(ire);
3759 			BUMP_IRE_STATS(ire_stats_v6, ire_stats_deleted);
3760 		}
3761 		/*
3762 		 * Now it's really out of the list. Before doing the
3763 		 * REFRELE, set ire_next to NULL as ire_inactive asserts
3764 		 * so.
3765 		 */
3766 		ire->ire_next = NULL;
3767 		IRE_REFRELE_NOTR(ire);
3768 		ire = ire_next;
3769 	}
3770 }
3771 
3772 /*
3773  * IRB_REFRELE is the only caller of the function. It calls to unlink
3774  * all the CONDEMNED ires from this bucket.
3775  */
3776 ire_t *
3777 ire_unlink(irb_t *irb)
3778 {
3779 	ire_t *ire;
3780 	ire_t *ire1;
3781 	ire_t **ptpn;
3782 	ire_t *ire_list = NULL;
3783 
3784 	ASSERT(RW_WRITE_HELD(&irb->irb_lock));
3785 	ASSERT(irb->irb_refcnt == 0);
3786 	ASSERT(irb->irb_marks & IRE_MARK_CONDEMNED);
3787 	ASSERT(irb->irb_ire != NULL);
3788 
3789 	for (ire = irb->irb_ire; ire != NULL; ire = ire1) {
3790 		ire1 = ire->ire_next;
3791 		if (ire->ire_marks & IRE_MARK_CONDEMNED) {
3792 			ptpn = ire->ire_ptpn;
3793 			ire1 = ire->ire_next;
3794 			if (ire1)
3795 				ire1->ire_ptpn = ptpn;
3796 			*ptpn = ire1;
3797 			ire->ire_ptpn = NULL;
3798 			ire->ire_next = NULL;
3799 			if (ire->ire_type == IRE_DEFAULT) {
3800 				/*
3801 				 * IRE is out of the list. We need to adjust
3802 				 * the accounting before the caller drops
3803 				 * the lock.
3804 				 */
3805 				if (ire->ire_ipversion == IPV6_VERSION) {
3806 					ASSERT(ipv6_ire_default_count != 0);
3807 					ipv6_ire_default_count--;
3808 				} else {
3809 					ASSERT(ip_ire_default_count != 0);
3810 					ip_ire_default_count--;
3811 				}
3812 			}
3813 			/*
3814 			 * We need to call ire_delete_v4 or ire_delete_v6
3815 			 * to clean up the cache or the redirects pointing at
3816 			 * the default gateway. We need to drop the lock
3817 			 * as ire_flush_cache/ire_delete_host_redircts require
3818 			 * so. But we can't drop the lock, as ire_unlink needs
3819 			 * to atomically remove the ires from the list.
3820 			 * So, create a temporary list of CONDEMNED ires
3821 			 * for doing ire_delete_v4/ire_delete_v6 operations
3822 			 * later on.
3823 			 */
3824 			ire->ire_next = ire_list;
3825 			ire_list = ire;
3826 		}
3827 	}
3828 	ASSERT(irb->irb_refcnt == 0);
3829 	irb->irb_marks &= ~IRE_MARK_CONDEMNED;
3830 	ASSERT(ire_list != NULL);
3831 	return (ire_list);
3832 }
3833 
3834 /*
3835  * Delete all the cache entries with this 'addr'.  When IP gets a gratuitous
3836  * ARP message on any of its interface queue, it scans the cache table and
3837  * deletes all the cache entries for that address. This function is called
3838  * from ip_arp_news in ip.c and  also for ARP ioctl processing in ip_if.c.
3839  * ip_ire_clookup_and_delete returns true if it finds at least one cache entry
3840  * which is used by ip_arp_news to determine if it needs to do an ire_walk_v4.
3841  * The return value is also  used for the same purpose by ARP IOCTL processing
3842  * in ip_if.c when deleting ARP entries. For SIOC*IFARP ioctls in addition to
3843  * the address, ip_if->ipif_ill also needs to be matched.
3844  */
3845 boolean_t
3846 ip_ire_clookup_and_delete(ipaddr_t addr, ipif_t *ipif)
3847 {
3848 	irb_t		*irb;
3849 	ire_t		*cire;
3850 	ill_t		*ill;
3851 	boolean_t	found = B_FALSE, loop_end = B_FALSE;
3852 
3853 	irb = &ip_cache_table[IRE_ADDR_HASH(addr, ip_cache_table_size)];
3854 	IRB_REFHOLD(irb);
3855 	for (cire = irb->irb_ire; cire != NULL; cire = cire->ire_next) {
3856 		if (cire->ire_marks & IRE_MARK_CONDEMNED)
3857 			continue;
3858 		if (cire->ire_addr == addr) {
3859 
3860 			/* This signifies start of an address match */
3861 			if (!loop_end)
3862 				loop_end = B_TRUE;
3863 
3864 			/* We are interested only in IRE_CACHEs */
3865 			if (cire->ire_type == IRE_CACHE) {
3866 				/* If we want a match with the ILL */
3867 				if (ipif != NULL &&
3868 				    ((ill = ire_to_ill(cire)) == NULL ||
3869 				    ill != ipif->ipif_ill)) {
3870 					continue;
3871 				}
3872 				if (!found)
3873 					found = B_TRUE;
3874 				ire_delete(cire);
3875 			}
3876 		/* End of the match */
3877 		} else if (loop_end)
3878 			break;
3879 	}
3880 	IRB_REFRELE(irb);
3881 
3882 	return (found);
3883 
3884 }
3885 
3886 /*
3887  * Delete the specified IRE.
3888  */
3889 void
3890 ire_delete(ire_t *ire)
3891 {
3892 	ire_t	*ire1;
3893 	ire_t	**ptpn;
3894 	irb_t *irb;
3895 
3896 	/*
3897 	 * It was never inserted in the list. Should call REFRELE
3898 	 * to free this IRE.
3899 	 */
3900 	if ((irb = ire->ire_bucket) == NULL) {
3901 		IRE_REFRELE_NOTR(ire);
3902 		return;
3903 	}
3904 
3905 	rw_enter(&irb->irb_lock, RW_WRITER);
3906 
3907 	/*
3908 	 * In case of V4 we might still be waiting for fastpath ack.
3909 	 */
3910 	if (ire->ire_nce == NULL && ire->ire_stq != NULL) {
3911 		ill_t *ill;
3912 
3913 		ill = ire_to_ill(ire);
3914 		if (ill != NULL)
3915 			ire_fastpath_list_delete(ill, ire);
3916 	}
3917 
3918 	if (ire->ire_ptpn == NULL) {
3919 		/*
3920 		 * Some other thread has removed us from the list.
3921 		 * It should have done the REFRELE for us.
3922 		 */
3923 		rw_exit(&irb->irb_lock);
3924 		return;
3925 	}
3926 
3927 	if (irb->irb_refcnt != 0) {
3928 		/*
3929 		 * The last thread to leave this bucket will
3930 		 * delete this ire.
3931 		 */
3932 		if (!(ire->ire_marks & IRE_MARK_CONDEMNED)) {
3933 			irb->irb_ire_cnt--;
3934 			if (ire->ire_marks & IRE_MARK_TEMPORARY)
3935 				irb->irb_tmp_ire_cnt--;
3936 			ire->ire_marks |= IRE_MARK_CONDEMNED;
3937 		}
3938 		irb->irb_marks |= IRE_MARK_CONDEMNED;
3939 		rw_exit(&irb->irb_lock);
3940 		return;
3941 	}
3942 
3943 	/*
3944 	 * Normally to delete an ire, we walk the bucket. While we
3945 	 * walk the bucket, we normally bump up irb_refcnt and hence
3946 	 * we return from above where we mark CONDEMNED and the ire
3947 	 * gets deleted from ire_unlink. This case is where somebody
3948 	 * knows the ire e.g by doing a lookup, and wants to delete the
3949 	 * IRE. irb_refcnt would be 0 in this case if nobody is walking
3950 	 * the bucket.
3951 	 */
3952 	ptpn = ire->ire_ptpn;
3953 	ire1 = ire->ire_next;
3954 	if (ire1 != NULL)
3955 		ire1->ire_ptpn = ptpn;
3956 	ASSERT(ptpn != NULL);
3957 	*ptpn = ire1;
3958 	ire->ire_ptpn = NULL;
3959 	ire->ire_next = NULL;
3960 	if (ire->ire_ipversion == IPV6_VERSION) {
3961 		BUMP_IRE_STATS(ire_stats_v6, ire_stats_deleted);
3962 	} else {
3963 		BUMP_IRE_STATS(ire_stats_v4, ire_stats_deleted);
3964 	}
3965 	/*
3966 	 * ip_wput/ip_wput_v6 checks this flag to see whether
3967 	 * it should still use the cached ire or not.
3968 	 */
3969 	ire->ire_marks |= IRE_MARK_CONDEMNED;
3970 	if (ire->ire_type == IRE_DEFAULT) {
3971 		/*
3972 		 * IRE is out of the list. We need to adjust the
3973 		 * accounting before we drop the lock.
3974 		 */
3975 		if (ire->ire_ipversion == IPV6_VERSION) {
3976 			ASSERT(ipv6_ire_default_count != 0);
3977 			ipv6_ire_default_count--;
3978 		} else {
3979 			ASSERT(ip_ire_default_count != 0);
3980 			ip_ire_default_count--;
3981 		}
3982 	}
3983 	irb->irb_ire_cnt--;
3984 	if (ire->ire_marks & IRE_MARK_TEMPORARY)
3985 		irb->irb_tmp_ire_cnt--;
3986 	rw_exit(&irb->irb_lock);
3987 
3988 	if (ire->ire_ipversion == IPV6_VERSION) {
3989 		ire_delete_v6(ire);
3990 	} else {
3991 		ire_delete_v4(ire);
3992 	}
3993 	/*
3994 	 * We removed it from the list. Decrement the
3995 	 * reference count.
3996 	 */
3997 	IRE_REFRELE_NOTR(ire);
3998 }
3999 
4000 /*
4001  * Delete the specified IRE.
4002  * All calls should use ire_delete().
4003  * Sometimes called as writer though not required by this function.
4004  *
4005  * NOTE : This function is called only if the ire was added
4006  * in the list.
4007  */
4008 static void
4009 ire_delete_v4(ire_t *ire)
4010 {
4011 	ASSERT(ire->ire_refcnt >= 1);
4012 	ASSERT(ire->ire_ipversion == IPV4_VERSION);
4013 
4014 	if (ire->ire_type != IRE_CACHE)
4015 		ire_flush_cache_v4(ire, IRE_FLUSH_DELETE);
4016 	if (ire->ire_type == IRE_DEFAULT) {
4017 		/*
4018 		 * when a default gateway is going away
4019 		 * delete all the host redirects pointing at that
4020 		 * gateway.
4021 		 */
4022 		ire_delete_host_redirects(ire->ire_gateway_addr);
4023 	}
4024 }
4025 
4026 /*
4027  * IRE_REFRELE/ire_refrele are the only caller of the function. It calls
4028  * to free the ire when the reference count goes to zero.
4029  */
4030 void
4031 ire_inactive(ire_t *ire)
4032 {
4033 	mblk_t *mp;
4034 	nce_t	*nce;
4035 	ill_t	*ill = NULL;
4036 	ill_t	*stq_ill = NULL;
4037 	ill_t	*in_ill = NULL;
4038 	ipif_t	*ipif;
4039 	boolean_t	need_wakeup = B_FALSE;
4040 
4041 	ASSERT(ire->ire_refcnt == 0);
4042 	ASSERT(ire->ire_ptpn == NULL);
4043 	ASSERT(ire->ire_next == NULL);
4044 
4045 	if ((nce = ire->ire_nce) != NULL) {
4046 		/* Only IPv6 IRE_CACHE type has an nce */
4047 		ASSERT(ire->ire_type == IRE_CACHE);
4048 		ASSERT(ire->ire_ipversion == IPV6_VERSION);
4049 		NCE_REFRELE_NOTR(nce);
4050 		ire->ire_nce = NULL;
4051 	}
4052 	if (ire->ire_ipif == NULL)
4053 		goto end;
4054 
4055 	ipif = ire->ire_ipif;
4056 	ill = ipif->ipif_ill;
4057 
4058 	if (ire->ire_bucket == NULL) {
4059 		/* The ire was never inserted in the table. */
4060 		goto end;
4061 	}
4062 
4063 	/*
4064 	 * ipif_ire_cnt on this ipif goes down by 1. If the ire_stq is
4065 	 * non-null ill_ire_count also goes down by 1. If the in_ill is
4066 	 * non-null either ill_mrtun_refcnt or ill_srcif_refcnt goes down by 1.
4067 	 *
4068 	 * The ipif that is associated with an ire is ire->ire_ipif and
4069 	 * hence when the ire->ire_ipif->ipif_ire_cnt drops to zero we call
4070 	 * ipif_ill_refrele_tail. Usually stq_ill is null or the same as
4071 	 * ire->ire_ipif->ipif_ill. So nothing more needs to be done. Only
4072 	 * in the case of IRE_CACHES when IPMP is used, stq_ill can be
4073 	 * different. If this is different from ire->ire_ipif->ipif_ill and
4074 	 * if the ill_ire_cnt on the stq_ill also has dropped to zero, we call
4075 	 * ipif_ill_refrele_tail on the stq_ill. If mobile ip is in use
4076 	 * in_ill could be non-null. If it is a reverse tunnel related ire
4077 	 * ill_mrtun_refcnt is non-zero. If it is forward tunnel related ire
4078 	 * ill_srcif_refcnt is non-null.
4079 	 */
4080 
4081 	if (ire->ire_stq != NULL)
4082 		stq_ill = (ill_t *)ire->ire_stq->q_ptr;
4083 	if (ire->ire_in_ill != NULL)
4084 		in_ill = ire->ire_in_ill;
4085 
4086 	if ((stq_ill == NULL || stq_ill == ill) && (in_ill == NULL)) {
4087 		/* Optimize the most common case */
4088 		mutex_enter(&ill->ill_lock);
4089 		ASSERT(ipif->ipif_ire_cnt != 0);
4090 		ipif->ipif_ire_cnt--;
4091 		if (ipif->ipif_ire_cnt == 0)
4092 			need_wakeup = B_TRUE;
4093 		if (stq_ill != NULL) {
4094 			ASSERT(stq_ill->ill_ire_cnt != 0);
4095 			stq_ill->ill_ire_cnt--;
4096 			if (stq_ill->ill_ire_cnt == 0)
4097 				need_wakeup = B_TRUE;
4098 		}
4099 		if (need_wakeup) {
4100 			/* Drops the ill lock */
4101 			ipif_ill_refrele_tail(ill);
4102 		} else {
4103 			mutex_exit(&ill->ill_lock);
4104 		}
4105 	} else {
4106 		/*
4107 		 * We can't grab all the ill locks at the same time.
4108 		 * It can lead to recursive lock enter in the call to
4109 		 * ipif_ill_refrele_tail and later. Instead do it 1 at
4110 		 * a time.
4111 		 */
4112 		mutex_enter(&ill->ill_lock);
4113 		ASSERT(ipif->ipif_ire_cnt != 0);
4114 		ipif->ipif_ire_cnt--;
4115 		if (ipif->ipif_ire_cnt == 0) {
4116 			/* Drops the lock */
4117 			ipif_ill_refrele_tail(ill);
4118 		} else {
4119 			mutex_exit(&ill->ill_lock);
4120 		}
4121 		if (stq_ill != NULL) {
4122 			mutex_enter(&stq_ill->ill_lock);
4123 			ASSERT(stq_ill->ill_ire_cnt != 0);
4124 			stq_ill->ill_ire_cnt--;
4125 			if (stq_ill->ill_ire_cnt == 0)  {
4126 				/* Drops the ill lock */
4127 				ipif_ill_refrele_tail(stq_ill);
4128 			} else {
4129 				mutex_exit(&stq_ill->ill_lock);
4130 			}
4131 		}
4132 		if (in_ill != NULL) {
4133 			mutex_enter(&in_ill->ill_lock);
4134 			if (ire->ire_type == IRE_MIPRTUN) {
4135 				/*
4136 				 * Mobile IP reverse tunnel ire.
4137 				 * Decrement table count and the
4138 				 * ill reference count. This signifies
4139 				 * mipagent is deleting reverse tunnel
4140 				 * route for a particular mobile node.
4141 				 */
4142 				mutex_enter(&ire_mrtun_lock);
4143 				ire_mrtun_count--;
4144 				mutex_exit(&ire_mrtun_lock);
4145 				ASSERT(in_ill->ill_mrtun_refcnt != 0);
4146 				in_ill->ill_mrtun_refcnt--;
4147 				if (in_ill->ill_mrtun_refcnt == 0) {
4148 					/* Drops the ill lock */
4149 					ipif_ill_refrele_tail(in_ill);
4150 				} else {
4151 					mutex_exit(&in_ill->ill_lock);
4152 				}
4153 			} else {
4154 				mutex_enter(&ire_srcif_table_lock);
4155 				ire_srcif_table_count--;
4156 				mutex_exit(&ire_srcif_table_lock);
4157 				ASSERT(in_ill->ill_srcif_refcnt != 0);
4158 				in_ill->ill_srcif_refcnt--;
4159 				if (in_ill->ill_srcif_refcnt == 0) {
4160 					/* Drops the ill lock */
4161 					ipif_ill_refrele_tail(in_ill);
4162 				} else {
4163 					mutex_exit(&in_ill->ill_lock);
4164 				}
4165 			}
4166 		}
4167 	}
4168 end:
4169 	/* This should be true for both V4 and V6 */
4170 	ASSERT(ire->ire_fastpath == NULL);
4171 
4172 
4173 	ire->ire_ipif = NULL;
4174 
4175 	/* Free the xmit header, and the IRE itself. */
4176 	if ((mp = ire->ire_dlureq_mp) != NULL) {
4177 		freeb(mp);
4178 		ire->ire_dlureq_mp = NULL;
4179 	}
4180 
4181 	if ((mp = ire->ire_fp_mp) != NULL) {
4182 		freeb(mp);
4183 		ire->ire_fp_mp = NULL;
4184 	}
4185 
4186 	if (ire->ire_in_ill != NULL) {
4187 		ire->ire_in_ill = NULL;
4188 	}
4189 
4190 #ifdef IRE_DEBUG
4191 	ire_trace_inactive(ire);
4192 #endif
4193 	mutex_destroy(&ire->ire_lock);
4194 	if (ire->ire_ipversion == IPV6_VERSION) {
4195 		BUMP_IRE_STATS(ire_stats_v6, ire_stats_freed);
4196 	} else {
4197 		BUMP_IRE_STATS(ire_stats_v4, ire_stats_freed);
4198 	}
4199 	if (ire->ire_mp != NULL) {
4200 		/* Still in an mblk */
4201 		freeb(ire->ire_mp);
4202 	} else {
4203 		/* Has been allocated out of the cache */
4204 		kmem_cache_free(ire_cache, ire);
4205 	}
4206 }
4207 
4208 /*
4209  * ire_walk routine to delete all IRE_CACHE/IRE_HOST_REDIRECT entries
4210  * that have a given gateway address.
4211  */
4212 void
4213 ire_delete_cache_gw(ire_t *ire, char *cp)
4214 {
4215 	ipaddr_t	gw_addr;
4216 
4217 	if (!(ire->ire_type & (IRE_CACHE|IRE_HOST_REDIRECT)))
4218 		return;
4219 
4220 	bcopy(cp, &gw_addr, sizeof (gw_addr));
4221 	if (ire->ire_gateway_addr == gw_addr) {
4222 		ip1dbg(("ire_delete_cache_gw: deleted 0x%x type %d to 0x%x\n",
4223 			(int)ntohl(ire->ire_addr), ire->ire_type,
4224 			(int)ntohl(ire->ire_gateway_addr)));
4225 		ire_delete(ire);
4226 	}
4227 }
4228 
4229 /*
4230  * Remove all IRE_CACHE entries that match the ire specified.
4231  *
4232  * The flag argument indicates if the flush request is due to addition
4233  * of new route (IRE_FLUSH_ADD) or deletion of old route (IRE_FLUSH_DELETE).
4234  *
4235  * This routine takes only the IREs from the forwarding table and flushes
4236  * the corresponding entries from the cache table.
4237  *
4238  * When flushing due to the deletion of an old route, it
4239  * just checks the cache handles (ire_phandle and ire_ihandle) and
4240  * deletes the ones that match.
4241  *
4242  * When flushing due to the creation of a new route, it checks
4243  * if a cache entry's address matches the one in the IRE and
4244  * that the cache entry's parent has a less specific mask than the
4245  * one in IRE. The destination of such a cache entry could be the
4246  * gateway for other cache entries, so we need to flush those as
4247  * well by looking for gateway addresses matching the IRE's address.
4248  */
4249 void
4250 ire_flush_cache_v4(ire_t *ire, int flag)
4251 {
4252 	int i;
4253 	ire_t *cire;
4254 	irb_t *irb;
4255 
4256 	if (ire->ire_type & IRE_CACHE)
4257 	    return;
4258 
4259 	/*
4260 	 * If a default is just created, there is no point
4261 	 * in going through the cache, as there will not be any
4262 	 * cached ires.
4263 	 */
4264 	if (ire->ire_type == IRE_DEFAULT && flag == IRE_FLUSH_ADD)
4265 		return;
4266 	if (flag == IRE_FLUSH_ADD) {
4267 		/*
4268 		 * This selective flush is due to the addition of
4269 		 * new IRE.
4270 		 */
4271 		for (i = 0; i < ip_cache_table_size; i++) {
4272 			irb = &ip_cache_table[i];
4273 			if ((cire = irb->irb_ire) == NULL)
4274 				continue;
4275 			IRB_REFHOLD(irb);
4276 			for (cire = irb->irb_ire; cire != NULL;
4277 			    cire = cire->ire_next) {
4278 				if (cire->ire_type != IRE_CACHE)
4279 					continue;
4280 				/*
4281 				 * If 'cire' belongs to the same subnet
4282 				 * as the new ire being added, and 'cire'
4283 				 * is derived from a prefix that is less
4284 				 * specific than the new ire being added,
4285 				 * we need to flush 'cire'; for instance,
4286 				 * when a new interface comes up.
4287 				 */
4288 				if (((cire->ire_addr & ire->ire_mask) ==
4289 				    (ire->ire_addr & ire->ire_mask)) &&
4290 				    (ip_mask_to_plen(cire->ire_cmask) <=
4291 				    ire->ire_masklen)) {
4292 					ire_delete(cire);
4293 					continue;
4294 				}
4295 				/*
4296 				 * This is the case when the ire_gateway_addr
4297 				 * of 'cire' belongs to the same subnet as
4298 				 * the new ire being added.
4299 				 * Flushing such ires is sometimes required to
4300 				 * avoid misrouting: say we have a machine with
4301 				 * two interfaces (I1 and I2), a default router
4302 				 * R on the I1 subnet, and a host route to an
4303 				 * off-link destination D with a gateway G on
4304 				 * the I2 subnet.
4305 				 * Under normal operation, we will have an
4306 				 * on-link cache entry for G and an off-link
4307 				 * cache entry for D with G as ire_gateway_addr,
4308 				 * traffic to D will reach its destination
4309 				 * through gateway G.
4310 				 * If the administrator does 'ifconfig I2 down',
4311 				 * the cache entries for D and G will be
4312 				 * flushed. However, G will now be resolved as
4313 				 * an off-link destination using R (the default
4314 				 * router) as gateway. Then D will also be
4315 				 * resolved as an off-link destination using G
4316 				 * as gateway - this behavior is due to
4317 				 * compatibility reasons, see comment in
4318 				 * ire_ihandle_lookup_offlink(). Traffic to D
4319 				 * will go to the router R and probably won't
4320 				 * reach the destination.
4321 				 * The administrator then does 'ifconfig I2 up'.
4322 				 * Since G is on the I2 subnet, this routine
4323 				 * will flush its cache entry. It must also
4324 				 * flush the cache entry for D, otherwise
4325 				 * traffic will stay misrouted until the IRE
4326 				 * times out.
4327 				 */
4328 				if ((cire->ire_gateway_addr & ire->ire_mask) ==
4329 				    (ire->ire_addr & ire->ire_mask)) {
4330 					ire_delete(cire);
4331 					continue;
4332 				}
4333 			}
4334 			IRB_REFRELE(irb);
4335 		}
4336 	} else {
4337 		/*
4338 		 * delete the cache entries based on
4339 		 * handle in the IRE as this IRE is
4340 		 * being deleted/changed.
4341 		 */
4342 		for (i = 0; i < ip_cache_table_size; i++) {
4343 			irb = &ip_cache_table[i];
4344 			if ((cire = irb->irb_ire) == NULL)
4345 				continue;
4346 			IRB_REFHOLD(irb);
4347 			for (cire = irb->irb_ire; cire != NULL;
4348 			    cire = cire->ire_next) {
4349 				if (cire->ire_type != IRE_CACHE)
4350 					continue;
4351 				if ((cire->ire_phandle == 0 ||
4352 				    cire->ire_phandle != ire->ire_phandle) &&
4353 				    (cire->ire_ihandle == 0 ||
4354 				    cire->ire_ihandle != ire->ire_ihandle))
4355 					continue;
4356 				ire_delete(cire);
4357 			}
4358 			IRB_REFRELE(irb);
4359 		}
4360 	}
4361 }
4362 
4363 /*
4364  * Matches the arguments passed with the values in the ire.
4365  *
4366  * Note: for match types that match using "ipif" passed in, ipif
4367  * must be checked for non-NULL before calling this routine.
4368  */
4369 static boolean_t
4370 ire_match_args(ire_t *ire, ipaddr_t addr, ipaddr_t mask, ipaddr_t gateway,
4371     int type, ipif_t *ipif, zoneid_t zoneid, uint32_t ihandle, int match_flags)
4372 {
4373 	ill_t *ire_ill = NULL, *dst_ill;
4374 	ill_t *ipif_ill = NULL;
4375 	ill_group_t *ire_ill_group = NULL;
4376 	ill_group_t *ipif_ill_group = NULL;
4377 
4378 	ASSERT(ire->ire_ipversion == IPV4_VERSION);
4379 	ASSERT((ire->ire_addr & ~ire->ire_mask) == 0);
4380 	ASSERT((!(match_flags & (MATCH_IRE_ILL|MATCH_IRE_ILL_GROUP))) ||
4381 	    (ipif != NULL && !ipif->ipif_isv6));
4382 	ASSERT(!(match_flags & MATCH_IRE_WQ));
4383 
4384 	/*
4385 	 * HIDDEN cache entries have to be looked up specifically with
4386 	 * MATCH_IRE_MARK_HIDDEN. MATCH_IRE_MARK_HIDDEN is usually set
4387 	 * when the interface is FAILED or INACTIVE. In that case,
4388 	 * any IRE_CACHES that exists should be marked with
4389 	 * IRE_MARK_HIDDEN. So, we don't really need to match below
4390 	 * for IRE_MARK_HIDDEN. But we do so for consistency.
4391 	 */
4392 	if (!(match_flags & MATCH_IRE_MARK_HIDDEN) &&
4393 	    (ire->ire_marks & IRE_MARK_HIDDEN))
4394 		return (B_FALSE);
4395 
4396 	if (zoneid != ALL_ZONES && zoneid != ire->ire_zoneid) {
4397 		/*
4398 		 * If MATCH_IRE_ZONEONLY has been set and the supplied zoneid is
4399 		 * valid and does not match that of ire_zoneid, a failure to
4400 		 * match is reported at this point. Otherwise, since some IREs
4401 		 * that are available in the global zone can be used in local
4402 		 * zones, additional checks need to be performed:
4403 		 *
4404 		 *	IRE_BROADCAST, IRE_CACHE and IRE_LOOPBACK
4405 		 *	entries should never be matched in this situation.
4406 		 *
4407 		 *	IRE entries that have an interface associated with them
4408 		 *	should in general not match unless they are an IRE_LOCAL
4409 		 *	or in the case when MATCH_IRE_DEFAULT has been set in
4410 		 *	the caller.  In the case of the former, checking of the
4411 		 *	other fields supplied should take place.
4412 		 *
4413 		 *	In the case where MATCH_IRE_DEFAULT has been set,
4414 		 *	all of the ipif's associated with the IRE's ill are
4415 		 *	checked to see if there is a matching zoneid.  If any
4416 		 *	one ipif has a matching zoneid, this IRE is a
4417 		 *	potential candidate so checking of the other fields
4418 		 *	takes place.
4419 		 *
4420 		 *	In the case where the IRE_INTERFACE has a usable source
4421 		 *	address (indicated by ill_usesrc_ifindex) in the
4422 		 *	correct zone then it's permitted to return this IRE
4423 		 */
4424 		if (match_flags & MATCH_IRE_ZONEONLY)
4425 			return (B_FALSE);
4426 		if (ire->ire_type & (IRE_BROADCAST | IRE_CACHE | IRE_LOOPBACK))
4427 			return (B_FALSE);
4428 		/*
4429 		 * Note, IRE_INTERFACE can have the stq as NULL. For
4430 		 * example, if the default multicast route is tied to
4431 		 * the loopback address.
4432 		 */
4433 		if ((ire->ire_type & IRE_INTERFACE) &&
4434 		    (ire->ire_stq != NULL)) {
4435 			dst_ill = (ill_t *)ire->ire_stq->q_ptr;
4436 			/*
4437 			 * If there is a usable source address in the
4438 			 * zone, then it's ok to return an
4439 			 * IRE_INTERFACE
4440 			 */
4441 			if (ipif_usesrc_avail(dst_ill, zoneid)) {
4442 				ip3dbg(("ire_match_args: dst_ill %p match %d\n",
4443 				    (void *)dst_ill,
4444 				    (ire->ire_addr == (addr & mask))));
4445 			} else {
4446 				ip3dbg(("ire_match_args: src_ipif NULL"
4447 				    " dst_ill %p\n", (void *)dst_ill));
4448 				return (B_FALSE);
4449 			}
4450 		}
4451 		if (ire->ire_ipif != NULL && ire->ire_type != IRE_LOCAL &&
4452 		    !(ire->ire_type & IRE_INTERFACE)) {
4453 			ipif_t	*tipif;
4454 
4455 			if ((match_flags & MATCH_IRE_DEFAULT) == 0) {
4456 				return (B_FALSE);
4457 			}
4458 			mutex_enter(&ire->ire_ipif->ipif_ill->ill_lock);
4459 			for (tipif = ire->ire_ipif->ipif_ill->ill_ipif;
4460 			    tipif != NULL; tipif = tipif->ipif_next) {
4461 				if (IPIF_CAN_LOOKUP(tipif) &&
4462 				    (tipif->ipif_flags & IPIF_UP) &&
4463 				    (tipif->ipif_zoneid == zoneid))
4464 					break;
4465 			}
4466 			mutex_exit(&ire->ire_ipif->ipif_ill->ill_lock);
4467 			if (tipif == NULL) {
4468 				return (B_FALSE);
4469 			}
4470 		}
4471 	}
4472 
4473 	/*
4474 	 * For IRE_CACHES, MATCH_IRE_ILL/ILL_GROUP really means that
4475 	 * somebody wants to send out on a particular interface which
4476 	 * is given by ire_stq and hence use ire_stq to derive the ill
4477 	 * value. ire_ipif for IRE_CACHES is just the means of getting
4478 	 * a source address i.e ire_src_addr = ire->ire_ipif->ipif_src_addr.
4479 	 * ire_to_ill does the right thing for this.
4480 	 */
4481 	if (match_flags & (MATCH_IRE_ILL|MATCH_IRE_ILL_GROUP)) {
4482 		ire_ill = ire_to_ill(ire);
4483 		if (ire_ill != NULL)
4484 			ire_ill_group = ire_ill->ill_group;
4485 		ipif_ill = ipif->ipif_ill;
4486 		ipif_ill_group = ipif_ill->ill_group;
4487 	}
4488 
4489 	if ((ire->ire_addr == (addr & mask)) &&
4490 	    ((!(match_flags & MATCH_IRE_GW)) ||
4491 		(ire->ire_gateway_addr == gateway)) &&
4492 	    ((!(match_flags & MATCH_IRE_TYPE)) ||
4493 		(ire->ire_type & type)) &&
4494 	    ((!(match_flags & MATCH_IRE_SRC)) ||
4495 		(ire->ire_src_addr == ipif->ipif_src_addr)) &&
4496 	    ((!(match_flags & MATCH_IRE_IPIF)) ||
4497 		(ire->ire_ipif == ipif)) &&
4498 	    ((!(match_flags & MATCH_IRE_MARK_HIDDEN)) ||
4499 		(ire->ire_type != IRE_CACHE ||
4500 		ire->ire_marks & IRE_MARK_HIDDEN)) &&
4501 	    ((!(match_flags & MATCH_IRE_ILL)) ||
4502 		(ire_ill == ipif_ill)) &&
4503 	    ((!(match_flags & MATCH_IRE_IHANDLE)) ||
4504 		(ire->ire_ihandle == ihandle)) &&
4505 	    ((!(match_flags & MATCH_IRE_ILL_GROUP)) ||
4506 		(ire_ill == ipif_ill) ||
4507 		(ire_ill_group != NULL &&
4508 		ire_ill_group == ipif_ill_group))) {
4509 		/* We found the matched IRE */
4510 		return (B_TRUE);
4511 	}
4512 	return (B_FALSE);
4513 }
4514 
4515 
4516 /*
4517  * Lookup for a route in all the tables
4518  */
4519 ire_t *
4520 ire_route_lookup(ipaddr_t addr, ipaddr_t mask, ipaddr_t gateway,
4521     int type, ipif_t *ipif, ire_t **pire, zoneid_t zoneid, int flags)
4522 {
4523 	ire_t *ire = NULL;
4524 
4525 	/*
4526 	 * ire_match_args() will dereference ipif MATCH_IRE_SRC or
4527 	 * MATCH_IRE_ILL is set.
4528 	 */
4529 	if ((flags & (MATCH_IRE_SRC | MATCH_IRE_ILL | MATCH_IRE_ILL_GROUP)) &&
4530 	    (ipif == NULL))
4531 		return (NULL);
4532 
4533 	/*
4534 	 * might be asking for a cache lookup,
4535 	 * This is not best way to lookup cache,
4536 	 * user should call ire_cache_lookup directly.
4537 	 *
4538 	 * If MATCH_IRE_TYPE was set, first lookup in the cache table and then
4539 	 * in the forwarding table, if the applicable type flags were set.
4540 	 */
4541 	if ((flags & MATCH_IRE_TYPE) == 0 || (type & IRE_CACHETABLE) != 0) {
4542 		ire = ire_ctable_lookup(addr, gateway, type, ipif, zoneid,
4543 		    flags);
4544 		if (ire != NULL)
4545 			return (ire);
4546 	}
4547 	if ((flags & MATCH_IRE_TYPE) == 0 || (type & IRE_FORWARDTABLE) != 0) {
4548 		ire = ire_ftable_lookup(addr, mask, gateway, type, ipif, pire,
4549 		    zoneid, 0, flags);
4550 	}
4551 	return (ire);
4552 }
4553 
4554 /*
4555  * Lookup a route in forwarding table.
4556  * specific lookup is indicated by passing the
4557  * required parameters and indicating the
4558  * match required in flag field.
4559  *
4560  * Looking for default route can be done in three ways
4561  * 1) pass mask as 0 and set MATCH_IRE_MASK in flags field
4562  *    along with other matches.
4563  * 2) pass type as IRE_DEFAULT and set MATCH_IRE_TYPE in flags
4564  *    field along with other matches.
4565  * 3) if the destination and mask are passed as zeros.
4566  *
4567  * A request to return a default route if no route
4568  * is found, can be specified by setting MATCH_IRE_DEFAULT
4569  * in flags.
4570  *
4571  * It does not support recursion more than one level. It
4572  * will do recursive lookup only when the lookup maps to
4573  * a prefix or default route and MATCH_IRE_RECURSIVE flag is passed.
4574  *
4575  * If the routing table is setup to allow more than one level
4576  * of recursion, the cleaning up cache table will not work resulting
4577  * in invalid routing.
4578  *
4579  * Supports IP_BOUND_IF by following the ipif/ill when recursing.
4580  *
4581  * NOTE : When this function returns NULL, pire has already been released.
4582  *	  pire is valid only when this function successfully returns an
4583  *	  ire.
4584  */
4585 ire_t *
4586 ire_ftable_lookup(ipaddr_t addr, ipaddr_t mask, ipaddr_t gateway,
4587     int type, ipif_t *ipif, ire_t **pire, zoneid_t zoneid, uint32_t ihandle,
4588     int flags)
4589 {
4590 	irb_t *irb_ptr;
4591 	ire_t *ire = NULL;
4592 	int i;
4593 	ipaddr_t gw_addr;
4594 
4595 	ASSERT(ipif == NULL || !ipif->ipif_isv6);
4596 	ASSERT(!(flags & MATCH_IRE_WQ));
4597 
4598 	/*
4599 	 * When we return NULL from this function, we should make
4600 	 * sure that *pire is NULL so that the callers will not
4601 	 * wrongly REFRELE the pire.
4602 	 */
4603 	if (pire != NULL)
4604 		*pire = NULL;
4605 	/*
4606 	 * ire_match_args() will dereference ipif MATCH_IRE_SRC or
4607 	 * MATCH_IRE_ILL is set.
4608 	 */
4609 	if ((flags & (MATCH_IRE_SRC | MATCH_IRE_ILL | MATCH_IRE_ILL_GROUP)) &&
4610 	    (ipif == NULL))
4611 		return (NULL);
4612 
4613 	/*
4614 	 * If the mask is known, the lookup
4615 	 * is simple, if the mask is not known
4616 	 * we need to search.
4617 	 */
4618 	if (flags & MATCH_IRE_MASK) {
4619 		uint_t masklen;
4620 
4621 		masklen = ip_mask_to_plen(mask);
4622 		if (ip_forwarding_table[masklen] == NULL)
4623 			return (NULL);
4624 		irb_ptr = &(ip_forwarding_table[masklen][
4625 		    IRE_ADDR_HASH(addr & mask, ip_ftable_hash_size)]);
4626 		rw_enter(&irb_ptr->irb_lock, RW_READER);
4627 		for (ire = irb_ptr->irb_ire; ire != NULL;
4628 		    ire = ire->ire_next) {
4629 			if (ire->ire_marks & IRE_MARK_CONDEMNED)
4630 				continue;
4631 			if (ire_match_args(ire, addr, mask, gateway, type, ipif,
4632 			    zoneid, ihandle, flags))
4633 				goto found_ire;
4634 		}
4635 		rw_exit(&irb_ptr->irb_lock);
4636 	} else {
4637 		/*
4638 		 * In this case we don't know the mask, we need to
4639 		 * search the table assuming different mask sizes.
4640 		 * we start with 32 bit mask, we don't allow default here.
4641 		 */
4642 		for (i = (IP_MASK_TABLE_SIZE - 1); i > 0; i--) {
4643 			ipaddr_t tmpmask;
4644 
4645 			if ((ip_forwarding_table[i]) == NULL)
4646 				continue;
4647 			tmpmask = ip_plen_to_mask(i);
4648 			irb_ptr = &ip_forwarding_table[i][
4649 			    IRE_ADDR_HASH(addr & tmpmask,
4650 			    ip_ftable_hash_size)];
4651 			rw_enter(&irb_ptr->irb_lock, RW_READER);
4652 			for (ire = irb_ptr->irb_ire; ire != NULL;
4653 			    ire = ire->ire_next) {
4654 				if (ire->ire_marks & IRE_MARK_CONDEMNED)
4655 					continue;
4656 				if (ire_match_args(ire, addr, ire->ire_mask,
4657 				    gateway, type, ipif, zoneid, ihandle,
4658 				    flags))
4659 					goto found_ire;
4660 			}
4661 			rw_exit(&irb_ptr->irb_lock);
4662 		}
4663 	}
4664 	/*
4665 	 * We come here if no route has yet been found.
4666 	 *
4667 	 * Handle the case where default route is
4668 	 * requested by specifying type as one of the possible
4669 	 * types for that can have a zero mask (IRE_DEFAULT and IRE_INTERFACE).
4670 	 *
4671 	 * If MATCH_IRE_MASK is specified, then the appropriate default route
4672 	 * would have been found above if it exists so it isn't looked up here.
4673 	 * If MATCH_IRE_DEFAULT was also specified, then a default route will be
4674 	 * searched for later.
4675 	 */
4676 	if ((flags & (MATCH_IRE_TYPE | MATCH_IRE_MASK)) == MATCH_IRE_TYPE &&
4677 	    (type & (IRE_DEFAULT | IRE_INTERFACE))) {
4678 		if ((ip_forwarding_table[0])) {
4679 			/* addr & mask is zero for defaults */
4680 			irb_ptr = &ip_forwarding_table[0][
4681 			    IRE_ADDR_HASH(0, ip_ftable_hash_size)];
4682 			rw_enter(&irb_ptr->irb_lock, RW_READER);
4683 			for (ire = irb_ptr->irb_ire; ire != NULL;
4684 			    ire = ire->ire_next) {
4685 				if (ire->ire_marks & IRE_MARK_CONDEMNED)
4686 					continue;
4687 				if (ire_match_args(ire, addr, (ipaddr_t)0,
4688 				    gateway, type, ipif, zoneid, ihandle,
4689 				    flags))
4690 					goto found_ire;
4691 			}
4692 			rw_exit(&irb_ptr->irb_lock);
4693 		}
4694 	}
4695 	/*
4696 	 * we come here only if no route is found.
4697 	 * see if the default route can be used which is allowed
4698 	 * only if the default matching criteria is specified.
4699 	 * The ip_ire_default_count tracks the number of IRE_DEFAULT
4700 	 * entries. However, the ip_forwarding_table[0] also contains
4701 	 * interface routes thus the count can be zero.
4702 	 */
4703 	if ((flags & (MATCH_IRE_DEFAULT | MATCH_IRE_MASK)) ==
4704 	    MATCH_IRE_DEFAULT) {
4705 		ire_t	*ire_origin;
4706 		uint_t  g_index;
4707 		uint_t	index;
4708 
4709 		if (ip_forwarding_table[0] == NULL)
4710 			return (NULL);
4711 		irb_ptr = &(ip_forwarding_table[0])[0];
4712 
4713 		/*
4714 		 * Keep a tab on the bucket while looking the IRE_DEFAULT
4715 		 * entries. We need to keep track of a particular IRE
4716 		 * (ire_origin) so this ensures that it will not be unlinked
4717 		 * from the hash list during the recursive lookup below.
4718 		 */
4719 		IRB_REFHOLD(irb_ptr);
4720 		ire = irb_ptr->irb_ire;
4721 		if (ire == NULL) {
4722 			IRB_REFRELE(irb_ptr);
4723 			return (NULL);
4724 		}
4725 
4726 		/*
4727 		 * Get the index first, since it can be changed by other
4728 		 * threads. Then get to the right default route skipping
4729 		 * default interface routes if any. As we hold a reference on
4730 		 * the IRE bucket, ip_ire_default_count can only increase so we
4731 		 * can't reach the end of the hash list unexpectedly.
4732 		 */
4733 		if (ip_ire_default_count != 0) {
4734 			g_index = ip_ire_default_index++;
4735 			index = g_index % ip_ire_default_count;
4736 			while (index != 0) {
4737 				if (!(ire->ire_type & IRE_INTERFACE))
4738 					index--;
4739 				ire = ire->ire_next;
4740 			}
4741 			ASSERT(ire != NULL);
4742 		} else {
4743 			/*
4744 			 * No default routes, so we only have default interface
4745 			 * routes: don't enter the first loop.
4746 			 */
4747 			ire = NULL;
4748 		}
4749 
4750 		/*
4751 		 * Round-robin the default routers list looking for a route that
4752 		 * matches the passed in parameters. If we can't find a default
4753 		 * route (IRE_DEFAULT), look for interface default routes.
4754 		 * We start with the ire we found above and we walk the hash
4755 		 * list until we're back where we started, see
4756 		 * ire_get_next_default_ire(). It doesn't matter if default
4757 		 * routes are added or deleted by other threads - we know this
4758 		 * ire will stay in the list because we hold a reference on the
4759 		 * ire bucket.
4760 		 * NB: if we only have interface default routes, ire is NULL so
4761 		 * we don't even enter this loop (see above).
4762 		 */
4763 		ire_origin = ire;
4764 		for (; ire != NULL;
4765 		    ire = ire_get_next_default_ire(ire, ire_origin)) {
4766 
4767 			if (ire_match_args(ire, addr, (ipaddr_t)0,
4768 			    gateway, type, ipif, zoneid, ihandle, flags)) {
4769 				int match_flags = 0;
4770 				ire_t *rire;
4771 
4772 				/*
4773 				 * The potentially expensive call to
4774 				 * ire_route_lookup() is avoided when we have
4775 				 * only one default route.
4776 				 */
4777 				if (ip_ire_default_count == 1 ||
4778 				    zoneid == ALL_ZONES) {
4779 					IRE_REFHOLD(ire);
4780 					IRB_REFRELE(irb_ptr);
4781 					goto found_ire_held;
4782 				}
4783 				/*
4784 				 * When we're in a local zone, we're only
4785 				 * interested in default routers that are
4786 				 * reachable through ipifs within our zone.
4787 				 */
4788 				if (ire->ire_ipif != NULL) {
4789 					match_flags |= MATCH_IRE_ILL_GROUP;
4790 				}
4791 				rire = ire_route_lookup(ire->ire_gateway_addr,
4792 				    0, 0, 0, ire->ire_ipif, NULL, zoneid,
4793 				    match_flags);
4794 				if (rire != NULL) {
4795 					ire_refrele(rire);
4796 					IRE_REFHOLD(ire);
4797 					IRB_REFRELE(irb_ptr);
4798 					goto found_ire_held;
4799 				}
4800 			}
4801 		}
4802 		/*
4803 		 * Either there are no default routes or we could not
4804 		 * find a default route. Look for a interface default
4805 		 * route matching the args passed in. No round robin
4806 		 * here. Just pick the right one.
4807 		 */
4808 		for (ire = irb_ptr->irb_ire; ire != NULL;
4809 		    ire = ire->ire_next) {
4810 
4811 			if (!(ire->ire_type & IRE_INTERFACE))
4812 				continue;
4813 
4814 			if (ire->ire_marks & IRE_MARK_CONDEMNED)
4815 				continue;
4816 
4817 			if (ire_match_args(ire, addr, (ipaddr_t)0,
4818 			    gateway, type, ipif, zoneid, ihandle, flags)) {
4819 				IRE_REFHOLD(ire);
4820 				IRB_REFRELE(irb_ptr);
4821 				goto found_ire_held;
4822 			}
4823 		}
4824 		IRB_REFRELE(irb_ptr);
4825 	}
4826 	ASSERT(ire == NULL);
4827 	return (NULL);
4828 found_ire:
4829 	ASSERT((ire->ire_marks & IRE_MARK_CONDEMNED) == 0);
4830 	IRE_REFHOLD(ire);
4831 	rw_exit(&irb_ptr->irb_lock);
4832 
4833 found_ire_held:
4834 	ASSERT(ire->ire_type != IRE_MIPRTUN && ire->ire_in_ill == NULL);
4835 	if ((flags & MATCH_IRE_RJ_BHOLE) &&
4836 	    (ire->ire_flags & (RTF_BLACKHOLE | RTF_REJECT))) {
4837 		return (ire);
4838 	}
4839 	/*
4840 	 * At this point, IRE that was found must be an IRE_FORWARDTABLE
4841 	 * type.  If this is a recursive lookup and an IRE_INTERFACE type was
4842 	 * found, return that.  If it was some other IRE_FORWARDTABLE type of
4843 	 * IRE (one of the prefix types), then it is necessary to fill in the
4844 	 * parent IRE pointed to by pire, and then lookup the gateway address of
4845 	 * the parent.  For backwards compatiblity, if this lookup returns an
4846 	 * IRE other than a IRE_CACHETABLE or IRE_INTERFACE, then one more level
4847 	 * of lookup is done.
4848 	 */
4849 	if (flags & MATCH_IRE_RECURSIVE) {
4850 		ipif_t	*gw_ipif;
4851 		int match_flags = MATCH_IRE_DSTONLY;
4852 		ire_t *save_ire;
4853 
4854 		if (ire->ire_type & IRE_INTERFACE)
4855 			return (ire);
4856 		if (pire != NULL)
4857 			*pire = ire;
4858 		/*
4859 		 * If we can't find an IRE_INTERFACE or the caller has not
4860 		 * asked for pire, we need to REFRELE the save_ire.
4861 		 */
4862 		save_ire = ire;
4863 
4864 		/*
4865 		 * Currently MATCH_IRE_ILL is never used with
4866 		 * (MATCH_IRE_RECURSIVE | MATCH_IRE_DEFAULT) while
4867 		 * sending out packets as MATCH_IRE_ILL is used only
4868 		 * for communicating with on-link hosts. We can't assert
4869 		 * that here as RTM_GET calls this function with
4870 		 * MATCH_IRE_ILL | MATCH_IRE_DEFAULT | MATCH_IRE_RECURSIVE.
4871 		 * We have already used the MATCH_IRE_ILL in determining
4872 		 * the right prefix route at this point. To match the
4873 		 * behavior of how we locate routes while sending out
4874 		 * packets, we don't want to use MATCH_IRE_ILL below
4875 		 * while locating the interface route.
4876 		 */
4877 		if (ire->ire_ipif != NULL)
4878 			match_flags |= MATCH_IRE_ILL_GROUP;
4879 
4880 		ire = ire_route_lookup(ire->ire_gateway_addr, 0, 0, 0,
4881 		    ire->ire_ipif, NULL, zoneid, match_flags);
4882 		if (ire == NULL) {
4883 			/*
4884 			 * Do not release the parent ire if MATCH_IRE_PARENT
4885 			 * is set. Also return it via ire.
4886 			 */
4887 			if (flags & MATCH_IRE_PARENT) {
4888 				if (pire != NULL) {
4889 					/*
4890 					 * Need an extra REFHOLD, if the parent
4891 					 * ire is returned via both ire and
4892 					 * pire.
4893 					 */
4894 					IRE_REFHOLD(save_ire);
4895 				}
4896 				ire = save_ire;
4897 			} else {
4898 				ire_refrele(save_ire);
4899 				if (pire != NULL)
4900 					*pire = NULL;
4901 			}
4902 			return (ire);
4903 		}
4904 		if (ire->ire_type & (IRE_CACHETABLE | IRE_INTERFACE)) {
4905 			/*
4906 			 * If the caller did not ask for pire, release
4907 			 * it now.
4908 			 */
4909 			if (pire == NULL) {
4910 				ire_refrele(save_ire);
4911 			}
4912 			return (ire);
4913 		}
4914 		match_flags |= MATCH_IRE_TYPE;
4915 		gw_addr = ire->ire_gateway_addr;
4916 		gw_ipif = ire->ire_ipif;
4917 		ire_refrele(ire);
4918 		ire = ire_route_lookup(gw_addr, 0, 0,
4919 		    (IRE_CACHETABLE | IRE_INTERFACE), gw_ipif, NULL, zoneid,
4920 		    match_flags);
4921 		if (ire == NULL) {
4922 			/*
4923 			 * Do not release the parent ire if MATCH_IRE_PARENT
4924 			 * is set. Also return it via ire.
4925 			 */
4926 			if (flags & MATCH_IRE_PARENT) {
4927 				if (pire != NULL) {
4928 					/*
4929 					 * Need an extra REFHOLD, if the
4930 					 * parent ire is returned via both
4931 					 * ire and pire.
4932 					 */
4933 					IRE_REFHOLD(save_ire);
4934 				}
4935 				ire = save_ire;
4936 			} else {
4937 				ire_refrele(save_ire);
4938 				if (pire != NULL)
4939 					*pire = NULL;
4940 			}
4941 			return (ire);
4942 		} else if (pire == NULL) {
4943 			/*
4944 			 * If the caller did not ask for pire, release
4945 			 * it now.
4946 			 */
4947 			ire_refrele(save_ire);
4948 		}
4949 		return (ire);
4950 	}
4951 	ASSERT(pire == NULL || *pire == NULL);
4952 	return (ire);
4953 }
4954 
4955 /*
4956  * Looks up cache table for a route.
4957  * specific lookup can be indicated by
4958  * passing the MATCH_* flags and the
4959  * necessary parameters.
4960  */
4961 ire_t *
4962 ire_ctable_lookup(ipaddr_t addr, ipaddr_t gateway, int type, ipif_t *ipif,
4963     zoneid_t zoneid, int flags)
4964 {
4965 	irb_t *irb_ptr;
4966 	ire_t *ire;
4967 
4968 	/*
4969 	 * ire_match_args() will dereference ipif MATCH_IRE_SRC or
4970 	 * MATCH_IRE_ILL is set.
4971 	 */
4972 	if ((flags & (MATCH_IRE_SRC | MATCH_IRE_ILL | MATCH_IRE_ILL_GROUP)) &&
4973 	    (ipif == NULL))
4974 		return (NULL);
4975 
4976 	irb_ptr = &ip_cache_table[IRE_ADDR_HASH(addr, ip_cache_table_size)];
4977 	rw_enter(&irb_ptr->irb_lock, RW_READER);
4978 	for (ire = irb_ptr->irb_ire; ire != NULL; ire = ire->ire_next) {
4979 		if (ire->ire_marks & IRE_MARK_CONDEMNED)
4980 			continue;
4981 		ASSERT(ire->ire_mask == IP_HOST_MASK);
4982 		ASSERT(ire->ire_type != IRE_MIPRTUN && ire->ire_in_ill == NULL);
4983 		if (ire_match_args(ire, addr, ire->ire_mask, gateway, type,
4984 		    ipif, zoneid, 0, flags)) {
4985 			IRE_REFHOLD(ire);
4986 			rw_exit(&irb_ptr->irb_lock);
4987 			return (ire);
4988 		}
4989 	}
4990 	rw_exit(&irb_ptr->irb_lock);
4991 	return (NULL);
4992 }
4993 
4994 /*
4995  * Lookup cache. Don't return IRE_MARK_HIDDEN entries. Callers
4996  * should use ire_ctable_lookup with MATCH_IRE_MARK_HIDDEN to get
4997  * to the hidden ones.
4998  */
4999 ire_t *
5000 ire_cache_lookup(ipaddr_t addr, zoneid_t zoneid)
5001 {
5002 	irb_t *irb_ptr;
5003 	ire_t *ire;
5004 
5005 	irb_ptr = &ip_cache_table[IRE_ADDR_HASH(addr, ip_cache_table_size)];
5006 	rw_enter(&irb_ptr->irb_lock, RW_READER);
5007 	for (ire = irb_ptr->irb_ire; ire != NULL; ire = ire->ire_next) {
5008 		if (ire->ire_marks & (IRE_MARK_CONDEMNED | IRE_MARK_HIDDEN))
5009 			continue;
5010 		if (ire->ire_addr == addr) {
5011 			if (zoneid == ALL_ZONES || ire->ire_zoneid == zoneid ||
5012 			    ire->ire_type == IRE_LOCAL) {
5013 				IRE_REFHOLD(ire);
5014 				rw_exit(&irb_ptr->irb_lock);
5015 				return (ire);
5016 			}
5017 		}
5018 	}
5019 	rw_exit(&irb_ptr->irb_lock);
5020 	return (NULL);
5021 }
5022 
5023 /*
5024  * Locate the interface ire that is tied to the cache ire 'cire' via
5025  * cire->ire_ihandle.
5026  *
5027  * We are trying to create the cache ire for an offlink destn based
5028  * on the cache ire of the gateway in 'cire'. 'pire' is the prefix ire
5029  * as found by ip_newroute(). We are called from ip_newroute() in
5030  * the IRE_CACHE case.
5031  */
5032 ire_t *
5033 ire_ihandle_lookup_offlink(ire_t *cire, ire_t *pire)
5034 {
5035 	ire_t	*ire;
5036 	int	match_flags;
5037 	ipaddr_t gw_addr;
5038 	ipif_t	*gw_ipif;
5039 
5040 	ASSERT(cire != NULL && pire != NULL);
5041 
5042 	/*
5043 	 * We don't need to specify the zoneid to ire_ftable_lookup() below
5044 	 * because the ihandle refers to an ipif which can be in only one zone.
5045 	 */
5046 	match_flags =  MATCH_IRE_TYPE | MATCH_IRE_IHANDLE | MATCH_IRE_MASK;
5047 	/*
5048 	 * ip_newroute calls ire_ftable_lookup with MATCH_IRE_ILL only
5049 	 * for on-link hosts. We should never be here for onlink.
5050 	 * Thus, use MATCH_IRE_ILL_GROUP.
5051 	 */
5052 	if (pire->ire_ipif != NULL)
5053 		match_flags |= MATCH_IRE_ILL_GROUP;
5054 	/*
5055 	 * We know that the mask of the interface ire equals cire->ire_cmask.
5056 	 * (When ip_newroute() created 'cire' for the gateway it set its
5057 	 * cmask from the interface ire's mask)
5058 	 */
5059 	ire = ire_ftable_lookup(cire->ire_addr, cire->ire_cmask, 0,
5060 	    IRE_INTERFACE, pire->ire_ipif, NULL, ALL_ZONES, cire->ire_ihandle,
5061 	    match_flags);
5062 	if (ire != NULL)
5063 		return (ire);
5064 	/*
5065 	 * If we didn't find an interface ire above, we can't declare failure.
5066 	 * For backwards compatibility, we need to support prefix routes
5067 	 * pointing to next hop gateways that are not on-link.
5068 	 *
5069 	 * Assume we are trying to ping some offlink destn, and we have the
5070 	 * routing table below.
5071 	 *
5072 	 * Eg.	default	- gw1		<--- pire	(line 1)
5073 	 *	gw1	- gw2				(line 2)
5074 	 *	gw2	- hme0				(line 3)
5075 	 *
5076 	 * If we already have a cache ire for gw1 in 'cire', the
5077 	 * ire_ftable_lookup above would have failed, since there is no
5078 	 * interface ire to reach gw1. We will fallthru below.
5079 	 *
5080 	 * Here we duplicate the steps that ire_ftable_lookup() did in
5081 	 * getting 'cire' from 'pire', in the MATCH_IRE_RECURSIVE case.
5082 	 * The differences are the following
5083 	 * i.   We want the interface ire only, so we call ire_ftable_lookup()
5084 	 *	instead of ire_route_lookup()
5085 	 * ii.  We look for only prefix routes in the 1st call below.
5086 	 * ii.  We want to match on the ihandle in the 2nd call below.
5087 	 */
5088 	match_flags =  MATCH_IRE_TYPE;
5089 	if (pire->ire_ipif != NULL)
5090 		match_flags |= MATCH_IRE_ILL_GROUP;
5091 	ire = ire_ftable_lookup(pire->ire_gateway_addr, 0, 0, IRE_OFFSUBNET,
5092 	    pire->ire_ipif, NULL, ALL_ZONES, 0, match_flags);
5093 	if (ire == NULL)
5094 		return (NULL);
5095 	/*
5096 	 * At this point 'ire' corresponds to the entry shown in line 2.
5097 	 * gw_addr is 'gw2' in the example above.
5098 	 */
5099 	gw_addr = ire->ire_gateway_addr;
5100 	gw_ipif = ire->ire_ipif;
5101 	ire_refrele(ire);
5102 
5103 	match_flags |= MATCH_IRE_IHANDLE;
5104 	ire = ire_ftable_lookup(gw_addr, 0, 0, IRE_INTERFACE,
5105 	    gw_ipif, NULL, ALL_ZONES, cire->ire_ihandle, match_flags);
5106 	return (ire);
5107 }
5108 
5109 /*
5110  * Locate the interface ire that is tied to the cache ire 'cire' via
5111  * cire->ire_ihandle.
5112  *
5113  * We are trying to create the cache ire for an onlink destn. or
5114  * gateway in 'cire'. We are called from ire_add_v4() in the IRE_IF_RESOLVER
5115  * case, after the ire has come back from ARP.
5116  */
5117 ire_t *
5118 ire_ihandle_lookup_onlink(ire_t *cire)
5119 {
5120 	ire_t	*ire;
5121 	int	match_flags;
5122 	int	i;
5123 	int	j;
5124 	irb_t	*irb_ptr;
5125 
5126 	ASSERT(cire != NULL);
5127 
5128 	/*
5129 	 * We don't need to specify the zoneid to ire_ftable_lookup() below
5130 	 * because the ihandle refers to an ipif which can be in only one zone.
5131 	 */
5132 	match_flags =  MATCH_IRE_TYPE | MATCH_IRE_IHANDLE | MATCH_IRE_MASK;
5133 	/*
5134 	 * We know that the mask of the interface ire equals cire->ire_cmask.
5135 	 * (When ip_newroute() created 'cire' for an on-link destn. it set its
5136 	 * cmask from the interface ire's mask)
5137 	 */
5138 	ire = ire_ftable_lookup(cire->ire_addr, cire->ire_cmask, 0,
5139 	    IRE_INTERFACE, NULL, NULL, ALL_ZONES, cire->ire_ihandle,
5140 	    match_flags);
5141 	if (ire != NULL)
5142 		return (ire);
5143 	/*
5144 	 * If we didn't find an interface ire above, we can't declare failure.
5145 	 * For backwards compatibility, we need to support prefix routes
5146 	 * pointing to next hop gateways that are not on-link.
5147 	 *
5148 	 * In the resolver/noresolver case, ip_newroute() thinks it is creating
5149 	 * the cache ire for an onlink destination in 'cire'. But 'cire' is
5150 	 * not actually onlink, because ire_ftable_lookup() cheated it, by
5151 	 * doing ire_route_lookup() twice and returning an interface ire.
5152 	 *
5153 	 * Eg. default	-	gw1			(line 1)
5154 	 *	gw1	-	gw2			(line 2)
5155 	 *	gw2	-	hme0			(line 3)
5156 	 *
5157 	 * In the above example, ip_newroute() tried to create the cache ire
5158 	 * 'cire' for gw1, based on the interface route in line 3. The
5159 	 * ire_ftable_lookup() above fails, because there is no interface route
5160 	 * to reach gw1. (it is gw2). We fall thru below.
5161 	 *
5162 	 * Do a brute force search based on the ihandle in a subset of the
5163 	 * forwarding tables, corresponding to cire->ire_cmask. Otherwise
5164 	 * things become very complex, since we don't have 'pire' in this
5165 	 * case. (Also note that this method is not possible in the offlink
5166 	 * case because we don't know the mask)
5167 	 */
5168 	i = ip_mask_to_plen(cire->ire_cmask);
5169 	if ((ip_forwarding_table[i]) == NULL)
5170 		return (NULL);
5171 	for (j = 0; j < ip_ftable_hash_size; j++) {
5172 		irb_ptr = &ip_forwarding_table[i][j];
5173 		rw_enter(&irb_ptr->irb_lock, RW_READER);
5174 		for (ire = irb_ptr->irb_ire; ire != NULL;
5175 		    ire = ire->ire_next) {
5176 			if (ire->ire_marks & IRE_MARK_CONDEMNED)
5177 				continue;
5178 			if ((ire->ire_type & IRE_INTERFACE) &&
5179 			    (ire->ire_ihandle == cire->ire_ihandle)) {
5180 				IRE_REFHOLD(ire);
5181 				rw_exit(&irb_ptr->irb_lock);
5182 				return (ire);
5183 			}
5184 		}
5185 		rw_exit(&irb_ptr->irb_lock);
5186 	}
5187 	return (NULL);
5188 }
5189 
5190 /*
5191  * ire_mrtun_lookup() is called by ip_rput() when packet is to be
5192  * tunneled through reverse tunnel. This is only supported for
5193  * IPv4 packets
5194  */
5195 
5196 ire_t *
5197 ire_mrtun_lookup(ipaddr_t srcaddr, ill_t *ill)
5198 {
5199 	irb_t *irb_ptr;
5200 	ire_t *ire;
5201 
5202 	ASSERT(ill != NULL);
5203 	ASSERT(!(ill->ill_isv6));
5204 
5205 	if (ip_mrtun_table == NULL)
5206 		return (NULL);
5207 	irb_ptr = &ip_mrtun_table[IRE_ADDR_HASH(srcaddr, IP_MRTUN_TABLE_SIZE)];
5208 	rw_enter(&irb_ptr->irb_lock, RW_READER);
5209 	for (ire = irb_ptr->irb_ire; ire != NULL; ire = ire->ire_next) {
5210 		if (ire->ire_marks & IRE_MARK_CONDEMNED)
5211 			continue;
5212 		if ((ire->ire_in_src_addr == srcaddr) &&
5213 		    ire->ire_in_ill == ill) {
5214 			IRE_REFHOLD(ire);
5215 			rw_exit(&irb_ptr->irb_lock);
5216 			return (ire);
5217 		}
5218 	}
5219 	rw_exit(&irb_ptr->irb_lock);
5220 	return (NULL);
5221 }
5222 
5223 /*
5224  * Return the IRE_LOOPBACK, IRE_IF_RESOLVER or IRE_IF_NORESOLVER
5225  * ire associated with the specified ipif.
5226  *
5227  * This might occasionally be called when IPIF_UP is not set since
5228  * the IP_MULTICAST_IF as well as creating interface routes
5229  * allows specifying a down ipif (ipif_lookup* match ipifs that are down).
5230  *
5231  * Note that if IPIF_NOLOCAL, IPIF_NOXMIT, or IPIF_DEPRECATED is set on
5232  * the ipif, this routine might return NULL.
5233  */
5234 ire_t *
5235 ipif_to_ire(ipif_t *ipif)
5236 {
5237 	ire_t	*ire;
5238 
5239 	ASSERT(!ipif->ipif_isv6);
5240 	if (ipif->ipif_ire_type == IRE_LOOPBACK) {
5241 		ire = ire_ctable_lookup(ipif->ipif_lcl_addr, 0, IRE_LOOPBACK,
5242 		    ipif, ALL_ZONES, (MATCH_IRE_TYPE | MATCH_IRE_IPIF));
5243 	} else if (ipif->ipif_flags & IPIF_POINTOPOINT) {
5244 		/* In this case we need to lookup destination address. */
5245 		ire = ire_ftable_lookup(ipif->ipif_pp_dst_addr, IP_HOST_MASK, 0,
5246 		    IRE_INTERFACE, ipif, NULL, ALL_ZONES, 0,
5247 		    (MATCH_IRE_TYPE | MATCH_IRE_IPIF | MATCH_IRE_MASK));
5248 	} else {
5249 		ire = ire_ftable_lookup(ipif->ipif_subnet,
5250 		    ipif->ipif_net_mask, 0, IRE_INTERFACE, ipif, NULL,
5251 		    ALL_ZONES, 0, (MATCH_IRE_TYPE | MATCH_IRE_IPIF |
5252 		    MATCH_IRE_MASK));
5253 	}
5254 	return (ire);
5255 }
5256 
5257 /*
5258  * ire_walk function.
5259  * Count the number of IRE_CACHE entries in different categories.
5260  */
5261 void
5262 ire_cache_count(ire_t *ire, char *arg)
5263 {
5264 	ire_cache_count_t *icc = (ire_cache_count_t *)arg;
5265 
5266 	if (ire->ire_type != IRE_CACHE)
5267 		return;
5268 
5269 	icc->icc_total++;
5270 
5271 	if (ire->ire_ipversion == IPV6_VERSION) {
5272 		mutex_enter(&ire->ire_lock);
5273 		if (IN6_IS_ADDR_UNSPECIFIED(&ire->ire_gateway_addr_v6)) {
5274 			mutex_exit(&ire->ire_lock);
5275 			icc->icc_onlink++;
5276 			return;
5277 		}
5278 		mutex_exit(&ire->ire_lock);
5279 	} else {
5280 		if (ire->ire_gateway_addr == 0) {
5281 			icc->icc_onlink++;
5282 			return;
5283 		}
5284 	}
5285 
5286 	ASSERT(ire->ire_ipif != NULL);
5287 	if (ire->ire_max_frag < ire->ire_ipif->ipif_mtu)
5288 		icc->icc_pmtu++;
5289 	else if (ire->ire_tire_mark != ire->ire_ob_pkt_count +
5290 	    ire->ire_ib_pkt_count)
5291 		icc->icc_offlink++;
5292 	else
5293 		icc->icc_unused++;
5294 }
5295 
5296 /*
5297  * ire_walk function called by ip_trash_ire_reclaim().
5298  * Free a fraction of the IRE_CACHE cache entries. The fractions are
5299  * different for different categories of IRE_CACHE entries.
5300  * A fraction of zero means to not free any in that category.
5301  * Use the hash bucket id plus lbolt as a random number. Thus if the fraction
5302  * is N then every Nth hash bucket chain will be freed.
5303  */
5304 void
5305 ire_cache_reclaim(ire_t *ire, char *arg)
5306 {
5307 	ire_cache_reclaim_t *icr = (ire_cache_reclaim_t *)arg;
5308 	uint_t rand;
5309 
5310 	if (ire->ire_type != IRE_CACHE)
5311 		return;
5312 
5313 	if (ire->ire_ipversion == IPV6_VERSION) {
5314 		rand = (uint_t)lbolt +
5315 		    IRE_ADDR_HASH_V6(ire->ire_addr_v6, ip6_cache_table_size);
5316 		mutex_enter(&ire->ire_lock);
5317 		if (IN6_IS_ADDR_UNSPECIFIED(&ire->ire_gateway_addr_v6)) {
5318 			mutex_exit(&ire->ire_lock);
5319 			if (icr->icr_onlink != 0 &&
5320 			    (rand/icr->icr_onlink)*icr->icr_onlink == rand) {
5321 				ire_delete(ire);
5322 				return;
5323 			}
5324 			goto done;
5325 		}
5326 		mutex_exit(&ire->ire_lock);
5327 	} else {
5328 		rand = (uint_t)lbolt +
5329 		    IRE_ADDR_HASH(ire->ire_addr, ip_cache_table_size);
5330 		if (ire->ire_gateway_addr == 0) {
5331 			if (icr->icr_onlink != 0 &&
5332 			    (rand/icr->icr_onlink)*icr->icr_onlink == rand) {
5333 				ire_delete(ire);
5334 				return;
5335 			}
5336 			goto done;
5337 		}
5338 	}
5339 	/* Not onlink IRE */
5340 	ASSERT(ire->ire_ipif != NULL);
5341 	if (ire->ire_max_frag < ire->ire_ipif->ipif_mtu) {
5342 		/* Use ptmu fraction */
5343 		if (icr->icr_pmtu != 0 &&
5344 		    (rand/icr->icr_pmtu)*icr->icr_pmtu == rand) {
5345 			ire_delete(ire);
5346 			return;
5347 		}
5348 	} else if (ire->ire_tire_mark != ire->ire_ob_pkt_count +
5349 	    ire->ire_ib_pkt_count) {
5350 		/* Use offlink fraction */
5351 		if (icr->icr_offlink != 0 &&
5352 		    (rand/icr->icr_offlink)*icr->icr_offlink == rand) {
5353 			ire_delete(ire);
5354 			return;
5355 		}
5356 	} else {
5357 		/* Use unused fraction */
5358 		if (icr->icr_unused != 0 &&
5359 		    (rand/icr->icr_unused)*icr->icr_unused == rand) {
5360 			ire_delete(ire);
5361 			return;
5362 		}
5363 	}
5364 done:
5365 	/*
5366 	 * Update tire_mark so that those that haven't been used since this
5367 	 * reclaim will be considered unused next time we reclaim.
5368 	 */
5369 	ire->ire_tire_mark = ire->ire_ob_pkt_count + ire->ire_ib_pkt_count;
5370 }
5371 
5372 static void
5373 power2_roundup(uint32_t *value)
5374 {
5375 	int i;
5376 
5377 	for (i = 1; i < 31; i++) {
5378 		if (*value <= (1 << i))
5379 			break;
5380 	}
5381 	*value = (1 << i);
5382 }
5383 
5384 void
5385 ip_ire_init()
5386 {
5387 	int i;
5388 
5389 	mutex_init(&ire_ft_init_lock, NULL, MUTEX_DEFAULT, 0);
5390 	mutex_init(&ire_handle_lock, NULL, MUTEX_DEFAULT, NULL);
5391 	mutex_init(&ire_mrtun_lock, NULL, MUTEX_DEFAULT, NULL);
5392 	mutex_init(&ire_srcif_table_lock, NULL, MUTEX_DEFAULT, NULL);
5393 
5394 	/* Calculate the IPv4 cache table size. */
5395 	ip_cache_table_size = MAX(ip_cache_table_size,
5396 	    ((kmem_avail() >> ip_ire_mem_ratio) / sizeof (ire_t) /
5397 	    ip_ire_max_bucket_cnt));
5398 	if (ip_cache_table_size > ip_max_cache_table_size)
5399 		ip_cache_table_size = ip_max_cache_table_size;
5400 	/*
5401 	 * Make sure that the table size is always a power of 2.  The
5402 	 * hash macro IRE_ADDR_HASH() depends on that.
5403 	 */
5404 	power2_roundup(&ip_cache_table_size);
5405 
5406 	ip_cache_table = (irb_t *)kmem_zalloc(ip_cache_table_size *
5407 	    sizeof (irb_t), KM_SLEEP);
5408 
5409 	for (i = 0; i < ip_cache_table_size; i++) {
5410 		rw_init(&ip_cache_table[i].irb_lock, NULL,
5411 		    RW_DEFAULT, NULL);
5412 	}
5413 
5414 	/* Calculate the IPv6 cache table size. */
5415 	ip6_cache_table_size = MAX(ip6_cache_table_size,
5416 	    ((kmem_avail() >> ip_ire_mem_ratio) / sizeof (ire_t) /
5417 	    ip6_ire_max_bucket_cnt));
5418 	if (ip6_cache_table_size > ip6_max_cache_table_size)
5419 		ip6_cache_table_size = ip6_max_cache_table_size;
5420 	/*
5421 	 * Make sure that the table size is always a power of 2.  The
5422 	 * hash macro IRE_ADDR_HASH_V6() depends on that.
5423 	 */
5424 	power2_roundup(&ip6_cache_table_size);
5425 
5426 	ip_cache_table_v6 = (irb_t *)kmem_zalloc(ip6_cache_table_size *
5427 	    sizeof (irb_t), KM_SLEEP);
5428 
5429 	for (i = 0; i < ip6_cache_table_size; i++) {
5430 		rw_init(&ip_cache_table_v6[i].irb_lock, NULL,
5431 		    RW_DEFAULT, NULL);
5432 	}
5433 	/*
5434 	 * Create ire caches, ire_reclaim()
5435 	 * will give IRE_CACHE back to system when needed.
5436 	 * This needs to be done here before anything else, since
5437 	 * ire_add() expects the cache to be created.
5438 	 */
5439 	ire_cache = kmem_cache_create("ire_cache",
5440 		sizeof (ire_t), 0, ip_ire_constructor,
5441 		ip_ire_destructor, ip_trash_ire_reclaim, NULL, NULL, 0);
5442 
5443 	/*
5444 	 * Initialize ip_mrtun_table to NULL now, it will be
5445 	 * populated by ip_rt_add if reverse tunnel is created
5446 	 */
5447 	ip_mrtun_table = NULL;
5448 
5449 	/*
5450 	 * Make sure that the forwarding table size is a power of 2.
5451 	 * The IRE*_ADDR_HASH() macroes depend on that.
5452 	 */
5453 	power2_roundup(&ip_ftable_hash_size);
5454 	power2_roundup(&ip6_ftable_hash_size);
5455 }
5456 
5457 void
5458 ip_ire_fini()
5459 {
5460 	int i;
5461 
5462 	mutex_destroy(&ire_ft_init_lock);
5463 	mutex_destroy(&ire_handle_lock);
5464 
5465 	for (i = 0; i < ip_cache_table_size; i++) {
5466 		rw_destroy(&ip_cache_table[i].irb_lock);
5467 	}
5468 	kmem_free(ip_cache_table, ip_cache_table_size * sizeof (irb_t));
5469 
5470 	for (i = 0; i < ip6_cache_table_size; i++) {
5471 		rw_destroy(&ip_cache_table_v6[i].irb_lock);
5472 	}
5473 	kmem_free(ip_cache_table_v6, ip6_cache_table_size * sizeof (irb_t));
5474 
5475 	if (ip_mrtun_table != NULL) {
5476 		for (i = 0; i < IP_MRTUN_TABLE_SIZE; i++) {
5477 			rw_destroy(&ip_mrtun_table[i].irb_lock);
5478 		}
5479 		kmem_free(ip_mrtun_table, IP_MRTUN_TABLE_SIZE * sizeof (irb_t));
5480 	}
5481 	kmem_cache_destroy(ire_cache);
5482 }
5483 
5484 int
5485 ire_add_mrtun(ire_t **ire_p, queue_t *q, mblk_t *mp, ipsq_func_t func)
5486 {
5487 	ire_t   *ire1;
5488 	irb_t	*irb_ptr;
5489 	ire_t	**irep;
5490 	ire_t	*ire;
5491 	int	i;
5492 	uint_t	max_frag;
5493 	ill_t	*stq_ill;
5494 	int error;
5495 
5496 	ire = *ire_p;
5497 	ASSERT(ire->ire_ipversion == IPV4_VERSION);
5498 	/* Is ip_mrtun_table empty ? */
5499 
5500 	if (ip_mrtun_table == NULL) {
5501 		/* create the mrtun table */
5502 		mutex_enter(&ire_mrtun_lock);
5503 		if (ip_mrtun_table == NULL) {
5504 			ip_mrtun_table =
5505 			    (irb_t *)kmem_zalloc(IP_MRTUN_TABLE_SIZE *
5506 			    sizeof (irb_t), KM_NOSLEEP);
5507 
5508 			if (ip_mrtun_table == NULL) {
5509 				ip2dbg(("ire_add_mrtun: allocation failure\n"));
5510 				mutex_exit(&ire_mrtun_lock);
5511 				ire_refrele(ire);
5512 				*ire_p = NULL;
5513 				return (ENOMEM);
5514 			}
5515 
5516 			for (i = 0; i < IP_MRTUN_TABLE_SIZE; i++) {
5517 			    rw_init(&ip_mrtun_table[i].irb_lock, NULL,
5518 				    RW_DEFAULT, NULL);
5519 			}
5520 			ip2dbg(("ire_add_mrtun: mrtun table is created\n"));
5521 		}
5522 		/* some other thread got it and created the table */
5523 		mutex_exit(&ire_mrtun_lock);
5524 	}
5525 
5526 	/*
5527 	 * Check for duplicate in the bucket and insert in the table
5528 	 */
5529 	irb_ptr = &(ip_mrtun_table[IRE_ADDR_HASH(ire->ire_in_src_addr,
5530 	    IP_MRTUN_TABLE_SIZE)]);
5531 
5532 	/*
5533 	 * Start the atomic add of the ire. Grab the ill locks,
5534 	 * ill_g_usesrc_lock and the bucket lock.
5535 	 *
5536 	 * If ipif or ill is changing ire_atomic_start() may queue the
5537 	 * request and return EINPROGRESS.
5538 	 */
5539 	error = ire_atomic_start(irb_ptr, ire, q, mp, func);
5540 	if (error != 0) {
5541 		/*
5542 		 * We don't know whether it is a valid ipif or not.
5543 		 * So, set it to NULL. This assumes that the ire has not added
5544 		 * a reference to the ipif.
5545 		 */
5546 		ire->ire_ipif = NULL;
5547 		ire_delete(ire);
5548 		ip1dbg(("ire_add_mrtun: ire_atomic_start failed\n"));
5549 		*ire_p = NULL;
5550 		return (error);
5551 	}
5552 	for (ire1 = irb_ptr->irb_ire; ire1 != NULL; ire1 = ire1->ire_next) {
5553 		if (ire1->ire_marks & IRE_MARK_CONDEMNED)
5554 			continue;
5555 		/* has anyone inserted the route in the meanwhile ? */
5556 		if (ire1->ire_in_ill == ire->ire_in_ill &&
5557 		    ire1->ire_in_src_addr == ire->ire_in_src_addr) {
5558 			ip1dbg(("ire_add_mrtun: Duplicate entry exists\n"));
5559 			IRE_REFHOLD(ire1);
5560 			ire_atomic_end(irb_ptr, ire);
5561 			ire_delete(ire);
5562 			/* Return the old ire */
5563 			*ire_p = ire1;
5564 			return (0);
5565 		}
5566 	}
5567 
5568 	/* Atomically set the ire_max_frag */
5569 	max_frag = *ire->ire_max_fragp;
5570 	ire->ire_max_fragp = NULL;
5571 	ire->ire_max_frag = MIN(max_frag, IP_MAXPACKET);
5572 
5573 	irep = (ire_t **)irb_ptr;
5574 	if (*irep != NULL) {
5575 		/* Find the last ire which matches ire_in_src_addr */
5576 		ire1 = *irep;
5577 		while (ire1->ire_in_src_addr == ire->ire_in_src_addr) {
5578 			irep = &ire1->ire_next;
5579 			ire1 = *irep;
5580 			if (ire1 == NULL)
5581 				break;
5582 		}
5583 	}
5584 	ire1 = *irep;
5585 	if (ire1 != NULL)
5586 		ire1->ire_ptpn = &ire->ire_next;
5587 	ire->ire_next = ire1;
5588 	/* Link the new one in. */
5589 	ire->ire_ptpn = irep;
5590 	membar_producer();
5591 	*irep = ire;
5592 	ire->ire_bucket = irb_ptr;
5593 	IRE_REFHOLD_LOCKED(ire);
5594 
5595 	ip2dbg(("ire_add_mrtun: created and linked ire %p\n", (void *)*irep));
5596 
5597 	/*
5598 	 * Protect ire_mrtun_count and ill_mrtun_refcnt from
5599 	 * another thread trying to add ire in the table
5600 	 */
5601 	mutex_enter(&ire_mrtun_lock);
5602 	ire_mrtun_count++;
5603 	mutex_exit(&ire_mrtun_lock);
5604 	/*
5605 	 * ill_mrtun_refcnt is protected by the ill_lock held via
5606 	 * ire_atomic_start
5607 	 */
5608 	ire->ire_in_ill->ill_mrtun_refcnt++;
5609 
5610 	if (ire->ire_ipif != NULL) {
5611 		ire->ire_ipif->ipif_ire_cnt++;
5612 		if (ire->ire_stq != NULL) {
5613 			stq_ill = (ill_t *)ire->ire_stq->q_ptr;
5614 			stq_ill->ill_ire_cnt++;
5615 		}
5616 	} else {
5617 		ASSERT(ire->ire_stq == NULL);
5618 	}
5619 
5620 	ire_atomic_end(irb_ptr, ire);
5621 	ire_fastpath(ire);
5622 	*ire_p = ire;
5623 	return (0);
5624 }
5625 
5626 
5627 /* Walks down the mrtun table */
5628 
5629 void
5630 ire_walk_ill_mrtun(uint_t match_flags, uint_t ire_type, pfv_t func, void *arg,
5631     ill_t *ill)
5632 {
5633 	irb_t	*irb;
5634 	ire_t	*ire;
5635 	int	i;
5636 	int	ret;
5637 
5638 	ASSERT((!(match_flags & (MATCH_IRE_WQ | MATCH_IRE_ILL |
5639 	    MATCH_IRE_ILL_GROUP))) || (ill != NULL));
5640 	ASSERT(match_flags == 0 || ire_type == IRE_MIPRTUN);
5641 
5642 	mutex_enter(&ire_mrtun_lock);
5643 	if (ire_mrtun_count == 0) {
5644 		mutex_exit(&ire_mrtun_lock);
5645 		return;
5646 	}
5647 	mutex_exit(&ire_mrtun_lock);
5648 
5649 	ip2dbg(("ire_walk_ill_mrtun:walking the reverse tunnel table \n"));
5650 	for (i = 0; i < IP_MRTUN_TABLE_SIZE; i++) {
5651 
5652 		irb = &(ip_mrtun_table[i]);
5653 		if (irb->irb_ire == NULL)
5654 			continue;
5655 		IRB_REFHOLD(irb);
5656 		for (ire = irb->irb_ire; ire != NULL;
5657 		    ire = ire->ire_next) {
5658 			ASSERT(ire->ire_ipversion == IPV4_VERSION);
5659 			if (match_flags != 0) {
5660 				ret = ire_walk_ill_match(
5661 				    match_flags, ire_type,
5662 				    ire, ill, ALL_ZONES);
5663 			}
5664 			if (match_flags == 0 || ret)
5665 				(*func)(ire, arg);
5666 		}
5667 		IRB_REFRELE(irb);
5668 	}
5669 }
5670 
5671 /*
5672  * Source interface based lookup routine (IPV4 only).
5673  * This routine is called only when RTA_SRCIFP bitflag is set
5674  * by routing socket while adding/deleting the route and it is
5675  * also called from ip_rput() when packets arrive from an interface
5676  * for which ill_srcif_ref_cnt is positive. This function is useful
5677  * when a packet coming from one interface must be forwarded to another
5678  * designated interface to reach the correct node. This function is also
5679  * called from ip_newroute when the link-layer address of an ire is resolved.
5680  * We need to make sure that ip_newroute searches for IRE_IF_RESOLVER type
5681  * ires--thus the ire_type parameter is needed.
5682  */
5683 
5684 ire_t *
5685 ire_srcif_table_lookup(ipaddr_t dst_addr, int ire_type, ipif_t *ipif,
5686     ill_t *in_ill, int flags)
5687 {
5688 	irb_t	*irb_ptr;
5689 	ire_t	*ire;
5690 	irb_t	*ire_srcif_table;
5691 
5692 	ASSERT(in_ill != NULL && !in_ill->ill_isv6);
5693 	ASSERT(!(flags & (MATCH_IRE_ILL|MATCH_IRE_ILL_GROUP)) ||
5694 	    (ipif != NULL && !ipif->ipif_isv6));
5695 
5696 	/*
5697 	 * No need to lock the ill since it is refheld by the caller of this
5698 	 * function
5699 	 */
5700 	if (in_ill->ill_srcif_table == NULL) {
5701 		return (NULL);
5702 	}
5703 
5704 	if (!(flags & MATCH_IRE_TYPE)) {
5705 		flags |= MATCH_IRE_TYPE;
5706 		ire_type = IRE_INTERFACE;
5707 	}
5708 	ire_srcif_table = in_ill->ill_srcif_table;
5709 	irb_ptr = &ire_srcif_table[IRE_ADDR_HASH(dst_addr,
5710 	    IP_SRCIF_TABLE_SIZE)];
5711 	rw_enter(&irb_ptr->irb_lock, RW_READER);
5712 	for (ire = irb_ptr->irb_ire; ire != NULL; ire = ire->ire_next) {
5713 		if (ire->ire_marks & IRE_MARK_CONDEMNED)
5714 			continue;
5715 		if (ire_match_args(ire, dst_addr, ire->ire_mask, 0,
5716 		    ire_type, ipif, ire->ire_zoneid, 0, flags)) {
5717 			IRE_REFHOLD(ire);
5718 			rw_exit(&irb_ptr->irb_lock);
5719 			return (ire);
5720 		}
5721 	}
5722 	/* Not Found */
5723 	rw_exit(&irb_ptr->irb_lock);
5724 	return (NULL);
5725 }
5726 
5727 
5728 /*
5729  * Adds the ire into the special routing table which is hanging off of
5730  * the src_ipif->ipif_ill. It also increments the refcnt in the ill.
5731  * The forward table contains only IRE_IF_RESOLVER, IRE_IF_NORESOLVER
5732  * i,e. IRE_INTERFACE entries. Originally the dlureq_mp field is NULL
5733  * for IRE_IF_RESOLVER entry because we do not have the dst_addr's
5734  * link-layer address at the time of addition.
5735  * Upon resolving the address from ARP, dlureq_mp field is updated with
5736  * proper information in ire_update_srcif_v4.
5737  */
5738 static int
5739 ire_add_srcif_v4(ire_t **ire_p, queue_t *q, mblk_t *mp, ipsq_func_t func)
5740 {
5741 	ire_t	*ire1;
5742 	irb_t	*ire_srcifp_table = NULL;
5743 	irb_t	*irb_ptr = NULL;
5744 	ire_t   **irep;
5745 	ire_t   *ire;
5746 	int	flags;
5747 	int	i;
5748 	ill_t	*stq_ill;
5749 	uint_t	max_frag;
5750 	int error = 0;
5751 
5752 	ire = *ire_p;
5753 	ASSERT(ire->ire_in_ill != NULL);
5754 	ASSERT(ire->ire_ipversion == IPV4_VERSION);
5755 	ASSERT(ire->ire_type == IRE_IF_NORESOLVER ||
5756 	    ire->ire_type == IRE_IF_RESOLVER);
5757 
5758 	ire->ire_mask = IP_HOST_MASK;
5759 	/* Update ire_dlureq_mp with NULL value upon creation */
5760 	if (ire->ire_type == IRE_IF_RESOLVER) {
5761 		/*
5762 		 * assign NULL now, it will be updated
5763 		 * with correct value upon returning from
5764 		 * ARP
5765 		 */
5766 		ire->ire_dlureq_mp = NULL;
5767 	} else {
5768 		ire->ire_dlureq_mp = ill_dlur_gen(NULL,
5769 		    ire->ire_ipif->ipif_ill->ill_phys_addr_length,
5770 		    ire->ire_ipif->ipif_ill->ill_sap,
5771 		    ire->ire_ipif->ipif_ill->ill_sap_length);
5772 	}
5773 	/* Make sure the address is properly masked. */
5774 	ire->ire_addr &= ire->ire_mask;
5775 
5776 	ASSERT(ire->ire_max_fragp != NULL);
5777 	max_frag = *ire->ire_max_fragp;
5778 	ire->ire_max_fragp = NULL;
5779 	ire->ire_max_frag = MIN(max_frag, IP_MAXPACKET);
5780 
5781 	mutex_enter(&ire->ire_in_ill->ill_lock);
5782 	if (ire->ire_in_ill->ill_srcif_table == NULL) {
5783 		/* create the incoming interface based table */
5784 		ire->ire_in_ill->ill_srcif_table =
5785 		    (irb_t *)kmem_zalloc(IP_SRCIF_TABLE_SIZE *
5786 			sizeof (irb_t), KM_NOSLEEP);
5787 		if (ire->ire_in_ill->ill_srcif_table == NULL) {
5788 			ip1dbg(("ire_add_srcif_v4: Allocation fail\n"));
5789 			mutex_exit(&ire->ire_in_ill->ill_lock);
5790 			ire_delete(ire);
5791 			*ire_p = NULL;
5792 			return (ENOMEM);
5793 		}
5794 		ire_srcifp_table = ire->ire_in_ill->ill_srcif_table;
5795 		for (i = 0; i < IP_SRCIF_TABLE_SIZE; i++) {
5796 			rw_init(&ire_srcifp_table[i].irb_lock, NULL,
5797 			    RW_DEFAULT, NULL);
5798 		}
5799 		ip2dbg(("ire_add_srcif_v4: table created for ill %p\n",
5800 		    (void *)ire->ire_in_ill));
5801 	}
5802 	/* Check for duplicate and insert */
5803 	ASSERT(ire->ire_in_ill->ill_srcif_table != NULL);
5804 	irb_ptr =
5805 	    &(ire->ire_in_ill->ill_srcif_table[IRE_ADDR_HASH(ire->ire_addr,
5806 	    IP_SRCIF_TABLE_SIZE)]);
5807 	mutex_exit(&ire->ire_in_ill->ill_lock);
5808 	flags = (MATCH_IRE_MASK | MATCH_IRE_TYPE | MATCH_IRE_GW);
5809 	flags |= MATCH_IRE_IPIF;
5810 
5811 	/*
5812 	 * Start the atomic add of the ire. Grab the ill locks,
5813 	 * ill_g_usesrc_lock and the bucket lock.
5814 	 *
5815 	 * If ipif or ill is changing ire_atomic_start() may queue the
5816 	 * request and return EINPROGRESS.
5817 	 */
5818 	error = ire_atomic_start(irb_ptr, ire, q, mp, func);
5819 	if (error != 0) {
5820 		/*
5821 		 * We don't know whether it is a valid ipif or not.
5822 		 * So, set it to NULL. This assumes that the ire has not added
5823 		 * a reference to the ipif.
5824 		 */
5825 		ire->ire_ipif = NULL;
5826 		ire_delete(ire);
5827 		ip1dbg(("ire_add_srcif_v4: ire_atomic_start failed\n"));
5828 		*ire_p = NULL;
5829 		return (error);
5830 	}
5831 	for (ire1 = irb_ptr->irb_ire; ire1 != NULL; ire1 = ire1->ire_next) {
5832 		if (ire1->ire_marks & IRE_MARK_CONDEMNED)
5833 			continue;
5834 		if (ire1->ire_zoneid != ire->ire_zoneid)
5835 			continue;
5836 		/* Has anyone inserted route in the meanwhile ? */
5837 		if (ire_match_args(ire1, ire->ire_addr, ire->ire_mask, 0,
5838 		    ire->ire_type, ire->ire_ipif, ire->ire_zoneid, 0, flags)) {
5839 			ip1dbg(("ire_add_srcif_v4 : Duplicate entry exists\n"));
5840 			IRE_REFHOLD(ire1);
5841 			ire_atomic_end(irb_ptr, ire);
5842 			ire_delete(ire);
5843 			/* Return old ire as in ire_add_v4 */
5844 			*ire_p = ire1;
5845 			return (0);
5846 		}
5847 	}
5848 	irep = (ire_t **)irb_ptr;
5849 	if (*irep != NULL) {
5850 		/* Find the last ire which matches ire_addr */
5851 		ire1 = *irep;
5852 		while (ire1->ire_addr == ire->ire_addr) {
5853 			irep = &ire1->ire_next;
5854 			ire1 = *irep;
5855 			if (ire1 == NULL)
5856 				break;
5857 		}
5858 	}
5859 	ire1 = *irep;
5860 	if (ire1 != NULL)
5861 		ire1->ire_ptpn = &ire->ire_next;
5862 	ire->ire_next = ire1;
5863 	/* Link the new one in. */
5864 	ire->ire_ptpn = irep;
5865 	membar_producer();
5866 	*irep = ire;
5867 	ire->ire_bucket = irb_ptr;
5868 	IRE_REFHOLD_LOCKED(ire);
5869 
5870 	/*
5871 	 * Protect ire_in_ill->ill_srcif_refcnt and table reference count.
5872 	 * Note, ire_atomic_start already grabs the ire_in_ill->ill_lock
5873 	 * so ill_srcif_refcnt is already protected.
5874 	 */
5875 	ire->ire_in_ill->ill_srcif_refcnt++;
5876 	mutex_enter(&ire_srcif_table_lock);
5877 	ire_srcif_table_count++;
5878 	mutex_exit(&ire_srcif_table_lock);
5879 	irb_ptr->irb_ire_cnt++;
5880 	if (ire->ire_ipif != NULL) {
5881 		ire->ire_ipif->ipif_ire_cnt++;
5882 		if (ire->ire_stq != NULL) {
5883 			stq_ill = (ill_t *)ire->ire_stq->q_ptr;
5884 			stq_ill->ill_ire_cnt++;
5885 		}
5886 	} else {
5887 		ASSERT(ire->ire_stq == NULL);
5888 	}
5889 
5890 	ire_atomic_end(irb_ptr, ire);
5891 	*ire_p = ire;
5892 	return (0);
5893 }
5894 
5895 
5896 /*
5897  * This function is called by ire_add_then_send when ARP request comes
5898  * back to ip_wput->ire_add_then_send for resolved ire in the interface
5899  * based routing table. At this point, it only needs to update the resolver
5900  * information for the ire. The passed ire is returned to the caller as it
5901  * is the ire which is created as mblk.
5902  */
5903 
5904 static ire_t *
5905 ire_update_srcif_v4(ire_t *ire)
5906 {
5907 	ire_t   *ire1;
5908 	irb_t	*irb;
5909 	int	error;
5910 
5911 	ASSERT(ire->ire_type != IRE_MIPRTUN &&
5912 	    ire->ire_ipif->ipif_net_type == IRE_IF_RESOLVER);
5913 	ASSERT(ire->ire_ipversion == IPV4_VERSION);
5914 
5915 	/*
5916 	 * This ire is from ARP. Update
5917 	 * ire_dlureq_mp info
5918 	 */
5919 	ire1 = ire_srcif_table_lookup(ire->ire_addr,
5920 	    IRE_IF_RESOLVER, ire->ire_ipif,
5921 	    ire->ire_in_ill,
5922 	    MATCH_IRE_ILL | MATCH_IRE_TYPE);
5923 	if (ire1 == NULL) {
5924 		/* Mobile node registration expired ? */
5925 		ire_delete(ire);
5926 		return (NULL);
5927 	}
5928 	irb = ire1->ire_bucket;
5929 	ASSERT(irb != NULL);
5930 	/*
5931 	 * Start the atomic add of the ire. Grab the ill locks,
5932 	 * ill_g_usesrc_lock and the bucket lock.
5933 	 */
5934 	error = ire_atomic_start(irb, ire1, NULL, NULL, NULL);
5935 	if (error != 0) {
5936 		/*
5937 		 * We don't know whether it is a valid ipif or not.
5938 		 * So, set it to NULL. This assumes that the ire has not added
5939 		 * a reference to the ipif.
5940 		 */
5941 		ire->ire_ipif = NULL;
5942 		ire_delete(ire);
5943 		ip1dbg(("ire_update_srcif_v4: ire_atomic_start failed\n"));
5944 		return (NULL);
5945 	}
5946 	ASSERT(ire->ire_max_fragp == NULL);
5947 	ire->ire_max_frag = ire1->ire_max_frag;
5948 	/*
5949 	 * Update resolver information and
5950 	 * send-to queue.
5951 	 */
5952 	ASSERT(ire->ire_dlureq_mp != NULL);
5953 	ire1->ire_dlureq_mp = copyb(ire->ire_dlureq_mp);
5954 	if (ire1->ire_dlureq_mp ==  NULL) {
5955 		ip0dbg(("ire_update_srcif: copyb failed\n"));
5956 		ire_refrele(ire1);
5957 		ire_refrele(ire);
5958 		ire_atomic_end(irb, ire1);
5959 		return (NULL);
5960 	}
5961 	ire1->ire_stq = ire->ire_stq;
5962 
5963 	ASSERT(ire->ire_fp_mp == NULL);
5964 
5965 	ire_atomic_end(irb, ire1);
5966 	ire_refrele(ire1);
5967 	/* Return the passed ire */
5968 	return (ire);   /* Update done */
5969 }
5970 
5971 
5972 /*
5973  * Check if another multirt route resolution is needed.
5974  * B_TRUE is returned is there remain a resolvable route,
5975  * or if no route for that dst is resolved yet.
5976  * B_FALSE is returned if all routes for that dst are resolved
5977  * or if the remaining unresolved routes are actually not
5978  * resolvable.
5979  * This only works in the global zone.
5980  */
5981 boolean_t
5982 ire_multirt_need_resolve(ipaddr_t dst)
5983 {
5984 	ire_t	*first_fire;
5985 	ire_t	*first_cire;
5986 	ire_t	*fire;
5987 	ire_t	*cire;
5988 	irb_t	*firb;
5989 	irb_t	*cirb;
5990 	int	unres_cnt = 0;
5991 	boolean_t resolvable = B_FALSE;
5992 
5993 	/* Retrieve the first IRE_HOST that matches the destination */
5994 	first_fire = ire_ftable_lookup(dst, IP_HOST_MASK, 0, IRE_HOST, NULL,
5995 	    NULL, ALL_ZONES, 0, MATCH_IRE_MASK | MATCH_IRE_TYPE);
5996 
5997 	/* No route at all */
5998 	if (first_fire == NULL) {
5999 		return (B_TRUE);
6000 	}
6001 
6002 	firb = first_fire->ire_bucket;
6003 	ASSERT(firb != NULL);
6004 
6005 	/* Retrieve the first IRE_CACHE ire for that destination. */
6006 	first_cire = ire_cache_lookup(dst, GLOBAL_ZONEID);
6007 
6008 	/* No resolved route. */
6009 	if (first_cire == NULL) {
6010 		ire_refrele(first_fire);
6011 		return (B_TRUE);
6012 	}
6013 
6014 	/*
6015 	 * At least one route is resolved. Here we look through the forward
6016 	 * and cache tables, to compare the number of declared routes
6017 	 * with the number of resolved routes. The search for a resolvable
6018 	 * route is performed only if at least one route remains
6019 	 * unresolved.
6020 	 */
6021 	cirb = first_cire->ire_bucket;
6022 	ASSERT(cirb != NULL);
6023 
6024 	/* Count the number of routes to that dest that are declared. */
6025 	IRB_REFHOLD(firb);
6026 	for (fire = first_fire; fire != NULL; fire = fire->ire_next) {
6027 		if (!(fire->ire_flags & RTF_MULTIRT))
6028 			continue;
6029 		if (fire->ire_addr != dst)
6030 			continue;
6031 		unres_cnt++;
6032 	}
6033 	IRB_REFRELE(firb);
6034 
6035 	/* Then subtract the number of routes to that dst that are resolved */
6036 	IRB_REFHOLD(cirb);
6037 	for (cire = first_cire; cire != NULL; cire = cire->ire_next) {
6038 		if (!(cire->ire_flags & RTF_MULTIRT))
6039 			continue;
6040 		if (cire->ire_addr != dst)
6041 			continue;
6042 		if (cire->ire_marks & (IRE_MARK_CONDEMNED | IRE_MARK_HIDDEN))
6043 			continue;
6044 		unres_cnt--;
6045 	}
6046 	IRB_REFRELE(cirb);
6047 
6048 	/* At least one route is unresolved; search for a resolvable route. */
6049 	if (unres_cnt > 0)
6050 		resolvable = ire_multirt_lookup(&first_cire, &first_fire,
6051 		    MULTIRT_USESTAMP | MULTIRT_CACHEGW);
6052 
6053 	if (first_fire != NULL)
6054 		ire_refrele(first_fire);
6055 
6056 	if (first_cire != NULL)
6057 		ire_refrele(first_cire);
6058 
6059 	return (resolvable);
6060 }
6061 
6062 
6063 /*
6064  * Explore a forward_table bucket, starting from fire_arg.
6065  * fire_arg MUST be an IRE_HOST entry.
6066  *
6067  * Return B_TRUE and update *ire_arg and *fire_arg
6068  * if at least one resolvable route is found. *ire_arg
6069  * is the IRE entry for *fire_arg's gateway.
6070  *
6071  * Return B_FALSE otherwise (all routes are resolved or
6072  * the remaining unresolved routes are all unresolvable).
6073  *
6074  * The IRE selection relies on a priority mechanism
6075  * driven by the flags passed in by the caller.
6076  * The caller, such as ip_newroute_ipif(), can get the most
6077  * relevant ire at each stage of a multiple route resolution.
6078  *
6079  * The rules are:
6080  *
6081  * - if MULTIRT_CACHEGW is specified in flags, IRE_CACHETABLE
6082  *   ires are preferred for the gateway. This gives the highest
6083  *   priority to routes that can be resolved without using
6084  *   a resolver.
6085  *
6086  * - if MULTIRT_CACHEGW is not specified, or if MULTIRT_CACHEGW
6087  *   is specified but no IRE_CACHETABLE ire entry for the gateway
6088  *   is found, the following rules apply.
6089  *
6090  * - if MULTIRT_USESTAMP is specified in flags, IRE_INTERFACE
6091  *   ires for the gateway, that have not been tried since
6092  *   a configurable amount of time, are preferred.
6093  *   This applies when a resolver must be invoked for
6094  *   a missing route, but we don't want to use the resolver
6095  *   upon each packet emission. If no such resolver is found,
6096  *   B_FALSE is returned.
6097  *   The MULTIRT_USESTAMP flag can be combined with
6098  *   MULTIRT_CACHEGW.
6099  *
6100  * - if MULTIRT_USESTAMP is not specified in flags, the first
6101  *   unresolved but resolvable route is selected.
6102  *
6103  * - Otherwise, there is no resolvalble route, and
6104  *   B_FALSE is returned.
6105  *
6106  * At last, MULTIRT_SETSTAMP can be specified in flags to
6107  * request the timestamp of unresolvable routes to
6108  * be refreshed. This prevents the useless exploration
6109  * of those routes for a while, when MULTIRT_USESTAMP is used.
6110  *
6111  * This only works in the global zone.
6112  */
6113 boolean_t
6114 ire_multirt_lookup(ire_t **ire_arg, ire_t **fire_arg, uint32_t flags)
6115 {
6116 	clock_t	delta;
6117 	ire_t	*best_fire = NULL;
6118 	ire_t	*best_cire = NULL;
6119 	ire_t	*first_fire;
6120 	ire_t	*first_cire;
6121 	ire_t	*fire;
6122 	ire_t	*cire;
6123 	irb_t	*firb = NULL;
6124 	irb_t	*cirb = NULL;
6125 	ire_t	*gw_ire;
6126 	boolean_t	already_resolved;
6127 	boolean_t	res;
6128 	ipaddr_t	dst;
6129 	ipaddr_t	gw;
6130 
6131 	ip2dbg(("ire_multirt_lookup: *ire_arg %p, *fire_arg %p, flags %04x\n",
6132 	    (void *)*ire_arg, (void *)*fire_arg, flags));
6133 
6134 	ASSERT(ire_arg != NULL);
6135 	ASSERT(fire_arg != NULL);
6136 
6137 	/* Not an IRE_HOST ire; give up. */
6138 	if ((*fire_arg == NULL) || ((*fire_arg)->ire_type != IRE_HOST)) {
6139 		return (B_FALSE);
6140 	}
6141 
6142 	/* This is the first IRE_HOST ire for that destination. */
6143 	first_fire = *fire_arg;
6144 	firb = first_fire->ire_bucket;
6145 	ASSERT(firb != NULL);
6146 
6147 	dst = first_fire->ire_addr;
6148 
6149 	ip2dbg(("ire_multirt_lookup: dst %08x\n", ntohl(dst)));
6150 
6151 	/*
6152 	 * Retrieve the first IRE_CACHE ire for that destination;
6153 	 * if we don't find one, no route for that dest is
6154 	 * resolved yet.
6155 	 */
6156 	first_cire = ire_cache_lookup(dst, GLOBAL_ZONEID);
6157 	if (first_cire != NULL) {
6158 		cirb = first_cire->ire_bucket;
6159 	}
6160 
6161 	ip2dbg(("ire_multirt_lookup: first_cire %p\n", (void *)first_cire));
6162 
6163 	/*
6164 	 * Search for a resolvable route, giving the top priority
6165 	 * to routes that can be resolved without any call to the resolver.
6166 	 */
6167 	IRB_REFHOLD(firb);
6168 
6169 	if (!CLASSD(dst)) {
6170 		/*
6171 		 * For all multiroute IRE_HOST ires for that destination,
6172 		 * check if the route via the IRE_HOST's gateway is
6173 		 * resolved yet.
6174 		 */
6175 		for (fire = first_fire; fire != NULL; fire = fire->ire_next) {
6176 
6177 			if (!(fire->ire_flags & RTF_MULTIRT))
6178 				continue;
6179 			if (fire->ire_addr != dst)
6180 				continue;
6181 
6182 			gw = fire->ire_gateway_addr;
6183 
6184 			ip2dbg(("ire_multirt_lookup: fire %p, "
6185 			    "ire_addr %08x, ire_gateway_addr %08x\n",
6186 			    (void *)fire, ntohl(fire->ire_addr), ntohl(gw)));
6187 
6188 			already_resolved = B_FALSE;
6189 
6190 			if (first_cire != NULL) {
6191 				ASSERT(cirb != NULL);
6192 
6193 				IRB_REFHOLD(cirb);
6194 				/*
6195 				 * For all IRE_CACHE ires for that
6196 				 * destination.
6197 				 */
6198 				for (cire = first_cire;
6199 				    cire != NULL;
6200 				    cire = cire->ire_next) {
6201 
6202 					if (!(cire->ire_flags & RTF_MULTIRT))
6203 						continue;
6204 					if (cire->ire_addr != dst)
6205 						continue;
6206 					if (cire->ire_marks &
6207 					    (IRE_MARK_CONDEMNED |
6208 						IRE_MARK_HIDDEN))
6209 						continue;
6210 					/*
6211 					 * Check if the IRE_CACHE's gateway
6212 					 * matches the IRE_HOST's gateway.
6213 					 */
6214 					if (cire->ire_gateway_addr == gw) {
6215 						already_resolved = B_TRUE;
6216 						break;
6217 					}
6218 				}
6219 				IRB_REFRELE(cirb);
6220 			}
6221 
6222 			/*
6223 			 * This route is already resolved;
6224 			 * proceed with next one.
6225 			 */
6226 			if (already_resolved) {
6227 				ip2dbg(("ire_multirt_lookup: found cire %p, "
6228 				    "already resolved\n", (void *)cire));
6229 				continue;
6230 			}
6231 
6232 			/*
6233 			 * The route is unresolved; is it actually
6234 			 * resolvable, i.e. is there a cache or a resolver
6235 			 * for the gateway?
6236 			 */
6237 			gw_ire = ire_route_lookup(gw, 0, 0, 0, NULL, NULL,
6238 			    ALL_ZONES, MATCH_IRE_RECURSIVE);
6239 
6240 			ip2dbg(("ire_multirt_lookup: looked up gw_ire %p\n",
6241 			    (void *)gw_ire));
6242 
6243 			/*
6244 			 * If gw_ire is typed IRE_CACHETABLE,
6245 			 * this route can be resolved without any call to the
6246 			 * resolver. If the MULTIRT_CACHEGW flag is set,
6247 			 * give the top priority to this ire and exit the
6248 			 * loop.
6249 			 * This is typically the case when an ARP reply
6250 			 * is processed through ip_wput_nondata().
6251 			 */
6252 			if ((flags & MULTIRT_CACHEGW) &&
6253 			    (gw_ire != NULL) &&
6254 			    (gw_ire->ire_type & IRE_CACHETABLE)) {
6255 				/*
6256 				 * Release the resolver associated to the
6257 				 * previous candidate best ire, if any.
6258 				 */
6259 				if (best_cire != NULL) {
6260 					ire_refrele(best_cire);
6261 					ASSERT(best_fire != NULL);
6262 				}
6263 
6264 				best_fire = fire;
6265 				best_cire = gw_ire;
6266 
6267 				ip2dbg(("ire_multirt_lookup: found top prio "
6268 				    "best_fire %p, best_cire %p\n",
6269 				    (void *)best_fire, (void *)best_cire));
6270 				break;
6271 			}
6272 
6273 			/*
6274 			 * Compute the time elapsed since our preceding
6275 			 * attempt to  resolve that route.
6276 			 * If the MULTIRT_USESTAMP flag is set, we take that
6277 			 * route into account only if this time interval
6278 			 * exceeds ip_multirt_resolution_interval;
6279 			 * this prevents us from attempting to resolve a
6280 			 * broken route upon each sending of a packet.
6281 			 */
6282 			delta = lbolt - fire->ire_last_used_time;
6283 			delta = TICK_TO_MSEC(delta);
6284 
6285 			res = (boolean_t)
6286 			    ((delta > ip_multirt_resolution_interval) ||
6287 				(!(flags & MULTIRT_USESTAMP)));
6288 
6289 			ip2dbg(("ire_multirt_lookup: fire %p, delta %lu, "
6290 			    "res %d\n",
6291 			    (void *)fire, delta, res));
6292 
6293 			if (res) {
6294 				/*
6295 				 * We are here if MULTIRT_USESTAMP flag is set
6296 				 * and the resolver for fire's gateway
6297 				 * has not been tried since
6298 				 * ip_multirt_resolution_interval, or if
6299 				 * MULTIRT_USESTAMP is not set but gw_ire did
6300 				 * not fill the conditions for MULTIRT_CACHEGW,
6301 				 * or if neither MULTIRT_USESTAMP nor
6302 				 * MULTIRT_CACHEGW are set.
6303 				 */
6304 				if (gw_ire != NULL) {
6305 					if (best_fire == NULL) {
6306 						ASSERT(best_cire == NULL);
6307 
6308 						best_fire = fire;
6309 						best_cire = gw_ire;
6310 
6311 						ip2dbg(("ire_multirt_lookup:"
6312 						    "found candidate "
6313 						    "best_fire %p, "
6314 						    "best_cire %p\n",
6315 						    (void *)best_fire,
6316 						    (void *)best_cire));
6317 
6318 						/*
6319 						 * If MULTIRT_CACHEGW is not
6320 						 * set, we ignore the top
6321 						 * priority ires that can
6322 						 * be resolved without any
6323 						 * call to the resolver;
6324 						 * In that case, there is
6325 						 * actually no need
6326 						 * to continue the loop.
6327 						 */
6328 						if (!(flags &
6329 						    MULTIRT_CACHEGW)) {
6330 							break;
6331 						}
6332 						continue;
6333 					}
6334 				} else {
6335 					/*
6336 					 * No resolver for the gateway: the
6337 					 * route is not resolvable.
6338 					 * If the MULTIRT_SETSTAMP flag is
6339 					 * set, we stamp the IRE_HOST ire,
6340 					 * so we will not select it again
6341 					 * during this resolution interval.
6342 					 */
6343 					if (flags & MULTIRT_SETSTAMP)
6344 						fire->ire_last_used_time =
6345 						    lbolt;
6346 				}
6347 			}
6348 
6349 			if (gw_ire != NULL)
6350 				ire_refrele(gw_ire);
6351 		}
6352 	} else { /* CLASSD(dst) */
6353 
6354 		for (fire = first_fire;
6355 		    fire != NULL;
6356 		    fire = fire->ire_next) {
6357 
6358 			if (!(fire->ire_flags & RTF_MULTIRT))
6359 				continue;
6360 			if (fire->ire_addr != dst)
6361 				continue;
6362 
6363 			already_resolved = B_FALSE;
6364 
6365 			gw = fire->ire_gateway_addr;
6366 
6367 			gw_ire = ire_ftable_lookup(gw, 0, 0, IRE_INTERFACE,
6368 			    NULL, NULL, ALL_ZONES, 0,
6369 			    MATCH_IRE_RECURSIVE | MATCH_IRE_TYPE);
6370 
6371 			/* No resolver for the gateway; we skip this ire. */
6372 			if (gw_ire == NULL) {
6373 				continue;
6374 			}
6375 
6376 			if (first_cire != NULL) {
6377 
6378 				IRB_REFHOLD(cirb);
6379 				/*
6380 				 * For all IRE_CACHE ires for that
6381 				 * destination.
6382 				 */
6383 				for (cire = first_cire;
6384 				    cire != NULL;
6385 				    cire = cire->ire_next) {
6386 
6387 					if (!(cire->ire_flags & RTF_MULTIRT))
6388 						continue;
6389 					if (cire->ire_addr != dst)
6390 						continue;
6391 					if (cire->ire_marks &
6392 					    (IRE_MARK_CONDEMNED |
6393 						IRE_MARK_HIDDEN))
6394 						continue;
6395 
6396 					/*
6397 					 * Cache entries are linked to the
6398 					 * parent routes using the parent handle
6399 					 * (ire_phandle). If no cache entry has
6400 					 * the same handle as fire, fire is
6401 					 * still unresolved.
6402 					 */
6403 					ASSERT(cire->ire_phandle != 0);
6404 					if (cire->ire_phandle ==
6405 					    fire->ire_phandle) {
6406 						already_resolved = B_TRUE;
6407 						break;
6408 					}
6409 				}
6410 				IRB_REFRELE(cirb);
6411 			}
6412 
6413 			/*
6414 			 * This route is already resolved; proceed with
6415 			 * next one.
6416 			 */
6417 			if (already_resolved) {
6418 				ire_refrele(gw_ire);
6419 				continue;
6420 			}
6421 
6422 			/*
6423 			 * Compute the time elapsed since our preceding
6424 			 * attempt to resolve that route.
6425 			 * If the MULTIRT_USESTAMP flag is set, we take
6426 			 * that route into account only if this time
6427 			 * interval exceeds ip_multirt_resolution_interval;
6428 			 * this prevents us from attempting to resolve a
6429 			 * broken route upon each sending of a packet.
6430 			 */
6431 			delta = lbolt - fire->ire_last_used_time;
6432 			delta = TICK_TO_MSEC(delta);
6433 
6434 			res = (boolean_t)
6435 			    ((delta > ip_multirt_resolution_interval) ||
6436 			    (!(flags & MULTIRT_USESTAMP)));
6437 
6438 			ip3dbg(("ire_multirt_lookup: fire %p, delta %lx, "
6439 			    "flags %04x, res %d\n",
6440 			    (void *)fire, delta, flags, res));
6441 
6442 			if (res) {
6443 				if (best_cire != NULL) {
6444 					/*
6445 					 * Release the resolver associated
6446 					 * to the preceding candidate best
6447 					 * ire, if any.
6448 					 */
6449 					ire_refrele(best_cire);
6450 					ASSERT(best_fire != NULL);
6451 				}
6452 				best_fire = fire;
6453 				best_cire = gw_ire;
6454 				continue;
6455 			}
6456 
6457 			ire_refrele(gw_ire);
6458 		}
6459 	}
6460 
6461 	if (best_fire != NULL) {
6462 		IRE_REFHOLD(best_fire);
6463 	}
6464 	IRB_REFRELE(firb);
6465 
6466 	/* Release the first IRE_CACHE we initially looked up, if any. */
6467 	if (first_cire != NULL)
6468 		ire_refrele(first_cire);
6469 
6470 	/* Found a resolvable route. */
6471 	if (best_fire != NULL) {
6472 		ASSERT(best_cire != NULL);
6473 
6474 		if (*fire_arg != NULL)
6475 			ire_refrele(*fire_arg);
6476 		if (*ire_arg != NULL)
6477 			ire_refrele(*ire_arg);
6478 
6479 		/*
6480 		 * Update the passed-in arguments with the
6481 		 * resolvable multirt route we found.
6482 		 */
6483 		*fire_arg = best_fire;
6484 		*ire_arg = best_cire;
6485 
6486 		ip2dbg(("ire_multirt_lookup: returning B_TRUE, "
6487 		    "*fire_arg %p, *ire_arg %p\n",
6488 		    (void *)best_fire, (void *)best_cire));
6489 
6490 		return (B_TRUE);
6491 	}
6492 
6493 	ASSERT(best_cire == NULL);
6494 
6495 	ip2dbg(("ire_multirt_lookup: returning B_FALSE, *fire_arg %p, "
6496 	    "*ire_arg %p\n",
6497 	    (void *)*fire_arg, (void *)*ire_arg));
6498 
6499 	/* No resolvable route. */
6500 	return (B_FALSE);
6501 }
6502 
6503 /*
6504  * Find an IRE_OFFSUBNET IRE entry for the multicast address 'group'
6505  * that goes through 'ipif'. As a fallback, a route that goes through
6506  * ipif->ipif_ill can be returned.
6507  */
6508 ire_t *
6509 ipif_lookup_multi_ire(ipif_t *ipif, ipaddr_t group)
6510 {
6511 	ire_t	*ire;
6512 	ire_t	*save_ire = NULL;
6513 	ire_t   *gw_ire;
6514 	irb_t   *irb;
6515 	ipaddr_t gw_addr;
6516 	int	match_flags = MATCH_IRE_TYPE | MATCH_IRE_ILL;
6517 
6518 	ASSERT(CLASSD(group));
6519 
6520 	ire = ire_ftable_lookup(group, 0, 0, 0, NULL, NULL, ALL_ZONES, 0,
6521 	    MATCH_IRE_DEFAULT);
6522 
6523 	if (ire == NULL)
6524 		return (NULL);
6525 
6526 	irb = ire->ire_bucket;
6527 	ASSERT(irb);
6528 
6529 	IRB_REFHOLD(irb);
6530 	ire_refrele(ire);
6531 	for (ire = irb->irb_ire; ire != NULL; ire = ire->ire_next) {
6532 		if (ire->ire_addr != group ||
6533 		    ipif->ipif_zoneid != ire->ire_zoneid) {
6534 			continue;
6535 		}
6536 
6537 		switch (ire->ire_type) {
6538 		case IRE_DEFAULT:
6539 		case IRE_PREFIX:
6540 		case IRE_HOST:
6541 			gw_addr = ire->ire_gateway_addr;
6542 			gw_ire = ire_ftable_lookup(gw_addr, 0, 0, IRE_INTERFACE,
6543 			    ipif, NULL, ALL_ZONES, 0, match_flags);
6544 
6545 			if (gw_ire != NULL) {
6546 				if (save_ire != NULL) {
6547 					ire_refrele(save_ire);
6548 				}
6549 				IRE_REFHOLD(ire);
6550 				if (gw_ire->ire_ipif == ipif) {
6551 					ire_refrele(gw_ire);
6552 
6553 					IRB_REFRELE(irb);
6554 					return (ire);
6555 				}
6556 				ire_refrele(gw_ire);
6557 				save_ire = ire;
6558 			}
6559 			break;
6560 		case IRE_IF_NORESOLVER:
6561 		case IRE_IF_RESOLVER:
6562 			if (ire->ire_ipif == ipif) {
6563 				if (save_ire != NULL) {
6564 					ire_refrele(save_ire);
6565 				}
6566 				IRE_REFHOLD(ire);
6567 
6568 				IRB_REFRELE(irb);
6569 				return (ire);
6570 			}
6571 			break;
6572 		}
6573 	}
6574 	IRB_REFRELE(irb);
6575 
6576 	return (save_ire);
6577 }
6578 
6579 /*
6580  * The purpose of the next two functions is to provide some external access to
6581  * routing/l2 lookup functionality while hiding the implementation of routing
6582  * and interface data structures (IRE/ILL).  Thus, interfaces are passed/
6583  * returned by name instead of by ILL reference.  These functions are used by
6584  * IP Filter.
6585  * Return a link layer header suitable for an IP packet being sent to the
6586  * dst_addr IP address.  The interface associated with the route is put into
6587  * ifname, which must be a buffer of LIFNAMSIZ bytes.  The dst_addr is the
6588  * packet's ultimate destination address, not a router address.
6589  *
6590  * This function is used when the caller wants to know the outbound interface
6591  * and MAC header for a packet given only the address.
6592  */
6593 mblk_t *
6594 ip_nexthop_route(const struct sockaddr *target, char *ifname)
6595 {
6596 	struct nce_s *nce;
6597 	ire_t *dir, *gw;
6598 	ill_t *ill;
6599 	mblk_t *mp;
6600 
6601 	/* parameter sanity */
6602 	if (ifname == NULL || target == NULL)
6603 		return (NULL);
6604 
6605 	gw = NULL;
6606 
6607 	/* Find the route entry, if it exists. */
6608 	switch (target->sa_family) {
6609 	case AF_INET:
6610 		dir = ire_route_lookup(
6611 		    ((struct sockaddr_in *)target)->sin_addr.s_addr,
6612 		    0xffffffff,
6613 		    0, 0, NULL, &gw, ALL_ZONES,
6614 		    MATCH_IRE_DSTONLY|MATCH_IRE_DEFAULT|MATCH_IRE_RECURSIVE);
6615 		break;
6616 	case AF_INET6:
6617 		dir = ire_route_lookup_v6(
6618 		    &((struct sockaddr_in6 *)target)->sin6_addr,
6619 		    NULL,
6620 		    0, 0, NULL, &gw, ALL_ZONES,
6621 		    MATCH_IRE_DSTONLY|MATCH_IRE_DEFAULT|MATCH_IRE_RECURSIVE);
6622 		if ((dir != NULL) && (dir->ire_nce == NULL)) {
6623 			ire_refrele(dir);
6624 			dir = NULL;
6625 		}
6626 		break;
6627 	default:
6628 		dir = NULL;
6629 		break;
6630 	}
6631 
6632 
6633 	if (dir == NULL)
6634 		return (NULL);
6635 
6636 	/* Map the IRE to an ILL so we can fill in ifname. */
6637 	ill = ire_to_ill(dir);
6638 	if (ill == NULL) {
6639 		ire_refrele(dir);
6640 		return (NULL);
6641 	}
6642 	(void) strncpy(ifname, ill->ill_name, LIFNAMSIZ);
6643 
6644 	/* Return a copy of the header to the caller. */
6645 	switch (target->sa_family) {
6646 	case AF_INET :
6647 		if (dir->ire_fp_mp != NULL) {
6648 			if ((mp = dupb(dir->ire_fp_mp)) == NULL)
6649 				mp = copyb(dir->ire_fp_mp);
6650 		} else if (dir->ire_dlureq_mp != NULL) {
6651 			if ((mp = dupb(dir->ire_dlureq_mp)) == NULL)
6652 				mp = copyb(dir->ire_dlureq_mp);
6653 		} else {
6654 			mp = NULL;
6655 		}
6656 		break;
6657 	case AF_INET6 :
6658 		nce = dir->ire_nce;
6659 		if (nce->nce_fp_mp != NULL) {
6660 			if ((mp = dupb(nce->nce_fp_mp)) == NULL)
6661 				mp = copyb(nce->nce_fp_mp);
6662 		} else if (nce->nce_res_mp != NULL) {
6663 			if ((mp = dupb(nce->nce_res_mp)) == NULL)
6664 				mp = copyb(nce->nce_res_mp);
6665 		} else {
6666 			mp = NULL;
6667 		}
6668 		break;
6669 	}
6670 
6671 	ire_refrele(dir);
6672 	return (mp);
6673 }
6674 
6675 
6676 /*
6677  * Return a link layer header suitable for an IP packet being sent to the
6678  * dst_addr IP address on the specified output interface.  The dst_addr
6679  * may be the packet's ultimate destination or a predetermined next hop
6680  * router's address.
6681  * ifname must be nul-terminated.
6682  *
6683  * This function is used when the caller knows the outbound interface (usually
6684  * because it was specified by policy) and only needs the MAC header for a
6685  * packet.
6686  */
6687 mblk_t *
6688 ip_nexthop(const struct sockaddr *target, const char *ifname)
6689 {
6690 	struct nce_s *nce;
6691 	ill_walk_context_t ctx;
6692 	t_uscalar_t sap;
6693 	ire_t *dir, *gw;
6694 	ill_t *ill;
6695 	mblk_t *mp;
6696 
6697 	/* parameter sanity */
6698 	if (ifname == NULL || target == NULL)
6699 		return (NULL);
6700 
6701 	switch (target->sa_family) {
6702 	case AF_INET :
6703 		sap = IP_DL_SAP;
6704 		break;
6705 	case AF_INET6 :
6706 		sap = IP6_DL_SAP;
6707 		break;
6708 	default:
6709 		return (NULL);
6710 	}
6711 
6712 	/* Lock ill_g_lock before walking through the list */
6713 	rw_enter(&ill_g_lock, RW_READER);
6714 	/*
6715 	 * Can we find the interface name among those currently configured?
6716 	 */
6717 	for (ill = ILL_START_WALK_ALL(&ctx); ill != NULL;
6718 	    ill = ill_next(&ctx, ill)) {
6719 		if ((strcmp(ifname, ill->ill_name) == 0) &&
6720 		    (ill->ill_sap == sap))
6721 			break;
6722 	}
6723 	if (ill == NULL || ill->ill_ipif == NULL) {
6724 		rw_exit(&ill_g_lock);
6725 		return (NULL);
6726 	}
6727 
6728 	mutex_enter(&ill->ill_lock);
6729 	if (!ILL_CAN_LOOKUP(ill)) {
6730 		mutex_exit(&ill->ill_lock);
6731 		rw_exit(&ill_g_lock);
6732 		return (NULL);
6733 	}
6734 	ill_refhold_locked(ill);
6735 	mutex_exit(&ill->ill_lock);
6736 	rw_exit(&ill_g_lock);
6737 
6738 	gw = NULL;
6739 	/* Find the resolver entry, if it exists. */
6740 	switch (target->sa_family) {
6741 	case AF_INET:
6742 		dir = ire_route_lookup(
6743 			((struct sockaddr_in *)target)->sin_addr.s_addr,
6744 			0xffffffff,
6745 			0, 0, ill->ill_ipif, &gw, ALL_ZONES,
6746 			MATCH_IRE_DSTONLY|MATCH_IRE_DEFAULT|
6747 			MATCH_IRE_RECURSIVE|MATCH_IRE_IPIF);
6748 		break;
6749 	case AF_INET6:
6750 		dir = ire_route_lookup_v6(
6751 			&((struct sockaddr_in6 *)target)->sin6_addr, NULL,
6752 			0, 0, ill->ill_ipif, &gw, ALL_ZONES,
6753 			MATCH_IRE_DSTONLY|MATCH_IRE_DEFAULT|
6754 			MATCH_IRE_RECURSIVE|MATCH_IRE_IPIF);
6755 		if ((dir != NULL) && (dir->ire_nce == NULL)) {
6756 			ire_refrele(dir);
6757 			dir = NULL;
6758 		}
6759 		break;
6760 	default:
6761 		dir = NULL;
6762 		break;
6763 	}
6764 
6765 	ill_refrele(ill);
6766 
6767 	if (dir == NULL)
6768 		return (NULL);
6769 
6770 	/* Return a copy of the header to the caller. */
6771 	switch (target->sa_family) {
6772 	case AF_INET :
6773 		if (dir->ire_fp_mp != NULL) {
6774 			if ((mp = dupb(dir->ire_fp_mp)) == NULL)
6775 				mp = copyb(dir->ire_fp_mp);
6776 		} else if (dir->ire_dlureq_mp != NULL) {
6777 			if ((mp = dupb(dir->ire_dlureq_mp)) == NULL)
6778 				mp = copyb(dir->ire_dlureq_mp);
6779 		} else {
6780 			mp = NULL;
6781 		}
6782 		break;
6783 	case AF_INET6 :
6784 		nce = dir->ire_nce;
6785 		if (nce->nce_fp_mp != NULL) {
6786 			if ((mp = dupb(nce->nce_fp_mp)) == NULL)
6787 				mp = copyb(nce->nce_fp_mp);
6788 		} else if (nce->nce_res_mp != NULL) {
6789 			if ((mp = dupb(nce->nce_res_mp)) == NULL)
6790 				mp = copyb(nce->nce_res_mp);
6791 		} else {
6792 			mp = NULL;
6793 		}
6794 		break;
6795 	}
6796 
6797 	ire_refrele(dir);
6798 	return (mp);
6799 }
6800 
6801 /*
6802  * IRE iterator for inbound and loopback broadcast processing.
6803  * Given an IRE_BROADCAST ire, walk the ires with the same destination
6804  * address, but skip over the passed-in ire. Returns the next ire without
6805  * a hold - assumes that the caller holds a reference on the IRE bucket.
6806  */
6807 ire_t *
6808 ire_get_next_bcast_ire(ire_t *curr, ire_t *ire)
6809 {
6810 	ill_t *ill;
6811 
6812 	if (curr == NULL) {
6813 		for (curr = ire->ire_bucket->irb_ire; curr != NULL;
6814 		    curr = curr->ire_next) {
6815 			if (curr->ire_addr == ire->ire_addr)
6816 				break;
6817 		}
6818 	} else {
6819 		curr = curr->ire_next;
6820 	}
6821 	ill = ire_to_ill(ire);
6822 	for (; curr != NULL; curr = curr->ire_next) {
6823 		if (curr->ire_addr != ire->ire_addr) {
6824 			/*
6825 			 * All the IREs to a given destination are contiguous;
6826 			 * break out once the address doesn't match.
6827 			 */
6828 			break;
6829 		}
6830 		if (curr == ire) {
6831 			/* skip over the passed-in ire */
6832 			continue;
6833 		}
6834 		if ((curr->ire_stq != NULL && ire->ire_stq == NULL) ||
6835 		    (curr->ire_stq == NULL && ire->ire_stq != NULL)) {
6836 			/*
6837 			 * If the passed-in ire is loopback, skip over
6838 			 * non-loopback ires and vice versa.
6839 			 */
6840 			continue;
6841 		}
6842 		if (ire_to_ill(curr) != ill) {
6843 			/* skip over IREs going through a different interface */
6844 			continue;
6845 		}
6846 		if (curr->ire_marks & IRE_MARK_CONDEMNED) {
6847 			/* skip over deleted IREs */
6848 			continue;
6849 		}
6850 		return (curr);
6851 	}
6852 	return (NULL);
6853 }
6854 
6855 /*
6856  * IRE iterator used by ire_ftable_lookup[_v6]() to process multiple default
6857  * routes. Given a starting point in the hash list (ire_origin), walk the IREs
6858  * in the bucket skipping default interface routes and deleted entries.
6859  * Returns the next IRE (unheld), or NULL when we're back to the starting point.
6860  * Assumes that the caller holds a reference on the IRE bucket.
6861  */
6862 ire_t *
6863 ire_get_next_default_ire(ire_t *ire, ire_t *ire_origin)
6864 {
6865 	ASSERT(ire_origin->ire_bucket != NULL);
6866 	ASSERT(ire != NULL);
6867 
6868 	do {
6869 		ire = ire->ire_next;
6870 		if (ire == NULL)
6871 			ire = ire_origin->ire_bucket->irb_ire;
6872 		if (ire == ire_origin)
6873 			return (NULL);
6874 	} while ((ire->ire_type & IRE_INTERFACE) ||
6875 	    (ire->ire_marks & IRE_MARK_CONDEMNED));
6876 	ASSERT(ire != NULL);
6877 	return (ire);
6878 }
6879 
6880 #ifdef IRE_DEBUG
6881 th_trace_t *
6882 th_trace_ire_lookup(ire_t *ire)
6883 {
6884 	int bucket_id;
6885 	th_trace_t *th_trace;
6886 
6887 	ASSERT(MUTEX_HELD(&ire->ire_lock));
6888 
6889 	bucket_id = IP_TR_HASH(curthread);
6890 	ASSERT(bucket_id < IP_TR_HASH_MAX);
6891 
6892 	for (th_trace = ire->ire_trace[bucket_id]; th_trace != NULL;
6893 	    th_trace = th_trace->th_next) {
6894 		if (th_trace->th_id == curthread)
6895 			return (th_trace);
6896 	}
6897 	return (NULL);
6898 }
6899 
6900 void
6901 ire_trace_ref(ire_t *ire)
6902 {
6903 	int bucket_id;
6904 	th_trace_t *th_trace;
6905 
6906 	/*
6907 	 * Attempt to locate the trace buffer for the curthread.
6908 	 * If it does not exist, then allocate a new trace buffer
6909 	 * and link it in list of trace bufs for this ipif, at the head
6910 	 */
6911 	mutex_enter(&ire->ire_lock);
6912 	if (ire->ire_trace_disable == B_TRUE) {
6913 		mutex_exit(&ire->ire_lock);
6914 		return;
6915 	}
6916 	th_trace = th_trace_ire_lookup(ire);
6917 	if (th_trace == NULL) {
6918 		bucket_id = IP_TR_HASH(curthread);
6919 		th_trace = (th_trace_t *)kmem_zalloc(sizeof (th_trace_t),
6920 		    KM_NOSLEEP);
6921 		if (th_trace == NULL) {
6922 			ire->ire_trace_disable = B_TRUE;
6923 			mutex_exit(&ire->ire_lock);
6924 			ire_trace_inactive(ire);
6925 			return;
6926 		}
6927 
6928 		th_trace->th_id = curthread;
6929 		th_trace->th_next = ire->ire_trace[bucket_id];
6930 		th_trace->th_prev = &ire->ire_trace[bucket_id];
6931 		if (th_trace->th_next != NULL)
6932 			th_trace->th_next->th_prev = &th_trace->th_next;
6933 		ire->ire_trace[bucket_id] = th_trace;
6934 	}
6935 	ASSERT(th_trace->th_refcnt < TR_BUF_MAX - 1);
6936 	th_trace->th_refcnt++;
6937 	th_trace_rrecord(th_trace);
6938 	mutex_exit(&ire->ire_lock);
6939 }
6940 
6941 void
6942 ire_trace_free(th_trace_t *th_trace)
6943 {
6944 	/* unlink th_trace and free it */
6945 	*th_trace->th_prev = th_trace->th_next;
6946 	if (th_trace->th_next != NULL)
6947 		th_trace->th_next->th_prev = th_trace->th_prev;
6948 	th_trace->th_next = NULL;
6949 	th_trace->th_prev = NULL;
6950 	kmem_free(th_trace, sizeof (th_trace_t));
6951 }
6952 
6953 void
6954 ire_untrace_ref(ire_t *ire)
6955 {
6956 	th_trace_t *th_trace;
6957 
6958 	mutex_enter(&ire->ire_lock);
6959 
6960 	if (ire->ire_trace_disable == B_TRUE) {
6961 		mutex_exit(&ire->ire_lock);
6962 		return;
6963 	}
6964 
6965 	th_trace = th_trace_ire_lookup(ire);
6966 	ASSERT(th_trace != NULL && th_trace->th_refcnt > 0);
6967 	th_trace_rrecord(th_trace);
6968 	th_trace->th_refcnt--;
6969 
6970 	if (th_trace->th_refcnt == 0)
6971 		ire_trace_free(th_trace);
6972 
6973 	mutex_exit(&ire->ire_lock);
6974 }
6975 
6976 static void
6977 ire_trace_inactive(ire_t *ire)
6978 {
6979 	th_trace_t *th_trace;
6980 	int i;
6981 
6982 	mutex_enter(&ire->ire_lock);
6983 	for (i = 0; i < IP_TR_HASH_MAX; i++) {
6984 		while (ire->ire_trace[i] != NULL) {
6985 			th_trace = ire->ire_trace[i];
6986 
6987 			/* unlink th_trace and free it */
6988 			ire->ire_trace[i] = th_trace->th_next;
6989 			if (th_trace->th_next != NULL)
6990 				th_trace->th_next->th_prev =
6991 				    &ire->ire_trace[i];
6992 
6993 			th_trace->th_next = NULL;
6994 			th_trace->th_prev = NULL;
6995 			kmem_free(th_trace, sizeof (th_trace_t));
6996 		}
6997 	}
6998 
6999 	mutex_exit(&ire->ire_lock);
7000 }
7001 
7002 /* ARGSUSED */
7003 void
7004 ire_thread_exit(ire_t *ire, caddr_t arg)
7005 {
7006 	th_trace_t	*th_trace;
7007 
7008 	mutex_enter(&ire->ire_lock);
7009 	th_trace = th_trace_ire_lookup(ire);
7010 	if (th_trace == NULL) {
7011 		mutex_exit(&ire->ire_lock);
7012 		return;
7013 	}
7014 	ASSERT(th_trace->th_refcnt == 0);
7015 
7016 	ire_trace_free(th_trace);
7017 	mutex_exit(&ire->ire_lock);
7018 }
7019 
7020 #endif
7021